@objectstack/core 17.0.0-rc.2 → 17.0.0-rc.4

package/dist/index.d.ts

@@ -4,7 +4,6 @@ import { z } from 'zod';
 import { LoggerConfig, MigrationOnCrashPolicy, MigrationJournalEvent } from '@objectstack/spec/system';
 import { ObjectLogger } from './logger.js';
 export { createLogger } from './logger.js';
-import { ConflictResolutionStrategy, ApiRegistryEntryInput, ApiRegistryEntry, ApiDiscoveryQuery, ApiDiscoveryResponse, ApiEndpointRegistration, ApiRegistry as ApiRegistry$1 } from '@objectstack/spec/api';
 import * as QA from '@objectstack/spec/qa';
 import { KeyObject } from 'node:crypto';
 import { PluginCapability, PluginPermissions as PluginPermissions$1, PluginPermissionSet, ResourceType, PermissionAction, PluginPermission, SandboxConfig, KernelSecurityScanResult, KernelSecurityVulnerability, PluginHealthCheck, PluginHealthStatus as PluginHealthStatus$1, PluginHealthReport, HotReloadConfig, VersionConstraint, DependencyConflict, SemanticVersion, CompatibilityLevel } from '@objectstack/spec/kernel';
@@ -336,6 +335,33 @@ declare class ObjectKernel {
     private describeInitOrderFault;
     private startPluginWithTimeout;
     private rollbackStartedPlugins;
+    /**
+     * Dispatch `kernel:shutdown`, ISOLATING failures: a handler that throws is
+     * logged and the remaining handlers still run (#5274).
+     *
+     * This is a per-hook judgement, deliberately NOT the bare awaited loop
+     * `context.trigger` runs for every other hook — the boot-path hooks
+     * (`kernel:ready`, `kernel:bootstrapped`, `kernel:listening`) keep
+     * propagating, because everything dispatched before "✅ Bootstrap complete"
+     * is a precondition of that claim and swallowing a throw there only hides
+     * the failure behind a process reporting success (#5170, #5257).
+     *
+     * On the teardown path there is no "refuse to proceed" left to buy. What is
+     * queued behind a failing shutdown handler is the rest of the cleanup —
+     * every other subscriber, then each plugin's `destroy()` in reverse order —
+     * which is what flushes buffers, closes connections and releases locks. So
+     * one bad handler must not amplify into leaked resources and unflushed
+     * writes. Same reasoning, same wording, same `Hook handler failed:
+     * kernel:shutdown` log line as `LiteKernel`'s dispatch site, which reaches
+     * the shared isolating dispatcher `ObjectKernelBase.triggerHook` (#5257).
+     *
+     * `ObjectKernel` cannot call that dispatcher: it does not extend
+     * `ObjectKernelBase` (only `LiteKernel` does) and owns its own `hooks` map,
+     * so the semantics are mirrored here rather than shared. One hook name
+     * meaning two opposite things across the two kernels is exactly the bug
+     * #5170/#5257 closed, so the pin for this one lives on both sides too.
+     */
+    private triggerShutdownHookIsolating;
     private performShutdown;
     /**
      * Topological order over `dependencies` (hard) + `optionalDependencies`
@@ -581,11 +607,64 @@ declare abstract class ObjectKernelBase {
      */
     protected runPluginDestroy(plugin: Plugin): Promise<void>;
     /**
-     * Trigger a hook with all registered handlers
+     * Trigger a hook with all registered handlers, ISOLATING failures: a
+     * handler that throws is logged and the remaining handlers still run.
+     *
+     * Use this for hooks where one subscriber's failure must not deny the
+     * others their turn — notification-style hooks, and `kernel:shutdown`,
+     * where the handlers still queued behind the failing one are the cleanup
+     * that flushes buffers and releases resources (#5257).
+     *
+     * It is the WRONG dispatcher for anything on the BOOT path. Every hook
+     * dispatched before "✅ Bootstrap complete" is a precondition of that
+     * claim, so swallowing a throw there does not rescue the boot — it only
+     * hides the failure behind a process that reports success. Those hooks
+     * (`kernel:ready`, `kernel:bootstrapped`, `kernel:listening`) use
+     * {@link triggerHookOrThrow} (#5170, #5257).
+     *
      * @param name - Hook name
      * @param args - Arguments to pass to handlers
      */
     protected triggerHook(name: string, ...args: any[]): Promise<void>;
+    /**
+     * Trigger a hook with all registered handlers, PROPAGATING the first
+     * failure: the remaining handlers do not run and the original error
+     * reaches the caller unwrapped.
+     *
+     * This is the dispatch semantics `ObjectKernel` has always had for every
+     * lifecycle hook (its `context.trigger` is a bare awaited loop that never
+     * catches). `LiteKernel` used the isolating {@link triggerHook} for all of
+     * them, so one hook name meant two opposite things depending on which
+     * kernel booted the same plugin code (#5170).
+     *
+     * `LiteKernel` now uses this dispatcher for all three BOOT-path hooks:
+     *
+     * - `kernel:ready` (#5170) — the only correct moment for a plugin to
+     *   assert that the preconditions it declared were actually met (the
+     *   registries are still filling during `init()`), so "declared but not
+     *   deliverable ⇒ refuse to boot" gates live there. On LiteKernel, which
+     *   is what vitest/serverless/edge run, they were downgraded to an error
+     *   log while the process carried on serving traffic without the
+     *   guarantee it claimed.
+     * - `kernel:bootstrapped` and `kernel:listening` (#5257) — the same
+     *   argument one hook later. `kernel:listening` is where HTTP server
+     *   plugins open their socket, so a swallowed failure there produced the
+     *   worst shape available: a live process printing "✅ Bootstrap complete"
+     *   with nothing listening. `kernel:bootstrapped` carries reconcile and
+     *   audit passes whose silent failure is a quieter version of the same
+     *   lie.
+     *
+     * Deliberately NOT applied to `kernel:shutdown`, which keeps
+     * {@link triggerHook}: on the teardown path a failing handler must not
+     * block the cleanup queued behind it. That is a per-hook judgement
+     * recorded at the dispatch site in `lite-kernel.ts`, not an inherited
+     * default — and it is the reason this dispatcher is chosen per hook rather
+     * than swapped in wholesale.
+     *
+     * @param name - Hook name
+     * @param args - Arguments to pass to handlers
+     */
+    protected triggerHookOrThrow(name: string, ...args: any[]): Promise<void>;
     /**
      * Get current kernel state
      */
@@ -748,315 +827,6 @@ declare class LiteKernel extends ObjectKernelBase {
     isRunning(): boolean;
 }
 
-/**
- * API Registry Service
- *
- * Central registry for managing API endpoints across different protocols.
- * Provides endpoint registration, discovery, and conflict resolution.
- *
- * **Features:**
- * - Multi-protocol support (REST, GraphQL, OData, WebSocket, etc.)
- * - Route conflict detection with configurable resolution strategies
- * - RBAC permission integration
- * - Dynamic schema linking with ObjectQL references
- * - Plugin API registration
- *
- * **Architecture Alignment:**
- * - Kubernetes: Service Discovery & API Server
- * - AWS API Gateway: Unified API Management
- * - Kong Gateway: Plugin-based API Management
- *
- * @example
- * ```typescript
- * const registry = new ApiRegistry(logger, 'priority');
- *
- * // Register an API
- * registry.registerApi({
- *   id: 'customer_api',
- *   name: 'Customer API',
- *   type: 'rest',
- *   version: 'v1',
- *   basePath: '/api/v1/customers',
- *   endpoints: [...]
- * });
- *
- * // Discover APIs
- * const apis = registry.findApis({ type: 'rest', status: 'active' });
- *
- * // Get registry snapshot
- * const snapshot = registry.getRegistry();
- * ```
- */
-declare class ApiRegistry {
-    private apis;
-    private endpoints;
-    private routes;
-    private apisByType;
-    private apisByTag;
-    private apisByStatus;
-    private conflictResolution;
-    private logger;
-    private version;
-    private updatedAt;
-    constructor(logger: Logger, conflictResolution?: ConflictResolutionStrategy, version?: string);
-    /**
-     * Register an API with its endpoints
-     *
-     * @param api - API registry entry
-     * @throws Error if API already registered or route conflicts detected
-     */
-    registerApi(api: ApiRegistryEntryInput): void;
-    /**
-     * Unregister an API and all its endpoints
-     *
-     * @param apiId - API identifier
-     */
-    unregisterApi(apiId: string): void;
-    /**
-     * Register a single endpoint
-     *
-     * @param apiId - API identifier
-     * @param endpoint - Endpoint registration
-     * @throws Error if route conflict detected
-     */
-    private registerEndpoint;
-    /**
-     * Unregister a single endpoint
-     *
-     * @param apiId - API identifier
-     * @param endpointId - Endpoint identifier
-     */
-    private unregisterEndpoint;
-    /**
-     * Register a route with conflict detection
-     *
-     * @param apiId - API identifier
-     * @param endpoint - Endpoint registration
-     * @throws Error if route conflict detected (based on strategy)
-     */
-    private registerRoute;
-    /**
-     * Handle route conflict based on resolution strategy
-     *
-     * @param routeKey - Route key
-     * @param apiId - New API identifier
-     * @param endpoint - New endpoint
-     * @param existingRoute - Existing route registration
-     * @param newPriority - New endpoint priority
-     * @throws Error if strategy is 'error'
-     */
-    private handleRouteConflict;
-    /**
-     * Generate a unique route key for conflict detection
-     *
-     * NOTE: This implementation uses exact string matching for route conflict detection.
-     * It works well for static paths but has limitations with parameterized routes.
-     * For example, `/api/users/:id` and `/api/users/:userId` will NOT be detected as conflicts
-     * even though they are semantically identical parameterized patterns. Similarly,
-     * `/api/:resource/list` and `/api/:entity/list` would also not be detected as conflicting.
-     *
-     * For more advanced conflict detection (e.g., path-to-regexp pattern matching),
-     * consider integrating with your routing library's conflict detection mechanism.
-     *
-     * @param endpoint - Endpoint registration
-     * @returns Route key (e.g., "GET:/api/v1/customers/:id")
-     */
-    private getRouteKey;
-    /**
-     * Validate endpoint registration
-     *
-     * @param endpoint - Endpoint to validate
-     * @param apiId - API identifier (for error messages)
-     * @throws Error if endpoint is invalid
-     */
-    private validateEndpoint;
-    /**
-     * Get an API by ID
-     *
-     * @param apiId - API identifier
-     * @returns API registry entry or undefined
-     */
-    getApi(apiId: string): ApiRegistryEntry | undefined;
-    /**
-     * Get all registered APIs
-     *
-     * @returns Array of all APIs
-     */
-    getAllApis(): ApiRegistryEntry[];
-    /**
-     * Find APIs matching query criteria
-     *
-     * Performance optimized with auxiliary indices for O(1) lookups on type, tags, and status.
-     *
-     * @param query - Discovery query parameters
-     * @returns Matching APIs
-     */
-    findApis(query: ApiDiscoveryQuery): ApiDiscoveryResponse;
-    /**
-     * Get endpoint by API ID and endpoint ID
-     *
-     * @param apiId - API identifier
-     * @param endpointId - Endpoint identifier
-     * @returns Endpoint registration or undefined
-     */
-    getEndpoint(apiId: string, endpointId: string): ApiEndpointRegistration | undefined;
-    /**
-     * Find endpoint by route (method + path)
-     *
-     * @param method - HTTP method
-     * @param path - URL path
-     * @returns Endpoint registration or undefined
-     */
-    findEndpointByRoute(method: string, path: string): {
-        api: ApiRegistryEntry;
-        endpoint: ApiEndpointRegistration;
-    } | undefined;
-    /**
-     * Get complete registry snapshot
-     *
-     * @returns Current registry state
-     */
-    getRegistry(): ApiRegistry$1;
-    /**
-     * Clear all registered APIs
-     *
-     * **⚠️ SAFETY WARNING:**
-     * This method clears all registered APIs and should be used with caution.
-     *
-     * **Usage Restrictions:**
-     * - In production environments (NODE_ENV=production), a `force: true` parameter is required
-     * - Primarily intended for testing and development hot-reload scenarios
-     *
-     * @param options - Clear options
-     * @param options.force - Force clear in production environment (default: false)
-     * @throws Error if called in production without force flag
-     *
-     * @example Safe usage in tests
-     * ```typescript
-     * beforeEach(() => {
-     *   registry.clear(); // OK in test environment
-     * });
-     * ```
-     *
-     * @example Usage in production (requires explicit force)
-     * ```typescript
-     * // In production, explicit force is required
-     * registry.clear({ force: true });
-     * ```
-     */
-    clear(options?: {
-        force?: boolean;
-    }): void;
-    /**
-     * Get registry statistics
-     *
-     * @returns Registry statistics
-     */
-    getStats(): {
-        totalApis: number;
-        totalEndpoints: number;
-        totalRoutes: number;
-        apisByType: Record<string, number>;
-        endpointsByApi: Record<string, number>;
-    };
-    /**
-     * Update auxiliary indices when an API is registered
-     *
-     * @param api - API entry to index
-     * @private
-     * @internal
-     */
-    private updateIndices;
-    /**
-     * Remove API from auxiliary indices when unregistered
-     *
-     * @param api - API entry to remove from indices
-     * @private
-     * @internal
-     */
-    private removeFromIndices;
-    /**
-     * Helper to ensure an index set exists and return it
-     *
-     * @param map - Index map
-     * @param key - Index key
-     * @returns The Set for this key (created if needed)
-     * @private
-     * @internal
-     */
-    private ensureIndexSet;
-    /**
-     * Helper to remove an ID from an index set and clean up empty sets
-     *
-     * @param map - Index map
-     * @param key - Index key
-     * @param id - API ID to remove
-     * @private
-     * @internal
-     */
-    private removeFromIndexSet;
-    /**
-     * Check if running in production environment
-     *
-     * @returns true if NODE_ENV is 'production'
-     * @private
-     * @internal
-     */
-    private isProductionEnvironment;
-}
-
-/**
- * API Registry Plugin Configuration
- */
-interface ApiRegistryPluginConfig {
-    /**
-     * Conflict resolution strategy for route conflicts
-     * @default 'error'
-     */
-    conflictResolution?: ConflictResolutionStrategy;
-    /**
-     * Registry version
-     * @default '1.0.0'
-     */
-    version?: string;
-}
-/**
- * API Registry Plugin
- *
- * Registers the API Registry service in the kernel, making it available
- * to all plugins for endpoint registration and discovery.
- *
- * **Usage:**
- * ```typescript
- * const kernel = new ObjectKernel();
- *
- * // Register API Registry Plugin
- * kernel.use(createApiRegistryPlugin({ conflictResolution: 'priority' }));
- *
- * // In other plugins, access the API Registry
- * const plugin: Plugin = {
- *   name: 'my-plugin',
- *   init: async (ctx) => {
- *     const registry = ctx.getService<ApiRegistry>('api-registry');
- *
- *     // Register plugin APIs
- *     registry.registerApi({
- *       id: 'my_plugin_api',
- *       name: 'My Plugin API',
- *       type: 'rest',
- *       version: 'v1',
- *       basePath: '/api/v1/my-plugin',
- *       endpoints: [...]
- *     });
- *   }
- * };
- * ```
- *
- * @param config - Plugin configuration
- * @returns Plugin instance
- */
-declare function createApiRegistryPlugin(config?: ApiRegistryPluginConfig): Plugin;
-
 /**
  * Interface for executing test actions against a target system.
  * The target could be a local Kernel instance or a remote API.
@@ -2202,7 +1972,49 @@ declare const ANONYMOUS_DENY_STATUS: 401;
 declare const ANONYMOUS_DENY_CODE: "UNAUTHENTICATED";
 /** Human-facing message. */
 declare const ANONYMOUS_DENY_MESSAGE = "Authentication is required to access this endpoint.";
-/** The single 401 body shape every seam returns: `{ error, message }`. */
+/**
+ * The **REST seam's** 401 body — flat `{ error, message }`. NOT the platform's
+ * only one; see the two-envelope table below before you reuse this shape.
+ *
+ * Exactly one consumer writes it: `@objectstack/rest`'s `enforceAuth`
+ * (`rest-server.ts` — `res.status(ANONYMOUS_DENY_STATUS).json(ANONYMOUS_DENY_BODY)`),
+ * which owns the `/data/*` and `/meta` surfaces.
+ *
+ * ## Two live envelopes, one denial (#5632)
+ *
+ * Every HTTP seam shares the DECISION ({@link shouldDenyAnonymous}) and the
+ * semantics ({@link ANONYMOUS_DENY_STATUS} / {@link ANONYMOUS_DENY_CODE} /
+ * {@link ANONYMOUS_DENY_MESSAGE}). What differs is the **wrapper**:
+ *
+ *  - **REST seam** — `@objectstack/rest` `enforceAuth`, this constant, verbatim:
+ *    `{ error: 'UNAUTHENTICATED', message: '…' }`. The code is the value of the
+ *    top-level `error` key; there is no `success` key and no nesting.
+ *  - **Dispatcher seams** — the five runtime domains `domains/ai.ts`,
+ *    `domains/meta.ts`, `domains/security.ts`, `domains/actions.ts` and
+ *    `domains/automation.ts` do NOT use this constant. Each calls
+ *    `deps.error(ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, { code: ANONYMOUS_DENY_CODE })`,
+ *    so the wire body is the dispatcher's standard wrapper:
+ *    `{ success: false, error: { code, message, httpStatus } }`.
+ *
+ * Both shapes are **live and sanctioned** — ADR-0112's 2026-07-30 amendment
+ * (#4007) records the flat and wrapped envelopes as the two live ones, and
+ * assigns retiring one of them to the envelope-convergence line (#3843 family).
+ * Converging them is a breaking wire change; it is not this module's to make,
+ * and this constant must not be read as if it had already happened.
+ *
+ * ## Reading this from a consumer (human or AI author)
+ *
+ * Read the envelope the seam you called DECLARES — flat from `/data` + `/meta`,
+ * wrapped from a dispatcher-mounted surface. Do **not** write a tolerant
+ * `body.error?.code ?? body.error` chain that swallows both: that fallback is
+ * precisely where an envelope regression hides, and this docstring claiming to
+ * be "the single shape every seam returns" is what used to invite it (#5632).
+ *
+ * Both shapes are pinned against a real booted showcase by
+ * `packages/qa/dogfood/test/showcase-anonymous-deny-surfaces.dogfood.test.ts`,
+ * which classifies every anonymous 401 into exactly one of the two families and
+ * fails on a third dialect or on a seam that changes family.
+ */
 declare const ANONYMOUS_DENY_BODY: {
     readonly error: "UNAUTHENTICATED";
     readonly message: "Authentication is required to access this endpoint.";
@@ -3004,9 +2816,28 @@ declare class PluginHealthMonitor {
      */
     shutdown(): void;
     /**
-     * Timeout helper
+     * Race a plugin's custom health check against its timeout guard, and
+     * reclaim the guard the moment the race settles (#4875).
+     *
+     * Same shape, same reasoning as `ObjectKernel.raceStartupTimeout()` (#4813,
+     * PR #4874): the guard used to be armed and then abandoned — when the check
+     * won the race, its `setTimeout` stayed ref'd in the event loop for the full
+     * `config.timeout`. Health checks are *periodic*, so unlike the kernel's
+     * one-shot startup guards the orphans here accumulate: one per plugin per
+     * round, each pinning the loop for `config.timeout`.
+     *
+     * Clearing on settle rather than `unref()`-ing at arm time is deliberate.
+     * An unref'd guard also stops pinning the loop, but it stops being a guard
+     * as well: if the check never settles and nothing else keeps the loop alive,
+     * Node exits before the timer can fire and the timeout is never reported.
+     * The guard has to stay ref'd exactly as long as the race is undecided,
+     * which is what `clearTimeout` in a `finally` expresses.
+     *
+     * `check` is widened to `T | PromiseLike<T>` because `checkMethod` is called
+     * dynamically off the plugin and may be synchronous; such a check wins the
+     * race immediately and the guard is reclaimed on the same turn.
      */
-    private timeout;
+    private raceCheckTimeout;
 }
 
 /**
@@ -3068,6 +2899,29 @@ declare class HotReloadManager {
      * Trigger hot reload for a plugin
      */
     reloadPlugin(pluginName: string, plugin: Plugin, version: string, getPluginState: () => Record<string, any>, restorePluginState: (state: Record<string, any>) => void): Promise<boolean>;
+    /**
+     * Race a plugin's `destroy()` against its shutdown-timeout guard, and
+     * reclaim the guard the moment the race settles (#4952).
+     *
+     * The guard used to be armed and then abandoned — byte-for-byte the leak
+     * #4813 fixed in the kernel's startup guards (PR #4874) and #4875 fixed in
+     * the periodic health checks (PR #4950): when `destroy()` won the race, its
+     * `setTimeout` stayed ref'd in the event loop for the full
+     * `shutdownTimeout`, so a hot reload that finished in milliseconds still
+     * pinned the loop for the whole budget — once per reload, per plugin.
+     *
+     * Clearing on settle rather than `unref()`-ing at arm time is deliberate.
+     * An unref'd guard also stops pinning the loop, but it stops being a guard
+     * as well: if `destroy()` never settles and nothing else keeps the loop
+     * alive, Node exits before the timer can fire and the timeout is never
+     * reported. The guard has to stay ref'd exactly as long as the race is
+     * undecided, which is what `clearTimeout` in a `finally` expresses.
+     *
+     * `shutdown` is widened to `T | PromiseLike<T>` because the Plugin contract
+     * permits a synchronous `destroy()` (`Promise<void> | void`); such a hook
+     * wins the race immediately and the guard is reclaimed on the same turn.
+     */
+    private raceShutdownTimeout;
     /**
      * Schedule a reload with debouncing
      */
@@ -3222,4 +3076,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type EngineWithTransaction, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type InterruptedRun, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type MigrationChunk, type MigrationChunkContext, MigrationJournalRefusal, type MigrationPlan, type MigrationPlanProvider, MigrationPlanRegistry, type MigrationPlanStep, type MigrationRunResult, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type OrderablePlugin, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, type RunMigrationJournalOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VersionCompatibility, assertInitServiceRequirements, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, describeInitOrderFault, engineCanRollBack, evaluateAuthGate, extractApiKey, filterTokenContextFrom, findInterruptedRuns, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, hashMigrationPlan, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, planChunks, postureVisibleRows, readAuthoredTranslationLayer, readRunJournal, resolveApiKeyPrincipal, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolvePluginOrder, resolveUserAuthzGrants, resumeMigrationJournal, runMigrationJournal, safeExit, shouldDenyAnonymous, signPayload, validateInitServiceContract, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };
+export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type EngineWithTransaction, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type InterruptedRun, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type MigrationChunk, type MigrationChunkContext, MigrationJournalRefusal, type MigrationPlan, type MigrationPlanProvider, MigrationPlanRegistry, type MigrationPlanStep, type MigrationRunResult, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type OrderablePlugin, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, type RunMigrationJournalOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VersionCompatibility, assertInitServiceRequirements, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, describeInitOrderFault, engineCanRollBack, evaluateAuthGate, extractApiKey, filterTokenContextFrom, findInterruptedRuns, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, hashMigrationPlan, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, planChunks, postureVisibleRows, readAuthoredTranslationLayer, readRunJournal, resolveApiKeyPrincipal, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolvePluginOrder, resolveUserAuthzGrants, resumeMigrationJournal, runMigrationJournal, safeExit, shouldDenyAnonymous, signPayload, validateInitServiceContract, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };