@objectstack/runtime 12.1.0 → 12.2.0

package/dist/index.d.cts

@@ -263,6 +263,24 @@ declare class AppPlugin implements Plugin {
      * bundle-agnostic (it only closes over the engine + logger).
      */
     private installDefaultHookBodyRunner;
+    /**
+     * Install the engine's DEFAULT action body runner (`engine.setDefaultActionRunner`).
+     *
+     * The exact action-path parallel of {@link installDefaultHookBodyRunner}
+     * (#2605 item 1): actions authored at runtime (Studio → `action` metadata →
+     * publish) are registered by ObjectQLPlugin's authored-action re-sync,
+     * which lives in `objectql` and therefore has no sandbox of its own. This
+     * boot point hands it the same QuickJS-sandboxed runner that
+     * `defineStack({ actions })` bundles already execute through, so an
+     * authored `body` becomes a real `executeAction` handler instead of a
+     * silent "Action not found".
+     *
+     * `OS_DISABLE_AUTHORED_ACTIONS=1` opts out for deployments that want
+     * runtime-authored (DB-stored, non-code-reviewed) action bodies to stay
+     * inert; code-shipped actions are unaffected (AppPlugin registers those
+     * itself with its own runner).
+     */
+    private installDefaultActionBodyRunner;
     start: (ctx: PluginContext) => Promise<void>;
     stop: (ctx: PluginContext) => Promise<void>;
     /**

package/dist/index.d.ts

@@ -263,6 +263,24 @@ declare class AppPlugin implements Plugin {
      * bundle-agnostic (it only closes over the engine + logger).
      */
     private installDefaultHookBodyRunner;
+    /**
+     * Install the engine's DEFAULT action body runner (`engine.setDefaultActionRunner`).
+     *
+     * The exact action-path parallel of {@link installDefaultHookBodyRunner}
+     * (#2605 item 1): actions authored at runtime (Studio → `action` metadata →
+     * publish) are registered by ObjectQLPlugin's authored-action re-sync,
+     * which lives in `objectql` and therefore has no sandbox of its own. This
+     * boot point hands it the same QuickJS-sandboxed runner that
+     * `defineStack({ actions })` bundles already execute through, so an
+     * authored `body` becomes a real `executeAction` handler instead of a
+     * silent "Action not found".
+     *
+     * `OS_DISABLE_AUTHORED_ACTIONS=1` opts out for deployments that want
+     * runtime-authored (DB-stored, non-code-reviewed) action bodies to stay
+     * inert; code-shipped actions are unaffected (AppPlugin registers those
+     * itself with its own runner).
+     */
+    private installDefaultActionBodyRunner;
     start: (ctx: PluginContext) => Promise<void>;
     stop: (ctx: PluginContext) => Promise<void>;
     /**

package/dist/index.js

@@ -818,6 +818,7 @@ __export(app_plugin_exports, {
   collectBundleFunctions: () => collectBundleFunctions,
   collectBundleHooks: () => collectBundleHooks
 });
+import { wireAuthoredTranslationSync } from "@objectstack/core";
 import { resolveMultiOrgEnabled } from "@objectstack/types";
 function collectBundleHooks(bundle) {
   const out = [];
@@ -893,6 +894,8 @@ var init_app_plugin = __esm({
         this.empty = false;
         this.init = async (ctx) => {
           this.installDefaultHookBodyRunner(ctx);
+          this.installDefaultActionBodyRunner(ctx);
+          wireAuthoredTranslationSync(ctx);
           if (this.empty) {
             ctx.logger.debug("[AppPlugin] empty env \u2014 no app payload, skipping init", {
               pluginName: this.name
@@ -1455,6 +1458,43 @@ var init_app_plugin = __esm({
         }));
         ctx.logger.info("[AppPlugin] Installed default hook body runner (runtime-authored hooks can execute)");
       }
+      /**
+       * Install the engine's DEFAULT action body runner (`engine.setDefaultActionRunner`).
+       *
+       * The exact action-path parallel of {@link installDefaultHookBodyRunner}
+       * (#2605 item 1): actions authored at runtime (Studio → `action` metadata →
+       * publish) are registered by ObjectQLPlugin's authored-action re-sync,
+       * which lives in `objectql` and therefore has no sandbox of its own. This
+       * boot point hands it the same QuickJS-sandboxed runner that
+       * `defineStack({ actions })` bundles already execute through, so an
+       * authored `body` becomes a real `executeAction` handler instead of a
+       * silent "Action not found".
+       *
+       * `OS_DISABLE_AUTHORED_ACTIONS=1` opts out for deployments that want
+       * runtime-authored (DB-stored, non-code-reviewed) action bodies to stay
+       * inert; code-shipped actions are unaffected (AppPlugin registers those
+       * itself with its own runner).
+       */
+      installDefaultActionBodyRunner(ctx) {
+        if (process.env.OS_DISABLE_AUTHORED_ACTIONS === "1") {
+          ctx.logger.info("[AppPlugin] OS_DISABLE_AUTHORED_ACTIONS=1 \u2014 runtime-authored action bodies will not execute");
+          return;
+        }
+        let ql;
+        try {
+          ql = ctx.getService("objectql");
+        } catch {
+          return;
+        }
+        if (!ql || typeof ql.setDefaultActionRunner !== "function") return;
+        if (ql._defaultActionRunner) return;
+        ql.setDefaultActionRunner(actionBodyRunnerFactory(new QuickJSScriptRunner(), {
+          ql,
+          logger: ctx.logger,
+          appId: "runtime-authored"
+        }));
+        ctx.logger.info("[AppPlugin] Installed default action body runner (runtime-authored actions can execute)");
+      }
       /**
        * Emit a kernel hook so the control-plane `AppCatalogService` can
        * upsert / delete the corresponding `sys_app` row. Silently no-ops
@@ -4605,6 +4645,9 @@ var _HttpDispatcher = class _HttpDispatcher {
     } catch {
     }
     if (!aiService) {
+      if (method === "GET" && subPath === "/ai/agents") {
+        return { handled: true, response: { status: 200, body: { agents: [] } } };
+      }
       return {
         handled: true,
         response: {