@objectstack/core 16.1.0 → 17.0.0-rc.0

package/dist/index.d.cts

@@ -1751,6 +1751,14 @@ interface ResolvedAuthzContext {
     tabPermissions?: Record<string, 'visible' | 'hidden' | 'default_on' | 'default_off'>;
     /** Fellow-org user IDs for RLS scoping of identity tables (`id IN (...)`). */
     org_user_ids: string[];
+    /**
+     * [ADR-0105 D2] Every organization this principal currently holds a VALID
+     * membership in — the caller's org access set, and the read reach of the
+     * `group` tenancy posture (Layer 0 becomes `organization_id IN (...)`).
+     * Resolved here, once, so no surface re-derives it; empty for an anonymous or
+     * membership-less principal, which fails the group wall closed.
+     */
+    accessible_org_ids: string[];
     /**
      * [ADR-0095 D2/D3] The monotonic posture rung this principal resolves to,
      * DERIVED once here from held capability grants (never a better-auth role):
@@ -1788,6 +1796,8 @@ interface UserAuthzGrants {
     systemPermissions: string[];
     /** Fellow-org user IDs for RLS scoping of identity tables (`id IN (...)`). */
     org_user_ids: string[];
+    /** [ADR-0105 D2] Organizations this user holds a currently-valid membership in. */
+    accessible_org_ids: string[];
     tabPermissions?: Record<string, 'visible' | 'hidden' | 'default_on' | 'default_off'>;
     posture?: AuthzPosture;
     /** The user's unique email (`sys_user`), for `current_user.email` owner RLS. */
@@ -2123,12 +2133,16 @@ type BucketGranularity = 'day' | 'week' | 'month' | 'quarter' | 'year';
  * `datetime` field in a reference timezone layers that on top (and, per
  * ADR-0053, a `date` field compares against these `YYYY-MM-DD` bounds directly).
  *
- * Returns `null` for the null/empty bucket, an unparseable key, or a key that
- * is shape-valid but out of range (e.g. `2026-13`, a `-W53` in a 52-week year,
+ * Returns `null` for the empty bucket, an unparseable key, or a key that is
+ * shape-valid but out of range (e.g. `2026-13`, a `-W53` in a 52-week year,
  * `2026-02-30`). Callers drop the range and fall back to an unscoped (superset)
  * drill rather than emit a wrong bound.
+ *
+ * `key` admits `null` because that IS the empty bucket's key on both aggregation
+ * paths (#3839); callers pass a grouped row's dimension value straight through
+ * rather than casting a lie.
  */
-declare function bucketKeyToCalendarRange(key: string, granularity: BucketGranularity): {
+declare function bucketKeyToCalendarRange(key: string | null | undefined, granularity: BucketGranularity): {
     start: string;
     end: string;
 } | null;
@@ -2251,6 +2265,92 @@ declare function withTransientRetry<T>(fn: (attempt: number) => Promise<T>, opts
  */
 declare function bulkWrite<TRow, TRecord = any>(rows: TRow[], opts: BulkWriteOptions<TRow, TRecord>): Promise<BulkWriteRowResult<TRecord>[]>;
 
+/**
+ * The slice of an execution context the resolver reads. Structural on purpose —
+ * see {@link filterTokenContextFrom}.
+ */
+interface ExecutionContextLike {
+    readonly userId?: string;
+    readonly tenantId?: string;
+    readonly timezone?: string;
+}
+/**
+ * The request-scoped values a placeholder can resolve against.
+ *
+ * `now` is captured ONCE per resolve call so every token in one filter shares
+ * an instant — otherwise a `$gte {current_month_start}` / `$lt
+ * {next_month_start}` pair evaluated microseconds apart could straddle a
+ * month boundary and silently drop a row.
+ */
+interface FilterTokenResolutionContext {
+    /** Reference instant. Defaults to `new Date()` at call time. */
+    now?: Date;
+    /** IANA reference timezone for calendar boundaries. Defaults to UTC. */
+    timezone?: string;
+    /** Resolves `{current_user_id}`. */
+    userId?: string;
+    /** Resolves `{current_org_id}`. */
+    orgId?: string;
+}
+/**
+ * Raised when a filter carries a placeholder outside the vocabulary.
+ *
+ * Carries `status`/`code` so the REST layer's generic 4xx passthrough maps it
+ * to a **400 with a fixable message** rather than a 500: the caller's filter is
+ * malformed, the server is fine. (Same convention plugin-sharing uses for its
+ * record-scope denial — no runtime dependency in either direction.)
+ */
+declare class UnknownFilterTokenError extends Error {
+    readonly token: string;
+    readonly suggestion?: string;
+    readonly status = 400;
+    readonly code = "FILTER_TOKEN_UNKNOWN";
+    constructor(token: string, suggestion?: string);
+}
+/**
+ * Raised when a token IS in the vocabulary but the request carries no value
+ * for it — an unauthenticated caller filtering on `{current_user_id}`.
+ *
+ * Distinct from {@link UnknownFilterTokenError} because the fix is different:
+ * the metadata is correct, the context is not. Never silently resolves to
+ * `null`/`undefined`, which on most drivers degrades to `IS NULL` and would
+ * quietly hand back rows the filter was written to exclude.
+ */
+declare class UnresolvedFilterTokenError extends Error {
+    readonly token: string;
+    /** 400, not 500 — see {@link UnknownFilterTokenError}. */
+    readonly status = 400;
+    readonly code = "FILTER_TOKEN_UNRESOLVED";
+    constructor(token: string, detail: string);
+}
+/**
+ * Resolve one token NAME (the bit inside the braces) to its concrete value.
+ * Throws {@link UnresolvedFilterTokenError} for a vocabulary token the request
+ * carries no value for. Returns `undefined` only when the token is outside the
+ * vocabulary — callers turn that into {@link UnknownFilterTokenError}.
+ */
+declare function resolveFilterToken(token: string, ctx?: FilterTokenResolutionContext): unknown;
+/**
+ * Deep-replace every fully-wrapped placeholder in `filter` with its resolved
+ * value, returning a NEW tree (the caller's metadata is never mutated — a view
+ * or dataset definition is shared across requests, so resolving in place would
+ * bake one request's user id, and one day's dates, into every later render).
+ *
+ * Returns the input unchanged, by reference, when it holds no placeholders.
+ */
+declare function resolveFilterTokens<T>(filter: T, ctx?: FilterTokenResolutionContext): T;
+/**
+ * Convenience bridge from an execution context to the resolver's inputs.
+ * `{current_org_id}` reads `tenantId` — the active organization IS the tenant
+ * on the read path (same value the RLS compiler binds to
+ * `current_user.organization_id`).
+ *
+ * Typed structurally, not as `ExecutionContext`, so both the parsed context
+ * (defaults applied) and the pre-parse `ExecutionContextInput` a caller holds
+ * mid-pipeline satisfy it. The three fields read here are optional in both.
+ */
+declare function filterTokenContextFrom(execCtx: ExecutionContextLike | undefined, now?: Date): FilterTokenResolutionContext;
+
 /**
  * In-memory Map-backed cache fallback.
  *
@@ -2687,4 +2787,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type UserAuthzGrants, type VersionCompatibility, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, resolveUserAuthzGrants, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };
+export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VersionCompatibility, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, filterTokenContextFrom, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolveUserAuthzGrants, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };

package/dist/index.d.ts

@@ -1751,6 +1751,14 @@ interface ResolvedAuthzContext {
     tabPermissions?: Record<string, 'visible' | 'hidden' | 'default_on' | 'default_off'>;
     /** Fellow-org user IDs for RLS scoping of identity tables (`id IN (...)`). */
     org_user_ids: string[];
+    /**
+     * [ADR-0105 D2] Every organization this principal currently holds a VALID
+     * membership in — the caller's org access set, and the read reach of the
+     * `group` tenancy posture (Layer 0 becomes `organization_id IN (...)`).
+     * Resolved here, once, so no surface re-derives it; empty for an anonymous or
+     * membership-less principal, which fails the group wall closed.
+     */
+    accessible_org_ids: string[];
     /**
      * [ADR-0095 D2/D3] The monotonic posture rung this principal resolves to,
      * DERIVED once here from held capability grants (never a better-auth role):
@@ -1788,6 +1796,8 @@ interface UserAuthzGrants {
     systemPermissions: string[];
     /** Fellow-org user IDs for RLS scoping of identity tables (`id IN (...)`). */
     org_user_ids: string[];
+    /** [ADR-0105 D2] Organizations this user holds a currently-valid membership in. */
+    accessible_org_ids: string[];
     tabPermissions?: Record<string, 'visible' | 'hidden' | 'default_on' | 'default_off'>;
     posture?: AuthzPosture;
     /** The user's unique email (`sys_user`), for `current_user.email` owner RLS. */
@@ -2123,12 +2133,16 @@ type BucketGranularity = 'day' | 'week' | 'month' | 'quarter' | 'year';
  * `datetime` field in a reference timezone layers that on top (and, per
  * ADR-0053, a `date` field compares against these `YYYY-MM-DD` bounds directly).
  *
- * Returns `null` for the null/empty bucket, an unparseable key, or a key that
- * is shape-valid but out of range (e.g. `2026-13`, a `-W53` in a 52-week year,
+ * Returns `null` for the empty bucket, an unparseable key, or a key that is
+ * shape-valid but out of range (e.g. `2026-13`, a `-W53` in a 52-week year,
  * `2026-02-30`). Callers drop the range and fall back to an unscoped (superset)
  * drill rather than emit a wrong bound.
+ *
+ * `key` admits `null` because that IS the empty bucket's key on both aggregation
+ * paths (#3839); callers pass a grouped row's dimension value straight through
+ * rather than casting a lie.
  */
-declare function bucketKeyToCalendarRange(key: string, granularity: BucketGranularity): {
+declare function bucketKeyToCalendarRange(key: string | null | undefined, granularity: BucketGranularity): {
     start: string;
     end: string;
 } | null;
@@ -2251,6 +2265,92 @@ declare function withTransientRetry<T>(fn: (attempt: number) => Promise<T>, opts
  */
 declare function bulkWrite<TRow, TRecord = any>(rows: TRow[], opts: BulkWriteOptions<TRow, TRecord>): Promise<BulkWriteRowResult<TRecord>[]>;
 
+/**
+ * The slice of an execution context the resolver reads. Structural on purpose —
+ * see {@link filterTokenContextFrom}.
+ */
+interface ExecutionContextLike {
+    readonly userId?: string;
+    readonly tenantId?: string;
+    readonly timezone?: string;
+}
+/**
+ * The request-scoped values a placeholder can resolve against.
+ *
+ * `now` is captured ONCE per resolve call so every token in one filter shares
+ * an instant — otherwise a `$gte {current_month_start}` / `$lt
+ * {next_month_start}` pair evaluated microseconds apart could straddle a
+ * month boundary and silently drop a row.
+ */
+interface FilterTokenResolutionContext {
+    /** Reference instant. Defaults to `new Date()` at call time. */
+    now?: Date;
+    /** IANA reference timezone for calendar boundaries. Defaults to UTC. */
+    timezone?: string;
+    /** Resolves `{current_user_id}`. */
+    userId?: string;
+    /** Resolves `{current_org_id}`. */
+    orgId?: string;
+}
+/**
+ * Raised when a filter carries a placeholder outside the vocabulary.
+ *
+ * Carries `status`/`code` so the REST layer's generic 4xx passthrough maps it
+ * to a **400 with a fixable message** rather than a 500: the caller's filter is
+ * malformed, the server is fine. (Same convention plugin-sharing uses for its
+ * record-scope denial — no runtime dependency in either direction.)
+ */
+declare class UnknownFilterTokenError extends Error {
+    readonly token: string;
+    readonly suggestion?: string;
+    readonly status = 400;
+    readonly code = "FILTER_TOKEN_UNKNOWN";
+    constructor(token: string, suggestion?: string);
+}
+/**
+ * Raised when a token IS in the vocabulary but the request carries no value
+ * for it — an unauthenticated caller filtering on `{current_user_id}`.
+ *
+ * Distinct from {@link UnknownFilterTokenError} because the fix is different:
+ * the metadata is correct, the context is not. Never silently resolves to
+ * `null`/`undefined`, which on most drivers degrades to `IS NULL` and would
+ * quietly hand back rows the filter was written to exclude.
+ */
+declare class UnresolvedFilterTokenError extends Error {
+    readonly token: string;
+    /** 400, not 500 — see {@link UnknownFilterTokenError}. */
+    readonly status = 400;
+    readonly code = "FILTER_TOKEN_UNRESOLVED";
+    constructor(token: string, detail: string);
+}
+/**
+ * Resolve one token NAME (the bit inside the braces) to its concrete value.
+ * Throws {@link UnresolvedFilterTokenError} for a vocabulary token the request
+ * carries no value for. Returns `undefined` only when the token is outside the
+ * vocabulary — callers turn that into {@link UnknownFilterTokenError}.
+ */
+declare function resolveFilterToken(token: string, ctx?: FilterTokenResolutionContext): unknown;
+/**
+ * Deep-replace every fully-wrapped placeholder in `filter` with its resolved
+ * value, returning a NEW tree (the caller's metadata is never mutated — a view
+ * or dataset definition is shared across requests, so resolving in place would
+ * bake one request's user id, and one day's dates, into every later render).
+ *
+ * Returns the input unchanged, by reference, when it holds no placeholders.
+ */
+declare function resolveFilterTokens<T>(filter: T, ctx?: FilterTokenResolutionContext): T;
+/**
+ * Convenience bridge from an execution context to the resolver's inputs.
+ * `{current_org_id}` reads `tenantId` — the active organization IS the tenant
+ * on the read path (same value the RLS compiler binds to
+ * `current_user.organization_id`).
+ *
+ * Typed structurally, not as `ExecutionContext`, so both the parsed context
+ * (defaults applied) and the pre-parse `ExecutionContextInput` a caller holds
+ * mid-pipeline satisfy it. The three fields read here are optional in both.
+ */
+declare function filterTokenContextFrom(execCtx: ExecutionContextLike | undefined, now?: Date): FilterTokenResolutionContext;
+
 /**
  * In-memory Map-backed cache fallback.
  *
@@ -2687,4 +2787,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type UserAuthzGrants, type VersionCompatibility, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, resolveUserAuthzGrants, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };
+export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VersionCompatibility, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, filterTokenContextFrom, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolveUserAuthzGrants, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };

package/dist/index.js

@@ -1252,6 +1252,7 @@ function createMemoryMetadata() {
 }
 
 // src/fallbacks/authored-translation-sync.ts
+import { LEGACY_OBJECT_FIRST_KEYS } from "@objectstack/spec/system";
 var OWNER_PROP = "__authoredTranslationSyncOwner";
 var LOCALE_LIKE = /^[a-z]{2,3}([_-]([A-Za-z]{4}|[A-Za-z]{2}|[0-9]{3}))?$/;
 async function readAuthoredTranslationLayer(engine, logger) {
@@ -1281,14 +1282,32 @@ async function readAuthoredTranslationLayer(engine, logger) {
       continue;
     }
     if (!data || typeof data !== "object") continue;
-    const locale = typeof data?._meta?.locale === "string" && data._meta.locale || typeof data?.locale === "string" && data.locale || (typeof row?.name === "string" && LOCALE_LIKE.test(row.name) ? row.name : void 0) || void 0;
+    const legacyKeys = LEGACY_OBJECT_FIRST_KEYS.filter((key) => data[key] !== void 0);
+    if (legacyKeys.length > 0) {
+      logger?.warn?.(
+        `[i18n] authored translation '${row?.name}' uses the retired object-first shape (${legacyKeys.join(", ")}) \u2014 nothing resolves from it; re-author it under 'objects.<object_name>' with a top-level 'locale' \u2014 skipped`
+      );
+      continue;
+    }
+    const locale = typeof data?.locale === "string" && data.locale || (typeof row?.name === "string" && LOCALE_LIKE.test(row.name) ? row.name : void 0) || void 0;
     if (!locale) {
       logger?.warn?.(
-        `[i18n] authored translation '${row?.name}' has no resolvable locale (set _meta.locale, or name the item after its BCP-47 locale) \u2014 skipped`
+        `[i18n] authored translation '${row?.name}' has no resolvable locale (set the top-level 'locale', or name the item after its BCP-47 locale) \u2014 skipped`
       );
       continue;
     }
-    const { name: _n, locale: _l, _packageId: _p, _provenance: _pr, _lock: _lk, ...payload } = data;
+    const {
+      name: _n,
+      locale: _l,
+      _packageId: _p,
+      _packageVersion: _pv,
+      _provenance: _pr,
+      _lock: _lk,
+      _lockReason: _lr,
+      _lockDocsUrl: _ld,
+      _lockSource: _ls,
+      ...payload
+    } = data;
     byLocale[locale] = deepMerge(byLocale[locale] ?? {}, payload);
   }
   return byLocale;
@@ -4212,7 +4231,7 @@ import {
   mapMembershipRole,
   BUILTIN_IDENTITY_PLATFORM_ADMIN,
   ADMIN_FULL_ACCESS,
-  ORGANIZATION_ADMIN
+  ORGANIZATION_ADMIN_GRANTS
 } from "@objectstack/spec";
 
 // src/security/grant-validity.ts
@@ -4320,7 +4339,8 @@ async function resolveAuthzContext(input) {
     positions: [],
     permissions: [],
     systemPermissions: [],
-    org_user_ids: []
+    org_user_ids: [],
+    accessible_org_ids: []
   };
   let userId;
   let tenantId;
@@ -4356,6 +4376,7 @@ async function resolveAuthzContext(input) {
   ctx.permissions = grants.permissions;
   ctx.systemPermissions = grants.systemPermissions;
   ctx.org_user_ids = grants.org_user_ids;
+  ctx.accessible_org_ids = grants.accessible_org_ids;
   if (grants.tabPermissions) ctx.tabPermissions = grants.tabPermissions;
   if (grants.posture) ctx.posture = grants.posture;
   if (grants.email && !ctx.email) ctx.email = grants.email;
@@ -4367,7 +4388,8 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     positions: [],
     permissions: Array.isArray(opts.seedPermissions) ? [...opts.seedPermissions] : [],
     systemPermissions: [],
-    org_user_ids: [userId]
+    org_user_ids: [userId],
+    accessible_org_ids: []
   };
   if (opts.seedEmail) grants.email = opts.seedEmail;
   if (!ql || typeof ql.find !== "function") return grants;
@@ -4385,9 +4407,17 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     const u = await getUserRow();
     if (u?.email) grants.email = String(u.email);
   }
-  const memberWhere = tenantId ? { user_id: userId, organization_id: tenantId } : { user_id: userId };
-  const members = await tryFind(ql, "sys_member", memberWhere, 50);
+  const nowMs = opts.nowMs ?? Date.now();
+  const members = await tryFind(ql, "sys_member", { user_id: userId }, 200);
+  const accessibleOrgIds = /* @__PURE__ */ new Set();
   for (const m of members) {
+    if (!isGrantActive(m, nowMs)) continue;
+    const org = m.organization_id ?? m.organizationId;
+    if (typeof org === "string" && org) accessibleOrgIds.add(org);
+  }
+  grants.accessible_org_ids = Array.from(accessibleOrgIds);
+  const activeMembers = tenantId ? members.filter((m) => (m.organization_id ?? m.organizationId) === tenantId) : members;
+  for (const m of activeMembers) {
     if (m.role && typeof m.role === "string") {
       for (const raw of m.role.split(",").map((s) => s.trim()).filter(Boolean)) {
         const r = mapMembershipRole(raw);
@@ -4395,7 +4425,6 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
       }
     }
   }
-  const nowMs = opts.nowMs ?? Date.now();
   const userPositionRows = await tryFind(ql, "sys_user_position", { user_id: userId }, 200);
   for (const ur of userPositionRows) {
     const org = ur.organization_id ?? null;
@@ -4467,7 +4496,9 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
   }
   grants.posture = derivePosture({
     isPlatformAdmin: hasPlatformAdminGrant,
-    isTenantAdmin: grants.permissions.includes(ORGANIZATION_ADMIN)
+    // [ADR-0105 D4] Either org-admin capability set resolves the rung — the
+    // wall-less variant differs only by withholding the superuser bits.
+    isTenantAdmin: ORGANIZATION_ADMIN_GRANTS.some((n) => grants.permissions.includes(n))
   });
   if (!grants.permissions.includes("ai_seat")) {
     const aiAccess = (await getUserRow())?.ai_access;
@@ -4598,8 +4629,8 @@ function calendarPartsInTzOrUtc(d, tz) {
     day: d.getUTCDate()
   };
 }
-function zonedDateStartToUtcMs(ymd, tz) {
-  const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(ymd);
+function zonedDateStartToUtcMs(ymd2, tz) {
+  const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(ymd2);
   const wallAsUtc = m ? Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3])) : NaN;
   if (!tz || tz === "UTC" || Number.isNaN(wallAsUtc)) return wallAsUtc;
   try {
@@ -4815,6 +4846,212 @@ async function bulkWrite(rows, opts) {
   return results;
 }
 
+// src/utils/filter-tokens.ts
+import {
+  classifyFilterToken,
+  parseDateMacroParam
+} from "@objectstack/spec/data";
+var UnknownFilterTokenError = class extends Error {
+  constructor(token, suggestion) {
+    super(
+      `Unresolvable filter placeholder "{${token}}". ` + (suggestion ? `Did you mean "{${suggestion}}"? ` : "Resolvable placeholders are the context tokens ({current_user_id}, {current_org_id}) and the date macros ({today}, {current_quarter_start}, {30_days_ago}, \u2026). ") + "Sending it to the data engine verbatim would compare it as a literal string and match nothing, which is indistinguishable from an empty result."
+    );
+    this.status = 400;
+    this.code = "FILTER_TOKEN_UNKNOWN";
+    this.name = "UnknownFilterTokenError";
+    this.token = token;
+    this.suggestion = suggestion;
+  }
+};
+var UnresolvedFilterTokenError = class extends Error {
+  constructor(token, detail) {
+    super(`Filter placeholder "{${token}}" cannot be resolved: ${detail}`);
+    /** 400, not 500 — see {@link UnknownFilterTokenError}. */
+    this.status = 400;
+    this.code = "FILTER_TOKEN_UNRESOLVED";
+    this.name = "UnresolvedFilterTokenError";
+    this.token = token;
+  }
+};
+function ymd(year, month, day) {
+  const p = (n) => String(n).padStart(2, "0");
+  return `${year}-${p(month)}-${p(day)}`;
+}
+function proxyDay(now, timezone) {
+  const { year, month, day } = calendarPartsInTzOrUtc(now, timezone);
+  return new Date(Date.UTC(year, month - 1, day));
+}
+var asYmd = (d) => ymd(d.getUTCFullYear(), d.getUTCMonth() + 1, d.getUTCDate());
+function startOfPeriod(kind, d) {
+  const r = new Date(d.getTime());
+  switch (kind) {
+    case "week": {
+      const dow = (r.getUTCDay() + 6) % 7;
+      r.setUTCDate(r.getUTCDate() - dow);
+      return r;
+    }
+    case "month":
+      return new Date(Date.UTC(r.getUTCFullYear(), r.getUTCMonth(), 1));
+    case "quarter":
+      return new Date(Date.UTC(r.getUTCFullYear(), Math.floor(r.getUTCMonth() / 3) * 3, 1));
+    case "year":
+      return new Date(Date.UTC(r.getUTCFullYear(), 0, 1));
+  }
+}
+function daysInMonth(year, month) {
+  return new Date(Date.UTC(year, month + 1, 0)).getUTCDate();
+}
+function addMonthsClamped(d, n) {
+  const year = d.getUTCFullYear();
+  const month = d.getUTCMonth() + n;
+  const targetYear = year + Math.floor(month / 12);
+  const targetMonth = (month % 12 + 12) % 12;
+  const day = Math.min(d.getUTCDate(), daysInMonth(targetYear, targetMonth));
+  return new Date(Date.UTC(
+    targetYear,
+    targetMonth,
+    day,
+    d.getUTCHours(),
+    d.getUTCMinutes(),
+    d.getUTCSeconds(),
+    d.getUTCMilliseconds()
+  ));
+}
+function addPeriods(kind, d, n) {
+  switch (kind) {
+    case "week": {
+      const r = new Date(d.getTime());
+      r.setUTCDate(r.getUTCDate() + n * 7);
+      return r;
+    }
+    case "month":
+      return addMonthsClamped(d, n);
+    case "quarter":
+      return addMonthsClamped(d, n * 3);
+    case "year":
+      return addMonthsClamped(d, n * 12);
+  }
+}
+function addUnits(unit, d, n) {
+  const r = new Date(d.getTime());
+  switch (unit) {
+    case "minute":
+      r.setUTCMinutes(r.getUTCMinutes() + n);
+      return r;
+    case "hour":
+      r.setUTCHours(r.getUTCHours() + n);
+      return r;
+    case "day":
+      r.setUTCDate(r.getUTCDate() + n);
+      return r;
+    case "week":
+      r.setUTCDate(r.getUTCDate() + n * 7);
+      return r;
+    // Month/year steps clamp rather than overflow — see addMonthsClamped.
+    case "month":
+      return addMonthsClamped(d, n);
+    case "year":
+      return addMonthsClamped(d, n * 12);
+  }
+}
+var PERIOD_RE = /^(?:(current|last|next)_)?(week|month|quarter|year)_(start|end)$/;
+function resolvePeriodToken(token, today) {
+  const m = PERIOD_RE.exec(token);
+  if (!m) return void 0;
+  const rel = m[1] ?? "current";
+  const kind = m[2];
+  const bound = m[3];
+  const offset = rel === "last" ? -1 : rel === "next" ? 1 : 0;
+  const periodStart = startOfPeriod(kind, addPeriods(kind, startOfPeriod(kind, today), offset));
+  if (bound === "start") return asYmd(periodStart);
+  const next = addPeriods(kind, periodStart, 1);
+  next.setUTCDate(next.getUTCDate() - 1);
+  return asYmd(next);
+}
+function resolveFilterToken(token, ctx = {}) {
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  if (token === "current_user_id") {
+    if (!ctx.userId) {
+      throw new UnresolvedFilterTokenError(
+        token,
+        "the request has no authenticated user. A filter scoped to the signed-in user cannot run for an anonymous or system caller \u2014 gate the surface on authentication, or drop the token from the filter."
+      );
+    }
+    return ctx.userId;
+  }
+  if (token === "current_org_id") {
+    if (!ctx.orgId) {
+      throw new UnresolvedFilterTokenError(
+        token,
+        "the request carries no active organization (ExecutionContext.tenantId is unset). Set the active org on the request, or drop the token from the filter."
+      );
+    }
+    return ctx.orgId;
+  }
+  const today = proxyDay(now, ctx.timezone);
+  switch (token) {
+    case "now":
+      return now.toISOString();
+    case "today":
+      return asYmd(today);
+    case "yesterday":
+      return asYmd(addUnits("day", today, -1));
+    case "tomorrow":
+      return asYmd(addUnits("day", today, 1));
+  }
+  const period = resolvePeriodToken(token, today);
+  if (period !== void 0) return period;
+  const param = parseDateMacroParam(token);
+  if (param) {
+    const sign = param.direction === "ago" ? -1 : 1;
+    if (param.unit === "minute" || param.unit === "hour") {
+      return addUnits(param.unit, now, sign * param.n).toISOString();
+    }
+    return asYmd(addUnits(param.unit, today, sign * param.n));
+  }
+  return void 0;
+}
+function hasFilterToken(node) {
+  if (typeof node === "string") return classifyFilterToken(node) !== null;
+  if (Array.isArray(node)) return node.some(hasFilterToken);
+  if (node && typeof node === "object" && !(node instanceof Date)) {
+    return Object.values(node).some(hasFilterToken);
+  }
+  return false;
+}
+function resolveFilterTokens(filter, ctx = {}) {
+  if (filter == null) return filter;
+  if (!hasFilterToken(filter)) return filter;
+  const pinned = { ...ctx, now: ctx.now ?? /* @__PURE__ */ new Date() };
+  const walk = (node) => {
+    if (typeof node === "string") {
+      const cls = classifyFilterToken(node);
+      if (!cls) return node;
+      if (cls.kind === "unknown") throw new UnknownFilterTokenError(cls.token, cls.suggestion);
+      const resolved = resolveFilterToken(cls.token, pinned);
+      if (resolved === void 0) throw new UnknownFilterTokenError(cls.token);
+      return resolved;
+    }
+    if (Array.isArray(node)) return node.map(walk);
+    if (node && typeof node === "object") {
+      if (node instanceof Date) return node;
+      const out = {};
+      for (const [k, v] of Object.entries(node)) out[k] = walk(v);
+      return out;
+    }
+    return node;
+  };
+  return walk(filter);
+}
+function filterTokenContextFrom(execCtx, now) {
+  return {
+    now,
+    timezone: execCtx?.timezone,
+    userId: execCtx?.userId,
+    orgId: execCtx?.tenantId
+  };
+}
+
 // src/health-monitor.ts
 var PluginHealthMonitor = class {
   constructor(logger) {
@@ -5759,6 +5996,8 @@ export {
   SecurePluginContext,
   SemanticVersionManager,
   ServiceLifecycle,
+  UnknownFilterTokenError,
+  UnresolvedFilterTokenError,
   bucketKeyToCalendarRange,
   buildPermissionsFromGrants,
   bulkWrite,
@@ -5779,6 +6018,7 @@ export {
   derivePosture,
   evaluateAuthGate,
   extractApiKey,
+  filterTokenContextFrom,
   generateApiKey,
   generateEd25519KeyPair,
   getEnv,
@@ -5795,6 +6035,8 @@ export {
   readAuthoredTranslationLayer,
   resolveApiKeyPrincipal,
   resolveAuthzContext,
+  resolveFilterToken,
+  resolveFilterTokens,
   resolveLocale,
   resolveLocalizationContext,
   resolveUserAuthzGrants,