@objectstack/types 17.0.0-rc.5 → 17.0.0

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { TenancyPosture } from '@objectstack/spec/security';
-import { ErrorCode, ApiError } from '@objectstack/spec/api';
+import { ErrorCode, ApiError, FieldErrorCode } from '@objectstack/spec/api';
 
 /**
  * Degraded-boot reporting, shared by every subsystem that can be told to boot
@@ -391,12 +391,14 @@ declare const INTERNAL_ERROR_MESSAGE = "Internal server error";
  *
  * Matches: dialect error codes (`SQLSTATE`, `sqlite_*`), bare statements
  * (a message that *starts* as `SELECT`/`INSERT INTO`/`UPDATE`/`DELETE FROM` —
- * drivers prefix the offending SQL to their message), and constraint-violation
- * dumps, which name physical tables and columns.
+ * drivers prefix the offending SQL to their message), constraint-violation
+ * dumps, which name physical tables and columns, and the
+ * {@link DIALECT_LEAK_PHRASINGS} of the engines this repo ships.
  *
  * Does NOT match ordinary business or validation messages, which is why the
- * statement forms are anchored with `startsWith`: a legitimate message may
- * *mention* "update" without being one.
+ * statement forms are anchored with `startsWith` and the dialect phrasings on
+ * the driver's template: a legitimate message may *mention* "update", or say
+ * "does not exist" about a business record, without being either.
  */
 declare function looksLikeInternalErrorLeak(message: string | undefined | null): boolean;
 /**
@@ -680,6 +682,427 @@ declare function sendOk(res: EnvelopeResponse, data: unknown, status?: number):
  */
 declare function sendError(res: EnvelopeResponse, status: number, code: ErrorCode, message: string, extra?: Pick<ApiError, 'category' | 'httpStatus' | 'details' | 'requestId'>): void;
 
+/**
+ * The ONE rule for "what HTTP answer does a THROWN error declare?" (#8016).
+ *
+ * A service or protocol throw that carries its own `.status` / `.statusCode`
+ * and its own semantic `.code` is a *refusal*, not a fault: the caller asked
+ * for something the platform will not do, and the honest answer is that status
+ * with that code. A throw carrying neither is a fault, and the honest answer is
+ * the caller's fallback — 500 `INTERNAL_ERROR` at an HTTP boundary.
+ *
+ * ## Why this is shared rather than restated per door
+ *
+ * `/api/v1/packages` has **two** HTTP doors. The runtime dispatcher's
+ * `HttpDispatcher.errorFromThrown` read `.status` first and answered `409
+ * DESTRUCTIVE_CHANGE` for a `metadata-protocol` refusal. The direct-mount REST
+ * registrar (`packages/rest/src/package-routes.ts`) had four catch-alls that
+ * answered `500 INTERNAL_ERROR` regardless — and *that* registrar mounts first
+ * in the production stack, so 500 was what production actually returned. One
+ * throw, two answers, and the wrong one was the live one (#8016).
+ *
+ * The rule therefore lives in ONE function that both doors call. It could not
+ * live in `packages/runtime`: `@objectstack/runtime` depends on
+ * `@objectstack/rest`, so the arrow only points one way and `errorFromThrown`
+ * is unreachable from the REST door by construction. `@objectstack/types`
+ * depends on nothing but `@objectstack/spec`, which is exactly why the other
+ * shared HTTP-boundary helpers already live here — `looksLikeInternalErrorLeak`
+ * ("do not ship driver internals to clients") and `sendOk`/`sendError` ("write
+ * the declared envelope"). "What status does this throw mean?" is the same kind
+ * of property: it belongs to the boundary, not to one router.
+ *
+ * ## Two spellings of the code, because the two envelopes are not equally closed
+ *
+ * {@link ThrownHttpError.code} is narrowed to `StandardErrorCode ∪
+ * ERROR_CODE_LEDGER` — the union `ApiErrorSchema` validates against — so a
+ * throw whose `.code` is not a registered member does not get to name itself;
+ * it falls to the code the status derives. That is the same rule
+ * `metadata-protocol`'s `toRowApiError` applies to a per-row batch error, and
+ * it is what lets `sendError`'s closed `ErrorCode` parameter be satisfied
+ * without a cast. The direct-mount REST door needs exactly this: its bodies are
+ * parsed against `BaseResponseSchema` by its own conformance suite, so an
+ * unregistered code there is a failing test, not a wire answer.
+ *
+ * {@link ThrownHttpError.declaredCode} is the producer's own string, verbatim
+ * and un-narrowed, which is what the dispatcher door has always put on the
+ * wire — `STORAGE_FAILURE`, `FLOW_FAILED` and `DUPLICATE` are all unregistered
+ * and all pinned by existing dispatcher tests. Narrowing it here would rewrite
+ * a behaviour three suites assert, which is a contract decision (should the
+ * dispatcher's `error.code` be closed too?) and not this function's to take.
+ *
+ * So the doors agree on **status** unconditionally and on **code** for every
+ * registered code, and differ only where a producer emits a code the ledger
+ * does not know — a case that is already a contract violation on either door.
+ * Both answers come from ONE function, which is what keeps that difference a
+ * documented one rather than a drift.
+ *
+ * ## What this deliberately does NOT decide
+ *
+ *  - **Message disclosure.** A 5xx message may name physical tables or carry a
+ *    driver dump; withholding it is `looksLikeInternalErrorLeak`'s job, applied
+ *    by the caller (the dispatcher does; see #3867). This function returns the
+ *    thrown message verbatim.
+ *  - **Whether a declared status is *plausible*.** No 400-599 band is imposed,
+ *    because the dispatcher never imposed one and this function exists to make
+ *    the two doors agree. Narrowing the accepted band is a change to the rule,
+ *    and it belongs here — in one place, for both doors — if it is ever made.
+ */
+
+/** The HTTP answer a thrown error declares. See {@link resolveThrownHttpError}. */
+interface ThrownHttpError {
+    /** The producer's own `status`/`statusCode`, or the caller's fallback. */
+    status: number;
+    /**
+     * The status the THROW ITSELF declared — `.status`, `.statusCode`, or the
+     * 400 a validation-shaped throw declares by shape — and **absent** when it
+     * declared none, i.e. when {@link ThrownHttpError.status} above is the
+     * caller's `fallbackStatus`.
+     *
+     * ## Why `status` cannot answer this
+     *
+     * A producer that declares `500` and one that declares nothing both resolve
+     * to `status: 500`, so a caller that must tell "the producer said so" from
+     * "I supplied the default" cannot read it off the value. The workaround in
+     * the repo was to probe this function with a fallback no producer declares
+     * — `resolveThrownHttpError(e, 0).status !== 0`, still spelled by hand in
+     * `packages/rest`'s publish-classification suite. That is a magic number
+     * standing in for a fact this function already computed, and it fails
+     * silently the day a producer declares the sentinel. So the fact is stated.
+     *
+     * ## Who needs the distinction
+     *
+     * A sink that mirrors the status onto RESPONSE DATA instead of into the
+     * response's own status line — where the fallback would not be a default but
+     * an invention. `metadata-protocol`'s `toRowApiError` is the measured one
+     * (#8570): a batch row rides a **200**, so stamping `status` there would put
+     * `httpStatus: 500` on every undeclared driver fault, an ADDITION to the
+     * wire, where stamping `declaredStatus` restores only what a producer really
+     * declared. Boundaries that answer with the status itself keep reading
+     * `status` — the fallback is exactly what they want.
+     */
+    declaredStatus?: number;
+    /**
+     * A member of the declared ADR-0112 vocabulary — for a boundary whose
+     * envelope is checked against it. Never the HTTP status.
+     */
+    code: ErrorCode;
+    /**
+     * The producer's own code, verbatim and un-narrowed, or `undefined` when it
+     * declared none. For the dispatcher door, whose `error.code` is not closed in
+     * practice. See the module note on why there are two.
+     */
+    declaredCode?: string;
+    /** The thrown message, UNSANITISED — see the module note on disclosure. */
+    message: string;
+    /**
+     * Structured context: spec-validation `issues[]`, record-validation
+     * `fields[]`. Absent rather than `{}` when the throw carried none, so an
+     * empty object never reads as "there is context here".
+     */
+    details?: Record<string, unknown>;
+}
+/**
+ * Resolve a thrown error into the status, code, message and structured context
+ * an HTTP boundary should answer with.
+ *
+ * Precedence, in order:
+ *
+ * | Question | Answer |
+ * |---|---|
+ * | status | `.status` → `.statusCode` → 400 if it is a validation failure → `fallbackStatus` |
+ * | declaredStatus | the same chain WITHOUT the fallback — absent when the throw declared none |
+ * | code | `VALIDATION_FAILED` if it is one → a REGISTERED `.code` → derived from the status |
+ * | declaredCode | `VALIDATION_FAILED` if it is one → any non-empty string `.code` → absent |
+ * | message | `.message` when it is a string → `String(error)` |
+ *
+ * Both status spellings are read because both are produced in this repo:
+ * `plugin-approvals`' lifecycle hooks and `metadata-protocol` throw
+ * `statusCode`, `metadata-protocol`'s conflicts throw `status`. Reading one
+ * spelling is how `/api/v1/data` answered 500 for a deliberate `409
+ * RECORD_LOCKED` until #7525.
+ */
+declare function resolveThrownHttpError(error: unknown, fallbackStatus?: number): ThrownHttpError;
+
+/** The HTTP status a validation failure maps to when the error names none. */
+declare const VALIDATION_FAILED_STATUS = 400;
+interface ValidationFailureDetails {
+    code: 'VALIDATION_FAILED';
+    /** Per-field envelopes, passed through verbatim. `[]` when absent/malformed. */
+    fields: unknown[];
+}
+/**
+ * Structured `details` for a thrown validation failure, or `undefined` when
+ * `err` is not one. Callers use the `undefined` result as the predicate and the
+ * returned object as the `details` payload, so the two can never disagree.
+ */
+declare function validationFailureDetails(err: any): ValidationFailureDetails | undefined;
+/**
+ * [#3878/#3899] The CONSTRUCTOR for the shape {@link validationFailureDetails}
+ * recognises — kept in the same module so the two can never drift. Thrown from
+ * a domain handler, both dispatcher error exits map it to
+ * `400 VALIDATION_FAILED` + `details.fields[]` (#3918) with no new error
+ * channel and no runtime dependency on objectql's `ValidationError` class.
+ * First built inline by the analytics domain; hoisted here when notifications
+ * and automation grew the same entry gates rather than a third copy.
+ */
+declare function validationFailure(message: string, fields: unknown[]): Error;
+/**
+ * Zod issues → the dispatcher's `fields[]` envelope entries
+ * (`{ field, code, message }`). `'(body)'` names a root-level failure — a body
+ * that is the wrong TYPE entirely has no path to point at.
+ *
+ * ## The `code` is an ADR-0114 `FieldErrorCode`, not Zod's (#8124)
+ *
+ * This used to assign `issue.code` verbatim, which put Zod's own vocabulary
+ * (`unrecognized_keys`, `too_small`, …) on a wire position
+ * `FieldErrorSchema.code` declares as a CLOSED catalog — the exact
+ * pass-through ADR-0114 D3 closed on the REST transport. It now maps through
+ * `zodIssuesToFields`, the one D3 implementation in the repo, which lives in
+ * `@objectstack/spec` beside the catalog it is total over (this package cannot
+ * import `@objectstack/rest`, where the compliant copy grew up — the
+ * dependency arrow points the other way, which is what #8124 moved it for).
+ *
+ * Two things ride along, both additive:
+ *
+ * - **The optional `input`** (the value that was parsed) buys the D3
+ *   `invalid_type` split: with it a MISSING required property is reported as
+ *   `required` instead of the `invalid_type` Zod spells it as. Callers without
+ *   the input at hand degrade per the D3 table — every code is still a
+ *   catalog member.
+ * - **Union expansion (#5014)**: a rejection behind a `z.union` yields the
+ *   union's own entry PLUS the branch entries that explain it, so entry count
+ *   is not issue count. Read `fields.length` as the number of field errors.
+ */
+declare function fieldsFromZodIssues(issues: Array<{
+    path: Array<string | number | symbol>;
+    code: string;
+    message: string;
+}>, ...input: [] | [unknown]): Array<{
+    field: string;
+    code: FieldErrorCode;
+    message: string;
+}>;
+
+/**
+ * The one home for Postgres' `«sub-object» "x" of relation "y" …` phrasing
+ * (#6615).
+ *
+ * ## The superstring hole, stated once
+ *
+ * Postgres phrases a failure about something *inside* a relation by naming the
+ * relation too:
+ *
+ * ```
+ * column     "label"           of relation "sys_team" does not exist   (42703)
+ * constraint "uq_sys_team_name" of relation "sys_team" does not exist  (42704)
+ * column     "environment_id"  of relation "sys_metadata" already exists (42701)
+ * ```
+ *
+ * Every one of those **contains a complete, legal missing-TABLE phrase** —
+ * `relation "sys_team" does not exist` — as a substring, while meaning the
+ * opposite: the relation is right there, which is precisely why it could be
+ * named. No amount of tightening a "does this say a relation is missing?"
+ * regex can remove that match, because the phrase really is in there. The only
+ * repair is to ask the more specific question FIRST. That makes the ORDER the
+ * fix, not the pattern — and it is why three packages each grew their own copy
+ * of this phrase (#5352, #6035/PR #6346, #6347/PR #6613) before it was given a
+ * home.
+ *
+ * ## Two widths, on purpose — never collapse them
+ *
+ * The three consumers do not want the same regex, and the difference is not
+ * sloppiness: it is **which direction of error is safe** at each site.
+ *
+ * | consumer | asks | uses | a MISS costs |
+ * |:---|:---|:---|:---|
+ * | `@objectstack/rest` `mapDataError` (#5352) | which column? | {@link matchMissingColumnOfRelation} | a vaguer message (`404` instead of `400 INVALID_FIELD`) |
+ * | `@objectstack/service-analytics` `isMissingSourceError` / `missingSourceRelation` (#6035) | is this a missing COLUMN, so keep it hard? | {@link matchMissingColumnOfRelation} | a mistyped column degrades to a confident empty chart |
+ * | `@objectstack/metadata` `MISSING_TABLE.excludes` (#6347) | is this about a sub-object, so not a missing table? | {@link isRelationSubObjectPhrase} | a corruption verdict returns (`event_seq` restarts at 1) |
+ *
+ * The first two **extract**, so they must be strict: over-matching there would
+ * turn a genuinely missing table into a hard failure and regress #5033's
+ * deliberate leniency, while under-matching merely keeps today's verdict. The
+ * third **excludes**, so it is deliberately wider — any sub-object, any quoted
+ * identifier, any verdict — because over-matching there only ever converts a
+ * benign verdict into a loud one, and a miss restores data corruption.
+ *
+ * Collapsing the two into one regex would therefore be wrong for one caller
+ * whichever width won. They are two exports for that reason, and the reason is
+ * load-bearing rather than stylistic.
+ *
+ * ## Home
+ *
+ * `@objectstack/types`, following `isUniqueViolationError`'s move
+ * (#6250 — four hand-written answers to one question) and
+ * `isModuleNotFoundError`'s (framework#3265 — "single shared owner … so the
+ * parallel loaders cannot drift apart"). This module deliberately imports
+ * nothing.
+ *
+ * ⚠️ Unlike #6250, adopting this **does** add one dependency edge:
+ * `@objectstack/service-analytics` did not depend on `@objectstack/types`
+ * before #6615. It is acyclic by construction — `@objectstack/types` depends
+ * only on `@objectstack/spec`, which depends on nothing in-repo, so no package
+ * except `spec` itself can form a cycle by consuming it — and 25 of the repo's
+ * 73 packages (5 of 16 services) already carry the same edge. Recorded here
+ * rather than left for a reader to rediscover.
+ */
+/**
+ * Postgres' missing-COLUMN template, strictly. Returns the column name, or
+ * `undefined` when the message is not that phrase.
+ *
+ * Anchored to `column "%s" of relation "%s" does not exist` — the exact errmsg
+ * template Postgres emits for SQLSTATE 42703 on the write path
+ * (`INSERT` / `UPDATE` / `ALTER`). Both quotes are required because Postgres
+ * always emits them here, and requiring them is the safe direction of error for
+ * the two consumers that call this.
+ *
+ * Deliberately narrow in two further ways, both preserved verbatim from the
+ * open-coded copies this replaces:
+ *
+ * - the identifier is `[a-z0-9_]+` (case-insensitive), so a quoted identifier
+ *   carrying a space or punctuation is NOT matched. Postgres can quote such
+ *   names; the consumers accept the miss because a miss is the cheap direction.
+ * - the relation is `\S+` — quoted or bare, unparsed. This function answers
+ *   "which COLUMN", never "which relation".
+ *
+ * The read-path phrasing `column "bogus" does not exist` is a different
+ * sentence with no relation in it, so it does not match — and it does not need
+ * to: it carries no missing-table substring, which is the whole hole this
+ * module exists for.
+ */
+declare function matchMissingColumnOfRelation(message: string): string | undefined;
+/**
+ * The same quirk, **wider**: does this message talk about any sub-object of a
+ * relation, in any verdict?
+ *
+ * Drops all three of {@link matchMissingColumnOfRelation}'s anchors — the
+ * literal `column`, the `[a-z0-9_]+` identifier shape, and the trailing
+ * `does not exist` — so it also recognises `constraint "uq_x" of relation "y"
+ * does not exist` (42704), `column "x" of relation "y" already exists` (42701),
+ * and every other sub-object Postgres phrases this way.
+ *
+ * For **exclusion** callers only. A `true` here means "the relation is present,
+ * so whatever else this error is, it is not a missing table"; it does not mean
+ * the error is benign and it names nothing. Using it to extract would be a
+ * category error — there is no capture group precisely so that it cannot be.
+ */
+declare function isRelationSubObjectPhrase(message: string): boolean;
+
+/**
+ * Whether a thrown driver error is a unique/primary-key constraint violation.
+ *
+ * Reads all three channels in turn — `code`, `errno`, `message` — then one step
+ * down the `cause` chain, because pool and query-builder layers re-throw with
+ * the original attached. A plain string is judged on the message channel, so a
+ * caller that has already unwrapped `err.message` can pass it straight in.
+ *
+ * **Unrecognised is always `false`.** The default has to be "not a conflict":
+ * a false positive relabels an unrelated failure as the client's fault (a 409
+ * an SDK will not retry, pointing at a value that is fine), while a false
+ * negative costs only the generic envelope that was the status quo.
+ *
+ * @param error - the thrown value, of any shape.
+ *
+ * @example
+ * ```ts
+ * catch (error) {
+ *   if (isUniqueViolationError(error)) return conflict();  // 409 UNIQUE_VIOLATION
+ *   throw error;
+ * }
+ * ```
+ */
+declare function isUniqueViolationError(error: unknown): boolean;
+/**
+ * Which column a unique-constraint violation was raised on — or `undefined`
+ * when the dialect did not determinably name one (#6544).
+ *
+ * ## The contract, and why it is this narrow
+ *
+ * **A value comes back only when the identifier the driver printed is
+ * determinably a COLUMN.** When a dialect names an *index* instead — MySQL's
+ * `Duplicate entry 'a@b.com' for key 'idx_email_unique'`, Postgres'
+ * `violates unique constraint "sys_user_email_key"`, SQLite's
+ * `UNIQUE constraint failed: index 'idx_lower_email'` — the answer is
+ * `undefined`, never the index name.
+ *
+ * That is the maintainer's 2026-08-08 ruling on #6544, and the reasoning is the
+ * caller's, not this module's: **an index name mistaken for a column is worse
+ * than no answer at all.**
+ *
+ *  - `@objectstack/rest`'s import runner renders this into a form field —
+ *    "A record with this `email` already exists." An index name there points
+ *    the user at a field that does not exist on the object, so they cannot act
+ *    on it; `undefined` degrades to generic copy, which is merely less helpful.
+ *  - #5495's autonumber-retry branch asks a yes/no question of the answer —
+ *    "is the conflicting column the autonumber field?" — and an index name
+ *    produces a *wrong retry decision*, not a vaguer one.
+ *
+ * ⛔ **The accepted cost: MySQL deployments usually get no column.** MySQL's
+ * duplicate-entry message names the index and never the column, so there is
+ * nothing here to read. That is deliberate. Do not "improve" this by deriving a
+ * column from an index name (`idx_email_unique` → `email`, or MySQL 8's
+ * `for key 'sys_user.email'` → `email`): index names are free-form, a
+ * deployment's may match no column at all, and a plausible-looking wrong field
+ * is exactly the failure this export exists to avoid. If MySQL must name
+ * columns, the answer is a schema lookup of the index — a different, wider
+ * contract — not a guess in this function.
+ *
+ * A **composite** key is `undefined` for the same reason: `Key (tenant_id,
+ * email)=(…)` has no single offending column, and naming the first is the same
+ * class of wrong answer.
+ *
+ * ## What it reads
+ *
+ * Gated on {@link isUniqueViolationError}, so a NOT NULL or FOREIGN KEY failure
+ * can never reach the extraction — SQLite's `NOT NULL constraint failed: t.c`
+ * shares its shape with the positive and is refused at the gate, not by the
+ * patterns. Then `message`, then `detail` (node-postgres keeps its `DETAIL:`
+ * line there), then one step down the `cause` chain, bounded exactly as the
+ * predicate's walk is. A bare string is read as a message, so a caller holding
+ * only `err.message` can pass it straight in.
+ *
+ * @param error - the thrown value, of any shape.
+ * @returns the conflicting column, or `undefined` when none is determinable.
+ *
+ * @example
+ * ```ts
+ * const column = uniqueViolationColumn(error);
+ * return column
+ *   ? `A record with this ${column} already exists.`
+ *   : 'A record with this value already exists.';
+ * ```
+ */
+declare function uniqueViolationColumn(error: unknown): string | undefined;
+
+/**
+ * Whether a thrown driver error says the `ON CONFLICT` target it was given is
+ * backed by no PRIMARY KEY or UNIQUE index.
+ *
+ * Reads the message channel, then one step at a time down the `cause` chain —
+ * pool and query-builder layers re-throw with the original attached, and the
+ * refusal this predicate gates keeps the raw error as its own `cause`. A plain
+ * string is judged directly, so a caller that already unwrapped `err.message`
+ * can pass it in.
+ *
+ * **Unrecognised is always `false`.** A false positive is the expensive
+ * direction: it tells a caller to go add an index when the real failure was a
+ * syntax error, a missing table, or — worst — a genuine unique violation on an
+ * index that exists and works. A false negative costs only the raw error that
+ * was the status quo before recognition existed.
+ *
+ * @param error - the thrown value, of any shape.
+ *
+ * @example
+ * ```ts
+ * catch (error) {
+ *   // ⚠️ NOT isUniqueViolationError — that is the opposite condition.
+ *   if (isUnbackedConflictTargetError(error)) throw refuseUnbackedConflictTarget(object, keys, error);
+ *   throw error;
+ * }
+ * ```
+ */
+declare function isUnbackedConflictTargetError(error: unknown): boolean;
+
 /**
  * [ADR-0120 D5e] The `isolated`-posture install gate for `'global'` uniqueness.
  *
@@ -904,4 +1327,4 @@ interface RuntimePlugin {
     onStart?: (ctx: RuntimeContext) => void | Promise<void>;
 }
 
-export { type EnvelopeResponse, GLOBAL_UNIQUE_CONFIRMATION_REQUIRED, GLOBAL_UNIQUE_ISOLATED_PRESCRIPTION, type GlobalUniqueAttestation, type GlobalUniqueFinding, type IKernel, INTERNAL_ERROR_MESSAGE, type KeysetPageQuery, type KeysetWalk, type KeysetWalkOptions, type RuntimeContext, type RuntimePlugin, _resetEnvDeprecationWarnings, buildGlobalUniqueStopMessage, collectConfiguredLocales, collectGlobalUniques, declaredIndexUniqueIsGlobal, declaresServerFault, describeGlobalUniqueFinding, emitDegradedBootBanner, fieldUniqueIsGlobal, globalUniqueFindingId, isMcpServerEnabled, isModuleNotFoundError, isPlatformOwnedObject, keysetWalk, looksLikeInternalErrorLeak, postureGatesGlobalUniques, readEnvWithDeprecation, recordGlobalUniqueAttestation, resolveAllowDegradedTenancy, resolveAllowDevPlugin, resolveAllowDriverConnectFailure, resolveMcpStdioAutoStart, resolveMultiOrgEnabled, resolveOrgLimit, resolveSandboxTimeoutMs, resolveSearchPinyinEnabled, resolveTenancyPosture, sendError, sendOk, stampSearchPinyinEnabled, unconfirmedGlobalUniques };
+export { type EnvelopeResponse, GLOBAL_UNIQUE_CONFIRMATION_REQUIRED, GLOBAL_UNIQUE_ISOLATED_PRESCRIPTION, type GlobalUniqueAttestation, type GlobalUniqueFinding, type IKernel, INTERNAL_ERROR_MESSAGE, type KeysetPageQuery, type KeysetWalk, type KeysetWalkOptions, type RuntimeContext, type RuntimePlugin, type ThrownHttpError, VALIDATION_FAILED_STATUS, type ValidationFailureDetails, _resetEnvDeprecationWarnings, buildGlobalUniqueStopMessage, collectConfiguredLocales, collectGlobalUniques, declaredIndexUniqueIsGlobal, declaresServerFault, describeGlobalUniqueFinding, emitDegradedBootBanner, fieldUniqueIsGlobal, fieldsFromZodIssues, globalUniqueFindingId, isMcpServerEnabled, isModuleNotFoundError, isPlatformOwnedObject, isRelationSubObjectPhrase, isUnbackedConflictTargetError, isUniqueViolationError, keysetWalk, looksLikeInternalErrorLeak, matchMissingColumnOfRelation, postureGatesGlobalUniques, readEnvWithDeprecation, recordGlobalUniqueAttestation, resolveAllowDegradedTenancy, resolveAllowDevPlugin, resolveAllowDriverConnectFailure, resolveMcpStdioAutoStart, resolveMultiOrgEnabled, resolveOrgLimit, resolveSandboxTimeoutMs, resolveSearchPinyinEnabled, resolveTenancyPosture, resolveThrownHttpError, sendError, sendOk, stampSearchPinyinEnabled, unconfirmedGlobalUniques, uniqueViolationColumn, validationFailure, validationFailureDetails };