@objectstack/objectql 8.0.1 → 9.0.0

package/dist/index.js

@@ -5,6 +5,9 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -27,6 +30,609 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/seed-loader.ts
+var seed_loader_exports = {};
+__export(seed_loader_exports, {
+  SeedLoaderService: () => SeedLoaderService
+});
+var import_data2, import_formula, DEFAULT_EXTERNAL_ID_FIELD, _SeedLoaderService, SeedLoaderService;
+var init_seed_loader = __esm({
+  "src/seed-loader.ts"() {
+    "use strict";
+    import_data2 = require("@objectstack/spec/data");
+    import_formula = require("@objectstack/formula");
+    DEFAULT_EXTERNAL_ID_FIELD = "name";
+    _SeedLoaderService = class _SeedLoaderService {
+      constructor(engine, metadata, logger) {
+        this.engine = engine;
+        this.metadata = metadata;
+        this.logger = logger;
+      }
+      // ==========================================================================
+      // Public API
+      // ==========================================================================
+      async load(request) {
+        const startTime = Date.now();
+        const config = request.config;
+        const allErrors = [];
+        const allResults = [];
+        const datasets = this.filterByEnv(request.seeds, config.env);
+        if (datasets.length === 0) {
+          return this.buildEmptyResult(config, Date.now() - startTime);
+        }
+        const objectNames = datasets.map((d) => d.object);
+        const graph = await this.buildDependencyGraph(objectNames);
+        this.logger.info("[SeedLoader] Dependency graph built", {
+          objects: objectNames.length,
+          insertOrder: graph.insertOrder,
+          circularDeps: graph.circularDependencies.length
+        });
+        const orderedDatasets = this.orderDatasets(datasets, graph.insertOrder);
+        const refMap = this.buildReferenceMap(graph);
+        const insertedRecords = /* @__PURE__ */ new Map();
+        const deferredUpdates = [];
+        for (const dataset of orderedDatasets) {
+          const result = await this.loadDataset(
+            dataset,
+            config,
+            refMap,
+            insertedRecords,
+            deferredUpdates,
+            allErrors
+          );
+          allResults.push(result);
+          if (config.haltOnError && result.errored > 0) {
+            this.logger.warn("[SeedLoader] Halting on first error", { object: dataset.object });
+            break;
+          }
+        }
+        if (config.multiPass && deferredUpdates.length > 0 && !config.dryRun) {
+          this.logger.info("[SeedLoader] Pass 2: resolving deferred references", {
+            count: deferredUpdates.length
+          });
+          await this.resolveDeferredUpdates(deferredUpdates, insertedRecords, allResults, allErrors, config.organizationId);
+        }
+        const durationMs = Date.now() - startTime;
+        return this.buildResult(config, graph, allResults, allErrors, durationMs);
+      }
+      async buildDependencyGraph(objectNames) {
+        const nodes = [];
+        const objectSet = new Set(objectNames);
+        for (const objectName of objectNames) {
+          const objDef = await this.metadata.getObject(objectName);
+          const dependsOn = [];
+          const references = [];
+          if (objDef && objDef.fields) {
+            const fields = objDef.fields;
+            for (const [fieldName, fieldDef] of Object.entries(fields)) {
+              if ((fieldDef.type === "lookup" || fieldDef.type === "master_detail") && fieldDef.reference) {
+                const targetObject = fieldDef.reference;
+                if (objectSet.has(targetObject) && !dependsOn.includes(targetObject)) {
+                  dependsOn.push(targetObject);
+                }
+                references.push({
+                  field: fieldName,
+                  targetObject,
+                  targetField: DEFAULT_EXTERNAL_ID_FIELD,
+                  fieldType: fieldDef.type
+                });
+              }
+            }
+          }
+          nodes.push({ object: objectName, dependsOn, references });
+        }
+        const { insertOrder, circularDependencies } = this.topologicalSort(nodes);
+        return { nodes, insertOrder, circularDependencies };
+      }
+      async validate(datasets, config) {
+        const parsedConfig = import_data2.SeedLoaderConfigSchema.parse({ ...config, dryRun: true });
+        return this.load({ seeds: datasets, config: parsedConfig });
+      }
+      // ==========================================================================
+      // Internal: Seed Loading
+      // ==========================================================================
+      async loadDataset(dataset, config, refMap, insertedRecords, deferredUpdates, allErrors) {
+        const objectName = dataset.object;
+        const mode = dataset.mode || config.defaultMode;
+        const externalId = dataset.externalId || "name";
+        let inserted = 0;
+        let updated = 0;
+        let skipped = 0;
+        let errored = 0;
+        let referencesResolved = 0;
+        let referencesDeferred = 0;
+        const errors = [];
+        if (!insertedRecords.has(objectName)) {
+          insertedRecords.set(objectName, /* @__PURE__ */ new Map());
+        }
+        let existingRecords;
+        if ((mode === "upsert" || mode === "update" || mode === "ignore") && !config.dryRun) {
+          existingRecords = await this.loadExistingRecords(
+            objectName,
+            externalId,
+            config.organizationId
+          );
+        }
+        const objectRefs = refMap.get(objectName) || [];
+        const seedNow = /* @__PURE__ */ new Date();
+        const seedIdentity = config.identity;
+        const baseEvalCtx = {
+          now: seedNow,
+          user: seedIdentity?.user,
+          // Fall back to the per-tenant organizationId so `os.org.id` resolves
+          // during per-org replay even without an explicit identity.org.
+          org: seedIdentity?.org ?? (config.organizationId ? { id: config.organizationId } : void 0),
+          env: config.env
+        };
+        for (let i = 0; i < dataset.records.length; i++) {
+          const seedResult = (0, import_formula.resolveSeedRecord)(
+            dataset.records[i],
+            baseEvalCtx
+          );
+          if (!seedResult.ok) {
+            errored++;
+            const error = {
+              sourceObject: objectName,
+              field: "(expression)",
+              targetObject: objectName,
+              targetField: "(expression)",
+              attemptedValue: dataset.records[i],
+              recordIndex: i,
+              message: `Cannot resolve dynamic seed values for ${objectName} record #${i}: ${seedResult.error.message}. Records using cel\`os.user.id\` / cel\`os.org.id\` require a seed identity \u2014 ensure a system/admin user exists before seeding (see SeedLoaderConfig.identity).`
+            };
+            errors.push(error);
+            allErrors.push(error);
+            this.logger.warn(`[SeedLoader] ${error.message}`);
+            continue;
+          }
+          const record = { ...seedResult.value };
+          if (config.organizationId && record["organization_id"] == null) {
+            record["organization_id"] = config.organizationId;
+          }
+          for (const ref of objectRefs) {
+            const fieldValue = record[ref.field];
+            if (fieldValue === void 0 || fieldValue === null) continue;
+            if (typeof fieldValue === "object") {
+              const wrapped = fieldValue.externalId;
+              const hint = wrapped !== void 0 ? ` Pass the natural key directly: ${ref.field}: ${JSON.stringify(wrapped)}.` : ` Pass the target's ${ref.targetField} value as a plain string.`;
+              const error = {
+                sourceObject: objectName,
+                field: ref.field,
+                targetObject: ref.targetObject,
+                targetField: ref.targetField,
+                attemptedValue: fieldValue,
+                recordIndex: i,
+                message: `Invalid reference for ${objectName}.${ref.field}: expected a ${ref.targetObject}.${ref.targetField} natural-key string but got an object.${hint}`
+              };
+              errors.push(error);
+              allErrors.push(error);
+              this.logger.warn(`[SeedLoader] ${error.message}`, { recordIndex: i });
+              record[ref.field] = null;
+              continue;
+            }
+            if (typeof fieldValue !== "string" || this.looksLikeInternalId(fieldValue)) continue;
+            const targetMap = insertedRecords.get(ref.targetObject);
+            const resolvedId = targetMap?.get(String(fieldValue));
+            if (resolvedId) {
+              record[ref.field] = resolvedId;
+              referencesResolved++;
+            } else if (!config.dryRun) {
+              const dbId = await this.resolveFromDatabase(ref.targetObject, ref.targetField, fieldValue, config.organizationId);
+              if (dbId) {
+                record[ref.field] = dbId;
+                referencesResolved++;
+              } else if (config.multiPass) {
+                record[ref.field] = null;
+                deferredUpdates.push({
+                  objectName,
+                  recordExternalId: String(record[externalId] ?? ""),
+                  field: ref.field,
+                  targetObject: ref.targetObject,
+                  targetField: ref.targetField,
+                  attemptedValue: fieldValue,
+                  recordIndex: i
+                });
+                referencesDeferred++;
+              } else {
+                const error = {
+                  sourceObject: objectName,
+                  field: ref.field,
+                  targetObject: ref.targetObject,
+                  targetField: ref.targetField,
+                  attemptedValue: fieldValue,
+                  recordIndex: i,
+                  message: `Cannot resolve reference: ${objectName}.${ref.field} = '${fieldValue}' \u2192 ${ref.targetObject}.${ref.targetField} not found`
+                };
+                errors.push(error);
+                allErrors.push(error);
+              }
+            } else {
+              const targetMap2 = insertedRecords.get(ref.targetObject);
+              if (!targetMap2?.has(String(fieldValue))) {
+                const error = {
+                  sourceObject: objectName,
+                  field: ref.field,
+                  targetObject: ref.targetObject,
+                  targetField: ref.targetField,
+                  attemptedValue: fieldValue,
+                  recordIndex: i,
+                  message: `[dry-run] Reference may not resolve: ${objectName}.${ref.field} = '${fieldValue}' \u2192 ${ref.targetObject}.${ref.targetField}`
+                };
+                errors.push(error);
+                allErrors.push(error);
+              }
+            }
+          }
+          if (!config.dryRun) {
+            try {
+              const result = await this.writeRecord(
+                objectName,
+                record,
+                mode,
+                externalId,
+                existingRecords
+              );
+              if (result.action === "inserted") inserted++;
+              else if (result.action === "updated") updated++;
+              else if (result.action === "skipped") skipped++;
+              const externalIdValue = String(record[externalId] ?? "");
+              const internalId = result.id;
+              if (externalIdValue && internalId) {
+                insertedRecords.get(objectName).set(externalIdValue, String(internalId));
+              }
+            } catch (err) {
+              errored++;
+              const error = {
+                sourceObject: objectName,
+                field: "(write)",
+                targetObject: objectName,
+                targetField: externalId,
+                attemptedValue: record[externalId] ?? null,
+                recordIndex: i,
+                message: `Failed to write ${objectName} record #${i} (${externalId}=${String(record[externalId] ?? "")}): ${err.message}`
+              };
+              errors.push(error);
+              allErrors.push(error);
+              this.logger.warn(`[SeedLoader] ${error.message}`, { recordIndex: i });
+            }
+          } else {
+            const externalIdValue = String(record[externalId] ?? "");
+            if (externalIdValue) {
+              insertedRecords.get(objectName).set(externalIdValue, `dry-run-id-${i}`);
+            }
+            inserted++;
+          }
+        }
+        return {
+          object: objectName,
+          mode,
+          inserted,
+          updated,
+          skipped,
+          errored,
+          total: dataset.records.length,
+          referencesResolved,
+          referencesDeferred,
+          errors
+        };
+      }
+      // ==========================================================================
+      // Internal: Reference Resolution
+      // ==========================================================================
+      async resolveFromDatabase(targetObject, targetField, value, organizationId) {
+        try {
+          const where = { [targetField]: value };
+          if (organizationId) where.organization_id = organizationId;
+          const records = await this.engine.find(targetObject, {
+            where,
+            fields: ["id"],
+            limit: 1,
+            context: { isSystem: true }
+          });
+          if (records && records.length > 0) {
+            return String(records[0].id || records[0]._id);
+          }
+        } catch {
+        }
+        return null;
+      }
+      async resolveDeferredUpdates(deferredUpdates, insertedRecords, allResults, allErrors, organizationId) {
+        for (const deferred of deferredUpdates) {
+          const targetMap = insertedRecords.get(deferred.targetObject);
+          let resolvedId = targetMap?.get(String(deferred.attemptedValue));
+          if (!resolvedId) {
+            resolvedId = await this.resolveFromDatabase(
+              deferred.targetObject,
+              deferred.targetField,
+              deferred.attemptedValue,
+              organizationId
+            ) ?? void 0;
+          }
+          if (resolvedId) {
+            const objectRecordMap = insertedRecords.get(deferred.objectName);
+            const recordId = objectRecordMap?.get(deferred.recordExternalId);
+            if (recordId) {
+              try {
+                await this.engine.update(deferred.objectName, {
+                  id: recordId,
+                  [deferred.field]: resolvedId
+                }, { context: { isSystem: true } });
+                const resultEntry = allResults.find((r) => r.object === deferred.objectName);
+                if (resultEntry) {
+                  resultEntry.referencesResolved++;
+                  resultEntry.referencesDeferred--;
+                }
+              } catch (err) {
+                this.logger.warn("[SeedLoader] Failed to resolve deferred reference", {
+                  object: deferred.objectName,
+                  field: deferred.field,
+                  error: err.message
+                });
+              }
+            }
+          } else {
+            const error = {
+              sourceObject: deferred.objectName,
+              field: deferred.field,
+              targetObject: deferred.targetObject,
+              targetField: deferred.targetField,
+              attemptedValue: deferred.attemptedValue,
+              recordIndex: deferred.recordIndex,
+              message: `Deferred reference unresolved after pass 2: ${deferred.objectName}.${deferred.field} = '${deferred.attemptedValue}' \u2192 ${deferred.targetObject}.${deferred.targetField} not found`
+            };
+            const resultEntry = allResults.find((r) => r.object === deferred.objectName);
+            if (resultEntry) {
+              resultEntry.errors.push(error);
+            }
+            allErrors.push(error);
+          }
+        }
+      }
+      async writeRecord(objectName, record, mode, externalId, existingRecords) {
+        const externalIdValue = record[externalId];
+        const existing = existingRecords?.get(String(externalIdValue ?? ""));
+        const opts = _SeedLoaderService.SEED_OPTIONS;
+        switch (mode) {
+          case "insert": {
+            const result = await this.engine.insert(objectName, record, opts);
+            return { action: "inserted", id: this.extractId(result) };
+          }
+          case "update": {
+            if (!existing) {
+              return { action: "skipped" };
+            }
+            const id = this.extractId(existing);
+            await this.engine.update(objectName, { ...record, id }, opts);
+            return { action: "updated", id };
+          }
+          case "upsert": {
+            if (existing) {
+              const id = this.extractId(existing);
+              await this.engine.update(objectName, { ...record, id }, opts);
+              return { action: "updated", id };
+            } else {
+              const result = await this.engine.insert(objectName, record, opts);
+              return { action: "inserted", id: this.extractId(result) };
+            }
+          }
+          case "ignore": {
+            if (existing) {
+              return { action: "skipped", id: this.extractId(existing) };
+            }
+            const result = await this.engine.insert(objectName, record, opts);
+            return { action: "inserted", id: this.extractId(result) };
+          }
+          case "replace": {
+            const result = await this.engine.insert(objectName, record, opts);
+            return { action: "inserted", id: this.extractId(result) };
+          }
+          default: {
+            const result = await this.engine.insert(objectName, record, opts);
+            return { action: "inserted", id: this.extractId(result) };
+          }
+        }
+      }
+      // ==========================================================================
+      // Internal: Dependency Graph
+      // ==========================================================================
+      /**
+       * Kahn's algorithm for topological sort with cycle detection.
+       */
+      topologicalSort(nodes) {
+        const inDegree = /* @__PURE__ */ new Map();
+        const adjacency = /* @__PURE__ */ new Map();
+        const objectSet = new Set(nodes.map((n) => n.object));
+        for (const node of nodes) {
+          inDegree.set(node.object, 0);
+          adjacency.set(node.object, []);
+        }
+        for (const node of nodes) {
+          for (const dep of node.dependsOn) {
+            if (objectSet.has(dep) && dep !== node.object) {
+              adjacency.get(dep).push(node.object);
+              inDegree.set(node.object, (inDegree.get(node.object) || 0) + 1);
+            }
+          }
+        }
+        const queue = [];
+        for (const [obj, degree] of inDegree) {
+          if (degree === 0) queue.push(obj);
+        }
+        const insertOrder = [];
+        while (queue.length > 0) {
+          const current = queue.shift();
+          insertOrder.push(current);
+          for (const neighbor of adjacency.get(current) || []) {
+            const newDegree = (inDegree.get(neighbor) || 0) - 1;
+            inDegree.set(neighbor, newDegree);
+            if (newDegree === 0) {
+              queue.push(neighbor);
+            }
+          }
+        }
+        const circularDependencies = [];
+        const remaining = nodes.filter((n) => !insertOrder.includes(n.object));
+        if (remaining.length > 0) {
+          const cycles = this.findCycles(remaining);
+          circularDependencies.push(...cycles);
+          for (const node of remaining) {
+            if (!insertOrder.includes(node.object)) {
+              insertOrder.push(node.object);
+            }
+          }
+        }
+        return { insertOrder, circularDependencies };
+      }
+      findCycles(nodes) {
+        const cycles = [];
+        const nodeMap = new Map(nodes.map((n) => [n.object, n]));
+        const visited = /* @__PURE__ */ new Set();
+        const inStack = /* @__PURE__ */ new Set();
+        const dfs = (current, path) => {
+          if (inStack.has(current)) {
+            const cycleStart = path.indexOf(current);
+            if (cycleStart !== -1) {
+              cycles.push([...path.slice(cycleStart), current]);
+            }
+            return;
+          }
+          if (visited.has(current)) return;
+          visited.add(current);
+          inStack.add(current);
+          path.push(current);
+          const node = nodeMap.get(current);
+          if (node) {
+            for (const dep of node.dependsOn) {
+              if (nodeMap.has(dep)) {
+                dfs(dep, [...path]);
+              }
+            }
+          }
+          inStack.delete(current);
+        };
+        for (const node of nodes) {
+          if (!visited.has(node.object)) {
+            dfs(node.object, []);
+          }
+        }
+        return cycles;
+      }
+      // ==========================================================================
+      // Internal: Helpers
+      // ==========================================================================
+      filterByEnv(datasets, env) {
+        if (!env) return datasets;
+        return datasets.filter((d) => d.env.includes(env));
+      }
+      orderDatasets(datasets, insertOrder) {
+        const orderMap = new Map(insertOrder.map((name, i) => [name, i]));
+        return [...datasets].sort((a, b) => {
+          const orderA = orderMap.get(a.object) ?? Number.MAX_SAFE_INTEGER;
+          const orderB = orderMap.get(b.object) ?? Number.MAX_SAFE_INTEGER;
+          return orderA - orderB;
+        });
+      }
+      buildReferenceMap(graph) {
+        const map = /* @__PURE__ */ new Map();
+        for (const node of graph.nodes) {
+          if (node.references.length > 0) {
+            map.set(node.object, node.references);
+          }
+        }
+        return map;
+      }
+      async loadExistingRecords(objectName, externalId, organizationId) {
+        const map = /* @__PURE__ */ new Map();
+        try {
+          const findArgs = {
+            fields: ["id", externalId],
+            context: { isSystem: true }
+          };
+          if (organizationId) findArgs.where = { organization_id: organizationId };
+          const records = await this.engine.find(objectName, findArgs);
+          for (const record of records || []) {
+            const key = String(record[externalId] ?? "");
+            if (key) {
+              map.set(key, record);
+            }
+          }
+        } catch {
+        }
+        return map;
+      }
+      looksLikeInternalId(value) {
+        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value)) {
+          return true;
+        }
+        if (/^[0-9a-f]{24}$/i.test(value)) {
+          return true;
+        }
+        return false;
+      }
+      extractId(record) {
+        if (!record) return void 0;
+        return String(record.id || record._id || "");
+      }
+      buildEmptyResult(config, durationMs) {
+        return {
+          success: true,
+          dryRun: config.dryRun,
+          dependencyGraph: { nodes: [], insertOrder: [], circularDependencies: [] },
+          results: [],
+          errors: [],
+          summary: {
+            objectsProcessed: 0,
+            totalRecords: 0,
+            totalInserted: 0,
+            totalUpdated: 0,
+            totalSkipped: 0,
+            totalErrored: 0,
+            totalReferencesResolved: 0,
+            totalReferencesDeferred: 0,
+            circularDependencyCount: 0,
+            durationMs
+          }
+        };
+      }
+      buildResult(config, graph, results, errors, durationMs) {
+        const summary = {
+          objectsProcessed: results.length,
+          totalRecords: results.reduce((sum, r) => sum + r.total, 0),
+          totalInserted: results.reduce((sum, r) => sum + r.inserted, 0),
+          totalUpdated: results.reduce((sum, r) => sum + r.updated, 0),
+          totalSkipped: results.reduce((sum, r) => sum + r.skipped, 0),
+          totalErrored: results.reduce((sum, r) => sum + r.errored, 0),
+          totalReferencesResolved: results.reduce((sum, r) => sum + r.referencesResolved, 0),
+          totalReferencesDeferred: results.reduce((sum, r) => sum + r.referencesDeferred, 0),
+          circularDependencyCount: graph.circularDependencies.length,
+          durationMs
+        };
+        const hasErrors = errors.length > 0 || summary.totalErrored > 0;
+        return {
+          success: !hasErrors,
+          dryRun: config.dryRun,
+          dependencyGraph: graph,
+          results,
+          errors,
+          summary
+        };
+      }
+    };
+    // ==========================================================================
+    // Internal: Write Operations
+    // ==========================================================================
+    /**
+     * Seed writes always run as a privileged system context. This bypasses
+     * RBAC checks (so seeds can target system tables like `sys_*`) and
+     * disables the SecurityPlugin's auto-injection of `organization_id` /
+     * `owner_id` — seeds either declare those fields explicitly per
+     * record, or are intentionally cross-tenant / global.
+     */
+    _SeedLoaderService.SEED_OPTIONS = { context: { isSystem: true } };
+    SeedLoaderService = _SeedLoaderService;
+  }
+});
+
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
@@ -43,6 +649,7 @@ __export(index_exports, {
   SECRET_REF_PREFIX: () => SECRET_REF_PREFIX,
   SchemaRegistry: () => SchemaRegistry,
   ScopedContext: () => ScopedContext,
+  SeedLoaderService: () => SeedLoaderService,
   SysMetadataRepository: () => SysMetadataRepository,
   ValidationError: () => ValidationError,
   applyInMemoryAggregation: () => applyInMemoryAggregation,
@@ -1568,7 +2175,7 @@ var SysMetadataRepository = class {
 
 // src/protocol.ts
 var import_metadata_core2 = require("@objectstack/metadata-core");
-var import_data2 = require("@objectstack/spec/data");
+var import_data3 = require("@objectstack/spec/data");
 var import_shared4 = require("@objectstack/spec/shared");
 var import_ui2 = require("@objectstack/spec/ui");
 var import_system = require("@objectstack/spec/system");
@@ -2937,8 +3544,8 @@ var _ObjectStackProtocolImplementation = class _ObjectStackProtocolImplementatio
         } catch {
         }
       }
-      if ((0, import_data2.isFilterAST)(parsedFilter)) {
-        parsedFilter = (0, import_data2.parseFilterAST)(parsedFilter);
+      if ((0, import_data3.isFilterAST)(parsedFilter)) {
+        parsedFilter = (0, import_data3.parseFilterAST)(parsedFilter);
       }
       options.where = parsedFilter;
     }
@@ -4279,12 +4886,16 @@ var _ObjectStackProtocolImplementation = class _ObjectStackProtocolImplementatio
         item: result.item.body
       });
       await this.ensureObjectStorage(request.type, request.name);
-      return {
+      const response = {
         success: true,
         version: result.version,
         seq: result.seq,
         message: `Published draft \u2014 type=${request.type}, name=${request.name} [seq=${result.seq}]`
       };
+      if (singularType === "seed" && !request._skipSeedApply) {
+        response.seedApplied = await this.applySeedBodies([result.item.body], orgId);
+      }
+      return response;
     } catch (err) {
       if (err instanceof import_metadata_core2.ConflictError) {
         const conflict = new Error(
@@ -4299,6 +4910,58 @@ var _ObjectStackProtocolImplementation = class _ObjectStackProtocolImplementatio
       throw err;
     }
   }
+  /**
+   * Materialize published `seed` bodies into data rows via the SeedLoaderService
+   * (externalId-keyed upsert, multi-pass for cross-seed references). Passing ALL
+   * of a publish's seed bodies in ONE call lets a child seed reference a parent
+   * seed's rows regardless of publish order. Best-effort: any failure is
+   * returned, never thrown — publishing metadata must not be blocked by a data
+   * problem, but the caller surfaces `seedApplied` so the failure is LOUD.
+   */
+  async applySeedBodies(bodies, organizationId) {
+    try {
+      const seeds = bodies.filter(
+        (b) => b && typeof b.object === "string" && Array.isArray(b.records)
+      );
+      if (seeds.length === 0) {
+        return { success: false, inserted: 0, updated: 0, error: "seed apply: no readable seed bodies" };
+      }
+      const { SeedLoaderService: SeedLoaderService2 } = await Promise.resolve().then(() => (init_seed_loader(), seed_loader_exports));
+      const { SeedLoaderRequestSchema } = await import("@objectstack/spec/data");
+      const metadataAdapter = {
+        getObject: async (name) => {
+          const wrapper = await this.getMetaItem({
+            type: "object",
+            name,
+            ...organizationId ? { organizationId } : {}
+          });
+          return wrapper?.item ?? wrapper ?? null;
+        }
+      };
+      const loader = new SeedLoaderService2(
+        this.engine,
+        metadataAdapter,
+        console
+      );
+      const request = SeedLoaderRequestSchema.parse({
+        seeds,
+        config: {
+          defaultMode: "upsert",
+          multiPass: true,
+          ...organizationId ? { organizationId } : {}
+        }
+      });
+      const r = await loader.load(request);
+      return {
+        success: r.success,
+        inserted: r.summary.totalInserted,
+        updated: r.summary.totalUpdated,
+        ...r.errors?.length ? { errors: r.errors } : {}
+      };
+    } catch (e) {
+      return { success: false, inserted: 0, updated: 0, error: e?.message ?? "seed apply failed" };
+    }
+  }
   /**
    * List pending DRAFT metadata (ADR-0033) for the org, optionally narrowed
    * by `packageId` and/or `type`. The list reads of `getMetaItems` only see
@@ -4332,14 +4995,25 @@ var _ObjectStackProtocolImplementation = class _ObjectStackProtocolImplementatio
     const drafts = await repo.listDrafts({ packageId: request.packageId });
     const published = [];
     const failed = [];
-    for (const d of drafts) {
+    const ordered = [
+      ...drafts.filter((d) => d.type !== "seed"),
+      ...drafts.filter((d) => d.type === "seed")
+    ];
+    const seedBodies = [];
+    for (const d of ordered) {
       try {
+        if (d.type === "seed") {
+          const ref = { type: d.type, name: d.name, org: orgId ?? "env" };
+          const draft = await repo.get(ref, { state: "draft" });
+          if (draft?.body) seedBodies.push(draft.body);
+        }
         const r = await this.publishMetaItem({
           type: d.type,
           name: d.name,
           ...request.organizationId ? { organizationId: request.organizationId } : {},
           ...request.actor ? { actor: request.actor } : {},
-          message: `publish app package '${request.packageId}'`
+          message: `publish app package '${request.packageId}'`,
+          _skipSeedApply: true
         });
         published.push({ type: d.type, name: d.name, version: r.version });
       } catch (e) {
@@ -4356,7 +5030,8 @@ var _ObjectStackProtocolImplementation = class _ObjectStackProtocolImplementatio
       publishedCount: published.length,
       failedCount: failed.length,
       published,
-      failed
+      failed,
+      ...seedBodies.length > 0 ? { seedApplied: await this.applySeedBodies(seedBodies, orgId) } : {}
     };
   }
   /**
@@ -5132,11 +5807,11 @@ function collectSecretFields(schema) {
 
 // src/engine.ts
 var import_shared5 = require("@objectstack/spec/shared");
-var import_formula3 = require("@objectstack/formula");
+var import_formula4 = require("@objectstack/formula");
 var import_spec = require("@objectstack/spec");
 
 // src/hook-wrappers.ts
-var import_formula = require("@objectstack/formula");
+var import_formula2 = require("@objectstack/formula");
 
 // src/hook-metrics.ts
 var noopHookMetricsRecorder = {
@@ -5213,10 +5888,10 @@ function wrapDeclarativeHook(meta, handler, opts = {}) {
   if (meta.condition) {
     const expr = typeof meta.condition === "string" ? { dialect: "cel", source: meta.condition } : meta.condition;
     if (expr.source && expr.source.trim()) {
-      const check = import_formula.ExpressionEngine.compile(expr);
+      const check = import_formula2.ExpressionEngine.compile(expr);
       if (check.ok) {
         conditionFn = (record) => {
-          const r = import_formula.ExpressionEngine.evaluate(expr, { record: record ?? {} });
+          const r = import_formula2.ExpressionEngine.evaluate(expr, { record: record ?? {} });
           if (!r.ok) {
             logger.warn("[hook] condition evaluation failed; treating as false", {
               hook: meta.name,
@@ -5688,7 +6363,7 @@ function validateRecord(objectSchema, data, mode) {
 }
 
 // src/validation/rule-validator.ts
-var import_formula2 = require("@objectstack/formula");
+var import_formula3 = require("@objectstack/formula");
 var import_ajv = __toESM(require("ajv"));
 var ajv = new import_ajv.default({ allErrors: true, strict: false });
 var jsonSchemaCache = /* @__PURE__ */ new WeakMap();
@@ -5704,7 +6379,7 @@ function stripReadonlyWhenFields(objectSchema, data, previous, logger) {
   let result = data;
   for (const [name, def] of Object.entries(fields)) {
     if (!def?.readonlyWhen || !(name in data)) continue;
-    const res = import_formula2.ExpressionEngine.evaluate(toExpression(def.readonlyWhen), {
+    const res = import_formula3.ExpressionEngine.evaluate(toExpression(def.readonlyWhen), {
       record: merged,
       previous: previous ?? void 0
     });
@@ -5759,7 +6434,7 @@ function evaluateValidationRules(objectSchema, data, mode, opts = {}) {
     for (const [name, def] of Object.entries(fields)) {
       const pred = def?.requiredWhen ?? def?.conditionalRequired;
       if (!pred) continue;
-      const res = import_formula2.ExpressionEngine.evaluate(toExpression(pred), { record: merged, previous });
+      const res = import_formula3.ExpressionEngine.evaluate(toExpression(pred), { record: merged, previous });
       if (!res.ok) {
         opts.logger?.warn?.(`requiredWhen for '${name}' failed to evaluate \u2014 skipped`);
         continue;
@@ -5830,7 +6505,7 @@ function checkStateMachine(rule, mode, data, previous) {
 }
 function checkPredicate(rule, record, previous, logger) {
   const expr = toExpression(rule.condition);
-  const result = import_formula2.ExpressionEngine.evaluate(expr, {
+  const result = import_formula3.ExpressionEngine.evaluate(expr, {
     record,
     previous: previous ?? void 0
   });
@@ -5928,7 +6603,7 @@ function checkJsonSchema(rule, data, logger) {
   return null;
 }
 function checkConditional(rule, ctx) {
-  const result = import_formula2.ExpressionEngine.evaluate(toExpression(rule.when), {
+  const result = import_formula3.ExpressionEngine.evaluate(toExpression(rule.when), {
     record: ctx.merged,
     previous: ctx.previous ?? void 0
   });
@@ -6109,7 +6784,7 @@ function planFormulaProjection(schema, requestedFields) {
     if (def?.type === "formula" && def.expression) {
       const expr = typeof def.expression === "string" ? { dialect: "cel", source: def.expression } : def.expression;
       plan.push({ name: f, expression: expr });
-      import_formula3.ExpressionEngine.compile(expr);
+      import_formula4.ExpressionEngine.compile(expr);
     } else if (Array.isArray(requestedFields) && requestedFields.length > 0) {
       projected.add(f);
     }
@@ -6131,7 +6806,7 @@ function applyFormulaPlan(plan, records) {
   for (const rec of records) {
     if (rec == null) continue;
     for (const fp of plan) {
-      const r = import_formula3.ExpressionEngine.evaluate(fp.expression, { record: rec });
+      const r = import_formula4.ExpressionEngine.evaluate(fp.expression, { record: rec });
       rec[fp.name] = r.ok ? r.value : null;
     }
   }
@@ -6556,7 +7231,7 @@ var _ObjectQL = class _ObjectQL {
       if (f.defaultValue == null) continue;
       const dv = f.defaultValue;
       if (typeof dv === "object" && dv !== null && dv.dialect && typeof dv.source === "string") {
-        const result = import_formula3.ExpressionEngine.evaluate(dv, {
+        const result = import_formula4.ExpressionEngine.evaluate(dv, {
           now,
           user: execCtx?.userId ? { id: String(execCtx.userId), role: execCtx?.roles?.[0] } : void 0,
           org: execCtx?.tenantId ? { id: String(execCtx.tenantId) } : void 0,
@@ -9215,6 +9890,9 @@ function convertIntrospectedSchemaToObjects(introspectedSchema, options) {
   }
   return objects;
 }
+
+// src/index.ts
+init_seed_loader();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DEFAULT_EXTENDER_PRIORITY,
@@ -9230,6 +9908,7 @@ function convertIntrospectedSchemaToObjects(introspectedSchema, options) {
   SECRET_REF_PREFIX,
   SchemaRegistry,
   ScopedContext,
+  SeedLoaderService,
   SysMetadataRepository,
   ValidationError,
   applyInMemoryAggregation,