feat: add namespace property to ObjectSchema with tableName auto-derivation, extend SystemObjectName with all system objects, create sys-namespaced object definitions across plugin-auth/plugin-security/plugin-audit

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

packages/metadata/src/objects/sys-metadata.object.ts

@@ -15,7 +15,8 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
  * @see MetadataRecordSchema in metadata-persistence.zod.ts
  */
 export const SysMetadataObject = ObjectSchema.create({
-  name: 'sys_metadata',
+  namespace: 'sys',
+  name: 'metadata',
   label: 'System Metadata',
   pluralLabel: 'System Metadata',
   icon: 'settings',

packages/plugins/plugin-audit/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "@objectstack/plugin-audit",
+  "version": "3.2.5",
+  "license": "Apache-2.0",
+  "description": "Audit Plugin for ObjectStack — System audit log object and audit trail",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsup --config ../../../tsup.config.ts",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@objectstack/spec": "workspace:*"
+  },
+  "devDependencies": {
+    "@types/node": "^25.3.5",
+    "typescript": "^5.0.0",
+    "vitest": "^4.0.18"
+  }
+}

packages/plugins/plugin-audit/src/index.ts

@@ -0,0 +1,11 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * @objectstack/plugin-audit
+ *
+ * Audit Plugin for ObjectStack
+ * Provides the sys_audit_log system object definition for immutable audit trails.
+ */
+
+// System Object Definitions (sys namespace)
+export { SysAuditLog } from './objects/index.js';

packages/plugins/plugin-audit/src/objects/index.ts

@@ -0,0 +1,9 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * Audit Plugin — System Object Definitions (sys namespace)
+ *
+ * Canonical ObjectSchema definitions for audit-related system objects.
+ */
+
+export { SysAuditLog } from './sys-audit-log.object.js';

packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts

@@ -0,0 +1,115 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { ObjectSchema, Field } from '@objectstack/spec/data';
+
+/**
+ * sys_audit_log — System Audit Log Object
+ *
+ * Immutable audit trail for all significant platform events.
+ * Records who did what, when, and the before/after state.
+ *
+ * @namespace sys
+ */
+export const SysAuditLog = ObjectSchema.create({
+  namespace: 'sys',
+  name: 'audit_log',
+  label: 'Audit Log',
+  pluralLabel: 'Audit Logs',
+  icon: 'scroll-text',
+  isSystem: true,
+  description: 'Immutable audit trail for platform events',
+  titleFormat: '{action} on {object_name} by {user_id}',
+  compactLayout: ['action', 'object_name', 'user_id', 'created_at'],
+  
+  fields: {
+    id: Field.text({
+      label: 'Audit Log ID',
+      required: true,
+      readonly: true,
+    }),
+    
+    created_at: Field.datetime({
+      label: 'Timestamp',
+      required: true,
+      defaultValue: 'NOW()',
+      readonly: true,
+    }),
+    
+    user_id: Field.text({
+      label: 'User ID',
+      required: false,
+      description: 'User who performed the action (null for system actions)',
+    }),
+    
+    action: Field.select(['create', 'update', 'delete', 'restore', 'login', 'logout', 'permission_change', 'config_change', 'export', 'import'], {
+      label: 'Action',
+      required: true,
+    }),
+    
+    object_name: Field.text({
+      label: 'Object Name',
+      required: false,
+      maxLength: 255,
+      description: 'Target object (e.g. sys_user, project_task)',
+    }),
+    
+    record_id: Field.text({
+      label: 'Record ID',
+      required: false,
+      description: 'ID of the affected record',
+    }),
+    
+    old_value: Field.textarea({
+      label: 'Old Value',
+      required: false,
+      description: 'JSON-serialized previous state',
+    }),
+    
+    new_value: Field.textarea({
+      label: 'New Value',
+      required: false,
+      description: 'JSON-serialized new state',
+    }),
+    
+    ip_address: Field.text({
+      label: 'IP Address',
+      required: false,
+      maxLength: 45,
+    }),
+    
+    user_agent: Field.textarea({
+      label: 'User Agent',
+      required: false,
+    }),
+    
+    tenant_id: Field.text({
+      label: 'Tenant ID',
+      required: false,
+      description: 'Tenant context for multi-tenant isolation',
+    }),
+    
+    metadata: Field.textarea({
+      label: 'Metadata',
+      required: false,
+      description: 'JSON-serialized additional context',
+    }),
+  },
+  
+  indexes: [
+    { fields: ['created_at'] },
+    { fields: ['user_id'] },
+    { fields: ['object_name', 'record_id'] },
+    { fields: ['action'] },
+    { fields: ['tenant_id'] },
+  ],
+  
+  enable: {
+    trackHistory: false, // Audit logs are themselves the audit trail
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ['get', 'list'], // Read-only — audit logs are immutable
+    trash: false, // Never soft-delete audit logs
+    mru: false,
+    clone: false,
+  },
+});

packages/plugins/plugin-audit/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src"
+  },
+  "include": ["src/**/*"],
+  "exclude": ["dist", "node_modules", "**/*.test.ts"]
+}

packages/plugins/plugin-auth/src/objects/auth-account.object.ts

@@ -1,121 +1,7 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-import { ObjectSchema, Field } from '@objectstack/spec/data';
-
 /**
- * Auth Account Object
- * 
- * Uses better-auth's native schema for seamless migration:
- * - id: string
- * - created_at: Date
- * - updated_at: Date
- * - provider_id: string (e.g., 'google', 'github')
- * - account_id: string (provider's user ID)
- * - user_id: string (link to user table)
- * - access_token: string | null
- * - refresh_token: string | null
- * - id_token: string | null
- * - access_token_expires_at: Date | null
- * - refresh_token_expires_at: Date | null
- * - scope: string | null
- * - password: string | null (for email/password provider)
+ * @deprecated Use `SysAccount` from `./sys-account.object` instead.
+ *             This re-export is kept for backward compatibility.
  */
-export const AuthAccount = ObjectSchema.create({
-  name: 'sys_account',
-  label: 'Account',
-  pluralLabel: 'Accounts',
-  icon: 'link',
-  description: 'OAuth and authentication provider accounts',
-  titleFormat: '{provider_id} - {account_id}',
-  compactLayout: ['provider_id', 'user_id', 'account_id'],
-  
-  fields: {
-    id: Field.text({
-      label: 'Account ID',
-      required: true,
-      readonly: true,
-    }),
-    
-    created_at: Field.datetime({
-      label: 'Created At',
-      defaultValue: 'NOW()',
-      readonly: true,
-    }),
-    
-    updated_at: Field.datetime({
-      label: 'Updated At',
-      defaultValue: 'NOW()',
-      readonly: true,
-    }),
-    
-    provider_id: Field.text({
-      label: 'Provider ID',
-      required: true,
-      description: 'OAuth provider identifier (google, github, etc.)',
-    }),
-    
-    account_id: Field.text({
-      label: 'Provider Account ID',
-      required: true,
-      description: "User's ID in the provider's system",
-    }),
-    
-    user_id: Field.text({
-      label: 'User ID',
-      required: true,
-      description: 'Link to user table',
-    }),
-    
-    access_token: Field.textarea({
-      label: 'Access Token',
-      required: false,
-    }),
-    
-    refresh_token: Field.textarea({
-      label: 'Refresh Token',
-      required: false,
-    }),
-    
-    id_token: Field.textarea({
-      label: 'ID Token',
-      required: false,
-    }),
-    
-    access_token_expires_at: Field.datetime({
-      label: 'Access Token Expires At',
-      required: false,
-    }),
-    
-    refresh_token_expires_at: Field.datetime({
-      label: 'Refresh Token Expires At',
-      required: false,
-    }),
-    
-    scope: Field.text({
-      label: 'OAuth Scope',
-      required: false,
-    }),
-    
-    password: Field.text({
-      label: 'Password Hash',
-      required: false,
-      description: 'Hashed password for email/password provider',
-    }),
-  },
-  
-  // Database indexes for performance
-  indexes: [
-    { fields: ['user_id'], unique: false },
-    { fields: ['provider_id', 'account_id'], unique: true },
-  ],
-  
-  // Enable features
-  enable: {
-    trackHistory: false,
-    searchable: false,
-    apiEnabled: true,
-    apiMethods: ['get', 'list', 'create', 'update', 'delete'],
-    trash: true,
-    mru: false,
-  },
-});
+export { SysAccount as AuthAccount } from './sys-account.object.js';