fix: register ObjectQLSecurityPlugin as 'security' service, not 'auth'

[Copilot]

ObjectQLSecurityPlugin was claiming the 'auth' service slot, which belongs to @objectstack/plugin-auth. Loading both plugins causes [Kernel] Service 'auth' already registered and a fatal exit.

Root cause: Conflation of authentication (plugin-auth) and authorization (plugin-security) under the same service name.

Changes:

• plugin-security/src/plugin.ts — registerService('auth', ...) → registerService('security', ...)
• plugin-security/__tests__/plugin.test.ts — Updated assertion to match new service name
• ROADMAP.md — Clarified service registration in package matrix

No consumers were looking up the 'auth' service expecting security plugin capabilities (verified via codebase-wide search).

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
objectql	Ready	Preview, Comment	Mar 20, 2026 5:17am

[Copilot]

Pull request overview

Fixes a kernel service-name collision by ensuring @objectql/plugin-security registers under the correct service key ('security') rather than incorrectly claiming 'auth' (which is reserved for authentication via @objectstack/plugin-auth). This aligns plugin service naming with the codebase’s authn/authz separation and prevents fatal “service already registered” startup failures when both plugins are loaded.

Changes:

• Updated ObjectQLSecurityPlugin to call registerService('security', kernel.security) instead of registerService('auth', ...).
• Updated the plugin unit test to assert the new service name.
• Clarified the service registration behavior in the package matrix in ROADMAP.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
ROADMAP.md	Documents that plugin-security registers as the 'security' service (and that 'auth' is reserved for plugin-auth).
packages/foundation/plugin-security/src/plugin.ts	Changes the service registration key from 'auth' to 'security' during plugin install.
packages/foundation/plugin-security/tests/plugin.test.ts	Updates assertion to match the new service registration name.

[Copilot]

String quotes are inconsistent here: this logger call uses double quotes while the rest of the file predominantly uses single quotes. For consistency (and to satisfy typical lint rules), switch this string literal to single quotes.

Suggested change

	this.logger.info("Registered 'security' service alias");
	this.logger.info('Registered \'security\' service alias');