@objectstack/runtime 9.11.0 → 10.0.0

package/dist/index.d.cts

@@ -117,6 +117,19 @@ interface StandaloneStackResult {
     requires?: string[];
     objects?: any[];
     manifest?: any;
+    /**
+     * App-declared RBAC metadata, surfaced so the CLI (`serve`/`dev`/`start`)
+     * can wire it without a host `objectstack.config.ts`. In particular the
+     * `serve` command reads `permissions[]` to honour an app-declared default
+     * profile (ADR-0056 D7 — `appDefaultProfileName` → SecurityPlugin
+     * `fallbackPermissionSet`) and reads both `roles[]` and `permissions[]` to
+     * register application org roles with Better-Auth. Without these the
+     * artifact-serve path silently fell back to the built-in `member_default`
+     * (owner-only), so an `isDefault` profile declared purely in app metadata
+     * was ignored under `objectstack dev`.
+     */
+    permissions?: any[];
+    roles?: any[];
 }
 declare function createStandaloneStack(config?: StandaloneStackConfig): Promise<StandaloneStackResult>;
 

package/dist/index.d.ts

@@ -117,6 +117,19 @@ interface StandaloneStackResult {
     requires?: string[];
     objects?: any[];
     manifest?: any;
+    /**
+     * App-declared RBAC metadata, surfaced so the CLI (`serve`/`dev`/`start`)
+     * can wire it without a host `objectstack.config.ts`. In particular the
+     * `serve` command reads `permissions[]` to honour an app-declared default
+     * profile (ADR-0056 D7 — `appDefaultProfileName` → SecurityPlugin
+     * `fallbackPermissionSet`) and reads both `roles[]` and `permissions[]` to
+     * register application org roles with Better-Auth. Without these the
+     * artifact-serve path silently fell back to the built-in `member_default`
+     * (owner-only), so an `isDefault` profile declared purely in app metadata
+     * was ignored under `objectstack dev`.
+     */
+    permissions?: any[];
+    roles?: any[];
 }
 declare function createStandaloneStack(config?: StandaloneStackConfig): Promise<StandaloneStackResult>;
 

package/dist/index.js

@@ -963,6 +963,35 @@ var init_app_plugin = __esm({
               error: err?.message ?? String(err)
             });
           }
+          try {
+            const metadata = ctx.getService("metadata");
+            if (typeof metadata?.registerInMemory === "function") {
+              const securityBundle = this.bundle.manifest ? { ...this.bundle.manifest, ...this.bundle } : this.bundle;
+              const SECURITY_FIELDS = [
+                ["roles", "role"],
+                ["permissions", "permission"],
+                ["sharingRules", "sharing_rule"],
+                ["policies", "policy"]
+              ];
+              let count = 0;
+              for (const [field, type] of SECURITY_FIELDS) {
+                const arr = securityBundle?.[field];
+                if (!Array.isArray(arr)) continue;
+                for (const item of arr) {
+                  if (!item?.name) continue;
+                  metadata.registerInMemory(type, item.name, item);
+                  count += 1;
+                }
+              }
+              if (count > 0) {
+                ctx.logger.info("Registered stack-declared security metadata", { appId, count });
+              }
+            }
+          } catch (err) {
+            ctx.logger.warn("[AppPlugin] failed to register security metadata", {
+              error: err?.message ?? String(err)
+            });
+          }
           const stackBundle = this.bundle.default || this.bundle;
           const runtime = stackBundle && typeof stackBundle.onEnable === "function" ? stackBundle : this.bundle;
           if (runtime && typeof runtime.onEnable === "function") {
@@ -1587,6 +1616,8 @@ async function createStandaloneStack(config) {
   const requires = Array.isArray(artifactBundle?.requires) ? artifactBundle.requires.filter((c) => typeof c === "string") : void 0;
   const objects = Array.isArray(artifactBundle?.objects) ? artifactBundle.objects : void 0;
   const manifest = artifactBundle?.manifest;
+  const permissions = Array.isArray(artifactBundle?.permissions) ? artifactBundle.permissions : void 0;
+  const roles = Array.isArray(artifactBundle?.roles) ? artifactBundle.roles : void 0;
   return {
     plugins,
     api: {
@@ -1595,7 +1626,9 @@ async function createStandaloneStack(config) {
     },
     ...requires ? { requires } : {},
     ...objects ? { objects } : {},
-    ...manifest ? { manifest } : {}
+    ...manifest ? { manifest } : {},
+    ...permissions ? { permissions } : {},
+    ...roles ? { roles } : {}
   };
 }
 var StandaloneStackConfigSchema;
@@ -1997,25 +2030,33 @@ function coerceLocale(value) {
   const s = typeof value === "string" ? value.trim() : value != null ? String(value).trim() : "";
   return s || void 0;
 }
+function coerceCurrency(value) {
+  const s = typeof value === "string" ? value.trim().toUpperCase() : "";
+  return /^[A-Z]{3}$/.test(s) ? s : void 0;
+}
 async function resolveLocalization(opts, ql, sctx) {
   try {
     const settings = await opts.getService("settings");
     if (settings && typeof settings.get === "function") {
-      const [tzRes, localeRes] = await Promise.all([
+      const [tzRes, localeRes, currencyRes] = await Promise.all([
         settings.get("localization", "timezone", sctx).catch(() => void 0),
-        settings.get("localization", "locale", sctx).catch(() => void 0)
+        settings.get("localization", "locale", sctx).catch(() => void 0),
+        settings.get("localization", "currency", sctx).catch(() => void 0)
       ]);
       const tz = coerceTimeZone(tzRes?.value);
       const locale = coerceLocale(localeRes?.value);
-      if (tz || locale) return { timezone: tz ?? "UTC", locale: locale ?? "en-US" };
+      const currency = coerceCurrency(currencyRes?.value);
+      if (tz || locale || currency) return { timezone: tz ?? "UTC", locale: locale ?? "en-US", currency };
     }
   } catch {
   }
   const tzRows = await tryFind(ql, "sys_setting", { namespace: "localization", key: "timezone", scope: "tenant" }, 1);
   const localeRows = await tryFind(ql, "sys_setting", { namespace: "localization", key: "locale", scope: "tenant" }, 1);
+  const currencyRows = await tryFind(ql, "sys_setting", { namespace: "localization", key: "currency", scope: "tenant" }, 1);
   return {
     timezone: coerceTimeZone(tzRows[0]?.value) ?? "UTC",
-    locale: coerceLocale(localeRows[0]?.value) ?? "en-US"
+    locale: coerceLocale(localeRows[0]?.value) ?? "en-US",
+    currency: coerceCurrency(currencyRows[0]?.value)
   };
 }
 async function resolveExecutionContext(opts) {
@@ -2070,6 +2111,13 @@ async function resolveExecutionContext(opts) {
       }
     }
   }
+  const userRoleRows = await tryFind(ql, "sys_user_role", { user_id: userId }, 200);
+  for (const ur of userRoleRows) {
+    const org = ur.organization_id ?? null;
+    if (org && tenantId && org !== tenantId) continue;
+    const r = ur.role;
+    if (typeof r === "string" && r && !ctx.roles.includes(r)) ctx.roles.push(r);
+  }
   if (tenantId) {
     const orgMembers = await tryFind(
       ql,
@@ -2156,6 +2204,7 @@ async function resolveExecutionContext(opts) {
   const localization = await resolveLocalization(opts, ql, { tenantId, userId });
   ctx.timezone = localization.timezone;
   ctx.locale = localization.locale;
+  if (localization.currency) ctx.currency = localization.currency;
   return ctx;
 }
 function isPermissionDeniedError(e) {