@objectstack/platform-objects 7.2.0 → 7.3.0

package/dist/index.js

@@ -12,9 +12,12 @@ var SysUser = data.ObjectSchema.create({
   icon: "user",
   isSystem: true,
   managedBy: "better-auth",
-  // ADR-0010 — identity table is managed by better-auth, schema must not drift.
-  _lock: "full",
-  _lockReason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+  // ADR-0010 §3.7 — identity table is managed by better-auth; schema must not drift.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "User accounts for authentication",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -427,6 +430,14 @@ var SysSession = data.ObjectSchema.create({
   icon: "key",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Active user sessions",
   displayNameField: "user_id",
   titleFormat: "Session \u2014 {user_id}",
@@ -582,6 +593,14 @@ var SysAccount = data.ObjectSchema.create({
   icon: "link",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "OAuth and authentication provider accounts",
   titleFormat: "{provider_id} - {account_id}",
   compactLayout: ["provider_id", "user_id", "account_id"],
@@ -755,6 +774,14 @@ var SysVerification = data.ObjectSchema.create({
   icon: "shield-check",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Email and phone verification tokens",
   titleFormat: "Verification for {identifier}",
   compactLayout: ["identifier", "expires_at", "created_at"],
@@ -810,6 +837,14 @@ var SysOrganization = data.ObjectSchema.create({
   icon: "building-2",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Organizations for multi-tenant grouping",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -1012,6 +1047,14 @@ var SysMember = data.ObjectSchema.create({
   icon: "user-check",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Organization membership records",
   titleFormat: "{user_id} in {organization_id}",
   compactLayout: ["user_id", "organization_id", "role"],
@@ -1161,6 +1204,14 @@ var SysInvitation = data.ObjectSchema.create({
   icon: "mail",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Organization invitations for user onboarding",
   titleFormat: "Invitation to {organization_id}",
   compactLayout: ["email", "organization_id", "status"],
@@ -1361,6 +1412,14 @@ var SysTeam = data.ObjectSchema.create({
   icon: "users",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Teams within organizations for fine-grained grouping",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -1498,6 +1557,14 @@ var SysTeamMember = data.ObjectSchema.create({
   icon: "user-plus",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Team membership records linking users to teams",
   titleFormat: "{user_id} in {team_id}",
   compactLayout: ["user_id", "team_id", "created_at"],
@@ -1825,6 +1892,14 @@ var SysApiKey = data.ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "API keys for programmatic access",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -2007,6 +2082,14 @@ var SysTwoFactor = data.ObjectSchema.create({
   icon: "smartphone",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Two-factor authentication credentials",
   titleFormat: "Two-factor for {user_id}",
   compactLayout: ["user_id", "created_at"],
@@ -2153,6 +2236,14 @@ var SysDeviceCode = data.ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests",
   titleFormat: "{user_code}",
   compactLayout: ["user_code", "status", "client_id", "expires_at"],
@@ -2332,6 +2423,14 @@ var SysOauthApplication = data.ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Registered OAuth/OIDC client applications",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -2726,6 +2825,14 @@ var SysOauthAccessToken = data.ObjectSchema.create({
   icon: "ticket",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Opaque OAuth access tokens issued to client applications",
   compactLayout: ["client_id", "user_id", "expires_at"],
   fields: {
@@ -2804,6 +2911,14 @@ var SysOauthRefreshToken = data.ObjectSchema.create({
   icon: "refresh-cw",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Opaque OAuth refresh tokens (linked to a session)",
   compactLayout: ["client_id", "user_id", "expires_at"],
   fields: {
@@ -2886,6 +3001,14 @@ var SysOauthConsent = data.ObjectSchema.create({
   icon: "shield-check",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "User consent records for OAuth client applications",
   compactLayout: ["client_id", "user_id", "scopes"],
   fields: {
@@ -2946,6 +3069,14 @@ var SysJwks = data.ObjectSchema.create({
   icon: "key",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Asymmetric key pairs used to sign and verify issued JWTs",
   compactLayout: ["id", "created_at", "expires_at"],
   fields: {
@@ -2993,6 +3124,13 @@ var SysRole = data.ObjectSchema.create({
   icon: "shield",
   isSystem: true,
   managedBy: "config",
+  // ADR-0010 §3.7 — RBAC primitive; tenants may add custom rows
+  // (created via UI / API) but the schema itself is locked.
+  protection: {
+    lock: "no-overlay",
+    reason: "RBAC schema is platform-defined \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Role definitions for RBAC access control",
   displayNameField: "label",
   titleFormat: "{label}",
@@ -3196,6 +3334,13 @@ var SysPermissionSet = data.ObjectSchema.create({
   icon: "lock",
   isSystem: true,
   managedBy: "config",
+  // ADR-0010 §3.7 — RBAC primitive; tenants may add custom rows
+  // (created via UI / API) but the schema itself is locked.
+  protection: {
+    lock: "no-overlay",
+    reason: "RBAC schema is platform-defined \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Named permission groupings for fine-grained access control",
   displayNameField: "label",
   titleFormat: "{label}",
@@ -7449,9 +7594,13 @@ var SETUP_APP = {
   icon: "settings",
   active: true,
   isDefault: false,
-  // ADR-0010 — core admin UI must not be overlay-edited or deleted.
-  _lock: "full",
-  _lockReason: "Core admin UI shipped by @objectstack/platform-objects \u2014 see ADR-0010.",
+  // ADR-0010 §3.7 — author-facing protection block. Loader translates
+  // this into the `_lock` envelope at registration time.
+  protection: {
+    lock: "full",
+    reason: "Core admin UI shipped by @objectstack/platform-objects \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   branding: {
     primaryColor: "#475569"
     // Slate-600 — neutral admin palette
@@ -7678,11 +7827,41 @@ var STUDIO_APP = {
   icon: "hammer",
   active: true,
   isDefault: false,
+  // Studio is the metadata-authoring host, so its ambient copilot is
+  // pinned to the schema-architect agent. Resolved by the ambient chat
+  // endpoint via `app.defaultAgent` — no UI-side `?agent=` override
+  // needed. Every other app falls back to the data-query agent.
+  defaultAgent: "metadata_assistant",
   branding: {
     primaryColor: "#6366f1"
     // Indigo-500 — distinct from Setup's slate
   },
   requiredPermissions: ["studio.access"],
+  contextSelectors: [
+    {
+      // Package scope — pinned to the sidebar header. Selecting a package
+      // injects `{active_package}` into every `metadata:resource` nav
+      // item below, so the whole workbench filters to that package in
+      // one click. Options come from the installed-packages REST surface,
+      // narrowed to project-scoped packages: this dropdown exists so
+      // third-party developers can scope to *their* custom package, so we
+      // deliberately hide the platform's own system/cloud kernel packages
+      // (auth, security, audit, queue, …) which are not user-authored.
+      id: "active_package",
+      label: "Package",
+      icon: "package",
+      optionsSource: {
+        endpoint: "/api/v1/packages",
+        valueKey: "manifest.id",
+        labelKey: "manifest.name",
+        filter: [{ key: "manifest.scope", op: "nin", value: ["system", "cloud"] }]
+      },
+      includeAll: true,
+      allValue: "",
+      persist: "query",
+      placement: "sidebar_header"
+    }
+  ],
   navigation: [
     {
       id: "group_overview",
@@ -7696,6 +7875,13 @@ var STUDIO_APP = {
           label: "All Metadata Types",
           componentRef: "metadata:directory",
           icon: "layers"
+        },
+        {
+          id: "nav_packages",
+          type: "component",
+          label: "Packages",
+          componentRef: "developer:packages",
+          icon: "package"
         }
       ]
     },
@@ -7713,7 +7899,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Objects",
           componentRef: "metadata:resource",
-          params: { type: "object" },
+          params: { type: "object", package: "{active_package}" },
           icon: "box"
         },
         {
@@ -7721,7 +7907,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Validations",
           componentRef: "metadata:resource",
-          params: { type: "validation" },
+          params: { type: "validation", package: "{active_package}" },
           icon: "check-square"
         }
       ]
@@ -7738,7 +7924,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Apps",
           componentRef: "metadata:resource",
-          params: { type: "app" },
+          params: { type: "app", package: "{active_package}" },
           icon: "app-window"
         },
         {
@@ -7746,7 +7932,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Views",
           componentRef: "metadata:resource",
-          params: { type: "view" },
+          params: { type: "view", package: "{active_package}" },
           icon: "table"
         },
         {
@@ -7754,7 +7940,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Pages",
           componentRef: "metadata:resource",
-          params: { type: "page" },
+          params: { type: "page", package: "{active_package}" },
           icon: "file-text"
         },
         {
@@ -7762,7 +7948,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Dashboards",
           componentRef: "metadata:resource",
-          params: { type: "dashboard" },
+          params: { type: "dashboard", package: "{active_package}" },
           icon: "layout-dashboard"
         },
         {
@@ -7770,7 +7956,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Reports",
           componentRef: "metadata:resource",
-          params: { type: "report" },
+          params: { type: "report", package: "{active_package}" },
           icon: "bar-chart-3"
         }
       ]
@@ -7787,7 +7973,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Actions",
           componentRef: "metadata:resource",
-          params: { type: "action" },
+          params: { type: "action", package: "{active_package}" },
           icon: "mouse-pointer-click"
         },
         {
@@ -7795,7 +7981,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Hooks",
           componentRef: "metadata:resource",
-          params: { type: "hook" },
+          params: { type: "hook", package: "{active_package}" },
           icon: "webhook"
         }
       ]
@@ -7812,7 +7998,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Flows",
           componentRef: "metadata:resource",
-          params: { type: "flow" },
+          params: { type: "flow", package: "{active_package}" },
           icon: "git-branch"
         },
         {
@@ -7820,7 +8006,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Workflow Rules",
           componentRef: "metadata:resource",
-          params: { type: "workflow" },
+          params: { type: "workflow", package: "{active_package}" },
           icon: "zap"
         },
         {
@@ -7828,7 +8014,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Approval Processes",
           componentRef: "metadata:resource",
-          params: { type: "approval" },
+          params: { type: "approval", package: "{active_package}" },
           icon: "check-circle"
         }
       ]
@@ -7847,7 +8033,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Agents",
           componentRef: "metadata:resource",
-          params: { type: "agent" },
+          params: { type: "agent", package: "{active_package}" },
           icon: "bot"
         },
         {
@@ -7855,7 +8041,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Tools",
           componentRef: "metadata:resource",
-          params: { type: "tool" },
+          params: { type: "tool", package: "{active_package}" },
           icon: "wrench"
         },
         {
@@ -7863,7 +8049,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Skills",
           componentRef: "metadata:resource",
-          params: { type: "skill" },
+          params: { type: "skill", package: "{active_package}" },
           icon: "brain"
         }
       ]
@@ -7916,7 +8102,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Email Templates",
           componentRef: "metadata:resource",
-          params: { type: "email_template" },
+          params: { type: "email_template", package: "{active_package}" },
           icon: "mail"
         }
       ]