fix(apps): app plugins depend on AuthPlugin by plugin name, not package id (ADR-0048)

Live `os dev` boot surfaced: `Dependency 'com.objectstack.plugin-auth' not found
for plugin 'com.objectstack.setup'`. The kernel matches plugin `dependencies` by
plugin NAME — AuthPlugin's name is `com.objectstack.auth`, while its package id is
`com.objectstack.plugin-auth`. Point the class-level dependency at the plugin name
(`com.objectstack.auth`); the manifest-level dependency stays the package id.

Adds packages/cli/src/adr-0048-app-split.test.ts: boots a real ObjectQL engine,
runs each app plugin's start(), asserts setup/studio/account register under their
own package ids and coexist.

VERIFIED end-to-end: `os dev` (app-showcase) boots clean and /api/v1/meta/app
reports setup→com.objectstack.setup, studio→com.objectstack.studio,
account→com.objectstack.account (previously all com.objectstack.plugin-auth).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: os-zhuang

packages/apps/account/src/index.ts

@@ -45,7 +45,9 @@ export class AccountAppPlugin {
   readonly name = ACCOUNT_APP_PACKAGE_ID;
   readonly type = 'standard';
   readonly version = ACCOUNT_APP_VERSION;
-  readonly dependencies: string[] = ['com.objectstack.plugin-auth'];
+  // Kernel plugin dependency is matched by plugin NAME (AuthPlugin.name =
+  // 'com.objectstack.auth'), not by package id.
+  readonly dependencies: string[] = ['com.objectstack.auth'];
 
   async init(_ctx: any): Promise<void> {
     // No-op: registration happens in start() once the manifest service exists.

packages/apps/setup/src/index.ts

@@ -41,7 +41,9 @@ export class SetupAppPlugin {
   readonly name = SETUP_APP_PACKAGE_ID;
   readonly type = 'standard';
   readonly version = SETUP_APP_VERSION;
-  readonly dependencies: string[] = ['com.objectstack.plugin-auth'];
+  // Kernel plugin dependency is matched by plugin NAME (AuthPlugin.name =
+  // 'com.objectstack.auth'), not by package id.
+  readonly dependencies: string[] = ['com.objectstack.auth'];
 
   async init(_ctx: any): Promise<void> {
     // No-op: registration happens in start() once the manifest service exists.

packages/apps/studio/src/index.ts

@@ -48,7 +48,9 @@ export class StudioAppPlugin {
   readonly name = STUDIO_APP_PACKAGE_ID;
   readonly type = 'standard';
   readonly version = STUDIO_APP_VERSION;
-  readonly dependencies: string[] = ['com.objectstack.plugin-auth'];
+  // Kernel plugin dependency is matched by plugin NAME (AuthPlugin.name =
+  // 'com.objectstack.auth'), not by package id.
+  readonly dependencies: string[] = ['com.objectstack.auth'];
 
   async init(_ctx: any): Promise<void> {
     // No-op: registration happens in start() once the manifest service exists.

packages/cli/src/adr-0048-app-split.test.ts

@@ -0,0 +1,78 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * ADR-0048 — end-to-end verification that the platform apps now live in their
+ * own one-app packages and register under DISTINCT package ids.
+ *
+ * Boots a real ObjectQL engine, runs each app package's plugin `start()` against
+ * a manifest service backed by `engine.registerApp` (exactly what the kernel
+ * wires — see objectql plugin.ts: `register(m) => ql.registerApp(m)`), and
+ * asserts each app resolves under `com.objectstack.{studio,setup,account}` and
+ * that all three coexist (the multi-app-package ambiguity is gone).
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { ObjectQL } from '@objectstack/objectql';
+import { createStudioAppPlugin } from '@objectstack/studio';
+import { createSetupAppPlugin } from '@objectstack/setup';
+import { createAccountAppPlugin } from '@objectstack/account';
+
+function makeCtx(engine: ObjectQL) {
+  return {
+    getService: (name: string) =>
+      name === 'manifest' ? { register: (m: any) => engine.registerApp(m) } : undefined,
+    registerService: () => {},
+    getServices: () => new Map(),
+    logger: { info: () => {}, warn: () => {}, error: () => {}, debug: () => {} },
+    hook: () => {},
+  } as any;
+}
+
+describe('ADR-0048 — platform apps as one-app packages', () => {
+  let engine: ObjectQL;
+
+  beforeEach(async () => {
+    engine = new ObjectQL();
+    engine.registry.logLevel = 'silent';
+    const ctx = makeCtx(engine);
+    for (const plugin of [createSetupAppPlugin(), createStudioAppPlugin(), createAccountAppPlugin()]) {
+      await plugin.init?.(ctx);
+      await plugin.start(ctx);
+    }
+  });
+
+  it('registers each app under its OWN package id', () => {
+    expect(engine.registry.getItem<any>('app', 'studio', 'com.objectstack.studio')?._packageId).toBe(
+      'com.objectstack.studio',
+    );
+    expect(engine.registry.getItem<any>('app', 'setup', 'com.objectstack.setup')?._packageId).toBe(
+      'com.objectstack.setup',
+    );
+    expect(engine.registry.getItem<any>('app', 'account', 'com.objectstack.account')?._packageId).toBe(
+      'com.objectstack.account',
+    );
+  });
+
+  it('all three apps coexist and resolve by name (getApp)', () => {
+    expect(engine.registry.getApp('studio')?.name).toBe('studio');
+    expect(engine.registry.getApp('setup')?.name).toBe('setup');
+    expect(engine.registry.getApp('account')?.name).toBe('account');
+  });
+
+  it('each app package owns a distinct namespace (no install-gate conflict)', () => {
+    expect(engine.registry.getNamespaceOwners('studio')).toEqual(['com.objectstack.studio']);
+    expect(engine.registry.getNamespaceOwners('setup')).toEqual(['com.objectstack.setup']);
+    expect(engine.registry.getNamespaceOwners('account')).toEqual(['com.objectstack.account']);
+  });
+
+  it('records all three as installed packages', () => {
+    const ids = engine.registry.getAllPackages().map((p: any) => p.manifest.id);
+    expect(ids).toEqual(
+      expect.arrayContaining([
+        'com.objectstack.studio',
+        'com.objectstack.setup',
+        'com.objectstack.account',
+      ]),
+    );
+  });
+});