@objectstack/core 17.0.0-rc.5 → 17.0.0

package/dist/index.js

@@ -93,6 +93,30 @@ function assertInitServiceRequirements(plugin, isServiceRegistered) {
   }
 }
 
+// src/hook-dispatch.ts
+function traceDispatch(name, handlers, logger) {
+  logger.debug(`Triggering hook: ${name}`, {
+    hook: name,
+    handlerCount: handlers.length
+  });
+}
+async function dispatchHookIsolating(name, handlers, logger, args = []) {
+  traceDispatch(name, handlers, logger);
+  for (const handler of handlers) {
+    try {
+      await handler(...args);
+    } catch (error) {
+      logger.error(`Hook handler failed: ${name}`, error);
+    }
+  }
+}
+async function dispatchHookPropagating(name, handlers, logger, args = []) {
+  if (logger) traceDispatch(name, handlers, logger);
+  for (const handler of handlers) {
+    await handler(...args);
+  }
+}
+
 // src/kernel-base.ts
 var ObjectKernelBase = class {
   constructor(logger) {
@@ -172,11 +196,11 @@ var ObjectKernelBase = class {
         }
         this.hooks.get(name).push(handler);
       },
+      // PROPAGATING dispatch, and deliberately WITHOUT the trace line the
+      // kernel's own dispatch sites emit — `context.trigger` has never
+      // logged one, so no logger is handed over (#5282).
       trigger: async (name, ...args) => {
-        const handlers = this.hooks.get(name) || [];
-        for (const handler of handlers) {
-          await handler(...args);
-        }
+        await dispatchHookPropagating(name, this.hooks.get(name) || [], void 0, args);
       },
       getServices: () => {
         if (this.services instanceof Map) {
@@ -295,22 +319,16 @@ var ObjectKernelBase = class {
    * (`kernel:ready`, `kernel:bootstrapped`, `kernel:listening`) use
    * {@link triggerHookOrThrow} (#5170, #5257).
    *
+   * The loop itself lives in {@link dispatchHookIsolating} — one
+   * implementation shared with `ObjectKernel`'s own `kernel:shutdown`
+   * dispatch, which cannot inherit this method (`ObjectKernel` does not
+   * extend this class) and used to hand-mirror it (#5282).
+   *
    * @param name - Hook name
    * @param args - Arguments to pass to handlers
    */
   async triggerHook(name, ...args) {
-    const handlers = this.hooks.get(name) || [];
-    this.logger.debug(`Triggering hook: ${name}`, {
-      hook: name,
-      handlerCount: handlers.length
-    });
-    for (const handler of handlers) {
-      try {
-        await handler(...args);
-      } catch (error) {
-        this.logger.error(`Hook handler failed: ${name}`, error);
-      }
-    }
+    await dispatchHookIsolating(name, this.hooks.get(name) || [], this.logger, args);
   }
   /**
    * Trigger a hook with all registered handlers, PROPAGATING the first
@@ -347,18 +365,15 @@ var ObjectKernelBase = class {
    * default — and it is the reason this dispatcher is chosen per hook rather
    * than swapped in wholesale.
    *
+   * The loop itself lives in {@link dispatchHookPropagating} — the same
+   * function `PluginContext.trigger` runs on both kernels, so "propagating"
+   * means one thing repo-wide (#5282).
+   *
    * @param name - Hook name
    * @param args - Arguments to pass to handlers
    */
   async triggerHookOrThrow(name, ...args) {
-    const handlers = this.hooks.get(name) || [];
-    this.logger.debug(`Triggering hook: ${name}`, {
-      hook: name,
-      handlerCount: handlers.length
-    });
-    for (const handler of handlers) {
-      await handler(...args);
-    }
+    await dispatchHookPropagating(name, this.hooks.get(name) || [], this.logger, args);
   }
   /**
    * Get current kernel state
@@ -494,7 +509,15 @@ var ObjectLogger = class _ObjectLogger {
       redact: config.redact ?? ["password", "token", "secret", "key"],
       sourceLocation: config.sourceLocation ?? false,
       file: config.file,
-      rotation: config.rotation ?? { maxSize: "10m", maxFiles: 5 }
+      // Per-key, because `LoggerConfig` is the AUTHOR state (ADR-0122): the
+      // schema defaults `maxSize`/`maxFiles` *inside* `rotation`, so a caller
+      // may legitimately write `{ rotation: { maxSize: '5m' } }` and this
+      // constructor — which does not parse — has to fill the other half the
+      // same way `LoggerConfigSchema.parse` would.
+      rotation: {
+        maxSize: config.rotation?.maxSize ?? "10m",
+        maxFiles: config.rotation?.maxFiles ?? 5
+      }
     };
     this.bindings = bindings;
     this.redactPatterns = this.config.redact.map(tokenizeFieldName).filter((words) => words.length > 0);
@@ -1362,6 +1385,7 @@ function createMemoryJob() {
 }
 
 // src/fallbacks/memory-i18n.ts
+import { normalizeSupportedLocales } from "@objectstack/spec/system";
 function deepMerge(target, source) {
   const result = { ...target };
   for (const key of Object.keys(source)) {
@@ -1395,6 +1419,7 @@ function createMemoryI18n() {
   const translations = /* @__PURE__ */ new Map();
   const authored = /* @__PURE__ */ new Map();
   let defaultLocale = "en";
+  let supportedLocales;
   function resolveKey(data, key) {
     const parts = key.split(".");
     let current = data;
@@ -1460,9 +1485,29 @@ function createMemoryI18n() {
         authored.set(locale, { ...data });
       }
     },
+    /**
+     * Report the locales this stack offers.
+     *
+     * [#7679] When the app declared `i18n.supportedLocales`, that declaration
+     * IS the answer — in declared order, and including a declared locale no
+     * bundle was ever loaded for (declared-but-unserved). Reporting the
+     * declaration rather than an intersection is what gives a client the
+     * signal that the locale it is being offered has nothing behind it yet;
+     * quietly dropping it would leave the gap invisible on both sides. It is
+     * also the only answer that does not depend on how much had loaded by the
+     * time this was called.
+     *
+     * With nothing declared, the loaded set — the behaviour every app that
+     * never opted in already has.
+     */
     getLocales() {
+      if (supportedLocales) return [...supportedLocales];
       return [.../* @__PURE__ */ new Set([...translations.keys(), ...authored.keys()])];
     },
+    /** @see II18nService.setSupportedLocales — [#7679] */
+    setSupportedLocales(locales) {
+      supportedLocales = normalizeSupportedLocales(locales);
+    },
     getDefaultLocale() {
       return defaultLocale;
     },
@@ -1472,14 +1517,42 @@ function createMemoryI18n() {
   };
 }
 
+// src/metadata-service-contract.ts
+import { pluralToSingular } from "@objectstack/spec/shared";
+var REGISTER_REFUSAL_CODE = "VALIDATION_ERROR";
+function canonicalMetadataServiceType(type) {
+  return pluralToSingular(type);
+}
+function registerRefusal(message) {
+  const err = new Error(message);
+  err.code = REGISTER_REFUSAL_CODE;
+  err.status = 400;
+  return err;
+}
+function assertMetadataRegisterContract(type, name, data) {
+  if (typeof data !== "object" || data === null || Array.isArray(data)) {
+    const shape = data === null ? "null" : Array.isArray(data) ? "an array" : `a ${typeof data}`;
+    throw registerRefusal(
+      `IMetadataService.register('${type}', '${name}'): data is ${shape}, not a metadata document. register() stores plain-object documents only \u2014 accepting a value the service cannot key was measured as accept-then-drop on document-keyed stores (#7378 row 3: refuse loudly, never coerce into storability). Wrap the value in a document object whose shape the '${type}' type's schema accepts, or store it under a type that declares one.`
+    );
+  }
+  const documentName = data.name;
+  if (documentName !== void 0 && documentName !== name) {
+    throw registerRefusal(
+      `IMetadataService.register('${type}', '${name}'): data.name is '${String(documentName)}', which disagrees with the name argument '${name}'. A disagreement is almost always an authoring bug, and resolving it silently in either direction can file the item under a key the caller never wrote (#7378 row 1: refuse loudly, locate the mismatch). Register under one name: pass the intended key as the argument and make data.name match it, or omit data.name.`
+    );
+  }
+}
+
 // src/fallbacks/memory-metadata.ts
 function createMemoryMetadata() {
   const store = /* @__PURE__ */ new Map();
   function getTypeMap(type) {
-    let map = store.get(type);
+    const canonical = canonicalMetadataServiceType(type);
+    let map = store.get(canonical);
     if (!map) {
       map = /* @__PURE__ */ new Map();
-      store.set(type, map);
+      store.set(canonical, map);
     }
     return map;
   }
@@ -1494,6 +1567,7 @@ function createMemoryMetadata() {
     },
     _serviceName: "metadata",
     async register(type, name, data) {
+      assertMetadataRegisterContract(type, name, data);
       getTypeMap(type).set(name, data);
     },
     // Mirror MetadataManager.registerInMemory (synchronous, no persistence).
@@ -1505,7 +1579,11 @@ function createMemoryMetadata() {
     // so `defineStack({ datasources })` entries silently never reached the
     // registry and were absent from GET /api/v1/datasources and
     // GET /api/v1/meta/datasource (ADR-0015 §18). This store is already
-    // in-memory only, so registerInMemory and register share an implementation.
+    // in-memory only, so registerInMemory and register share a store — but
+    // NOT the [#7378] refusals: the ruling names `register`, and this member
+    // is a boot-time seeding primitive for source-control-owned artefacts
+    // (see assertMetadataRegisterContract's header for the boundary). It does
+    // share the row-2 canonical type fold, via getTypeMap.
     registerInMemory(type, name, data) {
       getTypeMap(type).set(name, data);
     },
@@ -1729,11 +1807,12 @@ var ObjectKernel = class {
         }
         this.hooks.get(name).push(handler);
       },
+      // PROPAGATING dispatch — the same shared loop `LiteKernel`'s
+      // context.trigger runs, and deliberately WITHOUT a trace line:
+      // `context.trigger` has never emitted one on either kernel, so no
+      // logger is handed over (#5282).
       trigger: async (name, ...args) => {
-        const handlers = this.hooks.get(name) || [];
-        for (const handler of handlers) {
-          await handler(...args);
-        }
+        await dispatchHookPropagating(name, this.hooks.get(name) || [], void 0, args);
       },
       getServices: () => {
         return new Map(this.services);
@@ -2157,27 +2236,21 @@ var ObjectKernel = class {
    * one bad handler must not amplify into leaked resources and unflushed
    * writes. Same reasoning, same wording, same `Hook handler failed:
    * kernel:shutdown` log line as `LiteKernel`'s dispatch site, which reaches
-   * the shared isolating dispatcher `ObjectKernelBase.triggerHook` (#5257).
+   * the isolating dispatcher through `ObjectKernelBase.triggerHook` (#5257).
    *
-   * `ObjectKernel` cannot call that dispatcher: it does not extend
+   * Until #5282 "same wording" was literally that — the loop was typed out a
+   * second time here, because `ObjectKernel` does not extend
    * `ObjectKernelBase` (only `LiteKernel` does) and owns its own `hooks` map,
-   * so the semantics are mirrored here rather than shared. One hook name
-   * meaning two opposite things across the two kernels is exactly the bug
-   * #5170/#5257 closed, so the pin for this one lives on both sides too.
+   * so the base's `protected triggerHook` is out of reach. The loop now lives
+   * in {@link dispatchHookIsolating}, which BOTH sides call: the storage is
+   * still two maps (deliberately — unifying it was out of #5282's scope), but
+   * "isolating" is one implementation, so it can no longer drift on one
+   * kernel while the other keeps the old shape. That drift is exactly the bug
+   * #5170 / #5257 / #5274 each closed one hook at a time, and the paired-pin
+   * gate (`scripts/check-kernel-hook-pairs.mjs`) covers the residue.
    */
   async triggerShutdownHookIsolating() {
-    const handlers = this.hooks.get("kernel:shutdown") || [];
-    this.logger.debug("Triggering hook: kernel:shutdown", {
-      hook: "kernel:shutdown",
-      handlerCount: handlers.length
-    });
-    for (const handler of handlers) {
-      try {
-        await handler();
-      } catch (error) {
-        this.logger.error("Hook handler failed: kernel:shutdown", error);
-      }
-    }
+    await dispatchHookIsolating("kernel:shutdown", this.hooks.get("kernel:shutdown") || [], this.logger);
   }
   async performShutdown() {
     await this.triggerShutdownHookIsolating();
@@ -2345,6 +2418,20 @@ __export(qa_exports, {
 });
 
 // src/qa/runner.ts
+function describeActualType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function containsInapplicableHint(actual) {
+  if (actual === void 0) {
+    return "The path resolved to nothing \u2014 the field is absent from the result, or the path is misspelled. Use 'is_null' if asserting absence is what you meant.";
+  }
+  if (actual === null) {
+    return "The path resolved to null. Use 'is_null' if asserting absence is what you meant.";
+  }
+  return "'contains' tests array membership and string substrings only. Use 'equals' to compare a scalar, or point the field at the array or string you meant to look inside.";
+}
 var TestRunner = class {
   constructor(adapter) {
     this.adapter = adapter;
@@ -2472,6 +2559,10 @@ var TestRunner = class {
           if (!actual.includes(expected)) throw new Error(`Assertion failed: ${assertion.field} array does not contain ${expected}`);
         } else if (typeof actual === "string") {
           if (!actual.includes(String(expected))) throw new Error(`Assertion failed: ${assertion.field} string does not contain ${expected}`);
+        } else {
+          throw new Error(
+            `Assertion failed: ${assertion.field} cannot be evaluated by 'contains' \u2014 expected an array or a string at that path, got ${describeActualType(actual)}. ` + containsInapplicableHint(actual)
+          );
         }
         break;
       case "not_null":
@@ -2488,11 +2579,29 @@ var TestRunner = class {
 };
 
 // src/qa/http-adapter.ts
+import { RestApiConfigSchema, CrudEndpointsConfigSchema } from "@objectstack/spec/api";
+var dataPathCache;
+function defaultDataPath() {
+  if (dataPathCache === void 0) {
+    const api = RestApiConfigSchema.parse({});
+    const crud = CrudEndpointsConfigSchema.parse({});
+    dataPathCache = `${api.apiPath ?? `${api.basePath}/${api.version}`}${crud.dataPrefix}`;
+  }
+  return dataPathCache;
+}
 var HttpTestAdapter = class {
   constructor(baseUrl, authToken) {
     this.baseUrl = baseUrl;
     this.authToken = authToken;
   }
+  /** `{baseUrl}{apiBasePath}{dataPrefix}/{object}` — the collection URL. */
+  collectionUrl(objectName) {
+    return `${this.baseUrl}${defaultDataPath()}/${encodeURIComponent(objectName)}`;
+  }
+  /** `{collection}/{id}` — the single-record URL. */
+  recordUrl(objectName, id) {
+    return `${this.collectionUrl(objectName)}/${encodeURIComponent(String(id))}`;
+  }
   async execute(action, _context) {
     const headers = {
       "Content-Type": "application/json"
@@ -2524,7 +2633,7 @@ var HttpTestAdapter = class {
     }
   }
   async createRecord(objectName, data, headers) {
-    const response = await fetch(`${this.baseUrl}/api/data/${objectName}`, {
+    const response = await fetch(this.collectionUrl(objectName), {
       method: "POST",
       headers,
       body: JSON.stringify(data)
@@ -2532,19 +2641,19 @@ var HttpTestAdapter = class {
     return this.handleResponse(response);
   }
   async updateRecord(objectName, data, headers) {
-    const id = data.id;
+    const { id, ...fields } = data;
     if (!id) throw new Error("Update record requires id in payload");
-    const response = await fetch(`${this.baseUrl}/api/data/${objectName}/${id}`, {
-      method: "PUT",
+    const response = await fetch(this.recordUrl(objectName, id), {
+      method: "PATCH",
       headers,
-      body: JSON.stringify(data)
+      body: JSON.stringify(fields)
     });
     return this.handleResponse(response);
   }
   async deleteRecord(objectName, data, headers) {
     const id = data.id;
     if (!id) throw new Error("Delete record requires id in payload");
-    const response = await fetch(`${this.baseUrl}/api/data/${objectName}/${id}`, {
+    const response = await fetch(this.recordUrl(objectName, id), {
       method: "DELETE",
       headers
     });
@@ -2553,14 +2662,14 @@ var HttpTestAdapter = class {
   async readRecord(objectName, data, headers) {
     const id = data.id;
     if (!id) throw new Error("Read record requires id in payload");
-    const response = await fetch(`${this.baseUrl}/api/data/${objectName}/${id}`, {
+    const response = await fetch(this.recordUrl(objectName, id), {
       method: "GET",
       headers
     });
     return this.handleResponse(response);
   }
   async queryRecords(objectName, data, headers) {
-    const response = await fetch(`${this.baseUrl}/api/data/${objectName}/query`, {
+    const response = await fetch(`${this.collectionUrl(objectName)}/query`, {
       method: "POST",
       headers,
       body: JSON.stringify(data)
@@ -4357,7 +4466,116 @@ async function resolveLocalizationContext(input) {
   };
 }
 
+// src/security/assemble-execution-context.ts
+var ENTRY_EXECUTION_CONTEXT_FIELDS = [
+  "positions",
+  "permissions",
+  "systemPermissions",
+  "isSystem",
+  "principalKind",
+  "onBehalfOf",
+  "audience",
+  "userId",
+  "tenantId",
+  "email",
+  "accessToken",
+  "tabPermissions",
+  "posture",
+  "authGate",
+  "org_user_ids",
+  "accessible_org_ids",
+  "oauthScopes",
+  "timezone",
+  "locale",
+  "currency"
+];
+function emit(fields) {
+  const ctx = {};
+  for (const key of ENTRY_EXECUTION_CONTEXT_FIELDS) {
+    const value = fields[key];
+    if (value !== void 0) ctx[key] = value;
+  }
+  return ctx;
+}
+function entryFields(input, anonymous) {
+  const { authz, oauth, localization, requestLocale, accessToken, authGate } = input;
+  const agent = !anonymous && oauth?.clientId ? oauth : void 0;
+  return {
+    // [ADR-0090 D9/D10] Principal taxonomy at the HTTP entry: a session-backed
+    // request is a human principal; a sessionless one is a guest, holding the
+    // built-in `guest` position implicitly and exclusively. Internal engine
+    // calls that construct bare contexts never pass through here, so the
+    // security plugin's empty-context skip path keeps its meaning.
+    positions: agent ? [] : anonymous ? ["guest"] : authz.positions,
+    permissions: agent ? agent.scopePermissions : authz.permissions,
+    // [ADR-0090 D10] System capabilities on the agent principal gate business
+    // ACTION invocation (`actionPermissionError` reads `ctx.systemPermissions`)
+    // — a door SEPARATE from the object CRUD/FLS/RLS intersection, which is
+    // driven by the resolved ceiling SETS (they carry no caps, so cap-gated
+    // OBJECT access stays denied to the agent regardless of this line). The
+    // `actions:execute` scope IS the user's consent to let this agent invoke
+    // actions on their behalf; without it the agent holds none.
+    systemPermissions: agent ? agent.delegatesActions ? authz.systemPermissions ?? [] : [] : authz.systemPermissions,
+    isSystem: false,
+    principalKind: agent ? "agent" : anonymous ? "guest" : "human",
+    onBehalfOf: agent ? { userId: authz.userId, principalKind: "human" } : void 0,
+    // [ADR-0090 D10/D11 — P1 shape] No transport resolves an external
+    // (portal/partner) audience yet; `undefined` reads as 'internal'. Named
+    // here rather than excluded so the gap is visible in the closed set instead
+    // of being invisible outside it — when an external principal type lands,
+    // this is the line that must change, on every face at once.
+    audience: void 0,
+    userId: authz.userId,
+    tenantId: authz.tenantId,
+    email: authz.email,
+    accessToken,
+    tabPermissions: authz.tabPermissions,
+    // [ADR-0095 D2 / #2947] The derived posture rung, carried so every
+    // transport presents enforcement the SAME value. Present only for an
+    // authenticated principal (guest → absent).
+    posture: authz.posture,
+    // [ADR-0069 / #7280] The AUTHENTICATION-policy gate, carried for the seam
+    // that reads it off the envelope (REST's `enforceAuth`). Anonymous → never:
+    // a guest has no authenticated session for a policy gate to attach to, so
+    // "gated guest" is not a state this entry can emit even if a face passed
+    // one.
+    authGate: anonymous ? void 0 : authGate,
+    /** Fellow-org user IDs for RLS scoping of identity tables. */
+    org_user_ids: authz.org_user_ids,
+    // [ADR-0105 D2] The caller's org access set — the `group` posture's Layer 0
+    // wall reads it directly, so every transport must carry it (#6206).
+    accessible_org_ids: authz.accessible_org_ids,
+    // OAuth provenance: surface the token's granted scopes so the MCP
+    // dispatcher can narrow the exposed tool families (undefined for every
+    // other provenance = not scope-limited).
+    oauthScopes: oauth && authz.userId === oauth.userId ? oauth.scopes : void 0,
+    // Anonymous → no localization (no scope to resolve against); the engine
+    // default stands. [#3957] The request's OWN language preference wins over
+    // the workspace default, so a rejection message is not rendered in English
+    // beside the Chinese label of the very field it names.
+    timezone: anonymous ? void 0 : localization?.timezone,
+    locale: anonymous ? void 0 : requestLocale ?? localization?.locale,
+    currency: anonymous ? void 0 : localization?.currency
+  };
+}
+function assembleExecutionContext(input) {
+  if (!input.authz.userId) return void 0;
+  return emit(entryFields(input, false));
+}
+function assembleExecutionContextOrGuest(input) {
+  return emit(entryFields(input, !input.authz.userId));
+}
+
 // src/security/auth-gate.ts
+var DEFAULT_AUTH_GATE_MESSAGE = "Access is blocked by an authentication policy.";
+function normalizeAuthGate(sessionUser) {
+  const gate = sessionUser?.authGate;
+  if (!gate || typeof gate.code !== "string") return null;
+  return {
+    code: gate.code,
+    message: typeof gate.message === "string" && gate.message ? gate.message : DEFAULT_AUTH_GATE_MESSAGE
+  };
+}
 var ALLOW_PREFIXES = ["/api/v1/auth/", "/api/auth/", "/auth/"];
 var ALLOW_SUFFIXES = ["/health", "/ready", "/discovery", "/me/apps", "/me/localization"];
 function isAuthGateAllowlisted(rawPath) {
@@ -4376,13 +4594,10 @@ function isAuthGateAllowlisted(rawPath) {
   return false;
 }
 function evaluateAuthGate(sessionUser, path) {
-  const gate = sessionUser?.authGate;
-  if (!gate || typeof gate.code !== "string") return null;
+  const gate = normalizeAuthGate(sessionUser);
+  if (!gate) return null;
   if (isAuthGateAllowlisted(path)) return null;
-  return {
-    code: gate.code,
-    message: typeof gate.message === "string" && gate.message ? gate.message : "Access is blocked by an authentication policy."
-  };
+  return gate;
 }
 
 // src/security/anonymous-deny.ts
@@ -4404,6 +4619,29 @@ function shouldDenyAnonymous(input) {
   return true;
 }
 
+// src/security/audience-binding-suggestion-status.ts
+var AUDIENCE_BINDING_SUGGESTION_STATUSES = {
+  pending: true,
+  confirmed: true,
+  dismissed: true
+};
+var AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES = Object.keys(
+  AUDIENCE_BINDING_SUGGESTION_STATUSES
+);
+var isAudienceBindingSuggestionStatus = (value) => Object.prototype.hasOwnProperty.call(AUDIENCE_BINDING_SUGGESTION_STATUSES, value);
+var unknownAudienceBindingSuggestionStatusMessage = (value) => `Unknown status filter '${value}' \u2014 expected one of: ${AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES.join(", ")}`;
+
+// src/security/operation-private-keys.ts
+var OPERATION_PRIVATE_KEY_PREFIX = "__";
+function withoutOperationPrivateKeys(exec) {
+  const out = {};
+  for (const [key, value] of Object.entries(exec)) {
+    if (key.startsWith(OPERATION_PRIVATE_KEY_PREFIX)) continue;
+    out[key] = value;
+  }
+  return out;
+}
+
 // src/utils/datetime.ts
 import { nextUtcCalendarDay, utcInstantMs } from "@objectstack/spec/data";
 function calendarPartsInTz(d, tz) {
@@ -4646,6 +4884,27 @@ async function bulkWrite(rows, opts) {
   return results;
 }
 
+// src/utils/internal-write-response.ts
+function collectInternalWriteResponseFields(schema) {
+  const fields = schema?.fields;
+  if (!fields || typeof fields !== "object") return [];
+  const out = [];
+  for (const [name, def] of Object.entries(fields)) {
+    if (def && def.internal === true) out.push(name);
+  }
+  return out;
+}
+function omitInternalFieldsFromWriteResponse(schema, records) {
+  if (!records) return;
+  const internalFields = collectInternalWriteResponseFields(schema);
+  if (internalFields.length === 0) return;
+  const list = Array.isArray(records) ? records : [records];
+  for (const row of list) {
+    if (!row || typeof row !== "object") continue;
+    for (const field of internalFields) delete row[field];
+  }
+}
+
 // src/utils/migration-journal.ts
 import { createHash as createHash2, randomUUID } from "crypto";
 import {
@@ -5241,6 +5500,15 @@ function filterTokenContextFrom(execCtx, now) {
   };
 }
 
+// src/utils/record-not-found.ts
+function recordNotFoundError(object, id) {
+  const err = new Error(`Record ${id} not found in ${object}`);
+  err.code = "RECORD_NOT_FOUND";
+  err.status = 404;
+  err.object = object;
+  return err;
+}
+
 // src/health-monitor.ts
 var PluginHealthMonitor = class {
   constructor(logger) {
@@ -6223,13 +6491,17 @@ export {
   ANONYMOUS_DENY_MESSAGE,
   ANONYMOUS_DENY_STATUS,
   API_KEY_PREFIX,
+  AUDIENCE_BINDING_SUGGESTION_STATUSES,
+  AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES,
   CORE_FALLBACK_FACTORIES,
   DependencyResolver,
+  ENTRY_EXECUTION_CONTEXT_FIELDS,
   HotReloadManager,
   LiteKernel,
   MigrationJournalRefusal,
   MigrationPlanRegistry,
   NamespaceResolver,
+  OPERATION_PRIVATE_KEY_PREFIX,
   ObjectKernel,
   ObjectKernelBase,
   ObjectLogger,
@@ -6251,12 +6523,17 @@ export {
   ServiceLifecycle,
   UnknownFilterTokenError,
   UnresolvedFilterTokenError,
+  assembleExecutionContext,
+  assembleExecutionContextOrGuest,
   assertInitServiceRequirements,
+  assertMetadataRegisterContract,
   bucketKeyToCalendarRange,
   buildPermissionsFromGrants,
   bulkWrite,
   calendarPartsInTz,
   calendarPartsInTzOrUtc,
+  canonicalMetadataServiceType,
+  collectInternalWriteResponseFields,
   counterSignPayload,
   createLogger,
   createMemoryCache,
@@ -6281,18 +6558,22 @@ export {
   getMemoryUsage,
   hashApiKey,
   hashMigrationPlan,
+  isAudienceBindingSuggestionStatus,
   isAuthGateAllowlisted,
   isExpired,
   isGrantActive,
   isGrantExpired,
   isNode,
   nextUtcCalendarDay,
+  normalizeAuthGate,
+  omitInternalFieldsFromWriteResponse,
   parseScopes,
   parseSignature,
   planChunks,
   postureVisibleRows,
   readAuthoredTranslationLayer,
   readRunJournal,
+  recordNotFoundError,
   resolveApiKeyPrincipal,
   resolveAuthzContext,
   resolveFilterToken,
@@ -6306,6 +6587,7 @@ export {
   safeExit,
   shouldDenyAnonymous,
   signPayload,
+  unknownAudienceBindingSuggestionStatusMessage,
   utcInstantMs,
   validateInitServiceContract,
   verifyPayload,
@@ -6314,6 +6596,7 @@ export {
   verifyPublisherSignature,
   wireAuthoredTranslationSync,
   withTransientRetry,
+  withoutOperationPrivateKeys,
   zonedDateStartToUtcMs
 };
 //# sourceMappingURL=index.js.map