@objectstack/runtime 6.7.1 → 6.8.1

package/dist/index.d.cts

@@ -98,6 +98,7 @@ declare const StandaloneStackConfigSchema: z.ZodObject<{
     }>>;
     environmentId: z.ZodOptional<z.ZodString>;
     artifactPath: z.ZodOptional<z.ZodString>;
+    projectRoot: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type StandaloneStackConfig = z.input<typeof StandaloneStackConfigSchema>;
 interface StandaloneStackResult {

package/dist/index.d.ts

@@ -98,6 +98,7 @@ declare const StandaloneStackConfigSchema: z.ZodObject<{
     }>>;
     environmentId: z.ZodOptional<z.ZodString>;
     artifactPath: z.ZodOptional<z.ZodString>;
+    projectRoot: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type StandaloneStackConfig = z.input<typeof StandaloneStackConfigSchema>;
 interface StandaloneStackResult {

package/dist/index.js

@@ -2122,7 +2122,19 @@ var StandaloneStackConfigSchema = z.object({
   databaseAuthToken: z.string().optional(),
   databaseDriver: z.enum(["sqlite", "sqlite-wasm", "turso", "memory", "postgres", "mongodb"]).optional(),
   environmentId: z.string().optional(),
-  artifactPath: z.string().optional()
+  artifactPath: z.string().optional(),
+  /**
+   * Project root directory. When set (typically by the CLI after locating
+   * `objectstack.config.ts`), the default sqlite database is placed under
+   * `<projectRoot>/.objectstack/data/standalone.db` instead of the global
+   * `~/.objectstack/data/standalone.db`. This keeps per-project data
+   * scoped to the project folder so different examples / apps don't
+   * share a single database by accident.
+   *
+   * Explicit `databaseUrl` / `OS_DATABASE_URL` / `OS_HOME` still take
+   * precedence over this default.
+   */
+  projectRoot: z.string().optional()
 });
 function detectDriverFromUrl(dbUrl) {
   if (/^memory:\/\//i.test(dbUrl)) return "memory";
@@ -2147,7 +2159,7 @@ async function createStandaloneStack(config) {
   const environmentId = cfg.environmentId ?? process.env.OS_ENVIRONMENT_ID ?? "proj_local";
   const artifactPathInput = cfg.artifactPath ?? process.env.OS_ARTIFACT_PATH ?? resolvePath2(cwd, "dist/objectstack.json");
   const artifactPath = isHttpUrl(artifactPathInput) ? artifactPathInput : artifactPathInput.startsWith("/") ? artifactPathInput : resolvePath2(cwd, artifactPathInput);
-  const dbUrl = cfg.databaseUrl ?? process.env.OS_DATABASE_URL?.trim() ?? process.env.TURSO_DATABASE_URL?.trim() ?? `file:${resolvePath2(resolveObjectStackHome(), "data/standalone.db")}`;
+  const dbUrl = cfg.databaseUrl ?? process.env.OS_DATABASE_URL?.trim() ?? process.env.TURSO_DATABASE_URL?.trim() ?? (process.env.OS_HOME?.trim() ? `file:${resolvePath2(resolveObjectStackHome(), "data/standalone.db")}` : cfg.projectRoot ? `file:${resolvePath2(cfg.projectRoot, ".objectstack/data/standalone.db")}` : `file:${resolvePath2(resolveObjectStackHome(), "data/standalone.db")}`);
   const dbAuthToken = cfg.databaseAuthToken ?? process.env.OS_DATABASE_AUTH_TOKEN?.trim() ?? process.env.TURSO_AUTH_TOKEN?.trim();
   const explicitDriver = cfg.databaseDriver ?? process.env.OS_DATABASE_DRIVER?.trim();
   const dbDriver = explicitDriver ?? detectDriverFromUrl(dbUrl);
@@ -2365,6 +2377,13 @@ function toHeaders(input) {
   }
   return h;
 }
+function safeJsonParse2(s, fallback) {
+  try {
+    return JSON.parse(s);
+  } catch {
+    return fallback;
+  }
+}
 async function tryFind(ql, object, where, limit = 100) {
   if (!ql || typeof ql.find !== "function") return [];
   try {
@@ -2380,6 +2399,7 @@ async function resolveExecutionContext(opts) {
   const ctx = {
     roles: [],
     permissions: [],
+    systemPermissions: [],
     isSystem: false
   };
   let userId;
@@ -2488,10 +2508,38 @@ async function resolveExecutionContext(opts) {
       { id: { $in: Array.from(psIds) } },
       500
     );
+    const tabRank = {
+      hidden: 0,
+      default_off: 1,
+      default_on: 2,
+      visible: 3
+    };
+    const mergedTabs = {};
     for (const ps of psRows) {
       if (ps.name && !ctx.permissions.includes(ps.name)) {
         ctx.permissions.push(ps.name);
       }
+      const sysPerms = typeof ps.system_permissions === "string" ? safeJsonParse2(ps.system_permissions, []) : ps.system_permissions ?? ps.systemPermissions;
+      if (Array.isArray(sysPerms)) {
+        for (const p of sysPerms) {
+          if (typeof p === "string" && !ctx.systemPermissions.includes(p)) {
+            ctx.systemPermissions.push(p);
+          }
+        }
+      }
+      const tabs = typeof ps.tab_permissions === "string" ? safeJsonParse2(ps.tab_permissions, {}) : ps.tab_permissions ?? ps.tabPermissions;
+      if (tabs && typeof tabs === "object") {
+        for (const [app, val] of Object.entries(tabs)) {
+          if (typeof val !== "string" || !(val in tabRank)) continue;
+          const cur = mergedTabs[app];
+          if (!cur || tabRank[val] > tabRank[cur]) {
+            mergedTabs[app] = val;
+          }
+        }
+      }
+    }
+    if (Object.keys(mergedTabs).length > 0) {
+      ctx.tabPermissions = mergedTabs;
     }
   }
   return ctx;
@@ -3091,6 +3139,15 @@ var _HttpDispatcher = class _HttpDispatcher {
   async handleMetadata(path, _context, method, body, query) {
     const parts = path.replace(/^\/+/, "").split("/").filter(Boolean);
     if (parts[0] === "types") {
+      const protocol = await this.resolveService("protocol");
+      if (protocol && typeof protocol.getMetaTypes === "function") {
+        try {
+          const result = await protocol.getMetaTypes({});
+          return { handled: true, response: this.success(result) };
+        } catch (e) {
+          console.warn("[HttpDispatcher] protocol.getMetaTypes() failed:", e?.message);
+        }
+      }
       const metadataService = await this.resolveService("metadata", _context.environmentId);
       if (metadataService && typeof metadataService.getRegisteredTypes === "function") {
         try {
@@ -3100,11 +3157,6 @@ var _HttpDispatcher = class _HttpDispatcher {
           console.warn("[HttpDispatcher] MetadataService.getRegisteredTypes() failed:", e.message);
         }
       }
-      const protocol = await this.resolveService("protocol");
-      if (protocol && typeof protocol.getMetaTypes === "function") {
-        const result = await protocol.getMetaTypes({});
-        return { handled: true, response: this.success(result) };
-      }
       return { handled: true, response: this.success({ types: ["object", "app", "plugin"] }) };
     }
     if (parts.length >= 3 && parts[parts.length - 1] === "published" && (!method || method === "GET")) {
@@ -3252,6 +3304,14 @@ var _HttpDispatcher = class _HttpDispatcher {
       return { handled: true, response: this.error("Not found", 404) };
     }
     if (parts.length === 0) {
+      const protocol = await this.resolveService("protocol");
+      if (protocol && typeof protocol.getMetaTypes === "function") {
+        try {
+          const result = await protocol.getMetaTypes({});
+          return { handled: true, response: this.success(result) };
+        } catch {
+        }
+      }
       const metadataService = await this.resolveService("metadata", _context.environmentId);
       if (metadataService && typeof metadataService.getRegisteredTypes === "function") {
         try {
@@ -3260,11 +3320,6 @@ var _HttpDispatcher = class _HttpDispatcher {
         } catch {
         }
       }
-      const protocol = await this.resolveService("protocol");
-      if (protocol && typeof protocol.getMetaTypes === "function") {
-        const result = await protocol.getMetaTypes({});
-        return { handled: true, response: this.success(result) };
-      }
       return { handled: true, response: this.success({ types: ["object", "app", "plugin"] }) };
     }
     return { handled: false };
@@ -5842,6 +5897,9 @@ function mountRouteOnServer(route, server, routePath, securityHeaders) {
   } else if (m === "delete" && typeof server.delete === "function") {
     server.delete(routePath, handler);
     return true;
+  } else if (m === "patch" && typeof server.patch === "function") {
+    server.patch(routePath, handler);
+    return true;
   }
   return false;
 }