diff --git a/.changeset/out-of-repo-package-names.md b/.changeset/out-of-repo-package-names.md new file mode 100644 index 0000000000..3d65b0dd20 --- /dev/null +++ b/.changeset/out-of-repo-package-names.md @@ -0,0 +1,48 @@ +--- +'@objectstack/console': patch +'@objectstack/cli': patch +--- + +Stop naming a package nobody can install: `@objectstack/framework` is not a real +package, and the multi-org remedy now says it is not publicly obtainable + +Four `@objectstack/` names appear in this repo's published docs and runtime text +without this repo building any of them. Measured against the public npm registry +(unauthenticated `GET https://registry.npmjs.org/@objectstack%2F`, with +`@objectstack/spec` and `@objectstack/cli` as positive controls so a 404 is a +fact about the name and not about access), they are **not one population but +three**: + +- `@objectstack/framework` — **404, and fabricated.** Unlike the others, nothing + in this tree describes it as enterprise, cloud, or private; it is presented as + the *default public* install. There is no umbrella package and there never was. +- `@objectstack/security-enterprise` (404) and `@objectstack/organizations` + (404) — **real, and deliberately not public.** This tree calls them + "closed-source" and "cloud-private" in a dozen places, and + `PLATFORM_CAPABILITY_PROVIDERS` declares `security-enterprise` with + `edition: 'enterprise'`. Their 404 is the caveat npm's API carries for any + private package, not evidence of fabrication. +- `@objectstack/service-tenant` — **published, at 4.1.0**, exactly as + `platform-object-names.ts` describes it. Untouched. + +What changes: + +- **`@objectstack/console`'s README** no longer opens with + `pnpm add @objectstack/framework`. The mechanism it described is real, just + misnamed: `@objectstack/cli` declares `@objectstack/console` as a dependency + and both ship at one version from the Changesets `fixed` group, so any app + that installs the CLI — every `npx create-objectstack` scaffold does — already + gets a version-matched Console. The instruction is corrected rather than + deleted, so the reader is left with something they can run. +- **`serve`'s multi-org fail-fast** kept telling an operator to add + `@objectstack/organizations` to their app without saying the runtime ships + only with an enterprise/cloud subscription. That is the un-followable "add it + to your dependencies" that framework#3366 exists to make legible. The remedy + now states it, so an operator without a licence can see that the two bullets + below it are their actual path. The declared-but-unresolvable branch is + unchanged — that operator does have the package. + +No behaviour changes: boot outcomes, exit codes and the posture wall are +untouched, and `@objectstack/security-enterprise`'s install hint is deliberately +left alone — it already names its edition boundary, and the test pinning it is +strengthened to assert that it keeps doing so. diff --git a/packages/cli/src/commands/serve.ts b/packages/cli/src/commands/serve.ts index ba779d8282..6c758623d3 100644 --- a/packages/cli/src/commands/serve.ts +++ b/packages/cli/src/commands/serve.ts @@ -2658,7 +2658,10 @@ export default class Serve extends Command { " — declare it in the app's package.json and install; the CLI resolves it from the\n" + ' app, not from the framework it is linked out of. Being merely reachable\n' + ' through NODE_PATH / a hoisted workspace store is deliberately not enough\n' + - ' (#4719) — that made this wall depend on how the process was launched — or\n'; + ' (#4719) — that made this wall depend on how the process was launched.\n' + + ' NOTE: this runtime is closed-source and is NOT on the public npm registry —\n' + + ' it is distributed with an enterprise / cloud subscription. Without one this\n' + + ' bullet is not followable, and one of the two below is your path — or\n'; console.error( chalk.red( `\n ✖ FATAL: tenancy posture '${tenancyPosture}' was requested but ` + diff --git a/packages/cli/src/utils/console.ts b/packages/cli/src/utils/console.ts index ec316754b1..eee8fe557b 100644 --- a/packages/cli/src/utils/console.ts +++ b/packages/cli/src/utils/console.ts @@ -14,7 +14,9 @@ * 1. `@objectstack/console` — the framework-vendored, version-locked * build. Shipped as a dist-only npm package frozen at the objectui * SHA recorded in `/.objectui-sha`. This is what a - * fresh `pnpm add @objectstack/framework` install gets. Cloud / + * fresh `@objectstack/cli` install gets: the CLI declares this + * package as a dependency and both ship at one version from the + * Changesets `fixed` group, so no app installs it by hand. Cloud / * objectos Docker builds overlay their own `cloud/.objectui-sha` * build into this package's `dist/` so the same package name * always wins regardless of who built the image. diff --git a/packages/cli/test/capability-preflight.test.ts b/packages/cli/test/capability-preflight.test.ts index fcd95ecc8b..e310665ec3 100644 --- a/packages/cli/test/capability-preflight.test.ts +++ b/packages/cli/test/capability-preflight.test.ts @@ -5,7 +5,10 @@ import { missingProviderMessage, makeProviderResolver, } from '../src/utils/capability-preflight.js'; -import { classifyRequiredCapability } from '@objectstack/spec/kernel'; +import { + classifyRequiredCapability, + PLATFORM_CAPABILITY_PROVIDERS, +} from '@objectstack/spec/kernel'; // framework#3366 — the CLI-side resolution + message layer over the spec-owned // classifier. Resolution is injected so the classification is deterministic. @@ -69,10 +72,20 @@ describe('renderCapabilityMessage (#3366)', () => { expect(m).toContain('pnpm add @objectstack/service-automation'); }); - it('enterprise provider hint points at plugins[] wiring', () => { + it('enterprise provider hint names plugins[] wiring AND carries the edition boundary', () => { const m = msgFor('hierarchy-security', () => false); expect(m).toContain('pnpm add @objectstack/security-enterprise'); expect(m).toContain('plugins[]'); + // #10921 — this `pnpm add` names a package this repo does not build and that + // is not publicly resolvable; it is followable only by a licensee. What keeps + // it from reading as an ordinary open-edition install is the roster's edition + // note, so assert the message carries that note VERBATIM instead of a literal + // copied into this file — the note is spec-owned, and a copy here would let + // the two drift apart with both still green. Strip the note from the roster + // entry, or stop interpolating it, and this fails. + const note = PLATFORM_CAPABILITY_PROVIDERS['hierarchy-security'].note; + expect(note, 'the enterprise roster entry must carry an edition note').toBeTruthy(); + expect(m).toContain(note!); }); it('unknown token reads as a typo hint', () => { diff --git a/packages/console/README.md b/packages/console/README.md index 5d560784f9..210c3a0a1f 100644 --- a/packages/console/README.md +++ b/packages/console/README.md @@ -1,20 +1,24 @@ # @objectstack/console -**Prebuilt Console SPA, version-locked to `@objectstack/framework`.** +**Prebuilt Console SPA, version-locked to the framework release that ships it.** This package contains nothing but a prebuilt `dist/` directory: the static assets of the ObjectStack runtime Console, baked at the commit of [`objectstack-ai/objectui`](https://github.com/objectstack-ai/objectui) recorded in [`.objectui-sha`](../../.objectui-sha) of this framework release. -It exists so that a single +You never install it directly. `@objectstack/cli` declares it as a +dependency, and both ship at the same version from the Changesets `fixed` +group (see [`.changeset/config.json`](../../.changeset/config.json)), so +scaffolding an app ```sh -pnpm add @objectstack/framework +npx create-objectstack ``` -always pulls in a Console build matched to the framework version — no -second npm dependency to keep in sync. +— or adding `@objectstack/cli` to an existing one — always pulls in a Console +build matched to the framework version, with no second npm dependency to keep +in sync. ## Relationship to `@object-ui/console` @@ -22,7 +26,7 @@ second npm dependency to keep in sync. |---|---|---| | Repo | [`objectstack-ai/objectui`](https://github.com/objectstack-ai/objectui) | [`objectstack-ai/objectstack`](https://github.com/objectstack-ai/objectstack) | | Role | Standalone Console SPA on its own release cadence | Prebuilt SPA frozen at the SHA this framework release was tested against | -| Use | Cloud overlays, advanced users, anyone consuming Console directly | Default install for `@objectstack/framework` consumers | +| Use | Cloud overlays, advanced users, anyone consuming Console directly | What every `@objectstack/cli` install gets by default | The framework CLI's `resolveConsolePath()` (in `packages/cli/src/utils/console.ts`) prefers `@objectstack/console` and