@objectstack/platform-objects 7.1.0 → 7.2.1

package/dist/security/index.d.ts

@@ -208,6 +208,13 @@ declare const SysRole: Omit<{
         caseSensitive?: boolean | undefined;
         autonumberFormat?: string | undefined;
     }>;
+    _lock?: "full" | "none" | "no-overlay" | "no-delete" | undefined;
+    _lockReason?: string | undefined;
+    _lockSource?: "artifact" | "package" | "env-forced" | undefined;
+    _provenance?: "package" | "env-forced" | "org" | undefined;
+    _packageId?: string | undefined;
+    _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -353,7 +360,7 @@ declare const SysRole: Omit<{
             wrap?: boolean | undefined;
             type?: string | undefined;
             pinned?: "left" | "right" | undefined;
-            summary?: "min" | "max" | "count" | "sum" | "avg" | "none" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
+            summary?: "none" | "min" | "max" | "count" | "sum" | "avg" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
             link?: boolean | undefined;
             action?: string | undefined;
         }[];
@@ -402,7 +409,7 @@ declare const SysRole: Omit<{
         bordered?: boolean | undefined;
         compactToolbar?: boolean | undefined;
         selection?: {
-            type: "multiple" | "single" | "none";
+            type: "none" | "multiple" | "single";
         } | undefined;
         navigation?: {
             mode: "none" | "split" | "page" | "modal" | "drawer" | "popover" | "new_window";
@@ -597,7 +604,7 @@ declare const SysRole: Omit<{
         apiMethods?: ("search" | "create" | "import" | "delete" | "list" | "get" | "update" | "upsert" | "history" | "bulk" | "aggregate" | "restore" | "purge" | "export")[] | undefined;
     } | undefined;
     recordTypes?: string[] | undefined;
-    sharingModel?: "read" | "full" | "private" | "read_write" | undefined;
+    sharingModel?: "full" | "read" | "private" | "read_write" | undefined;
     publicSharing?: {
         enabled: boolean;
         allowedAudiences?: ("email" | "public" | "link_only" | "signed_in")[] | undefined;
@@ -700,6 +707,11 @@ declare const SysRole: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_role";
     readonly label: "Role";
@@ -707,6 +719,11 @@ declare const SysRole: Omit<{
     readonly icon: "shield";
     readonly isSystem: true;
     readonly managedBy: "config";
+    readonly protection: {
+        readonly lock: "no-overlay";
+        readonly reason: "RBAC schema is platform-defined — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Role definitions for RBAC access control";
     readonly displayNameField: "label";
     readonly titleFormat: "{label}";
@@ -2677,6 +2694,13 @@ declare const SysPermissionSet: Omit<{
         caseSensitive?: boolean | undefined;
         autonumberFormat?: string | undefined;
     }>;
+    _lock?: "full" | "none" | "no-overlay" | "no-delete" | undefined;
+    _lockReason?: string | undefined;
+    _lockSource?: "artifact" | "package" | "env-forced" | undefined;
+    _provenance?: "package" | "env-forced" | "org" | undefined;
+    _packageId?: string | undefined;
+    _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -2822,7 +2846,7 @@ declare const SysPermissionSet: Omit<{
             wrap?: boolean | undefined;
             type?: string | undefined;
             pinned?: "left" | "right" | undefined;
-            summary?: "min" | "max" | "count" | "sum" | "avg" | "none" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
+            summary?: "none" | "min" | "max" | "count" | "sum" | "avg" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
             link?: boolean | undefined;
             action?: string | undefined;
         }[];
@@ -2871,7 +2895,7 @@ declare const SysPermissionSet: Omit<{
         bordered?: boolean | undefined;
         compactToolbar?: boolean | undefined;
         selection?: {
-            type: "multiple" | "single" | "none";
+            type: "none" | "multiple" | "single";
         } | undefined;
         navigation?: {
             mode: "none" | "split" | "page" | "modal" | "drawer" | "popover" | "new_window";
@@ -3066,7 +3090,7 @@ declare const SysPermissionSet: Omit<{
         apiMethods?: ("search" | "create" | "import" | "delete" | "list" | "get" | "update" | "upsert" | "history" | "bulk" | "aggregate" | "restore" | "purge" | "export")[] | undefined;
     } | undefined;
     recordTypes?: string[] | undefined;
-    sharingModel?: "read" | "full" | "private" | "read_write" | undefined;
+    sharingModel?: "full" | "read" | "private" | "read_write" | undefined;
     publicSharing?: {
         enabled: boolean;
         allowedAudiences?: ("email" | "public" | "link_only" | "signed_in")[] | undefined;
@@ -3169,6 +3193,11 @@ declare const SysPermissionSet: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_permission_set";
     readonly label: "Permission Set";
@@ -3176,6 +3205,11 @@ declare const SysPermissionSet: Omit<{
     readonly icon: "lock";
     readonly isSystem: true;
     readonly managedBy: "config";
+    readonly protection: {
+        readonly lock: "no-overlay";
+        readonly reason: "RBAC schema is platform-defined — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Named permission groupings for fine-grained access control";
     readonly displayNameField: "label";
     readonly titleFormat: "{label}";
@@ -5641,6 +5675,13 @@ declare const SysUserPermissionSet: Omit<{
         caseSensitive?: boolean | undefined;
         autonumberFormat?: string | undefined;
     }>;
+    _lock?: "full" | "none" | "no-overlay" | "no-delete" | undefined;
+    _lockReason?: string | undefined;
+    _lockSource?: "artifact" | "package" | "env-forced" | undefined;
+    _provenance?: "package" | "env-forced" | "org" | undefined;
+    _packageId?: string | undefined;
+    _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -5786,7 +5827,7 @@ declare const SysUserPermissionSet: Omit<{
             wrap?: boolean | undefined;
             type?: string | undefined;
             pinned?: "left" | "right" | undefined;
-            summary?: "min" | "max" | "count" | "sum" | "avg" | "none" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
+            summary?: "none" | "min" | "max" | "count" | "sum" | "avg" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
             link?: boolean | undefined;
             action?: string | undefined;
         }[];
@@ -5835,7 +5876,7 @@ declare const SysUserPermissionSet: Omit<{
         bordered?: boolean | undefined;
         compactToolbar?: boolean | undefined;
         selection?: {
-            type: "multiple" | "single" | "none";
+            type: "none" | "multiple" | "single";
         } | undefined;
         navigation?: {
             mode: "none" | "split" | "page" | "modal" | "drawer" | "popover" | "new_window";
@@ -6030,7 +6071,7 @@ declare const SysUserPermissionSet: Omit<{
         apiMethods?: ("search" | "create" | "import" | "delete" | "list" | "get" | "update" | "upsert" | "history" | "bulk" | "aggregate" | "restore" | "purge" | "export")[] | undefined;
     } | undefined;
     recordTypes?: string[] | undefined;
-    sharingModel?: "read" | "full" | "private" | "read_write" | undefined;
+    sharingModel?: "full" | "read" | "private" | "read_write" | undefined;
     publicSharing?: {
         enabled: boolean;
         allowedAudiences?: ("email" | "public" | "link_only" | "signed_in")[] | undefined;
@@ -6133,6 +6174,11 @@ declare const SysUserPermissionSet: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_user_permission_set";
     readonly label: "User Permission Set";
@@ -7598,6 +7644,13 @@ declare const SysRolePermissionSet: Omit<{
         caseSensitive?: boolean | undefined;
         autonumberFormat?: string | undefined;
     }>;
+    _lock?: "full" | "none" | "no-overlay" | "no-delete" | undefined;
+    _lockReason?: string | undefined;
+    _lockSource?: "artifact" | "package" | "env-forced" | undefined;
+    _provenance?: "package" | "env-forced" | "org" | undefined;
+    _packageId?: string | undefined;
+    _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -7743,7 +7796,7 @@ declare const SysRolePermissionSet: Omit<{
             wrap?: boolean | undefined;
             type?: string | undefined;
             pinned?: "left" | "right" | undefined;
-            summary?: "min" | "max" | "count" | "sum" | "avg" | "none" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
+            summary?: "none" | "min" | "max" | "count" | "sum" | "avg" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
             link?: boolean | undefined;
             action?: string | undefined;
         }[];
@@ -7792,7 +7845,7 @@ declare const SysRolePermissionSet: Omit<{
         bordered?: boolean | undefined;
         compactToolbar?: boolean | undefined;
         selection?: {
-            type: "multiple" | "single" | "none";
+            type: "none" | "multiple" | "single";
         } | undefined;
         navigation?: {
             mode: "none" | "split" | "page" | "modal" | "drawer" | "popover" | "new_window";
@@ -7987,7 +8040,7 @@ declare const SysRolePermissionSet: Omit<{
         apiMethods?: ("search" | "create" | "import" | "delete" | "list" | "get" | "update" | "upsert" | "history" | "bulk" | "aggregate" | "restore" | "purge" | "export")[] | undefined;
     } | undefined;
     recordTypes?: string[] | undefined;
-    sharingModel?: "read" | "full" | "private" | "read_write" | undefined;
+    sharingModel?: "full" | "read" | "private" | "read_write" | undefined;
     publicSharing?: {
         enabled: boolean;
         allowedAudiences?: ("email" | "public" | "link_only" | "signed_in")[] | undefined;
@@ -8090,6 +8143,11 @@ declare const SysRolePermissionSet: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_role_permission_set";
     readonly label: "Role Permission Set";
@@ -9220,6 +9278,13 @@ declare const SysRecordShare: Omit<{
         caseSensitive?: boolean | undefined;
         autonumberFormat?: string | undefined;
     }>;
+    _lock?: "full" | "none" | "no-overlay" | "no-delete" | undefined;
+    _lockReason?: string | undefined;
+    _lockSource?: "artifact" | "package" | "env-forced" | undefined;
+    _provenance?: "package" | "env-forced" | "org" | undefined;
+    _packageId?: string | undefined;
+    _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -9365,7 +9430,7 @@ declare const SysRecordShare: Omit<{
             wrap?: boolean | undefined;
             type?: string | undefined;
             pinned?: "left" | "right" | undefined;
-            summary?: "min" | "max" | "count" | "sum" | "avg" | "none" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
+            summary?: "none" | "min" | "max" | "count" | "sum" | "avg" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
             link?: boolean | undefined;
             action?: string | undefined;
         }[];
@@ -9414,7 +9479,7 @@ declare const SysRecordShare: Omit<{
         bordered?: boolean | undefined;
         compactToolbar?: boolean | undefined;
         selection?: {
-            type: "multiple" | "single" | "none";
+            type: "none" | "multiple" | "single";
         } | undefined;
         navigation?: {
             mode: "none" | "split" | "page" | "modal" | "drawer" | "popover" | "new_window";
@@ -9609,7 +9674,7 @@ declare const SysRecordShare: Omit<{
         apiMethods?: ("search" | "create" | "import" | "delete" | "list" | "get" | "update" | "upsert" | "history" | "bulk" | "aggregate" | "restore" | "purge" | "export")[] | undefined;
     } | undefined;
     recordTypes?: string[] | undefined;
-    sharingModel?: "read" | "full" | "private" | "read_write" | undefined;
+    sharingModel?: "full" | "read" | "private" | "read_write" | undefined;
     publicSharing?: {
         enabled: boolean;
         allowedAudiences?: ("email" | "public" | "link_only" | "signed_in")[] | undefined;
@@ -9712,6 +9777,11 @@ declare const SysRecordShare: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_record_share";
     readonly label: "Record Share";
@@ -12194,6 +12264,13 @@ declare const SysSharingRule: Omit<{
         caseSensitive?: boolean | undefined;
         autonumberFormat?: string | undefined;
     }>;
+    _lock?: "full" | "none" | "no-overlay" | "no-delete" | undefined;
+    _lockReason?: string | undefined;
+    _lockSource?: "artifact" | "package" | "env-forced" | undefined;
+    _provenance?: "package" | "env-forced" | "org" | undefined;
+    _packageId?: string | undefined;
+    _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -12339,7 +12416,7 @@ declare const SysSharingRule: Omit<{
             wrap?: boolean | undefined;
             type?: string | undefined;
             pinned?: "left" | "right" | undefined;
-            summary?: "min" | "max" | "count" | "sum" | "avg" | "none" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
+            summary?: "none" | "min" | "max" | "count" | "sum" | "avg" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
             link?: boolean | undefined;
             action?: string | undefined;
         }[];
@@ -12388,7 +12465,7 @@ declare const SysSharingRule: Omit<{
         bordered?: boolean | undefined;
         compactToolbar?: boolean | undefined;
         selection?: {
-            type: "multiple" | "single" | "none";
+            type: "none" | "multiple" | "single";
         } | undefined;
         navigation?: {
             mode: "none" | "split" | "page" | "modal" | "drawer" | "popover" | "new_window";
@@ -12583,7 +12660,7 @@ declare const SysSharingRule: Omit<{
         apiMethods?: ("search" | "create" | "import" | "delete" | "list" | "get" | "update" | "upsert" | "history" | "bulk" | "aggregate" | "restore" | "purge" | "export")[] | undefined;
     } | undefined;
     recordTypes?: string[] | undefined;
-    sharingModel?: "read" | "full" | "private" | "read_write" | undefined;
+    sharingModel?: "full" | "read" | "private" | "read_write" | undefined;
     publicSharing?: {
         enabled: boolean;
         allowedAudiences?: ("email" | "public" | "link_only" | "signed_in")[] | undefined;
@@ -12686,6 +12763,11 @@ declare const SysSharingRule: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_sharing_rule";
     readonly label: "Sharing Rule";
@@ -15318,6 +15400,13 @@ declare const SysShareLink: Omit<{
         caseSensitive?: boolean | undefined;
         autonumberFormat?: string | undefined;
     }>;
+    _lock?: "full" | "none" | "no-overlay" | "no-delete" | undefined;
+    _lockReason?: string | undefined;
+    _lockSource?: "artifact" | "package" | "env-forced" | undefined;
+    _provenance?: "package" | "env-forced" | "org" | undefined;
+    _packageId?: string | undefined;
+    _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -15463,7 +15552,7 @@ declare const SysShareLink: Omit<{
             wrap?: boolean | undefined;
             type?: string | undefined;
             pinned?: "left" | "right" | undefined;
-            summary?: "min" | "max" | "count" | "sum" | "avg" | "none" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
+            summary?: "none" | "min" | "max" | "count" | "sum" | "avg" | "count_empty" | "count_filled" | "count_unique" | "percent_empty" | "percent_filled" | undefined;
             link?: boolean | undefined;
             action?: string | undefined;
         }[];
@@ -15512,7 +15601,7 @@ declare const SysShareLink: Omit<{
         bordered?: boolean | undefined;
         compactToolbar?: boolean | undefined;
         selection?: {
-            type: "multiple" | "single" | "none";
+            type: "none" | "multiple" | "single";
         } | undefined;
         navigation?: {
             mode: "none" | "split" | "page" | "modal" | "drawer" | "popover" | "new_window";
@@ -15707,7 +15796,7 @@ declare const SysShareLink: Omit<{
         apiMethods?: ("search" | "create" | "import" | "delete" | "list" | "get" | "update" | "upsert" | "history" | "bulk" | "aggregate" | "restore" | "purge" | "export")[] | undefined;
     } | undefined;
     recordTypes?: string[] | undefined;
-    sharingModel?: "read" | "full" | "private" | "read_write" | undefined;
+    sharingModel?: "full" | "read" | "private" | "read_write" | undefined;
     publicSharing?: {
         enabled: boolean;
         allowedAudiences?: ("email" | "public" | "link_only" | "signed_in")[] | undefined;
@@ -15810,6 +15899,11 @@ declare const SysShareLink: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_share_link";
     readonly label: "Share Link";

package/dist/security/index.js

@@ -11,6 +11,13 @@ var SysRole = data.ObjectSchema.create({
   icon: "shield",
   isSystem: true,
   managedBy: "config",
+  // ADR-0010 §3.7 — RBAC primitive; tenants may add custom rows
+  // (created via UI / API) but the schema itself is locked.
+  protection: {
+    lock: "no-overlay",
+    reason: "RBAC schema is platform-defined \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Role definitions for RBAC access control",
   displayNameField: "label",
   titleFormat: "{label}",
@@ -214,6 +221,13 @@ var SysPermissionSet = data.ObjectSchema.create({
   icon: "lock",
   isSystem: true,
   managedBy: "config",
+  // ADR-0010 §3.7 — RBAC primitive; tenants may add custom rows
+  // (created via UI / API) but the schema itself is locked.
+  protection: {
+    lock: "no-overlay",
+    reason: "RBAC schema is platform-defined \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
   description: "Named permission groupings for fine-grained access control",
   displayNameField: "label",
   titleFormat: "{label}",