@objectstack/runtime 7.8.0 → 7.9.0

package/dist/index.d.cts

@@ -2027,6 +2027,15 @@ interface ObjectOSStackConfig {
      * (ADR §5.2 — "framework exposes seams; cloud supplies metadata + policy").
      */
     extraPlugins?: Plugin[];
+    /**
+     * Capability tokens force-mounted on EVERY per-environment kernel, in
+     * addition to whatever the app artifact declares in `requires`. Merged and
+     * de-duped with `bundle.requires` before the capability loader runs. This
+     * is the host seam for a cloud operator to make a capability ubiquitous
+     * across all tenants without editing each app — e.g. `['ai','aiStudio']`
+     * so every cloud environment supports AI-driven online development.
+     */
+    defaultRequires?: string[];
 }
 interface ObjectOSStackResult {
     plugins: any[];
@@ -2248,6 +2257,14 @@ interface RuntimeConfigPluginConfig {
     controlPlaneUrl?: string;
     /** Override the `features.installLocal` flag. Default: false. */
     installLocal?: boolean;
+    /**
+     * Override the `features.aiStudio` flag — whether the SPA should surface
+     * AI-driven metadata authoring ("online development") affordances. Default:
+     * true (the actual authoring capability is still gated server-side by the
+     * presence of the `metadata_assistant` agent / @objectstack/service-ai-studio
+     * package; set false to force-hide the authoring UI for a tier/deployment).
+     */
+    aiStudio?: boolean;
     /**
      * Report this runtime as a single-environment deployment (CLI
      * `objectstack dev` / `os serve`). Defaults to `false` for
@@ -2269,6 +2286,7 @@ declare class RuntimeConfigPlugin implements Plugin {
     readonly version = "1.0.0";
     private readonly cloudUrl;
     private readonly installLocal;
+    private readonly aiStudio;
     private readonly singleEnvironment;
     private readonly productName;
     private readonly productShortName;
@@ -2400,6 +2418,12 @@ interface ArtifactKernelFactoryConfig {
      * `process.env.OS_AUTH_SECRET` / `AUTH_SECRET` at construction time.
      */
     authBaseSecret?: string;
+    /**
+     * Capability tokens force-mounted on every per-environment kernel, merged
+     * (and de-duped by the loader) with the artifact's own `requires`. Lets a
+     * host make a capability ubiquitous across tenants — e.g. `['ai','aiStudio']`.
+     */
+    defaultRequires?: string[];
 }
 declare class ArtifactKernelFactory implements EnvironmentKernelFactory {
     private readonly client;
@@ -2407,6 +2431,7 @@ declare class ArtifactKernelFactory implements EnvironmentKernelFactory {
     private readonly logger;
     private readonly kernelConfig?;
     private readonly authBaseSecret;
+    private readonly defaultRequires;
     constructor(config: ArtifactKernelFactoryConfig);
     create(environmentId: string): Promise<ObjectKernel>;
 }

package/dist/index.d.ts

@@ -2027,6 +2027,15 @@ interface ObjectOSStackConfig {
      * (ADR §5.2 — "framework exposes seams; cloud supplies metadata + policy").
      */
     extraPlugins?: Plugin[];
+    /**
+     * Capability tokens force-mounted on EVERY per-environment kernel, in
+     * addition to whatever the app artifact declares in `requires`. Merged and
+     * de-duped with `bundle.requires` before the capability loader runs. This
+     * is the host seam for a cloud operator to make a capability ubiquitous
+     * across all tenants without editing each app — e.g. `['ai','aiStudio']`
+     * so every cloud environment supports AI-driven online development.
+     */
+    defaultRequires?: string[];
 }
 interface ObjectOSStackResult {
     plugins: any[];
@@ -2248,6 +2257,14 @@ interface RuntimeConfigPluginConfig {
     controlPlaneUrl?: string;
     /** Override the `features.installLocal` flag. Default: false. */
     installLocal?: boolean;
+    /**
+     * Override the `features.aiStudio` flag — whether the SPA should surface
+     * AI-driven metadata authoring ("online development") affordances. Default:
+     * true (the actual authoring capability is still gated server-side by the
+     * presence of the `metadata_assistant` agent / @objectstack/service-ai-studio
+     * package; set false to force-hide the authoring UI for a tier/deployment).
+     */
+    aiStudio?: boolean;
     /**
      * Report this runtime as a single-environment deployment (CLI
      * `objectstack dev` / `os serve`). Defaults to `false` for
@@ -2269,6 +2286,7 @@ declare class RuntimeConfigPlugin implements Plugin {
     readonly version = "1.0.0";
     private readonly cloudUrl;
     private readonly installLocal;
+    private readonly aiStudio;
     private readonly singleEnvironment;
     private readonly productName;
     private readonly productShortName;
@@ -2400,6 +2418,12 @@ interface ArtifactKernelFactoryConfig {
      * `process.env.OS_AUTH_SECRET` / `AUTH_SECRET` at construction time.
      */
     authBaseSecret?: string;
+    /**
+     * Capability tokens force-mounted on every per-environment kernel, merged
+     * (and de-duped by the loader) with the artifact's own `requires`. Lets a
+     * host make a capability ubiquitous across tenants — e.g. `['ai','aiStudio']`.
+     */
+    defaultRequires?: string[];
 }
 declare class ArtifactKernelFactory implements EnvironmentKernelFactory {
     private readonly client;
@@ -2407,6 +2431,7 @@ declare class ArtifactKernelFactory implements EnvironmentKernelFactory {
     private readonly logger;
     private readonly kernelConfig?;
     private readonly authBaseSecret;
+    private readonly defaultRequires;
     constructor(config: ArtifactKernelFactoryConfig);
     create(environmentId: string): Promise<ObjectKernel>;
 }

package/dist/index.js

@@ -3514,7 +3514,8 @@ var _HttpDispatcher = class _HttpDispatcher {
         if (protocol && typeof protocol.getMetaItem === "function") {
           try {
             const organizationId = await this.resolveActiveOrganizationId(_context);
-            const data = await protocol.getMetaItem({ type: singularType, name, packageId, organizationId });
+            const previewDrafts = query?.preview === "draft";
+            const data = await protocol.getMetaItem({ type: singularType, name, packageId, organizationId, previewDrafts });
             return { handled: true, response: this.success(data) };
           } catch (e) {
           }
@@ -3556,7 +3557,8 @@ var _HttpDispatcher = class _HttpDispatcher {
       if (protocol && typeof protocol.getMetaItems === "function") {
         try {
           const organizationId = await this.resolveActiveOrganizationId(_context);
-          const data = await protocol.getMetaItems({ type: typeOrName, packageId, organizationId });
+          const previewDrafts = query?.preview === "draft";
+          const data = await protocol.getMetaItems({ type: typeOrName, packageId, organizationId, previewDrafts });
           if (data && (data.items !== void 0 || Array.isArray(data))) {
             return { handled: true, response: this.success(data) };
           }
@@ -3910,6 +3912,24 @@ var _HttpDispatcher = class _HttpDispatcher {
         }
         return { handled: true, response: this.error("Draft publishing not supported", 501) };
       }
+      if (parts.length === 2 && parts[1] === "discard-drafts" && m === "POST") {
+        const id = decodeURIComponent(parts[0]);
+        const protocol = await this.resolveService("protocol");
+        if (protocol && typeof protocol.discardPackageDrafts === "function") {
+          try {
+            const organizationId = await this.resolveActiveOrganizationId(_context);
+            const result = await protocol.discardPackageDrafts({
+              packageId: id,
+              ...organizationId ? { organizationId } : {},
+              ...body?.actor ? { actor: body.actor } : {}
+            });
+            return { handled: true, response: this.success(result) };
+          } catch (e) {
+            return { handled: true, response: this.error(e.message, e.statusCode || 500) };
+          }
+        }
+        return { handled: true, response: this.error("Draft discarding not supported", 501) };
+      }
       if (parts.length === 2 && parts[1] === "revert" && m === "POST") {
         const id = decodeURIComponent(parts[0]);
         const metadataService = await this.getService(CoreServiceName.enum.metadata);
@@ -3935,9 +3955,27 @@ var _HttpDispatcher = class _HttpDispatcher {
       }
       if (parts.length === 1 && m === "DELETE") {
         const id = decodeURIComponent(parts[0]);
-        const success = registry.uninstallPackage(id);
-        if (!success) return { handled: true, response: this.error(`Package '${id}' not found`, 404) };
-        return { handled: true, response: this.success({ success: true }) };
+        const registryRemoved = registry.uninstallPackage(id);
+        let persisted = void 0;
+        const protocol = await this.resolveService("protocol");
+        if (protocol && typeof protocol.deletePackage === "function") {
+          try {
+            const organizationId = await this.resolveActiveOrganizationId(_context);
+            const keepData = query?.keepData === "true" || query?.keepData === "1";
+            persisted = await protocol.deletePackage({
+              packageId: id,
+              ...organizationId ? { organizationId } : {},
+              ...keepData ? { keepData: true } : {}
+            });
+          } catch (e) {
+            return { handled: true, response: this.error(e.message, e.statusCode || 500) };
+          }
+        }
+        const deletedCount = persisted?.deletedCount ?? 0;
+        if (!registryRemoved && deletedCount === 0) {
+          return { handled: true, response: this.error(`Package '${id}' not found`, 404) };
+        }
+        return { handled: true, response: this.success({ success: true, registryRemoved, persisted }) };
       }
     } catch (e) {
       return { handled: true, response: this.error(e.message, e.statusCode || 500) };
@@ -6528,6 +6566,16 @@ var CAPABILITY_PROVIDERS = {
     pkg: "@objectstack/service-ai",
     export: "AIServicePlugin"
   },
+  // AI Studio — AI-driven metadata authoring ("online development"). This is
+  // a commercial capability that ships in the private @objectstack/service-ai-studio
+  // package (not part of the open-source framework). The dynamic import below
+  // silently skips when the package isn't installed, so the open-source build
+  // is unaffected; cloud and enterprise installs that ship the package light it
+  // up. Pair with `ai` in `requires` (it attaches via the `ai:ready` hook).
+  aiStudio: {
+    pkg: "@objectstack/service-ai-studio",
+    export: "AIStudioPlugin"
+  },
   analytics: {
     pkg: "@objectstack/service-analytics",
     export: "AnalyticsServicePlugin",
@@ -6854,6 +6902,7 @@ var ArtifactKernelFactory = class {
     this.envRegistry = config.envRegistry;
     this.logger = config.logger ?? console;
     this.kernelConfig = config.kernelConfig;
+    this.defaultRequires = config.defaultRequires ?? [];
     this.authBaseSecret = (config.authBaseSecret ?? readEnvWithDeprecation3("OS_AUTH_SECRET", ["AUTH_SECRET", "BETTER_AUTH_SECRET"]) ?? "").trim();
   }
   async create(environmentId) {
@@ -7020,7 +7069,10 @@ var ArtifactKernelFactory = class {
       });
     }
     const requiresRaw = (Array.isArray(bundle?.requires) ? bundle.requires : null) ?? (Array.isArray(sys?.requires) ? sys.requires : null) ?? [];
-    const requires = requiresRaw.filter((x) => typeof x === "string" && x.length > 0);
+    const requires = [
+      ...requiresRaw,
+      ...this.defaultRequires
+    ].filter((x) => typeof x === "string" && x.length > 0);
     if (requires.length > 0) {
       const installed = await loadCapabilities({
         kernel,
@@ -7679,13 +7731,7 @@ var MarketplaceProxyPlugin = class _MarketplaceProxyPlugin {
             }
             const target = `${cloudUrl}${incomingUrl.pathname}${incomingUrl.search}`;
             if (method !== "GET" && method !== "HEAD") {
-              return c.json({
-                success: false,
-                error: {
-                  code: "marketplace_method_not_allowed",
-                  message: `Marketplace proxy only forwards GET/HEAD; install via cloud.`
-                }
-              }, 405);
+              return next();
             }
             const accept = c.req.header("accept") ?? "application/json";
             const acceptLang = c.req.header("accept-language") ?? "";
@@ -7909,7 +7955,8 @@ var RuntimeConfigPlugin = class {
         const rawApp = httpServer.getRawApp();
         const features = {
           installLocal: this.installLocal,
-          marketplace: true
+          marketplace: true,
+          aiStudio: this.aiStudio
         };
         let envRegistry = null;
         try {
@@ -7960,6 +8007,7 @@ var RuntimeConfigPlugin = class {
     };
     this.cloudUrl = config.controlPlaneUrl === "" ? "" : resolveCloudUrl(config.controlPlaneUrl) ?? "";
     this.installLocal = !!config.installLocal;
+    this.aiStudio = config.aiStudio !== false;
     this.singleEnvironment = !!config.singleEnvironment;
     const envName = (typeof process !== "undefined" ? process.env?.OS_PRODUCT_NAME : void 0)?.trim();
     const envShort = (typeof process !== "undefined" ? process.env?.OS_PRODUCT_SHORT_NAME : void 0)?.trim();
@@ -8151,7 +8199,8 @@ var ObjectOSEnvironmentPlugin = class {
       const factory = new ArtifactKernelFactory({
         client,
         envRegistry,
-        logger: ctx.logger
+        logger: ctx.logger,
+        defaultRequires: this.config.defaultRequires
       });
       const kernelManager = new KernelManager({
         factory,