Merge branch 'main' of https://github.com/objectstack-ai/framework

Author: hotlong

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- **`@objectstack/driver-sql` tests failing in CI** — Added `vitest.config.ts` with resolve aliases for `@objectstack/spec/*` subpath exports (`/data`, `/contracts`, `/system`). Without these aliases, vitest could not resolve the source paths at test time, causing all 81 tests to fail with `ERR_MODULE_NOT_FOUND`.
+
 ### Added
 - **Account portal: full better-auth SDK migration** — All user-settings pages (`/account/*`) and the first-run `/setup` wizard now use typed SDK methods from `@objectstack/client` instead of raw `fetch()` calls against `/api/v1/auth/…`. This fixes several silent bugs (wrong parameter names, invented endpoints) and adds missing features:
   - **SDK extensions** (`packages/client`): `auth.{updateUser, changePassword, changeEmail, sendVerificationEmail, verifyEmail, deleteUser, bootstrapStatus}`, `auth.sessions.{list, revoke, revokeOthers, revokeAll}`, `auth.twoFactor.{enable, verifyTotp, disable, generateBackupCodes, verifyBackupCode}`, `auth.accounts.{list, unlink, linkSocial}`, `organizations.{removeMember, updateMemberRole, getActiveMember, leave}`, `organizations.invitations.{list, listMine, cancel, accept, reject, resend}`, `organizations.teams.{list, create, update, delete, listMembers, addMember, removeMember}`.

apps/objectos/README.md

@@ -172,19 +172,53 @@ Behavior:
 
 ### Database (Local / Standalone mode)
 
+ObjectOS in single-project local mode uses **two** databases:
+
+| DB | Purpose | Env var | Default |
+|:---|:---|:---|:---|
+| **Project DB** | Your business data (records served at `/api/v1/data/*`) | `OS_DATABASE_URL` / `OS_DATABASE_DRIVER` | local SQLite at `.objectstack/data/proj_local.db` |
+| **Control DB** | Framework bookkeeping (`sys_organization`, `sys_project`, `sys_user`, …) | `OS_CONTROL_DATABASE_URL` | local SQLite at `.objectstack/data/control.db` |
+
+Other variables:
+
 | Variable | Default | Description |
 |:---|:---|:---|
-| `OS_DATABASE_URL` | `.objectstack/data/app.db` | SQLite file path, `libsql://`, or `http(s)://` |
 | `OS_DATABASE_AUTH_TOKEN` | — | Auth token for libSQL / Turso |
+| `OS_DATABASE_DRIVER` | inferred from URL scheme | Explicit override: `mongodb`, `postgres`, `mysql`, `sqlite`, `turso`, `memory` |
 
-Supported `OS_DATABASE_URL` formats:
+The driver is **inferred from the URL scheme** of `OS_DATABASE_URL`
+(and `OS_CONTROL_DATABASE_URL`). You almost never need to set
+`OS_DATABASE_DRIVER` explicitly.
 
-| Value | Driver |
+| `OS_DATABASE_URL` value | Driver |
 |:---|:---|
-| unset | SQLite — `.objectstack/data/app.db` |
-| `file:<path>` | SQLite at that path |
-| `libsql://host` | libSQL / Turso |
-| `http(s)://host` | libSQL over HTTP (sqld) |
+| unset | SQLite — `.objectstack/data/proj_local.db` |
+| `file:<path>` / `<path>.db` / `<path>.sqlite` | SQLite at that path |
+| `:memory:` | SQLite in-memory |
+| `mongodb://…` / `mongodb+srv://…` | **MongoDB** (`@objectstack/driver-mongodb`) |
+| `postgres://…` / `postgresql://…` | PostgreSQL (`@objectstack/driver-sql`) |
+| `mysql://…` / `mysql2://…` | MySQL (`@objectstack/driver-sql`) |
+| `libsql://…` / `https://*.turso.…` | libSQL / Turso (`@objectstack/driver-turso`) |
+
+Examples:
+
+```bash
+# Project DB on MongoDB (control DB stays on local SQLite)
+OS_DATABASE_URL=mongodb://localhost:27017/objectos pnpm dev
+
+# Project DB on Postgres
+OS_DATABASE_URL=postgres://user:pass@host:5432/myapp pnpm dev
+
+# Pin both DBs explicitly (Postgres for project, Turso for control plane)
+OS_DATABASE_URL=postgres://user:pass@host/myapp \
+OS_CONTROL_DATABASE_URL=libsql://control.turso.io \
+OS_DATABASE_AUTH_TOKEN=$TURSO_TOKEN \
+pnpm dev
+```
+
+For backward compatibility, `OS_DATABASE_URL` is also accepted as a
+fallback for the control DB when neither `OS_CONTROL_DATABASE_URL` nor
+an explicit programmatic value is set.
 
 ### Kernel Tuning
 

content/docs/concepts/north-star.mdx

@@ -498,6 +498,10 @@ preserve Built, reduce Drift, and advance Missing.
 - **CLI `publish` routes to project publish endpoint (D2).** `objectstack publish` now POSTs to `/api/v1/cloud/projects/:id/metadata`, accepts `--project` and `--server` flags, and returns `versionId`, `commitId`, and `checksum` — [packages/cli/src/commands/publish.ts](packages/cli/src/commands/publish.ts).
 - **`apps/objectos` uses ObjectOS runtime mode (M4).** `apps/objectos/objectstack.config.ts` boots via `createBootStack({ runtime: { cloudUrl: ... } })`, separating the ObjectOS runtime from the control plane — [apps/objectos/objectstack.config.ts](apps/objectos/objectstack.config.ts).
 - **`apps/cloud` is an independent control plane (D8).** `apps/cloud/objectstack.config.ts` boots via `createBootStack({ mode: 'cloud', ... })`, running the control plane independently without the ObjectOS runtime manifest — [apps/cloud/objectstack.config.ts](apps/cloud/objectstack.config.ts).
+- **Storage driver matrix expanded to MongoDB.** `@objectstack/driver-mongodb` ships a full `IDataDriver` (filter translator, aggregation builder, schema sync) with 75 unit tests against `mongodb-memory-server`, and is wired into the CLI / `service-cloud` driver factory — [packages/plugins/driver-mongodb/](packages/plugins/driver-mongodb/), [packages/services/service-cloud/src/driver-factory.ts](packages/services/service-cloud/src/driver-factory.ts).
+- **Driver auto-detection from URL scheme.** `OS_DATABASE_URL` / `OS_CONTROL_DATABASE_URL` infer the driver from `mongodb://`, `postgres://`, `mysql://`, `libsql://`, `file:`, `:memory:` so deploys can drop the explicit `OS_DATABASE_DRIVER` flag — [packages/cli/src/commands/serve.ts](packages/cli/src/commands/serve.ts), [apps/objectos/objectstack.config.ts](apps/objectos/objectstack.config.ts).
+- **CLI startup banner shows resolved driver + redacted DB URL.** `objectstack serve` prints a `Driver:` line (e.g. `MongoDBDriver → mongodb://admin:****@host/db`) so operators can verify URL inference at a glance — [packages/cli/src/utils/format.ts](packages/cli/src/utils/format.ts).
+- **Multi-driver e2e harness.** `examples/app-crm` ships a shared `runDriverAcceptance()` helper plus per-driver Playwright specs (sqlite / mongodb / postgres) and a `scripts/run-driver-acceptance.sh` wrapper that boots `pnpm dev` per-driver — [examples/app-crm/e2e/_acceptance.ts](examples/app-crm/e2e/_acceptance.ts).
 
 ### <AlertTriangle className="inline" /> Drift (Needs Cleanup)
 

content/docs/references/security/rls.mdx

@@ -25,7 +25,7 @@ permissions (CRUD), RLS provides record-level filtering.
 
 - Users only see records from their organization
 
-- `using: "tenant_id = current_user.tenant_id"`
+- `using: "organization_id = current_user.organization_id"`
 
 2. **Ownership-Based Access**
 
@@ -83,7 +83,7 @@ object: 'account',
 
 operation: 'select',
 
-using: 'tenant_id = current_user.tenant_id'
+using: 'organization_id = current_user.organization_id'
 
 \}
 

examples/app-crm/e2e/_acceptance.ts

@@ -0,0 +1,67 @@
+import { test, expect, request } from '@playwright/test';
+
+/**
+ * Shared driver-acceptance suite for the CRM example.
+ * Each driver-specific spec calls `runDriverAcceptance({ label, baseURL })`.
+ * The CRM dev server is expected to be reachable at `baseURL`,
+ * already booted with the appropriate `OS_DATABASE_URL` for the driver
+ * under test (this is wired by the Playwright `webServer` config or by
+ * a wrapper script that boots the server out-of-band).
+ */
+export function runDriverAcceptance(opts: { label: string; baseURL?: string }) {
+  const BASE_URL = opts.baseURL ?? process.env.CRM_BASE_URL ?? 'http://localhost:3001';
+
+  test.describe(`CRM running on ${opts.label} driver`, () => {
+    test('Studio responds', async () => {
+      const ctx = await request.newContext({ baseURL: BASE_URL });
+      const studio = await ctx.get('/_studio/');
+      expect(studio.status()).toBeGreaterThanOrEqual(200);
+      expect(studio.status()).toBeLessThan(500);
+      await ctx.dispose();
+    });
+
+    test('seed data is queryable', async () => {
+      const ctx = await request.newContext({ baseURL: BASE_URL });
+      const res = await ctx.get('/api/v1/data/account?limit=10');
+      expect(res.ok()).toBe(true);
+      const body = await res.json();
+      expect(body.object).toBe('account');
+      expect(Array.isArray(body.records)).toBe(true);
+      expect(body.records.length).toBeGreaterThan(0);
+      await ctx.dispose();
+    });
+
+    test('CRUD round-trip on account', async () => {
+      const ctx = await request.newContext({ baseURL: BASE_URL });
+      const unique = `Playwright ${opts.label} ${Date.now()}`;
+
+      const created = await ctx.post('/api/v1/data/account', {
+        data: { name: unique, industry: 'technology', type: 'prospect' },
+      });
+      expect(created.ok()).toBe(true);
+      const createdBody = await created.json();
+      const id = createdBody.id ?? createdBody.record?.id;
+      expect(id).toBeTruthy();
+      expect(createdBody.record?.name).toBe(unique);
+
+      const fetched = await ctx.get(`/api/v1/data/account/${id}`);
+      expect(fetched.ok()).toBe(true);
+      const fetchedBody = await fetched.json();
+      expect(fetchedBody.record?.name).toBe(unique);
+
+      const updated = await ctx.patch(`/api/v1/data/account/${id}`, {
+        data: { industry: 'finance' },
+      });
+      expect(updated.ok()).toBe(true);
+
+      const reread = await ctx.get(`/api/v1/data/account/${id}`);
+      const rereadBody = await reread.json();
+      expect(rereadBody.record?.industry).toBe('finance');
+
+      const deleted = await ctx.delete(`/api/v1/data/account/${id}`);
+      expect(deleted.ok()).toBe(true);
+
+      await ctx.dispose();
+    });
+  });
+}

examples/app-crm/e2e/mongodb-driver.spec.ts

@@ -1,62 +1,8 @@
-import { test, expect, request } from '@playwright/test';
+import { runDriverAcceptance } from './_acceptance';
 
 /**
- * E2E test: verifies the CRM dev server boots with the MongoDB driver
- * (selected via `OS_DATABASE_DRIVER=mongodb`) and that CRUD round-trips
- * land in the configured MongoDB database.
+ * Boots `pnpm dev` with `OS_DATABASE_URL=mongodb://...`
+ * (driver auto-inferred from the URL  no OS_DATABASE_DRIVER needed).scheme 
+ * Requires a local mongod listening on the URL.
  */
-const BASE_URL = process.env.CRM_BASE_URL ?? 'http://localhost:3001';
-
-test.describe('CRM running on MongoDB driver', () => {
-  test('Studio responds', async () => {
-    const ctx = await request.newContext({ baseURL: BASE_URL });
-    const studio = await ctx.get('/_studio/');
-    expect(studio.status()).toBeGreaterThanOrEqual(200);
-    expect(studio.status()).toBeLessThan(500);
-    await ctx.dispose();
-  });
-
-  test('seed data is queryable from MongoDB', async () => {
-    const ctx = await request.newContext({ baseURL: BASE_URL });
-    const res = await ctx.get('/api/v1/data/account?limit=10');
-    expect(res.ok()).toBe(true);
-    const body = await res.json();
-    expect(body.object).toBe('account');
-    expect(Array.isArray(body.records)).toBe(true);
-    expect(body.records.length).toBeGreaterThan(0);
-    await ctx.dispose();
-  });
-
-  test('CRUD round-trip on account collection', async () => {
-    const ctx = await request.newContext({ baseURL: BASE_URL });
-    const unique = `Playwright Mongo Account ${Date.now()}`;
-
-    const created = await ctx.post('/api/v1/data/account', {
-      data: { name: unique, industry: 'technology', type: 'prospect' },
-    });
-    expect(created.ok()).toBe(true);
-    const createdBody = await created.json();
-    const id = createdBody.id ?? createdBody.record?.id;
-    expect(id).toBeTruthy();
-    expect(createdBody.record?.name).toBe(unique);
-
-    const fetched = await ctx.get(`/api/v1/data/account/${id}`);
-    expect(fetched.ok()).toBe(true);
-    const fetchedBody = await fetched.json();
-    expect(fetchedBody.record?.name).toBe(unique);
-
-    const updated = await ctx.patch(`/api/v1/data/account/${id}`, {
-      data: { industry: 'finance' },
-    });
-    expect(updated.ok()).toBe(true);
-
-    const reread = await ctx.get(`/api/v1/data/account/${id}`);
-    const rereadBody = await reread.json();
-    expect(rereadBody.record?.industry).toBe('finance');
-
-    const deleted = await ctx.delete(`/api/v1/data/account/${id}`);
-    expect(deleted.ok()).toBe(true);
-
-    await ctx.dispose();
-  });
-});
+runDriverAcceptance({ label: 'MongoDB' });

examples/app-crm/e2e/postgres-driver.spec.ts

@@ -0,0 +1,8 @@
+import { runDriverAcceptance } from './_acceptance';
+
+/**
+ * Boots `pnpm dev` with `OS_DATABASE_URL=postgres://...`
+ * (driver auto-inferred → SqlDriver(client:'pg')).
+ * Requires a running PostgreSQL instance reachable at the URL.
+ */
+runDriverAcceptance({ label: 'PostgreSQL' });

examples/app-crm/e2e/sqlite-driver.spec.ts

@@ -0,0 +1,8 @@
+import { runDriverAcceptance } from './_acceptance';
+
+/**
+ * Boots `pnpm dev` with `OS_DATABASE_URL=file:./<dir>/proj_local.db`
+ * (driver auto-inferred → SqlDriver(client:'better-sqlite3')).
+ * Requires no external services — runs anywhere.
+ */
+runDriverAcceptance({ label: 'SQLite' });

examples/app-crm/objectstack.config.ts

@@ -13,7 +13,6 @@ import * as cubes from './src/cubes';
 
 // ─── Barrel Imports (one per metadata type) ─────────────────────────
 import * as objects from './src/objects';
-import * as apis from './src/apis';
 import * as actions from './src/actions';
 import * as dashboards from './src/dashboards';
 import * as reports from './src/reports';
@@ -60,7 +59,6 @@ export default defineStack({
 
   // Auto-collected from barrel index files via Object.values()
   objects: Object.values(objects),
-  apis: Object.values(apis),
   actions: Object.values(actions),
   dashboards: Object.values(dashboards),
   reports: Object.values(reports),

examples/app-crm/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "@example/app-crm",
+  "name": "@objectstack/example-crm",
   "version": "4.0.4",
   "description": "Example CRM implementation using ObjectStack Protocol",
   "license": "Apache-2.0",
@@ -16,7 +16,8 @@
     "build": "objectstack build",
     "typecheck": "tsc --noEmit",
     "test": "objectstack test",
-    "test:e2e": "playwright test"
+    "test:e2e": "playwright test",
+    "test:e2e:drivers": "./scripts/run-driver-acceptance.sh"
   },
   "dependencies": {
     "@objectstack/spec": "workspace:*",