@objectstack/runtime 15.0.0 → 15.1.0

package/dist/index.cjs

@@ -913,11 +913,12 @@ function collectBundleFunctions(bundle) {
   merge(bundle?.manifest?.functions);
   return out;
 }
-var import_core2, import_types, AppPlugin;
+var import_core2, import_metadata_core, import_types, AppPlugin;
 var init_app_plugin = __esm({
   "src/app-plugin.ts"() {
     "use strict";
     import_core2 = require("@objectstack/core");
+    import_metadata_core = require("@objectstack/metadata-core");
     import_types = require("@objectstack/types");
     init_seed_loader();
     init_package_state_store();
@@ -940,6 +941,7 @@ var init_app_plugin = __esm({
           }
           const sys = this.bundle.manifest || this.bundle;
           const appId = sys.id || sys.name;
+          (0, import_metadata_core.assertProtocolCompat)(sys, void 0, (m) => ctx.logger.warn(`[AppPlugin] ${m}`));
           ctx.logger.info("Registering App Service", {
             appId,
             pluginName: this.name,
@@ -1387,6 +1389,18 @@ var init_app_plugin = __esm({
               const budget = new Promise((resolve) => {
                 timer = setTimeout(() => resolve("budget"), seedBudgetMs);
               });
+              const emitSeedSettled = (overBudget) => {
+                const trigger = ctx.trigger;
+                if (typeof trigger !== "function") return;
+                try {
+                  const p = trigger.call(ctx, "app:seeded", { appId, overBudget });
+                  if (p && typeof p.catch === "function") {
+                    p.catch((err) => ctx.logger.debug("[Seeder] app:seeded trigger failed", { appId, error: err?.message ?? String(err) }));
+                  }
+                } catch (err) {
+                  ctx.logger.debug("[Seeder] app:seeded trigger failed", { appId, error: err?.message ?? String(err) });
+                }
+              };
               const winner = await Promise.race([seedPromise.then(() => "done"), budget]);
               if (timer) clearTimeout(timer);
               if (winner === "budget") {
@@ -1395,7 +1409,9 @@ var init_app_plugin = __esm({
                 );
                 seedPromise.catch((err) => {
                   ctx.logger.warn("[Seeder] Background seed failed after budget", { appId, error: err?.message ?? String(err) });
-                });
+                }).then(() => emitSeedSettled(true));
+              } else {
+                emitSeedSettled(false);
               }
             }
           }
@@ -2165,6 +2181,7 @@ function safeGet(ctx, name) {
 var import_core5 = require("@objectstack/core");
 var import_types3 = require("@objectstack/types");
 var import_system = require("@objectstack/spec/system");
+var import_api = require("@objectstack/spec/api");
 var import_ai2 = require("@objectstack/spec/ai");
 var import_shared2 = require("@objectstack/spec/shared");
 init_package_state_store();
@@ -2177,6 +2194,9 @@ var ACTION_TO_API_METHOD = {
   delete: "delete",
   query: "list",
   find: "list",
+  // Aggregation is a list-class read: an object whose whitelist excludes
+  // `list` must not leak row statistics through GROUP BY either.
+  aggregate: "list",
   batch: "bulk"
 };
 function checkApiExposure(def, action) {
@@ -2278,6 +2298,7 @@ async function resolveExecutionContext(opts) {
   if (authz.email) ctx.email = authz.email;
   if (authz.accessToken) ctx.accessToken = authz.accessToken;
   if (authz.tabPermissions) ctx.tabPermissions = authz.tabPermissions;
+  if (authz.posture) ctx.posture = authz.posture;
   ctx.org_user_ids = authz.org_user_ids;
   if (oauthPrincipal && ctx.userId === oauthPrincipal.userId) {
     ctx.oauthScopes = oauthPrincipal.scopes;
@@ -2517,6 +2538,26 @@ var _HttpDispatcher = class _HttpDispatcher {
       }
       throw { statusCode: 503, message: "Data service not available" };
     }
+    if (action === "aggregate") {
+      if (!Array.isArray(params.aggregations) || params.aggregations.length === 0) {
+        throw { statusCode: 400, message: "aggregate requires at least one aggregation" };
+      }
+      const engine = await this.getObjectQLService(scopeId) ?? await this.resolveService("objectql", scopeId).catch(() => null);
+      if (engine && typeof engine.aggregate === "function") {
+        const rows = await engine.aggregate(
+          params.object,
+          {
+            ...params.where ? { where: params.where } : {},
+            ...params.groupBy ? { groupBy: params.groupBy } : {},
+            ...params.aggregations ? { aggregations: params.aggregations } : {},
+            ...params.timezone ? { timezone: params.timezone } : {},
+            ...executionContext ? { context: executionContext } : {}
+          }
+        );
+        return { object: params.object, rows: rows ?? [] };
+      }
+      throw { statusCode: 503, message: "Data service not available" };
+    }
     if (action === "batch") {
       return { object: params.object, results: [] };
     }
@@ -2800,31 +2841,45 @@ var _HttpDispatcher = class _HttpDispatcher {
         const res = await callData("get", { object, id }, driver, envId, ec);
         return res?.record ?? res ?? null;
       },
+      aggregate: async (object, o) => {
+        const res = await callData(
+          "aggregate",
+          {
+            object,
+            where: o?.where,
+            groupBy: o?.groupBy,
+            aggregations: o?.aggregations,
+            timezone: o?.timezone
+          },
+          void 0,
+          envId,
+          ec
+        );
+        return res?.rows ?? [];
+      },
       create: async (object, data) => await callData("create", { object, data }, driver, envId, ec),
       update: async (object, id, data) => await callData("update", { object, id, data }, driver, envId, ec),
       remove: async (object, id) => await callData("delete", { object, id }, driver, envId, ec),
       // ── Business-action surface (McpActionBridge) ──────────────
       // Resolution + dispatch flow through the framework's own action
-      // mechanism (engine.executeAction / automation flow runner) bound to
-      // THIS request's ExecutionContext — the same permission + RLS path
-      // the REST `/actions/...` route uses. No `@objectstack/service-ai`.
+      // mechanism (engine.executeAction / automation flow runner). All
+      // gating is at INVOKE time — `ai.exposed` (author opt-in, #2849) +
+      // the ADR-0066 D4 capability gate + record load under the caller's
+      // RLS. Script/body handlers then run TRUSTED (see
+      // buildActionEngineFacade); flows honour `runAs` with the caller's
+      // identity forwarded. No `@objectstack/service-ai`.
       listActions: async () => {
         const meta = await getMeta();
-        const objs = await meta?.listObjects?.() ?? [];
         const hasAutomation = Boolean(
           await this.resolveService("automation", envId).catch(() => null)
         );
         const out = [];
-        for (const obj of objs) {
-          const objectName = obj?.name;
+        for (const { action, objectName, obj } of await this.collectActionDeclarations(meta)) {
           if (!objectName || isSystemObjectName(objectName)) continue;
-          const actions = Array.isArray(obj?.actions) ? obj.actions : [];
-          for (const action of actions) {
-            if (!action || typeof action.name !== "string") continue;
-            if (!this.isHeadlessInvokableAction(action, hasAutomation)) continue;
-            if (this.actionPermissionError(action, ec)) continue;
-            out.push(this.summarizeAction(action, obj, objectName));
-          }
+          if (!this.isHeadlessInvokableAction(action, hasAutomation)) continue;
+          if (this.actionAiExposureError(action)) continue;
+          if (this.actionPermissionError(action, ec)) continue;
+          out.push(this.summarizeAction(action, obj, objectName));
         }
         return out;
       },
@@ -2850,6 +2905,23 @@ var _HttpDispatcher = class _HttpDispatcher {
     const on = objectName ? ` on '${objectName}'` : "";
     return `Action '${actionDef?.name ?? "unknown"}'${on} requires capability [${required.join(", ")}] \u2014 caller is missing [${missing.join(", ")}]`;
   }
+  /**
+   * [#2849 / ADR-0011] AI-exposure gate for the MCP action surface. Returns a
+   * human-readable error string unless the action's author explicitly opted it
+   * into the AI surface with `ai.exposed: true`, or `null` when exposed.
+   *
+   * This gate is the REAL agent-facing boundary for actions: script/body
+   * handlers execute as TRUSTED application code (the engine facade carries no
+   * ExecutionContext — see {@link buildActionEngineFacade}), so once invoked, a
+   * body's reads/writes are NOT bounded by the caller's RLS/FLS or an agent's
+   * data ceiling (ADR-0090 D10). The author's explicit opt-in — not a data-layer
+   * backstop — therefore decides what AI may trigger. Fail-closed by default.
+   */
+  actionAiExposureError(actionDef, objectName) {
+    if (actionDef?.ai?.exposed === true) return null;
+    const on = objectName ? ` on '${objectName}'` : "";
+    return `Action '${actionDef?.name ?? "unknown"}'${on} is not exposed to AI \u2014 the app author must opt it in with \`ai: { exposed: true, description: \u2026 }\``;
+  }
   /**
    * Whether an action has a headless invocation path (so MCP can run it).
    * Mirrors the supported-type set of the (now cloud-side) action-tools
@@ -2932,7 +3004,18 @@ var _HttpDispatcher = class _HttpDispatcher {
     }
     return out;
   }
-  /** Slim engine facade matching the ActionContext.engine shape handlers expect. */
+  /**
+   * Slim engine facade matching the ActionContext.engine shape handlers expect.
+   *
+   * ⚠️ TRUSTED (SECURITY-DEFINER-like) BY DESIGN (#2849): these calls carry NO
+   * ExecutionContext, so the data engine's security middleware skips RLS / FLS /
+   * CRUD / tenant scoping entirely. Action bodies are the app author's own code
+   * and legitimately perform cross-object writes the invoking user could not
+   * (convert-lead, cascade-close). The boundary is therefore enforced at INVOKE
+   * time (`ai.exposed` + ADR-0066 D4 capability gate), and every dispatch is
+   * audit-logged. Longer-term direction: an action-level `runAs: 'user'|'system'`
+   * mirroring flows (ADR-0049) — tracked in #2849.
+   */
   buildActionEngineFacade(ql) {
     return {
       async insert(object, data) {
@@ -2960,11 +3043,19 @@ var _HttpDispatcher = class _HttpDispatcher {
   }
   /**
    * Resolve + invoke a business action by its declarative name for the MCP
-   * `run_action` tool. Enforces the ADR-0066 D4 capability gate and RLS as the
-   * caller, loads the subject record under RLS for row-context actions, and
-   * dispatches through the framework's `engine.executeAction` (script/body) or
-   * automation flow runner (flow). Throws on denial / not-found / handler
-   * failure so the tool surfaces a clean tool-error. No service-ai dependency.
+   * `run_action` tool. Enforces the AI-exposure gate (`ai.exposed`, #2849), the
+   * ADR-0066 D4 capability gate, loads the subject record under the caller's
+   * RLS for row-context actions, and dispatches through the framework's
+   * `engine.executeAction` (script/body) or automation flow runner (flow).
+   * Throws on denial / not-found / handler failure so the tool surfaces a
+   * clean tool-error. No service-ai dependency.
+   *
+   * SECURITY MODEL (#2849): all gating happens at INVOKE time. A script/body
+   * handler then runs as trusted code — its engine facade performs
+   * context-less reads/writes that bypass RLS/FLS (SECURITY-DEFINER-like), so
+   * the caller's permissions and an agent's ADR-0090 D10 data ceiling do NOT
+   * bound what the body does internally. Flow actions differ: the flow engine
+   * receives the caller's identity below and honours `runAs` (ADR-0049).
    */
   async invokeBusinessAction(name, input, wiring) {
     const { driver, envId, ec, getMeta, callData } = wiring;
@@ -2987,6 +3078,8 @@ var _HttpDispatcher = class _HttpDispatcher {
         `Action '${name}' (type='${action?.type ?? "script"}') cannot be invoked via MCP`
       );
     }
+    const exposureError = this.actionAiExposureError(action, objectName);
+    if (exposureError) throw new Error(exposureError);
     const gateError = this.actionPermissionError(action, ec, objectName);
     if (gateError) throw new Error(gateError);
     let record = {};
@@ -3005,7 +3098,15 @@ var _HttpDispatcher = class _HttpDispatcher {
         throw new Error(`Action '${name}' is a flow but no automation service is available`);
       }
       const result = await automation.execute(action.target, {
-        triggerData: { record, params, user, action: action.name }
+        record,
+        ...objectName !== "global" ? { object: objectName } : {},
+        userId: ec?.userId,
+        ...Array.isArray(ec?.positions) && ec.positions.length ? { positions: ec.positions } : {},
+        ...Array.isArray(ec?.permissions) && ec.permissions.length ? { permissions: ec.permissions } : {},
+        ...ec?.tenantId ? { tenantId: ec.tenantId } : {},
+        // Record fields seed flows' named `isInput` variables (like the
+        // record-change trigger); explicit action params win on clash.
+        params: { ...record, ...params }
       });
       if (result && typeof result === "object" && "success" in result && result.success === false) {
         throw new Error(`Flow '${action.target}' failed: ${result.error ?? "unknown error"}`);
@@ -3016,6 +3117,9 @@ var _HttpDispatcher = class _HttpDispatcher {
     if (!ql || typeof ql.executeAction !== "function") {
       throw new Error("Data engine not available for action dispatch");
     }
+    console.info(
+      `[action-audit] MCP run_action '${action.name}' on '${objectName}' \u2014 body executes TRUSTED (context-less engine, RLS/FLS-bypassing) for user '${ec?.userId ?? "anonymous"}'` + (ec?.principalKind === "agent" ? ` (AGENT on behalf of '${ec?.onBehalfOf?.userId ?? "unknown"}')` : "")
+    );
     const actionContext = {
       record,
       user,
@@ -3046,24 +3150,82 @@ var _HttpDispatcher = class _HttpDispatcher {
    * and no `objectName` was supplied (so `run_action` can ask for one).
    */
   async resolveActionByName(meta, name, objectName) {
+    const decls = await this.collectActionDeclarations(meta);
     if (objectName) {
-      const def = await meta?.getObject?.(objectName);
-      const action = Array.isArray(def?.actions) ? def.actions.find((a) => a?.name === name) : void 0;
-      return action ? { action, objectName } : null;
-    }
-    const objs = await meta?.listObjects?.() ?? [];
-    const matches = [];
-    for (const obj of objs) {
-      if (!obj?.name) continue;
-      const action = Array.isArray(obj?.actions) ? obj.actions.find((a) => a?.name === name) : void 0;
-      if (action) matches.push({ action, objectName: obj.name });
+      const hit = decls.find((d) => d.objectName === objectName && d.action?.name === name);
+      return hit ? { action: hit.action, objectName } : null;
     }
+    const matches = decls.filter((d) => d.action?.name === name);
     if (matches.length === 0) return null;
     if (matches.length > 1) {
       const where = matches.map((m) => m.objectName).join(", ");
       throw new Error(`Action '${name}' exists on multiple objects (${where}); pass objectName to disambiguate`);
     }
-    return matches[0];
+    return { action: matches[0].action, objectName: matches[0].objectName };
+  }
+  /**
+   * The MCP surface's single declaration source: every action declaration the
+   * bridge may list or invoke, as `{ action, objectName, obj }` rows.
+   *
+   * Two shapes feed it (#3010):
+   *  1. `object.actions` — bundle/artifact objects and authored object rows.
+   *  2. Standalone `action` metadata items — Studio-authored rows that the
+   *     engine executes since #2608 (`resyncAuthoredActions`) but that never
+   *     appear inside any object definition. Their owning object follows the
+   *     same convention as the engine registration key (`objectName` field,
+   *     legacy `object` field, else the `'global'` wildcard).
+   *
+   * On a key clash (`objectName:name`) the object-embedded declaration wins,
+   * mirroring the execution layer's artifact-wins rule — `resyncAuthoredActions`
+   * refuses to clobber an artifact-registered handler, so the embedded
+   * declaration is the one that matches what actually runs. All MCP gating
+   * (`ai.exposed`, ADR-0066 D4, headless-invokability) applies downstream of
+   * this collection, unchanged.
+   */
+  async collectActionDeclarations(meta) {
+    const objs = await meta?.listObjects?.() ?? [];
+    const objByName = /* @__PURE__ */ new Map();
+    for (const obj of objs) {
+      if (typeof obj?.name === "string") objByName.set(obj.name, obj);
+    }
+    const out = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const obj of objs) {
+      const objectName = obj?.name;
+      if (!objectName) continue;
+      for (const action of Array.isArray(obj?.actions) ? obj.actions : []) {
+        if (!action || typeof action.name !== "string") continue;
+        seen.add(`${objectName}:${action.name}`);
+        out.push({ action, objectName, obj });
+      }
+    }
+    let standalone = [];
+    try {
+      standalone = await meta?.loadMany?.("action") ?? [];
+    } catch {
+      standalone = [];
+    }
+    for (const action of standalone) {
+      if (!action || typeof action.name !== "string") continue;
+      const objectName = this.standaloneActionObjectName(action);
+      const key = `${objectName}:${action.name}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push({ action, objectName, obj: objByName.get(objectName) });
+    }
+    return out;
+  }
+  /**
+   * Owning object of a standalone `action` item — must stay in lockstep with
+   * the ObjectQL plugin's `actionObjectKey` (the engine registration key), so
+   * the declaration the MCP surface resolves is the one whose handler
+   * `executeAction` will find: spec `objectName`, bundle-collector `object`,
+   * else the `'global'` wildcard.
+   */
+  standaloneActionObjectName(action) {
+    if (typeof action?.objectName === "string" && action.objectName.length > 0) return action.objectName;
+    if (typeof action?.object === "string" && action.object.length > 0) return action.object;
+    return "global";
   }
   /**
    * Generate a `sys_api_key` and return the raw secret EXACTLY ONCE
@@ -3332,7 +3494,6 @@ var _HttpDispatcher = class _HttpDispatcher {
     const hasAuth = !!authSvc;
     const hasGraphQL = !!(graphqlSvc || this.kernel.graphql);
     const hasSearch = !!searchSvc;
-    const hasWebSockets = !!realtimeSvc;
     const hasFiles = !!filesSvc;
     const hasAnalytics = !!analyticsSvc;
     const hasWorkflow = !!workflowSvc;
@@ -3355,7 +3516,12 @@ var _HttpDispatcher = class _HttpDispatcher {
       analytics: hasAnalytics ? `${prefix}/analytics` : void 0,
       automation: hasAutomation ? `${prefix}/automation` : void 0,
       workflow: hasWorkflow ? `${prefix}/workflow` : void 0,
-      realtime: hasWebSockets ? `${prefix}/realtime` : void 0,
+      // Never advertised (ADR-0076 D12, #2462): service-realtime is an
+      // in-process pub/sub bus — the dispatcher has no /realtime branch
+      // and no plugin mounts one, so an advertised route would 404.
+      // Re-add only when a real HTTP/WS surface exists (and then it must
+      // pass through the shouldDenyAnonymous gate, #2567).
+      realtime: void 0,
       notifications: hasNotification ? `${prefix}/notifications` : void 0,
       ai: hasAi ? `${prefix}/ai` : void 0,
       i18n: hasI18n ? `${prefix}/i18n` : void 0,
@@ -3364,19 +3530,27 @@ var _HttpDispatcher = class _HttpDispatcher {
       // out. The objectui Integrations page reads this.
       mcp: _HttpDispatcher.isMcpEnabled() ? `${prefix}/mcp` : void 0
     };
-    const svcAvailable = (route, provider) => ({
-      enabled: true,
-      status: "available",
-      handlerReady: true,
-      route,
-      provider
-    });
+    const svcAvailable = (route, provider, svc) => {
+      const self = svc ? (0, import_api.readServiceSelfInfo)(svc) : void 0;
+      if (self) {
+        return {
+          enabled: true,
+          status: self.status,
+          handlerReady: self.handlerReady ?? false,
+          route,
+          provider,
+          message: self.message
+        };
+      }
+      return { enabled: true, status: "available", handlerReady: true, route, provider };
+    };
     const svcUnavailable = (name) => ({
       enabled: false,
       status: "unavailable",
       handlerReady: false,
       message: `Install a ${name} plugin to enable`
     });
+    const realtimeSelf = realtimeSvc ? (0, import_api.readServiceSelfInfo)(realtimeSvc) : void 0;
     let locale = { default: "en", supported: ["en"], timezone: "UTC" };
     if (hasI18n && i18nSvc) {
       const defaultLocale = typeof i18nSvc.getDefaultLocale === "function" ? i18nSvc.getDefaultLocale() : "en";
@@ -3397,7 +3571,10 @@ var _HttpDispatcher = class _HttpDispatcher {
       features: {
         graphql: hasGraphQL,
         search: hasSearch,
-        websockets: hasWebSockets,
+        // No WS/HTTP realtime surface is mounted anywhere — a mere
+        // in-process realtime service must not advertise websockets
+        // (ADR-0076 D12, #2462).
+        websockets: false,
         files: hasFiles,
         analytics: hasAnalytics,
         ai: hasAi,
@@ -3410,21 +3587,31 @@ var _HttpDispatcher = class _HttpDispatcher {
         metadata: { enabled: true, status: "degraded", handlerReady: true, route: routes.metadata, provider: "kernel", message: "In-memory registry; DB persistence pending" },
         data: svcAvailable(routes.data, "kernel"),
         // Plugin-provided — only available when a plugin registers the service
-        auth: hasAuth ? svcAvailable(routes.auth) : svcUnavailable("auth"),
-        automation: hasAutomation ? svcAvailable(routes.automation) : svcUnavailable("automation"),
-        analytics: hasAnalytics ? svcAvailable(routes.analytics) : svcUnavailable("analytics"),
-        cache: hasCache ? svcAvailable() : svcUnavailable("cache"),
-        queue: hasQueue ? svcAvailable() : svcUnavailable("queue"),
-        job: hasJob ? svcAvailable() : svcUnavailable("job"),
-        ui: hasUi ? svcAvailable(routes.ui) : svcUnavailable("ui"),
-        workflow: hasWorkflow ? svcAvailable(routes.workflow) : svcUnavailable("workflow"),
-        realtime: hasWebSockets ? svcAvailable(routes.realtime) : svcUnavailable("realtime"),
-        notification: hasNotification ? svcAvailable(routes.notifications) : svcUnavailable("notification"),
-        ai: hasAi ? svcAvailable(routes.ai) : svcUnavailable("ai"),
-        i18n: hasI18n ? svcAvailable(routes.i18n) : svcUnavailable("i18n"),
-        graphql: hasGraphQL ? svcAvailable(routes.graphql) : svcUnavailable("graphql"),
-        "file-storage": hasFiles ? svcAvailable(routes.storage) : svcUnavailable("file-storage"),
-        search: hasSearch ? svcAvailable() : svcUnavailable("search")
+        auth: hasAuth ? svcAvailable(routes.auth, void 0, authSvc) : svcUnavailable("auth"),
+        automation: hasAutomation ? svcAvailable(routes.automation, void 0, automationSvc) : svcUnavailable("automation"),
+        analytics: hasAnalytics ? svcAvailable(routes.analytics, void 0, analyticsSvc) : svcUnavailable("analytics"),
+        cache: hasCache ? svcAvailable(void 0, void 0, cacheSvc) : svcUnavailable("cache"),
+        queue: hasQueue ? svcAvailable(void 0, void 0, queueSvc) : svcUnavailable("queue"),
+        job: hasJob ? svcAvailable(void 0, void 0, jobSvc) : svcUnavailable("job"),
+        ui: hasUi ? svcAvailable(routes.ui, void 0, uiSvc) : svcUnavailable("ui"),
+        workflow: hasWorkflow ? svcAvailable(routes.workflow, void 0, workflowSvc) : svcUnavailable("workflow"),
+        // Honest entry (ADR-0076 D12, #2462): the registered realtime
+        // service is an in-process event bus with NO mounted HTTP/WS
+        // surface — report it degraded with handlerReady:false (or as
+        // the stub it declares itself to be), never as an available
+        // HTTP capability with a route that would 404.
+        realtime: realtimeSvc ? {
+          enabled: true,
+          status: realtimeSelf?.status ?? "degraded",
+          handlerReady: false,
+          message: realtimeSelf?.message ?? "In-process event bus only \u2014 no HTTP/WS realtime surface is mounted"
+        } : svcUnavailable("realtime"),
+        notification: hasNotification ? svcAvailable(routes.notifications, void 0, notificationSvc) : svcUnavailable("notification"),
+        ai: hasAi ? svcAvailable(routes.ai, void 0, aiSvc) : svcUnavailable("ai"),
+        i18n: hasI18n ? svcAvailable(routes.i18n, void 0, i18nSvc) : svcUnavailable("i18n"),
+        graphql: hasGraphQL ? svcAvailable(routes.graphql, void 0, graphqlSvc) : svcUnavailable("graphql"),
+        "file-storage": hasFiles ? svcAvailable(routes.storage, void 0, filesSvc) : svcUnavailable("file-storage"),
+        search: hasSearch ? svcAvailable(void 0, void 0, searchSvc) : svcUnavailable("search")
       },
       locale
     };
@@ -3436,13 +3623,58 @@ var _HttpDispatcher = class _HttpDispatcher {
     if (!body || !body.query) {
       throw { statusCode: 400, message: "Missing query in request body" };
     }
+    let ec = context.executionContext;
+    if (!ec) {
+      ec = await this.resolveRequestExecutionContext(context);
+      if (ec) context.executionContext = ec;
+    }
+    if ((0, import_core5.shouldDenyAnonymous)({ requireAuth: this.requireAuth, userId: ec?.userId, isSystem: ec?.isSystem })) {
+      throw {
+        statusCode: import_core5.ANONYMOUS_DENY_STATUS,
+        message: import_core5.ANONYMOUS_DENY_MESSAGE,
+        code: import_core5.ANONYMOUS_DENY_CODE
+      };
+    }
     if (typeof this.kernel.graphql !== "function") {
       throw { statusCode: 501, message: "GraphQL service not available" };
     }
     return this.kernel.graphql(body.query, body.variables, {
-      request: context.request
+      request: context.request,
+      context: ec
     });
   }
+  /**
+   * Resolve the RBAC/RLS execution context for a request that did NOT flow
+   * through {@link dispatch} (which resolves and caches it on
+   * `context.executionContext`). The dispatcher-plugin's direct `/graphql`
+   * route is the current caller. Mirrors the identity resolution `dispatch()`
+   * performs so an anonymous-deny gate can tell an authenticated caller from
+   * an anonymous one, and so the caller's identity can be THREADED to the
+   * engine (#2992 / ADR-0096 D1) instead of dropped. Best-effort: returns
+   * `undefined` on failure (treated as anonymous, i.e. denied under
+   * `requireAuth`).
+   */
+  async resolveRequestExecutionContext(context) {
+    try {
+      return await resolveExecutionContext({
+        getService: (n) => this.resolveService(n, context.environmentId),
+        getQl: async () => {
+          const k = this.kernel;
+          if (k && typeof k.getServiceAsync === "function") {
+            const ql = await k.getServiceAsync("objectql").catch(() => void 0);
+            if (ql && (ql.registry || typeof ql.find === "function")) return ql;
+          }
+          return this.getObjectQLService(context.environmentId);
+        },
+        request: context.request,
+        // OAuth access tokens are honoured only on the MCP surface
+        // (#2698); GraphQL enforces no per-scope tool gating.
+        acceptOAuthAccessToken: false
+      });
+    } catch {
+      return void 0;
+    }
+  }
   /**
    * Handles Auth requests
    * path: sub-path after /auth/
@@ -3510,12 +3742,12 @@ var _HttpDispatcher = class _HttpDispatcher {
    * Fallback for backward compat: /metadata (all objects), /metadata/:objectName (get object)
    */
   async handleMetadata(path, _context, method, body, query) {
-    if (this.requireAuth) {
+    {
       const ec = _context.executionContext;
-      if (!ec?.userId && !ec?.isSystem) {
+      if ((0, import_core5.shouldDenyAnonymous)({ requireAuth: this.requireAuth, userId: ec?.userId, isSystem: ec?.isSystem })) {
         return {
           handled: true,
-          response: this.error("Authentication is required to access this endpoint.", 401, { code: "unauthenticated" })
+          response: this.error(import_core5.ANONYMOUS_DENY_MESSAGE, import_core5.ANONYMOUS_DENY_STATUS, { code: import_core5.ANONYMOUS_DENY_CODE })
         };
       }
     }
@@ -3897,8 +4129,11 @@ var _HttpDispatcher = class _HttpDispatcher {
       return { handled: true, response: this.error("Security service not available", 503) };
     }
     const ec = context.executionContext;
-    if (!ec?.userId && !ec?.isSystem) {
-      return { handled: true, response: this.error("Authentication required", 401) };
+    if ((0, import_core5.shouldDenyAnonymous)({ requireAuth: true, userId: ec?.userId, isSystem: ec?.isSystem })) {
+      return {
+        handled: true,
+        response: this.error(import_core5.ANONYMOUS_DENY_MESSAGE, import_core5.ANONYMOUS_DENY_STATUS, { code: import_core5.ANONYMOUS_DENY_CODE })
+      };
     }
     const m = method.toUpperCase();
     const parts = path.split("/").filter(Boolean);
@@ -4021,6 +4256,17 @@ var _HttpDispatcher = class _HttpDispatcher {
       }
       if (parts.length === 0 && m === "POST") {
         const manifest = body.manifest || body;
+        const pkgId = typeof manifest?.id === "string" ? manifest.id.trim() : "";
+        if (!pkgId) {
+          return { handled: true, response: this.error("Package id is required", 400) };
+        }
+        const overwrite = body?.overwrite === true || query?.overwrite === "true" || query?.overwrite === true;
+        if (!overwrite && registry.getPackage(pkgId)) {
+          return {
+            handled: true,
+            response: this.error(`Package '${pkgId}' already exists`, 409)
+          };
+        }
         let pkg;
         const protocolSvc = await this.resolveService("protocol").catch(() => null);
         if (protocolSvc && typeof protocolSvc.installPackage === "function") {
@@ -4948,6 +5194,9 @@ var _HttpDispatcher = class _HttpDispatcher {
       engine: engineFacade,
       params: { ...reqParams, recordId, objectName }
     };
+    console.info(
+      `[action-audit] REST action '${objectName}/${actionName}' \u2014 body executes TRUSTED (context-less engine, RLS/FLS-bypassing) for user '${userFromAuth.id}'`
+    );
     try {
       let result;
       try {
@@ -5020,12 +5269,12 @@ var _HttpDispatcher = class _HttpDispatcher {
       if (route.method !== method) continue;
       const params = matchRoute(route.path, fullPath);
       if (params === null) continue;
-      if (this.requireAuth && route.auth !== false) {
+      if (route.auth !== false) {
         const gec = context.executionContext;
-        if (!gec?.userId && !gec?.isSystem) {
+        if ((0, import_core5.shouldDenyAnonymous)({ requireAuth: this.requireAuth, userId: gec?.userId, isSystem: gec?.isSystem })) {
           return {
             handled: true,
-            response: this.error("Authentication is required to access this endpoint.", 401, { code: "unauthenticated" })
+            response: this.error(import_core5.ANONYMOUS_DENY_MESSAGE, import_core5.ANONYMOUS_DENY_STATUS, { code: import_core5.ANONYMOUS_DENY_CODE })
           };
         }
       }
@@ -5955,7 +6204,12 @@ function createDispatcherPlugin(config = {}) {
       if (!server) return;
       const kernel = ctx.getKernel();
       const enforceMembership = config.enforceProjectMembership ?? (config.scoping?.enableProjectScoping ?? false);
-      const requireAuth = config.requireAuth ?? config.scoping?.requireAuth ?? false;
+      const requireAuth = config.requireAuth ?? config.scoping?.requireAuth ?? true;
+      if (!requireAuth) {
+        ctx.logger?.warn?.(
+          "[dispatcher] requireAuth is OFF \u2014 /graphql, /ai and the /meta catch-all serve anonymous callers. This is a deliberate opt-out; set api.requireAuth=true to deny anonymous access (ADR-0056 D2, #2567)."
+        );
+      }
       const dispatcher = new HttpDispatcher(kernel, void 0, {
         enforceProjectMembership: enforceMembership,
         requireAuth
@@ -6142,6 +6396,14 @@ function createDispatcherPlugin(config = {}) {
           errorResponse(err, res);
         }
       });
+      server.patch(`${prefix}/packages/:id`, async (req, res) => {
+        try {
+          const result = await dispatcher.handlePackages(`/${req.params.id}`, "PATCH", req.body, req.query, { request: req });
+          sendResult(result, res);
+        } catch (err) {
+          errorResponse(err, res);
+        }
+      });
       server.patch(`${prefix}/packages/:id/enable`, async (req, res) => {
         try {
           const result = await dispatcher.handlePackages(`/${req.params.id}/enable`, "PATCH", {}, {}, { request: req });