Schema-driven internal admin over other parts' tables, driven entirely by their declared data_ownership.reads (RFC 0004). Reads project only declared, non-redacted columns through the SqlExecutor seam; writes dispatch to the parts' public-export mutators. No compile-time dependency on the parts it administers.

Append-only domain event log over a part-owned Postgres table, written and queried through a contract-stable interface and a driver-free SqlExecutor seam.

Programmatic API-key authentication — issue, scope, verify, rotate, and revoke long-lived bearer keys through a contract-stable interface and a driver-free SqlExecutor seam. The API-facing sibling of auth.session.

Email/password authentication and server-validated sessions through a contract-stable interface, wrapping Better Auth behind part-owned tables.

Organizations, memberships, and roles with a row-level-scoping authorization gate, over part-owned Postgres tables, through a contract-stable interface and a driver-free SqlExecutor seam.

Subscription billing through a contract-stable interface: hosted checkout, a webhook-derived subscription mirror, cancel/reactivate/change-plan, and entitlement — with pluggable, attested payment-vendor adapters.

Vendor-neutral metered-usage ledger — record consumption events idempotently, aggregate per subject/meter/period, and report unreported usage to a biller (Stripe Meters) out-of-band. The ledger is the source of truth; the biller is an adapter.

Send transactional email through a contract-stable interface with pluggable, attested vendor adapters.

Typed feature flags with first-match targeting rules and sticky percentage rollout, evaluated on a fail-safe hot path (an unknown flag / type mismatch / storage error returns the caller's fallback, never throws).

Durable background jobs with capped exponential-backoff retries and a dead-letter, over a part-owned Postgres schema. Serverless-safe transactional enqueue through a driver-free SqlExecutor seam; processing in either a long-running worker or a serverless drain. Wraps graphile-worker.

Fixed-window API rate limiting through a contract-stable interface, with a built-in per-instance in-memory store and a typed pluggable-store seam for Redis-compatible backends.

Postgres-native full-text search — index documents, then search them with raw user query strings safely, ranked (title over body) with highlighted snippets, on plain Postgres with no separate search vendor.

Send a transactional SMS through a contract-stable, vendor-neutral interface — E.164 recipient, a plain-text body, transient-retry, typed errors — with pluggable, attested vendor adapters.

Presigned, direct-to-storage uploads and downloads for any S3-compatible provider, via in-part AWS Signature Version 4 — no SDK, no proxying bytes through the app.

Outbound signed webhooks — register customer endpoints, dispatch events to a transactional outbox (never inline), and deliver out-of-band with retry, capped backoff, a delivery log, dead-letter, and SSRF defense. The API-facing sibling of webhooks.ingest.

Verify inbound webhooks — HMAC signature, timestamp window, replay defense — through a contract-stable interface with pluggable, attested signature-scheme adapters.