Creator surface: the reads, runtime items, use handlers, a judged bar, benches, eye rows

[dop42]

Owner's ask: make sure the APIs give creators their full power, and add what is logically missing. This compares the creator surface with ESX / QBCore / ox_core / ox_inventory / ox_lib / ox_target and fills the gaps that can be filled safely.

Server exports (all behind the READ / WRITERS allowlists, writes audited event=export.<Name>)

• GetPlayers(filter?), GetJobs(), GetGangs(): the roster and the configured groups (grades as a list)
• GetItem, GetItems, GetInventory(target), CanCarryItem(target, item, count?, meta?)
• RegisterItem(name, def): an item added on both halves at runtime. Validated by the one Catalog.Register both halves run, sent to late joiners on hello, never a weapon, never a taken name, capped per caller (SERVER.EXPORTS.ITEMS.MAX_PER_CALLER), sent eight per event so the client takes them inside one resume
• RegisterUsableItem(name, export) / UnregisterUsableItem: the caller's export decides a use ({ ok, consume? }), never taken from another owner
• OpenStash(src, name, options?): configured stashes or the caller's own namespace only, under the create cap (rule also enforced in the contract)
• GetVehicle, GetOwnedVehicles, AddVehicle, HasKeys, GiveKeys
• Notify(src, msg, kind?, ms?)
• StartProgress(src, spec) / StopProgress(src, id?): a bar the server starts and judges by its own clock (modules/progress/server/main.lua): finished early is rejected + security journal, no report is no_answer, leaving is left; verdict on opx:on:progress:finished
• RegisterCraftingBench(key, def) / UnregisterCraftingBench(key): stored as <caller>:<key>, gate as a job list
• GetMetadata / SetMetadata take a citizen id: one row key (JSON_SET / JSON_REMOVE on a quoted path) under the offline ledger, bounds checked at the write
• a caller that stops takes its use handlers, benches and server bars with it

Client exports

• AddTarget / UpdateTarget / RemoveTarget / ClearTargets: rows owned by the caller's resource name, callbacks held to its own exports, swept on stop/reload by the eye
• ShowPrompt / UpdatePrompt / HidePrompt / HideAllPrompts
• OpenPanel / UpdatePanel / AppendPanel / ClosePanel (opx:on:panel:action)
• OpenCraftingBench(key); reads GetPlayerData, GetItemCount, HasItem, GetItem, IsDown, GetNeeds
• a caller named like a module is refused the eye and the strip (export.ownerTaken): it would share that module's rows

Public events

opx:on:inventory:items (bag deltas by item name, from a per-bag tally), opx:on:character:created / deleted, opx:on:vehicles:registered / state (impound), opx:on:crafting:ordered / collected, opx:on:progress:finished.

Skipped, and why

• Hooks from another resource: a veto runs inside the action, synchronously; a cross-resource call there cannot be bounded
• Impound / garage screen for a player, job-gated garages: need UI and garage-module work
• Shops / gunsmith contracts: shops is the clothing shop; gunsmith is a crafting consumer, covered by creator benches
• Runtime weapons: need a TweakDB record and a class
• A server↔client callback helper: already Lib.Callback in opx_lib over Open77.net

Checks

• OPX_LIB_PATH=../opx_lib lua tests/run.lua: 4546 checks, 0 failed (≈170 new: allowlist refusal, validation, audit, events firing, caller-stop cleanup, client budget for target rows and runtime-item parts)
• luac -p on every changed file, manifest paths ≤ 47, python tools/check-sandbox-globals.py ok; no UI change
• Merged origin/main

Docs: opx77-framework/opx77_doc#10

🤖 Generated with Claude Code