@objectstack/types 17.0.0-rc.3 → 17.0.0-rc.4

package/dist/index.d.ts

@@ -89,21 +89,33 @@ declare function readEnvWithDeprecation(preferred: string, legacy: string | read
     silent?: boolean;
 }): string | undefined;
 /**
- * Resolve whether the deployment runs in multi-org (a.k.a. multi-tenant) mode.
- *
- * Single source of truth for the `OS_MULTI_ORG_ENABLED` flag. Resolution: the
- * canonical `OS_MULTI_ORG_ENABLED`; else `false`. Any value other than a
+ * Read the LEGACY `OS_MULTI_ORG_ENABLED` boolean.
+ *
+ * ⚠️ **[ADR-0105 D1] DEMOTED — not the knob to gate on.** `OS_TENANCY_POSTURE`
+ * superseded this flag and is the authoritative one;
+ * {@link resolveTenancyPosture} is where the two are reconciled (posture when
+ * set, else this boolean). This function only reports the legacy input, so a
+ * deployment that sets ONLY the canonical `OS_TENANCY_POSTURE` reads `false`
+ * here while genuinely running a walled multi-organization posture.
+ *
+ * **Answering "is this deployment multi-org?" with this function is a bug.**
+ * Ask the posture instead — `postureEnforcesWall(resolveTenancyPosture())`
+ * (`@objectstack/spec/security`) — or, inside a running kernel, the `tenancy`
+ * service, which additionally knows whether the requested wall is actually
+ * ENFORCED (ADR-0093 D4/D5). Two shipped defects came from gating on this
+ * boolean after the demotion: cloud#1020 (the EE licence gate) and #5233
+ * (`organization/create` 403'd on a posture-only deployment whose organization
+ * wall was fully mounted — the guided "create your workspace" path dead-ended).
+ * The sentence this paragraph replaced actively instructed both.
+ *
+ * Legitimate remaining callers are the ones that specifically mean *the legacy
+ * input*: {@link resolveTenancyPosture}'s own back-compat fallback, and
+ * back-compat/reporting surfaces that must echo what the operator typed.
+ *
+ * Resolution: `OS_MULTI_ORG_ENABLED`; else `false`. Any value other than a
  * case-insensitive `'false'` enables it. (The legacy `OS_MULTI_TENANT` alias was
  * removed in 11.0.)
  *
- * Every site that needs to know "is this multi-org?" — the SQL driver's
- * tenant-audit gate, the auth manager's `/auth/config` feature flag and
- * org-create guard, the CLI / dev / runtime org-scoping plugin wiring — MUST
- * call this instead of re-reading the env, so the driver, the security layer,
- * and the UI can never disagree about the mode. Previously each site inlined
- * its own `String(... ?? 'false').toLowerCase() !== 'false'` (and the SQL
- * driver read `process.env` directly, skipping the deprecation warning).
- *
  * Reads `process.env` live on each call; memoise at the call site if the
  * result must be stable for the process lifetime.
  */
@@ -237,7 +249,9 @@ declare function resolveMcpStdioAutoStart(): {
  * self-created orgs (each of which can auto-provision a free environment on the
  * cloud control plane) without penalising a user invited into many orgs.
  *
- * Only meaningful when multi-org is enabled ({@link resolveMultiOrgEnabled}).
+ * Only meaningful under a posture that enforces an organization wall, i.e.
+ * `postureEnforcesWall({@link resolveTenancyPosture}())` — NOT the demoted
+ * `resolveMultiOrgEnabled()` boolean (ADR-0105 D1, #5233).
  * Returns `undefined` when unset or non-positive → no limit (better-auth treats
  * an absent `organizationLimit` as unlimited), preserving self-host behaviour.
  * Deployments that let users self-create orgs SHOULD set a generous cap.
@@ -364,6 +378,10 @@ declare function _resetEnvDeprecationWarnings(): void;
  * positive costs a caller nothing but detail on a response that was a server
  * fault anyway — while the full text still reaches server logs and the
  * error reporter.
+ *
+ * [#5811] {@link declaresServerFault} joins it here for the same reason and
+ * answers the other half of the question: the heuristic asks whether a message
+ * *sounds* internal, the declaration asks whether the producer *said so*.
  */
 /** Generic replacement text for a message that trips {@link looksLikeInternalErrorLeak}. */
 declare const INTERNAL_ERROR_MESSAGE = "Internal server error";
@@ -381,6 +399,53 @@ declare const INTERNAL_ERROR_MESSAGE = "Internal server error";
  * *mention* "update" without being one.
  */
 declare function looksLikeInternalErrorLeak(message: string | undefined | null): boolean;
+/**
+ * Whether the thrown error **declares a server fault** in the ADR-0112 envelope:
+ * `status >= 500` *and* a non-empty `code`.
+ *
+ * The counterpart to {@link looksLikeInternalErrorLeak}, and deliberately not a
+ * message test at all. Some server faults are dangerous to echo while saying
+ * nothing a phrasing heuristic can recognise — the motivating family is
+ * `service-analytics`' `read-scope-sql.ts`, whose ten fail-closed RLS lowering
+ * refusals name the FIELD NAMES AND COMPARANDS OF THE RLS POLICY:
+ *
+ * ```
+ * [read-scope-sql] unsafe field identifier "secret_policy_field" — refusing to
+ * build read scope (fail-closed).
+ * ```
+ *
+ * That text comes from an administrator's sharing rule compiled by the security
+ * service; the tenant who receives it never wrote it and must not be able to read
+ * it out of an error body. Measured, all eleven of its message shapes return
+ * FALSE from `looksLikeInternalErrorLeak` — they look nothing like a driver dump —
+ * so a boundary that only ran the heuristic echoed every one of them verbatim
+ * (#5811 measured 11/11 through `errorResponseBase`). Teaching the heuristic to
+ * recognise `[read-scope-sql]` would have been *more* message sniffing, which is
+ * the mechanism #5352/#5367 exist to remove. So the withhold keys on the
+ * DECLARATION instead: a producer that says `status >= 500` with a `code` has
+ * declared that this is the server's fault, and a server fault's detail belongs in
+ * the operator's log, not in the caller's body.
+ *
+ * **Both halves are required, and it is deliberately NOT "any 5xx".** #5667 kept
+ * UNDECLARED 5xx errors legible on purpose — a bare `Error` from our own code
+ * ("no strategy can handle query …") is the operator's own bug report, carries
+ * nothing tenant-sensitive, and still falls to `looksLikeInternalErrorLeak`.
+ * Widening this to every 500 would delete that decision.
+ *
+ * **Reads `status`, not `statusCode`.** `status` is the channel ADR-0112 declares;
+ * `statusCode` is an alternate spelling some boundaries tolerate when *deriving*
+ * an HTTP status. Accepting it here would make the disclosure rule depend on which
+ * spelling a producer happened to use — consumer-side leniency of exactly the kind
+ * Prime Directive #12 removes. A producer that wants its detail withheld declares
+ * the envelope.
+ *
+ * Costs no diagnostics: every boundary that applies this still logs the untouched
+ * error and hands it to the error reporter.
+ *
+ * @param err - the thrown value, of any shape (a non-object is simply not a
+ *   declaration).
+ */
+declare function declaresServerFault(err: unknown): boolean;
 
 /**
  * Seek-based (keyset) pagination for the batch walks that read a whole object.
@@ -615,6 +680,216 @@ declare function sendOk(res: EnvelopeResponse, data: unknown, status?: number):
  */
 declare function sendError(res: EnvelopeResponse, status: number, code: ErrorCode, message: string, extra?: Pick<ApiError, 'category' | 'httpStatus' | 'details' | 'requestId'>): void;
 
+/**
+ * [ADR-0120 D5e] The `isolated`-posture install gate for `'global'` uniqueness.
+ *
+ * ## Why a gate exists at all
+ *
+ * ADR-0120's scope vocabulary is deliberately **posture-invariant**: the author
+ * states a business boundary (`'organization'` = one holder per organization,
+ * `'global'` = one holder across the whole installation) and the same app
+ * package runs unmodified under every tenancy posture (ADR-0105 D1
+ * `single | group | isolated`). No index shape reads the posture — a posture
+ * flip has zero automatic schema consequences, which is exactly what makes one
+ * app package serve all three.
+ *
+ * One residual survives that invariance, and only in one direction
+ * (ADR-0120 §Posture portability, Resolved question #4):
+ *
+ * - Under `single` / `group`, `'global'` means "the installation" — which for a
+ *   `group` deployment IS the customer company (集团). An app business rule
+ *   spelled `'global'` is correct there.
+ * - Under `isolated`, organizations are **separate customers**. The identical
+ *   declaration now crosses customers: it over-constrains (customer B cannot
+ *   reuse customer A's material code) and it becomes a cross-tenant existence
+ *   oracle — the very leak #3696 closed for field-level uniques (S10).
+ *
+ * `'global'` is therefore physically posture-invariant but not *safety*-invariant,
+ * and the ADR's S14 row records the honest cost: "unique across the whole
+ * company" is not expressible in metadata alone, because it means the
+ * installation under `group` and one organization under `isolated`. A third,
+ * posture-resolved word (`'company'`) was designed and **rejected** — it is the
+ * one token that cannot be used without first understanding the posture
+ * spectrum, exactly the cognitive load an AI-authored vocabulary must not carry.
+ * The scenario is handled **here**, at the deployment seam, instead.
+ *
+ * ## Why a HARD stop and not an advisory
+ *
+ * Maintainer decision, 2026-08-04 (ADR-0120 Resolved #4). An advisory that
+ * nobody reads leaves a cross-customer constraint enforced in production — the
+ * ADR-0049/0078 class this whole ADR exists to close. So installing an app that
+ * carries `'global'` uniques on non-`sys` objects into an `isolated` environment
+ * **stops**, lists each index, and asks the installer (typically an AI agent) to
+ * either confirm it as genuinely platform-wide or rewrite it to
+ * `'organization'`. The confirmation is recorded in the install manifest
+ * (ADR-0104 attestation style) so it is **never re-asked**.
+ *
+ * ⛔ **Never a boot-time warning** (#4884 discipline). A deployment whose apps
+ * were installed before this gate existed, or whose posture changed after
+ * install, is reached by the ADVISORY form in `os doctor` / `os migrate plan` —
+ * the two cases a gate at the install seam structurally cannot see. Turning
+ * this into a startup diagnostic would fire on every boot of every deployment
+ * forever, which is the false-alarm class #4884 retired.
+ *
+ * ## What counts as a finding
+ *
+ * | Declaration | Finding? | Why |
+ * |:---|:---|:---|
+ * | field `unique: 'global'` | ✅ | one holder across the installation — crosses customers under `isolated` |
+ * | declared index `unique: 'global'` | ✅ | same boundary, spelled on the index |
+ * | declared index `unique: true` | ✅ | ADR-0120 D1: bare `true` **is** the deprecated positional spelling of `'global'`; identical physical shape, identical hazard. Excluding it would leave the gate bypassable by spelling for the whole of 17.x |
+ * | field `unique: true` / `'organization'` | ❌ | per-organization — correct under every posture |
+ * | declared index `unique: 'organization'` | ❌ | per-organization (D3 NULL-safe key part) |
+ * | anything on a `sys_*` object | ❌ | engine idempotency / dedup keys (the ADR's S5 inventory) are platform-wide **by construction**; asking about them on every install is the false-alarm class again |
+ *
+ * The enumeration is a pure projection of declared metadata — no tenancy
+ * inference, no database access — which is what lets the identical function
+ * serve the hard gate, `os doctor` and `os migrate plan`.
+ */
+
+/**
+ * Is this object platform-owned (the ADR's "`sys` objects")?
+ *
+ * The ADR scopes the gate to **non-`sys`** objects because the platform's own
+ * `'global'` uniques are the S5 inventory — `sys_job.name`,
+ * `sys_notification.dedup_key`, `http_delivery (source, dedup_key)` and the rest
+ * — engine idempotency keys that are platform-wide on purpose and identical
+ * under every posture. Re-confirming them on every app install would be the
+ * #4884 false-alarm class with extra steps.
+ *
+ * `base_` is included alongside `sys_`: it is the platform's other reserved
+ * object prefix, carrying the same "owned by the framework, not the app"
+ * meaning. An app object can never legitimately claim either.
+ */
+declare function isPlatformOwnedObject(objectName: unknown): boolean;
+/**
+ * Does a FIELD-level `unique` value ask for the installation-wide boundary?
+ *
+ * Only the explicit `'global'` does. Bare `true` at field level is the
+ * documented, unambiguous synonym of `'organization'` (ADR-0120 D1 —
+ * "field-level bare `true` stays valid indefinitely", Resolved #2), so it is
+ * never a finding.
+ */
+declare function fieldUniqueIsGlobal(unique: unknown): boolean;
+/**
+ * Does a DECLARED-INDEX `unique` value ask for the installation-wide boundary?
+ *
+ * `'global'` and bare `true` both do. Per ADR-0120 D1 the bare spelling **is**
+ * `'global'` — "today's verbatim semantics, materialized over exactly the listed
+ * columns" — deprecated (lint `unique/unscoped-declared-index` warns in 17.x,
+ * protocol 18 rejects it, #5082) but physically identical while it lasts. A gate
+ * that judged only the explicit word would be bypassable by writing the
+ * deprecated one, which is the #4986 trap wearing the gate's own uniform.
+ */
+declare function declaredIndexUniqueIsGlobal(unique: unknown): boolean;
+/** One installation-wide unique declaration found on an app (non-`sys`) object. */
+interface GlobalUniqueFinding {
+    /** Stable identity for the attestation record — see {@link globalUniqueFindingId}. */
+    readonly id: string;
+    /** Object (and therefore table) the declaration sits on. */
+    readonly object: string;
+    /** Which spelling carried it. */
+    readonly kind: 'field' | 'index';
+    /** Field name for `kind: 'field'`; the index's declared name (when it has one) otherwise. */
+    readonly name?: string;
+    /** The columns the constraint spans, in declaration order. */
+    readonly columns: readonly string[];
+    /** The exact authored value (`true` | `'global'`) — quoted back in the stop message. */
+    readonly spelling: true | 'global';
+}
+/**
+ * Stable id for one finding, used as the attestation key.
+ *
+ * Keyed by object + kind + **columns**, deliberately NOT by the index's optional
+ * `name`: a declared index may be anonymous, and renaming an index does not
+ * change which constraint the installer confirmed. Two indexes on the same
+ * object spanning the same columns are the same constraint by any physical
+ * reading, so collapsing them is correct rather than lossy.
+ */
+declare function globalUniqueFindingId(objectName: string, kind: 'field' | 'index', columns: readonly string[]): string;
+/**
+ * Enumerate every installation-wide unique declared on an app's non-`sys`
+ * objects (ADR-0120 D5e).
+ *
+ * Pure and posture-agnostic on purpose: the CALLER decides whether the posture
+ * makes these findings a hard stop (`isolated`, at install) or an advisory
+ * (`os doctor` / `os migrate plan`). Deterministic order — objects as supplied,
+ * fields before indexes within an object — so the stop message and the
+ * attestation record are reproducible across runs.
+ */
+declare function collectGlobalUniques(objects: unknown): GlobalUniqueFinding[];
+/**
+ * The attestation recorded in the install manifest once an installer has
+ * confirmed a set of findings as genuinely platform-wide (ADR-0104 style).
+ *
+ * Shape follows the ADR-0104 precedent rather than inventing one: the FACT
+ * observed (which constraint ids a human/agent affirmed), WHO affirmed it, WHEN,
+ * and under WHICH posture the question was asked. That last field is what keeps
+ * the record honest — an attestation given under `isolated` is evidence about
+ * `isolated`, and nothing else.
+ *
+ * Never rewritten in place: confirmations ACCUMULATE. A later install of a newer
+ * version that adds a new `'global'` index asks about the new one only — the
+ * earlier answers stand, which is the "之后不复问" half of the decision.
+ */
+interface GlobalUniqueAttestation {
+    /** Posture the confirmation was given under. */
+    readonly posture: TenancyPosture;
+    /** Finding ids affirmed as genuinely platform-wide. */
+    readonly confirmed: readonly string[];
+    /** ISO timestamp of the most recent confirmation. */
+    readonly attestedAt: string;
+    /** Identity of the confirming installer, when the seam knows one. */
+    readonly attestedBy?: string | null;
+}
+/**
+ * Which findings still need an answer, given an existing attestation.
+ *
+ * Returns the findings NOT covered by `attestation.confirmed`. An empty result
+ * means the install proceeds silently — this is the mechanism behind "never
+ * re-asked".
+ *
+ * An attestation recorded under a DIFFERENT posture does not carry over: the
+ * question "is this genuinely platform-wide, knowing organizations here are
+ * separate customers?" was never asked. Confirmations made under `isolated` are
+ * the only ones that answer it, so a `single`-posture record is treated as
+ * absent rather than as consent — the conservative direction, and the only one
+ * that cannot silently admit a cross-customer constraint.
+ */
+declare function unconfirmedGlobalUniques(findings: readonly GlobalUniqueFinding[], attestation: GlobalUniqueAttestation | undefined | null, posture: TenancyPosture): GlobalUniqueFinding[];
+/**
+ * Merge a new set of confirmations into an existing attestation.
+ *
+ * Additive by construction — see {@link GlobalUniqueAttestation}. A record from
+ * another posture is replaced rather than merged: its `confirmed` ids answered a
+ * different question.
+ */
+declare function recordGlobalUniqueAttestation(previous: GlobalUniqueAttestation | undefined | null, confirmedIds: readonly string[], posture: TenancyPosture, attestedBy?: string | null, now?: string): GlobalUniqueAttestation;
+/** Render one finding the way both the hard stop and the advisory quote it. */
+declare function describeGlobalUniqueFinding(finding: GlobalUniqueFinding): string;
+/**
+ * The prescription every surface repeats verbatim, so the hard stop and the two
+ * advisories cannot drift into three different pieces of advice.
+ */
+declare const GLOBAL_UNIQUE_ISOLATED_PRESCRIPTION: string;
+/**
+ * The full hard-stop message for an install into an `isolated` environment.
+ *
+ * Built here rather than at the install seam so the CLI, the HTTP surface and
+ * the tests all quote one text.
+ */
+declare function buildGlobalUniqueStopMessage(appLabel: string, findings: readonly GlobalUniqueFinding[]): string;
+/** Error code the install seam returns when the gate stops an install. */
+declare const GLOBAL_UNIQUE_CONFIRMATION_REQUIRED = "UNIQUE_SCOPE_CONFIRMATION_REQUIRED";
+/**
+ * Does this posture make `'global'` uniques a decision point at all?
+ *
+ * `isolated` only. Under `single` there is one customer; under `group` the
+ * installation IS the customer company, which is what `'global'` means there —
+ * both are the benign direction the ADR leaves to the app's install notes.
+ */
+declare function postureGatesGlobalUniques(posture: unknown): boolean;
+
 interface IKernel {
     ql?: any;
     start(): Promise<void>;
@@ -629,4 +904,4 @@ interface RuntimePlugin {
     onStart?: (ctx: RuntimeContext) => void | Promise<void>;
 }
 
-export { type EnvelopeResponse, type IKernel, INTERNAL_ERROR_MESSAGE, type KeysetPageQuery, type KeysetWalk, type KeysetWalkOptions, type RuntimeContext, type RuntimePlugin, _resetEnvDeprecationWarnings, collectConfiguredLocales, emitDegradedBootBanner, isMcpServerEnabled, isModuleNotFoundError, keysetWalk, looksLikeInternalErrorLeak, readEnvWithDeprecation, resolveAllowDegradedTenancy, resolveAllowDevPlugin, resolveAllowDriverConnectFailure, resolveMcpStdioAutoStart, resolveMultiOrgEnabled, resolveOrgLimit, resolveSandboxTimeoutMs, resolveSearchPinyinEnabled, resolveTenancyPosture, sendError, sendOk, stampSearchPinyinEnabled };
+export { type EnvelopeResponse, GLOBAL_UNIQUE_CONFIRMATION_REQUIRED, GLOBAL_UNIQUE_ISOLATED_PRESCRIPTION, type GlobalUniqueAttestation, type GlobalUniqueFinding, type IKernel, INTERNAL_ERROR_MESSAGE, type KeysetPageQuery, type KeysetWalk, type KeysetWalkOptions, type RuntimeContext, type RuntimePlugin, _resetEnvDeprecationWarnings, buildGlobalUniqueStopMessage, collectConfiguredLocales, collectGlobalUniques, declaredIndexUniqueIsGlobal, declaresServerFault, describeGlobalUniqueFinding, emitDegradedBootBanner, fieldUniqueIsGlobal, globalUniqueFindingId, isMcpServerEnabled, isModuleNotFoundError, isPlatformOwnedObject, keysetWalk, looksLikeInternalErrorLeak, postureGatesGlobalUniques, readEnvWithDeprecation, recordGlobalUniqueAttestation, resolveAllowDegradedTenancy, resolveAllowDevPlugin, resolveAllowDriverConnectFailure, resolveMcpStdioAutoStart, resolveMultiOrgEnabled, resolveOrgLimit, resolveSandboxTimeoutMs, resolveSearchPinyinEnabled, resolveTenancyPosture, sendError, sendOk, stampSearchPinyinEnabled, unconfirmedGlobalUniques };

package/dist/index.js

@@ -20,15 +20,27 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  GLOBAL_UNIQUE_CONFIRMATION_REQUIRED: () => GLOBAL_UNIQUE_CONFIRMATION_REQUIRED,
+  GLOBAL_UNIQUE_ISOLATED_PRESCRIPTION: () => GLOBAL_UNIQUE_ISOLATED_PRESCRIPTION,
   INTERNAL_ERROR_MESSAGE: () => INTERNAL_ERROR_MESSAGE,
   _resetEnvDeprecationWarnings: () => _resetEnvDeprecationWarnings,
+  buildGlobalUniqueStopMessage: () => buildGlobalUniqueStopMessage,
   collectConfiguredLocales: () => collectConfiguredLocales,
+  collectGlobalUniques: () => collectGlobalUniques,
+  declaredIndexUniqueIsGlobal: () => declaredIndexUniqueIsGlobal,
+  declaresServerFault: () => declaresServerFault,
+  describeGlobalUniqueFinding: () => describeGlobalUniqueFinding,
   emitDegradedBootBanner: () => emitDegradedBootBanner,
+  fieldUniqueIsGlobal: () => fieldUniqueIsGlobal,
+  globalUniqueFindingId: () => globalUniqueFindingId,
   isMcpServerEnabled: () => isMcpServerEnabled,
   isModuleNotFoundError: () => isModuleNotFoundError,
+  isPlatformOwnedObject: () => isPlatformOwnedObject,
   keysetWalk: () => keysetWalk,
   looksLikeInternalErrorLeak: () => looksLikeInternalErrorLeak,
+  postureGatesGlobalUniques: () => postureGatesGlobalUniques,
   readEnvWithDeprecation: () => readEnvWithDeprecation,
+  recordGlobalUniqueAttestation: () => recordGlobalUniqueAttestation,
   resolveAllowDegradedTenancy: () => resolveAllowDegradedTenancy,
   resolveAllowDevPlugin: () => resolveAllowDevPlugin,
   resolveAllowDriverConnectFailure: () => resolveAllowDriverConnectFailure,
@@ -40,7 +52,8 @@ __export(index_exports, {
   resolveTenancyPosture: () => resolveTenancyPosture,
   sendError: () => sendError,
   sendOk: () => sendOk,
-  stampSearchPinyinEnabled: () => stampSearchPinyinEnabled
+  stampSearchPinyinEnabled: () => stampSearchPinyinEnabled,
+  unconfirmedGlobalUniques: () => unconfirmedGlobalUniques
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -184,6 +197,11 @@ function looksLikeInternalErrorLeak(message) {
   const lower = String(message).toLowerCase();
   return lower.includes("sqlite_") || lower.includes("sqlstate") || lower.startsWith("insert into ") || lower.startsWith("update ") || lower.startsWith("select ") || lower.startsWith("delete from ") || lower.includes("constraint failed") || lower.includes("unique constraint") || lower.includes("foreign key");
 }
+function declaresServerFault(err) {
+  if (typeof err !== "object" || err === null) return false;
+  const { status, code } = err;
+  return typeof status === "number" && status >= 500 && typeof code === "string" && code.length > 0;
+}
 
 // src/keyset-walk.ts
 function withCursor(where, key, cursor) {
@@ -261,17 +279,127 @@ function sendOk(res, data, status = 200) {
 function sendError(res, status, code, message, extra) {
   res.status(status).json({ success: false, error: { code, message, ...extra } });
 }
+
+// src/unique-scope-install-gate.ts
+var import_security2 = require("@objectstack/spec/security");
+var SYS_OBJECT_PREFIXES = ["sys_", "base_"];
+function isPlatformOwnedObject(objectName) {
+  const name = typeof objectName === "string" ? objectName.trim().toLowerCase() : "";
+  if (!name) return false;
+  return SYS_OBJECT_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+function fieldUniqueIsGlobal(unique) {
+  return unique === "global";
+}
+function declaredIndexUniqueIsGlobal(unique) {
+  return unique === "global" || unique === true;
+}
+function globalUniqueFindingId(objectName, kind, columns) {
+  return `${objectName}:${kind}:${columns.join("+")}`;
+}
+function fieldEntriesOf(fields) {
+  if (!fields) return [];
+  if (Array.isArray(fields)) {
+    return fields.filter((f) => f && f.name != null).map((f) => ({ name: String(f.name), def: f }));
+  }
+  if (typeof fields !== "object") return [];
+  return Object.entries(fields).map(([name, def]) => ({ name, def }));
+}
+function collectGlobalUniques(objects) {
+  if (!Array.isArray(objects)) return [];
+  const findings = [];
+  for (const obj of objects) {
+    const objectName = typeof obj?.name === "string" ? obj.name.trim() : "";
+    if (!objectName) continue;
+    if (isPlatformOwnedObject(objectName)) continue;
+    for (const { name, def } of fieldEntriesOf(obj?.fields)) {
+      if (!fieldUniqueIsGlobal(def?.unique)) continue;
+      findings.push({
+        id: globalUniqueFindingId(objectName, "field", [name]),
+        object: objectName,
+        kind: "field",
+        name,
+        columns: [name],
+        spelling: "global"
+      });
+    }
+    const declaredIndexes = Array.isArray(obj?.indexes) ? obj.indexes : [];
+    for (const idx of declaredIndexes) {
+      if (!declaredIndexUniqueIsGlobal(idx?.unique)) continue;
+      const columns = Array.isArray(idx?.fields) ? idx.fields.filter((f) => typeof f === "string").map((f) => f) : [];
+      if (columns.length === 0) continue;
+      const indexName = typeof idx?.name === "string" && idx.name.trim() ? idx.name.trim() : void 0;
+      findings.push({
+        id: globalUniqueFindingId(objectName, "index", columns),
+        object: objectName,
+        kind: "index",
+        ...indexName ? { name: indexName } : {},
+        columns,
+        spelling: idx.unique === true ? true : "global"
+      });
+    }
+  }
+  return findings;
+}
+function unconfirmedGlobalUniques(findings, attestation, posture) {
+  if (!attestation || attestation.posture !== posture) return [...findings];
+  const confirmed = new Set(attestation.confirmed ?? []);
+  return findings.filter((f) => !confirmed.has(f.id));
+}
+function recordGlobalUniqueAttestation(previous, confirmedIds, posture, attestedBy, now = (/* @__PURE__ */ new Date()).toISOString()) {
+  const carried = previous && previous.posture === posture ? previous.confirmed ?? [] : [];
+  const merged = Array.from(/* @__PURE__ */ new Set([...carried, ...confirmedIds])).sort();
+  return {
+    posture,
+    confirmed: merged,
+    attestedAt: now,
+    ...attestedBy !== void 0 ? { attestedBy } : {}
+  };
+}
+function describeGlobalUniqueFinding(finding) {
+  const spelling = finding.spelling === true ? "`unique: true`" : "`unique: 'global'`";
+  const deprecated = finding.spelling === true ? " [deprecated bare spelling of 'global']" : "";
+  if (finding.kind === "field") {
+    return `${finding.object}.${finding.name} \u2014 field-level ${spelling}`;
+  }
+  const label = finding.name ? ` '${finding.name}'` : "";
+  return `${finding.object} \u2014 declared index${label} [${finding.columns.join(", ")}] ${spelling}${deprecated}`;
+}
+var GLOBAL_UNIQUE_ISOLATED_PRESCRIPTION = "Under the 'isolated' posture organizations are separate CUSTOMERS, so an installation-wide unique constrains across customers and can reveal that another customer already holds a value (ADR-0120 S10/S14). For each index above, either (a) confirm it is genuinely platform-wide \u2014 an infrastructure/dedup key, a DNS hostname, an external provider id \u2014 or (b) rewrite it to `unique: 'organization'` so it is one holder per organization. See ADR-0120 \xA7Posture portability.";
+function buildGlobalUniqueStopMessage(appLabel, findings) {
+  const lines = findings.map((f) => `  \u2022 ${describeGlobalUniqueFinding(f)}`);
+  return `'${appLabel}' declares ${findings.length} installation-wide unique constraint(s) on its own objects, and this environment runs the 'isolated' tenancy posture (ADR-0120 D5e):
+${lines.join("\n")}
+${GLOBAL_UNIQUE_ISOLATED_PRESCRIPTION}
+Re-run the install with the confirmation to record it in the install manifest \u2014 it is asked once, never again for the same constraints.`;
+}
+var GLOBAL_UNIQUE_CONFIRMATION_REQUIRED = "UNIQUE_SCOPE_CONFIRMATION_REQUIRED";
+function postureGatesGlobalUniques(posture) {
+  return (0, import_security2.normalizeTenancyPosture)(posture) === "isolated";
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  GLOBAL_UNIQUE_CONFIRMATION_REQUIRED,
+  GLOBAL_UNIQUE_ISOLATED_PRESCRIPTION,
   INTERNAL_ERROR_MESSAGE,
   _resetEnvDeprecationWarnings,
+  buildGlobalUniqueStopMessage,
   collectConfiguredLocales,
+  collectGlobalUniques,
+  declaredIndexUniqueIsGlobal,
+  declaresServerFault,
+  describeGlobalUniqueFinding,
   emitDegradedBootBanner,
+  fieldUniqueIsGlobal,
+  globalUniqueFindingId,
   isMcpServerEnabled,
   isModuleNotFoundError,
+  isPlatformOwnedObject,
   keysetWalk,
   looksLikeInternalErrorLeak,
+  postureGatesGlobalUniques,
   readEnvWithDeprecation,
+  recordGlobalUniqueAttestation,
   resolveAllowDegradedTenancy,
   resolveAllowDevPlugin,
   resolveAllowDriverConnectFailure,
@@ -283,6 +411,7 @@ function sendError(res, status, code, message, extra) {
   resolveTenancyPosture,
   sendError,
   sendOk,
-  stampSearchPinyinEnabled
+  stampSearchPinyinEnabled,
+  unconfirmedGlobalUniques
 });
 //# sourceMappingURL=index.js.map