@objectstack/platform-objects 12.6.0 → 14.3.0

package/dist/index.mjs

@@ -37,13 +37,14 @@ var SysUser = ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
-      // Org invitations are a multi-org-only flow (the endpoint resolves
-      // an active org that does not exist in single-org mode). Hide the
-      // affordance unless multi-org is enabled — matching the
-      // `create_organization` gate on sys_organization. This action is the
-      // most exposed of the set because the Users list is always reachable
-      // in single-org, unlike the org/membership lists.
-      visible: "features.multiOrgEnabled != false",
+      // Gated on the org CAPABILITY, not multi-org (ADR-0081 D1): the
+      // better-auth organization plugin is always mounted, and single-org
+      // mode now bootstraps a Default Organization (plugin-auth) so the
+      // endpoint's active-org resolution works there too. This is THE
+      // "add a teammate" affordance — the Users list is always reachable —
+      // and every add flows through better-auth invitations, never bespoke
+      // sys_user CRUD.
+      visible: "features.organization != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -102,6 +103,62 @@ var SysUser = ObjectSchema.create({
       successMessage: "Account unlocked",
       refreshAfter: true
     },
+    {
+      // #2766 V1 — a platform admin can add a login-capable teammate without
+      // the email-dependent invite flow. Hits the plugin-auth wrapper route
+      // (NOT better-auth's stock /admin/create-user): the wrapper runs the
+      // ADR-0068 admin gate, drives the better-auth pipeline (scrypt hash +
+      // credential sys_account), stamps must_change_password, and — when
+      // "Generate temporary password" is picked — returns the password ONCE
+      // in the response for the result dialog. It is never persisted or logged.
+      name: "create_user",
+      label: "Create User",
+      icon: "user-plus",
+      variant: "secondary",
+      locations: ["list_toolbar"],
+      type: "api",
+      target: "/api/v1/auth/admin/create-user",
+      visible: "features.admin == true",
+      successMessage: "User created",
+      refreshAfter: true,
+      params: [
+        // The endpoint requires email OR phone (phone-only users get a
+        // placeholder address; requires auth.plugins.phoneNumber).
+        { field: "email", required: false },
+        {
+          name: "phoneNumber",
+          label: "Phone Number",
+          type: "text",
+          required: false,
+          helpText: "Sign-in phone number (E.164, e.g. +8613800000000). Required when no email is given."
+        },
+        { field: "name", required: false },
+        {
+          name: "generatePassword",
+          label: "Generate Temporary Password",
+          type: "boolean",
+          required: false,
+          defaultValue: true
+        },
+        { name: "password", label: "Password (leave empty to generate)", type: "text", required: false },
+        {
+          name: "mustChangePassword",
+          label: "Require Password Change On First Login",
+          type: "boolean",
+          required: false,
+          defaultValue: true
+        }
+      ],
+      resultDialog: {
+        title: "User Created",
+        description: "Copy the temporary password now \u2014 it is shown only once and never stored.",
+        acknowledge: "I have saved this password",
+        fields: [
+          { path: "user.email", label: "Email", format: "text" },
+          { path: "temporaryPassword", label: "Temporary Password", format: "secret" }
+        ]
+      }
+    },
     {
       name: "set_user_password",
       label: "Set Password",
@@ -109,13 +166,40 @@ var SysUser = ObjectSchema.create({
       variant: "secondary",
       locations: ["list_item"],
       type: "api",
+      // #2766 V1 — same path as better-auth's stock route, but served by the
+      // plugin-auth wrapper registered ahead of the catch-all: it accepts the
+      // ADR-0068 platform-admin signals (the stock handler only honors the
+      // legacy role scalar), can mint a temporary password, and stamps
+      // must_change_password.
       target: "/api/v1/auth/admin/set-user-password",
       recordIdParam: "userId",
       successMessage: "Password updated",
       refreshAfter: false,
       params: [
-        { name: "newPassword", label: "New Password", type: "text", required: true }
-      ]
+        {
+          name: "generatePassword",
+          label: "Generate Temporary Password",
+          type: "boolean",
+          required: false,
+          defaultValue: false
+        },
+        { name: "newPassword", label: "New Password (leave empty to generate)", type: "text", required: false },
+        {
+          name: "mustChangePassword",
+          label: "Require Password Change On Next Login",
+          type: "boolean",
+          required: false,
+          defaultValue: true
+        }
+      ],
+      resultDialog: {
+        title: "Password Updated",
+        description: "If a temporary password was generated, copy it now \u2014 it is shown only once and never stored.",
+        acknowledge: "Done",
+        fields: [
+          { path: "temporaryPassword", label: "Temporary Password", format: "secret" }
+        ]
+      }
     },
     {
       name: "set_user_role",
@@ -434,6 +518,37 @@ var SysUser = ObjectSchema.create({
       group: "Admin",
       description: "Timestamp of the last password change. Backs password_expiry_days; system-managed."
     }),
+    // #2766 V1.5 — phone-number sign-in identifier (better-auth phoneNumber
+    // plugin, mapped via buildPhoneNumberPluginSchema). Unique when present;
+    // null for email-only accounts. Written through better-auth, not CRUD.
+    phone_number: Field.text({
+      label: "Phone Number",
+      required: false,
+      readonly: true,
+      searchable: true,
+      maxLength: 32,
+      group: "Account",
+      description: "Sign-in phone number (E.164 recommended). Unique per user; managed by better-auth when the phoneNumber plugin is enabled."
+    }),
+    phone_number_verified: Field.boolean({
+      label: "Phone Verified",
+      defaultValue: false,
+      readonly: true,
+      group: "Account",
+      description: "Whether the phone number has been verified (OTP verification requires SMS infrastructure; false until that ships). System-managed."
+    }),
+    // #2766 V1 — admin-issued "must change password on next sign-in" flag.
+    // Set by the /admin/create-user and /admin/set-user-password routes when
+    // a temporary password is issued; enforced through the ADR-0069 authGate
+    // (surfaces as PASSWORD_EXPIRED); cleared by stampPasswordChangedAt once
+    // the user completes a password change.
+    must_change_password: Field.boolean({
+      label: "Must Change Password",
+      defaultValue: false,
+      readonly: true,
+      group: "Admin",
+      description: "When true, the user is blocked (403 PASSWORD_EXPIRED) until they change their password. Stamped by the admin user-management routes; system-managed."
+    }),
     // ADR-0069 D3 — when enforced MFA first applied to this user; starts the
     // grace clock. Stamped lazily at session validation; system-managed.
     mfa_required_at: Field.datetime({
@@ -531,7 +646,10 @@ var SysUser = ObjectSchema.create({
   },
   indexes: [
     { fields: ["email"], unique: true },
-    { fields: ["created_at"], unique: false }
+    { fields: ["created_at"], unique: false },
+    // #2766 V1.5 — phone sign-in identifier; unique when present (null for
+    // email-only accounts), also the upsert match key for identity import.
+    { fields: ["phone_number"], unique: true }
   ],
   enable: {
     trackHistory: true,
@@ -932,6 +1050,12 @@ var SysVerification = ObjectSchema.create({
   icon: "shield-check",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE one-time credentials
+  // (email/phone verification + password-reset tokens) — reading one is
+  // account takeover. Not covered by the wildcard `'*'` grant; admins retain
+  // access via the superuser bypass; better-auth reads via its adapter
+  // (system context), so verification flows are unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -1265,11 +1389,11 @@ var SysMember = ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/add-member",
-      // Org-membership mutations are multi-org-only: the better-auth
-      // endpoints resolve an active org that does not exist in single-org
-      // mode, so these actions would fail at the API. Gate every one on
-      // the multi-org flag (mirrors sys_organization.create_organization).
-      visible: "features.multiOrgEnabled != false",
+      // Gated on the org CAPABILITY, not multi-org (ADR-0081 D1): the
+      // better-auth endpoints resolve the session's active org, which
+      // single-org mode now guarantees via plugin-auth's default-org
+      // bootstrap. Same gate on every membership mutation below.
+      visible: "features.organization != false",
       successMessage: "Member added",
       refreshAfter: true,
       params: [
@@ -1287,7 +1411,7 @@ var SysMember = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Member role updated",
       refreshAfter: true,
       params: [
@@ -1304,7 +1428,7 @@ var SysMember = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-member",
       recordIdParam: "memberIdOrEmail",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Remove this member from the organization? They will lose access to all org resources.",
       successMessage: "Member removed",
       refreshAfter: true
@@ -1326,7 +1450,7 @@ var SysMember = ObjectSchema.create({
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
       bodyExtra: { role: "owner" },
-      visible: "record.role != 'owner' && features.multiOrgEnabled != false",
+      visible: "record.role != 'owner' && features.organization != false",
       confirmText: "Transfer ownership of this organization to the selected member? You will be demoted to admin and lose owner-only privileges.",
       successMessage: "Ownership transferred",
       refreshAfter: true
@@ -1434,7 +1558,7 @@ var SysInvitation = ObjectSchema.create({
       // sys_organization.create_organization). The recipient-side
       // accept/reject actions below stay record-gated — they are
       // unreachable in single-org anyway (no invitation rows exist).
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -1452,7 +1576,7 @@ var SysInvitation = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/cancel-invitation",
       recordIdParam: "invitationId",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Cancel this invitation? The recipient will no longer be able to accept it.",
       successMessage: "Invitation canceled",
       refreshAfter: true
@@ -1466,7 +1590,7 @@ var SysInvitation = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
       bodyExtra: { resend: true },
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Invitation resent",
       refreshAfter: true,
       params: [
@@ -1656,7 +1780,7 @@ var SysTeam = ObjectSchema.create({
       // Teams are nested inside organizations — a multi-org-only concept.
       // Gate every team mutation on the multi-org flag so the affordances
       // disappear in single-org (mirrors sys_organization.create_organization).
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Team created",
       refreshAfter: true,
       params: [
@@ -1677,7 +1801,7 @@ var SysTeam = ObjectSchema.create({
       target: "/api/v1/auth/organization/update-team",
       recordIdParam: "teamId",
       bodyShape: { wrap: "data" },
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Team updated",
       refreshAfter: true,
       params: [
@@ -1696,7 +1820,7 @@ var SysTeam = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-team",
       recordIdParam: "teamId",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Delete this team? Members will lose any team-scoped access. This cannot be undone.",
       successMessage: "Team deleted",
       refreshAfter: true
@@ -1810,7 +1934,7 @@ var SysTeamMember = ObjectSchema.create({
       // Team membership lives under organizations — multi-org-only. Gate
       // both mutations so they vanish in single-org (mirrors
       // sys_organization.create_organization).
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Team member added",
       refreshAfter: true,
       params: [
@@ -1831,7 +1955,7 @@ var SysTeamMember = ObjectSchema.create({
       locations: ["list_item"],
       type: "api",
       target: "/api/v1/auth/organization/remove-team-member",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Remove this user from the team? They will lose any team-scoped access.",
       successMessage: "Team member removed",
       refreshAfter: true,
@@ -2069,7 +2193,7 @@ var SysBusinessUnitMember = ObjectSchema.create({
   managedBy: "platform",
   description: "User assignment to a business unit (matrix-org friendly, effective-dated).",
   titleFormat: "{user_id} in {business_unit_id}",
-  highlightFields: ["user_id", "business_unit_id", "role_in_business_unit", "is_primary"],
+  highlightFields: ["user_id", "business_unit_id", "function_in_business_unit", "is_primary"],
   fields: {
     id: Field.text({
       label: "Member ID",
@@ -2087,10 +2211,10 @@ var SysBusinessUnitMember = ObjectSchema.create({
       required: true,
       group: "Assignment"
     }),
-    role_in_business_unit: Field.select(
+    function_in_business_unit: Field.select(
       ["member", "lead", "deputy"],
       {
-        label: "Role in Business Unit",
+        label: "Function in Business Unit",
         required: false,
         defaultValue: "member",
         description: "`lead` is the day-to-day head; `deputy` may stand in for the lead in approval routing.",
@@ -2494,6 +2618,12 @@ var SysDeviceCode = ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE pending device-grant
+  // codes — reading `user_code`/`device_code` lets an attacker hijack a
+  // pending CLI login. Not covered by the wildcard `'*'` grant; admins retain
+  // access via the superuser bypass; better-auth reads via its adapter
+  // (system context), so the device-grant flow is unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3089,6 +3219,11 @@ var SysOauthAccessToken = ObjectSchema.create({
   icon: "ticket",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE bearer credentials —
+  // reading one is session hijack. Not covered by the wildcard `'*'` grant;
+  // admins retain access via the superuser bypass; better-auth reads via its
+  // adapter (system context), so OAuth flows are unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3175,6 +3310,11 @@ var SysOauthRefreshToken = ObjectSchema.create({
   icon: "refresh-cw",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE long-lived credentials —
+  // a refresh token mints new access tokens. Not covered by the wildcard `'*'`
+  // grant; admins retain access via the superuser bypass; better-auth reads
+  // via its adapter (system context), so OAuth flows are unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3333,6 +3473,13 @@ var SysJwks = ObjectSchema.create({
   icon: "key",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are the environment's JWT SIGNING
+  // KEYS (private key material). Not covered by the wildcard `'*'` grant — an
+  // ordinary member gets 403 from the generic data layer. Platform admins
+  // (viewAllRecords/modifyAllRecords) retain access via the posture-gated
+  // superuser bypass; better-auth itself reads via its adapter (system
+  // context), so token signing/verification is unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3646,6 +3793,14 @@ var SysScimProvider = ObjectSchema.create({
   icon: "users",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D3/④] Admin-only identity config carrying a live credential
+  // (`scim_token` — the bearer external IdPs authenticate provisioning calls
+  // with). Object-level capability gate, mirroring the sibling
+  // `sys_sso_provider`: ordinary members are denied entirely (without it, the
+  // `member_default` wildcard `'*': allowRead` would expose SCIM connections
+  // to every authenticated user). better-auth's own endpoints read via a
+  // system context, so SCIM provisioning is unaffected.
+  requiredPermissions: ["manage_platform_settings"],
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
   protection: {
     lock: "full",
@@ -4934,6 +5089,14 @@ var SysSecret = ObjectSchema.create({
   icon: "key",
   isSystem: true,
   managedBy: "system",
+  // [ADR-0066 D2/④] Secure-by-default: the environment's encrypted-secrets
+  // store (settings/datasource credentials). Not covered by the wildcard `'*'`
+  // grant — ordinary members get 403 from the generic data layer. Platform
+  // admins retain access via the posture-gated superuser bypass. Internal
+  // readers are unaffected: `engine.resolveSecret` reads at DRIVER level,
+  // SettingsService / the datasource secret-binder read with no principal
+  // (middleware falls open for principal-less internal calls).
+  access: { default: "private" },
   description: "Cipher store referenced by sys_setting handles. Never holds plaintext.",
   highlightFields: ["namespace", "key", "kms_key_id", "version", "rotated_at"],
   listViews: {
@@ -5281,21 +5444,33 @@ var SETUP_NAV_CONTRIBUTIONS = [
     priority: BASE_PRIORITY,
     items: [
       { id: "nav_users", type: "object", label: "Users", objectName: "sys_user", icon: "user" },
+      // The ACTIVE organization's record page (Members / Invitations / Teams
+      // tabs with the better-auth row actions), rendered inside the app shell
+      // (ADR-0081). `{current_org_id}` resolves from the session's active
+      // organization; unresolved (e.g. org-less admin before bootstrap) it
+      // falls back to the sys_organization list — one row in single-org.
+      { id: "nav_organization", type: "object", label: "Organization", objectName: "sys_organization", recordId: "{current_org_id}", icon: "building-2" },
       { id: "nav_business_units", type: "object", label: "Business Units", objectName: "sys_business_unit", icon: "building", requiresObject: "sys_business_unit" },
-      { id: "nav_teams", type: "object", label: "Teams", objectName: "sys_team", icon: "users-round", requiresService: "org-scoping" },
+      // Teams / Invitations no longer gate on `org-scoping` (ADR-0081 D1):
+      // the better-auth organization capability is always mounted, and
+      // plugin-auth's single-org default-org bootstrap guarantees an org to
+      // invite into — these are the OPEN member-management basics. Only the
+      // org LIST below keeps the gate: browsing organizations is meaningful
+      // only when more than one can exist (enterprise multi-org).
+      { id: "nav_teams", type: "object", label: "Teams", objectName: "sys_team", icon: "users-round" },
       { id: "nav_organizations", type: "object", label: "Organizations", objectName: "sys_organization", icon: "building-2", requiresService: "org-scoping" },
-      { id: "nav_invitations", type: "object", label: "Invitations", objectName: "sys_invitation", icon: "mail", requiresService: "org-scoping" }
+      { id: "nav_invitations", type: "object", label: "Invitations", objectName: "sys_invitation", icon: "mail" }
     ]
   },
   {
     app: "setup",
     group: "group_access_control",
-    // Priority 300 keeps API Keys after plugin-security's Roles / Permission
+    // Priority 300 keeps API Keys after plugin-security's Positions / Permission
     // Sets (100) and plugin-sharing's Sharing Rules / Record Shares (200),
     // preserving the original menu order.
     priority: 300,
     items: [
-      // Roles / Permission Sets are contributed by @objectstack/plugin-security
+      // Positions / Permission Sets are contributed by @objectstack/plugin-security
       // and Sharing Rules / Record Shares by @objectstack/plugin-sharing
       // (ADR-0029 K2). Only API Keys (sys_api_key, an identity object owned by
       // plugin-auth) remains a platform-objects base entry here.
@@ -5346,7 +5521,11 @@ var SETUP_NAV_CONTRIBUTIONS = [
     priority: BASE_PRIORITY,
     items: [
       { id: "nav_oauth_apps", type: "object", label: "OAuth Applications", objectName: "sys_oauth_application", icon: "app-window" },
-      { id: "nav_jwks", type: "object", label: "Signing Keys (JWKS)", objectName: "sys_jwks", icon: "key-round" },
+      // nav_jwks is capability-gated (like nav_api_keys): sys_jwks is
+      // `access.default:'private'` (ADR-0066 ④ — signing keys), so a
+      // non-admin's list request 403s server-side; gating the nav item keeps
+      // the menu honest instead of showing an entry that can only error.
+      { id: "nav_jwks", type: "object", label: "Signing Keys (JWKS)", objectName: "sys_jwks", icon: "key-round", requiredPermissions: ["manage_platform_settings"] },
       // `sys_verification` (email/phone tokens) and `sys_device_code` (OAuth
       // device-grant codes) deliberately omit `list` from their `apiMethods`
       // (sensitive, ephemeral secrets — not browsable), so an object/list-view
@@ -6685,8 +6864,8 @@ var enObjects = {
       user_id: {
         label: "User"
       },
-      role_in_business_unit: {
-        label: "Role in Business Unit",
+      function_in_business_unit: {
+        label: "Function in Business Unit",
         help: "`lead` is the day-to-day head; `deputy` may stand in for the lead in approval routing.",
         options: {
           member: "member",
@@ -8638,12 +8817,13 @@ var en = {
         nav_marketplace_installed: { label: "Installed Apps" },
         // People & Organization
         nav_users: { label: "Users" },
+        nav_organization: { label: "Organization" },
         nav_business_units: { label: "Business Units" },
         nav_teams: { label: "Teams" },
         nav_organizations: { label: "Organizations" },
         nav_invitations: { label: "Invitations" },
         // Access Control
-        nav_roles: { label: "Roles" },
+        nav_positions: { label: "Positions" },
         nav_permission_sets: { label: "Permission Sets" },
         nav_sharing_rules: { label: "Sharing Rules" },
         nav_record_shares: { label: "Record Shares" },
@@ -9431,8 +9611,8 @@ var zhCNObjects = {
       user_id: {
         label: "\u7528\u6237"
       },
-      role_in_business_unit: {
-        label: "\u4E1A\u52A1\u5355\u5143\u5185\u89D2\u8272",
+      function_in_business_unit: {
+        label: "\u4E1A\u52A1\u5355\u5143\u5185\u804C\u80FD",
         help: "`lead` \u8868\u793A\u65E5\u5E38\u8D1F\u8D23\u4EBA\uFF1B`deputy` \u53EF\u5728\u5BA1\u6279\u8DEF\u7531\u4E2D\u4EE3\u66FF\u8D1F\u8D23\u4EBA\u3002",
         options: {
           member: "\u6210\u5458",
@@ -11381,16 +11561,18 @@ var zhCN = {
         group_advanced: { label: "\u9AD8\u7EA7" },
         nav_system_overview: { label: "\u7CFB\u7EDF\u6982\u89C8" },
         nav_users: { label: "\u7528\u6237" },
+        nav_organization: { label: "\u7EC4\u7EC7" },
         nav_business_units: { label: "\u4E1A\u52A1\u5355\u5143" },
         nav_teams: { label: "\u56E2\u961F" },
         nav_organizations: { label: "\u7EC4\u7EC7" },
         nav_invitations: { label: "\u9080\u8BF7" },
-        nav_roles: { label: "\u89D2\u8272" },
+        nav_positions: { label: "\u5C97\u4F4D" },
         nav_capabilities: { label: "\u80FD\u529B" },
         nav_permission_sets: { label: "\u6743\u9650\u96C6" },
         nav_sharing_rules: { label: "\u5171\u4EAB\u89C4\u5219" },
         nav_record_shares: { label: "\u8BB0\u5F55\u5171\u4EAB" },
         nav_api_keys: { label: "API \u5BC6\u94A5" },
+        nav_connect_agent: { label: "\u8FDE\u63A5\u667A\u80FD\u4F53" },
         nav_approval_processes: { label: "\u5BA1\u6279\u6D41\u7A0B" },
         nav_approval_requests: { label: "\u5BA1\u6279\u7533\u8BF7" },
         nav_approval_actions: { label: "\u5BA1\u6279\u5386\u53F2" },
@@ -12140,8 +12322,8 @@ var jaJPObjects = {
       user_id: {
         label: "\u30E6\u30FC\u30B6\u30FC"
       },
-      role_in_business_unit: {
-        label: "\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8\u5185\u30ED\u30FC\u30EB",
+      function_in_business_unit: {
+        label: "\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8\u5185\u306E\u8077\u80FD",
         help: "`lead` \u306F\u65E5\u5E38\u306E\u8CAC\u4EFB\u8005\u3001`deputy` \u306F\u627F\u8A8D\u30EB\u30FC\u30C6\u30A3\u30F3\u30B0\u3067\u30EA\u30FC\u30C9\u306E\u4EE3\u7406\u3092\u52D9\u3081\u308B\u5834\u5408\u304C\u3042\u308A\u307E\u3059\u3002",
         options: {
           member: "\u30E1\u30F3\u30D0\u30FC",
@@ -14089,11 +14271,12 @@ var jaJP = {
         group_advanced: { label: "\u8A73\u7D30" },
         nav_system_overview: { label: "\u30B7\u30B9\u30C6\u30E0\u6982\u8981" },
         nav_users: { label: "\u30E6\u30FC\u30B6\u30FC" },
+        nav_organization: { label: "\u7D44\u7E54" },
         nav_business_units: { label: "\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8" },
         nav_teams: { label: "\u30C1\u30FC\u30E0" },
         nav_organizations: { label: "\u7D44\u7E54" },
         nav_invitations: { label: "\u62DB\u5F85" },
-        nav_roles: { label: "\u30ED\u30FC\u30EB" },
+        nav_positions: { label: "\u30DD\u30B8\u30B7\u30E7\u30F3" },
         nav_permission_sets: { label: "\u6A29\u9650\u30BB\u30C3\u30C8" },
         nav_sharing_rules: { label: "\u5171\u6709\u30EB\u30FC\u30EB" },
         nav_record_shares: { label: "\u30EC\u30B3\u30FC\u30C9\u5171\u6709" },
@@ -14846,8 +15029,8 @@ var esESObjects = {
       user_id: {
         label: "Usuario"
       },
-      role_in_business_unit: {
-        label: "Rol en el departamento",
+      function_in_business_unit: {
+        label: "Funci\xF3n en la unidad de negocio",
         help: "`lead` es el responsable del d\xEDa a d\xEDa; `deputy` puede sustituir al responsable en el enrutamiento de aprobaciones.",
         options: {
           member: "Miembro",
@@ -16795,11 +16978,12 @@ var esES = {
         group_advanced: { label: "Avanzado" },
         nav_system_overview: { label: "Resumen del Sistema" },
         nav_users: { label: "Usuarios" },
+        nav_organization: { label: "Organizaci\xF3n" },
         nav_business_units: { label: "Unidades de negocio" },
         nav_teams: { label: "Equipos" },
         nav_organizations: { label: "Organizaciones" },
         nav_invitations: { label: "Invitaciones" },
-        nav_roles: { label: "Roles" },
+        nav_positions: { label: "Posiciones" },
         nav_permission_sets: { label: "Conjuntos de Permisos" },
         nav_sharing_rules: { label: "Reglas de Compartici\xF3n" },
         nav_record_shares: { label: "Registros Compartidos" },
@@ -17044,7 +17228,7 @@ var SysUserDetailPage = {
     },
     // ── Tabs: curated related lists ───────────────────────────────
     // Only the 4 lists that are semantically about THIS user account.
-    // Everything else (sys_role created_by, sys_email_template
+    // Everything else (sys_position created_by, sys_email_template
     // updated_by, …) is incidental authorship metadata and would only
     // create noise.
     tabs: {
@@ -17053,6 +17237,38 @@ var SysUserDetailPage = {
         type: "line",
         position: "top",
         items: [
+          {
+            label: "Positions",
+            icon: "shield-check",
+            children: [
+              {
+                // [ADR-0090 D3] Position assignments (岗位分派) — pure SDUI:
+                // the Add picker creates sys_user_position rows storing the
+                // position's MACHINE NAME (valueField: 'name'), and every
+                // server-side rule (the D12 delegated-admin gate, audience-
+                // anchor rejection) surfaces its error in the dialog.
+                type: "record:related_list",
+                properties: {
+                  objectName: "sys_user_position",
+                  relationshipField: "user_id",
+                  columns: ["position", "business_unit_id", "granted_by", "created_at"],
+                  sort: [{ field: "created_at", order: "desc" }],
+                  limit: 25,
+                  showViewAll: true,
+                  title: "Positions",
+                  add: {
+                    picker: {
+                      object: "sys_position",
+                      valueField: "name",
+                      labelField: "label"
+                    },
+                    linkField: "position",
+                    label: "Assign position"
+                  }
+                }
+              }
+            ]
+          },
           {
             label: "Sessions",
             icon: "monitor",
@@ -17259,6 +17475,84 @@ var SysUserDetailPage = {
   }
 };
 
+// src/pages/sys-position.page.ts
+var SysPositionDetailPage = {
+  name: "sys_position_detail",
+  label: "Position",
+  type: "record",
+  object: "sys_position",
+  template: "default",
+  kind: "slotted",
+  isDefault: true,
+  regions: [],
+  slots: {
+    tabs: {
+      type: "page:tabs",
+      properties: {
+        type: "line",
+        position: "top",
+        items: [
+          {
+            label: "Holders",
+            icon: "users",
+            children: [
+              {
+                type: "record:related_list",
+                properties: {
+                  objectName: "sys_user_position",
+                  relationshipField: "position",
+                  relationshipValueField: "name",
+                  columns: ["user_id", "business_unit_id", "granted_by", "created_at"],
+                  sort: [{ field: "created_at", order: "desc" }],
+                  limit: 25,
+                  showViewAll: true,
+                  title: "Holders",
+                  add: {
+                    picker: {
+                      object: "sys_user",
+                      labelField: "name"
+                    },
+                    linkField: "user_id",
+                    label: "Assign user"
+                  }
+                }
+              }
+            ]
+          },
+          {
+            label: "Permission Sets",
+            icon: "lock",
+            children: [
+              {
+                type: "record:related_list",
+                properties: {
+                  objectName: "sys_position_permission_set",
+                  relationshipField: "position_id",
+                  columns: ["permission_set_id", "created_at"],
+                  sort: [{ field: "created_at", order: "desc" }],
+                  limit: 25,
+                  showViewAll: true,
+                  title: "Permission Sets",
+                  add: {
+                    picker: {
+                      object: "sys_permission_set",
+                      labelField: "label"
+                    },
+                    linkField: "permission_set_id",
+                    label: "Bind permission set"
+                  }
+                }
+              }
+            ]
+          }
+        ]
+      }
+    },
+    // No Chatter feed on an RBAC primitive.
+    discussion: []
+  }
+};
+
 // src/apps/translations/en.metadata-forms.generated.ts
 var enMetadataForms = {
   object: {
@@ -18564,69 +18858,6 @@ var enMetadataForms = {
         label: "Label",
         helpText: "Display label for admins"
       },
-      isProfile: {
-        label: "Is Profile",
-        helpText: "Profile = base set assigned to users. Permission Set = additive grant."
-      },
-      systemPermissions: {
-        label: "System Permissions",
-        helpText: "List of system capability keys"
-      },
-      objects: {
-        label: "Objects",
-        helpText: '{ "account": { allowRead: true, allowEdit: true, ... } }'
-      },
-      fields: {
-        label: "Fields",
-        helpText: '{ "account.amount": { readable: true, editable: false } }'
-      },
-      tabPermissions: {
-        label: "Tab Permissions",
-        helpText: '{ "app_crm": "visible", "app_admin": "hidden" }'
-      },
-      rowLevelSecurity: {
-        label: "Row Level Security",
-        helpText: "Array of RLS policies (see rls.zod.ts)"
-      },
-      contextVariables: {
-        label: "Context Variables",
-        helpText: "Custom variables referenced in RLS predicates"
-      }
-    }
-  },
-  profile: {
-    label: "Profile",
-    sections: {
-      identity: {
-        label: "Identity",
-        description: "Permission Sets stack on top of a Profile to grant additional access. Profiles are the base set assigned 1:1 to each user."
-      },
-      system_permissions: {
-        label: "System Permissions",
-        description: "High-level capabilities not tied to a specific object \u2014 e.g. manage_users, view_audit_logs."
-      },
-      object_and_field_permissions: {
-        label: "Object & Field Permissions",
-        description: "Per-object CRUD + per-field FLS. Edit via the matrix editor or paste JSON here."
-      },
-      tab_and_row_level_security: {
-        label: "Tab & Row-Level Security",
-        description: "Tab visibility, RLS policies, and custom context variables for predicate evaluation."
-      }
-    },
-    fields: {
-      name: {
-        label: "Name",
-        helpText: "Machine name (snake_case)"
-      },
-      label: {
-        label: "Label",
-        helpText: "Display label for admins"
-      },
-      isProfile: {
-        label: "Is Profile",
-        helpText: "Profile = base set assigned to users. Permission Set = additive grant."
-      },
       systemPermissions: {
         label: "System Permissions",
         helpText: "List of system capability keys"
@@ -18653,12 +18884,12 @@ var enMetadataForms = {
       }
     }
   },
-  role: {
-    label: "Role",
+  position: {
+    label: "Position",
     sections: {
-      role: {
-        label: "Role",
-        description: "Roles compose a hierarchy used for record sharing (sales VP \u2192 sales mgr \u2192 sales rep). Permissions themselves live on Permission Sets and Profiles."
+      position: {
+        label: "Position",
+        description: "A position is a flat, assignable bundle of permission sets (e.g. sales_rep, sales_manager). Capability lives on permission sets; visibility depth lives on the business-unit tree."
       }
     },
     fields: {
@@ -18669,10 +18900,6 @@ var enMetadataForms = {
       label: {
         label: "Label"
       },
-      parent: {
-        label: "Parent",
-        helpText: "Parent role machine name (Reports To)"
-      },
       description: {
         label: "Description"
       }
@@ -20202,10 +20429,6 @@ var zhCNMetadataForms = {
         label: "\u663E\u793A\u540D\u79F0",
         helpText: "\u9762\u5411\u7BA1\u7406\u5458\u7684\u663E\u793A\u6807\u7B7E"
       },
-      isProfile: {
-        label: "\u662F\u5426\u914D\u7F6E\u6587\u4EF6",
-        helpText: "\u52FE\u9009\u540E\u4F5C\u4E3A\u5B8C\u6574\u914D\u7F6E\u6587\u4EF6\uFF08\u800C\u975E\u9644\u52A0\u6743\u9650\u96C6\uFF09"
-      },
       systemPermissions: {
         label: "\u7CFB\u7EDF\u6743\u9650",
         helpText: "\u5E94\u7528\u8BBF\u95EE\u3001API\u3001\u7BA1\u7406\u64CD\u4F5C"
@@ -20232,71 +20455,12 @@ var zhCNMetadataForms = {
       }
     }
   },
-  profile: {
-    label: "\u914D\u7F6E\u6587\u4EF6",
+  position: {
+    label: "\u5C97\u4F4D",
     sections: {
-      identity: {
-        label: "\u6807\u8BC6",
-        description: "\u6743\u9650\u96C6\u53E0\u52A0\u5728\u914D\u7F6E\u6587\u4EF6\u4E4B\u4E0A\u4EE5\u6388\u4E88\u989D\u5916\u7684\u8BBF\u95EE\u6743\u9650\u3002\u914D\u7F6E\u6587\u4EF6\u662F\u6309 1:1 \u5206\u914D\u7ED9\u6BCF\u4E2A\u7528\u6237\u7684\u57FA\u7840\u96C6\u5408\u3002"
-      },
-      system_permissions: {
-        label: "\u7CFB\u7EDF\u6743\u9650",
-        description: "\u4E0E\u7279\u5B9A\u5BF9\u8C61\u65E0\u5173\u7684\u9AD8\u7EA7\u80FD\u529B\u2014\u2014\u4F8B\u5982 manage_users\u3001view_audit_logs\u3002"
-      },
-      object_and_field_permissions: {
-        label: "\u5BF9\u8C61\u4E0E\u5B57\u6BB5\u6743\u9650",
-        description: "\u6309\u5BF9\u8C61\u7684\u589E\u5220\u6539\u67E5 + \u6309\u5B57\u6BB5\u7684\u5B57\u6BB5\u7EA7\u5B89\u5168\uFF08FLS\uFF09\u3002\u53EF\u901A\u8FC7\u77E9\u9635\u7F16\u8F91\u5668\u7F16\u8F91\uFF0C\u6216\u5728\u6B64\u5904\u7C98\u8D34 JSON\u3002"
-      },
-      tab_and_row_level_security: {
-        label: "\u6807\u7B7E\u9875\u4E0E\u884C\u7EA7\u5B89\u5168",
-        description: "\u6807\u7B7E\u9875\u53EF\u89C1\u6027\u3001RLS \u7B56\u7565\uFF0C\u4EE5\u53CA\u7528\u4E8E\u8C13\u8BCD\u6C42\u503C\u7684\u81EA\u5B9A\u4E49\u4E0A\u4E0B\u6587\u53D8\u91CF\u3002"
-      }
-    },
-    fields: {
-      name: {
-        label: "\u540D\u79F0",
-        helpText: "\u673A\u5668\u540D\uFF08snake_case\uFF09"
-      },
-      label: {
-        label: "\u663E\u793A\u540D\u79F0",
-        helpText: "\u9762\u5411\u7BA1\u7406\u5458\u663E\u793A\u7684\u6807\u7B7E"
-      },
-      isProfile: {
-        label: "\u662F\u5426\u914D\u7F6E\u6587\u4EF6",
-        helpText: "\u914D\u7F6E\u6587\u4EF6 = \u5206\u914D\u7ED9\u7528\u6237\u7684\u57FA\u7840\u96C6\u5408\u3002\u6743\u9650\u96C6 = \u9644\u52A0\u6388\u4E88\u3002"
-      },
-      systemPermissions: {
-        label: "\u7CFB\u7EDF\u6743\u9650",
-        helpText: "\u7CFB\u7EDF\u80FD\u529B\u952E\u5217\u8868"
-      },
-      objects: {
-        label: "\u5BF9\u8C61\u6743\u9650",
-        helpText: '\u793A\u4F8B\uFF1A{ "account": { allowRead: true, allowEdit: true, ... } }'
-      },
-      fields: {
-        label: "\u5B57\u6BB5",
-        helpText: '\u793A\u4F8B\uFF1A{ "account.amount": { readable: true, editable: false } }'
-      },
-      tabPermissions: {
-        label: "\u6807\u7B7E\u9875\u6743\u9650",
-        helpText: '\u793A\u4F8B\uFF1A{ "app_crm": "visible", "app_admin": "hidden" }'
-      },
-      rowLevelSecurity: {
-        label: "\u884C\u7EA7\u5B89\u5168",
-        helpText: "RLS \u7B56\u7565\u6570\u7EC4\uFF08\u53C2\u89C1 rls.zod.ts\uFF09"
-      },
-      contextVariables: {
-        label: "\u4E0A\u4E0B\u6587\u53D8\u91CF",
-        helpText: "RLS \u8C13\u8BCD\u4E2D\u5F15\u7528\u7684\u81EA\u5B9A\u4E49\u53D8\u91CF"
-      }
-    }
-  },
-  role: {
-    label: "\u89D2\u8272",
-    sections: {
-      role: {
-        label: "\u89D2\u8272\u5B9A\u4E49",
-        description: "\u89D2\u8272\u540D\u79F0\u4E0E\u7EE7\u627F\u5173\u7CFB"
+      position: {
+        label: "\u5C97\u4F4D",
+        description: "\u5C97\u4F4D\u662F\u6241\u5E73\u7684\u3001\u53EF\u5206\u914D\u7684\u6743\u9650\u96C6\u7EC4\u5408(\u5982 sales_rep\u3001sales_manager)\u3002\u80FD\u529B\u5728\u6743\u9650\u96C6\u4E0A;\u53EF\u89C1\u8303\u56F4\u6DF1\u5EA6\u5728\u4E1A\u52A1\u5355\u5143\u6811\u4E0A\u3002"
       }
     },
     fields: {
@@ -20307,10 +20471,6 @@ var zhCNMetadataForms = {
       label: {
         label: "\u663E\u793A\u540D\u79F0"
       },
-      parent: {
-        label: "\u7236\u7EA7",
-        helpText: "\u7EE7\u627F\u7236\u89D2\u8272\u7684\u6743\u9650"
-      },
       description: {
         label: "\u63CF\u8FF0"
       }
@@ -21840,10 +22000,6 @@ var jaJPMetadataForms = {
         label: "\u8868\u793A\u540D",
         helpText: "\u7BA1\u7406\u8005\u5411\u3051\u8868\u793A\u30E9\u30D9\u30EB"
       },
-      isProfile: {
-        label: "\u30D7\u30ED\u30D5\u30A1\u30A4\u30EB\u304B",
-        helpText: "Profile = \u30E6\u30FC\u30B6\u30FC\u306B\u5272\u308A\u5F53\u3066\u308B\u57FA\u672C\u30BB\u30C3\u30C8\u3002Permission Set = \u8FFD\u52A0\u6A29\u9650\u3002"
-      },
       systemPermissions: {
         label: "\u30B7\u30B9\u30C6\u30E0\u6A29\u9650",
         helpText: "\u30B7\u30B9\u30C6\u30E0\u6A5F\u80FD\u30AD\u30FC\u306E\u30EA\u30B9\u30C8"
@@ -21870,71 +22026,12 @@ var jaJPMetadataForms = {
       }
     }
   },
-  profile: {
-    label: "\u30D7\u30ED\u30D5\u30A1\u30A4\u30EB",
+  position: {
+    label: "\u30DD\u30B8\u30B7\u30E7\u30F3",
     sections: {
-      identity: {
-        label: "ID",
-        description: "\u6A29\u9650\u30BB\u30C3\u30C8\u306F\u30D7\u30ED\u30D5\u30A1\u30A4\u30EB\u306B\u8FFD\u52A0\u30A2\u30AF\u30BB\u30B9\u6A29\u3092\u91CD\u306D\u308B\u3002\u30D7\u30ED\u30D5\u30A1\u30A4\u30EB\u306F\u5404\u30E6\u30FC\u30B6\u30FC\u306B 1:1 \u3067\u5272\u308A\u5F53\u3066\u308B\u57FA\u672C\u30BB\u30C3\u30C8\u3002"
-      },
-      system_permissions: {
-        label: "\u30B7\u30B9\u30C6\u30E0\u6A29\u9650",
-        description: "\u7279\u5B9A\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u306B\u7D10\u3065\u304B\u306A\u3044\u9AD8\u30EC\u30D9\u30EB\u6A5F\u80FD \u2014 \u4F8B: manage_users, view_audit_logs\u3002"
-      },
-      object_and_field_permissions: {
-        label: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3068\u30D5\u30A3\u30FC\u30EB\u30C9\u6A29\u9650",
-        description: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u5358\u4F4D\u306E CRUD + \u30D5\u30A3\u30FC\u30EB\u30C9\u5358\u4F4D\u306E FLS\u3002\u30DE\u30C8\u30EA\u30C3\u30AF\u30B9\u30A8\u30C7\u30A3\u30BF\u30FC\u3067\u7DE8\u96C6\u3001\u307E\u305F\u306F\u3053\u3053\u306B JSON \u3092\u8CBC\u308A\u4ED8\u3051\u3002"
-      },
-      tab_and_row_level_security: {
-        label: "\u30BF\u30D6\u3068\u884C\u30EC\u30D9\u30EB\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3",
-        description: "\u30BF\u30D6\u8868\u793A\u3001RLS \u30DD\u30EA\u30B7\u30FC\u3001\u8FF0\u8A9E\u8A55\u4FA1\u7528\u30AB\u30B9\u30BF\u30E0\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\u5909\u6570\u3002"
-      }
-    },
-    fields: {
-      name: {
-        label: "\u540D\u524D",
-        helpText: "\u30DE\u30B7\u30F3\u540D\uFF08snake_case\uFF09"
-      },
-      label: {
-        label: "\u8868\u793A\u540D",
-        helpText: "\u7BA1\u7406\u8005\u5411\u3051\u8868\u793A\u30E9\u30D9\u30EB"
-      },
-      isProfile: {
-        label: "\u30D7\u30ED\u30D5\u30A1\u30A4\u30EB\u304B",
-        helpText: "Profile = \u30E6\u30FC\u30B6\u30FC\u306B\u5272\u308A\u5F53\u3066\u308B\u57FA\u672C\u30BB\u30C3\u30C8\u3002Permission Set = \u8FFD\u52A0\u6A29\u9650\u3002"
-      },
-      systemPermissions: {
-        label: "\u30B7\u30B9\u30C6\u30E0\u6A29\u9650",
-        helpText: "\u30B7\u30B9\u30C6\u30E0\u6A5F\u80FD\u30AD\u30FC\u306E\u30EA\u30B9\u30C8"
-      },
-      objects: {
-        label: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u6A29\u9650",
-        helpText: '\u4F8B: { "account": { allowRead: true, allowEdit: true, ... } }'
-      },
-      fields: {
-        label: "\u30D5\u30A3\u30FC\u30EB\u30C9",
-        helpText: '\u4F8B: { "account.amount": { readable: true, editable: false } }'
-      },
-      tabPermissions: {
-        label: "\u30BF\u30D6\u6A29\u9650",
-        helpText: '\u4F8B: { "app_crm": "visible", "app_admin": "hidden" }'
-      },
-      rowLevelSecurity: {
-        label: "\u884C\u30EC\u30D9\u30EB\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3",
-        helpText: "RLS \u30DD\u30EA\u30B7\u30FC\u306E\u914D\u5217\uFF08rls.zod.ts \u53C2\u7167\uFF09"
-      },
-      contextVariables: {
-        label: "\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\u5909\u6570",
-        helpText: "RLS \u8FF0\u8A9E\u3067\u53C2\u7167\u3059\u308B\u30AB\u30B9\u30BF\u30E0\u5909\u6570"
-      }
-    }
-  },
-  role: {
-    label: "\u30ED\u30FC\u30EB",
-    sections: {
-      role: {
-        label: "\u30ED\u30FC\u30EB",
-        description: "\u30ED\u30FC\u30EB\u306F\u30EC\u30B3\u30FC\u30C9\u5171\u6709\u306B\u4F7F\u3046\u968E\u5C64\u3092\u69CB\u6210\uFF08sales VP \u2192 sales mgr \u2192 sales rep\uFF09\u3002\u6A29\u9650\u81EA\u4F53\u306F Permission Sets \u3068 Profiles \u306B\u5B58\u5728\u3002"
+      position: {
+        label: "\u30DD\u30B8\u30B7\u30E7\u30F3",
+        description: "\u30DD\u30B8\u30B7\u30E7\u30F3\u306F\u6A29\u9650\u30BB\u30C3\u30C8\u3092\u307E\u3068\u3081\u3066\u5272\u308A\u5F53\u3066\u308B\u30D5\u30E9\u30C3\u30C8\u306A\u5358\u4F4D(\u4F8B: sales_rep\u3001sales_manager)\u3002\u80FD\u529B\u306F\u6A29\u9650\u30BB\u30C3\u30C8\u306B\u3001\u53EF\u8996\u7BC4\u56F2\u306E\u6DF1\u3055\u306F\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8\u30C4\u30EA\u30FC\u306B\u3042\u308A\u307E\u3059\u3002"
       }
     },
     fields: {
@@ -21945,10 +22042,6 @@ var jaJPMetadataForms = {
       label: {
         label: "\u8868\u793A\u540D"
       },
-      parent: {
-        label: "\u89AA",
-        helpText: "\u89AA\u30ED\u30FC\u30EB\u306E\u30DE\u30B7\u30F3\u540D\uFF08Reports To\uFF09"
-      },
       description: {
         label: "\u8AAC\u660E"
       }
@@ -23478,69 +23571,6 @@ var esESMetadataForms = {
         label: "Etiqueta",
         helpText: "Etiqueta mostrada para administradores"
       },
-      isProfile: {
-        label: "Es perfil",
-        helpText: "Profile = conjunto base asignado a usuarios. Permission Set = concesi\xF3n adicional."
-      },
-      systemPermissions: {
-        label: "Permisos del sistema",
-        helpText: "Lista de claves de capacidades del sistema"
-      },
-      objects: {
-        label: "Permisos de objeto",
-        helpText: 'Ejemplo: { "account": { allowRead: true, allowEdit: true, ... } }'
-      },
-      fields: {
-        label: "Campos",
-        helpText: 'Ejemplo: { "account.amount": { readable: true, editable: false } }'
-      },
-      tabPermissions: {
-        label: "Permisos de pesta\xF1a",
-        helpText: 'Ejemplo: { "app_crm": "visible", "app_admin": "hidden" }'
-      },
-      rowLevelSecurity: {
-        label: "Seguridad a nivel de fila",
-        helpText: "Array de pol\xEDticas RLS (ver rls.zod.ts)"
-      },
-      contextVariables: {
-        label: "Variables de contexto",
-        helpText: "Variables personalizadas referenciadas en predicados RLS"
-      }
-    }
-  },
-  profile: {
-    label: "Perfil",
-    sections: {
-      identity: {
-        label: "Identidad",
-        description: "Los conjuntos de permisos se apilan sobre un perfil para conceder acceso adicional. Los perfiles son el conjunto base asignado 1:1 a cada usuario."
-      },
-      system_permissions: {
-        label: "Permisos del sistema",
-        description: "Capacidades de alto nivel no vinculadas a un objeto espec\xEDfico \u2014 p. ej. manage_users, view_audit_logs."
-      },
-      object_and_field_permissions: {
-        label: "Permisos de objeto y campo",
-        description: "CRUD por objeto + FLS por campo. Edita mediante el editor matricial o pega JSON aqu\xED."
-      },
-      tab_and_row_level_security: {
-        label: "Pesta\xF1a y seguridad a nivel de fila",
-        description: "Visibilidad de pesta\xF1as, pol\xEDticas RLS y variables de contexto personalizadas para evaluar predicados."
-      }
-    },
-    fields: {
-      name: {
-        label: "Nombre",
-        helpText: "Nombre de m\xE1quina (snake_case)"
-      },
-      label: {
-        label: "Etiqueta",
-        helpText: "Etiqueta mostrada para administradores"
-      },
-      isProfile: {
-        label: "Es perfil",
-        helpText: "Profile = conjunto base asignado a usuarios. Permission Set = concesi\xF3n adicional."
-      },
       systemPermissions: {
         label: "Permisos del sistema",
         helpText: "Lista de claves de capacidades del sistema"
@@ -23567,12 +23597,12 @@ var esESMetadataForms = {
       }
     }
   },
-  role: {
-    label: "Rol",
+  position: {
+    label: "Posici\xF3n",
     sections: {
-      role: {
-        label: "Rol",
-        description: "Los roles componen una jerarqu\xEDa usada para compartir registros (sales VP \u2192 sales mgr \u2192 sales rep). Los permisos en s\xED residen en Permission Sets y Profiles."
+      position: {
+        label: "Posici\xF3n",
+        description: "Una posici\xF3n es un conjunto plano y asignable de permission sets (p. ej. sales_rep, sales_manager). La capacidad reside en los permission sets; la profundidad de visibilidad en el \xE1rbol de unidades de negocio."
       }
     },
     fields: {
@@ -23583,10 +23613,6 @@ var esESMetadataForms = {
       label: {
         label: "Etiqueta"
       },
-      parent: {
-        label: "Padre",
-        helpText: "Nombre de m\xE1quina del rol padre (Reports To)"
-      },
       description: {
         label: "Descripci\xF3n"
       }
@@ -23868,6 +23894,6 @@ function createPlatformObjectsPlugin() {
   return new PlatformObjectsPlugin();
 }
 
-export { ACCOUNT_APP, MetadataFormsTranslations, PlatformObjectsPlugin, SETUP_APP, SETUP_NAV_CONTRIBUTIONS, STUDIO_APP, SetupAppTranslations, SysAccount, SysApiKey, SysAttachment, SysBusinessUnit, SysBusinessUnitMember, SysDeviceCode, SysEmail, SysEmailTemplate, SysImportJob, SysInvitation, SysJob, SysJobQueue, SysJobRun, SysJwks, SysMember, SysNotification, SysOauthAccessToken, SysOauthApplication, SysOauthConsent, SysOauthRefreshToken, SysOrganization, SysOrganizationDetailPage, SysReportSchedule, SysSavedReport, SysScimProvider, SysSecret, SysSession, SysSetting, SysSettingAudit, SysSsoProvider, SysTeam, SysTeamMember, SysTwoFactor, SysUser, SysUserDetailPage, SysUserPreference, SysVerification, SystemOverviewDashboard, SystemOverviewDatasets, createPlatformObjectsPlugin, en, esES, jaJP, zhCN };
+export { ACCOUNT_APP, MetadataFormsTranslations, PlatformObjectsPlugin, SETUP_APP, SETUP_NAV_CONTRIBUTIONS, STUDIO_APP, SetupAppTranslations, SysAccount, SysApiKey, SysAttachment, SysBusinessUnit, SysBusinessUnitMember, SysDeviceCode, SysEmail, SysEmailTemplate, SysImportJob, SysInvitation, SysJob, SysJobQueue, SysJobRun, SysJwks, SysMember, SysNotification, SysOauthAccessToken, SysOauthApplication, SysOauthConsent, SysOauthRefreshToken, SysOrganization, SysOrganizationDetailPage, SysPositionDetailPage, SysReportSchedule, SysSavedReport, SysScimProvider, SysSecret, SysSession, SysSetting, SysSettingAudit, SysSsoProvider, SysTeam, SysTeamMember, SysTwoFactor, SysUser, SysUserDetailPage, SysUserPreference, SysVerification, SystemOverviewDashboard, SystemOverviewDatasets, createPlatformObjectsPlugin, en, esES, jaJP, zhCN };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map