@objectstack/core 16.1.0 → 17.0.0-rc.1

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { Logger, IServiceRegistry } from '@objectstack/spec/contracts';
-export { IDataDriver, IDataEngine, IHttpRequest, IHttpResponse, IHttpServer, Logger, Middleware, RouteHandler } from '@objectstack/spec/contracts';
+import { Logger, LifecycleEventName, IServiceRegistry } from '@objectstack/spec/contracts';
+export { EngineSchemaRegistryView, IDataDriver, IDataEngine, IHttpRequest, IHttpResponse, IHttpServer, IObjectQLEngine, Logger, Middleware, RouteHandler } from '@objectstack/spec/contracts';
 import { z } from 'zod';
 import { LoggerConfig } from '@objectstack/spec/system';
 import { ObjectLogger } from './logger.js';
@@ -9,6 +9,7 @@ import * as QA from '@objectstack/spec/qa';
 import { KeyObject } from 'node:crypto';
 import { PluginCapability, PluginPermissions as PluginPermissions$1, PluginPermissionSet, ResourceType, PermissionAction, PluginPermission, SandboxConfig, KernelSecurityScanResult, KernelSecurityVulnerability, PluginHealthCheck, PluginHealthStatus as PluginHealthStatus$1, PluginHealthReport, HotReloadConfig, VersionConstraint, DependencyConflict, SemanticVersion, CompatibilityLevel } from '@objectstack/spec/kernel';
 import { AuthzPosture } from '@objectstack/spec/security';
+export { nextUtcCalendarDay, utcInstantMs } from '@objectstack/spec/data';
 
 /**
  * Service Lifecycle Types
@@ -213,6 +214,12 @@ declare class ObjectKernel {
     private startedPlugins;
     private pluginStartTimes;
     private shutdownHandlers;
+    /**
+     * Name of the plugin whose init() is currently executing (Phase 1 is
+     * sequential, so at most one). Lets a getService miss during init name
+     * the structural fault (#4131) instead of only the symptom.
+     */
+    private currentlyInitializing?;
     constructor(config?: ObjectKernelConfig);
     /**
      * Register a plugin with enhanced validation
@@ -290,9 +297,27 @@ declare class ObjectKernel {
      */
     getState(): string;
     private initPluginWithTimeout;
+    /**
+     * Whether a service is resolvable on this kernel right now — direct
+     * registration or a loader-registered factory. Backs the init-service
+     * contract checks (#4131).
+     */
+    private hasAnyService;
+    /**
+     * When a getService miss happens while a plugin's init() is running,
+     * append the structural diagnosis (#4131): which plugin was initializing,
+     * and — when a composed plugin declares the service — who provides it.
+     * Empty string outside Phase 1, so non-boot messages stay unchanged.
+     */
+    private describeInitOrderFault;
     private startPluginWithTimeout;
     private rollbackStartedPlugins;
     private performShutdown;
+    /**
+     * Topological order over `dependencies` (hard) + `optionalDependencies`
+     * (order-if-present) — ADR-0116, #4131. One implementation shared with
+     * LiteKernel via `plugin-order.ts`.
+     */
     private resolveDependencies;
     private registerShutdownSignals;
     /**
@@ -350,17 +375,22 @@ interface PluginContext {
      */
     getServices(): Map<string, any>;
     /**
-     * Register a hook handler
+     * Register a hook handler.
+     *
+     * Known lifecycle-bus names (see `IPluginLifecycleEvents` in
+     * `@objectstack/spec`) autocomplete; the bus stays open to custom
+     * cross-plugin event names, so any string remains valid.
+     *
      * @param name - Hook name (e.g., 'kernel:ready', 'data:beforeInsert')
      * @param handler - Hook handler function
      */
-    hook(name: string, handler: (...args: any[]) => void | Promise<void>): void;
+    hook(name: LifecycleEventName | (string & {}), handler: (...args: any[]) => void | Promise<void>): void;
     /**
      * Trigger a hook
-     * @param name - Hook name
+     * @param name - Hook name (known lifecycle names autocomplete; custom names stay legal)
      * @param args - Arguments to pass to hook handlers
      */
-    trigger(name: string, ...args: any[]): Promise<void>;
+    trigger(name: LifecycleEventName | (string & {}), ...args: any[]): Promise<void>;
     /**
      * Logger instance
      */
@@ -393,8 +423,35 @@ interface Plugin {
     /**
      * List of other plugin names that this plugin depends on.
      * The kernel ensures these plugins are initialized before this one.
+     * A name that is not registered on the kernel is a boot error.
      */
     dependencies?: string[];
+    /**
+     * Soft dependencies — order-if-present (ADR-0116, #4131).
+     * Registered names are hoisted ahead exactly like `dependencies`;
+     * absent names are silently skipped instead of failing the boot.
+     * For plugins that DEGRADE gracefully without the dependency but must
+     * never initialize before it when both are composed (e.g. AppPlugin on
+     * an engine-less metadata-only kernel).
+     */
+    optionalDependencies?: string[];
+    /**
+     * Services this plugin resolves SYNCHRONOUSLY during `init()`
+     * (ADR-0116, #4131). The kernel validates the resolved order before
+     * Phase 1 (a required service whose only declared provider initializes
+     * later is a named boot error) and re-checks immediately before this
+     * plugin's init runs. Declare only hard init-time needs — a service the
+     * init merely probes behind a try/catch does not belong here.
+     */
+    requiresServices?: string[];
+    /**
+     * Services this plugin's `init()` UNCONDITIONALLY registers
+     * (ADR-0116, #4131). Powers the pre-Phase-1 ordering validation and
+     * lets misordering errors name the provider. Never declare a service
+     * that is registered conditionally (option-gated, environment-gated):
+     * the kernel would blame orderings this plugin cannot satisfy.
+     */
+    providesServices?: string[];
     /**
      * Init Phase: Register services
      * Called when kernel is initializing.
@@ -437,6 +494,12 @@ declare abstract class ObjectKernelBase {
     protected state: KernelState;
     protected logger: Logger;
     protected context: PluginContext;
+    /**
+     * Name of the plugin whose init() is currently executing (Phase 1 runs
+     * sequentially, so there is at most one). Lets a getService miss during
+     * init name the structural fault (#4131) instead of only the symptom.
+     */
+    protected currentlyInitializing?: string;
     constructor(logger: Logger);
     /**
      * Validate kernel state
@@ -454,10 +517,30 @@ declare abstract class ObjectKernelBase {
      */
     protected createContext(): PluginContext;
     /**
-     * Resolve plugin dependencies using topological sort
+     * Resolve plugin dependencies using topological sort — `dependencies`
+     * hard, `optionalDependencies` order-if-present (ADR-0116, #4131). One
+     * implementation shared with ObjectKernel via `plugin-order.ts`.
      * @returns Ordered list of plugins (dependencies first)
      */
     protected resolveDependencies(): Plugin[];
+    /**
+     * Whether a service is registered on this kernel right now. Backs the
+     * init-service contract checks (#4131).
+     */
+    protected hasRegisteredService(name: string): boolean;
+    /**
+     * Pre-Phase-1 ordering validation (ADR-0116, #4131): a plugin whose
+     * `requiresServices` names a service provided only by a LATER plugin is
+     * a named boot error before any init side effects.
+     */
+    protected validateInitServices(ordered: Plugin[]): void;
+    /**
+     * When a getService miss happens while a plugin's init() is running,
+     * append the structural diagnosis (#4131): which plugin was initializing,
+     * and — when a composed plugin declares the service — who provides it.
+     * Empty string outside Phase 1, so non-boot messages stay unchanged.
+     */
+    protected describeInitOrderFault(serviceName: string): string;
     /**
      * Run plugin init phase
      * @param plugin - Plugin to initialize
@@ -495,6 +578,90 @@ declare abstract class ObjectKernelBase {
     abstract destroy(): Promise<void>;
 }
 
+/**
+ * Plugin ordering + init-service contract (ADR-0116, #4131).
+ *
+ * The kernel resolves BOTH init and start order from the plugin dependency
+ * graph, so `kernel.use()` registration order proves nothing. Twice a plugin
+ * relied on list position anyway and shipped a boot that dies inside init —
+ * the first cut of DefaultDatasourcePlugin (started after boot schema-sync;
+ * server with no tables) and AppPlugin (#4085: `manifest` grabbed in init
+ * before ObjectQLPlugin registered it). Both times the fix existed only as a
+ * convention: put the plugin in the right slot, write a comment. This module
+ * is the enforced form of that contract, shared by ObjectKernel and
+ * LiteKernel so there is exactly one ordering semantic:
+ *
+ *  - `dependencies` — hard: hoisted ahead, missing ⇒ boot error (unchanged).
+ *  - `optionalDependencies` — order-if-present: hoisted ahead when composed,
+ *    silently skipped when absent. For plugins that DEGRADE without the
+ *    dependency but must never init before it (AppPlugin on an engine-less
+ *    metadata-only kernel).
+ *  - `requiresServices` — services a plugin resolves SYNCHRONOUSLY during
+ *    `init()`. Validated before Phase 1 (provable misordering ⇒ named error
+ *    instead of a crash inside init) and again immediately before each init
+ *    (authoritative: the service is either registered by now or init dies).
+ *  - `providesServices` — services a plugin's `init()` UNCONDITIONALLY
+ *    registers. Powers the pre-Phase-1 check and the named diagnostics.
+ *    Declare only unconditional registrations: a conditional service (e.g.
+ *    one gated behind an option) would indict this plugin for orderings it
+ *    cannot actually satisfy.
+ */
+/**
+ * The ordering-relevant surface of a kernel plugin. Structural on purpose:
+ * ObjectKernel sorts `PluginMetadata`, LiteKernel sorts `Plugin`, and both
+ * satisfy this shape.
+ */
+interface OrderablePlugin {
+    name: string;
+    /** Hard dependencies — hoisted ahead; missing ⇒ boot error. */
+    dependencies?: string[];
+    /** Soft dependencies — hoisted ahead when composed, skipped when absent. */
+    optionalDependencies?: string[];
+    /** Services resolved synchronously during init(). */
+    requiresServices?: string[];
+    /** Services init() unconditionally registers. */
+    providesServices?: string[];
+}
+/**
+ * Topologically order plugins: every plugin's `dependencies` (throw when
+ * missing) and `optionalDependencies` (skip when missing) init before it.
+ * Insertion order is preserved for plugins with no edges between them.
+ * Cycles through either edge kind throw — an optional dependency is a real
+ * edge whenever both sides are composed.
+ */
+declare function resolvePluginOrder<P extends OrderablePlugin>(plugins: Map<string, P>): P[];
+/**
+ * Pre-Phase-1 check: walk the resolved order and prove no plugin requires a
+ * service whose only declared provider initializes AFTER it. A violation is
+ * the exact #4085 class — misplaced composition — reported as a named,
+ * structural boot error BEFORE any init side effects, instead of a bare
+ * "Service not found" thrown from inside the victim's init.
+ *
+ * Deliberately does NOT fail when a required service has no declared provider
+ * and is not yet registered: an earlier plugin may register it without
+ * declaring `providesServices`. That case is settled authoritatively by
+ * {@link assertInitServiceRequirements} immediately before the requiring
+ * plugin's init runs.
+ */
+declare function validateInitServiceContract<P extends OrderablePlugin>(ordered: P[], isServiceRegistered: (name: string) => boolean): void;
+/**
+ * Diagnosis suffix for a getService miss that happens WHILE a plugin's
+ * init() is running: names the initializing plugin and — when a composed
+ * plugin declares the service — the provider and the directive to declare
+ * the ordering. Returns '' when no plugin is initializing, so non-boot
+ * error messages stay byte-identical. Shared by both kernels.
+ */
+declare function describeInitOrderFault(currentlyInitializing: string | undefined, plugins: Iterable<OrderablePlugin>, serviceName: string): string;
+/**
+ * Just-before-init check: every service in `requiresServices` must be
+ * registered at the moment the plugin's init() is about to run. At this
+ * point the verdict is authoritative — Phase 1 runs sequentially, so a
+ * service absent now is absent for this init, and the init would die on a
+ * bare "Service not found" anyway. This turns that crash into a named
+ * composition error.
+ */
+declare function assertInitServiceRequirements(plugin: OrderablePlugin, isServiceRegistered: (name: string) => boolean): void;
+
 /**
  * ObjectKernel - MiniKernel Architecture
  *
@@ -1751,6 +1918,14 @@ interface ResolvedAuthzContext {
     tabPermissions?: Record<string, 'visible' | 'hidden' | 'default_on' | 'default_off'>;
     /** Fellow-org user IDs for RLS scoping of identity tables (`id IN (...)`). */
     org_user_ids: string[];
+    /**
+     * [ADR-0105 D2] Every organization this principal currently holds a VALID
+     * membership in — the caller's org access set, and the read reach of the
+     * `group` tenancy posture (Layer 0 becomes `organization_id IN (...)`).
+     * Resolved here, once, so no surface re-derives it; empty for an anonymous or
+     * membership-less principal, which fails the group wall closed.
+     */
+    accessible_org_ids: string[];
     /**
      * [ADR-0095 D2/D3] The monotonic posture rung this principal resolves to,
      * DERIVED once here from held capability grants (never a better-auth role):
@@ -1788,6 +1963,8 @@ interface UserAuthzGrants {
     systemPermissions: string[];
     /** Fellow-org user IDs for RLS scoping of identity tables (`id IN (...)`). */
     org_user_ids: string[];
+    /** [ADR-0105 D2] Organizations this user holds a currently-valid membership in. */
+    accessible_org_ids: string[];
     tabPermissions?: Record<string, 'visible' | 'hidden' | 'default_on' | 'default_off'>;
     posture?: AuthzPosture;
     /** The user's unique email (`sys_user`), for `current_user.email` owner RLS. */
@@ -1987,18 +2164,16 @@ declare function evaluateAuthGate(sessionUser: any, path: string): AuthGate | nu
 
 /** HTTP status every seam returns for an anonymous-denied request. */
 declare const ANONYMOUS_DENY_STATUS: 401;
-/** Stable machine code (mirrors the REST `enforceAuth` seam). */
-declare const ANONYMOUS_DENY_CODE: "unauthenticated";
+/** Stable machine code (mirrors the REST `enforceAuth` seam). ADR-0112: SCREAMING, a `StandardErrorCode` member. */
+declare const ANONYMOUS_DENY_CODE: "UNAUTHENTICATED";
 /** Human-facing message. */
 declare const ANONYMOUS_DENY_MESSAGE = "Authentication is required to access this endpoint.";
 /** The single 401 body shape every seam returns: `{ error, message }`. */
 declare const ANONYMOUS_DENY_BODY: {
-    readonly error: "unauthenticated";
+    readonly error: "UNAUTHENTICATED";
     readonly message: "Authentication is required to access this endpoint.";
 };
 interface AnonymousDenyInput {
-    /** The `requireAuth` posture. Falsy ⇒ no-op (demo / single-tenant). */
-    requireAuth: boolean | undefined;
     /** Resolved caller id, if any. */
     userId?: string | null;
     /** Internal system context (never set on inbound HTTP; cannot be forged). */
@@ -2105,6 +2280,7 @@ declare function calendarPartsInTzOrUtc(d: Date, tz?: string): CalendarParts;
  * reference-tz calendar, so its bucket boundary is that tz's midnight instant.
  */
 declare function zonedDateStartToUtcMs(ymd: string, tz?: string): number;
+
 /**
  * Granularity of a canonical date-bucket key. Mirrors `@objectstack/spec`'s
  * `DateGranularity` enum but kept as a local literal union so this low-level
@@ -2123,12 +2299,16 @@ type BucketGranularity = 'day' | 'week' | 'month' | 'quarter' | 'year';
  * `datetime` field in a reference timezone layers that on top (and, per
  * ADR-0053, a `date` field compares against these `YYYY-MM-DD` bounds directly).
  *
- * Returns `null` for the null/empty bucket, an unparseable key, or a key that
- * is shape-valid but out of range (e.g. `2026-13`, a `-W53` in a 52-week year,
+ * Returns `null` for the empty bucket, an unparseable key, or a key that is
+ * shape-valid but out of range (e.g. `2026-13`, a `-W53` in a 52-week year,
  * `2026-02-30`). Callers drop the range and fall back to an unscoped (superset)
  * drill rather than emit a wrong bound.
+ *
+ * `key` admits `null` because that IS the empty bucket's key on both aggregation
+ * paths (#3839); callers pass a grouped row's dimension value straight through
+ * rather than casting a lie.
  */
-declare function bucketKeyToCalendarRange(key: string, granularity: BucketGranularity): {
+declare function bucketKeyToCalendarRange(key: string | null | undefined, granularity: BucketGranularity): {
     start: string;
     end: string;
 } | null;
@@ -2251,15 +2431,114 @@ declare function withTransientRetry<T>(fn: (attempt: number) => Promise<T>, opts
  */
 declare function bulkWrite<TRow, TRecord = any>(rows: TRow[], opts: BulkWriteOptions<TRow, TRecord>): Promise<BulkWriteRowResult<TRecord>[]>;
 
+/**
+ * The slice of an execution context the resolver reads. Structural on purpose —
+ * see {@link filterTokenContextFrom}.
+ */
+interface ExecutionContextLike {
+    readonly userId?: string;
+    readonly tenantId?: string;
+    readonly timezone?: string;
+}
+/**
+ * The request-scoped values a placeholder can resolve against.
+ *
+ * `now` is captured ONCE per resolve call so every token in one filter shares
+ * an instant — otherwise a `$gte {current_month_start}` / `$lt
+ * {next_month_start}` pair evaluated microseconds apart could straddle a
+ * month boundary and silently drop a row.
+ */
+interface FilterTokenResolutionContext {
+    /** Reference instant. Defaults to `new Date()` at call time. */
+    now?: Date;
+    /** IANA reference timezone for calendar boundaries. Defaults to UTC. */
+    timezone?: string;
+    /** Resolves `{current_user_id}`. */
+    userId?: string;
+    /** Resolves `{current_org_id}`. */
+    orgId?: string;
+}
+/**
+ * Raised when a filter carries a placeholder outside the vocabulary.
+ *
+ * Carries `status`/`code` so the REST layer's generic 4xx passthrough maps it
+ * to a **400 with a fixable message** rather than a 500: the caller's filter is
+ * malformed, the server is fine. (Same convention plugin-sharing uses for its
+ * record-scope denial — no runtime dependency in either direction.)
+ */
+declare class UnknownFilterTokenError extends Error {
+    readonly token: string;
+    readonly suggestion?: string;
+    readonly status = 400;
+    readonly code = "FILTER_TOKEN_UNKNOWN";
+    constructor(token: string, suggestion?: string);
+}
+/**
+ * Raised when a token IS in the vocabulary but the request carries no value
+ * for it — an unauthenticated caller filtering on `{current_user_id}`.
+ *
+ * Distinct from {@link UnknownFilterTokenError} because the fix is different:
+ * the metadata is correct, the context is not. Never silently resolves to
+ * `null`/`undefined`, which on most drivers degrades to `IS NULL` and would
+ * quietly hand back rows the filter was written to exclude.
+ */
+declare class UnresolvedFilterTokenError extends Error {
+    readonly token: string;
+    /** 400, not 500 — see {@link UnknownFilterTokenError}. */
+    readonly status = 400;
+    readonly code = "FILTER_TOKEN_UNRESOLVED";
+    constructor(token: string, detail: string);
+}
+/**
+ * Resolve one token NAME (the bit inside the braces) to its concrete value.
+ * Throws {@link UnresolvedFilterTokenError} for a vocabulary token the request
+ * carries no value for. Returns `undefined` only when the token is outside the
+ * vocabulary — callers turn that into {@link UnknownFilterTokenError}.
+ */
+declare function resolveFilterToken(token: string, ctx?: FilterTokenResolutionContext): unknown;
+/**
+ * Deep-replace every fully-wrapped placeholder in `filter` with its resolved
+ * value, returning a NEW tree (the caller's metadata is never mutated — a view
+ * or dataset definition is shared across requests, so resolving in place would
+ * bake one request's user id, and one day's dates, into every later render).
+ *
+ * Returns the input unchanged, by reference, when it holds no placeholders.
+ */
+declare function resolveFilterTokens<T>(filter: T, ctx?: FilterTokenResolutionContext): T;
+/**
+ * Convenience bridge from an execution context to the resolver's inputs.
+ * `{current_org_id}` reads `tenantId` — the active organization IS the tenant
+ * on the read path (same value the RLS compiler binds to
+ * `current_user.organization_id`).
+ *
+ * Typed structurally, not as `ExecutionContext`, so both the parsed context
+ * (defaults applied) and the pre-parse `ExecutionContextInput` a caller holds
+ * mid-pipeline satisfy it. The three fields read here are optional in both.
+ */
+declare function filterTokenContextFrom(execCtx: ExecutionContextLike | undefined, now?: Date): FilterTokenResolutionContext;
+
 /**
  * In-memory Map-backed cache fallback.
  *
  * Implements the ICacheService contract with basic get/set/delete/has/clear
  * and TTL expiry.  Used by ObjectKernel as an automatic fallback when no
  * real cache plugin (e.g. Redis) is registered.
+ *
+ * [#4058] Self-describes as `degraded`, not `stub` (ADR-0076 D12): this is a
+ * real cache — it stores, expires, and reports true stats — just process-local
+ * and unshared. The non-standard `_fallback: true` it used to carry was read by
+ * nothing (`readServiceSelfInfo` reads only `__serviceInfo` — `_dev`, the other
+ * marker it knew back then, was itself retired in #4319), so discovery reported
+ * it as fully `available`. `handlerReady: false` because
+ * no HTTP surface is mounted for `cache` at all — the same reason realtime
+ * reports false.
  */
 declare function createMemoryCache(): {
-    _fallback: boolean;
+    __serviceInfo: {
+        status: "degraded";
+        handlerReady: boolean;
+        message: string;
+    };
     _serviceName: string;
     get<T = unknown>(key: string): Promise<T | undefined>;
     set<T = unknown>(key: string, value: T, ttl?: number): Promise<void>;
@@ -2279,9 +2558,18 @@ declare function createMemoryCache(): {
  * Implements the IQueueService contract with synchronous in-process delivery.
  * Used by ObjectKernel as an automatic fallback when no real queue plugin
  * (e.g. BullMQ / RabbitMQ) is registered.
+ *
+ * [#4058] `degraded`, not `stub` (ADR-0076 D12): messages really reach real
+ * subscribers — synchronously, in-process, with no durability or retry.
+ * `getQueueSize()` answering 0 follows from that rather than faking it: nothing
+ * is ever buffered. `handlerReady: false` — no HTTP surface exists for `queue`.
  */
 declare function createMemoryQueue(): {
-    _fallback: boolean;
+    __serviceInfo: {
+        status: "degraded";
+        handlerReady: boolean;
+        message: string;
+    };
     _serviceName: string;
     publish<T = unknown>(queue: string, data: T): Promise<string>;
     subscribe(queue: string, handler: (msg: any) => Promise<void>): Promise<void>;
@@ -2296,9 +2584,19 @@ declare function createMemoryQueue(): {
  * Implements the IJobService contract with basic schedule/cancel/trigger
  * operations.  Used by ObjectKernel as an automatic fallback when no real
  * job plugin (e.g. Agenda / BullMQ) is registered.
+ *
+ * [#4058] `degraded` (ADR-0076 D12), with the missing half named in the
+ * message rather than left for a deployer to discover: `trigger()` really runs
+ * the registered handler, but nothing here owns a timer, so a `schedule()`d job
+ * NEVER fires on its own. That is reduced capability, not fabricated output —
+ * no call returns a made-up answer. `handlerReady: false`: no HTTP surface.
  */
 declare function createMemoryJob(): {
-    _fallback: boolean;
+    __serviceInfo: {
+        status: "degraded";
+        handlerReady: boolean;
+        message: string;
+    };
     _serviceName: string;
     schedule(name: string, schedule: any, handler: any): Promise<void>;
     cancel(name: string): Promise<void>;
@@ -2339,7 +2637,10 @@ declare function resolveLocale(requestedLocale: string, availableLocales: string
  * Does not load files from disk — operates purely in-memory.
  */
 declare function createMemoryI18n(): {
-    _fallback: boolean;
+    __serviceInfo: {
+        status: "degraded";
+        message: string;
+    };
     _serviceName: string;
     t(key: string, locale: string, params?: Record<string, unknown>): string;
     getTranslations(locale: string): Record<string, unknown>;
@@ -2364,7 +2665,10 @@ declare function createMemoryI18n(): {
  * (e.g. MetadataPlugin with file-system persistence) is registered.
  */
 declare function createMemoryMetadata(): {
-    _fallback: boolean;
+    __serviceInfo: {
+        status: "degraded";
+        message: string;
+    };
     _serviceName: string;
     register(type: string, name: string, data: any): Promise<void>;
     registerInMemory(type: string, name: string, data: any): void;
@@ -2687,4 +2991,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type UserAuthzGrants, type VersionCompatibility, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, resolveUserAuthzGrants, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };
+export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type OrderablePlugin, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VersionCompatibility, assertInitServiceRequirements, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, describeInitOrderFault, evaluateAuthGate, extractApiKey, filterTokenContextFrom, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolvePluginOrder, resolveUserAuthzGrants, safeExit, shouldDenyAnonymous, signPayload, validateInitServiceContract, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };