@objectstack/platform-objects 12.6.0 → 14.3.0

package/dist/apps/index.d.mts

@@ -42,7 +42,7 @@ declare const SETUP_APP: App;
  * that owns the underlying objects rather than living here (ADR-0029 K2):
  *   - `group_integrations` → `@objectstack/plugin-webhooks` (K2.a)
  *   - `group_approvals`     → `@objectstack/plugin-approvals` (K2.b)
- *   - `group_access_control` Roles / Permission Sets → `@objectstack/plugin-security`
+ *   - `group_access_control` Positions / Permission Sets → `@objectstack/plugin-security`
  *   - `group_access_control` Sharing Rules / Record Shares → `@objectstack/plugin-sharing`
  * As each remaining domain moves to its capability plugin, its entries move out
  * of this file into that plugin the same way.

package/dist/apps/index.d.ts

@@ -42,7 +42,7 @@ declare const SETUP_APP: App;
  * that owns the underlying objects rather than living here (ADR-0029 K2):
  *   - `group_integrations` → `@objectstack/plugin-webhooks` (K2.a)
  *   - `group_approvals`     → `@objectstack/plugin-approvals` (K2.b)
- *   - `group_access_control` Roles / Permission Sets → `@objectstack/plugin-security`
+ *   - `group_access_control` Positions / Permission Sets → `@objectstack/plugin-security`
  *   - `group_access_control` Sharing Rules / Record Shares → `@objectstack/plugin-sharing`
  * As each remaining domain moves to its capability plugin, its entries move out
  * of this file into that plugin the same way.

package/dist/apps/index.js

@@ -127,21 +127,33 @@ var SETUP_NAV_CONTRIBUTIONS = [
     priority: BASE_PRIORITY,
     items: [
       { id: "nav_users", type: "object", label: "Users", objectName: "sys_user", icon: "user" },
+      // The ACTIVE organization's record page (Members / Invitations / Teams
+      // tabs with the better-auth row actions), rendered inside the app shell
+      // (ADR-0081). `{current_org_id}` resolves from the session's active
+      // organization; unresolved (e.g. org-less admin before bootstrap) it
+      // falls back to the sys_organization list — one row in single-org.
+      { id: "nav_organization", type: "object", label: "Organization", objectName: "sys_organization", recordId: "{current_org_id}", icon: "building-2" },
       { id: "nav_business_units", type: "object", label: "Business Units", objectName: "sys_business_unit", icon: "building", requiresObject: "sys_business_unit" },
-      { id: "nav_teams", type: "object", label: "Teams", objectName: "sys_team", icon: "users-round", requiresService: "org-scoping" },
+      // Teams / Invitations no longer gate on `org-scoping` (ADR-0081 D1):
+      // the better-auth organization capability is always mounted, and
+      // plugin-auth's single-org default-org bootstrap guarantees an org to
+      // invite into — these are the OPEN member-management basics. Only the
+      // org LIST below keeps the gate: browsing organizations is meaningful
+      // only when more than one can exist (enterprise multi-org).
+      { id: "nav_teams", type: "object", label: "Teams", objectName: "sys_team", icon: "users-round" },
       { id: "nav_organizations", type: "object", label: "Organizations", objectName: "sys_organization", icon: "building-2", requiresService: "org-scoping" },
-      { id: "nav_invitations", type: "object", label: "Invitations", objectName: "sys_invitation", icon: "mail", requiresService: "org-scoping" }
+      { id: "nav_invitations", type: "object", label: "Invitations", objectName: "sys_invitation", icon: "mail" }
     ]
   },
   {
     app: "setup",
     group: "group_access_control",
-    // Priority 300 keeps API Keys after plugin-security's Roles / Permission
+    // Priority 300 keeps API Keys after plugin-security's Positions / Permission
     // Sets (100) and plugin-sharing's Sharing Rules / Record Shares (200),
     // preserving the original menu order.
     priority: 300,
     items: [
-      // Roles / Permission Sets are contributed by @objectstack/plugin-security
+      // Positions / Permission Sets are contributed by @objectstack/plugin-security
       // and Sharing Rules / Record Shares by @objectstack/plugin-sharing
       // (ADR-0029 K2). Only API Keys (sys_api_key, an identity object owned by
       // plugin-auth) remains a platform-objects base entry here.
@@ -192,7 +204,11 @@ var SETUP_NAV_CONTRIBUTIONS = [
     priority: BASE_PRIORITY,
     items: [
       { id: "nav_oauth_apps", type: "object", label: "OAuth Applications", objectName: "sys_oauth_application", icon: "app-window" },
-      { id: "nav_jwks", type: "object", label: "Signing Keys (JWKS)", objectName: "sys_jwks", icon: "key-round" },
+      // nav_jwks is capability-gated (like nav_api_keys): sys_jwks is
+      // `access.default:'private'` (ADR-0066 ④ — signing keys), so a
+      // non-admin's list request 403s server-side; gating the nav item keeps
+      // the menu honest instead of showing an entry that can only error.
+      { id: "nav_jwks", type: "object", label: "Signing Keys (JWKS)", objectName: "sys_jwks", icon: "key-round", requiredPermissions: ["manage_platform_settings"] },
       // `sys_verification` (email/phone tokens) and `sys_device_code` (OAuth
       // device-grant codes) deliberately omit `list` from their `apiMethods`
       // (sensitive, ephemeral secrets — not browsable), so an object/list-view
@@ -1531,8 +1547,8 @@ var enObjects = {
       user_id: {
         label: "User"
       },
-      role_in_business_unit: {
-        label: "Role in Business Unit",
+      function_in_business_unit: {
+        label: "Function in Business Unit",
         help: "`lead` is the day-to-day head; `deputy` may stand in for the lead in approval routing.",
         options: {
           member: "member",
@@ -3484,12 +3500,13 @@ var en = {
         nav_marketplace_installed: { label: "Installed Apps" },
         // People & Organization
         nav_users: { label: "Users" },
+        nav_organization: { label: "Organization" },
         nav_business_units: { label: "Business Units" },
         nav_teams: { label: "Teams" },
         nav_organizations: { label: "Organizations" },
         nav_invitations: { label: "Invitations" },
         // Access Control
-        nav_roles: { label: "Roles" },
+        nav_positions: { label: "Positions" },
         nav_permission_sets: { label: "Permission Sets" },
         nav_sharing_rules: { label: "Sharing Rules" },
         nav_record_shares: { label: "Record Shares" },
@@ -4277,8 +4294,8 @@ var zhCNObjects = {
       user_id: {
         label: "\u7528\u6237"
       },
-      role_in_business_unit: {
-        label: "\u4E1A\u52A1\u5355\u5143\u5185\u89D2\u8272",
+      function_in_business_unit: {
+        label: "\u4E1A\u52A1\u5355\u5143\u5185\u804C\u80FD",
         help: "`lead` \u8868\u793A\u65E5\u5E38\u8D1F\u8D23\u4EBA\uFF1B`deputy` \u53EF\u5728\u5BA1\u6279\u8DEF\u7531\u4E2D\u4EE3\u66FF\u8D1F\u8D23\u4EBA\u3002",
         options: {
           member: "\u6210\u5458",
@@ -6227,16 +6244,18 @@ var zhCN = {
         group_advanced: { label: "\u9AD8\u7EA7" },
         nav_system_overview: { label: "\u7CFB\u7EDF\u6982\u89C8" },
         nav_users: { label: "\u7528\u6237" },
+        nav_organization: { label: "\u7EC4\u7EC7" },
         nav_business_units: { label: "\u4E1A\u52A1\u5355\u5143" },
         nav_teams: { label: "\u56E2\u961F" },
         nav_organizations: { label: "\u7EC4\u7EC7" },
         nav_invitations: { label: "\u9080\u8BF7" },
-        nav_roles: { label: "\u89D2\u8272" },
+        nav_positions: { label: "\u5C97\u4F4D" },
         nav_capabilities: { label: "\u80FD\u529B" },
         nav_permission_sets: { label: "\u6743\u9650\u96C6" },
         nav_sharing_rules: { label: "\u5171\u4EAB\u89C4\u5219" },
         nav_record_shares: { label: "\u8BB0\u5F55\u5171\u4EAB" },
         nav_api_keys: { label: "API \u5BC6\u94A5" },
+        nav_connect_agent: { label: "\u8FDE\u63A5\u667A\u80FD\u4F53" },
         nav_approval_processes: { label: "\u5BA1\u6279\u6D41\u7A0B" },
         nav_approval_requests: { label: "\u5BA1\u6279\u7533\u8BF7" },
         nav_approval_actions: { label: "\u5BA1\u6279\u5386\u53F2" },
@@ -6986,8 +7005,8 @@ var jaJPObjects = {
       user_id: {
         label: "\u30E6\u30FC\u30B6\u30FC"
       },
-      role_in_business_unit: {
-        label: "\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8\u5185\u30ED\u30FC\u30EB",
+      function_in_business_unit: {
+        label: "\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8\u5185\u306E\u8077\u80FD",
         help: "`lead` \u306F\u65E5\u5E38\u306E\u8CAC\u4EFB\u8005\u3001`deputy` \u306F\u627F\u8A8D\u30EB\u30FC\u30C6\u30A3\u30F3\u30B0\u3067\u30EA\u30FC\u30C9\u306E\u4EE3\u7406\u3092\u52D9\u3081\u308B\u5834\u5408\u304C\u3042\u308A\u307E\u3059\u3002",
         options: {
           member: "\u30E1\u30F3\u30D0\u30FC",
@@ -8935,11 +8954,12 @@ var jaJP = {
         group_advanced: { label: "\u8A73\u7D30" },
         nav_system_overview: { label: "\u30B7\u30B9\u30C6\u30E0\u6982\u8981" },
         nav_users: { label: "\u30E6\u30FC\u30B6\u30FC" },
+        nav_organization: { label: "\u7D44\u7E54" },
         nav_business_units: { label: "\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8" },
         nav_teams: { label: "\u30C1\u30FC\u30E0" },
         nav_organizations: { label: "\u7D44\u7E54" },
         nav_invitations: { label: "\u62DB\u5F85" },
-        nav_roles: { label: "\u30ED\u30FC\u30EB" },
+        nav_positions: { label: "\u30DD\u30B8\u30B7\u30E7\u30F3" },
         nav_permission_sets: { label: "\u6A29\u9650\u30BB\u30C3\u30C8" },
         nav_sharing_rules: { label: "\u5171\u6709\u30EB\u30FC\u30EB" },
         nav_record_shares: { label: "\u30EC\u30B3\u30FC\u30C9\u5171\u6709" },
@@ -9692,8 +9712,8 @@ var esESObjects = {
       user_id: {
         label: "Usuario"
       },
-      role_in_business_unit: {
-        label: "Rol en el departamento",
+      function_in_business_unit: {
+        label: "Funci\xF3n en la unidad de negocio",
         help: "`lead` es el responsable del d\xEDa a d\xEDa; `deputy` puede sustituir al responsable en el enrutamiento de aprobaciones.",
         options: {
           member: "Miembro",
@@ -11641,11 +11661,12 @@ var esES = {
         group_advanced: { label: "Avanzado" },
         nav_system_overview: { label: "Resumen del Sistema" },
         nav_users: { label: "Usuarios" },
+        nav_organization: { label: "Organizaci\xF3n" },
         nav_business_units: { label: "Unidades de negocio" },
         nav_teams: { label: "Equipos" },
         nav_organizations: { label: "Organizaciones" },
         nav_invitations: { label: "Invitaciones" },
-        nav_roles: { label: "Roles" },
+        nav_positions: { label: "Posiciones" },
         nav_permission_sets: { label: "Conjuntos de Permisos" },
         nav_sharing_rules: { label: "Reglas de Compartici\xF3n" },
         nav_record_shares: { label: "Registros Compartidos" },