@b2bc-devkit/sheetorm 1.0.2 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@b2bc-devkit/sheetorm",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "TypeScript ORM for Google Sheets (Google Apps Script runtime)",
   "type": "module",
   "license": "GPL-3.0-or-later",
@@ -68,7 +68,7 @@
     "@babel/plugin-transform-numeric-separator": "^7.28.6",
     "@babel/plugin-transform-optional-chaining": "^7.28.6",
     "@google/clasp": "^3.3.0",
-    "@rollup/plugin-babel": "^6.1.0",
+    "@rollup/plugin-babel": "^7.0.0",
     "@types/google-apps-script": "^2.0.8",
     "@types/jest": "^30.0.0",
     "@typescript-eslint/eslint-plugin": "^8.57.1",
@@ -80,7 +80,7 @@
     "prettier": "^3.8.1",
     "terser": "^5.44.1",
     "ts-jest": "^29.4.6",
-    "typescript": "^5.9.3",
-    "vite": "^7.3.1"
+    "typescript": "^6.0.2",
+    "vite": "^8.0.8"
   }
 }

package/{README.md → readme.md}

@@ -27,6 +27,7 @@ extend `Record`, and everything just works.
 - **Lifecycle hooks** — `beforeSave`, `afterSave`, `beforeDelete`, `afterDelete`
 - **Batch operations** — `beginBatch` / `commitBatch` / `rollbackBatch` for safe bulk writes
 - **Pagination & grouping** — `select()` returns `PaginatedResult<T>`, `groupBy()` returns `GroupResult<T>`
+- **Sheet protection** — Auto-protect sheets on creation via `isProtected()` / `protectedFor()` overrides
 - **Zero runtime dependencies** — Bundles into a single `Code.js` via Vite
 
 ## Quick Start
@@ -93,6 +94,35 @@ class ArchivedCar extends Record {
 }
 ```
 
+### 5. Protect a sheet
+
+SheetORM can automatically protect auto-created sheets using the Google Sheets Protection API. Override
+`isProtected()` and `protectedFor()` on your model class:
+
+```ts
+class SecretReport extends Record {
+  @Required()
+  title: string;
+
+  body: string;
+
+  static override isProtected(): boolean {
+    return true;
+  }
+
+  static override protectedFor(): string[] {
+    return ["alice@example.com", "bob@example.com"];
+  }
+}
+```
+
+When `isProtected()` returns `true`, the sheet is protected the first time it is created. The emails returned
+by `protectedFor()` are added as editors — all other users (except the spreadsheet owner) are restricted to
+view-only access. If `protectedFor()` returns an empty array, only the owner can edit.
+
+Protection is applied **once** during sheet creation. Existing sheets are never re-protected on subsequent
+saves.
+
 ### Available decorators
 
 SheetORM supports three TypeScript property decorators on `Record` models.
@@ -273,6 +303,8 @@ decorators and an optional static property to customize behavior:
 | `@Indexed(options?)`          | Secondary index (implies `@Field`); auto-creates `idx_{ClassName}s`          |
 | `static get tableName()`      | Sheet name (defaults to `tbl_{ClassName}s` — e.g. `tbl_Cars` for `Car`)      |
 | `static get indexTableName()` | Combined index sheet name (defaults to `idx_{ClassName}s` — e.g. `idx_Cars`) |
+| `static isProtected()`        | Return `true` to protect the sheet on creation (default: `false`)            |
+| `static protectedFor()`       | Email addresses of allowed editors (default: `[]`)                           |
 
 #### `@Required()`
 
@@ -383,11 +415,11 @@ const ids = indexStore.searchCombined("idx_Cars", "model", "320i");
 npm test
 ```
 
-Runs **333 unit and benchmark tests** across 11 test suites using Jest + ts-jest with in-memory mock adapters:
+Runs **337 unit and benchmark tests** across 11 test suites using Jest + ts-jest with in-memory mock adapters:
 
 | Suite                      | Tests | Description                                  |
 | -------------------------- | ----- | -------------------------------------------- |
-| `record.test.ts`           | 74    | ActiveRecord API (save, find, query, Query)  |
+| `record.test.ts`           | 78    | ActiveRecord API (save, find, query, Query)  |
 | `query-engine.test.ts`     | 60    | Filter, sort, paginate, group                |
 | `serialization.test.ts`    | 47    | Row ↔ Entity conversion                      |
 | `index-store.test.ts`      | 44    | Secondary index CRUD                         |
@@ -567,6 +599,11 @@ included in this template):
 1. Install `madge` globally with `npm i --global madge`.
 2. Check for circular dependencies with `madge src/index.ts --circular`.
 
+## Security
+
+To report a vulnerability, see [SECURITY.md](SECURITY.md). Do not open a public GitHub issue for security
+issues — use GitHub's private Security Advisories instead.
+
 ## License
 
 GPL-3.0-or-later — see [license.md](license.md).