@objectstack/runtime 12.1.0 → 12.2.0

package/dist/index.cjs

@@ -901,10 +901,11 @@ function collectBundleFunctions(bundle) {
   merge(bundle?.manifest?.functions);
   return out;
 }
-var import_types, AppPlugin;
+var import_core2, import_types, AppPlugin;
 var init_app_plugin = __esm({
   "src/app-plugin.ts"() {
     "use strict";
+    import_core2 = require("@objectstack/core");
     import_types = require("@objectstack/types");
     init_seed_loader();
     init_package_state_store();
@@ -917,6 +918,8 @@ var init_app_plugin = __esm({
         this.empty = false;
         this.init = async (ctx) => {
           this.installDefaultHookBodyRunner(ctx);
+          this.installDefaultActionBodyRunner(ctx);
+          (0, import_core2.wireAuthoredTranslationSync)(ctx);
           if (this.empty) {
             ctx.logger.debug("[AppPlugin] empty env \u2014 no app payload, skipping init", {
               pluginName: this.name
@@ -1479,6 +1482,43 @@ var init_app_plugin = __esm({
         }));
         ctx.logger.info("[AppPlugin] Installed default hook body runner (runtime-authored hooks can execute)");
       }
+      /**
+       * Install the engine's DEFAULT action body runner (`engine.setDefaultActionRunner`).
+       *
+       * The exact action-path parallel of {@link installDefaultHookBodyRunner}
+       * (#2605 item 1): actions authored at runtime (Studio → `action` metadata →
+       * publish) are registered by ObjectQLPlugin's authored-action re-sync,
+       * which lives in `objectql` and therefore has no sandbox of its own. This
+       * boot point hands it the same QuickJS-sandboxed runner that
+       * `defineStack({ actions })` bundles already execute through, so an
+       * authored `body` becomes a real `executeAction` handler instead of a
+       * silent "Action not found".
+       *
+       * `OS_DISABLE_AUTHORED_ACTIONS=1` opts out for deployments that want
+       * runtime-authored (DB-stored, non-code-reviewed) action bodies to stay
+       * inert; code-shipped actions are unaffected (AppPlugin registers those
+       * itself with its own runner).
+       */
+      installDefaultActionBodyRunner(ctx) {
+        if (process.env.OS_DISABLE_AUTHORED_ACTIONS === "1") {
+          ctx.logger.info("[AppPlugin] OS_DISABLE_AUTHORED_ACTIONS=1 \u2014 runtime-authored action bodies will not execute");
+          return;
+        }
+        let ql;
+        try {
+          ql = ctx.getService("objectql");
+        } catch {
+          return;
+        }
+        if (!ql || typeof ql.setDefaultActionRunner !== "function") return;
+        if (ql._defaultActionRunner) return;
+        ql.setDefaultActionRunner(actionBodyRunnerFactory(new QuickJSScriptRunner(), {
+          ql,
+          logger: ctx.logger,
+          appId: "runtime-authored"
+        }));
+        ctx.logger.info("[AppPlugin] Installed default action body runner (runtime-authored actions can execute)");
+      }
       /**
        * Emit a kernel hook so the control-plane `AppCatalogService` can
        * upsert / delete the corresponding `sys_app` row. Silently no-ops
@@ -1793,7 +1833,7 @@ __export(index_exports, {
   NoopMetricsRegistry: () => import_observability.NoopMetricsRegistry,
   OBSERVABILITY_ERRORS_SERVICE: () => import_observability3.OBSERVABILITY_ERRORS_SERVICE,
   OBSERVABILITY_METRICS_SERVICE: () => import_observability3.OBSERVABILITY_METRICS_SERVICE,
-  ObjectKernel: () => import_core5.ObjectKernel,
+  ObjectKernel: () => import_core6.ObjectKernel,
   ObservabilityServicePlugin: () => ObservabilityServicePlugin,
   QuickJSScriptRunner: () => QuickJSScriptRunner,
   RUNTIME_METRICS: () => import_observability.RUNTIME_METRICS,
@@ -1835,7 +1875,7 @@ __export(index_exports, {
   resolveRequestId: () => resolveRequestId
 });
 module.exports = __toCommonJS(index_exports);
-var import_core5 = require("@objectstack/core");
+var import_core6 = require("@objectstack/core");
 
 // src/runtime.ts
 var import_core = require("@objectstack/core");
@@ -2107,7 +2147,7 @@ function safeGet(ctx, name) {
 }
 
 // src/http-dispatcher.ts
-var import_core4 = require("@objectstack/core");
+var import_core5 = require("@objectstack/core");
 var import_system = require("@objectstack/spec/system");
 var import_shared2 = require("@objectstack/spec/shared");
 init_package_state_store();
@@ -2142,7 +2182,7 @@ function checkApiExposure(def, action) {
 }
 
 // src/security/resolve-execution-context.ts
-var import_core2 = require("@objectstack/core");
+var import_core3 = require("@objectstack/core");
 function toHeaders(input) {
   if (!input) return new Headers();
   if (typeof Headers !== "undefined" && input instanceof Headers) return input;
@@ -2171,7 +2211,7 @@ async function resolveExecutionContext(opts) {
       return void 0;
     }
   };
-  const authz = await (0, import_core2.resolveAuthzContext)({ ql, headers, getSession });
+  const authz = await (0, import_core3.resolveAuthzContext)({ ql, headers, getSession });
   const ctx = {
     roles: authz.roles,
     permissions: authz.permissions,
@@ -2186,7 +2226,7 @@ async function resolveExecutionContext(opts) {
   ctx.org_user_ids = authz.org_user_ids;
   if (authz.userId) {
     const settings = await Promise.resolve(opts.getService("settings")).catch(() => void 0);
-    const localization = await (0, import_core2.resolveLocalizationContext)({
+    const localization = await (0, import_core3.resolveLocalizationContext)({
       ql,
       settings,
       tenantId: authz.tenantId,
@@ -2205,7 +2245,7 @@ function isPermissionDeniedError(e) {
 }
 
 // src/security/api-key.ts
-var import_core3 = require("@objectstack/core");
+var import_core4 = require("@objectstack/core");
 
 // src/http-dispatcher.ts
 function randomUUID() {
@@ -2897,7 +2937,7 @@ var _HttpDispatcher = class _HttpDispatcher {
     if (!ql || typeof ql.insert !== "function") {
       return { handled: true, response: this.error("Data service not available", 503) };
     }
-    const generated = (0, import_core3.generateApiKey)();
+    const generated = (0, import_core4.generateApiKey)();
     const row = {
       name,
       key: generated.hash,
@@ -2990,7 +3030,7 @@ var _HttpDispatcher = class _HttpDispatcher {
    */
   async enforceAuthGate(context, cleanPath) {
     try {
-      if ((0, import_core4.isAuthGateAllowlisted)(cleanPath)) return null;
+      if ((0, import_core5.isAuthGateAllowlisted)(cleanPath)) return null;
       const authService = await this.resolveService("auth", context.environmentId);
       if (!authService || typeof authService.isAuthGateActive !== "function" || !authService.isAuthGateActive()) {
         return null;
@@ -3012,7 +3052,7 @@ var _HttpDispatcher = class _HttpDispatcher {
         return null;
       }
       const session = await api.getSession({ headers }).catch(() => void 0);
-      const gate = (0, import_core4.evaluateAuthGate)(session?.user, cleanPath);
+      const gate = (0, import_core5.evaluateAuthGate)(session?.user, cleanPath);
       if (!gate) return null;
       return this.error(gate.message, 403, { code: gate.code });
     } catch {
@@ -3176,7 +3216,7 @@ var _HttpDispatcher = class _HttpDispatcher {
     return {
       name: "ObjectOS",
       version: "1.0.0",
-      environment: (0, import_core4.getEnv)("NODE_ENV", "development"),
+      environment: (0, import_core5.getEnv)("NODE_ENV", "development"),
       routes,
       endpoints: routes,
       // Alias for backward compatibility with some clients
@@ -3681,7 +3721,7 @@ var _HttpDispatcher = class _HttpDispatcher {
       let translations = i18nService.getTranslations(locale);
       if (Object.keys(translations).length === 0) {
         const availableLocales = typeof i18nService.getLocales === "function" ? i18nService.getLocales() : [];
-        const resolved = (0, import_core4.resolveLocale)(locale, availableLocales);
+        const resolved = (0, import_core5.resolveLocale)(locale, availableLocales);
         if (resolved && resolved !== locale) {
           translations = i18nService.getTranslations(resolved);
           return { handled: true, response: this.success({ locale: resolved, requestedLocale: locale, translations }) };
@@ -3694,7 +3734,7 @@ var _HttpDispatcher = class _HttpDispatcher {
       let locale = parts[2] ? decodeURIComponent(parts[2]) : query?.locale;
       if (!locale) return { handled: true, response: this.error("Missing locale parameter", 400) };
       const availableLocales = typeof i18nService.getLocales === "function" ? i18nService.getLocales() : [];
-      const resolved = (0, import_core4.resolveLocale)(locale, availableLocales);
+      const resolved = (0, import_core5.resolveLocale)(locale, availableLocales);
       if (resolved) locale = resolved;
       if (typeof i18nService.getFieldLabels === "function") {
         const labels2 = i18nService.getFieldLabels(objectName, locale);
@@ -4670,6 +4710,9 @@ var _HttpDispatcher = class _HttpDispatcher {
     } catch {
     }
     if (!aiService) {
+      if (method === "GET" && subPath === "/ai/agents") {
+        return { handled: true, response: { status: 200, body: { agents: [] } } };
+      }
       return {
         handled: true,
         response: {