@objectstack/runtime 9.9.0 → 9.10.0

package/dist/index.cjs

@@ -227,7 +227,7 @@ var init_package_state_store = __esm({
 });
 
 // src/sandbox/quickjs-runner.ts
-function installApiMethod(vm, parent, method, objectName, ctx, caps, required, origin) {
+function installApiMethod(vm, parent, method, objectName, ctx, caps, required, origin, txState) {
   const fn = vm.newFunction(method, (...argHandles) => {
     if (!caps.has(required)) {
       throw new SandboxError(
@@ -242,7 +242,8 @@ function installApiMethod(vm, parent, method, objectName, ctx, caps, required, o
     const deferred = vm.newPromise();
     void (async () => {
       try {
-        const proxy = apiAny.object(objectName);
+        const source = txState.api ?? apiAny;
+        const proxy = source.object(objectName);
         const m = proxy[method];
         if (typeof m !== "function") {
           throw new SandboxError(`ctx.api.object('${objectName}').${method} not implemented`);
@@ -388,8 +389,9 @@ var init_quickjs_runner = __esm({
         const start = Date.now();
         const deadline = start + args.timeoutMs;
         runtime.setInterruptHandler(() => Date.now() > deadline);
+        const txState = { api: null, handle: null, open: false };
         try {
-          this.installCtx(vm, args.ctx, new Set(args.capabilities), args.origin);
+          this.installCtx(vm, args.ctx, new Set(args.capabilities), args.origin, txState);
           if (args.isExpression) {
             const wrapped2 = `globalThis.__result = JSON.stringify((function(){ return (${args.source}); })());`;
             const result = vm.evalCode(wrapped2);
@@ -452,6 +454,16 @@ var init_quickjs_runner = __esm({
             pumps++;
           }
         } finally {
+          if (txState.open && txState.handle != null) {
+            const apiTx = args.ctx.api;
+            const rollback = apiTx?.rollbackTransaction;
+            if (typeof rollback === "function") {
+              try {
+                await rollback.call(apiTx, txState.handle);
+              } catch {
+              }
+            }
+          }
           vm.dispose();
         }
       }
@@ -464,7 +476,7 @@ var init_quickjs_runner = __esm({
        * {@link installApiMethod}) so they may return Promises (real ObjectQL
        * `find/count/insert/...` are async) without asyncify's single-unwind limit.
        */
-      installCtx(vm, ctx, caps, origin) {
+      installCtx(vm, ctx, caps, origin, txState) {
         setGlobalJson(vm, "__input", ctx.input);
         setGlobalJson(vm, "__previous", ctx.previous);
         const ctxObj = vm.newObject();
@@ -499,12 +511,70 @@ var init_quickjs_runner = __esm({
           const wrap = vm.newObject();
           const READ = ["find", "findOne", "count", "aggregate"];
           const WRITE = ["insert", "update", "delete", "updateMany", "deleteMany", "upsert"];
-          for (const m of READ) installApiMethod(vm, wrap, m, objectName, ctx, caps, "api.read", origin);
-          for (const m of WRITE) installApiMethod(vm, wrap, m, objectName, ctx, caps, "api.write", origin);
+          for (const m of READ) installApiMethod(vm, wrap, m, objectName, ctx, caps, "api.read", origin, txState);
+          for (const m of WRITE) installApiMethod(vm, wrap, m, objectName, ctx, caps, "api.write", origin, txState);
           return wrap;
         });
         vm.setProp(apiObj, "object", objectFn);
         objectFn.dispose();
+        const apiTx = ctx.api;
+        const installTxLeaf = (name, run) => {
+          const fn = vm.newFunction(name, () => {
+            if (!caps.has("api.transaction")) {
+              throw new SandboxError(
+                `capability 'api.transaction' not granted to ${origin.kind} '${origin.name}' (called ctx.api.transaction)`
+              );
+            }
+            const deferred = vm.newPromise();
+            void (async () => {
+              try {
+                await run();
+                if (!vm.alive) return;
+                deferred.resolve(vm.undefined);
+              } catch (err) {
+                if (!vm.alive) return;
+                const errH = err instanceof Error ? vm.newError({ name: err.name || "Error", message: err.message }) : vm.newError({ name: "Error", message: String(err) });
+                deferred.reject(errH);
+                errH.dispose();
+              }
+            })();
+            return deferred.handle;
+          });
+          vm.setProp(apiObj, name, fn);
+          fn.dispose();
+        };
+        installTxLeaf("__txBegin", async () => {
+          if (txState.open) throw new SandboxError("nested ctx.api.transaction is not supported");
+          const begin = apiTx?.beginTransaction;
+          if (typeof begin === "function") {
+            const r = await begin.call(apiTx) ?? null;
+            if (r) {
+              txState.api = r.ctx;
+              txState.handle = r.handle;
+            }
+          }
+          txState.open = true;
+        });
+        installTxLeaf("__txCommit", async () => {
+          const { handle, open } = txState;
+          txState.api = null;
+          txState.handle = null;
+          txState.open = false;
+          const commit = apiTx?.commitTransaction;
+          if (open && handle != null && typeof commit === "function") {
+            await commit.call(apiTx, handle);
+          }
+        });
+        installTxLeaf("__txRollback", async () => {
+          const { handle, open } = txState;
+          txState.api = null;
+          txState.handle = null;
+          txState.open = false;
+          const rollback = apiTx?.rollbackTransaction;
+          if (open && handle != null && typeof rollback === "function") {
+            await rollback.call(apiTx, handle);
+          }
+        });
         vm.setProp(ctxObj, "api", apiObj);
         apiObj.dispose();
         const logObj = vm.newObject();
@@ -537,6 +607,25 @@ var init_quickjs_runner = __esm({
         cryptoObj.dispose();
         vm.setProp(vm.global, "__ctx", ctxObj);
         ctxObj.dispose();
+        const sugar = vm.evalCode(
+          `__ctx.api.transaction = async function (fn) {
+         await __ctx.api.__txBegin();
+         try {
+           var r = await fn();
+           await __ctx.api.__txCommit();
+           return r;
+         } catch (e) {
+           await __ctx.api.__txRollback();
+           throw e;
+         }
+       };`
+        );
+        if (sugar.error) {
+          const msg = vm.dump(sugar.error);
+          sugar.error.dispose();
+          throw new SandboxError(`failed to install ctx.api.transaction: ${formatErr(msg)}`);
+        }
+        sugar.value.dispose();
       }
     };
     SandboxError = class extends Error {
@@ -796,14 +885,13 @@ function collectBundleFunctions(bundle) {
   merge(bundle?.manifest?.functions);
   return out;
 }
-var import_types, import_system, AppPlugin;
+var import_types, AppPlugin;
 var init_app_plugin = __esm({
   "src/app-plugin.ts"() {
     "use strict";
     import_types = require("@objectstack/types");
     init_seed_loader();
     init_package_state_store();
-    import_system = require("@objectstack/spec/system");
     init_quickjs_runner();
     init_body_runner();
     AppPlugin = class {
@@ -1069,7 +1157,7 @@ var init_app_plugin = __esm({
               ...d,
               object: d.object
             }));
-            const seedIdentity = await this.ensureSeedIdentity(ql, ctx.logger);
+            const seedIdentity = void 0;
             try {
               const kernel = ctx.kernel;
               const existing = (() => {
@@ -1112,10 +1200,10 @@ var init_app_plugin = __esm({
                     defaultMode: "upsert",
                     multiPass: true,
                     organizationId,
-                    // Bind os.user (system identity) and os.org (this
-                    // tenant) so identity-derived seed values resolve
-                    // per-org. org.id falls back to organizationId
-                    // inside the loader when identity.org is absent.
+                    // `os.org` is derived from organizationId inside
+                    // the loader. `seedIdentity` (os.user) is undefined
+                    // unless a seed embeds `cel`os.user.id`` — see the
+                    // lazy guard where it is resolved.
                     identity: seedIdentity
                   }
                 });
@@ -1275,64 +1363,6 @@ var init_app_plugin = __esm({
         this.name = `plugin.app.${appId}`;
         this.version = sys?.version;
       }
-      /**
-       * Resolve the identity bound to `os.user` / `os.org` for seed CEL values.
-       *
-       * On a fresh boot there are zero users until the first human sign-up
-       * (which the SeedLoader runs *before*), so identity-derived seeds like
-       * `owner_id: cel`os.user.id`` had nothing to resolve against and were
-       * dropped silently. To make seeds deterministic and self-sufficient we
-       * upsert a single non-loginable **system user** (`usr_system`) and bind
-       * it as `os.user`.
-       *
-       * Why a dedicated system user rather than the login admin:
-       *  - `sys_user` is better-auth-managed and schema-locked (ADR-0010); the
-       *    password lives in `sys_account`, so a *loginable* admin can only be
-       *    minted through better-auth (the CLI does this via HTTP sign-up after
-       *    boot). A raw insert here would bypass those invariants.
-       *  - `usr_system` is an owner identity only (no credential row), analogous
-       *    to Salesforce's "Automated Process" user. The human admin is created
-       *    independently and need not be the seed owner.
-       *
-       * Idempotent: matches by the stable id, inserts once, reuses thereafter.
-       * Failures are non-fatal (logged) — records that actually need `os.user`
-       * then fail loudly in the loader with an actionable message.
-       */
-      async ensureSeedIdentity(ql, logger) {
-        const SYSTEM_USER_ID = import_system.SystemUserId.SYSTEM;
-        const SYSTEM_USER_EMAIL = "system@objectstack.local";
-        const identity = { user: { id: SYSTEM_USER_ID, role: "system", email: SYSTEM_USER_EMAIL } };
-        const opts = { context: { isSystem: true } };
-        try {
-          const existing = await ql.find(
-            "sys_user",
-            { where: { id: SYSTEM_USER_ID }, limit: 1 },
-            opts
-          );
-          if (Array.isArray(existing) && existing.length > 0) {
-            return identity;
-          }
-          await ql.insert(
-            "sys_user",
-            {
-              id: SYSTEM_USER_ID,
-              name: "System",
-              email: SYSTEM_USER_EMAIL,
-              email_verified: true,
-              role: "system"
-            },
-            opts
-          );
-          logger.info(
-            `[Seeder] Provisioned deterministic system user (${SYSTEM_USER_ID}) as seed owner \u2014 binds os.user for identity-derived seed values`
-          );
-        } catch (err) {
-          logger.warn("[Seeder] Failed to ensure system seed user; os.user-dependent seeds may be dropped", {
-            error: err?.message ?? String(err)
-          });
-        }
-        return identity;
-      }
       /**
        * Emit a kernel hook so the control-plane `AppCatalogService` can
        * upsert / delete the corresponding `sys_app` row. Silently no-ops
@@ -1950,7 +1980,7 @@ function safeGet(ctx, name) {
 
 // src/http-dispatcher.ts
 var import_core3 = require("@objectstack/core");
-var import_system2 = require("@objectstack/spec/system");
+var import_system = require("@objectstack/spec/system");
 var import_shared2 = require("@objectstack/spec/shared");
 init_package_state_store();
 
@@ -2695,7 +2725,7 @@ var _HttpDispatcher = class _HttpDispatcher {
     let userId;
     let activeOrganizationId;
     try {
-      const authService = await this.resolveService(import_system2.CoreServiceName.enum.auth);
+      const authService = await this.resolveService(import_system.CoreServiceName.enum.auth);
       const sessionData = await authService?.api?.getSession?.({
         headers: context.request?.headers
       });
@@ -2764,21 +2794,21 @@ var _HttpDispatcher = class _HttpDispatcher {
       queueSvc,
       jobSvc
     ] = await Promise.all([
-      this.resolveService(import_system2.CoreServiceName.enum.auth),
-      this.resolveService(import_system2.CoreServiceName.enum.graphql),
-      this.resolveService(import_system2.CoreServiceName.enum.search),
-      this.resolveService(import_system2.CoreServiceName.enum.realtime),
-      this.resolveService(import_system2.CoreServiceName.enum["file-storage"]),
-      this.resolveService(import_system2.CoreServiceName.enum.analytics),
-      this.resolveService(import_system2.CoreServiceName.enum.workflow),
-      this.resolveService(import_system2.CoreServiceName.enum.ai),
-      this.resolveService(import_system2.CoreServiceName.enum.notification),
-      this.resolveService(import_system2.CoreServiceName.enum.i18n),
-      this.resolveService(import_system2.CoreServiceName.enum.ui),
-      this.resolveService(import_system2.CoreServiceName.enum.automation),
-      this.resolveService(import_system2.CoreServiceName.enum.cache),
-      this.resolveService(import_system2.CoreServiceName.enum.queue),
-      this.resolveService(import_system2.CoreServiceName.enum.job)
+      this.resolveService(import_system.CoreServiceName.enum.auth),
+      this.resolveService(import_system.CoreServiceName.enum.graphql),
+      this.resolveService(import_system.CoreServiceName.enum.search),
+      this.resolveService(import_system.CoreServiceName.enum.realtime),
+      this.resolveService(import_system.CoreServiceName.enum["file-storage"]),
+      this.resolveService(import_system.CoreServiceName.enum.analytics),
+      this.resolveService(import_system.CoreServiceName.enum.workflow),
+      this.resolveService(import_system.CoreServiceName.enum.ai),
+      this.resolveService(import_system.CoreServiceName.enum.notification),
+      this.resolveService(import_system.CoreServiceName.enum.i18n),
+      this.resolveService(import_system.CoreServiceName.enum.ui),
+      this.resolveService(import_system.CoreServiceName.enum.automation),
+      this.resolveService(import_system.CoreServiceName.enum.cache),
+      this.resolveService(import_system.CoreServiceName.enum.queue),
+      this.resolveService(import_system.CoreServiceName.enum.job)
     ]);
     const hasAuth = !!authSvc;
     const hasGraphQL = !!(graphqlSvc || this.kernel.graphql);
@@ -2899,7 +2929,7 @@ var _HttpDispatcher = class _HttpDispatcher {
    * path: sub-path after /auth/
    */
   async handleAuth(path, method, body, context) {
-    const authService = await this.getService(import_system2.CoreServiceName.enum.auth);
+    const authService = await this.getService(import_system.CoreServiceName.enum.auth);
     if (authService && typeof authService.handler === "function") {
       const response = await authService.handler(context.request, context.response);
       return { handled: true, result: response };
@@ -2997,7 +3027,7 @@ var _HttpDispatcher = class _HttpDispatcher {
     if (parts.length >= 3 && parts[parts.length - 1] === "published" && (!method || method === "GET")) {
       const type = parts[0];
       const name = parts.slice(1, -1).join("/");
-      const metadataService = await this.getService(import_system2.CoreServiceName.enum.metadata);
+      const metadataService = await this.getService(import_system.CoreServiceName.enum.metadata);
       if (metadataService && typeof metadataService.getPublished === "function") {
         const data = await metadataService.getPublished(type, name);
         if (data === void 0) return { handled: true, response: this.error("Not found", 404) };
@@ -3127,7 +3157,7 @@ var _HttpDispatcher = class _HttpDispatcher {
         } catch {
         }
       }
-      const metadataService = await this.getService(import_system2.CoreServiceName.enum.metadata);
+      const metadataService = await this.getService(import_system.CoreServiceName.enum.metadata);
       if (metadataService && typeof metadataService.list === "function") {
         try {
           let items = await metadataService.list(typeOrName);
@@ -3261,7 +3291,7 @@ var _HttpDispatcher = class _HttpDispatcher {
    * path: sub-path after /analytics/
    */
   async handleAnalytics(path, method, body, _context) {
-    const analyticsService = await this.getService(import_system2.CoreServiceName.enum.analytics);
+    const analyticsService = await this.getService(import_system.CoreServiceName.enum.analytics);
     if (!analyticsService) return { handled: false };
     const m = method.toUpperCase();
     const subPath = path.replace(/^\/+/, "");
@@ -3293,7 +3323,7 @@ var _HttpDispatcher = class _HttpDispatcher {
    *   POST /read/all   → markAllRead
    */
   async handleNotification(path, method, body, query, context) {
-    const service = await this.resolveService(import_system2.CoreServiceName.enum.notification, context.environmentId);
+    const service = await this.resolveService(import_system.CoreServiceName.enum.notification, context.environmentId);
     if (!service || typeof service.listInbox !== "function") return { handled: false };
     const userId = context.executionContext?.userId;
     if (!userId) {
@@ -3331,7 +3361,7 @@ var _HttpDispatcher = class _HttpDispatcher {
    *   GET /labels/:object?locale=xx   → getFieldLabels  (locale from query)
    */
   async handleI18n(path, method, query, _context) {
-    const i18nService = await this.getService(import_system2.CoreServiceName.enum.i18n);
+    const i18nService = await this.getService(import_system.CoreServiceName.enum.i18n);
     if (!i18nService) return { handled: true, response: this.error("i18n service not available", 501) };
     const m = method.toUpperCase();
     const parts = path.replace(/^\/+/, "").split("/").filter(Boolean);
@@ -3449,7 +3479,7 @@ var _HttpDispatcher = class _HttpDispatcher {
       }
       if (parts.length === 2 && parts[1] === "publish" && m === "POST") {
         const id = decodeURIComponent(parts[0]);
-        const metadataService = await this.getService(import_system2.CoreServiceName.enum.metadata);
+        const metadataService = await this.getService(import_system.CoreServiceName.enum.metadata);
         if (metadataService && typeof metadataService.publishPackage === "function") {
           const result = await metadataService.publishPackage(id, body || {});
           return { handled: true, response: this.success(result) };
@@ -3535,7 +3565,7 @@ var _HttpDispatcher = class _HttpDispatcher {
       }
       if (parts.length === 2 && parts[1] === "revert" && m === "POST") {
         const id = decodeURIComponent(parts[0]);
-        const metadataService = await this.getService(import_system2.CoreServiceName.enum.metadata);
+        const metadataService = await this.getService(import_system.CoreServiceName.enum.metadata);
         if (metadataService && typeof metadataService.revertPackage === "function") {
           await metadataService.revertPackage(id);
           return { handled: true, response: this.success({ success: true }) };
@@ -3713,7 +3743,7 @@ var _HttpDispatcher = class _HttpDispatcher {
    */
   async applyPublishedSeeds(names, organizationId, _context) {
     const protocol = await this.resolveService("protocol");
-    const metadata = await this.getService(import_system2.CoreServiceName.enum.metadata);
+    const metadata = await this.getService(import_system.CoreServiceName.enum.metadata);
     const ql = await this.resolveService("objectql");
     if (!protocol || typeof protocol.getMetaItem !== "function" || !ql || !metadata) {
       return { success: false, error: "seed apply: required services unavailable" };
@@ -3766,7 +3796,7 @@ var _HttpDispatcher = class _HttpDispatcher {
    */
   async resolveActiveOrganizationId(context) {
     try {
-      const authService = await this.resolveService(import_system2.CoreServiceName.enum.auth);
+      const authService = await this.resolveService(import_system.CoreServiceName.enum.auth);
       const rawHeaders = context.request?.headers;
       let headers = rawHeaders;
       if (rawHeaders && typeof rawHeaders === "object" && typeof rawHeaders.get !== "function") {
@@ -3794,7 +3824,7 @@ var _HttpDispatcher = class _HttpDispatcher {
    * path: sub-path after /storage/
    */
   async handleStorage(path, method, file, context) {
-    const storageService = await this.getService(import_system2.CoreServiceName.enum["file-storage"]) || this.kernel.services?.["file-storage"];
+    const storageService = await this.getService(import_system.CoreServiceName.enum["file-storage"]) || this.kernel.services?.["file-storage"];
     if (!storageService) {
       return { handled: true, response: this.error("File storage not configured", 501) };
     }
@@ -3873,7 +3903,7 @@ var _HttpDispatcher = class _HttpDispatcher {
    *   GET    /:name/runs/:runId/screen → the screen a paused run awaits
    */
   async handleAutomation(path, method, body, context, query) {
-    const automationService = await this.getService(import_system2.CoreServiceName.enum.automation);
+    const automationService = await this.getService(import_system.CoreServiceName.enum.automation);
     if (!automationService) return { handled: false };
     const m = method.toUpperCase();
     const parts = path.replace(/^\/+/, "").split("/").filter(Boolean);