@objectstack/runtime 8.0.1 → 9.0.1

package/dist/index.d.ts

@@ -4,13 +4,12 @@ export { ObjectKernel } from '@objectstack/core';
 import { ClusterServicePluginOptions } from '@objectstack/service-cluster';
 import { ClusterCapabilityConfigInput, ExecutionContext } from '@objectstack/spec/kernel';
 import { z } from 'zod';
-import * as Contracts from '@objectstack/spec/contracts';
-import { ISeedLoaderService, IDataEngine, IMetadataService } from '@objectstack/spec/contracts';
-import { SeedLoaderRequest, SeedLoaderResult, ObjectDependencyGraph, Seed, SeedLoaderConfigInput, ExpressionBody, ScriptBody, HookBody, Hook } from '@objectstack/spec/data';
+export { SeedLoaderService } from '@objectstack/objectql';
 import { SchemaDiffEntry } from '@objectstack/spec/shared';
 import { MetricsRegistry, ErrorReporter } from '@objectstack/observability';
 export { CapturedError, ErrorReporter, InMemoryErrorReporter, InMemoryMetricsRegistry, MetricSample, MetricsRegistry, NoopErrorReporter, NoopMetricsRegistry, OBSERVABILITY_ERRORS_SERVICE, OBSERVABILITY_METRICS_SERVICE, RUNTIME_METRICS } from '@objectstack/observability';
 import { MiddlewareConfig, MiddlewareType } from '@objectstack/spec/system';
+import { ExpressionBody, ScriptBody, HookBody, Hook } from '@objectstack/spec/data';
 export { RestApiPluginConfig, RestServer, RouteEntry, RouteGroupBuilder, RouteManager, createRestApiPlugin } from '@objectstack/rest';
 export { _resetEnvDeprecationWarnings, readEnvWithDeprecation } from '@objectstack/types';
 
@@ -301,58 +300,6 @@ declare function collectBundleActions(bundle: any): Array<{
  */
 declare function collectBundleFunctions(bundle: any): Record<string, (ctx: any) => any>;
 
-interface Logger {
-    info(message: string, meta?: Record<string, any>): void;
-    warn(message: string, meta?: Record<string, any>): void;
-    error(message: string, error?: Error, meta?: Record<string, any>): void;
-    debug(message: string, meta?: Record<string, any>): void;
-}
-/**
- * SeedLoaderService — Runtime implementation of ISeedLoaderService
- *
- * Provides metadata-driven seed data loading with:
- * - Automatic lookup/master_detail reference resolution via externalId
- * - Topological dependency ordering (parents before children)
- * - Multi-pass loading for circular references
- * - Dry-run validation mode
- * - Upsert support honoring SeedSchema mode
- * - Actionable error reporting
- */
-declare class SeedLoaderService implements ISeedLoaderService {
-    private engine;
-    private metadata;
-    private logger;
-    constructor(engine: IDataEngine, metadata: IMetadataService, logger: Logger);
-    load(request: SeedLoaderRequest): Promise<SeedLoaderResult>;
-    buildDependencyGraph(objectNames: string[]): Promise<ObjectDependencyGraph>;
-    validate(datasets: Seed[], config?: SeedLoaderConfigInput): Promise<SeedLoaderResult>;
-    private loadDataset;
-    private resolveFromDatabase;
-    private resolveDeferredUpdates;
-    /**
-     * Seed writes always run as a privileged system context. This bypasses
-     * RBAC checks (so seeds can target system tables like `sys_*`) and
-     * disables the SecurityPlugin's auto-injection of `organization_id` /
-     * `owner_id` — seeds either declare those fields explicitly per
-     * record, or are intentionally cross-tenant / global.
-     */
-    private static readonly SEED_OPTIONS;
-    private writeRecord;
-    /**
-     * Kahn's algorithm for topological sort with cycle detection.
-     */
-    private topologicalSort;
-    private findCycles;
-    private filterByEnv;
-    private orderDatasets;
-    private buildReferenceMap;
-    private loadExistingRecords;
-    private looksLikeInternalId;
-    private extractId;
-    private buildEmptyResult;
-    private buildResult;
-}
-
 /**
  * Payload of the `external.schema.drift` event emitted on the kernel bus by the
  * background drift checker (ADR-0015 §5.2). Consumed by `audit` / `notification`
@@ -891,57 +838,6 @@ declare class HttpServer implements IHttpServer {
     getMiddlewares(): Middleware[];
 }
 
-/**
- * Per-project driver registry contract.
- *
- * Resolves a project (by hostname or ID) and produces an instantiated
- * `IDataDriver` bound to that project's physical database. Concrete
- * implementations sit on top of either:
- *   - the ObjectStack Cloud HTTP API (see {@link ArtifactEnvironmentRegistry})
- *   - a local file artifact (see {@link FileArtifactApiClient} +
- *     {@link ArtifactEnvironmentRegistry})
- *
- * The contract lives in `@objectstack/runtime` so the runtime can
- * express "fetch artifact + boot per-project kernel" without taking a
- * dependency on the cloud control plane.
- */
-
-type IDataDriver = Contracts.IDataDriver;
-/**
- * Multi-tenant kernel router contract.
- *
- * The HTTP dispatcher uses this optional seam to resolve a per-environment
- * kernel when serving a multi-tenant runtime. The framework only depends on
- * the *interface* — the concrete LRU/TTL implementation (and everything else
- * multi-tenant: hostname resolution, artifact fetching, per-env kernel
- * construction) lives in the cloud distribution
- * (`@objectstack/objectos-runtime`), not here.
- */
-interface KernelManager {
-    /** Resolve (building + caching on first use) the kernel for an environment. */
-    getOrCreate(environmentId: string): Promise<ObjectKernel>;
-}
-interface EnvironmentDriverRegistry {
-    /** Resolve a project by hostname. Returns `null` when unknown. */
-    resolveByHostname(host: string): Promise<{
-        environmentId: string;
-        driver: IDataDriver;
-    } | null>;
-    /** Resolve a project's driver by ID. Returns `null` when unknown. */
-    resolveById(environmentId: string): Promise<IDataDriver | null>;
-    /**
-     * Look up the cached project row + driver by ID without triggering a
-     * remote/file fetch. Returns the full cached entry when fresh.
-     */
-    peekById(environmentId: string): {
-        environmentId: string;
-        driver: IDataDriver;
-        project: any;
-    } | null;
-    /** Drop cached entries for the given project. */
-    invalidate(environmentId: string): void;
-}
-
 /** Minimal local interface — full EnvironmentScopeManager was removed in Phase R. */
 interface EnvironmentScopeManager {
     touch(environmentId: string): void;
@@ -951,6 +847,21 @@ interface HttpProtocolContext {
     response?: any;
     environmentId?: string;
     dataDriver?: any;
+    /**
+     * Dispatcher-provided hint for the host's {@link KernelResolver}: the
+     * cleaned route path (API prefix stripped). Lets the resolver apply its
+     * own path policy (e.g. skip env resolution for control-plane routes)
+     * without re-deriving the dispatcher's URL handling.
+     */
+    routePath?: string;
+    /**
+     * Dispatcher-provided hint for the host's {@link KernelResolver}: the
+     * UNVALIDATED environment-id candidate parsed from the scoped URL form
+     * (`/environments/:id/...`) or the router's `params.environmentId`.
+     * URL parsing is the dispatcher's routing convention, so it stays here;
+     * validation (registry lookup) is the resolver's job.
+     */
+    urlEnvironmentId?: string;
     /**
      * Identity envelope resolved by `resolveExecutionContext` and threaded
      * into every ObjectQL call so the SecurityPlugin middleware can apply
@@ -967,6 +878,31 @@ interface HttpDispatcherResult {
     };
     result?: any;
 }
+/**
+ * ADR-0006 generic kernel-resolution seam.
+ *
+ * A host (e.g. ObjectStack Cloud) injects a resolver to own per-request
+ * kernel selection. The framework ships NO multi-tenant implementation — all
+ * hostname→env strategy, the per-env kernel cache, and the control plane live
+ * in the host distribution (`@objectstack/objectos-runtime`). When no resolver
+ * is injected the dispatcher serves every request from its single
+ * `defaultKernel` (single-environment mode).
+ *
+ * Returning `undefined` routes the request to `defaultKernel` — resolvers use
+ * this for control-plane / unscoped / single-environment requests.
+ *
+ * As of ADR-0006 Phase 5 the resolver owns the ENTIRE per-request environment
+ * resolution, not just kernel selection: the dispatcher no longer performs any
+ * hostname / header / session → environment lookup of its own. The dispatcher
+ * provides parsing hints on the context (`routePath`, `urlEnvironmentId`) and
+ * expects the resolver to SET `context.environmentId` (and optionally
+ * `context.dataDriver`) for scoped requests — downstream dispatcher stages
+ * (project-membership enforcement, scope TTL touch, scoped service resolution)
+ * key off `context.environmentId`.
+ */
+interface KernelResolver {
+    resolveKernel(context: HttpProtocolContext, defaultKernel: ObjectKernel): Promise<ObjectKernel | undefined> | ObjectKernel | undefined;
+}
 /**
  * Optional configuration passed to the dispatcher constructor. Supports the
  * legacy `enforceProjectMembership` toggle plus the new multi-kernel
@@ -975,13 +911,16 @@ interface HttpDispatcherResult {
 interface HttpDispatcherOptions {
     enforceProjectMembership?: boolean;
     /**
-     * Optional {@link KernelManager}. When present, the dispatcher resolves
-     * `context.environmentId` first and then routes the request against the
-     * project's dedicated kernel via `kernelManager.getOrCreate(environmentId)`.
-     * Requests that fail to resolve a environmentId fall through to the
-     * constructor-supplied kernel (self-hosted / legacy behavior).
+     * Optional generic kernel-resolution seam (ADR-0006). The SOLE
+     * multi-tenant hook: the host's resolver owns env resolution + kernel
+     * selection per request (see {@link KernelResolver}). Falls back to
+     * `resolveService('kernel-resolver')`. Hosts that register none run
+     * single-environment on `defaultKernel`. (The legacy `kernelManager`
+     * option and the dispatcher's built-in hostname/header/session
+     * resolution were removed in ADR-0006 Phase 5 — that strategy lives in
+     * the cloud distribution's resolver now.)
      */
-    kernelManager?: KernelManager;
+    kernelResolver?: KernelResolver;
     /**
      * Optional {@link EnvironmentScopeManager}. When present, `touch(environmentId)` is
      * called on every scoped request so idle projects are evicted after TTL.
@@ -999,9 +938,8 @@ interface HttpDispatcherOptions {
 declare class HttpDispatcher {
     private kernel;
     private defaultKernel;
-    private envRegistry?;
     private defaultProject?;
-    private kernelManager?;
+    private kernelResolver?;
     private scopeManager?;
     /**
      * When `true`, scoped data-plane routes enforce a
@@ -1023,7 +961,13 @@ declare class HttpDispatcher {
     private static readonly SYSTEM_ENVIRONMENT_ID;
     /** Well-known platform org id — members bypass project membership. */
     private static readonly PLATFORM_ORG_ID;
-    constructor(kernel: ObjectKernel, envRegistry?: any, options?: HttpDispatcherOptions);
+    /**
+     * @param _envRegistryIgnored — RETIRED (ADR-0006 Phase 5). Environment
+     * resolution moved behind the host's {@link KernelResolver}; the
+     * positional parameter is kept so existing 3-arg callers keep compiling,
+     * but its value is ignored.
+     */
+    constructor(kernel: ObjectKernel, _envRegistryIgnored?: unknown, options?: HttpDispatcherOptions);
     private resolveDefaultProject;
     private success;
     private error;
@@ -1107,24 +1051,17 @@ declare class HttpDispatcher {
      */
     private extractEnvironmentIdFromPath;
     /**
-     * Resolve environment context for incoming request.
-     *
-     * Precedence:
-     * 0. URL path matches `/environments/:environmentId/...` OR request.params.environmentId set by router
-     *    → envRegistry.resolveById(id)
-     * 1. request.headers.host → envRegistry.resolveByHostname(host)
-     * 2. request.headers['x-environment-id'] → envRegistry.resolveById(id)
-     * 3. session.activeEnvironmentId → envRegistry.resolveById(id)
-     * 4. session.activeOrganizationId → find default project → envRegistry.resolveById(id)
-     * 5. single-environment default (registered by `createSingleEnvironmentPlugin`)
-     *    → envRegistry.resolveById(defaultProject.environmentId). Lets bare
-     *    `/api/v1/data/...` URLs resolve to the lone project in
-     *    `cloudUrl: 'local'` deployments.
+     * Attach the dispatcher's parsing hints for the host's
+     * {@link KernelResolver} (ADR-0006 Phase 5).
      *
-     * Skip for paths: /auth, /cloud, /health, /discovery (NOT /meta when scoped,
-     * so project-scoped meta routes can resolve their project).
+     * Environment RESOLUTION (hostname / x-environment-id / session /
+     * org-default / single-env-default → environment + driver) is owned by
+     * the host's resolver — the dispatcher no longer touches an environment
+     * registry. What stays here is pure URL parsing (the dispatcher's own
+     * routing convention): the scoped-path environment-id candidate and the
+     * cleaned route path, both UNVALIDATED.
      */
-    private resolveEnvironmentContext;
+    private prepareResolverHints;
     /**
      * Check whether the authenticated user is a member of
      * `context.environmentId`. Runs after {@link resolveEnvironmentContext}
@@ -1763,274 +1700,6 @@ declare function readArtifactSource(pathOrUrl: string, opts?: {
 declare function loadArtifactBundle(absArtifactPath: string, opts?: LoadArtifactBundleOptions): Promise<any | null>;
 declare function mergeRuntimeModule(bundle: any, artifactAbsPath: string, tag?: string): Promise<void>;
 
-/**
- * MarketplaceProxyPlugin
- *
- * Forwards `GET /api/v1/marketplace/*` from a tenant ObjectOS runtime to
- * the configured ObjectStack Cloud control-plane URL. The cloud endpoint
- * is unauthenticated and only exposes packages whose owner has opted in
- * to the public catalog (`sys_package.marketplace_listed = true`) — so the
- * proxy passes through without any credentials.
- *
- * Why proxy instead of direct browser → cloud:
- *   - The Console SPA stays on the tenant origin, so no CORS configuration
- *     is required on the cloud side.
- *   - Local-dev `os serve` works regardless of whether the developer's
- *     browser has cookies for cloud.objectos.ai.
- *   - Adds a single, easily auditable network seam between tenant and
- *     control plane.
- *
- * Install is NOT proxied here. Installing a package mutates control-plane
- * state and requires a cloud session + active organization context — the
- * Console SPA performs install by opening the cloud's install dialog in a
- * new tab so the user authenticates against cloud directly. A future
- * iteration may introduce a delegated install token; until then, browse
- * here and install on cloud.
- */
-
-interface MarketplaceProxyPluginConfig {
-    /**
-     * Control-plane base URL (e.g. https://cloud.objectos.ai). When the
-     * caller passes nothing AND the runtime has no OS_CLOUD_URL set, the
-     * plugin falls back to the public ObjectStack-operated cloud so that
-     * `objectstack dev` can browse the marketplace out of the box. Set
-     * OS_CLOUD_URL=off (or `local`) to opt out — the plugin then mounts
-     * a stub that responds 503 and the SPA renders an empty-state
-     * explaining marketplace is unavailable in this runtime.
-     */
-    controlPlaneUrl?: string;
-    /**
-     * Disable the in-memory response cache (testing / debugging).
-     * Defaults to the value of `OS_MARKETPLACE_CACHE` (anything in
-     * {"off","false","0","no"} disables).
-     */
-    cacheDisabled?: boolean;
-    /**
-     * Override the LRU upper bound. Defaults to 200 entries.
-     */
-    cacheMaxEntries?: number;
-    /**
-     * Public R2 base URL for marketplace snapshots. When set, GETs for
-     * snapshot-backed paths (`/packages`, `/packages/:id`,
-     * `/packages/:id/versions/:vid/manifest`) are fetched directly from
-     * R2 (CF edge) — bypassing the cloud control plane entirely.
-     * Defaults to the value of OS_MARKETPLACE_PUBLIC_BASE_URL. Empty
-     * string disables the public fast-path (legacy cloud-proxy only).
-     */
-    publicMarketplaceBaseUrl?: string;
-}
-declare class MarketplaceProxyPlugin implements Plugin {
-    readonly name = "com.objectstack.runtime.marketplace-proxy";
-    readonly version = "1.1.0";
-    private readonly cloudUrl;
-    private readonly publicBaseUrl;
-    private readonly cache;
-    constructor(config?: MarketplaceProxyPluginConfig);
-    init: (_ctx: PluginContext) => Promise<void>;
-    start: (ctx: PluginContext) => Promise<void>;
-}
-
-interface MarketplaceInstallLocalPluginConfig {
-    /** Cloud control-plane base URL. When unset, falls back to OS_CLOUD_URL
-     *  and then to the public ObjectStack cloud so a fresh `objectstack dev`
-     *  can install from the marketplace without configuration. Set
-     *  OS_CLOUD_URL=off to disable (the install endpoint then returns 503). */
-    controlPlaneUrl?: string;
-    /** Override the on-disk cache directory. Defaults to
-     *  `<cwd>/.objectstack/installed-packages`. */
-    storageDir?: string;
-}
-declare class MarketplaceInstallLocalPlugin implements Plugin {
-    readonly name = "com.objectstack.runtime.marketplace-install-local";
-    readonly version = "1.0.0";
-    private readonly cloudUrl;
-    private readonly storageDir;
-    constructor(config?: MarketplaceInstallLocalPluginConfig);
-    init: (_ctx: PluginContext) => Promise<void>;
-    start: (ctx: PluginContext) => Promise<void>;
-    /**
-     * Re-register every cached manifest with the kernel's manifest service.
-     * Safe to call on a kernel that already has the same manifest_id (the
-     * underlying ObjectQL registry overwrites by id, but we still warn so
-     * a developer can spot the dev-time clash between their config.ts and
-     * a marketplace package).
-     */
-    private rehydrate;
-    private handleInstall;
-    private handleList;
-    private handleUninstall;
-    /**
-     * Detect whether `manifestId` is already known to the kernel and classify
-     * the source so we can refuse vs upgrade gracefully.
-     *
-     *   'none'         — fresh install
-     *   'marketplace'  — previously installed by this plugin (allow upgrade)
-     *   'user-code'    — defined by AppPlugin from objectstack.config.ts
-     *                    (refuse to avoid silently overwriting authored code)
-     */
-    private findConflict;
-    /**
-     * Pull a userId out of the request's better-auth session, if any.
-     * Returns null when there is no signed-in user. v1 does not check
-     * admin role — UI gating + the auth requirement is sufficient for
-     * dev / single-tenant runtimes. Stricter checks can be layered on
-     * via a middleware in cloud-hosted multi-tenant deployments.
-     */
-    /**
-     * POST /api/v1/marketplace/install-local/:manifestId/reseed-sample-data
-     *
-     * Re-runs SeedLoaderService against the cached manifest's `data` arrays.
-     * Idempotent (upsert by id). Useful when:
-     *   • The user installed an app and skipped sample data
-     *   • A purge was undone
-     *   • The user wants a clean baseline back after editing demo rows
-     *
-     * Multi-tenant: requires an active organization on the session (same
-     * rule as install seed path).
-     */
-    private handleReseed;
-    /**
-     * POST /api/v1/marketplace/install-local/:manifestId/purge-sample-data
-     *
-     * Deletes every record whose id is declared in the cached manifest's
-     * seed datasets. Uses the `driver` service directly to bypass ACL /
-     * lifecycle hooks (same pattern as cloud purge). User-created records
-     * are never touched — only ids declared in the package's bundled
-     * datasets are removed. Already-deleted rows count as `skipped`.
-     */
-    private handlePurge;
-    /**
-     * Replicate the start-time side-effects that AppPlugin runs for
-     * statically-declared apps but the `manifest` service does NOT:
-     *
-     *   1. Load `manifest.translations` (array of `Record<locale, data>`)
-     *      into the i18n service — auto-creating an in-memory fallback if
-     *      none is registered, matching AppPlugin's behaviour.
-     *
-     *   2. Merge `manifest.data` (an array of seed datasets) into the
-     *      kernel's `seed-datasets` service so SecurityPlugin's per-org
-     *      replay middleware picks them up on every future
-     *      sys_organization insert.
-     *
-     *   3. When `seedNow=true`, also run the seed immediately so the user
-     *      sees demo data without having to create a new org:
-     *        • single-tenant: run SeedLoaderService inline (mirrors
-     *          AppPlugin single-tenant branch)
-     *        • multi-tenant: invoke `seed-replayer` for the caller's
-     *          active org (resolved from the request session)
-     *
-     * Errors are logged but never thrown — install succeeds even if
-     * post-register side-effects partially fail (the manifest itself is
-     * already registered + cached). Returns a small summary for the
-     * response envelope.
-     */
-    private applySideEffects;
-    /**
-     * Best-effort active-org resolution. Reads the better-auth session
-     * (same path as requireAuthenticatedUser) and returns
-     * `session.activeOrganizationId`, falling back to the user's first
-     * org membership.
-     */
-    private resolveActiveOrgId;
-    private requireAuthenticatedUser;
-    private readAll;
-}
-
-/**
- * RuntimeConfigPlugin
- *
- * Serves `GET /api/v1/runtime/config` (and the legacy alias
- * `GET /api/v1/studio/runtime-config`) from a tenant ObjectOS runtime so
- * the Console / Studio SPA can learn the upstream cloud URL and capability
- * flags **at boot time**, instead of sniffing `window.location.hostname`
- * or reading Vite-time env vars.
- *
- * Response shape (mirrors cloud's `createStudioRuntimeConfigPlugin`):
- *
- *   {
- *     cloudUrl: string,            // base URL of the upstream cloud
- *     singleEnvironment: false,    // multi-tenant runtime
- *     features: {
- *       installLocal: boolean,     // false here — install-local is owned
- *                                  // by CLI `serve` (single-tenant), not
- *                                  // by createObjectOSStack
- *       marketplace: boolean,      // true — MarketplaceProxyPlugin mounts
- *                                  // /api/v1/marketplace/*
- *     }
- *   }
- *
- * Registers its routes on the Hono raw app, parallel to MarketplaceProxy /
- * AuthProxy / MarketplaceInstallLocal plugins.
- */
-
-interface RuntimeConfigPluginConfig {
-    /**
-     * Upstream cloud base URL. Falls back to `resolveCloudUrl()` (reads
-     * `OS_CLOUD_URL` / built-in default) when omitted. Pass an explicit
-     * empty string to declare "this runtime IS the cloud" (same-origin
-     * for marketplace + install).
-     */
-    controlPlaneUrl?: string;
-    /** Override the `features.installLocal` flag. Default: false. */
-    installLocal?: boolean;
-    /**
-     * Override the `features.aiStudio` flag — whether the SPA should surface
-     * AI-driven metadata authoring ("online development") affordances. Default:
-     * true (the actual authoring capability is still gated server-side by the
-     * presence of the `metadata_assistant` agent / @objectstack/service-ai-studio
-     * package; set false to force-hide the authoring UI for a tier/deployment).
-     */
-    aiStudio?: boolean;
-    /**
-     * Report this runtime as a single-environment deployment (CLI
-     * `objectstack dev` / `os serve`). Defaults to `false` for
-     * multi-tenant ObjectOS.
-     */
-    singleEnvironment?: boolean;
-    /**
-     * Product name shown in browser title, splash screen, and other
-     * client chrome. Operators can override per-deployment (white-label,
-     * regional rebrands). Falls back to `OS_PRODUCT_NAME` env var, then
-     * to the default `'ObjectOS'`.
-     */
-    productName?: string;
-    /** Short product name (PWA shortName, compact spots). Defaults to productName. */
-    productShortName?: string;
-}
-declare class RuntimeConfigPlugin implements Plugin {
-    readonly name = "com.objectstack.runtime.runtime-config";
-    readonly version = "1.0.0";
-    private readonly cloudUrl;
-    private readonly installLocal;
-    private readonly aiStudio;
-    private readonly singleEnvironment;
-    private readonly productName;
-    private readonly productShortName;
-    constructor(config?: RuntimeConfigPluginConfig);
-    init: (_ctx: PluginContext) => Promise<void>;
-    start: (ctx: PluginContext) => Promise<void>;
-    destroy: () => Promise<void>;
-}
-
-/**
- * Shared marketplace / cloud control-plane defaults.
- *
- * Centralised so every plugin + the CLI auto-inject path agree on
- * "what cloud URL do we mean when the user didn't set OS_CLOUD_URL?".
- * Until we have a competing public hosted cloud, this points at the
- * ObjectStack-operated control plane so a vanilla `objectstack dev` can
- * browse the marketplace out of the box.
- */
-declare const DEFAULT_CLOUD_URL = "https://cloud.objectos.ai";
-/**
- * Resolve the effective control-plane URL from an explicit constructor
- * value, the OS_CLOUD_URL env var, or the default. Returns an empty
- * string when the caller explicitly disabled cloud with
- * `OS_CLOUD_URL=off` / `local` — callers should treat that as
- * "marketplace unavailable on this runtime".
- */
-declare function resolveCloudUrl(explicit?: string | null): string;
-
 /**
  * # Hook & Action Body Sandbox
  *
@@ -2261,4 +1930,4 @@ declare function actionBodyRunnerFactory(runner: ScriptRunner, opts: FactoryOpti
     timeoutMs?: number;
 }) => ((actionCtx: any) => Promise<unknown>) | undefined;
 
-export { AppPlugin, DEFAULT_CLOUD_URL, DEFAULT_RATE_LIMITS, type DefaultHostConfigOptions, type DefaultHostConfigResult, type DispatcherPluginConfig, DriverPlugin, type EnvironmentDriverRegistry, type ExternalSchemaDriftEvent, ExternalValidationPlugin, HttpDispatcher, type HttpDispatcherResult, type HttpProtocolContext, HttpServer, type KernelManager, type LoadArtifactBundleOptions, MarketplaceInstallLocalPlugin, type MarketplaceInstallLocalPluginConfig, MarketplaceProxyPlugin, type MarketplaceProxyPluginConfig, MiddlewareManager, ObservabilityServicePlugin, type ObservabilityServicePluginOptions, QuickJSScriptRunner, type QuickJSScriptRunnerOptions, type RateLimitBucketConfig, type RateLimitDecision, type RateLimitDefaults, type RateLimitStore, RateLimiter, Runtime, type RuntimeConfig, RuntimeConfigPlugin, type RuntimeConfigPluginConfig, SYSTEM_ENVIRONMENT_ID, SandboxError, type ScriptContext, type ScriptOrigin, type ScriptResult, type ScriptRunOptions, type ScriptRunner, type SecurityHeadersOptions, SeedLoaderService, type StandaloneStackConfig, type StandaloneStackResult, type SystemEnvironmentPluginConfig, type TraceContext, UnimplementedScriptRunner, actionBodyRunnerFactory, buildSecurityHeaders, collectBundleActions, collectBundleFunctions, collectBundleHooks, createDefaultHostConfig, createDispatcherPlugin, createExternalValidationPlugin, createStandaloneStack, createSystemEnvironmentPlugin, extractRequestId, formatTraceparent, generateRequestId, hookBodyRunnerFactory, isHttpUrl, loadArtifactBundle, mergeRuntimeModule, parseTraceparent, readArtifactSource, resolveCloudUrl, resolveDefaultArtifactPath, resolveErrorReporter, resolveMetrics, resolveObjectStackHome, resolveRequestId };
+export { AppPlugin, DEFAULT_RATE_LIMITS, type DefaultHostConfigOptions, type DefaultHostConfigResult, type DispatcherPluginConfig, DriverPlugin, type ExternalSchemaDriftEvent, ExternalValidationPlugin, HttpDispatcher, type HttpDispatcherResult, type HttpProtocolContext, HttpServer, type KernelResolver, type LoadArtifactBundleOptions, MiddlewareManager, ObservabilityServicePlugin, type ObservabilityServicePluginOptions, QuickJSScriptRunner, type QuickJSScriptRunnerOptions, type RateLimitBucketConfig, type RateLimitDecision, type RateLimitDefaults, type RateLimitStore, RateLimiter, Runtime, type RuntimeConfig, SYSTEM_ENVIRONMENT_ID, SandboxError, type ScriptContext, type ScriptOrigin, type ScriptResult, type ScriptRunOptions, type ScriptRunner, type SecurityHeadersOptions, type StandaloneStackConfig, type StandaloneStackResult, type SystemEnvironmentPluginConfig, type TraceContext, UnimplementedScriptRunner, actionBodyRunnerFactory, buildSecurityHeaders, collectBundleActions, collectBundleFunctions, collectBundleHooks, createDefaultHostConfig, createDispatcherPlugin, createExternalValidationPlugin, createStandaloneStack, createSystemEnvironmentPlugin, extractRequestId, formatTraceparent, generateRequestId, hookBodyRunnerFactory, isHttpUrl, loadArtifactBundle, mergeRuntimeModule, parseTraceparent, readArtifactSource, resolveDefaultArtifactPath, resolveErrorReporter, resolveMetrics, resolveObjectStackHome, resolveRequestId };