@objectstack/objectql 8.0.1 → 9.0.1

package/dist/index.d.mts

@@ -1,10 +1,10 @@
-import { ServiceObject, ObjectOwnership, HookContext, QueryAST, EngineQueryOptions, DataEngineInsertOptions, EngineUpdateOptions, EngineDeleteOptions, EngineCountOptions, EngineAggregateOptions, DateGranularityValue, Hook } from '@objectstack/spec/data';
+import { ServiceObject, ObjectOwnership, HookContext, QueryAST, EngineQueryOptions, DataEngineInsertOptions, EngineUpdateOptions, EngineDeleteOptions, EngineCountOptions, EngineAggregateOptions, DateGranularityValue, Hook, SeedLoaderRequest, SeedLoaderResult, ObjectDependencyGraph, Seed, SeedLoaderConfigInput } from '@objectstack/spec/data';
 import { ObjectStackManifest, InstalledPackage, MetadataValidationResult, MetadataLock, MetadataProvenance, ExecutionContext } from '@objectstack/spec/kernel';
 import * as _objectstack_metadata_core from '@objectstack/metadata-core';
 import { MetadataRepository, MetaRef, MetadataItem, PutOptions, PutResult, DeleteOptions, DeleteResult, MetadataWriteIntent, ListFilter, MetadataItemHeader, HistoryOptions, MetadataEvent, WatchFilter } from '@objectstack/metadata-core';
 import { ObjectStackProtocol, MetadataCacheRequest, MetadataCacheResponse, BatchUpdateRequest, BatchUpdateResponse, UpdateManyDataRequest, DeleteManyDataRequest, InstallPackageRequest, InstallPackageResponse } from '@objectstack/spec/api';
-import { IDataEngine, DriverInterface, Logger, Plugin, PluginContext, ObjectKernel } from '@objectstack/core';
-import { IFeedService, IRealtimeService, ICryptoProvider } from '@objectstack/spec/contracts';
+import { IDataEngine, DriverInterface, Logger as Logger$1, Plugin, PluginContext, ObjectKernel } from '@objectstack/core';
+import { IFeedService, IRealtimeService, ICryptoProvider, ISeedLoaderService, IDataEngine as IDataEngine$1, IMetadataService } from '@objectstack/spec/contracts';
 import { Expression } from '@objectstack/spec';
 
 /**
@@ -358,6 +358,81 @@ declare class SchemaRegistry {
     reset(): void;
 }
 
+/** One runtime-verification finding (ADR-0038 BuildIssue, layer 'runtime'). */
+interface RuntimeBuildIssue {
+    layer: 'runtime';
+    severity: 'error' | 'warning';
+    /** The artifact whose runtime behaviour is broken. */
+    artifact: {
+        type: string;
+        name: string;
+    };
+    /** What it exercised, when narrower than the artifact (e.g. a widget). */
+    ref?: {
+        type: string;
+        name: string;
+        member?: string;
+    };
+    /** 'seed_not_applied' | 'view_read_failed' | 'empty_query' | 'widget_query_failed' | 'probes_unavailable' */
+    code: string;
+    message: string;
+    fix?: string;
+}
+/** Aggregate result of one post-publish probe pass. */
+interface BuildProbeReport {
+    /** Findings, empty when every probe passed. */
+    issues: RuntimeBuildIssue[];
+    /** How many probes actually ran, per plane (0s mean nothing to probe). */
+    checked: {
+        seeds: number;
+        views: number;
+        widgets: number;
+    };
+}
+/** The single read the probes need from the data engine. */
+interface ProbeEngine {
+    find(objectName: string, query: unknown): Promise<Array<Record<string, unknown>>>;
+}
+/** Optional analytics surface — when absent, widget probes degrade to a warning. */
+interface ProbeAnalytics {
+    queryDataset(dataset: unknown, selection: unknown, context?: unknown): Promise<unknown>;
+}
+interface RunBuildProbesOptions {
+    engine: ProbeEngine;
+    /** Read an ACTIVE (published) item body by type+name; undefined when absent. */
+    getItem: (type: string, name: string) => Promise<unknown | undefined>;
+    /** The just-published artifact set (publishPackageDrafts' `published`). */
+    published: Array<{
+        type: string;
+        name: string;
+    }>;
+    /**
+     * The kernel's analytics service, when one is mounted. Widget probes run
+     * the SAME `queryDataset` path the dashboard renderer hits — absent
+     * service means widgets can't be probed (one aggregate warning, not
+     * per-widget noise).
+     */
+    analytics?: ProbeAnalytics;
+    /** Threaded into engine/analytics reads (tenant scoping). */
+    organizationId?: string | null;
+}
+/**
+ * Run the L3 runtime probes over a just-published artifact set:
+ *
+ *  • per published `seed` — its target object must have rows now
+ *    (`seed_not_applied`: the rows were promised but never materialized);
+ *  • per published `view` — a limit-1 read through the same engine the
+ *    renderer uses must not throw (`view_read_failed`);
+ *  • per published `dashboard` widget — its real dataset selection must
+ *    execute (`widget_query_failed`) and must not return empty on an object
+ *    that HAS rows (`empty_query` — the four-layer staging incident class).
+ *
+ * All probes are reads (limit-1 / single aggregate); a probe crash is
+ * reported, never thrown — verification must not break the publish it
+ * verifies.
+ */
+declare function runBuildProbes(opts: RunBuildProbesOptions): Promise<BuildProbeReport>;
+
 /**
  * Re-export the canonical validation-result type so callers in this
  * package don't need to dual-import from `@objectstack/spec/kernel`.
@@ -1250,12 +1325,40 @@ declare class ObjectStackProtocolImplementation implements ObjectStackProtocol {
         organizationId?: string;
         actor?: string;
         message?: string;
+        /**
+         * INTERNAL — `publishPackageDrafts` publishes many drafts and batch-applies
+         * every seed body in ONE loader pass afterwards (cross-seed references need
+         * multi-pass over the whole set), so it suppresses the per-item apply here.
+         */
+        _skipSeedApply?: boolean;
     }): Promise<{
         success: boolean;
         version: string;
         seq: number;
         message?: string;
+        /**
+         * Present when a `seed` draft was published: the result of materializing
+         * its rows. Publishing the metadata ALWAYS succeeds independently — a
+         * seed-load problem is surfaced here, never thrown, so callers (and UIs)
+         * must check `seedApplied.success` instead of assuming data went live.
+         */
+        seedApplied?: {
+            success: boolean;
+            inserted: number;
+            updated: number;
+            error?: string;
+            errors?: unknown[];
+        };
     }>;
+    /**
+     * Materialize published `seed` bodies into data rows via the SeedLoaderService
+     * (externalId-keyed upsert, multi-pass for cross-seed references). Passing ALL
+     * of a publish's seed bodies in ONE call lets a child seed reference a parent
+     * seed's rows regardless of publish order. Best-effort: any failure is
+     * returned, never thrown — publishing metadata must not be blocked by a data
+     * problem, but the caller surfaces `seedApplied` so the failure is LOUD.
+     */
+    private applySeedBodies;
     /**
      * List pending DRAFT metadata (ADR-0033) for the org, optionally narrowed
      * by `packageId` and/or `type`. The list reads of `getMetaItems` only see
@@ -1304,6 +1407,23 @@ declare class ObjectStackProtocolImplementation implements ObjectStackProtocol {
             error: string;
             code?: string;
         }>;
+        /** Aggregate result of materializing every published `seed` (absent when no seeds). */
+        seedApplied?: {
+            success: boolean;
+            inserted: number;
+            updated: number;
+            error?: string;
+            errors?: unknown[];
+        };
+        /**
+         * ADR-0038 L3 — post-publish runtime probe report (absent when nothing
+         * was publishable). One real read per published artifact: seeded
+         * objects must have rows, views must be readable, dashboard widgets'
+         * dataset selections must execute and return data. `issues` carries
+         * BuildIssue-shaped findings (layer 'runtime') for the agent / chat
+         * health surfaces; probes never fail the publish itself.
+         */
+        probes?: BuildProbeReport;
     }>;
     /**
      * Discard every pending DRAFT bound to a package — the NON-destructive
@@ -1799,7 +1919,7 @@ type EngineMiddleware = (ctx: OperationContext, next: () => Promise<void>) => Pr
  */
 interface ObjectQLHostContext {
     ql: ObjectQL;
-    logger: Logger;
+    logger: Logger$1;
     [key: string]: any;
 }
 declare class ObjectQL implements IDataEngine {
@@ -3107,4 +3227,56 @@ declare function convertIntrospectedSchemaToObjects(introspectedSchema: Introspe
     skipSystemColumns?: boolean;
 }): ServiceObject[];
 
-export { type BindHooksOptions, type BindHooksResult, DEFAULT_EXTENDER_PRIORITY, DEFAULT_OWNER_PRIORITY, type EngineMiddleware, type EvaluateRulesOptions, type FieldValidationError, type HookEntry, type HookHandler, type HookMetricLabel, type HookMetricOutcome, type HookMetricsRecorder, type HookSkipReason, InMemoryHookMetricsRecorder, type IntrospectedColumn, type IntrospectedForeignKey, type IntrospectedSchema, type IntrospectedTable, MetadataFacade, type ObjectContributor, ObjectQL, type ObjectQLHostContext, type ObjectQLKernelOptions, ObjectQLPlugin, ObjectRepository, ObjectStackProtocolImplementation, type OperationContext, RESERVED_NAMESPACES, SECRET_MASK, SECRET_REF_PREFIX, SchemaRegistry, type SchemaRegistryOptions, ScopedContext, type SysMetadataEngine, SysMetadataRepository, type SysMetadataRepositoryOptions, ValidationError, type WrapDeclarativeOptions, applyInMemoryAggregation, applySystemFields, bindHooksToEngine, bucketDateValue, collectSecretFields, computeFQN, convertIntrospectedSchemaToObjects, createObjectQLKernel, evaluateValidationRules, isSecretRef, legalNextStates, makeSecretRef, needsPriorRecord, noopHookMetricsRecorder, parseFQN, parseSecretRef, toTitleCase, validateRecord, wrapDeclarativeHook };
+interface Logger {
+    info(message: string, meta?: Record<string, any>): void;
+    warn(message: string, meta?: Record<string, any>): void;
+    error(message: string, error?: Error, meta?: Record<string, any>): void;
+    debug(message: string, meta?: Record<string, any>): void;
+}
+/**
+ * SeedLoaderService — Runtime implementation of ISeedLoaderService
+ *
+ * Provides metadata-driven seed data loading with:
+ * - Automatic lookup/master_detail reference resolution via externalId
+ * - Topological dependency ordering (parents before children)
+ * - Multi-pass loading for circular references
+ * - Dry-run validation mode
+ * - Upsert support honoring SeedSchema mode
+ * - Actionable error reporting
+ */
+declare class SeedLoaderService implements ISeedLoaderService {
+    private engine;
+    private metadata;
+    private logger;
+    constructor(engine: IDataEngine$1, metadata: IMetadataService, logger: Logger);
+    load(request: SeedLoaderRequest): Promise<SeedLoaderResult>;
+    buildDependencyGraph(objectNames: string[]): Promise<ObjectDependencyGraph>;
+    validate(datasets: Seed[], config?: SeedLoaderConfigInput): Promise<SeedLoaderResult>;
+    private loadDataset;
+    private resolveFromDatabase;
+    private resolveDeferredUpdates;
+    /**
+     * Seed writes always run as a privileged system context. This bypasses
+     * RBAC checks (so seeds can target system tables like `sys_*`) and
+     * disables the SecurityPlugin's auto-injection of `organization_id` /
+     * `owner_id` — seeds either declare those fields explicitly per
+     * record, or are intentionally cross-tenant / global.
+     */
+    private static readonly SEED_OPTIONS;
+    private writeRecord;
+    /**
+     * Kahn's algorithm for topological sort with cycle detection.
+     */
+    private topologicalSort;
+    private findCycles;
+    private filterByEnv;
+    private orderDatasets;
+    private buildReferenceMap;
+    private loadExistingRecords;
+    private looksLikeInternalId;
+    private extractId;
+    private buildEmptyResult;
+    private buildResult;
+}
+
+export { type BindHooksOptions, type BindHooksResult, type BuildProbeReport, DEFAULT_EXTENDER_PRIORITY, DEFAULT_OWNER_PRIORITY, type EngineMiddleware, type EvaluateRulesOptions, type FieldValidationError, type HookEntry, type HookHandler, type HookMetricLabel, type HookMetricOutcome, type HookMetricsRecorder, type HookSkipReason, InMemoryHookMetricsRecorder, type IntrospectedColumn, type IntrospectedForeignKey, type IntrospectedSchema, type IntrospectedTable, MetadataFacade, type ObjectContributor, ObjectQL, type ObjectQLHostContext, type ObjectQLKernelOptions, ObjectQLPlugin, ObjectRepository, ObjectStackProtocolImplementation, type OperationContext, RESERVED_NAMESPACES, type RunBuildProbesOptions, type RuntimeBuildIssue, SECRET_MASK, SECRET_REF_PREFIX, SchemaRegistry, type SchemaRegistryOptions, ScopedContext, SeedLoaderService, type SysMetadataEngine, SysMetadataRepository, type SysMetadataRepositoryOptions, ValidationError, type WrapDeclarativeOptions, applyInMemoryAggregation, applySystemFields, bindHooksToEngine, bucketDateValue, collectSecretFields, computeFQN, convertIntrospectedSchemaToObjects, createObjectQLKernel, evaluateValidationRules, isSecretRef, legalNextStates, makeSecretRef, needsPriorRecord, noopHookMetricsRecorder, parseFQN, parseSecretRef, runBuildProbes, toTitleCase, validateRecord, wrapDeclarativeHook };

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-import { ServiceObject, ObjectOwnership, HookContext, QueryAST, EngineQueryOptions, DataEngineInsertOptions, EngineUpdateOptions, EngineDeleteOptions, EngineCountOptions, EngineAggregateOptions, DateGranularityValue, Hook } from '@objectstack/spec/data';
+import { ServiceObject, ObjectOwnership, HookContext, QueryAST, EngineQueryOptions, DataEngineInsertOptions, EngineUpdateOptions, EngineDeleteOptions, EngineCountOptions, EngineAggregateOptions, DateGranularityValue, Hook, SeedLoaderRequest, SeedLoaderResult, ObjectDependencyGraph, Seed, SeedLoaderConfigInput } from '@objectstack/spec/data';
 import { ObjectStackManifest, InstalledPackage, MetadataValidationResult, MetadataLock, MetadataProvenance, ExecutionContext } from '@objectstack/spec/kernel';
 import * as _objectstack_metadata_core from '@objectstack/metadata-core';
 import { MetadataRepository, MetaRef, MetadataItem, PutOptions, PutResult, DeleteOptions, DeleteResult, MetadataWriteIntent, ListFilter, MetadataItemHeader, HistoryOptions, MetadataEvent, WatchFilter } from '@objectstack/metadata-core';
 import { ObjectStackProtocol, MetadataCacheRequest, MetadataCacheResponse, BatchUpdateRequest, BatchUpdateResponse, UpdateManyDataRequest, DeleteManyDataRequest, InstallPackageRequest, InstallPackageResponse } from '@objectstack/spec/api';
-import { IDataEngine, DriverInterface, Logger, Plugin, PluginContext, ObjectKernel } from '@objectstack/core';
-import { IFeedService, IRealtimeService, ICryptoProvider } from '@objectstack/spec/contracts';
+import { IDataEngine, DriverInterface, Logger as Logger$1, Plugin, PluginContext, ObjectKernel } from '@objectstack/core';
+import { IFeedService, IRealtimeService, ICryptoProvider, ISeedLoaderService, IDataEngine as IDataEngine$1, IMetadataService } from '@objectstack/spec/contracts';
 import { Expression } from '@objectstack/spec';
 
 /**
@@ -358,6 +358,81 @@ declare class SchemaRegistry {
     reset(): void;
 }
 
+/** One runtime-verification finding (ADR-0038 BuildIssue, layer 'runtime'). */
+interface RuntimeBuildIssue {
+    layer: 'runtime';
+    severity: 'error' | 'warning';
+    /** The artifact whose runtime behaviour is broken. */
+    artifact: {
+        type: string;
+        name: string;
+    };
+    /** What it exercised, when narrower than the artifact (e.g. a widget). */
+    ref?: {
+        type: string;
+        name: string;
+        member?: string;
+    };
+    /** 'seed_not_applied' | 'view_read_failed' | 'empty_query' | 'widget_query_failed' | 'probes_unavailable' */
+    code: string;
+    message: string;
+    fix?: string;
+}
+/** Aggregate result of one post-publish probe pass. */
+interface BuildProbeReport {
+    /** Findings, empty when every probe passed. */
+    issues: RuntimeBuildIssue[];
+    /** How many probes actually ran, per plane (0s mean nothing to probe). */
+    checked: {
+        seeds: number;
+        views: number;
+        widgets: number;
+    };
+}
+/** The single read the probes need from the data engine. */
+interface ProbeEngine {
+    find(objectName: string, query: unknown): Promise<Array<Record<string, unknown>>>;
+}
+/** Optional analytics surface — when absent, widget probes degrade to a warning. */
+interface ProbeAnalytics {
+    queryDataset(dataset: unknown, selection: unknown, context?: unknown): Promise<unknown>;
+}
+interface RunBuildProbesOptions {
+    engine: ProbeEngine;
+    /** Read an ACTIVE (published) item body by type+name; undefined when absent. */
+    getItem: (type: string, name: string) => Promise<unknown | undefined>;
+    /** The just-published artifact set (publishPackageDrafts' `published`). */
+    published: Array<{
+        type: string;
+        name: string;
+    }>;
+    /**
+     * The kernel's analytics service, when one is mounted. Widget probes run
+     * the SAME `queryDataset` path the dashboard renderer hits — absent
+     * service means widgets can't be probed (one aggregate warning, not
+     * per-widget noise).
+     */
+    analytics?: ProbeAnalytics;
+    /** Threaded into engine/analytics reads (tenant scoping). */
+    organizationId?: string | null;
+}
+/**
+ * Run the L3 runtime probes over a just-published artifact set:
+ *
+ *  • per published `seed` — its target object must have rows now
+ *    (`seed_not_applied`: the rows were promised but never materialized);
+ *  • per published `view` — a limit-1 read through the same engine the
+ *    renderer uses must not throw (`view_read_failed`);
+ *  • per published `dashboard` widget — its real dataset selection must
+ *    execute (`widget_query_failed`) and must not return empty on an object
+ *    that HAS rows (`empty_query` — the four-layer staging incident class).
+ *
+ * All probes are reads (limit-1 / single aggregate); a probe crash is
+ * reported, never thrown — verification must not break the publish it
+ * verifies.
+ */
+declare function runBuildProbes(opts: RunBuildProbesOptions): Promise<BuildProbeReport>;
+
 /**
  * Re-export the canonical validation-result type so callers in this
  * package don't need to dual-import from `@objectstack/spec/kernel`.
@@ -1250,12 +1325,40 @@ declare class ObjectStackProtocolImplementation implements ObjectStackProtocol {
         organizationId?: string;
         actor?: string;
         message?: string;
+        /**
+         * INTERNAL — `publishPackageDrafts` publishes many drafts and batch-applies
+         * every seed body in ONE loader pass afterwards (cross-seed references need
+         * multi-pass over the whole set), so it suppresses the per-item apply here.
+         */
+        _skipSeedApply?: boolean;
     }): Promise<{
         success: boolean;
         version: string;
         seq: number;
         message?: string;
+        /**
+         * Present when a `seed` draft was published: the result of materializing
+         * its rows. Publishing the metadata ALWAYS succeeds independently — a
+         * seed-load problem is surfaced here, never thrown, so callers (and UIs)
+         * must check `seedApplied.success` instead of assuming data went live.
+         */
+        seedApplied?: {
+            success: boolean;
+            inserted: number;
+            updated: number;
+            error?: string;
+            errors?: unknown[];
+        };
     }>;
+    /**
+     * Materialize published `seed` bodies into data rows via the SeedLoaderService
+     * (externalId-keyed upsert, multi-pass for cross-seed references). Passing ALL
+     * of a publish's seed bodies in ONE call lets a child seed reference a parent
+     * seed's rows regardless of publish order. Best-effort: any failure is
+     * returned, never thrown — publishing metadata must not be blocked by a data
+     * problem, but the caller surfaces `seedApplied` so the failure is LOUD.
+     */
+    private applySeedBodies;
     /**
      * List pending DRAFT metadata (ADR-0033) for the org, optionally narrowed
      * by `packageId` and/or `type`. The list reads of `getMetaItems` only see
@@ -1304,6 +1407,23 @@ declare class ObjectStackProtocolImplementation implements ObjectStackProtocol {
             error: string;
             code?: string;
         }>;
+        /** Aggregate result of materializing every published `seed` (absent when no seeds). */
+        seedApplied?: {
+            success: boolean;
+            inserted: number;
+            updated: number;
+            error?: string;
+            errors?: unknown[];
+        };
+        /**
+         * ADR-0038 L3 — post-publish runtime probe report (absent when nothing
+         * was publishable). One real read per published artifact: seeded
+         * objects must have rows, views must be readable, dashboard widgets'
+         * dataset selections must execute and return data. `issues` carries
+         * BuildIssue-shaped findings (layer 'runtime') for the agent / chat
+         * health surfaces; probes never fail the publish itself.
+         */
+        probes?: BuildProbeReport;
     }>;
     /**
      * Discard every pending DRAFT bound to a package — the NON-destructive
@@ -1799,7 +1919,7 @@ type EngineMiddleware = (ctx: OperationContext, next: () => Promise<void>) => Pr
  */
 interface ObjectQLHostContext {
     ql: ObjectQL;
-    logger: Logger;
+    logger: Logger$1;
     [key: string]: any;
 }
 declare class ObjectQL implements IDataEngine {
@@ -3107,4 +3227,56 @@ declare function convertIntrospectedSchemaToObjects(introspectedSchema: Introspe
     skipSystemColumns?: boolean;
 }): ServiceObject[];
 
-export { type BindHooksOptions, type BindHooksResult, DEFAULT_EXTENDER_PRIORITY, DEFAULT_OWNER_PRIORITY, type EngineMiddleware, type EvaluateRulesOptions, type FieldValidationError, type HookEntry, type HookHandler, type HookMetricLabel, type HookMetricOutcome, type HookMetricsRecorder, type HookSkipReason, InMemoryHookMetricsRecorder, type IntrospectedColumn, type IntrospectedForeignKey, type IntrospectedSchema, type IntrospectedTable, MetadataFacade, type ObjectContributor, ObjectQL, type ObjectQLHostContext, type ObjectQLKernelOptions, ObjectQLPlugin, ObjectRepository, ObjectStackProtocolImplementation, type OperationContext, RESERVED_NAMESPACES, SECRET_MASK, SECRET_REF_PREFIX, SchemaRegistry, type SchemaRegistryOptions, ScopedContext, type SysMetadataEngine, SysMetadataRepository, type SysMetadataRepositoryOptions, ValidationError, type WrapDeclarativeOptions, applyInMemoryAggregation, applySystemFields, bindHooksToEngine, bucketDateValue, collectSecretFields, computeFQN, convertIntrospectedSchemaToObjects, createObjectQLKernel, evaluateValidationRules, isSecretRef, legalNextStates, makeSecretRef, needsPriorRecord, noopHookMetricsRecorder, parseFQN, parseSecretRef, toTitleCase, validateRecord, wrapDeclarativeHook };
+interface Logger {
+    info(message: string, meta?: Record<string, any>): void;
+    warn(message: string, meta?: Record<string, any>): void;
+    error(message: string, error?: Error, meta?: Record<string, any>): void;
+    debug(message: string, meta?: Record<string, any>): void;
+}
+/**
+ * SeedLoaderService — Runtime implementation of ISeedLoaderService
+ *
+ * Provides metadata-driven seed data loading with:
+ * - Automatic lookup/master_detail reference resolution via externalId
+ * - Topological dependency ordering (parents before children)
+ * - Multi-pass loading for circular references
+ * - Dry-run validation mode
+ * - Upsert support honoring SeedSchema mode
+ * - Actionable error reporting
+ */
+declare class SeedLoaderService implements ISeedLoaderService {
+    private engine;
+    private metadata;
+    private logger;
+    constructor(engine: IDataEngine$1, metadata: IMetadataService, logger: Logger);
+    load(request: SeedLoaderRequest): Promise<SeedLoaderResult>;
+    buildDependencyGraph(objectNames: string[]): Promise<ObjectDependencyGraph>;
+    validate(datasets: Seed[], config?: SeedLoaderConfigInput): Promise<SeedLoaderResult>;
+    private loadDataset;
+    private resolveFromDatabase;
+    private resolveDeferredUpdates;
+    /**
+     * Seed writes always run as a privileged system context. This bypasses
+     * RBAC checks (so seeds can target system tables like `sys_*`) and
+     * disables the SecurityPlugin's auto-injection of `organization_id` /
+     * `owner_id` — seeds either declare those fields explicitly per
+     * record, or are intentionally cross-tenant / global.
+     */
+    private static readonly SEED_OPTIONS;
+    private writeRecord;
+    /**
+     * Kahn's algorithm for topological sort with cycle detection.
+     */
+    private topologicalSort;
+    private findCycles;
+    private filterByEnv;
+    private orderDatasets;
+    private buildReferenceMap;
+    private loadExistingRecords;
+    private looksLikeInternalId;
+    private extractId;
+    private buildEmptyResult;
+    private buildResult;
+}
+
+export { type BindHooksOptions, type BindHooksResult, type BuildProbeReport, DEFAULT_EXTENDER_PRIORITY, DEFAULT_OWNER_PRIORITY, type EngineMiddleware, type EvaluateRulesOptions, type FieldValidationError, type HookEntry, type HookHandler, type HookMetricLabel, type HookMetricOutcome, type HookMetricsRecorder, type HookSkipReason, InMemoryHookMetricsRecorder, type IntrospectedColumn, type IntrospectedForeignKey, type IntrospectedSchema, type IntrospectedTable, MetadataFacade, type ObjectContributor, ObjectQL, type ObjectQLHostContext, type ObjectQLKernelOptions, ObjectQLPlugin, ObjectRepository, ObjectStackProtocolImplementation, type OperationContext, RESERVED_NAMESPACES, type RunBuildProbesOptions, type RuntimeBuildIssue, SECRET_MASK, SECRET_REF_PREFIX, SchemaRegistry, type SchemaRegistryOptions, ScopedContext, SeedLoaderService, type SysMetadataEngine, SysMetadataRepository, type SysMetadataRepositoryOptions, ValidationError, type WrapDeclarativeOptions, applyInMemoryAggregation, applySystemFields, bindHooksToEngine, bucketDateValue, collectSecretFields, computeFQN, convertIntrospectedSchemaToObjects, createObjectQLKernel, evaluateValidationRules, isSecretRef, legalNextStates, makeSecretRef, needsPriorRecord, noopHookMetricsRecorder, parseFQN, parseSecretRef, runBuildProbes, toTitleCase, validateRecord, wrapDeclarativeHook };