refactor: remove SetupPlugin and related files, integrate static Setup App definition

- Deleted the SetupPlugin and its associated files, including README, CHANGELOG, and configuration.
- Integrated the static Setup App definition directly into the platform-objects package.
- Updated AIServicePlugin to utilize the new static Setup App for navigation entries.
- Removed navigation contribution logic from AIServicePlugin and SecurityPlugin.
- Adjusted documentation and tests to reflect the removal of dynamic Setup navigation contributions.

Author: hotlong

apps/cloud/package.json

@@ -26,7 +26,6 @@
     "@objectstack/plugin-auth": "workspace:*",
     "@objectstack/plugin-hono-server": "workspace:*",
     "@objectstack/plugin-security": "workspace:*",
-    "@objectstack/plugin-setup": "workspace:*",
     "@objectstack/runtime": "workspace:*",
     "@objectstack/service-ai": "workspace:*",
     "@objectstack/service-analytics": "workspace:*",

apps/cloud/server/index.ts

@@ -55,26 +55,15 @@ async function bootKernel(): Promise<BootResult> {
     kernel.registerService('http.server', httpServer);
     kernel.registerService('http-server', httpServer); // alias for backward compatibility
 
-    // 1. SetupPlugin — must be registered BEFORE the control-plane preset
-    //    so that AuthPlugin / SecurityPlugin / AuditPlugin can resolve the
-    //    `setupNav` service during their own `init()` and contribute their
-    //    Setup-App navigation items. Without this ordering the deployed
-    //    `/api/v1/meta/app` would return a Setup app with empty `areas`
-    //    (no menu rendered in Studio).
-    try {
-        const setupPkg = '@objectstack/plugin-setup';
-        const { SetupPlugin } = await import(/* webpackIgnore: true */ setupPkg);
-        await kernel.use(new SetupPlugin());
-    } catch {
-        // optional
-    }
-
-    // 2. Config plugins (control-plane preset + MultiProjectPlugin + Auth/Security/Audit)
+    // 1. Config plugins (control-plane preset + MultiProjectPlugin + Auth/Security/Audit).
+    //    AuthPlugin registers the platform Setup App via its manifest
+    //    (definition lives in @objectstack/platform-objects/apps), so no
+    //    separate setup plugin is needed.
     for (const plugin of stackConfig.plugins ?? []) {
         await kernel.use(plugin as any);
     }
 
-    // 3. REST API + Dispatcher — consume the scoping config from stackConfig.api
+    // 2. REST API + Dispatcher — consume the scoping config from stackConfig.api
     const api = (stackConfig as any).api ?? {};
     try {
         await kernel.use(

apps/server/package.json

@@ -30,7 +30,6 @@
     "@objectstack/plugin-auth": "workspace:*",
     "@objectstack/plugin-hono-server": "workspace:*",
     "@objectstack/plugin-security": "workspace:*",
-    "@objectstack/plugin-setup": "workspace:*",
     "@objectstack/runtime": "workspace:*",
     "@objectstack/service-ai": "workspace:*",
     "@objectstack/service-analytics": "workspace:*",

apps/server/server/index.ts

@@ -55,23 +55,14 @@ async function bootKernel(): Promise<BootResult> {
     kernel.registerService('http.server', httpServer);
     kernel.registerService('http-server', httpServer); // alias for backward compatibility
 
-    // 1. Config plugins (control-plane preset + MultiProjectPlugin)
+    // 1. Config plugins (control-plane preset + MultiProjectPlugin + Auth/Security/Audit).
+    //    AuthPlugin registers the platform Setup App via its manifest
+    //    (definition lives in @objectstack/platform-objects/apps).
     for (const plugin of stackConfig.plugins ?? []) {
         await kernel.use(plugin as any);
     }
 
-    // 2. Optional SetupPlugin — provides the Studio's setup app. Same as
-    //    the CLI's auto-register path; kept here so the serverless bundle
-    //    is independently bootable.
-    try {
-        const setupPkg = '@objectstack/plugin-setup';
-        const { SetupPlugin } = await import(/* webpackIgnore: true */ setupPkg);
-        await kernel.use(new SetupPlugin());
-    } catch {
-        // optional
-    }
-
-    // 3. REST API + Dispatcher — consume the scoping config from stackConfig.api
+    // 2. REST API + Dispatcher — consume the scoping config from stackConfig.api
     const api = (stackConfig as any).api ?? {};
     try {
         await kernel.use(

apps/studio/package.json

@@ -40,7 +40,6 @@
     "@objectstack/plugin-auth": "workspace:*",
     "@objectstack/plugin-msw": "workspace:*",
     "@objectstack/plugin-security": "workspace:*",
-    "@objectstack/plugin-setup": "workspace:*",
     "@objectstack/runtime": "workspace:*",
     "@objectstack/service-ai": "workspace:*",
     "@objectstack/service-analytics": "workspace:*",

apps/studio/src/mocks/createKernel.ts

@@ -4,7 +4,6 @@ import { ObjectKernel, DriverPlugin, AppPlugin } from '@objectstack/runtime';
 import { ObjectQLPlugin } from '@objectstack/objectql';
 import { InMemoryDriver } from '@objectstack/driver-memory';
 import { MSWPlugin } from '@objectstack/plugin-msw';
-import { SetupPlugin } from '@objectstack/plugin-setup';
 import { AutomationServicePlugin } from '@objectstack/service-automation';
 import { AnalyticsServicePlugin } from '@objectstack/service-analytics';
 import { MetadataPlugin } from '@objectstack/metadata';
@@ -19,6 +18,7 @@ import {
 } from '@objectstack/platform-objects/identity';
 import { SysRole, SysPermissionSet } from '@objectstack/platform-objects/security';
 import { SysAuditLog } from '@objectstack/platform-objects/audit';
+import { SETUP_APP } from '@objectstack/platform-objects/apps';
 
 /** All system objects from auth, security, and audit plugins */
 const SYSTEM_OBJECTS = [
@@ -58,7 +58,9 @@ export async function createKernel(options: KernelOptions) {
     // Register the driver
     await kernel.use(new DriverPlugin(driver, 'memory'));
 
-    // Register system objects (auth, security, audit) as a built-in system package
+    // Register system objects (auth, security, audit) as a built-in system package.
+    // The Setup App (admin nav metadata) ships in the same package since the
+    // referenced sys_* objects all live here.
     const systemConfig = {
         name: 'system',
         manifest: {
@@ -69,6 +71,7 @@ export async function createKernel(options: KernelOptions) {
             namespace: 'sys',
         },
         objects: SYSTEM_OBJECTS,
+        apps: [SETUP_APP],
     };
     console.log('[KernelFactory] Loading system objects:', SYSTEM_OBJECTS.length);
     await kernel.use(new AppPlugin(systemConfig));
@@ -80,9 +83,6 @@ export async function createKernel(options: KernelOptions) {
     }
 
     // Register services and plugins
-    // SetupPlugin must load BEFORE other plugins that contribute navigation items
-    // so that the setupNav service is available during their init() phase
-    await kernel.use(new SetupPlugin());
     await kernel.use(new FeedServicePlugin());
     await kernel.use(new MetadataPlugin({ watch: false }));
     await kernel.use(new AIServicePlugin());

packages/cli/package.json

@@ -48,7 +48,6 @@
     "@objectstack/plugin-auth": "workspace:*",
     "@objectstack/plugin-hono-server": "workspace:*",
     "@objectstack/plugin-security": "workspace:*",
-    "@objectstack/plugin-setup": "workspace:*",
     "@objectstack/rest": "workspace:*",
     "@objectstack/runtime": "workspace:^",
     "@objectstack/service-ai": "workspace:*",

packages/cli/src/commands/serve.ts

@@ -336,23 +336,7 @@ export default class Serve extends Command {
         }
       }
 
-      // 5. Auto-register SetupPlugin BEFORE config plugins so that other
-      // plugins (e.g. AuthPlugin) can call setupNav.contribute() during init.
-      const hasSetupPlugin = plugins.some(
-        (p: any) => p.name === 'com.objectstack.setup' || p.constructor?.name === 'SetupPlugin'
-      );
-      if (!hasSetupPlugin) {
-        try {
-          const setupPkg = '@objectstack/plugin-setup';
-          const { SetupPlugin } = await import(/* webpackIgnore: true */ setupPkg);
-          await kernel.use(new SetupPlugin());
-          trackPlugin('Setup');
-        } catch {
-          // @objectstack/plugin-setup not installed — setup app unavailable
-        }
-      }
-
-      // 5a. Auto-register Studio single-project signal in dev mode.
+      // 5. Auto-register Studio single-project signal in dev mode.
       //
       // `objectstack dev` runs a vanilla user stack (e.g. examples/app-crm)
       // as a single project — there is no apps/cloud control plane and no

packages/platform-objects/package.json

@@ -35,6 +35,11 @@
       "types": "./dist/metadata/index.d.ts",
       "import": "./dist/metadata/index.mjs",
       "require": "./dist/metadata/index.js"
+    },
+    "./apps": {
+      "types": "./dist/apps/index.d.ts",
+      "import": "./dist/apps/index.mjs",
+      "require": "./dist/apps/index.js"
     }
   },
   "scripts": {

packages/platform-objects/src/apps/index.ts

@@ -0,0 +1,3 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+export { SETUP_APP } from './setup.app.js';