@objectstack/runtime 6.8.1 → 7.0.0

package/dist/index.js

@@ -1271,7 +1271,15 @@ var init_app_plugin = __esm({
     AppPlugin = class {
       constructor(bundle, projectContext) {
         this.type = "app";
+        /** When true, init/start become no-ops — env has no app payload. */
+        this.empty = false;
         this.init = async (ctx) => {
+          if (this.empty) {
+            ctx.logger.debug("[AppPlugin] empty env \u2014 no app payload, skipping init", {
+              pluginName: this.name
+            });
+            return;
+          }
           const sys = this.bundle.manifest || this.bundle;
           const appId = sys.id || sys.name;
           ctx.logger.info("Registering App Service", {
@@ -1286,6 +1294,12 @@ var init_app_plugin = __esm({
           ctx.getService("manifest").register(servicePayload);
         };
         this.start = async (ctx) => {
+          if (this.empty) {
+            ctx.logger.debug("[AppPlugin] empty env \u2014 no app payload, skipping start", {
+              pluginName: this.name
+            });
+            return;
+          }
           const sys = this.bundle.manifest || this.bundle;
           const appId = sys.id || sys.name;
           let ql;
@@ -1445,6 +1459,66 @@ var init_app_plugin = __esm({
           } catch (err) {
             ctx.logger.error("[AppPlugin] Failed to schedule approval-process registration", err, { appId });
           }
+          try {
+            const jobs = Array.isArray(this.bundle.jobs) ? this.bundle.jobs : Array.isArray((this.bundle.manifest || {}).jobs) ? this.bundle.manifest.jobs : [];
+            if (jobs.length > 0) {
+              ctx.hook("kernel:ready", async () => {
+                let svc;
+                try {
+                  svc = ctx.getService("job");
+                } catch {
+                }
+                if (!svc || typeof svc.schedule !== "function") {
+                  ctx.logger.warn("[AppPlugin] job service not registered \u2014 skipping declarative jobs", {
+                    appId,
+                    jobCount: jobs.length
+                  });
+                  return;
+                }
+                const fnMap = collectBundleFunctions(this.bundle);
+                let ok = 0;
+                for (const job of jobs) {
+                  const jobName = job?.name;
+                  if (!jobName) {
+                    ctx.logger.warn("[AppPlugin] skipping job without name", { appId, job });
+                    continue;
+                  }
+                  if (job.enabled === false) {
+                    ctx.logger.debug("[AppPlugin] job disabled \u2014 skipping", { appId, job: jobName });
+                    continue;
+                  }
+                  const handler = fnMap[job.handler];
+                  if (typeof handler !== "function") {
+                    ctx.logger.warn("[AppPlugin] job handler not found in bundle.functions \u2014 skipping", {
+                      appId,
+                      job: jobName,
+                      handler: job.handler
+                    });
+                    continue;
+                  }
+                  try {
+                    await svc.schedule(
+                      jobName,
+                      job.schedule,
+                      async (jobCtx) => {
+                        await handler({ ...jobCtx, jobId: jobName, bundle: this.bundle });
+                      }
+                    );
+                    ok++;
+                  } catch (err) {
+                    ctx.logger.warn("[AppPlugin] Failed to schedule job", {
+                      appId,
+                      job: jobName,
+                      error: err?.message ?? String(err)
+                    });
+                  }
+                }
+                ctx.logger.info("[AppPlugin] Scheduled background jobs", { appId, count: ok });
+              });
+            }
+          } catch (err) {
+            ctx.logger.error("[AppPlugin] Failed to schedule background-job registration", err, { appId });
+          }
           this.emitCatalogEvent(ctx, "app:registered", sys);
           await this.loadTranslations(ctx, appId);
           const seedDatasets = [];
@@ -1517,51 +1591,68 @@ var init_app_plugin = __esm({
             } catch (e) {
               ctx.logger.warn("[Seeder] Failed to register seed-datasets/seed-replayer service", { error: e?.message });
             }
-            const multiTenant = String(process.env.OS_MULTI_TENANT ?? "true").toLowerCase() !== "false";
+            const multiTenant = String(process.env.OS_MULTI_TENANT ?? "false").toLowerCase() !== "false";
             if (multiTenant) {
               ctx.logger.info("[Seeder] multi-tenant mode \u2014 skipping inline seed; per-org replay will run on sys_organization insert");
             } else {
-              try {
-                const metadata = ctx.getService("metadata");
-                if (metadata) {
-                  const seedLoader = new SeedLoaderService(ql, metadata, ctx.logger);
-                  const { SeedLoaderRequestSchema } = await import("@objectstack/spec/data");
-                  const request = SeedLoaderRequestSchema.parse({
-                    datasets: normalizedDatasets,
-                    config: { defaultMode: "upsert", multiPass: true }
-                  });
-                  const result = await seedLoader.load(request);
-                  ctx.logger.info("[Seeder] Seed loading complete", {
-                    inserted: result.summary.totalInserted,
-                    updated: result.summary.totalUpdated,
-                    errors: result.errors.length
-                  });
-                } else {
-                  ctx.logger.debug("[Seeder] No metadata service; using basic insert fallback");
+              const seedBudgetMs = Number(process.env.OS_INLINE_SEED_BUDGET_MS ?? 8e3);
+              const seedPromise = (async () => {
+                try {
+                  const metadata = ctx.getService("metadata");
+                  if (metadata) {
+                    const seedLoader = new SeedLoaderService(ql, metadata, ctx.logger);
+                    const { SeedLoaderRequestSchema } = await import("@objectstack/spec/data");
+                    const request = SeedLoaderRequestSchema.parse({
+                      datasets: normalizedDatasets,
+                      config: { defaultMode: "upsert", multiPass: true }
+                    });
+                    const result = await seedLoader.load(request);
+                    ctx.logger.info("[Seeder] Seed loading complete", {
+                      inserted: result.summary.totalInserted,
+                      updated: result.summary.totalUpdated,
+                      errors: result.errors.length
+                    });
+                  } else {
+                    ctx.logger.debug("[Seeder] No metadata service; using basic insert fallback");
+                    for (const dataset of normalizedDatasets) {
+                      ctx.logger.info(`[Seeder] Seeding ${dataset.records.length} records for ${dataset.object}`);
+                      for (const record of dataset.records) {
+                        try {
+                          await ql.insert(dataset.object, record, { context: { isSystem: true } });
+                        } catch (err) {
+                          ctx.logger.warn(`[Seeder] Failed to insert ${dataset.object} record:`, { error: err.message });
+                        }
+                      }
+                    }
+                    ctx.logger.info("[Seeder] Data seeding complete.");
+                  }
+                } catch (err) {
+                  ctx.logger.warn("[Seeder] SeedLoaderService failed, falling back to basic insert", { error: err.message });
                   for (const dataset of normalizedDatasets) {
-                    ctx.logger.info(`[Seeder] Seeding ${dataset.records.length} records for ${dataset.object}`);
                     for (const record of dataset.records) {
                       try {
                         await ql.insert(dataset.object, record, { context: { isSystem: true } });
-                      } catch (err) {
-                        ctx.logger.warn(`[Seeder] Failed to insert ${dataset.object} record:`, { error: err.message });
+                      } catch (insertErr) {
+                        ctx.logger.warn(`[Seeder] Failed to insert ${dataset.object} record:`, { error: insertErr.message });
                       }
                     }
                   }
-                  ctx.logger.info("[Seeder] Data seeding complete.");
+                  ctx.logger.info("[Seeder] Data seeding complete (fallback).");
                 }
-              } catch (err) {
-                ctx.logger.warn("[Seeder] SeedLoaderService failed, falling back to basic insert", { error: err.message });
-                for (const dataset of normalizedDatasets) {
-                  for (const record of dataset.records) {
-                    try {
-                      await ql.insert(dataset.object, record, { context: { isSystem: true } });
-                    } catch (insertErr) {
-                      ctx.logger.warn(`[Seeder] Failed to insert ${dataset.object} record:`, { error: insertErr.message });
-                    }
-                  }
-                }
-                ctx.logger.info("[Seeder] Data seeding complete (fallback).");
+              })();
+              let timer;
+              const budget = new Promise((resolve2) => {
+                timer = setTimeout(() => resolve2("budget"), seedBudgetMs);
+              });
+              const winner = await Promise.race([seedPromise.then(() => "done"), budget]);
+              if (timer) clearTimeout(timer);
+              if (winner === "budget") {
+                ctx.logger.warn(
+                  `[Seeder] Inline seed exceeded ${seedBudgetMs}ms budget for ${appId}; continuing in background to avoid blocking kernel start.`
+                );
+                seedPromise.catch((err) => {
+                  ctx.logger.warn("[Seeder] Background seed failed after budget", { appId, error: err?.message ?? String(err) });
+                });
               }
             }
           }
@@ -1572,10 +1663,54 @@ var init_app_plugin = __esm({
         };
         this.bundle = bundle;
         this.projectContext = projectContext;
-        const sys = bundle.manifest || bundle;
-        const appId = sys.id || sys.name || "unnamed-app";
+        const sys = bundle?.manifest || bundle;
+        const appId = sys?.id || sys?.name;
+        if (!appId) {
+          const APP_CATEGORY_KEYS = [
+            "objects",
+            "views",
+            "apps",
+            "pages",
+            "dashboards",
+            "reports",
+            "flows",
+            "workflows",
+            "triggers",
+            "agents",
+            "tools",
+            "skills",
+            "actions",
+            "permissions",
+            "roles",
+            "profiles",
+            "translations",
+            "sharingRules",
+            "ragPipelines",
+            "data"
+          ];
+          const hasAppPayload = APP_CATEGORY_KEYS.some((k) => {
+            const v = (bundle && bundle[k]) ?? (sys && sys[k]);
+            return Array.isArray(v) && v.length > 0;
+          });
+          if (!hasAppPayload) {
+            this.empty = true;
+            const envSlug = projectContext?.environmentId ? projectContext.environmentId.slice(0, 8) : "empty";
+            this.name = `plugin.app.empty-${envSlug}`;
+            return;
+          }
+          const bundleKeys = bundle && typeof bundle === "object" ? Object.keys(bundle).slice(0, 20).join(",") : typeof bundle;
+          const sysKeys = sys && typeof sys === "object" ? Object.keys(sys).slice(0, 20).join(",") : typeof sys;
+          const ctxHint = projectContext ? ` projectContext=${JSON.stringify({
+            environmentId: projectContext.environmentId,
+            packageId: projectContext.packageId,
+            source: projectContext.source
+          })}` : "";
+          throw new Error(
+            `[AppPlugin] bundle has app payload but no manifest.id / manifest.name \u2014 cannot register as a plugin. bundleKeys=[${bundleKeys}] sysKeys=[${sysKeys}]${ctxHint}`
+          );
+        }
         this.name = `plugin.app.${appId}`;
-        this.version = sys.version;
+        this.version = sys?.version;
       }
       /**
        * Emit a kernel hook so the control-plane `AppCatalogService` can
@@ -2120,7 +2255,7 @@ function resolveObjectStackHome() {
 var StandaloneStackConfigSchema = z.object({
   databaseUrl: z.string().optional(),
   databaseAuthToken: z.string().optional(),
-  databaseDriver: z.enum(["sqlite", "sqlite-wasm", "turso", "memory", "postgres", "mongodb"]).optional(),
+  databaseDriver: z.enum(["sqlite", "sqlite-wasm", "memory", "postgres", "mongodb"]).optional(),
   environmentId: z.string().optional(),
   artifactPath: z.string().optional(),
   /**
@@ -2138,7 +2273,6 @@ var StandaloneStackConfigSchema = z.object({
 });
 function detectDriverFromUrl(dbUrl) {
   if (/^memory:\/\//i.test(dbUrl)) return "memory";
-  if (/^(libsql|https?):\/\//i.test(dbUrl)) return "turso";
   if (/^(postgres(ql)?|pg):\/\//i.test(dbUrl)) return "postgres";
   if (/^mongodb(\+srv)?:\/\//i.test(dbUrl)) return "mongodb";
   if (/^wasm-sqlite:\/\//i.test(dbUrl)) return "sqlite-wasm";
@@ -2146,7 +2280,7 @@ function detectDriverFromUrl(dbUrl) {
   if (/^file:/i.test(dbUrl)) return "sqlite";
   if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(dbUrl)) return "sqlite";
   throw new Error(
-    `[StandaloneStack] Unsupported database URL scheme: ${dbUrl}. Supported schemes: memory://, libsql://, https://, postgres://, pg://, mongodb://, mongodb+srv://, file:`
+    `[StandaloneStack] Unsupported database URL scheme: ${dbUrl}. Supported schemes: memory://, postgres://, pg://, mongodb://, mongodb+srv://, file:`
   );
 }
 async function createStandaloneStack(config) {
@@ -2160,25 +2294,12 @@ async function createStandaloneStack(config) {
   const artifactPathInput = cfg.artifactPath ?? process.env.OS_ARTIFACT_PATH ?? resolvePath2(cwd, "dist/objectstack.json");
   const artifactPath = isHttpUrl(artifactPathInput) ? artifactPathInput : artifactPathInput.startsWith("/") ? artifactPathInput : resolvePath2(cwd, artifactPathInput);
   const dbUrl = cfg.databaseUrl ?? process.env.OS_DATABASE_URL?.trim() ?? process.env.TURSO_DATABASE_URL?.trim() ?? (process.env.OS_HOME?.trim() ? `file:${resolvePath2(resolveObjectStackHome(), "data/standalone.db")}` : cfg.projectRoot ? `file:${resolvePath2(cfg.projectRoot, ".objectstack/data/standalone.db")}` : `file:${resolvePath2(resolveObjectStackHome(), "data/standalone.db")}`);
-  const dbAuthToken = cfg.databaseAuthToken ?? process.env.OS_DATABASE_AUTH_TOKEN?.trim() ?? process.env.TURSO_AUTH_TOKEN?.trim();
   const explicitDriver = cfg.databaseDriver ?? process.env.OS_DATABASE_DRIVER?.trim();
   const dbDriver = explicitDriver ?? detectDriverFromUrl(dbUrl);
   let driverPlugin;
   if (dbDriver === "memory") {
     const { InMemoryDriver } = await import("@objectstack/driver-memory");
     driverPlugin = new DriverPlugin2(new InMemoryDriver());
-  } else if (dbDriver === "turso") {
-    let TursoDriver;
-    try {
-      ({ TursoDriver } = await import("@objectstack/driver-turso"));
-    } catch (err) {
-      throw new Error(
-        `[StandaloneStack] libsql/turso URL detected ("${dbUrl}") but @objectstack/driver-turso is not installed. Install it with: npm install @objectstack/driver-turso  (or use a file: URL to default to better-sqlite3). (${err?.message ?? err})`
-      );
-    }
-    driverPlugin = new DriverPlugin2(
-      new TursoDriver({ url: dbUrl, authToken: dbAuthToken })
-    );
   } else if (dbDriver === "postgres") {
     const { SqlDriver } = await import("@objectstack/driver-sql");
     driverPlugin = new DriverPlugin2(
@@ -2437,8 +2558,12 @@ async function resolveExecutionContext(opts) {
   if (!userId) {
     try {
       const authService = await opts.getService("auth");
+      let api = authService?.api;
+      if (!api && typeof authService?.getApi === "function") {
+        api = await authService.getApi();
+      }
       const headersInstance = toHeaders(headers);
-      const sessionData = await authService?.api?.getSession?.({ headers: headersInstance });
+      const sessionData = await api?.getSession?.({ headers: headersInstance });
       userId = sessionData?.user?.id ?? sessionData?.session?.userId;
       tenantId = tenantId ?? sessionData?.session?.activeOrganizationId;
       ctx.accessToken = sessionData?.session?.token ?? ctx.accessToken;
@@ -3915,7 +4040,7 @@ var _HttpDispatcher = class _HttpDispatcher {
           return {
             handled: true,
             response: this.error(
-              "No ObjectQL driver is registered. Register at least one DriverPlugin (e.g. InMemoryDriver or TursoDriver).",
+              "No ObjectQL driver is registered. Register at least one DriverPlugin (e.g. InMemoryDriver or SqlDriver).",
               503
             )
           };
@@ -5283,7 +5408,7 @@ var _HttpDispatcher = class _HttpDispatcher {
    * Handle AI service routes (/ai/chat, /ai/models, /ai/conversations, etc.)
    * Resolves the AI service and its built-in route handlers, then dispatches.
    */
-  async handleAI(subPath, method, body, query, _context) {
+  async handleAI(subPath, method, body, query, context) {
     let aiService;
     try {
       aiService = await this.resolveService("ai");
@@ -5327,7 +5452,23 @@ var _HttpDispatcher = class _HttpDispatcher {
       if (route.method !== method) continue;
       const params = matchRoute(route.path, fullPath);
       if (params === null) continue;
-      const result = await route.handler({ body, params, query });
+      const ec = context.executionContext;
+      const user = ec?.userId ? {
+        userId: ec.userId,
+        id: ec.userId,
+        displayName: ec.userDisplayName ?? ec.userName ?? ec.userId,
+        email: ec.userEmail,
+        roles: Array.isArray(ec.roles) ? ec.roles : [],
+        permissions: Array.isArray(ec.permissions) ? ec.permissions : [],
+        organizationId: ec.tenantId
+      } : void 0;
+      const result = await route.handler({
+        body,
+        params,
+        query,
+        headers: context.request?.headers,
+        user
+      });
       if (result.stream && result.events) {
         return {
           handled: true,
@@ -5832,13 +5973,22 @@ function resolveErrorReporter(ctx, override) {
 }
 
 // src/dispatcher-plugin.ts
-function mountRouteOnServer(route, server, routePath, securityHeaders) {
+function mountRouteOnServer(route, server, routePath, securityHeaders, resolveUser) {
   const handler = async (req, res) => {
     try {
+      let user;
+      if (resolveUser) {
+        try {
+          user = await resolveUser(req.headers ?? {});
+        } catch {
+        }
+      }
       const result = await route.handler({
         body: req.body,
         params: req.params,
-        query: req.query
+        query: req.query,
+        headers: req.headers,
+        user
       });
       if (result.stream && result.events) {
         res.status(result.status);
@@ -6575,6 +6725,32 @@ function createDispatcherPlugin(config = {}) {
         }
       }
       ctx.logger.info("Dispatcher bridge routes registered", { prefix, enableProjectScoping, projectResolution });
+      const resolveRequestUser = async (headers) => {
+        try {
+          const authService = ctx.getService("auth");
+          if (!authService) return void 0;
+          let api = authService.api;
+          if (!api && typeof authService.getApi === "function") {
+            api = await authService.getApi();
+          }
+          if (!api?.getSession) return void 0;
+          const headersInstance = headers instanceof Headers ? headers : new Headers(headers);
+          const sessionData = await api.getSession({ headers: headersInstance });
+          const userId = sessionData?.user?.id ?? sessionData?.session?.userId;
+          if (!userId) return void 0;
+          return {
+            userId,
+            id: userId,
+            displayName: sessionData?.user?.name ?? sessionData?.user?.email ?? userId,
+            email: sessionData?.user?.email,
+            roles: [],
+            permissions: [],
+            organizationId: sessionData?.session?.activeOrganizationId
+          };
+        } catch {
+          return void 0;
+        }
+      };
       const toScopedPath = (routePath) => {
         if (routePath.startsWith(prefix)) {
           const tail = routePath.slice(prefix.length);
@@ -6587,11 +6763,11 @@ function createDispatcherPlugin(config = {}) {
         const routePath = route.path.startsWith("/api/v1") ? route.path : `${prefix}${route.path}`;
         let count = 0;
         if (enableProjectScoping && projectResolution === "required") {
-          if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders)) count++;
+          if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser)) count++;
         } else {
-          if (mountRouteOnServer(route, server, routePath, securityHeaders)) count++;
+          if (mountRouteOnServer(route, server, routePath, securityHeaders, resolveRequestUser)) count++;
           if (enableProjectScoping) {
-            if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders)) count++;
+            if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser)) count++;
           }
         }
         return count;
@@ -7366,6 +7542,27 @@ function extractRuntimeFromMetadata(metadata) {
 }
 async function createDriver(driverType, databaseUrl, authToken) {
   switch (driverType) {
+    case "libsql":
+    case "turso": {
+      let TursoDriver;
+      try {
+        ({ TursoDriver } = await import("@objectstack/driver-turso"));
+      } catch (primaryErr) {
+        try {
+          const { createRequire } = await import("module");
+          const path = await import("path");
+          const url = await import("url");
+          const hostRequire = createRequire(path.join(process.cwd(), "noop.js"));
+          const resolved = hostRequire.resolve("@objectstack/driver-turso");
+          ({ TursoDriver } = await import(url.pathToFileURL(resolved).href));
+        } catch (fallbackErr) {
+          throw new Error(
+            `[ArtifactEnvironmentRegistry] libsql/turso driver requested but @objectstack/driver-turso is not resolvable. Install it from the cloud monorepo (cloud/packages/driver-turso) or via npm. (primary: ${primaryErr?.message ?? primaryErr}; fallback: ${fallbackErr?.message ?? fallbackErr})`
+          );
+        }
+      }
+      return new TursoDriver({ url: databaseUrl, authToken });
+    }
     case "memory": {
       const { InMemoryDriver } = await import("@objectstack/driver-memory");
       const dbName = databaseUrl.replace(/^memory:\/\//, "").trim();
@@ -7384,18 +7581,6 @@ async function createDriver(driverType, databaseUrl, authToken) {
         useNullAsDefault: true
       });
     }
-    case "libsql":
-    case "turso": {
-      let TursoDriver;
-      try {
-        ({ TursoDriver } = await import("@objectstack/driver-turso"));
-      } catch (err) {
-        throw new Error(
-          `[ArtifactEnvironmentRegistry] libsql/turso driver requested but @objectstack/driver-turso is not installed. Install it with: npm install @objectstack/driver-turso. (${err?.message ?? err})`
-        );
-      }
-      return new TursoDriver({ url: databaseUrl, authToken });
-    }
     case "postgres":
     case "postgresql":
     case "pg": {
@@ -7653,39 +7838,7 @@ var ArtifactKernelFactory = class {
           // intentionally do NOT pass crossSubDomainCookies here
           // so cookies stay isolated per project subdomain.
           trustedOrigins: trustedOriginsList.length ? trustedOriginsList : void 0,
-          ...oidcProviders ? { oidcProviders } : {},
-          // Auto-provision a personal organization for every new
-          // user. SecurityPlugin's ObjectQL middleware does this
-          // for direct `ql.insert` calls, but better-auth's
-          // adapter writes through `dataEngine` directly,
-          // bypassing that middleware — so JIT-created SSO users
-          // would otherwise land on the empty "create
-          // organization" screen on first login.
-          databaseHooks: {
-            user: {
-              create: {
-                after: async (user) => {
-                  try {
-                    const ql = kernel.getService("objectql");
-                    if (!ql) return;
-                    const [{ ensureUserHasOrganization, cloneTenantSeedData }] = await Promise.all([
-                      import("@objectstack/plugin-security")
-                    ]);
-                    await ensureUserHasOrganization(ql, user, {
-                      logger: this.logger,
-                      cloneSeedData: cloneTenantSeedData
-                    });
-                  } catch (e) {
-                    this.logger.warn?.("[ArtifactKernelFactory] auto-org provisioning hook failed", {
-                      environmentId,
-                      userId: user?.id,
-                      error: e?.message
-                    });
-                  }
-                }
-              }
-            }
-          }
+          ...oidcProviders ? { oidcProviders } : {}
         }));
         if (oidcProviders) {
           this.logger.info?.("[ArtifactKernelFactory] platform SSO wired", {
@@ -7703,9 +7856,20 @@ var ArtifactKernelFactory = class {
       this.logger.warn?.("[ArtifactKernelFactory] OS_AUTH_SECRET not set \u2014 per-project AuthPlugin skipped (auth endpoints will return 404)", { environmentId });
     }
     try {
+      const multiTenant = String(process.env.OS_MULTI_TENANT ?? "false").toLowerCase() !== "false";
+      if (multiTenant) {
+        try {
+          const { OrgScopingPlugin } = await import("@objectstack/plugin-org-scoping");
+          await kernel.use(new OrgScopingPlugin());
+        } catch (err) {
+          this.logger.warn?.("[ArtifactKernelFactory] OrgScopingPlugin not registered (multi-tenant disabled)", {
+            environmentId,
+            error: err?.message
+          });
+        }
+      }
       const { SecurityPlugin } = await import("@objectstack/plugin-security");
-      const multiTenant = String(process.env.OS_MULTI_TENANT ?? "true").toLowerCase() !== "false";
-      await kernel.use(new SecurityPlugin({ multiTenant }));
+      await kernel.use(new SecurityPlugin());
     } catch (err) {
       this.logger.warn?.("[ArtifactKernelFactory] SecurityPlugin not registered", {
         environmentId,
@@ -7713,8 +7877,15 @@ var ArtifactKernelFactory = class {
       });
     }
     const projectName = project.hostname ?? environmentId;
-    const bundle = artifact.metadata;
-    const sys = bundle?.manifest ?? bundle;
+    const artifactAny = artifact;
+    const topLevelManifest = artifactAny?.manifest && typeof artifactAny.manifest === "object" ? artifactAny.manifest : null;
+    const topLevelFunctions = Array.isArray(artifactAny?.functions) ? artifactAny.functions : [];
+    const bundle = {
+      ...artifact.metadata ?? {},
+      ...topLevelManifest ? { manifest: topLevelManifest } : {},
+      functions: topLevelFunctions
+    };
+    const sys = bundle.manifest ?? bundle;
     const packageId = sys?.packageId ?? sys?.package_id ?? bundle?.packageId;
     const i18nCfg = bundle?.i18n ?? sys?.i18n ?? {};
     const trArr = Array.isArray(bundle?.translations) ? bundle.translations : Array.isArray(sys?.translations) ? sys.translations : [];
@@ -8224,6 +8395,40 @@ function resolveCloudUrl(explicit) {
 
 // src/cloud/marketplace-proxy-plugin.ts
 var MARKETPLACE_PREFIX = "/api/v1/marketplace";
+var DEFAULT_LRU_MAX = 200;
+var LIST_TTL_MS = 30 * 60 * 1e3;
+var PACKAGE_TTL_MS = 2 * 60 * 60 * 1e3;
+var VERSION_TTL_MS = 24 * 60 * 60 * 1e3;
+function ttlForPath(pathname) {
+  if (/\/packages\/[^/]+\/versions\//.test(pathname)) return VERSION_TTL_MS;
+  if (/\/packages\/[^/]+/.test(pathname)) return PACKAGE_TTL_MS;
+  return LIST_TTL_MS;
+}
+var LruTtlCache = class {
+  constructor(max) {
+    this.max = max;
+    this.map = /* @__PURE__ */ new Map();
+  }
+  get(key) {
+    const entry = this.map.get(key);
+    if (!entry) return void 0;
+    this.map.delete(key);
+    this.map.set(key, entry);
+    return entry;
+  }
+  set(key, entry) {
+    if (this.map.has(key)) this.map.delete(key);
+    this.map.set(key, entry);
+    while (this.map.size > this.max) {
+      const oldest = this.map.keys().next().value;
+      if (oldest === void 0) break;
+      this.map.delete(oldest);
+    }
+  }
+  clear() {
+    this.map.clear();
+  }
+};
 var MarketplaceProxyPlugin = class _MarketplaceProxyPlugin {
   constructor(config = {}) {
     this.name = "com.objectstack.runtime.marketplace-proxy";
@@ -8245,6 +8450,7 @@ var MarketplaceProxyPlugin = class _MarketplaceProxyPlugin {
         }
         const rawApp = httpServer.getRawApp();
         const cloudUrl = this.cloudUrl;
+        const cache = this.cache;
         const handler = async (c, next) => {
           if (!cloudUrl) {
             return c.json({
@@ -8271,24 +8477,51 @@ var MarketplaceProxyPlugin = class _MarketplaceProxyPlugin {
                 }
               }, 405);
             }
-            const resp = await fetch(target, {
-              method,
-              headers: {
-                // Strip the inbound Host header — fetch will set
-                // it to the cloud host. Forward only the
-                // identifying headers cloud might log.
-                "Accept": c.req.header("accept") ?? "application/json",
-                "User-Agent": `objectos-marketplace-proxy/${_MarketplaceProxyPlugin.prototype.version ?? "1.0.0"}`
+            const accept = c.req.header("accept") ?? "application/json";
+            const acceptLang = c.req.header("accept-language") ?? "";
+            const cacheKey = `${incomingUrl.pathname}${incomingUrl.search}|al=${acceptLang}|a=${accept}`;
+            const reqCacheCtl = (c.req.header("cache-control") ?? "").toLowerCase();
+            const bypass = !cache || reqCacheCtl.includes("no-cache") || reqCacheCtl.includes("no-store");
+            const now = Date.now();
+            if (cache && !bypass) {
+              const hit = cache.get(cacheKey);
+              if (hit && hit.expiresAt > now) {
+                return buildCachedResponse(hit, method, "HIT");
               }
-            });
-            const headers = new Headers();
-            const passthroughHeaders = ["content-type", "cache-control", "etag", "last-modified"];
-            for (const h of passthroughHeaders) {
-              const v = resp.headers.get(h);
-              if (v) headers.set(h, v);
+              if (hit) {
+                const revalHeaders = {
+                  "Accept": accept,
+                  "User-Agent": `objectos-marketplace-proxy/${_MarketplaceProxyPlugin.prototype.version ?? "1.0.0"}`
+                };
+                if (acceptLang) revalHeaders["Accept-Language"] = acceptLang;
+                if (hit.etag) revalHeaders["If-None-Match"] = hit.etag;
+                if (hit.lastModified) revalHeaders["If-Modified-Since"] = hit.lastModified;
+                const revalResp = await fetch(target, { method: "GET", headers: revalHeaders });
+                if (revalResp.status === 304) {
+                  hit.expiresAt = now + hit.ttlMs;
+                  const newEtag = revalResp.headers.get("etag");
+                  const newLm = revalResp.headers.get("last-modified");
+                  if (newEtag) hit.etag = newEtag;
+                  if (newLm) hit.lastModified = newLm;
+                  cache.set(cacheKey, hit);
+                  return buildCachedResponse(hit, method, "REVALIDATED");
+                }
+                return await consumeAndMaybeCache(revalResp, cacheKey, incomingUrl.pathname, method, cache);
+              }
+            }
+            const reqHeaders = {
+              // Strip the inbound Host header — fetch will set
+              // it to the cloud host. Forward only the
+              // identifying headers cloud might log.
+              "Accept": accept,
+              "User-Agent": `objectos-marketplace-proxy/${_MarketplaceProxyPlugin.prototype.version ?? "1.0.0"}`
+            };
+            if (acceptLang) reqHeaders["Accept-Language"] = acceptLang;
+            const resp = await fetch(target, { method: "GET", headers: reqHeaders });
+            if (bypass || !cache) {
+              return await passthroughResponse(resp, method, bypass ? "BYPASS" : "MISS");
             }
-            const body = await resp.arrayBuffer();
-            return new Response(body, { status: resp.status, headers });
+            return await consumeAndMaybeCache(resp, cacheKey, incomingUrl.pathname, method, cache);
           } catch (err) {
             const errObj = err instanceof Error ? err : new Error(err?.message ?? String(err));
             ctx.logger?.error?.("[MarketplaceProxyPlugin] proxy failed", errObj);
@@ -8311,12 +8544,67 @@ var MarketplaceProxyPlugin = class _MarketplaceProxyPlugin {
             }
           }
         }
-        ctx.logger?.info?.(`[MarketplaceProxyPlugin] mounted at ${MARKETPLACE_PREFIX}/* \u2192 ${cloudUrl || "(unconfigured)"}`);
+        ctx.logger?.info?.(`[MarketplaceProxyPlugin] mounted at ${MARKETPLACE_PREFIX}/* \u2192 ${cloudUrl || "(unconfigured)"} (cache=${this.cache ? "on" : "off"})`);
       });
     };
     this.cloudUrl = resolveCloudUrl(config.controlPlaneUrl);
+    const envFlag = (process.env.OS_MARKETPLACE_CACHE ?? "").trim().toLowerCase();
+    const envDisabled = ["off", "false", "0", "no", "disable", "disabled"].includes(envFlag);
+    const disabled = config.cacheDisabled ?? envDisabled;
+    this.cache = disabled ? null : new LruTtlCache(Math.max(8, config.cacheMaxEntries ?? DEFAULT_LRU_MAX));
   }
 };
+var PASSTHROUGH_HEADERS = ["content-type", "cache-control", "etag", "last-modified", "vary"];
+function collectHeaders(src) {
+  const out = {};
+  for (const h of PASSTHROUGH_HEADERS) {
+    const v = src.headers.get(h);
+    if (v) out[h] = v;
+  }
+  return out;
+}
+function buildCachedResponse(entry, method, xCache) {
+  const headers = new Headers(entry.headers);
+  headers.set("X-Cache", xCache);
+  const ageSec = Math.max(0, Math.floor((entry.expiresAt - entry.ttlMs - Date.now()) / -1e3));
+  headers.set("Age", String(Math.max(0, ageSec)));
+  const body = method === "HEAD" ? null : entry.body;
+  return new Response(body, { status: entry.status, headers });
+}
+async function passthroughResponse(resp, method, xCache) {
+  const headers = new Headers(collectHeaders(resp));
+  headers.set("X-Cache", xCache);
+  if (method === "HEAD") {
+    try {
+      await resp.arrayBuffer();
+    } catch {
+    }
+    return new Response(null, { status: resp.status, headers });
+  }
+  const body = await resp.arrayBuffer();
+  return new Response(body, { status: resp.status, headers });
+}
+async function consumeAndMaybeCache(resp, key, pathname, method, cache) {
+  const body = await resp.arrayBuffer();
+  const headers = collectHeaders(resp);
+  if (resp.status >= 200 && resp.status < 300) {
+    const ttlMs = ttlForPath(pathname);
+    const entry = {
+      status: resp.status,
+      body,
+      headers,
+      etag: resp.headers.get("etag") ?? void 0,
+      lastModified: resp.headers.get("last-modified") ?? void 0,
+      expiresAt: Date.now() + ttlMs,
+      ttlMs
+    };
+    cache.set(key, entry);
+  }
+  const respHeaders = new Headers(headers);
+  respHeaders.set("X-Cache", "MISS");
+  const outBody = method === "HEAD" ? null : body;
+  return new Response(outBody, { status: resp.status, headers: respHeaders });
+}
 
 // src/cloud/runtime-config-plugin.ts
 var RuntimeConfigPlugin = class {
@@ -8354,12 +8642,14 @@ var RuntimeConfigPlugin = class {
           let defaultEnvironmentId;
           let defaultOrgId;
           let resolvedSingleEnv = this.singleEnvironment;
-          if (envRegistry && host && typeof envRegistry.resolveHostname === "function") {
+          const resolveFn = typeof envRegistry?.resolveByHostname === "function" ? envRegistry.resolveByHostname.bind(envRegistry) : typeof envRegistry?.resolveHostname === "function" ? envRegistry.resolveHostname.bind(envRegistry) : null;
+          if (resolveFn && host) {
             try {
-              const resolved = await envRegistry.resolveHostname(host);
+              const resolved = await resolveFn(host);
               if (resolved?.environmentId) {
-                defaultEnvironmentId = resolved.environmentId;
-                if (resolved.organizationId) defaultOrgId = String(resolved.organizationId);
+                defaultEnvironmentId = String(resolved.environmentId);
+                const orgId = resolved.organizationId ?? resolved.organization_id;
+                if (orgId) defaultOrgId = String(orgId);
                 resolvedSingleEnv = true;
               }
             } catch {
@@ -8370,7 +8660,11 @@ var RuntimeConfigPlugin = class {
             singleEnvironment: resolvedSingleEnv,
             defaultOrgId,
             defaultEnvironmentId,
-            features
+            features,
+            branding: {
+              productName: this.productName,
+              productShortName: this.productShortName
+            }
           });
         };
         rawApp.get("/api/v1/runtime/config", handler);
@@ -8387,6 +8681,10 @@ var RuntimeConfigPlugin = class {
     this.cloudUrl = config.controlPlaneUrl === "" ? "" : resolveCloudUrl(config.controlPlaneUrl) ?? "";
     this.installLocal = !!config.installLocal;
     this.singleEnvironment = !!config.singleEnvironment;
+    const envName = (typeof process !== "undefined" ? process.env?.OS_PRODUCT_NAME : void 0)?.trim();
+    const envShort = (typeof process !== "undefined" ? process.env?.OS_PRODUCT_SHORT_NAME : void 0)?.trim();
+    this.productName = (config.productName ?? envName ?? "ObjectOS").trim() || "ObjectOS";
+    this.productShortName = (config.productShortName ?? envShort ?? this.productName).trim() || this.productName;
   }
 };
 
@@ -8676,9 +8974,15 @@ var MarketplaceInstallLocalPlugin = class {
         const postHandler = async (c) => this.handleInstall(c, ctx);
         const getHandler = async (c) => this.handleList(c);
         const deleteHandler = async (c) => this.handleUninstall(c, ctx);
+        const reseedHandler = async (c) => this.handleReseed(c, ctx);
+        const purgeHandler = async (c) => this.handlePurge(c, ctx);
         if (typeof rawApp.post === "function") rawApp.post(ROUTE_BASE, postHandler);
         if (typeof rawApp.get === "function") rawApp.get(ROUTE_BASE, getHandler);
         if (typeof rawApp.delete === "function") rawApp.delete(`${ROUTE_BASE}/:manifestId`, deleteHandler);
+        if (typeof rawApp.post === "function") {
+          rawApp.post(`${ROUTE_BASE}/:manifestId/reseed-sample-data`, reseedHandler);
+          rawApp.post(`${ROUTE_BASE}/:manifestId/purge-sample-data`, purgeHandler);
+        }
         ctx.logger?.info?.(`[MarketplaceInstallLocal] mounted at ${ROUTE_BASE} (storage: ${this.storageDir})`);
       });
     };
@@ -8775,7 +9079,8 @@ var MarketplaceInstallLocalPlugin = class {
         version,
         manifest,
         installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        installedBy: userId
+        installedBy: userId,
+        withSampleData: false
       };
       try {
         mkdirSync3(this.storageDir, { recursive: true });
@@ -8802,6 +9107,13 @@ var MarketplaceInstallLocalPlugin = class {
         ctx.logger?.warn?.(`[MarketplaceInstallLocal] syncSchemas failed for ${manifestId}: ${err?.message ?? err}`);
       }
       const seededSummary = await this.applySideEffects(ctx, manifest, { seedNow: true, c });
+      if (seededSummary.seeded.mode === "inline" && (seededSummary.seeded.inserted ?? 0) + (seededSummary.seeded.updated ?? 0) > 0) {
+        entry.withSampleData = true;
+        try {
+          writeFileSync2(join(this.storageDir, safeFilename(manifestId)), JSON.stringify(entry, null, 2), "utf8");
+        } catch {
+        }
+      }
       return c.json({
         success: true,
         data: {
@@ -8828,7 +9140,8 @@ var MarketplaceInstallLocalPlugin = class {
             manifestId: e.manifestId,
             version: e.version,
             installedAt: e.installedAt,
-            installedBy: e.installedBy
+            installedBy: e.installedBy,
+            withSampleData: e.withSampleData ?? false
           })),
           total: entries.length,
           storageDir: this.storageDir
@@ -8893,6 +9206,145 @@ var MarketplaceInstallLocalPlugin = class {
      * dev / single-tenant runtimes. Stricter checks can be layered on
      * via a middleware in cloud-hosted multi-tenant deployments.
      */
+    /**
+     * POST /api/v1/marketplace/install-local/:manifestId/reseed-sample-data
+     *
+     * Re-runs SeedLoaderService against the cached manifest's `data` arrays.
+     * Idempotent (upsert by id). Useful when:
+     *   • The user installed an app and skipped sample data
+     *   • A purge was undone
+     *   • The user wants a clean baseline back after editing demo rows
+     *
+     * Multi-tenant: requires an active organization on the session (same
+     * rule as install seed path).
+     */
+    this.handleReseed = async (c, ctx) => {
+      const userId = await this.requireAuthenticatedUser(c, ctx);
+      if (!userId) {
+        return c.json({ success: false, error: { code: "unauthorized", message: "Authentication required." } }, 401);
+      }
+      const manifestId = String(c.req.param?.("manifestId") ?? c.req.params?.manifestId ?? "").trim();
+      if (!manifestId) {
+        return c.json({ success: false, error: { code: "bad_request", message: "manifestId path param required." } }, 400);
+      }
+      const file = join(this.storageDir, safeFilename(manifestId));
+      if (!existsSync2(file)) {
+        return c.json({ success: false, error: { code: "not_found", message: `No marketplace install for ${manifestId}.` } }, 404);
+      }
+      let entry;
+      try {
+        entry = JSON.parse(readFileSync(file, "utf8"));
+      } catch (err) {
+        return c.json({ success: false, error: { code: "storage_failed", message: `Failed to read manifest cache: ${err?.message ?? err}` } }, 500);
+      }
+      const summary = await this.applySideEffects(ctx, entry.manifest, { seedNow: true, c });
+      if (summary.seeded.mode === "skipped") {
+        return c.json({
+          success: false,
+          error: {
+            code: "reseed_skipped",
+            message: `Reseed did not run: ${summary.seeded.reason ?? "unknown reason"}`
+          }
+        }, 400);
+      }
+      try {
+        entry.withSampleData = true;
+        writeFileSync2(file, JSON.stringify(entry, null, 2), "utf8");
+      } catch {
+      }
+      return c.json({
+        success: true,
+        data: {
+          manifestId,
+          inserted: summary.seeded.inserted ?? 0,
+          updated: summary.seeded.updated ?? 0,
+          errors: summary.seeded.errors ?? 0,
+          withSampleData: true
+        }
+      }, 200);
+    };
+    /**
+     * POST /api/v1/marketplace/install-local/:manifestId/purge-sample-data
+     *
+     * Deletes every record whose id is declared in the cached manifest's
+     * seed datasets. Uses the `driver` service directly to bypass ACL /
+     * lifecycle hooks (same pattern as cloud purge). User-created records
+     * are never touched — only ids declared in the package's bundled
+     * datasets are removed. Already-deleted rows count as `skipped`.
+     */
+    this.handlePurge = async (c, ctx) => {
+      const userId = await this.requireAuthenticatedUser(c, ctx);
+      if (!userId) {
+        return c.json({ success: false, error: { code: "unauthorized", message: "Authentication required." } }, 401);
+      }
+      const manifestId = String(c.req.param?.("manifestId") ?? c.req.params?.manifestId ?? "").trim();
+      if (!manifestId) {
+        return c.json({ success: false, error: { code: "bad_request", message: "manifestId path param required." } }, 400);
+      }
+      const file = join(this.storageDir, safeFilename(manifestId));
+      if (!existsSync2(file)) {
+        return c.json({ success: false, error: { code: "not_found", message: `No marketplace install for ${manifestId}.` } }, 404);
+      }
+      let entry;
+      try {
+        entry = JSON.parse(readFileSync(file, "utf8"));
+      } catch (err) {
+        return c.json({ success: false, error: { code: "storage_failed", message: `Failed to read manifest cache: ${err?.message ?? err}` } }, 500);
+      }
+      const datasets = Array.isArray(entry.manifest?.data) ? entry.manifest.data.filter((d) => d && d.object && Array.isArray(d.records)) : [];
+      if (datasets.length === 0) {
+        return c.json({
+          success: false,
+          error: { code: "nothing_to_purge", message: "This package declares no seed datasets." }
+        }, 400);
+      }
+      let driver;
+      try {
+        driver = ctx.getService("driver");
+      } catch {
+      }
+      if (!driver || typeof driver.delete !== "function") {
+        return c.json({
+          success: false,
+          error: { code: "driver_missing", message: "driver service unavailable \u2014 cannot purge." }
+        }, 500);
+      }
+      let deleted = 0;
+      let skipped = 0;
+      let errors = 0;
+      for (const ds of datasets) {
+        const object = String(ds.object);
+        for (const rec of ds.records) {
+          const id = rec?.id;
+          if (id === void 0 || id === null || id === "") {
+            skipped++;
+            continue;
+          }
+          try {
+            const r = await driver.delete(object, id);
+            if (r === false || r === 0 || r?.deleted === 0) skipped++;
+            else deleted++;
+          } catch (err) {
+            const msg = String(err?.message ?? err);
+            if (/not.?found|no row/i.test(msg)) skipped++;
+            else {
+              errors++;
+              ctx.logger?.warn?.(`[MarketplaceInstallLocal] purge ${object}#${id}: ${msg}`);
+            }
+          }
+        }
+      }
+      try {
+        entry.withSampleData = false;
+        writeFileSync2(file, JSON.stringify(entry, null, 2), "utf8");
+      } catch {
+      }
+      ctx.logger?.info?.(`[MarketplaceInstallLocal] purged ${manifestId}: deleted=${deleted} skipped=${skipped} errors=${errors}`);
+      return c.json({
+        success: true,
+        data: { manifestId, deleted, skipped, errors, withSampleData: false }
+      }, 200);
+    };
     /**
      * Replicate the start-time side-effects that AppPlugin runs for
      * statically-declared apps but the `manifest` service does NOT:
@@ -8982,7 +9434,7 @@ var MarketplaceInstallLocalPlugin = class {
         }
       }
       if (opts.seedNow && datasets.length > 0) {
-        const multiTenant = String(process.env.OS_MULTI_TENANT ?? "true").toLowerCase() !== "false";
+        const multiTenant = String(process.env.OS_MULTI_TENANT ?? "false").toLowerCase() !== "false";
         try {
           const ql = ctx.getService("objectql");
           let metadata;