@objectstack/platform-objects 12.5.0 → 13.0.0

package/dist/index.js

@@ -39,13 +39,14 @@ var SysUser = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
-      // Org invitations are a multi-org-only flow (the endpoint resolves
-      // an active org that does not exist in single-org mode). Hide the
-      // affordance unless multi-org is enabled — matching the
-      // `create_organization` gate on sys_organization. This action is the
-      // most exposed of the set because the Users list is always reachable
-      // in single-org, unlike the org/membership lists.
-      visible: "features.multiOrgEnabled != false",
+      // Gated on the org CAPABILITY, not multi-org (ADR-0081 D1): the
+      // better-auth organization plugin is always mounted, and single-org
+      // mode now bootstraps a Default Organization (plugin-auth) so the
+      // endpoint's active-org resolution works there too. This is THE
+      // "add a teammate" affordance — the Users list is always reachable —
+      // and every add flows through better-auth invitations, never bespoke
+      // sys_user CRUD.
+      visible: "features.organization != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -934,6 +935,12 @@ var SysVerification = data.ObjectSchema.create({
   icon: "shield-check",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE one-time credentials
+  // (email/phone verification + password-reset tokens) — reading one is
+  // account takeover. Not covered by the wildcard `'*'` grant; admins retain
+  // access via the superuser bypass; better-auth reads via its adapter
+  // (system context), so verification flows are unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -1267,11 +1274,11 @@ var SysMember = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/add-member",
-      // Org-membership mutations are multi-org-only: the better-auth
-      // endpoints resolve an active org that does not exist in single-org
-      // mode, so these actions would fail at the API. Gate every one on
-      // the multi-org flag (mirrors sys_organization.create_organization).
-      visible: "features.multiOrgEnabled != false",
+      // Gated on the org CAPABILITY, not multi-org (ADR-0081 D1): the
+      // better-auth endpoints resolve the session's active org, which
+      // single-org mode now guarantees via plugin-auth's default-org
+      // bootstrap. Same gate on every membership mutation below.
+      visible: "features.organization != false",
       successMessage: "Member added",
       refreshAfter: true,
       params: [
@@ -1289,7 +1296,7 @@ var SysMember = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Member role updated",
       refreshAfter: true,
       params: [
@@ -1306,7 +1313,7 @@ var SysMember = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-member",
       recordIdParam: "memberIdOrEmail",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Remove this member from the organization? They will lose access to all org resources.",
       successMessage: "Member removed",
       refreshAfter: true
@@ -1328,7 +1335,7 @@ var SysMember = data.ObjectSchema.create({
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
       bodyExtra: { role: "owner" },
-      visible: "record.role != 'owner' && features.multiOrgEnabled != false",
+      visible: "record.role != 'owner' && features.organization != false",
       confirmText: "Transfer ownership of this organization to the selected member? You will be demoted to admin and lose owner-only privileges.",
       successMessage: "Ownership transferred",
       refreshAfter: true
@@ -1436,7 +1443,7 @@ var SysInvitation = data.ObjectSchema.create({
       // sys_organization.create_organization). The recipient-side
       // accept/reject actions below stay record-gated — they are
       // unreachable in single-org anyway (no invitation rows exist).
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -1454,7 +1461,7 @@ var SysInvitation = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/cancel-invitation",
       recordIdParam: "invitationId",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Cancel this invitation? The recipient will no longer be able to accept it.",
       successMessage: "Invitation canceled",
       refreshAfter: true
@@ -1468,7 +1475,7 @@ var SysInvitation = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
       bodyExtra: { resend: true },
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Invitation resent",
       refreshAfter: true,
       params: [
@@ -1658,7 +1665,7 @@ var SysTeam = data.ObjectSchema.create({
       // Teams are nested inside organizations — a multi-org-only concept.
       // Gate every team mutation on the multi-org flag so the affordances
       // disappear in single-org (mirrors sys_organization.create_organization).
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Team created",
       refreshAfter: true,
       params: [
@@ -1679,7 +1686,7 @@ var SysTeam = data.ObjectSchema.create({
       target: "/api/v1/auth/organization/update-team",
       recordIdParam: "teamId",
       bodyShape: { wrap: "data" },
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Team updated",
       refreshAfter: true,
       params: [
@@ -1698,7 +1705,7 @@ var SysTeam = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-team",
       recordIdParam: "teamId",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Delete this team? Members will lose any team-scoped access. This cannot be undone.",
       successMessage: "Team deleted",
       refreshAfter: true
@@ -1812,7 +1819,7 @@ var SysTeamMember = data.ObjectSchema.create({
       // Team membership lives under organizations — multi-org-only. Gate
       // both mutations so they vanish in single-org (mirrors
       // sys_organization.create_organization).
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Team member added",
       refreshAfter: true,
       params: [
@@ -1833,7 +1840,7 @@ var SysTeamMember = data.ObjectSchema.create({
       locations: ["list_item"],
       type: "api",
       target: "/api/v1/auth/organization/remove-team-member",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Remove this user from the team? They will lose any team-scoped access.",
       successMessage: "Team member removed",
       refreshAfter: true,
@@ -2071,7 +2078,7 @@ var SysBusinessUnitMember = data.ObjectSchema.create({
   managedBy: "platform",
   description: "User assignment to a business unit (matrix-org friendly, effective-dated).",
   titleFormat: "{user_id} in {business_unit_id}",
-  highlightFields: ["user_id", "business_unit_id", "role_in_business_unit", "is_primary"],
+  highlightFields: ["user_id", "business_unit_id", "function_in_business_unit", "is_primary"],
   fields: {
     id: data.Field.text({
       label: "Member ID",
@@ -2089,10 +2096,10 @@ var SysBusinessUnitMember = data.ObjectSchema.create({
       required: true,
       group: "Assignment"
     }),
-    role_in_business_unit: data.Field.select(
+    function_in_business_unit: data.Field.select(
       ["member", "lead", "deputy"],
       {
-        label: "Role in Business Unit",
+        label: "Function in Business Unit",
         required: false,
         defaultValue: "member",
         description: "`lead` is the day-to-day head; `deputy` may stand in for the lead in approval routing.",
@@ -2496,6 +2503,12 @@ var SysDeviceCode = data.ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE pending device-grant
+  // codes — reading `user_code`/`device_code` lets an attacker hijack a
+  // pending CLI login. Not covered by the wildcard `'*'` grant; admins retain
+  // access via the superuser bypass; better-auth reads via its adapter
+  // (system context), so the device-grant flow is unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3091,6 +3104,11 @@ var SysOauthAccessToken = data.ObjectSchema.create({
   icon: "ticket",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE bearer credentials —
+  // reading one is session hijack. Not covered by the wildcard `'*'` grant;
+  // admins retain access via the superuser bypass; better-auth reads via its
+  // adapter (system context), so OAuth flows are unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3177,6 +3195,11 @@ var SysOauthRefreshToken = data.ObjectSchema.create({
   icon: "refresh-cw",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE long-lived credentials —
+  // a refresh token mints new access tokens. Not covered by the wildcard `'*'`
+  // grant; admins retain access via the superuser bypass; better-auth reads
+  // via its adapter (system context), so OAuth flows are unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3335,6 +3358,13 @@ var SysJwks = data.ObjectSchema.create({
   icon: "key",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are the environment's JWT SIGNING
+  // KEYS (private key material). Not covered by the wildcard `'*'` grant — an
+  // ordinary member gets 403 from the generic data layer. Platform admins
+  // (viewAllRecords/modifyAllRecords) retain access via the posture-gated
+  // superuser bypass; better-auth itself reads via its adapter (system
+  // context), so token signing/verification is unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3648,6 +3678,14 @@ var SysScimProvider = data.ObjectSchema.create({
   icon: "users",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D3/④] Admin-only identity config carrying a live credential
+  // (`scim_token` — the bearer external IdPs authenticate provisioning calls
+  // with). Object-level capability gate, mirroring the sibling
+  // `sys_sso_provider`: ordinary members are denied entirely (without it, the
+  // `member_default` wildcard `'*': allowRead` would expose SCIM connections
+  // to every authenticated user). better-auth's own endpoints read via a
+  // system context, so SCIM provisioning is unaffected.
+  requiredPermissions: ["manage_platform_settings"],
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
   protection: {
     lock: "full",
@@ -4936,6 +4974,14 @@ var SysSecret = data.ObjectSchema.create({
   icon: "key",
   isSystem: true,
   managedBy: "system",
+  // [ADR-0066 D2/④] Secure-by-default: the environment's encrypted-secrets
+  // store (settings/datasource credentials). Not covered by the wildcard `'*'`
+  // grant — ordinary members get 403 from the generic data layer. Platform
+  // admins retain access via the posture-gated superuser bypass. Internal
+  // readers are unaffected: `engine.resolveSecret` reads at DRIVER level,
+  // SettingsService / the datasource secret-binder read with no principal
+  // (middleware falls open for principal-less internal calls).
+  access: { default: "private" },
   description: "Cipher store referenced by sys_setting handles. Never holds plaintext.",
   highlightFields: ["namespace", "key", "kms_key_id", "version", "rotated_at"],
   listViews: {
@@ -5283,10 +5329,22 @@ var SETUP_NAV_CONTRIBUTIONS = [
     priority: BASE_PRIORITY,
     items: [
       { id: "nav_users", type: "object", label: "Users", objectName: "sys_user", icon: "user" },
+      // The ACTIVE organization's record page (Members / Invitations / Teams
+      // tabs with the better-auth row actions), rendered inside the app shell
+      // (ADR-0081). `{current_org_id}` resolves from the session's active
+      // organization; unresolved (e.g. org-less admin before bootstrap) it
+      // falls back to the sys_organization list — one row in single-org.
+      { id: "nav_organization", type: "object", label: "Organization", objectName: "sys_organization", recordId: "{current_org_id}", icon: "building-2" },
       { id: "nav_business_units", type: "object", label: "Business Units", objectName: "sys_business_unit", icon: "building", requiresObject: "sys_business_unit" },
-      { id: "nav_teams", type: "object", label: "Teams", objectName: "sys_team", icon: "users-round", requiresService: "org-scoping" },
+      // Teams / Invitations no longer gate on `org-scoping` (ADR-0081 D1):
+      // the better-auth organization capability is always mounted, and
+      // plugin-auth's single-org default-org bootstrap guarantees an org to
+      // invite into — these are the OPEN member-management basics. Only the
+      // org LIST below keeps the gate: browsing organizations is meaningful
+      // only when more than one can exist (enterprise multi-org).
+      { id: "nav_teams", type: "object", label: "Teams", objectName: "sys_team", icon: "users-round" },
       { id: "nav_organizations", type: "object", label: "Organizations", objectName: "sys_organization", icon: "building-2", requiresService: "org-scoping" },
-      { id: "nav_invitations", type: "object", label: "Invitations", objectName: "sys_invitation", icon: "mail", requiresService: "org-scoping" }
+      { id: "nav_invitations", type: "object", label: "Invitations", objectName: "sys_invitation", icon: "mail" }
     ]
   },
   {
@@ -5348,7 +5406,11 @@ var SETUP_NAV_CONTRIBUTIONS = [
     priority: BASE_PRIORITY,
     items: [
       { id: "nav_oauth_apps", type: "object", label: "OAuth Applications", objectName: "sys_oauth_application", icon: "app-window" },
-      { id: "nav_jwks", type: "object", label: "Signing Keys (JWKS)", objectName: "sys_jwks", icon: "key-round" },
+      // nav_jwks is capability-gated (like nav_api_keys): sys_jwks is
+      // `access.default:'private'` (ADR-0066 ④ — signing keys), so a
+      // non-admin's list request 403s server-side; gating the nav item keeps
+      // the menu honest instead of showing an entry that can only error.
+      { id: "nav_jwks", type: "object", label: "Signing Keys (JWKS)", objectName: "sys_jwks", icon: "key-round", requiredPermissions: ["manage_platform_settings"] },
       // `sys_verification` (email/phone tokens) and `sys_device_code` (OAuth
       // device-grant codes) deliberately omit `list` from their `apiMethods`
       // (sensitive, ephemeral secrets — not browsable), so an object/list-view
@@ -6687,8 +6749,8 @@ var enObjects = {
       user_id: {
         label: "User"
       },
-      role_in_business_unit: {
-        label: "Role in Business Unit",
+      function_in_business_unit: {
+        label: "Function in Business Unit",
         help: "`lead` is the day-to-day head; `deputy` may stand in for the lead in approval routing.",
         options: {
           member: "member",
@@ -8640,6 +8702,7 @@ var en = {
         nav_marketplace_installed: { label: "Installed Apps" },
         // People & Organization
         nav_users: { label: "Users" },
+        nav_organization: { label: "Organization" },
         nav_business_units: { label: "Business Units" },
         nav_teams: { label: "Teams" },
         nav_organizations: { label: "Organizations" },
@@ -9433,8 +9496,8 @@ var zhCNObjects = {
       user_id: {
         label: "\u7528\u6237"
       },
-      role_in_business_unit: {
-        label: "\u4E1A\u52A1\u5355\u5143\u5185\u89D2\u8272",
+      function_in_business_unit: {
+        label: "\u4E1A\u52A1\u5355\u5143\u5185\u804C\u80FD",
         help: "`lead` \u8868\u793A\u65E5\u5E38\u8D1F\u8D23\u4EBA\uFF1B`deputy` \u53EF\u5728\u5BA1\u6279\u8DEF\u7531\u4E2D\u4EE3\u66FF\u8D1F\u8D23\u4EBA\u3002",
         options: {
           member: "\u6210\u5458",
@@ -11383,6 +11446,7 @@ var zhCN = {
         group_advanced: { label: "\u9AD8\u7EA7" },
         nav_system_overview: { label: "\u7CFB\u7EDF\u6982\u89C8" },
         nav_users: { label: "\u7528\u6237" },
+        nav_organization: { label: "\u7EC4\u7EC7" },
         nav_business_units: { label: "\u4E1A\u52A1\u5355\u5143" },
         nav_teams: { label: "\u56E2\u961F" },
         nav_organizations: { label: "\u7EC4\u7EC7" },
@@ -12142,8 +12206,8 @@ var jaJPObjects = {
       user_id: {
         label: "\u30E6\u30FC\u30B6\u30FC"
       },
-      role_in_business_unit: {
-        label: "\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8\u5185\u30ED\u30FC\u30EB",
+      function_in_business_unit: {
+        label: "\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8\u5185\u306E\u8077\u80FD",
         help: "`lead` \u306F\u65E5\u5E38\u306E\u8CAC\u4EFB\u8005\u3001`deputy` \u306F\u627F\u8A8D\u30EB\u30FC\u30C6\u30A3\u30F3\u30B0\u3067\u30EA\u30FC\u30C9\u306E\u4EE3\u7406\u3092\u52D9\u3081\u308B\u5834\u5408\u304C\u3042\u308A\u307E\u3059\u3002",
         options: {
           member: "\u30E1\u30F3\u30D0\u30FC",
@@ -14091,6 +14155,7 @@ var jaJP = {
         group_advanced: { label: "\u8A73\u7D30" },
         nav_system_overview: { label: "\u30B7\u30B9\u30C6\u30E0\u6982\u8981" },
         nav_users: { label: "\u30E6\u30FC\u30B6\u30FC" },
+        nav_organization: { label: "\u7D44\u7E54" },
         nav_business_units: { label: "\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8" },
         nav_teams: { label: "\u30C1\u30FC\u30E0" },
         nav_organizations: { label: "\u7D44\u7E54" },
@@ -14848,8 +14913,8 @@ var esESObjects = {
       user_id: {
         label: "Usuario"
       },
-      role_in_business_unit: {
-        label: "Rol en el departamento",
+      function_in_business_unit: {
+        label: "Funci\xF3n en la unidad de negocio",
         help: "`lead` es el responsable del d\xEDa a d\xEDa; `deputy` puede sustituir al responsable en el enrutamiento de aprobaciones.",
         options: {
           member: "Miembro",
@@ -16797,6 +16862,7 @@ var esES = {
         group_advanced: { label: "Avanzado" },
         nav_system_overview: { label: "Resumen del Sistema" },
         nav_users: { label: "Usuarios" },
+        nav_organization: { label: "Organizaci\xF3n" },
         nav_business_units: { label: "Unidades de negocio" },
         nav_teams: { label: "Equipos" },
         nav_organizations: { label: "Organizaciones" },
@@ -17046,7 +17112,7 @@ var SysUserDetailPage = {
     },
     // ── Tabs: curated related lists ───────────────────────────────
     // Only the 4 lists that are semantically about THIS user account.
-    // Everything else (sys_role created_by, sys_email_template
+    // Everything else (sys_position created_by, sys_email_template
     // updated_by, …) is incidental authorship metadata and would only
     // create noise.
     tabs: {
@@ -18566,10 +18632,6 @@ var enMetadataForms = {
         label: "Label",
         helpText: "Display label for admins"
       },
-      isProfile: {
-        label: "Is Profile",
-        helpText: "Profile = base set assigned to users. Permission Set = additive grant."
-      },
       systemPermissions: {
         label: "System Permissions",
         helpText: "List of system capability keys"
@@ -18625,10 +18687,6 @@ var enMetadataForms = {
         label: "Label",
         helpText: "Display label for admins"
       },
-      isProfile: {
-        label: "Is Profile",
-        helpText: "Profile = base set assigned to users. Permission Set = additive grant."
-      },
       systemPermissions: {
         label: "System Permissions",
         helpText: "List of system capability keys"
@@ -20204,10 +20262,6 @@ var zhCNMetadataForms = {
         label: "\u663E\u793A\u540D\u79F0",
         helpText: "\u9762\u5411\u7BA1\u7406\u5458\u7684\u663E\u793A\u6807\u7B7E"
       },
-      isProfile: {
-        label: "\u662F\u5426\u914D\u7F6E\u6587\u4EF6",
-        helpText: "\u52FE\u9009\u540E\u4F5C\u4E3A\u5B8C\u6574\u914D\u7F6E\u6587\u4EF6\uFF08\u800C\u975E\u9644\u52A0\u6743\u9650\u96C6\uFF09"
-      },
       systemPermissions: {
         label: "\u7CFB\u7EDF\u6743\u9650",
         helpText: "\u5E94\u7528\u8BBF\u95EE\u3001API\u3001\u7BA1\u7406\u64CD\u4F5C"
@@ -20263,10 +20317,6 @@ var zhCNMetadataForms = {
         label: "\u663E\u793A\u540D\u79F0",
         helpText: "\u9762\u5411\u7BA1\u7406\u5458\u663E\u793A\u7684\u6807\u7B7E"
       },
-      isProfile: {
-        label: "\u662F\u5426\u914D\u7F6E\u6587\u4EF6",
-        helpText: "\u914D\u7F6E\u6587\u4EF6 = \u5206\u914D\u7ED9\u7528\u6237\u7684\u57FA\u7840\u96C6\u5408\u3002\u6743\u9650\u96C6 = \u9644\u52A0\u6388\u4E88\u3002"
-      },
       systemPermissions: {
         label: "\u7CFB\u7EDF\u6743\u9650",
         helpText: "\u7CFB\u7EDF\u80FD\u529B\u952E\u5217\u8868"
@@ -21842,10 +21892,6 @@ var jaJPMetadataForms = {
         label: "\u8868\u793A\u540D",
         helpText: "\u7BA1\u7406\u8005\u5411\u3051\u8868\u793A\u30E9\u30D9\u30EB"
       },
-      isProfile: {
-        label: "\u30D7\u30ED\u30D5\u30A1\u30A4\u30EB\u304B",
-        helpText: "Profile = \u30E6\u30FC\u30B6\u30FC\u306B\u5272\u308A\u5F53\u3066\u308B\u57FA\u672C\u30BB\u30C3\u30C8\u3002Permission Set = \u8FFD\u52A0\u6A29\u9650\u3002"
-      },
       systemPermissions: {
         label: "\u30B7\u30B9\u30C6\u30E0\u6A29\u9650",
         helpText: "\u30B7\u30B9\u30C6\u30E0\u6A5F\u80FD\u30AD\u30FC\u306E\u30EA\u30B9\u30C8"
@@ -21901,10 +21947,6 @@ var jaJPMetadataForms = {
         label: "\u8868\u793A\u540D",
         helpText: "\u7BA1\u7406\u8005\u5411\u3051\u8868\u793A\u30E9\u30D9\u30EB"
       },
-      isProfile: {
-        label: "\u30D7\u30ED\u30D5\u30A1\u30A4\u30EB\u304B",
-        helpText: "Profile = \u30E6\u30FC\u30B6\u30FC\u306B\u5272\u308A\u5F53\u3066\u308B\u57FA\u672C\u30BB\u30C3\u30C8\u3002Permission Set = \u8FFD\u52A0\u6A29\u9650\u3002"
-      },
       systemPermissions: {
         label: "\u30B7\u30B9\u30C6\u30E0\u6A29\u9650",
         helpText: "\u30B7\u30B9\u30C6\u30E0\u6A5F\u80FD\u30AD\u30FC\u306E\u30EA\u30B9\u30C8"
@@ -23480,10 +23522,6 @@ var esESMetadataForms = {
         label: "Etiqueta",
         helpText: "Etiqueta mostrada para administradores"
       },
-      isProfile: {
-        label: "Es perfil",
-        helpText: "Profile = conjunto base asignado a usuarios. Permission Set = concesi\xF3n adicional."
-      },
       systemPermissions: {
         label: "Permisos del sistema",
         helpText: "Lista de claves de capacidades del sistema"
@@ -23539,10 +23577,6 @@ var esESMetadataForms = {
         label: "Etiqueta",
         helpText: "Etiqueta mostrada para administradores"
       },
-      isProfile: {
-        label: "Es perfil",
-        helpText: "Profile = conjunto base asignado a usuarios. Permission Set = concesi\xF3n adicional."
-      },
       systemPermissions: {
         label: "Permisos del sistema",
         helpText: "Lista de claves de capacidades del sistema"