@objectstack/core 17.0.0-rc.0 → 17.0.0-rc.1

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { Logger, IServiceRegistry } from '@objectstack/spec/contracts';
-export { IDataDriver, IDataEngine, IHttpRequest, IHttpResponse, IHttpServer, Logger, Middleware, RouteHandler } from '@objectstack/spec/contracts';
+import { Logger, LifecycleEventName, IServiceRegistry } from '@objectstack/spec/contracts';
+export { EngineSchemaRegistryView, IDataDriver, IDataEngine, IHttpRequest, IHttpResponse, IHttpServer, IObjectQLEngine, Logger, Middleware, RouteHandler } from '@objectstack/spec/contracts';
 import { z } from 'zod';
 import { LoggerConfig } from '@objectstack/spec/system';
 import { ObjectLogger } from './logger.cjs';
@@ -9,6 +9,7 @@ import * as QA from '@objectstack/spec/qa';
 import { KeyObject } from 'node:crypto';
 import { PluginCapability, PluginPermissions as PluginPermissions$1, PluginPermissionSet, ResourceType, PermissionAction, PluginPermission, SandboxConfig, KernelSecurityScanResult, KernelSecurityVulnerability, PluginHealthCheck, PluginHealthStatus as PluginHealthStatus$1, PluginHealthReport, HotReloadConfig, VersionConstraint, DependencyConflict, SemanticVersion, CompatibilityLevel } from '@objectstack/spec/kernel';
 import { AuthzPosture } from '@objectstack/spec/security';
+export { nextUtcCalendarDay, utcInstantMs } from '@objectstack/spec/data';
 
 /**
  * Service Lifecycle Types
@@ -213,6 +214,12 @@ declare class ObjectKernel {
     private startedPlugins;
     private pluginStartTimes;
     private shutdownHandlers;
+    /**
+     * Name of the plugin whose init() is currently executing (Phase 1 is
+     * sequential, so at most one). Lets a getService miss during init name
+     * the structural fault (#4131) instead of only the symptom.
+     */
+    private currentlyInitializing?;
     constructor(config?: ObjectKernelConfig);
     /**
      * Register a plugin with enhanced validation
@@ -290,9 +297,27 @@ declare class ObjectKernel {
      */
     getState(): string;
     private initPluginWithTimeout;
+    /**
+     * Whether a service is resolvable on this kernel right now — direct
+     * registration or a loader-registered factory. Backs the init-service
+     * contract checks (#4131).
+     */
+    private hasAnyService;
+    /**
+     * When a getService miss happens while a plugin's init() is running,
+     * append the structural diagnosis (#4131): which plugin was initializing,
+     * and — when a composed plugin declares the service — who provides it.
+     * Empty string outside Phase 1, so non-boot messages stay unchanged.
+     */
+    private describeInitOrderFault;
     private startPluginWithTimeout;
     private rollbackStartedPlugins;
     private performShutdown;
+    /**
+     * Topological order over `dependencies` (hard) + `optionalDependencies`
+     * (order-if-present) — ADR-0116, #4131. One implementation shared with
+     * LiteKernel via `plugin-order.ts`.
+     */
     private resolveDependencies;
     private registerShutdownSignals;
     /**
@@ -350,17 +375,22 @@ interface PluginContext {
      */
     getServices(): Map<string, any>;
     /**
-     * Register a hook handler
+     * Register a hook handler.
+     *
+     * Known lifecycle-bus names (see `IPluginLifecycleEvents` in
+     * `@objectstack/spec`) autocomplete; the bus stays open to custom
+     * cross-plugin event names, so any string remains valid.
+     *
      * @param name - Hook name (e.g., 'kernel:ready', 'data:beforeInsert')
      * @param handler - Hook handler function
      */
-    hook(name: string, handler: (...args: any[]) => void | Promise<void>): void;
+    hook(name: LifecycleEventName | (string & {}), handler: (...args: any[]) => void | Promise<void>): void;
     /**
      * Trigger a hook
-     * @param name - Hook name
+     * @param name - Hook name (known lifecycle names autocomplete; custom names stay legal)
      * @param args - Arguments to pass to hook handlers
      */
-    trigger(name: string, ...args: any[]): Promise<void>;
+    trigger(name: LifecycleEventName | (string & {}), ...args: any[]): Promise<void>;
     /**
      * Logger instance
      */
@@ -393,8 +423,35 @@ interface Plugin {
     /**
      * List of other plugin names that this plugin depends on.
      * The kernel ensures these plugins are initialized before this one.
+     * A name that is not registered on the kernel is a boot error.
      */
     dependencies?: string[];
+    /**
+     * Soft dependencies — order-if-present (ADR-0116, #4131).
+     * Registered names are hoisted ahead exactly like `dependencies`;
+     * absent names are silently skipped instead of failing the boot.
+     * For plugins that DEGRADE gracefully without the dependency but must
+     * never initialize before it when both are composed (e.g. AppPlugin on
+     * an engine-less metadata-only kernel).
+     */
+    optionalDependencies?: string[];
+    /**
+     * Services this plugin resolves SYNCHRONOUSLY during `init()`
+     * (ADR-0116, #4131). The kernel validates the resolved order before
+     * Phase 1 (a required service whose only declared provider initializes
+     * later is a named boot error) and re-checks immediately before this
+     * plugin's init runs. Declare only hard init-time needs — a service the
+     * init merely probes behind a try/catch does not belong here.
+     */
+    requiresServices?: string[];
+    /**
+     * Services this plugin's `init()` UNCONDITIONALLY registers
+     * (ADR-0116, #4131). Powers the pre-Phase-1 ordering validation and
+     * lets misordering errors name the provider. Never declare a service
+     * that is registered conditionally (option-gated, environment-gated):
+     * the kernel would blame orderings this plugin cannot satisfy.
+     */
+    providesServices?: string[];
     /**
      * Init Phase: Register services
      * Called when kernel is initializing.
@@ -437,6 +494,12 @@ declare abstract class ObjectKernelBase {
     protected state: KernelState;
     protected logger: Logger;
     protected context: PluginContext;
+    /**
+     * Name of the plugin whose init() is currently executing (Phase 1 runs
+     * sequentially, so there is at most one). Lets a getService miss during
+     * init name the structural fault (#4131) instead of only the symptom.
+     */
+    protected currentlyInitializing?: string;
     constructor(logger: Logger);
     /**
      * Validate kernel state
@@ -454,10 +517,30 @@ declare abstract class ObjectKernelBase {
      */
     protected createContext(): PluginContext;
     /**
-     * Resolve plugin dependencies using topological sort
+     * Resolve plugin dependencies using topological sort — `dependencies`
+     * hard, `optionalDependencies` order-if-present (ADR-0116, #4131). One
+     * implementation shared with ObjectKernel via `plugin-order.ts`.
      * @returns Ordered list of plugins (dependencies first)
      */
     protected resolveDependencies(): Plugin[];
+    /**
+     * Whether a service is registered on this kernel right now. Backs the
+     * init-service contract checks (#4131).
+     */
+    protected hasRegisteredService(name: string): boolean;
+    /**
+     * Pre-Phase-1 ordering validation (ADR-0116, #4131): a plugin whose
+     * `requiresServices` names a service provided only by a LATER plugin is
+     * a named boot error before any init side effects.
+     */
+    protected validateInitServices(ordered: Plugin[]): void;
+    /**
+     * When a getService miss happens while a plugin's init() is running,
+     * append the structural diagnosis (#4131): which plugin was initializing,
+     * and — when a composed plugin declares the service — who provides it.
+     * Empty string outside Phase 1, so non-boot messages stay unchanged.
+     */
+    protected describeInitOrderFault(serviceName: string): string;
     /**
      * Run plugin init phase
      * @param plugin - Plugin to initialize
@@ -495,6 +578,90 @@ declare abstract class ObjectKernelBase {
     abstract destroy(): Promise<void>;
 }
 
+/**
+ * Plugin ordering + init-service contract (ADR-0116, #4131).
+ *
+ * The kernel resolves BOTH init and start order from the plugin dependency
+ * graph, so `kernel.use()` registration order proves nothing. Twice a plugin
+ * relied on list position anyway and shipped a boot that dies inside init —
+ * the first cut of DefaultDatasourcePlugin (started after boot schema-sync;
+ * server with no tables) and AppPlugin (#4085: `manifest` grabbed in init
+ * before ObjectQLPlugin registered it). Both times the fix existed only as a
+ * convention: put the plugin in the right slot, write a comment. This module
+ * is the enforced form of that contract, shared by ObjectKernel and
+ * LiteKernel so there is exactly one ordering semantic:
+ *
+ *  - `dependencies` — hard: hoisted ahead, missing ⇒ boot error (unchanged).
+ *  - `optionalDependencies` — order-if-present: hoisted ahead when composed,
+ *    silently skipped when absent. For plugins that DEGRADE without the
+ *    dependency but must never init before it (AppPlugin on an engine-less
+ *    metadata-only kernel).
+ *  - `requiresServices` — services a plugin resolves SYNCHRONOUSLY during
+ *    `init()`. Validated before Phase 1 (provable misordering ⇒ named error
+ *    instead of a crash inside init) and again immediately before each init
+ *    (authoritative: the service is either registered by now or init dies).
+ *  - `providesServices` — services a plugin's `init()` UNCONDITIONALLY
+ *    registers. Powers the pre-Phase-1 check and the named diagnostics.
+ *    Declare only unconditional registrations: a conditional service (e.g.
+ *    one gated behind an option) would indict this plugin for orderings it
+ *    cannot actually satisfy.
+ */
+/**
+ * The ordering-relevant surface of a kernel plugin. Structural on purpose:
+ * ObjectKernel sorts `PluginMetadata`, LiteKernel sorts `Plugin`, and both
+ * satisfy this shape.
+ */
+interface OrderablePlugin {
+    name: string;
+    /** Hard dependencies — hoisted ahead; missing ⇒ boot error. */
+    dependencies?: string[];
+    /** Soft dependencies — hoisted ahead when composed, skipped when absent. */
+    optionalDependencies?: string[];
+    /** Services resolved synchronously during init(). */
+    requiresServices?: string[];
+    /** Services init() unconditionally registers. */
+    providesServices?: string[];
+}
+/**
+ * Topologically order plugins: every plugin's `dependencies` (throw when
+ * missing) and `optionalDependencies` (skip when missing) init before it.
+ * Insertion order is preserved for plugins with no edges between them.
+ * Cycles through either edge kind throw — an optional dependency is a real
+ * edge whenever both sides are composed.
+ */
+declare function resolvePluginOrder<P extends OrderablePlugin>(plugins: Map<string, P>): P[];
+/**
+ * Pre-Phase-1 check: walk the resolved order and prove no plugin requires a
+ * service whose only declared provider initializes AFTER it. A violation is
+ * the exact #4085 class — misplaced composition — reported as a named,
+ * structural boot error BEFORE any init side effects, instead of a bare
+ * "Service not found" thrown from inside the victim's init.
+ *
+ * Deliberately does NOT fail when a required service has no declared provider
+ * and is not yet registered: an earlier plugin may register it without
+ * declaring `providesServices`. That case is settled authoritatively by
+ * {@link assertInitServiceRequirements} immediately before the requiring
+ * plugin's init runs.
+ */
+declare function validateInitServiceContract<P extends OrderablePlugin>(ordered: P[], isServiceRegistered: (name: string) => boolean): void;
+/**
+ * Diagnosis suffix for a getService miss that happens WHILE a plugin's
+ * init() is running: names the initializing plugin and — when a composed
+ * plugin declares the service — the provider and the directive to declare
+ * the ordering. Returns '' when no plugin is initializing, so non-boot
+ * error messages stay byte-identical. Shared by both kernels.
+ */
+declare function describeInitOrderFault(currentlyInitializing: string | undefined, plugins: Iterable<OrderablePlugin>, serviceName: string): string;
+/**
+ * Just-before-init check: every service in `requiresServices` must be
+ * registered at the moment the plugin's init() is about to run. At this
+ * point the verdict is authoritative — Phase 1 runs sequentially, so a
+ * service absent now is absent for this init, and the init would die on a
+ * bare "Service not found" anyway. This turns that crash into a named
+ * composition error.
+ */
+declare function assertInitServiceRequirements(plugin: OrderablePlugin, isServiceRegistered: (name: string) => boolean): void;
+
 /**
  * ObjectKernel - MiniKernel Architecture
  *
@@ -1997,18 +2164,16 @@ declare function evaluateAuthGate(sessionUser: any, path: string): AuthGate | nu
 
 /** HTTP status every seam returns for an anonymous-denied request. */
 declare const ANONYMOUS_DENY_STATUS: 401;
-/** Stable machine code (mirrors the REST `enforceAuth` seam). */
-declare const ANONYMOUS_DENY_CODE: "unauthenticated";
+/** Stable machine code (mirrors the REST `enforceAuth` seam). ADR-0112: SCREAMING, a `StandardErrorCode` member. */
+declare const ANONYMOUS_DENY_CODE: "UNAUTHENTICATED";
 /** Human-facing message. */
 declare const ANONYMOUS_DENY_MESSAGE = "Authentication is required to access this endpoint.";
 /** The single 401 body shape every seam returns: `{ error, message }`. */
 declare const ANONYMOUS_DENY_BODY: {
-    readonly error: "unauthenticated";
+    readonly error: "UNAUTHENTICATED";
     readonly message: "Authentication is required to access this endpoint.";
 };
 interface AnonymousDenyInput {
-    /** The `requireAuth` posture. Falsy ⇒ no-op (demo / single-tenant). */
-    requireAuth: boolean | undefined;
     /** Resolved caller id, if any. */
     userId?: string | null;
     /** Internal system context (never set on inbound HTTP; cannot be forged). */
@@ -2115,6 +2280,7 @@ declare function calendarPartsInTzOrUtc(d: Date, tz?: string): CalendarParts;
  * reference-tz calendar, so its bucket boundary is that tz's midnight instant.
  */
 declare function zonedDateStartToUtcMs(ymd: string, tz?: string): number;
+
 /**
  * Granularity of a canonical date-bucket key. Mirrors `@objectstack/spec`'s
  * `DateGranularity` enum but kept as a local literal union so this low-level
@@ -2357,9 +2523,22 @@ declare function filterTokenContextFrom(execCtx: ExecutionContextLike | undefine
  * Implements the ICacheService contract with basic get/set/delete/has/clear
  * and TTL expiry.  Used by ObjectKernel as an automatic fallback when no
  * real cache plugin (e.g. Redis) is registered.
+ *
+ * [#4058] Self-describes as `degraded`, not `stub` (ADR-0076 D12): this is a
+ * real cache — it stores, expires, and reports true stats — just process-local
+ * and unshared. The non-standard `_fallback: true` it used to carry was read by
+ * nothing (`readServiceSelfInfo` reads only `__serviceInfo` — `_dev`, the other
+ * marker it knew back then, was itself retired in #4319), so discovery reported
+ * it as fully `available`. `handlerReady: false` because
+ * no HTTP surface is mounted for `cache` at all — the same reason realtime
+ * reports false.
  */
 declare function createMemoryCache(): {
-    _fallback: boolean;
+    __serviceInfo: {
+        status: "degraded";
+        handlerReady: boolean;
+        message: string;
+    };
     _serviceName: string;
     get<T = unknown>(key: string): Promise<T | undefined>;
     set<T = unknown>(key: string, value: T, ttl?: number): Promise<void>;
@@ -2379,9 +2558,18 @@ declare function createMemoryCache(): {
  * Implements the IQueueService contract with synchronous in-process delivery.
  * Used by ObjectKernel as an automatic fallback when no real queue plugin
  * (e.g. BullMQ / RabbitMQ) is registered.
+ *
+ * [#4058] `degraded`, not `stub` (ADR-0076 D12): messages really reach real
+ * subscribers — synchronously, in-process, with no durability or retry.
+ * `getQueueSize()` answering 0 follows from that rather than faking it: nothing
+ * is ever buffered. `handlerReady: false` — no HTTP surface exists for `queue`.
  */
 declare function createMemoryQueue(): {
-    _fallback: boolean;
+    __serviceInfo: {
+        status: "degraded";
+        handlerReady: boolean;
+        message: string;
+    };
     _serviceName: string;
     publish<T = unknown>(queue: string, data: T): Promise<string>;
     subscribe(queue: string, handler: (msg: any) => Promise<void>): Promise<void>;
@@ -2396,9 +2584,19 @@ declare function createMemoryQueue(): {
  * Implements the IJobService contract with basic schedule/cancel/trigger
  * operations.  Used by ObjectKernel as an automatic fallback when no real
  * job plugin (e.g. Agenda / BullMQ) is registered.
+ *
+ * [#4058] `degraded` (ADR-0076 D12), with the missing half named in the
+ * message rather than left for a deployer to discover: `trigger()` really runs
+ * the registered handler, but nothing here owns a timer, so a `schedule()`d job
+ * NEVER fires on its own. That is reduced capability, not fabricated output —
+ * no call returns a made-up answer. `handlerReady: false`: no HTTP surface.
  */
 declare function createMemoryJob(): {
-    _fallback: boolean;
+    __serviceInfo: {
+        status: "degraded";
+        handlerReady: boolean;
+        message: string;
+    };
     _serviceName: string;
     schedule(name: string, schedule: any, handler: any): Promise<void>;
     cancel(name: string): Promise<void>;
@@ -2439,7 +2637,10 @@ declare function resolveLocale(requestedLocale: string, availableLocales: string
  * Does not load files from disk — operates purely in-memory.
  */
 declare function createMemoryI18n(): {
-    _fallback: boolean;
+    __serviceInfo: {
+        status: "degraded";
+        message: string;
+    };
     _serviceName: string;
     t(key: string, locale: string, params?: Record<string, unknown>): string;
     getTranslations(locale: string): Record<string, unknown>;
@@ -2464,7 +2665,10 @@ declare function createMemoryI18n(): {
  * (e.g. MetadataPlugin with file-system persistence) is registered.
  */
 declare function createMemoryMetadata(): {
-    _fallback: boolean;
+    __serviceInfo: {
+        status: "degraded";
+        message: string;
+    };
     _serviceName: string;
     register(type: string, name: string, data: any): Promise<void>;
     registerInMemory(type: string, name: string, data: any): void;
@@ -2787,4 +2991,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VersionCompatibility, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, filterTokenContextFrom, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolveUserAuthzGrants, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };
+export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type OrderablePlugin, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VersionCompatibility, assertInitServiceRequirements, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, describeInitOrderFault, evaluateAuthGate, extractApiKey, filterTokenContextFrom, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolvePluginOrder, resolveUserAuthzGrants, safeExit, shouldDenyAnonymous, signPayload, validateInitServiceContract, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };