@objectstack/platform-objects 7.2.0 → 7.3.0

package/dist/identity/index.d.mts

@@ -216,6 +216,7 @@ declare const SysUser: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -708,6 +709,11 @@ declare const SysUser: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_user";
     readonly label: "User";
@@ -715,8 +721,11 @@ declare const SysUser: Omit<{
     readonly icon: "user";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
-    readonly _lock: "full";
-    readonly _lockReason: "Identity table managed by better-auth — see ADR-0010.";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "User accounts for authentication";
     readonly displayNameField: "name";
     readonly titleFormat: "{name}";
@@ -3414,6 +3423,7 @@ declare const SysSession: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -3906,6 +3916,11 @@ declare const SysSession: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_session";
     readonly label: "Session";
@@ -3913,6 +3928,11 @@ declare const SysSession: Omit<{
     readonly icon: "key";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Active user sessions";
     readonly displayNameField: "user_id";
     readonly titleFormat: "Session — {user_id}";
@@ -6143,6 +6163,7 @@ declare const SysAccount: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -6635,6 +6656,11 @@ declare const SysAccount: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_account";
     readonly label: "Account";
@@ -6642,6 +6668,11 @@ declare const SysAccount: Omit<{
     readonly icon: "link";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "OAuth and authentication provider accounts";
     readonly titleFormat: "{provider_id} - {account_id}";
     readonly compactLayout: ["provider_id", "user_id", "account_id"];
@@ -9279,6 +9310,7 @@ declare const SysVerification: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -9771,6 +9803,11 @@ declare const SysVerification: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_verification";
     readonly label: "Verification";
@@ -9778,6 +9815,11 @@ declare const SysVerification: Omit<{
     readonly icon: "shield-check";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Email and phone verification tokens";
     readonly titleFormat: "Verification for {identifier}";
     readonly compactLayout: ["identifier", "expires_at", "created_at"];
@@ -11064,6 +11106,7 @@ declare const SysOrganization: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -11556,6 +11599,11 @@ declare const SysOrganization: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_organization";
     readonly label: "Organization";
@@ -11563,6 +11611,11 @@ declare const SysOrganization: Omit<{
     readonly icon: "building-2";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Organizations for multi-tenant grouping";
     readonly displayNameField: "name";
     readonly titleFormat: "{name}";
@@ -13143,6 +13196,7 @@ declare const SysMember: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -13635,6 +13689,11 @@ declare const SysMember: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_member";
     readonly label: "Member";
@@ -13642,6 +13701,11 @@ declare const SysMember: Omit<{
     readonly icon: "user-check";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Organization membership records";
     readonly titleFormat: "{user_id} in {organization_id}";
     readonly compactLayout: ["user_id", "organization_id", "role"];
@@ -14845,6 +14909,7 @@ declare const SysInvitation: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -15337,6 +15402,11 @@ declare const SysInvitation: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_invitation";
     readonly label: "Invitation";
@@ -15344,6 +15414,11 @@ declare const SysInvitation: Omit<{
     readonly icon: "mail";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Organization invitations for user onboarding";
     readonly titleFormat: "Invitation to {organization_id}";
     readonly compactLayout: ["email", "organization_id", "status"];
@@ -17315,6 +17390,7 @@ declare const SysTeam: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -17807,6 +17883,11 @@ declare const SysTeam: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_team";
     readonly label: "Team";
@@ -17814,6 +17895,11 @@ declare const SysTeam: Omit<{
     readonly icon: "users";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Teams within organizations for fine-grained grouping";
     readonly displayNameField: "name";
     readonly titleFormat: "{name}";
@@ -19018,6 +19104,7 @@ declare const SysTeamMember: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -19510,6 +19597,11 @@ declare const SysTeamMember: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_team_member";
     readonly label: "Team Member";
@@ -19517,6 +19609,11 @@ declare const SysTeamMember: Omit<{
     readonly icon: "user-plus";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Team membership records linking users to teams";
     readonly titleFormat: "{user_id} in {team_id}";
     readonly compactLayout: ["user_id", "team_id", "created_at"];
@@ -20502,6 +20599,7 @@ declare const SysDepartment: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -20994,6 +21092,11 @@ declare const SysDepartment: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_department";
     readonly label: "Department";
@@ -23607,6 +23710,7 @@ declare const SysDepartmentMember: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -24099,6 +24203,11 @@ declare const SysDepartmentMember: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_department_member";
     readonly label: "Department Member";
@@ -25918,6 +26027,7 @@ declare const SysApiKey: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -26410,6 +26520,11 @@ declare const SysApiKey: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_api_key";
     readonly label: "API Key";
@@ -26417,6 +26532,11 @@ declare const SysApiKey: Omit<{
     readonly icon: "key-round";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "API keys for programmatic access";
     readonly displayNameField: "name";
     readonly titleFormat: "{name}";
@@ -28697,6 +28817,7 @@ declare const SysTwoFactor: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -29189,6 +29310,11 @@ declare const SysTwoFactor: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_two_factor";
     readonly label: "Two Factor";
@@ -29196,6 +29322,11 @@ declare const SysTwoFactor: Omit<{
     readonly icon: "smartphone";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Two-factor authentication credentials";
     readonly titleFormat: "Two-factor for {user_id}";
     readonly compactLayout: ["user_id", "created_at"];
@@ -30774,6 +30905,7 @@ declare const SysDeviceCode: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -31266,6 +31398,11 @@ declare const SysDeviceCode: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_device_code";
     readonly label: "Device Code";
@@ -31273,6 +31410,11 @@ declare const SysDeviceCode: Omit<{
     readonly icon: "key-round";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests";
     readonly titleFormat: "{user_code}";
     readonly compactLayout: ["user_code", "status", "client_id", "expires_at"];
@@ -33619,6 +33761,7 @@ declare const SysUserPreference: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -34111,6 +34254,11 @@ declare const SysUserPreference: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_user_preference";
     readonly label: "User Preference";
@@ -35476,6 +35624,7 @@ declare const SysOauthApplication: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -35968,6 +36117,11 @@ declare const SysOauthApplication: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_oauth_application";
     readonly label: "OAuth Application";
@@ -35975,6 +36129,11 @@ declare const SysOauthApplication: Omit<{
     readonly icon: "key-round";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Registered OAuth/OIDC client applications";
     readonly displayNameField: "name";
     readonly titleFormat: "{name}";
@@ -41700,6 +41859,7 @@ declare const SysOauthAccessToken: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -42192,6 +42352,11 @@ declare const SysOauthAccessToken: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_oauth_access_token";
     readonly label: "OAuth Access Token";
@@ -42199,6 +42364,11 @@ declare const SysOauthAccessToken: Omit<{
     readonly icon: "ticket";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Opaque OAuth access tokens issued to client applications";
     readonly compactLayout: ["client_id", "user_id", "expires_at"];
     readonly fields: {
@@ -44190,6 +44360,7 @@ declare const SysOauthRefreshToken: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -44682,6 +44853,11 @@ declare const SysOauthRefreshToken: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_oauth_refresh_token";
     readonly label: "OAuth Refresh Token";
@@ -44689,6 +44865,11 @@ declare const SysOauthRefreshToken: Omit<{
     readonly icon: "refresh-cw";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Opaque OAuth refresh tokens (linked to a session)";
     readonly compactLayout: ["client_id", "user_id", "expires_at"];
     readonly fields: {
@@ -46855,6 +47036,7 @@ declare const SysOauthConsent: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -47347,6 +47529,11 @@ declare const SysOauthConsent: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_oauth_consent";
     readonly label: "OAuth Consent";
@@ -47354,6 +47541,11 @@ declare const SysOauthConsent: Omit<{
     readonly icon: "shield-check";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "User consent records for OAuth client applications";
     readonly compactLayout: ["client_id", "user_id", "scopes"];
     readonly fields: {
@@ -48813,6 +49005,7 @@ declare const SysJwks: Omit<{
     _provenance?: "package" | "env-forced" | "org" | undefined;
     _packageId?: string | undefined;
     _packageVersion?: string | undefined;
+    _lockDocsUrl?: string | undefined;
     label?: string | undefined;
     pluralLabel?: string | undefined;
     description?: string | undefined;
@@ -49305,6 +49498,11 @@ declare const SysJwks: Omit<{
             role?: string | undefined;
         } | undefined;
     }[] | undefined;
+    protection?: {
+        lock: "full" | "none" | "no-overlay" | "no-delete";
+        reason: string;
+        docsUrl?: string | undefined;
+    } | undefined;
 }, "fields"> & Pick<{
     readonly name: "sys_jwks";
     readonly label: "JWKS Key";
@@ -49312,6 +49510,11 @@ declare const SysJwks: Omit<{
     readonly icon: "key";
     readonly isSystem: true;
     readonly managedBy: "better-auth";
+    readonly protection: {
+        readonly lock: "full";
+        readonly reason: "Identity table managed by better-auth — see ADR-0010.";
+        readonly docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection";
+    };
     readonly description: "Asymmetric key pairs used to sign and verify issued JWTs";
     readonly compactLayout: ["id", "created_at", "expires_at"];
     readonly fields: {