@objectstack/cli 4.0.4 → 4.1.0

package/dist/utils/cloud-config.js

@@ -0,0 +1,75 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+/**
+ * Cloud credential store — separate from the runtime credential store at
+ * `~/.objectstack/credentials.json`.
+ *
+ * Why a second file?
+ * ------------------
+ * ObjectStack now has two distinct identities on a developer's machine:
+ *
+ *   1. **Runtime identity** — who you are inside your *own* ObjectOS
+ *      instance (the CRM / Todo / app you're building). Stored in
+ *      `credentials.json`, written by `os login`.
+ *
+ *   2. **Cloud identity** — who you are on the official ObjectStack Cloud
+ *      package registry (`https://cloud.objectos.app`). Stored in
+ *      `cloud.json`, written by `os cloud login`. Used to publish &
+ *      install packages, browse the marketplace, etc.
+ *
+ * Keeping them in separate files makes it unambiguous which token a
+ * command is going to use, and makes it impossible to accidentally
+ * publish a package with a runtime-scoped token.
+ */
+import { chmod, mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** Canonical hosted control plane. */
+export const DEFAULT_CLOUD_URL = 'https://cloud.objectos.app';
+export function getCloudCredentialsPath() {
+    return join(homedir(), '.objectstack', 'cloud.json');
+}
+export async function readCloudConfig() {
+    const path = getCloudCredentialsPath();
+    try {
+        const content = await readFile(path, 'utf-8');
+        return JSON.parse(content);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            throw new Error('Not logged in to ObjectStack Cloud. Run `os cloud login` first.');
+        }
+        throw new Error(`Failed to read cloud credentials: ${error.message}`);
+    }
+}
+export async function tryReadCloudConfig() {
+    try {
+        return await readCloudConfig();
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function writeCloudConfig(config) {
+    const path = getCloudCredentialsPath();
+    const dir = join(homedir(), '.objectstack');
+    await mkdir(dir, { recursive: true });
+    await writeFile(path, JSON.stringify(config, null, 2), { mode: 0o600 });
+    try {
+        await chmod(path, 0o600);
+    }
+    catch {
+        // Platforms without chmod support — silently continue.
+    }
+}
+export async function deleteCloudConfig() {
+    const path = getCloudCredentialsPath();
+    try {
+        await unlink(path);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw new Error(`Failed to delete cloud credentials: ${error.message}`);
+        }
+    }
+}
+//# sourceMappingURL=cloud-config.js.map

package/dist/utils/cloud-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-config.js","sourceRoot":"","sources":["../../src/utils/cloud-config.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,sCAAsC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAmB9D,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,eAAe,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAmB;IACxD,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IAE5C,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/utils/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,GAAG,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CA6BzD;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBvE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAgC,GAAG,OAAO,CAE5E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,GAAG,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CA6BzD;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAiCvE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAgC,GAAG,OAAO,CAE5E"}

package/dist/utils/config.js

@@ -47,10 +47,25 @@ export async function loadConfig(source) {
     const { mod } = await bundleRequire({
         filepath: absolutePath,
     });
-    const config = mod.default || mod;
-    if (!config) {
+    const baseConfig = mod.default || mod;
+    if (!baseConfig) {
         throw new Error(`No default export found in ${path.basename(absolutePath)}`);
     }
+    // Preserve named exports (e.g. `onEnable`, `onDisable` lifecycle hooks)
+    // alongside the default-exported stack. Module-namespace named exports are
+    // otherwise dropped when we unwrap `mod.default`, which prevents AppPlugin
+    // from invoking runtime hooks.
+    const config = (baseConfig === mod || mod.default == null)
+        ? baseConfig
+        : (() => {
+            const merged = { ...baseConfig };
+            for (const key of Object.keys(mod)) {
+                if (key === 'default' || key in merged)
+                    continue;
+                merged[key] = mod[key];
+            }
+            return merged;
+        })();
     return {
         config,
         absolutePath,

package/dist/utils/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,0BAA0B,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC,CAAC;YAC/F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC,CAAC;YACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,cAAc;IACd,MAAM,UAAU,GAAG;QACjB,uBAAuB;QACvB,uBAAuB;QACvB,wBAAwB;KACzB,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IACrC,CAAC;IAED,UAAU,CAAC,8DAA8D,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAe;IAC9C,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,aAAa,CAAC;QAClC,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,MAAM;QACN,YAAY;QACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC7B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,uBAAuB;IACjE,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,0BAA0B,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC,CAAC;YAC/F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC,CAAC;YACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,cAAc;IACd,MAAM,UAAU,GAAG;QACjB,uBAAuB;QACvB,uBAAuB;QACvB,wBAAwB;KACzB,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IACrC,CAAC;IAED,UAAU,CAAC,8DAA8D,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAe;IAC9C,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,aAAa,CAAC;QAClC,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,MAAM,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC;QACxD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,MAAM,GAAQ,EAAE,GAAG,UAAU,EAAE,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,IAAI,MAAM;oBAAE,SAAS;gBACjD,MAAM,CAAC,GAAG,CAAC,GAAI,GAAW,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,MAAM;QACN,YAAY;QACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC7B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,uBAAuB;IACjE,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/utils/console.d.ts

@@ -0,0 +1,33 @@
+/** URL mount path for the Console portal inside the ObjectStack server */
+export declare const CONSOLE_PATH = "/_console";
+/**
+ * Resolve the filesystem path to the @objectstack/console package.
+ * Searches workspace locations first, then falls back to node_modules.
+ */
+export declare function resolveConsolePath(): string | null;
+/**
+ * Check whether the Console portal has a pre-built `dist/` directory.
+ */
+export declare function hasConsoleDist(consolePath: string): boolean;
+/**
+ * Create a lightweight kernel plugin that serves the pre-built Console
+ * portal static files at `/_console/*`.
+ *
+ * Identical SPA-fallback semantics to `createStudioStaticPlugin` and
+ * `createAccountStaticPlugin`:
+ *   - `index.html` is read fresh on every fallback hit (so a rebuild
+ *     producing new hashed asset names doesn't leave the browser
+ *     pointing at stale URLs).
+ *   - Hashed asset paths under `/_console/assets/*` never SPA-fallback —
+ *     a real 404 surfaces a rebuild/deploy mismatch instead of the
+ *     dreaded "asset returns text/html" silent failure.
+ */
+export declare function createConsoleStaticPlugin(distPath: string, options?: {
+    isDev?: boolean;
+    rootRedirect?: boolean;
+}): {
+    name: string;
+    init: () => Promise<void>;
+    start: (ctx: any) => Promise<void>;
+};
+//# sourceMappingURL=console.d.ts.map

package/dist/utils/console.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../../src/utils/console.ts"],"names":[],"mappings":"AAwBA,0EAA0E;AAC1E,eAAO,MAAM,YAAY,cAAc,CAAC;AAIxC;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CA6ClD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE3D;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE;;;iBAM1F,GAAG;EAgEzB"}

package/dist/utils/console.js

@@ -0,0 +1,172 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+/**
+ * Console UI Integration Utilities
+ *
+ * Mirrors `studio.ts` / `account.ts` but for the opinionated, fork-ready
+ * runtime console (`@objectstack/console`). The Console SPA is mounted at
+ * `/_console/` by every deployment that opts in (CLI dev server,
+ * self-host, Vercel) — exactly the same convention as `_studio` and
+ * `_account`. The Console is built with `base: '/_console/'`, so its
+ * pre-built `dist/` is served verbatim.
+ *
+ * Note: this module was previously named `dashboard.ts` (and the SPA was
+ * `apps/dashboard`). It was renamed to disambiguate from the spec-level
+ * `Dashboard` metadata type — the Console *renders* dashboards, it is not
+ * itself a dashboard.
+ */
+import path from 'path';
+import fs from 'fs';
+import { createRequire } from 'module';
+import { pathToFileURL } from 'url';
+// ─── Constants ──────────────────────────────────────────────────────
+/** URL mount path for the Console portal inside the ObjectStack server */
+export const CONSOLE_PATH = '/_console';
+// ─── Path Resolution ────────────────────────────────────────────────
+/**
+ * Resolve the filesystem path to the @objectstack/console package.
+ * Searches workspace locations first, then falls back to node_modules.
+ */
+export function resolveConsolePath() {
+    const cwd = process.cwd();
+    // Workspace candidates (monorepo layouts)
+    const candidates = [
+        path.resolve(cwd, 'apps/console'),
+        path.resolve(cwd, '../../apps/console'),
+        path.resolve(cwd, '../apps/console'),
+    ];
+    for (const candidate of candidates) {
+        const pkgPath = path.join(candidate, 'package.json');
+        if (fs.existsSync(pkgPath)) {
+            try {
+                const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+                if (pkg.name === '@objectstack/console')
+                    return candidate;
+            }
+            catch {
+                // Skip invalid package.json
+            }
+        }
+    }
+    // Fallback: resolve from node_modules via createRequire.
+    const resolutionBases = [
+        pathToFileURL(path.join(cwd, 'package.json')).href, // consumer workspace
+        import.meta.url, // CLI package itself
+    ];
+    for (const base of resolutionBases) {
+        try {
+            const req = createRequire(base);
+            const resolved = req.resolve('@objectstack/console/package.json');
+            return path.dirname(resolved);
+        }
+        catch {
+            // Not resolvable from this base — try next
+        }
+    }
+    // Last resort: direct filesystem check in cwd/node_modules
+    const directPath = path.join(cwd, 'node_modules', '@objectstack', 'console');
+    if (fs.existsSync(path.join(directPath, 'package.json'))) {
+        return directPath;
+    }
+    return null;
+}
+/**
+ * Check whether the Console portal has a pre-built `dist/` directory.
+ */
+export function hasConsoleDist(consolePath) {
+    return fs.existsSync(path.join(consolePath, 'dist', 'index.html'));
+}
+// ─── Plugin Factory ─────────────────────────────────────────────────
+/**
+ * Create a lightweight kernel plugin that serves the pre-built Console
+ * portal static files at `/_console/*`.
+ *
+ * Identical SPA-fallback semantics to `createStudioStaticPlugin` and
+ * `createAccountStaticPlugin`:
+ *   - `index.html` is read fresh on every fallback hit (so a rebuild
+ *     producing new hashed asset names doesn't leave the browser
+ *     pointing at stale URLs).
+ *   - Hashed asset paths under `/_console/assets/*` never SPA-fallback —
+ *     a real 404 surfaces a rebuild/deploy mismatch instead of the
+ *     dreaded "asset returns text/html" silent failure.
+ */
+export function createConsoleStaticPlugin(distPath, options) {
+    return {
+        name: 'com.objectstack.console-static',
+        init: async () => { },
+        start: async (ctx) => {
+            const httpServer = ctx.getService?.('http.server');
+            if (!httpServer?.getRawApp) {
+                ctx.logger?.warn?.('Console static: http.server service not found — skipping');
+                return;
+            }
+            const app = httpServer.getRawApp();
+            const absoluteDist = path.resolve(distPath);
+            const indexPath = path.join(absoluteDist, 'index.html');
+            if (!fs.existsSync(indexPath)) {
+                ctx.logger?.warn?.(`Console static: dist not found at ${absoluteDist}`);
+                return;
+            }
+            const readIndexHtml = () => fs.readFileSync(indexPath, 'utf-8');
+            // The Console is the default end-user surface — root `/` redirects
+            // here whenever the Console is mounted (`rootRedirect !== false`).
+            // Mirrors the studio plugin's `rootRedirect` option. The CLI's
+            // serve.ts gates whether the Console mounts at all via `--no-console`
+            // / `OS_DISABLE_CONSOLE=1`; once mounted, claiming `/` is the
+            // intended behaviour in both dev and production deployments.
+            if (options?.rootRedirect !== false) {
+                app.get('/', (c) => c.redirect(`${CONSOLE_PATH}/`));
+            }
+            // Redirect bare path to trailing-slash (SPA convention)
+            app.get(CONSOLE_PATH, (c) => c.redirect(`${CONSOLE_PATH}/`));
+            // Serve static files with SPA fallback
+            app.get(`${CONSOLE_PATH}/*`, async (c) => {
+                const reqPath = c.req.path.substring(CONSOLE_PATH.length) || '/';
+                const filePath = path.join(absoluteDist, reqPath);
+                // Security: prevent path traversal
+                if (!filePath.startsWith(absoluteDist)) {
+                    return c.text('Forbidden', 403);
+                }
+                // Try serving the exact file
+                if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {
+                    const content = fs.readFileSync(filePath);
+                    return new Response(content, {
+                        headers: { 'content-type': mimeType(filePath) },
+                    });
+                }
+                // Hashed-asset paths must never SPA-fallback.
+                if (reqPath.startsWith('/assets/')) {
+                    return c.text('Not Found', 404);
+                }
+                // SPA fallback
+                return new Response(readIndexHtml(), {
+                    headers: { 'content-type': 'text/html; charset=utf-8' },
+                });
+            });
+            // Suppress unused-parameter lint when isDev isn't needed.
+            void options;
+        },
+    };
+}
+// ─── Helpers ────────────────────────────────────────────────────────
+const MIME_TYPES = {
+    '.html': 'text/html; charset=utf-8',
+    '.js': 'application/javascript; charset=utf-8',
+    '.mjs': 'application/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.ico': 'image/x-icon',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+    '.ttf': 'font/ttf',
+    '.map': 'application/json',
+};
+function mimeType(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    return MIME_TYPES[ext] || 'application/octet-stream';
+}
+//# sourceMappingURL=console.js.map

package/dist/utils/console.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console.js","sourceRoot":"","sources":["../../src/utils/console.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE;;;;;;;;;;;;;;GAcG;AACH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,uEAAuE;AAEvE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AAExC,uEAAuE;AAEvE;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAE1B,0CAA0C;IAC1C,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,oBAAoB,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC;KACrC,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACrD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC1D,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAsB;oBAAE,OAAO,SAAS,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,eAAe,GAAG;QACtB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,EAAG,qBAAqB;QAC1E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAwC,qBAAqB;KAC7E,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IAC7E,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,OAAqD;IAC/G,OAAO;QACL,IAAI,EAAE,gCAAgC;QAEtC,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QAEpB,KAAK,EAAE,KAAK,EAAE,GAAQ,EAAE,EAAE;YACxB,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,CAAC;YACnD,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,0DAA0D,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAE5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9B,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAEhE,mEAAmE;YACnE,mEAAmE;YACnE,+DAA+D;YAC/D,sEAAsE;YACtE,8DAA8D;YAC9D,6DAA6D;YAC7D,IAAI,OAAO,EAAE,YAAY,KAAK,KAAK,EAAE,CAAC;gBACpC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC;YAED,wDAAwD;YACxD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC;YAElE,uCAAuC;YACvC,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,EAAE,KAAK,EAAE,CAAM,EAAE,EAAE;gBAC5C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;gBACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBAElD,mCAAmC;gBACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBACvC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;gBAClC,CAAC;gBAED,6BAA6B;gBAC7B,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC9D,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;oBAC1C,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;wBAC3B,OAAO,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE;qBAChD,CAAC,CAAC;gBACL,CAAC;gBAED,8CAA8C;gBAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBACnC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;gBAClC,CAAC;gBAED,eAAe;gBACf,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE;oBACnC,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;iBACxD,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,0DAA0D;YAC1D,KAAK,OAAO,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AAEvE,MAAM,UAAU,GAA2B;IACzC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAI,uCAAuC;IAChD,MAAM,EAAG,uCAAuC;IAChD,MAAM,EAAG,yBAAyB;IAClC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAG,eAAe;IACxB,MAAM,EAAG,WAAW;IACpB,MAAM,EAAG,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAG,WAAW;IACpB,MAAM,EAAG,cAAc;IACvB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAG,UAAU;IACnB,MAAM,EAAG,kBAAkB;CAC5B,CAAC;AAEF,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AACvD,CAAC"}

package/dist/utils/extract-hook-body.d.ts

@@ -0,0 +1,13 @@
+export interface ExtractedBody {
+    /** Pure function-body source (without the surrounding `(ctx) => {...}`). */
+    source: string;
+    /** Inferred capability tokens — may be merged with explicit `// @capabilities` line. */
+    capabilities: Array<'api.read' | 'api.write' | 'crypto.uuid' | 'crypto.hash' | 'log'>;
+    /** True when source is a single expression (arrow with implicit return). */
+    isExpression: boolean;
+}
+/**
+ * Extract the body source from a callable. Throws on forbidden patterns.
+ */
+export declare function extractHookBody(fn: (...a: unknown[]) => unknown, originLabel: string): ExtractedBody;
+//# sourceMappingURL=extract-hook-body.d.ts.map

package/dist/utils/extract-hook-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-hook-body.d.ts","sourceRoot":"","sources":["../../src/utils/extract-hook-body.ts"],"names":[],"mappings":"AAgDA,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,YAAY,EAAE,KAAK,CAAC,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,aAAa,GAAG,KAAK,CAAC,CAAC;IACtF,4EAA4E;IAC5E,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,CAmDpG"}

package/dist/utils/extract-hook-body.js

@@ -0,0 +1,175 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+/**
+ * Extract a metadata-only `HookBody` from an inline JS function.
+ *
+ * The CLI's `lowerCallables` pass already has direct access to every
+ * `handler: (ctx) => {...}` value the user wrote in their `defineStack({...})`
+ * config. After tsx/esbuild has loaded the config, those callables are real
+ * runtime functions whose `.toString()` returns the compiled source — that
+ * source is exactly what we want to ship as `body.source` so the runtime can
+ * re-evaluate it inside the QuickJS sandbox without needing the .mjs side
+ * channel.
+ *
+ * For v1 we apply a deliberately simple **regex allow-list** over the
+ * extracted body — full TypeScript AST analysis is deferred to v2. Anything
+ * the regex rejects (top-level `import`, `require(`, `fetch(`, `process.*`,
+ * `globalThis.*`, `eval`, `new Function`) makes the build **fail**. There is
+ * no silent fallback to the L3 .mjs path because that path is being closed.
+ *
+ * Capability inference: we scan the body for known `ctx.api.*`, `ctx.log.*`,
+ * `ctx.crypto.*` access patterns and add the matching capability tokens to
+ * `body.capabilities` automatically. Authors can still override by setting
+ * `// @capabilities api.read api.write` as the first line of the function.
+ */
+const FORBIDDEN_PATTERNS = [
+    { rx: /\bimport\s*[\(\*\{]/, reason: 'dynamic `import()` and ES imports are not allowed in hook/action bodies — declare a Connector recipe instead' },
+    { rx: /\brequire\s*\(/, reason: '`require()` is not allowed in hook/action bodies' },
+    { rx: /\bfetch\s*\(/, reason: '`fetch()` is not allowed in hook/action bodies — declare a Connector recipe instead' },
+    { rx: /\bprocess\s*\./, reason: '`process` access is not allowed in hook/action bodies' },
+    { rx: /\bglobalThis\s*\./, reason: '`globalThis` access is not allowed in hook/action bodies' },
+    { rx: /\beval\s*\(/, reason: '`eval()` is not allowed in hook/action bodies' },
+    { rx: /\bnew\s+Function\s*\(/, reason: '`new Function()` is not allowed in hook/action bodies' },
+];
+const CAPABILITY_PATTERNS = [
+    // Match `ctx.api.object(...)` directly OR a local alias like
+    // `const api = ctx.api;` then `api.object(...)`. We accept any
+    // identifier (or chain) ending in `.object(...)` followed by a known
+    // read/write method — over-inclusive but safe (false-positive caps
+    // get rejected at the runtime by the sandbox if not actually granted).
+    { rx: /\.object\s*\([^)]+\)\s*\.\s*(?:find|findOne|count|aggregate|get|list)\b/, cap: 'api.read' },
+    { rx: /\.object\s*\([^)]+\)\s*\.\s*(?:insert|update|upsert|delete|patch|remove|create)\b/, cap: 'api.write' },
+    { rx: /ctx\.crypto\.randomUUID\b/, cap: 'crypto.uuid' },
+    { rx: /ctx\.crypto\.hash\b/, cap: 'crypto.hash' },
+    { rx: /ctx\.log\.(?:info|warn|error|debug)\b/, cap: 'log' },
+];
+/**
+ * Extract the body source from a callable. Throws on forbidden patterns.
+ */
+export function extractHookBody(fn, originLabel) {
+    const raw = String(fn);
+    // Strip leading function/arrow header and trailing closing brace so the
+    // result is a pure block body suitable for `new Function('ctx', body)`.
+    const block = peelToBlockBody(raw);
+    if (!block) {
+        throw new Error(`[hook-body-extract] could not parse the body of ${originLabel}; ` +
+            `please rewrite the handler as a single arrow function or named function expression`);
+    }
+    // Reject any forbidden token before we ship the source as metadata.
+    for (const { rx, reason } of FORBIDDEN_PATTERNS) {
+        if (rx.test(block.source)) {
+            throw new Error(`[hook-body-extract] ${originLabel}: ${reason}\n` +
+                `--- offending body source ---\n${block.source.slice(0, 400)}${block.source.length > 400 ? '…' : ''}`);
+        }
+    }
+    // Infer capabilities from API surface usage.
+    const inferred = new Set();
+    for (const { rx, cap } of CAPABILITY_PATTERNS) {
+        if (rx.test(block.source))
+            inferred.add(cap);
+    }
+    // Honour an explicit override: `// @capabilities api.read api.write`.
+    const overrideMatch = block.source.match(/^[\s\n]*\/\/\s*@capabilities\s+([a-z.\s]+)/m);
+    if (overrideMatch) {
+        const tokens = overrideMatch[1].split(/\s+/).filter(Boolean);
+        for (const t of tokens) {
+            if (t === 'api.read' ||
+                t === 'api.write' ||
+                t === 'crypto.uuid' ||
+                t === 'crypto.hash' ||
+                t === 'log') {
+                inferred.add(t);
+            }
+        }
+    }
+    return {
+        source: block.source,
+        capabilities: [...inferred].sort(),
+        isExpression: block.isExpression,
+    };
+}
+/**
+ * Remove the parameter list and outermost braces from a function string,
+ * yielding the bare statements (or expression for shorthand arrows).
+ */
+function peelToBlockBody(raw) {
+    // Try arrow forms first since they're the dominant authoring style.
+    // Match the parameter list followed by `=>` and either `{...}` or expr.
+    // We rely on a manual brace scan rather than a single regex so braces
+    // inside string/template literals don't confuse us.
+    const arrowIdx = findTopLevelArrow(raw);
+    if (arrowIdx >= 0) {
+        const after = raw.slice(arrowIdx + 2).trimStart();
+        if (after.startsWith('{')) {
+            const body = sliceBalanced(after, '{', '}');
+            if (body)
+                return { source: body.inner, isExpression: false };
+        }
+        else {
+            // Implicit-return arrow — wrap as `return ...;`
+            const expr = after.replace(/[;\s]+$/g, '');
+            return { source: `return (${expr});`, isExpression: true };
+        }
+    }
+    // function () { ... } / async function () { ... }
+    const fnIdx = raw.search(/\bfunction\b/);
+    if (fnIdx >= 0) {
+        const braceIdx = raw.indexOf('{', fnIdx);
+        if (braceIdx > 0) {
+            const body = sliceBalanced(raw.slice(braceIdx), '{', '}');
+            if (body)
+                return { source: body.inner, isExpression: false };
+        }
+    }
+    // Method shorthand inside an object literal: `name(ctx) { ... }`.
+    const braceIdx = raw.indexOf('{');
+    if (braceIdx > 0) {
+        const body = sliceBalanced(raw.slice(braceIdx), '{', '}');
+        if (body)
+            return { source: body.inner, isExpression: false };
+    }
+    return null;
+}
+function findTopLevelArrow(s) {
+    // Skip past balanced parameter list `(...)` then expect `=>`.
+    // We scan looking for `(` not preceded by an identifier char and
+    // immediately matched by a balanced `)` then optional whitespace then `=>`.
+    let i = 0;
+    const len = s.length;
+    while (i < len) {
+        if (s[i] === '(') {
+            const closing = matchBalancedIndex(s, i, '(', ')');
+            if (closing < 0)
+                return -1;
+            let j = closing + 1;
+            while (j < len && /\s/.test(s[j]))
+                j++;
+            if (s[j] === '=' && s[j + 1] === '>')
+                return j;
+            i = closing + 1;
+            continue;
+        }
+        i++;
+    }
+    return -1;
+}
+function matchBalancedIndex(s, start, open, close) {
+    let depth = 0;
+    for (let i = start; i < s.length; i++) {
+        const c = s[i];
+        if (c === open)
+            depth++;
+        else if (c === close) {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}
+function sliceBalanced(s, open, close) {
+    const end = matchBalancedIndex(s, 0, open, close);
+    if (end < 0)
+        return null;
+    return { inner: s.slice(1, end) };
+}
+//# sourceMappingURL=extract-hook-body.js.map

package/dist/utils/extract-hook-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-hook-body.js","sourceRoot":"","sources":["../../src/utils/extract-hook-body.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,kBAAkB,GAA0C;IAChE,EAAE,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,8GAA8G,EAAE;IACrJ,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,kDAAkD,EAAE;IACpF,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,qFAAqF,EAAE;IACrH,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,uDAAuD,EAAE;IACzF,EAAE,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE,0DAA0D,EAAE;IAC/F,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,+CAA+C,EAAE;IAC9E,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE,uDAAuD,EAAE;CACjG,CAAC;AAEF,MAAM,mBAAmB,GAAiG;IACxH,6DAA6D;IAC7D,+DAA+D;IAC/D,qEAAqE;IACrE,mEAAmE;IACnE,uEAAuE;IACvE,EAAE,EAAE,EAAE,yEAAyE,EAAE,GAAG,EAAE,UAAU,EAAE;IAClG,EAAE,EAAE,EAAE,mFAAmF,EAAE,GAAG,EAAE,WAAW,EAAE;IAC7G,EAAE,EAAE,EAAE,2BAA2B,EAAE,GAAG,EAAE,aAAa,EAAE;IACvD,EAAE,EAAE,EAAE,qBAAqB,EAAE,GAAG,EAAE,aAAa,EAAE;IACjD,EAAE,EAAE,EAAE,uCAAuC,EAAE,GAAG,EAAE,KAAK,EAAE;CAC5D,CAAC;AAWF;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,EAAgC,EAAE,WAAmB;IACnF,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAEvB,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,mDAAmD,WAAW,IAAI;YAChE,oFAAoF,CACvF,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;QAChD,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,uBAAuB,WAAW,KAAK,MAAM,IAAI;gBAC/C,kCAAkC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyC,CAAC;IAClE,KAAK,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,mBAAmB,EAAE,CAAC;QAC9C,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,sEAAsE;IACtE,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACxF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IACE,CAAC,KAAK,UAAU;gBAChB,CAAC,KAAK,WAAW;gBACjB,CAAC,KAAK,aAAa;gBACnB,CAAC,KAAK,aAAa;gBACnB,CAAC,KAAK,KAAK,EACX,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC;AACJ,CAAC;AAOD;;;GAGG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,oEAAoE;IACpE,wEAAwE;IACxE,sEAAsE;IACtE,oDAAoD;IACpD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,gDAAgD;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,WAAW,IAAI,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1D,IAAI,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1D,IAAI,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,8DAA8D;IAC9D,iEAAiE;IACjE,4EAA4E;IAC5E,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IACrB,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACnD,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;YACpB,OAAO,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,CAAC,CAAC;YAC/C,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS,EAAE,KAAa,EAAE,IAAY,EAAE,KAAa;IAC/E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,IAAI;YAAE,KAAK,EAAE,CAAC;aACnB,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YACrB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,CAAS,EAAE,IAAY,EAAE,KAAa;IAC3D,MAAM,GAAG,GAAG,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AACpC,CAAC"}

package/dist/utils/format.d.ts

@@ -46,6 +46,14 @@ export interface ServerReadyOptions {
     pluginNames?: string[];
     uiEnabled?: boolean;
     studioPath?: string;
+    accountPath?: string;
+    consolePath?: string;
+    /** Resolved storage driver display name (e.g. "MongoDBDriver", "SqlDriver(pg)"). */
+    driverLabel?: string;
+    /** Resolved DB URL with credentials redacted. */
+    databaseUrl?: string;
+    /** Whether the SecurityPlugin was wired in multi-tenant mode (default true). */
+    multiTenant?: boolean;
 }
 export declare function printServerReady(opts: ServerReadyOptions): void;
 export declare function printMetadataStats(stats: MetadataStats): void;

package/dist/utils/format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/utils/format.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAGpC,eAAO,MAAM,QAAQ,gBAAgB,CAAC;AACtC,eAAO,MAAM,SAAS,OAAO,CAAC;AAI9B,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,QAM1C;AAID,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,QAGxC;AAID,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,QAGzE;AAID,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,QAEvC;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,QAEvC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,QAErC;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,QAEpC;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,QAEpC;AAID,wBAAgB,WAAW;;;EAM1B;AAID,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,QAwC9C;AAID,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,GAAG,GAAG,aAAa,CAwC/D;AAID,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,QAmBxD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,QAwDtD"}
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/utils/format.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAGpC,eAAO,MAAM,QAAQ,gBAAgB,CAAC;AACtC,eAAO,MAAM,SAAS,OAAO,CAAC;AAI9B,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,QAM1C;AAID,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,QAGxC;AAID,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,QAGzE;AAID,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,QAEvC;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,QAEvC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,QAErC;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,QAEpC;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,QAEpC;AAID,wBAAgB,WAAW;;;EAM1B;AAID,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,QAwC9C;AAID,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,GAAG,GAAG,aAAa,CAwC/D;AAID,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,QAgCxD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,QAwDtD"}

package/dist/utils/format.js

@@ -127,13 +127,26 @@ export function printServerReady(opts) {
     console.log('');
     console.log(chalk.bold.green('  ✓ Server is ready'));
     console.log('');
-    console.log(chalk.cyan('  ➜') + chalk.bold('  API:     ') + chalk.cyan(base + '/'));
+    console.log(chalk.cyan('  ➜') + chalk.bold('  API:       ') + chalk.cyan(base + '/'));
     if (opts.uiEnabled && opts.studioPath) {
-        console.log(chalk.cyan('  ➜') + chalk.bold('  Studio:  ') + chalk.cyan(base + opts.studioPath + '/'));
+        console.log(chalk.cyan('  ➜') + chalk.bold('  Studio:    ') + chalk.cyan(base + opts.studioPath + '/'));
+    }
+    if (opts.uiEnabled && opts.accountPath) {
+        console.log(chalk.cyan('  ➜') + chalk.bold('  Account:   ') + chalk.cyan(base + opts.accountPath + '/'));
+    }
+    if (opts.uiEnabled && opts.consolePath) {
+        console.log(chalk.cyan('  ➜') + chalk.bold('  Console:   ') + chalk.cyan(base + opts.consolePath + '/'));
     }
     console.log('');
     console.log(chalk.dim(`  Config:  ${opts.configFile}`));
     console.log(chalk.dim(`  Mode:    ${opts.isDev ? 'development' : 'production'}`));
+    if (opts.driverLabel) {
+        const dbInfo = opts.databaseUrl ? `${opts.driverLabel}  ${chalk.dim('→')} ${opts.databaseUrl}` : opts.driverLabel;
+        console.log(chalk.dim(`  Driver:  ${dbInfo}`));
+    }
+    if (opts.multiTenant !== undefined) {
+        console.log(chalk.dim(`  Tenancy: ${opts.multiTenant ? 'multi-tenant' : 'single-tenant'}`));
+    }
     console.log(chalk.dim(`  Plugins: ${opts.pluginCount} loaded`));
     if (opts.pluginNames && opts.pluginNames.length > 0) {
         console.log(chalk.dim(`           ${opts.pluginNames.join(', ')}`));