@objectstack/platform-objects 9.2.0 → 9.3.0

package/dist/index.mjs

@@ -4554,15 +4554,9 @@ var SETUP_NAV_CONTRIBUTIONS = [
       { id: "nav_system_overview", type: "dashboard", label: "System Overview", dashboardName: "system_overview", icon: "activity" }
     ]
   },
-  {
-    app: "setup",
-    group: "group_apps",
-    priority: BASE_PRIORITY,
-    items: [
-      { id: "nav_marketplace_browse", type: "url", label: "Browse Marketplace", url: "/apps/setup/system/marketplace", icon: "store" },
-      { id: "nav_marketplace_installed", type: "url", label: "Installed Apps", url: "/apps/setup/system/marketplace/installed", icon: "package-check", requiresObject: "sys_package_installation" }
-    ]
-  },
+  // No group_apps contribution left here — both marketplace entries moved
+  // out (see header note); the group_apps shell anchor in setup.app.ts is
+  // filled entirely by capability plugins now.
   {
     app: "setup",
     group: "group_people_org",
@@ -4641,6 +4635,15 @@ var STUDIO_APP = {
   icon: "hammer",
   active: true,
   isDefault: false,
+  // ADR-0010 §3.7 — author-facing protection block. Loader translates
+  // this into the `_lock` envelope at registration time. Same rationale
+  // as Setup: tenant overlay edits to the metadata workbench can lock
+  // implementers out of the very surface used to repair metadata.
+  protection: {
+    lock: "full",
+    reason: "Core developer workbench shipped by @objectstack/platform-objects \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   // Studio is the metadata-authoring host, so its ambient copilot is
   // pinned to the schema-architect agent. Resolved by the ambient chat
   // endpoint via `app.defaultAgent` — no UI-side `?agent=` override
@@ -4932,6 +4935,16 @@ var ACCOUNT_APP = {
   isDefault: false,
   // Surface via the avatar dropdown, not the App Switcher — see App.hidden.
   hidden: true,
+  // ADR-0010 §3.7 — author-facing protection block. Loader translates
+  // this into the `_lock` envelope at registration time. Every
+  // authenticated user depends on this app to manage their own
+  // sessions / API keys / linked accounts, so a tenant overlay that
+  // breaks it is a security-relevant outage — same class as Setup.
+  protection: {
+    lock: "full",
+    reason: "Core self-service security UI shipped by @objectstack/platform-objects \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   branding: {
     primaryColor: "#0ea5e9"
     // sky-500 — distinct from Setup's slate