@objectstack/platform-objects 7.2.0 → 7.3.0

package/dist/identity/index.js

@@ -10,9 +10,12 @@ var SysUser = data.ObjectSchema.create({
   icon: "user",
   isSystem: true,
   managedBy: "better-auth",
-  // ADR-0010 — identity table is managed by better-auth, schema must not drift.
-  _lock: "full",
-  _lockReason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+  // ADR-0010 §3.7 — identity table is managed by better-auth; schema must not drift.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "User accounts for authentication",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -425,6 +428,14 @@ var SysSession = data.ObjectSchema.create({
   icon: "key",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Active user sessions",
   displayNameField: "user_id",
   titleFormat: "Session \u2014 {user_id}",
@@ -580,6 +591,14 @@ var SysAccount = data.ObjectSchema.create({
   icon: "link",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "OAuth and authentication provider accounts",
   titleFormat: "{provider_id} - {account_id}",
   compactLayout: ["provider_id", "user_id", "account_id"],
@@ -753,6 +772,14 @@ var SysVerification = data.ObjectSchema.create({
   icon: "shield-check",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Email and phone verification tokens",
   titleFormat: "Verification for {identifier}",
   compactLayout: ["identifier", "expires_at", "created_at"],
@@ -808,6 +835,14 @@ var SysOrganization = data.ObjectSchema.create({
   icon: "building-2",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Organizations for multi-tenant grouping",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -1010,6 +1045,14 @@ var SysMember = data.ObjectSchema.create({
   icon: "user-check",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Organization membership records",
   titleFormat: "{user_id} in {organization_id}",
   compactLayout: ["user_id", "organization_id", "role"],
@@ -1159,6 +1202,14 @@ var SysInvitation = data.ObjectSchema.create({
   icon: "mail",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Organization invitations for user onboarding",
   titleFormat: "Invitation to {organization_id}",
   compactLayout: ["email", "organization_id", "status"],
@@ -1359,6 +1410,14 @@ var SysTeam = data.ObjectSchema.create({
   icon: "users",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Teams within organizations for fine-grained grouping",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -1496,6 +1555,14 @@ var SysTeamMember = data.ObjectSchema.create({
   icon: "user-plus",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Team membership records linking users to teams",
   titleFormat: "{user_id} in {team_id}",
   compactLayout: ["user_id", "team_id", "created_at"],
@@ -1823,6 +1890,14 @@ var SysApiKey = data.ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "API keys for programmatic access",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -2005,6 +2080,14 @@ var SysTwoFactor = data.ObjectSchema.create({
   icon: "smartphone",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Two-factor authentication credentials",
   titleFormat: "Two-factor for {user_id}",
   compactLayout: ["user_id", "created_at"],
@@ -2151,6 +2234,14 @@ var SysDeviceCode = data.ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests",
   titleFormat: "{user_code}",
   compactLayout: ["user_code", "status", "client_id", "expires_at"],
@@ -2330,6 +2421,14 @@ var SysOauthApplication = data.ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Registered OAuth/OIDC client applications",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -2724,6 +2823,14 @@ var SysOauthAccessToken = data.ObjectSchema.create({
   icon: "ticket",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Opaque OAuth access tokens issued to client applications",
   compactLayout: ["client_id", "user_id", "expires_at"],
   fields: {
@@ -2802,6 +2909,14 @@ var SysOauthRefreshToken = data.ObjectSchema.create({
   icon: "refresh-cw",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Opaque OAuth refresh tokens (linked to a session)",
   compactLayout: ["client_id", "user_id", "expires_at"],
   fields: {
@@ -2884,6 +2999,14 @@ var SysOauthConsent = data.ObjectSchema.create({
   icon: "shield-check",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "User consent records for OAuth client applications",
   compactLayout: ["client_id", "user_id", "scopes"],
   fields: {
@@ -2944,6 +3067,14 @@ var SysJwks = data.ObjectSchema.create({
   icon: "key",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Asymmetric key pairs used to sign and verify issued JWTs",
   compactLayout: ["id", "created_at", "expires_at"],
   fields: {