@objectstack/core 17.0.0-rc.6 → 17.1.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { Logger, LifecycleEventName, IServiceRegistry, IObjectQLEngine } from '@objectstack/spec/contracts';
-export { EngineSchemaRegistryView, EngineTransactionInfo, EngineTransactionOptions, IDataDriver, IDataEngine, IHttpRequest, IHttpResponse, IHttpServer, IObjectQLEngine, Logger, Middleware, RouteHandler } from '@objectstack/spec/contracts';
+import { Logger, LifecycleEventName, IServiceRegistry, AudienceBindingSuggestionFilter, IObjectQLEngine } from '@objectstack/spec/contracts';
+export { EngineSchemaRegistryView, EngineTransactionInfo, EngineTransactionOptions, HttpResponseObservation, HttpResponseObserver, IDataDriver, IDataEngine, IHttpRequest, IHttpResponse, IHttpServer, IObjectQLEngine, Logger, Middleware, RouteHandler, UNMATCHED_ROUTE_PATTERN } from '@objectstack/spec/contracts';
 import { z } from 'zod';
 import { LoggerConfig, MigrationOnCrashPolicy, MigrationJournalEvent } from '@objectstack/spec/system';
 import { ObjectLogger } from './logger.cjs';
@@ -7,7 +7,7 @@ export { createLogger } from './logger.cjs';
 import * as QA from '@objectstack/spec/qa';
 import { KeyObject } from 'node:crypto';
 import { PluginCapability, PluginPermissions as PluginPermissions$1, PluginPermissionSet, ResourceType, PermissionAction, PluginPermission, SandboxConfig, KernelSecurityScanResult, KernelSecurityVulnerability, ExecutionContext, PluginHealthCheckParsed, PluginHealthStatus as PluginHealthStatus$1, PluginHealthReport, HotReloadConfigParsed, VersionConstraint, DependencyConflict, SemanticVersion, CompatibilityLevel } from '@objectstack/spec/kernel';
-import { AuthzPosture } from '@objectstack/spec/security';
+import { TenancyPosture, AuthzPosture } from '@objectstack/spec/security';
 export { nextUtcCalendarDay, utcInstantMs } from '@objectstack/spec/data';
 
 /**
@@ -222,6 +222,14 @@ declare class ObjectKernel {
     constructor(config?: ObjectKernelConfig);
     /**
      * Register a plugin with enhanced validation
+     *
+     * Duplicate names OVERWRITE, with one `warn` naming both versions — the
+     * declared contract in `plugin-registration.ts`, applied identically by
+     * `LiteKernel.use()` (#9864, maintainer ruling 2026-08-19). The overwrite
+     * itself is unchanged: it is what lets an app config's `plugins` entry
+     * supersede a plugin the CLI auto-registered earlier in the same boot
+     * (#9863). What changes is that it is no longer silent, and no longer
+     * disagrees with the other kernel.
      */
     use(plugin: Plugin): Promise<this>;
     /**
@@ -811,6 +819,17 @@ declare class LiteKernel extends ObjectKernelBase {
     /**
      * Register a plugin
      * @param plugin - Plugin instance
+     *
+     * Duplicate names OVERWRITE, with one `warn` naming both versions — the
+     * declared contract in `plugin-registration.ts`, applied identically by
+     * `ObjectKernel.use()` (#9864, maintainer ruling 2026-08-19).
+     *
+     * This method used to `throw` `[Kernel] Plugin '<name>' already
+     * registered` here while `ObjectKernel` overwrote silently, so one input
+     * had two meanings depending on which kernel was running — and the kernel
+     * that runs in production was the silent one. The ruling converged them on
+     * the behaviour that already works (an app config superseding a plugin the
+     * CLI auto-registered, #9863) and made it audible rather than removing it.
      */
     use(plugin: Plugin): this;
     /**
@@ -882,7 +901,67 @@ declare class TestRunner {
 declare class HttpTestAdapter implements TestExecutionAdapter {
     private baseUrl;
     private authToken?;
+    /**
+     * The single discovery probe of a run, memoised as the in-flight promise so
+     * concurrent record actions share one request rather than racing N.
+     *
+     * `os test` builds ONE adapter for the whole run (`packages/cli/src/commands/
+     * test.ts`) and hands it to every suite, so instance scope IS run scope.
+     */
+    private mountPromise?;
     constructor(baseUrl: string, authToken?: string | undefined);
+    /** The resolved data mount; probes at most once per adapter. */
+    private dataMount;
+    /**
+     * Ask the server where it serves the Data Protocol, and fall back to the
+     * convention — loudly — when it cannot say.
+     *
+     * ## [#7983] What the probe recovers, measured rather than assumed
+     *
+     * `@objectstack/client` answers the same question through discovery
+     * (`getRoute`, `packages/client/src/index.ts`), and this follows it: prefer
+     * the server's own `routes.data`, fall back to the convention. Measured on a
+     * booted stack (REST generator + dispatcher bridge, three configs):
+     *
+     *   | deployment                     | `{apiBase}/discovery` | serves        |
+     *   |--------------------------------|-----------------------|---------------|
+     *   | stock                          | 200 `/api/v1/data`    | `/api/v1/data`|
+     *   | `crud.dataPrefix: '/objects'`  | 200 `/api/v1/objects` | `/api/v1/objects` |
+     *   | `api.apiPath: '/api/2026-01'`  | **404**               | `/api/2026-01/data` |
+     *
+     * So the probe closes the `dataPrefix` row exactly: `RestServer`'s discovery
+     * handler substitutes the configured prefix into `routes.data`, and reading
+     * it is strictly better than recomputing it here. The `apiPath` row it cannot
+     * close, and the reason is structural rather than an oversight — `apiPath`
+     * moves the base that discovery itself is mounted under, so the document that
+     * would name the new mount is behind the very prefix we are missing.
+     *
+     * ⛔ And the one discovery document at a FIXED path does not rescue it:
+     * `/.well-known/objectstack` is mounted at the site root by the dispatcher
+     * bridge, but its `routes.data` is the DISPATCHER's own `${prefix}/data` —
+     * measured as `/api/v1/data` under all three configs above, including the two
+     * where the server serves elsewhere. Falling back to it would turn "we could
+     * not resolve the mount" into "discovery told us `/api/v1/data`": the same
+     * 404, now with a false provenance attached. Not probed, deliberately.
+     *
+     * Hence: one probe, then a diagnostic that NAMES the mount, the evidence and
+     * the remedy. `api_call` takes the path it is given and is unaffected either
+     * way — it stays the escape hatch for a host this cannot reach.
+     */
+    private resolveDataMount;
+    /** `{baseUrl}{dataMount}/{object}` — the collection URL. */
+    private collectionUrl;
+    /** `{collection}/{id}` — the single-record URL. */
+    private recordUrl;
+    /**
+     * The provenance clause appended to a failed record action's error.
+     *
+     * The card this closes is about a 404 that reads like the author's own URL
+     * mistake; the mount is the one fact that distinguishes the two, so it rides
+     * on the failure itself rather than only on a warning printed earlier in the
+     * transcript.
+     */
+    private mountNote;
     execute(action: QA.TestAction, _context: Record<string, unknown>): Promise<unknown>;
     private createRecord;
     private updateRecord;
@@ -1708,9 +1787,74 @@ declare function isExpired(value: unknown, nowMs: number): boolean;
 /** The principal resolved from a valid `sys_api_key`. */
 interface ApiKeyPrincipal {
     userId: string;
+    /**
+     * The organization this key authenticates INTO — read from the row's
+     * `active_organization_id` and adopted by `resolveAuthzContext` as the
+     * request's active organization (`ExecutionContext.tenantId`), which is what
+     * lets the ADR-0105 Layer 0 wall match. `undefined` for a key minted before
+     * #8287, or one minted under the `single` posture where there is no
+     * organization to inherit.
+     */
     tenantId?: string;
     scopes: string[];
 }
+/**
+ * [#8287] Why a key was refused. Distinct from "no key present" and from "this
+ * key is unknown/revoked/expired": a refusal means the credential is real and
+ * intact but cannot be admitted under this deployment's tenancy posture.
+ */
+type ApiKeyRefusalReason = 'organization_required' | 'organization_membership_ended';
+/**
+ * The verdict on an inbound API key. Three outcomes, deliberately distinct:
+ *
+ *  - `none` — no key header, or a key that is unknown / revoked / expired /
+ *    owner-less. Indistinguishable by design (never tell a prober which), and
+ *    the caller MAY fall through to the session path exactly as before.
+ *  - `admitted` — a usable principal.
+ *  - `refused` — a real, intact key the posture cannot admit. The caller must
+ *    NOT fall through to the session path: falling through would be more
+ *    permissive than today's behaviour (an API key already outranks a session),
+ *    and the whole point of the refusal is that it is LOUD at call time.
+ */
+type ApiKeyAdmission = {
+    outcome: 'none';
+} | {
+    outcome: 'admitted';
+    principal: ApiKeyPrincipal;
+} | {
+    outcome: 'refused';
+    reason: ApiKeyRefusalReason;
+    message: string;
+};
+/**
+ * The shape of the kernel's `tenancy` service this module reads a posture from.
+ * Structural on purpose: `@objectstack/core` must not depend on the plugin that
+ * provides it, and an embedding without that plugin simply supplies nothing.
+ */
+interface TenancyPostureSource {
+    posture?: string;
+    isolationActive?: boolean;
+}
+/**
+ * [#8287] Resolve the EFFECTIVE tenancy posture from the kernel's `tenancy`
+ * service — the same reconciliation `plugin-security` performs before handing a
+ * posture to `computeTenantLayer0Filter`, so the wall and the API-key admission
+ * can never disagree about which posture is in force.
+ *
+ * ⚠️ Deliberately NOT `resolveTenancyPosture()` from `@objectstack/types`, which
+ * reads `OS_TENANCY_POSTURE` directly. That answers what the operator ASKED
+ * for, not what is ENFORCED: under ADR-0093 D4/D5 a deployment that requests
+ * `isolated` without the enterprise `@objectstack/organizations` runtime
+ * resolves to `single` and runs with NO organization wall. Reading the env
+ * there would refuse org-less API keys on a deployment whose wall is not even
+ * active — breaking working automation to enforce a boundary that does not
+ * exist. The `tenancy` service is the one place that already knows the
+ * difference.
+ *
+ * Returns `undefined` when no service is available, which callers must treat as
+ * "no posture-conditional refusal" — see {@link resolveApiKeyAdmission}.
+ */
+declare function effectiveTenancyPosture(tenancy: TenancyPostureSource | undefined | null): TenancyPosture | undefined;
 /**
  * Verify an inbound API key against `sys_api_key` and resolve its principal.
  * This is the ONE verify path shared by the dispatcher/MCP and REST surfaces.
@@ -1722,7 +1866,21 @@ interface ApiKeyPrincipal {
  * @param headers Request headers (Web `Headers` or a plain object).
  * @param nowMs   Clock for expiry checks (injectable for tests).
  */
-declare function resolveApiKeyPrincipal(ql: any, headers: any, nowMs?: number): Promise<ApiKeyPrincipal | undefined>;
+declare function resolveApiKeyPrincipal(ql: any, headers: any, nowMs?: number, tenancyPosture?: TenancyPosture): Promise<ApiKeyPrincipal | undefined>;
+/**
+ * [#8287] The full verdict behind {@link resolveApiKeyPrincipal} — same lookup,
+ * but it distinguishes a POSTURE REFUSAL from "no principal".
+ *
+ * `resolveApiKeyPrincipal` collapses `refused` into `undefined` so every
+ * existing caller keeps working and keeps failing closed; a caller that can
+ * report WHY (the shared `resolveAuthzContext`) uses this instead.
+ *
+ * The only refusal decided here is the org-less one, because it needs nothing
+ * but the row and the posture. The ex-member refusal needs the caller's
+ * membership set and is decided in `resolveAuthzContext`, where that set is
+ * already resolved.
+ */
+declare function resolveApiKeyAdmission(ql: any, headers: any, nowMs?: number, tenancyPosture?: TenancyPosture): Promise<ApiKeyAdmission>;
 
 /** The transport-agnostic authorization envelope produced from a request. */
 interface ResolvedAuthzContext {
@@ -1754,6 +1912,24 @@ interface ResolvedAuthzContext {
      * anonymous requests carry no rung.
      */
     posture?: AuthzPosture;
+    /**
+     * [#8287] Set when an inbound API key was REFUSED — a real, intact
+     * credential this deployment's tenancy posture cannot admit. The context is
+     * otherwise EMPTY (no `userId`), so every transport already fails it closed
+     * to 401 with no change; this field only lets a transport that wants to say
+     * WHY do so, instead of answering the operator with a bare "unauthenticated"
+     * for a key they can see is neither revoked nor expired.
+     *
+     * ⚠️ `reason` is NOT an `error.code`. The wire vocabulary is closed
+     * (ADR-0112: `StandardErrorCode ∪ ERROR_CODE_LEDGER`, both in `packages/spec`)
+     * and a refused credential's standard member is `UNAUTHENTICATED`. This is a
+     * diagnostic discriminator for the message, deliberately lowercase so it can
+     * never be mistaken for one.
+     */
+    authRefusal?: {
+        reason: ApiKeyRefusalReason;
+        message: string;
+    };
 }
 interface ResolveAuthzInput {
     /** Data engine (ObjectQL) exposing `find(object, { where, limit, context })`. */
@@ -1768,6 +1944,18 @@ interface ResolveAuthzInput {
     getSession?: (headers: any) => Promise<any> | any;
     /** Clock injection for API-key expiry (tests). */
     nowMs?: number;
+    /**
+     * [#8287] The deployment's EFFECTIVE tenancy posture, as resolved from the
+     * kernel's `tenancy` service (`effectiveTenancyPosture`) — never from
+     * `OS_TENANCY_POSTURE`, which reports what was requested rather than what is
+     * enforced (ADR-0093 D4/D5).
+     *
+     * Supplied by the transport because this resolver is deliberately
+     * kernel-agnostic. OMITTING it disables the two posture-conditional API-key
+     * refusals and leaves behaviour exactly as it was — so an unwired caller is
+     * never made WORSE, only less strict.
+     */
+    tenancyPosture?: TenancyPosture;
 }
 /**
  * Resolve the authorization context for an inbound request. Always resolves —
@@ -2226,12 +2414,16 @@ declare const ANONYMOUS_DENY_CODE: "UNAUTHENTICATED";
 /** Human-facing message. */
 declare const ANONYMOUS_DENY_MESSAGE = "Authentication is required to access this endpoint.";
 /**
- * The **REST seam's** 401 body — flat `{ error, message }`. NOT the platform's
- * only one; see the two-envelope table below before you reuse this shape.
+ * The **REST seam's** 401 body — flat `{ error, code, message }`. NOT the
+ * platform's only one; see the two-envelope table below before you reuse this
+ * shape.
  *
- * Exactly one consumer writes it: `@objectstack/rest`'s `enforceAuth`
- * (`rest-server.ts` — `res.status(ANONYMOUS_DENY_STATUS).json(ANONYMOUS_DENY_BODY)`),
- * which owns the `/data/*` and `/meta` surfaces.
+ * Two consumers write it verbatim, both flat-family seams: `@objectstack/rest`'s
+ * `enforceAuth` (`rest-server.ts` —
+ * `res.status(ANONYMOUS_DENY_STATUS).json(ANONYMOUS_DENY_BODY)`), which owns the
+ * `/data/*` and `/meta` surfaces, and `@objectstack/runtime`'s
+ * `mountRouteOnServer` (`dispatcher-plugin.ts` — the endpoint-route 401 arm,
+ * #9823), which answers declared routes mounted on the HTTP server.
  *
  * ## Two live envelopes, one denial (#5632)
  *
@@ -2240,8 +2432,11 @@ declare const ANONYMOUS_DENY_MESSAGE = "Authentication is required to access thi
  * {@link ANONYMOUS_DENY_MESSAGE}). What differs is the **wrapper**:
  *
  *  - **REST seam** — `@objectstack/rest` `enforceAuth`, this constant, verbatim:
- *    `{ error: 'UNAUTHENTICATED', message: '…' }`. The code is the value of the
- *    top-level `error` key; there is no `success` key and no nesting.
+ *    `{ error: 'UNAUTHENTICATED', code: 'UNAUTHENTICATED', message: '…' }`.
+ *    The machine code lives in the top-level `code` key — the same documented
+ *    key every other REST error family answers (#9487, maintainer-ruled
+ *    ADDITIVE: `error` keeps carrying the code value it always has, so no
+ *    existing reader breaks). There is no `success` key and no nesting.
  *  - **Dispatcher seams** — the five runtime domains `domains/ai.ts`,
  *    `domains/meta.ts`, `domains/security.ts`, `domains/actions.ts` and
  *    `domains/automation.ts` do NOT use this constant. Each calls
@@ -2253,7 +2448,10 @@ declare const ANONYMOUS_DENY_MESSAGE = "Authentication is required to access thi
  * (#4007) records the flat and wrapped envelopes as the two live ones, and
  * assigns retiring one of them to the envelope-convergence line (#3843 family).
  * Converging them is a breaking wire change; it is not this module's to make,
- * and this constant must not be read as if it had already happened.
+ * and this constant must not be read as if it had already happened. The #9487
+ * `code` key does NOT settle that question either way (ADR-0112 D5 stays
+ * open): it aligns the flat family to the `{ error, code }` shape the other
+ * flat REST error families already answer, without moving or removing a key.
  *
  * ## Reading this from a consumer (human or AI author)
  *
@@ -2270,6 +2468,7 @@ declare const ANONYMOUS_DENY_MESSAGE = "Authentication is required to access thi
  */
 declare const ANONYMOUS_DENY_BODY: {
     readonly error: "UNAUTHENTICATED";
+    readonly code: "UNAUTHENTICATED";
     readonly message: "Authentication is required to access this endpoint.";
 };
 interface AnonymousDenyInput {
@@ -2312,6 +2511,156 @@ declare function isGrantActive(row: GrantValidityWindow | null | undefined, nowM
  */
 declare function isGrantExpired(row: GrantValidityWindow | null | undefined, nowMs: number): boolean;
 
+/** A catalogue row that may carry the `active` flag (`sys_permission_set`, `sys_position`). */
+interface ActivatableRow {
+    active?: unknown;
+}
+/**
+ * True unless the row carries an `active` column that is explicitly OFF.
+ *
+ * The ONE predicate every reader of `sys_permission_set.active` /
+ * `sys_position.active` uses, so the resolver that enforces the flag and the
+ * break-glass guard that simulates a write to it can never disagree about what
+ * "deactivated" means.
+ */
+declare function isRowActive(row: ActivatableRow | null | undefined): boolean;
+
+/**
+ * ADMIN_STANDING_SURFACE — what `resolveAuthzContext` READS when it decides
+ * who is an administrator, declared beside the resolver that reads it.
+ *
+ * ## Why this file exists (#8734)
+ *
+ * `plugin-auth`'s break-glass guard (`last-admin-guard.ts`, ADR-0024 D5.2)
+ * decides whether a pending write can empty the administrator population by
+ * testing the payload against three standing-key lists — `MEMBER_STANDING_KEYS`,
+ * `GRANT_STANDING_KEYS`, `PERMISSION_SET_STANDING_KEYS`. Those lists are not an
+ * independent design artifact: they are a CACHE of the columns this resolver
+ * consumes. A payload touching none of them is skipped without any reads, so a
+ * column this resolver starts reading and the guard's list omits is a write
+ * class the guard silently stops judging — the one write class that can lock an
+ * installation out of its own administration, with no in-product recovery.
+ *
+ * Nothing bound the two together. The correspondence was carried by a comment,
+ * and it had already gone false once: #6084 wrote, beside the list, that
+ * everything a permission-set write touches other than `name` — naming `active`
+ * explicitly — is invisible to "who is an administrator". That was true when
+ * written. #8613 made `active` a resolution-time predicate (a DEACTIVATED
+ * `admin_full_access` set confers nothing, §6b below), and the sentence became
+ * false. It was caught by one agent reading the comment closely enough to
+ * notice it contradicted the code being written. Nothing mechanical would have
+ * caught it: the guard's own tests stay green, because the guard is simply never
+ * consulted for that write.
+ *
+ * ## What this file is, and what it is NOT
+ *
+ * It is a MEASUREMENT, not a wish. Its column lists are asserted equal to what
+ * the resolver actually reads at runtime, by
+ * `admin-standing-surface.test.ts`, which drives the real
+ * `resolveAuthzContext` over a recording engine and collects every property
+ * access and every `where` key per table. That is deliberate: a hand-written
+ * list of "columns the derivation reads" is the same artifact as the comment
+ * that went stale, one indirection along. Observation is also the only reading
+ * that survives the derivation moving INTO a helper — `active` is read by
+ * `isRowActive(ps)` and the window bounds by `isGrantActive(row, now)`, neither
+ * of which names a column at the resolver's own call site.
+ *
+ * It is NOT a projection the resolver consumes. `ql.find` here returns whole
+ * rows and the reads are ordinary property accesses on untyped rows, so nothing
+ * in this file can FORCE the resolver to read only what it declares. The force
+ * comes from the observation test: add a read, and this declaration is red
+ * until it is updated; update this declaration, and `plugin-auth`'s
+ * correspondence test is red until every new column is either in a standing-key
+ * list or explicitly excluded with a reason.
+ *
+ * ## Reading the entries
+ *
+ * Every table this resolution path reads is listed — including the ones that
+ * CANNOT confer administrator standing, each with the reason it cannot. That is
+ * the table-level half of the same guarantee: a resolver that starts deriving
+ * administrator standing from a new table would otherwise be invisible to a
+ * column-set comparison, because the new table appears in neither side's list.
+ */
+/** How a table this resolver reads relates to "who is an administrator". */
+interface AdminStandingTable {
+    /**
+     * `derives` — a write to this table can change the administrator population,
+     * so `last-admin-guard.ts` must carry a standing-key list for it.
+     * `reads-only` — this resolver reads the table for something else entirely.
+     */
+    readonly role: 'derives' | 'reads-only';
+    /** Why the row above is the right classification. Prose, but pinned to a measured table. */
+    readonly reason: string;
+    /**
+     * Every column this resolver reads on the table — property accesses and
+     * `where` keys alike, in every spelling it actually touches. Declared for
+     * `derives` tables only; asserted equal to the observed set.
+     */
+    readonly columns?: readonly string[];
+}
+/**
+ * The measured read surface of the administrator derivation.
+ *
+ * Scope, stated so the gate cannot be read as claiming more than it measures:
+ * this is the SESSION/user-id resolution path — `resolveAuthzContext` with a
+ * principal, and therefore all of `resolveUserAuthzGrants`. The API-key
+ * ADMISSION path (`resolveApiKeyAdmission`) is outside it on purpose: it
+ * authenticates a principal and seeds `permissions` with the key's scopes, and
+ * confers no administrator standing of its own — `hasPlatformAdminGrant` (§6b)
+ * is set only from a `sys_permission_set` row reached through an UNSCOPED
+ * `sys_user_permission_set` grant, never from a scope string.
+ */
+declare const ADMIN_STANDING_SURFACE: Readonly<Record<string, AdminStandingTable>>;
+/** The tables a write to which can change who is an administrator. */
+declare function adminStandingTables(): string[];
+/**
+ * The columns this resolver reads on `table`, or `undefined` when the table is
+ * not part of the administrator derivation.
+ */
+declare function adminStandingColumns(table: string): readonly string[] | undefined;
+
+/**
+ * [#7678] The `?status=` vocabulary of the audience-binding suggestion list
+ * (ADR-0090 D5/D9) — ONE owner for a rule that had exactly one implementation
+ * and two seams needing it.
+ *
+ * The predicate was written for the runtime dispatcher's `/security` domain and
+ * lived there, private. The **live** REST route
+ * (`rest-server.ts` → `registerSecurityEndpoints`) is a second seam onto the
+ * same service call and never had it, so `?status=garbage` reached the service,
+ * matched no row, and answered **200 with an empty list** — which reads as
+ * "there are no suggestions", a plausible and actionable-looking answer, rather
+ * than "your filter was not a status". That silent arm is the defect; the two
+ * seams disagreeing about one contract is the cause.
+ *
+ * So this module is the convergence, not a copy: `domains/security.ts` and
+ * `rest-server.ts` both import from here, and the vocabulary — including the
+ * refusal wording — exists once.
+ *
+ * The record is keyed BY the contract type on purpose (carried over from the
+ * original): adding a status to `AudienceBindingSuggestionFilter` leaves a key
+ * missing here and renaming one leaves a key excess, and either way this fails
+ * to compile. A plain `['pending', …]` array would silently drift.
+ */
+
+/** The `status` arm of {@link AudienceBindingSuggestionFilter}, named. */
+type AudienceBindingSuggestionStatus = NonNullable<AudienceBindingSuggestionFilter['status']>;
+/** The accepted `?status=` values, keyed by the contract type (see module note). */
+declare const AUDIENCE_BINDING_SUGGESTION_STATUSES: Record<AudienceBindingSuggestionStatus, true>;
+/**
+ * The same vocabulary as a list — for refusal messages, and for tests that must
+ * enumerate every valid value FROM the type rather than hand-picking one.
+ */
+declare const AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES: readonly AudienceBindingSuggestionStatus[];
+/**
+ * Is `value` one of the three statuses the contract declares? Case-sensitive on
+ * purpose — the contract's values are lowercase, so `PENDING` is not a status
+ * and gets the same refusal as `garbage`.
+ */
+declare const isAudienceBindingSuggestionStatus: (value: string) => value is AudienceBindingSuggestionStatus;
+/** The refusal wording, shared so both seams answer an unknown status identically. */
+declare const unknownAudienceBindingSuggestionStatusMessage: (value: string) => string;
+
 /**
  * [#7284] The `__` operation-private-key convention — one owner, on the
  * CONSUMER side.
@@ -2333,8 +2682,10 @@ declare function isGrantExpired(row: GrantValidityWindow | null | undefined, now
  *    `__delegatorReadScope` / `__delegatorWriteScope`, stamped in place by
  *    `security-plugin.ts` (`sc.__readScope = …`);
  *  - the engine's internal privilege markers on the same channel —
- *    `__expandRead` waives the object-level CRUD check for a lookup expansion,
- *    `__referentialFieldClear` the referential-clear write.
+ *    `__expandRead` marks a read as a lookup EXPANSION sub-read (it no longer
+ *    relaxes any gate — #7626 removed that waiver — but it still travels with
+ *    one operation and must not be inherited by another), `__referentialFieldClear`
+ *    authorizes the referential-clear write.
  *
  * plugin-security is the PRODUCER of that vocabulary and would be the most
  * honest owner of the rule for consuming it, but none of the three consumers
@@ -2464,6 +2815,20 @@ interface CalendarParts {
     month: number;
     day: number;
 }
+/**
+ * A wall clock as a human writes it — calendar day plus an optional
+ * time-of-day, with **no zone attached**. `2026-08-01 06:00:00` is this shape:
+ * it names a reading on a clock, and only a reference timezone turns it into an
+ * instant. Omitted time components default to 0, so {@link CalendarParts} alone
+ * is midnight.
+ */
+interface WallClockParts extends CalendarParts {
+    /** 0-23. */
+    hour?: number;
+    minute?: number;
+    second?: number;
+    millisecond?: number;
+}
 /**
  * The year/month/day an instant falls on in `tz`. Throws if `tz` is not a
  * valid IANA zone (callers treat that as a fall-through to UTC).
@@ -2488,8 +2853,52 @@ declare function calendarPartsInTzOrUtc(d: Date, tz?: string): CalendarParts;
  *
  * Used by date-bucket drill ranges (#1752): a `datetime` field buckets on the
  * reference-tz calendar, so its bucket boundary is that tz's midnight instant.
+ *
+ * Date-only by contract: a `YYYY-MM-DD HH:mm:ss` argument is still `NaN` here.
+ * Callers holding a wall clock with a time-of-day want
+ * {@link zonedWallClockToUtcMs}, which this delegates its zone arithmetic to.
  */
 declare function zonedDateStartToUtcMs(ymd: string, tz?: string): number;
+/**
+ * The UTC instant (epoch ms) at which a **wall clock** reading happens in
+ * reference timezone `tz` — the general inverse of {@link calendarPartsInTz},
+ * of which {@link zonedDateStartToUtcMs} is the midnight special case.
+ *
+ * `2026-08-01 06:00:00` in `Asia/Shanghai` is `2026-07-31T22:00:00Z`: a
+ * different day, month and quarter. That gap is why this direction exists as a
+ * shared primitive at all — bulk import (#8485) reads offset-free spreadsheet
+ * cells, which are wall clocks and nothing more, and `new Date(cell)` resolves
+ * them against the **process** `TZ`, i.e. a host setting rather than the
+ * tenant's configured zone.
+ *
+ * DST-safe: the zone offset is read from the platform tz database via
+ * `Intl.DateTimeFormat` (never hand-computed), and a two-pass resolution settles
+ * the case where the offset differs side-to-side of the target instant. Two
+ * wall clocks are not a bijection with instants, and this function resolves
+ * both degenerate cases to the **earlier candidate instant** — in both, the
+ * final pass reads the offset on the DST side of the transition (measured, not
+ * merely intended — `datetime.test.ts` pins both):
+ *  - a clock reading the zone **skips** (spring forward: `02:30` on a US
+ *    spring-forward day) settles on the *post*-transition offset (EDT, −04),
+ *    which places the instant just **before** the gap: it reads `01:30` EST
+ *    locally, not `03:30` EDT. Note this is the opposite of Temporal's
+ *    `'compatible'` disambiguation, which pushes a gap reading forward;
+ *  - a clock reading that happens **twice** (fall back: `01:30` on a US
+ *    fall-back day) resolves to its first occurrence, the one still on the
+ *    pre-transition DST offset (EDT, −04).
+ *
+ * A spreadsheet cell naming a wall clock that its zone never had is ambiguous
+ * by construction; what matters for an import is that the answer is
+ * deterministic and host-independent, which both branches above are.
+ *
+ * FALLBACK — an unset, `'UTC'`, or invalid `tz` reads the wall clock **as UTC**,
+ * never as the process-local clock. Every caller of this family already degrades
+ * that way ({@link zonedDateStartToUtcMs}, and the export renderer's cell path),
+ * and a host `TZ` fallback would reintroduce exactly the deployment-dependent
+ * instant this primitive exists to remove. A parts object that produces an
+ * invalid date (`NaN` components) returns `NaN`, as `Date.UTC` does.
+ */
+declare function zonedWallClockToUtcMs(parts: WallClockParts, tz?: string): number;
 
 /**
  * Granularity of a canonical date-bucket key. Mirrors `@objectstack/spec`'s
@@ -2641,6 +3050,30 @@ declare function withTransientRetry<T>(fn: (attempt: number) => Promise<T>, opts
  */
 declare function bulkWrite<TRow, TRecord = any>(rows: TRow[], opts: BulkWriteOptions<TRow, TRecord>): Promise<BulkWriteRowResult<TRecord>[]>;
 
+/**
+ * Collect the names of fields declared `internal: true` on `schema`.
+ *
+ * Same verdicts as objectql's `collectInternalReadFields` (see the module
+ * header for why it is restated rather than imported): strict `=== true`,
+ * empty result for a missing/field-less schema.
+ */
+declare function collectInternalWriteResponseFields(schema: unknown): string[];
+/**
+ * Drop every `internal: true` field from a write response's record(s), in
+ * place. THE single helper every external write mouth goes through — see the
+ * module header; the three tripwires enforce the "every".
+ *
+ * @param schema  The registered object schema (`engine.registry.getObject(...)`
+ *                / the protocol's own registry view / `metadataService
+ *                .getObject(...)`). An unknown object (no schema) strips
+ *                nothing — the write itself would have been refused upstream
+ *                by the object-existence gate.
+ * @param records A single record, an array of records, or anything a write
+ *                mouth hands back where a record could sit (`null`, a count, a
+ *                boolean): non-objects are skipped, arrays are walked.
+ */
+declare function omitInternalFieldsFromWriteResponse(schema: unknown, records: unknown): void;
+
 /**
  * Can this runtime actually roll back? — the ADR-0119 D4 gate, shared.
  *
@@ -2934,6 +3367,87 @@ declare function resolveFilterTokens<T>(filter: T, ctx?: FilterTokenResolutionCo
  */
 declare function filterTokenContextFrom(execCtx: ExecutionContextLike | undefined, now?: Date): FilterTokenResolutionContext;
 
+/** Which temporal storage rule a declared field takes. */
+type TemporalComparandKind = 'datetime' | 'date' | 'time';
+/**
+ * The kind a declared field's `type` takes, or `null` for every non-temporal
+ * field.
+ *
+ * The same three-way split `driver-memory`'s `indexTemporalFields` and
+ * `SqlDriver.temporalFieldKind` make, so the door and the drivers cannot
+ * disagree about which fields are temporal at all.
+ */
+declare function temporalComparandKind(fieldType: unknown): TemporalComparandKind | null;
+/**
+ * Is `value` a comparand that a `kind` column's storage rule cannot read?
+ *
+ * `true` ONLY for a non-empty, non-placeholder STRING that the kind's rule
+ * would hand back unchanged. Everything else — a number, a `Date`, `null`, a
+ * `{ $field }` reference, filter structure, the empty string, a `{token}` —
+ * answers `false`, each for a reason recorded in the module note or below.
+ *
+ * A `{placeholder}` is stepped around rather than judged because it is another
+ * layer's vocabulary and that layer already refuses the unknown ones loudly
+ * (`FILTER_TOKEN_UNKNOWN` / 400, with the resolvable tokens listed). Both doors
+ * that call this run BEFORE token resolution, so judging a placeholder here
+ * would refuse `{30_days_ago}` — the platform's own correct spelling, and the
+ * positive control this fix is pinned against.
+ */
+declare function isUninterpretableTemporalComparand(kind: TemporalComparandKind, value: unknown): boolean;
+
+/**
+ * [#4435] The 404 a single-record operation answers when the id names no row.
+ *
+ * Extracted so the READ and the two WRITE paths cannot disagree about it. They
+ * did: `getData` answered `404 RECORD_NOT_FOUND` while `updateData` returned
+ * `200 { record: null }` and `deleteData` returned `200 { success: true }` for
+ * any string in the path — so a typo'd id, an already-deleted row and a real
+ * deletion were indistinguishable, and a client PATCHing a concurrently deleted
+ * record was told its write had landed.
+ *
+ * That is the same silent-no-op shape the v17 train removed everywhere else
+ * this window (#4240/#4303/#4315 refuse missing fields, #4169 refuses unknown
+ * params, #4190 stopped dropping filters) — a write that touched zero rows
+ * reporting 200 is that shape one level up, on the verb where it costs the
+ * most.
+ *
+ * [#5138] EXPORTED, for the same "cannot disagree about it" reason one layer
+ * out. `@objectstack/runtime`'s `callData` is protocol-first with an ObjectQL
+ * FALLBACK, and the fallback had reinvented this fact three incompatible ways
+ * (`get` → `null`, `update` → a bare `Error` with no status ⇒ 500, `delete` →
+ * no check at all ⇒ `200 { deleted: true }` for a row that never existed). It
+ * now calls THIS function, so the two paths behind one `callData` answer a
+ * missing id identically — which is the only reason a caller may stop caring
+ * which of them served it. Re-spelling the envelope there would have been a
+ * second not-found envelope; `RECORD_NOT_FOUND` (#5088) is the one this repo
+ * has.
+ *
+ * ── [#7867] Why it lives in `@objectstack/core` and not where it was written ──
+ *
+ * Because the THIRD path that needed it could not reach the second one. An
+ * action body's `ctx.api.object(name).update({ id, … })` traverses neither
+ * `protocol.updateData` nor `callData`: it reaches `ObjectQL.update()`'s by-id
+ * branch directly, which had no existence gate at all, so a ghost id was a
+ * silent no-op that then died on whatever the pipeline complained about first
+ * (a `HookConditionError` 400 on a hooked object, a required-field
+ * `VALIDATION_FAILED` 400 on an unhooked one — the 400 class varied with the
+ * object's declarations; the missing 404 was the constant).
+ *
+ * The gate for that path belongs in the engine, and `packages/objectql` cannot
+ * import `@objectstack/metadata-protocol` where this function was written:
+ * ADR-0076 D2's boundary ratchet (`core-boundary.ratchet.test.ts`) forbids the
+ * whole `@objectstack/objectql/core` closure — `engine.ts` included — from
+ * pulling that package in. So the choice was a FOURTH spelling of the envelope
+ * or one home both layers already depend on. #5138's own sentence rules the
+ * first out, so this is the second: the factory moved down to the lowest
+ * package the three producers share, and `@objectstack/metadata-protocol`
+ * re-exports it unchanged for every existing importer.
+ *
+ * This is the same move `engineCanRollBack` made for the same reason — a fact
+ * two layers must agree on lives in the layer beneath both, not in a copy each.
+ */
+declare function recordNotFoundError(object: string, id: string | number): Error;
+
 /**
  * In-memory Map-backed cache fallback.
  *
@@ -3069,7 +3583,24 @@ declare function createMemoryI18n(): {
      * not a merge — so deleted items/keys stop resolving on the next sync.
      */
     replaceAuthoredTranslations(byLocale: Record<string, Record<string, unknown>>): void;
+    /**
+     * Report the locales this stack offers.
+     *
+     * [#7679] When the app declared `i18n.supportedLocales`, that declaration
+     * IS the answer — in declared order, and including a declared locale no
+     * bundle was ever loaded for (declared-but-unserved). Reporting the
+     * declaration rather than an intersection is what gives a client the
+     * signal that the locale it is being offered has nothing behind it yet;
+     * quietly dropping it would leave the gap invisible on both sides. It is
+     * also the only answer that does not depend on how much had loaded by the
+     * time this was called.
+     *
+     * With nothing declared, the loaded set — the behaviour every app that
+     * never opted in already has.
+     */
     getLocales(): string[];
+    /** @see II18nService.setSupportedLocales — [#7679] */
+    setSupportedLocales(locales: readonly string[] | undefined): void;
     getDefaultLocale(): string;
     setDefaultLocale(locale: string): void;
 };
@@ -3080,6 +3611,13 @@ declare function createMemoryI18n(): {
  * Implements the IMetadataService contract with a simple Map-of-Maps store.
  * Used by ObjectKernel as an automatic fallback when no real metadata plugin
  * (e.g. MetadataPlugin with file-system persistence) is registered.
+ *
+ * [#7378] Carries the ruled register/read argument contract
+ * (`../metadata-service-contract.ts` — the ruling is quoted there):
+ * `register` refuses a `data.name` that disagrees with the `name` argument and
+ * refuses a non-document `data` (rows 1/3), and every type store is keyed on
+ * the CANONICAL type (row 2), so `register('objects', n, d)` and
+ * `get('object', n)` address one store rather than two.
  */
 declare function createMemoryMetadata(): {
     __serviceInfo: {
@@ -3133,6 +3671,37 @@ declare function wireAuthoredTranslationSync(ctx: MinimalCtx): void;
  */
 declare const CORE_FALLBACK_FACTORIES: Record<string, () => Record<string, any>>;
 
+/**
+ * The canonical spelling an `IMetadataService` type store is keyed on
+ * (#7378 row 2). Folds a plural manifest spelling to the singular metadata
+ * type name (`'objects'` → `'object'`, `'views'` → `'view'`, …) through the
+ * platform's one plural↔singular map (`PLURAL_TO_SINGULAR`,
+ * `@objectstack/spec/shared`); a name with no plural mapping — which includes
+ * every canonical singular type — passes through unchanged.
+ */
+declare function canonicalMetadataServiceType(type: string): string;
+/**
+ * Enforce rows 1 and 3 of the #7378 ruling on a
+ * `register(type, name, data)` payload — call it before the first store write,
+ * so a refusal writes nothing anywhere.
+ *
+ * Refuses, with a locating `VALIDATION_ERROR` (status 400):
+ *
+ *  - **a non-document `data`** (row 3): anything that is not a plain object —
+ *    primitives, `null`, arrays. The contract declares `data: unknown`, so
+ *    this is a runtime refusal, not a type error;
+ *  - **a `data.name` that disagrees with the `name` argument** (row 1), in
+ *    either direction. A document with NO `name` of its own is fine — the
+ *    argument is the key, and there is no disagreement to refuse.
+ *
+ * Deliberately NOT called by `registerInMemory`: that optional member is a
+ * boot-time seeding primitive outside the ruled surface (the ruling names
+ * `register`), and its callers hand it artefacts whose shape source control
+ * owns. It shares the row-2 canonical fold — a store key is a store fact, not
+ * a per-member choice — just not the refusals.
+ */
+declare function assertMetadataRegisterContract(type: string, name: string, data: unknown): asserts data is Record<string, unknown>;
+
 /**
  * Plugin Health Monitor
  *
@@ -3450,4 +4019,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, ENTRY_EXECUTION_CONTEXT_FIELDS, type EngineWithTransaction, type EntryExecutionContextField, type EntryLocalization, type ExecutionContextAssemblyInput, type ExecutionContextEntryFields, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type InterruptedRun, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type MigrationChunk, type MigrationChunkContext, MigrationJournalRefusal, type MigrationPlan, type MigrationPlanProvider, MigrationPlanRegistry, type MigrationPlanStep, type MigrationRunResult, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, type OAuthTokenProvenance, OPERATION_PRIVATE_KEY_PREFIX, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type OrderablePlugin, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, type RunMigrationJournalOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VersionCompatibility, assembleExecutionContext, assembleExecutionContextOrGuest, assertInitServiceRequirements, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, describeInitOrderFault, engineCanRollBack, evaluateAuthGate, extractApiKey, filterTokenContextFrom, findInterruptedRuns, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, hashMigrationPlan, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, normalizeAuthGate, parseScopes, parseSignature, planChunks, postureVisibleRows, readAuthoredTranslationLayer, readRunJournal, resolveApiKeyPrincipal, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolvePluginOrder, resolveUserAuthzGrants, resumeMigrationJournal, runMigrationJournal, safeExit, shouldDenyAnonymous, signPayload, validateInitServiceContract, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, withoutOperationPrivateKeys, zonedDateStartToUtcMs };
+export { ADMIN_STANDING_SURFACE, ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, AUDIENCE_BINDING_SUGGESTION_STATUSES, AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES, type ActivatableRow, type AdminStandingTable, type AnonymousDenyInput, type ApiKeyAdmission, type ApiKeyPrincipal, type ApiKeyRefusalReason, type AudienceBindingSuggestionStatus, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, ENTRY_EXECUTION_CONTEXT_FIELDS, type EngineWithTransaction, type EntryExecutionContextField, type EntryLocalization, type ExecutionContextAssemblyInput, type ExecutionContextEntryFields, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type InterruptedRun, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type MigrationChunk, type MigrationChunkContext, MigrationJournalRefusal, type MigrationPlan, type MigrationPlanProvider, MigrationPlanRegistry, type MigrationPlanStep, type MigrationRunResult, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, type OAuthTokenProvenance, OPERATION_PRIVATE_KEY_PREFIX, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type OrderablePlugin, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, type RunMigrationJournalOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type TemporalComparandKind, type TenancyPostureSource, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VersionCompatibility, type WallClockParts, adminStandingColumns, adminStandingTables, assembleExecutionContext, assembleExecutionContextOrGuest, assertInitServiceRequirements, assertMetadataRegisterContract, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, canonicalMetadataServiceType, collectInternalWriteResponseFields, counterSignPayload, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, describeInitOrderFault, effectiveTenancyPosture, engineCanRollBack, evaluateAuthGate, extractApiKey, filterTokenContextFrom, findInterruptedRuns, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, hashMigrationPlan, isAudienceBindingSuggestionStatus, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, isRowActive, isUninterpretableTemporalComparand, normalizeAuthGate, omitInternalFieldsFromWriteResponse, parseScopes, parseSignature, planChunks, postureVisibleRows, readAuthoredTranslationLayer, readRunJournal, recordNotFoundError, resolveApiKeyAdmission, resolveApiKeyPrincipal, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolvePluginOrder, resolveUserAuthzGrants, resumeMigrationJournal, runMigrationJournal, safeExit, shouldDenyAnonymous, signPayload, temporalComparandKind, unknownAudienceBindingSuggestionStatusMessage, validateInitServiceContract, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, withoutOperationPrivateKeys, zonedDateStartToUtcMs, zonedWallClockToUtcMs };