@objectstack/platform-objects 5.1.0 → 6.0.0

package/dist/index.mjs

@@ -3266,6 +3266,20 @@ var defaultPermissionSets = [
         operation: "select",
         using: "id = current_user.id"
       },
+      // Org collaborators: members can see other users in the same
+      // organization. Without this, owner/assignee lookups, @-mention
+      // suggestions, reviewer pickers and team-roster surfaces all
+      // collapse to just the current user. `org_user_ids` is
+      // pre-resolved by runtime/resolve-execution-context from
+      // `sys_member` for the active organization. Sensitive credential
+      // tables (`sys_account`, `sys_session`, `sys_api_key`, …) keep
+      // their stricter self-only carve-outs above.
+      {
+        name: "sys_user_org_members",
+        object: "sys_user",
+        operation: "select",
+        using: "id IN (current_user.org_user_ids)"
+      },
       {
         name: "sys_session_self",
         object: "sys_session",
@@ -3363,8 +3377,14 @@ var defaultPermissionSets = [
         operation: "select",
         using: "id = current_user.id"
       },
-      // ── Per-user visibility on better-auth tables that lack
-      //    `organization_id` (matches the `member_default` carve-outs).
+      // Org collaborators (read-only): see `sys_user_org_members` in
+      // `member_default` for rationale.
+      {
+        name: "sys_user_org_members",
+        object: "sys_user",
+        operation: "select",
+        using: "id IN (current_user.org_user_ids)"
+      },
       {
         name: "sys_session_self",
         object: "sys_session",
@@ -3808,12 +3828,12 @@ var SysActivity = ObjectSchema.create({
       group: "Target"
     }),
     // ── Context ──────────────────────────────────────────────────
-    project_id: Field.lookup("sys_project", {
-      label: "Project",
+    environment_id: Field.lookup("sys_environment", {
+      label: "Environment",
       required: false,
       readonly: true,
       searchable: true,
-      description: "Project context (multi-project deployments)",
+      description: "Environment context (multi-environment deployments)",
       group: "Context"
     }),
     metadata: Field.textarea({
@@ -3829,7 +3849,7 @@ var SysActivity = ObjectSchema.create({
     { fields: ["actor_id"] },
     { fields: ["object_name", "record_id"] },
     { fields: ["type"] },
-    { fields: ["project_id"] }
+    { fields: ["environment_id"] }
   ],
   enable: {
     trackHistory: false,
@@ -4091,13 +4111,56 @@ var SysNotification = ObjectSchema.create({
   displayNameField: "title",
   titleFormat: "{title}",
   compactLayout: ["title", "type", "is_read", "created_at"],
+  /**
+   * Row-level inbox actions. Use `visible` CEL expressions to ensure
+   * `mark_read` only shows on unread rows and vice-versa, mirroring the
+   * mark-as-read affordances in GitHub / Linear inboxes. The toolbar-level
+   * `mark_all_read` is intentionally omitted server-side: it requires a
+   * bulk update primitive that doesn't yet exist on the REST surface, and
+   * the popover already handles the multi-row case client-side via N
+   * single-row PATCHes (see `InboxPopover.tsx` -> AppHeader `markAllRead`).
+   */
+  actions: [
+    {
+      name: "mark_read",
+      label: "Mark as Read",
+      icon: "check",
+      variant: "secondary",
+      mode: "custom",
+      locations: ["list_item"],
+      type: "api",
+      method: "PATCH",
+      target: "/api/v1/data/sys_notification/{id}",
+      bodyExtra: { is_read: true },
+      visible: "!record.is_read",
+      successMessage: "Notification marked as read",
+      refreshAfter: true
+    },
+    {
+      name: "mark_unread",
+      label: "Mark as Unread",
+      icon: "bell-dot",
+      variant: "secondary",
+      mode: "custom",
+      locations: ["list_item"],
+      type: "api",
+      method: "PATCH",
+      target: "/api/v1/data/sys_notification/{id}",
+      bodyExtra: { is_read: false, read_at: null },
+      visible: "record.is_read",
+      successMessage: "Notification marked as unread",
+      refreshAfter: true
+    }
+  ],
   listViews: {
     unread: {
       type: "grid",
       name: "unread",
       label: "Unread",
       data: { provider: "object", object: "sys_notification" },
-      columns: ["type", "title", "recipient_id", "created_at"],
+      // Title + actor first (the "who/what" the user actually scans);
+      // type stays as a categorising chip; created_at right-aligned.
+      columns: ["title", "actor_name", "type", "created_at"],
       filter: [
         { field: "recipient_id", operator: "equals", value: "{current_user_id}" },
         { field: "is_read", operator: "equals", value: false }
@@ -4111,17 +4174,21 @@ var SysNotification = ObjectSchema.create({
       name: "mine",
       label: "Mine",
       data: { provider: "object", object: "sys_notification" },
-      columns: ["type", "title", "is_read", "created_at"],
+      columns: ["title", "actor_name", "type", "is_read", "created_at"],
       filter: [{ field: "recipient_id", operator: "equals", value: "{current_user_id}" }],
       sort: [{ field: "created_at", order: "desc" }],
-      pagination: { pageSize: 50 }
+      pagination: { pageSize: 50 },
+      // Group by notification category so mention/assignment storms don't
+      // hide system or task_due rows. Users still toggle to flat via the
+      // toolbar Group control if they prefer chronology only.
+      grouping: { fields: [{ field: "type", order: "asc", collapsed: false }] }
     },
     all_notifications: {
       type: "grid",
       name: "all_notifications",
       label: "All",
       data: { provider: "object", object: "sys_notification" },
-      columns: ["type", "title", "recipient_id", "is_read", "created_at"],
+      columns: ["title", "recipient_id", "actor_name", "type", "is_read", "created_at"],
       sort: [{ field: "created_at", order: "desc" }],
       pagination: { pageSize: 100 }
     }
@@ -4974,6 +5041,14 @@ var SysApprovalRequest = ObjectSchema.create({
       description: "Record snapshot at submission time",
       group: "State"
     }),
+    process_hash: Field.text({
+      label: "Process Hash",
+      required: false,
+      maxLength: 80,
+      readonly: true,
+      description: "sha256 of the approval process body at submit time (ADR-0009 execution pinning). Resolved through sys_metadata_history so process upgrades do not affect in-flight requests.",
+      group: "State"
+    }),
     completed_at: Field.datetime({
       label: "Completed At",
       required: false,
@@ -5562,12 +5637,12 @@ var SysMetadataObject = ObjectSchema.create({
     }),
     /**
      * @deprecated ADR-0005 (revised 2026-05): per-env DBs replace per-project
-     * isolation. `project_id` is no longer written by saveMetaItem and not
+     * isolation. `environment_id` is no longer written by saveMetaItem and not
      * consulted by overlay reads. Kept for legacy rows; new writes leave it
      * NULL. Will be dropped in a future schema migration.
      */
-    project_id: Field.lookup("sys_project", {
-      label: "Project (deprecated)",
+    environment_id: Field.lookup("sys_environment", {
+      label: "Environment (deprecated)",
       required: false,
       description: "DEPRECATED. Use organization_id for tenant isolation."
     }),
@@ -5617,7 +5692,7 @@ var SysMetadataObject = ObjectSchema.create({
   indexes: [
     // ADR-0005 (revised 2026-05): overlay uniqueness is scoped by
     // (type, name, organization_id), restricted to active rows so resets
-    // / archived versions don't collide. project_id is deprecated and
+    // / archived versions don't collide. environment_id is deprecated and
     // not part of the discriminator. The runtime layer (protocol.ts
     // ensureOverlayIndex) issues a DROP-then-CREATE migration to
     // replace any pre-existing legacy composite index in-place.
@@ -6260,6 +6335,28 @@ var SETUP_APP = {
         { id: "nav_notifications", type: "object", label: "Notifications", objectName: "sys_notification", icon: "bell", requiresObject: "sys_notification" }
       ]
     },
+    {
+      id: "group_integrations",
+      type: "group",
+      label: "Integrations",
+      icon: "plug",
+      children: [
+        // Outbound HTTP integrations. `sys_webhook` always ships with
+        // platform-objects, so the Webhooks entry is always visible.
+        // `sys_webhook_delivery` is the durable outbox row from
+        // `@objectstack/plugin-webhooks/schema` — gated on `requiresObject`
+        // so the Deliveries entry only renders when the plugin has been
+        // wired into `defineStack({ objects: [SysWebhookDelivery, ...] })`.
+        //
+        // This is the canonical demonstration of "everything is an object":
+        // managing webhooks (configuration) and inspecting deliveries
+        // (operational telemetry) reuses the same generic ObjectView /
+        // ObjectListView UI as any business object — no bespoke webhook
+        // admin page.
+        { id: "nav_webhooks", type: "object", label: "Webhooks", objectName: "sys_webhook", icon: "webhook", requiresObject: "sys_webhook" },
+        { id: "nav_webhook_deliveries", type: "object", label: "Webhook Deliveries", objectName: "sys_webhook_delivery", icon: "send", requiresObject: "sys_webhook_delivery" }
+      ]
+    },
     {
       id: "group_advanced",
       type: "group",
@@ -6283,7 +6380,7 @@ var SETUP_APP = {
         //  - The marketplace-only `sys_app` / `sys_package` /
         //    `sys_package_installation` menus have been removed entirely;
         //    they are contributed by `@objectstack/service-tenant`
-        //    (control-plane) and are not present in single-project runtimes.
+        //    (control-plane) and are not present in single-environment runtimes.
         { id: "nav_oauth_apps", type: "object", label: "OAuth Applications", objectName: "sys_oauth_application", icon: "app-window" },
         { id: "nav_jwks", type: "object", label: "Signing Keys (JWKS)", objectName: "sys_jwks", icon: "key-round" },
         { id: "nav_verifications", type: "object", label: "Verifications", objectName: "sys_verification", icon: "mail-check" },
@@ -6362,7 +6459,7 @@ var SystemOverviewDashboard = Dashboard.create({
       type: "metric",
       object: "sys_package_installation",
       // Cloud-only object — only registered when service-tenant is loaded.
-      // Hide this widget gracefully in single-project runtimes.
+      // Hide this widget gracefully in single-environment runtimes.
       requiresObject: "sys_package_installation",
       layout: {
         x: 9,
@@ -8214,9 +8311,9 @@ var enObjects = {
         label: "URL",
         help: "Optional deep-link to the activity target"
       },
-      project_id: {
+      environment_id: {
         label: "Project",
-        help: "Project context (multi-project deployments)"
+        help: "Environment context (multi-environment deployments)"
       },
       metadata: {
         label: "Metadata",
@@ -9209,7 +9306,7 @@ var enObjects = {
         label: "Organization",
         help: "Organization for multi-tenant isolation."
       },
-      project_id: {
+      environment_id: {
         label: "Project (deprecated)",
         help: "DEPRECATED. Use organization_id for tenant isolation."
       },
@@ -9291,7 +9388,7 @@ var enObjects = {
         label: "Organization",
         help: "Organization for multi-tenant isolation."
       },
-      project_id: {
+      environment_id: {
         label: "Environment ID",
         help: "Scopes this history entry to a specific environment."
       },
@@ -11249,7 +11346,7 @@ var zhCNObjects = {
         label: "URL",
         help: "\u6307\u5411\u6D3B\u52A8\u76EE\u6807\u7684\u53EF\u9009\u6DF1\u5EA6\u94FE\u63A5"
       },
-      project_id: {
+      environment_id: {
         label: "\u9879\u76EE",
         help: "\u9879\u76EE\u4E0A\u4E0B\u6587\uFF08\u591A\u9879\u76EE\u90E8\u7F72\uFF09"
       },
@@ -12248,7 +12345,7 @@ var zhCNObjects = {
         label: "\u7EC4\u7EC7",
         help: "\u7528\u4E8E\u591A\u79DF\u6237\u9694\u79BB\u7684\u7EC4\u7EC7\u3002"
       },
-      project_id: {
+      environment_id: {
         label: "\u9879\u76EE\uFF08\u5DF2\u5E9F\u5F03\uFF09",
         help: "\u5DF2\u5E9F\u5F03\u3002\u8BF7\u4F7F\u7528 organization_id \u8FDB\u884C\u79DF\u6237\u9694\u79BB\u3002"
       },
@@ -12330,7 +12427,7 @@ var zhCNObjects = {
         label: "\u7EC4\u7EC7",
         help: "\u7528\u4E8E\u591A\u79DF\u6237\u9694\u79BB\u7684\u7EC4\u7EC7\u3002"
       },
-      project_id: {
+      environment_id: {
         label: "\u73AF\u5883 ID",
         help: "\u5C06\u8BE5\u5386\u53F2\u8BB0\u5F55\u9650\u5B9A\u5230\u7279\u5B9A\u73AF\u5883\u3002"
       },
@@ -14238,7 +14335,7 @@ var jaJPObjects = {
         label: "URL",
         help: "\u30A2\u30AF\u30C6\u30A3\u30D3\u30C6\u30A3\u30BF\u30FC\u30B2\u30C3\u30C8\u3078\u306E\u30AA\u30D7\u30B7\u30E7\u30F3\u306E\u30C7\u30A3\u30FC\u30D7\u30EA\u30F3\u30AF"
       },
-      project_id: {
+      environment_id: {
         label: "\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8",
         help: "\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\uFF08\u30DE\u30EB\u30C1\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u30C7\u30D7\u30ED\u30A4\u30E1\u30F3\u30C8\uFF09"
       },
@@ -15233,7 +15330,7 @@ var jaJPObjects = {
         label: "\u7D44\u7E54",
         help: "\u30DE\u30EB\u30C1\u30C6\u30CA\u30F3\u30C8\u5206\u96E2\u306E\u305F\u3081\u306E\u7D44\u7E54\u3002"
       },
-      project_id: {
+      environment_id: {
         label: "\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\uFF08\u975E\u63A8\u5968\uFF09",
         help: "\u975E\u63A8\u5968\u3002\u30C6\u30CA\u30F3\u30C8\u5206\u96E2\u306B\u306F organization_id \u3092\u4F7F\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
       },
@@ -15315,7 +15412,7 @@ var jaJPObjects = {
         label: "\u7D44\u7E54",
         help: "\u30DE\u30EB\u30C1\u30C6\u30CA\u30F3\u30C8\u5206\u96E2\u306E\u305F\u3081\u306E\u7D44\u7E54\u3002"
       },
-      project_id: {
+      environment_id: {
         label: "\u74B0\u5883 ID",
         help: "\u3053\u306E\u5C65\u6B74\u30A8\u30F3\u30C8\u30EA\u3092\u7279\u5B9A\u306E\u74B0\u5883\u306B\u30B9\u30B3\u30FC\u30D7\u3057\u307E\u3059\u3002"
       },
@@ -17223,7 +17320,7 @@ var esESObjects = {
         label: "URL",
         help: "Enlace profundo opcional al destino de la actividad."
       },
-      project_id: {
+      environment_id: {
         label: "Proyecto",
         help: "Contexto del proyecto (implementaciones multiproyecto)."
       },
@@ -18218,7 +18315,7 @@ var esESObjects = {
         label: "Organizaci\xF3n",
         help: "Organizaci\xF3n para el aislamiento multi-tenant."
       },
-      project_id: {
+      environment_id: {
         label: "Proyecto (obsoleto)",
         help: "OBSOLETO. Use organization_id para el aislamiento del tenant."
       },
@@ -18300,7 +18397,7 @@ var esESObjects = {
         label: "Organizaci\xF3n",
         help: "Organizaci\xF3n para el aislamiento multi-tenant."
       },
-      project_id: {
+      environment_id: {
         label: "ID del entorno",
         help: "Limita esta entrada de historial a un entorno espec\xEDfico."
       },