feat(platform-objects): add user_app_state object for @object-ui UI persistence

@object-ui app-shell calls dataSource.find('user_app_state', { filter: { user_id, kind }, limit: 1 }) to persist per-user UI state (grid columns, sidebar collapsed, last-opened tab, etc.). The resource name 'user_app_state' is hard-coded as the default in app-shell, so environments without this object were returning 404 to every Console session.

- New ObjectSchema 'user_app_state' (unprefixed to match the @object-ui default) registered via plugin-auth's authIdentityObjects list, so every env that uses plugin-auth (cloud control + every artifact env via ArtifactKernelFactory) gets it automatically.
- Member RLS carve-out 'user_app_state_self' filters by user_id = current_user.id, mirroring sys_user_preference_self. The wildcard tenant_isolation policy would otherwise DENY because user_app_state has no organization_id (it's a per-user blob, not per-tenant).
- Test updated to include the new policy name and the new system object.

Fixes 404 on https://crm.objectos.app/api/v1/data/user_app_state and any other env reported by users.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

packages/platform-objects/src/identity/index.ts

@@ -28,6 +28,7 @@ export { SysApiKey } from './sys-api-key.object.js';
 export { SysTwoFactor } from './sys-two-factor.object.js';
 export { SysDeviceCode } from './sys-device-code.object.js';
 export { SysUserPreference } from './sys-user-preference.object.js';
+export { UserAppState } from './user-app-state.object.js';
 
 // ── OIDC Provider Objects ──────────────────────────────────────────────────
 export { SysOauthApplication } from './sys-oauth-application.object.js';

packages/platform-objects/src/identity/user-app-state.object.ts

@@ -0,0 +1,92 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { ObjectSchema, Field } from '@objectstack/spec/data';
+
+/**
+ * user_app_state — Per-user UI app state (set by @object-ui).
+ *
+ * Backs the `@object-ui/app-shell` "persistent user state" hook that
+ * stores per-user, per-kind blobs of UI state (e.g. column widths,
+ * sidebar collapsed/expanded, last-opened tab) so the Console / any
+ * @object-ui surface can remember where the user left off.
+ *
+ * Contract (consumed by `@object-ui/app-shell` and friends):
+ *   - load(): `find('user_app_state', { filter: { user_id, kind }, limit: 1 })`
+ *   - save(): `create({ user_id, kind, payload, updated_at })` or
+ *             `update(id, { payload, updated_at })`
+ *
+ * The object name is intentionally unprefixed (`user_app_state`, not
+ * `sys_user_app_state`) because `@object-ui` hard-codes the resource
+ * name as a default; renaming would require every consumer to pass an
+ * explicit `resource` override.
+ *
+ * This is a *system* object — registered automatically with every
+ * environment by `@objectstack/platform-objects` so the Console works
+ * out of the box on a fresh env without the user having to install
+ * anything. Per-user RLS is enforced by the standard owner-row policy
+ * (`user_id` must equal the calling session's user id) — added in a
+ * follow-up commit once the policy is finalised.
+ */
+export const UserAppState = ObjectSchema.create({
+  name: 'user_app_state',
+  label: 'User App State',
+  pluralLabel: 'User App State',
+  icon: 'settings',
+  isSystem: true,
+  managedBy: 'system',
+  description: 'Per-user UI app state blobs (set by @object-ui app-shell).',
+  titleFormat: '{kind}',
+  compactLayout: ['user_id', 'kind'],
+
+  fields: {
+    id: Field.text({
+      label: 'State ID',
+      required: true,
+      readonly: true,
+    }),
+
+    created_at: Field.datetime({
+      label: 'Created At',
+      defaultValue: 'NOW()',
+      readonly: true,
+    }),
+
+    updated_at: Field.datetime({
+      label: 'Updated At',
+      defaultValue: 'NOW()',
+      readonly: true,
+    }),
+
+    user_id: Field.lookup('sys_user', {
+      label: 'User',
+      required: true,
+      description: 'Owner user of this app-state blob.',
+    }),
+
+    kind: Field.text({
+      label: 'Kind',
+      required: true,
+      maxLength: 255,
+      description: 'State discriminator (e.g. grid-state:account, sidebar).',
+    }),
+
+    payload: Field.json({
+      label: 'Payload',
+      description: 'Arbitrary JSON payload — the saved UI state blob.',
+    }),
+  },
+
+  indexes: [
+    { fields: ['user_id', 'kind'], unique: true },
+    { fields: ['user_id'], unique: false },
+  ],
+
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ['get', 'list', 'create', 'update', 'delete'],
+    trash: false,
+    mru: false,
+  },
+});

packages/platform-objects/src/platform-objects.test.ts

@@ -14,6 +14,7 @@ import {
   SysUser,
   SysUserPreference,
   SysVerification,
+  UserAppState,
 } from './identity/index.js';
 import {
   SysPermissionSet,
@@ -43,6 +44,7 @@ const systemObjects = [
   ['SysApiKey', SysApiKey, 'sys_api_key'],
   ['SysTwoFactor', SysTwoFactor, 'sys_two_factor'],
   ['SysUserPreference', SysUserPreference, 'sys_user_preference'],
+  ['UserAppState', UserAppState, 'user_app_state'],
   ['SysRole', SysRole, 'sys_role'],
   ['SysPermissionSet', SysPermissionSet, 'sys_permission_set'],
   ['SysUserPermissionSet', SysUserPermissionSet, 'sys_user_permission_set'],
@@ -106,6 +108,7 @@ describe('@objectstack/platform-objects', () => {
         'sys_user_preference_self',
         'sys_user_self',
         'tenant_isolation',
+        'user_app_state_self',
       ]);
       const tenantPolicy = (member.rowLevelSecurity ?? []).find((p) => p.name === 'tenant_isolation')!;
       expect(tenantPolicy.using).toBe('organization_id = current_user.organization_id');

packages/platform-objects/src/security/default-permission-sets.ts

@@ -181,6 +181,12 @@ export const defaultPermissionSets: PermissionSet[] = [
         operation: 'all',
         using: 'user_id = current_user.id',
       },
+      {
+        name: 'user_app_state_self',
+        object: 'user_app_state',
+        operation: 'all',
+        using: 'user_id = current_user.id',
+      },
       {
         name: 'sys_api_key_self',
         object: 'sys_api_key',
@@ -280,6 +286,12 @@ export const defaultPermissionSets: PermissionSet[] = [
         operation: 'select',
         using: 'user_id = current_user.id',
       },
+      {
+        name: 'user_app_state_self',
+        object: 'user_app_state',
+        operation: 'select',
+        using: 'user_id = current_user.id',
+      },
       {
         name: 'sys_api_key_self',
         object: 'sys_api_key',

packages/plugins/plugin-auth/src/manifest.ts

@@ -27,6 +27,7 @@ import {
   SysUser,
   SysUserPreference,
   SysVerification,
+  UserAppState,
 } from '@objectstack/platform-objects/identity';
 
 export const AUTH_PLUGIN_ID = 'com.objectstack.plugin-auth';
@@ -46,6 +47,7 @@ export const authIdentityObjects: any[] = [
   SysApiKey,
   SysTwoFactor,
   SysUserPreference,
+  UserAppState,
   SysOauthApplication,
   SysOauthAccessToken,
   SysOauthRefreshToken,