@objectstack/core 17.3.0 → 17.4.0

package/dist/index.d.cts

@@ -1,7 +1,7 @@
 import { Logger, LifecycleEventName, IServiceRegistry, AudienceBindingSuggestionFilter, IObjectQLEngine } from '@objectstack/spec/contracts';
 export { EngineSchemaRegistryView, EngineTransactionInfo, EngineTransactionOptions, HttpResponseObservation, HttpResponseObserver, IDataDriver, IDataEngine, IHttpRequest, IHttpResponse, IHttpServer, IObjectQLEngine, Logger, Middleware, RouteHandler, UNMATCHED_ROUTE_PATTERN } from '@objectstack/spec/contracts';
 import { LoggerConfig, MigrationOnCrashPolicy, MigrationJournalEvent } from '@objectstack/spec/system';
-import { CORE_PLUGIN_TYPES, PluginCapability, PluginPermissions as PluginPermissions$1, PluginPermissionSet, ResourceType, PermissionAction, PluginPermission, SandboxConfig, KernelSecurityScanResult, KernelSecurityVulnerability, ExecutionContext, PluginHealthCheckParsed, PluginHealthStatus as PluginHealthStatus$1, PluginHealthReport, HotReloadConfigParsed, VersionConstraint, DependencyConflict, SemanticVersion, CompatibilityLevel } from '@objectstack/spec/kernel';
+import { PluginDefinition, CORE_PLUGIN_TYPES, PluginCapability, PluginPermissions as PluginPermissions$1, PluginPermissionSet, ResourceType, PermissionAction, PluginPermission, SandboxConfig, ExecutionContext, PluginHealthCheckParsed, PluginHealthStatus as PluginHealthStatus$1, PluginHealthReport, HotReloadConfigParsed, VersionConstraint, DependencyConflict, SemanticVersion, CompatibilityLevel } from '@objectstack/spec/kernel';
 import { ObjectLogger } from './logger.cjs';
 export { createLogger } from './logger.cjs';
 import * as QA from '@objectstack/spec/qa';
@@ -72,6 +72,27 @@ interface PluginLoadResult {
 interface PluginStartupResult {
     success: boolean;
     pluginName: string;
+    /**
+     * Elapsed milliseconds the plugin's `start()` took.
+     *
+     * Named for the member `packages/spec` declares for the same measure --
+     * `PluginStartupResultSchema.durationMs` in
+     * `packages/spec/src/kernel/startup-orchestrator.zod.ts` ("Time taken to
+     * start the plugin in milliseconds"), where the bare `duration` spelling is
+     * retired: a duration-shaped number carries its unit in its key name. Like
+     * `PluginLoadResult.loadTime` above, it is the same `Date.now() - startTime`
+     * computation under a name that does not lie.
+     */
+    durationMs?: number;
+    /**
+     * The same elapsed milliseconds as {@link PluginStartupResult.durationMs}.
+     *
+     * @deprecated Misnamed: this has never held an instant, so a reader who
+     * correctly takes `startTime` for one and writes `Date.now() - result.startTime`
+     * gets an age near the epoch instead of a wait. Read `durationMs` instead.
+     * Still populated so nothing has to change on this release (ADR-0087 L1 --
+     * the old shape keeps working while the fleet moves); slated for removal.
+     */
     startTime?: number;
     error?: Error;
     timedOut?: boolean;
@@ -152,6 +173,25 @@ declare class PluginLoader {
     getLoadedPlugins(): Map<string, PluginMetadata>;
     private toPluginMetadata;
     private validatePluginStructure;
+    /**
+     * Refuse a plugin object the DECLARED plugin contract refuses (#16049,
+     * maintainer ruling 2026-09-06: "the protocol is the baseline; the runtime
+     * aligns to it").
+     *
+     * The check itself — `PluginSchema.safeParse` for validation only, the
+     * eight keys it reaches, the `version` exclusion and the
+     * `PLUGIN_CONTRACT_VIOLATION` envelope — lives in `plugin-contract.ts`,
+     * because since #16721 it is ONE statement run by BOTH kernels:
+     * `LiteKernel.use()` calls it directly, and `ObjectKernel.use()` reaches
+     * it here, through `loadPlugin`. That module's comment is the authority on
+     * what is refused; this method adds nothing to it and subtracts nothing.
+     *
+     * What stays THIS loader's own, and is deliberately not shared: the
+     * structural checks one call up ({@link validatePluginStructure} —
+     * `name`, `init`, semver) and the version-compatibility check below.
+     * The convergence is on the schema, not on the loader.
+     */
+    private validatePluginContract;
     private checkVersionCompatibility;
     private isValidSemanticVersion;
     private verifyPluginSignature;
@@ -204,7 +244,12 @@ declare class ObjectKernel {
     private pluginLoader;
     private config;
     private startedPlugins;
-    private pluginStartTimes;
+    /**
+     * Plugin name -> elapsed milliseconds that plugin's `start()` took. These
+     * are DURATIONS, never start instants; the old spelling `pluginStartTimes`
+     * said the opposite of what it held.
+     */
+    private pluginStartupDurations;
     private shutdownHandlers;
     /**
      * Name of the plugin whose init() is currently executing (Phase 1 is
@@ -244,6 +289,25 @@ declare class ObjectKernel {
      * Validate Critical System Requirements
      */
     private validateSystemRequirements;
+    /**
+     * Publish this boot's degraded-capabilities conclusion on
+     * {@link DEGRADED_CAPABILITIES_SERVICE} — the data half of the warning
+     * `validateSystemRequirements()` just logged (#16630).
+     *
+     * ⛔ Best-effort, and silent on failure BY DESIGN: this is a diagnostic
+     * readout, and a readout must never be able to fail a boot that the kernel
+     * has just decided is good enough to run. The one way `registerService`
+     * can throw here is a name collision, which the guard above already
+     * forecloses; the `catch` is there so that stays true if either ever
+     * changes. (`recordSeedOutcome` in `@objectstack/runtime` states the same
+     * rule for the same reason.)
+     *
+     * The value is FROZEN and holds a COPY. `getService` hands out the stored
+     * reference, so an unfrozen live array would let any reader edit the
+     * kernel's own record of what was missing — and this record exists
+     * precisely so that two packages cannot disagree about it.
+     */
+    private publishDegradedCapabilities;
     /**
      * Bootstrap the kernel with enhanced features
      */
@@ -260,8 +324,18 @@ declare class ObjectKernel {
      * Check health of all plugins
      */
     checkAllPluginsHealth(): Promise<Map<string, any>>;
+    /**
+     * Per-plugin startup durations: plugin name -> elapsed milliseconds that
+     * plugin's `start()` took. Not start instants -- see
+     * {@link PluginStartupResult.durationMs}.
+     */
+    getPluginStartupDurations(): Map<string, number>;
     /**
      * Get plugin startup metrics
+     *
+     * @deprecated Renamed to {@link ObjectKernel.getPluginStartupDurations},
+     * which states what the values are. Retained as a delegating alias so
+     * nothing has to change on this release; slated for removal.
      */
     getPluginMetrics(): Map<string, number>;
     /**
@@ -474,24 +548,55 @@ type PluginType = 'standard' | (typeof CORE_PLUGIN_TYPES)[number];
  * Plugin Interface
  *
  * All ObjectStack plugins must implement this interface.
- */
-interface Plugin {
+ *
+ * ## Two halves, one contract (#16334)
+ *
+ * **The metadata half is inherited, not restated.** Every key `PluginSchema`
+ * declares (`@objectstack/spec`, `kernel/plugin.zod.ts`) — `id`, `type`,
+ * `staticPath`, `slug`, `default`, `version`, `description`, `author`,
+ * `homepage` — arrives here through `PluginDefinition`
+ * (`z.input<typeof PluginSchema>`), so the keys the compiler accepts on a
+ * plugin object and the keys `kernel.use()` validates
+ * (`PluginLoader.validatePluginContract`, #16049) are ONE declaration. Before
+ * this the interface spelled `type` and `version` itself and declared neither
+ * `staticPath` nor `slug`, so an in-repo `ui` plugin could not carry the two
+ * keys the schema requires of it without widening its own type — two shapes
+ * for one contract, free to drift.
+ *
+ * **The runtime half is declared here and only here**: `name`, the ADR-0116
+ * ordering declarations, and the `init` / `start` / `destroy` lifecycle. The
+ * spec's schema describes what a plugin OBJECT may say about itself, never
+ * what it does.
+ *
+ * ### `type`
+ *
+ * The inherited `type` is a {@link PluginType} — the closed set the spec
+ * declares (`'standard'` plus `CORE_PLUGIN_TYPES`); `packages/rest`'s
+ * `plugin-type-closed-set.pin.test.ts` pins that the inherited key and the
+ * exported alias are the same union. Absent means `'standard'` at the schema
+ * (`.default('standard')`), and the loader never writes that default back
+ * onto the object. A value outside the set no longer type-checks, and since
+ * #16049 `kernel.use()` REFUSES it at boot — `assertPluginContract`
+ * (`plugin-contract.ts`, run by BOTH `ObjectKernel.use()` and `LiteKernel.use()`
+ * since #16721) runs `PluginSchema` over every plugin object and raises
+ * `PLUGIN_CONTRACT_VIOLATION` naming the plugin and the first violated key.
+ * `type: 'ui'` additionally owes `staticPath` and `slug` (#16334,
+ * `PLUGIN_UI_REQUIRED_KEY_MISSING`), refused on the same path.
+ *
+ * ⚠️ This comment used to say a bad `type` was refused "at parse". It was
+ * measured false (#16049, from #15638): `PluginSchema` had no runtime caller,
+ * kernel plugin objects were never parsed, and a `type` outside the set was
+ * accepted and stored verbatim. The refusal described here is the one that
+ * now exists, on the boot path, and the compiler's arm is the second half
+ * rather than the only one — `kernel.use(plugin as any)` is a shipped
+ * in-repo pattern, and externally authored plugins never meet this compiler
+ * at all.
+ */
+interface Plugin extends PluginDefinition {
     /**
      * Unique plugin name (e.g., 'com.objectstack.engine.objectql')
      */
     name: string;
-    /**
-     * Plugin version
-     */
-    version?: string;
-    /**
-     * Plugin type categorisation for runtime behaviour — a {@link PluginType},
-     * the closed set the spec declares. The enumeration lives on that type
-     * (derived from `CORE_PLUGIN_TYPES`), not in this comment: a value outside
-     * it no longer type-checks, and `PluginSchema.type` refuses it at parse.
-     * @default 'standard'
-     */
-    type?: PluginType;
     /**
      * List of other plugin names that this plugin depends on.
      * The kernel ensures these plugins are initialized before this one.
@@ -864,6 +969,26 @@ declare class LiteKernel extends ObjectKernelBase {
      * Register a plugin
      * @param plugin - Plugin instance
      *
+     * A plugin object the DECLARED plugin contract refuses is refused here,
+     * with `PLUGIN_CONTRACT_VIOLATION` — the same check, the same envelope,
+     * that `ObjectKernel.use()` runs through `PluginLoader` (`plugin-contract.ts`
+     * is the one statement both kernels call; #16721, maintainer ruling
+     * 2026-09-08, option A under #9864's precedent that the kernels converge).
+     *
+     * This method used to write the object straight into the registry, so the
+     * same plugin was accepted by this kernel and refused by `ObjectKernel` —
+     * and `AGENTS.md` names THIS kernel for tests, so a plugin could be green
+     * in vitest and refused at production boot. Measured before converging
+     * (#16721 step 1): of 813 `LiteKernel.use()` calls reachable in this
+     * repository's suites, 807 were accepted by the schema unchanged and the
+     * six refusals came from three test-local fixture objects, none of them
+     * product code.
+     *
+     * Ordering, and why it is pinned: state first (`validateIdle`), then the
+     * contract, then registration — a refused plugin never reaches the
+     * registry, so it can neither be booted nor supersede an earlier
+     * registration under its name.
+     *
      * Duplicate names OVERWRITE, with one `warn` naming both versions — the
      * declared contract in `plugin-registration.ts`, applied identically by
      * `ObjectKernel.use()` (#9864, maintainer ruling 2026-08-19).
@@ -1755,96 +1880,6 @@ declare class PluginSandboxRuntime {
     shutdown(): void;
 }
 
-/**
- * Scan Target
- */
-interface ScanTarget {
-    pluginId: string;
-    version: string;
-    files?: string[];
-    dependencies?: Record<string, string>;
-}
-/**
- * Security Issue
- */
-interface SecurityIssue {
-    id: string;
-    severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
-    category: 'vulnerability' | 'malware' | 'license' | 'code-quality' | 'configuration';
-    title: string;
-    description: string;
-    location?: {
-        file?: string;
-        line?: number;
-        column?: number;
-    };
-    remediation?: string;
-    cve?: string;
-    cvss?: number;
-}
-/**
- * Plugin Security Scanner
- *
- * Scans plugins for security vulnerabilities, malware, and license issues
- */
-declare class PluginSecurityScanner {
-    private logger;
-    private vulnerabilityDb;
-    private scanResults;
-    private passThreshold;
-    constructor(logger: ObjectLogger, config?: {
-        passThreshold?: number;
-    });
-    /**
-     * Perform a comprehensive security scan on a plugin
-     */
-    scan(target: ScanTarget): Promise<KernelSecurityScanResult>;
-    /**
-     * Scan code for vulnerabilities
-     */
-    private scanCode;
-    /**
-     * Scan dependencies for known vulnerabilities
-     */
-    private scanDependencies;
-    /**
-     * Scan for malware patterns
-     */
-    private scanMalware;
-    /**
-     * Check license compliance
-     */
-    private scanLicenses;
-    /**
-     * Check configuration security
-     */
-    private scanConfiguration;
-    /**
-     * Calculate security score based on issues
-     */
-    private calculateSecurityScore;
-    /**
-     * Add a vulnerability to the database
-     */
-    addVulnerability(packageName: string, version: string, vulnerability: KernelSecurityVulnerability): void;
-    /**
-     * Get scan result from cache
-     */
-    getScanResult(pluginId: string, version: string): KernelSecurityScanResult | undefined;
-    /**
-     * Clear scan results cache
-     */
-    clearCache(): void;
-    /**
-     * Update vulnerability database from external source
-     */
-    updateVulnerabilityDatabase(): Promise<void>;
-    /**
-     * Shutdown security scanner
-     */
-    shutdown(): void;
-}
-
 /** Default visible prefix for generated keys (helps users identify a key). */
 declare const API_KEY_PREFIX = "osk_";
 /**
@@ -1888,6 +1923,21 @@ declare function isExpired(value: unknown, nowMs: number): boolean;
 /** The principal resolved from a valid `sys_api_key`. */
 interface ApiKeyPrincipal {
     userId: string;
+    /**
+     * [#15256 / 2A] The `sys_api_key` ROW id — a non-secret handle an operator
+     * can look the credential up by. Carried so the posture-conditional refusal
+     * log in `resolve-authz-context.ts` can name WHICH key was refused without
+     * naming the credential.
+     *
+     * ⛔ Never the raw key and never its hash: the raw key is returned exactly
+     * once by {@link generateApiKey} and only `sha256(raw)` is ever stored, and
+     * neither may enter a log line (see this module's SECURITY header). The row
+     * id is not derived from either.
+     *
+     * Optional because a row is only required to identify its owner; a store
+     * that answers without an `id` still yields a usable principal.
+     */
+    keyId?: string;
     /**
      * The organization this key authenticates INTO — read from the row's
      * `active_organization_id` and adopted by `resolveAuthzContext` as the
@@ -1926,6 +1976,19 @@ type ApiKeyAdmission = {
     outcome: 'refused';
     reason: ApiKeyRefusalReason;
     message: string;
+    /**
+     * [#15256 / 2A] The refused key's `sys_api_key` row id — same non-secret
+     * handle as {@link ApiKeyPrincipal.keyId}, carried on this arm too so the
+     * refusal log can name the credential the operator must go look at. ⛔
+     * Never the raw key or its hash. The WIRE answer is unchanged (a generic
+     * `401 UNAUTHENTICATED`, no reason and no id), so nothing here reaches a
+     * caller holding someone else's key.
+     */
+    keyId?: string;
+    /** The owner this refused key authenticates as — for the same log line. */
+    userId?: string;
+    /** The organization the refusal is about, when the key names one. */
+    organizationId?: string;
 };
 /**
  * The shape of the kernel's `tenancy` service this module reads a posture from.
@@ -2029,13 +2092,13 @@ declare function resolveApiKeyAdmission(ql: any, headers: any, nowMs?: number, t
  * ## Why a THROW, and not a field on the envelope
  *
  * The alternative was a discriminator field on `ResolvedAuthzContext` — the
- * shape `authRefusal` already has. That was rejected on a MEASUREMENT, not a
- * preference: `authRefusal` has existed since #8287 and, outside this module
- * and its own unit test, has **zero** consumers anywhere in the repo. A
- * diagnostic field on this envelope is demonstrably not read by any door. Every
- * transport reads `userId` and `systemPermissions`; a new sibling field would
- * have to be taught to eight separate call sites before it made a single door
- * louder, and would answer the old quiet 403 at every site that was missed.
+ * shape `authRefusal` had (#8287). That was rejected on a MEASUREMENT, not a
+ * preference: from #8287 until #14273 removed it, `authRefusal` had **zero**
+ * consumers anywhere in the repo outside this module and test assertions — a
+ * reading #14273 acted on by deleting the field. Every transport reads `userId`
+ * and `systemPermissions`; a new sibling field would have to be taught to eight
+ * separate call sites before it made a single door louder, and would answer
+ * the old quiet 403 at every site that was missed.
  *
  * A field is quiet by default and must be deliberately made loud. A throw is
  * loud by default and must be deliberately silenced. On a security surface
@@ -2168,6 +2231,15 @@ declare function rethrowAuthzStoreUnavailable(err: unknown): undefined;
 /** The transport-agnostic authorization envelope produced from a request. */
 interface ResolvedAuthzContext {
     userId?: string;
+    /**
+     * The ACTIVE organization this request operates in.
+     *
+     * ⚠️ [#15409] For a session principal under a wall-enforcing posture this is
+     * a VETTED value, never the stored `activeOrganizationId` as read: a claim
+     * that is not in {@link accessible_org_ids} is dropped and the context
+     * resolves with no active organization at all. Absent here is the fail-closed
+     * state, not a missing lookup — Layer 0 denies on it.
+     */
     tenantId?: string;
     email?: string;
     accessToken?: string;
@@ -2197,24 +2269,6 @@ interface ResolvedAuthzContext {
      * anonymous requests carry no rung.
      */
     posture?: AuthzPosture;
-    /**
-     * [#8287] Set when an inbound API key was REFUSED — a real, intact
-     * credential this deployment's tenancy posture cannot admit. The context is
-     * otherwise EMPTY (no `userId`), so every transport already fails it closed
-     * to 401 with no change; this field only lets a transport that wants to say
-     * WHY do so, instead of answering the operator with a bare "unauthenticated"
-     * for a key they can see is neither revoked nor expired.
-     *
-     * ⚠️ `reason` is NOT an `error.code`. The wire vocabulary is closed
-     * (ADR-0112: `StandardErrorCode ∪ ERROR_CODE_LEDGER`, both in `packages/spec`)
-     * and a refused credential's standard member is `UNAUTHENTICATED`. This is a
-     * diagnostic discriminator for the message, deliberately lowercase so it can
-     * never be mistaken for one.
-     */
-    authRefusal?: {
-        reason: ApiKeyRefusalReason;
-        message: string;
-    };
 }
 interface ResolveAuthzInput {
     /** Data engine (ObjectQL) exposing `find(object, { where, limit, context })`. */
@@ -4108,6 +4162,71 @@ declare function runMigrationJournal(engine: IObjectQLEngine, plan: MigrationPla
 /** Resume a run the journal says was interrupted. Thin alias for intent at call sites. */
 declare function resumeMigrationJournal(engine: IObjectQLEngine, plan: MigrationPlan, runId: string, options?: Omit<RunMigrationJournalOptions, 'runId'>): Promise<MigrationRunResult>;
 
+/** Example row references a group carries, so the summary can point at real rows. */
+declare const ADVISORY_SAMPLE_ROWS = 5;
+/** One advisory rule hit, as the evaluator reports it. */
+interface AdvisoryHit {
+    /** Object the row belongs to. */
+    object: string;
+    /** The declared rule's `name`. */
+    rule: string;
+    /** The rule's declared severity — `'warning'` or `'info'`; never `'error'`. */
+    severity: string;
+    /** The rule's author-written message, in the caller's locale. */
+    message: string;
+    /**
+     * A reference to the row, when the write carries one.
+     *
+     * NOT necessarily an id: on the path this exists for — a seed INSERT — the
+     * driver has not issued an id yet at validation time, so an id-only reference
+     * would be empty for exactly the case the aggregation was built for. The
+     * producer sends the best stable handle it has (`id`, else `name=<value>`,
+     * the same way the seed loader names a row in its own errors).
+     */
+    recordRef?: string;
+}
+/** Every hit for one `(object, rule)` pair, folded. */
+interface AdvisoryGroup {
+    object: string;
+    rule: string;
+    severity: string;
+    /** The first message seen for this group (they differ only by interpolation). */
+    message: string;
+    /** How many ROWS tripped this rule during the scope. */
+    rows: number;
+    /** Up to {@link ADVISORY_SAMPLE_ROWS} example row references. */
+    sampleRows: string[];
+}
+/**
+ * Offer one advisory hit to the active aggregation scope.
+ *
+ * @returns `true` when a scope captured it — the caller must then NOT log its
+ * own per-row line, because the scope owner reports the whole group. `false`
+ * when no scope is active, which is the ordinary interactive case: the caller
+ * logs exactly as it always did. A caller that ignores the return value
+ * degrades to today's behaviour rather than losing the report.
+ */
+declare function recordAdvisoryHit(hit: AdvisoryHit): boolean;
+/**
+ * Whether an advisory aggregation scope is active on this async context.
+ *
+ * Exported for tests and for a caller that wants to skip building a message it
+ * is about to discard; {@link recordAdvisoryHit}'s return value is the one that
+ * decides.
+ */
+declare function isAggregatingAdvisories(): boolean;
+/**
+ * Run `fn` with advisory hits aggregated, then hand the folded groups to
+ * `report`.
+ *
+ * `report` runs in a `finally`, so a load that throws still reports what it
+ * tripped before failing — the diagnostics of a half-finished seed are the ones
+ * most worth having. It is called only when there is something to report, and
+ * its own failure is never allowed to replace the caller's outcome: a reporting
+ * bug must not turn a successful seed load into a failed one.
+ */
+declare function runWithAdvisoryAggregation<T>(fn: () => Promise<T>, report: (groups: AdvisoryGroup[]) => void): Promise<T>;
+
 /**
  * The slice of an execution context the resolver reads. Structural on purpose —
  * see {@link filterTokenContextFrom}.
@@ -4633,6 +4752,19 @@ declare function createMemoryI18n(): {
     setSupportedLocales(locales: readonly string[] | undefined): void;
     getDefaultLocale(): string;
     setDefaultLocale(locale: string): void;
+    /**
+     * @see II18nService.setFallbackLocale — [#15694]
+     *
+     * ⛔ There is deliberately NO `getFallbackLocale()` beside this. The two
+     * are different questions: this one is what the provider was TOLD, the
+     * accessor is what the serving layer ASKS it in order to build the
+     * metadata-document translators' fallback chain (#14882). Answering the
+     * second from `defaultLocale` — the only value that was always available
+     * here — would settle the default-locale contract question #14882 leaves
+     * deliberately open, from a degraded provider. Without the accessor those
+     * reads keep the resolvers' own default, which is known and intentional.
+     */
+    setFallbackLocale(locale: string): void;
 };
 
 /**
@@ -5133,4 +5265,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { ADMIN_STANDING_NON_TABLE_INPUTS, ADMIN_STANDING_SURFACE, ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, AUDIENCE_BINDING_SUGGESTION_STATUSES, AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES, AUTHZ_GRANTS_CACHE_TTL_ENV, AUTHZ_INVALIDATED_CHANNEL, AUTHZ_STORE_UNAVAILABLE_CODE, AUTHZ_STORE_UNAVAILABLE_MESSAGE, AUTHZ_STORE_UNAVAILABLE_STATUS, type ActivatableRow, type AdminStandingNonTableInput, type AdminStandingTable, type AnonymousDenyInput, type ApiKeyAdmission, type ApiKeyPrincipal, type ApiKeyRefusalReason, type ArtifactPackageError, type AudienceBindingSuggestionStatus, type AuthGate, type AuthzCachePosture, type AuthzCachePostureInput, type AuthzCachePostureStatement, type AuthzGrantsCacheTtlReading, type AuthzInvalidatedPayload, type AuthzInvalidationBusState, type AuthzInvalidationReason, type AuthzPostureSink, AuthzStoreUnavailableError, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, ENTRY_EXECUTION_CONTEXT_FIELDS, type EngineWithTransaction, type EntryExecutionContextField, type EntryLocalization, type ExecutionContextAssemblyInput, type ExecutionContextEntryFields, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, InMemoryMetadataActivationStore, type IntegrityFile, type IntegrityViolation, type IntegrityViolationKind, type InterruptedRun, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, METADATA_ACTIVATION_TABLE, type MetadataActivationRow, type MetadataActivationStore, type MetadataActivationStoreEngine, type MigrationChunk, type MigrationChunkContext, MigrationJournalRefusal, type MigrationPlan, type MigrationPlanProvider, MigrationPlanRegistry, type MigrationPlanStep, type MigrationRunResult, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, type OAuthTokenProvenance, OPERATION_PRIVATE_KEY_PREFIX, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, ObjectStoreMetadataActivationStore, type OrderablePlugin, PLATFORM_ADMIN_EMAIL_SEPARATOR, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type PlatformAdminConfigSink, type PlatformAdminEmailConfig, type Plugin, type PluginArtifactVerifyResult, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PluginType, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, type RunMigrationJournalOptions, SERVICE_NOT_REGISTERED_CODE, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type TemporalComparandKind, type TenancyPostureSource, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VerifyIntegrityResult, type VersionCompatibility, type WallClockParts, adminStandingColumns, adminStandingTables, artifactPackageId, assembleExecutionContext, assembleExecutionContextOrGuest, assertInitServiceRequirements, assertMetadataRegisterContract, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, canonicalMetadataServiceType, collectInternalWriteResponseFields, counterSignPayload, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, describeInitOrderFault, effectiveTenancyPosture, engineCanRollBack, evaluateAuthGate, extractApiKey, filterTokenContextFrom, findInterruptedRuns, formatIntegrityViolation, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hasPlatformAdminStanding, hashApiKey, hashMigrationPlan, isAudienceBindingSuggestionStatus, isAuthGateAllowlisted, isAuthzStoreUnavailableError, isConfiguredPlatformAdminEmail, isExpired, isGrantActive, isGrantExpired, isNode, isRowActive, isServiceNotRegisteredError, isUninterpretableTemporalComparand, matchesConfiguredPlatformAdmin, normalizeAuthGate, normalizePlatformAdminEmail, omitInternalFieldsFromWriteResponse, parsePlatformAdminEmails, parseScopes, parseSignature, planChunks, postureVisibleRows, readAuthoredTranslationLayer, readAuthzGrantsCacheTtlMs, readRunJournal, recordNotFoundError, reportAuthzCachePosture, reportLegacyPlatformAdminGrant, resetLegacyPlatformAdminGrantReport, resetPlatformAdminEmailMemo, resolveApiKeyAdmission, resolveApiKeyPrincipal, resolveArtifactPackageOrder, resolveAuthzCachePosture, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolvePlatformAdminEmails, resolvePluginOrder, resolveUserAuthzGrants, resumeMigrationJournal, rethrowAuthzStoreUnavailable, runMigrationJournal, safeExit, setPlatformAdminConfigSink, shouldDenyAnonymous, signPayload, temporalComparandKind, unknownAudienceBindingSuggestionStatusMessage, validateInitServiceContract, verifyIntegrity, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, withoutOperationPrivateKeys, zonedDateStartToUtcMs, zonedWallClockToUtcMs };
+export { ADMIN_STANDING_NON_TABLE_INPUTS, ADMIN_STANDING_SURFACE, ADVISORY_SAMPLE_ROWS, ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, AUDIENCE_BINDING_SUGGESTION_STATUSES, AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES, AUTHZ_GRANTS_CACHE_TTL_ENV, AUTHZ_INVALIDATED_CHANNEL, AUTHZ_STORE_UNAVAILABLE_CODE, AUTHZ_STORE_UNAVAILABLE_MESSAGE, AUTHZ_STORE_UNAVAILABLE_STATUS, type ActivatableRow, type AdminStandingNonTableInput, type AdminStandingTable, type AdvisoryGroup, type AdvisoryHit, type AnonymousDenyInput, type ApiKeyAdmission, type ApiKeyPrincipal, type ApiKeyRefusalReason, type ArtifactPackageError, type AudienceBindingSuggestionStatus, type AuthGate, type AuthzCachePosture, type AuthzCachePostureInput, type AuthzCachePostureStatement, type AuthzGrantsCacheTtlReading, type AuthzInvalidatedPayload, type AuthzInvalidationBusState, type AuthzInvalidationReason, type AuthzPostureSink, AuthzStoreUnavailableError, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, ENTRY_EXECUTION_CONTEXT_FIELDS, type EngineWithTransaction, type EntryExecutionContextField, type EntryLocalization, type ExecutionContextAssemblyInput, type ExecutionContextEntryFields, type ExecutionContextLike, type FilterTokenResolutionContext, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, InMemoryMetadataActivationStore, type IntegrityFile, type IntegrityViolation, type IntegrityViolationKind, type InterruptedRun, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, METADATA_ACTIVATION_TABLE, type MetadataActivationRow, type MetadataActivationStore, type MetadataActivationStoreEngine, type MigrationChunk, type MigrationChunkContext, MigrationJournalRefusal, type MigrationPlan, type MigrationPlanProvider, MigrationPlanRegistry, type MigrationPlanStep, type MigrationRunResult, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, type OAuthTokenProvenance, OPERATION_PRIVATE_KEY_PREFIX, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, ObjectStoreMetadataActivationStore, type OrderablePlugin, PLATFORM_ADMIN_EMAIL_SEPARATOR, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type PlatformAdminConfigSink, type PlatformAdminEmailConfig, type Plugin, type PluginArtifactVerifyResult, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PluginType, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolveUserAuthzGrantsOptions, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, type RunMigrationJournalOptions, SERVICE_NOT_REGISTERED_CODE, SIGNATURE_ALG, type SandboxContext, SecurePluginContext, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type TemporalComparandKind, type TenancyPostureSource, UnknownFilterTokenError, UnresolvedFilterTokenError, type UserAuthzGrants, type VerifyIntegrityResult, type VersionCompatibility, type WallClockParts, adminStandingColumns, adminStandingTables, artifactPackageId, assembleExecutionContext, assembleExecutionContextOrGuest, assertInitServiceRequirements, assertMetadataRegisterContract, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, canonicalMetadataServiceType, collectInternalWriteResponseFields, counterSignPayload, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, describeInitOrderFault, effectiveTenancyPosture, engineCanRollBack, evaluateAuthGate, extractApiKey, filterTokenContextFrom, findInterruptedRuns, formatIntegrityViolation, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hasPlatformAdminStanding, hashApiKey, hashMigrationPlan, isAggregatingAdvisories, isAudienceBindingSuggestionStatus, isAuthGateAllowlisted, isAuthzStoreUnavailableError, isConfiguredPlatformAdminEmail, isExpired, isGrantActive, isGrantExpired, isNode, isRowActive, isServiceNotRegisteredError, isUninterpretableTemporalComparand, matchesConfiguredPlatformAdmin, normalizeAuthGate, normalizePlatformAdminEmail, omitInternalFieldsFromWriteResponse, parsePlatformAdminEmails, parseScopes, parseSignature, planChunks, postureVisibleRows, readAuthoredTranslationLayer, readAuthzGrantsCacheTtlMs, readRunJournal, recordAdvisoryHit, recordNotFoundError, reportAuthzCachePosture, reportLegacyPlatformAdminGrant, resetLegacyPlatformAdminGrantReport, resetPlatformAdminEmailMemo, resolveApiKeyAdmission, resolveApiKeyPrincipal, resolveArtifactPackageOrder, resolveAuthzCachePosture, resolveAuthzContext, resolveFilterToken, resolveFilterTokens, resolveLocale, resolveLocalizationContext, resolvePlatformAdminEmails, resolvePluginOrder, resolveUserAuthzGrants, resumeMigrationJournal, rethrowAuthzStoreUnavailable, runMigrationJournal, runWithAdvisoryAggregation, safeExit, setPlatformAdminConfigSink, shouldDenyAnonymous, signPayload, temporalComparandKind, unknownAudienceBindingSuggestionStatusMessage, validateInitServiceContract, verifyIntegrity, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, withoutOperationPrivateKeys, zonedDateStartToUtcMs, zonedWallClockToUtcMs };