@objectstack/core 17.0.0-rc.6 → 17.0.0

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { Logger, LifecycleEventName, IServiceRegistry, IObjectQLEngine } from '@objectstack/spec/contracts';
+import { Logger, LifecycleEventName, IServiceRegistry, AudienceBindingSuggestionFilter, IObjectQLEngine } from '@objectstack/spec/contracts';
 export { EngineSchemaRegistryView, EngineTransactionInfo, EngineTransactionOptions, IDataDriver, IDataEngine, IHttpRequest, IHttpResponse, IHttpServer, IObjectQLEngine, Logger, Middleware, RouteHandler } from '@objectstack/spec/contracts';
 import { z } from 'zod';
 import { LoggerConfig, MigrationOnCrashPolicy, MigrationJournalEvent } from '@objectstack/spec/system';
@@ -883,6 +883,10 @@ declare class HttpTestAdapter implements TestExecutionAdapter {
     private baseUrl;
     private authToken?;
     constructor(baseUrl: string, authToken?: string | undefined);
+    /** `{baseUrl}{apiBasePath}{dataPrefix}/{object}` — the collection URL. */
+    private collectionUrl;
+    /** `{collection}/{id}` — the single-record URL. */
+    private recordUrl;
     execute(action: QA.TestAction, _context: Record<string, unknown>): Promise<unknown>;
     private createRecord;
     private updateRecord;
@@ -2312,6 +2316,48 @@ declare function isGrantActive(row: GrantValidityWindow | null | undefined, nowM
  */
 declare function isGrantExpired(row: GrantValidityWindow | null | undefined, nowMs: number): boolean;
 
+/**
+ * [#7678] The `?status=` vocabulary of the audience-binding suggestion list
+ * (ADR-0090 D5/D9) — ONE owner for a rule that had exactly one implementation
+ * and two seams needing it.
+ *
+ * The predicate was written for the runtime dispatcher's `/security` domain and
+ * lived there, private. The **live** REST route
+ * (`rest-server.ts` → `registerSecurityEndpoints`) is a second seam onto the
+ * same service call and never had it, so `?status=garbage` reached the service,
+ * matched no row, and answered **200 with an empty list** — which reads as
+ * "there are no suggestions", a plausible and actionable-looking answer, rather
+ * than "your filter was not a status". That silent arm is the defect; the two
+ * seams disagreeing about one contract is the cause.
+ *
+ * So this module is the convergence, not a copy: `domains/security.ts` and
+ * `rest-server.ts` both import from here, and the vocabulary — including the
+ * refusal wording — exists once.
+ *
+ * The record is keyed BY the contract type on purpose (carried over from the
+ * original): adding a status to `AudienceBindingSuggestionFilter` leaves a key
+ * missing here and renaming one leaves a key excess, and either way this fails
+ * to compile. A plain `['pending', …]` array would silently drift.
+ */
+
+/** The `status` arm of {@link AudienceBindingSuggestionFilter}, named. */
+type AudienceBindingSuggestionStatus = NonNullable<AudienceBindingSuggestionFilter['status']>;
+/** The accepted `?status=` values, keyed by the contract type (see module note). */
+declare const AUDIENCE_BINDING_SUGGESTION_STATUSES: Record<AudienceBindingSuggestionStatus, true>;
+/**
+ * The same vocabulary as a list — for refusal messages, and for tests that must
+ * enumerate every valid value FROM the type rather than hand-picking one.
+ */
+declare const AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES: readonly AudienceBindingSuggestionStatus[];
+/**
+ * Is `value` one of the three statuses the contract declares? Case-sensitive on
+ * purpose — the contract's values are lowercase, so `PENDING` is not a status
+ * and gets the same refusal as `garbage`.
+ */
+declare const isAudienceBindingSuggestionStatus: (value: string) => value is AudienceBindingSuggestionStatus;
+/** The refusal wording, shared so both seams answer an unknown status identically. */
+declare const unknownAudienceBindingSuggestionStatusMessage: (value: string) => string;
+
 /**
  * [#7284] The `__` operation-private-key convention — one owner, on the
  * CONSUMER side.
@@ -2333,8 +2379,10 @@ declare function isGrantExpired(row: GrantValidityWindow | null | undefined, now
  *    `__delegatorReadScope` / `__delegatorWriteScope`, stamped in place by
  *    `security-plugin.ts` (`sc.__readScope = …`);
  *  - the engine's internal privilege markers on the same channel —
- *    `__expandRead` waives the object-level CRUD check for a lookup expansion,
- *    `__referentialFieldClear` the referential-clear write.
+ *    `__expandRead` marks a read as a lookup EXPANSION sub-read (it no longer
+ *    relaxes any gate — #7626 removed that waiver — but it still travels with
+ *    one operation and must not be inherited by another), `__referentialFieldClear`
+ *    authorizes the referential-clear write.
  *
  * plugin-security is the PRODUCER of that vocabulary and would be the most
  * honest owner of the rule for consuming it, but none of the three consumers
@@ -2641,6 +2689,30 @@ declare function withTransientRetry<T>(fn: (attempt: number) => Promise<T>, opts
  */
 declare function bulkWrite<TRow, TRecord = any>(rows: TRow[], opts: BulkWriteOptions<TRow, TRecord>): Promise<BulkWriteRowResult<TRecord>[]>;
 
+/**
+ * Collect the names of fields declared `internal: true` on `schema`.
+ *
+ * Same verdicts as objectql's `collectInternalReadFields` (see the module
+ * header for why it is restated rather than imported): strict `=== true`,
+ * empty result for a missing/field-less schema.
+ */
+declare function collectInternalWriteResponseFields(schema: unknown): string[];
+/**
+ * Drop every `internal: true` field from a write response's record(s), in
+ * place. THE single helper every external write mouth goes through — see the
+ * module header; the three tripwires enforce the "every".
+ *
+ * @param schema  The registered object schema (`engine.registry.getObject(...)`
+ *                / the protocol's own registry view / `metadataService
+ *                .getObject(...)`). An unknown object (no schema) strips
+ *                nothing — the write itself would have been refused upstream
+ *                by the object-existence gate.
+ * @param records A single record, an array of records, or anything a write
+ *                mouth hands back where a record could sit (`null`, a count, a
+ *                boolean): non-objects are skipped, arrays are walked.
+ */
+declare function omitInternalFieldsFromWriteResponse(schema: unknown, records: unknown): void;
+
 /**
  * Can this runtime actually roll back? — the ADR-0119 D4 gate, shared.
  *
@@ -2934,6 +3006,59 @@ declare function resolveFilterTokens<T>(filter: T, ctx?: FilterTokenResolutionCo
  */
 declare function filterTokenContextFrom(execCtx: ExecutionContextLike | undefined, now?: Date): FilterTokenResolutionContext;
 
+/**
+ * [#4435] The 404 a single-record operation answers when the id names no row.
+ *
+ * Extracted so the READ and the two WRITE paths cannot disagree about it. They
+ * did: `getData` answered `404 RECORD_NOT_FOUND` while `updateData` returned
+ * `200 { record: null }` and `deleteData` returned `200 { success: true }` for
+ * any string in the path — so a typo'd id, an already-deleted row and a real
+ * deletion were indistinguishable, and a client PATCHing a concurrently deleted
+ * record was told its write had landed.
+ *
+ * That is the same silent-no-op shape the v17 train removed everywhere else
+ * this window (#4240/#4303/#4315 refuse missing fields, #4169 refuses unknown
+ * params, #4190 stopped dropping filters) — a write that touched zero rows
+ * reporting 200 is that shape one level up, on the verb where it costs the
+ * most.
+ *
+ * [#5138] EXPORTED, for the same "cannot disagree about it" reason one layer
+ * out. `@objectstack/runtime`'s `callData` is protocol-first with an ObjectQL
+ * FALLBACK, and the fallback had reinvented this fact three incompatible ways
+ * (`get` → `null`, `update` → a bare `Error` with no status ⇒ 500, `delete` →
+ * no check at all ⇒ `200 { deleted: true }` for a row that never existed). It
+ * now calls THIS function, so the two paths behind one `callData` answer a
+ * missing id identically — which is the only reason a caller may stop caring
+ * which of them served it. Re-spelling the envelope there would have been a
+ * second not-found envelope; `RECORD_NOT_FOUND` (#5088) is the one this repo
+ * has.
+ *
+ * ── [#7867] Why it lives in `@objectstack/core` and not where it was written ──
+ *
+ * Because the THIRD path that needed it could not reach the second one. An
+ * action body's `ctx.api.object(name).update({ id, … })` traverses neither
+ * `protocol.updateData` nor `callData`: it reaches `ObjectQL.update()`'s by-id
+ * branch directly, which had no existence gate at all, so a ghost id was a
+ * silent no-op that then died on whatever the pipeline complained about first
+ * (a `HookConditionError` 400 on a hooked object, a required-field
+ * `VALIDATION_FAILED` 400 on an unhooked one — the 400 class varied with the
+ * object's declarations; the missing 404 was the constant).
+ *
+ * The gate for that path belongs in the engine, and `packages/objectql` cannot
+ * import `@objectstack/metadata-protocol` where this function was written:
+ * ADR-0076 D2's boundary ratchet (`core-boundary.ratchet.test.ts`) forbids the
+ * whole `@objectstack/objectql/core` closure — `engine.ts` included — from
+ * pulling that package in. So the choice was a FOURTH spelling of the envelope
+ * or one home both layers already depend on. #5138's own sentence rules the
+ * first out, so this is the second: the factory moved down to the lowest
+ * package the three producers share, and `@objectstack/metadata-protocol`
+ * re-exports it unchanged for every existing importer.
+ *
+ * This is the same move `engineCanRollBack` made for the same reason — a fact
+ * two layers must agree on lives in the layer beneath both, not in a copy each.
+ */
+declare function recordNotFoundError(object: string, id: string | number): Error;
+
 /**
  * In-memory Map-backed cache fallback.
  *
@@ -3069,7 +3194,24 @@ declare function createMemoryI18n(): {
      * not a merge — so deleted items/keys stop resolving on the next sync.
      */
     replaceAuthoredTranslations(byLocale: Record<string, Record<string, unknown>>): void;
+    /**
+     * Report the locales this stack offers.
+     *
+     * [#7679] When the app declared `i18n.supportedLocales`, that declaration
+     * IS the answer — in declared order, and including a declared locale no
+     * bundle was ever loaded for (declared-but-unserved). Reporting the
+     * declaration rather than an intersection is what gives a client the
+     * signal that the locale it is being offered has nothing behind it yet;
+     * quietly dropping it would leave the gap invisible on both sides. It is
+     * also the only answer that does not depend on how much had loaded by the
+     * time this was called.
+     *
+     * With nothing declared, the loaded set — the behaviour every app that
+     * never opted in already has.
+     */
     getLocales(): string[];
+    /** @see II18nService.setSupportedLocales — [#7679] */
+    setSupportedLocales(locales: readonly string[] | undefined): void;
     getDefaultLocale(): string;
     setDefaultLocale(locale: string): void;
 };
@@ -3080,6 +3222,13 @@ declare function createMemoryI18n(): {
  * Implements the IMetadataService contract with a simple Map-of-Maps store.
  * Used by ObjectKernel as an automatic fallback when no real metadata plugin
  * (e.g. MetadataPlugin with file-system persistence) is registered.
+ *
+ * [#7378] Carries the ruled register/read argument contract
+ * (`../metadata-service-contract.ts` — the ruling is quoted there):
+ * `register` refuses a `data.name` that disagrees with the `name` argument and
+ * refuses a non-document `data` (rows 1/3), and every type store is keyed on
+ * the CANONICAL type (row 2), so `register('objects', n, d)` and
+ * `get('object', n)` address one store rather than two.
  */
 declare function createMemoryMetadata(): {
     __serviceInfo: {
@@ -3133,6 +3282,37 @@ declare function wireAuthoredTranslationSync(ctx: MinimalCtx): void;
  */
 declare const CORE_FALLBACK_FACTORIES: Record<string, () => Record<string, any>>;
 
+/**
+ * The canonical spelling an `IMetadataService` type store is keyed on
+ * (#7378 row 2). Folds a plural manifest spelling to the singular metadata
+ * type name (`'objects'` → `'object'`, `'views'` → `'view'`, …) through the
+ * platform's one plural↔singular map (`PLURAL_TO_SINGULAR`,
+ * `@objectstack/spec/shared`); a name with no plural mapping — which includes
+ * every canonical singular type — passes through unchanged.
+ */
+declare function canonicalMetadataServiceType(type: string): string;
+/**
+ * Enforce rows 1 and 3 of the #7378 ruling on a
+ * `register(type, name, data)` payload — call it before the first store write,
+ * so a refusal writes nothing anywhere.
+ *
+ * Refuses, with a locating `VALIDATION_ERROR` (status 400):
+ *
+ *  - **a non-document `data`** (row 3): anything that is not a plain object —
+ *    primitives, `null`, arrays. The contract declares `data: unknown`, so
+ *    this is a runtime refusal, not a type error;
+ *  - **a `data.name` that disagrees with the `name` argument** (row 1), in
+ *    either direction. A document with NO `name` of its own is fine — the
+ *    argument is the key, and there is no disagreement to refuse.
+ *
+ * Deliberately NOT called by `registerInMemory`: that optional member is a
+ * boot-time seeding primitive outside the ruled surface (the ruling names
+ * `register`), and its callers hand it artefacts whose shape source control
+ * owns. It shares the row-2 canonical fold — a store key is a store fact, not
+ * a per-member choice — just not the refusals.
+ */
+declare function assertMetadataRegisterContract(type: string, name: string, data: unknown): asserts data is Record<string, unknown>;
+
 /**
  * Plugin Health Monitor
  *
@@ -3450,4 +3630,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, ENTRY_EXECUTION_CONTEXT_FIELDS, type EngineWithTransaction, type EntryExecutionContextField, type EntryLocalization, type ExecutionContextAssemblyInput, type ExecutionContextEntryFields, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type InterruptedRun, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type MigrationChunk, type MigrationChunkContext, MigrationJournalRefusal, type MigrationPlan, type MigrationPlanProvider, MigrationPlanRegistry, type MigrationPlanStep, type MigrationRunResult, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, type OAuthTokenProvenance, OPERATION_PRIVATE_KEY_PREFIX, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type OrderablePlugin, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, type RunMigrationJournalOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VersionCompatibility, assembleExecutionContext, assembleExecutionContextOrGuest, assertInitServiceRequirements, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, describeInitOrderFault, engineCanRollBack, evaluateAuthGate, extractApiKey, filterTokenContextFrom, findInterruptedRuns, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, hashMigrationPlan, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, normalizeAuthGate, parseScopes, parseSignature, planChunks, postureVisibleRows, readAuthoredTranslationLayer, readRunJournal, resolveApiKeyPrincipal, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolvePluginOrder, resolveUserAuthzGrants, resumeMigrationJournal, runMigrationJournal, safeExit, shouldDenyAnonymous, signPayload, validateInitServiceContract, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, withoutOperationPrivateKeys, zonedDateStartToUtcMs };
+export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, AUDIENCE_BINDING_SUGGESTION_STATUSES, AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES, type AnonymousDenyInput, type ApiKeyPrincipal, type AudienceBindingSuggestionStatus, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, ENTRY_EXECUTION_CONTEXT_FIELDS, type EngineWithTransaction, type EntryExecutionContextField, type EntryLocalization, type ExecutionContextAssemblyInput, type ExecutionContextEntryFields, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type InterruptedRun, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type MigrationChunk, type MigrationChunkContext, MigrationJournalRefusal, type MigrationPlan, type MigrationPlanProvider, MigrationPlanRegistry, type MigrationPlanStep, type MigrationRunResult, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, type OAuthTokenProvenance, OPERATION_PRIVATE_KEY_PREFIX, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type OrderablePlugin, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, type RunMigrationJournalOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VersionCompatibility, assembleExecutionContext, assembleExecutionContextOrGuest, assertInitServiceRequirements, assertMetadataRegisterContract, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, canonicalMetadataServiceType, collectInternalWriteResponseFields, counterSignPayload, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, describeInitOrderFault, engineCanRollBack, evaluateAuthGate, extractApiKey, filterTokenContextFrom, findInterruptedRuns, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, hashMigrationPlan, isAudienceBindingSuggestionStatus, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, normalizeAuthGate, omitInternalFieldsFromWriteResponse, parseScopes, parseSignature, planChunks, postureVisibleRows, readAuthoredTranslationLayer, readRunJournal, recordNotFoundError, resolveApiKeyPrincipal, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolvePluginOrder, resolveUserAuthzGrants, resumeMigrationJournal, runMigrationJournal, safeExit, shouldDenyAnonymous, signPayload, unknownAudienceBindingSuggestionStatusMessage, validateInitServiceContract, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, withoutOperationPrivateKeys, zonedDateStartToUtcMs };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { Logger, LifecycleEventName, IServiceRegistry, IObjectQLEngine } from '@objectstack/spec/contracts';
+import { Logger, LifecycleEventName, IServiceRegistry, AudienceBindingSuggestionFilter, IObjectQLEngine } from '@objectstack/spec/contracts';
 export { EngineSchemaRegistryView, EngineTransactionInfo, EngineTransactionOptions, IDataDriver, IDataEngine, IHttpRequest, IHttpResponse, IHttpServer, IObjectQLEngine, Logger, Middleware, RouteHandler } from '@objectstack/spec/contracts';
 import { z } from 'zod';
 import { LoggerConfig, MigrationOnCrashPolicy, MigrationJournalEvent } from '@objectstack/spec/system';
@@ -883,6 +883,10 @@ declare class HttpTestAdapter implements TestExecutionAdapter {
     private baseUrl;
     private authToken?;
     constructor(baseUrl: string, authToken?: string | undefined);
+    /** `{baseUrl}{apiBasePath}{dataPrefix}/{object}` — the collection URL. */
+    private collectionUrl;
+    /** `{collection}/{id}` — the single-record URL. */
+    private recordUrl;
     execute(action: QA.TestAction, _context: Record<string, unknown>): Promise<unknown>;
     private createRecord;
     private updateRecord;
@@ -2312,6 +2316,48 @@ declare function isGrantActive(row: GrantValidityWindow | null | undefined, nowM
  */
 declare function isGrantExpired(row: GrantValidityWindow | null | undefined, nowMs: number): boolean;
 
+/**
+ * [#7678] The `?status=` vocabulary of the audience-binding suggestion list
+ * (ADR-0090 D5/D9) — ONE owner for a rule that had exactly one implementation
+ * and two seams needing it.
+ *
+ * The predicate was written for the runtime dispatcher's `/security` domain and
+ * lived there, private. The **live** REST route
+ * (`rest-server.ts` → `registerSecurityEndpoints`) is a second seam onto the
+ * same service call and never had it, so `?status=garbage` reached the service,
+ * matched no row, and answered **200 with an empty list** — which reads as
+ * "there are no suggestions", a plausible and actionable-looking answer, rather
+ * than "your filter was not a status". That silent arm is the defect; the two
+ * seams disagreeing about one contract is the cause.
+ *
+ * So this module is the convergence, not a copy: `domains/security.ts` and
+ * `rest-server.ts` both import from here, and the vocabulary — including the
+ * refusal wording — exists once.
+ *
+ * The record is keyed BY the contract type on purpose (carried over from the
+ * original): adding a status to `AudienceBindingSuggestionFilter` leaves a key
+ * missing here and renaming one leaves a key excess, and either way this fails
+ * to compile. A plain `['pending', …]` array would silently drift.
+ */
+
+/** The `status` arm of {@link AudienceBindingSuggestionFilter}, named. */
+type AudienceBindingSuggestionStatus = NonNullable<AudienceBindingSuggestionFilter['status']>;
+/** The accepted `?status=` values, keyed by the contract type (see module note). */
+declare const AUDIENCE_BINDING_SUGGESTION_STATUSES: Record<AudienceBindingSuggestionStatus, true>;
+/**
+ * The same vocabulary as a list — for refusal messages, and for tests that must
+ * enumerate every valid value FROM the type rather than hand-picking one.
+ */
+declare const AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES: readonly AudienceBindingSuggestionStatus[];
+/**
+ * Is `value` one of the three statuses the contract declares? Case-sensitive on
+ * purpose — the contract's values are lowercase, so `PENDING` is not a status
+ * and gets the same refusal as `garbage`.
+ */
+declare const isAudienceBindingSuggestionStatus: (value: string) => value is AudienceBindingSuggestionStatus;
+/** The refusal wording, shared so both seams answer an unknown status identically. */
+declare const unknownAudienceBindingSuggestionStatusMessage: (value: string) => string;
+
 /**
  * [#7284] The `__` operation-private-key convention — one owner, on the
  * CONSUMER side.
@@ -2333,8 +2379,10 @@ declare function isGrantExpired(row: GrantValidityWindow | null | undefined, now
  *    `__delegatorReadScope` / `__delegatorWriteScope`, stamped in place by
  *    `security-plugin.ts` (`sc.__readScope = …`);
  *  - the engine's internal privilege markers on the same channel —
- *    `__expandRead` waives the object-level CRUD check for a lookup expansion,
- *    `__referentialFieldClear` the referential-clear write.
+ *    `__expandRead` marks a read as a lookup EXPANSION sub-read (it no longer
+ *    relaxes any gate — #7626 removed that waiver — but it still travels with
+ *    one operation and must not be inherited by another), `__referentialFieldClear`
+ *    authorizes the referential-clear write.
  *
  * plugin-security is the PRODUCER of that vocabulary and would be the most
  * honest owner of the rule for consuming it, but none of the three consumers
@@ -2641,6 +2689,30 @@ declare function withTransientRetry<T>(fn: (attempt: number) => Promise<T>, opts
  */
 declare function bulkWrite<TRow, TRecord = any>(rows: TRow[], opts: BulkWriteOptions<TRow, TRecord>): Promise<BulkWriteRowResult<TRecord>[]>;
 
+/**
+ * Collect the names of fields declared `internal: true` on `schema`.
+ *
+ * Same verdicts as objectql's `collectInternalReadFields` (see the module
+ * header for why it is restated rather than imported): strict `=== true`,
+ * empty result for a missing/field-less schema.
+ */
+declare function collectInternalWriteResponseFields(schema: unknown): string[];
+/**
+ * Drop every `internal: true` field from a write response's record(s), in
+ * place. THE single helper every external write mouth goes through — see the
+ * module header; the three tripwires enforce the "every".
+ *
+ * @param schema  The registered object schema (`engine.registry.getObject(...)`
+ *                / the protocol's own registry view / `metadataService
+ *                .getObject(...)`). An unknown object (no schema) strips
+ *                nothing — the write itself would have been refused upstream
+ *                by the object-existence gate.
+ * @param records A single record, an array of records, or anything a write
+ *                mouth hands back where a record could sit (`null`, a count, a
+ *                boolean): non-objects are skipped, arrays are walked.
+ */
+declare function omitInternalFieldsFromWriteResponse(schema: unknown, records: unknown): void;
+
 /**
  * Can this runtime actually roll back? — the ADR-0119 D4 gate, shared.
  *
@@ -2934,6 +3006,59 @@ declare function resolveFilterTokens<T>(filter: T, ctx?: FilterTokenResolutionCo
  */
 declare function filterTokenContextFrom(execCtx: ExecutionContextLike | undefined, now?: Date): FilterTokenResolutionContext;
 
+/**
+ * [#4435] The 404 a single-record operation answers when the id names no row.
+ *
+ * Extracted so the READ and the two WRITE paths cannot disagree about it. They
+ * did: `getData` answered `404 RECORD_NOT_FOUND` while `updateData` returned
+ * `200 { record: null }` and `deleteData` returned `200 { success: true }` for
+ * any string in the path — so a typo'd id, an already-deleted row and a real
+ * deletion were indistinguishable, and a client PATCHing a concurrently deleted
+ * record was told its write had landed.
+ *
+ * That is the same silent-no-op shape the v17 train removed everywhere else
+ * this window (#4240/#4303/#4315 refuse missing fields, #4169 refuses unknown
+ * params, #4190 stopped dropping filters) — a write that touched zero rows
+ * reporting 200 is that shape one level up, on the verb where it costs the
+ * most.
+ *
+ * [#5138] EXPORTED, for the same "cannot disagree about it" reason one layer
+ * out. `@objectstack/runtime`'s `callData` is protocol-first with an ObjectQL
+ * FALLBACK, and the fallback had reinvented this fact three incompatible ways
+ * (`get` → `null`, `update` → a bare `Error` with no status ⇒ 500, `delete` →
+ * no check at all ⇒ `200 { deleted: true }` for a row that never existed). It
+ * now calls THIS function, so the two paths behind one `callData` answer a
+ * missing id identically — which is the only reason a caller may stop caring
+ * which of them served it. Re-spelling the envelope there would have been a
+ * second not-found envelope; `RECORD_NOT_FOUND` (#5088) is the one this repo
+ * has.
+ *
+ * ── [#7867] Why it lives in `@objectstack/core` and not where it was written ──
+ *
+ * Because the THIRD path that needed it could not reach the second one. An
+ * action body's `ctx.api.object(name).update({ id, … })` traverses neither
+ * `protocol.updateData` nor `callData`: it reaches `ObjectQL.update()`'s by-id
+ * branch directly, which had no existence gate at all, so a ghost id was a
+ * silent no-op that then died on whatever the pipeline complained about first
+ * (a `HookConditionError` 400 on a hooked object, a required-field
+ * `VALIDATION_FAILED` 400 on an unhooked one — the 400 class varied with the
+ * object's declarations; the missing 404 was the constant).
+ *
+ * The gate for that path belongs in the engine, and `packages/objectql` cannot
+ * import `@objectstack/metadata-protocol` where this function was written:
+ * ADR-0076 D2's boundary ratchet (`core-boundary.ratchet.test.ts`) forbids the
+ * whole `@objectstack/objectql/core` closure — `engine.ts` included — from
+ * pulling that package in. So the choice was a FOURTH spelling of the envelope
+ * or one home both layers already depend on. #5138's own sentence rules the
+ * first out, so this is the second: the factory moved down to the lowest
+ * package the three producers share, and `@objectstack/metadata-protocol`
+ * re-exports it unchanged for every existing importer.
+ *
+ * This is the same move `engineCanRollBack` made for the same reason — a fact
+ * two layers must agree on lives in the layer beneath both, not in a copy each.
+ */
+declare function recordNotFoundError(object: string, id: string | number): Error;
+
 /**
  * In-memory Map-backed cache fallback.
  *
@@ -3069,7 +3194,24 @@ declare function createMemoryI18n(): {
      * not a merge — so deleted items/keys stop resolving on the next sync.
      */
     replaceAuthoredTranslations(byLocale: Record<string, Record<string, unknown>>): void;
+    /**
+     * Report the locales this stack offers.
+     *
+     * [#7679] When the app declared `i18n.supportedLocales`, that declaration
+     * IS the answer — in declared order, and including a declared locale no
+     * bundle was ever loaded for (declared-but-unserved). Reporting the
+     * declaration rather than an intersection is what gives a client the
+     * signal that the locale it is being offered has nothing behind it yet;
+     * quietly dropping it would leave the gap invisible on both sides. It is
+     * also the only answer that does not depend on how much had loaded by the
+     * time this was called.
+     *
+     * With nothing declared, the loaded set — the behaviour every app that
+     * never opted in already has.
+     */
     getLocales(): string[];
+    /** @see II18nService.setSupportedLocales — [#7679] */
+    setSupportedLocales(locales: readonly string[] | undefined): void;
     getDefaultLocale(): string;
     setDefaultLocale(locale: string): void;
 };
@@ -3080,6 +3222,13 @@ declare function createMemoryI18n(): {
  * Implements the IMetadataService contract with a simple Map-of-Maps store.
  * Used by ObjectKernel as an automatic fallback when no real metadata plugin
  * (e.g. MetadataPlugin with file-system persistence) is registered.
+ *
+ * [#7378] Carries the ruled register/read argument contract
+ * (`../metadata-service-contract.ts` — the ruling is quoted there):
+ * `register` refuses a `data.name` that disagrees with the `name` argument and
+ * refuses a non-document `data` (rows 1/3), and every type store is keyed on
+ * the CANONICAL type (row 2), so `register('objects', n, d)` and
+ * `get('object', n)` address one store rather than two.
  */
 declare function createMemoryMetadata(): {
     __serviceInfo: {
@@ -3133,6 +3282,37 @@ declare function wireAuthoredTranslationSync(ctx: MinimalCtx): void;
  */
 declare const CORE_FALLBACK_FACTORIES: Record<string, () => Record<string, any>>;
 
+/**
+ * The canonical spelling an `IMetadataService` type store is keyed on
+ * (#7378 row 2). Folds a plural manifest spelling to the singular metadata
+ * type name (`'objects'` → `'object'`, `'views'` → `'view'`, …) through the
+ * platform's one plural↔singular map (`PLURAL_TO_SINGULAR`,
+ * `@objectstack/spec/shared`); a name with no plural mapping — which includes
+ * every canonical singular type — passes through unchanged.
+ */
+declare function canonicalMetadataServiceType(type: string): string;
+/**
+ * Enforce rows 1 and 3 of the #7378 ruling on a
+ * `register(type, name, data)` payload — call it before the first store write,
+ * so a refusal writes nothing anywhere.
+ *
+ * Refuses, with a locating `VALIDATION_ERROR` (status 400):
+ *
+ *  - **a non-document `data`** (row 3): anything that is not a plain object —
+ *    primitives, `null`, arrays. The contract declares `data: unknown`, so
+ *    this is a runtime refusal, not a type error;
+ *  - **a `data.name` that disagrees with the `name` argument** (row 1), in
+ *    either direction. A document with NO `name` of its own is fine — the
+ *    argument is the key, and there is no disagreement to refuse.
+ *
+ * Deliberately NOT called by `registerInMemory`: that optional member is a
+ * boot-time seeding primitive outside the ruled surface (the ruling names
+ * `register`), and its callers hand it artefacts whose shape source control
+ * owns. It shares the row-2 canonical fold — a store key is a store fact, not
+ * a per-member choice — just not the refusals.
+ */
+declare function assertMetadataRegisterContract(type: string, name: string, data: unknown): asserts data is Record<string, unknown>;
+
 /**
  * Plugin Health Monitor
  *
@@ -3450,4 +3630,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, ENTRY_EXECUTION_CONTEXT_FIELDS, type EngineWithTransaction, type EntryExecutionContextField, type EntryLocalization, type ExecutionContextAssemblyInput, type ExecutionContextEntryFields, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type InterruptedRun, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type MigrationChunk, type MigrationChunkContext, MigrationJournalRefusal, type MigrationPlan, type MigrationPlanProvider, MigrationPlanRegistry, type MigrationPlanStep, type MigrationRunResult, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, type OAuthTokenProvenance, OPERATION_PRIVATE_KEY_PREFIX, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type OrderablePlugin, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, type RunMigrationJournalOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VersionCompatibility, assembleExecutionContext, assembleExecutionContextOrGuest, assertInitServiceRequirements, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, describeInitOrderFault, engineCanRollBack, evaluateAuthGate, extractApiKey, filterTokenContextFrom, findInterruptedRuns, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, hashMigrationPlan, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, normalizeAuthGate, parseScopes, parseSignature, planChunks, postureVisibleRows, readAuthoredTranslationLayer, readRunJournal, resolveApiKeyPrincipal, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolvePluginOrder, resolveUserAuthzGrants, resumeMigrationJournal, runMigrationJournal, safeExit, shouldDenyAnonymous, signPayload, validateInitServiceContract, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, withoutOperationPrivateKeys, zonedDateStartToUtcMs };
+export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, AUDIENCE_BINDING_SUGGESTION_STATUSES, AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES, type AnonymousDenyInput, type ApiKeyPrincipal, type AudienceBindingSuggestionStatus, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, ENTRY_EXECUTION_CONTEXT_FIELDS, type EngineWithTransaction, type EntryExecutionContextField, type EntryLocalization, type ExecutionContextAssemblyInput, type ExecutionContextEntryFields, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type InterruptedRun, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type MigrationChunk, type MigrationChunkContext, MigrationJournalRefusal, type MigrationPlan, type MigrationPlanProvider, MigrationPlanRegistry, type MigrationPlanStep, type MigrationRunResult, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, type OAuthTokenProvenance, OPERATION_PRIVATE_KEY_PREFIX, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type OrderablePlugin, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, type RunMigrationJournalOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VersionCompatibility, assembleExecutionContext, assembleExecutionContextOrGuest, assertInitServiceRequirements, assertMetadataRegisterContract, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, canonicalMetadataServiceType, collectInternalWriteResponseFields, counterSignPayload, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, describeInitOrderFault, engineCanRollBack, evaluateAuthGate, extractApiKey, filterTokenContextFrom, findInterruptedRuns, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, hashMigrationPlan, isAudienceBindingSuggestionStatus, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, normalizeAuthGate, omitInternalFieldsFromWriteResponse, parseScopes, parseSignature, planChunks, postureVisibleRows, readAuthoredTranslationLayer, readRunJournal, recordNotFoundError, resolveApiKeyPrincipal, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolvePluginOrder, resolveUserAuthzGrants, resumeMigrationJournal, runMigrationJournal, safeExit, shouldDenyAnonymous, signPayload, unknownAudienceBindingSuggestionStatusMessage, validateInitServiceContract, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, withoutOperationPrivateKeys, zonedDateStartToUtcMs };