cloud

Author: hotlong

apps/server/objectstack.config.ts

@@ -124,17 +124,15 @@ async function createProjectStack() {
         baseUrl,
         controlDriverUrl: controlDbUrl,
         appBundles: createFsAppBundleResolver(),
-        // Project-mode per-project plugins. Identical to the cloud default
-        // except for the AppPlugin tail — we eagerly load the local
-        // artifact bundle (if present) so the single project picks up
-        // schema definitions without needing a control-plane app row.
+        // Project-mode per-project plugins. The control plane (created by
+        // `createCloudStack`'s preset) is the sole owner of identity,
+        // authentication, security, audit, tenant catalogs, and packages —
+        // their tables live in `control.db`. Each per-project kernel only
+        // registers the engines needed to materialize that project's
+        // **business data** schemas + records.
         basePlugins: async ({ projectId }: { projectId: string }) => {
             const { ObjectQLPlugin } = await import('@objectstack/objectql');
             const { MetadataPlugin } = await import('@objectstack/metadata');
-            const { createTenantPlugin } = await import('@objectstack/service-tenant');
-            const { AuthPlugin } = await import('@objectstack/plugin-auth');
-            const { SecurityPlugin } = await import('@objectstack/plugin-security');
-            const { AuditPlugin } = await import('@objectstack/plugin-audit');
             const { AppPlugin } = await import('@objectstack/runtime');
 
             let artifactBundle: any = null;
@@ -155,10 +153,6 @@ async function createProjectStack() {
                     environmentId: projectId,
                     artifactSource: { mode: 'local-file', path: localArtifactPath },
                 }),
-                createTenantPlugin({ registerSystemObjects: true }),
-                new AuthPlugin({ secret: authSecret, baseUrl }),
-                new SecurityPlugin(),
-                new AuditPlugin(),
             ];
             if (artifactBundle) plugins.push(new AppPlugin(artifactBundle));
             return plugins;

packages/services/service-cloud/src/cloud-stack.ts

@@ -85,22 +85,20 @@ export async function createCloudStack(config: CloudStackConfig): Promise<{
         process.env.OBJECTSTACK_DATABASE_AUTH_TOKEN || process.env.TURSO_AUTH_TOKEN || controlDriverAuthToken,
     );
 
-    // Default base plugins (cloud per-project kernel)
+    // Default base plugins (per-project kernel — business data only).
+    //
+    // Identity, authentication, security, audit, and tenant catalogs are owned
+    // exclusively by the control-plane kernel (see control-plane-preset.ts).
+    // Their tables live in the control DB and must NOT be duplicated per project.
+    // Each per-project kernel only registers the engines needed to materialise
+    // that project's business-data schemas and records.
     const resolvedBasePlugins: BasePluginsFactory = basePlugins ?? (async ({ projectId, project }) => {
         const { ObjectQLPlugin } = await import('@objectstack/objectql');
         const { MetadataPlugin } = await import('@objectstack/metadata');
-        const { createTenantPlugin } = await import('@objectstack/service-tenant');
-        const { AuthPlugin } = await import('@objectstack/plugin-auth');
-        const { SecurityPlugin } = await import('@objectstack/plugin-security');
-        const { AuditPlugin } = await import('@objectstack/plugin-audit');
         const orgId = project.organization_id;
         return [
             new ObjectQLPlugin({ environmentId: projectId }),
             new MetadataPlugin({ watch: false, environmentId: projectId, organizationId: orgId }),
-            createTenantPlugin({ registerSystemObjects: true }),
-            new AuthPlugin({ secret: authSecret, baseUrl }),
-            new SecurityPlugin(),
-            new AuditPlugin(),
         ];
     });