feat(apps): wire Setup/Studio/Account app packages into dev+serve; drop from plugin-auth (ADR-0048)

⚠️ BOOT-CRITICAL — verify with a live `os dev` (and `os serve`) boot before merge.

Completes the ADR-0048 app split:
- plugin-auth's manifest no longer registers `apps: [SETUP_APP, STUDIO_APP,
  ACCOUNT_APP]` nor `navigationContributions: SETUP_NAV_CONTRIBUTIONS`; it keeps
  only the auth objects + their detail pages.
- dev-plugin.ts and cli `serve.ts` now register the three new app packages
  (best-effort dynamic import, skipped if not installed) right after AuthPlugin,
  so each app publishes under its own package id (com.objectstack.{setup,studio,
  account}) and `/apps/<packageId>` resolves unambiguously.
- plugin-dev + cli declare the three app packages as workspace deps.

The AppSchemas still physically live in @objectstack/platform-objects/apps
(the new packages import them); moving the definitions in is a later non-behavioral
cleanup. Verified statically: all packages build, plugin-dev/cli typecheck clean,
plugin-auth (114) + platform-objects (55) tests pass. NOT runtime-boot-verified.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: os-zhuang

packages/cli/package.json

@@ -59,6 +59,8 @@
     "@objectstack/plugin-audit": "workspace:*",
     "@objectstack/plugin-auth": "workspace:*",
     "@objectstack/plugin-email": "workspace:*",
+    "@objectstack/setup": "workspace:*",
+    "@objectstack/studio": "workspace:*",
     "@objectstack/plugin-hono-server": "workspace:*",
     "@objectstack/mcp": "workspace:*",
     "@objectstack/plugin-org-scoping": "workspace:*",

packages/cli/src/commands/serve.ts

@@ -1176,6 +1176,23 @@ export default class Serve extends Command {
             }));
             trackPlugin('Auth');
 
+            // ADR-0048 — the platform apps (Setup/Studio/Account) moved out of
+            // plugin-auth's manifest into their own one-app packages. Register
+            // each after AuthPlugin (best-effort; skipped if not installed).
+            for (const [appPkg, factory] of [
+              ['@objectstack/setup', 'createSetupAppPlugin'],
+              ['@objectstack/studio', 'createStudioAppPlugin'],
+              ['@objectstack/account', 'createAccountAppPlugin'],
+            ] as const) {
+              try {
+                const appMod: any = await import(/* webpackIgnore: true */ appPkg);
+                await kernel.use(appMod[factory]());
+                trackPlugin(appPkg);
+              } catch {
+                // best-effort — the app package is optional
+              }
+            }
+
             // Pair: OrgScopingPlugin (multi-tenant) — optional, must register BEFORE SecurityPlugin
             // OrgScopingPlugin provides `organization_id` auto-stamp, per-org
             // seed-replay, and default-org bootstrap. SecurityPlugin probes

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -4,10 +4,8 @@ import { Plugin, PluginContext, IHttpServer } from '@objectstack/core';
 import type { BetterAuthOptions } from 'better-auth';
 import { AuthConfig, type SocialProviderConfig, SystemObjectName, SystemUserId } from '@objectstack/spec/system';
 import {
-  SETUP_APP,
-  SETUP_NAV_CONTRIBUTIONS,
-  STUDIO_APP,
-  ACCOUNT_APP,
+  // ADR-0048 — the Setup/Studio/Account apps moved to their own packages
+  // (@objectstack/{setup,studio,account}); plugin-auth no longer registers them.
   SystemOverviewDashboard,
   SystemOverviewDatasets,
 } from '@objectstack/platform-objects/apps';
@@ -180,15 +178,10 @@ export class AuthPlugin implements Plugin {
         ? { defaultDatasource: this.options.manifestDatasource }
         : {}),
       objects: authIdentityObjects,
-      // The platform Setup App is a static metadata artifact (lives in
-      // @objectstack/platform-objects/apps). plugin-auth is the natural
-      // owner of its registration since it loads first among the trio
-      // (auth + security + audit) that supplies the underlying objects.
-      apps: [SETUP_APP, STUDIO_APP, ACCOUNT_APP],
-      // ADR-0029 D7 — the Setup App is a shell of group anchors; its entries
-      // for platform-objects-owned objects are contributed here. Capability
-      // plugins (e.g. plugin-webhooks) contribute their own slots' entries.
-      navigationContributions: SETUP_NAV_CONTRIBUTIONS,
+      // ADR-0048 — Setup/Studio/Account apps (and the Setup nav contributions)
+      // moved to their own one-app packages (@objectstack/{setup,studio,account}),
+      // each registering under its own package id so /apps/<packageId> resolves
+      // unambiguously. plugin-auth keeps only the auth objects + their pages.
       // Slotted record-detail pages for system objects — currently
       // sys_organization gets a Members / Invitations / Teams tab strip
       // (see SysOrganizationDetailPage for the rationale and the

packages/plugins/plugin-dev/package.json

@@ -20,9 +20,12 @@
     "@objectstack/core": "workspace:*",
     "@objectstack/spec": "workspace:*",
     "@objectstack/types": "workspace:*",
+    "@objectstack/account": "workspace:^",
     "@objectstack/driver-memory": "workspace:^",
     "@objectstack/objectql": "workspace:^",
     "@objectstack/plugin-auth": "workspace:^",
+    "@objectstack/setup": "workspace:^",
+    "@objectstack/studio": "workspace:^",
     "@objectstack/plugin-hono-server": "workspace:^",
     "@objectstack/plugin-org-scoping": "workspace:^",
     "@objectstack/plugin-security": "workspace:^",

packages/plugins/plugin-dev/src/dev-plugin.ts

@@ -548,6 +548,23 @@ export class DevPlugin implements Plugin {
       } catch {
         ctx.logger.warn('  ✘ @objectstack/plugin-auth not installed — skipping auth');
       }
+
+      // ADR-0048 — the platform apps (Setup/Studio/Account) moved out of
+      // plugin-auth's manifest into their own one-app packages. Register each
+      // after AuthPlugin so they load alongside the auth objects they navigate.
+      for (const spec of [
+        ['@objectstack/setup', 'createSetupAppPlugin'],
+        ['@objectstack/studio', 'createStudioAppPlugin'],
+        ['@objectstack/account', 'createAccountAppPlugin'],
+      ] as const) {
+        try {
+          const mod: any = await import(/* @vite-ignore */ spec[0]);
+          this.childPlugins.push(mod[spec[1]]());
+          ctx.logger.info(`  ✔ App package enabled (${spec[0]})`);
+        } catch {
+          ctx.logger.warn(`  ✘ ${spec[0]} not installed — skipping its app`);
+        }
+      }
     }
 
     // 5. Security Plugin (RBAC, RLS, field-level masking)