@objectstack/runtime 5.0.0 → 5.2.0

package/dist/index.js

@@ -178,6 +178,10 @@ var init_driver_plugin = __esm({
 });
 
 // src/seed-loader.ts
+var seed_loader_exports = {};
+__export(seed_loader_exports, {
+  SeedLoaderService: () => SeedLoaderService
+});
 import { SeedLoaderConfigSchema } from "@objectstack/spec/data";
 import { resolveSeedRecord } from "@objectstack/formula";
 var DEFAULT_EXTERNAL_ID_FIELD, _SeedLoaderService, SeedLoaderService;
@@ -915,7 +919,7 @@ var init_quickjs_runner = __esm({
           evalRes.value.dispose();
           let pumps = 0;
           while (pumps < 1e3) {
-            await new Promise((resolve) => setImmediate(resolve));
+            await new Promise((resolve2) => setImmediate(resolve2));
             const pending = runtime.executePendingJobs();
             if (pending.error) {
               const err = vm.dump(pending.error);
@@ -9198,7 +9202,7 @@ var require_utils = __commonJS({
       }
     }
     function get(url, options = {}) {
-      return new Promise((resolve, reject) => {
+      return new Promise((resolve2, reject) => {
         let timeoutId;
         const request = http.get(url, options, (response) => {
           response.setEncoding("utf8");
@@ -9206,7 +9210,7 @@ var require_utils = __commonJS({
           response.on("data", (chunk) => body += chunk);
           response.on("end", () => {
             (0, timers_1.clearTimeout)(timeoutId);
-            resolve({ status: response.statusCode, body });
+            resolve2({ status: response.statusCode, body });
           });
         }).on("error", (error2) => {
           (0, timers_1.clearTimeout)(timeoutId);
@@ -9225,13 +9229,13 @@ var require_utils = __commonJS({
       return host && match.test(host.toLowerCase()) ? true : false;
     }
     function promiseWithResolvers() {
-      let resolve;
+      let resolve2;
       let reject;
       const promise = new Promise(function withResolversExecutor(promiseResolve, promiseReject) {
-        resolve = promiseResolve;
+        resolve2 = promiseResolve;
         reject = promiseReject;
       });
-      return { promise, resolve, reject };
+      return { promise, resolve: resolve2, reject };
     }
     function squashError(_error) {
       return;
@@ -9242,8 +9246,8 @@ var require_utils = __commonJS({
     exports.randomBytes = randomBytes;
     async function once(ee, name, options) {
       options?.signal?.throwIfAborted();
-      const { promise, resolve, reject } = promiseWithResolvers();
-      const onEvent = (data) => resolve(data);
+      const { promise, resolve: resolve2, reject } = promiseWithResolvers();
+      const onEvent = (data) => resolve2(data);
       const onError = (error2) => reject(error2);
       const abortListener = addAbortListener(options?.signal, function() {
         reject(this.reason);
@@ -11844,13 +11848,13 @@ var require_mongo_logger = __commonJS({
     function createStdioLogger(stream) {
       return {
         write: (log) => {
-          return new Promise((resolve, reject) => {
+          return new Promise((resolve2, reject) => {
             const logLine = (0, util_1.inspect)(log, { compact: true, breakLength: Infinity });
             stream.write(`${logLine}
 `, "utf-8", (error2) => {
               if (error2)
                 return reject(error2);
-              resolve(true);
+              resolve2(true);
             });
           });
         }
@@ -22625,20 +22629,20 @@ var require_compression = __commonJS({
     ]);
     var ZSTD_COMPRESSION_LEVEL = 3;
     var zlibInflate = (buf) => {
-      return new Promise((resolve, reject) => {
+      return new Promise((resolve2, reject) => {
         zlib.inflate(buf, (error2, result) => {
           if (error2)
             return reject(error2);
-          resolve(result);
+          resolve2(result);
         });
       });
     };
     var zlibDeflate = (buf, options) => {
-      return new Promise((resolve, reject) => {
+      return new Promise((resolve2, reject) => {
         zlib.deflate(buf, options, (error2, result) => {
           if (error2)
             return reject(error2);
-          resolve(result);
+          resolve2(result);
         });
       });
     };
@@ -23359,7 +23363,7 @@ var require_state_machine = __commonJS({
           socket = tls.connect(socketOptions, () => {
             socket.write(message);
           });
-          const { promise: willResolveKmsRequest, reject: rejectOnTlsSocketError, resolve } = (0, utils_1.promiseWithResolvers)();
+          const { promise: willResolveKmsRequest, reject: rejectOnTlsSocketError, resolve: resolve2 } = (0, utils_1.promiseWithResolvers)();
           abortListener = (0, utils_1.addAbortListener)(options?.signal, function() {
             destroySockets();
             rejectOnTlsSocketError(this.reason);
@@ -23371,7 +23375,7 @@ var require_state_machine = __commonJS({
               request.addResponse(buffer.read(bytesNeeded));
             }
             if (request.bytesNeeded <= 0) {
-              resolve();
+              resolve2();
             }
           });
           await (options?.timeoutContext?.csotEnabled() ? Promise.all([
@@ -24952,8 +24956,8 @@ var require_on_data = __commonJS({
           }
           if (finished)
             return closeHandler();
-          const { promise, resolve, reject } = (0, utils_1.promiseWithResolvers)();
-          unconsumedPromises.push({ resolve, reject });
+          const { promise, resolve: resolve2, reject } = (0, utils_1.promiseWithResolvers)();
+          unconsumedPromises.push({ resolve: resolve2, reject });
           return promise;
         },
         return() {
@@ -26120,13 +26124,13 @@ var require_connect = __commonJS({
       socket.setNoDelay(noDelay);
       socket.setTimeout(connectTimeoutMS);
       let cancellationHandler = null;
-      const { promise: connectedSocket, resolve, reject } = (0, utils_1.promiseWithResolvers)();
+      const { promise: connectedSocket, resolve: resolve2, reject } = (0, utils_1.promiseWithResolvers)();
       if (existingSocket) {
-        resolve(socket);
+        resolve2(socket);
       } else {
         const start = performance.now();
         const connectEvent = useTLS ? "secureConnect" : "connect";
-        socket.once(connectEvent, () => resolve(socket)).once("error", (cause) => reject(new error_1.MongoNetworkError(error_1.MongoError.buildErrorMessage(cause), { cause }))).once("timeout", () => {
+        socket.once(connectEvent, () => resolve2(socket)).once("error", (cause) => reject(new error_1.MongoNetworkError(error_1.MongoError.buildErrorMessage(cause), { cause }))).once("timeout", () => {
           reject(new error_1.MongoNetworkTimeoutError(`Socket '${connectEvent}' timed out after ${performance.now() - start | 0}ms (connectTimeoutMS: ${connectTimeoutMS})`));
         }).once("close", () => reject(new error_1.MongoNetworkError(`Socket closed after ${performance.now() - start | 0} during connection establishment`)));
         if (options.cancellationToken != null) {
@@ -26650,10 +26654,10 @@ var require_connection_pool = __commonJS({
       async checkOut(options) {
         const checkoutTime = (0, utils_1.processTimeMS)();
         this.emitAndLog(_ConnectionPool.CONNECTION_CHECK_OUT_STARTED, new connection_pool_events_1.ConnectionCheckOutStartedEvent(this));
-        const { promise, resolve, reject } = (0, utils_1.promiseWithResolvers)();
+        const { promise, resolve: resolve2, reject } = (0, utils_1.promiseWithResolvers)();
         const timeout = options.timeoutContext.connectionCheckoutTimeout;
         const waitQueueMember = {
-          resolve,
+          resolve: resolve2,
           reject,
           cancelled: false,
           checkoutTime
@@ -27888,13 +27892,13 @@ var require_connection_string = __commonJS({
     var LB_REPLICA_SET_ERROR = "loadBalanced option not supported with a replicaSet option";
     var LB_DIRECT_CONNECTION_ERROR = "loadBalanced option not supported when directConnection is provided";
     function retryDNSTimeoutFor(rrtype) {
-      const resolve = rrtype === "SRV" ? (address) => dns.promises.resolve(address, "SRV") : (address) => dns.promises.resolve(address, "TXT");
+      const resolve2 = rrtype === "SRV" ? (address) => dns.promises.resolve(address, "SRV") : (address) => dns.promises.resolve(address, "TXT");
       return async function dnsReqRetryTimeout(lookupAddress) {
         try {
-          return await resolve(lookupAddress);
+          return await resolve2(lookupAddress);
         } catch (firstDNSError) {
           if (firstDNSError.code === dns.TIMEOUT) {
-            return await resolve(lookupAddress);
+            return await resolve2(lookupAddress);
           } else {
             throw firstDNSError;
           }
@@ -31533,13 +31537,13 @@ var require_topology = __commonJS({
           }
           return transaction.server;
         }
-        const { promise: serverPromise, resolve, reject } = (0, utils_1.promiseWithResolvers)();
+        const { promise: serverPromise, resolve: resolve2, reject } = (0, utils_1.promiseWithResolvers)();
         const waitQueueMember = {
           serverSelector,
           topologyDescription: this.description,
           mongoLogger: this.client.mongoLogger,
           transaction,
-          resolve,
+          resolve: resolve2,
           reject,
           cancelled: false,
           startTime: (0, utils_1.processTimeMS)(),
@@ -35158,12 +35162,28 @@ import { ObjectKernel as ObjectKernel4 } from "@objectstack/core";
 
 // src/runtime.ts
 import { ObjectKernel } from "@objectstack/core";
+import {
+  ClusterServicePlugin,
+  MetadataClusterBridgePlugin
+} from "@objectstack/service-cluster";
 var Runtime = class {
   constructor(config = {}) {
     this.kernel = new ObjectKernel(config.kernel);
     if (config.server) {
       this.kernel.registerService("http.server", config.server);
     }
+    if (config.cluster !== false) {
+      const opts = this.normalizeClusterOptions(config.cluster);
+      this.kernel.use(new ClusterServicePlugin(opts));
+      this.kernel.use(new MetadataClusterBridgePlugin());
+    }
+  }
+  normalizeClusterOptions(raw) {
+    if (!raw) return {};
+    if (typeof raw === "object" && ("cluster" in raw || "config" in raw) && !("driver" in raw)) {
+      return raw;
+    }
+    return { config: raw };
   }
   /**
    * Register a plugin
@@ -35465,6 +35485,23 @@ async function resolveExecutionContext(opts) {
       }
     }
   }
+  if (tenantId) {
+    const orgMembers = await tryFind(
+      ql,
+      "sys_member",
+      { organization_id: tenantId },
+      1e3
+    );
+    const orgUserIds = Array.from(
+      new Set(
+        orgMembers.map((m) => m.user_id ?? m.userId).filter((v) => typeof v === "string" && v.length > 0)
+      )
+    );
+    if (!orgUserIds.includes(userId)) orgUserIds.push(userId);
+    ctx.org_user_ids = orgUserIds;
+  } else {
+    ctx.org_user_ids = [userId];
+  }
   const upsRows = await tryFind(
     ql,
     "sys_user_permission_set",
@@ -38739,6 +38776,47 @@ function safeReport(reporter, err, ctx) {
   }
 }
 
+// src/observability/observability-service-plugin.ts
+import {
+  OBSERVABILITY_METRICS_SERVICE,
+  OBSERVABILITY_ERRORS_SERVICE
+} from "@objectstack/observability";
+var ObservabilityServicePlugin = class {
+  constructor(options = {}) {
+    this.name = "com.objectstack.observability.service";
+    this.version = "1.0.0";
+    this.type = "standard";
+    this.options = options;
+  }
+  async init(ctx) {
+    const metrics = this.options.metrics ?? new NoopMetricsRegistry();
+    const errors2 = this.options.errors ?? new NoopErrorReporter();
+    ctx.registerService(OBSERVABILITY_METRICS_SERVICE, metrics);
+    ctx.registerService(OBSERVABILITY_ERRORS_SERVICE, errors2);
+    ctx.logger.info(
+      `ObservabilityServicePlugin: registered metrics=${metrics.constructor?.name ?? "unknown"} errors=${errors2.constructor?.name ?? "unknown"}`
+    );
+  }
+};
+function resolveMetrics(ctx, override) {
+  if (override) return override;
+  try {
+    const m = ctx.getService(OBSERVABILITY_METRICS_SERVICE);
+    if (m) return m;
+  } catch {
+  }
+  return new NoopMetricsRegistry();
+}
+function resolveErrorReporter(ctx, override) {
+  if (override) return override;
+  try {
+    const e = ctx.getService(OBSERVABILITY_ERRORS_SERVICE);
+    if (e) return e;
+  } catch {
+  }
+  return new NoopErrorReporter();
+}
+
 // src/dispatcher-plugin.ts
 function mountRouteOnServer(route, server, routePath, securityHeaders) {
   const handler = async (req, res) => {
@@ -40462,7 +40540,39 @@ var ArtifactKernelFactory = class {
           // intentionally do NOT pass crossSubDomainCookies here
           // so cookies stay isolated per project subdomain.
           trustedOrigins: trustedOriginsList.length ? trustedOriginsList : void 0,
-          ...oidcProviders ? { oidcProviders } : {}
+          ...oidcProviders ? { oidcProviders } : {},
+          // Auto-provision a personal organization for every new
+          // user. SecurityPlugin's ObjectQL middleware does this
+          // for direct `ql.insert` calls, but better-auth's
+          // adapter writes through `dataEngine` directly,
+          // bypassing that middleware — so JIT-created SSO users
+          // would otherwise land on the empty "create
+          // organization" screen on first login.
+          databaseHooks: {
+            user: {
+              create: {
+                after: async (user) => {
+                  try {
+                    const ql = kernel.getService("objectql");
+                    if (!ql) return;
+                    const [{ ensureUserHasOrganization, cloneTenantSeedData }] = await Promise.all([
+                      import("@objectstack/plugin-security")
+                    ]);
+                    await ensureUserHasOrganization(ql, user, {
+                      logger: this.logger,
+                      cloneSeedData: cloneTenantSeedData
+                    });
+                  } catch (e) {
+                    this.logger.warn?.("[ArtifactKernelFactory] auto-org provisioning hook failed", {
+                      projectId,
+                      userId: user?.id,
+                      error: e?.message
+                    });
+                  }
+                }
+              }
+            }
+          }
         }));
         if (oidcProviders) {
           this.logger.info?.("[ArtifactKernelFactory] platform SSO wired", {
@@ -40792,17 +40902,6 @@ var AuthProxyPlugin = class {
                 }
               }
               try {
-                try {
-                  const pubCfg = typeof authSvc?.getPublicConfig === "function" ? authSvc.getPublicConfig() : null;
-                  const ssoProviders = Array.isArray(pubCfg?.socialProviders) ? pubCfg.socialProviders : [];
-                  const ssoWired = ssoProviders.some(
-                    (p) => p?.enabled !== false && p?.id === "objectstack-cloud"
-                  );
-                  if (ssoWired) {
-                    return c.json({ hasOwner: true });
-                  }
-                } catch {
-                }
                 const dataEngine = typeof authSvc?.getDataEngine === "function" ? authSvc.getDataEngine() : null;
                 if (!dataEngine || typeof dataEngine.count !== "function") {
                   return c.json({ hasOwner: true });
@@ -40866,6 +40965,114 @@ var AuthProxyPlugin = class {
   }
 };
 
+// src/cloud/cloud-url.ts
+var DEFAULT_CLOUD_URL = "https://cloud.objectos.app";
+function resolveCloudUrl(explicit) {
+  const raw = (explicit ?? process.env.OS_CLOUD_URL ?? "").trim();
+  const lower = raw.toLowerCase();
+  if (lower === "off" || lower === "none" || lower === "local" || lower === "disabled") {
+    return "";
+  }
+  const picked = raw || DEFAULT_CLOUD_URL;
+  return picked.replace(/\/+$/, "");
+}
+
+// src/cloud/marketplace-proxy-plugin.ts
+var MARKETPLACE_PREFIX = "/api/v1/marketplace";
+var MarketplaceProxyPlugin = class _MarketplaceProxyPlugin {
+  constructor(config = {}) {
+    this.name = "com.objectstack.runtime.marketplace-proxy";
+    this.version = "1.0.0";
+    this.init = async (_ctx) => {
+    };
+    this.start = async (ctx) => {
+      ctx.hook("kernel:ready", async () => {
+        let httpServer;
+        try {
+          httpServer = ctx.getService("http-server");
+        } catch {
+          ctx.logger?.warn?.("[MarketplaceProxyPlugin] http-server not available \u2014 marketplace routes not mounted");
+          return;
+        }
+        if (!httpServer || typeof httpServer.getRawApp !== "function") {
+          ctx.logger?.warn?.("[MarketplaceProxyPlugin] http-server missing getRawApp() \u2014 marketplace routes not mounted");
+          return;
+        }
+        const rawApp = httpServer.getRawApp();
+        const cloudUrl = this.cloudUrl;
+        const handler = async (c, next) => {
+          if (!cloudUrl) {
+            return c.json({
+              success: false,
+              error: {
+                code: "marketplace_unavailable",
+                message: "No control-plane URL configured for this runtime (OS_CLOUD_URL)."
+              }
+            }, 503);
+          }
+          try {
+            const incomingUrl = new URL(c.req.url);
+            if (incomingUrl.pathname.startsWith(`${MARKETPLACE_PREFIX}/install-local`)) {
+              return next();
+            }
+            const target = `${cloudUrl}${incomingUrl.pathname}${incomingUrl.search}`;
+            const method = String(c.req.method ?? "GET").toUpperCase();
+            if (method !== "GET" && method !== "HEAD") {
+              return c.json({
+                success: false,
+                error: {
+                  code: "marketplace_method_not_allowed",
+                  message: `Marketplace proxy only forwards GET/HEAD; install via cloud.`
+                }
+              }, 405);
+            }
+            const resp = await fetch(target, {
+              method,
+              headers: {
+                // Strip the inbound Host header — fetch will set
+                // it to the cloud host. Forward only the
+                // identifying headers cloud might log.
+                "Accept": c.req.header("accept") ?? "application/json",
+                "User-Agent": `objectos-marketplace-proxy/${_MarketplaceProxyPlugin.prototype.version ?? "1.0.0"}`
+              }
+            });
+            const headers = new Headers();
+            const passthroughHeaders = ["content-type", "cache-control", "etag", "last-modified"];
+            for (const h of passthroughHeaders) {
+              const v = resp.headers.get(h);
+              if (v) headers.set(h, v);
+            }
+            const body = await resp.arrayBuffer();
+            return new Response(body, { status: resp.status, headers });
+          } catch (err) {
+            const errObj = err instanceof Error ? err : new Error(err?.message ?? String(err));
+            ctx.logger?.error?.("[MarketplaceProxyPlugin] proxy failed", errObj);
+            return c.json({
+              success: false,
+              error: {
+                code: "marketplace_proxy_failed",
+                message: err?.message ?? String(err)
+              }
+            }, 502);
+          }
+        };
+        if (typeof rawApp.all === "function") {
+          rawApp.all(`${MARKETPLACE_PREFIX}/*`, handler);
+        } else {
+          for (const m of ["get", "head"]) {
+            try {
+              rawApp[m]?.(`${MARKETPLACE_PREFIX}/*`, handler);
+            } catch {
+            }
+          }
+        }
+        ctx.logger?.info?.(`[MarketplaceProxyPlugin] mounted at ${MARKETPLACE_PREFIX}/* \u2192 ${cloudUrl || "(unconfigured)"}`);
+      });
+    };
+    this.cloudUrl = resolveCloudUrl(config.controlPlaneUrl);
+  }
+};
+
 // src/cloud/file-artifact-api-client.ts
 import { readFile as readFile2, stat } from "fs/promises";
 import { resolve as resolvePath4 } from "path";
@@ -41092,7 +41299,7 @@ async function createObjectOSStack(config) {
   };
   const enginePlugins = await createHostEnginePlugins();
   return {
-    plugins: [...enginePlugins, new ObjectOSProjectPlugin(merged), new AuthProxyPlugin()],
+    plugins: [...enginePlugins, new ObjectOSProjectPlugin(merged), new AuthProxyPlugin(), new MarketplaceProxyPlugin({ controlPlaneUrl: merged.controlPlaneUrl === "file" ? void 0 : merged.controlPlaneUrl })],
     api: {
       enableProjectScoping: true,
       projectResolution: "auto",
@@ -41106,6 +41313,462 @@ async function createObjectOSStack(config) {
   };
 }
 
+// src/cloud/marketplace-install-local-plugin.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync, readdirSync, unlinkSync, writeFileSync } from "fs";
+import { join, resolve } from "path";
+var ROUTE_BASE = "/api/v1/marketplace/install-local";
+var DEFAULT_DIR = ".objectstack/installed-packages";
+function safeFilename(manifestId) {
+  return manifestId.replace(/[^a-zA-Z0-9._-]/g, "_") + ".json";
+}
+var MarketplaceInstallLocalPlugin = class {
+  constructor(config = {}) {
+    this.name = "com.objectstack.runtime.marketplace-install-local";
+    this.version = "1.0.0";
+    this.init = async (_ctx) => {
+    };
+    this.start = async (ctx) => {
+      ctx.hook("kernel:ready", async () => {
+        await this.rehydrate(ctx);
+        let httpServer;
+        try {
+          httpServer = ctx.getService("http-server");
+        } catch {
+          ctx.logger?.warn?.("[MarketplaceInstallLocal] http-server not available \u2014 install endpoints not mounted");
+          return;
+        }
+        if (!httpServer || typeof httpServer.getRawApp !== "function") {
+          ctx.logger?.warn?.("[MarketplaceInstallLocal] http-server missing getRawApp() \u2014 install endpoints not mounted");
+          return;
+        }
+        const rawApp = httpServer.getRawApp();
+        const postHandler = async (c) => this.handleInstall(c, ctx);
+        const getHandler = async (c) => this.handleList(c);
+        const deleteHandler = async (c) => this.handleUninstall(c, ctx);
+        if (typeof rawApp.post === "function") rawApp.post(ROUTE_BASE, postHandler);
+        if (typeof rawApp.get === "function") rawApp.get(ROUTE_BASE, getHandler);
+        if (typeof rawApp.delete === "function") rawApp.delete(`${ROUTE_BASE}/:manifestId`, deleteHandler);
+        ctx.logger?.info?.(`[MarketplaceInstallLocal] mounted at ${ROUTE_BASE} (storage: ${this.storageDir})`);
+      });
+    };
+    /**
+     * Re-register every cached manifest with the kernel's manifest service.
+     * Safe to call on a kernel that already has the same manifest_id (the
+     * underlying ObjectQL registry overwrites by id, but we still warn so
+     * a developer can spot the dev-time clash between their config.ts and
+     * a marketplace package).
+     */
+    this.rehydrate = async (ctx) => {
+      const entries = this.readAll();
+      if (entries.length === 0) return;
+      let manifestService = null;
+      try {
+        manifestService = ctx.getService("manifest");
+      } catch {
+        ctx.logger?.warn?.("[MarketplaceInstallLocal] no `manifest` service \u2014 rehydrate skipped");
+        return;
+      }
+      for (const entry of entries) {
+        try {
+          manifestService.register(entry.manifest);
+          try {
+            const ql = ctx.getService("objectql");
+            if (ql && typeof ql.syncSchemas === "function") await ql.syncSchemas();
+          } catch {
+          }
+          await this.applySideEffects(ctx, entry.manifest, { seedNow: false });
+          ctx.logger?.info?.(`[MarketplaceInstallLocal] rehydrated ${entry.manifestId}@${entry.version}`);
+        } catch (err) {
+          ctx.logger?.error?.(`[MarketplaceInstallLocal] rehydrate failed for ${entry.manifestId}`, err instanceof Error ? err : new Error(String(err)));
+        }
+      }
+    };
+    this.handleInstall = async (c, ctx) => {
+      if (!this.cloudUrl) {
+        return c.json({ success: false, error: { code: "marketplace_unavailable", message: "OS_CLOUD_URL not configured." } }, 503);
+      }
+      const userId = await this.requireAuthenticatedUser(c, ctx);
+      if (!userId) {
+        return c.json({ success: false, error: { code: "unauthorized", message: "Authentication required to install packages." } }, 401);
+      }
+      let body = {};
+      try {
+        body = await c.req.json();
+      } catch {
+      }
+      const packageId = String(body?.packageId ?? "").trim();
+      const versionId = String(body?.versionId ?? "latest").trim() || "latest";
+      if (!packageId) {
+        return c.json({ success: false, error: { code: "bad_request", message: "packageId is required." } }, 400);
+      }
+      let payload;
+      try {
+        const url = `${this.cloudUrl}/api/v1/marketplace/packages/${encodeURIComponent(packageId)}/versions/${encodeURIComponent(versionId)}/manifest`;
+        const resp = await fetch(url, { headers: { "Accept": "application/json" } });
+        if (!resp.ok) {
+          const text = await resp.text().catch(() => "");
+          return c.json({
+            success: false,
+            error: { code: "cloud_fetch_failed", message: `Cloud returned ${resp.status}: ${text.slice(0, 200)}` }
+          }, resp.status === 404 ? 404 : 502);
+        }
+        payload = await resp.json();
+      } catch (err) {
+        return c.json({
+          success: false,
+          error: { code: "cloud_fetch_failed", message: err?.message ?? String(err) }
+        }, 502);
+      }
+      const data = payload?.data ?? payload;
+      const manifest = data?.manifest;
+      const resolvedVersionId = String(data?.version_id ?? versionId);
+      const version = String(data?.version ?? "unknown");
+      const manifestId = String(manifest?.id ?? manifest?.name ?? "");
+      if (!manifest || !manifestId) {
+        return c.json({ success: false, error: { code: "invalid_manifest", message: "Cloud returned an invalid manifest payload." } }, 502);
+      }
+      const conflict = this.findConflict(ctx, manifestId);
+      if (conflict === "user-code") {
+        return c.json({
+          success: false,
+          error: {
+            code: "manifest_conflict",
+            message: `manifest_id "${manifestId}" is already defined by this runtime's local code. Refusing to overwrite. Uninstall the local definition first.`
+          }
+        }, 409);
+      }
+      const entry = {
+        packageId,
+        versionId: resolvedVersionId,
+        manifestId,
+        version,
+        manifest,
+        installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        installedBy: userId
+      };
+      try {
+        mkdirSync2(this.storageDir, { recursive: true });
+        writeFileSync(join(this.storageDir, safeFilename(manifestId)), JSON.stringify(entry, null, 2), "utf8");
+      } catch (err) {
+        return c.json({
+          success: false,
+          error: { code: "storage_failed", message: `Failed to persist manifest: ${err?.message ?? err}` }
+        }, 500);
+      }
+      try {
+        const manifestService = ctx.getService("manifest");
+        manifestService.register(manifest);
+      } catch (err) {
+        ctx.logger?.warn?.(`[MarketplaceInstallLocal] hot-register failed for ${manifestId} (will load on next restart): ${err?.message ?? err}`);
+      }
+      try {
+        const ql = ctx.getService("objectql");
+        if (ql && typeof ql.syncSchemas === "function") {
+          await ql.syncSchemas();
+          ctx.logger?.info?.(`[MarketplaceInstallLocal] syncSchemas() ran after registering ${manifestId}`);
+        }
+      } catch (err) {
+        ctx.logger?.warn?.(`[MarketplaceInstallLocal] syncSchemas failed for ${manifestId}: ${err?.message ?? err}`);
+      }
+      const seededSummary = await this.applySideEffects(ctx, manifest, { seedNow: true, c });
+      return c.json({
+        success: true,
+        data: {
+          manifestId,
+          version,
+          versionId: resolvedVersionId,
+          installedAt: entry.installedAt,
+          hotLoaded: true,
+          upgradedFrom: conflict === "marketplace" ? "previous-marketplace-version" : null,
+          translationsLoaded: seededSummary.translationsLoaded,
+          seeded: seededSummary.seeded,
+          note: "App is now available in this runtime. Refresh the console to see it in the app switcher."
+        }
+      }, 200);
+    };
+    this.handleList = async (c) => {
+      const entries = this.readAll();
+      return c.json({
+        success: true,
+        data: {
+          items: entries.map((e) => ({
+            packageId: e.packageId,
+            versionId: e.versionId,
+            manifestId: e.manifestId,
+            version: e.version,
+            installedAt: e.installedAt,
+            installedBy: e.installedBy
+          })),
+          total: entries.length,
+          storageDir: this.storageDir
+        }
+      }, 200);
+    };
+    this.handleUninstall = async (c, ctx) => {
+      const userId = await this.requireAuthenticatedUser(c, ctx);
+      if (!userId) {
+        return c.json({ success: false, error: { code: "unauthorized", message: "Authentication required." } }, 401);
+      }
+      const manifestId = String(c.req.param?.("manifestId") ?? c.req.params?.manifestId ?? "").trim();
+      if (!manifestId) {
+        return c.json({ success: false, error: { code: "bad_request", message: "manifestId path param required." } }, 400);
+      }
+      const file = join(this.storageDir, safeFilename(manifestId));
+      if (!existsSync2(file)) {
+        return c.json({ success: false, error: { code: "not_found", message: `No marketplace install for ${manifestId}.` } }, 404);
+      }
+      try {
+        unlinkSync(file);
+      } catch (err) {
+        return c.json({ success: false, error: { code: "storage_failed", message: err?.message ?? String(err) } }, 500);
+      }
+      ctx.logger?.info?.(`[MarketplaceInstallLocal] uninstalled ${manifestId} (cached manifest removed; restart runtime to unload from running kernel)`);
+      return c.json({
+        success: true,
+        data: {
+          manifestId,
+          note: "Cached manifest removed. The app remains loaded in the running kernel until the next restart (the kernel API does not support unregistering apps in-place)."
+        }
+      }, 200);
+    };
+    /**
+     * Detect whether `manifestId` is already known to the kernel and classify
+     * the source so we can refuse vs upgrade gracefully.
+     *
+     *   'none'         — fresh install
+     *   'marketplace'  — previously installed by this plugin (allow upgrade)
+     *   'user-code'    — defined by AppPlugin from objectstack.config.ts
+     *                    (refuse to avoid silently overwriting authored code)
+     */
+    this.findConflict = (ctx, manifestId) => {
+      if (existsSync2(join(this.storageDir, safeFilename(manifestId)))) {
+        return "marketplace";
+      }
+      try {
+        const ql = ctx.getService("objectql");
+        const packages = ql?.registry?.getAllPackages?.() ?? [];
+        const hit = packages.find(
+          (p) => (p?.manifest?.id ?? p?.id ?? p?.manifest?.name) === manifestId
+        );
+        if (hit) return "user-code";
+      } catch {
+      }
+      return "none";
+    };
+    /**
+     * Pull a userId out of the request's better-auth session, if any.
+     * Returns null when there is no signed-in user. v1 does not check
+     * admin role — UI gating + the auth requirement is sufficient for
+     * dev / single-tenant runtimes. Stricter checks can be layered on
+     * via a middleware in cloud-hosted multi-tenant deployments.
+     */
+    /**
+     * Replicate the start-time side-effects that AppPlugin runs for
+     * statically-declared apps but the `manifest` service does NOT:
+     *
+     *   1. Load `manifest.translations` (array of `Record<locale, data>`)
+     *      into the i18n service — auto-creating an in-memory fallback if
+     *      none is registered, matching AppPlugin's behaviour.
+     *
+     *   2. Merge `manifest.data` (an array of seed datasets) into the
+     *      kernel's `seed-datasets` service so SecurityPlugin's per-org
+     *      replay middleware picks them up on every future
+     *      sys_organization insert.
+     *
+     *   3. When `seedNow=true`, also run the seed immediately so the user
+     *      sees demo data without having to create a new org:
+     *        • single-tenant: run SeedLoaderService inline (mirrors
+     *          AppPlugin single-tenant branch)
+     *        • multi-tenant: invoke `seed-replayer` for the caller's
+     *          active org (resolved from the request session)
+     *
+     * Errors are logged but never thrown — install succeeds even if
+     * post-register side-effects partially fail (the manifest itself is
+     * already registered + cached). Returns a small summary for the
+     * response envelope.
+     */
+    this.applySideEffects = async (ctx, manifest, opts) => {
+      const appId = String(manifest?.id ?? "unknown");
+      let translationsLoaded = 0;
+      let seedSummary = { mode: "skipped", reason: "no-datasets" };
+      try {
+        const bundles = [];
+        if (Array.isArray(manifest?.translations)) bundles.push(...manifest.translations);
+        if (Array.isArray(manifest?.i18n)) bundles.push(...manifest.i18n);
+        if (bundles.length > 0) {
+          let i18nService;
+          try {
+            i18nService = ctx.getService("i18n");
+          } catch {
+          }
+          if (!i18nService) {
+            try {
+              const mod = await import("@objectstack/core");
+              const createMemoryI18n = mod.createMemoryI18n;
+              if (typeof createMemoryI18n === "function") {
+                i18nService = createMemoryI18n();
+                ctx.registerService?.("i18n", i18nService);
+                ctx.logger?.info?.(`[MarketplaceInstallLocal] auto-registered in-memory i18n fallback for "${appId}"`);
+              }
+            } catch {
+            }
+          }
+          if (i18nService?.loadTranslations) {
+            for (const bundle of bundles) {
+              for (const [locale, data] of Object.entries(bundle)) {
+                if (data && typeof data === "object") {
+                  try {
+                    i18nService.loadTranslations(locale, data);
+                    translationsLoaded++;
+                  } catch (err) {
+                    ctx.logger?.warn?.(`[MarketplaceInstallLocal] failed to load ${appId} translations for ${locale}: ${err?.message ?? err}`);
+                  }
+                }
+              }
+            }
+            ctx.logger?.info?.(`[MarketplaceInstallLocal] loaded ${translationsLoaded} locale bundle(s) for ${appId}`);
+          }
+        }
+      } catch (err) {
+        ctx.logger?.warn?.(`[MarketplaceInstallLocal] i18n side-effect failed for ${appId}: ${err?.message ?? err}`);
+      }
+      const datasets = Array.isArray(manifest?.data) ? manifest.data.filter((d) => d && d.object && Array.isArray(d.records)) : [];
+      if (datasets.length > 0) {
+        try {
+          const kernel = ctx.kernel;
+          let existing = [];
+          try {
+            const v = kernel?.getService?.("seed-datasets");
+            if (Array.isArray(v)) existing = v;
+          } catch {
+          }
+          const merged = [...existing, ...datasets];
+          if (kernel?.registerService) kernel.registerService("seed-datasets", merged);
+          else ctx.registerService?.("seed-datasets", merged);
+          ctx.logger?.info?.(`[MarketplaceInstallLocal] merged ${datasets.length} seed dataset(s) into kernel (total: ${merged.length})`);
+        } catch (err) {
+          ctx.logger?.warn?.(`[MarketplaceInstallLocal] failed to merge seed-datasets: ${err?.message ?? err}`);
+        }
+      }
+      if (opts.seedNow && datasets.length > 0) {
+        const multiTenant = String(process.env.OS_MULTI_TENANT ?? "true").toLowerCase() !== "false";
+        try {
+          const ql = ctx.getService("objectql");
+          let metadata;
+          try {
+            metadata = ctx.getService("metadata");
+          } catch {
+          }
+          if (!ql || !metadata) {
+            seedSummary = { mode: "skipped", reason: "objectql-or-metadata-missing" };
+          } else {
+            let organizationId;
+            if (multiTenant) {
+              const resolved = await this.resolveActiveOrgId(opts.c, ctx);
+              if (resolved) organizationId = resolved;
+              else {
+                seedSummary = { mode: "skipped", reason: "multi-tenant-no-active-org" };
+                ctx.logger?.warn?.("[MarketplaceInstallLocal] multi-tenant: no active org on request \u2014 data not seeded");
+              }
+            }
+            if (!multiTenant || organizationId) {
+              const [{ SeedLoaderService: SeedLoaderService2 }, { SeedLoaderRequestSchema }] = await Promise.all([
+                Promise.resolve().then(() => (init_seed_loader(), seed_loader_exports)),
+                import("@objectstack/spec/data")
+              ]);
+              const seedLoader = new SeedLoaderService2(ql, metadata, ctx.logger);
+              const request = SeedLoaderRequestSchema.parse({
+                datasets,
+                config: {
+                  defaultMode: "upsert",
+                  multiPass: true,
+                  ...organizationId ? { organizationId } : {}
+                }
+              });
+              const result = await seedLoader.load(request);
+              seedSummary = {
+                mode: "inline",
+                inserted: result.summary.totalInserted,
+                updated: result.summary.totalUpdated,
+                errors: result.errors.length
+              };
+              ctx.logger?.info?.(`[MarketplaceInstallLocal] inline seed for ${appId}${organizationId ? ` (org=${organizationId})` : ""}: inserted=${seedSummary.inserted} updated=${seedSummary.updated} errors=${seedSummary.errors}`);
+            }
+          }
+        } catch (err) {
+          seedSummary = { mode: "skipped", reason: `seed-error: ${err?.message ?? err}` };
+          ctx.logger?.warn?.(`[MarketplaceInstallLocal] seed run failed for ${appId}: ${err?.message ?? err}`);
+        }
+      }
+      return { translationsLoaded, seeded: seedSummary };
+    };
+    /**
+     * Best-effort active-org resolution. Reads the better-auth session
+     * (same path as requireAuthenticatedUser) and returns
+     * `session.activeOrganizationId`, falling back to the user's first
+     * org membership.
+     */
+    this.resolveActiveOrgId = async (c, ctx) => {
+      if (!c?.req?.raw?.headers) return null;
+      try {
+        const authService = ctx.getService("auth");
+        let api = authService?.api;
+        if (!api && typeof authService?.getApi === "function") api = await authService.getApi();
+        if (!api?.getSession) return null;
+        const session = await api.getSession({ headers: c.req.raw.headers });
+        const direct = session?.session?.activeOrganizationId ?? session?.activeOrganizationId ?? null;
+        if (direct) return String(direct);
+        const userId = session?.user?.id;
+        if (!userId) return null;
+        try {
+          const ql = ctx.getService("objectql");
+          if (ql?.find) {
+            const rows = await ql.find("sys_organization_member", { where: { user_id: userId }, limit: 1, context: { isSystem: true } });
+            const row = Array.isArray(rows) ? rows[0] : rows?.items?.[0] ?? null;
+            return row?.organization_id ? String(row.organization_id) : null;
+          }
+        } catch {
+        }
+      } catch {
+      }
+      return null;
+    };
+    this.requireAuthenticatedUser = async (c, ctx) => {
+      try {
+        const authService = ctx.getService("auth");
+        let api = authService?.api;
+        if (!api && typeof authService?.getApi === "function") {
+          api = await authService.getApi();
+        }
+        if (api?.getSession && c?.req?.raw?.headers) {
+          const session = await api.getSession({ headers: c.req.raw.headers });
+          const userId = session?.user?.id ?? null;
+          if (userId) return String(userId);
+        }
+      } catch {
+      }
+      const xUserId = c?.req?.header?.("x-user-id");
+      if (xUserId) return String(xUserId);
+      return null;
+    };
+    this.readAll = () => {
+      if (!existsSync2(this.storageDir)) return [];
+      const out = [];
+      for (const name of readdirSync(this.storageDir)) {
+        if (!name.endsWith(".json")) continue;
+        try {
+          const raw = readFileSync(join(this.storageDir, name), "utf8");
+          out.push(JSON.parse(raw));
+        } catch {
+        }
+      }
+      return out;
+    };
+    this.cloudUrl = resolveCloudUrl(config.controlPlaneUrl);
+    this.storageDir = config.storageDir ? resolve(config.storageDir) : resolve(process.cwd(), DEFAULT_DIR);
+  }
+};
+
 // src/index.ts
 init_platform_sso();
 
@@ -41145,6 +41808,7 @@ export {
   ArtifactEnvironmentRegistry,
   ArtifactKernelFactory,
   AuthProxyPlugin,
+  DEFAULT_CLOUD_URL,
   DEFAULT_RATE_LIMITS,
   DriverPlugin,
   FileArtifactApiClient,
@@ -41153,10 +41817,15 @@ export {
   InMemoryErrorReporter,
   InMemoryMetricsRegistry,
   KernelManager,
+  MarketplaceInstallLocalPlugin,
+  MarketplaceProxyPlugin,
   MiddlewareManager,
   NoopErrorReporter,
   NoopMetricsRegistry,
+  OBSERVABILITY_ERRORS_SERVICE,
+  OBSERVABILITY_METRICS_SERVICE,
   ObjectKernel4 as ObjectKernel,
+  ObservabilityServicePlugin,
   PLATFORM_SSO_PROVIDER_ID,
   QuickJSScriptRunner,
   RUNTIME_METRICS,
@@ -41193,7 +41862,10 @@ export {
   mergeRuntimeModule,
   parseTraceparent,
   readArtifactSource,
+  resolveCloudUrl,
   resolveDefaultArtifactPath,
+  resolveErrorReporter,
+  resolveMetrics,
   resolveRequestId,
   seedPlatformSsoClient
 };