@objectstack/cli 10.2.0 → 11.0.0

package/dist/commands/serve.js

@@ -7,7 +7,7 @@ import chalk from 'chalk';
 import { bundleRequire } from 'bundle-require';
 import { BUNDLE_REQUIRE_EXTERNALS } from '../utils/config.js';
 import { shouldBootWithLibrary } from '../utils/plugin-detection.js';
-import { readEnvWithDeprecation } from '@objectstack/types';
+import { readEnvWithDeprecation, resolveMultiOrgEnabled } from '@objectstack/types';
 import { resolveObjectStackHome } from '@objectstack/runtime';
 import { LOG_LEVELS, resolveLogLevel, readLogLevelEnv } from '../utils/log-level.js';
 import { printError, printServerReady, } from '../utils/format.js';
@@ -412,7 +412,7 @@ export default class Serve extends Command {
                     // "missing artifact" error and assemble a bare kernel that
                     // can later install marketplace apps at runtime.
                     const { createDefaultHostConfig } = await import('@objectstack/runtime');
-                    const bootResult = await createDefaultHostConfig({ requireArtifact: !useEmptyBoot });
+                    const bootResult = await createDefaultHostConfig({ requireArtifact: !useEmptyBoot, dev: isDev });
                     config = { ...originalConfig, ...bootResult };
                 }
                 else if (resolvedMode === 'standalone') {
@@ -423,6 +423,9 @@ export default class Serve extends Command {
                     const standaloneInput = {
                         ...(config.standalone ?? {}),
                         projectRoot: (config.standalone?.projectRoot ?? path.dirname(absolutePath)),
+                        // #2229: dev enables the native-better-sqlite3 → wasm → in-memory
+                        // step-down in the shared datasource factory; prod fails loudly.
+                        dev: isDev,
                     };
                     const bootResult = await createStandaloneStack(standaloneInput);
                     config = { ...originalConfig, ...bootResult };
@@ -516,10 +519,39 @@ export default class Serve extends Command {
                     envLevel: readLogLevelEnv(),
                 }),
             };
+            // Cluster wiring: env-driven driver selection (mirrors OS_DATABASE_URL).
+            // The remote driver self-registers on import; import it dynamically so it
+            // works in BOTH config-boot and compiled-artifact mode. Open-core ships
+            // only the in-memory driver — remote drivers (e.g. redis) come from the EE
+            // distribution; if absent we fall back to the in-memory cluster.
+            let clusterConfig;
+            const __clusterDriver = process.env.OS_CLUSTER_DRIVER?.trim();
+            if (__clusterDriver && __clusterDriver !== 'memory') {
+                // Multi-node authorization gate (open mechanism): a distribution (e.g.
+                // an EE license) may deny multi-node. On denial, downgrade to
+                // single-node rather than fail — multi-node is an add-on, never brick.
+                // Dynamic, non-literal specifier so the CLI does not statically depend
+                // on the cluster package (mirrors the remote-driver import below).
+                const __clusterPkg = '@objectstack/service-cluster';
+                const { checkMultiNodeAllowed } = (await import(__clusterPkg));
+                const __gate = checkMultiNodeAllowed();
+                if (!__gate.allowed) {
+                    console.warn(`[cluster] multi-node not authorized (${__gate.reason ?? 'denied'}) — ` +
+                        `downgrading to single-node (in-memory cluster). Remove OS_CLUSTER_DRIVER to silence.`);
+                }
+                else {
+                    try {
+                        await import(`@objectstack/service-cluster-${__clusterDriver}`);
+                    }
+                    catch { /* may already be registered by the loaded config */ }
+                    clusterConfig = { driver: __clusterDriver, url: process.env.OS_REDIS_URL };
+                }
+            }
             const runtime = new Runtime({
                 kernel: {
                     logger: loggerConfig
-                }
+                },
+                cluster: clusterConfig,
             });
             const kernel = runtime.getKernel();
             // Load plugins from configuration
@@ -587,19 +619,25 @@ export default class Serve extends Command {
                         resolvedDatabaseUrl = databaseUrl ?? 'mongodb://localhost:27017/objectstack';
                     }
                     else if (driverType === 'sqlite' || driverType === 'sql') {
-                        const { SqlDriver } = await import('@objectstack/driver-sql');
                         const filePath = (databaseUrl ?? ':memory:').replace(/^file:/, '').replace(/^sqlite:/, '').replace(/^sql:\/\//, '');
-                        await kernel.use(new DriverPlugin(new SqlDriver({
-                            client: 'better-sqlite3',
-                            connection: { filename: filePath },
-                            useNullAsDefault: true,
+                        // Probe-by-connect with a dev-only native → wasm → in-memory
+                        // step-down (#2229). better-sqlite3 loads its native addon lazily
+                        // (first query), so an ABI mismatch is invisible here and would
+                        // otherwise surface much later as a runtime crash. resolveSqliteDriver
+                        // forces the load and degrades gracefully in dev / fails loudly in prod.
+                        const { resolveSqliteDriver } = await import('@objectstack/service-datasource');
+                        const resolved = await resolveSqliteDriver({
+                            filename: filePath,
+                            dev: isDev,
                             // #2186: in dev, self-heal a persisted DB when a metadata change
                             // relaxes a constraint (loosen-only; never destructive / never in prod).
                             autoMigrate: isDev ? 'safe' : undefined,
-                        })));
-                        trackPlugin('SqlDriver');
-                        resolvedDriverLabel = 'SqlDriver(sqlite)';
-                        resolvedDatabaseUrl = databaseUrl ?? ':memory:';
+                            warn: (m) => console.warn(chalk.yellow(m)),
+                        });
+                        await kernel.use(new DriverPlugin(resolved.driver));
+                        trackPlugin(resolved.engine === 'memory' ? 'MemoryDriver' : resolved.engine === 'sqlite-wasm' ? 'SqliteWasmDriver' : 'SqlDriver');
+                        resolvedDriverLabel = resolved.label;
+                        resolvedDatabaseUrl = resolved.engine === 'memory' ? '(in-memory)' : (databaseUrl ?? ':memory:');
                     }
                     else if (driverType === 'sqlite-wasm' || driverType === 'wasm-sqlite' || driverType === 'wasm') {
                         const { SqliteWasmDriver } = await import('@objectstack/driver-sqlite-wasm');
@@ -637,94 +675,26 @@ export default class Serve extends Command {
                         resolvedDatabaseUrl = databaseUrl;
                     }
                     else if (isDev) {
-                        // Default in dev: prefer native SQLite for production-like SQL
-                        // semantics at native speed. When the native `better-sqlite3`
-                        // binary is unavailable — not built, ABI mismatch after a Node
-                        // upgrade (e.g. Node 25 → NODE_MODULE_VERSION mismatch), or a
-                        // blocked prebuild download — fall back to the pure-JS wasm SQLite
-                        // driver, which keeps *real* SQL semantics (and on-disk
-                        // persistence) without any native build step. Only if wasm also
-                        // fails to load do we drop to the in-memory driver (mingo), which
-                        // is neither real SQL nor persistent.
-                        //
-                        // knex loads its client lazily (at first query, not at construction),
-                        // so the only reliable signal inside this registration window is to
-                        // actually open a connection: connect() runs `SELECT 1`, which forces
-                        // better-sqlite3 to load. If that throws we step down the chain here
-                        // instead of letting the failure surface much later — as a
-                        // missing-module crash on the first real query — or be swallowed by
-                        // the silent catch below, leaving the kernel with no driver at all.
-                        let sqliteDriver;
-                        let sqliteOk = false;
-                        try {
-                            const { SqlDriver } = await import('@objectstack/driver-sql');
-                            sqliteDriver = new SqlDriver({
-                                client: 'better-sqlite3',
-                                connection: { filename: ':memory:' },
-                                useNullAsDefault: true,
-                                autoMigrate: 'safe', // #2186 dev loosen-only self-heal
-                            });
-                            await sqliteDriver.connect();
-                            sqliteOk = true;
-                        }
-                        catch {
-                            sqliteOk = false;
-                            if (sqliteDriver?.disconnect) {
-                                try {
-                                    await sqliteDriver.disconnect();
-                                }
-                                catch { /* ignore */ }
-                            }
-                        }
-                        if (sqliteOk) {
-                            await kernel.use(new DriverPlugin(sqliteDriver));
-                            trackPlugin('SqlDriver');
-                            resolvedDriverLabel = 'SqlDriver(sqlite)';
-                            resolvedDatabaseUrl = ':memory:';
-                        }
-                        else {
-                            // Native unavailable → try the pure-JS wasm SQLite driver before
-                            // giving up on SQL fidelity entirely. Same probe-by-connect
-                            // approach: actually open the connection so a load failure is
-                            // caught here rather than on the first real query.
-                            let wasmDriver;
-                            let wasmOk = false;
-                            try {
-                                const { SqliteWasmDriver } = await import('@objectstack/driver-sqlite-wasm');
-                                wasmDriver = new SqliteWasmDriver({
-                                    filename: ':memory:',
-                                    persist: 'on-disconnect',
-                                });
-                                await wasmDriver.connect();
-                                wasmOk = true;
-                            }
-                            catch {
-                                wasmOk = false;
-                                if (wasmDriver?.disconnect) {
-                                    try {
-                                        await wasmDriver.disconnect();
-                                    }
-                                    catch { /* ignore */ }
-                                }
-                            }
-                            if (wasmOk) {
-                                await kernel.use(new DriverPlugin(wasmDriver));
-                                trackPlugin('SqliteWasmDriver');
-                                resolvedDriverLabel = 'SqliteWasmDriver';
-                                resolvedDatabaseUrl = ':memory:';
-                                console.warn(chalk.yellow('  ⚠ native better-sqlite3 unavailable (ABI mismatch or not built) — dev using wasm SQLite (real SQL, slower).\n' +
-                                    '    Rebuild better-sqlite3 for native speed, or set OS_DATABASE_DRIVER=sqlite-wasm to silence this.'));
-                            }
-                            else {
-                                const { InMemoryDriver } = await import('@objectstack/driver-memory');
-                                await kernel.use(new DriverPlugin(new InMemoryDriver()));
-                                trackPlugin('MemoryDriver');
-                                resolvedDriverLabel = 'InMemoryDriver';
-                                resolvedDatabaseUrl = '(in-memory)';
-                                console.warn(chalk.yellow('  ⚠ neither native nor wasm SQLite available — dev falling back to InMemoryDriver (mingo, not real SQL).\n' +
-                                    '    Rebuild better-sqlite3, or set OS_DATABASE_URL / OS_DATABASE_DRIVER for SQL fidelity.'));
-                            }
-                        }
+                        // Default in dev (no DB configured): prefer native SQLite for
+                        // production-like SQL at native speed, with a graceful step-down to
+                        // wasm SQLite (real SQL + on-disk persistence) then in-memory when the
+                        // native better-sqlite3 binary is unavailable — not built, ABI mismatch
+                        // after a Node upgrade (e.g. NODE_MODULE_VERSION change), or a blocked
+                        // prebuild download. Shared with the explicit-file branch and the
+                        // datasource factory via resolveSqliteDriver (#2229), which probes by
+                        // actually opening a connection + running SELECT 1 (better-sqlite3 loads
+                        // its native addon lazily at first query, not at construction).
+                        const { resolveSqliteDriver } = await import('@objectstack/service-datasource');
+                        const resolved = await resolveSqliteDriver({
+                            filename: ':memory:',
+                            dev: true,
+                            autoMigrate: 'safe', // #2186 dev loosen-only self-heal
+                            warn: (m) => console.warn(chalk.yellow(m)),
+                        });
+                        await kernel.use(new DriverPlugin(resolved.driver));
+                        trackPlugin(resolved.engine === 'memory' ? 'MemoryDriver' : resolved.engine === 'sqlite-wasm' ? 'SqliteWasmDriver' : 'SqlDriver');
+                        resolvedDriverLabel = resolved.label;
+                        resolvedDatabaseUrl = resolved.engine === 'memory' ? '(in-memory)' : ':memory:';
                     }
                 }
                 catch (e) {
@@ -876,9 +846,23 @@ export default class Serve extends Command {
                                     return next();
                                 const sub = host === __rootDomain ? '' : host.slice(0, -(__rootDomain.length + 1));
                                 const head = sub.split('.').pop() || '';
-                                if (RESERVED.has(sub) || RESERVED.has(head))
-                                    return next();
                                 const p = c.req.path;
+                                if (RESERVED.has(sub) || RESERVED.has(head)) {
+                                    // A browser loading the Console on a bare/reserved platform host
+                                    // (the apex or `www`/`app`/… — none bind a tenant env) gets the
+                                    // Console SPA, but its `/api/v1/auth/*` calls 404 (no env → no
+                                    // auth) → a dead "Auth request failed with status 404" login.
+                                    // When this runtime is cloud-connected (`OS_CLOUD_URL` set), send
+                                    // Console requests to the cloud control plane to pick/open an
+                                    // environment instead. A self-hosted single-env runtime (no
+                                    // `OS_CLOUD_URL`) keeps the prior pass-through. Non-console paths
+                                    // (infra, health, /api) fall through below unchanged.
+                                    const cloudUrl = (process.env.OS_CLOUD_URL || '').trim();
+                                    if (cloudUrl && (p === '/_console' || p.startsWith('/_console/'))) {
+                                        return c.redirect(`${cloudUrl.replace(/\/+$/, '')}/_console/`, 302);
+                                    }
+                                    return next();
+                                }
                                 if (p.startsWith('/_admin/') || p === '/_admin' || p.startsWith('/.well-known/')) {
                                     return next();
                                 }
@@ -1235,6 +1219,11 @@ export default class Serve extends Command {
                             plugins: {
                                 admin: String(process.env.OS_AUTH_ADMIN ?? 'true').toLowerCase() !== 'false',
                                 twoFactor: String(process.env.OS_AUTH_TWO_FACTOR ?? 'false').toLowerCase() === 'true',
+                                // ADR-0069 D1: reject breached passwords (Have I Been Pwned).
+                                // Opt-in; the auth Settings toggle (password_reject_breached) is
+                                // the primary control, OS_AUTH_PASSWORD_REJECT_BREACHED the
+                                // operator override (env wins in buildPluginList()).
+                                passwordRejectBreached: String(process.env.OS_AUTH_PASSWORD_REJECT_BREACHED ?? 'false').toLowerCase() === 'true',
                             },
                             advanced: process.env.OS_COOKIE_DOMAIN
                                 ? {
@@ -1269,7 +1258,7 @@ export default class Serve extends Command {
                         // the `org-scoping` service at start() time and conditionally
                         // strips the wildcard `tenant_isolation` RLS when this plugin
                         // is absent — so registration order matters.
-                        const multiTenant = String(readEnvWithDeprecation('OS_MULTI_ORG_ENABLED', 'OS_MULTI_TENANT') ?? 'false').toLowerCase() !== 'false';
+                        const multiTenant = resolveMultiOrgEnabled();
                         if (multiTenant) {
                             try {
                                 const orgScopingPkg = '@objectstack/plugin-org-scoping';
@@ -1360,6 +1349,11 @@ export default class Serve extends Command {
                 const apiConfig = config.api ?? {};
                 const enableProjectScoping = apiConfig.enableProjectScoping ?? false;
                 const projectResolution = apiConfig.projectResolution ?? 'auto';
+                // Per-project membership (sys_environment_member 403 gate) is, by
+                // default, ON whenever project-scoping is on. A host can opt OUT
+                // (env-native auth IS the membership — ADR-0024 D9) by setting
+                // `api.enforceProjectMembership: false`. Undefined → dispatcher default.
+                const enforceProjectMembership = apiConfig.enforceProjectMembership;
                 // `requireAuth: true` rejects anonymous requests on `/api/v1/data/*`
                 // with HTTP 401 before they reach ObjectQL. Default-on when the
                 // stack opts in OR when the resolved tier set includes `auth`
@@ -1385,6 +1379,7 @@ export default class Serve extends Command {
                     const observability = await buildServeObservability();
                     await kernel.use(createDispatcherPlugin({
                         scoping: { enableProjectScoping, projectResolution },
+                        enforceProjectMembership,
                         observability,
                     }));
                     trackPlugin('Dispatcher');
@@ -1416,7 +1411,32 @@ export default class Serve extends Command {
                     return import(/* webpackIgnore: true */ pkg);
                 }
             };
-            if (!hasAIPlugin && tierEnabled('ai')) {
+            // [CE AI opt-in] Auto-register the headless AI service ONLY when the host
+            // app DECLARES the AI service (or the cloud AI Studio that builds on it).
+            // Declaration is the edition boundary: a Community-Edition app that omits
+            // both gets no AI service, no
+            // agents, and no `services.ai` in discovery (so the console hides its AI
+            // surface), while MCP and every other capability are unaffected. Gating on
+            // a *declared* dep — not mere resolvability — makes this reliable in a
+            // workspace/monorepo, where the package stays hoist-resolvable when undeclared.
+            const _fs = await import('node:fs');
+            const hostDeclaresDependency = (pkg) => {
+                try {
+                    const hostPkg = JSON.parse(_fs.readFileSync(_hostRequire.resolve('./package.json'), 'utf8'));
+                    return Boolean(hostPkg.dependencies?.[pkg] ?? hostPkg.devDependencies?.[pkg]
+                        ?? hostPkg.optionalDependencies?.[pkg] ?? hostPkg.peerDependencies?.[pkg]);
+                }
+                catch {
+                    return false;
+                }
+            };
+            // AI Studio (`@objectstack/service-ai-studio`) attaches its personas via the
+            // `ai:ready` hook the base service fires, so declaring Studio implies the base
+            // service — load it even when only Studio is in the deps (the base is a
+            // transitive dep of Studio, so it stays resolvable).
+            const wantsAiService = hostDeclaresDependency('@objectstack/service-ai')
+                || hostDeclaresDependency('@objectstack/service-ai-studio');
+            if (!hasAIPlugin && tierEnabled('ai') && wantsAiService) {
                 try {
                     const aiPkg = '@objectstack/service-ai';
                     const { AIServicePlugin } = await importFromHost(aiPkg);
@@ -1970,7 +1990,7 @@ export default class Serve extends Command {
                 consolePath: loadedPlugins.includes('ConsoleUI') ? CONSOLE_PATH : undefined,
                 driverLabel: resolvedDriverLabel,
                 databaseUrl: redactDbUrl(resolvedDatabaseUrl),
-                multiTenant: String(readEnvWithDeprecation('OS_MULTI_ORG_ENABLED', 'OS_MULTI_TENANT') ?? 'false').toLowerCase() !== 'false',
+                multiTenant: resolveMultiOrgEnabled(),
                 seededAdmin,
             });
             // ── Publish the actually-bound port ────────────────────────────