@objectstack/runtime 11.10.0 → 12.0.0

package/dist/index.d.cts

@@ -33,7 +33,7 @@ interface RuntimeConfig {
      * - `ClusterCapabilityConfigInput`: forwarded to `defineCluster()`.
      * - `{ cluster: IClusterService }`: bring your own instance.
      *
-     * See `content/docs/concepts/cluster-semantics.mdx` for driver options.
+     * See `content/docs/kernel/cluster.mdx` for driver options.
      */
     cluster?: false | ClusterCapabilityConfigInput | ClusterServicePluginOptions;
 }
@@ -242,6 +242,27 @@ declare class AppPlugin implements Plugin {
     private readonly empty;
     constructor(bundle: any, projectContext?: AppPluginProjectContext);
     init: (ctx: PluginContext) => Promise<void>;
+    /**
+     * Install the engine's DEFAULT hook body runner (`engine.setDefaultBodyRunner`).
+     *
+     * Hooks authored at runtime (Studio → `protocol.saveMetaItem` → publish)
+     * bind through paths that pass no explicit `bodyRunner` — notably
+     * ObjectQLPlugin's metadata-service bind — so without this default their
+     * L1/L2 `body` is silently dropped by `bindHooksToEngine` and the hook
+     * never runs (#2588). The runtime owns the sandbox bridge (objectql stays
+     * sandbox-free), so this is the boot point that wires it: same
+     * QuickJS-sandboxed, capability-gated runner the `defineStack({ hooks })`
+     * bind already uses.
+     *
+     * `OS_DISABLE_AUTHORED_HOOKS=1` opts out for deployments that want
+     * runtime-authored (DB-stored, non-code-reviewed) hook bodies to stay
+     * inert; code-shipped hooks are unaffected (AppPlugin passes its own
+     * runner explicitly).
+     *
+     * Idempotent: the first AppPlugin to run installs it; the runner is
+     * bundle-agnostic (it only closes over the engine + logger).
+     */
+    private installDefaultHookBodyRunner;
     start: (ctx: PluginContext) => Promise<void>;
     stop: (ctx: PluginContext) => Promise<void>;
     /**
@@ -965,6 +986,17 @@ declare class HttpDispatcher {
     private resolveDefaultProject;
     private success;
     private error;
+    /**
+     * Build an error response from a THROWN service/protocol error, preserving
+     * the error's own HTTP `status` and — critically — any structured `issues`
+     * array (e.g. spec-validation `{ path, message, code }[]` from
+     * `protocol.saveMetaItem`). The plain `error(msg, code)` path collapses a
+     * validation failure to a single message, so the UI can only show a generic
+     * banner; carrying `issues` (and the semantic `code`) in `details` lets it
+     * map each error back to the offending field. Falls back to `fallbackStatus`
+     * and behaves exactly like `error()` for errors that carry neither.
+     */
+    private errorFromThrown;
     /**
      * ADR-0046: `doc` list responses omit `content` by default — manuals
      * are the one metadata payload that grows unbounded, and the list

package/dist/index.d.ts

@@ -33,7 +33,7 @@ interface RuntimeConfig {
      * - `ClusterCapabilityConfigInput`: forwarded to `defineCluster()`.
      * - `{ cluster: IClusterService }`: bring your own instance.
      *
-     * See `content/docs/concepts/cluster-semantics.mdx` for driver options.
+     * See `content/docs/kernel/cluster.mdx` for driver options.
      */
     cluster?: false | ClusterCapabilityConfigInput | ClusterServicePluginOptions;
 }
@@ -242,6 +242,27 @@ declare class AppPlugin implements Plugin {
     private readonly empty;
     constructor(bundle: any, projectContext?: AppPluginProjectContext);
     init: (ctx: PluginContext) => Promise<void>;
+    /**
+     * Install the engine's DEFAULT hook body runner (`engine.setDefaultBodyRunner`).
+     *
+     * Hooks authored at runtime (Studio → `protocol.saveMetaItem` → publish)
+     * bind through paths that pass no explicit `bodyRunner` — notably
+     * ObjectQLPlugin's metadata-service bind — so without this default their
+     * L1/L2 `body` is silently dropped by `bindHooksToEngine` and the hook
+     * never runs (#2588). The runtime owns the sandbox bridge (objectql stays
+     * sandbox-free), so this is the boot point that wires it: same
+     * QuickJS-sandboxed, capability-gated runner the `defineStack({ hooks })`
+     * bind already uses.
+     *
+     * `OS_DISABLE_AUTHORED_HOOKS=1` opts out for deployments that want
+     * runtime-authored (DB-stored, non-code-reviewed) hook bodies to stay
+     * inert; code-shipped hooks are unaffected (AppPlugin passes its own
+     * runner explicitly).
+     *
+     * Idempotent: the first AppPlugin to run installs it; the runner is
+     * bundle-agnostic (it only closes over the engine + logger).
+     */
+    private installDefaultHookBodyRunner;
     start: (ctx: PluginContext) => Promise<void>;
     stop: (ctx: PluginContext) => Promise<void>;
     /**
@@ -965,6 +986,17 @@ declare class HttpDispatcher {
     private resolveDefaultProject;
     private success;
     private error;
+    /**
+     * Build an error response from a THROWN service/protocol error, preserving
+     * the error's own HTTP `status` and — critically — any structured `issues`
+     * array (e.g. spec-validation `{ path, message, code }[]` from
+     * `protocol.saveMetaItem`). The plain `error(msg, code)` path collapses a
+     * validation failure to a single message, so the UI can only show a generic
+     * banner; carrying `issues` (and the semantic `code`) in `details` lets it
+     * map each error back to the offending field. Falls back to `fallbackStatus`
+     * and behaves exactly like `error()` for errors that carry neither.
+     */
+    private errorFromThrown;
     /**
      * ADR-0046: `doc` list responses omit `content` by default — manuals
      * are the one metadata payload that grows unbounded, and the list

package/dist/index.js

@@ -892,6 +892,7 @@ var init_app_plugin = __esm({
         /** When true, init/start become no-ops — env has no app payload. */
         this.empty = false;
         this.init = async (ctx) => {
+          this.installDefaultHookBodyRunner(ctx);
           if (this.empty) {
             ctx.logger.debug("[AppPlugin] empty env \u2014 no app payload, skipping init", {
               pluginName: this.name
@@ -1414,6 +1415,46 @@ var init_app_plugin = __esm({
         this.name = `plugin.app.${appId}`;
         this.version = sys?.version;
       }
+      /**
+       * Install the engine's DEFAULT hook body runner (`engine.setDefaultBodyRunner`).
+       *
+       * Hooks authored at runtime (Studio → `protocol.saveMetaItem` → publish)
+       * bind through paths that pass no explicit `bodyRunner` — notably
+       * ObjectQLPlugin's metadata-service bind — so without this default their
+       * L1/L2 `body` is silently dropped by `bindHooksToEngine` and the hook
+       * never runs (#2588). The runtime owns the sandbox bridge (objectql stays
+       * sandbox-free), so this is the boot point that wires it: same
+       * QuickJS-sandboxed, capability-gated runner the `defineStack({ hooks })`
+       * bind already uses.
+       *
+       * `OS_DISABLE_AUTHORED_HOOKS=1` opts out for deployments that want
+       * runtime-authored (DB-stored, non-code-reviewed) hook bodies to stay
+       * inert; code-shipped hooks are unaffected (AppPlugin passes its own
+       * runner explicitly).
+       *
+       * Idempotent: the first AppPlugin to run installs it; the runner is
+       * bundle-agnostic (it only closes over the engine + logger).
+       */
+      installDefaultHookBodyRunner(ctx) {
+        if (process.env.OS_DISABLE_AUTHORED_HOOKS === "1") {
+          ctx.logger.info("[AppPlugin] OS_DISABLE_AUTHORED_HOOKS=1 \u2014 runtime-authored hook bodies will not execute");
+          return;
+        }
+        let ql;
+        try {
+          ql = ctx.getService("objectql");
+        } catch {
+          return;
+        }
+        if (!ql || typeof ql.setDefaultBodyRunner !== "function") return;
+        if (ql._defaultBodyRunner) return;
+        ql.setDefaultBodyRunner(hookBodyRunnerFactory(new QuickJSScriptRunner(), {
+          ql,
+          logger: ctx.logger,
+          appId: "runtime-authored"
+        }));
+        ctx.logger.info("[AppPlugin] Installed default hook body runner (runtime-authored hooks can execute)");
+      }
       /**
        * Emit a kernel hook so the control-plane `AppCatalogService` can
        * upsert / delete the corresponding `sys_app` row. Silently no-ops
@@ -2167,6 +2208,22 @@ var _HttpDispatcher = class _HttpDispatcher {
       body: { success: false, error: { message, code, details } }
     };
   }
+  /**
+   * Build an error response from a THROWN service/protocol error, preserving
+   * the error's own HTTP `status` and — critically — any structured `issues`
+   * array (e.g. spec-validation `{ path, message, code }[]` from
+   * `protocol.saveMetaItem`). The plain `error(msg, code)` path collapses a
+   * validation failure to a single message, so the UI can only show a generic
+   * banner; carrying `issues` (and the semantic `code`) in `details` lets it
+   * map each error back to the offending field. Falls back to `fallbackStatus`
+   * and behaves exactly like `error()` for errors that carry neither.
+   */
+  errorFromThrown(e, fallbackStatus = 500) {
+    const status = typeof e?.status === "number" ? e.status : typeof e?.statusCode === "number" ? e.statusCode : fallbackStatus;
+    const issues = Array.isArray(e?.issues) ? e.issues : void 0;
+    const details = issues || e?.code ? { ...e?.code ? { code: e.code } : {}, ...issues ? { issues } : {} } : void 0;
+    return this.error(e?.message ?? String(e), status, details);
+  }
   /**
    * ADR-0046: `doc` list responses omit `content` by default — manuals
    * are the one metadata payload that grows unbounded, and the list
@@ -3238,7 +3295,7 @@ var _HttpDispatcher = class _HttpDispatcher {
             const result = await protocol.saveMetaItem({ type, name, item: body, organizationId, ...packageId ? { packageId } : {} });
             return { handled: true, response: this.success(result) };
           } catch (e) {
-            return { handled: true, response: this.error(e.message, 400) };
+            return { handled: true, response: this.errorFromThrown(e, 400) };
           }
         }
         const metaSvc = await this.resolveService("metadata", _context.environmentId);
@@ -3721,9 +3778,20 @@ var _HttpDispatcher = class _HttpDispatcher {
             } catch (e) {
               result.unhideError = e?.message ?? "visibility flip failed";
             }
+            try {
+              const changed = [
+                ...(result?.published ?? []).map((p) => `${p.type}/${p.name}`),
+                ...(result?.unhiddenApps ?? []).map((n) => `app/${n}`)
+              ];
+              if (changed.length > 0 && this.kernel?.context?.trigger) {
+                await this.kernel.context.trigger("metadata:reloaded", { changed });
+              }
+            } catch (e) {
+              result.rebindError = e?.message ?? "metadata:reloaded announce failed";
+            }
             return { handled: true, response: this.success(result) };
           } catch (e) {
-            return { handled: true, response: this.error(e.message, e.statusCode || 500) };
+            return { handled: true, response: this.errorFromThrown(e, 500) };
           }
         }
         return { handled: true, response: this.error("Draft publishing not supported", 501) };
@@ -5696,6 +5764,60 @@ function createDispatcherPlugin(config = {}) {
           errorResponse(err, res);
         }
       });
+      server.post(`${prefix}/packages/:id/duplicate`, async (req, res) => {
+        try {
+          const result = await dispatcher.handlePackages(`/${req.params.id}/duplicate`, "POST", req.body, {}, { request: req });
+          sendResult(result, res);
+        } catch (err) {
+          errorResponse(err, res);
+        }
+      });
+      server.post(`${prefix}/packages/:id/adopt-orphans`, async (req, res) => {
+        try {
+          const result = await dispatcher.handlePackages(`/${req.params.id}/adopt-orphans`, "POST", req.body, {}, { request: req });
+          sendResult(result, res);
+        } catch (err) {
+          errorResponse(err, res);
+        }
+      });
+      server.post(`${prefix}/packages/:id/discard-drafts`, async (req, res) => {
+        try {
+          const result = await dispatcher.handlePackages(`/${req.params.id}/discard-drafts`, "POST", req.body, {}, { request: req });
+          sendResult(result, res);
+        } catch (err) {
+          errorResponse(err, res);
+        }
+      });
+      server.get(`${prefix}/packages/:id/commits`, async (req, res) => {
+        try {
+          const result = await dispatcher.handlePackages(`/${req.params.id}/commits`, "GET", void 0, req.query ?? {}, { request: req });
+          sendResult(result, res);
+        } catch (err) {
+          errorResponse(err, res);
+        }
+      });
+      server.post(`${prefix}/packages/:id/commits/:commitId/revert`, async (req, res) => {
+        try {
+          const result = await dispatcher.handlePackages(
+            `/${req.params.id}/commits/${req.params.commitId}/revert`,
+            "POST",
+            req.body,
+            {},
+            { request: req }
+          );
+          sendResult(result, res);
+        } catch (err) {
+          errorResponse(err, res);
+        }
+      });
+      server.post(`${prefix}/packages/:id/rollback`, async (req, res) => {
+        try {
+          const result = await dispatcher.handlePackages(`/${req.params.id}/rollback`, "POST", req.body, {}, { request: req });
+          sendResult(result, res);
+        } catch (err) {
+          errorResponse(err, res);
+        }
+      });
       server.post(`${prefix}/storage/upload`, async (req, res) => {
         try {
           const result = await dispatcher.handleStorage("upload", "POST", req.body, { request: req });