Glossary

A single canonical definition for each term used in this documentation.

Action

A named operation declared in metadata, invocable via REST (/api/v1/data/<object>/actions/<action>), buttons in the UI, or flow steps. Inherits the caller's permissions.

Adapter

A framework package that integrates ObjectStack with a host runtime — Express, Fastify, Hono, Next.js, Nuxt, SvelteKit, NestJS. Most ObjectOS deployments don't need one; ObjectOS bundles its own HTTP server.

AI seat

The unit ObjectOS is priced in, and the only billed seat in every edition. Viewers, app users who do not use the in-product AI, and developers building over MCP are free. See License & Pricing.

App

A bundle of objects + views + permissions presented as a single navigable application. Multiple apps can coexist in one runtime (e.g. CRM + Helpdesk + Setup).

Artifact

A compiled objectstack.json file. Self-contained, immutable description of an app — manifest, objects, views, apps, flows, permissions, translations. Produced by os compile. The thing ObjectOS actually executes.

Better Auth

The auth library powering @objectstack/plugin-auth. You don't configure Better Auth directly; the plugin wraps it.

Business ontology

Your app's definition — objects and fields, relations, actions, permissions, flows, and agent and tool definitions — as one executable, versioned whole: authored as typed ObjectStack metadata, validated rather than reasoned over, and run by the runtime, which derives the database, REST API, UI and MCP tools from it. Views, dashboards, apps and translations are projections of it, not part of it. It is yours on either ObjectOS edition: export it and run it on the open-source ObjectStack runtime. The full account is Business Ontology in the ObjectStack docs.

Capability

An optional runtime feature declared by an artifact in its requires list. Maps to a package — e.g. audit → @objectstack/plugin-audit. Loaded on demand by ObjectOS. See Runtime Capabilities.

CEL

Common Expression Language — Google's safe, sandboxed expression syntax. Used in formulas, validation rules, permission predicates, sharing rules, and flow conditions.

Control Plane

An optional service that publishes versioned artifacts to ObjectOS instances. Hosted as ObjectOS Cloud or self-hosted. Most deployments don't need one — file-backed mode works for single-app production.

Driver

A data backend implementation: driver-sql (Postgres, MySQL, SQLite, Turso/libSQL), driver-mongodb, driver-memory. Picked at boot via the database URL.

Embedder

The service that converts text to vectors for RAG / semantic search. Pluggable across providers (OpenAI, Azure, 硅基流动, Ollama, …). See AI Service.

Environment

A deployment's own identity — the id it reports as OS_ENVIRONMENT_ID, persisted once a cloud binding completes. A self-managed ObjectOS is a single-environment runtime: one process, one environment, one app. Holding many environments, and publishing an artifact for each, is what a control plane does. See Environment Variables.

Field

A typed property on an Object. ~48 built-in types: text, select, lookup, markdown, file, formula, summary, etc. See Data Model.

Flow

Declarative business logic — autolaunched (record trigger), scheduled (cron), or manual (button / API). Executes as a DAG with condition/loop/retry/parallel primitives. See Flows & Automation.

Formula field

A computed field whose value is a CEL expression evaluated at read time. Not stored.

Hook

A function injected into the object lifecycle (beforeInsert, afterUpdate, …). Authored in TypeScript. Different from a flow: hooks are first-class code; flows are metadata.

Kernel

The microkernel inside ObjectOS that loads plugins, holds the DI container, dispatches events, and serves the deployment's metadata. One process builds one kernel, during startup, and does not report ready until it is built — so nothing per request decides which metadata to serve.

Manifest

The top-level metadata at the head of an artifact: id, namespace, version, type (app / plugin / service), name, description, requires list.

Marketplace

The built-in catalog of installable apps. Backed by a configurable package registry. See Marketplace.

MCP (Model Context Protocol)

An open protocol for AI agents to discover and call tools. ObjectOS can expose its objects + actions as MCP via @objectstack/mcp.

Object

A typed business entity — task, account, invoice. Declared as a TypeScript schema; generates REST APIs, views, audit entries, RBAC checkpoints automatically. See Data Model.

ObjectOS

The commercial runtime environment built on ObjectStack: hosted in the browser with nothing to install (ObjectOS Cloud) or self-managed on your own infrastructure (ObjectOS Enterprise), licensed per AI seat. Not open source — the stack it runs is, and on either edition you can export your ontology and run it on that open runtime. This documentation site is for ObjectOS.

ObjectQL

The data layer protocol and query engine. Compiles declarative queries to native SQL / Mongo queries. Used by REST endpoints, the UI, flows — all the same engine.

ObjectStack

The open stack, Apache-2.0: the protocol, microkernel, SDK, CLI and production runtime that execute a business ontology — the @objectstack/* npm packages and the runtime image. ObjectOS is the commercial runtime environment built on it; the two are different products under different licenses.

ObjectUI

The view layer protocol — apps, views, pages, dashboards, actions, charts, navigation. ObjectOS renders ObjectUI declarations.

Permission Set

A bundle of grants — object permissions, field permissions, system permissions. Attached to users directly or via positions. The primary authorization unit. See Permissions.

Plugin

A framework package that extends the runtime with a capability — plugin-auth, plugin-security, plugin-audit, plugin-webhooks, mcp, etc. Activated via DI + lifecycle hooks (init → start → destroy).

Position

The job function a user holds — "Sales Manager", "Support Agent", "Auditor". The single people-grouping concept since ObjectStack 13, and deliberately flat: reporting structure lives on the business-unit tree instead. A position targets apps and tabs at an audience, names approvers, and distributes permission sets to everyone who holds it. See Positions.

Project

Old name for Environment. It survives in inherited configuration and in framework-internal identifiers; ObjectOS documentation says Environment.

Record Share

A direct grant of access to a specific record for one recipient — a user (user), a team (team), a position (position), a business unit (business_unit), or a business unit together with every unit beneath it (unit_and_subordinates). Stored as sys_record_share rows, whose recipient_type column takes exactly those five values. Different from sharing rules (declarative criteria).

Setup

The built-in administration app, at /apps/setup inside the UI served at /_console/, gated by the setup.access permission. Manages users, business units, teams, positions, permission sets, sharing rules, record shares and API keys, plus configuration, diagnostics and integrations. See Configure.

Sharing Rule

A declarative rule that grants record access based on criteria ("regional managers can see records in their region"). Evaluated at query time, compiled into row-level filters. A rule stored without criteria shares nothing — it is not a match-all. See Record Access.

Studio

The built-in metadata-authoring surface, at /studio inside the UI served at /_console/, gated by the studio.access permission. Where the metadata itself is designed — packages, objects, apps, flows and permission sets — one package at a time, across four pillars: Data, Automations, Interfaces, Access. Peer of Setup, not part of it: Setup operates a running deployment (its people, their grants, its configuration), Studio authors what that deployment runs — hence permissions are designed in Studio, assigned in Setup. Unlike Setup it is not an app under /apps/; the UI serves it as its own route subtree. See Configure.

Surface

One of the HTTP entry points a running ObjectOS exposes: / (REST API) and /_console/ (the UI). There are two, not three — account is not a surface of its own. Sign-in, registration and account self-service are all routes inside the UI:

There is no /_account/ surface. It was retired when the standalone account portal was removed, and those URLs now return 404.

System Context

The internal execution mode used by plugins, hooks, and seed scripts that need to bypass security checks. Auditable; not exposed to user code.

Tenant

An isolation boundary between the organizations sharing one deployment. A walled tenancy posture puts the wall up and is a licensed capability. Those organizations still share the deployment's app, its database and its metadata, so the wall separates their data and memberships rather than their schema. See Multi-organization deployments.

Trigger

The condition that fires a flow — record event (after_insert), schedule (cron), or manual invocation.

View

A declarative UI configuration — list, form, kanban, calendar, gantt — attached to an Object. ObjectOS renders it; you don't write the component.

Zod schema

The runtime + compile-time type system used by @objectstack/spec. Every object, field, view, app, flow is parsed and validated by a Zod schema. JSON Schema, TypeScript types, and REST request validators are all derived from the same Zod definitions.