ObjectStackContext schema — Kernel Protocol reference
Context schemas of the ObjectStack Kernel Protocol: KernelContext, RuntimeMode and 1 more — each property with its type, default and a TypeScript example.
Source: packages/spec/src/kernel/context.zod.ts
TypeScript Usage
import { KernelContextSchema, RuntimeMode, TenantRuntimeContextSchema } from '@objectstack/spec/kernel';
import type { KernelContext, RuntimeMode, TenantRuntimeContext } from '@objectstack/spec/kernel';
// Validate data
const result = KernelContextSchema.parse(data);KernelContext
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| instanceId | string | ✅ | Unique UUID for this running kernel process |
| mode | Enum<'development' | 'production' | 'test' | 'provisioning'> | optional (default: "production") | Kernel operating mode |
| version | string | ✅ | Kernel version |
| appName | string | optional | Host application name |
| cwd | string | ✅ | Current working directory |
| workspaceRoot | string | optional | Workspace root if different from cwd |
| startedAt | integer | ✅ | Boot timestamp — Unix milliseconds |
| features | Record<string, boolean> | optional (default: {}) | Global feature toggles |
| previewMode | never | optional | [REMOVED] context.previewMode was removed in @objectstack/spec 17 (ADR-0049 enforce-or-remove) — nothing ever read the block: none of its six keys (autoLogin, simulatedRole, simulatedUserName, readOnly, expiresInSeconds, bannerMessage) had a consumer in any repo, so an authored block parsed cleanly and configured NOTHING, while its own docstring promised an auth bypass ("skips authentication screens", "simulates an admin identity") and named a production guard no runtime ever received. Delete the key. Preview/demo deployments belong to the deployment layer, which owns auth per-project (ArtifactKernelFactory in the cloud distribution); OS_PREVIEW_MODE stays there as a routing-only switch. If a preview experience becomes a product capability it re-declares fresh, with the production-posture hard-refusal as the first-landed half (ruling record). |
| startTime | never | optional | [REMOVED] context.startTime was renamed to context.startedAt in @objectstack/spec 17 — the boot INSTANT now carries the shared EpochMs schema, which declares the epoch-millisecond unit the key name used to leave to the describe prose. Rename the key to startedAt; the value is unchanged (Date.now()). *At rather than startTimeMs deliberately: every *Ms key in this package is a DURATION, so spelling an instant that way would move it into the family the rule exists to separate it from. |
RuntimeMode
Kernel operating mode
Allowed Values
developmentproductiontestprovisioning
TenantRuntimeContext
Tenant-aware kernel runtime context
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| instanceId | string | ✅ | Unique UUID for this running kernel process |
| mode | Enum<'development' | 'production' | 'test' | 'provisioning'> | optional (default: "production") | Kernel operating mode |
| version | string | ✅ | Kernel version |
| appName | string | optional | Host application name |
| cwd | string | ✅ | Current working directory |
| workspaceRoot | string | optional | Workspace root if different from cwd |
| startedAt | integer | ✅ | Boot timestamp — Unix milliseconds |
| features | Record<string, boolean> | optional (default: {}) | Global feature toggles |
| previewMode | never | optional | [REMOVED] context.previewMode was removed in @objectstack/spec 17 (ADR-0049 enforce-or-remove) — nothing ever read the block: none of its six keys (autoLogin, simulatedRole, simulatedUserName, readOnly, expiresInSeconds, bannerMessage) had a consumer in any repo, so an authored block parsed cleanly and configured NOTHING, while its own docstring promised an auth bypass ("skips authentication screens", "simulates an admin identity") and named a production guard no runtime ever received. Delete the key. Preview/demo deployments belong to the deployment layer, which owns auth per-project (ArtifactKernelFactory in the cloud distribution); OS_PREVIEW_MODE stays there as a routing-only switch. If a preview experience becomes a product capability it re-declares fresh, with the production-posture hard-refusal as the first-landed half (ruling record). |
| startTime | never | optional | [REMOVED] context.startTime was renamed to context.startedAt in @objectstack/spec 17 — the boot INSTANT now carries the shared EpochMs schema, which declares the epoch-millisecond unit the key name used to leave to the describe prose. Rename the key to startedAt; the value is unchanged (Date.now()). *At rather than startTimeMs deliberately: every *Ms key in this package is a DURATION, so spelling an instant that way would move it into the family the rule exists to separate it from. |
| tenantId | string | ✅ | Resolved tenant identifier |
| tenantPlan | Enum<'free' | 'pro' | 'enterprise'> | ✅ | Tenant subscription plan |
| tenantRegion | string | optional | Tenant deployment region |
| tenantDbUrl | string | ✅ | Tenant database connection URL |
| tenantQuotas | { maxUsers?: integer; maxStorage?: integer; apiRateLimit?: integer; maxObjects?: integer; … } | optional | Tenant resource quotas |
Nested Shape: TenantRuntimeContext.tenantQuotas
| Property | Type | Required | Description |
|---|---|---|---|
| maxUsers | integer | optional | Maximum number of users |
| maxStorage | integer | optional | Maximum storage in bytes |
| apiRateLimit | integer | optional | API requests per minute |
| maxObjects | integer | optional | Maximum number of custom objects |
| maxRecordsPerObject | integer | optional | Maximum records per object |
| maxDeploymentsPerDay | integer | optional | Maximum deployments per day |
| maxStorageBytes | integer | optional | Maximum storage in bytes |