@objectstack/platform-objects 7.1.0 → 7.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/apps/index.d.mts +12 -0
- package/dist/apps/index.d.ts +12 -0
- package/dist/apps/index.js +48 -16
- package/dist/apps/index.js.map +1 -1
- package/dist/apps/index.mjs +48 -16
- package/dist/apps/index.mjs.map +1 -1
- package/dist/audit/index.d.mts +240 -48
- package/dist/audit/index.d.ts +240 -48
- package/dist/identity/index.d.mts +386 -61
- package/dist/identity/index.d.ts +386 -61
- package/dist/identity/index.js +135 -1
- package/dist/identity/index.js.map +1 -1
- package/dist/identity/index.mjs +135 -1
- package/dist/identity/index.mjs.map +1 -1
- package/dist/index.d.mts +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.js +327 -17
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +327 -18
- package/dist/index.mjs.map +1 -1
- package/dist/integration/index.d.mts +15 -3
- package/dist/integration/index.d.ts +15 -3
- package/dist/metadata/index.d.mts +3264 -7
- package/dist/metadata/index.d.ts +3264 -7
- package/dist/metadata/index.js +130 -0
- package/dist/metadata/index.js.map +1 -1
- package/dist/metadata/index.mjs +130 -1
- package/dist/metadata/index.mjs.map +1 -1
- package/dist/security/index.d.mts +115 -21
- package/dist/security/index.d.ts +115 -21
- package/dist/security/index.js +14 -0
- package/dist/security/index.js.map +1 -1
- package/dist/security/index.mjs +14 -0
- package/dist/security/index.mjs.map +1 -1
- package/dist/system/index.d.mts +45 -9
- package/dist/system/index.d.ts +45 -9
- package/package.json +2 -2
package/dist/index.mjs
CHANGED
|
@@ -10,6 +10,12 @@ var SysUser = ObjectSchema.create({
|
|
|
10
10
|
icon: "user",
|
|
11
11
|
isSystem: true,
|
|
12
12
|
managedBy: "better-auth",
|
|
13
|
+
// ADR-0010 §3.7 — identity table is managed by better-auth; schema must not drift.
|
|
14
|
+
protection: {
|
|
15
|
+
lock: "full",
|
|
16
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
17
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
18
|
+
},
|
|
13
19
|
description: "User accounts for authentication",
|
|
14
20
|
displayNameField: "name",
|
|
15
21
|
titleFormat: "{name}",
|
|
@@ -422,6 +428,14 @@ var SysSession = ObjectSchema.create({
|
|
|
422
428
|
icon: "key",
|
|
423
429
|
isSystem: true,
|
|
424
430
|
managedBy: "better-auth",
|
|
431
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
432
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
433
|
+
// forbid sys_metadata overlays entirely.
|
|
434
|
+
protection: {
|
|
435
|
+
lock: "full",
|
|
436
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
437
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
438
|
+
},
|
|
425
439
|
description: "Active user sessions",
|
|
426
440
|
displayNameField: "user_id",
|
|
427
441
|
titleFormat: "Session \u2014 {user_id}",
|
|
@@ -577,6 +591,14 @@ var SysAccount = ObjectSchema.create({
|
|
|
577
591
|
icon: "link",
|
|
578
592
|
isSystem: true,
|
|
579
593
|
managedBy: "better-auth",
|
|
594
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
595
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
596
|
+
// forbid sys_metadata overlays entirely.
|
|
597
|
+
protection: {
|
|
598
|
+
lock: "full",
|
|
599
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
600
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
601
|
+
},
|
|
580
602
|
description: "OAuth and authentication provider accounts",
|
|
581
603
|
titleFormat: "{provider_id} - {account_id}",
|
|
582
604
|
compactLayout: ["provider_id", "user_id", "account_id"],
|
|
@@ -601,7 +623,7 @@ var SysAccount = ObjectSchema.create({
|
|
|
601
623
|
mode: "create",
|
|
602
624
|
locations: ["list_toolbar"],
|
|
603
625
|
type: "url",
|
|
604
|
-
target: "/api/v1/auth/sign-in/social?provider=${param.provider}&callbackURL=${ctx.origin}/apps/account/sys_account",
|
|
626
|
+
target: "/api/v1/auth/sign-in/social?provider=${param.provider}&callbackURL=${ctx.origin}/_console/apps/account/sys_account",
|
|
605
627
|
params: [
|
|
606
628
|
{
|
|
607
629
|
name: "provider",
|
|
@@ -750,6 +772,14 @@ var SysVerification = ObjectSchema.create({
|
|
|
750
772
|
icon: "shield-check",
|
|
751
773
|
isSystem: true,
|
|
752
774
|
managedBy: "better-auth",
|
|
775
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
776
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
777
|
+
// forbid sys_metadata overlays entirely.
|
|
778
|
+
protection: {
|
|
779
|
+
lock: "full",
|
|
780
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
781
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
782
|
+
},
|
|
753
783
|
description: "Email and phone verification tokens",
|
|
754
784
|
titleFormat: "Verification for {identifier}",
|
|
755
785
|
compactLayout: ["identifier", "expires_at", "created_at"],
|
|
@@ -805,6 +835,14 @@ var SysOrganization = ObjectSchema.create({
|
|
|
805
835
|
icon: "building-2",
|
|
806
836
|
isSystem: true,
|
|
807
837
|
managedBy: "better-auth",
|
|
838
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
839
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
840
|
+
// forbid sys_metadata overlays entirely.
|
|
841
|
+
protection: {
|
|
842
|
+
lock: "full",
|
|
843
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
844
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
845
|
+
},
|
|
808
846
|
description: "Organizations for multi-tenant grouping",
|
|
809
847
|
displayNameField: "name",
|
|
810
848
|
titleFormat: "{name}",
|
|
@@ -1007,6 +1045,14 @@ var SysMember = ObjectSchema.create({
|
|
|
1007
1045
|
icon: "user-check",
|
|
1008
1046
|
isSystem: true,
|
|
1009
1047
|
managedBy: "better-auth",
|
|
1048
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
1049
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
1050
|
+
// forbid sys_metadata overlays entirely.
|
|
1051
|
+
protection: {
|
|
1052
|
+
lock: "full",
|
|
1053
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
1054
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
1055
|
+
},
|
|
1010
1056
|
description: "Organization membership records",
|
|
1011
1057
|
titleFormat: "{user_id} in {organization_id}",
|
|
1012
1058
|
compactLayout: ["user_id", "organization_id", "role"],
|
|
@@ -1156,6 +1202,14 @@ var SysInvitation = ObjectSchema.create({
|
|
|
1156
1202
|
icon: "mail",
|
|
1157
1203
|
isSystem: true,
|
|
1158
1204
|
managedBy: "better-auth",
|
|
1205
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
1206
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
1207
|
+
// forbid sys_metadata overlays entirely.
|
|
1208
|
+
protection: {
|
|
1209
|
+
lock: "full",
|
|
1210
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
1211
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
1212
|
+
},
|
|
1159
1213
|
description: "Organization invitations for user onboarding",
|
|
1160
1214
|
titleFormat: "Invitation to {organization_id}",
|
|
1161
1215
|
compactLayout: ["email", "organization_id", "status"],
|
|
@@ -1356,6 +1410,14 @@ var SysTeam = ObjectSchema.create({
|
|
|
1356
1410
|
icon: "users",
|
|
1357
1411
|
isSystem: true,
|
|
1358
1412
|
managedBy: "better-auth",
|
|
1413
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
1414
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
1415
|
+
// forbid sys_metadata overlays entirely.
|
|
1416
|
+
protection: {
|
|
1417
|
+
lock: "full",
|
|
1418
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
1419
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
1420
|
+
},
|
|
1359
1421
|
description: "Teams within organizations for fine-grained grouping",
|
|
1360
1422
|
displayNameField: "name",
|
|
1361
1423
|
titleFormat: "{name}",
|
|
@@ -1493,6 +1555,14 @@ var SysTeamMember = ObjectSchema.create({
|
|
|
1493
1555
|
icon: "user-plus",
|
|
1494
1556
|
isSystem: true,
|
|
1495
1557
|
managedBy: "better-auth",
|
|
1558
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
1559
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
1560
|
+
// forbid sys_metadata overlays entirely.
|
|
1561
|
+
protection: {
|
|
1562
|
+
lock: "full",
|
|
1563
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
1564
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
1565
|
+
},
|
|
1496
1566
|
description: "Team membership records linking users to teams",
|
|
1497
1567
|
titleFormat: "{user_id} in {team_id}",
|
|
1498
1568
|
compactLayout: ["user_id", "team_id", "created_at"],
|
|
@@ -1820,6 +1890,14 @@ var SysApiKey = ObjectSchema.create({
|
|
|
1820
1890
|
icon: "key-round",
|
|
1821
1891
|
isSystem: true,
|
|
1822
1892
|
managedBy: "better-auth",
|
|
1893
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
1894
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
1895
|
+
// forbid sys_metadata overlays entirely.
|
|
1896
|
+
protection: {
|
|
1897
|
+
lock: "full",
|
|
1898
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
1899
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
1900
|
+
},
|
|
1823
1901
|
description: "API keys for programmatic access",
|
|
1824
1902
|
displayNameField: "name",
|
|
1825
1903
|
titleFormat: "{name}",
|
|
@@ -2002,6 +2080,14 @@ var SysTwoFactor = ObjectSchema.create({
|
|
|
2002
2080
|
icon: "smartphone",
|
|
2003
2081
|
isSystem: true,
|
|
2004
2082
|
managedBy: "better-auth",
|
|
2083
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
2084
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
2085
|
+
// forbid sys_metadata overlays entirely.
|
|
2086
|
+
protection: {
|
|
2087
|
+
lock: "full",
|
|
2088
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
2089
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
2090
|
+
},
|
|
2005
2091
|
description: "Two-factor authentication credentials",
|
|
2006
2092
|
titleFormat: "Two-factor for {user_id}",
|
|
2007
2093
|
compactLayout: ["user_id", "created_at"],
|
|
@@ -2148,6 +2234,14 @@ var SysDeviceCode = ObjectSchema.create({
|
|
|
2148
2234
|
icon: "key-round",
|
|
2149
2235
|
isSystem: true,
|
|
2150
2236
|
managedBy: "better-auth",
|
|
2237
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
2238
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
2239
|
+
// forbid sys_metadata overlays entirely.
|
|
2240
|
+
protection: {
|
|
2241
|
+
lock: "full",
|
|
2242
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
2243
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
2244
|
+
},
|
|
2151
2245
|
description: "OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests",
|
|
2152
2246
|
titleFormat: "{user_code}",
|
|
2153
2247
|
compactLayout: ["user_code", "status", "client_id", "expires_at"],
|
|
@@ -2327,6 +2421,14 @@ var SysOauthApplication = ObjectSchema.create({
|
|
|
2327
2421
|
icon: "key-round",
|
|
2328
2422
|
isSystem: true,
|
|
2329
2423
|
managedBy: "better-auth",
|
|
2424
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
2425
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
2426
|
+
// forbid sys_metadata overlays entirely.
|
|
2427
|
+
protection: {
|
|
2428
|
+
lock: "full",
|
|
2429
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
2430
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
2431
|
+
},
|
|
2330
2432
|
description: "Registered OAuth/OIDC client applications",
|
|
2331
2433
|
displayNameField: "name",
|
|
2332
2434
|
titleFormat: "{name}",
|
|
@@ -2721,6 +2823,14 @@ var SysOauthAccessToken = ObjectSchema.create({
|
|
|
2721
2823
|
icon: "ticket",
|
|
2722
2824
|
isSystem: true,
|
|
2723
2825
|
managedBy: "better-auth",
|
|
2826
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
2827
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
2828
|
+
// forbid sys_metadata overlays entirely.
|
|
2829
|
+
protection: {
|
|
2830
|
+
lock: "full",
|
|
2831
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
2832
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
2833
|
+
},
|
|
2724
2834
|
description: "Opaque OAuth access tokens issued to client applications",
|
|
2725
2835
|
compactLayout: ["client_id", "user_id", "expires_at"],
|
|
2726
2836
|
fields: {
|
|
@@ -2799,6 +2909,14 @@ var SysOauthRefreshToken = ObjectSchema.create({
|
|
|
2799
2909
|
icon: "refresh-cw",
|
|
2800
2910
|
isSystem: true,
|
|
2801
2911
|
managedBy: "better-auth",
|
|
2912
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
2913
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
2914
|
+
// forbid sys_metadata overlays entirely.
|
|
2915
|
+
protection: {
|
|
2916
|
+
lock: "full",
|
|
2917
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
2918
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
2919
|
+
},
|
|
2802
2920
|
description: "Opaque OAuth refresh tokens (linked to a session)",
|
|
2803
2921
|
compactLayout: ["client_id", "user_id", "expires_at"],
|
|
2804
2922
|
fields: {
|
|
@@ -2881,6 +2999,14 @@ var SysOauthConsent = ObjectSchema.create({
|
|
|
2881
2999
|
icon: "shield-check",
|
|
2882
3000
|
isSystem: true,
|
|
2883
3001
|
managedBy: "better-auth",
|
|
3002
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
3003
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
3004
|
+
// forbid sys_metadata overlays entirely.
|
|
3005
|
+
protection: {
|
|
3006
|
+
lock: "full",
|
|
3007
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
3008
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
3009
|
+
},
|
|
2884
3010
|
description: "User consent records for OAuth client applications",
|
|
2885
3011
|
compactLayout: ["client_id", "user_id", "scopes"],
|
|
2886
3012
|
fields: {
|
|
@@ -2941,6 +3067,14 @@ var SysJwks = ObjectSchema.create({
|
|
|
2941
3067
|
icon: "key",
|
|
2942
3068
|
isSystem: true,
|
|
2943
3069
|
managedBy: "better-auth",
|
|
3070
|
+
// ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
|
|
3071
|
+
// but may add overlay row-level config. Use `no-overlay` if you need to
|
|
3072
|
+
// forbid sys_metadata overlays entirely.
|
|
3073
|
+
protection: {
|
|
3074
|
+
lock: "full",
|
|
3075
|
+
reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
|
|
3076
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
3077
|
+
},
|
|
2944
3078
|
description: "Asymmetric key pairs used to sign and verify issued JWTs",
|
|
2945
3079
|
compactLayout: ["id", "created_at", "expires_at"],
|
|
2946
3080
|
fields: {
|
|
@@ -2988,6 +3122,13 @@ var SysRole = ObjectSchema.create({
|
|
|
2988
3122
|
icon: "shield",
|
|
2989
3123
|
isSystem: true,
|
|
2990
3124
|
managedBy: "config",
|
|
3125
|
+
// ADR-0010 §3.7 — RBAC primitive; tenants may add custom rows
|
|
3126
|
+
// (created via UI / API) but the schema itself is locked.
|
|
3127
|
+
protection: {
|
|
3128
|
+
lock: "no-overlay",
|
|
3129
|
+
reason: "RBAC schema is platform-defined \u2014 see ADR-0010.",
|
|
3130
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
3131
|
+
},
|
|
2991
3132
|
description: "Role definitions for RBAC access control",
|
|
2992
3133
|
displayNameField: "label",
|
|
2993
3134
|
titleFormat: "{label}",
|
|
@@ -3191,6 +3332,13 @@ var SysPermissionSet = ObjectSchema.create({
|
|
|
3191
3332
|
icon: "lock",
|
|
3192
3333
|
isSystem: true,
|
|
3193
3334
|
managedBy: "config",
|
|
3335
|
+
// ADR-0010 §3.7 — RBAC primitive; tenants may add custom rows
|
|
3336
|
+
// (created via UI / API) but the schema itself is locked.
|
|
3337
|
+
protection: {
|
|
3338
|
+
lock: "no-overlay",
|
|
3339
|
+
reason: "RBAC schema is platform-defined \u2014 see ADR-0010.",
|
|
3340
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
3341
|
+
},
|
|
3194
3342
|
description: "Named permission groupings for fine-grained access control",
|
|
3195
3343
|
displayNameField: "label",
|
|
3196
3344
|
titleFormat: "{label}",
|
|
@@ -6922,6 +7070,135 @@ var SysMetadataHistoryObject = ObjectSchema.create({
|
|
|
6922
7070
|
trash: false
|
|
6923
7071
|
}
|
|
6924
7072
|
});
|
|
7073
|
+
var SysMetadataAuditObject = ObjectSchema.create({
|
|
7074
|
+
name: "sys_metadata_audit",
|
|
7075
|
+
label: "Metadata Audit",
|
|
7076
|
+
pluralLabel: "Metadata Audit",
|
|
7077
|
+
icon: "shield-check",
|
|
7078
|
+
isSystem: true,
|
|
7079
|
+
managedBy: "append-only",
|
|
7080
|
+
description: "Append-only audit trail of metadata write decisions (ADR-0010).",
|
|
7081
|
+
fields: {
|
|
7082
|
+
/** Primary Key (UUID) */
|
|
7083
|
+
id: Field.text({
|
|
7084
|
+
label: "ID",
|
|
7085
|
+
required: true,
|
|
7086
|
+
readonly: true
|
|
7087
|
+
}),
|
|
7088
|
+
/** When the decision was made (ISO-8601 UTC). */
|
|
7089
|
+
occurred_at: Field.datetime({
|
|
7090
|
+
label: "Occurred At",
|
|
7091
|
+
required: true,
|
|
7092
|
+
readonly: true
|
|
7093
|
+
}),
|
|
7094
|
+
/** Acting principal (user id, system id, or 'system'). */
|
|
7095
|
+
actor: Field.text({
|
|
7096
|
+
label: "Actor",
|
|
7097
|
+
required: true,
|
|
7098
|
+
readonly: true,
|
|
7099
|
+
maxLength: 255,
|
|
7100
|
+
description: 'Acting principal \u2014 user id, system id, or "system".'
|
|
7101
|
+
}),
|
|
7102
|
+
/** Code path that produced the decision (e.g. `protocol.saveMetaItem`). */
|
|
7103
|
+
source: Field.text({
|
|
7104
|
+
label: "Source",
|
|
7105
|
+
required: false,
|
|
7106
|
+
readonly: true,
|
|
7107
|
+
maxLength: 128
|
|
7108
|
+
}),
|
|
7109
|
+
/** Metadata type (singular, e.g. `app`, `object`, `view`). */
|
|
7110
|
+
type: Field.text({
|
|
7111
|
+
label: "Metadata Type",
|
|
7112
|
+
required: true,
|
|
7113
|
+
readonly: true,
|
|
7114
|
+
searchable: true,
|
|
7115
|
+
maxLength: 100
|
|
7116
|
+
}),
|
|
7117
|
+
/** Item machine name. */
|
|
7118
|
+
name: Field.text({
|
|
7119
|
+
label: "Name",
|
|
7120
|
+
required: true,
|
|
7121
|
+
readonly: true,
|
|
7122
|
+
searchable: true,
|
|
7123
|
+
maxLength: 255
|
|
7124
|
+
}),
|
|
7125
|
+
/** Organization for multi-tenant filtering. NULL for env-wide writes. */
|
|
7126
|
+
organization_id: Field.lookup("sys_organization", {
|
|
7127
|
+
label: "Organization",
|
|
7128
|
+
required: false,
|
|
7129
|
+
readonly: true
|
|
7130
|
+
}),
|
|
7131
|
+
/** Operation kind. */
|
|
7132
|
+
operation: Field.select(["save", "publish", "rollback", "delete", "reset"], {
|
|
7133
|
+
label: "Operation",
|
|
7134
|
+
required: true,
|
|
7135
|
+
readonly: true
|
|
7136
|
+
}),
|
|
7137
|
+
/** Decision outcome — allowed, denied (refused), or forced (bypassed via override). */
|
|
7138
|
+
outcome: Field.select(["allowed", "denied", "forced"], {
|
|
7139
|
+
label: "Outcome",
|
|
7140
|
+
required: true,
|
|
7141
|
+
readonly: true
|
|
7142
|
+
}),
|
|
7143
|
+
/**
|
|
7144
|
+
* Machine-readable code for the decision:
|
|
7145
|
+
* - on `allowed`: `'ok'`
|
|
7146
|
+
* - on `denied`: `'not_overridable'` | `'not_creatable'` |
|
|
7147
|
+
* `'item_locked'` | `'invalid_metadata'` | `'destructive_change'` |
|
|
7148
|
+
* `'metadata_conflict'`
|
|
7149
|
+
* - on `forced`: `'lock_override'` (Phase 3)
|
|
7150
|
+
*/
|
|
7151
|
+
code: Field.text({
|
|
7152
|
+
label: "Code",
|
|
7153
|
+
required: true,
|
|
7154
|
+
readonly: true,
|
|
7155
|
+
maxLength: 64
|
|
7156
|
+
}),
|
|
7157
|
+
/**
|
|
7158
|
+
* Lock state observed at the time of the decision (`none` if the
|
|
7159
|
+
* item carried no `_lock`). Captured even on `allowed` rows so
|
|
7160
|
+
* later compliance queries can see "what was the lock state when
|
|
7161
|
+
* this write succeeded".
|
|
7162
|
+
*/
|
|
7163
|
+
lock_state: Field.select(["none", "no-overlay", "no-delete", "full"], {
|
|
7164
|
+
label: "Lock State",
|
|
7165
|
+
required: false,
|
|
7166
|
+
readonly: true
|
|
7167
|
+
}),
|
|
7168
|
+
/** True when the write succeeded by bypassing a lock (Phase 3). */
|
|
7169
|
+
lock_overridden: Field.boolean({
|
|
7170
|
+
label: "Lock Overridden",
|
|
7171
|
+
required: false,
|
|
7172
|
+
readonly: true
|
|
7173
|
+
}),
|
|
7174
|
+
/** Optional request correlation id for tracing. */
|
|
7175
|
+
request_id: Field.text({
|
|
7176
|
+
label: "Request ID",
|
|
7177
|
+
required: false,
|
|
7178
|
+
readonly: true,
|
|
7179
|
+
maxLength: 128
|
|
7180
|
+
}),
|
|
7181
|
+
/** Optional free-form context (e.g. brief diff summary). */
|
|
7182
|
+
note: Field.textarea({
|
|
7183
|
+
label: "Note",
|
|
7184
|
+
required: false,
|
|
7185
|
+
readonly: true
|
|
7186
|
+
})
|
|
7187
|
+
},
|
|
7188
|
+
indexes: [
|
|
7189
|
+
{ fields: ["organization_id", "occurred_at"] },
|
|
7190
|
+
{ fields: ["type", "name", "occurred_at"] },
|
|
7191
|
+
{ fields: ["actor", "occurred_at"] },
|
|
7192
|
+
{ fields: ["outcome"] }
|
|
7193
|
+
],
|
|
7194
|
+
enable: {
|
|
7195
|
+
trackHistory: false,
|
|
7196
|
+
searchable: false,
|
|
7197
|
+
apiEnabled: true,
|
|
7198
|
+
apiMethods: ["get", "list"],
|
|
7199
|
+
trash: false
|
|
7200
|
+
}
|
|
7201
|
+
});
|
|
6925
7202
|
var SysSetting = ObjectSchema.create({
|
|
6926
7203
|
name: "sys_setting",
|
|
6927
7204
|
label: "Setting",
|
|
@@ -7315,6 +7592,13 @@ var SETUP_APP = {
|
|
|
7315
7592
|
icon: "settings",
|
|
7316
7593
|
active: true,
|
|
7317
7594
|
isDefault: false,
|
|
7595
|
+
// ADR-0010 §3.7 — author-facing protection block. Loader translates
|
|
7596
|
+
// this into the `_lock` envelope at registration time.
|
|
7597
|
+
protection: {
|
|
7598
|
+
lock: "full",
|
|
7599
|
+
reason: "Core admin UI shipped by @objectstack/platform-objects \u2014 see ADR-0010.",
|
|
7600
|
+
docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
|
|
7601
|
+
},
|
|
7318
7602
|
branding: {
|
|
7319
7603
|
primaryColor: "#475569"
|
|
7320
7604
|
// Slate-600 — neutral admin palette
|
|
@@ -7546,6 +7830,31 @@ var STUDIO_APP = {
|
|
|
7546
7830
|
// Indigo-500 — distinct from Setup's slate
|
|
7547
7831
|
},
|
|
7548
7832
|
requiredPermissions: ["studio.access"],
|
|
7833
|
+
contextSelectors: [
|
|
7834
|
+
{
|
|
7835
|
+
// Package scope — pinned to the sidebar header. Selecting a package
|
|
7836
|
+
// injects `{active_package}` into every `metadata:resource` nav
|
|
7837
|
+
// item below, so the whole workbench filters to that package in
|
|
7838
|
+
// one click. Options come from the installed-packages REST surface,
|
|
7839
|
+
// narrowed to project-scoped packages: this dropdown exists so
|
|
7840
|
+
// third-party developers can scope to *their* custom package, so we
|
|
7841
|
+
// deliberately hide the platform's own system/cloud kernel packages
|
|
7842
|
+
// (auth, security, audit, queue, …) which are not user-authored.
|
|
7843
|
+
id: "active_package",
|
|
7844
|
+
label: "Package",
|
|
7845
|
+
icon: "package",
|
|
7846
|
+
optionsSource: {
|
|
7847
|
+
endpoint: "/api/v1/packages",
|
|
7848
|
+
valueKey: "manifest.id",
|
|
7849
|
+
labelKey: "manifest.name",
|
|
7850
|
+
filter: [{ key: "manifest.scope", op: "nin", value: ["system", "cloud"] }]
|
|
7851
|
+
},
|
|
7852
|
+
includeAll: true,
|
|
7853
|
+
allValue: "",
|
|
7854
|
+
persist: "query",
|
|
7855
|
+
placement: "sidebar_header"
|
|
7856
|
+
}
|
|
7857
|
+
],
|
|
7549
7858
|
navigation: [
|
|
7550
7859
|
{
|
|
7551
7860
|
id: "group_overview",
|
|
@@ -7576,7 +7885,7 @@ var STUDIO_APP = {
|
|
|
7576
7885
|
type: "component",
|
|
7577
7886
|
label: "Objects",
|
|
7578
7887
|
componentRef: "metadata:resource",
|
|
7579
|
-
params: { type: "object" },
|
|
7888
|
+
params: { type: "object", package: "{active_package}" },
|
|
7580
7889
|
icon: "box"
|
|
7581
7890
|
},
|
|
7582
7891
|
{
|
|
@@ -7584,7 +7893,7 @@ var STUDIO_APP = {
|
|
|
7584
7893
|
type: "component",
|
|
7585
7894
|
label: "Validations",
|
|
7586
7895
|
componentRef: "metadata:resource",
|
|
7587
|
-
params: { type: "validation" },
|
|
7896
|
+
params: { type: "validation", package: "{active_package}" },
|
|
7588
7897
|
icon: "check-square"
|
|
7589
7898
|
}
|
|
7590
7899
|
]
|
|
@@ -7601,7 +7910,7 @@ var STUDIO_APP = {
|
|
|
7601
7910
|
type: "component",
|
|
7602
7911
|
label: "Apps",
|
|
7603
7912
|
componentRef: "metadata:resource",
|
|
7604
|
-
params: { type: "app" },
|
|
7913
|
+
params: { type: "app", package: "{active_package}" },
|
|
7605
7914
|
icon: "app-window"
|
|
7606
7915
|
},
|
|
7607
7916
|
{
|
|
@@ -7609,7 +7918,7 @@ var STUDIO_APP = {
|
|
|
7609
7918
|
type: "component",
|
|
7610
7919
|
label: "Views",
|
|
7611
7920
|
componentRef: "metadata:resource",
|
|
7612
|
-
params: { type: "view" },
|
|
7921
|
+
params: { type: "view", package: "{active_package}" },
|
|
7613
7922
|
icon: "table"
|
|
7614
7923
|
},
|
|
7615
7924
|
{
|
|
@@ -7617,7 +7926,7 @@ var STUDIO_APP = {
|
|
|
7617
7926
|
type: "component",
|
|
7618
7927
|
label: "Pages",
|
|
7619
7928
|
componentRef: "metadata:resource",
|
|
7620
|
-
params: { type: "page" },
|
|
7929
|
+
params: { type: "page", package: "{active_package}" },
|
|
7621
7930
|
icon: "file-text"
|
|
7622
7931
|
},
|
|
7623
7932
|
{
|
|
@@ -7625,7 +7934,7 @@ var STUDIO_APP = {
|
|
|
7625
7934
|
type: "component",
|
|
7626
7935
|
label: "Dashboards",
|
|
7627
7936
|
componentRef: "metadata:resource",
|
|
7628
|
-
params: { type: "dashboard" },
|
|
7937
|
+
params: { type: "dashboard", package: "{active_package}" },
|
|
7629
7938
|
icon: "layout-dashboard"
|
|
7630
7939
|
},
|
|
7631
7940
|
{
|
|
@@ -7633,7 +7942,7 @@ var STUDIO_APP = {
|
|
|
7633
7942
|
type: "component",
|
|
7634
7943
|
label: "Reports",
|
|
7635
7944
|
componentRef: "metadata:resource",
|
|
7636
|
-
params: { type: "report" },
|
|
7945
|
+
params: { type: "report", package: "{active_package}" },
|
|
7637
7946
|
icon: "bar-chart-3"
|
|
7638
7947
|
}
|
|
7639
7948
|
]
|
|
@@ -7650,7 +7959,7 @@ var STUDIO_APP = {
|
|
|
7650
7959
|
type: "component",
|
|
7651
7960
|
label: "Actions",
|
|
7652
7961
|
componentRef: "metadata:resource",
|
|
7653
|
-
params: { type: "action" },
|
|
7962
|
+
params: { type: "action", package: "{active_package}" },
|
|
7654
7963
|
icon: "mouse-pointer-click"
|
|
7655
7964
|
},
|
|
7656
7965
|
{
|
|
@@ -7658,7 +7967,7 @@ var STUDIO_APP = {
|
|
|
7658
7967
|
type: "component",
|
|
7659
7968
|
label: "Hooks",
|
|
7660
7969
|
componentRef: "metadata:resource",
|
|
7661
|
-
params: { type: "hook" },
|
|
7970
|
+
params: { type: "hook", package: "{active_package}" },
|
|
7662
7971
|
icon: "webhook"
|
|
7663
7972
|
}
|
|
7664
7973
|
]
|
|
@@ -7675,7 +7984,7 @@ var STUDIO_APP = {
|
|
|
7675
7984
|
type: "component",
|
|
7676
7985
|
label: "Flows",
|
|
7677
7986
|
componentRef: "metadata:resource",
|
|
7678
|
-
params: { type: "flow" },
|
|
7987
|
+
params: { type: "flow", package: "{active_package}" },
|
|
7679
7988
|
icon: "git-branch"
|
|
7680
7989
|
},
|
|
7681
7990
|
{
|
|
@@ -7683,7 +7992,7 @@ var STUDIO_APP = {
|
|
|
7683
7992
|
type: "component",
|
|
7684
7993
|
label: "Workflow Rules",
|
|
7685
7994
|
componentRef: "metadata:resource",
|
|
7686
|
-
params: { type: "workflow" },
|
|
7995
|
+
params: { type: "workflow", package: "{active_package}" },
|
|
7687
7996
|
icon: "zap"
|
|
7688
7997
|
},
|
|
7689
7998
|
{
|
|
@@ -7691,7 +8000,7 @@ var STUDIO_APP = {
|
|
|
7691
8000
|
type: "component",
|
|
7692
8001
|
label: "Approval Processes",
|
|
7693
8002
|
componentRef: "metadata:resource",
|
|
7694
|
-
params: { type: "approval" },
|
|
8003
|
+
params: { type: "approval", package: "{active_package}" },
|
|
7695
8004
|
icon: "check-circle"
|
|
7696
8005
|
}
|
|
7697
8006
|
]
|
|
@@ -7710,7 +8019,7 @@ var STUDIO_APP = {
|
|
|
7710
8019
|
type: "component",
|
|
7711
8020
|
label: "Agents",
|
|
7712
8021
|
componentRef: "metadata:resource",
|
|
7713
|
-
params: { type: "agent" },
|
|
8022
|
+
params: { type: "agent", package: "{active_package}" },
|
|
7714
8023
|
icon: "bot"
|
|
7715
8024
|
},
|
|
7716
8025
|
{
|
|
@@ -7718,7 +8027,7 @@ var STUDIO_APP = {
|
|
|
7718
8027
|
type: "component",
|
|
7719
8028
|
label: "Tools",
|
|
7720
8029
|
componentRef: "metadata:resource",
|
|
7721
|
-
params: { type: "tool" },
|
|
8030
|
+
params: { type: "tool", package: "{active_package}" },
|
|
7722
8031
|
icon: "wrench"
|
|
7723
8032
|
},
|
|
7724
8033
|
{
|
|
@@ -7726,7 +8035,7 @@ var STUDIO_APP = {
|
|
|
7726
8035
|
type: "component",
|
|
7727
8036
|
label: "Skills",
|
|
7728
8037
|
componentRef: "metadata:resource",
|
|
7729
|
-
params: { type: "skill" },
|
|
8038
|
+
params: { type: "skill", package: "{active_package}" },
|
|
7730
8039
|
icon: "brain"
|
|
7731
8040
|
}
|
|
7732
8041
|
]
|
|
@@ -7779,7 +8088,7 @@ var STUDIO_APP = {
|
|
|
7779
8088
|
type: "component",
|
|
7780
8089
|
label: "Email Templates",
|
|
7781
8090
|
componentRef: "metadata:resource",
|
|
7782
|
-
params: { type: "email_template" },
|
|
8091
|
+
params: { type: "email_template", package: "{active_package}" },
|
|
7783
8092
|
icon: "mail"
|
|
7784
8093
|
}
|
|
7785
8094
|
]
|
|
@@ -26000,6 +26309,6 @@ function createPlatformObjectsPlugin() {
|
|
|
26000
26309
|
return new PlatformObjectsPlugin();
|
|
26001
26310
|
}
|
|
26002
26311
|
|
|
26003
|
-
export { ACCOUNT_APP, MetadataFormsTranslations, PlatformObjectsPlugin, SETUP_APP, STUDIO_APP, SetupAppTranslations, SysAccount, SysActivity, SysApiKey, SysApprovalAction, SysApprovalProcess, SysApprovalRequest, SysAttachment, SysAuditLog, SysComment, SysDepartment, SysDepartmentMember, SysDeviceCode, SysEmail, SysEmailTemplate, SysInvitation, SysJob, SysJobQueue, SysJobRun, SysJwks, SysMember, SysMetadataObject as SysMetadata, SysMetadataHistoryObject, SysMetadataObject, SysNotification, SysOauthAccessToken, SysOauthApplication, SysOauthConsent, SysOauthRefreshToken, SysOrganization, SysOrganizationDetailPage, SysPermissionSet, SysPresence, SysRecordShare, SysReportSchedule, SysRole, SysRolePermissionSet, SysSavedReport, SysSecret, SysSession, SysSetting, SysSettingAudit, SysShareLink, SysSharingRule, SysTeam, SysTeamMember, SysTwoFactor, SysUser, SysUserDetailPage, SysUserPermissionSet, SysUserPreference, SysVerification, SysWebhook, SystemOverviewDashboard, createPlatformObjectsPlugin, defaultPermissionSets, en, esES, jaJP, zhCN };
|
|
26312
|
+
export { ACCOUNT_APP, MetadataFormsTranslations, PlatformObjectsPlugin, SETUP_APP, STUDIO_APP, SetupAppTranslations, SysAccount, SysActivity, SysApiKey, SysApprovalAction, SysApprovalProcess, SysApprovalRequest, SysAttachment, SysAuditLog, SysComment, SysDepartment, SysDepartmentMember, SysDeviceCode, SysEmail, SysEmailTemplate, SysInvitation, SysJob, SysJobQueue, SysJobRun, SysJwks, SysMember, SysMetadataObject as SysMetadata, SysMetadataAuditObject, SysMetadataHistoryObject, SysMetadataObject, SysNotification, SysOauthAccessToken, SysOauthApplication, SysOauthConsent, SysOauthRefreshToken, SysOrganization, SysOrganizationDetailPage, SysPermissionSet, SysPresence, SysRecordShare, SysReportSchedule, SysRole, SysRolePermissionSet, SysSavedReport, SysSecret, SysSession, SysSetting, SysSettingAudit, SysShareLink, SysSharingRule, SysTeam, SysTeamMember, SysTwoFactor, SysUser, SysUserDetailPage, SysUserPermissionSet, SysUserPreference, SysVerification, SysWebhook, SystemOverviewDashboard, createPlatformObjectsPlugin, defaultPermissionSets, en, esES, jaJP, zhCN };
|
|
26004
26313
|
//# sourceMappingURL=index.mjs.map
|
|
26005
26314
|
//# sourceMappingURL=index.mjs.map
|