@ossy/platform 1.39.3 → 3.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/platform",
-  "version": "1.39.3",
+  "version": "3.0.1",
   "description": "Ossy application server runtime",
   "repository": {
     "type": "git",
@@ -44,16 +44,16 @@
     "@aws-sdk/util-create-request": "^3.972.26",
     "@aws-sdk/util-format-url": "^3.972.17",
     "@modelcontextprotocol/sdk": "^1.12.1",
-    "@ossy/app": "^1.40.3",
-    "@ossy/event-store": "^1.8.3",
-    "@ossy/locale": "^1.40.3",
-    "@ossy/observability": "^1.8.3",
-    "@ossy/policies": "^1.13.3",
-    "@ossy/schema": "^1.0.1",
-    "@ossy/sdk": "^1.40.3",
-    "@ossy/tokens": "^1.13.3",
-    "@ossy/users": "^1.13.3",
-    "@ossy/workspaces": "^1.17.3",
+    "@ossy/app": "^3.0.1",
+    "@ossy/event-store": "^3.0.1",
+    "@ossy/locale": "^3.0.1",
+    "@ossy/observability": "^3.0.1",
+    "@ossy/policies": "^3.0.1",
+    "@ossy/schema": "^3.0.1",
+    "@ossy/sdk": "^3.0.1",
+    "@ossy/tokens": "^3.0.1",
+    "@ossy/users": "^3.0.1",
+    "@ossy/workspaces": "^3.0.1",
     "cookie-parser": "^1.4.7",
     "dotenv": ">=16.0.0 <18.0.0",
     "express": ">=5.0.0 <6.0.0",
@@ -73,5 +73,5 @@
     "src",
     "Dockerfile"
   ],
-  "gitHead": "a0d89185a17f8de8ce328c3a648c108ff1d61d8f"
+  "gitHead": "4a70ec216448680d2fddc57b2a8a0077489720ae"
 }

package/src/Definition.js

@@ -3,6 +3,6 @@ export const Definition = {
   title: 'Platform',
   description: 'Deployment platform configuration aligned with deployment-tools S3 platform-config.json.',
   icon: 'controller',
-  statuses: ['beta'],
+  status: ['beta'],
   entitlementRequired: false,
 }

package/src/PlatformShell.jsx

@@ -25,12 +25,12 @@ import { ComponentSlotsProvider, Slot } from '@ossy/design-system'
 export function PlatformShell({ slots = {}, children }) {
   return (
     <ComponentSlotsProvider slots={slots}>
-      <Slot name="app:system-messages" />
-      <Slot name="app:header" />
-      <Slot name="app:sidebar" />
-      <Slot name="app:toolbar" />
+      <Slot view="app:system-messages" />
+      <Slot view="app:header" />
+      <Slot view="app:sidebar" />
+      <Slot view="app:toolbar" />
       {children}
-      <Slot name="app:notifications" />
+      <Slot view="app:notifications" />
     </ComponentSlotsProvider>
   )
 }

package/src/actions/action.service.js

@@ -62,7 +62,7 @@ export const ActionService = {
    * Invoke an action by id — records audit, runs the derived primary task, dispatches on_action follow-ups.
    *
    * @param {string} id
-   * @param {{ payload?: unknown, sdk?: unknown, log?: unknown, integrations?: unknown, req?: unknown }} context
+   * @param {{ payload?: unknown, sdk?: unknown, log?: unknown, integrations?: unknown, req?: unknown, signal?: AbortSignal }} context
    * @returns {Promise<unknown>}
    */
   async invoke (id, context = {}) {
@@ -92,6 +92,11 @@ export const ActionService = {
 
     try {
       const result = await TaskService.invoke(taskId, invokeContext)
+      if (context.signal?.aborted) {
+        throw context.signal.reason instanceof Error
+          ? context.signal.reason
+          : new Error(`[ActionService] Action aborted: "${id}"`)
+      }
       const taskRunId = invokeContext.audit?.taskRunId ?? null
 
       if (!skipAudit) {

package/src/audit/action-invocation-service.js

@@ -3,7 +3,6 @@ import { Aggregate } from '@ossy/event-store'
 import { createLogger } from '@ossy/observability'
 import { taskIdFromActionId } from '@ossy/schema'
 import { ActionInvocation } from './action-invocation.aggregate.js'
-import { PlatformSchema } from '../schema-ids.js'
 import { MeteringService } from '../metering/metering-service.js'
 import { detectChannel } from './detect-channel.js'
 import {
@@ -42,7 +41,7 @@ export const ActionInvocationService = {
     try {
       await Aggregate.Of(ActionInvocation, {
         resourceId: invocationId,
-        type: PlatformSchema.actionInvocation,
+        type: '@ossy/platform/schema/action-invocation',
         event: 'Invoked',
         createdBy: actorId ?? undefined,
         payload: {

package/src/audit/action-invocation.aggregate.js

@@ -1,12 +1,10 @@
-import { PlatformSchema } from '../schema-ids.js'
-
 /**
  * ADR 0008 entity — audit record for each action invocation (POST /actions, MCP, SDK).
  */
 export class ActionInvocation {
 
   static kind = 'entity'
-  static SchemaId = PlatformSchema.actionInvocation
+  static SchemaId = '@ossy/platform/schema/action-invocation'
   static AggregateType = 'ActionInvocation'
 
   static View (events, state = {}) {

package/src/audit/task-run-list.aggregate.js

@@ -1,5 +1,3 @@
-import { PlatformSchema } from '../schema-ids.js'
-
 /**
  * ADR 0008 projection — workspace-scoped task run list for UI and billing queries.
  */
@@ -9,9 +7,9 @@ export class TaskRunListProjection {
   static ProjectionId = '@ossy/platform/data/task-run-list'
 
   static sources = [
-    { type: PlatformSchema.taskRun, event: 'Started' },
-    { type: PlatformSchema.taskRun, event: 'Completed' },
-    { type: PlatformSchema.taskRun, event: 'Failed' },
+    { type: '@ossy/platform/schema/task-run', event: 'Started' },
+    { type: '@ossy/platform/schema/task-run', event: 'Completed' },
+    { type: '@ossy/platform/schema/task-run', event: 'Failed' },
   ]
 
   static scopeFromEvent (event) {

package/src/audit/task-run-service.js

@@ -2,7 +2,6 @@ import { nanoid } from 'nanoid'
 import { Aggregate } from '@ossy/event-store'
 import { createLogger, metrics } from '@ossy/observability'
 import { TaskRun } from './task-run.aggregate.js'
-import { PlatformSchema } from '../schema-ids.js'
 import { MeteringService } from '../metering/metering-service.js'
 import { detectChannel } from './detect-channel.js'
 import {
@@ -12,9 +11,18 @@ import {
   summarizeError,
   summarizeResult,
 } from './audit-helpers.js'
+import { rejectOnAbort } from '../request-diagnostics.js'
 
 const log = createLogger('platform/task-run')
 
+function assertNotAborted (context) {
+  if (context.signal?.aborted) {
+    throw context.signal.reason instanceof Error
+      ? context.signal.reason
+      : new Error('Operation aborted')
+  }
+}
+
 function recordTaskMetrics (taskId, durationMs) {
   try { metrics.timing('task.duration', durationMs, { task: taskId }) } catch {}
   try { metrics.increment('task.run', { task: taskId }) } catch {}
@@ -49,6 +57,10 @@ export const TaskRunService = {
     } = opts
 
     if (audit === false) {
+      assertNotAborted(context)
+      if (context.signal) {
+        return Promise.race([handler(context), rejectOnAbort(context.signal)])
+      }
       return handler(context)
     }
 
@@ -72,7 +84,10 @@ export const TaskRunService = {
     })
 
     try {
-      const result = await handler(context)
+      assertNotAborted(context)
+      const result = context.signal
+        ? await Promise.race([handler(context), rejectOnAbort(context.signal)])
+        : await handler(context)
       const durationMs = Date.now() - startMs
       await TaskRunService._appendCompleted({
         runId,
@@ -145,7 +160,7 @@ export const TaskRunService = {
     try {
       await Aggregate.Of(TaskRun, {
         resourceId: runId,
-        type: PlatformSchema.taskRun,
+        type: '@ossy/platform/schema/task-run',
         event: 'Started',
         createdBy: actorId ?? undefined,
         payload: {

package/src/audit/task-run.aggregate.js

@@ -1,12 +1,10 @@
-import { PlatformSchema } from '../schema-ids.js'
-
 /**
  * ADR 0008 entity — one stream per task execution (sync invoke, changestream, cron, on_action).
  */
 export class TaskRun {
 
   static kind = 'entity'
-  static SchemaId = PlatformSchema.taskRun
+  static SchemaId = '@ossy/platform/schema/task-run'
   static AggregateType = 'TaskRun'
 
   static View (events, state = {}) {

package/src/directory.schema.js

@@ -1,7 +1,5 @@
-import { PlatformSchema } from './schema-ids.js'
-
 export default {
-  id: PlatformSchema.directory,
+  id: '@ossy/platform/schema/directory',
   name: 'Directory',
   categoryName: 'Platform',
   icon: 'folder',

package/src/file.schema.js

@@ -1,7 +1,5 @@
-import { PlatformSchema } from './schema-ids.js'
-
 export default {
-  id: PlatformSchema.file,
+  id: '@ossy/platform/schema/file',
   name: 'File',
   categoryName: 'Platform',
   icon: 'file',

package/src/index.js

@@ -4,7 +4,6 @@ export { ChangeStream } from './tasks/change-stream.js'
 export { registerSchema, getSystemSchemas } from './resources/schema.registry.js'
 export { getPlatformSchema, initPlatformSchema, createSchemaEngine, schemaForWorkspace } from './resources/schema.service.js'
 export { validateSchemasForImport, ALLOWED_FIELD_TYPES, normalizeFieldType, resolveFieldDef } from './resources/schema.validation.js'
-export { PlatformSchema } from './schema-ids.js'
 export { IntegrationService } from './integration.service.js'
 export { ConfigService } from './config.service.js'
 export { ActionService } from './actions/action.service.js'

package/src/metering/metering-service.js

@@ -1,7 +1,6 @@
 import { nanoid } from 'nanoid'
 import { EventStore } from '@ossy/event-store'
 import { createLogger, metrics } from '@ossy/observability'
-import { PlatformSchema } from '../schema-ids.js'
 import { moduleIdFromTaskId } from '../audit/audit-helpers.js'
 
 const log = createLogger('platform/metering')
@@ -73,7 +72,7 @@ export const MeteringService = {
     try {
       await EventStore.AppendResourceEvent({
         id: nanoid(),
-        type: PlatformSchema.meterEvent,
+        type: '@ossy/platform/schema/meter-event',
         resourceId: nanoid(),
         event: 'Recorded',
         version: 1,

package/src/push/mount-push-sse.js

@@ -5,6 +5,46 @@ const log = createLogger('@ossy/platform')
 
 const HEARTBEAT_MS = 25_000
 
+/** @type {Map<string, number>} */
+const activeConnectionsByWorkspace = new Map()
+
+/** @type {Set<{ res: import('express').Response, heartbeat: ReturnType<typeof setInterval>, unsubscribe: () => void, workspaceId: string }>} */
+const activeConnections = new Set()
+
+function trackConnection (workspaceId, delta) {
+  const next = Math.max(0, (activeConnectionsByWorkspace.get(workspaceId) ?? 0) + delta)
+  if (next === 0) {
+    activeConnectionsByWorkspace.delete(workspaceId)
+  } else {
+    activeConnectionsByWorkspace.set(workspaceId, next)
+  }
+  return next
+}
+
+function releaseConnection (connection) {
+  if (!activeConnections.delete(connection)) return
+
+  clearInterval(connection.heartbeat)
+  connection.unsubscribe()
+  const remaining = trackConnection(connection.workspaceId, -1)
+  log.debug('[push] SSE closed', {
+    workspaceId: connection.workspaceId,
+    activeForWorkspace: remaining,
+  })
+}
+
+/**
+ * Tear down all open SSE connections so HTTP server shutdown is not blocked.
+ */
+export function closePushSseConnections () {
+  for (const connection of [...activeConnections]) {
+    releaseConnection(connection)
+    if (!connection.res.writableEnded) {
+      connection.res.end()
+    }
+  }
+}
+
 /**
  * ADR 0008 §9 — workspace-scoped SSE invalidation bus.
  *
@@ -30,14 +70,22 @@ export function mountPushSse (app) {
     send({ kind: 'connected', scope: { workspaceId } })
 
     const unsubscribe = PushInvalidation.subscribe(workspaceId, send)
+    const activeForWorkspace = trackConnection(workspaceId, 1)
+    log.debug('[push] SSE opened', {
+      workspaceId,
+      activeForWorkspace,
+      userId: req.userId,
+    })
+
     const heartbeat = setInterval(() => {
       res.write(': heartbeat\n\n')
     }, HEARTBEAT_MS)
 
+    const connection = { res, heartbeat, unsubscribe, workspaceId }
+    activeConnections.add(connection)
+
     req.on('close', () => {
-      clearInterval(heartbeat)
-      unsubscribe()
-      log.debug(`[push] SSE closed for workspace ${workspaceId}`)
+      releaseConnection(connection)
     })
   })
 }

package/src/request-diagnostics.js

@@ -0,0 +1,144 @@
+import { createLogger } from '@ossy/observability'
+
+const log = createLogger('@ossy/platform/request-diagnostics')
+
+export class OperationTimeoutError extends Error {
+  constructor (label, timeoutMs) {
+    super(`Operation timed out after ${timeoutMs}ms: ${label}`)
+    this.name = 'OperationTimeoutError'
+    this.label = label
+    this.timeoutMs = timeoutMs
+  }
+}
+
+export function resolveTimeoutMs (envKey, fallback) {
+  const raw = process.env[envKey]
+  const parsed = Number.parseInt(String(raw ?? ''), 10)
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback
+}
+
+/**
+ * Reject when `promise` does not settle within `timeoutMs`.
+ * Pass `timeoutMs <= 0` to disable (returns `promise` unchanged).
+ *
+ * When `abortController` is supplied, aborts its signal on timeout so callers
+ * can propagate cancellation into long-running work.
+ *
+ * @template T
+ * @param {Promise<T>} promise
+ * @param {number} timeoutMs
+ * @param {string} label
+ * @param {{ abortController?: AbortController }} [options]
+ * @returns {Promise<T>}
+ */
+export function withTimeout (promise, timeoutMs, label, options = {}) {
+  if (!timeoutMs || timeoutMs <= 0) return promise
+
+  const { abortController } = options
+  let timer
+
+  const timeoutPromise = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      const err = new OperationTimeoutError(label, timeoutMs)
+      abortController?.abort(err)
+      reject(err)
+    }, timeoutMs)
+  })
+
+  const abortPromise = abortController
+    ? new Promise((_, reject) => {
+        const { signal } = abortController
+        if (signal.aborted) {
+          reject(signal.reason ?? new OperationTimeoutError(label, timeoutMs))
+          return
+        }
+        signal.addEventListener('abort', () => {
+          reject(signal.reason ?? new OperationTimeoutError(label, timeoutMs))
+        }, { once: true })
+      })
+    : null
+
+  const races = abortPromise ? [promise, timeoutPromise, abortPromise] : [promise, timeoutPromise]
+
+  return Promise.race(races).finally(() => {
+    clearTimeout(timer)
+  })
+}
+
+/**
+ * Reject when a signal aborts (used to race cooperative task handlers).
+ *
+ * @param {AbortSignal} signal
+ * @returns {Promise<never>}
+ */
+export function rejectOnAbort (signal) {
+  return new Promise((_, reject) => {
+    if (signal.aborted) {
+      reject(signal.reason ?? new Error('Operation aborted'))
+      return
+    }
+    signal.addEventListener('abort', () => {
+      reject(signal.reason ?? new Error('Operation aborted'))
+    }, { once: true })
+  })
+}
+
+/**
+ * Log when an operation exceeds the slow threshold.
+ *
+ * @param {string} label
+ * @param {{ log?: import('@ossy/observability').Logger, warnThresholdMs?: number }} [options]
+ */
+export function createTimedOperation (label, options = {}) {
+  const logger = options.log ?? log
+  const warnThresholdMs = options.warnThresholdMs
+    ?? resolveTimeoutMs('OSSY_REQUEST_SLOW_MS', 5000)
+  const start = performance.now()
+
+  return {
+    finish (detail) {
+      const elapsedMs = Math.round(performance.now() - start)
+      const payload = { label, elapsedMs, ...(detail ?? {}) }
+      if (elapsedMs >= warnThresholdMs) {
+        logger.warn('[slow-operation]', payload)
+      } else {
+        logger.debug('[timing]', payload)
+      }
+      return elapsedMs
+    },
+  }
+}
+
+/**
+ * Express middleware — logs requests that exceed OSSY_REQUEST_SLOW_MS (default 5s).
+ *
+ * @param {import('@ossy/observability').Logger} [logger]
+ */
+export function createSlowRequestLogger (logger = log) {
+  const slowThresholdMs = resolveTimeoutMs('OSSY_REQUEST_SLOW_MS', 5000)
+
+  return (req, res, next) => {
+    const start = performance.now()
+    const requestUrl = req.originalUrl || req.url || '/'
+
+    const onFinished = () => {
+      res.removeListener('finish', onFinished)
+      res.removeListener('close', onFinished)
+      const elapsedMs = Math.round(performance.now() - start)
+      if (elapsedMs < slowThresholdMs) return
+
+      logger.warn('[slow-request]', {
+        method: req.method,
+        url: requestUrl,
+        elapsedMs,
+        statusCode: res.statusCode,
+        userId: req.userId,
+        workspaceId: req.workspaceId,
+      })
+    }
+
+    res.on('finish', onFinished)
+    res.on('close', onFinished)
+    next()
+  }
+}

package/src/request-diagnostics.spec.js

@@ -0,0 +1,40 @@
+import { describe, expect, it } from '@jest/globals'
+import { OperationTimeoutError, rejectOnAbort, withTimeout } from './request-diagnostics.js'
+
+describe('request-diagnostics', () => {
+  it('withTimeout resolves when promise settles in time', async () => {
+    const result = await withTimeout(Promise.resolve('ok'), 100, 'fast')
+    expect(result).toBe('ok')
+  })
+
+  it('withTimeout rejects with OperationTimeoutError when promise is slow', async () => {
+    await expect(withTimeout(new Promise(() => {}), 20, 'slow-op')).rejects.toMatchObject({
+      label: 'slow-op',
+      timeoutMs: 20,
+    })
+    await expect(withTimeout(new Promise(() => {}), 20, 'slow-op')).rejects.toBeInstanceOf(OperationTimeoutError)
+  })
+
+  it('withTimeout passes through when timeout is disabled', async () => {
+    const result = await withTimeout(Promise.resolve(42), 0, 'disabled')
+    expect(result).toBe(42)
+  })
+
+  it('withTimeout aborts the supplied controller on timeout', async () => {
+    const abortController = new AbortController()
+    let aborted = false
+    abortController.signal.addEventListener('abort', () => { aborted = true })
+
+    await expect(
+      withTimeout(new Promise(() => {}), 20, 'abortable', { abortController }),
+    ).rejects.toBeInstanceOf(OperationTimeoutError)
+    expect(aborted).toBe(true)
+    expect(abortController.signal.aborted).toBe(true)
+  })
+
+  it('rejectOnAbort rejects when signal is already aborted', async () => {
+    const abortController = new AbortController()
+    abortController.abort(new Error('already gone'))
+    await expect(rejectOnAbort(abortController.signal)).rejects.toThrow(/already gone/)
+  })
+})

package/src/runtime.js

@@ -4,7 +4,7 @@ import express from 'express'
 import cookieParser from 'cookie-parser'
 import morgan from 'morgan'
 import { Router as OssyRouter } from '@ossy/router'
-import { loadManifest, resolveEntryUrl } from './server.js'
+import { loadManifest, resolveEntryUrl, loadLayoutsById, resolvePageLayoutRender } from './server.js'
 import { resolveRequestLocale } from './locale.js'
 import { buildManifestSummary } from '@ossy/app/manifest/build-manifest-summary'
 import { ProxyInternal } from './proxy-internal.js'
@@ -31,7 +31,7 @@ function cloneSerializable (value) {
  */
 const siteContextCache = new Map()
 
-function buildSiteContext (manifest, buildDir) {
+function buildSiteContext (manifest, buildDir, layoutsById) {
   const config = manifest.config
   const supportedLanguages = Array.isArray(config.supportedLanguages) ? config.supportedLanguages : []
 
@@ -50,14 +50,15 @@ function buildSiteContext (manifest, buildDir) {
     return promise
   }
 
-  return { pageRouter, apiRouter, manifest, manifestSummary: buildManifestSummary(manifest), loadEntry, buildDir }
+  return { pageRouter, apiRouter, manifest, manifestSummary: buildManifestSummary(manifest), loadEntry, buildDir, layoutsById }
 }
 
 async function getSiteContext (domain) {
   if (siteContextCache.has(domain)) return siteContextCache.get(domain)
   const buildDir = await loadSite(domain)
   const manifest = loadManifest(buildDir)
-  const context = buildSiteContext(manifest, buildDir)
+  const layoutsById = await loadLayoutsById(manifest.layouts, buildDir, log)
+  const context = buildSiteContext(manifest, buildDir, layoutsById)
   siteContextCache.set(domain, context)
   return context
 }
@@ -129,7 +130,7 @@ export async function startRuntime ({ port } = {}) {
       return
     }
 
-    const { pageRouter, apiRouter, manifest, manifestSummary, loadEntry, buildDir } = context
+    const { pageRouter, apiRouter, manifest, manifestSummary, loadEntry, buildDir, layoutsById } = context
 
     try {
       const apiRoute = apiRouter.getPageByUrl(requestUrl)
@@ -169,6 +170,11 @@ export async function startRuntime ({ port } = {}) {
 
       const config = manifest.config
       const { language, messages, fallbackMessages } = resolveRequestLocale(pageRouter, requestUrl, buildDir, config)
+      const {
+        Layout,
+        layoutEntry,
+        layoutSlots,
+      } = resolvePageLayoutRender(layoutsById, pageEntry)
       const props = {
         ...config,
         ...(req.userAppSettings || {}),
@@ -190,6 +196,11 @@ export async function startRuntime ({ port } = {}) {
           ...(page.package ? { package: page.package } : {}),
         })),
         pageId: pageRoute.id,
+        componentEntries: manifest.components,
+        resolveComponentEntry: (entry) => resolveEntryUrl(entry, buildDir),
+        layoutSlots,
+        Layout,
+        layoutEntry,
       }
       const html = await mod.render(props)
       res.status(200).type('html').send(html)

package/src/server.js

@@ -7,7 +7,7 @@ import { Router as OssyRouter } from '@ossy/router'
 import cookieParser from 'cookie-parser'
 import { ProxyInternal } from './proxy-internal.js'
 import { SDK, resolveActionId } from '@ossy/sdk'
-import { AggregateRebuild, resolveMongoUrl } from '@ossy/event-store'
+import { AggregateRebuild, ensureEventStoreIndexes, Mongo, resolveMongoUrl } from '@ossy/event-store'
 import { TaskService } from './tasks/task-service.js'
 import { ChangeStream } from './tasks/change-stream.js'
 import { buildManifestSummary } from '@ossy/app/manifest/build-manifest-summary'
@@ -26,13 +26,23 @@ import {
   buildActionEntitlementIndex,
   createWorkspaceLoader,
 } from './entitlements/action-entitlement.js'
-import { mountPushSse } from './push/mount-push-sse.js'
+import { closePushSseConnections, mountPushSse } from './push/mount-push-sse.js'
+import {
+  createSlowRequestLogger,
+  createTimedOperation,
+  OperationTimeoutError,
+  resolveTimeoutMs,
+  withTimeout,
+} from './request-diagnostics.js'
 import { mergeWorkspaceSchemas } from '@ossy/workspaces/merge-workspace-schemas'
 import {
   buildEnableablePackageSet,
   setEnableablePackages,
 } from '@ossy/workspaces/entitlements'
 const log = createLogger('@ossy/platform')
+const MONGO_TIMEOUT_MS = resolveTimeoutMs('OSSY_MONGO_TIMEOUT_MS', 10_000)
+const SSR_RENDER_TIMEOUT_MS = resolveTimeoutMs('OSSY_SSR_RENDER_TIMEOUT_MS', 30_000)
+const ACTION_TIMEOUT_MS = resolveTimeoutMs('OSSY_ACTION_TIMEOUT_MS', 60_000)
 
 const DEFAULT_PORT = 3000
 const MANIFEST_FILE = 'manifest.json'
@@ -77,7 +87,8 @@ export function loadManifest (buildDir) {
   const actions = Array.isArray(manifest.actions) ? manifest.actions : []
   const emails = Array.isArray(manifest.emails) ? manifest.emails : []
   const layouts = Array.isArray(manifest.layouts) ? manifest.layouts : []
-  for (const e of entries) {    if ((e.type === 'page' || e.type === 'api') && !validRoutable(e)) {
+  for (const e of entries) {
+    if ((e.type === 'page' || e.type === 'api') && !validRoutable(e)) {
       log.warn(`Skipping ${e.type} "${e.id}" — manifest entry has no path.`)
     }
   }
@@ -117,6 +128,49 @@ function cloneSerializable (value) {
   return value == null ? value : JSON.parse(JSON.stringify(value))
 }
 
+/**
+ * Load all registered layout bundles keyed by canonical layout id.
+ *
+ * @param {Array<{ id: string, entry: string }>} layoutManifest
+ * @param {string} buildDir
+ * @param {import('@ossy/observability').Logger} log
+ */
+async function loadLayoutsById (layoutManifest, buildDir, log) {
+  /** @type {Map<string, { component: import('react').ComponentType, entry: string }>} */
+  const layoutsById = new Map()
+  for (const layoutEntry of layoutManifest ?? []) {
+    if (!layoutEntry?.id || !layoutEntry?.entry) continue
+    try {
+      const mod = await import(/* @vite-ignore */ resolveEntryUrl(layoutEntry.entry, buildDir))
+      if (typeof mod.default === 'function') {
+        layoutsById.set(layoutEntry.id, { component: mod.default, entry: layoutEntry.entry })
+      }
+    } catch (err) {
+      log.warn(`Failed to load layout "${layoutEntry.id}"`, undefined, err)
+    }
+  }
+  return layoutsById
+}
+
+/**
+ * @param {Map<string, { component: import('react').ComponentType, entry: string }>} layoutsById
+ * @param {{ layout?: string, slots?: Record<string, string | null> }} pageEntry
+ */
+function resolvePageLayoutRender (layoutsById, pageEntry) {
+  const layoutId = pageEntry?.layout ?? '@ossy/app/layout/default'
+  const layoutRecord = layoutsById.get(layoutId) ?? layoutsById.get('@ossy/app/layout/default') ?? null
+  const layoutSlots =
+    pageEntry?.slots && typeof pageEntry.slots === 'object' && !Array.isArray(pageEntry.slots)
+      ? pageEntry.slots
+      : {}
+  return {
+    Layout: layoutRecord?.component ?? null,
+    layoutEntry: layoutRecord?.entry ?? null,
+    layoutSlots,
+    layoutId,
+  }
+}
+
 export async function startServer (options = {}) {
   const cwd = options.cwd ? path.resolve(options.cwd) : process.cwd()
   const buildDir = path.resolve(cwd, options.buildDir || 'build')
@@ -169,6 +223,8 @@ export async function startServer (options = {}) {
 
   // Aggregate registration — mirrors task and schema registration above.
   // AggregateRebuild is provided by @ossy/event-store.
+  /** @type {(() => void) | null} */
+  let runStartupRebuild = null
   if (AggregateRebuild) {
     for (const agg of manifest.aggregates ?? []) {
       try {
@@ -179,9 +235,13 @@ export async function startServer (options = {}) {
       }
     }
 
-    AggregateRebuild.BuildAndSaveAll().catch((error) => {
-      log.error('BuildAndSaveAll failed — is MongoDB reachable?', undefined, error)
-    })
+    // Defer full startup rebuild until the server is listening so request handling
+    // is not starved while snapshots catch up (332k+ streams on large local DBs).
+    runStartupRebuild = () => {
+      AggregateRebuild.BuildAndSaveAll().catch((error) => {
+        log.error('BuildAndSaveAll failed — is MongoDB reachable?', undefined, error)
+      })
+    }
   }
 
   for (const startup of manifest.startups ?? []) {
@@ -206,34 +266,9 @@ export async function startServer (options = {}) {
     }
   }
 
-  // Layout loading — one `*.layout.jsx` per app wraps every page render. The
-  // layout component decides route-specific chrome (auth, public flows, etc.).
-  /** @type {{ component: import('react').ComponentType, entry: string } | null} */
-  let appLayout = null
+  // Layout loading — registered layouts keyed by id; each page picks layout + merged slots at build time.
   const layoutManifest = manifest.layouts ?? []
-  if (layoutManifest.length > 1) {
-    log.warn(
-      `Multiple layouts in manifest (${layoutManifest.length}); only the first is used. Use one *.layout.jsx per app.`,
-    )
-  }
-  const layoutEntry = layoutManifest[0]
-  if (layoutEntry) {
-    try {
-      const mod = await import(/* @vite-ignore */ resolveEntryUrl(layoutEntry.entry, buildDir))
-      if (typeof mod.default === 'function') {
-        appLayout = { component: mod.default, entry: layoutEntry.entry }
-      }
-    } catch (err) {
-      log.warn(`Failed to load layout "${layoutEntry.id}"`, undefined, err)
-    }
-  }
-
-  // App-controlled shell slots: `export const slots` in `*.layout.jsx` is recorded
-  // on `manifest.layouts[0].slots` at build time and resolved at render in page-runtime.
-  const layoutSlots =
-    layoutEntry && typeof layoutEntry.slots === 'object' && !Array.isArray(layoutEntry.slots)
-      ? layoutEntry.slots
-      : {}
+  const layoutsById = await loadLayoutsById(layoutManifest, buildDir, log)
 
   // Register the SDK so all tasks receive it as `sdk`.
   // Priority: explicit options.sdk → SDK.of() from env vars → null (direct-DB fallback in tasks).
@@ -245,6 +280,9 @@ export async function startServer (options = {}) {
   TaskService.startScheduler()
 
   if (process.env.DB_URL) {
+    await ensureEventStoreIndexes().catch((err) => {
+      log.error('Failed to ensure MongoDB indexes — aggregate reads may be very slow', undefined, err)
+    })
     ChangeStream.start(resolveMongoUrl(process.env.DB_URL))
   }
 
@@ -267,7 +305,12 @@ export async function startServer (options = {}) {
   let loadWorkspaceForEntitlements = null
   try {
     const { Workspace } = await import('@ossy/workspaces/server')
-    loadWorkspaceForEntitlements = createWorkspaceLoader(Workspace)
+    const loadWorkspace = createWorkspaceLoader(Workspace)
+    loadWorkspaceForEntitlements = (workspaceId) => withTimeout(
+      loadWorkspace(workspaceId),
+      MONGO_TIMEOUT_MS,
+      `loadWorkspace(${workspaceId})`,
+    )
   } catch (err) {
     log.warn('[@ossy/platform] Workspace aggregate unavailable — action entitlements disabled', err)
   }
@@ -288,6 +331,7 @@ export async function startServer (options = {}) {
   })
   app.use(UsersMiddleware.AuthenticateUser)
   app.use(WorkspacesMiddleware.ExtractWorkspaceId())
+  app.use(createSlowRequestLogger(log))
   if (fs.existsSync(publicDir)) app.use(express.static(publicDir))
   app.use(ProxyInternal())
 
@@ -343,16 +387,33 @@ export async function startServer (options = {}) {
     }
 
     const actionLog = createLogger(actionId)
+    const actionTimer = createTimedOperation(`POST /actions ${actionId}`, { log: actionLog })
+    const actionAbort = new AbortController()
     try {
-      const result = await ActionService.invoke(actionId, {
-        payload,
-        sdk: req.sdk ?? null,
-        log: actionLog,
-        integrations: IntegrationService,
-        req,
-      })
+      const result = await withTimeout(
+        ActionService.invoke(actionId, {
+          payload,
+          sdk: req.sdk ?? null,
+          log: actionLog,
+          integrations: IntegrationService,
+          req,
+          signal: actionAbort.signal,
+        }),
+        ACTION_TIMEOUT_MS,
+        `POST /actions ${actionId}`,
+        { abortController: actionAbort },
+      )
+      actionTimer.finish({ statusCode: 200 })
       res.json(result ?? { ok: true })
     } catch (err) {
+      actionTimer.finish({
+        statusCode: err instanceof OperationTimeoutError ? 504 : (err?.status ?? 500),
+        timedOut: err instanceof OperationTimeoutError,
+      })
+      if (err instanceof OperationTimeoutError) {
+        actionLog.error('Action timed out', { id: actionId, timeoutMs: err.timeoutMs })
+        return res.status(504).json({ error: 'Action timed out', code: 'ACTION_TIMEOUT' })
+      }
       actionLog.error('Action failed', { id: actionId }, err)
       const status = err?.status ?? 500
       res.status(status).json({ error: err?.message ?? 'Internal error' })
@@ -368,6 +429,7 @@ export async function startServer (options = {}) {
 
   app.all('*all', async (req, res) => {
     const requestUrl = req.originalUrl || '/'
+    const pageTimer = createTimedOperation(`page ${req.method} ${requestUrl}`, { log })
     try {
       const apiRoute = apiRouter.getPageByUrl(requestUrl)
       if (apiRoute) {
@@ -393,18 +455,25 @@ export async function startServer (options = {}) {
           res.status(404).send('Not found')
           return
         }
+        const loadEntryTimer = createTimedOperation(`SSR loadEntry ${pageRoute.id}`, { log })
         const mod = await loadEntry(pageEntry.entry)
+        loadEntryTimer.finish()
         if (typeof mod.render !== 'function') {
           res.status(503).type('text').send('SSR runtime unavailable')
           return
         }
-        const Layout = appLayout?.component ?? null
-        const layoutEntry = appLayout?.entry ?? null
+        const {
+          Layout,
+          layoutEntry,
+          layoutSlots,
+        } = resolvePageLayoutRender(layoutsById, pageEntry)
         const { language, messages, fallbackMessages } = resolveRequestLocale(pageRouter, requestUrl, buildDir, config)
         let schemasForPage = cloneSerializable(manifest.schemas || [])
         if (req.workspaceId && loadWorkspaceForEntitlements) {
+          const workspaceTimer = createTimedOperation(`SSR loadWorkspace ${req.workspaceId}`, { log })
           try {
             const workspace = await loadWorkspaceForEntitlements(req.workspaceId)
+            workspaceTimer.finish({ pageId: pageRoute.id })
             if (workspace?.schemas?.length) {
               schemasForPage = mergeWorkspaceSchemas(
                 schemasForPage,
@@ -412,7 +481,20 @@ export async function startServer (options = {}) {
               )
             }
           } catch (err) {
-            log.warn('[@ossy/platform] Failed to merge workspace schemas for SSR', err)
+            workspaceTimer.finish({
+              pageId: pageRoute.id,
+              error: err?.message ?? String(err),
+              timedOut: err instanceof OperationTimeoutError,
+            })
+            if (err instanceof OperationTimeoutError) {
+              log.warn('[@ossy/platform] SSR workspace schema merge timed out — using manifest schemas only', {
+                workspaceId: req.workspaceId,
+                pageId: pageRoute.id,
+                timeoutMs: err.timeoutMs,
+              })
+            } else {
+              log.warn('[@ossy/platform] Failed to merge workspace schemas for SSR', err)
+            }
           }
         }
         // Page component → `app:content` is resolved in page-runtime (SSR + hydrate).
@@ -439,17 +521,44 @@ export async function startServer (options = {}) {
           })),
           pageId: pageRoute.id,
           componentEntries: manifest.components,
+          resolveComponentEntry: (entry) => resolveEntryUrl(entry, buildDir),
           layoutSlots,
           Layout,
           layoutEntry,
         }
-        const html = await mod.render(props)
+        const renderTimer = createTimedOperation(`SSR render ${pageRoute.id}`, { log })
+        let html
+        try {
+          html = await withTimeout(
+            mod.render(props),
+            SSR_RENDER_TIMEOUT_MS,
+            `SSR render(${pageRoute.id})`,
+          )
+        } catch (err) {
+          renderTimer.finish({ timedOut: err instanceof OperationTimeoutError })
+          if (err instanceof OperationTimeoutError) {
+            log.error('[@ossy/platform] SSR render timed out', {
+              pageId: pageRoute.id,
+              url: requestUrl,
+              timeoutMs: err.timeoutMs,
+            })
+            if (!res.headersSent) {
+              res.status(504).type('text').send('Page render timed out')
+            }
+            return
+          }
+          throw err
+        }
+        renderTimer.finish()
+        pageTimer.finish({ pageId: pageRoute.id, statusCode: 200 })
         res.status(200).type('html').send(html)
         return
       }
 
+      pageTimer.finish({ statusCode: 404 })
       res.status(404).send('Not found')
     } catch (err) {
+      pageTimer.finish({ error: err?.message ?? String(err) })
       log.error('Request handling failed', undefined, err)
       if (!res.headersSent) {
         res.status(500).type('text').send('Internal Server Error')
@@ -466,7 +575,12 @@ export async function startServer (options = {}) {
   log.info(`Running on http://localhost:${port}`)
   log.info('Press Ctrl+C to stop.')
 
-  const closeServer = () => new Promise((resolve) => server.close(() => resolve()))
+  runStartupRebuild?.()
+
+  const closeServer = () => new Promise((resolve) => {
+    server.closeAllConnections?.()
+    server.close(() => resolve())
+  })
 
   let shuttingDown = false
   const handleShutdown = async (signal) => {
@@ -474,6 +588,10 @@ export async function startServer (options = {}) {
     shuttingDown = true
     log.info(`Received ${signal}, shutting down...`)
     try {
+      TaskService.stop()
+      closePushSseConnections()
+      await ChangeStream.stop()
+      await Mongo.closeConnection()
       await closeServer()
     } finally {
       process.exit(0)
@@ -488,6 +606,7 @@ export async function startServer (options = {}) {
 }
 
 export default startServer
+export { loadLayoutsById, resolvePageLayoutRender }
 export { ConfigService } from './config.service.js'
 export { ActionService } from './actions/action.service.js'
 export { IntegrationService } from './integration.service.js'
@@ -496,7 +615,6 @@ export { originalObjectKey, derivativeObjectKey, assertStorageKey } from './stor
 export { S3Client } from './storage/s3.client.js'
 export { LocalStorageClient } from './storage/local-storage.client.js'
 export { getSystemSchemas } from './resources/schema.registry.js'
-export { PlatformSchema } from './schema-ids.js'
 export { getPlatformSchema, initPlatformSchema, createSchemaEngine, schemaForWorkspace } from './resources/schema.service.js'
 export { validateSchemasForImport } from './resources/schema.validation.js'
 export {

package/src/tasks/change-stream.js

@@ -17,6 +17,10 @@ export class ChangeStream {
   static _reconnectAttempts = 0
   static _dbUrl = null
   static _client = null
+  /** @type {import('mongodb').ChangeStream | null} */
+  static _changeStream = null
+  /** @type {ReturnType<typeof setTimeout> | null} */
+  static _reconnectTimer = null
 
   /**
    * Opens the MongoDB changestream and wires up reconnect logic.
@@ -33,12 +37,35 @@ export class ChangeStream {
     })
   }
 
-  static stop() {
+  static async stop () {
     ChangeStream._stopped = true
-    if (ChangeStream._client) {
-      ChangeStream._client.close().catch(() => {})
-      ChangeStream._client = null
+
+    if (ChangeStream._reconnectTimer) {
+      clearTimeout(ChangeStream._reconnectTimer)
+      ChangeStream._reconnectTimer = null
+    }
+
+    const stream = ChangeStream._changeStream
+    ChangeStream._changeStream = null
+    if (stream) {
+      try {
+        await stream.close()
+      } catch {
+        // ignore — stream may already be closed
+      }
+    }
+
+    const client = ChangeStream._client
+    ChangeStream._client = null
+    if (client) {
+      try {
+        await client.close()
+      } catch {
+        // ignore
+      }
     }
+
+    log.info('[ChangeStream] Stopped')
   }
 
   static async _getMongoClient() {
@@ -46,7 +73,10 @@ export class ChangeStream {
     return MongoClient
   }
 
-  static async _getClient() {
+  static async _getClient () {
+    if (ChangeStream._stopped) {
+      throw new Error('ChangeStream stopped')
+    }
     if (!ChangeStream._client) {
       const MongoClient = await ChangeStream._getMongoClient()
       ChangeStream._client = new MongoClient(ChangeStream._dbUrl, {
@@ -56,7 +86,8 @@ export class ChangeStream {
     return ChangeStream._client
   }
 
-  static async _resetClient() {
+  static async _resetClient () {
+    if (ChangeStream._stopped) return
     const MongoClient = await ChangeStream._getMongoClient()
     const prev = ChangeStream._client
     ChangeStream._client = new MongoClient(ChangeStream._dbUrl, {
@@ -68,7 +99,7 @@ export class ChangeStream {
     log.info('[ChangeStream] New MongoClient instance created')
   }
 
-  static _scheduleReconnect() {
+  static _scheduleReconnect () {
     if (ChangeStream._stopped) return
 
     const delaySecs = Math.min(Math.pow(2, ChangeStream._reconnectAttempts), 30)
@@ -76,7 +107,12 @@ export class ChangeStream {
 
     log.info(`[ChangeStream] Reconnecting in ${delaySecs}s...`)
 
-    setTimeout(() => {
+    if (ChangeStream._reconnectTimer) {
+      clearTimeout(ChangeStream._reconnectTimer)
+    }
+
+    ChangeStream._reconnectTimer = setTimeout(() => {
+      ChangeStream._reconnectTimer = null
       if (ChangeStream._stopped) return
       ChangeStream._open().catch((error) => {
         log.error('[ChangeStream] Change stream could not be opened', undefined, error)
@@ -85,16 +121,30 @@ export class ChangeStream {
     }, delaySecs * 1000)
   }
 
-  static async _open() {
+  static async _open () {
+    if (ChangeStream._stopped) return
+
     log.info('[ChangeStream] Watching for changes')
 
     const dbName = process.env.DB_NAME || 'test'
     const client = await ChangeStream._getClient()
+    if (ChangeStream._stopped) return
+
     const collection = client.db(dbName).collection('eventstore')
 
+    if (ChangeStream._changeStream) {
+      try {
+        await ChangeStream._changeStream.close()
+      } catch {
+        // ignore
+      }
+      ChangeStream._changeStream = null
+    }
+
     const changeStream = collection.watch([
       { $match: { operationType: 'insert' } },
     ])
+    ChangeStream._changeStream = changeStream
 
     const wasReconnecting = ChangeStream._reconnectAttempts > 0
     ChangeStream._reconnectAttempts = 0
@@ -105,6 +155,7 @@ export class ChangeStream {
     // Ensures only one reconnect is scheduled if both 'error' and 'close' fire for the same failure.
     let reconnectScheduled = false
     const scheduleOnce = () => {
+      if (ChangeStream._stopped) return
       if (!reconnectScheduled) {
         reconnectScheduled = true
         ChangeStream._scheduleReconnect()
@@ -112,6 +163,7 @@ export class ChangeStream {
     }
 
     changeStream.on('error', (error) => {
+      if (ChangeStream._stopped) return
       log.error('[ChangeStream] Change stream error (server keeps running)', undefined, error)
       if (isMongoTopologyClosedError(error)) {
         ChangeStream._resetClient().catch(() => {})
@@ -132,11 +184,19 @@ export class ChangeStream {
     })
 
     changeStream.on('close', () => {
+      if (ChangeStream._changeStream === changeStream) {
+        ChangeStream._changeStream = null
+      }
+      if (ChangeStream._stopped) return
       log.info('[ChangeStream] close detected')
       scheduleOnce()
     })
 
     changeStream.on('end', () => {
+      if (ChangeStream._changeStream === changeStream) {
+        ChangeStream._changeStream = null
+      }
+      if (ChangeStream._stopped) return
       log.info('[ChangeStream] end detected')
       scheduleOnce()
     })

package/src/users.middleware.js

@@ -5,8 +5,14 @@ import { User } from '@ossy/users/server'
 import { Token } from '@ossy/tokens/server'
 import { ConfigService } from './config.service.js'
 import { PoliciesQueries } from '@ossy/policies/server'
+import {
+  OperationTimeoutError,
+  resolveTimeoutMs,
+  withTimeout,
+} from './request-diagnostics.js'
 
 const log = createLogger('users')
+const AUTH_TIMEOUT_MS = resolveTimeoutMs('OSSY_AUTH_TIMEOUT_MS', 10_000)
 
 function normalizeAuthToken (token) {
   const trimmed = String(token ?? '').trim()
@@ -58,29 +64,55 @@ export class UsersMiddleware {
     log.info('[UsersMiddleware] Authenticating')
     log.debug('[UsersMiddleware] authToken', { authToken })
 
-    TokenService.verify(authToken)
-      .then(UsersMiddleware.assertApiTokenActive)
-      .then(payload => {
-        req.authPayload = payload
-        req.tokenScopes = payload?.type === 'Api' ? (payload.scopes ?? ['*']) : null
-        return payload
-      })
-      .then(({ sub }) => Aggregate.Of(User, sub))
-      .then(Aggregate.View())
-      .then(user => {
-        const workspaces = user.workspaces ?? []
+    const authStarted = performance.now()
+    let authFinished = false
+    const finishAuth = (apply) => {
+      if (authFinished) return
+      authFinished = true
+      apply()
+    }
 
-        return PoliciesQueries.GetPoliciesForUser(user.id)
-          .then(policies => {
-            log.info('[UsersMiddleware] Resolved user')
-            req.userId = user.id
-            req.user = { ...user, workspaces, policies }
-            next()
-          })
-      })
+    withTimeout(
+      TokenService.verify(authToken)
+        .then(UsersMiddleware.assertApiTokenActive)
+        .then(payload => {
+          req.authPayload = payload
+          req.tokenScopes = payload?.type === 'Api' ? (payload.scopes ?? ['*']) : null
+          return payload
+        })
+        .then(({ sub }) => Aggregate.Of(User, sub))
+        .then(Aggregate.View())
+        .then(user => {
+          const workspaces = user.workspaces ?? []
+
+          return PoliciesQueries.GetPoliciesForUser(user.id)
+            .then(policies => {
+              finishAuth(() => {
+                log.info('[UsersMiddleware] Resolved user', {
+                  elapsedMs: Math.round(performance.now() - authStarted),
+                })
+                req.userId = user.id
+                req.user = { ...user, workspaces, policies }
+                next()
+              })
+            })
+        }),
+      AUTH_TIMEOUT_MS,
+      'UsersMiddleware.AuthenticateUser',
+    )
       .catch(error => {
+        if (error instanceof OperationTimeoutError) {
+          log.warn('[UsersMiddleware] Auth timed out', {
+            timeoutMs: error.timeoutMs,
+            elapsedMs: Math.round(performance.now() - authStarted),
+          })
+          finishAuth(() => {
+            res.status(504).json({ error: 'Authentication timed out', code: 'AUTH_TIMEOUT' })
+          })
+          return
+        }
         log.debug('[UsersMiddleware] Auth failed; anonymous', { error })
-        asAnonymous()
+        finishAuth(asAnonymous)
       })
   }
 

package/src/schema-ids.js

@@ -1,9 +0,0 @@
-/** Platform envelope schemas (ADR 0008). */
-export const PlatformSchema = Object.freeze({
-  config: '@ossy/platform/schema/config',
-  directory: '@ossy/platform/schema/directory',
-  file: '@ossy/platform/schema/file',
-  taskRun: '@ossy/platform/schema/task-run',
-  actionInvocation: '@ossy/platform/schema/action-invocation',
-  meterEvent: '@ossy/platform/schema/meter-event',
-})