@objectstack/metadata 9.1.0 → 9.3.0

package/dist/index.d.cts

@@ -571,6 +571,20 @@ interface MetadataPluginOptions {
      * business-data namespaces.
      */
     registerSystemObjects?: boolean;
+    /**
+     * Owning package id for source-file metadata loaded by the filesystem
+     * scanner (`watch`/eager mode) — the project's `defineStack({ manifest:
+     * { id } })` id. When set, scanned items are stamped with
+     * `_packageId`/`_provenance: 'package'` via `applyProtection`, exactly
+     * like the artifact path, so GET /meta consumers can tell code-defined
+     * metadata from user-authored rows.
+     *
+     * Leave unset when the host has no package identity — items then stay
+     * unstamped (runtime-authored semantics). Do NOT pass a guessed value:
+     * `_packageId` feeds `isArtifactBacked()` write authorization, so a
+     * wrong id silently changes who may edit these items.
+     */
+    packageId?: string;
 }
 declare class MetadataPlugin implements Plugin {
     name: string;

package/dist/index.d.ts

@@ -571,6 +571,20 @@ interface MetadataPluginOptions {
      * business-data namespaces.
      */
     registerSystemObjects?: boolean;
+    /**
+     * Owning package id for source-file metadata loaded by the filesystem
+     * scanner (`watch`/eager mode) — the project's `defineStack({ manifest:
+     * { id } })` id. When set, scanned items are stamped with
+     * `_packageId`/`_provenance: 'package'` via `applyProtection`, exactly
+     * like the artifact path, so GET /meta consumers can tell code-defined
+     * metadata from user-authored rows.
+     *
+     * Leave unset when the host has no package identity — items then stay
+     * unstamped (runtime-authored semantics). Do NOT pass a guessed value:
+     * `_packageId` feeds `isArtifactBacked()` write authorization, so a
+     * wrong id silently changes who may edit these items.
+     */
+    packageId?: string;
 }
 declare class MetadataPlugin implements Plugin {
     name: string;

package/dist/index.js

@@ -3569,6 +3569,9 @@ var MetadataPlugin = class {
           for (const item of items) {
             const meta = item;
             if (meta?.name) {
+              applyProtection(meta, {
+                packageId: this.options.packageId
+              });
               await this.manager.register(entry.type, meta.name, item);
             }
           }