@objectstack/core 17.2.0 → 17.3.0

package/dist/index.js

@@ -713,138 +713,6 @@ function createLogger(config) {
 // src/kernel.ts
 import { ServiceRequirementDef } from "@objectstack/spec/system";
 
-// src/security/plugin-config-validator.ts
-import { z } from "zod";
-var PluginConfigValidator = class {
-  constructor(logger) {
-    this.logger = logger;
-  }
-  /**
-   * Validate plugin configuration against its Zod schema
-   * 
-   * @param plugin - Plugin metadata with configSchema
-   * @param config - User-provided configuration
-   * @returns Validated and typed configuration
-   * @throws Error with detailed validation errors
-   */
-  validatePluginConfig(plugin, config) {
-    if (!plugin.configSchema) {
-      this.logger.debug(`Plugin ${plugin.name} has no config schema - skipping validation`);
-      return config;
-    }
-    try {
-      const validatedConfig = plugin.configSchema.parse(config);
-      this.logger.debug(`\u2705 Plugin config validated: ${plugin.name}`, {
-        plugin: plugin.name,
-        configKeys: Object.keys(config || {}).length
-      });
-      return validatedConfig;
-    } catch (error) {
-      if (error instanceof z.ZodError) {
-        const formattedErrors = this.formatZodErrors(error);
-        const errorMessage = [
-          `Plugin ${plugin.name} configuration validation failed:`,
-          ...formattedErrors.map((e) => `  - ${e.path}: ${e.message}`)
-        ].join("\n");
-        this.logger.error(errorMessage, void 0, {
-          plugin: plugin.name,
-          errors: formattedErrors
-        });
-        throw new Error(errorMessage);
-      }
-      throw error;
-    }
-  }
-  /**
-   * Validate partial configuration (for incremental updates)
-   * 
-   * @param plugin - Plugin metadata
-   * @param partialConfig - Partial configuration to validate
-   * @returns Validated partial configuration
-   */
-  validatePartialConfig(plugin, partialConfig) {
-    if (!plugin.configSchema) {
-      return partialConfig;
-    }
-    try {
-      const partialSchema = plugin.configSchema.partial();
-      const validatedConfig = partialSchema.parse(partialConfig);
-      this.logger.debug(`\u2705 Partial config validated: ${plugin.name}`);
-      return validatedConfig;
-    } catch (error) {
-      if (error instanceof z.ZodError) {
-        const formattedErrors = this.formatZodErrors(error);
-        const errorMessage = [
-          `Plugin ${plugin.name} partial configuration validation failed:`,
-          ...formattedErrors.map((e) => `  - ${e.path}: ${e.message}`)
-        ].join("\n");
-        throw new Error(errorMessage);
-      }
-      throw error;
-    }
-  }
-  /**
-   * Get default configuration from schema
-   * 
-   * @param plugin - Plugin metadata
-   * @returns Default configuration object
-   */
-  getDefaultConfig(plugin) {
-    if (!plugin.configSchema) {
-      return void 0;
-    }
-    try {
-      const defaults = plugin.configSchema.parse({});
-      this.logger.debug(`Default config extracted: ${plugin.name}`);
-      return defaults;
-    } catch (error) {
-      this.logger.debug(`No default config available: ${plugin.name}`);
-      return void 0;
-    }
-  }
-  /**
-   * Check if configuration is valid without throwing
-   * 
-   * @param plugin - Plugin metadata
-   * @param config - Configuration to check
-   * @returns True if valid, false otherwise
-   */
-  isConfigValid(plugin, config) {
-    if (!plugin.configSchema) {
-      return true;
-    }
-    const result = plugin.configSchema.safeParse(config);
-    return result.success;
-  }
-  /**
-   * Get configuration errors without throwing
-   * 
-   * @param plugin - Plugin metadata
-   * @param config - Configuration to check
-   * @returns Array of validation errors, or empty array if valid
-   */
-  getConfigErrors(plugin, config) {
-    if (!plugin.configSchema) {
-      return [];
-    }
-    const result = plugin.configSchema.safeParse(config);
-    if (result.success) {
-      return [];
-    }
-    return this.formatZodErrors(result.error);
-  }
-  // Private methods
-  formatZodErrors(error) {
-    return error.issues.map((e) => ({
-      path: e.path.join(".") || "root",
-      message: e.message
-    }));
-  }
-};
-function createPluginConfigValidator(logger) {
-  return new PluginConfigValidator(logger);
-}
-
 // src/security/plugin-artifact-signature.ts
 import {
   sign as cryptoSign,
@@ -947,6 +815,20 @@ async function verifyPluginArtifact(input, keys) {
   return { ok: true, publisherVerified: publisher.verified, platformVerified };
 }
 
+// src/service-not-registered.ts
+var SERVICE_NOT_REGISTERED_CODE = "SERVICE_NOT_REGISTERED";
+var SERVICE_NOT_REGISTERED_BRAND = "__objectstackServiceNotRegistered";
+function serviceNotRegisteredError(name) {
+  const err = new Error(`Service '${name}' not found`);
+  err[SERVICE_NOT_REGISTERED_BRAND] = true;
+  err.code = SERVICE_NOT_REGISTERED_CODE;
+  err.serviceName = name;
+  return err;
+}
+function isServiceNotRegisteredError(err) {
+  return typeof err === "object" && err !== null && err[SERVICE_NOT_REGISTERED_BRAND] === true;
+}
+
 // src/plugin-loader.ts
 var ServiceLifecycle = /* @__PURE__ */ ((ServiceLifecycle2) => {
   ServiceLifecycle2["SINGLETON"] = "singleton";
@@ -962,7 +844,6 @@ var PluginLoader = class {
     this.scopedServices = /* @__PURE__ */ new Map();
     this.creating = /* @__PURE__ */ new Set();
     this.logger = logger;
-    this.configValidator = new PluginConfigValidator(logger);
   }
   /**
    * Set the plugin context for service factories
@@ -989,9 +870,6 @@ var PluginLoader = class {
       if (!versionCheck.compatible) {
         throw new Error(`Version incompatible: ${versionCheck.message}`);
       }
-      if (metadata.configSchema) {
-        this.validatePluginConfig(metadata);
-      }
       if (metadata.signature) {
         await this.verifyPluginSignature(metadata);
       }
@@ -1030,7 +908,7 @@ var PluginLoader = class {
     if (!registration) {
       const instance = this.serviceInstances.get(name);
       if (!instance) {
-        throw new Error(`Service '${name}' not found`);
+        throw serviceNotRegisteredError(name);
       }
       return instance;
     }
@@ -1190,16 +1068,6 @@ var PluginLoader = class {
     const semverRegex = /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/;
     return semverRegex.test(version);
   }
-  validatePluginConfig(plugin, config) {
-    if (!plugin.configSchema) {
-      return;
-    }
-    if (config === void 0) {
-      this.logger.debug(`Plugin ${plugin.name} has configuration schema (config validation postponed)`);
-      return;
-    }
-    this.configValidator.validatePluginConfig(plugin, config);
-  }
   async verifyPluginSignature(plugin) {
     if (!plugin.signature) {
       return;
@@ -1489,7 +1357,7 @@ function createMemoryI18n() {
 }
 
 // src/metadata-service-contract.ts
-import { pluralToSingular } from "@objectstack/spec/shared";
+import { pluralToSingular } from "@objectstack/spec/meta-spelling";
 var REGISTER_REFUSAL_CODE = "VALIDATION_ERROR";
 function canonicalMetadataServiceType(type) {
   return pluralToSingular(type);
@@ -2373,6 +2241,67 @@ var ObjectKernel = class {
   }
 };
 
+// src/artifact-packages.ts
+import { ArtifactPackageSchema } from "@objectstack/spec";
+var MAX_REPORTED_ENTRY_ISSUES = 5;
+function refuse(code, message) {
+  const err = new Error(message);
+  err.code = code;
+  err.status = 422;
+  return err;
+}
+function artifactPackageId(manifest) {
+  const id = manifest?.id || manifest?.name;
+  return typeof id === "string" && id !== "" ? id : void 0;
+}
+function resolveArtifactPackageOrder(artifact) {
+  const declared = artifact?.packages;
+  if (declared === void 0 || declared === null) return [artifact];
+  if (!Array.isArray(declared)) {
+    throw refuse(
+      "INVALID_ARTIFACT_PACKAGES",
+      `A release artifact's \`packages\` must be an array of package entries (ADR-0130 D4, \`ArtifactPackageEntrySchema\`), but this artifact carries \`packages\` of type ${typeof declared}. Omit the key entirely for a single-package artifact \u2014 \`manifest\` is retained, not replaced.`
+    );
+  }
+  const nodes = /* @__PURE__ */ new Map();
+  declared.forEach((entry, index) => {
+    const verdict = ArtifactPackageSchema.safeParse(entry);
+    if (!verdict.success) {
+      const issues = verdict.error.issues;
+      const shown = issues.slice(0, MAX_REPORTED_ENTRY_ISSUES);
+      throw refuse(
+        "INVALID_ARTIFACT_PACKAGE_ENTRY",
+        `Release artifact \`packages[${index}]\` is not a package entry (ADR-0130 D4): ` + shown.map((i) => `${i.path.join(".") || "<entry>"}: ${i.message}`).join("; ") + (issues.length > shown.length ? ` (+${issues.length - shown.length} more)` : "") + ". Each entry is a WRAPPER object carrying its package under `manifest:` \u2014 wrap an inlined body as `{ manifest: { \u2026 } }`. The key position is reserved so a future external-segment form is an additive key rather than a reshape. The body under `manifest:` is the ASSEMBLED package body (`AssembledPackageBodySchema`): its `objects` / `datasources` are DEFINITIONS, not the authoring manifest's glob patterns \u2014 a compiled artifact has no files left to glob."
+      );
+    }
+    const manifest = entry.manifest;
+    const id = artifactPackageId(manifest);
+    if (id === void 0) {
+      throw refuse(
+        "INVALID_ARTIFACT_PACKAGE_ENTRY",
+        `Release artifact \`packages[${index}]\` carries a manifest with no usable package id: \`registerApp\` keys the installed package on \`id || name\`, so an entry without either cannot be ordered against its siblings or addressed after install.`
+      );
+    }
+    if (nodes.has(id)) {
+      throw refuse(
+        "DUPLICATE_ARTIFACT_PACKAGE",
+        `Release artifact declares package "${id}" more than once (\`packages[${index}]\` repeats an earlier entry). One artifact carries each package once \u2014 an artifact is one atomic delivery (ADR-0130 D1/D6), not a list with last-writer-wins.`
+      );
+    }
+    nodes.set(id, {
+      // `name` is what `resolvePluginOrder` puts in its diagnostics; the MAP KEY
+      // is what its edges resolve against. Both are the package id, so an error
+      // it raises names the same string the artifact author wrote.
+      name: id,
+      optionalDependencies: Object.keys(
+        manifest.dependencies ?? {}
+      ),
+      manifest
+    });
+  });
+  return resolvePluginOrder(nodes).map((node) => node.manifest);
+}
+
 // src/lite-kernel.ts
 var LiteKernel = class extends ObjectKernelBase {
   constructor(config) {
@@ -3102,6 +3031,55 @@ var PluginSignatureVerifier = class {
   }
 };
 
+// src/security/plugin-artifact-integrity.ts
+import { createHash } from "crypto";
+var SRI_ALGORITHMS = /* @__PURE__ */ new Set(["sha256", "sha384", "sha512"]);
+function sriDigestFor(declared, data) {
+  const dash = declared.indexOf("-");
+  const alg = dash > 0 && SRI_ALGORITHMS.has(declared.slice(0, dash)) ? declared.slice(0, dash) : "sha256";
+  return `${alg}-${createHash(alg).update(data).digest("base64")}`;
+}
+function verifyIntegrity(files, integrity, options = {}) {
+  if (integrity === null || integrity === void 0) {
+    return { ok: true, skipped: true, checked: 0, violations: [] };
+  }
+  const exempt = new Set(options.exempt ?? []);
+  const byPath = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    if (!exempt.has(f.path)) byPath.set(f.path, f.data);
+  }
+  const violations = [];
+  let checked = 0;
+  for (const [path, declaredRaw] of Object.entries(integrity)) {
+    if (exempt.has(path)) continue;
+    const declared = typeof declaredRaw === "string" ? declaredRaw : String(declaredRaw);
+    const data = byPath.get(path);
+    if (data === void 0) {
+      violations.push({ kind: "missing_file", path, declared });
+      continue;
+    }
+    checked++;
+    const actual = sriDigestFor(declared, data);
+    if (actual !== declared) violations.push({ kind: "digest_mismatch", path, declared, actual });
+  }
+  for (const path of [...byPath.keys()].sort()) {
+    if (!Object.prototype.hasOwnProperty.call(integrity, path)) {
+      violations.push({ kind: "extra_file", path });
+    }
+  }
+  return { ok: violations.length === 0, skipped: false, checked, violations };
+}
+function formatIntegrityViolation(v) {
+  switch (v.kind) {
+    case "digest_mismatch":
+      return `${v.path}: digest mismatch \u2014 manifest declares ${v.declared}, artifact bytes hash to ${v.actual}`;
+    case "missing_file":
+      return `${v.path}: declared in the integrity map but absent from the artifact`;
+    case "extra_file":
+      return `${v.path}: present in the artifact but not in the integrity map`;
+  }
+}
+
 // src/security/plugin-permission-enforcer.ts
 var PluginPermissionEnforcer = class {
   constructor(logger) {
@@ -4196,13 +4174,13 @@ var PluginSecurityScanner = class {
 };
 
 // src/security/api-key.ts
-import { createHash, randomBytes } from "crypto";
+import { createHash as createHash2, randomBytes } from "crypto";
 import { postureEnforcesWall, postureUsesUnionScope, normalizeTenancyPosture } from "@objectstack/spec/security";
 var API_KEY_PREFIX = "osk_";
 var API_KEY_ENTROPY_BYTES = 32;
 var VISIBLE_PREFIX_LEN = 12;
 function hashApiKey(raw) {
-  return createHash("sha256").update(raw, "utf8").digest("hex");
+  return createHash2("sha256").update(raw, "utf8").digest("hex");
 }
 function generateApiKey(prefix = API_KEY_PREFIX) {
   const secret = randomBytes(API_KEY_ENTROPY_BYTES).toString("base64url");
@@ -4319,11 +4297,41 @@ function safeJsonParse(s, fallback) {
   }
 }
 
+// src/security/authz-store-unavailable.ts
+var AUTHZ_STORE_UNAVAILABLE_STATUS = 503;
+var AUTHZ_STORE_UNAVAILABLE_CODE = "SERVICE_UNAVAILABLE";
+var AUTHZ_STORE_UNAVAILABLE_MESSAGE = "The authorization store could not be read, so this request's permissions were never determined. This is a server-side outage, not a permission denial.";
+var AUTHZ_STORE_UNAVAILABLE_BRAND = "__objectstackAuthzStoreUnavailable";
+var _a, _b;
+var AuthzStoreUnavailableError = class extends (_b = Error, _a = AUTHZ_STORE_UNAVAILABLE_BRAND, _b) {
+  constructor(object, cause) {
+    super(`${AUTHZ_STORE_UNAVAILABLE_MESSAGE} (failed read: \`${object}\`)`);
+    /** Brand — see the module doc on why this is not `instanceof`. */
+    this[_a] = true;
+    /** ADR-0112 wire code. */
+    this.code = AUTHZ_STORE_UNAVAILABLE_CODE;
+    /** HTTP status a transport should answer. */
+    this.status = AUTHZ_STORE_UNAVAILABLE_STATUS;
+    this.name = "AuthzStoreUnavailableError";
+    this.object = object;
+    if (cause !== void 0) this.cause = cause;
+  }
+};
+function isAuthzStoreUnavailableError(err) {
+  return typeof err === "object" && err !== null && err[AUTHZ_STORE_UNAVAILABLE_BRAND] === true;
+}
+function rethrowAuthzStoreUnavailable(err) {
+  if (isAuthzStoreUnavailableError(err)) throw err;
+  return void 0;
+}
+
 // src/security/resolve-authz-context.ts
+import { isMissingTableError, resolveTenancyPosture } from "@objectstack/types";
 import {
   mapMembershipRole,
   BUILTIN_IDENTITY_PLATFORM_ADMIN,
   ADMIN_FULL_ACCESS,
+  ADMIN_FULL_ACCESS_CAPABILITIES,
   ORGANIZATION_ADMIN_GRANTS
 } from "@objectstack/spec";
 import { postureEnforcesWall as postureEnforcesWall2 } from "@objectstack/spec/security";
@@ -4346,6 +4354,20 @@ function isGrantActive(row, nowMs) {
   if (until !== void 0 && !(nowMs < until)) return false;
   return true;
 }
+function nextGrantValidityBoundary(rows, nowMs) {
+  let next;
+  for (const row of rows) {
+    if (!row) continue;
+    const from = toEpochMs(row.valid_from ?? row.validFrom);
+    const until = toEpochMs(row.valid_until ?? row.validUntil);
+    for (const bound of [from, until]) {
+      if (bound !== void 0 && bound > nowMs && (next === void 0 || bound < next)) {
+        next = bound;
+      }
+    }
+  }
+  return next;
+}
 function isGrantExpired(row, nowMs) {
   if (!row) return false;
   const until = toEpochMs(row.valid_until ?? row.validUntil);
@@ -4353,6 +4375,227 @@ function isGrantExpired(row, nowMs) {
   return !(nowMs < until);
 }
 
+// src/security/authz-cache-posture.ts
+var AUTHZ_GRANTS_CACHE_TTL_ENV = "OS_AUTHZ_GRANTS_CACHE_TTL_MS";
+function resolveAuthzCachePosture(input) {
+  const { ttlMs, bus, driver } = input;
+  if (!(ttlMs > 0)) {
+    return { posture: "disabled", loud: false, message: "" };
+  }
+  if (bus === "bridged") {
+    return {
+      posture: "bus-narrowed",
+      loud: false,
+      message: `[authz-cache] grants cache ENABLED (ttl=${ttlMs}ms) with the "authz.invalidated" bridge attached` + (driver ? ` (cluster driver "${driver}")` : "") + ". The bus narrows the TYPICAL convergence to one network hop; the TTL remains the correctness bound, because no shipped driver delivers better than at-most-once (cluster.mdx \xA74.2)."
+    };
+  }
+  const why = bus === "in-process" ? `the cluster driver "${driver ?? "memory"}" is in-process and does not fan out across replicas` : "no cluster service is registered on this node";
+  return {
+    posture: "ttl-only",
+    loud: true,
+    message: `[authz-cache] grants cache ENABLED (ttl=${ttlMs}ms) with NO "authz.invalidated" invalidation bus \u2014 ${why}. A grant revoked on another replica is honoured by this one for up to ${ttlMs}ms. That is a supported configuration, not an error: the TTL is the correctness bound and it still holds. It is stated because a silently-absent invalidation bridge is how a security control gets disabled without anyone noticing (#4785). To narrow the typical window, configure a remote cluster driver; to remove it entirely, set ${AUTHZ_GRANTS_CACHE_TTL_ENV}=0.`
+  };
+}
+function readAuthzGrantsCacheTtlMs(env = typeof process !== "undefined" ? process.env : {}) {
+  const raw = env[AUTHZ_GRANTS_CACHE_TTL_ENV];
+  if (raw === void 0 || raw.trim() === "") {
+    return { ttlMs: 0, malformed: false };
+  }
+  const parsed = Number(raw.trim());
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    return { ttlMs: 0, raw, malformed: true };
+  }
+  return { ttlMs: Math.floor(parsed), raw, malformed: false };
+}
+function reportAuthzCachePosture(input, sink2) {
+  if (input.malformedTtl) {
+    sink2.warn(
+      `[authz-cache] ${AUTHZ_GRANTS_CACHE_TTL_ENV}=${JSON.stringify(input.malformedTtl.raw ?? "")} is not a non-negative number; the grants cache is treated as DISABLED. Set a millisecond count, or 0 to disable it deliberately.`
+    );
+  }
+  const statement = resolveAuthzCachePosture(input);
+  if (statement.posture === "disabled") return statement;
+  if (statement.loud) sink2.warn(statement.message);
+  else sink2.info?.(statement.message);
+  return statement;
+}
+
+// src/security/resolve-user-grants-cache.ts
+var GRANTS_CACHE_WATCHED_OBJECTS = /* @__PURE__ */ new Set([
+  "sys_member",
+  "sys_user_position",
+  "sys_user_permission_set",
+  "sys_position",
+  "sys_position_permission_set",
+  "sys_permission_set",
+  "sys_user"
+]);
+var grantsCacheStates = /* @__PURE__ */ new WeakMap();
+var WRITE_OPERATIONS = /* @__PURE__ */ new Set(["insert", "update", "delete"]);
+function grantsCacheState(ql) {
+  const existing = grantsCacheStates.get(ql);
+  if (existing !== void 0) return existing ?? void 0;
+  const seamQl = ql;
+  const epoch = seamQl.writeEpoch;
+  const hasEpoch = !!epoch && typeof epoch === "object" && typeof epoch.current === "number" && typeof epoch.bump === "function" && typeof epoch.subscribe === "function";
+  if (!hasEpoch || typeof seamQl.registerMiddleware !== "function") {
+    return void 0;
+  }
+  const state = { gen: 0, entries: /* @__PURE__ */ new Map() };
+  try {
+    seamQl.registerMiddleware(async (ctx, next) => {
+      if (typeof ctx?.operation !== "string" || !WRITE_OPERATIONS.has(ctx.operation) || typeof ctx?.object !== "string" || !GRANTS_CACHE_WATCHED_OBJECTS.has(ctx.object)) {
+        return next();
+      }
+      try {
+        await next();
+      } finally {
+        state.gen += 1;
+      }
+    });
+    epoch.subscribe((_epoch, reason) => {
+      if (reason !== "write") state.gen += 1;
+    });
+  } catch {
+    grantsCacheStates.set(ql, null);
+    return void 0;
+  }
+  grantsCacheStates.set(ql, state);
+  return state;
+}
+function grantsCacheKey(userId, opts) {
+  return JSON.stringify([
+    userId,
+    opts.tenantId ?? null,
+    opts.seedEmail ?? null,
+    Array.isArray(opts.seedPermissions) ? opts.seedPermissions : []
+  ]);
+}
+var cloneGrants = (grants) => structuredClone(grants);
+function openUserGrantsCache(ql, userId, opts) {
+  if (opts.bypassGrantsCache) return void 0;
+  const { ttlMs } = readAuthzGrantsCacheTtlMs();
+  if (ttlMs <= 0) return void 0;
+  if (!ql || typeof ql !== "object" || typeof ql.find !== "function") {
+    return void 0;
+  }
+  const state = grantsCacheState(ql);
+  if (!state) return void 0;
+  const key = grantsCacheKey(userId, opts);
+  const now = opts.nowMs ?? Date.now();
+  const genAtOpen = state.gen;
+  const existing = state.entries.get(key);
+  if (existing) {
+    if (existing.gen === state.gen && existing.expiresAt > now) {
+      return { hit: cloneGrants(existing.value), commit: () => {
+      } };
+    }
+    state.entries.delete(key);
+  }
+  return {
+    commit(grants, nextBoundaryMs) {
+      const expiresAt = Math.min(now + ttlMs, nextBoundaryMs ?? Number.POSITIVE_INFINITY);
+      if (expiresAt <= now) return;
+      state.entries.set(key, { value: cloneGrants(grants), gen: genAtOpen, expiresAt });
+    }
+  };
+}
+
+// src/security/platform-admin.ts
+import { isEmailVerifiedUserRow, PLATFORM_OWNER_EMAIL_ENV, resolvePlatformOwnerEmail } from "@objectstack/types";
+var PLATFORM_ADMIN_EMAIL_SEPARATOR = ",";
+function normalizePlatformAdminEmail(value) {
+  return typeof value === "string" ? value.trim().toLowerCase() : "";
+}
+function isParseableAddress(entry) {
+  if (/\s/.test(entry)) return false;
+  const at = entry.indexOf("@");
+  if (at <= 0) return false;
+  if (entry.indexOf("@", at + 1) !== -1) return false;
+  return at < entry.length - 1;
+}
+var EMPTY_CONFIG = Object.freeze({
+  emails: Object.freeze([]),
+  declaredSpellings: Object.freeze([])
+});
+function parsePlatformAdminEmails(raw) {
+  if (raw == null) return EMPTY_CONFIG;
+  const text = String(raw);
+  if (text.trim() === "") return EMPTY_CONFIG;
+  const emails = [];
+  const declaredSpellings = [];
+  for (const piece of text.split(PLATFORM_ADMIN_EMAIL_SEPARATOR)) {
+    const entry = normalizePlatformAdminEmail(piece);
+    if (entry === "") continue;
+    if (!isParseableAddress(entry)) {
+      return {
+        emails: Object.freeze([]),
+        declaredSpellings: Object.freeze([]),
+        raw: text,
+        refusal: `${PLATFORM_OWNER_EMAIL_ENV} entry ${JSON.stringify(piece)} is not an email address, so the WHOLE variable is refused and this deployment has ZERO config-derived platform administrators. The entry is not skipped on purpose: silently dropping it would leave a narrower administrator set than the operator declared, with nothing to notice. Fix the entry, or remove it \u2014 ${PLATFORM_OWNER_EMAIL_ENV} takes one address or a comma-separated list of them.`
+      };
+    }
+    if (!emails.includes(entry)) {
+      emails.push(entry);
+      declaredSpellings.push(piece.trim());
+    }
+  }
+  return {
+    emails: Object.freeze(emails),
+    declaredSpellings: Object.freeze(declaredSpellings),
+    raw: text
+  };
+}
+var defaultSink = {
+  error: (m) => console.error(m),
+  warn: (m) => console.warn(m)
+};
+var sink = defaultSink;
+function setPlatformAdminConfigSink(next) {
+  const prev = sink;
+  sink = next ?? defaultSink;
+  return prev;
+}
+var NOT_MEMOIZED = /* @__PURE__ */ Symbol("platform-admin-config-not-memoized");
+var memoKey = NOT_MEMOIZED;
+var memoValue = EMPTY_CONFIG;
+function resolvePlatformAdminEmails() {
+  const raw = resolvePlatformOwnerEmail();
+  if (memoKey !== NOT_MEMOIZED && memoKey === raw) return memoValue;
+  const parsed = parsePlatformAdminEmails(raw);
+  memoKey = raw;
+  memoValue = parsed;
+  if (parsed.refusal) sink.error(`[authz] ${parsed.refusal}`);
+  return parsed;
+}
+function resetPlatformAdminEmailMemo() {
+  memoKey = NOT_MEMOIZED;
+  memoValue = EMPTY_CONFIG;
+}
+function matchesConfiguredPlatformAdmin(row, config) {
+  if (config.emails.length === 0) return false;
+  if (!row || typeof row !== "object") return false;
+  if (!isConfiguredPlatformAdminEmail(row.email, config)) return false;
+  return isEmailVerifiedUserRow(row);
+}
+function isConfiguredPlatformAdminEmail(email, config) {
+  if (config.emails.length === 0) return false;
+  const candidate = normalizePlatformAdminEmail(email);
+  return candidate !== "" && config.emails.includes(candidate);
+}
+var legacyGrantPointerSaid = false;
+function reportLegacyPlatformAdminGrant(input) {
+  if (legacyGrantPointerSaid) return;
+  legacyGrantPointerSaid = true;
+  const email = normalizePlatformAdminEmail(input.email);
+  sink.warn(
+    `[authz] user ${input.userId} holds PLATFORM_ADMIN through the legacy unscoped 'admin_full_access' grant row, not through ${PLATFORM_OWNER_EMAIL_ENV}. The grant row is the OLD anchor and is honoured for now; it is removed in a later release. Re-anchor this deployment by declaring its administrators in configuration: ${PLATFORM_OWNER_EMAIL_ENV}=${email || "<the administrator's verified email address>"} (comma-separated for several), and make sure each account's email is VERIFIED \u2014 an unverified account holding a configured address is not an administrator. Reported once per process; further holders are not listed.`
+  );
+}
+function resetLegacyPlatformAdminGrantReport() {
+  legacyGrantPointerSaid = false;
+}
+
 // src/security/posture-ladder.ts
 var POSTURE_LADDER = [
   "PLATFORM_ADMIN",
@@ -4433,8 +4676,9 @@ async function tryFind(ql, object, where, limit = 100, organizationId) {
     let rows = await ql.find(object, { where, limit, context });
     if (rows && rows.value) rows = rows.value;
     return Array.isArray(rows) ? rows : [];
-  } catch {
-    return [];
+  } catch (err) {
+    if (isMissingTableError(err, object)) return [];
+    throw new AuthzStoreUnavailableError(object, err);
   }
 }
 async function resolveAuthzContext(input) {
@@ -4508,6 +4752,8 @@ async function resolveAuthzContext(input) {
   return ctx;
 }
 async function resolveUserAuthzGrants(ql, userId, opts = {}) {
+  const grantsCache = openUserGrantsCache(ql, userId, opts);
+  if (grantsCache?.hit) return grantsCache.hit;
   const { tenantId } = opts;
   const grants = {
     positions: [],
@@ -4528,7 +4774,8 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     }
     return userRow;
   };
-  const needsUserRow = !grants.email || !grants.permissions.includes("ai_seat");
+  const platformAdminConfig = resolvePlatformAdminEmails();
+  const needsUserRow = !grants.email || !grants.permissions.includes("ai_seat") || platformAdminConfig.emails.length > 0;
   const [, members, userPositionRows, orgMembersLeg, upsRowsAll] = await Promise.all([
     needsUserRow ? getUserRow() : Promise.resolve(void 0),
     tryFind(ql, "sys_member", { user_id: userId }, 200),
@@ -4630,6 +4877,18 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     }
     if (Object.keys(mergedTabs).length > 0) grants.tabPermissions = mergedTabs;
   }
+  const configConfersPlatformAdmin = platformAdminConfig.emails.length > 0 && matchesConfiguredPlatformAdmin(await getUserRow(), platformAdminConfig);
+  if (configConfersPlatformAdmin) {
+    hasPlatformAdminGrant = true;
+    if (!grants.permissions.includes(ADMIN_FULL_ACCESS)) grants.permissions.push(ADMIN_FULL_ACCESS);
+    for (const p of ADMIN_FULL_ACCESS_CAPABILITIES.systemPermissions ?? []) {
+      if (!grants.systemPermissions.includes(p)) grants.systemPermissions.push(p);
+    }
+  } else if (hasPlatformAdminGrant) {
+    if (postureEnforcesWall2(resolveTenancyPosture())) {
+      reportLegacyPlatformAdminGrant({ userId, email: userRow?.email });
+    }
+  }
   if (hasPlatformAdminGrant && !grants.positions.includes(BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
     grants.positions.unshift(BUILTIN_IDENTITY_PLATFORM_ADMIN);
   }
@@ -4643,8 +4902,21 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     const aiAccess = (await getUserRow())?.ai_access;
     if (aiAccess === true || aiAccess === 1 || aiAccess === "1") grants.permissions.push("ai_seat");
   }
+  grantsCache?.commit(
+    grants,
+    nextGrantValidityBoundary([...members, ...userPositionRows, ...upsRowsAll], nowMs)
+  );
   return grants;
 }
+async function hasPlatformAdminStanding(ql, userId, opts = {}) {
+  if (!ql || typeof userId !== "string" || userId.length === 0) return false;
+  try {
+    const grants = await resolveUserAuthzGrants(ql, userId, { nowMs: opts.nowMs });
+    return grants.posture === "PLATFORM_ADMIN";
+  } catch {
+    return false;
+  }
+}
 function isValidTimeZone(tz) {
   try {
     new Intl.DateTimeFormat("en-US", { timeZone: tz });
@@ -4666,25 +4938,98 @@ function coerceCurrency(value) {
   return /^[A-Z]{3}$/.test(s) ? s : void 0;
 }
 var LOCALIZATION_FAILURE_CACHE_TTL_MS = 3e4;
-var localizationFailureCache = /* @__PURE__ */ new WeakMap();
+var LOCALIZATION_CACHE_TTL_ENV = "OS_LOCALIZATION_CACHE_TTL_MS";
+var LOCALIZATION_SUCCESS_CACHE_DEFAULT_TTL_MS = 3e4;
+function localizationSuccessCacheTtlMs(env = typeof process !== "undefined" ? process.env : {}) {
+  const raw = env[LOCALIZATION_CACHE_TTL_ENV];
+  if (raw === void 0 || raw.trim() === "") return LOCALIZATION_SUCCESS_CACHE_DEFAULT_TTL_MS;
+  const parsed = Number(raw.trim());
+  if (!Number.isFinite(parsed) || parsed < 0) return 0;
+  return Math.floor(parsed);
+}
+function readWriteEpoch(ql) {
+  if (!ql || typeof ql !== "object") return void 0;
+  const epoch = ql.writeEpoch;
+  if (!epoch || typeof epoch !== "object") return void 0;
+  const seam = epoch;
+  if (typeof seam.current !== "number" || typeof seam.bump !== "function" || typeof seam.subscribe !== "function") {
+    return void 0;
+  }
+  return seam.current;
+}
+var localizationSettingsStates = /* @__PURE__ */ new WeakMap();
+var localizationNoSettingsState = { gen: 0 };
+function localizationSettingsState(settings) {
+  if (!settings || typeof settings !== "object") return localizationNoSettingsState;
+  const existing = localizationSettingsStates.get(settings);
+  if (existing) return existing;
+  const state = { gen: 0 };
+  localizationSettingsStates.set(settings, state);
+  const subscribe = settings.subscribe;
+  if (typeof subscribe === "function") {
+    try {
+      subscribe.call(
+        settings,
+        "localization",
+        () => {
+          state.gen += 1;
+        }
+      );
+    } catch {
+    }
+  }
+  return state;
+}
+var localizationCache = /* @__PURE__ */ new WeakMap();
+function localizationEntryIsLive(entry, epoch, settings) {
+  if (entry.kind === "failure") return true;
+  return entry.epoch === epoch && entry.settings === settings && entry.settingsGen === settings.gen;
+}
+function putLocalizationEntry(ql, key, entry) {
+  const bucket = localizationCache.get(ql) ?? /* @__PURE__ */ new Map();
+  bucket.set(key, entry);
+  localizationCache.set(ql, bucket);
+}
 async function resolveLocalizationContext(input) {
-  const { ql, tenantId, userId } = input;
+  const { ql, settings, tenantId, userId } = input;
   const cacheKey = `${tenantId ?? ""}|${userId ?? ""}`;
-  if (ql && typeof ql === "object") {
-    const hit = localizationFailureCache.get(ql)?.get(cacheKey);
-    if (hit && hit.expiresAt > Date.now()) return hit.value;
-  }
-  const { value, failed } = await resolveLocalizationContextUncached(input);
-  if (failed && ql && typeof ql === "object") {
-    const bucket = localizationFailureCache.get(ql) ?? /* @__PURE__ */ new Map();
-    bucket.set(cacheKey, { value, expiresAt: Date.now() + LOCALIZATION_FAILURE_CACHE_TTL_MS });
-    localizationFailureCache.set(ql, bucket);
+  const cacheable = Boolean(ql) && typeof ql === "object";
+  const epoch = cacheable ? readWriteEpoch(ql) : void 0;
+  const settingsState = localizationSettingsState(settings);
+  if (cacheable) {
+    const hit = localizationCache.get(ql)?.get(cacheKey);
+    if (hit && hit.expiresAt > Date.now() && localizationEntryIsLive(hit, epoch, settingsState)) {
+      return hit.value;
+    }
+  }
+  const { value, backendFailed } = await resolveLocalizationContextUncached(input);
+  if (!cacheable) return value;
+  if (backendFailed) {
+    putLocalizationEntry(ql, cacheKey, {
+      value,
+      expiresAt: Date.now() + LOCALIZATION_FAILURE_CACHE_TTL_MS,
+      kind: "failure"
+    });
+    return value;
+  }
+  const ttlMs = localizationSuccessCacheTtlMs();
+  if (epoch !== void 0 && ttlMs > 0) {
+    putLocalizationEntry(ql, cacheKey, {
+      value,
+      expiresAt: Date.now() + ttlMs,
+      kind: "success",
+      epoch,
+      settings: settingsState,
+      settingsGen: settingsState.gen
+    });
+  } else {
+    localizationCache.get(ql)?.delete(cacheKey);
   }
   return value;
 }
 async function resolveLocalizationContextUncached(input) {
   const { ql, settings, tenantId, userId } = input;
-  let failed = false;
+  let backendFailed = false;
   try {
     if (settings && typeof settings.get === "function") {
       const sctx = { tenantId, userId };
@@ -4698,33 +5043,22 @@ async function resolveLocalizationContextUncached(input) {
           localeRes = many.locale;
           currencyRes = many.currency;
         } catch {
-          failed = true;
         }
       } else {
         [tzRes, localeRes, currencyRes] = await Promise.all([
-          settings.get("localization", "timezone", sctx).catch(() => {
-            failed = true;
-            return void 0;
-          }),
-          settings.get("localization", "locale", sctx).catch(() => {
-            failed = true;
-            return void 0;
-          }),
-          settings.get("localization", "currency", sctx).catch(() => {
-            failed = true;
-            return void 0;
-          })
+          settings.get("localization", "timezone", sctx).catch(() => void 0),
+          settings.get("localization", "locale", sctx).catch(() => void 0),
+          settings.get("localization", "currency", sctx).catch(() => void 0)
         ]);
       }
       const tz = coerceTimeZone(tzRes?.value);
       const locale = coerceLocale(localeRes?.value);
       const currency = coerceCurrency(currencyRes?.value);
       if (tz || locale || currency) {
-        return { value: { timezone: tz ?? "UTC", locale: locale ?? "en-US", currency }, failed: false };
+        return { value: { timezone: tz ?? "UTC", locale: locale ?? "en-US", currency }, backendFailed: false };
       }
     }
   } catch {
-    failed = true;
   }
   let rows = [];
   if (ql && typeof ql.find === "function") {
@@ -4737,7 +5071,7 @@ async function resolveLocalizationContextUncached(input) {
       if (result && result.value) result = result.value;
       rows = Array.isArray(result) ? result : [];
     } catch {
-      failed = true;
+      backendFailed = true;
     }
   }
   const valueOf = (k) => rows.find((r) => r.key === k)?.value;
@@ -4747,7 +5081,7 @@ async function resolveLocalizationContextUncached(input) {
       locale: coerceLocale(valueOf("locale")) ?? "en-US",
       currency: coerceCurrency(valueOf("currency"))
     },
-    failed
+    backendFailed
   };
 }
 
@@ -4909,7 +5243,7 @@ function shouldDenyAnonymous(input) {
 var ADMIN_STANDING_SURFACE = {
   sys_permission_set: {
     role: "derives",
-    reason: "The row `platform_admin` is resolved BY NAME from (\xA76b). Renaming it, deleting it or switching it off (ADR-0049 `active`, read here since #8613) un-makes every platform admin at once, with no identity table touched.",
+    reason: "The row `admin_full_access` is resolved BY NAME from (\xA76b) \u2014 `platform_admin` is the POSITION that row derives, not the row's own name. Renaming it, deleting it or switching it off (ADR-0049 `active`, read here since #8613) un-makes every GRANT-derived platform admin at once, with no identity table touched. \u26A0\uFE0F It does NOT un-make a CONFIG-derived one (\xA76b-config, #11970): that route sets the same standing from `ADMIN_FULL_ACCESS_CAPABILITIES` in `@objectstack/spec` and matches the caller's own stored `sys_user` row, so it touches an identity table and never reads this one. With `OS_PLATFORM_OWNER_EMAIL` unset the first sentence is the whole truth; with it declared, this row stops being the single point that un-makes every administrator.",
     columns: [
       "id",
       "name",
@@ -4951,8 +5285,14 @@ var ADMIN_STANDING_SURFACE = {
     ]
   },
   sys_user: {
-    role: "reads-only",
-    reason: "Read for the `current_user.email` RLS fallback and the ADR-0024 `ai_seat` synthesis (\xA77). Neither confers administrator standing. The guard does watch this table, but for the ban/delete WRITE SHAPES \u2014 `banned` is never read here, so it is not a derivation column and carries no standing-key list."
+    role: "derives",
+    reason: "[#11663 L2] RECLASSIFIED from `reads-only`. This table used to be read only for the `current_user.email` RLS fallback and the ADR-0024 `ai_seat` synthesis (\xA77), and the note here said so: \"Neither confers administrator standing.\" That sentence is now FALSE. The config anchor (\xA76b-config) matches the row's own `email` against the deployment's declared administrator list and requires `email_verified` to read verified, so a write that changes either column takes platform-admin standing away from a config-derived administrator \u2014 an address change and an email_verified reset are both ordinary, reachable writes, and neither touches a grant table. `banned` stays absent from the column list because the resolver still never reads it; the guard watches the ban/delete WRITE SHAPES on this table for its own reasons, which is a different question from what this resolver consumes.",
+    columns: [
+      "id",
+      "email",
+      "email_verified",
+      "ai_access"
+    ]
   },
   sys_user_position: {
     role: "reads-only",
@@ -4967,6 +5307,13 @@ var ADMIN_STANDING_SURFACE = {
     reason: "Position-bound permission sets (\xA76a). Contributes ids to `psIds` \u2014 and therefore names to `permissions` \u2014 but not to `unscopedUserPsIds`, which is the set \xA76b tests for platform-admin standing."
   }
 };
+var ADMIN_STANDING_NON_TABLE_INPUTS = [
+  {
+    kind: "env",
+    name: "OS_PLATFORM_OWNER_EMAIL",
+    reason: "The deployment's declared platform administrator(s) \u2014 one address or a comma-separated list, matched case-insensitively against `sys_user.email` and conferring standing only when that row's `email_verified` reads verified (\xA76b-config). Read live on every derivation with a per-process memo keyed on the raw string, so a rolled process picks up a change with no special path. Unset, blank, or carrying any unparseable entry means ZERO config-derived administrators, fail closed. No runtime write reaches it, so no break-glass guard can simulate a change to it: revocation is a configuration change plus a process roll, by design."
+  }
+];
 function adminStandingTables() {
   return Object.entries(ADMIN_STANDING_SURFACE).filter(([, t]) => t.role === "derives").map(([name]) => name).sort();
 }
@@ -4998,6 +5345,9 @@ function withoutOperationPrivateKeys(exec) {
   return out;
 }
 
+// src/security/authz-invalidation-channel.ts
+var AUTHZ_INVALIDATED_CHANNEL = "authz.invalidated";
+
 // src/utils/datetime.ts
 import { nextUtcCalendarDay, utcInstantMs } from "@objectstack/spec/data";
 function calendarPartsInTz(d, tz) {
@@ -5278,7 +5628,7 @@ function omitInternalFieldsFromWriteResponse(schema, records) {
 }
 
 // src/utils/migration-journal.ts
-import { createHash as createHash2, randomUUID } from "crypto";
+import { createHash as createHash3, randomUUID } from "crypto";
 import {
   MIGRATION_JOURNAL_OBJECT
 } from "@objectstack/spec/system";
@@ -5335,7 +5685,7 @@ function hashMigrationPlan(plan, chunks) {
     steps: plan.steps.map((s) => s.name),
     chunks: chunks.map((c) => [c.stepIndex, c.offset, c.length])
   });
-  return createHash2("sha256").update(shape, "utf8").digest("hex").slice(0, 32);
+  return createHash3("sha256").update(shape, "utf8").digest("hex").slice(0, 32);
 }
 async function appendEvent(engine, event, execContext) {
   await engine.insert(
@@ -5903,6 +6253,110 @@ function isUninterpretableTemporalComparand(kind, value) {
   return !(readsAsWallClock(s) || readsAsInstant(s));
 }
 
+// src/utils/metadata-activation-store.ts
+var METADATA_ACTIVATION_TABLE = "sys_metadata_activation";
+var SYSTEM_CTX2 = { isSystem: true, positions: [], permissions: [] };
+var InMemoryMetadataActivationStore = class {
+  constructor() {
+    this.rows = /* @__PURE__ */ new Map();
+  }
+  async list() {
+    return [...this.rows.values()];
+  }
+  async setActive(row) {
+    this.rows.set(row.name, { ...row });
+  }
+};
+var ObjectStoreMetadataActivationStore = class {
+  constructor(engine, metadataType) {
+    this.engine = engine;
+    this.metadataType = metadataType;
+  }
+  /**
+   * Every row of this type. Read once at boot to hydrate the consumer's
+   * projection.
+   *
+   * The only scoping is the `metadata_type` discriminator: the ledger is
+   * deployment-wide and has no tenant column, so there is no second axis to
+   * filter on (see the module header).
+   */
+  async list() {
+    const rows = await this.engine.find(METADATA_ACTIVATION_TABLE, {
+      where: { metadata_type: this.metadataType },
+      context: SYSTEM_CTX2
+    });
+    if (!Array.isArray(rows)) return [];
+    const out = [];
+    for (const row of rows) {
+      const r = row;
+      if (typeof r.name !== "string" || !r.name) continue;
+      out.push({
+        name: r.name,
+        packageId: typeof r.package_id === "string" ? r.package_id : "",
+        // The column defaults to `true`; only an explicit `false`
+        // disarms. A driver that round-trips booleans as 0/1
+        // (SQLite/libsql) is read through the same `=== false || === 0`
+        // test, so a `0` is not mistaken for `true`.
+        active: !(r.active === false || r.active === 0)
+      });
+    }
+    return out;
+  }
+  /**
+   * Insert or update the row for one packaged artifact.
+   *
+   * Read-then-write rather than a blind upsert because the object's
+   * uniqueness is a DECLARED index (`unique: 'global'` over
+   * `(metadata_type, name)`), not a primary key this store controls: there is
+   * no id to collide on, so an insert-and-catch could not tell "already
+   * there" from a real store failure.
+   *
+   * That index is also why taking the FIRST match is taking the only one: the
+   * read below is keyed on exactly the index's two columns, so it can match
+   * at most one row. It used to pick the first row with a NULL organization
+   * out of the result, back when the table carried a reserved tenant column;
+   * with no such column the set it was choosing from can no longer hold more
+   * than one member.
+   */
+  async setActive(row) {
+    const existing = await this.engine.find(METADATA_ACTIVATION_TABLE, {
+      where: { metadata_type: this.metadataType, name: row.name },
+      context: SYSTEM_CTX2
+    });
+    const current = Array.isArray(existing) ? existing[0] : void 0;
+    if (current && current.id != null) {
+      await this.engine.update(
+        METADATA_ACTIVATION_TABLE,
+        { id: current.id, active: row.active, package_id: row.packageId },
+        { context: SYSTEM_CTX2 }
+      );
+      return;
+    }
+    await this.engine.insert(
+      METADATA_ACTIVATION_TABLE,
+      {
+        metadata_type: this.metadataType,
+        name: row.name,
+        package_id: row.packageId,
+        active: row.active
+      },
+      { context: SYSTEM_CTX2 }
+    );
+  }
+  /**
+   * Read the backing table once so a misconfiguration surfaces at BOOT
+   * rather than as a failed toggle later. Throws the driver error verbatim —
+   * `no such table: sys_metadata_activation` means the object was never
+   * registered (or its schema never synced) in this composition.
+   *
+   * ⚠️ Unscoped by design: the question is "does the TABLE read at all",
+   * which is a property of the composition, not of one `metadata_type`.
+   */
+  async probe() {
+    await this.engine.find(METADATA_ACTIVATION_TABLE, { where: {}, limit: 1, context: SYSTEM_CTX2 });
+  }
+};
+
 // src/utils/record-not-found.ts
 function recordNotFoundError(object, id) {
   const err = new Error(`Record ${id} not found in ${object}`);
@@ -5913,6 +6367,45 @@ function recordNotFoundError(object, id) {
 }
 
 // src/health-monitor.ts
+var RECOVERY_IS_THRESHOLD_GATED = {
+  degraded: true,
+  unhealthy: true,
+  failed: true,
+  recovering: true,
+  healthy: false,
+  unknown: false
+};
+function healthMonitorRefusal(message) {
+  const err = new Error(message);
+  err.code = "VALIDATION_ERROR";
+  err.status = 400;
+  return err;
+}
+var RETIRED_HEALTH_CHECK_KEYS = [
+  [
+    "autoRestart",
+    "'autoRestart' was removed from PluginHealthCheck in @objectstack/spec 18 (#12032, ADR-0049 enforce-or-remove) \u2014 it never restarted a plugin. `attemptRestart` called `plugin.destroy()` and stopped there, then logged 'Plugin restarted' and set status `recovering`, and the periodic checks carried on against the destroyed instance \u2014 which the default check (`{ name: 'plugin-loaded', status: 'passed' }`) passes forever, so a destroyed, never-re-initialised plugin ended up reported `healthy`. Delete the key. This monitor no longer destroys anything: a failing plugin is reported `unhealthy` or `failed` and left alone."
+  ],
+  [
+    "maxRestartAttempts",
+    "'maxRestartAttempts' was removed from PluginHealthCheck in @objectstack/spec 18 (#12032, ADR-0049 enforce-or-remove) \u2014 it capped a restart that never happened, so it only counted `destroy()` calls. Delete the key."
+  ],
+  [
+    "restartBackoff",
+    "'restartBackoff' was removed from PluginHealthCheck in @objectstack/spec 18 (#12032, ADR-0049 enforce-or-remove) \u2014 it delayed a restart that never happened, so it only moved when the `destroy()` landed. Delete the key."
+  ]
+];
+var RESTART_IS_THE_HOSTS_JOB = " Restarting a plugin is the HOST's job in this host-driven library: poll `getHealthStatus(pluginName)` / `getHealthReport(pluginName)` and act on `unhealthy` / `failed` at the level that owns the plugin's lifetime \u2014 recreate the kernel, or let your supervisor restart the process.";
+function assertNoRetiredKeys(pluginName, config) {
+  for (const [key, guidance] of RETIRED_HEALTH_CHECK_KEYS) {
+    if (!Object.prototype.hasOwnProperty.call(config, key)) {
+      continue;
+    }
+    throw healthMonitorRefusal(
+      `[HealthMonitor] Plugin '${pluginName}': ${guidance}${RESTART_IS_THE_HOSTS_JOB}`
+    );
+  }
+}
 var PluginHealthMonitor = class {
   constructor(logger) {
     this.healthChecks = /* @__PURE__ */ new Map();
@@ -5921,18 +6414,17 @@ var PluginHealthMonitor = class {
     this.checkIntervals = /* @__PURE__ */ new Map();
     this.failureCounters = /* @__PURE__ */ new Map();
     this.successCounters = /* @__PURE__ */ new Map();
-    this.restartAttempts = /* @__PURE__ */ new Map();
     this.logger = logger.child({ component: "HealthMonitor" });
   }
   /**
    * Register a plugin for health monitoring
    */
   registerPlugin(pluginName, config) {
+    assertNoRetiredKeys(pluginName, config);
     this.healthChecks.set(pluginName, config);
     this.healthStatus.set(pluginName, "unknown");
     this.failureCounters.set(pluginName, 0);
     this.successCounters.set(pluginName, 0);
-    this.restartAttempts.set(pluginName, 0);
     this.logger.info("Plugin registered for health monitoring", {
       plugin: pluginName,
       interval: config.interval
@@ -5984,6 +6476,7 @@ var PluginHealthMonitor = class {
     let status = "healthy";
     let message;
     const checks = [];
+    let failureRoute;
     try {
       if (config.checkMethod && typeof plugin[config.checkMethod] === "function") {
         const checkResult = await this.raceCheckTimeout(
@@ -6004,8 +6497,8 @@ var PluginHealthMonitor = class {
       if (status === "healthy") {
         this.successCounters.set(pluginName, (this.successCounters.get(pluginName) || 0) + 1);
         this.failureCounters.set(pluginName, 0);
-        const currentStatus = this.healthStatus.get(pluginName);
-        if (currentStatus === "unhealthy" || currentStatus === "degraded") {
+        const currentStatus = this.healthStatus.get(pluginName) ?? "unknown";
+        if (RECOVERY_IS_THRESHOLD_GATED[currentStatus]) {
           const successCount = this.successCounters.get(pluginName) || 0;
           if (successCount >= config.successThreshold) {
             this.healthStatus.set(pluginName, "healthy");
@@ -6017,27 +6510,11 @@ var PluginHealthMonitor = class {
           this.healthStatus.set(pluginName, "healthy");
         }
       } else {
-        this.failureCounters.set(pluginName, (this.failureCounters.get(pluginName) || 0) + 1);
-        this.successCounters.set(pluginName, 0);
-        const failureCount = this.failureCounters.get(pluginName) || 0;
-        if (failureCount >= config.failureThreshold) {
-          this.healthStatus.set(pluginName, "unhealthy");
-          this.logger.warn("Plugin marked as unhealthy", {
-            plugin: pluginName,
-            failures: failureCount
-          });
-          if (config.autoRestart) {
-            await this.attemptRestart(pluginName, plugin, config);
-          }
-        } else {
-          this.healthStatus.set(pluginName, "degraded");
-        }
+        failureRoute = "returned";
       }
     } catch (error) {
       status = "failed";
       message = error instanceof Error ? error.message : "Unknown error";
-      this.failureCounters.set(pluginName, (this.failureCounters.get(pluginName) || 0) + 1);
-      this.healthStatus.set(pluginName, "failed");
       checks.push({
         name: "health-check",
         status: "failed",
@@ -6047,6 +6524,10 @@ var PluginHealthMonitor = class {
         plugin: pluginName,
         error
       });
+      failureRoute = "thrown";
+    }
+    if (failureRoute) {
+      this.recordFailedRound(pluginName, config, failureRoute);
     }
     const report = {
       status: this.healthStatus.get(pluginName) || "unknown",
@@ -6060,56 +6541,42 @@ var PluginHealthMonitor = class {
     this.healthReports.set(pluginName, report);
   }
   /**
-   * Attempt to restart a plugin
+   * Handle one failed round — the single path BOTH failure routes take.
+   *
+   * `performHealthCheck` can fail two disjoint ways: the check *returns* a
+   * failure (`false` or `{ status: 'unhealthy' }`), or it *throws* — which by
+   * `raceCheckTimeout` includes every `timeout` overrun, the severest case of
+   * the two. The routes used to be handled in separate blocks, and only the
+   * returned one cleared `successCounters`, so the counters a declared
+   * `failureThreshold` / `successThreshold` are counted with depended on which
+   * way the round happened to fail (#11852).
+   *
+   * What stays route-specific is the *status label*, deliberately. A throw is
+   * the separate `failed` status applied immediately with no threshold — that
+   * is the documented contract (`content/docs/protocol/kernel/lifecycle.mdx`,
+   * "Custom Health Checks") and is pinned by the timeout test. Only the
+   * counters are shared, because that is what `failureThreshold` declares, and
+   * it does not name a route.
+   *
+   * This round ENDS here. Nothing is done TO the plugin — see the #12032 note
+   * on the class: a monitor that cannot re-initialise a plugin has no business
+   * destroying one.
    */
-  async attemptRestart(pluginName, plugin, config) {
-    const attempts = this.restartAttempts.get(pluginName) || 0;
-    if (attempts >= config.maxRestartAttempts) {
-      this.logger.error("Max restart attempts reached, giving up", {
-        plugin: pluginName,
-        attempts
-      });
+  recordFailedRound(pluginName, config, route) {
+    const failureCount = (this.failureCounters.get(pluginName) || 0) + 1;
+    this.failureCounters.set(pluginName, failureCount);
+    this.successCounters.set(pluginName, 0);
+    const thresholdReached = failureCount >= config.failureThreshold;
+    if (route === "thrown") {
       this.healthStatus.set(pluginName, "failed");
-      return;
-    }
-    this.restartAttempts.set(pluginName, attempts + 1);
-    const delay = this.calculateBackoff(attempts, config.restartBackoff);
-    this.logger.info("Scheduling plugin restart", {
-      plugin: pluginName,
-      attempt: attempts + 1,
-      delay
-    });
-    await new Promise((resolve) => setTimeout(resolve, delay));
-    try {
-      if (plugin.destroy) {
-        await plugin.destroy();
-      }
-      this.logger.info("Plugin restarted", { plugin: pluginName });
-      this.failureCounters.set(pluginName, 0);
-      this.successCounters.set(pluginName, 0);
-      this.healthStatus.set(pluginName, "recovering");
-    } catch (error) {
-      this.logger.error("Plugin restart failed", {
+    } else if (thresholdReached) {
+      this.healthStatus.set(pluginName, "unhealthy");
+      this.logger.warn("Plugin marked as unhealthy", {
         plugin: pluginName,
-        error
+        failures: failureCount
       });
-      this.healthStatus.set(pluginName, "failed");
-    }
-  }
-  /**
-   * Calculate backoff delay for restarts
-   */
-  calculateBackoff(attempt, strategy) {
-    const baseDelay = 1e3;
-    switch (strategy) {
-      case "fixed":
-        return baseDelay;
-      case "linear":
-        return baseDelay * (attempt + 1);
-      case "exponential":
-        return baseDelay * Math.pow(2, attempt);
-      default:
-        return baseDelay;
+    } else {
+      this.healthStatus.set(pluginName, "degraded");
     }
   }
   /**
@@ -6142,7 +6609,6 @@ var PluginHealthMonitor = class {
     this.healthReports.clear();
     this.failureCounters.clear();
     this.successCounters.clear();
-    this.restartAttempts.clear();
     this.logger.info("Health monitor shutdown complete");
   }
   /**
@@ -6183,7 +6649,7 @@ var PluginHealthMonitor = class {
 };
 
 // src/hot-reload.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var generateUUID = () => {
   if (typeof crypto !== "undefined" && crypto.randomUUID) {
     return crypto.randomUUID();
@@ -6194,6 +6660,42 @@ var generateUUID = () => {
     return v.toString(16);
   });
 };
+var HONOURED_STATE_STRATEGIES = ["memory", "none"];
+var RETIRED_STATE_STRATEGY_GUIDANCE = "'disk' and 'distributed' were removed from HotReloadConfig.stateStrategy in @objectstack/spec 18 (ADR-0049 enforce-or-remove) \u2014 neither was ever implemented. Both wrote to the same in-memory Map as 'memory' and reported it only at debug level, so a host that asked for durable or cluster-replicated state got process-local memory and no error. Use 'memory' for in-process state preservation across a reload, or 'none' to disable it. There is no in-tree replacement for durable or distributed plugin state \u2014 persist it in the host, which owns the process lifetime these strategies pretended to outlive.";
+function hotReloadRefusal(message) {
+  const err = new Error(message);
+  err.code = "VALIDATION_ERROR";
+  err.status = 400;
+  return err;
+}
+function assertHonouredStateStrategy(pluginName, strategy) {
+  if (HONOURED_STATE_STRATEGIES.includes(strategy)) {
+    return;
+  }
+  const shown = typeof strategy === "string" ? `'${strategy}'` : String(strategy);
+  const retired = strategy === "disk" || strategy === "distributed";
+  throw hotReloadRefusal(
+    `[HotReload] Plugin '${pluginName}': unsupported stateStrategy ${shown}. Honoured values are ${HONOURED_STATE_STRATEGIES.map((v) => `'${v}'`).join(" and ")}. ` + (retired ? RETIRED_STATE_STRATEGY_GUIDANCE : "This value has never been implemented by PluginStateManager.")
+  );
+}
+var RETIRED_HOT_RELOAD_KEYS = [
+  [
+    "distributedConfig",
+    "'distributedConfig' was removed from HotReloadConfig in @objectstack/spec 18 (ADR-0049 enforce-or-remove) \u2014 nothing ever read it. A provider, endpoints, a key prefix, a TTL and a replication factor could all be declared and no connection was ever opened. It left with the stateStrategy: 'distributed' value it was documented as being required for. Delete the key; there is no in-tree replacement for distributed plugin state \u2014 persist it in the host."
+  ],
+  [
+    "watchPatterns",
+    "'watchPatterns' was removed from HotReloadConfig in @objectstack/spec 18 (ADR-0049 enforce-or-remove) \u2014 nothing ever read it. Its only two uses were log lines: no watcher was ever constructed from it, so an author could declare a glob and no file change ever triggered a reload. File watching is the HOST's job in this host-driven library. Delete the key, declare your globs wherever your own watcher reads them, and call `HotReloadManager.scheduleReload(pluginName, reloadFn)` when one matches \u2014 that is the debounced integration point this class does implement."
+  ]
+];
+function assertNoRetiredKeys2(pluginName, config) {
+  for (const [key, guidance] of RETIRED_HOT_RELOAD_KEYS) {
+    if (!Object.prototype.hasOwnProperty.call(config, key)) {
+      continue;
+    }
+    throw hotReloadRefusal(`[HotReload] Plugin '${pluginName}': ${guidance}`);
+  }
+}
 var PluginStateManager = class {
   constructor(logger) {
     this.stateSnapshots = /* @__PURE__ */ new Map();
@@ -6220,17 +6722,6 @@ var PluginStateManager = class {
         this.memoryStore.set(snapshotId, snapshot);
         this.logger.debug("State saved to memory", { pluginId, snapshotId });
         break;
-      case "disk":
-        this.memoryStore.set(snapshotId, snapshot);
-        this.logger.debug("State saved to disk (memory fallback)", { pluginId, snapshotId });
-        break;
-      case "distributed":
-        this.memoryStore.set(snapshotId, snapshot);
-        this.logger.debug("State saved to distributed store (memory fallback)", {
-          pluginId,
-          snapshotId
-        });
-        break;
       case "none":
         this.logger.debug("State persistence disabled", { pluginId });
         break;
@@ -6278,7 +6769,7 @@ var PluginStateManager = class {
    */
   calculateChecksum(state) {
     const stateStr = JSON.stringify(state);
-    return createHash3("sha256").update(stateStr).digest("hex");
+    return createHash4("sha256").update(stateStr).digest("hex");
   }
   /**
    * Shutdown state manager
@@ -6292,7 +6783,6 @@ var PluginStateManager = class {
 var HotReloadManager = class {
   constructor(logger) {
     this.reloadConfigs = /* @__PURE__ */ new Map();
-    this.watchHandles = /* @__PURE__ */ new Map();
     this.reloadTimers = /* @__PURE__ */ new Map();
     this.logger = logger.child({ component: "HotReload" });
     this.stateManager = new PluginStateManager(logger);
@@ -6301,6 +6791,8 @@ var HotReloadManager = class {
    * Register a plugin for hot reload
    */
   registerPlugin(pluginName, config) {
+    assertHonouredStateStrategy(pluginName, config.stateStrategy);
+    assertNoRetiredKeys2(pluginName, config);
     if (!config.enabled) {
       this.logger.debug("Hot reload disabled for plugin", { plugin: pluginName });
       return;
@@ -6308,32 +6800,45 @@ var HotReloadManager = class {
     this.reloadConfigs.set(pluginName, config);
     this.logger.info("Plugin registered for hot reload", {
       plugin: pluginName,
-      watchPatterns: config.watchPatterns,
       stateStrategy: config.stateStrategy
     });
   }
   /**
-   * Start watching for changes (requires file system integration)
+   * Refuse the file-watching call this class never implemented (#12428).
+   *
+   * The body used to be a guard plus `logger.info('File watching started')`
+   * over an in-source note saying real watching "would require chokidar or
+   * similar". Nothing was ever watched, so an operator who set
+   * `enabled: true` and read that line at INFO had been told the opposite of
+   * the truth — positive confirmation of a capability that did not exist.
+   * ADR-0049 leaves three states and this surface qualified for none of the
+   * other two: no runtime composes this class, so ENFORCE would build for a
+   * caller that does not exist, and no roadmap entry anywhere claims the
+   * feature, so EXPERIMENTAL would be a promise nobody made.
+   *
+   * Kept as a throwing door rather than deleted: removing the method leaves a
+   * JavaScript host a bare `TypeError: not a function` with no prescription,
+   * and this is the one place a caller of the old placeholder is guaranteed
+   * to arrive. The refusal carries an ADR-0112 envelope so it can be asserted
+   * rather than merely caught.
    */
   startWatching(pluginName) {
-    const config = this.reloadConfigs.get(pluginName);
-    if (!config || !config.enabled) {
-      return;
-    }
-    this.logger.info("File watching started", {
-      plugin: pluginName,
-      patterns: config.watchPatterns
-    });
+    throw hotReloadRefusal(
+      `[HotReload] Plugin '${pluginName}': startWatching() never watched anything and was removed in @objectstack/core 18 (ADR-0049 enforce-or-remove). It logged 'File watching started' at info level while no watcher was ever constructed, so no file change could ever trigger a reload. File watching is the HOST's job in this host-driven library: run your own watcher and call \`HotReloadManager.scheduleReload(pluginName, reloadFn)\` when a file changes \u2014 that is the debounced integration point this class does implement. \`HotReloadConfig.watchPatterns\` was removed in @objectstack/spec 18 for the same reason; declare your globs where your watcher reads them.`
+    );
   }
   /**
-   * Stop watching for changes
+   * Cancel a pending debounced reload for a plugin.
+   *
+   * The name is historical (#12428). This never stopped a watcher, because
+   * nothing in this class ever started one: its `watchHandles` cleanup branch
+   * read a Map that had no writer anywhere in the tree, so the branch was
+   * structurally unreachable rather than merely untaken, and it left with
+   * `startWatching`'s placeholder. What survives is the half that always did
+   * something — the debounce timer armed by `scheduleReload` is cleared, so a
+   * reload that was scheduled but has not fired yet is cancelled.
    */
   stopWatching(pluginName) {
-    const handle = this.watchHandles.get(pluginName);
-    if (handle) {
-      this.watchHandles.delete(pluginName);
-      this.logger.info("File watching stopped", { plugin: pluginName });
-    }
     const timer = this.reloadTimers.get(pluginName);
     if (timer) {
       clearTimeout(timer);
@@ -6476,14 +6981,10 @@ var HotReloadManager = class {
    * Shutdown hot reload manager
    */
   shutdown() {
-    for (const pluginName of this.watchHandles.keys()) {
-      this.stopWatching(pluginName);
-    }
     for (const timer of this.reloadTimers.values()) {
       clearTimeout(timer);
     }
     this.reloadConfigs.clear();
-    this.watchHandles.clear();
     this.reloadTimers.clear();
     this.stateManager.shutdown();
     this.logger.info("Hot reload manager shutdown complete");
@@ -6892,6 +7393,7 @@ var NamespaceResolver = class {
 // src/index.ts
 import { UNMATCHED_ROUTE_PATTERN } from "@objectstack/spec/contracts";
 export {
+  ADMIN_STANDING_NON_TABLE_INPUTS,
   ADMIN_STANDING_SURFACE,
   ANONYMOUS_DENY_BODY,
   ANONYMOUS_DENY_CODE,
@@ -6900,11 +7402,19 @@ export {
   API_KEY_PREFIX,
   AUDIENCE_BINDING_SUGGESTION_STATUSES,
   AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES,
+  AUTHZ_GRANTS_CACHE_TTL_ENV,
+  AUTHZ_INVALIDATED_CHANNEL,
+  AUTHZ_STORE_UNAVAILABLE_CODE,
+  AUTHZ_STORE_UNAVAILABLE_MESSAGE,
+  AUTHZ_STORE_UNAVAILABLE_STATUS,
+  AuthzStoreUnavailableError,
   CORE_FALLBACK_FACTORIES,
   DependencyResolver,
   ENTRY_EXECUTION_CONTEXT_FIELDS,
   HotReloadManager,
+  InMemoryMetadataActivationStore,
   LiteKernel,
+  METADATA_ACTIVATION_TABLE,
   MigrationJournalRefusal,
   MigrationPlanRegistry,
   NamespaceResolver,
@@ -6912,10 +7422,11 @@ export {
   ObjectKernel,
   ObjectKernelBase,
   ObjectLogger,
+  ObjectStoreMetadataActivationStore,
+  PLATFORM_ADMIN_EMAIL_SEPARATOR,
   POSTURE_INJECTION_RULE,
   POSTURE_LADDER,
   POSTURE_RANK,
-  PluginConfigValidator,
   PluginHealthMonitor,
   PluginLoader,
   PluginPermissionEnforcer,
@@ -6924,6 +7435,7 @@ export {
   PluginSecurityScanner,
   PluginSignatureVerifier,
   qa_exports as QA,
+  SERVICE_NOT_REGISTERED_CODE,
   SIGNATURE_ALG,
   SecurePluginContext,
   SemanticVersionManager,
@@ -6933,6 +7445,7 @@ export {
   UnresolvedFilterTokenError,
   adminStandingColumns,
   adminStandingTables,
+  artifactPackageId,
   assembleExecutionContext,
   assembleExecutionContextOrGuest,
   assertInitServiceRequirements,
@@ -6951,7 +7464,6 @@ export {
   createMemoryJob,
   createMemoryMetadata,
   createMemoryQueue,
-  createPluginConfigValidator,
   createPluginPermissionEnforcer,
   deepMerge,
   defaultIsTransientError,
@@ -6963,48 +7475,67 @@ export {
   extractApiKey,
   filterTokenContextFrom,
   findInterruptedRuns,
+  formatIntegrityViolation,
   generateApiKey,
   generateEd25519KeyPair,
   getEnv,
   getMemoryUsage,
+  hasPlatformAdminStanding,
   hashApiKey,
   hashMigrationPlan,
   isAudienceBindingSuggestionStatus,
   isAuthGateAllowlisted,
+  isAuthzStoreUnavailableError,
+  isConfiguredPlatformAdminEmail,
   isExpired,
   isGrantActive,
   isGrantExpired,
   isNode,
   isRowActive,
+  isServiceNotRegisteredError,
   isUninterpretableTemporalComparand,
+  matchesConfiguredPlatformAdmin,
   nextUtcCalendarDay,
   normalizeAuthGate,
+  normalizePlatformAdminEmail,
   omitInternalFieldsFromWriteResponse,
+  parsePlatformAdminEmails,
   parseScopes,
   parseSignature,
   planChunks,
   postureVisibleRows,
   readAuthoredTranslationLayer,
+  readAuthzGrantsCacheTtlMs,
   readRunJournal,
   recordNotFoundError,
+  reportAuthzCachePosture,
+  reportLegacyPlatformAdminGrant,
+  resetLegacyPlatformAdminGrantReport,
+  resetPlatformAdminEmailMemo,
   resolveApiKeyAdmission,
   resolveApiKeyPrincipal,
+  resolveArtifactPackageOrder,
+  resolveAuthzCachePosture,
   resolveAuthzContext,
   resolveFilterToken,
   resolveFilterTokens,
   resolveLocale,
   resolveLocalizationContext,
+  resolvePlatformAdminEmails,
   resolvePluginOrder,
   resolveUserAuthzGrants,
   resumeMigrationJournal,
+  rethrowAuthzStoreUnavailable,
   runMigrationJournal,
   safeExit,
+  setPlatformAdminConfigSink,
   shouldDenyAnonymous,
   signPayload,
   temporalComparandKind,
   unknownAudienceBindingSuggestionStatusMessage,
   utcInstantMs,
   validateInitServiceContract,
+  verifyIntegrity,
   verifyPayload,
   verifyPlatformSignature,
   verifyPluginArtifact,