fix(console,cli): stop printing install instructions for packages nobody can install

.changeset/out-of-repo-package-names.md

@@ -0,0 +1,48 @@
+---
+'@objectstack/console': patch
+'@objectstack/cli': patch
+---
+
+Stop naming a package nobody can install: `@objectstack/framework` is not a real
+package, and the multi-org remedy now says it is not publicly obtainable
+
+Four `@objectstack/` names appear in this repo's published docs and runtime text
+without this repo building any of them. Measured against the public npm registry
+(unauthenticated `GET https://registry.npmjs.org/@objectstack%2F<name>`, with
+`@objectstack/spec` and `@objectstack/cli` as positive controls so a 404 is a
+fact about the name and not about access), they are **not one population but
+three**:
+
+- `@objectstack/framework` — **404, and fabricated.** Unlike the others, nothing
+  in this tree describes it as enterprise, cloud, or private; it is presented as
+  the *default public* install. There is no umbrella package and there never was.
+- `@objectstack/security-enterprise` (404) and `@objectstack/organizations`
+  (404) — **real, and deliberately not public.** This tree calls them
+  "closed-source" and "cloud-private" in a dozen places, and
+  `PLATFORM_CAPABILITY_PROVIDERS` declares `security-enterprise` with
+  `edition: 'enterprise'`. Their 404 is the caveat npm's API carries for any
+  private package, not evidence of fabrication.
+- `@objectstack/service-tenant` — **published, at 4.1.0**, exactly as
+  `platform-object-names.ts` describes it. Untouched.
+
+What changes:
+
+- **`@objectstack/console`'s README** no longer opens with
+  `pnpm add @objectstack/framework`. The mechanism it described is real, just
+  misnamed: `@objectstack/cli` declares `@objectstack/console` as a dependency
+  and both ship at one version from the Changesets `fixed` group, so any app
+  that installs the CLI — every `npx create-objectstack` scaffold does — already
+  gets a version-matched Console. The instruction is corrected rather than
+  deleted, so the reader is left with something they can run.
+- **`serve`'s multi-org fail-fast** kept telling an operator to add
+  `@objectstack/organizations` to their app without saying the runtime ships
+  only with an enterprise/cloud subscription. That is the un-followable "add it
+  to your dependencies" that framework#3366 exists to make legible. The remedy
+  now states it, so an operator without a licence can see that the two bullets
+  below it are their actual path. The declared-but-unresolvable branch is
+  unchanged — that operator does have the package.
+
+No behaviour changes: boot outcomes, exit codes and the posture wall are
+untouched, and `@objectstack/security-enterprise`'s install hint is deliberately
+left alone — it already names its edition boundary, and the test pinning it is
+strengthened to assert that it keeps doing so.

packages/cli/src/commands/serve.ts

@@ -2658,7 +2658,10 @@ export default class Serve extends Command {
                         "        — declare it in the app's package.json and install; the CLI resolves it from the\n" +
                         '          app, not from the framework it is linked out of. Being merely reachable\n' +
                         '          through NODE_PATH / a hoisted workspace store is deliberately not enough\n' +
-                        '          (#4719) — that made this wall depend on how the process was launched — or\n';
+                        '          (#4719) — that made this wall depend on how the process was launched.\n' +
+                        '          NOTE: this runtime is closed-source and is NOT on the public npm registry —\n' +
+                        '          it is distributed with an enterprise / cloud subscription. Without one this\n' +
+                        '          bullet is not followable, and one of the two below is your path — or\n';
                   console.error(
                     chalk.red(
                       `\n  ✖ FATAL: tenancy posture '${tenancyPosture}' was requested but ` +

packages/cli/src/utils/console.ts

@@ -14,7 +14,9 @@
  *   1. `@objectstack/console` — the framework-vendored, version-locked
  *      build. Shipped as a dist-only npm package frozen at the objectui
  *      SHA recorded in `<framework>/.objectui-sha`. This is what a
- *      fresh `pnpm add @objectstack/framework` install gets. Cloud /
+ *      fresh `@objectstack/cli` install gets: the CLI declares this
+ *      package as a dependency and both ship at one version from the
+ *      Changesets `fixed` group, so no app installs it by hand. Cloud /
  *      objectos Docker builds overlay their own `cloud/.objectui-sha`
  *      build into this package's `dist/` so the same package name
  *      always wins regardless of who built the image.

packages/cli/test/capability-preflight.test.ts

@@ -5,7 +5,10 @@ import {
   missingProviderMessage,
   makeProviderResolver,
 } from '../src/utils/capability-preflight.js';
-import { classifyRequiredCapability } from '@objectstack/spec/kernel';
+import {
+  classifyRequiredCapability,
+  PLATFORM_CAPABILITY_PROVIDERS,
+} from '@objectstack/spec/kernel';
 
 // framework#3366 — the CLI-side resolution + message layer over the spec-owned
 // classifier. Resolution is injected so the classification is deterministic.
@@ -69,10 +72,20 @@ describe('renderCapabilityMessage (#3366)', () => {
     expect(m).toContain('pnpm add @objectstack/service-automation');
   });
 
-  it('enterprise provider hint points at plugins[] wiring', () => {
+  it('enterprise provider hint names plugins[] wiring AND carries the edition boundary', () => {
     const m = msgFor('hierarchy-security', () => false);
     expect(m).toContain('pnpm add @objectstack/security-enterprise');
     expect(m).toContain('plugins[]');
+    // #10921 — this `pnpm add` names a package this repo does not build and that
+    // is not publicly resolvable; it is followable only by a licensee. What keeps
+    // it from reading as an ordinary open-edition install is the roster's edition
+    // note, so assert the message carries that note VERBATIM instead of a literal
+    // copied into this file — the note is spec-owned, and a copy here would let
+    // the two drift apart with both still green. Strip the note from the roster
+    // entry, or stop interpolating it, and this fails.
+    const note = PLATFORM_CAPABILITY_PROVIDERS['hierarchy-security'].note;
+    expect(note, 'the enterprise roster entry must carry an edition note').toBeTruthy();
+    expect(m).toContain(note!);
   });
 
   it('unknown token reads as a typo hint', () => {

packages/console/README.md

@@ -1,28 +1,32 @@
 # @objectstack/console
 
-**Prebuilt Console SPA, version-locked to `@objectstack/framework`.**
+**Prebuilt Console SPA, version-locked to the framework release that ships it.**
 
 This package contains nothing but a prebuilt `dist/` directory: the static
 assets of the ObjectStack runtime Console, baked at the commit of
 [`objectstack-ai/objectui`](https://github.com/objectstack-ai/objectui)
 recorded in [`.objectui-sha`](../../.objectui-sha) of this framework release.
 
-It exists so that a single
+You never install it directly. `@objectstack/cli` declares it as a
+dependency, and both ship at the same version from the Changesets `fixed`
+group (see [`.changeset/config.json`](../../.changeset/config.json)), so
+scaffolding an app
 
 ```sh
-pnpm add @objectstack/framework
+npx create-objectstack
 ```
 
-always pulls in a Console build matched to the framework version — no
-second npm dependency to keep in sync.
+— or adding `@objectstack/cli` to an existing one — always pulls in a Console
+build matched to the framework version, with no second npm dependency to keep
+in sync.
 
 ## Relationship to `@object-ui/console`
 
 | | `@object-ui/console` | `@objectstack/console` |
 |---|---|---|
 | Repo | [`objectstack-ai/objectui`](https://github.com/objectstack-ai/objectui) | [`objectstack-ai/objectstack`](https://github.com/objectstack-ai/objectstack) |
 | Role | Standalone Console SPA on its own release cadence | Prebuilt SPA frozen at the SHA this framework release was tested against |
-| Use | Cloud overlays, advanced users, anyone consuming Console directly | Default install for `@objectstack/framework` consumers |
+| Use | Cloud overlays, advanced users, anyone consuming Console directly | What every `@objectstack/cli` install gets by default |
 
 The framework CLI's `resolveConsolePath()` (in
 `packages/cli/src/utils/console.ts`) prefers `@objectstack/console` and