@happyvertical/smrt-fields 0.40.59 → 0.40.61

package/dist/index.js

@@ -1,5 +1,6 @@
 import { APP_FIELD_POLICY_SCOPE_KEY, FIELD_POLICY_SCOPE_TYPES, FIELD_POLICY_VISIBILITIES } from "./types.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, crossPackageRef, field, smrt } from "@happyvertical/smrt-core";
+import { MembershipCollection, assertOperationPermission, checkOperationPermission, getCurrentSessionPermissionContext, registerPermissionDefinitions } from "@happyvertical/smrt-users";
 import { TenantIsolationError, assertTenantReadAllowed, getCurrentTenant, isSuperAdminBypass, tenantId } from "@happyvertical/smrt-tenancy";
 import { importWorkspaceModule } from "@happyvertical/smrt-core/utils/import-workspace-module";
 //#region \0rolldown/runtime.js
@@ -15,7 +16,28 @@ var __exportAll = (all, no_symbols) => {
 };
 //#endregion
 //#region src/__smrt-register__.ts
-ObjectRegistry.registerPackageManifest(JSON.parse("{\"version\":\"1.0.0\",\"timestamp\":0,\"packageName\":\"@happyvertical/smrt-fields\",\"packageVersion\":\"0.40.59\",\"objects\":{\"@happyvertical/smrt-fields:FieldPolicyCollection\":{\"name\":\"fieldpolicycollection\",\"className\":\"FieldPolicyCollection\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldPolicyCollection\",\"collection\":\"fieldpolicies\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/collections/FieldPolicyCollection.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{},\"methods\":{\"getAppRows\":{\"name\":\"getAppRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Map<string, FieldPolicy>>\",\"isStatic\":false,\"isPublic\":true},\"getTenantRows\":{\"name\":\"getTenantRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false},{\"name\":\"tenantIds\",\"type\":\"string[]\",\"optional\":false}],\"returnType\":\"Promise<Map<string, Map<string, FieldPolicy>>>\",\"isStatic\":false,\"isPublic\":true},\"getUserRows\":{\"name\":\"getUserRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false},{\"name\":\"userId\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Map<string, FieldPolicy>>\",\"isStatic\":false,\"isPublic\":true},\"resolveBatch\":{\"name\":\"resolveBatch\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<FieldPolicyBatchResult>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"conflictColumns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"api\":{\"include\":[\"create\",\"update\",\"delete\",\"resolveBatch\"],\"routes\":{\"resolveBatch\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"resolve\"}}},\"cli\":false,\"mcp\":false,\"tableName\":\"_smrt_field_policies\"},\"extends\":\"SmrtCollection\",\"extendsTypeArg\":\"FieldPolicy\",\"exportName\":\"FieldPolicyCollection\",\"collectionExportName\":\"FieldPolicyCollectionCollection\",\"schema\":{\"tableName\":\"_smrt_field_policies\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_policies\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"}},\"indexes\":[{\"name\":\"_smrt_field_policies_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_policies_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"unique\":true}],\"version\":\"13aa748c\"}},\"@happyvertical/smrt-fields:FieldPolicy\":{\"name\":\"fieldpolicy\",\"className\":\"FieldPolicy\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldPolicy\",\"collection\":\"fieldpolicies\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/models/FieldPolicy.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{\"objectRef\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"fieldName\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"scopeType\":{\"type\":\"text\",\"required\":true,\"default\":\"app\",\"_meta\":{\"required\":true}},\"tenantId\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"sqlType\":\"UUID\",\"nullable\":true,\"__tenancy\":{\"isTenantIdField\":true,\"autoFilter\":true,\"required\":false,\"autoPopulate\":true,\"nullable\":true}}},\"userId\":{\"type\":\"crossPackageRef\",\"required\":false,\"related\":\"@happyvertical/smrt-users:User\",\"_meta\":{\"nullable\":true}},\"scopeKey\":{\"type\":\"text\",\"required\":true,\"_meta\":{\"required\":true}},\"defaultValue\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"visibility\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"help\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"label\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"displayOrder\":{\"type\":\"integer\",\"required\":false,\"_meta\":{\"nullable\":true}},\"locked\":{\"type\":\"boolean\",\"required\":false,\"_meta\":{\"nullable\":true}},\"updatedBy\":{\"type\":\"crossPackageRef\",\"required\":false,\"related\":\"@happyvertical/smrt-users:User\",\"_meta\":{\"nullable\":true}}},\"methods\":{\"getDefaultValue\":{\"name\":\"getDefaultValue\",\"async\":false,\"parameters\":[],\"returnType\":\"any\",\"isStatic\":false,\"isPublic\":true},\"setDefaultValue\":{\"name\":\"setDefaultValue\",\"async\":false,\"parameters\":[{\"name\":\"value\",\"type\":\"any\",\"optional\":false}],\"returnType\":\"void\",\"isStatic\":false,\"isPublic\":true},\"save\":{\"name\":\"save\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise\",\"isStatic\":false,\"isPublic\":true},\"delete\":{\"name\":\"delete\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise<void>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"tableName\":\"_smrt_field_policies\",\"conflictColumns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"api\":{\"include\":[\"create\",\"update\",\"delete\"]},\"cli\":{\"include\":[\"create\",\"update\",\"delete\"],\"exclude\":[\"getDefaultValue\",\"setDefaultValue\"]},\"mcp\":{\"include\":[]}},\"extends\":\"SmrtObject\",\"exportName\":\"FieldPolicy\",\"collectionExportName\":\"FieldPolicyCollection\",\"validationRules\":[{\"field\":\"objectRef\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"fieldName\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"scopeType\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"scopeKey\",\"rule\":\"required\",\"fieldType\":\"text\"}],\"schema\":{\"tableName\":\"_smrt_field_policies\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_policies\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"object_ref\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"field_name\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"scope_type\\\" TEXT NOT NULL DEFAULT 'app',\\n  \\\"tenant_id\\\" UUID,\\n  \\\"user_id\\\" UUID,\\n  \\\"scope_key\\\" TEXT NOT NULL,\\n  \\\"default_value\\\" TEXT,\\n  \\\"visibility\\\" TEXT,\\n  \\\"help\\\" TEXT,\\n  \\\"label\\\" TEXT,\\n  \\\"display_order\\\" INTEGER,\\n  \\\"locked\\\" BOOLEAN,\\n  \\\"updated_by\\\" UUID\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"object_ref\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"field_name\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"scope_type\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"app\"},\"tenant_id\":{\"type\":\"UUID\",\"referenceKind\":\"tenantId\",\"notNull\":false,\"unique\":false},\"user_id\":{\"type\":\"UUID\",\"referenceKind\":\"crossPackageRef\",\"notNull\":false,\"unique\":false},\"scope_key\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false},\"default_value\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"visibility\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"help\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"label\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"display_order\":{\"type\":\"INTEGER\",\"notNull\":false,\"unique\":false},\"locked\":{\"type\":\"BOOLEAN\",\"notNull\":false,\"unique\":false},\"updated_by\":{\"type\":\"UUID\",\"referenceKind\":\"crossPackageRef\",\"notNull\":false,\"unique\":false}},\"indexes\":[{\"name\":\"_smrt_field_policies_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_policies_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"unique\":true}],\"version\":\"34b355cc\"}}},\"moduleType\":\"smrt\",\"smrtDependencies\":[\"@happyvertical/smrt-core\",\"@happyvertical/smrt-tenancy\",\"@happyvertical/smrt-users\"]}"));
+ObjectRegistry.registerPackageManifest(JSON.parse("{\"version\":\"1.0.0\",\"timestamp\":0,\"packageName\":\"@happyvertical/smrt-fields\",\"packageVersion\":\"0.40.61\",\"objects\":{\"@happyvertical/smrt-fields:FieldPolicyCollection\":{\"name\":\"fieldpolicycollection\",\"className\":\"FieldPolicyCollection\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldPolicyCollection\",\"collection\":\"fieldpolicies\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/collections/FieldPolicyCollection.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{},\"methods\":{\"policyAudit\":{\"name\":\"policyAudit\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<FieldPolicyAuditSnapshot>\",\"isStatic\":false,\"isPublic\":true},\"getAppRows\":{\"name\":\"getAppRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Map<string, FieldPolicy>>\",\"isStatic\":false,\"isPublic\":true},\"getTenantRows\":{\"name\":\"getTenantRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false},{\"name\":\"tenantIds\",\"type\":\"string[]\",\"optional\":false}],\"returnType\":\"Promise<Map<string, Map<string, FieldPolicy>>>\",\"isStatic\":false,\"isPublic\":true},\"getUserRows\":{\"name\":\"getUserRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false},{\"name\":\"userId\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Map<string, FieldPolicy>>\",\"isStatic\":false,\"isPublic\":true},\"resolveBatch\":{\"name\":\"resolveBatch\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<FieldPolicyBatchResult>\",\"isStatic\":false,\"isPublic\":true},\"getEditorState\":{\"name\":\"getEditorState\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<FieldPolicyEditorStateResult>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"conflictColumns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"api\":{\"include\":[\"create\",\"update\",\"delete\",\"resolveBatch\",\"getEditorState\",\"policyAudit\"],\"principalContext\":true,\"routes\":{\"resolveBatch\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"resolve\"},\"getEditorState\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"editor-state\"},\"policyAudit\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"policy-audit\"}}},\"cli\":false,\"mcp\":false,\"tableName\":\"_smrt_field_policies\"},\"extends\":\"SmrtCollection\",\"extendsTypeArg\":\"FieldPolicy\",\"exportName\":\"FieldPolicyCollection\",\"collectionExportName\":\"FieldPolicyCollectionCollection\",\"schema\":{\"tableName\":\"_smrt_field_policies\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_policies\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"}},\"indexes\":[{\"name\":\"_smrt_field_policies_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_policies_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"unique\":true}],\"version\":\"13aa748c\"}},\"@happyvertical/smrt-fields:FieldPolicy\":{\"name\":\"fieldpolicy\",\"className\":\"FieldPolicy\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldPolicy\",\"collection\":\"fieldpolicies\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/models/FieldPolicy.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{\"objectRef\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"fieldName\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"scopeType\":{\"type\":\"text\",\"required\":true,\"default\":\"app\",\"_meta\":{\"required\":true}},\"tenantId\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"sqlType\":\"UUID\",\"nullable\":true,\"__tenancy\":{\"isTenantIdField\":true,\"autoFilter\":true,\"required\":false,\"autoPopulate\":true,\"nullable\":true}}},\"userId\":{\"type\":\"crossPackageRef\",\"required\":false,\"related\":\"@happyvertical/smrt-users:User\",\"_meta\":{\"nullable\":true}},\"scopeKey\":{\"type\":\"text\",\"required\":true,\"_meta\":{\"required\":true}},\"defaultValue\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"visibility\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"help\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"label\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"displayOrder\":{\"type\":\"integer\",\"required\":false,\"_meta\":{\"nullable\":true}},\"locked\":{\"type\":\"boolean\",\"required\":false,\"_meta\":{\"nullable\":true}},\"updatedBy\":{\"type\":\"crossPackageRef\",\"required\":false,\"related\":\"@happyvertical/smrt-users:User\",\"_meta\":{\"nullable\":true}}},\"methods\":{\"getDefaultValue\":{\"name\":\"getDefaultValue\",\"async\":false,\"parameters\":[],\"returnType\":\"any\",\"isStatic\":false,\"isPublic\":true},\"setDefaultValue\":{\"name\":\"setDefaultValue\",\"async\":false,\"parameters\":[{\"name\":\"value\",\"type\":\"any\",\"optional\":false}],\"returnType\":\"void\",\"isStatic\":false,\"isPublic\":true},\"save\":{\"name\":\"save\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise\",\"isStatic\":false,\"isPublic\":true},\"delete\":{\"name\":\"delete\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise<void>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"tableName\":\"_smrt_field_policies\",\"conflictColumns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"api\":{\"include\":[\"create\",\"update\",\"delete\"],\"principalContext\":true},\"cli\":{\"include\":[\"create\",\"update\",\"delete\"],\"exclude\":[\"getDefaultValue\",\"setDefaultValue\"]},\"mcp\":{\"include\":[]}},\"extends\":\"SmrtObject\",\"exportName\":\"FieldPolicy\",\"collectionExportName\":\"FieldPolicyCollection\",\"validationRules\":[{\"field\":\"objectRef\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"fieldName\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"scopeType\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"scopeKey\",\"rule\":\"required\",\"fieldType\":\"text\"}],\"schema\":{\"tableName\":\"_smrt_field_policies\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_policies\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"object_ref\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"field_name\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"scope_type\\\" TEXT NOT NULL DEFAULT 'app',\\n  \\\"tenant_id\\\" UUID,\\n  \\\"user_id\\\" UUID,\\n  \\\"scope_key\\\" TEXT NOT NULL,\\n  \\\"default_value\\\" TEXT,\\n  \\\"visibility\\\" TEXT,\\n  \\\"help\\\" TEXT,\\n  \\\"label\\\" TEXT,\\n  \\\"display_order\\\" INTEGER,\\n  \\\"locked\\\" BOOLEAN,\\n  \\\"updated_by\\\" UUID\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"object_ref\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"field_name\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"scope_type\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"app\"},\"tenant_id\":{\"type\":\"UUID\",\"referenceKind\":\"tenantId\",\"notNull\":false,\"unique\":false},\"user_id\":{\"type\":\"UUID\",\"referenceKind\":\"crossPackageRef\",\"notNull\":false,\"unique\":false},\"scope_key\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false},\"default_value\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"visibility\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"help\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"label\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"display_order\":{\"type\":\"INTEGER\",\"notNull\":false,\"unique\":false},\"locked\":{\"type\":\"BOOLEAN\",\"notNull\":false,\"unique\":false},\"updated_by\":{\"type\":\"UUID\",\"referenceKind\":\"crossPackageRef\",\"notNull\":false,\"unique\":false}},\"indexes\":[{\"name\":\"_smrt_field_policies_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_policies_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"unique\":true}],\"version\":\"34b355cc\"}}},\"moduleType\":\"smrt\",\"smrtDependencies\":[\"@happyvertical/smrt-core\",\"@happyvertical/smrt-tenancy\",\"@happyvertical/smrt-users\"]}"));
+//#endregion
+//#region src/permissions.ts
+var MANAGE_FIELD_POLICY_PERMISSION = "fields.policy.manage";
+var PERSONALIZE_FIELD_POLICY_PERMISSION = "fields.policy.personalize";
+var FIELD_POLICY_PERMISSION_DEFINITIONS = [{
+	slug: MANAGE_FIELD_POLICY_PERMISSION,
+	category: "fields",
+	name: "Manage Field Policies",
+	description: "Manage application and tenant field-policy overrides"
+}, {
+	slug: PERSONALIZE_FIELD_POLICY_PERMISSION,
+	category: "fields",
+	name: "Personalize Field Policies",
+	description: "Manage the caller’s own field-policy overrides"
+}];
+var registered = false;
+function ensureFieldPolicyPermissionsRegistered() {
+	if (registered) return;
+	registered = true;
+	registerPermissionDefinitions(FIELD_POLICY_PERMISSION_DEFINITIONS);
+}
 //#endregion
 //#region src/cache.ts
 var FIELD_POLICY_CACHE_TTL_MS = 3e4;
@@ -110,6 +132,9 @@ function getFieldReadPermission(field) {
 function isTransientField(field) {
 	return field.transient === true || field._meta?.transient === true;
 }
+function isPolicyAddressableField(field) {
+	return field._meta?.__smrtSystemField !== true && field.type !== "oneToMany" && field.type !== "manyToMany" && field.type !== "meta";
+}
 function isRequiredField(field) {
 	if (field.nullable === true || field._meta?.nullable === true) return false;
 	return field.required === true || field._meta?.required === true;
@@ -199,6 +224,55 @@ var __decorateClass$1 = (decorators, target, key, kind) => {
 	if (kind && result) __defProp$1(target, key, result);
 	return result;
 };
+ensureFieldPolicyPermissionsRegistered();
+var FIELD_POLICY_SCOPE_DENIAL_MESSAGE = "Field policy scope is not permitted for this principal.";
+function getFieldPolicyAmbientContext() {
+	const tenantContext = getCurrentTenant();
+	if (tenantContext) return {
+		permissions: tenantContext.permissions,
+		superAdminBypass: isSuperAdminBypass(),
+		tenantId: tenantContext.tenantId,
+		userId: tenantContext.userId
+	};
+	const sessionContext = getCurrentSessionPermissionContext();
+	if (!sessionContext?.tenantId) return;
+	return {
+		permissions: sessionContext.permissionSet,
+		superAdminBypass: sessionContext.superAdminBypass,
+		tenantId: sessionContext.tenantId,
+		userId: sessionContext.userId ?? void 0
+	};
+}
+var FieldPolicyAuthorizationError = class extends Error {
+	code = "permission_denied";
+	status = 403;
+	constructor(message) {
+		super(message);
+		this.name = "FieldPolicyAuthorizationError";
+	}
+};
+var FieldPolicyTenantIsolationError = class extends TenantIsolationError {
+	publicMessage = FIELD_POLICY_SCOPE_DENIAL_MESSAGE;
+	status = 403;
+	constructor(diagnosticMessage, details) {
+		super(FIELD_POLICY_SCOPE_DENIAL_MESSAGE);
+		Object.defineProperty(this, "cause", {
+			configurable: true,
+			enumerable: false,
+			value: new Error(diagnosticMessage),
+			writable: false
+		});
+		Object.defineProperty(this, "diagnostic", {
+			configurable: true,
+			enumerable: false,
+			value: {
+				...details,
+				message: diagnosticMessage
+			},
+			writable: false
+		});
+	}
+};
 var FieldPolicy = class extends SmrtObject {
 	objectRef = "";
 	fieldName = "";
@@ -246,11 +320,16 @@ var FieldPolicy = class extends SmrtObject {
 	async save() {
 		this.attributeScopeToAmbientContext();
 		const previousIdentity = await this.getPersistedIdentity();
-		if (previousIdentity) this.assertScopeOwnedByAmbientContext(previousIdentity, "save");
-		const ambientContext = getCurrentTenant();
+		if (previousIdentity) {
+			this.assertScopeOwnedByAmbientContext(previousIdentity, "save");
+			await this.assertScopePermission(previousIdentity);
+		}
+		this.assertScopeOwnedByAmbientContext(this, "save");
+		await this.assertScopePermission(this);
+		const ambientContext = getFieldPolicyAmbientContext();
 		if (ambientContext) this.updatedBy = ambientContext.userId ?? null;
 		this.normalizeDefaultValueForPersistence();
-		await this.validateFieldPolicy();
+		await this.validateFieldPolicy(previousIdentity);
 		this.scopeKey = this.computeScopeKey();
 		const identityChanged = previousIdentity && (previousIdentity.objectRef !== this.objectRef || previousIdentity.fieldName !== this.fieldName || previousIdentity.scopeType !== this.scopeType || previousIdentity.scopeKey !== this.scopeKey);
 		const result = identityChanged && previousIdentity ? await this.saveAfterIdentityChange() : await super.save();
@@ -306,12 +385,13 @@ var FieldPolicy = class extends SmrtObject {
 	async delete() {
 		const persisted = await this.getPersistedIdentity();
 		if (persisted) this.assertScopeOwnedByAmbientContext(persisted, "delete");
+		await this.assertScopePermission(persisted ?? this);
 		const objectRef = persisted?.objectRef ?? this.objectRef;
 		await super.delete();
 		invalidateFieldPolicyCache(objectRef, this.db);
 		if (this.objectRef && this.objectRef !== objectRef) invalidateFieldPolicyCache(this.objectRef, this.db);
 	}
-	async validateFieldPolicy() {
+	async validateFieldPolicy(previousIdentity) {
 		if (!this.objectRef || this.objectRef.trim() === "") throw new Error("FieldPolicy.objectRef is required");
 		if (!this.fieldName || this.fieldName.trim() === "") throw new Error("FieldPolicy.fieldName is required");
 		if (!FIELD_POLICY_SCOPE_TYPES.includes(this.scopeType)) throw new Error(`FieldPolicy.scopeType must be one of ${FIELD_POLICY_SCOPE_TYPES.join(", ")}; got "${this.scopeType}"`);
@@ -335,11 +415,11 @@ var FieldPolicy = class extends SmrtObject {
 		const needsOrgDefault = demotesRequiredField && !isUsableRequiredDefault(ownDefault);
 		const needsLockCheck = this.scopeType === "user";
 		if (needsOrgDefault || needsLockCheck) {
-			const orgPolicy = await this.resolveOrgTierFieldPolicy();
+			const orgPolicy = await this.resolveOrgTierFieldPolicy(previousIdentity);
 			if (needsOrgDefault) {
 				if (!isUsableRequiredDefault(orgPolicy?.hasDefault ? { value: orgPolicy.defaultValue } : void 0)) throw new Error(`Cannot set visibility "${this.visibility}" for required field "${this.objectRef}.${this.fieldName}": no resolved default exists at or below this layer`);
 			}
-			if (needsLockCheck && orgPolicy?.locked) throw new Error(`Field "${this.objectRef}.${this.fieldName}" is locked by org policy; user-scope overrides are not allowed`);
+			if (needsLockCheck && orgPolicy?.locked) throw new FieldPolicyAuthorizationError(`Field "${this.objectRef}.${this.fieldName}" is locked by org policy; user-scope overrides are not allowed`);
 		}
 	}
 	/**
@@ -350,17 +430,18 @@ var FieldPolicy = class extends SmrtObject {
 	* tenant-scope rows, the ambient context tenant for user-scope rows, and
 	* none for app-scope rows (their only lower layer is the code seed).
 	*
-	* On updates the resolver sees this row's PERSISTED version (there is no
-	* self-exclusion), so a save that removes the only default while demoting
-	* can pass here; the resolver-side safety net stays authoritative at read
-	* time.
+	* During an update, the persisted row is excluded from the lower-layer
+	* projection. That makes a clear-default + required-field demotion validate
+	* the post-write policy rather than accidentally counting the row being
+	* replaced.
 	*/
-	async resolveOrgTierFieldPolicy() {
-		const tenantIdForChain = this.scopeType === "tenant" ? this.tenantId : this.scopeType === "user" ? getCurrentTenant()?.tenantId ?? null : null;
+	async resolveOrgTierFieldPolicy(previousIdentity) {
+		const tenantIdForChain = this.scopeType === "tenant" ? this.tenantId : this.scopeType === "user" ? getFieldPolicyAmbientContext()?.tenantId ?? null : null;
 		const { resolveFieldPolicy } = await Promise.resolve().then(() => field_policy_resolver_exports);
 		return (await resolveFieldPolicy(this.objectRef, {
 			tenantId: tenantIdForChain,
-			db: this.options.db ?? this.options.persistence
+			db: this.options.db ?? this.options.persistence,
+			...previousIdentity ? { excludePolicyIds: /* @__PURE__ */ new Set([previousIdentity.id]) } : {}
 		})).fields[this.fieldName];
 	}
 	/**
@@ -398,14 +479,15 @@ var FieldPolicy = class extends SmrtObject {
 	* a non-bypass caller's tenant/user rows to name exactly the ambient
 	* tenant/user, so the derived value is the ONLY value that could ever have
 	* been accepted. An explicit value is never overwritten (a super-admin
-	* bypass caller keeps naming other scopes), and with no ambient context
-	* nothing is derived — scope-shape validation rejects the row as before.
+	* bypass caller keeps naming other scopes), and with neither tenancy nor
+	* authenticated-session context nothing is derived — scope-shape validation
+	* rejects the row as before.
 	* Consequence: a bypass caller writing ANOTHER tenant's row must pass
 	* `tenantId` through a server-side model call, because the generated routes
 	* still strip it.
 	*/
 	attributeScopeToAmbientContext() {
-		const context = getCurrentTenant();
+		const context = getFieldPolicyAmbientContext();
 		if (!context) return;
 		if (this.scopeType === "tenant" && this.tenantId === null) this.tenantId = context.tenantId;
 		if (this.scopeType === "user" && this.userId === null) this.userId = context.userId ?? null;
@@ -415,33 +497,33 @@ var FieldPolicy = class extends SmrtObject {
 	* the NEW scope on save and to the PERSISTED scope on save/delete of an
 	* existing row.
 	*
-	* With NO ambient identity at all (no tenant context entered — e.g. a
-	* runtime API deployment whose auth middleware never enters the tenancy
-	* ALS), only app-scope rows are accepted: tenant- and user-scope rows are
-	* unattributable without a context, so they are rejected outright rather
-	* than allowed by default. Inside a non-bypass context, a caller may only
-	* touch rows for its own tenant, and user rows only for its own user id —
-	* a context that carries NO user id may not touch the user tier at all.
+	* With NO ambient identity at all (neither tenant ALS nor authenticated
+	* session-permission ALS), only app-scope rows are accepted: tenant- and
+	* user-scope rows are unattributable without a context, so they are
+	* rejected outright rather than allowed by default. Inside a non-bypass
+	* context, a caller may only touch rows for its own tenant, and user rows
+	* only for its own user id — a context that carries NO user id may not
+	* touch the user tier at all.
 	* App-wide rows then require super-admin bypass (or a context-less/system
 	* caller).
 	*
 	* Package rule: a missing identity component DENIES, it never skips.
 	*/
 	assertScopeOwnedByAmbientContext(scope, operation) {
-		const context = getCurrentTenant();
+		const context = getFieldPolicyAmbientContext();
 		if (!context) {
-			if (scope.scopeType === "tenant" || scope.scopeType === "user") throw new TenantIsolationError(`${scope.scopeType === "tenant" ? "Tenant" : "User"}-scope field policy ${operation}s require an ambient tenant context (or super-admin bypass); without one the caller identity is unattributable`);
+			if (scope.scopeType === "tenant" || scope.scopeType === "user") throw new FieldPolicyTenantIsolationError(`${scope.scopeType === "tenant" ? "Tenant" : "User"}-scope field policy ${operation}s require an ambient tenant context (or super-admin bypass); without one the caller identity is unattributable`);
 			return;
 		}
-		if (isSuperAdminBypass()) return;
-		if (scope.scopeType === "app") throw new TenantIsolationError(`App-scope field policy ${operation}s are not allowed inside a tenant context (use a system context or super-admin bypass)`, { tenantId: context.tenantId });
-		if (scope.scopeType === "tenant" && scope.tenantId !== context.tenantId) throw new TenantIsolationError(`Tenant isolation violation in FieldPolicy.${operation}: context tenant is '${context.tenantId}' but the row belongs to '${scope.tenantId}'`, {
+		if (context.superAdminBypass) return;
+		if (scope.scopeType === "app") throw new FieldPolicyTenantIsolationError(`App-scope field policy ${operation}s are not allowed inside a tenant context (use a system context or super-admin bypass)`, { tenantId: context.tenantId });
+		if (scope.scopeType === "tenant" && scope.tenantId !== context.tenantId) throw new FieldPolicyTenantIsolationError(`Tenant isolation violation in FieldPolicy.${operation}: context tenant is '${context.tenantId}' but the row belongs to '${scope.tenantId}'`, {
 			tenantId: context.tenantId,
 			attemptedTenantId: scope.tenantId ?? void 0
 		});
 		if (scope.scopeType === "user") {
-			if (context.userId === void 0) throw new TenantIsolationError(`User-scope field policy ${operation}s require an ambient context that carries a user id; this context cannot attribute a user-scope write`, { tenantId: context.tenantId });
-			if (scope.userId !== context.userId) throw new TenantIsolationError(`Tenant isolation violation in FieldPolicy.${operation}: context user is '${context.userId}' but the row belongs to '${scope.userId}'`, { tenantId: context.tenantId });
+			if (context.userId === void 0) throw new FieldPolicyTenantIsolationError(`User-scope field policy ${operation}s require an ambient context that carries a user id; this context cannot attribute a user-scope write`, { tenantId: context.tenantId });
+			if (scope.userId !== context.userId) throw new FieldPolicyTenantIsolationError(`Tenant isolation violation in FieldPolicy.${operation}: context user is '${context.userId}' but the row belongs to '${scope.userId}'`, { tenantId: context.tenantId });
 		}
 	}
 	validateTenantContextBoundary() {
@@ -451,6 +533,24 @@ var FieldPolicy = class extends SmrtObject {
 			userId: this.userId
 		}, "save");
 	}
+	/**
+	* Permission boundary for policy mutations. Scope ownership is checked
+	* separately (and first) because permission never grants cross-tenant or
+	* cross-user access. Existing rows are checked against their persisted
+	* scope before an identity-changing save can mutate or delete them.
+	*/
+	async assertScopePermission(scope) {
+		const context = getFieldPolicyAmbientContext();
+		const [, , operation] = (scope.scopeType === "user" ? PERSONALIZE_FIELD_POLICY_PERMISSION : MANAGE_FIELD_POLICY_PERMISSION).split(".");
+		await assertOperationPermission({
+			collection: "fields.policy",
+			action: operation ?? "manage",
+			db: this.options.db ?? this.options.persistence,
+			tenantId: context?.tenantId ?? null,
+			userId: context?.userId ?? null,
+			permissionSet: context?.permissions
+		});
+	}
 	validateDefaultAgainstSecurityRail(fieldDef) {
 		if (isTransientField(fieldDef)) throw new Error(`Cannot store a default for transient field "${this.objectRef}.${this.fieldName}"`);
 		if (isSensitiveField(fieldDef)) throw new Error(`Cannot store a default for sensitive field "${this.objectRef}.${this.fieldName}"`);
@@ -490,6 +590,7 @@ var FieldPolicy = class extends SmrtObject {
 			return value === void 0 || value === null ? null : String(value);
 		};
 		return {
+			id: read("id", "id", String(this.id ?? "")),
 			objectRef: read("objectRef", "object_ref", this.objectRef),
 			fieldName: read("fieldName", "field_name", this.fieldName),
 			scopeType: read("scopeType", "scope_type", this.scopeType),
@@ -571,11 +672,14 @@ FieldPolicy = __decorateClass$1([smrt({
 		"scope_type",
 		"scope_key"
 	],
-	api: { include: [
-		"create",
-		"update",
-		"delete"
-	] },
+	api: {
+		include: [
+			"create",
+			"update",
+			"delete"
+		],
+		principalContext: true
+	},
 	cli: {
 		include: [
 			"create",
@@ -604,7 +708,196 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 var MAX_BATCH_OBJECT_REFS = 100;
+MAX_BATCH_OBJECT_REFS * 2;
 var FieldPolicyCollection = class extends SmrtCollection {
+	/**
+	* Permission-gated, tenant-scoped audit read for the defaults control
+	* panel. It returns editable own-tenant rows, read-only app summaries,
+	* projected user override counts, and identity-only manifest drift rows.
+	*/
+	async policyAudit(options = {}) {
+		const objectRefs = normalizeAuditRefs(options.objectRefs, "objectRefs", 100);
+		const countObjectRefs = normalizeAuditRefs(options.countObjectRefs ?? objectRefs, "countObjectRefs", 200);
+		const context = getCurrentTenant();
+		const tenantId = context?.tenantId ?? null;
+		const userId = context?.userId ?? null;
+		const permissionOptions = {
+			collection: "fields.policy",
+			db: this.db,
+			tenantId,
+			userId,
+			permissionSet: context?.permissions,
+			onDeny: "return"
+		};
+		const manage = tenantId ? await checkOperationPermission({
+			...permissionOptions,
+			action: "fields.policy.manage".split(".").at(-1) ?? "manage"
+		}) : { allowed: false };
+		const personalize = userId ? await checkOperationPermission({
+			...permissionOptions,
+			action: "fields.policy.personalize".split(".").at(-1) ?? "personalize"
+		}) : { allowed: false };
+		const caller = {
+			tenantId,
+			userId,
+			canManageOrg: manage.allowed,
+			canPersonalize: personalize.allowed && userId !== null
+		};
+		if (!caller.canManageOrg || tenantId === null) return emptyAudit(caller);
+		if (options.summaryOnly === true) return emptyAudit(caller);
+		const fieldMaps = /* @__PURE__ */ new Map();
+		const fieldMapFor = (objectRef) => {
+			let loaded = fieldMaps.get(objectRef);
+			if (!loaded) {
+				loaded = getObjectFieldMap(objectRef).catch(() => null);
+				fieldMaps.set(objectRef, loaded);
+			}
+			return loaded;
+		};
+		const classify = async (row) => {
+			const fields = await fieldMapFor(row.objectRef);
+			if (!fields) return "unknown-object";
+			const definition = fields.get(row.fieldName);
+			if (!definition) return "unknown-field";
+			if (isSensitiveField(definition) || getFieldReadPermission(definition) !== void 0 || isTransientField(definition)) return "gated";
+			return isPolicyAddressableField(definition) ? "ok" : "excluded-field";
+		};
+		const [appRows, orgRows, ownUserRows] = objectRefs.length ? await Promise.all([
+			this.list({ where: {
+				scopeType: "app",
+				"objectRef in": objectRefs
+			} }),
+			this.list({ where: {
+				scopeType: "tenant",
+				tenantId,
+				"objectRef in": objectRefs
+			} }),
+			userId ? this.list({ where: {
+				scopeType: "user",
+				userId,
+				"objectRef in": objectRefs
+			} }) : Promise.resolve([])
+		]) : [
+			[],
+			[],
+			[]
+		];
+		const audit = {
+			...emptyAudit(caller),
+			policies: options.countsOnly ? {} : await this.resolveAuditPolicies(objectRefs, tenantId, fieldMapFor)
+		};
+		const append = async (row, target, driftPrunable) => {
+			const state = await classify(row);
+			if (state === "ok") target.push(toAuditRow(row));
+			else if (state !== "gated") audit.driftRows.push({
+				...toDriftIdentity(row),
+				reason: state,
+				prunable: driftPrunable
+			});
+		};
+		for (const row of orgRows) await append(row, audit.orgRows, true);
+		for (const row of appRows) await append(row, audit.appRows, isSuperAdminBypass());
+		for (const row of ownUserRows) {
+			const state = await classify(row);
+			if (state !== "ok" && state !== "gated") audit.driftRows.push({
+				...toDriftIdentity(row),
+				reason: state,
+				prunable: caller.canPersonalize
+			});
+		}
+		if (options.includeDrift === true) {
+			const [driftAppRows, driftOrgRows, driftUserRows] = await Promise.all([
+				this.list({
+					where: { scopeType: "app" },
+					limit: 100
+				}),
+				this.list({
+					where: {
+						scopeType: "tenant",
+						tenantId
+					},
+					limit: 100
+				}),
+				userId ? this.list({
+					where: {
+						scopeType: "user",
+						userId
+					},
+					limit: 100
+				}) : Promise.resolve([])
+			]);
+			const knownIds = new Set([
+				...appRows,
+				...orgRows,
+				...ownUserRows
+			].map((row) => String(row.id)));
+			for (const [rows, prunable] of [
+				[driftAppRows, isSuperAdminBypass()],
+				[driftOrgRows, true],
+				[driftUserRows, caller.canPersonalize]
+			]) for (const row of rows) {
+				if (knownIds.has(String(row.id))) continue;
+				const state = await classify(row);
+				if (state !== "ok" && state !== "gated") audit.driftRows.push({
+					...toDriftIdentity(row),
+					reason: state,
+					prunable
+				});
+			}
+		}
+		const memberships = await MembershipCollection.create({ db: this.db });
+		const memberIds = [...new Set((await memberships.findActiveByTenant(tenantId)).map((membership) => membership.userId?.trim()).filter((id) => Boolean(id)))];
+		const projected = countObjectRefs.length && memberIds.length ? await this.list({
+			where: {
+				scopeType: "user",
+				"objectRef in": countObjectRefs,
+				"userId in": memberIds
+			},
+			select: ["objectRef", "fieldName"]
+		}) : [];
+		for (const row of projected) {
+			if (await classify(row) !== "ok") continue;
+			const byField = audit.userOverrideCounts[row.objectRef] ?? {};
+			audit.userOverrideCounts[row.objectRef] = byField;
+			byField[row.fieldName] = (byField[row.fieldName] ?? 0) + 1;
+		}
+		const { resolveSurvivingTenantChainIds } = await Promise.resolve().then(() => field_policy_resolver_exports);
+		const ancestorIds = (await resolveSurvivingTenantChainIds(tenantId, { db: this.db })).filter((id) => id !== tenantId);
+		if (ancestorIds.length && objectRefs.length) {
+			const ancestors = await this.list({ where: {
+				scopeType: "tenant",
+				"tenantId in": ancestorIds,
+				"objectRef in": objectRefs
+			} });
+			for (const row of ancestors) {
+				if (await classify(row) !== "ok") continue;
+				const names = audit.inheritedOrgKeys[row.objectRef] ?? [];
+				audit.inheritedOrgKeys[row.objectRef] = names;
+				if (!names.includes(row.fieldName)) names.push(row.fieldName);
+			}
+		}
+		audit.orgRows.sort(sortAuditRows);
+		audit.appRows.sort(sortAuditRows);
+		audit.driftRows.sort(sortDriftRows);
+		for (const names of Object.values(audit.inheritedOrgKeys)) names.sort();
+		return audit;
+	}
+	async resolveAuditPolicies(objectRefs, tenantId, fieldMapFor) {
+		const { resolveFieldPolicyExplained } = await Promise.resolve().then(() => field_policy_resolver_exports);
+		const policies = {};
+		for (const objectRef of objectRefs) {
+			if (!await fieldMapFor(objectRef)) continue;
+			const resolved = await resolveFieldPolicyExplained(objectRef, {
+				tenantId,
+				db: this.db
+			});
+			policies[objectRef] = await this.gateExplainedForEditorResponse(resolved, {
+				manage: true,
+				personalize: false
+			}, true);
+		}
+		return policies;
+	}
 	/** All app-scope rows for an object, keyed by field name. */
 	async getAppRows(objectRef) {
 		const rows = await this.list({ where: {
@@ -687,6 +980,86 @@ var FieldPolicyCollection = class extends SmrtCollection {
 		}
 		return { policies };
 	}
+	/**
+	* Context-derived bootstrap data for the policy gear. This is deliberately
+	* a collection action instead of reopening list/get: a caller can inspect
+	* only their safe effective policy and rows/layers they are permitted to
+	* edit, never arbitrary tenant or user policy rows.
+	*/
+	async getEditorState(options = {}) {
+		const objectRef = options.objectRef;
+		if (typeof objectRef !== "string" || objectRef.trim() === "") throw new Error("getEditorState requires a non-empty \"objectRef\" string");
+		const context = getCurrentTenant();
+		const permissionOptions = {
+			collection: "fields.policy",
+			db: this.db,
+			tenantId: context?.tenantId ?? null,
+			userId: context?.userId ?? null,
+			permissionSet: context?.permissions,
+			onDeny: "return"
+		};
+		const manage = await checkOperationPermission({
+			...permissionOptions,
+			action: "fields.policy.manage".split(".").at(-1) ?? "manage"
+		});
+		const personalize = await checkOperationPermission({
+			...permissionOptions,
+			action: "fields.policy.personalize".split(".").at(-1) ?? "personalize"
+		});
+		const personalizeAllowed = personalize.allowed && typeof context?.userId === "string" && context.userId.length > 0;
+		if (!manage.allowed && !personalizeAllowed) return {
+			code: "permission_denied",
+			message: `Permission denied for '${personalize.permission ?? "fields.policy.manage"}'.`,
+			ok: false,
+			status: 403
+		};
+		const { resolveFieldPolicyExplained } = await Promise.resolve().then(() => field_policy_resolver_exports);
+		const resolved = await resolveFieldPolicyExplained(objectRef, {
+			tenantId: context?.tenantId ?? null,
+			userId: context?.userId ?? null,
+			db: this.db
+		});
+		const policy = await this.gateExplainedForEditorResponse(resolved, {
+			manage: manage.allowed,
+			personalize: personalizeAllowed
+		});
+		const fieldNames = new Set(Object.keys(policy.fields));
+		const personalLowerDefaultUsable = personalizeAllowed ? await this.getPersonalLowerDefaultUsability(objectRef, context?.tenantId ?? null, fieldNames) : {};
+		const appRows = manage.allowed ? this.toEditorRows(await this.getAppRows(objectRef), fieldNames) : [];
+		const tenantRows = manage.allowed && context?.tenantId ? this.toEditorRows((await this.getTenantRows(objectRef, [context.tenantId])).get(context.tenantId) ?? /* @__PURE__ */ new Map(), fieldNames) : [];
+		const userRows = personalizeAllowed && context?.userId ? this.toEditorRows(await this.getUserRows(objectRef, context.userId), fieldNames) : [];
+		return {
+			capabilities: {
+				manage: manage.allowed,
+				personalize: personalizeAllowed
+			},
+			personalLowerDefaultUsable,
+			policy,
+			rows: {
+				app: appRows,
+				tenant: tenantRows,
+				user: userRows
+			}
+		};
+	}
+	/**
+	* Compute the non-disclosing fallback signal used only by personal drafts.
+	* Passing no user id resolves exactly code/app/tenant precedence, including
+	* the real tenant hierarchy, while keeping every lower-layer value server
+	* side. The public map is limited to fields already admitted by the editor
+	* response's security rail.
+	*/
+	async getPersonalLowerDefaultUsability(objectRef, tenantId, fieldNames) {
+		const { resolveFieldPolicy } = await Promise.resolve().then(() => field_policy_resolver_exports);
+		const lowerPolicy = await resolveFieldPolicy(objectRef, {
+			tenantId,
+			db: this.db
+		});
+		return Object.fromEntries(Array.from(fieldNames, (fieldName) => {
+			const field = lowerPolicy.fields[fieldName];
+			return [fieldName, isUsableRequiredDefault(field?.hasDefault ? { value: field.defaultValue } : void 0)];
+		}));
+	}
 	async gateResolvedForPublicResponse(resolved) {
 		const fieldMap = await getObjectFieldMap(resolved.objectRef);
 		const fields = {};
@@ -701,6 +1074,38 @@ var FieldPolicyCollection = class extends SmrtCollection {
 			fields
 		};
 	}
+	async gateExplainedForEditorResponse(resolved, capabilities, includeCode = false) {
+		const fieldMap = await getObjectFieldMap(resolved.objectRef);
+		const fields = {};
+		const layers = {};
+		for (const [fieldName, policy] of Object.entries(resolved.fields)) {
+			const fieldDef = fieldMap.get(fieldName);
+			if (!fieldDef || isSensitiveField(fieldDef) || getFieldReadPermission(fieldDef) !== void 0 || isTransientField(fieldDef)) continue;
+			fields[fieldName] = policy;
+			layers[fieldName] = (resolved.layers[fieldName] ?? []).filter((layer) => includeCode && layer.layer === "code" || capabilities.manage && (layer.layer === "app" || layer.layer === "tenant") || capabilities.personalize && layer.layer === "user");
+		}
+		return {
+			objectRef: resolved.objectRef,
+			fields,
+			layers
+		};
+	}
+	toEditorRows(rows, allowedFieldNames) {
+		return Array.from(rows.values()).filter((row) => allowedFieldNames.has(row.fieldName)).map((row) => ({
+			defaultValue: row.defaultValue,
+			displayOrder: row.displayOrder,
+			fieldName: row.fieldName,
+			help: row.help,
+			id: String(row.id),
+			label: row.label,
+			locked: row.locked,
+			scopeType: row.scopeType,
+			tenantId: row.tenantId,
+			updatedBy: row.updatedBy,
+			userId: row.userId,
+			visibility: row.visibility
+		})).sort((left, right) => left.fieldName.localeCompare(right.fieldName));
+	}
 };
 __publicField(FieldPolicyCollection, "_itemClass", FieldPolicy);
 FieldPolicyCollection = __decorateClass([smrt({
@@ -715,23 +1120,100 @@ FieldPolicyCollection = __decorateClass([smrt({
 			"create",
 			"update",
 			"delete",
-			"resolveBatch"
+			"resolveBatch",
+			"getEditorState",
+			"policyAudit"
 		],
-		routes: { resolveBatch: {
-			scope: "collection",
-			method: "POST",
-			path: "resolve"
-		} }
+		principalContext: true,
+		routes: {
+			resolveBatch: {
+				scope: "collection",
+				method: "POST",
+				path: "resolve"
+			},
+			getEditorState: {
+				scope: "collection",
+				method: "POST",
+				path: "editor-state"
+			},
+			policyAudit: {
+				scope: "collection",
+				method: "POST",
+				path: "policy-audit"
+			}
+		}
 	},
 	cli: false,
 	mcp: false
 })], FieldPolicyCollection);
+function normalizeAuditRefs(value, label, maximum) {
+	if (value === void 0) return [];
+	if (!Array.isArray(value)) throw new Error(`policyAudit ${label} must be a string array`);
+	if (value.some((ref) => typeof ref !== "string" || ref.trim() === "")) throw new Error(`policyAudit ${label} must contain non-empty strings`);
+	const refs = [...new Set(value)];
+	if (refs.length > maximum) throw new Error(`policyAudit ${label} accepts at most ${maximum} objectRefs`);
+	return refs;
+}
+function emptyAudit(caller) {
+	return {
+		orgRows: [],
+		appRows: [],
+		inheritedOrgKeys: {},
+		userOverrideCounts: {},
+		driftRows: [],
+		policies: {},
+		caller
+	};
+}
+function dateText(value) {
+	if (value instanceof Date) return value.toISOString();
+	return typeof value === "string" ? value : null;
+}
+function toAuditRow(row) {
+	return {
+		objectRef: row.objectRef,
+		defaultValue: row.defaultValue,
+		displayOrder: row.displayOrder,
+		fieldName: row.fieldName,
+		help: row.help,
+		id: String(row.id),
+		label: row.label,
+		locked: row.locked,
+		scopeType: row.scopeType,
+		tenantId: row.tenantId,
+		updatedBy: row.updatedBy,
+		userId: row.userId,
+		visibility: row.visibility,
+		createdAt: dateText(row.createdAt),
+		updatedAt: dateText(row.updatedAt)
+	};
+}
+function toDriftIdentity(row) {
+	return {
+		id: String(row.id),
+		objectRef: row.objectRef,
+		fieldName: row.fieldName,
+		scopeType: row.scopeType,
+		tenantId: row.tenantId,
+		userId: row.userId,
+		updatedBy: row.updatedBy,
+		createdAt: dateText(row.createdAt),
+		updatedAt: dateText(row.updatedAt)
+	};
+}
+function sortAuditRows(left, right) {
+	return left.objectRef.localeCompare(right.objectRef) || left.fieldName.localeCompare(right.fieldName);
+}
+function sortDriftRows(left, right) {
+	return left.objectRef.localeCompare(right.objectRef) || left.fieldName.localeCompare(right.fieldName) || left.scopeType.localeCompare(right.scopeType);
+}
 //#endregion
 //#region src/field-policy-resolver.ts
 var field_policy_resolver_exports = /* @__PURE__ */ __exportAll({
 	isMissingUsersDependency: () => isMissingUsersDependency,
 	resolveFieldPolicy: () => resolveFieldPolicy,
-	resolveFieldPolicyExplained: () => resolveFieldPolicyExplained
+	resolveFieldPolicyExplained: () => resolveFieldPolicyExplained,
+	resolveSurvivingTenantChainIds: () => resolveSurvivingTenantChainIds
 });
 async function resolveFieldPolicy(objectRef, options = {}) {
 	const explained = await resolveFieldPolicyExplained(objectRef, options);
@@ -740,6 +1222,10 @@ async function resolveFieldPolicy(objectRef, options = {}) {
 		fields: explained.fields
 	};
 }
+async function resolveSurvivingTenantChainIds(tenantId, options = {}) {
+	assertResolutionAllowedInContext(tenantId, null);
+	return selectSurvivingChainSuffix(await resolveTenantChain(tenantId, options)).map((node) => node.id);
+}
 async function resolveFieldPolicyExplained(objectRef, options = {}) {
 	const tenantId = options.tenantId ?? null;
 	const userId = options.userId ?? null;
@@ -751,8 +1237,11 @@ async function resolveFieldPolicyExplained(objectRef, options = {}) {
 		cacheDb = collection.db;
 	}
 	const fieldMap = await getObjectFieldMap(objectRef);
-	const cached = getCachedFieldPolicy(objectRef, tenantId, userId, cacheDb, options.tenantHierarchyLoader);
-	if (cached) return cached;
+	const hasExcludedRows = (options.excludePolicyIds?.size ?? 0) > 0;
+	if (!hasExcludedRows) {
+		const cached = getCachedFieldPolicy(objectRef, tenantId, userId, cacheDb, options.tenantHierarchyLoader);
+		if (cached) return cached;
+	}
 	const policyFields = selectPolicyAddressableFields(fieldMap);
 	const codeVisibility = buildCodeSeedVisibility(fieldMap);
 	const appRows = collection ? await collection.getAppRows(objectRef) : /* @__PURE__ */ new Map();
@@ -774,7 +1263,7 @@ async function resolveFieldPolicyExplained(objectRef, options = {}) {
 		});
 		let state = applyDelta({ visibility: "basic" }, codeDelta);
 		const appRow = appRows.get(fieldName);
-		if (appRow) {
+		if (appRow && !options.excludePolicyIds?.has(String(appRow.id))) {
 			const delta = rowToDelta(appRow);
 			contributions.push({
 				layer: "app",
@@ -784,7 +1273,7 @@ async function resolveFieldPolicyExplained(objectRef, options = {}) {
 		}
 		for (const node of survivingChain) {
 			const row = tenantRows.get(node.id)?.get(fieldName);
-			if (row) {
+			if (row && !options.excludePolicyIds?.has(String(row.id))) {
 				const delta = rowToDelta(row);
 				contributions.push({
 					layer: "tenant",
@@ -796,7 +1285,7 @@ async function resolveFieldPolicyExplained(objectRef, options = {}) {
 		}
 		const orgLocked = state.locked === true;
 		const userRow = userId ? userRows.get(fieldName) : void 0;
-		if (userRow && !orgLocked) {
+		if (userRow && !options.excludePolicyIds?.has(String(userRow.id)) && !orgLocked) {
 			const delta = rowToDelta(userRow);
 			contributions.push({
 				layer: "user",
@@ -834,7 +1323,7 @@ async function resolveFieldPolicyExplained(objectRef, options = {}) {
 		fields,
 		layers
 	};
-	setCachedFieldPolicy(objectRef, tenantId, userId, cacheDb, explained, options.tenantHierarchyLoader);
+	if (!hasExcludedRows) setCachedFieldPolicy(objectRef, tenantId, userId, cacheDb, explained, options.tenantHierarchyLoader);
 	return explained;
 }
 function assertResolutionAllowedInContext(tenantId, userId) {
@@ -847,11 +1336,7 @@ function assertResolutionAllowedInContext(tenantId, userId) {
 }
 function selectPolicyAddressableFields(fieldMap) {
 	const selected = /* @__PURE__ */ new Map();
-	for (const [name, field] of fieldMap) {
-		if (field._meta?.__smrtSystemField === true) continue;
-		if (field.type === "oneToMany" || field.type === "manyToMany" || field.type === "meta") continue;
-		selected.set(name, field);
-	}
+	for (const [name, field] of fieldMap) if (isPolicyAddressableField(field)) selected.set(name, field);
 	return selected;
 }
 function rowToDelta(row) {
@@ -931,6 +1416,218 @@ function isMissingUsersDependency(error) {
 	return false;
 }
 //#endregion
-export { APP_FIELD_POLICY_SCOPE_KEY, FIELD_POLICY_SCOPE_TYPES, FIELD_POLICY_VISIBILITIES, FieldPolicy, FieldPolicyCollection, assertDefaultValueMatchesFieldType, buildCodeSeedDelta, buildCodeSeedVisibility, clearFieldPolicyCache, getCodeDefault, getCodeSeedGroup, getFieldPolicyCacheTtlMs, getFieldReadPermission, getObjectFieldMap, invalidateFieldPolicyCache, isRequiredField, isSensitiveField, isTransientField, isUsableRequiredDefault, requireRegisteredObject, resolveFieldPolicy, resolveFieldPolicyExplained, sanitizeFieldUIHints };
+//#region src/settings-catalog.ts
+var DEFAULT_PAGE_SIZE = 50;
+var MAX_PAGE_SIZE = 100;
+var FORM_TYPES = /* @__PURE__ */ new Set([
+	"text",
+	"integer",
+	"decimal",
+	"boolean",
+	"datetime",
+	"json",
+	"foreignKey",
+	"crossPackageRef"
+]);
+var SYSTEM_NAMES = /* @__PURE__ */ new Set([
+	"id",
+	"slug",
+	"context",
+	"createdAt",
+	"created_at",
+	"updatedAt",
+	"updated_at",
+	"deletedAt",
+	"deleted_at",
+	"tenantId",
+	"tenant_id"
+]);
+function fieldPolicyCatalogItemId(objectRef, fieldName) {
+	return `${objectRef}::${fieldName}`;
+}
+function parseFieldPolicyCatalogQuery(params) {
+	return {
+		query: params.get("q"),
+		page: integerParam(params.get("page")),
+		pageSize: integerParam(params.get("pageSize")),
+		selectedId: params.get("selected"),
+		packageFilter: params.get("package"),
+		objectFilter: params.get("object"),
+		customizedOnly: params.get("customized") === "1"
+	};
+}
+async function buildFieldPolicySettingsCatalog(options) {
+	const collection = options.collection ?? (options.db ? await FieldPolicyCollection.create({ db: options.db }) : null);
+	if (!collection) throw new Error("A db or FieldPolicyCollection is required");
+	const filters = {
+		packageFilter: stringFilter(options.packageFilter),
+		objectFilter: stringFilter(options.objectFilter),
+		customizedOnly: options.customizedOnly === true
+	};
+	const query = options.query?.trim() ?? "";
+	const pageSize = clamp(options.pageSize, 1, MAX_PAGE_SIZE, DEFAULT_PAGE_SIZE);
+	const baseAudit = await collection.policyAudit({ summaryOnly: true });
+	if (!baseAudit.caller.canManageOrg) return {
+		page: emptyPage(query, pageSize),
+		audit: baseAudit,
+		objects: [],
+		packages: [],
+		filters
+	};
+	const objects = await listCatalogObjects(options.objectRefs);
+	const candidates = objects.filter((object) => (!filters.packageFilter || object.packageName === filters.packageFilter) && (!filters.objectFilter || object.objectRef === filters.objectFilter));
+	const allCandidateRefs = candidates.map((object) => object.objectRef);
+	const customized = customizedKeys(filters.customizedOnly && allCandidateRefs.length ? await loadAuditCounts(collection, allCandidateRefs, baseAudit) : baseAudit);
+	const entries = candidates.flatMap((object) => Object.entries(object.fields).filter(([fieldName]) => !filters.customizedOnly || customized.has(fieldPolicyCatalogItemId(object.objectRef, fieldName))).map(([fieldName, field]) => ({
+		item: {
+			id: fieldPolicyCatalogItemId(object.objectRef, fieldName),
+			label: fieldName,
+			...field.description ? { description: field.description } : {},
+			eyebrow: `${object.className} \xB7 ${object.packageName}`,
+			objectRef: object.objectRef,
+			fieldName,
+			className: object.className,
+			packageName: object.packageName
+		},
+		search: `${fieldName} ${spaced(fieldName)} ${object.className} ${object.packageName} ${object.objectRef} ${field.description ?? ""}`.toLowerCase()
+	})));
+	const filtered = query ? entries.filter((entry) => entry.search.includes(query.toLowerCase())) : entries;
+	const total = filtered.length;
+	const page = clamp(options.page, 1, Math.max(1, Math.ceil(total / pageSize)), 1);
+	const items = filtered.slice((page - 1) * pageSize, page * pageSize).map((entry) => entry.item);
+	const selectedSummary = (options.selectedId ? filtered.find((entry) => entry.item.id === options.selectedId)?.item : void 0) ?? items[0];
+	const selected = selectedSummary ? {
+		...selectedSummary,
+		fields: objects.find((object) => object.objectRef === selectedSummary.objectRef)?.fields ?? {}
+	} : null;
+	const auditRefs = selected ? uniqueRefs([selected.objectRef, ...items.map((item) => item.objectRef)]) : [];
+	const audit = auditRefs.length ? await collection.policyAudit({
+		objectRefs: auditRefs.slice(0, 100),
+		countObjectRefs: auditRefs,
+		includeDrift: true
+	}) : await collection.policyAudit({ includeDrift: true });
+	return {
+		page: {
+			items,
+			selected,
+			query,
+			page,
+			pageSize,
+			total
+		},
+		audit,
+		objects: objects.map(({ objectRef, className, packageName, fields }) => ({
+			objectRef,
+			className,
+			packageName,
+			fieldCount: Object.keys(fields).length
+		})),
+		packages: [...new Set(objects.map((object) => object.packageName))].sort(),
+		filters
+	};
+}
+async function listCatalogObjects(objectRefs) {
+	const refs = objectRefs ? [...objectRefs] : Array.from(ObjectRegistry.getPublicClasses().values()).reduce((result, registered) => {
+		if (registered.qualifiedName) result.push(registered.qualifiedName);
+		return result;
+	}, []);
+	const unique = [...new Set(refs)].sort();
+	const objects = [];
+	for (const objectRef of unique) {
+		if (!ObjectRegistry.getClassByQualifiedName(objectRef) || ObjectRegistry.getTableName(objectRef)?.startsWith("_smrt_")) continue;
+		const fields = await getObjectFieldMap(objectRef);
+		const selected = {};
+		for (const [name, definition] of fields) {
+			if (SYSTEM_NAMES.has(name) || !isPolicyAddressableField(definition) || isSensitiveField(definition) || isTransientField(definition) || getFieldReadPermission(definition) !== void 0 || !FORM_TYPES.has(String(definition.type))) continue;
+			selected[name] = {
+				type: definition.type,
+				...definition.required === true ? { required: true } : {},
+				...definition.default !== void 0 ? { default: definition.default } : {},
+				...typeof definition.description === "string" ? { description: definition.description } : {}
+			};
+		}
+		if (!Object.keys(selected).length) continue;
+		const colon = objectRef.lastIndexOf(":");
+		const packageName = colon === -1 ? "" : objectRef.slice(0, colon);
+		const className = colon === -1 ? objectRef : objectRef.slice(colon + 1);
+		objects.push({
+			objectRef,
+			className,
+			packageName,
+			fields: selected
+		});
+	}
+	return objects;
+}
+async function loadAuditCounts(collection, refs, baseline) {
+	const userOverrideCounts = {};
+	const orgRows = [];
+	const appRows = [];
+	const inheritedOrgKeys = {};
+	const chunkSize = 100;
+	for (let offset = 0; offset < refs.length; offset += chunkSize) {
+		const audit = await collection.policyAudit({
+			objectRefs: refs.slice(offset, offset + chunkSize),
+			countObjectRefs: refs.slice(offset, offset + chunkSize),
+			countsOnly: true
+		});
+		for (const [objectRef, byField] of Object.entries(audit.userOverrideCounts)) userOverrideCounts[objectRef] = {
+			...userOverrideCounts[objectRef] ?? {},
+			...byField
+		};
+		orgRows.push(...audit.orgRows);
+		appRows.push(...audit.appRows);
+		for (const [objectRef, fieldNames] of Object.entries(audit.inheritedOrgKeys)) {
+			const names = inheritedOrgKeys[objectRef] ?? [];
+			inheritedOrgKeys[objectRef] = names;
+			for (const fieldName of fieldNames) if (!names.includes(fieldName)) names.push(fieldName);
+		}
+	}
+	return {
+		...baseline,
+		orgRows,
+		appRows,
+		inheritedOrgKeys,
+		userOverrideCounts
+	};
+}
+function customizedKeys(audit) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const row of [...audit.orgRows, ...audit.appRows]) keys.add(fieldPolicyCatalogItemId(row.objectRef, row.fieldName));
+	for (const [objectRef, names] of Object.entries(audit.inheritedOrgKeys)) for (const name of names) keys.add(fieldPolicyCatalogItemId(objectRef, name));
+	for (const [objectRef, fields] of Object.entries(audit.userOverrideCounts)) for (const [name, count] of Object.entries(fields)) if (count > 0) keys.add(fieldPolicyCatalogItemId(objectRef, name));
+	return keys;
+}
+function emptyPage(query, pageSize) {
+	return {
+		items: [],
+		selected: null,
+		query,
+		page: 1,
+		pageSize,
+		total: 0
+	};
+}
+function uniqueRefs(refs) {
+	return [...new Set(refs)];
+}
+function stringFilter(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : null;
+}
+function integerParam(value) {
+	return value && /^\d+$/.test(value) ? Number(value) : null;
+}
+function clamp(value, min, max, fallback) {
+	return Number.isFinite(value) ? Math.min(max, Math.max(min, Math.trunc(value))) : fallback;
+}
+function spaced(value) {
+	return value.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]/g, " ");
+}
+//#endregion
+//#region src/index.ts
+ensureFieldPolicyPermissionsRegistered();
+//#endregion
+export { APP_FIELD_POLICY_SCOPE_KEY, FIELD_POLICY_PERMISSION_DEFINITIONS, FIELD_POLICY_SCOPE_TYPES, FIELD_POLICY_VISIBILITIES, FieldPolicy, FieldPolicyCollection, MANAGE_FIELD_POLICY_PERMISSION, PERSONALIZE_FIELD_POLICY_PERMISSION, assertDefaultValueMatchesFieldType, buildCodeSeedDelta, buildCodeSeedVisibility, buildFieldPolicySettingsCatalog, clearFieldPolicyCache, ensureFieldPolicyPermissionsRegistered, fieldPolicyCatalogItemId, getCodeDefault, getCodeSeedGroup, getFieldPolicyCacheTtlMs, getFieldReadPermission, getObjectFieldMap, invalidateFieldPolicyCache, isPolicyAddressableField, isRequiredField, isSensitiveField, isTransientField, isUsableRequiredDefault, parseFieldPolicyCatalogQuery, requireRegisteredObject, resolveFieldPolicy, resolveFieldPolicyExplained, resolveSurvivingTenantChainIds, sanitizeFieldUIHints };
 
 //# sourceMappingURL=index.js.map