@objectstack/plugin-security 6.9.0 → 7.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/README.md +13 -17
  2. package/dist/index.d.mts +818 -231
  3. package/dist/index.d.ts +818 -231
  4. package/dist/index.js +219 -369
  5. package/dist/index.js.map +1 -1
  6. package/dist/index.mjs +217 -368
  7. package/dist/index.mjs.map +1 -1
  8. package/package.json +4 -4
package/dist/index.d.ts CHANGED
@@ -21,34 +21,6 @@ interface SecurityPluginOptions {
21
21
  * @default 'member_default'
22
22
  */
23
23
  fallbackPermissionSet?: string | null;
24
- /**
25
- * Whether this deployment is multi-tenant.
26
- *
27
- * When `true` (default), SecurityPlugin:
28
- * - Auto-injects `organization_id = ctx.tenantId` on insert when
29
- * the target object declares an `organization_id` field.
30
- * - Honours the wildcard `tenant_isolation` RLS policy
31
- * (`organization_id = current_user.organization_id`) shipped with
32
- * the default `member_default` / `viewer_readonly` permission
33
- * sets.
34
- *
35
- * When `false`, SecurityPlugin:
36
- * - Skips the `organization_id` auto-injection block (saves a
37
- * metadata lookup per insert; `owner_id` injection still runs).
38
- * - Strips any RLS policy whose USING expression references
39
- * `current_user.organization_id` from the per-request policy
40
- * set, so single-tenant deployments don't pay the
41
- * field-existence safety-net cost on every find.
42
- *
43
- * Field-Level Security, owner-based RLS, and per-object permission
44
- * checks (allowRead/allowCreate/…) all operate identically regardless
45
- * of this flag. Set this to `false` for single-tenant or
46
- * single-organization deployments where `organization_id` carries no
47
- * meaning.
48
- *
49
- * @default true
50
- */
51
- multiTenant?: boolean;
52
24
  }
53
25
  /**
54
26
  * SecurityPlugin
@@ -59,6 +31,16 @@ interface SecurityPluginOptions {
59
31
  * This plugin is fully optional — without it, the system operates
60
32
  * without permission checks (same as current behavior).
61
33
  *
34
+ * **Multi-tenant Organization scoping is provided by the separate
35
+ * `@objectstack/plugin-org-scoping` package** (auto-stamps
36
+ * `organization_id` on insert, per-org seed replay, default-org
37
+ * bootstrap). When that plugin is installed, SecurityPlugin detects
38
+ * it via `getService('org-scoping')` and keeps the wildcard
39
+ * `current_user.organization_id` RLS policies that ship with the
40
+ * default permission sets. Without it, those policies are stripped so
41
+ * single-tenant deployments don't pay the field-existence safety-net
42
+ * cost on every find.
43
+ *
62
44
  * Dependencies:
63
45
  * - objectql service (ObjectQL engine with middleware support)
64
46
  * - metadata service (MetadataFacade for reading permission sets and RLS policies)
@@ -73,7 +55,15 @@ declare class SecurityPlugin implements Plugin {
73
55
  private fieldMasker;
74
56
  private readonly bootstrapPermissionSets;
75
57
  private readonly fallbackPermissionSet;
76
- private readonly multiTenant;
58
+ /**
59
+ * Runtime probe — set in `start()` from
60
+ * `ctx.getService('org-scoping')`. When `false`, wildcard RLS
61
+ * policies that reference `current_user.organization_id` are
62
+ * stripped from the per-request policy set (saves the
63
+ * field-existence safety net cost on every find in single-tenant
64
+ * deployments). When `true`, the policies apply normally.
65
+ */
66
+ private orgScopingEnabled;
77
67
  /**
78
68
  * Per-object field-name cache. Populated lazily from the metadata
79
69
  * service / ObjectQL registry on first access per object. Schemas are
@@ -347,7 +337,7 @@ declare const securityObjects: ((Omit<{
347
337
  abstract: boolean;
348
338
  datasource: string;
349
339
  fields: Record<string, {
350
- type: "number" | "boolean" | "tags" | "date" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
340
+ type: "number" | "boolean" | "tags" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
351
341
  required: boolean;
352
342
  searchable: boolean;
353
343
  multiple: boolean;
@@ -486,7 +476,7 @@ declare const securityObjects: ((Omit<{
486
476
  autoRotate: boolean;
487
477
  } | undefined;
488
478
  };
489
- scope: "field" | "record" | "table" | "database";
479
+ scope: "record" | "field" | "table" | "database";
490
480
  deterministicEncryption: boolean;
491
481
  searchableEncryption: boolean;
492
482
  } | undefined;
@@ -949,7 +939,7 @@ declare const securityObjects: ((Omit<{
949
939
  refreshAfter: boolean;
950
940
  objectName?: string | undefined;
951
941
  icon?: string | undefined;
952
- locations?: ("list_toolbar" | "list_item" | "record_header" | "record_more" | "record_related" | "global_nav")[] | undefined;
942
+ locations?: ("list_toolbar" | "list_item" | "record_header" | "record_more" | "record_related" | "record_section" | "global_nav")[] | undefined;
953
943
  component?: "action:button" | "action:icon" | "action:menu" | "action:group" | undefined;
954
944
  target?: string | undefined;
955
945
  body?: {
@@ -969,7 +959,7 @@ declare const securityObjects: ((Omit<{
969
959
  field?: string | undefined;
970
960
  objectOverride?: string | undefined;
971
961
  label?: string | undefined;
972
- type?: "number" | "boolean" | "date" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "tags" | "vector" | undefined;
962
+ type?: "number" | "boolean" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "tags" | "vector" | undefined;
973
963
  options?: {
974
964
  label: string;
975
965
  value: string;
@@ -982,6 +972,17 @@ declare const securityObjects: ((Omit<{
982
972
  variant?: "link" | "primary" | "secondary" | "danger" | "ghost" | undefined;
983
973
  confirmText?: string | undefined;
984
974
  successMessage?: string | undefined;
975
+ resultDialog?: {
976
+ title?: string | undefined;
977
+ description?: string | undefined;
978
+ acknowledge?: string | undefined;
979
+ format?: "secret" | "text" | "json" | "qrcode" | "code-list" | undefined;
980
+ fields?: {
981
+ path: string;
982
+ label?: string | undefined;
983
+ format?: "secret" | "text" | "json" | "qrcode" | "code-list" | undefined;
984
+ }[] | undefined;
985
+ } | undefined;
985
986
  visible?: {
986
987
  dialect: "cel" | "js" | "cron" | "template";
987
988
  source?: string | undefined;
@@ -2794,7 +2795,7 @@ declare const securityObjects: ((Omit<{
2794
2795
  abstract: boolean;
2795
2796
  datasource: string;
2796
2797
  fields: Record<string, {
2797
- type: "number" | "boolean" | "tags" | "date" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
2798
+ type: "number" | "boolean" | "tags" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
2798
2799
  required: boolean;
2799
2800
  searchable: boolean;
2800
2801
  multiple: boolean;
@@ -2933,7 +2934,7 @@ declare const securityObjects: ((Omit<{
2933
2934
  autoRotate: boolean;
2934
2935
  } | undefined;
2935
2936
  };
2936
- scope: "field" | "record" | "table" | "database";
2937
+ scope: "record" | "field" | "table" | "database";
2937
2938
  deterministicEncryption: boolean;
2938
2939
  searchableEncryption: boolean;
2939
2940
  } | undefined;
@@ -3396,7 +3397,7 @@ declare const securityObjects: ((Omit<{
3396
3397
  refreshAfter: boolean;
3397
3398
  objectName?: string | undefined;
3398
3399
  icon?: string | undefined;
3399
- locations?: ("list_toolbar" | "list_item" | "record_header" | "record_more" | "record_related" | "global_nav")[] | undefined;
3400
+ locations?: ("list_toolbar" | "list_item" | "record_header" | "record_more" | "record_related" | "record_section" | "global_nav")[] | undefined;
3400
3401
  component?: "action:button" | "action:icon" | "action:menu" | "action:group" | undefined;
3401
3402
  target?: string | undefined;
3402
3403
  body?: {
@@ -3416,7 +3417,7 @@ declare const securityObjects: ((Omit<{
3416
3417
  field?: string | undefined;
3417
3418
  objectOverride?: string | undefined;
3418
3419
  label?: string | undefined;
3419
- type?: "number" | "boolean" | "date" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "tags" | "vector" | undefined;
3420
+ type?: "number" | "boolean" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "tags" | "vector" | undefined;
3420
3421
  options?: {
3421
3422
  label: string;
3422
3423
  value: string;
@@ -3429,6 +3430,17 @@ declare const securityObjects: ((Omit<{
3429
3430
  variant?: "link" | "primary" | "secondary" | "danger" | "ghost" | undefined;
3430
3431
  confirmText?: string | undefined;
3431
3432
  successMessage?: string | undefined;
3433
+ resultDialog?: {
3434
+ title?: string | undefined;
3435
+ description?: string | undefined;
3436
+ acknowledge?: string | undefined;
3437
+ format?: "secret" | "text" | "json" | "qrcode" | "code-list" | undefined;
3438
+ fields?: {
3439
+ path: string;
3440
+ label?: string | undefined;
3441
+ format?: "secret" | "text" | "json" | "qrcode" | "code-list" | undefined;
3442
+ }[] | undefined;
3443
+ } | undefined;
3432
3444
  visible?: {
3433
3445
  dialect: "cel" | "js" | "cron" | "template";
3434
3446
  source?: string | undefined;
@@ -3437,178 +3449,703 @@ declare const securityObjects: ((Omit<{
3437
3449
  rationale?: string | undefined;
3438
3450
  generatedBy?: string | undefined;
3439
3451
  } | undefined;
3440
- } | undefined;
3441
- disabled?: boolean | {
3442
- dialect: "cel" | "js" | "cron" | "template";
3443
- source?: string | undefined;
3444
- ast?: unknown;
3445
- meta?: {
3446
- rationale?: string | undefined;
3447
- generatedBy?: string | undefined;
3452
+ } | undefined;
3453
+ disabled?: boolean | {
3454
+ dialect: "cel" | "js" | "cron" | "template";
3455
+ source?: string | undefined;
3456
+ ast?: unknown;
3457
+ meta?: {
3458
+ rationale?: string | undefined;
3459
+ generatedBy?: string | undefined;
3460
+ } | undefined;
3461
+ } | undefined;
3462
+ shortcut?: string | undefined;
3463
+ bulkEnabled?: boolean | undefined;
3464
+ aiExposed?: boolean | undefined;
3465
+ recordIdParam?: string | undefined;
3466
+ recordIdField?: string | undefined;
3467
+ bodyShape?: "flat" | {
3468
+ wrap: string;
3469
+ } | undefined;
3470
+ method?: "POST" | "PATCH" | "PUT" | "DELETE" | undefined;
3471
+ bodyExtra?: Record<string, unknown> | undefined;
3472
+ mode?: "custom" | "delete" | "create" | "edit" | undefined;
3473
+ timeout?: number | undefined;
3474
+ aria?: {
3475
+ ariaLabel?: string | undefined;
3476
+ ariaDescribedBy?: string | undefined;
3477
+ role?: string | undefined;
3478
+ } | undefined;
3479
+ }[] | undefined;
3480
+ }, "fields"> & Pick<{
3481
+ readonly name: "sys_permission_set";
3482
+ readonly label: "Permission Set";
3483
+ readonly pluralLabel: "Permission Sets";
3484
+ readonly icon: "lock";
3485
+ readonly isSystem: true;
3486
+ readonly managedBy: "config";
3487
+ readonly description: "Named permission groupings for fine-grained access control";
3488
+ readonly displayNameField: "label";
3489
+ readonly titleFormat: "{label}";
3490
+ readonly compactLayout: ["label", "name", "active"];
3491
+ readonly actions: [{
3492
+ readonly name: "activate_permission_set";
3493
+ readonly label: "Activate";
3494
+ readonly icon: "circle-check";
3495
+ readonly variant: "secondary";
3496
+ readonly mode: "custom";
3497
+ readonly locations: ["list_item", "record_header"];
3498
+ readonly type: "api";
3499
+ readonly method: "PATCH";
3500
+ readonly target: "/api/v1/data/sys_permission_set/{id}";
3501
+ readonly bodyExtra: {
3502
+ readonly active: true;
3503
+ };
3504
+ readonly successMessage: "Permission set activated";
3505
+ readonly refreshAfter: true;
3506
+ }, {
3507
+ readonly name: "deactivate_permission_set";
3508
+ readonly label: "Deactivate";
3509
+ readonly icon: "circle-off";
3510
+ readonly variant: "danger";
3511
+ readonly mode: "custom";
3512
+ readonly locations: ["list_item", "record_header"];
3513
+ readonly type: "api";
3514
+ readonly method: "PATCH";
3515
+ readonly target: "/api/v1/data/sys_permission_set/{id}";
3516
+ readonly bodyExtra: {
3517
+ readonly active: false;
3518
+ };
3519
+ readonly confirmText: "Deactivate this permission set? Existing assignments stay in place but stop granting access until re-activated.";
3520
+ readonly successMessage: "Permission set deactivated";
3521
+ readonly refreshAfter: true;
3522
+ }, {
3523
+ readonly name: "clone_permission_set";
3524
+ readonly label: "Clone";
3525
+ readonly icon: "copy";
3526
+ readonly variant: "secondary";
3527
+ readonly mode: "custom";
3528
+ readonly locations: ["list_item", "record_header"];
3529
+ readonly type: "api";
3530
+ readonly method: "POST";
3531
+ readonly target: "/api/v1/data/sys_permission_set";
3532
+ readonly bodyExtra: {
3533
+ readonly active: true;
3534
+ };
3535
+ readonly successMessage: "Permission set cloned";
3536
+ readonly refreshAfter: true;
3537
+ readonly params: [{
3538
+ readonly name: "label";
3539
+ readonly label: "New Display Name";
3540
+ readonly type: "text";
3541
+ readonly required: true;
3542
+ }, {
3543
+ readonly name: "name";
3544
+ readonly label: "New API Name";
3545
+ readonly type: "text";
3546
+ readonly required: true;
3547
+ readonly helpText: "Unique snake_case machine name";
3548
+ }, {
3549
+ readonly field: "description";
3550
+ readonly defaultFromRow: true;
3551
+ }, {
3552
+ readonly field: "object_permissions";
3553
+ readonly defaultFromRow: true;
3554
+ }, {
3555
+ readonly field: "field_permissions";
3556
+ readonly defaultFromRow: true;
3557
+ }];
3558
+ }];
3559
+ readonly listViews: {
3560
+ readonly active: {
3561
+ readonly type: "grid";
3562
+ readonly name: "active";
3563
+ readonly label: "Active";
3564
+ readonly data: {
3565
+ readonly provider: "object";
3566
+ readonly object: "sys_permission_set";
3567
+ };
3568
+ readonly columns: ["label", "name", "description", "updated_at"];
3569
+ readonly filter: [{
3570
+ readonly field: "active";
3571
+ readonly operator: "equals";
3572
+ readonly value: true;
3573
+ }];
3574
+ readonly sort: [{
3575
+ readonly field: "label";
3576
+ readonly order: "asc";
3577
+ }];
3578
+ readonly pagination: {
3579
+ readonly pageSize: 50;
3580
+ };
3581
+ };
3582
+ readonly inactive: {
3583
+ readonly type: "grid";
3584
+ readonly name: "inactive";
3585
+ readonly label: "Inactive";
3586
+ readonly data: {
3587
+ readonly provider: "object";
3588
+ readonly object: "sys_permission_set";
3589
+ };
3590
+ readonly columns: ["label", "name", "updated_at"];
3591
+ readonly filter: [{
3592
+ readonly field: "active";
3593
+ readonly operator: "equals";
3594
+ readonly value: false;
3595
+ }];
3596
+ readonly sort: [{
3597
+ readonly field: "label";
3598
+ readonly order: "asc";
3599
+ }];
3600
+ readonly pagination: {
3601
+ readonly pageSize: 50;
3602
+ };
3603
+ };
3604
+ readonly all_permsets: {
3605
+ readonly type: "grid";
3606
+ readonly name: "all_permsets";
3607
+ readonly label: "All";
3608
+ readonly data: {
3609
+ readonly provider: "object";
3610
+ readonly object: "sys_permission_set";
3611
+ };
3612
+ readonly columns: ["label", "name", "active", "updated_at"];
3613
+ readonly sort: [{
3614
+ readonly field: "label";
3615
+ readonly order: "asc";
3616
+ }];
3617
+ readonly pagination: {
3618
+ readonly pageSize: 50;
3619
+ };
3620
+ };
3621
+ };
3622
+ readonly fields: {
3623
+ readonly label: {
3624
+ readonly readonly?: boolean | undefined;
3625
+ readonly format?: string | undefined;
3626
+ readonly options?: {
3627
+ label: string;
3628
+ value: string;
3629
+ color?: string | undefined;
3630
+ default?: boolean | undefined;
3631
+ }[] | undefined;
3632
+ readonly description?: string | undefined;
3633
+ readonly label?: string | undefined;
3634
+ readonly name?: string | undefined;
3635
+ readonly precision?: number | undefined;
3636
+ readonly required?: boolean | undefined;
3637
+ readonly multiple?: boolean | undefined;
3638
+ readonly dependencies?: string[] | undefined;
3639
+ readonly theme?: string | undefined;
3640
+ readonly externalId?: boolean | undefined;
3641
+ readonly system?: boolean | undefined;
3642
+ readonly min?: number | undefined;
3643
+ readonly max?: number | undefined;
3644
+ readonly group?: string | undefined;
3645
+ readonly encryptionConfig?: {
3646
+ enabled: boolean;
3647
+ algorithm: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
3648
+ keyManagement: {
3649
+ provider: "local" | "aws-kms" | "azure-key-vault" | "gcp-kms" | "hashicorp-vault";
3650
+ keyId?: string | undefined;
3651
+ rotationPolicy?: {
3652
+ enabled: boolean;
3653
+ frequencyDays: number;
3654
+ retainOldVersions: number;
3655
+ autoRotate: boolean;
3656
+ } | undefined;
3657
+ };
3658
+ scope: "record" | "field" | "table" | "database";
3659
+ deterministicEncryption: boolean;
3660
+ searchableEncryption: boolean;
3661
+ } | undefined;
3662
+ readonly columnName?: string | undefined;
3663
+ readonly searchable?: boolean | undefined;
3664
+ readonly unique?: boolean | undefined;
3665
+ readonly defaultValue?: unknown;
3666
+ readonly maxLength?: number | undefined;
3667
+ readonly minLength?: number | undefined;
3668
+ readonly scale?: number | undefined;
3669
+ readonly reference?: string | undefined;
3670
+ readonly referenceFilters?: string[] | undefined;
3671
+ readonly writeRequiresMasterRead?: boolean | undefined;
3672
+ readonly deleteBehavior?: "set_null" | "cascade" | "restrict" | undefined;
3673
+ readonly expression?: {
3674
+ dialect: "cel" | "js" | "cron" | "template";
3675
+ source?: string | undefined;
3676
+ ast?: unknown;
3677
+ meta?: {
3678
+ rationale?: string | undefined;
3679
+ generatedBy?: string | undefined;
3680
+ } | undefined;
3681
+ } | undefined;
3682
+ readonly summaryOperations?: {
3683
+ object: string;
3684
+ field: string;
3685
+ function: "min" | "max" | "count" | "sum" | "avg";
3686
+ } | undefined;
3687
+ readonly language?: string | undefined;
3688
+ readonly lineNumbers?: boolean | undefined;
3689
+ readonly maxRating?: number | undefined;
3690
+ readonly allowHalf?: boolean | undefined;
3691
+ readonly displayMap?: boolean | undefined;
3692
+ readonly allowGeocoding?: boolean | undefined;
3693
+ readonly addressFormat?: "us" | "uk" | "international" | undefined;
3694
+ readonly colorFormat?: "hex" | "rgb" | "rgba" | "hsl" | undefined;
3695
+ readonly allowAlpha?: boolean | undefined;
3696
+ readonly presetColors?: string[] | undefined;
3697
+ readonly step?: number | undefined;
3698
+ readonly showValue?: boolean | undefined;
3699
+ readonly marks?: Record<string, string> | undefined;
3700
+ readonly barcodeFormat?: "qr" | "ean13" | "ean8" | "code128" | "code39" | "upca" | "upce" | undefined;
3701
+ readonly qrErrorCorrection?: "L" | "M" | "Q" | "H" | undefined;
3702
+ readonly displayValue?: boolean | undefined;
3703
+ readonly allowScanning?: boolean | undefined;
3704
+ readonly currencyConfig?: {
3705
+ precision: number;
3706
+ currencyMode: "fixed" | "dynamic";
3707
+ defaultCurrency: string;
3708
+ } | undefined;
3709
+ readonly vectorConfig?: {
3710
+ dimensions: number;
3711
+ distanceMetric: "cosine" | "euclidean" | "dotProduct" | "manhattan";
3712
+ normalized: boolean;
3713
+ indexed: boolean;
3714
+ indexType?: "flat" | "hnsw" | "ivfflat" | undefined;
3715
+ } | undefined;
3716
+ readonly fileAttachmentConfig?: {
3717
+ virusScan: boolean;
3718
+ virusScanOnUpload: boolean;
3719
+ quarantineOnThreat: boolean;
3720
+ allowMultiple: boolean;
3721
+ allowReplace: boolean;
3722
+ allowDelete: boolean;
3723
+ requireUpload: boolean;
3724
+ extractMetadata: boolean;
3725
+ extractText: boolean;
3726
+ versioningEnabled: boolean;
3727
+ publicRead: boolean;
3728
+ presignedUrlExpiry: number;
3729
+ minSize?: number | undefined;
3730
+ maxSize?: number | undefined;
3731
+ allowedTypes?: string[] | undefined;
3732
+ blockedTypes?: string[] | undefined;
3733
+ allowedMimeTypes?: string[] | undefined;
3734
+ blockedMimeTypes?: string[] | undefined;
3735
+ virusScanProvider?: "custom" | "clamav" | "virustotal" | "metadefender" | undefined;
3736
+ storageProvider?: string | undefined;
3737
+ storageBucket?: string | undefined;
3738
+ storagePrefix?: string | undefined;
3739
+ imageValidation?: {
3740
+ generateThumbnails: boolean;
3741
+ preserveMetadata: boolean;
3742
+ autoRotate: boolean;
3743
+ minWidth?: number | undefined;
3744
+ maxWidth?: number | undefined;
3745
+ minHeight?: number | undefined;
3746
+ maxHeight?: number | undefined;
3747
+ aspectRatio?: string | undefined;
3748
+ thumbnailSizes?: {
3749
+ name: string;
3750
+ width: number;
3751
+ height: number;
3752
+ crop: boolean;
3753
+ }[] | undefined;
3754
+ } | undefined;
3755
+ maxVersions?: number | undefined;
3756
+ } | undefined;
3757
+ readonly maskingRule?: {
3758
+ field: string;
3759
+ strategy: "partial" | "hash" | "redact" | "tokenize" | "randomize" | "nullify" | "substitute";
3760
+ preserveFormat: boolean;
3761
+ preserveLength: boolean;
3762
+ pattern?: string | undefined;
3763
+ roles?: string[] | undefined;
3764
+ exemptRoles?: string[] | undefined;
3765
+ } | undefined;
3766
+ readonly auditTrail?: boolean | undefined;
3767
+ readonly cached?: {
3768
+ enabled: boolean;
3769
+ ttl: number;
3770
+ invalidateOn: string[];
3771
+ } | undefined;
3772
+ readonly dataQuality?: {
3773
+ uniqueness: boolean;
3774
+ completeness: number;
3775
+ accuracy?: {
3776
+ source: string;
3777
+ threshold: number;
3778
+ } | undefined;
3779
+ } | undefined;
3780
+ readonly conditionalRequired?: {
3781
+ dialect: "cel" | "js" | "cron" | "template";
3782
+ source?: string | undefined;
3783
+ ast?: unknown;
3784
+ meta?: {
3785
+ rationale?: string | undefined;
3786
+ generatedBy?: string | undefined;
3787
+ } | undefined;
3788
+ } | undefined;
3789
+ readonly hidden?: boolean | undefined;
3790
+ readonly sortable?: boolean | undefined;
3791
+ readonly inlineHelpText?: string | undefined;
3792
+ readonly trackFeedHistory?: boolean | undefined;
3793
+ readonly caseSensitive?: boolean | undefined;
3794
+ readonly autonumberFormat?: string | undefined;
3795
+ readonly index?: boolean | undefined;
3796
+ readonly type: "text";
3797
+ };
3798
+ readonly name: {
3799
+ readonly readonly?: boolean | undefined;
3800
+ readonly format?: string | undefined;
3801
+ readonly options?: {
3802
+ label: string;
3803
+ value: string;
3804
+ color?: string | undefined;
3805
+ default?: boolean | undefined;
3806
+ }[] | undefined;
3807
+ readonly description?: string | undefined;
3808
+ readonly label?: string | undefined;
3809
+ readonly name?: string | undefined;
3810
+ readonly precision?: number | undefined;
3811
+ readonly required?: boolean | undefined;
3812
+ readonly multiple?: boolean | undefined;
3813
+ readonly dependencies?: string[] | undefined;
3814
+ readonly theme?: string | undefined;
3815
+ readonly externalId?: boolean | undefined;
3816
+ readonly system?: boolean | undefined;
3817
+ readonly min?: number | undefined;
3818
+ readonly max?: number | undefined;
3819
+ readonly group?: string | undefined;
3820
+ readonly encryptionConfig?: {
3821
+ enabled: boolean;
3822
+ algorithm: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
3823
+ keyManagement: {
3824
+ provider: "local" | "aws-kms" | "azure-key-vault" | "gcp-kms" | "hashicorp-vault";
3825
+ keyId?: string | undefined;
3826
+ rotationPolicy?: {
3827
+ enabled: boolean;
3828
+ frequencyDays: number;
3829
+ retainOldVersions: number;
3830
+ autoRotate: boolean;
3831
+ } | undefined;
3832
+ };
3833
+ scope: "record" | "field" | "table" | "database";
3834
+ deterministicEncryption: boolean;
3835
+ searchableEncryption: boolean;
3836
+ } | undefined;
3837
+ readonly columnName?: string | undefined;
3838
+ readonly searchable?: boolean | undefined;
3839
+ readonly unique?: boolean | undefined;
3840
+ readonly defaultValue?: unknown;
3841
+ readonly maxLength?: number | undefined;
3842
+ readonly minLength?: number | undefined;
3843
+ readonly scale?: number | undefined;
3844
+ readonly reference?: string | undefined;
3845
+ readonly referenceFilters?: string[] | undefined;
3846
+ readonly writeRequiresMasterRead?: boolean | undefined;
3847
+ readonly deleteBehavior?: "set_null" | "cascade" | "restrict" | undefined;
3848
+ readonly expression?: {
3849
+ dialect: "cel" | "js" | "cron" | "template";
3850
+ source?: string | undefined;
3851
+ ast?: unknown;
3852
+ meta?: {
3853
+ rationale?: string | undefined;
3854
+ generatedBy?: string | undefined;
3855
+ } | undefined;
3856
+ } | undefined;
3857
+ readonly summaryOperations?: {
3858
+ object: string;
3859
+ field: string;
3860
+ function: "min" | "max" | "count" | "sum" | "avg";
3861
+ } | undefined;
3862
+ readonly language?: string | undefined;
3863
+ readonly lineNumbers?: boolean | undefined;
3864
+ readonly maxRating?: number | undefined;
3865
+ readonly allowHalf?: boolean | undefined;
3866
+ readonly displayMap?: boolean | undefined;
3867
+ readonly allowGeocoding?: boolean | undefined;
3868
+ readonly addressFormat?: "us" | "uk" | "international" | undefined;
3869
+ readonly colorFormat?: "hex" | "rgb" | "rgba" | "hsl" | undefined;
3870
+ readonly allowAlpha?: boolean | undefined;
3871
+ readonly presetColors?: string[] | undefined;
3872
+ readonly step?: number | undefined;
3873
+ readonly showValue?: boolean | undefined;
3874
+ readonly marks?: Record<string, string> | undefined;
3875
+ readonly barcodeFormat?: "qr" | "ean13" | "ean8" | "code128" | "code39" | "upca" | "upce" | undefined;
3876
+ readonly qrErrorCorrection?: "L" | "M" | "Q" | "H" | undefined;
3877
+ readonly displayValue?: boolean | undefined;
3878
+ readonly allowScanning?: boolean | undefined;
3879
+ readonly currencyConfig?: {
3880
+ precision: number;
3881
+ currencyMode: "fixed" | "dynamic";
3882
+ defaultCurrency: string;
3883
+ } | undefined;
3884
+ readonly vectorConfig?: {
3885
+ dimensions: number;
3886
+ distanceMetric: "cosine" | "euclidean" | "dotProduct" | "manhattan";
3887
+ normalized: boolean;
3888
+ indexed: boolean;
3889
+ indexType?: "flat" | "hnsw" | "ivfflat" | undefined;
3890
+ } | undefined;
3891
+ readonly fileAttachmentConfig?: {
3892
+ virusScan: boolean;
3893
+ virusScanOnUpload: boolean;
3894
+ quarantineOnThreat: boolean;
3895
+ allowMultiple: boolean;
3896
+ allowReplace: boolean;
3897
+ allowDelete: boolean;
3898
+ requireUpload: boolean;
3899
+ extractMetadata: boolean;
3900
+ extractText: boolean;
3901
+ versioningEnabled: boolean;
3902
+ publicRead: boolean;
3903
+ presignedUrlExpiry: number;
3904
+ minSize?: number | undefined;
3905
+ maxSize?: number | undefined;
3906
+ allowedTypes?: string[] | undefined;
3907
+ blockedTypes?: string[] | undefined;
3908
+ allowedMimeTypes?: string[] | undefined;
3909
+ blockedMimeTypes?: string[] | undefined;
3910
+ virusScanProvider?: "custom" | "clamav" | "virustotal" | "metadefender" | undefined;
3911
+ storageProvider?: string | undefined;
3912
+ storageBucket?: string | undefined;
3913
+ storagePrefix?: string | undefined;
3914
+ imageValidation?: {
3915
+ generateThumbnails: boolean;
3916
+ preserveMetadata: boolean;
3917
+ autoRotate: boolean;
3918
+ minWidth?: number | undefined;
3919
+ maxWidth?: number | undefined;
3920
+ minHeight?: number | undefined;
3921
+ maxHeight?: number | undefined;
3922
+ aspectRatio?: string | undefined;
3923
+ thumbnailSizes?: {
3924
+ name: string;
3925
+ width: number;
3926
+ height: number;
3927
+ crop: boolean;
3928
+ }[] | undefined;
3929
+ } | undefined;
3930
+ maxVersions?: number | undefined;
3931
+ } | undefined;
3932
+ readonly maskingRule?: {
3933
+ field: string;
3934
+ strategy: "partial" | "hash" | "redact" | "tokenize" | "randomize" | "nullify" | "substitute";
3935
+ preserveFormat: boolean;
3936
+ preserveLength: boolean;
3937
+ pattern?: string | undefined;
3938
+ roles?: string[] | undefined;
3939
+ exemptRoles?: string[] | undefined;
3940
+ } | undefined;
3941
+ readonly auditTrail?: boolean | undefined;
3942
+ readonly cached?: {
3943
+ enabled: boolean;
3944
+ ttl: number;
3945
+ invalidateOn: string[];
3946
+ } | undefined;
3947
+ readonly dataQuality?: {
3948
+ uniqueness: boolean;
3949
+ completeness: number;
3950
+ accuracy?: {
3951
+ source: string;
3952
+ threshold: number;
3953
+ } | undefined;
3954
+ } | undefined;
3955
+ readonly conditionalRequired?: {
3956
+ dialect: "cel" | "js" | "cron" | "template";
3957
+ source?: string | undefined;
3958
+ ast?: unknown;
3959
+ meta?: {
3960
+ rationale?: string | undefined;
3961
+ generatedBy?: string | undefined;
3962
+ } | undefined;
3963
+ } | undefined;
3964
+ readonly hidden?: boolean | undefined;
3965
+ readonly sortable?: boolean | undefined;
3966
+ readonly inlineHelpText?: string | undefined;
3967
+ readonly trackFeedHistory?: boolean | undefined;
3968
+ readonly caseSensitive?: boolean | undefined;
3969
+ readonly autonumberFormat?: string | undefined;
3970
+ readonly index?: boolean | undefined;
3971
+ readonly type: "text";
3972
+ };
3973
+ readonly description: {
3974
+ readonly readonly?: boolean | undefined;
3975
+ readonly format?: string | undefined;
3976
+ readonly options?: {
3977
+ label: string;
3978
+ value: string;
3979
+ color?: string | undefined;
3980
+ default?: boolean | undefined;
3981
+ }[] | undefined;
3982
+ readonly description?: string | undefined;
3983
+ readonly label?: string | undefined;
3984
+ readonly name?: string | undefined;
3985
+ readonly precision?: number | undefined;
3986
+ readonly required?: boolean | undefined;
3987
+ readonly multiple?: boolean | undefined;
3988
+ readonly dependencies?: string[] | undefined;
3989
+ readonly theme?: string | undefined;
3990
+ readonly externalId?: boolean | undefined;
3991
+ readonly system?: boolean | undefined;
3992
+ readonly min?: number | undefined;
3993
+ readonly max?: number | undefined;
3994
+ readonly group?: string | undefined;
3995
+ readonly encryptionConfig?: {
3996
+ enabled: boolean;
3997
+ algorithm: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
3998
+ keyManagement: {
3999
+ provider: "local" | "aws-kms" | "azure-key-vault" | "gcp-kms" | "hashicorp-vault";
4000
+ keyId?: string | undefined;
4001
+ rotationPolicy?: {
4002
+ enabled: boolean;
4003
+ frequencyDays: number;
4004
+ retainOldVersions: number;
4005
+ autoRotate: boolean;
4006
+ } | undefined;
4007
+ };
4008
+ scope: "record" | "field" | "table" | "database";
4009
+ deterministicEncryption: boolean;
4010
+ searchableEncryption: boolean;
4011
+ } | undefined;
4012
+ readonly columnName?: string | undefined;
4013
+ readonly searchable?: boolean | undefined;
4014
+ readonly unique?: boolean | undefined;
4015
+ readonly defaultValue?: unknown;
4016
+ readonly maxLength?: number | undefined;
4017
+ readonly minLength?: number | undefined;
4018
+ readonly scale?: number | undefined;
4019
+ readonly reference?: string | undefined;
4020
+ readonly referenceFilters?: string[] | undefined;
4021
+ readonly writeRequiresMasterRead?: boolean | undefined;
4022
+ readonly deleteBehavior?: "set_null" | "cascade" | "restrict" | undefined;
4023
+ readonly expression?: {
4024
+ dialect: "cel" | "js" | "cron" | "template";
4025
+ source?: string | undefined;
4026
+ ast?: unknown;
4027
+ meta?: {
4028
+ rationale?: string | undefined;
4029
+ generatedBy?: string | undefined;
4030
+ } | undefined;
4031
+ } | undefined;
4032
+ readonly summaryOperations?: {
4033
+ object: string;
4034
+ field: string;
4035
+ function: "min" | "max" | "count" | "sum" | "avg";
4036
+ } | undefined;
4037
+ readonly language?: string | undefined;
4038
+ readonly lineNumbers?: boolean | undefined;
4039
+ readonly maxRating?: number | undefined;
4040
+ readonly allowHalf?: boolean | undefined;
4041
+ readonly displayMap?: boolean | undefined;
4042
+ readonly allowGeocoding?: boolean | undefined;
4043
+ readonly addressFormat?: "us" | "uk" | "international" | undefined;
4044
+ readonly colorFormat?: "hex" | "rgb" | "rgba" | "hsl" | undefined;
4045
+ readonly allowAlpha?: boolean | undefined;
4046
+ readonly presetColors?: string[] | undefined;
4047
+ readonly step?: number | undefined;
4048
+ readonly showValue?: boolean | undefined;
4049
+ readonly marks?: Record<string, string> | undefined;
4050
+ readonly barcodeFormat?: "qr" | "ean13" | "ean8" | "code128" | "code39" | "upca" | "upce" | undefined;
4051
+ readonly qrErrorCorrection?: "L" | "M" | "Q" | "H" | undefined;
4052
+ readonly displayValue?: boolean | undefined;
4053
+ readonly allowScanning?: boolean | undefined;
4054
+ readonly currencyConfig?: {
4055
+ precision: number;
4056
+ currencyMode: "fixed" | "dynamic";
4057
+ defaultCurrency: string;
4058
+ } | undefined;
4059
+ readonly vectorConfig?: {
4060
+ dimensions: number;
4061
+ distanceMetric: "cosine" | "euclidean" | "dotProduct" | "manhattan";
4062
+ normalized: boolean;
4063
+ indexed: boolean;
4064
+ indexType?: "flat" | "hnsw" | "ivfflat" | undefined;
4065
+ } | undefined;
4066
+ readonly fileAttachmentConfig?: {
4067
+ virusScan: boolean;
4068
+ virusScanOnUpload: boolean;
4069
+ quarantineOnThreat: boolean;
4070
+ allowMultiple: boolean;
4071
+ allowReplace: boolean;
4072
+ allowDelete: boolean;
4073
+ requireUpload: boolean;
4074
+ extractMetadata: boolean;
4075
+ extractText: boolean;
4076
+ versioningEnabled: boolean;
4077
+ publicRead: boolean;
4078
+ presignedUrlExpiry: number;
4079
+ minSize?: number | undefined;
4080
+ maxSize?: number | undefined;
4081
+ allowedTypes?: string[] | undefined;
4082
+ blockedTypes?: string[] | undefined;
4083
+ allowedMimeTypes?: string[] | undefined;
4084
+ blockedMimeTypes?: string[] | undefined;
4085
+ virusScanProvider?: "custom" | "clamav" | "virustotal" | "metadefender" | undefined;
4086
+ storageProvider?: string | undefined;
4087
+ storageBucket?: string | undefined;
4088
+ storagePrefix?: string | undefined;
4089
+ imageValidation?: {
4090
+ generateThumbnails: boolean;
4091
+ preserveMetadata: boolean;
4092
+ autoRotate: boolean;
4093
+ minWidth?: number | undefined;
4094
+ maxWidth?: number | undefined;
4095
+ minHeight?: number | undefined;
4096
+ maxHeight?: number | undefined;
4097
+ aspectRatio?: string | undefined;
4098
+ thumbnailSizes?: {
4099
+ name: string;
4100
+ width: number;
4101
+ height: number;
4102
+ crop: boolean;
4103
+ }[] | undefined;
4104
+ } | undefined;
4105
+ maxVersions?: number | undefined;
4106
+ } | undefined;
4107
+ readonly maskingRule?: {
4108
+ field: string;
4109
+ strategy: "partial" | "hash" | "redact" | "tokenize" | "randomize" | "nullify" | "substitute";
4110
+ preserveFormat: boolean;
4111
+ preserveLength: boolean;
4112
+ pattern?: string | undefined;
4113
+ roles?: string[] | undefined;
4114
+ exemptRoles?: string[] | undefined;
3448
4115
  } | undefined;
3449
- } | undefined;
3450
- shortcut?: string | undefined;
3451
- bulkEnabled?: boolean | undefined;
3452
- aiExposed?: boolean | undefined;
3453
- recordIdParam?: string | undefined;
3454
- recordIdField?: string | undefined;
3455
- bodyShape?: "flat" | {
3456
- wrap: string;
3457
- } | undefined;
3458
- method?: "POST" | "PATCH" | "PUT" | "DELETE" | undefined;
3459
- bodyExtra?: Record<string, unknown> | undefined;
3460
- mode?: "custom" | "delete" | "create" | "edit" | undefined;
3461
- timeout?: number | undefined;
3462
- aria?: {
3463
- ariaLabel?: string | undefined;
3464
- ariaDescribedBy?: string | undefined;
3465
- role?: string | undefined;
3466
- } | undefined;
3467
- }[] | undefined;
3468
- }, "fields"> & Pick<{
3469
- readonly name: "sys_permission_set";
3470
- readonly label: "Permission Set";
3471
- readonly pluralLabel: "Permission Sets";
3472
- readonly icon: "lock";
3473
- readonly isSystem: true;
3474
- readonly managedBy: "config";
3475
- readonly description: "Named permission groupings for fine-grained access control";
3476
- readonly displayNameField: "label";
3477
- readonly titleFormat: "{label}";
3478
- readonly compactLayout: ["label", "name", "active"];
3479
- readonly actions: [{
3480
- readonly name: "activate_permission_set";
3481
- readonly label: "Activate";
3482
- readonly icon: "circle-check";
3483
- readonly variant: "secondary";
3484
- readonly mode: "custom";
3485
- readonly locations: ["list_item", "record_header"];
3486
- readonly type: "api";
3487
- readonly method: "PATCH";
3488
- readonly target: "/api/v1/data/sys_permission_set/{id}";
3489
- readonly bodyExtra: {
3490
- readonly active: true;
3491
- };
3492
- readonly successMessage: "Permission set activated";
3493
- readonly refreshAfter: true;
3494
- }, {
3495
- readonly name: "deactivate_permission_set";
3496
- readonly label: "Deactivate";
3497
- readonly icon: "circle-off";
3498
- readonly variant: "danger";
3499
- readonly mode: "custom";
3500
- readonly locations: ["list_item", "record_header"];
3501
- readonly type: "api";
3502
- readonly method: "PATCH";
3503
- readonly target: "/api/v1/data/sys_permission_set/{id}";
3504
- readonly bodyExtra: {
3505
- readonly active: false;
3506
- };
3507
- readonly confirmText: "Deactivate this permission set? Existing assignments stay in place but stop granting access until re-activated.";
3508
- readonly successMessage: "Permission set deactivated";
3509
- readonly refreshAfter: true;
3510
- }, {
3511
- readonly name: "clone_permission_set";
3512
- readonly label: "Clone";
3513
- readonly icon: "copy";
3514
- readonly variant: "secondary";
3515
- readonly mode: "custom";
3516
- readonly locations: ["list_item", "record_header"];
3517
- readonly type: "api";
3518
- readonly method: "POST";
3519
- readonly target: "/api/v1/data/sys_permission_set";
3520
- readonly bodyExtra: {
3521
- readonly active: true;
3522
- };
3523
- readonly successMessage: "Permission set cloned";
3524
- readonly refreshAfter: true;
3525
- readonly params: [{
3526
- readonly name: "label";
3527
- readonly label: "New Display Name";
3528
- readonly type: "text";
3529
- readonly required: true;
3530
- }, {
3531
- readonly name: "name";
3532
- readonly label: "New API Name";
3533
- readonly type: "text";
3534
- readonly required: true;
3535
- readonly helpText: "Unique snake_case machine name";
3536
- }, {
3537
- readonly field: "description";
3538
- readonly defaultFromRow: true;
3539
- }, {
3540
- readonly field: "object_permissions";
3541
- readonly defaultFromRow: true;
3542
- }, {
3543
- readonly field: "field_permissions";
3544
- readonly defaultFromRow: true;
3545
- }];
3546
- }];
3547
- readonly listViews: {
3548
- readonly active: {
3549
- readonly type: "grid";
3550
- readonly name: "active";
3551
- readonly label: "Active";
3552
- readonly data: {
3553
- readonly provider: "object";
3554
- readonly object: "sys_permission_set";
3555
- };
3556
- readonly columns: ["label", "name", "description", "updated_at"];
3557
- readonly filter: [{
3558
- readonly field: "active";
3559
- readonly operator: "equals";
3560
- readonly value: true;
3561
- }];
3562
- readonly sort: [{
3563
- readonly field: "label";
3564
- readonly order: "asc";
3565
- }];
3566
- readonly pagination: {
3567
- readonly pageSize: 50;
3568
- };
3569
- };
3570
- readonly inactive: {
3571
- readonly type: "grid";
3572
- readonly name: "inactive";
3573
- readonly label: "Inactive";
3574
- readonly data: {
3575
- readonly provider: "object";
3576
- readonly object: "sys_permission_set";
3577
- };
3578
- readonly columns: ["label", "name", "updated_at"];
3579
- readonly filter: [{
3580
- readonly field: "active";
3581
- readonly operator: "equals";
3582
- readonly value: false;
3583
- }];
3584
- readonly sort: [{
3585
- readonly field: "label";
3586
- readonly order: "asc";
3587
- }];
3588
- readonly pagination: {
3589
- readonly pageSize: 50;
3590
- };
3591
- };
3592
- readonly all_permsets: {
3593
- readonly type: "grid";
3594
- readonly name: "all_permsets";
3595
- readonly label: "All";
3596
- readonly data: {
3597
- readonly provider: "object";
3598
- readonly object: "sys_permission_set";
3599
- };
3600
- readonly columns: ["label", "name", "active", "updated_at"];
3601
- readonly sort: [{
3602
- readonly field: "label";
3603
- readonly order: "asc";
3604
- }];
3605
- readonly pagination: {
3606
- readonly pageSize: 50;
3607
- };
4116
+ readonly auditTrail?: boolean | undefined;
4117
+ readonly cached?: {
4118
+ enabled: boolean;
4119
+ ttl: number;
4120
+ invalidateOn: string[];
4121
+ } | undefined;
4122
+ readonly dataQuality?: {
4123
+ uniqueness: boolean;
4124
+ completeness: number;
4125
+ accuracy?: {
4126
+ source: string;
4127
+ threshold: number;
4128
+ } | undefined;
4129
+ } | undefined;
4130
+ readonly conditionalRequired?: {
4131
+ dialect: "cel" | "js" | "cron" | "template";
4132
+ source?: string | undefined;
4133
+ ast?: unknown;
4134
+ meta?: {
4135
+ rationale?: string | undefined;
4136
+ generatedBy?: string | undefined;
4137
+ } | undefined;
4138
+ } | undefined;
4139
+ readonly hidden?: boolean | undefined;
4140
+ readonly sortable?: boolean | undefined;
4141
+ readonly inlineHelpText?: string | undefined;
4142
+ readonly trackFeedHistory?: boolean | undefined;
4143
+ readonly caseSensitive?: boolean | undefined;
4144
+ readonly autonumberFormat?: string | undefined;
4145
+ readonly index?: boolean | undefined;
4146
+ readonly type: "textarea";
3608
4147
  };
3609
- };
3610
- readonly fields: {
3611
- readonly label: {
4148
+ readonly object_permissions: {
3612
4149
  readonly readonly?: boolean | undefined;
3613
4150
  readonly format?: string | undefined;
3614
4151
  readonly options?: {
@@ -3781,9 +4318,9 @@ declare const securityObjects: ((Omit<{
3781
4318
  readonly caseSensitive?: boolean | undefined;
3782
4319
  readonly autonumberFormat?: string | undefined;
3783
4320
  readonly index?: boolean | undefined;
3784
- readonly type: "text";
4321
+ readonly type: "textarea";
3785
4322
  };
3786
- readonly name: {
4323
+ readonly field_permissions: {
3787
4324
  readonly readonly?: boolean | undefined;
3788
4325
  readonly format?: string | undefined;
3789
4326
  readonly options?: {
@@ -3956,9 +4493,9 @@ declare const securityObjects: ((Omit<{
3956
4493
  readonly caseSensitive?: boolean | undefined;
3957
4494
  readonly autonumberFormat?: string | undefined;
3958
4495
  readonly index?: boolean | undefined;
3959
- readonly type: "text";
4496
+ readonly type: "textarea";
3960
4497
  };
3961
- readonly description: {
4498
+ readonly system_permissions: {
3962
4499
  readonly readonly?: boolean | undefined;
3963
4500
  readonly format?: string | undefined;
3964
4501
  readonly options?: {
@@ -4133,7 +4670,7 @@ declare const securityObjects: ((Omit<{
4133
4670
  readonly index?: boolean | undefined;
4134
4671
  readonly type: "textarea";
4135
4672
  };
4136
- readonly object_permissions: {
4673
+ readonly row_level_security: {
4137
4674
  readonly readonly?: boolean | undefined;
4138
4675
  readonly format?: string | undefined;
4139
4676
  readonly options?: {
@@ -4308,7 +4845,7 @@ declare const securityObjects: ((Omit<{
4308
4845
  readonly index?: boolean | undefined;
4309
4846
  readonly type: "textarea";
4310
4847
  };
4311
- readonly field_permissions: {
4848
+ readonly tab_permissions: {
4312
4849
  readonly readonly?: boolean | undefined;
4313
4850
  readonly format?: string | undefined;
4314
4851
  readonly options?: {
@@ -5205,7 +5742,7 @@ declare const securityObjects: ((Omit<{
5205
5742
  abstract: boolean;
5206
5743
  datasource: string;
5207
5744
  fields: Record<string, {
5208
- type: "number" | "boolean" | "tags" | "date" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
5745
+ type: "number" | "boolean" | "tags" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
5209
5746
  required: boolean;
5210
5747
  searchable: boolean;
5211
5748
  multiple: boolean;
@@ -5344,7 +5881,7 @@ declare const securityObjects: ((Omit<{
5344
5881
  autoRotate: boolean;
5345
5882
  } | undefined;
5346
5883
  };
5347
- scope: "field" | "record" | "table" | "database";
5884
+ scope: "record" | "field" | "table" | "database";
5348
5885
  deterministicEncryption: boolean;
5349
5886
  searchableEncryption: boolean;
5350
5887
  } | undefined;
@@ -5807,7 +6344,7 @@ declare const securityObjects: ((Omit<{
5807
6344
  refreshAfter: boolean;
5808
6345
  objectName?: string | undefined;
5809
6346
  icon?: string | undefined;
5810
- locations?: ("list_toolbar" | "list_item" | "record_header" | "record_more" | "record_related" | "global_nav")[] | undefined;
6347
+ locations?: ("list_toolbar" | "list_item" | "record_header" | "record_more" | "record_related" | "record_section" | "global_nav")[] | undefined;
5811
6348
  component?: "action:button" | "action:icon" | "action:menu" | "action:group" | undefined;
5812
6349
  target?: string | undefined;
5813
6350
  body?: {
@@ -5827,7 +6364,7 @@ declare const securityObjects: ((Omit<{
5827
6364
  field?: string | undefined;
5828
6365
  objectOverride?: string | undefined;
5829
6366
  label?: string | undefined;
5830
- type?: "number" | "boolean" | "date" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "tags" | "vector" | undefined;
6367
+ type?: "number" | "boolean" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "tags" | "vector" | undefined;
5831
6368
  options?: {
5832
6369
  label: string;
5833
6370
  value: string;
@@ -5840,6 +6377,17 @@ declare const securityObjects: ((Omit<{
5840
6377
  variant?: "link" | "primary" | "secondary" | "danger" | "ghost" | undefined;
5841
6378
  confirmText?: string | undefined;
5842
6379
  successMessage?: string | undefined;
6380
+ resultDialog?: {
6381
+ title?: string | undefined;
6382
+ description?: string | undefined;
6383
+ acknowledge?: string | undefined;
6384
+ format?: "secret" | "text" | "json" | "qrcode" | "code-list" | undefined;
6385
+ fields?: {
6386
+ path: string;
6387
+ label?: string | undefined;
6388
+ format?: "secret" | "text" | "json" | "qrcode" | "code-list" | undefined;
6389
+ }[] | undefined;
6390
+ } | undefined;
5843
6391
  visible?: {
5844
6392
  dialect: "cel" | "js" | "cron" | "template";
5845
6393
  source?: string | undefined;
@@ -7138,7 +7686,7 @@ declare const securityObjects: ((Omit<{
7138
7686
  abstract: boolean;
7139
7687
  datasource: string;
7140
7688
  fields: Record<string, {
7141
- type: "number" | "boolean" | "tags" | "date" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
7689
+ type: "number" | "boolean" | "tags" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
7142
7690
  required: boolean;
7143
7691
  searchable: boolean;
7144
7692
  multiple: boolean;
@@ -7277,7 +7825,7 @@ declare const securityObjects: ((Omit<{
7277
7825
  autoRotate: boolean;
7278
7826
  } | undefined;
7279
7827
  };
7280
- scope: "field" | "record" | "table" | "database";
7828
+ scope: "record" | "field" | "table" | "database";
7281
7829
  deterministicEncryption: boolean;
7282
7830
  searchableEncryption: boolean;
7283
7831
  } | undefined;
@@ -7740,7 +8288,7 @@ declare const securityObjects: ((Omit<{
7740
8288
  refreshAfter: boolean;
7741
8289
  objectName?: string | undefined;
7742
8290
  icon?: string | undefined;
7743
- locations?: ("list_toolbar" | "list_item" | "record_header" | "record_more" | "record_related" | "global_nav")[] | undefined;
8291
+ locations?: ("list_toolbar" | "list_item" | "record_header" | "record_more" | "record_related" | "record_section" | "global_nav")[] | undefined;
7744
8292
  component?: "action:button" | "action:icon" | "action:menu" | "action:group" | undefined;
7745
8293
  target?: string | undefined;
7746
8294
  body?: {
@@ -7760,7 +8308,7 @@ declare const securityObjects: ((Omit<{
7760
8308
  field?: string | undefined;
7761
8309
  objectOverride?: string | undefined;
7762
8310
  label?: string | undefined;
7763
- type?: "number" | "boolean" | "date" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "tags" | "vector" | undefined;
8311
+ type?: "number" | "boolean" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "lookup" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "tags" | "vector" | undefined;
7764
8312
  options?: {
7765
8313
  label: string;
7766
8314
  value: string;
@@ -7773,6 +8321,17 @@ declare const securityObjects: ((Omit<{
7773
8321
  variant?: "link" | "primary" | "secondary" | "danger" | "ghost" | undefined;
7774
8322
  confirmText?: string | undefined;
7775
8323
  successMessage?: string | undefined;
8324
+ resultDialog?: {
8325
+ title?: string | undefined;
8326
+ description?: string | undefined;
8327
+ acknowledge?: string | undefined;
8328
+ format?: "secret" | "text" | "json" | "qrcode" | "code-list" | undefined;
8329
+ fields?: {
8330
+ path: string;
8331
+ label?: string | undefined;
8332
+ format?: "secret" | "text" | "json" | "qrcode" | "code-list" | undefined;
8333
+ }[] | undefined;
8334
+ } | undefined;
7776
8335
  visible?: {
7777
8336
  dialect: "cel" | "js" | "cron" | "template";
7778
8337
  source?: string | undefined;
@@ -8762,15 +9321,43 @@ declare const securityPluginManifestHeader: {
8762
9321
  description: string;
8763
9322
  };
8764
9323
 
8765
- interface CloneOptions {
8766
- logger?: {
8767
- info: (message: string, meta?: Record<string, any>) => void;
8768
- warn: (message: string, meta?: Record<string, any>) => void;
8769
- };
9324
+ interface MaybeLogger {
9325
+ info?: (message: string, meta?: Record<string, any>) => void;
9326
+ warn?: (message: string, meta?: Record<string, any>) => void;
9327
+ debug?: (message: string, meta?: Record<string, any>) => void;
8770
9328
  }
8771
- declare function cloneTenantSeedData(ql: any, targetOrgId: string, options?: CloneOptions): Promise<{
8772
- object: string;
8773
- count: number;
8774
- }[]>;
9329
+ /**
9330
+ * Ensure (or revoke) the org-scoped `organization_admin` grant for
9331
+ * `(userId, orgId)` based on the current `sys_member` rows.
9332
+ *
9333
+ * - If ANY membership row for the pair carries an owner/admin role,
9334
+ * ensure exactly one `sys_user_permission_set` row exists.
9335
+ * - Else, remove every `sys_user_permission_set` row that links the
9336
+ * pair to `organization_admin` (handles demotion and membership
9337
+ * removal symmetrically).
9338
+ *
9339
+ * Returns a structured report for observability. Never throws.
9340
+ */
9341
+ declare function reconcileOrgAdminGrant(ql: any, userId: string, orgId: string, options?: {
9342
+ logger?: MaybeLogger;
9343
+ }): Promise<{
9344
+ action: 'granted' | 'revoked' | 'noop' | 'skipped';
9345
+ reason?: string;
9346
+ }>;
9347
+ /**
9348
+ * Reconcile every `(user_id, organization_id)` pair that has at least
9349
+ * one `sys_member` row. Used by `kernel:ready` to backfill grants for
9350
+ * memberships that pre-date this feature, and as a safety net after
9351
+ * the platform admin bootstrap auto-creates the default organization.
9352
+ */
9353
+ declare function backfillOrgAdminGrants(ql: any, options?: {
9354
+ logger?: MaybeLogger;
9355
+ limit?: number;
9356
+ }): Promise<{
9357
+ scanned: number;
9358
+ granted: number;
9359
+ revoked: number;
9360
+ skipped: number;
9361
+ }>;
8775
9362
 
8776
- export { FieldMasker, PermissionDeniedError, PermissionEvaluator, RLSCompiler, RLS_DENY_FILTER, SECURITY_PLUGIN_ID, SECURITY_PLUGIN_VERSION, SecurityPlugin, cloneTenantSeedData, isPermissionDeniedError, securityDefaultPermissionSets, securityObjects, securityPluginManifestHeader };
9363
+ export { FieldMasker, PermissionDeniedError, PermissionEvaluator, RLSCompiler, RLS_DENY_FILTER, SECURITY_PLUGIN_ID, SECURITY_PLUGIN_VERSION, SecurityPlugin, backfillOrgAdminGrants, isPermissionDeniedError, reconcileOrgAdminGrant, securityDefaultPermissionSets, securityObjects, securityPluginManifestHeader };