@objectstack/cli 4.0.4 → 4.1.0

package/dist/commands/serve.js

@@ -5,9 +5,11 @@ import fs from 'fs';
 import net from 'net';
 import chalk from 'chalk';
 import { bundleRequire } from 'bundle-require';
-import { isHostConfig } from '../utils/plugin-detection.js';
+import { shouldBootWithLibrary } from '../utils/plugin-detection.js';
 import { printError, printServerReady, } from '../utils/format.js';
 import { STUDIO_PATH, resolveStudioPath, hasStudioDist, createStudioStaticPlugin, } from '../utils/studio.js';
+import { ACCOUNT_PATH, resolveAccountPath, hasAccountDist, createAccountStaticPlugin, } from '../utils/account.js';
+import { CONSOLE_PATH, resolveConsolePath, hasConsoleDist, createConsoleStaticPlugin, } from '../utils/console.js';
 import dotenvFlow from 'dotenv-flow';
 // Helper to find available port
 const getAvailablePort = async (startPort) => {
@@ -33,18 +35,61 @@ const getAvailablePort = async (startPort) => {
     return port;
 };
 export default class Serve extends Command {
-    static description = 'Start ObjectStack server with plugins from configuration';
+    static description = 'Start ObjectStack server. Reads `objectstack.config.ts` if present; otherwise falls back to `dist/objectstack.json` (or OS_ARTIFACT_PATH, including http(s):// URLs) as a portable artifact.';
     static args = {
         config: Args.string({ description: 'Configuration file path', required: false, default: 'objectstack.config.ts' }),
     };
     static flags = {
-        port: Flags.string({ char: 'p', description: 'Server port', default: '3000' }),
+        port: Flags.string({ char: 'p', description: 'Server port', default: process.env.PORT ?? '3000' }),
         dev: Flags.boolean({ description: 'Run in development mode (load devPlugins)' }),
-        ui: Flags.boolean({ description: 'Enable Studio UI at /_studio/ (default: true in dev mode)' }),
+        ui: Flags.boolean({ description: 'Enable Studio UI at /_studio/ (default: true)', default: true, allowNo: true }),
+        console: Flags.boolean({
+            description: 'Mount the Console UI at /_console/ when the package is installed (default: true). When disabled, Studio claims the root redirect.',
+            default: true,
+            allowNo: true,
+        }),
         server: Flags.boolean({ description: 'Start HTTP server plugin', default: true, allowNo: true }),
+        prebuilt: Flags.boolean({ description: 'Skip esbuild/bundle-require — load config as native ESM (production mode)', default: false }),
+        preset: Flags.string({
+            description: 'Plugin tier preset: minimal | default | full (overridden by config.tiers if set)',
+            options: ['minimal', 'default', 'full'],
+        }),
+    };
+    /**
+     * Capabilities auto-added to every app's `requires` for every preset
+     * EXCEPT `minimal`. These form the foundation that every server-side
+     * runtime expects to exist (background work, settings persistence,
+     * transactional mail, file uploads). Apps may still list these in
+     * `requires:` explicitly — duplicates are de-duped.
+     *
+     * Opt out: `objectstack serve --preset minimal`.
+     *
+     * Mirrored on hosted objectos per-project kernels by
+     * `mountDefaultProjectPlugins()` in `@objectstack/service-cloud`.
+     */
+    static ALWAYS_ON_CAPABILITIES = Object.freeze([
+        'queue', 'job', 'cache', 'settings', 'email', 'storage',
+    ]);
+    /**
+     * Auto-registered plugin tiers. Plugins explicitly listed in
+     * `config.plugins` are always loaded — tiers only gate the optional
+     * auto-registration blocks below (AIService, I18n, Studio UI, etc.).
+     */
+    static TIER_PRESETS = {
+        minimal: ['core'],
+        default: ['core', 'i18n', 'ui', 'auth'],
+        full: ['core', 'i18n', 'ui', 'ai', 'auth'],
     };
     async run() {
         const { args, flags } = await this.parse(Serve);
+        // When --dev is passed, set NODE_ENV early so any runtime modules
+        // imported below (and any deps that branch on NODE_ENV at import
+        // time) see development mode. We deliberately do NOT inherit
+        // NODE_ENV from the parent `os dev` spawn — see the note in
+        // commands/dev.ts for why.
+        if (flags.dev && !process.env.NODE_ENV) {
+            process.env.NODE_ENV = 'development';
+        }
         let port = parseInt(flags.port);
         try {
             const availablePort = await getAvailablePort(port);
@@ -63,14 +108,36 @@ export default class Serve extends Command {
         const isDev = flags.dev || process.env.NODE_ENV === 'development';
         const absolutePath = path.resolve(process.cwd(), args.config);
         const relativeConfig = path.relative(process.cwd(), absolutePath);
-        if (!fs.existsSync(absolutePath)) {
-            printError(`Configuration file not found: ${absolutePath}`);
-            console.log(chalk.dim('  Hint: Run `objectstack init` to create a new project'));
-            this.exit(1);
+        // ── Artifact-first fallback ──────────────────────────────────────
+        // If the user did not author an `objectstack.config.ts`, but a
+        // compiled artifact is reachable (explicit OS_ARTIFACT_PATH —
+        // including http(s):// URLs — or the canonical
+        // `<cwd>/dist/objectstack.json`), boot from that artifact alone.
+        // This is the same capability previously hard-coded in
+        // `apps/objectos/objectstack.config.ts`, lifted into the framework
+        // so any project can `objectstack start` against just a
+        // `dist/objectstack.json`.
+        const configMissing = !fs.existsSync(absolutePath);
+        let useArtifactFallback = false;
+        if (configMissing) {
+            const { resolveDefaultArtifactPath } = await import('@objectstack/runtime');
+            const artifactSource = resolveDefaultArtifactPath();
+            if (!artifactSource) {
+                printError(`Configuration file not found: ${absolutePath}`);
+                console.log(chalk.dim('  Hint: Run `objectstack init` to create a new project,'));
+                console.log(chalk.dim('        or run `objectstack build` first, or set OS_ARTIFACT_PATH.'));
+                this.exit(1);
+            }
+            useArtifactFallback = true;
         }
         // Quiet loading — only show a single spinner line
         console.log('');
-        console.log(chalk.dim(`  Loading ${relativeConfig}...`));
+        if (useArtifactFallback) {
+            console.log(chalk.dim('  No objectstack.config.ts found — booting from artifact (default host)...'));
+        }
+        else {
+            console.log(chalk.dim(`  Loading ${relativeConfig}...`));
+        }
         // Track loaded plugins for summary
         const loadedPlugins = [];
         const shortPluginName = (raw) => {
@@ -86,6 +153,20 @@ export default class Serve extends Command {
             return raw;
         };
         const trackPlugin = (name) => { loadedPlugins.push(shortPluginName(name)); };
+        // Track resolved storage driver + redacted URL for the startup banner.
+        let resolvedDriverLabel;
+        let resolvedDatabaseUrl;
+        const redactDbUrl = (url) => {
+            if (!url)
+                return undefined;
+            try {
+                // Redact passwords inside connection URLs: protocol://user:****@host/db
+                return url.replace(/(\/\/[^/@:]+):[^/@]+@/, '$1:****@');
+            }
+            catch {
+                return url;
+            }
+        };
         // Save original console/stdout methods — we'll suppress noise during boot
         const originalConsoleLog = console.log;
         const originalConsoleDebug = console.debug;
@@ -116,13 +197,145 @@ export default class Serve extends Command {
             console.debug = (...args) => { if (!bootQuiet)
                 originalConsoleDebug(...args); };
             // Load configuration
-            const { mod } = await bundleRequire({
-                filepath: absolutePath,
-            });
-            const config = mod.default || mod;
-            if (!config) {
+            // --prebuilt: load as native ESM (no esbuild, no bundle-require) —
+            // intended for production where the config has been compiled to dist/.
+            // --artifact-fallback: skip config loading entirely; the default-host
+            // helper will synthesize a stack from the artifact JSON below.
+            const { mod } = useArtifactFallback
+                ? { mod: { default: {} } }
+                : flags.prebuilt
+                    ? { mod: await import(absolutePath.startsWith('/') ? `file://${absolutePath}` : absolutePath) }
+                    : await bundleRequire({ filepath: absolutePath });
+            let config = mod.default || mod;
+            if (!useArtifactFallback && !config) {
                 throw new Error(`No default export found in ${args.config}`);
             }
+            // Preserve module-level named exports (e.g. `onEnable`, `onDisable`
+            // lifecycle hooks) that would otherwise be dropped when we unwrap
+            // `mod.default`. Without this AppPlugin can never invoke runtime hooks
+            // declared as `export const onEnable = ...` alongside the default
+            // `defineStack(...)` export.
+            if (mod.default != null && config !== mod) {
+                const merged = { ...config };
+                for (const key of Object.keys(mod)) {
+                    if (key === 'default' || key in merged)
+                        continue;
+                    merged[key] = mod[key];
+                }
+                config = merged;
+            }
+            // Boot-mode dispatch: standalone goes directly through
+            // `@objectstack/runtime` (no cloud dependencies). runtime/cloud
+            // modes go through `@objectstack/service-cloud`.
+            if (useArtifactFallback || shouldBootWithLibrary(config)) {
+                // The boot stack returns only `{plugins, api}` — preserve the
+                // original stack metadata (notably `requires`, `analyticsCubes`,
+                // `tiers`) so the capability resolver further down can read it.
+                const originalConfig = config;
+                const resolvedMode = config.bootMode ?? process.env.OS_MODE ?? 'standalone';
+                if (useArtifactFallback) {
+                    // Artifact-only boot — no objectstack.config.ts authored.
+                    // Always use the default-host helper which is standalone-only
+                    // and never depends on @objectstack/service-cloud.
+                    const { createDefaultHostConfig } = await import('@objectstack/runtime');
+                    const bootResult = await createDefaultHostConfig();
+                    config = { ...originalConfig, ...bootResult };
+                }
+                else if (resolvedMode === 'standalone') {
+                    const { createStandaloneStack } = await import('@objectstack/runtime');
+                    const bootResult = await createStandaloneStack(config.standalone);
+                    config = { ...originalConfig, ...bootResult };
+                }
+                else {
+                    // Cloud / multi-project boot modes require @objectstack/service-cloud.
+                    // When the package is unavailable (e.g. someone vendored only the
+                    // public framework), fail with a clear, actionable error instead of
+                    // an opaque module-not-found stack trace.
+                    let createBootStack;
+                    try {
+                        ({ createBootStack } = await import('@objectstack/service-cloud'));
+                    }
+                    catch (err) {
+                        throw new Error(`Boot mode '${resolvedMode}' requires @objectstack/service-cloud, which is not installed.\n`
+                            + `Either install it (\`pnpm add @objectstack/service-cloud\`) or switch to bootMode='standalone'.\n`
+                            + `Underlying error: ${err?.message ?? String(err)}`);
+                    }
+                    const bootResult = await createBootStack({
+                        mode: config.bootMode,
+                        runtime: config.runtime ?? config.project,
+                        cloud: config.cloud,
+                    });
+                    config = { ...originalConfig, ...bootResult };
+                }
+            }
+            // ── Resolve plugin tiers ──────────────────────────────────────
+            // Precedence: config.requires (capability declarations) >
+            //             config.tiers > --preset > built-in default.
+            //
+            // `requires: ['ai', 'automation', ...]` is the recommended
+            // app-level way to declare platform dependencies. The CLI
+            // expands each capability name into the matching tier so the
+            // optional auto-registration blocks below light up without
+            // extra flags. Explicitly-listed `config.plugins` always load
+            // and shadow any capability resolution (i.e. an explicit
+            // instance wins over the auto-loader).
+            const presetName = flags.preset ?? (isDev ? 'default' : 'default');
+            const presetTiers = Serve.TIER_PRESETS[presetName] ?? Serve.TIER_PRESETS.default;
+            const requires = Array.isArray(config.requires)
+                ? config.requires.filter((c) => typeof c === 'string')
+                : [];
+            // Auth callbacks (password-reset, email-verification, magic-link,
+            // invitation) depend on the email service. Auto-pull `email` when
+            // `auth` is required so transactional mail works out of the box
+            // (LogTransport fallback when no provider is configured).
+            if (requires.includes('auth') && !requires.includes('email')) {
+                requires.push('email');
+            }
+            // Default capability slate — every preset except `minimal` gets the
+            // foundational services (queue + job + cache + settings + email +
+            // storage). Opt out with `objectstack serve --preset minimal`.
+            // Keeping `auth → email` above as a defensive rule for users who
+            // explicitly opt into `minimal` but still enable auth.
+            const ALWAYS_CAPS = Serve.ALWAYS_ON_CAPABILITIES;
+            if (presetName !== 'minimal') {
+                for (const cap of ALWAYS_CAPS) {
+                    if (!requires.includes(cap))
+                        requires.push(cap);
+                }
+            }
+            // The email + approvals + reports services schedule background work
+            // (durable retries, SLA escalation, scheduled digests). Auto-pull
+            // 'job' and 'queue' so plugins can opt into durable scheduling.
+            // IMPORTANT: prepend, so their plugins load (and their kernel:ready
+            // hooks fire) BEFORE consumers like email/approvals that subscribe
+            // to queues during their own kernel:ready phase.
+            const NEEDS_JOB_OR_QUEUE = ['email', 'approvals', 'reports', 'auth'];
+            if (NEEDS_JOB_OR_QUEUE.some((c) => requires.includes(c))) {
+                if (!requires.includes('queue'))
+                    requires.unshift('queue');
+                if (!requires.includes('job'))
+                    requires.unshift('job');
+            }
+            // Capability → tier: any capability that is gated by a tier
+            // here automatically opens that tier when listed in `requires`.
+            // Capabilities NOT in this map (e.g. `automation`, `analytics`,
+            // `audit`) bypass tier gating and are loaded directly by the
+            // capability-resolver block further down.
+            const CAPABILITY_TO_TIER = {
+                ai: 'ai',
+                i18n: 'i18n',
+                ui: 'ui',
+                auth: 'auth',
+            };
+            const requiredTiers = requires
+                .map((c) => CAPABILITY_TO_TIER[c])
+                .filter((t) => typeof t === 'string');
+            const baseTiers = Array.isArray(config.tiers) && config.tiers.length > 0
+                ? config.tiers
+                : presetTiers;
+            const tiers = new Set([...baseTiers, ...requiredTiers]);
+            const tierEnabled = (t) => tiers.has(t);
+            const requiresCapability = (c) => requires.includes(c);
             // Import ObjectStack runtime
             const { Runtime } = await import('@objectstack/runtime');
             // Set kernel logger to 'silent' — the CLI manages its own output
@@ -151,24 +364,120 @@ export default class Serve extends Command {
                     // silent
                 }
             }
-            // 2. Auto-register Memory Driver if in Dev and no driver configured
+            // 2. Auto-register storage driver
+            // Priority:
+            //   1. OS_DATABASE_DRIVER env var (explicit override)
+            //   2. URL scheme inferred from OS_DATABASE_URL
+            //        mongodb://, mongodb+srv://       → mongodb
+            //        postgres://, postgresql://       → postgres
+            //        mysql://, mysql2://              → mysql
+            //        libsql://, http(s):// + .turso.  → turso
+            //        file:, sqlite:, *.db, :memory:   → sqlite
+            //   3. Default: InMemoryDriver in dev mode
             const hasDriver = plugins.some((p) => p.name?.includes('driver') || p.constructor?.name?.includes('Driver'));
-            if (isDev && !hasDriver && config.objects) {
+            if (!hasDriver && config.objects) {
+                const explicitDriver = (process.env.OS_DATABASE_DRIVER ?? '').toLowerCase().trim();
+                const databaseUrl = process.env.OS_DATABASE_URL;
+                const inferDriverFromUrl = (url) => {
+                    if (!url)
+                        return '';
+                    const u = url.trim();
+                    if (/^mongodb(\+srv)?:\/\//i.test(u))
+                        return 'mongodb';
+                    if (/^postgres(ql)?:\/\//i.test(u))
+                        return 'postgres';
+                    if (/^mysql2?:\/\//i.test(u))
+                        return 'mysql';
+                    if (/^libsql:\/\//i.test(u))
+                        return 'turso';
+                    if (/^https?:\/\//i.test(u) && /\.turso\./i.test(u))
+                        return 'turso';
+                    if (/^file:/i.test(u) || /^sqlite:/i.test(u) || u === ':memory:' || /\.(db|sqlite|sqlite3)$/i.test(u))
+                        return 'sqlite';
+                    return '';
+                };
+                const driverType = explicitDriver || inferDriverFromUrl(databaseUrl);
                 try {
                     const { DriverPlugin } = await import('@objectstack/runtime');
-                    const { InMemoryDriver } = await import('@objectstack/driver-memory');
-                    await kernel.use(new DriverPlugin(new InMemoryDriver()));
-                    trackPlugin('MemoryDriver');
+                    if (driverType === 'mongodb' || driverType === 'mongo') {
+                        const { MongoDBDriver } = await import('@objectstack/driver-mongodb');
+                        await kernel.use(new DriverPlugin(new MongoDBDriver({
+                            url: databaseUrl ?? 'mongodb://localhost:27017/objectstack',
+                        })));
+                        trackPlugin('MongoDBDriver');
+                        resolvedDriverLabel = 'MongoDBDriver';
+                        resolvedDatabaseUrl = databaseUrl ?? 'mongodb://localhost:27017/objectstack';
+                    }
+                    else if (driverType === 'sqlite' || driverType === 'sql') {
+                        const { SqlDriver } = await import('@objectstack/driver-sql');
+                        const filePath = (databaseUrl ?? ':memory:').replace(/^file:/, '').replace(/^sqlite:/, '').replace(/^sql:\/\//, '');
+                        await kernel.use(new DriverPlugin(new SqlDriver({
+                            client: 'better-sqlite3',
+                            connection: { filename: filePath },
+                            useNullAsDefault: true,
+                        })));
+                        trackPlugin('SqlDriver');
+                        resolvedDriverLabel = 'SqlDriver(sqlite)';
+                        resolvedDatabaseUrl = databaseUrl ?? ':memory:';
+                    }
+                    else if (driverType === 'postgres' || driverType === 'postgresql' || driverType === 'pg') {
+                        const { SqlDriver } = await import('@objectstack/driver-sql');
+                        await kernel.use(new DriverPlugin(new SqlDriver({
+                            client: 'pg',
+                            connection: databaseUrl,
+                            pool: { min: 0, max: 5 },
+                        })));
+                        trackPlugin('PostgresDriver');
+                        resolvedDriverLabel = 'SqlDriver(pg)';
+                        resolvedDatabaseUrl = databaseUrl;
+                    }
+                    else if (driverType === 'mysql' || driverType === 'mysql2') {
+                        const { SqlDriver } = await import('@objectstack/driver-sql');
+                        await kernel.use(new DriverPlugin(new SqlDriver({
+                            client: 'mysql2',
+                            connection: databaseUrl,
+                            pool: { min: 0, max: 5 },
+                        })));
+                        trackPlugin('MySQLDriver');
+                        resolvedDriverLabel = 'SqlDriver(mysql2)';
+                        resolvedDatabaseUrl = databaseUrl;
+                    }
+                    else if (driverType === 'turso' || driverType === 'libsql') {
+                        const { TursoDriver } = await import('@objectstack/driver-turso');
+                        await kernel.use(new DriverPlugin(new TursoDriver({
+                            url: databaseUrl ?? 'file:./local.db',
+                            authToken: process.env.OS_DATABASE_AUTH_TOKEN,
+                        })));
+                        trackPlugin('TursoDriver');
+                        resolvedDriverLabel = 'TursoDriver';
+                        resolvedDatabaseUrl = databaseUrl ?? 'file:./local.db';
+                    }
+                    else if (isDev) {
+                        // Default in dev: in-memory driver
+                        const { InMemoryDriver } = await import('@objectstack/driver-memory');
+                        await kernel.use(new DriverPlugin(new InMemoryDriver()));
+                        trackPlugin('MemoryDriver');
+                        resolvedDriverLabel = 'InMemoryDriver';
+                        resolvedDatabaseUrl = '(in-memory)';
+                    }
                 }
                 catch (e) {
                     // silent
                 }
             }
             // 3. Auto-register AppPlugin if config contains app definitions
-            // Skip if config is a host/aggregator config that already contains
-            // instantiated plugins — wrapping it would cause duplicate registration
-            // and startup failures (e.g. plugin.app.dev-workspace).
-            if (!isHostConfig(config) && (config.objects || config.manifest || config.apps)) {
+            // (objects / manifest / apps / flows / apis). Even host/aggregator
+            // configs (those whose `plugins` array contains instantiated plugins)
+            // need this wrap when they ALSO carry top-level metadata — otherwise
+            // top-level `flows`, `objects`, etc. never reach the ObjectQL registry
+            // and downstream services like AutomationServicePlugin start with 0 flows.
+            //
+            // To avoid double-registration when the host already wraps itself with
+            // an AppPlugin (e.g. apps/objectos's dev-workspace stack), we skip if
+            // any plugin in `plugins[]` is already an AppPlugin instance.
+            const hasAppPluginAlready = plugins.some((p) => p && (p.type === 'app' || p.constructor?.name === 'AppPlugin' || (p.name && typeof p.name === 'string' && p.name.startsWith('plugin.app.'))));
+            const configHasMetadata = !!(config.objects || config.manifest || config.apps || config.flows || config.apis);
+            if (!hasAppPluginAlready && configHasMetadata) {
                 try {
                     const { AppPlugin } = await import('@objectstack/runtime');
                     await kernel.use(new AppPlugin(config));
@@ -182,11 +491,33 @@ export default class Serve extends Command {
             // This ensures i18n REST routes work out of the box without manual plugin registration.
             const hasI18nPlugin = plugins.some((p) => p.name === 'com.objectstack.service.i18n'
                 || p.constructor?.name === 'I18nServicePlugin');
-            const configHasTranslations = ((Array.isArray(config.translations) && config.translations.length > 0)
-                || config.i18n
-                || (config.manifest && ((Array.isArray(config.manifest.translations) && config.manifest.translations.length > 0)
-                    || config.manifest.i18n)));
-            if (!hasI18nPlugin && configHasTranslations) {
+            // Check the top-level config AND any nested AppPlugin bundles in the
+            // `plugins` array — host/aggregator configs (e.g. apps/objectos) don't
+            // define translations themselves but compose multiple `new AppPlugin(...)`
+            // entries, each carrying its own translations.
+            const pluginBundleHasTranslations = (bundle) => {
+                if (!bundle || typeof bundle !== 'object')
+                    return false;
+                if (Array.isArray(bundle.translations) && bundle.translations.length > 0)
+                    return true;
+                if (bundle.i18n)
+                    return true;
+                if (bundle.manifest && ((Array.isArray(bundle.manifest.translations) && bundle.manifest.translations.length > 0)
+                    || bundle.manifest.i18n))
+                    return true;
+                return false;
+            };
+            const anyAppPluginHasTranslations = plugins.some((p) => {
+                if (!p)
+                    return false;
+                // AppPlugin instances expose their bundle on `.bundle`
+                if (p.bundle && pluginBundleHasTranslations(p.bundle))
+                    return true;
+                return false;
+            });
+            const configHasTranslations = (pluginBundleHasTranslations(config)
+                || anyAppPluginHasTranslations);
+            if (!hasI18nPlugin && configHasTranslations && tierEnabled('i18n')) {
                 try {
                     // Dynamic import with variable to prevent tsc from resolving the optional package
                     const i18nPkg = '@objectstack/service-i18n';
@@ -222,18 +553,426 @@ export default class Serve extends Command {
                     console.warn(chalk.yellow(`  ⚠ HTTP server plugin not available: ${e.message}`));
                 }
             }
-            // 5. Auto-register SetupPlugin BEFORE config plugins so that other
-            // plugins (e.g. AuthPlugin) can call setupNav.contribute() during init.
-            const hasSetupPlugin = plugins.some((p) => p.name === 'com.objectstack.setup' || p.constructor?.name === 'SetupPlugin');
-            if (!hasSetupPlugin) {
+            // Unknown-environment hostname guard.
+            //
+            // In multi-tenant cloud deployments (e.g. *.objectos.app), every
+            // public hostname is expected to map to a `sys_environment` row
+            // whose `hostname` column matches the request `Host`. Without this
+            // guard, an unknown subdomain like `demo-xxx.objectos.app` happily
+            // renders the control-plane Console SPA (served statically by
+            // createConsoleStaticPlugin), making the deployment look like an
+            // empty env rather than a missing one. We respond with a clear
+            // 404 instead.
+            //
+            // Activation: only when OS_ROOT_DOMAIN is set (e.g. "objectos.app").
+            // Reserved subdomains (cloud/www/api/docs/admin/app and the apex)
+            // bypass the check so platform surfaces keep working. Non-root
+            // hostnames (custom domains, localhost, *.workers.dev) pass through
+            // unchanged. Infra paths under /_admin or /.well-known are always
+            // allowed so health checks / cert flows aren't broken.
+            //
+            // Implemented as a Plugin so the middleware is wired during init
+            // (when http.server is available) and BEFORE start() runs on the
+            // Console static plugin / route-registering plugins. Hono's
+            // `app.use('*')` is order-independent for matching, so as long as
+            // the middleware is added before kernel:listening fires, it
+            // intercepts every request regardless of which plugin registered
+            // its handler.
+            const __rootDomain = (process.env.OS_ROOT_DOMAIN || '').trim().toLowerCase();
+            if (__rootDomain) {
+                const RESERVED = new Set(['', 'cloud', 'www', 'api', 'docs', 'admin', 'app']);
+                const guardPlugin = {
+                    name: 'com.objectstack.cli.unknown-hostname-guard',
+                    version: '1.0.0',
+                    init: async (ctx) => {
+                        try {
+                            const httpServer = ctx.getService?.('http.server') ?? ctx.getService?.('http-server');
+                            const rawApp = httpServer?.getRawApp?.();
+                            if (!rawApp || typeof rawApp.use !== 'function') {
+                                ctx.logger?.warn?.('[unknown-hostname-guard] http.server unavailable; guard not installed');
+                                return;
+                            }
+                            const getEnvRegistry = () => {
+                                try {
+                                    return ctx.getService?.('env-registry') ?? null;
+                                }
+                                catch {
+                                    return null;
+                                }
+                            };
+                            rawApp.use('*', async (c, next) => {
+                                const rawHost = c.req.header('host') || '';
+                                const host = rawHost.split(':')[0].toLowerCase();
+                                if (!host)
+                                    return next();
+                                const isPlatformHost = host === __rootDomain || host.endsWith('.' + __rootDomain);
+                                if (!isPlatformHost)
+                                    return next();
+                                const sub = host === __rootDomain ? '' : host.slice(0, -(__rootDomain.length + 1));
+                                const head = sub.split('.').pop() || '';
+                                if (RESERVED.has(sub) || RESERVED.has(head))
+                                    return next();
+                                const p = c.req.path;
+                                if (p.startsWith('/_admin/') || p === '/_admin' || p.startsWith('/.well-known/')) {
+                                    return next();
+                                }
+                                // Health and readiness endpoints must always answer 200
+                                // regardless of whether the requested hostname maps to
+                                // an env — Cloudflare's container probe (and any
+                                // upstream load balancer) hits whatever Host header is
+                                // currently bound to the worker. Returning 404 here on
+                                // an unmapped hostname would kill the container.
+                                if (p === '/api/v1/health' || p === '/api/v1/ready' || p === '/health') {
+                                    return next();
+                                }
+                                // Resolve env-registry lazily on each request — it may
+                                // not be registered yet at init() time (registered by
+                                // ObjectOSProjectPlugin's init which runs in plugin
+                                // dependency order; we don't want to rely on ordering).
+                                const registry = getEnvRegistry();
+                                if (!registry || typeof registry.resolveByHostname !== 'function') {
+                                    return next();
+                                }
+                                try {
+                                    const hit = await registry.resolveByHostname(host);
+                                    if (hit)
+                                        return next();
+                                }
+                                catch {
+                                    return next();
+                                }
+                                // Content negotiation: browsers (Accept: text/html) get
+                                // a clean 404 page; API clients (curl/fetch with JSON
+                                // accept) get a structured error body.
+                                const accept = (c.req.header('accept') || '').toLowerCase();
+                                const wantsHtml = accept.includes('text/html');
+                                if (wantsHtml) {
+                                    const safeHost = host.replace(/[<>&"']/g, (ch) => (({
+                                        '<': '&lt;', '>': '&gt;', '&': '&amp;', '"': '&quot;', "'": '&#39;',
+                                    }[ch]) ?? ch));
+                                    const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width,initial-scale=1" />
+<title>404 — Environment not found</title>
+<style>
+  :root { color-scheme: light dark; }
+  * { box-sizing: border-box; }
+  html, body { height: 100%; margin: 0; }
+  body {
+    font: 16px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+    background: #fafafa;
+    color: #111;
+    display: grid;
+    place-items: center;
+    padding: 24px;
+  }
+  @media (prefers-color-scheme: dark) {
+    body { background: #0b0b0c; color: #e8e8e8; }
+    .card { background: #141417; border-color: #26262b; }
+    .host { background: #1c1c20; border-color: #2d2d33; color: #d0d0d0; }
+    .muted { color: #8b8b94; }
+    a { color: #6ea8fe; }
+  }
+  .card {
+    max-width: 520px;
+    width: 100%;
+    background: #fff;
+    border: 1px solid #e6e6e6;
+    border-radius: 12px;
+    padding: 32px;
+    box-shadow: 0 1px 2px rgba(0,0,0,.04);
+    text-align: center;
+  }
+  .code { font: 600 64px/1 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; margin: 0; letter-spacing: -2px; }
+  h1 { font-size: 20px; margin: 16px 0 8px; font-weight: 600; }
+  p { margin: 8px 0; }
+  .muted { color: #666; font-size: 14px; }
+  .host {
+    display: inline-block;
+    margin-top: 16px;
+    padding: 6px 12px;
+    background: #f4f4f5;
+    border: 1px solid #e4e4e7;
+    border-radius: 6px;
+    font: 13px ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    color: #444;
+    word-break: break-all;
+  }
+  a { color: #2563eb; text-decoration: none; }
+  a:hover { text-decoration: underline; }
+</style>
+</head>
+<body>
+  <main class="card">
+    <p class="code">404</p>
+    <h1>Environment not found</h1>
+    <p class="muted">No ObjectStack environment is bound to this hostname.</p>
+    <div class="host">${safeHost}</div>
+    <p class="muted" style="margin-top:24px">
+      If you own this domain, bind it to an environment in the
+      <a href="https://cloud.objectos.app/">ObjectStack Cloud console</a>.
+    </p>
+  </main>
+</body>
+</html>`;
+                                    return c.html(html, 404);
+                                }
+                                return c.json({
+                                    error: 'environment_not_found',
+                                    message: `No environment is bound to hostname '${host}'.`,
+                                    hostname: host,
+                                }, 404);
+                            });
+                            ctx.logger?.info?.('[unknown-hostname-guard] installed', { rootDomain: __rootDomain });
+                        }
+                        catch (err) {
+                            ctx.logger?.warn?.('[unknown-hostname-guard] install failed', { error: err?.message ?? err });
+                        }
+                    },
+                };
                 try {
-                    const setupPkg = '@objectstack/plugin-setup';
-                    const { SetupPlugin } = await import(/* webpackIgnore: true */ setupPkg);
-                    await kernel.use(new SetupPlugin());
-                    trackPlugin('Setup');
+                    await kernel.use(guardPlugin);
+                    trackPlugin('UnknownHostnameGuard');
                 }
                 catch {
-                    // @objectstack/plugin-setup not installed — setup app unavailable
+                    // Best-effort.
+                }
+            }
+            // 5. Auto-register Studio single-project signal in dev mode.
+            //
+            // `objectstack dev` runs a vanilla user stack (e.g. examples/app-crm)
+            // as a single project — there is no apps/cloud control plane and no
+            // org/project picker is meaningful. Without this plugin Studio would
+            // fall back to its multi-project default and ask the user to "Create
+            // organization" before showing any platform metadata.
+            //
+            // The plugin only registers `GET /api/v1/studio/runtime-config`
+            // (returning `{ singleProject: true, defaultOrgId, defaultProjectId }`)
+            // — no identity seed, since CLI dev mode has no sys_organization /
+            // sys_project tables to write into. Skipped when the user config
+            // already carries a single-project / multi-project plugin.
+            const hasProjectModePlugin = plugins.some((p) => {
+                const n = p?.name ?? p?.constructor?.name ?? '';
+                return n === 'com.objectstack.studio.single-project'
+                    || n === 'com.objectstack.multi-project'
+                    || n === 'com.objectstack.studio.runtime-config';
+            });
+            if (isDev && !hasProjectModePlugin) {
+                try {
+                    const cloudPkg = '@objectstack/service-cloud';
+                    const { createSingleProjectPlugin } = await import(/* webpackIgnore: true */ cloudPkg);
+                    await kernel.use(createSingleProjectPlugin({
+                        projectId: process.env.OS_PROJECT_ID ?? 'proj_local',
+                        orgId: process.env.OS_ORG_ID ?? 'org_local',
+                        orgName: 'Local',
+                    }));
+                    trackPlugin('SingleProject');
+                }
+                catch {
+                    // @objectstack/service-cloud not installed — Studio falls back
+                    // to multi-project mode (org/project picker visible).
+                }
+            }
+            // 5b. Auto-register AuthPlugin (and paired Security/Audit) when the
+            // 'auth' tier is enabled and no auth plugin is already configured.
+            // The Studio + Account portals expect /api/v1/auth/* to be served by
+            // better-auth via @objectstack/plugin-auth. Without this block,
+            // running `objectstack dev` on a vanilla user stack would 404 on
+            // login/register flows.
+            const hasAuthPlugin = plugins.some((p) => p?.name === 'com.objectstack.auth' || p?.constructor?.name === 'AuthPlugin');
+            if (!hasAuthPlugin && tierEnabled('auth')) {
+                try {
+                    const authPkg = '@objectstack/plugin-auth';
+                    const { AuthPlugin } = await import(/* webpackIgnore: true */ authPkg);
+                    // In dev, fall back to a stable local secret so users don't have
+                    // to set AUTH_SECRET just to try the login/register flow.
+                    const secret = process.env.AUTH_SECRET
+                        ?? process.env.OS_AUTH_SECRET
+                        ?? (isDev ? 'dev-only-insecure-secret-change-me-in-production' : undefined);
+                    // Guard: in cloud-connected runtime mode (e.g. objectos worker)
+                    // the host kernel is a pure routing shell. Auth is owned by each
+                    // per-project kernel (`ArtifactKernelFactory` injects an
+                    // `AuthPlugin` per project against the project's own DB so users
+                    // persist and stay isolated per subdomain). Injecting a host-level
+                    // AuthPlugin here would compete with the per-project one — its
+                    // shared OS_AUTH_SECRET would erroneously validate cookies across
+                    // unrelated projects. Refuse to inject in runtime mode.
+                    const cloudUrl = process.env.OS_CLOUD_URL?.trim();
+                    const isRuntimeMode = !!cloudUrl && cloudUrl.toLowerCase() !== 'local' && cloudUrl.toLowerCase() !== 'off';
+                    if (isRuntimeMode) {
+                        console.warn(chalk.yellow('  ⚠ AuthPlugin skipped on host kernel — runtime mode (OS_CLOUD_URL set).\n' +
+                            '    Auth is owned per-project by ArtifactKernelFactory (see service-cloud).'));
+                    }
+                    else if (!secret) {
+                        console.warn(chalk.yellow('  ⚠ AuthPlugin skipped — set AUTH_SECRET to enable authentication in production'));
+                    }
+                    else {
+                        const baseUrl = process.env.AUTH_BASE_URL
+                            ?? process.env.OS_BASE_URL
+                            ?? `http://localhost:${port}`;
+                        const socialProviders = {};
+                        if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET)
+                            socialProviders.google = { clientId: process.env.GOOGLE_CLIENT_ID, clientSecret: process.env.GOOGLE_CLIENT_SECRET };
+                        if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET)
+                            socialProviders.github = { clientId: process.env.GITHUB_CLIENT_ID, clientSecret: process.env.GITHUB_CLIENT_SECRET };
+                        // Trusted origins (CSRF). better-auth uses a `*` glob that
+                        // does NOT cross dot-separators, so `http://localhost:*` does
+                        // not cover `http://<sub>.localhost:*`. Build the allow-list
+                        // explicitly:
+                        //   - explicit `OS_TRUSTED_ORIGINS` (comma-separated) wins
+                        //   - else dev / preview defaults below
+                        const trustedOrigins = [];
+                        const explicitTrusted = process.env.OS_TRUSTED_ORIGINS?.trim();
+                        if (explicitTrusted) {
+                            explicitTrusted.split(',').map(s => s.trim()).filter(Boolean).forEach(o => {
+                                if (!trustedOrigins.includes(o))
+                                    trustedOrigins.push(o);
+                            });
+                        }
+                        // Always add the configured baseUrl so first-party redirects work.
+                        try {
+                            const u = new URL(baseUrl);
+                            const baseOrigin = `${u.protocol}//${u.host}`;
+                            if (!trustedOrigins.includes(baseOrigin))
+                                trustedOrigins.push(baseOrigin);
+                        }
+                        catch { /* ignore malformed baseUrl */ }
+                        // Preview-mode subdomain wildcards (`<commit>--<pid>.<base>`).
+                        // Honour `OS_PREVIEW_BASE_DOMAINS` (used by service-cloud's
+                        // preview routing) and add `http://*.<base>:*` patterns.
+                        const previewMode = (process.env.OS_PREVIEW_MODE ?? '').trim().toLowerCase();
+                        const isPreviewMode = previewMode === '1' || previewMode === 'true' || previewMode === 'yes';
+                        if (isPreviewMode) {
+                            const baseDomains = (process.env.OS_PREVIEW_BASE_DOMAINS
+                                ?? 'preview.objectstack.ai,localhost')
+                                .split(',').map(s => s.trim()).filter(Boolean);
+                            for (const dom of baseDomains) {
+                                const isLoopback = dom === 'localhost' || dom.endsWith('.localhost');
+                                const scheme = isLoopback ? 'http' : 'https';
+                                const portSuffix = isLoopback ? ':*' : '';
+                                const wildcard = `${scheme}://*.${dom}${portSuffix}`;
+                                if (!trustedOrigins.includes(wildcard))
+                                    trustedOrigins.push(wildcard);
+                            }
+                        }
+                        // Dev convenience: keep `http://localhost:*` so plain
+                        // `localhost:<port>` still works for non-preview Studio/Console.
+                        if (isDev && !trustedOrigins.includes('http://localhost:*')) {
+                            trustedOrigins.push('http://localhost:*');
+                        }
+                        // Per-project subdomains: when OS_ROOT_DOMAIN is set (multi-
+                        // project hosting under `*.<root>`), every project hostname
+                        // must be trusted by better-auth or sign-up/sign-in is
+                        // rejected with "Invalid origin". Mirrors the OS_COOKIE_DOMAIN
+                        // wildcard semantics — they are always set together.
+                        const rootDomain = (process.env.OS_ROOT_DOMAIN ?? process.env.ROOT_DOMAIN)?.trim();
+                        if (rootDomain) {
+                            const wildcard = `https://*.${rootDomain}`;
+                            if (!trustedOrigins.includes(wildcard))
+                                trustedOrigins.push(wildcard);
+                        }
+                        // Collect application-defined org roles from the stack so
+                        // Better-Auth's organization plugin accepts invitations to
+                        // those roles (otherwise it 400s with `ROLE_NOT_FOUND`).
+                        // Sources:
+                        //   - top-level `roles[]` (role hierarchy entries)
+                        //   - `permissions[]` PermissionSets where `isProfile === true`
+                        //     (these double as role identifiers; e.g. CRM Profiles)
+                        // Real RBAC enforcement is still owned by SecurityPlugin, which
+                        // matches these names against `permission` metadata entries.
+                        const additionalOrgRoles = new Set();
+                        try {
+                            const stackAny = config ?? {};
+                            const collect = (arr) => {
+                                if (!Array.isArray(arr))
+                                    return;
+                                for (const r of arr) {
+                                    const n = typeof r === 'string' ? r : (r && typeof r.name === 'string' ? r.name : null);
+                                    if (n && n !== 'owner' && n !== 'admin' && n !== 'member')
+                                        additionalOrgRoles.add(n);
+                                }
+                            };
+                            collect(stackAny.roles);
+                            if (Array.isArray(stackAny.permissions)) {
+                                for (const p of stackAny.permissions) {
+                                    if (p && typeof p.name === 'string' && p.isProfile !== false) {
+                                        if (p.name !== 'owner' && p.name !== 'admin' && p.name !== 'member')
+                                            additionalOrgRoles.add(p.name);
+                                    }
+                                }
+                            }
+                        }
+                        catch {
+                            // best-effort
+                        }
+                        await kernel.use(new AuthPlugin({
+                            secret,
+                            baseUrl,
+                            socialProviders: Object.keys(socialProviders).length > 0 ? socialProviders : undefined,
+                            trustedOrigins: trustedOrigins.length ? trustedOrigins : undefined,
+                            ...(additionalOrgRoles.size > 0 ? { additionalOrgRoles: Array.from(additionalOrgRoles) } : {}),
+                            // Enable the admin plugin by default so the Setup app's
+                            // ban/unban/set-password/impersonate/set-role row actions
+                            // resolve to real endpoints. The plugin self-gates by role
+                            // (only users whose `role` column is `admin` can hit
+                            // /admin/* endpoints), so leaving it on for everyone is
+                            // safe. Opt-out via OS_AUTH_ADMIN=false.
+                            //
+                            // Similarly enable twoFactor by default — it powers the
+                            // Setup app's `sys_two_factor` toolbar actions (Enable 2FA,
+                            // Disable 2FA). Opt-out via OS_AUTH_TWO_FACTOR=false.
+                            //
+                            // (api-key plugin: not yet shipped by better-auth — generic
+                            // CRUD on `sys_api_key` handles row creation in the meantime.)
+                            plugins: {
+                                admin: String(process.env.OS_AUTH_ADMIN ?? 'true').toLowerCase() !== 'false',
+                                twoFactor: String(process.env.OS_AUTH_TWO_FACTOR ?? 'true').toLowerCase() !== 'false',
+                            },
+                            advanced: process.env.OS_COOKIE_DOMAIN
+                                ? {
+                                    crossSubDomainCookies: {
+                                        enabled: true,
+                                        domain: process.env.OS_COOKIE_DOMAIN,
+                                    },
+                                }
+                                : undefined,
+                        }));
+                        trackPlugin('Auth');
+                        // Pair: SecurityPlugin (RBAC) — optional
+                        try {
+                            const securityPkg = '@objectstack/plugin-security';
+                            const { SecurityPlugin } = await import(/* webpackIgnore: true */ securityPkg);
+                            // `OS_MULTI_TENANT=false` disables wildcard tenant_isolation
+                            // RLS policies and the `organization_id` auto-injection on
+                            // insert. Keep multi-tenant on by default — most ObjectStack
+                            // deployments are multi-org.
+                            const multiTenant = String(process.env.OS_MULTI_TENANT ?? 'true').toLowerCase() !== 'false';
+                            await kernel.use(new SecurityPlugin({ multiTenant }));
+                            trackPlugin('Security');
+                        }
+                        catch {
+                            // optional
+                        }
+                        // Pair: AuditPlugin — optional
+                        try {
+                            const auditPkg = '@objectstack/plugin-audit';
+                            const { AuditPlugin } = await import(/* webpackIgnore: true */ auditPkg);
+                            await kernel.use(new AuditPlugin());
+                            trackPlugin('Audit');
+                        }
+                        catch {
+                            // optional
+                        }
+                    }
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    if (!msg.includes('Cannot find module') && !msg.includes('ERR_MODULE_NOT_FOUND')) {
+                        console.warn(chalk.yellow(`  ⚠ AuthPlugin failed to load: ${msg}`));
+                    }
+                    // @objectstack/plugin-auth not installed — login/register endpoints unavailable
                 }
             }
             if (plugins.length > 0) {
@@ -272,9 +1011,22 @@ export default class Serve extends Command {
             }
             // Register REST API and Dispatcher plugins (consume http.server + protocol services)
             if (flags.server) {
+                // Read project-scoping config from the stack's top-level `api` field
+                // (e.g. { api: { enableProjectScoping: true, projectResolution: 'auto' } }).
+                // Forwarded to both REST and Dispatcher plugins so they mount scoped
+                // routes consistently.
+                const apiConfig = config.api ?? {};
+                const enableProjectScoping = apiConfig.enableProjectScoping ?? false;
+                const projectResolution = apiConfig.projectResolution ?? 'auto';
+                // `requireAuth: true` rejects anonymous requests on `/api/v1/data/*`
+                // with HTTP 401 before they reach ObjectQL. Default-on when the
+                // stack opts in OR when the resolved tier set includes `auth`
+                // (because anonymous data access is almost never desirable when
+                // auth is enabled). Apps can override via stack `api.requireAuth`.
+                const requireAuth = apiConfig.requireAuth ?? (tierEnabled('auth') ? true : false);
                 try {
                     const { createRestApiPlugin } = await import('@objectstack/rest');
-                    await kernel.use(createRestApiPlugin());
+                    await kernel.use(createRestApiPlugin({ api: { api: { enableProjectScoping, projectResolution, requireAuth } } }));
                     trackPlugin('RestAPI');
                 }
                 catch (e) {
@@ -283,7 +1035,7 @@ export default class Serve extends Command {
                 // Register Dispatcher plugin (auth, graphql, analytics, packages, hub, storage, automation)
                 try {
                     const { createDispatcherPlugin } = await import('@objectstack/runtime');
-                    await kernel.use(createDispatcherPlugin());
+                    await kernel.use(createDispatcherPlugin({ scoping: { enableProjectScoping, projectResolution } }));
                     trackPlugin('Dispatcher');
                 }
                 catch (e) {
@@ -295,7 +1047,7 @@ export default class Serve extends Command {
             // already in place when AIServicePlugin.start() fires the hook.
             const hasAIPlugin = plugins.some((p) => p.name === 'com.objectstack.service-ai'
                 || p.constructor?.name === 'AIServicePlugin');
-            if (!hasAIPlugin) {
+            if (!hasAIPlugin && tierEnabled('ai')) {
                 try {
                     const aiPkg = '@objectstack/service-ai';
                     const { AIServicePlugin } = await import(/* webpackIgnore: true */ aiPkg);
@@ -305,33 +1057,339 @@ export default class Serve extends Command {
                     await kernel.use(new AIServicePlugin());
                     trackPlugin('AIService');
                 }
-                catch {
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    if (!msg.includes('Cannot find module') && !msg.includes('ERR_MODULE_NOT_FOUND')) {
+                        console.error('[AI] AIServicePlugin failed to start:', msg);
+                    }
                     // @objectstack/service-ai not installed — AI features unavailable
                 }
             }
+            const CAPABILITY_PROVIDERS = {
+                automation: {
+                    pkg: '@objectstack/service-automation',
+                    export: 'AutomationServicePlugin',
+                    nameMatch: ['service-automation', 'AutomationServicePlugin'],
+                    // The default node packs ship from the same package; auto-register them
+                    // so flows actually have executors. Users can opt out by listing
+                    // their own subset explicitly in `plugins: []` (which sets
+                    // `nameMatch` to skip these auto-loads).
+                    extras: [
+                        { pkg: '@objectstack/service-automation', export: 'CrudNodesPlugin', nameMatch: ['crud-nodes', 'CrudNodesPlugin'] },
+                        { pkg: '@objectstack/service-automation', export: 'LogicNodesPlugin', nameMatch: ['logic-nodes', 'LogicNodesPlugin'] },
+                        { pkg: '@objectstack/service-automation', export: 'HttpConnectorPlugin', nameMatch: ['http-connector', 'HttpConnectorPlugin'] },
+                        { pkg: '@objectstack/service-automation', export: 'ScreenNodesPlugin', nameMatch: ['screen-nodes', 'ScreenNodesPlugin'] },
+                    ],
+                },
+                analytics: {
+                    pkg: '@objectstack/service-analytics',
+                    export: 'AnalyticsServicePlugin',
+                    nameMatch: ['service-analytics', 'AnalyticsServicePlugin'],
+                    configKey: 'analyticsCubes',
+                },
+                audit: {
+                    pkg: '@objectstack/plugin-audit',
+                    export: 'AuditPlugin',
+                    nameMatch: ['audit', 'AuditPlugin'],
+                },
+                cache: {
+                    pkg: '@objectstack/service-cache',
+                    export: 'CacheServicePlugin',
+                    nameMatch: ['service-cache', 'CacheServicePlugin'],
+                },
+                storage: {
+                    pkg: '@objectstack/service-storage',
+                    export: 'StorageServicePlugin',
+                    nameMatch: ['service-storage', 'StorageServicePlugin'],
+                },
+                queue: {
+                    pkg: '@objectstack/service-queue',
+                    export: 'QueueServicePlugin',
+                    nameMatch: ['service-queue', 'QueueServicePlugin'],
+                },
+                job: {
+                    pkg: '@objectstack/service-job',
+                    export: 'JobServicePlugin',
+                    nameMatch: ['service-job', 'JobServicePlugin'],
+                },
+                realtime: {
+                    pkg: '@objectstack/service-realtime',
+                    export: 'RealtimeServicePlugin',
+                    nameMatch: ['service-realtime', 'RealtimeServicePlugin'],
+                },
+                feed: {
+                    pkg: '@objectstack/service-feed',
+                    export: 'FeedServicePlugin',
+                    nameMatch: ['service-feed', 'FeedServicePlugin'],
+                },
+                mcp: {
+                    pkg: '@objectstack/plugin-mcp-server',
+                    export: 'MCPServerPlugin',
+                    nameMatch: ['mcp-server', 'MCPServerPlugin'],
+                },
+                marketplace: {
+                    pkg: '@objectstack/service-package',
+                    export: 'PackageServicePlugin',
+                    nameMatch: ['service-package', 'PackageServicePlugin'],
+                },
+                email: {
+                    pkg: '@objectstack/plugin-email',
+                    export: 'EmailServicePlugin',
+                    nameMatch: ['plugin-email', 'EmailServicePlugin'],
+                },
+                sharing: {
+                    pkg: '@objectstack/plugin-sharing',
+                    export: 'SharingServicePlugin',
+                    nameMatch: ['plugin-sharing', 'SharingServicePlugin', 'SharingPlugin'],
+                },
+                reports: {
+                    pkg: '@objectstack/plugin-reports',
+                    export: 'ReportsServicePlugin',
+                    nameMatch: ['plugin-reports', 'ReportsServicePlugin'],
+                },
+                approvals: {
+                    pkg: '@objectstack/plugin-approvals',
+                    export: 'ApprovalsServicePlugin',
+                    nameMatch: ['plugin-approvals', 'ApprovalsServicePlugin'],
+                },
+                settings: {
+                    pkg: '@objectstack/service-settings',
+                    export: 'SettingsServicePlugin',
+                    nameMatch: ['service-settings', 'SettingsServicePlugin'],
+                },
+            };
+            const hasPluginMatching = (fragments) => plugins.some((p) => {
+                const n = String(p?.name ?? '');
+                const c = String(p?.constructor?.name ?? '');
+                return fragments.some((f) => n.includes(f) || c.includes(f));
+            });
+            for (const cap of requires) {
+                const spec = CAPABILITY_PROVIDERS[cap];
+                if (!spec)
+                    continue; // tier-gated capabilities (ai/i18n/ui/auth) handled above
+                if (hasPluginMatching(spec.nameMatch))
+                    continue;
+                try {
+                    const mod = await import(/* webpackIgnore: true */ spec.pkg);
+                    const Ctor = mod[spec.export];
+                    if (!Ctor) {
+                        console.warn(chalk.yellow(`  ⚠ Capability "${cap}": ${spec.pkg} did not export ${spec.export}`));
+                        continue;
+                    }
+                    // analytics needs cubes from config, others take no args
+                    let arg;
+                    if (spec.configKey === 'analyticsCubes') {
+                        const cubes = config.analyticsCubes ?? config.cubes ?? [];
+                        arg = { cubes };
+                    }
+                    else if (cap === 'email') {
+                        // Compose EmailServicePlugin options from config.email + OS_EMAIL_* env.
+                        // Env precedence: env beats config so operators can override per-environment.
+                        const cfgEmail = config.email ?? {};
+                        const envProvider = process.env.OS_EMAIL_PROVIDER;
+                        const provider = (envProvider || cfgEmail.provider || 'log').toLowerCase();
+                        const apiKey = process.env.OS_EMAIL_API_KEY || cfgEmail.apiKey;
+                        const envFrom = process.env.OS_EMAIL_FROM;
+                        // OS_EMAIL_FROM supports either "addr@x" or "Name <addr@x>".
+                        let defaultFrom = cfgEmail.defaultFrom;
+                        if (envFrom) {
+                            const m = envFrom.match(/^\s*(?:"?([^"<]*?)"?\s*<\s*([^>]+)\s*>|(\S+))\s*$/);
+                            if (m) {
+                                const name = (m[1] ?? '').trim();
+                                const address = (m[2] ?? m[3] ?? '').trim();
+                                if (address)
+                                    defaultFrom = name ? { name, address } : { address };
+                            }
+                        }
+                        const retries = process.env.OS_EMAIL_RETRIES
+                            ? Number(process.env.OS_EMAIL_RETRIES)
+                            : cfgEmail.retries;
+                        const defaultTemplateContext = {
+                            appName: process.env.OS_APP_NAME || cfgEmail.appName || config.appName || 'ObjectStack',
+                            ...(cfgEmail.defaultTemplateContext || {}),
+                        };
+                        // Provide a sensible fallback `from` so templates can render
+                        // even before operators configure SMTP/SaaS. The log transport
+                        // simply prints to stdout; the address never leaves the box.
+                        if (!defaultFrom) {
+                            const slug = String(defaultTemplateContext.appName || 'objectstack')
+                                .toLowerCase()
+                                .replace(/[^a-z0-9]+/g, '-')
+                                .replace(/^-+|-+$/g, '') || 'objectstack';
+                            defaultFrom = { name: defaultTemplateContext.appName, address: `no-reply@${slug}.local` };
+                        }
+                        arg = {
+                            provider,
+                            ...(apiKey ? { apiKey } : {}),
+                            defaultFrom,
+                            ...(retries != null && !Number.isNaN(retries) ? { retries } : {}),
+                            defaultTemplateContext,
+                        };
+                        if (provider !== 'log' && !apiKey) {
+                            console.warn(chalk.yellow(`  ⚠ Capability "email": provider='${provider}' but no apiKey found (set OS_EMAIL_API_KEY or config.email.apiKey). Falling back to LogTransport.`));
+                            arg.provider = 'log';
+                        }
+                    }
+                    else if (cap === 'storage') {
+                        // Storage is now in the default capability slate. If the host
+                        // hasn't configured a backend explicitly we fall back to the
+                        // local-disk driver under `.objectstack/data/uploads/` so
+                        // avatars / attachments / report files work out of the box.
+                        // In production mode we emit a single loud warning so the
+                        // operator knows to point storage at S3 / GCS / Azure before
+                        // shipping (data on a single pod is volatile / non-replicated).
+                        const cfgStorage = config.storage;
+                        if (cfgStorage && (cfgStorage.driver || cfgStorage.adapter)) {
+                            arg = cfgStorage;
+                        }
+                        else {
+                            const root = process.env.OS_STORAGE_ROOT || '.objectstack/data/uploads';
+                            arg = { driver: 'local', root };
+                            if (!isDev) {
+                                console.warn(chalk.yellow(`  ⚠ StorageServicePlugin using local driver (${root}) — switch to S3/GCS/Azure for production (set config.storage or OS_STORAGE_*).`));
+                            }
+                        }
+                    }
+                    await kernel.use(arg !== undefined ? new Ctor(arg) : new Ctor());
+                    trackPlugin(spec.export);
+                    if (spec.extras) {
+                        for (const ex of spec.extras) {
+                            if (hasPluginMatching(ex.nameMatch))
+                                continue;
+                            try {
+                                const exMod = await import(/* webpackIgnore: true */ ex.pkg);
+                                const ExCtor = exMod[ex.export];
+                                if (ExCtor) {
+                                    await kernel.use(new ExCtor());
+                                    trackPlugin(ex.export);
+                                }
+                            }
+                            catch {
+                                // optional extra — silently skip
+                            }
+                        }
+                    }
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    if (!msg.includes('Cannot find module') && !msg.includes('ERR_MODULE_NOT_FOUND')) {
+                        console.error(`[Capability:${cap}] failed to load ${spec.pkg}: ${msg}`);
+                    }
+                    else {
+                        console.warn(chalk.yellow(`  ⚠ Capability "${cap}" required but ${spec.pkg} is not installed`));
+                    }
+                }
+            }
             // ── Studio UI ─────────────────────────────────────────────────
             // In dev mode, Studio UI is enabled by default (use --no-ui to disable).
             // Always serves the pre-built dist/ — no Vite dev server, no extra port.
-            const enableUI = flags.ui || isDev;
+            const enableUI = flags.ui && tierEnabled('ui');
             if (enableUI) {
-                const studioPath = resolveStudioPath();
-                if (!studioPath) {
-                    console.warn(chalk.yellow(`  ⚠ @objectstack/studio not found — skipping UI`));
+                // Pre-detect Console availability so we can demote Studio's root
+                // redirect when the Console is going to claim `/`.
+                // The `--no-console` flag (or OS_DISABLE_CONSOLE=1 env var) lets a
+                // host (e.g. apps/cloud) opt out of the Console entirely so Studio
+                // owns `/` — useful for control-plane deployments where the
+                // runtime Console is meaningless.
+                const consoleEnabled = flags.console && process.env.OS_DISABLE_CONSOLE !== '1';
+                const consolePath = consoleEnabled ? resolveConsolePath() : null;
+                const consoleWillMount = !!(consolePath && hasConsoleDist(consolePath));
+                // The `OS_DISABLE_STUDIO=1` env var lets a host (e.g. apps/cloud,
+                // which is a pure control plane) opt out of the Studio designer
+                // entirely while keeping Account/Console. Studio is meaningless
+                // when there are no per-project kernels in the same process.
+                const studioEnabled = process.env.OS_DISABLE_STUDIO !== '1';
+                if (studioEnabled) {
+                    const studioPath = resolveStudioPath();
+                    if (!studioPath) {
+                        console.warn(chalk.yellow(`  ⚠ @objectstack/studio not found — skipping UI`));
+                    }
+                    else if (hasStudioDist(studioPath)) {
+                        const distPath = path.join(studioPath, 'dist');
+                        await kernel.use(createStudioStaticPlugin(distPath, {
+                            isDev,
+                            rootRedirect: !consoleWillMount,
+                        }));
+                        trackPlugin('StudioUI');
+                    }
+                    else {
+                        console.warn(chalk.yellow(`  ⚠ Studio dist not found — run "pnpm --filter @objectstack/studio build" first`));
+                    }
+                }
+                // ── Account portal ─────────────────────────────────────────
+                // The account portal sits next to Studio under `/_account/` and
+                // follows the same enable rules — it's a self-service surface
+                // for end-users (login, organizations, profile, sessions).
+                const accountPath = resolveAccountPath();
+                if (!accountPath) {
+                    console.warn(chalk.yellow(`  ⚠ @objectstack/account not found — skipping Account UI`));
                 }
-                else if (hasStudioDist(studioPath)) {
-                    const distPath = path.join(studioPath, 'dist');
-                    await kernel.use(createStudioStaticPlugin(distPath, { isDev }));
-                    trackPlugin('StudioUI');
+                else if (hasAccountDist(accountPath)) {
+                    const accountDistPath = path.join(accountPath, 'dist');
+                    await kernel.use(createAccountStaticPlugin(accountDistPath, { isDev }));
+                    trackPlugin('AccountUI');
                 }
                 else {
-                    console.warn(chalk.yellow(`  ⚠ Studio dist not found — run "pnpm --filter @objectstack/studio build" first`));
+                    console.warn(chalk.yellow(`  ⚠ Account dist not found — run "pnpm --filter @objectstack/account build" first`));
+                }
+                // ── Console portal ──────────────────────────────────────────
+                // The opinionated, fork-ready runtime console (`@objectstack/console`)
+                // mounts under `/_console/` exactly like Studio/Account. When
+                // present, it owns root `/` redirect (preferred default UI). It
+                // is optional — we only mount it when the package resolves and
+                // a pre-built `dist/` is present.
+                if (consolePath) {
+                    if (consoleWillMount) {
+                        const consoleDistPath = path.join(consolePath, 'dist');
+                        await kernel.use(createConsoleStaticPlugin(consoleDistPath, { isDev }));
+                        trackPlugin('ConsoleUI');
+                    }
+                    else {
+                        console.warn(chalk.yellow(`  ⚠ Console dist not found — run "pnpm --filter @objectstack/console build" first`));
+                    }
                 }
             }
             // Boot the runtime
             await runtime.start();
-            // Wait briefly for pino worker thread buffers to flush, then restore
+            // Brief delay to allow logger writes to flush before restoring stdout
             await new Promise(r => setTimeout(r, 100));
             restoreOutput();
+            // ── Migrate-and-exit short-circuit ─────────────────────────────
+            // Out-of-band migration mode: the caller (e.g.
+            // `apps/cloud/scripts/migrate.ts`) just wants the kernel
+            // bootstrap (ObjectQLPlugin → schema sync → metadata hydration)
+            // to run once against the configured database, then exit. The
+            // HTTP server has already bound `port` at this point but we
+            // never accept a request — shutdown immediately so the deploy
+            // pipeline can move on.
+            if (process.env.OS_MIGRATE_AND_EXIT === '1') {
+                console.log(chalk.green(`✓ Migration complete (${loadedPlugins.length} plugins started against ${redactDbUrl(resolvedDatabaseUrl) || 'configured DB'})`));
+                try {
+                    await kernel.shutdown();
+                }
+                catch (err) {
+                    console.warn(chalk.yellow(`  ⚠ shutdown warning: ${err?.message ?? err}`));
+                }
+                process.exit(0);
+            }
+            // ── Driver introspection ──────────────────────────────────────
+            // When the driver was registered by an app preset / per-project
+            // factory (ProjectKernelFactory) instead of serve.ts's own
+            // OS_DATABASE_URL fallback, `resolvedDriverLabel` is still
+            // unset. Probe well-known service names so the banner can show
+            // *something* useful regardless of who wired the driver.
+            if (!resolvedDriverLabel) {
+                try {
+                    const probe = describeRegisteredDriver(kernel);
+                    if (probe) {
+                        resolvedDriverLabel = probe.label;
+                        resolvedDatabaseUrl = probe.url;
+                    }
+                }
+                catch {
+                    // best-effort only
+                }
+            }
             // ── Clean startup summary ──────────────────────────────────────
             printServerReady({
                 port,
@@ -341,14 +1399,14 @@ export default class Serve extends Command {
                 pluginNames: loadedPlugins,
                 uiEnabled: enableUI,
                 studioPath: STUDIO_PATH,
+                accountPath: ACCOUNT_PATH,
+                consolePath: loadedPlugins.includes('ConsoleUI') ? CONSOLE_PATH : undefined,
+                driverLabel: resolvedDriverLabel,
+                databaseUrl: redactDbUrl(resolvedDatabaseUrl),
+                multiTenant: String(process.env.OS_MULTI_TENANT ?? 'true').toLowerCase() !== 'false',
             });
-            // Keep process alive
-            process.on('SIGINT', async () => {
-                console.warn(chalk.yellow(`\n\n⏹  Stopping server...`));
-                await runtime.getKernel().shutdown();
-                console.log(chalk.green(`✅ Server stopped`));
-                process.exit(0);
-            });
+            // Kernel already registers SIGINT/SIGTERM handlers during bootstrap.
+            // No duplicate handler needed here — just keep the process alive.
         }
         catch (error) {
             restoreOutput();
@@ -360,4 +1418,61 @@ export default class Serve extends Command {
         }
     }
 }
+/**
+ * Best-effort driver introspection.
+ *
+ * Drivers register themselves under the kernel service name
+ * `driver.{driver.name}` (see `DriverPlugin.init`). We probe a list of
+ * well-known names and return a single-line label + redacted URL so the
+ * startup banner can show *something* even when the driver wasn't
+ * registered through this command's own `OS_DATABASE_URL` fallback
+ * (e.g. when the example app's preset or `ProjectKernelFactory` wired
+ * it). Returns `null` when nothing matches; the caller treats that as
+ * "no driver info available" and skips the line.
+ */
+function describeRegisteredDriver(kernel) {
+    const candidates = [
+        'driver.com.objectstack.driver.sql',
+        'driver.com.objectstack.driver.mongodb',
+        'driver.com.objectstack.driver.turso',
+        'driver.com.objectstack.driver.memory',
+        'driver.sql', 'driver.mongodb', 'driver.turso', 'driver.memory',
+    ];
+    for (const name of candidates) {
+        let driver;
+        try {
+            driver = kernel?.getService?.(name);
+        }
+        catch { /* not registered */ }
+        if (!driver)
+            continue;
+        // SqlDriver: `{ client, connection: string | { filename, host, ... } }`
+        const cfg = driver.config;
+        if (cfg) {
+            const client = cfg.client;
+            const conn = cfg.connection;
+            let url = '';
+            if (typeof conn === 'string') {
+                url = conn;
+            }
+            else if (conn && typeof conn === 'object') {
+                url = conn.filename
+                    ?? (conn.host ? `${conn.host}${conn.port ? `:${conn.port}` : ''}${conn.database ? `/${conn.database}` : ''}` : '');
+            }
+            const label = client ? `SqlDriver(${client})` : (driver.name ?? 'SqlDriver');
+            return { label, url: url || '(unknown)' };
+        }
+        // MongoDB / Turso drivers expose the URL on the instance itself.
+        if (driver.url) {
+            const label = driver.constructor?.name ?? driver.name ?? 'Driver';
+            return { label, url: String(driver.url) };
+        }
+        // InMemoryDriver — no URL.
+        return {
+            label: driver.constructor?.name ?? driver.name ?? 'Driver',
+            url: '(in-memory)',
+        };
+    }
+    return null;
+}
 //# sourceMappingURL=serve.js.map