@objectstack/platform-objects 7.2.0 → 7.3.0

package/dist/index.mjs

@@ -10,9 +10,12 @@ var SysUser = ObjectSchema.create({
   icon: "user",
   isSystem: true,
   managedBy: "better-auth",
-  // ADR-0010 — identity table is managed by better-auth, schema must not drift.
-  _lock: "full",
-  _lockReason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+  // ADR-0010 §3.7 — identity table is managed by better-auth; schema must not drift.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "User accounts for authentication",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -425,6 +428,14 @@ var SysSession = ObjectSchema.create({
   icon: "key",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Active user sessions",
   displayNameField: "user_id",
   titleFormat: "Session \u2014 {user_id}",
@@ -580,6 +591,14 @@ var SysAccount = ObjectSchema.create({
   icon: "link",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "OAuth and authentication provider accounts",
   titleFormat: "{provider_id} - {account_id}",
   compactLayout: ["provider_id", "user_id", "account_id"],
@@ -753,6 +772,14 @@ var SysVerification = ObjectSchema.create({
   icon: "shield-check",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Email and phone verification tokens",
   titleFormat: "Verification for {identifier}",
   compactLayout: ["identifier", "expires_at", "created_at"],
@@ -808,6 +835,14 @@ var SysOrganization = ObjectSchema.create({
   icon: "building-2",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Organizations for multi-tenant grouping",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -1010,6 +1045,14 @@ var SysMember = ObjectSchema.create({
   icon: "user-check",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Organization membership records",
   titleFormat: "{user_id} in {organization_id}",
   compactLayout: ["user_id", "organization_id", "role"],
@@ -1159,6 +1202,14 @@ var SysInvitation = ObjectSchema.create({
   icon: "mail",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Organization invitations for user onboarding",
   titleFormat: "Invitation to {organization_id}",
   compactLayout: ["email", "organization_id", "status"],
@@ -1359,6 +1410,14 @@ var SysTeam = ObjectSchema.create({
   icon: "users",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Teams within organizations for fine-grained grouping",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -1496,6 +1555,14 @@ var SysTeamMember = ObjectSchema.create({
   icon: "user-plus",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Team membership records linking users to teams",
   titleFormat: "{user_id} in {team_id}",
   compactLayout: ["user_id", "team_id", "created_at"],
@@ -1823,6 +1890,14 @@ var SysApiKey = ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "API keys for programmatic access",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -2005,6 +2080,14 @@ var SysTwoFactor = ObjectSchema.create({
   icon: "smartphone",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Two-factor authentication credentials",
   titleFormat: "Two-factor for {user_id}",
   compactLayout: ["user_id", "created_at"],
@@ -2151,6 +2234,14 @@ var SysDeviceCode = ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests",
   titleFormat: "{user_code}",
   compactLayout: ["user_code", "status", "client_id", "expires_at"],
@@ -2330,6 +2421,14 @@ var SysOauthApplication = ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Registered OAuth/OIDC client applications",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -2724,6 +2823,14 @@ var SysOauthAccessToken = ObjectSchema.create({
   icon: "ticket",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Opaque OAuth access tokens issued to client applications",
   compactLayout: ["client_id", "user_id", "expires_at"],
   fields: {
@@ -2802,6 +2909,14 @@ var SysOauthRefreshToken = ObjectSchema.create({
   icon: "refresh-cw",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Opaque OAuth refresh tokens (linked to a session)",
   compactLayout: ["client_id", "user_id", "expires_at"],
   fields: {
@@ -2884,6 +2999,14 @@ var SysOauthConsent = ObjectSchema.create({
   icon: "shield-check",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "User consent records for OAuth client applications",
   compactLayout: ["client_id", "user_id", "scopes"],
   fields: {
@@ -2944,6 +3067,14 @@ var SysJwks = ObjectSchema.create({
   icon: "key",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Asymmetric key pairs used to sign and verify issued JWTs",
   compactLayout: ["id", "created_at", "expires_at"],
   fields: {
@@ -2991,6 +3122,13 @@ var SysRole = ObjectSchema.create({
   icon: "shield",
   isSystem: true,
   managedBy: "config",
+  // ADR-0010 §3.7 — RBAC primitive; tenants may add custom rows
+  // (created via UI / API) but the schema itself is locked.
+  protection: {
+    lock: "no-overlay",
+    reason: "RBAC schema is platform-defined \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Role definitions for RBAC access control",
   displayNameField: "label",
   titleFormat: "{label}",
@@ -3194,6 +3332,13 @@ var SysPermissionSet = ObjectSchema.create({
   icon: "lock",
   isSystem: true,
   managedBy: "config",
+  // ADR-0010 §3.7 — RBAC primitive; tenants may add custom rows
+  // (created via UI / API) but the schema itself is locked.
+  protection: {
+    lock: "no-overlay",
+    reason: "RBAC schema is platform-defined \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Named permission groupings for fine-grained access control",
   displayNameField: "label",
   titleFormat: "{label}",
@@ -7447,9 +7592,13 @@ var SETUP_APP = {
   icon: "settings",
   active: true,
   isDefault: false,
-  // ADR-0010 — core admin UI must not be overlay-edited or deleted.
-  _lock: "full",
-  _lockReason: "Core admin UI shipped by @objectstack/platform-objects \u2014 see ADR-0010.",
+  // ADR-0010 §3.7 — author-facing protection block. Loader translates
+  // this into the `_lock` envelope at registration time.
+  protection: {
+    lock: "full",
+    reason: "Core admin UI shipped by @objectstack/platform-objects \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   branding: {
     primaryColor: "#475569"
     // Slate-600 — neutral admin palette
@@ -7676,11 +7825,41 @@ var STUDIO_APP = {
   icon: "hammer",
   active: true,
   isDefault: false,
+  // Studio is the metadata-authoring host, so its ambient copilot is
+  // pinned to the schema-architect agent. Resolved by the ambient chat
+  // endpoint via `app.defaultAgent` — no UI-side `?agent=` override
+  // needed. Every other app falls back to the data-query agent.
+  defaultAgent: "metadata_assistant",
   branding: {
     primaryColor: "#6366f1"
     // Indigo-500 — distinct from Setup's slate
   },
   requiredPermissions: ["studio.access"],
+  contextSelectors: [
+    {
+      // Package scope — pinned to the sidebar header. Selecting a package
+      // injects `{active_package}` into every `metadata:resource` nav
+      // item below, so the whole workbench filters to that package in
+      // one click. Options come from the installed-packages REST surface,
+      // narrowed to project-scoped packages: this dropdown exists so
+      // third-party developers can scope to *their* custom package, so we
+      // deliberately hide the platform's own system/cloud kernel packages
+      // (auth, security, audit, queue, …) which are not user-authored.
+      id: "active_package",
+      label: "Package",
+      icon: "package",
+      optionsSource: {
+        endpoint: "/api/v1/packages",
+        valueKey: "manifest.id",
+        labelKey: "manifest.name",
+        filter: [{ key: "manifest.scope", op: "nin", value: ["system", "cloud"] }]
+      },
+      includeAll: true,
+      allValue: "",
+      persist: "query",
+      placement: "sidebar_header"
+    }
+  ],
   navigation: [
     {
       id: "group_overview",
@@ -7694,6 +7873,13 @@ var STUDIO_APP = {
           label: "All Metadata Types",
           componentRef: "metadata:directory",
           icon: "layers"
+        },
+        {
+          id: "nav_packages",
+          type: "component",
+          label: "Packages",
+          componentRef: "developer:packages",
+          icon: "package"
         }
       ]
     },
@@ -7711,7 +7897,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Objects",
           componentRef: "metadata:resource",
-          params: { type: "object" },
+          params: { type: "object", package: "{active_package}" },
           icon: "box"
         },
         {
@@ -7719,7 +7905,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Validations",
           componentRef: "metadata:resource",
-          params: { type: "validation" },
+          params: { type: "validation", package: "{active_package}" },
           icon: "check-square"
         }
       ]
@@ -7736,7 +7922,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Apps",
           componentRef: "metadata:resource",
-          params: { type: "app" },
+          params: { type: "app", package: "{active_package}" },
           icon: "app-window"
         },
         {
@@ -7744,7 +7930,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Views",
           componentRef: "metadata:resource",
-          params: { type: "view" },
+          params: { type: "view", package: "{active_package}" },
           icon: "table"
         },
         {
@@ -7752,7 +7938,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Pages",
           componentRef: "metadata:resource",
-          params: { type: "page" },
+          params: { type: "page", package: "{active_package}" },
           icon: "file-text"
         },
         {
@@ -7760,7 +7946,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Dashboards",
           componentRef: "metadata:resource",
-          params: { type: "dashboard" },
+          params: { type: "dashboard", package: "{active_package}" },
           icon: "layout-dashboard"
         },
         {
@@ -7768,7 +7954,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Reports",
           componentRef: "metadata:resource",
-          params: { type: "report" },
+          params: { type: "report", package: "{active_package}" },
           icon: "bar-chart-3"
         }
       ]
@@ -7785,7 +7971,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Actions",
           componentRef: "metadata:resource",
-          params: { type: "action" },
+          params: { type: "action", package: "{active_package}" },
           icon: "mouse-pointer-click"
         },
         {
@@ -7793,7 +7979,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Hooks",
           componentRef: "metadata:resource",
-          params: { type: "hook" },
+          params: { type: "hook", package: "{active_package}" },
           icon: "webhook"
         }
       ]
@@ -7810,7 +7996,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Flows",
           componentRef: "metadata:resource",
-          params: { type: "flow" },
+          params: { type: "flow", package: "{active_package}" },
           icon: "git-branch"
         },
         {
@@ -7818,7 +8004,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Workflow Rules",
           componentRef: "metadata:resource",
-          params: { type: "workflow" },
+          params: { type: "workflow", package: "{active_package}" },
           icon: "zap"
         },
         {
@@ -7826,7 +8012,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Approval Processes",
           componentRef: "metadata:resource",
-          params: { type: "approval" },
+          params: { type: "approval", package: "{active_package}" },
           icon: "check-circle"
         }
       ]
@@ -7845,7 +8031,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Agents",
           componentRef: "metadata:resource",
-          params: { type: "agent" },
+          params: { type: "agent", package: "{active_package}" },
           icon: "bot"
         },
         {
@@ -7853,7 +8039,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Tools",
           componentRef: "metadata:resource",
-          params: { type: "tool" },
+          params: { type: "tool", package: "{active_package}" },
           icon: "wrench"
         },
         {
@@ -7861,7 +8047,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Skills",
           componentRef: "metadata:resource",
-          params: { type: "skill" },
+          params: { type: "skill", package: "{active_package}" },
           icon: "brain"
         }
       ]
@@ -7914,7 +8100,7 @@ var STUDIO_APP = {
           type: "component",
           label: "Email Templates",
           componentRef: "metadata:resource",
-          params: { type: "email_template" },
+          params: { type: "email_template", package: "{active_package}" },
           icon: "mail"
         }
       ]