@objectstack/runtime 9.11.0 → 10.2.0

package/dist/index.d.cts

@@ -117,6 +117,19 @@ interface StandaloneStackResult {
     requires?: string[];
     objects?: any[];
     manifest?: any;
+    /**
+     * App-declared RBAC metadata, surfaced so the CLI (`serve`/`dev`/`start`)
+     * can wire it without a host `objectstack.config.ts`. In particular the
+     * `serve` command reads `permissions[]` to honour an app-declared default
+     * profile (ADR-0056 D7 — `appDefaultProfileName` → SecurityPlugin
+     * `fallbackPermissionSet`) and reads both `roles[]` and `permissions[]` to
+     * register application org roles with Better-Auth. Without these the
+     * artifact-serve path silently fell back to the built-in `member_default`
+     * (owner-only), so an `isDefault` profile declared purely in app metadata
+     * was ignored under `objectstack dev`.
+     */
+    permissions?: any[];
+    roles?: any[];
 }
 declare function createStandaloneStack(config?: StandaloneStackConfig): Promise<StandaloneStackResult>;
 

package/dist/index.d.ts

@@ -117,6 +117,19 @@ interface StandaloneStackResult {
     requires?: string[];
     objects?: any[];
     manifest?: any;
+    /**
+     * App-declared RBAC metadata, surfaced so the CLI (`serve`/`dev`/`start`)
+     * can wire it without a host `objectstack.config.ts`. In particular the
+     * `serve` command reads `permissions[]` to honour an app-declared default
+     * profile (ADR-0056 D7 — `appDefaultProfileName` → SecurityPlugin
+     * `fallbackPermissionSet`) and reads both `roles[]` and `permissions[]` to
+     * register application org roles with Better-Auth. Without these the
+     * artifact-serve path silently fell back to the built-in `member_default`
+     * (owner-only), so an `isDefault` profile declared purely in app metadata
+     * was ignored under `objectstack dev`.
+     */
+    permissions?: any[];
+    roles?: any[];
 }
 declare function createStandaloneStack(config?: StandaloneStackConfig): Promise<StandaloneStackResult>;
 

package/dist/index.js

@@ -963,6 +963,65 @@ var init_app_plugin = __esm({
               error: err?.message ?? String(err)
             });
           }
+          try {
+            const dsDefs = this.bundle.datasources;
+            const dsList = Array.isArray(dsDefs) ? dsDefs : dsDefs && typeof dsDefs === "object" ? Object.entries(dsDefs).map(([name, def]) => ({ name, ...def })) : [];
+            if (dsList.length > 0) {
+              let connection;
+              try {
+                connection = ctx.getService("datasource-connection");
+              } catch {
+                connection = void 0;
+              }
+              if (typeof connection?.connectDeclared === "function") {
+                const objects = Array.isArray(this.bundle.objects) ? this.bundle.objects : [];
+                const results = await connection.connectDeclared({ datasources: dsList, objects });
+                const connected = results.filter((r) => r.status === "connected");
+                if (connected.length > 0) {
+                  ctx.logger.info("Auto-connected declared datasources", {
+                    appId,
+                    connected: connected.map((r) => r.name)
+                  });
+                }
+              } else {
+                ctx.logger.debug("No datasource-connection service \u2014 declared datasources stay metadata-only", { appId });
+              }
+            }
+          } catch (err) {
+            ctx.logger.error(
+              `[AppPlugin] declared-datasource auto-connect failed for app '${appId}': ${err?.message ?? String(err)}`
+            );
+            throw err;
+          }
+          try {
+            const metadata = ctx.getService("metadata");
+            if (typeof metadata?.registerInMemory === "function") {
+              const securityBundle = this.bundle.manifest ? { ...this.bundle.manifest, ...this.bundle } : this.bundle;
+              const SECURITY_FIELDS = [
+                ["roles", "role"],
+                ["permissions", "permission"],
+                ["sharingRules", "sharing_rule"],
+                ["policies", "policy"]
+              ];
+              let count = 0;
+              for (const [field, type] of SECURITY_FIELDS) {
+                const arr = securityBundle?.[field];
+                if (!Array.isArray(arr)) continue;
+                for (const item of arr) {
+                  if (!item?.name) continue;
+                  metadata.registerInMemory(type, item.name, item);
+                  count += 1;
+                }
+              }
+              if (count > 0) {
+                ctx.logger.info("Registered stack-declared security metadata", { appId, count });
+              }
+            }
+          } catch (err) {
+            ctx.logger.warn("[AppPlugin] failed to register security metadata", {
+              error: err?.message ?? String(err)
+            });
+          }
           const stackBundle = this.bundle.default || this.bundle;
           const runtime = stackBundle && typeof stackBundle.onEnable === "function" ? stackBundle : this.bundle;
           if (runtime && typeof runtime.onEnable === "function") {
@@ -1501,55 +1560,55 @@ async function createStandaloneStack(config) {
   const explicitDriver = cfg.databaseDriver ?? process.env.OS_DATABASE_DRIVER?.trim();
   const dbDriver = explicitDriver ?? detectDriverFromUrl(dbUrl);
   let driverPlugin;
-  if (dbDriver === "memory") {
-    const { InMemoryDriver } = await import("@objectstack/driver-memory");
-    driverPlugin = new DriverPlugin2(new InMemoryDriver());
-  } else if (dbDriver === "postgres") {
-    const { SqlDriver } = await import("@objectstack/driver-sql");
-    driverPlugin = new DriverPlugin2(
-      new SqlDriver({
-        client: "pg",
-        connection: dbUrl,
-        pool: { min: 0, max: 5 }
-      })
-    );
-  } else if (dbDriver === "mongodb") {
-    let MongoDBDriver;
-    try {
-      ({ MongoDBDriver } = await import("@objectstack/driver-mongodb"));
-    } catch (err) {
-      throw new Error(
-        `[StandaloneStack] mongodb URL detected but @objectstack/driver-mongodb is not installed. Add it as a dependency or pass an explicit driverPlugin. (${err?.message ?? err})`
-      );
-    }
-    driverPlugin = new DriverPlugin2(new MongoDBDriver({ url: dbUrl }));
-  } else if (dbDriver === "sqlite-wasm") {
+  if (dbDriver === "sqlite-wasm") {
     const { SqliteWasmDriver } = await import("@objectstack/driver-sqlite-wasm");
-    const filename = dbUrl.replace(/^wasm-sqlite:(\/\/)?/i, "").replace(/^file:(\/\/)?/i, "");
-    if (filename && filename !== ":memory:") {
+    const filename = dbUrl.replace(/^wasm-sqlite:(\/\/)?/i, "").replace(/^file:(\/\/)?/i, "") || ":memory:";
+    if (filename !== ":memory:") {
       mkdirSync2(resolvePath2(filename, ".."), { recursive: true });
     }
     driverPlugin = new DriverPlugin2(
       new SqliteWasmDriver({
-        filename: filename || ":memory:",
-        persist: filename && filename !== ":memory:" ? "on-write" : void 0
+        filename,
+        persist: filename !== ":memory:" ? "on-write" : void 0
       })
     );
   } else {
-    const { SqlDriver } = await import("@objectstack/driver-sql");
-    const filename = dbUrl.replace(/^file:(\/\/)?/, "");
-    if (!filename || /^[a-z][a-z0-9+.-]*:\/\//i.test(filename)) {
-      throw new Error(
-        `[StandaloneStack] sqlite driver was selected but the URL does not look like a file path: "${dbUrl}". Use file:/path/to/db.sqlite, or set OS_DATABASE_DRIVER explicitly.`
-      );
+    const { createDefaultDatasourceDriverFactory } = await import("@objectstack/service-datasource");
+    let driverId;
+    let driverConfig;
+    if (dbDriver === "memory") {
+      driverId = "memory";
+      driverConfig = {};
+    } else if (dbDriver === "postgres") {
+      driverId = "postgres";
+      driverConfig = { url: dbUrl };
+    } else if (dbDriver === "mongodb") {
+      driverId = "mongodb";
+      driverConfig = { url: dbUrl };
+    } else {
+      driverId = "sqlite";
+      const filename = dbUrl.replace(/^file:(\/\/)?/, "");
+      if (!filename || /^[a-z][a-z0-9+.-]*:\/\//i.test(filename)) {
+        throw new Error(
+          `[StandaloneStack] sqlite driver was selected but the URL does not look like a file path: "${dbUrl}". Use file:/path/to/db.sqlite, or set OS_DATABASE_DRIVER explicitly.`
+        );
+      }
+      mkdirSync2(resolvePath2(filename, ".."), { recursive: true });
+      driverConfig = { filename };
+    }
+    let driverHandle;
+    try {
+      driverHandle = await createDefaultDatasourceDriverFactory().create({ driver: driverId, config: driverConfig });
+    } catch (err) {
+      if (dbDriver === "mongodb") {
+        throw new Error(
+          `[StandaloneStack] mongodb URL detected but @objectstack/driver-mongodb is not installed. Add it as a dependency or pass an explicit driverPlugin. (${err?.message ?? err})`
+        );
+      }
+      throw err;
     }
-    mkdirSync2(resolvePath2(filename, ".."), { recursive: true });
     driverPlugin = new DriverPlugin2(
-      new SqlDriver({
-        client: "better-sqlite3",
-        connection: { filename },
-        useNullAsDefault: true
-      })
+      driverHandle?.driver ?? driverHandle
     );
   }
   const artifactBundle = await loadArtifactBundle(artifactPath, {
@@ -1587,6 +1646,8 @@ async function createStandaloneStack(config) {
   const requires = Array.isArray(artifactBundle?.requires) ? artifactBundle.requires.filter((c) => typeof c === "string") : void 0;
   const objects = Array.isArray(artifactBundle?.objects) ? artifactBundle.objects : void 0;
   const manifest = artifactBundle?.manifest;
+  const permissions = Array.isArray(artifactBundle?.permissions) ? artifactBundle.permissions : void 0;
+  const roles = Array.isArray(artifactBundle?.roles) ? artifactBundle.roles : void 0;
   return {
     plugins,
     api: {
@@ -1595,7 +1656,9 @@ async function createStandaloneStack(config) {
     },
     ...requires ? { requires } : {},
     ...objects ? { objects } : {},
-    ...manifest ? { manifest } : {}
+    ...manifest ? { manifest } : {},
+    ...permissions ? { permissions } : {},
+    ...roles ? { roles } : {}
   };
 }
 var StandaloneStackConfigSchema;
@@ -1997,25 +2060,33 @@ function coerceLocale(value) {
   const s = typeof value === "string" ? value.trim() : value != null ? String(value).trim() : "";
   return s || void 0;
 }
+function coerceCurrency(value) {
+  const s = typeof value === "string" ? value.trim().toUpperCase() : "";
+  return /^[A-Z]{3}$/.test(s) ? s : void 0;
+}
 async function resolveLocalization(opts, ql, sctx) {
   try {
     const settings = await opts.getService("settings");
     if (settings && typeof settings.get === "function") {
-      const [tzRes, localeRes] = await Promise.all([
+      const [tzRes, localeRes, currencyRes] = await Promise.all([
         settings.get("localization", "timezone", sctx).catch(() => void 0),
-        settings.get("localization", "locale", sctx).catch(() => void 0)
+        settings.get("localization", "locale", sctx).catch(() => void 0),
+        settings.get("localization", "currency", sctx).catch(() => void 0)
       ]);
       const tz = coerceTimeZone(tzRes?.value);
       const locale = coerceLocale(localeRes?.value);
-      if (tz || locale) return { timezone: tz ?? "UTC", locale: locale ?? "en-US" };
+      const currency = coerceCurrency(currencyRes?.value);
+      if (tz || locale || currency) return { timezone: tz ?? "UTC", locale: locale ?? "en-US", currency };
     }
   } catch {
   }
   const tzRows = await tryFind(ql, "sys_setting", { namespace: "localization", key: "timezone", scope: "tenant" }, 1);
   const localeRows = await tryFind(ql, "sys_setting", { namespace: "localization", key: "locale", scope: "tenant" }, 1);
+  const currencyRows = await tryFind(ql, "sys_setting", { namespace: "localization", key: "currency", scope: "tenant" }, 1);
   return {
     timezone: coerceTimeZone(tzRows[0]?.value) ?? "UTC",
-    locale: coerceLocale(localeRows[0]?.value) ?? "en-US"
+    locale: coerceLocale(localeRows[0]?.value) ?? "en-US",
+    currency: coerceCurrency(currencyRows[0]?.value)
   };
 }
 async function resolveExecutionContext(opts) {
@@ -2070,6 +2141,13 @@ async function resolveExecutionContext(opts) {
       }
     }
   }
+  const userRoleRows = await tryFind(ql, "sys_user_role", { user_id: userId }, 200);
+  for (const ur of userRoleRows) {
+    const org = ur.organization_id ?? null;
+    if (org && tenantId && org !== tenantId) continue;
+    const r = ur.role;
+    if (typeof r === "string" && r && !ctx.roles.includes(r)) ctx.roles.push(r);
+  }
   if (tenantId) {
     const orgMembers = await tryFind(
       ql,
@@ -2156,6 +2234,7 @@ async function resolveExecutionContext(opts) {
   const localization = await resolveLocalization(opts, ql, { tenantId, userId });
   ctx.timezone = localization.timezone;
   ctx.locale = localization.locale;
+  if (localization.currency) ctx.currency = localization.currency;
   return ctx;
 }
 function isPermissionDeniedError(e) {
@@ -2653,7 +2732,7 @@ var _HttpDispatcher = class _HttpDispatcher {
    */
   async enforceProjectMembership(context, path) {
     if (!this.enforceMembership) return null;
-    const skipPaths = ["/auth", "/cloud", "/health", "/discovery"];
+    const skipPaths = ["/auth", "/cloud", "/health", "/ready", "/discovery"];
     if (skipPaths.some((p) => path.startsWith(p))) return null;
     if (/(^|\/)share-links\/[^/]+\/(resolve|messages)$/.test(path)) return null;
     const environmentId = context.environmentId;
@@ -4470,6 +4549,10 @@ var _HttpDispatcher = class _HttpDispatcher {
           })
         };
       }
+      if (cleanPath === "/ready" && method === "GET") {
+        const state = typeof this.kernel?.getState === "function" ? this.kernel.getState() : "running";
+        return state === "running" ? { handled: true, response: this.success({ status: "ready", state }) } : { handled: true, response: this.error("Service not ready", 503, { state }) };
+      }
       if (cleanPath.startsWith("/auth")) {
         return this.handleAuth(cleanPath.substring(5), method, body, context);
       }