@objectstack/core 17.3.0 → 17.4.0

package/dist/index.cjs

@@ -32,6 +32,7 @@ var index_exports = {};
 __export(index_exports, {
   ADMIN_STANDING_NON_TABLE_INPUTS: () => ADMIN_STANDING_NON_TABLE_INPUTS,
   ADMIN_STANDING_SURFACE: () => ADMIN_STANDING_SURFACE,
+  ADVISORY_SAMPLE_ROWS: () => ADVISORY_SAMPLE_ROWS,
   ANONYMOUS_DENY_BODY: () => ANONYMOUS_DENY_BODY,
   ANONYMOUS_DENY_CODE: () => ANONYMOUS_DENY_CODE,
   ANONYMOUS_DENY_MESSAGE: () => ANONYMOUS_DENY_MESSAGE,
@@ -69,7 +70,6 @@ __export(index_exports, {
   PluginPermissionEnforcer: () => PluginPermissionEnforcer,
   PluginPermissionManager: () => PluginPermissionManager,
   PluginSandboxRuntime: () => PluginSandboxRuntime,
-  PluginSecurityScanner: () => PluginSecurityScanner,
   PluginSignatureVerifier: () => PluginSignatureVerifier,
   QA: () => qa_exports,
   SERVICE_NOT_REGISTERED_CODE: () => SERVICE_NOT_REGISTERED_CODE,
@@ -120,6 +120,7 @@ __export(index_exports, {
   hasPlatformAdminStanding: () => hasPlatformAdminStanding,
   hashApiKey: () => hashApiKey,
   hashMigrationPlan: () => hashMigrationPlan,
+  isAggregatingAdvisories: () => isAggregatingAdvisories,
   isAudienceBindingSuggestionStatus: () => isAudienceBindingSuggestionStatus,
   isAuthGateAllowlisted: () => isAuthGateAllowlisted,
   isAuthzStoreUnavailableError: () => isAuthzStoreUnavailableError,
@@ -144,6 +145,7 @@ __export(index_exports, {
   readAuthoredTranslationLayer: () => readAuthoredTranslationLayer,
   readAuthzGrantsCacheTtlMs: () => readAuthzGrantsCacheTtlMs,
   readRunJournal: () => readRunJournal,
+  recordAdvisoryHit: () => recordAdvisoryHit,
   recordNotFoundError: () => recordNotFoundError,
   reportAuthzCachePosture: () => reportAuthzCachePosture,
   reportLegacyPlatformAdminGrant: () => reportLegacyPlatformAdminGrant,
@@ -164,6 +166,7 @@ __export(index_exports, {
   resumeMigrationJournal: () => resumeMigrationJournal,
   rethrowAuthzStoreUnavailable: () => rethrowAuthzStoreUnavailable,
   runMigrationJournal: () => runMigrationJournal,
+  runWithAdvisoryAggregation: () => runWithAdvisoryAggregation,
   safeExit: () => safeExit,
   setPlatformAdminConfigSink: () => setPlatformAdminConfigSink,
   shouldDenyAnonymous: () => shouldDenyAnonymous,
@@ -998,6 +1001,29 @@ function isServiceNotRegisteredError(err) {
   return typeof err === "object" && err !== null && err[SERVICE_NOT_REGISTERED_BRAND] === true;
 }
 
+// src/plugin-contract.ts
+var import_kernel = require("@objectstack/spec/kernel");
+var PLUGIN_CONTRACT_VIOLATION_CODE = "PLUGIN_CONTRACT_VIOLATION";
+function assertPluginContract(plugin) {
+  const result = import_kernel.PluginSchema.safeParse(plugin);
+  if (result.success) {
+    return;
+  }
+  const issues = result.error.issues.filter((issue) => issue.path[0] !== "version");
+  if (issues.length === 0) {
+    return;
+  }
+  const first = issues[0];
+  const at = first.path.length > 0 ? first.path.join(".") : "(root)";
+  const id = plugin.id;
+  const named = typeof id === "string" && id.length > 0 ? `'${plugin.name}' (id: ${id})` : `'${plugin.name}'`;
+  const error = new Error(
+    `${PLUGIN_CONTRACT_VIOLATION_CODE}: plugin ${named} is refused by the declared plugin contract at '${at}': ${first.message}`
+  );
+  error.code = PLUGIN_CONTRACT_VIOLATION_CODE;
+  throw error;
+}
+
 // src/plugin-loader.ts
 var ServiceLifecycle = /* @__PURE__ */ ((ServiceLifecycle2) => {
   ServiceLifecycle2["SINGLETON"] = "singleton";
@@ -1035,6 +1061,7 @@ var PluginLoader = class {
       this.logger.info(`Loading plugin: ${plugin.name}`);
       const metadata = this.toPluginMetadata(plugin);
       this.validatePluginStructure(metadata);
+      this.validatePluginContract(metadata);
       const versionCheck = this.checkVersionCompatibility(metadata);
       if (!versionCheck.compatible) {
         throw new Error(`Version incompatible: ${versionCheck.message}`);
@@ -1219,6 +1246,27 @@ var PluginLoader = class {
       throw new Error(`Invalid semantic version: ${plugin.version}`);
     }
   }
+  /**
+   * Refuse a plugin object the DECLARED plugin contract refuses (#16049,
+   * maintainer ruling 2026-09-06: "the protocol is the baseline; the runtime
+   * aligns to it").
+   *
+   * The check itself — `PluginSchema.safeParse` for validation only, the
+   * eight keys it reaches, the `version` exclusion and the
+   * `PLUGIN_CONTRACT_VIOLATION` envelope — lives in `plugin-contract.ts`,
+   * because since #16721 it is ONE statement run by BOTH kernels:
+   * `LiteKernel.use()` calls it directly, and `ObjectKernel.use()` reaches
+   * it here, through `loadPlugin`. That module's comment is the authority on
+   * what is refused; this method adds nothing to it and subtracts nothing.
+   *
+   * What stays THIS loader's own, and is deliberately not shared: the
+   * structural checks one call up ({@link validatePluginStructure} —
+   * `name`, `init`, semver) and the version-compatibility check below.
+   * The convergence is on the schema, not on the loader.
+   */
+  validatePluginContract(plugin) {
+    assertPluginContract(plugin);
+  }
   checkVersionCompatibility(plugin) {
     const version = plugin.version;
     if (!this.isValidSemanticVersion(version)) {
@@ -1428,6 +1476,7 @@ function createMemoryI18n() {
   const authored = /* @__PURE__ */ new Map();
   let defaultLocale = "en";
   let supportedLocales;
+  let fallbackLocale;
   function resolveKey(data, key) {
     const parts = key.split(".");
     let current = data;
@@ -1464,7 +1513,11 @@ function createMemoryI18n() {
     _serviceName: "i18n",
     t(key, locale, params) {
       const data = resolveTranslations(locale) ?? mergedLocale(defaultLocale);
-      const value = data ? resolveKey(data, key) : void 0;
+      let value = data ? resolveKey(data, key) : void 0;
+      if (value === void 0 && fallbackLocale && fallbackLocale !== locale) {
+        const fallbackData = resolveTranslations(fallbackLocale);
+        value = fallbackData ? resolveKey(fallbackData, key) : void 0;
+      }
       if (value == null) return key;
       if (!params) return value;
       return value.replace(/\{\{(\w+)\}\}/g, (_, name) => String(params[name] ?? `{{${name}}}`));
@@ -1521,6 +1574,21 @@ function createMemoryI18n() {
     },
     setDefaultLocale(locale) {
       defaultLocale = locale;
+    },
+    /**
+     * @see II18nService.setFallbackLocale — [#15694]
+     *
+     * ⛔ There is deliberately NO `getFallbackLocale()` beside this. The two
+     * are different questions: this one is what the provider was TOLD, the
+     * accessor is what the serving layer ASKS it in order to build the
+     * metadata-document translators' fallback chain (#14882). Answering the
+     * second from `defaultLocale` — the only value that was always available
+     * here — would settle the default-locale contract question #14882 leaves
+     * deliberately open, from a degraded provider. Without the accessor those
+     * reads keep the resolvers' own default, which is known and intentional.
+     */
+    setFallbackLocale(locale) {
+      fallbackLocale = locale;
     }
   };
 }
@@ -1846,6 +1914,7 @@ async function raceWithTimeout(operation, timeoutMs, createTimeoutError) {
 }
 
 // src/kernel.ts
+var DEGRADED_CAPABILITIES_SERVICE = "kernel.degraded-capabilities";
 var ObjectKernel = class {
   constructor(config = {}) {
     this.plugins = /* @__PURE__ */ new Map();
@@ -1853,7 +1922,12 @@ var ObjectKernel = class {
     this.hooks = /* @__PURE__ */ new Map();
     this.state = "idle";
     this.startedPlugins = /* @__PURE__ */ new Set();
-    this.pluginStartTimes = /* @__PURE__ */ new Map();
+    /**
+     * Plugin name -> elapsed milliseconds that plugin's `start()` took. These
+     * are DURATIONS, never start instants; the old spelling `pluginStartTimes`
+     * said the opposite of what it held.
+     */
+    this.pluginStartupDurations = /* @__PURE__ */ new Map();
     this.shutdownHandlers = [];
     this.config = {
       defaultStartupTimeout: 3e4,
@@ -2040,9 +2114,40 @@ var ObjectKernel = class {
     }
     if (missingCoreServices.length > 0) {
       this.logger.warn(`System started with degraded capabilities. Missing core services: ${missingCoreServices.join(", ")}`);
+      this.publishDegradedCapabilities(missingCoreServices);
     }
     this.logger.info("System requirement check passed");
   }
+  /**
+   * Publish this boot's degraded-capabilities conclusion on
+   * {@link DEGRADED_CAPABILITIES_SERVICE} — the data half of the warning
+   * `validateSystemRequirements()` just logged (#16630).
+   *
+   * ⛔ Best-effort, and silent on failure BY DESIGN: this is a diagnostic
+   * readout, and a readout must never be able to fail a boot that the kernel
+   * has just decided is good enough to run. The one way `registerService`
+   * can throw here is a name collision, which the guard above already
+   * forecloses; the `catch` is there so that stays true if either ever
+   * changes. (`recordSeedOutcome` in `@objectstack/runtime` states the same
+   * rule for the same reason.)
+   *
+   * The value is FROZEN and holds a COPY. `getService` hands out the stored
+   * reference, so an unfrozen live array would let any reader edit the
+   * kernel's own record of what was missing — and this record exists
+   * precisely so that two packages cannot disagree about it.
+   */
+  publishDegradedCapabilities(missingCoreServices) {
+    try {
+      if (this.services.has(DEGRADED_CAPABILITIES_SERVICE) || this.pluginLoader.hasService(DEGRADED_CAPABILITIES_SERVICE)) {
+        return;
+      }
+      this.registerService(
+        DEGRADED_CAPABILITIES_SERVICE,
+        Object.freeze({ missingCoreServices: Object.freeze([...missingCoreServices]) })
+      );
+    } catch {
+    }
+  }
   /**
    * Bootstrap the kernel with enhanced features
    */
@@ -2155,11 +2260,23 @@ var ObjectKernel = class {
     }
     return results;
   }
+  /**
+   * Per-plugin startup durations: plugin name -> elapsed milliseconds that
+   * plugin's `start()` took. Not start instants -- see
+   * {@link PluginStartupResult.durationMs}.
+   */
+  getPluginStartupDurations() {
+    return new Map(this.pluginStartupDurations);
+  }
   /**
    * Get plugin startup metrics
+   *
+   * @deprecated Renamed to {@link ObjectKernel.getPluginStartupDurations},
+   * which states what the values are. Retained as a delegating alias so
+   * nothing has to change on this release; slated for removal.
    */
   getPluginMetrics() {
-    return new Map(this.pluginStartTimes);
+    return this.getPluginStartupDurations();
   }
   /**
    * Whether a plugin with the given name has been registered on this kernel.
@@ -2281,11 +2398,14 @@ var ObjectKernel = class {
       );
       const duration = Date.now() - startTime;
       this.startedPlugins.add(plugin.name);
-      this.pluginStartTimes.set(plugin.name, duration);
+      this.pluginStartupDurations.set(plugin.name, duration);
       this.logger.debug(`Plugin started: ${plugin.name} (${duration}ms)`);
       return {
         success: true,
         pluginName: plugin.name,
+        durationMs: duration,
+        // Deprecated alias carrying the same elapsed value; see
+        // PluginStartupResult.startTime.
         startTime: duration
       };
     } catch (error) {
@@ -2295,6 +2415,9 @@ var ObjectKernel = class {
         success: false,
         pluginName: plugin.name,
         error,
+        durationMs: duration,
+        // Deprecated alias carrying the same elapsed value; see
+        // PluginStartupResult.startTime.
         startTime: duration,
         timedOut: isTimeout
       };
@@ -2482,6 +2605,26 @@ var LiteKernel = class extends ObjectKernelBase {
    * Register a plugin
    * @param plugin - Plugin instance
    *
+   * A plugin object the DECLARED plugin contract refuses is refused here,
+   * with `PLUGIN_CONTRACT_VIOLATION` — the same check, the same envelope,
+   * that `ObjectKernel.use()` runs through `PluginLoader` (`plugin-contract.ts`
+   * is the one statement both kernels call; #16721, maintainer ruling
+   * 2026-09-08, option A under #9864's precedent that the kernels converge).
+   *
+   * This method used to write the object straight into the registry, so the
+   * same plugin was accepted by this kernel and refused by `ObjectKernel` —
+   * and `AGENTS.md` names THIS kernel for tests, so a plugin could be green
+   * in vitest and refused at production boot. Measured before converging
+   * (#16721 step 1): of 813 `LiteKernel.use()` calls reachable in this
+   * repository's suites, 807 were accepted by the schema unchanged and the
+   * six refusals came from three test-local fixture objects, none of them
+   * product code.
+   *
+   * Ordering, and why it is pinned: state first (`validateIdle`), then the
+   * contract, then registration — a refused plugin never reaches the
+   * registry, so it can neither be booted nor supersede an earlier
+   * registration under its name.
+   *
    * Duplicate names OVERWRITE, with one `warn` naming both versions — the
    * declared contract in `plugin-registration.ts`, applied identically by
    * `ObjectKernel.use()` (#9864, maintainer ruling 2026-08-19).
@@ -2495,6 +2638,7 @@ var LiteKernel = class extends ObjectKernelBase {
    */
   use(plugin) {
     this.validateIdle();
+    assertPluginContract(plugin);
     registerPluginByName(this.plugins, plugin, this.logger);
     return this;
   }
@@ -4120,228 +4264,6 @@ var _PluginSandboxRuntime = class _PluginSandboxRuntime {
 _PluginSandboxRuntime.MONITORING_INTERVAL_MS = 5e3;
 var PluginSandboxRuntime = _PluginSandboxRuntime;
 
-// src/security/security-scanner.ts
-var PluginSecurityScanner = class {
-  constructor(logger, config) {
-    // Known vulnerabilities database (CVE cache)
-    this.vulnerabilityDb = /* @__PURE__ */ new Map();
-    // Scan results cache
-    this.scanResults = /* @__PURE__ */ new Map();
-    this.passThreshold = 70;
-    this.logger = logger.child({ component: "SecurityScanner" });
-    if (config?.passThreshold !== void 0) {
-      this.passThreshold = config.passThreshold;
-    }
-  }
-  /**
-   * Perform a comprehensive security scan on a plugin
-   */
-  async scan(target) {
-    this.logger.info("Starting security scan", {
-      pluginId: target.pluginId,
-      version: target.version
-    });
-    const issues = [];
-    try {
-      const codeIssues = await this.scanCode(target);
-      issues.push(...codeIssues);
-      const depIssues = await this.scanDependencies(target);
-      issues.push(...depIssues);
-      const malwareIssues = await this.scanMalware(target);
-      issues.push(...malwareIssues);
-      const licenseIssues = await this.scanLicenses(target);
-      issues.push(...licenseIssues);
-      const configIssues = await this.scanConfiguration(target);
-      issues.push(...configIssues);
-      const score = this.calculateSecurityScore(issues);
-      const result = {
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        scanner: { name: "ObjectStack Security Scanner", version: "1.0.0" },
-        status: score >= this.passThreshold ? "passed" : "failed",
-        vulnerabilities: issues.map((issue) => ({
-          id: issue.id,
-          severity: issue.severity,
-          category: issue.category,
-          title: issue.title,
-          description: issue.description,
-          location: issue.location ? `${issue.location.file}:${issue.location.line}` : void 0,
-          remediation: issue.remediation,
-          affectedVersions: [],
-          exploitAvailable: false,
-          patchAvailable: false
-        })),
-        summary: {
-          totalVulnerabilities: issues.length,
-          criticalCount: issues.filter((i) => i.severity === "critical").length,
-          highCount: issues.filter((i) => i.severity === "high").length,
-          mediumCount: issues.filter((i) => i.severity === "medium").length,
-          lowCount: issues.filter((i) => i.severity === "low").length,
-          infoCount: issues.filter((i) => i.severity === "info").length
-        }
-      };
-      this.scanResults.set(`${target.pluginId}:${target.version}`, result);
-      this.logger.info("Security scan complete", {
-        pluginId: target.pluginId,
-        score,
-        status: result.status,
-        summary: result.summary
-      });
-      return result;
-    } catch (error) {
-      this.logger.error("Security scan failed", {
-        pluginId: target.pluginId,
-        error
-      });
-      throw error;
-    }
-  }
-  /**
-   * Scan code for vulnerabilities
-   */
-  async scanCode(target) {
-    const issues = [];
-    this.logger.debug("Code scan complete", {
-      pluginId: target.pluginId,
-      issuesFound: issues.length
-    });
-    return issues;
-  }
-  /**
-   * Scan dependencies for known vulnerabilities
-   */
-  async scanDependencies(target) {
-    const issues = [];
-    if (!target.dependencies) {
-      return issues;
-    }
-    for (const [depName, version] of Object.entries(target.dependencies)) {
-      const vulnKey = `${depName}@${version}`;
-      const vulnerability = this.vulnerabilityDb.get(vulnKey);
-      if (vulnerability) {
-        issues.push({
-          id: `vuln-${vulnerability.cve || depName}`,
-          severity: vulnerability.severity,
-          category: "vulnerability",
-          title: `Vulnerable dependency: ${depName}`,
-          description: `${depName}@${version} has known security vulnerabilities`,
-          remediation: vulnerability.fixedIn ? `Upgrade to ${vulnerability.fixedIn.join(" or ")}` : "No fix available",
-          cve: vulnerability.cve
-        });
-      }
-    }
-    this.logger.debug("Dependency scan complete", {
-      pluginId: target.pluginId,
-      dependencies: Object.keys(target.dependencies).length,
-      vulnerabilities: issues.length
-    });
-    return issues;
-  }
-  /**
-   * Scan for malware patterns
-   */
-  async scanMalware(target) {
-    const issues = [];
-    this.logger.debug("Malware scan complete", {
-      pluginId: target.pluginId,
-      issuesFound: issues.length
-    });
-    return issues;
-  }
-  /**
-   * Check license compliance
-   */
-  async scanLicenses(target) {
-    const issues = [];
-    if (!target.dependencies) {
-      return issues;
-    }
-    this.logger.debug("License scan complete", {
-      pluginId: target.pluginId,
-      issuesFound: issues.length
-    });
-    return issues;
-  }
-  /**
-   * Check configuration security
-   */
-  async scanConfiguration(target) {
-    const issues = [];
-    this.logger.debug("Configuration scan complete", {
-      pluginId: target.pluginId,
-      issuesFound: issues.length
-    });
-    return issues;
-  }
-  /**
-   * Calculate security score based on issues
-   */
-  calculateSecurityScore(issues) {
-    let score = 100;
-    for (const issue of issues) {
-      switch (issue.severity) {
-        case "critical":
-          score -= 20;
-          break;
-        case "high":
-          score -= 10;
-          break;
-        case "medium":
-          score -= 5;
-          break;
-        case "low":
-          score -= 2;
-          break;
-        case "info":
-          score -= 0;
-          break;
-      }
-    }
-    return Math.max(0, score);
-  }
-  /**
-   * Add a vulnerability to the database
-   */
-  addVulnerability(packageName, version, vulnerability) {
-    const key = `${packageName}@${version}`;
-    this.vulnerabilityDb.set(key, vulnerability);
-    this.logger.debug("Vulnerability added to database", {
-      package: packageName,
-      version,
-      cve: vulnerability.cve
-    });
-  }
-  /**
-   * Get scan result from cache
-   */
-  getScanResult(pluginId, version) {
-    return this.scanResults.get(`${pluginId}:${version}`);
-  }
-  /**
-   * Clear scan results cache
-   */
-  clearCache() {
-    this.scanResults.clear();
-    this.logger.debug("Scan results cache cleared");
-  }
-  /**
-   * Update vulnerability database from external source
-   */
-  async updateVulnerabilityDatabase() {
-    this.logger.info("Updating vulnerability database");
-    this.logger.info("Vulnerability database updated", {
-      entries: this.vulnerabilityDb.size
-    });
-  }
-  /**
-   * Shutdown security scanner
-   */
-  shutdown() {
-    this.vulnerabilityDb.clear();
-    this.scanResults.clear();
-    this.logger.info("Security scanner shutdown complete");
-  }
-};
-
 // src/security/api-key.ts
 var import_node_crypto3 = require("crypto");
 var import_security = require("@objectstack/spec/security");
@@ -4428,19 +4350,22 @@ async function resolveApiKeyAdmission(ql, headers, nowMs = Date.now(), tenancyPo
   const userId = row.user_id ?? row.userId;
   if (!userId || typeof userId !== "string") return { outcome: "none" };
   const tenantId = typeof row.active_organization_id === "string" && row.active_organization_id ? row.active_organization_id : void 0;
+  const keyId = typeof row.id === "string" && row.id ? row.id : void 0;
   if (!tenantId && tenancyPosture) {
     const posture = tenancyPosture;
     if ((0, import_security.postureEnforcesWall)(posture) && !(0, import_security.postureUsesUnionScope)(posture)) {
       return {
         outcome: "refused",
         reason: "organization_required",
+        keyId,
+        userId,
         message: "This API key carries no organization and cannot be used under the `isolated` tenancy posture, where every organization-scoped read is walled to an active organization. Mint a replacement key \u2014 new keys inherit the minter\u2019s active organization."
       };
     }
   }
   return {
     outcome: "admitted",
-    principal: { userId, tenantId, scopes: parseScopes(row.scopes) }
+    principal: { userId, keyId, tenantId, scopes: parseScopes(row.scopes) }
   };
 }
 function readHeader(headers, name) {
@@ -4498,6 +4423,7 @@ function rethrowAuthzStoreUnavailable(err) {
 var import_types2 = require("@objectstack/types");
 var import_spec2 = require("@objectstack/spec");
 var import_security2 = require("@objectstack/spec/security");
+var import_shared = require("@objectstack/spec/shared");
 
 // src/security/grant-validity.ts
 function toEpochMs(value) {
@@ -4832,6 +4758,18 @@ function safeJsonParse2(s, fallback) {
     return fallback;
   }
 }
+function warnApiKeyRefusal(details) {
+  const { reason, keyId, userId, organizationId } = details;
+  console.warn(
+    `[security] API key refused (${reason}): key=${keyId ?? "<unknown>"} principal=${userId ?? "<unknown>"} organization=${organizationId ?? "<none>"}. The caller received the generic 401 UNAUTHENTICATED \u2014 this reason is server-side only.`
+  );
+}
+function warnSessionOrganizationClaimDropped(details) {
+  const { reason, sessionId, userId, organizationId } = details;
+  console.warn(
+    `[security] Session organization claim dropped (${reason}): session=${sessionId ?? "<unknown>"} principal=${userId ?? "<unknown>"} organization=${organizationId ?? "<none>"}. The session stays authenticated with NO active organization \u2014 the wire is unchanged.`
+  );
+}
 async function tryFind(ql, object, where, limit = 100, organizationId) {
   if (!ql || typeof ql.find !== "function") return [];
   try {
@@ -4855,9 +4793,15 @@ async function resolveAuthzContext(input) {
   };
   let userId;
   let tenantId;
+  let sessionId;
   const admission = await resolveApiKeyAdmission(ql, headers, input.nowMs, input.tenancyPosture);
   if (admission.outcome === "refused") {
-    ctx.authRefusal = { reason: admission.reason, message: admission.message };
+    warnApiKeyRefusal({
+      reason: admission.reason,
+      keyId: admission.keyId,
+      userId: admission.userId,
+      organizationId: admission.organizationId
+    });
     return ctx;
   }
   const keyPrincipal = admission.outcome === "admitted" ? admission.principal : void 0;
@@ -4873,6 +4817,8 @@ async function resolveAuthzContext(input) {
       const sessionData = await input.getSession(headers);
       userId = sessionData?.user?.id ?? sessionData?.session?.userId;
       tenantId = tenantId ?? sessionData?.session?.activeOrganizationId;
+      const rawSessionId = sessionData?.session?.id;
+      sessionId = typeof rawSessionId === "string" && rawSessionId ? rawSessionId : void 0;
       ctx.accessToken = sessionData?.session?.token ?? ctx.accessToken;
       if (sessionData?.user?.email) ctx.email = String(sessionData.user.email);
     } catch {
@@ -4882,7 +4828,7 @@ async function resolveAuthzContext(input) {
   ctx.userId = userId;
   if (tenantId) ctx.tenantId = tenantId;
   if (!ql || typeof ql.find !== "function") return ctx;
-  const grants = await resolveUserAuthzGrants(ql, userId, {
+  let grants = await resolveUserAuthzGrants(ql, userId, {
     tenantId,
     nowMs: input.nowMs,
     seedPermissions: ctx.permissions,
@@ -4891,19 +4837,37 @@ async function resolveAuthzContext(input) {
   if (keyPrincipal?.tenantId && input.tenancyPosture) {
     const posture = input.tenancyPosture;
     if ((0, import_security2.postureEnforcesWall)(posture) && !grants.accessible_org_ids.includes(keyPrincipal.tenantId)) {
+      warnApiKeyRefusal({
+        reason: "organization_membership_ended",
+        keyId: keyPrincipal.keyId,
+        userId: keyPrincipal.userId,
+        organizationId: keyPrincipal.tenantId
+      });
       return {
         positions: [],
         permissions: [],
         systemPermissions: [],
         org_user_ids: [],
-        accessible_org_ids: [],
-        authRefusal: {
-          reason: "organization_membership_ended",
-          message: "This API key authenticates into an organization its owner is no longer a member of. The key was not revoked \u2014 the membership that backed it ended."
-        }
+        accessible_org_ids: []
       };
     }
   }
+  if (!keyPrincipal && tenantId && input.tenancyPosture && (0, import_security2.postureEnforcesWall)(input.tenancyPosture) && !grants.accessible_org_ids.includes(tenantId)) {
+    warnSessionOrganizationClaimDropped({
+      reason: "organization_membership_ended",
+      sessionId,
+      userId,
+      organizationId: tenantId
+    });
+    tenantId = void 0;
+    delete ctx.tenantId;
+    grants = await resolveUserAuthzGrants(ql, userId, {
+      tenantId,
+      nowMs: input.nowMs,
+      seedPermissions: ctx.permissions,
+      seedEmail: ctx.email
+    });
+  }
   ctx.positions = grants.positions;
   ctx.permissions = grants.permissions;
   ctx.systemPermissions = grants.systemPermissions;
@@ -5080,17 +5044,9 @@ async function hasPlatformAdminStanding(ql, userId, opts = {}) {
     return false;
   }
 }
-function isValidTimeZone(tz) {
-  try {
-    new Intl.DateTimeFormat("en-US", { timeZone: tz });
-    return true;
-  } catch {
-    return false;
-  }
-}
 function coerceTimeZone(value) {
   const s = typeof value === "string" ? value.trim() : value != null ? String(value).trim() : "";
-  return s && isValidTimeZone(s) ? s : void 0;
+  return s && (0, import_shared.isValueDomainMember)("iana_time_zone", s) ? s : void 0;
 }
 function coerceLocale(value) {
   const s = typeof value === "string" ? value.trim() : value != null ? String(value).trim() : "";
@@ -6177,6 +6133,52 @@ function errText(err) {
   }
 }
 
+// src/utils/advisory-aggregation.ts
+var import_node_async_hooks = require("async_hooks");
+var ADVISORY_SAMPLE_ROWS = 5;
+var storage = new import_node_async_hooks.AsyncLocalStorage();
+function keyOf(object, rule) {
+  return JSON.stringify([object, rule]);
+}
+function recordAdvisoryHit(hit) {
+  const collector = storage.getStore();
+  if (!collector) return false;
+  const key = keyOf(hit.object, hit.rule);
+  const existing = collector.groups.get(key);
+  if (existing) {
+    existing.rows += 1;
+    if (hit.recordRef != null && existing.sampleRows.length < ADVISORY_SAMPLE_ROWS) {
+      existing.sampleRows.push(hit.recordRef);
+    }
+    return true;
+  }
+  collector.groups.set(key, {
+    object: hit.object,
+    rule: hit.rule,
+    severity: hit.severity,
+    message: hit.message,
+    rows: 1,
+    sampleRows: hit.recordRef != null ? [hit.recordRef] : []
+  });
+  return true;
+}
+function isAggregatingAdvisories() {
+  return storage.getStore() !== void 0;
+}
+async function runWithAdvisoryAggregation(fn, report) {
+  const collector = { groups: /* @__PURE__ */ new Map() };
+  try {
+    return await storage.run(collector, fn);
+  } finally {
+    if (collector.groups.size > 0) {
+      try {
+        report([...collector.groups.values()]);
+      } catch {
+      }
+    }
+  }
+}
+
 // src/utils/filter-tokens.ts
 var import_data2 = require("@objectstack/spec/data");
 var UnknownFilterTokenError = class extends Error {
@@ -6692,7 +6694,7 @@ var PluginHealthMonitor = class {
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       message,
       metrics: {
-        uptime: Date.now() - startTime
+        uptimeMs: Date.now() - startTime
       },
       checks: checks.length > 0 ? checks : void 0
     };
@@ -7554,6 +7556,7 @@ var import_contracts = require("@objectstack/spec/contracts");
 0 && (module.exports = {
   ADMIN_STANDING_NON_TABLE_INPUTS,
   ADMIN_STANDING_SURFACE,
+  ADVISORY_SAMPLE_ROWS,
   ANONYMOUS_DENY_BODY,
   ANONYMOUS_DENY_CODE,
   ANONYMOUS_DENY_MESSAGE,
@@ -7591,7 +7594,6 @@ var import_contracts = require("@objectstack/spec/contracts");
   PluginPermissionEnforcer,
   PluginPermissionManager,
   PluginSandboxRuntime,
-  PluginSecurityScanner,
   PluginSignatureVerifier,
   QA,
   SERVICE_NOT_REGISTERED_CODE,
@@ -7642,6 +7644,7 @@ var import_contracts = require("@objectstack/spec/contracts");
   hasPlatformAdminStanding,
   hashApiKey,
   hashMigrationPlan,
+  isAggregatingAdvisories,
   isAudienceBindingSuggestionStatus,
   isAuthGateAllowlisted,
   isAuthzStoreUnavailableError,
@@ -7666,6 +7669,7 @@ var import_contracts = require("@objectstack/spec/contracts");
   readAuthoredTranslationLayer,
   readAuthzGrantsCacheTtlMs,
   readRunJournal,
+  recordAdvisoryHit,
   recordNotFoundError,
   reportAuthzCachePosture,
   reportLegacyPlatformAdminGrant,
@@ -7686,6 +7690,7 @@ var import_contracts = require("@objectstack/spec/contracts");
   resumeMigrationJournal,
   rethrowAuthzStoreUnavailable,
   runMigrationJournal,
+  runWithAdvisoryAggregation,
   safeExit,
   setPlatformAdminConfigSink,
   shouldDenyAnonymous,