@objectstack/plugin-security 7.3.0 → 7.4.1

package/dist/index.mjs

@@ -1,3 +1,891 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/translations/en.objects.generated.ts
+var enObjects;
+var init_en_objects_generated = __esm({
+  "src/translations/en.objects.generated.ts"() {
+    "use strict";
+    enObjects = {
+      sys_role: {
+        label: "Role",
+        pluralLabel: "Roles",
+        description: "Role definitions for RBAC access control",
+        fields: {
+          label: {
+            label: "Display Name"
+          },
+          name: {
+            label: "API Name",
+            help: "Unique machine name for the role (e.g. admin, editor, viewer)"
+          },
+          description: {
+            label: "Description"
+          },
+          permissions: {
+            label: "Permissions",
+            help: "JSON-serialized array of permission strings"
+          },
+          active: {
+            label: "Active"
+          },
+          is_default: {
+            label: "Default Role",
+            help: "Automatically assigned to new users"
+          },
+          id: {
+            label: "Role ID"
+          },
+          created_at: {
+            label: "Created At"
+          },
+          updated_at: {
+            label: "Updated At"
+          }
+        },
+        _views: {
+          active: {
+            label: "Active"
+          },
+          default_roles: {
+            label: "Default"
+          },
+          custom: {
+            label: "Custom"
+          },
+          all_roles: {
+            label: "All"
+          }
+        },
+        _actions: {
+          activate_role: {
+            label: "Activate Role",
+            successMessage: "Role activated"
+          },
+          deactivate_role: {
+            label: "Deactivate Role",
+            confirmText: "Deactivate this role? Users with the role keep their assignment but the role stops granting permissions until re-activated.",
+            successMessage: "Role deactivated"
+          },
+          set_default_role: {
+            label: "Set as Default",
+            confirmText: "Make this the default role for new users? Existing users are unaffected.",
+            successMessage: "Default role updated"
+          },
+          clone_role: {
+            label: "Clone Role",
+            successMessage: "Role cloned"
+          }
+        }
+      },
+      sys_permission_set: {
+        label: "Permission Set",
+        pluralLabel: "Permission Sets",
+        description: "Named permission groupings for fine-grained access control",
+        fields: {
+          label: {
+            label: "Display Name"
+          },
+          name: {
+            label: "API Name",
+            help: "Unique machine name for the permission set"
+          },
+          description: {
+            label: "Description"
+          },
+          object_permissions: {
+            label: "Object Permissions",
+            help: "JSON-serialized object-level CRUD permissions"
+          },
+          field_permissions: {
+            label: "Field Permissions",
+            help: "JSON-serialized field-level read/write permissions"
+          },
+          system_permissions: {
+            label: "System Permissions",
+            help: 'JSON-serialized array of system capability names (e.g. ["setup.access","studio.access","manage_users"])'
+          },
+          row_level_security: {
+            label: "Row-Level Security",
+            help: "JSON-serialized array of row-level security policies (USING/CHECK clauses)"
+          },
+          tab_permissions: {
+            label: "Tab Permissions",
+            help: "JSON-serialized map of app tab visibility (visible | hidden | default_on | default_off)"
+          },
+          active: {
+            label: "Active"
+          },
+          id: {
+            label: "Permission Set ID"
+          },
+          created_at: {
+            label: "Created At"
+          },
+          updated_at: {
+            label: "Updated At"
+          }
+        },
+        _views: {
+          active: {
+            label: "Active"
+          },
+          inactive: {
+            label: "Inactive"
+          },
+          all_permsets: {
+            label: "All"
+          }
+        },
+        _actions: {
+          activate_permission_set: {
+            label: "Activate",
+            successMessage: "Permission set activated"
+          },
+          deactivate_permission_set: {
+            label: "Deactivate",
+            confirmText: "Deactivate this permission set? Existing assignments stay in place but stop granting access until re-activated.",
+            successMessage: "Permission set deactivated"
+          },
+          clone_permission_set: {
+            label: "Clone",
+            successMessage: "Permission set cloned"
+          }
+        }
+      },
+      sys_user_permission_set: {
+        label: "User Permission Set",
+        pluralLabel: "User Permission Sets",
+        description: "Direct assignment of a permission set to a user (optionally scoped to an organization).",
+        fields: {
+          id: {
+            label: "Assignment ID",
+            help: "UUID of the assignment."
+          },
+          user_id: {
+            label: "User",
+            help: "Foreign key to sys_user."
+          },
+          permission_set_id: {
+            label: "Permission Set",
+            help: "Foreign key to sys_permission_set."
+          },
+          organization_id: {
+            label: "Organization",
+            help: "Optional organization scope. NULL = applies in every org context."
+          },
+          granted_by: {
+            label: "Granted By",
+            help: "User who granted this permission set."
+          },
+          created_at: {
+            label: "Created At"
+          },
+          updated_at: {
+            label: "Updated At"
+          }
+        }
+      },
+      sys_role_permission_set: {
+        label: "Role Permission Set",
+        pluralLabel: "Role Permission Sets",
+        description: "Binds a permission set to a role.",
+        fields: {
+          id: {
+            label: "Binding ID",
+            help: "UUID of the role-permission-set binding."
+          },
+          role_id: {
+            label: "Role",
+            help: "Foreign key to sys_role."
+          },
+          permission_set_id: {
+            label: "Permission Set",
+            help: "Foreign key to sys_permission_set."
+          },
+          created_at: {
+            label: "Created At"
+          },
+          updated_at: {
+            label: "Updated At"
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/translations/zh-CN.objects.generated.ts
+var zhCNObjects;
+var init_zh_CN_objects_generated = __esm({
+  "src/translations/zh-CN.objects.generated.ts"() {
+    "use strict";
+    zhCNObjects = {
+      sys_role: {
+        label: "\u89D2\u8272",
+        pluralLabel: "\u89D2\u8272",
+        description: "\u7528\u4E8E RBAC \u8BBF\u95EE\u63A7\u5236\u7684\u89D2\u8272\u5B9A\u4E49",
+        fields: {
+          label: {
+            label: "\u663E\u793A\u540D\u79F0"
+          },
+          name: {
+            label: "API \u540D\u79F0",
+            help: "\u89D2\u8272\u7684\u552F\u4E00\u673A\u5668\u540D\u79F0\uFF08\u4F8B\u5982 admin\u3001editor\u3001viewer\uFF09"
+          },
+          description: {
+            label: "\u63CF\u8FF0"
+          },
+          permissions: {
+            label: "\u6743\u9650",
+            help: "\u6743\u9650\u5B57\u7B26\u4E32\u6570\u7EC4\u7684 JSON \u5E8F\u5217\u5316\u5185\u5BB9"
+          },
+          active: {
+            label: "\u542F\u7528"
+          },
+          is_default: {
+            label: "\u9ED8\u8BA4\u89D2\u8272",
+            help: "\u81EA\u52A8\u5206\u914D\u7ED9\u65B0\u7528\u6237"
+          },
+          id: {
+            label: "\u89D2\u8272 ID"
+          },
+          created_at: {
+            label: "\u521B\u5EFA\u65F6\u95F4"
+          },
+          updated_at: {
+            label: "\u66F4\u65B0\u65F6\u95F4"
+          }
+        },
+        _views: {
+          active: {
+            label: "\u542F\u7528"
+          },
+          default_roles: {
+            label: "\u9ED8\u8BA4"
+          },
+          custom: {
+            label: "\u81EA\u5B9A\u4E49"
+          },
+          all_roles: {
+            label: "\u5168\u90E8"
+          }
+        },
+        _actions: {
+          activate_role: {
+            label: "\u6FC0\u6D3B\u89D2\u8272",
+            successMessage: "\u89D2\u8272\u5DF2\u6FC0\u6D3B"
+          },
+          deactivate_role: {
+            label: "\u505C\u7528\u89D2\u8272",
+            confirmText: "\u786E\u5B9A\u8981\u505C\u7528\u6B64\u89D2\u8272\u5417\uFF1F\u62E5\u6709\u8BE5\u89D2\u8272\u7684\u7528\u6237\u4ECD\u4FDD\u7559\u5176\u5206\u914D\uFF0C\u4F46\u5728\u91CD\u65B0\u6FC0\u6D3B\u4E4B\u524D\u8BE5\u89D2\u8272\u5C06\u4E0D\u518D\u6388\u4E88\u6743\u9650\u3002",
+            successMessage: "\u89D2\u8272\u5DF2\u505C\u7528"
+          },
+          set_default_role: {
+            label: "\u8BBE\u4E3A\u9ED8\u8BA4",
+            confirmText: "\u5C06\u6B64\u89D2\u8272\u8BBE\u4E3A\u65B0\u7528\u6237\u7684\u9ED8\u8BA4\u89D2\u8272\u5417\uFF1F\u73B0\u6709\u7528\u6237\u4E0D\u53D7\u5F71\u54CD\u3002",
+            successMessage: "\u5DF2\u66F4\u65B0\u9ED8\u8BA4\u89D2\u8272"
+          },
+          clone_role: {
+            label: "\u514B\u9686\u89D2\u8272",
+            successMessage: "\u5DF2\u514B\u9686\u89D2\u8272"
+          }
+        }
+      },
+      sys_permission_set: {
+        label: "\u6743\u9650\u96C6",
+        pluralLabel: "\u6743\u9650\u96C6",
+        description: "\u7528\u4E8E\u7CBE\u7EC6\u5316\u8BBF\u95EE\u63A7\u5236\u7684\u547D\u540D\u6743\u9650\u5206\u7EC4",
+        fields: {
+          label: {
+            label: "\u663E\u793A\u540D\u79F0"
+          },
+          name: {
+            label: "API \u540D\u79F0",
+            help: "\u6743\u9650\u96C6\u7684\u552F\u4E00\u673A\u5668\u540D\u79F0"
+          },
+          description: {
+            label: "\u63CF\u8FF0"
+          },
+          object_permissions: {
+            label: "\u5BF9\u8C61\u6743\u9650",
+            help: "\u5BF9\u8C61\u7EA7 CRUD \u6743\u9650\u7684 JSON \u5E8F\u5217\u5316\u5185\u5BB9"
+          },
+          field_permissions: {
+            label: "\u5B57\u6BB5\u6743\u9650",
+            help: "\u5B57\u6BB5\u7EA7\u8BFB\u5199\u6743\u9650\u7684 JSON \u5E8F\u5217\u5316\u5185\u5BB9"
+          },
+          system_permissions: {
+            label: "\u7CFB\u7EDF\u6743\u9650",
+            help: '\u7CFB\u7EDF\u80FD\u529B\u540D\u79F0\u7684 JSON \u5E8F\u5217\u5316\u6570\u7EC4\uFF08\u4F8B\u5982 ["setup.access","studio.access","manage_users"]\uFF09'
+          },
+          row_level_security: {
+            label: "\u884C\u7EA7\u5B89\u5168",
+            help: "\u884C\u7EA7\u5B89\u5168\u7B56\u7565\u7684 JSON \u5E8F\u5217\u5316\u6570\u7EC4\uFF08USING/CHECK \u5B50\u53E5\uFF09"
+          },
+          tab_permissions: {
+            label: "\u6807\u7B7E\u9875\u6743\u9650",
+            help: "\u5E94\u7528\u6807\u7B7E\u9875\u53EF\u89C1\u6027\u7684 JSON \u5E8F\u5217\u5316\u6620\u5C04\uFF08visible | hidden | default_on | default_off\uFF09"
+          },
+          active: {
+            label: "\u542F\u7528"
+          },
+          id: {
+            label: "\u6743\u9650\u96C6 ID"
+          },
+          created_at: {
+            label: "\u521B\u5EFA\u65F6\u95F4"
+          },
+          updated_at: {
+            label: "\u66F4\u65B0\u65F6\u95F4"
+          }
+        },
+        _views: {
+          active: {
+            label: "\u542F\u7528"
+          },
+          inactive: {
+            label: "\u505C\u7528"
+          },
+          all_permsets: {
+            label: "\u5168\u90E8"
+          }
+        },
+        _actions: {
+          activate_permission_set: {
+            label: "\u6FC0\u6D3B",
+            successMessage: "\u6743\u9650\u96C6\u5DF2\u6FC0\u6D3B"
+          },
+          deactivate_permission_set: {
+            label: "\u505C\u7528",
+            confirmText: "\u786E\u5B9A\u8981\u505C\u7528\u6B64\u6743\u9650\u96C6\u5417\uFF1F\u73B0\u6709\u5206\u914D\u4ECD\u5C06\u4FDD\u7559\uFF0C\u4F46\u5728\u91CD\u65B0\u6FC0\u6D3B\u4E4B\u524D\u5C06\u4E0D\u518D\u6388\u4E88\u8BBF\u95EE\u6743\u9650\u3002",
+            successMessage: "\u6743\u9650\u96C6\u5DF2\u505C\u7528"
+          },
+          clone_permission_set: {
+            label: "\u514B\u9686",
+            successMessage: "\u5DF2\u514B\u9686\u6743\u9650\u96C6"
+          }
+        }
+      },
+      sys_user_permission_set: {
+        label: "\u7528\u6237\u6743\u9650\u96C6",
+        pluralLabel: "\u7528\u6237\u6743\u9650\u96C6",
+        description: "\u5C06\u6743\u9650\u96C6\u76F4\u63A5\u5206\u914D\u7ED9\u7528\u6237\uFF08\u53EF\u6309\u7EC4\u7EC7\u8303\u56F4\u9650\u5B9A\uFF09\u3002",
+        fields: {
+          id: {
+            label: "\u5206\u914D ID",
+            help: "\u8BE5\u5206\u914D\u8BB0\u5F55\u7684 UUID\u3002"
+          },
+          user_id: {
+            label: "\u7528\u6237",
+            help: "\u6307\u5411 sys_user \u7684\u5916\u952E\u3002"
+          },
+          permission_set_id: {
+            label: "\u6743\u9650\u96C6",
+            help: "\u6307\u5411 sys_permission_set \u7684\u5916\u952E\u3002"
+          },
+          organization_id: {
+            label: "\u7EC4\u7EC7",
+            help: "\u53EF\u9009\u7684\u7EC4\u7EC7\u8303\u56F4\u3002NULL = \u5728\u6240\u6709\u7EC4\u7EC7\u4E0A\u4E0B\u6587\u4E2D\u90FD\u751F\u6548\u3002"
+          },
+          granted_by: {
+            label: "\u6388\u6743\u4EBA",
+            help: "\u6388\u4E88\u8BE5\u6743\u9650\u96C6\u7684\u7528\u6237\u3002"
+          },
+          created_at: {
+            label: "\u521B\u5EFA\u65F6\u95F4"
+          },
+          updated_at: {
+            label: "\u66F4\u65B0\u65F6\u95F4"
+          }
+        }
+      },
+      sys_role_permission_set: {
+        label: "\u89D2\u8272\u6743\u9650\u96C6",
+        pluralLabel: "\u89D2\u8272\u6743\u9650\u96C6",
+        description: "\u5C06\u6743\u9650\u96C6\u7ED1\u5B9A\u5230\u89D2\u8272\u3002",
+        fields: {
+          id: {
+            label: "\u7ED1\u5B9A ID",
+            help: "\u89D2\u8272-\u6743\u9650\u96C6\u7ED1\u5B9A\u8BB0\u5F55\u7684 UUID\u3002"
+          },
+          role_id: {
+            label: "\u89D2\u8272",
+            help: "\u6307\u5411 sys_role \u7684\u5916\u952E\u3002"
+          },
+          permission_set_id: {
+            label: "\u6743\u9650\u96C6",
+            help: "\u6307\u5411 sys_permission_set \u7684\u5916\u952E\u3002"
+          },
+          created_at: {
+            label: "\u521B\u5EFA\u65F6\u95F4"
+          },
+          updated_at: {
+            label: "\u66F4\u65B0\u65F6\u95F4"
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/translations/ja-JP.objects.generated.ts
+var jaJPObjects;
+var init_ja_JP_objects_generated = __esm({
+  "src/translations/ja-JP.objects.generated.ts"() {
+    "use strict";
+    jaJPObjects = {
+      sys_role: {
+        label: "\u30ED\u30FC\u30EB",
+        pluralLabel: "\u30ED\u30FC\u30EB",
+        description: "RBAC \u30A2\u30AF\u30BB\u30B9\u5236\u5FA1\u306E\u305F\u3081\u306E\u30ED\u30FC\u30EB\u5B9A\u7FA9",
+        fields: {
+          label: {
+            label: "\u8868\u793A\u540D"
+          },
+          name: {
+            label: "API \u540D",
+            help: "\u30ED\u30FC\u30EB\u306E\u4E00\u610F\u306E\u6A5F\u68B0\u540D\uFF08\u4F8B: admin\u3001editor\u3001viewer\uFF09"
+          },
+          description: {
+            label: "\u8AAC\u660E"
+          },
+          permissions: {
+            label: "\u6A29\u9650",
+            help: "\u6A29\u9650\u6587\u5B57\u5217\u306E JSON \u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u914D\u5217"
+          },
+          active: {
+            label: "\u6709\u52B9"
+          },
+          is_default: {
+            label: "\u30C7\u30D5\u30A9\u30EB\u30C8\u30ED\u30FC\u30EB",
+            help: "\u65B0\u898F\u30E6\u30FC\u30B6\u30FC\u306B\u81EA\u52D5\u7684\u306B\u5272\u308A\u5F53\u3066\u3089\u308C\u307E\u3059"
+          },
+          id: {
+            label: "\u30ED\u30FC\u30EB ID"
+          },
+          created_at: {
+            label: "\u4F5C\u6210\u65E5\u6642"
+          },
+          updated_at: {
+            label: "\u66F4\u65B0\u65E5\u6642"
+          }
+        },
+        _views: {
+          active: {
+            label: "\u6709\u52B9"
+          },
+          default_roles: {
+            label: "\u30C7\u30D5\u30A9\u30EB\u30C8"
+          },
+          custom: {
+            label: "\u30AB\u30B9\u30BF\u30E0"
+          },
+          all_roles: {
+            label: "\u3059\u3079\u3066"
+          }
+        },
+        _actions: {
+          activate_role: {
+            label: "\u30ED\u30FC\u30EB\u3092\u6709\u52B9\u5316",
+            successMessage: "\u30ED\u30FC\u30EB\u304C\u6709\u52B9\u5316\u3055\u308C\u307E\u3057\u305F"
+          },
+          deactivate_role: {
+            label: "\u30ED\u30FC\u30EB\u3092\u7121\u52B9\u5316",
+            confirmText: "\u3053\u306E\u30ED\u30FC\u30EB\u3092\u7121\u52B9\u5316\u3057\u307E\u3059\u304B\uFF1F\u3053\u306E\u30ED\u30FC\u30EB\u3092\u6301\u3064\u30E6\u30FC\u30B6\u30FC\u306E\u5272\u308A\u5F53\u3066\u306F\u7DAD\u6301\u3055\u308C\u307E\u3059\u304C\u3001\u518D\u5EA6\u6709\u52B9\u5316\u3059\u308B\u307E\u3067\u6A29\u9650\u306E\u4ED8\u4E0E\u306F\u505C\u6B62\u3055\u308C\u307E\u3059\u3002",
+            successMessage: "\u30ED\u30FC\u30EB\u304C\u7121\u52B9\u5316\u3055\u308C\u307E\u3057\u305F"
+          },
+          set_default_role: {
+            label: "\u30C7\u30D5\u30A9\u30EB\u30C8\u306B\u8A2D\u5B9A",
+            confirmText: "\u3053\u306E\u30ED\u30FC\u30EB\u3092\u65B0\u898F\u30E6\u30FC\u30B6\u30FC\u306E\u30C7\u30D5\u30A9\u30EB\u30C8\u30ED\u30FC\u30EB\u306B\u3057\u307E\u3059\u304B\uFF1F\u65E2\u5B58\u306E\u30E6\u30FC\u30B6\u30FC\u306B\u306F\u5F71\u97FF\u3057\u307E\u305B\u3093\u3002",
+            successMessage: "\u30C7\u30D5\u30A9\u30EB\u30C8\u30ED\u30FC\u30EB\u3092\u66F4\u65B0\u3057\u307E\u3057\u305F"
+          },
+          clone_role: {
+            label: "\u30ED\u30FC\u30EB\u3092\u8907\u88FD",
+            successMessage: "\u30ED\u30FC\u30EB\u3092\u8907\u88FD\u3057\u307E\u3057\u305F"
+          }
+        }
+      },
+      sys_permission_set: {
+        label: "\u6A29\u9650\u30BB\u30C3\u30C8",
+        pluralLabel: "\u6A29\u9650\u30BB\u30C3\u30C8",
+        description: "\u7D30\u304B\u3044\u30A2\u30AF\u30BB\u30B9\u5236\u5FA1\u306E\u305F\u3081\u306E\u6A29\u9650\u30B0\u30EB\u30FC\u30D7",
+        fields: {
+          label: {
+            label: "\u8868\u793A\u540D"
+          },
+          name: {
+            label: "API \u540D",
+            help: "\u6A29\u9650\u30BB\u30C3\u30C8\u306E\u4E00\u610F\u306E\u6A5F\u68B0\u540D"
+          },
+          description: {
+            label: "\u8AAC\u660E"
+          },
+          object_permissions: {
+            label: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u6A29\u9650",
+            help: "JSON \u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u3055\u308C\u305F\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u30EC\u30D9\u30EB\u306E CRUD \u6A29\u9650"
+          },
+          field_permissions: {
+            label: "\u30D5\u30A3\u30FC\u30EB\u30C9\u6A29\u9650",
+            help: "JSON \u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u3055\u308C\u305F\u30D5\u30A3\u30FC\u30EB\u30C9\u30EC\u30D9\u30EB\u306E\u8AAD\u307F\u53D6\u308A/\u66F8\u304D\u8FBC\u307F\u6A29\u9650"
+          },
+          system_permissions: {
+            label: "\u30B7\u30B9\u30C6\u30E0\u6A29\u9650",
+            help: '\u30B7\u30B9\u30C6\u30E0\u30B1\u30FC\u30D1\u30D3\u30EA\u30C6\u30A3\u540D\u306EJSON\u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u914D\u5217\uFF08\u4F8B: ["setup.access","studio.access","manage_users"]\uFF09'
+          },
+          row_level_security: {
+            label: "\u884C\u30EC\u30D9\u30EB\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3",
+            help: "\u884C\u30EC\u30D9\u30EB\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u30DD\u30EA\u30B7\u30FC\u306EJSON\u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u914D\u5217\uFF08USING/CHECK \u53E5\uFF09"
+          },
+          tab_permissions: {
+            label: "\u30BF\u30D6\u6A29\u9650",
+            help: "\u30A2\u30D7\u30EA\u306E\u30BF\u30D6\u8868\u793A\u306EJSON\u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u30DE\u30C3\u30D7\uFF08visible | hidden | default_on | default_off\uFF09"
+          },
+          active: {
+            label: "\u6709\u52B9"
+          },
+          id: {
+            label: "\u6A29\u9650\u30BB\u30C3\u30C8 ID"
+          },
+          created_at: {
+            label: "\u4F5C\u6210\u65E5\u6642"
+          },
+          updated_at: {
+            label: "\u66F4\u65B0\u65E5\u6642"
+          }
+        },
+        _views: {
+          active: {
+            label: "\u6709\u52B9"
+          },
+          inactive: {
+            label: "\u7121\u52B9"
+          },
+          all_permsets: {
+            label: "\u3059\u3079\u3066"
+          }
+        },
+        _actions: {
+          activate_permission_set: {
+            label: "\u6709\u52B9\u5316",
+            successMessage: "\u6A29\u9650\u30BB\u30C3\u30C8\u304C\u6709\u52B9\u5316\u3055\u308C\u307E\u3057\u305F"
+          },
+          deactivate_permission_set: {
+            label: "\u7121\u52B9\u5316",
+            confirmText: "\u3053\u306E\u6A29\u9650\u30BB\u30C3\u30C8\u3092\u7121\u52B9\u5316\u3057\u307E\u3059\u304B\uFF1F\u65E2\u5B58\u306E\u5272\u308A\u5F53\u3066\u306F\u7DAD\u6301\u3055\u308C\u307E\u3059\u304C\u3001\u518D\u5EA6\u6709\u52B9\u5316\u3059\u308B\u307E\u3067\u30A2\u30AF\u30BB\u30B9\u306E\u4ED8\u4E0E\u306F\u505C\u6B62\u3055\u308C\u307E\u3059\u3002",
+            successMessage: "\u6A29\u9650\u30BB\u30C3\u30C8\u304C\u7121\u52B9\u5316\u3055\u308C\u307E\u3057\u305F"
+          },
+          clone_permission_set: {
+            label: "\u8907\u88FD",
+            successMessage: "\u6A29\u9650\u30BB\u30C3\u30C8\u3092\u8907\u88FD\u3057\u307E\u3057\u305F"
+          }
+        }
+      },
+      sys_user_permission_set: {
+        label: "\u30E6\u30FC\u30B6\u30FC\u6A29\u9650\u30BB\u30C3\u30C8",
+        pluralLabel: "\u30E6\u30FC\u30B6\u30FC\u6A29\u9650\u30BB\u30C3\u30C8",
+        description: "\u30E6\u30FC\u30B6\u30FC\u3078\u306E\u6A29\u9650\u30BB\u30C3\u30C8\u306E\u76F4\u63A5\u5272\u308A\u5F53\u3066\uFF08\u7D44\u7E54\u30B9\u30B3\u30FC\u30D7\u53EF\u80FD\uFF09\u3002",
+        fields: {
+          id: {
+            label: "\u5272\u308A\u5F53\u3066 ID",
+            help: "\u5272\u308A\u5F53\u3066\u306E UUID\u3002"
+          },
+          user_id: {
+            label: "\u30E6\u30FC\u30B6\u30FC",
+            help: "sys_user \u3078\u306E\u5916\u90E8\u30AD\u30FC\u3002"
+          },
+          permission_set_id: {
+            label: "\u6A29\u9650\u30BB\u30C3\u30C8",
+            help: "sys_permission_set \u3078\u306E\u5916\u90E8\u30AD\u30FC\u3002"
+          },
+          organization_id: {
+            label: "\u7D44\u7E54",
+            help: "\u30AA\u30D7\u30B7\u30E7\u30F3\u306E\u7D44\u7E54\u30B9\u30B3\u30FC\u30D7\u3002NULL = \u3059\u3079\u3066\u306E\u7D44\u7E54\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\u3067\u9069\u7528\u3002"
+          },
+          granted_by: {
+            label: "\u4ED8\u4E0E\u8005",
+            help: "\u3053\u306E\u6A29\u9650\u30BB\u30C3\u30C8\u3092\u4ED8\u4E0E\u3057\u305F\u30E6\u30FC\u30B6\u30FC\u3002"
+          },
+          created_at: {
+            label: "\u4F5C\u6210\u65E5\u6642"
+          },
+          updated_at: {
+            label: "\u66F4\u65B0\u65E5\u6642"
+          }
+        }
+      },
+      sys_role_permission_set: {
+        label: "\u30ED\u30FC\u30EB\u6A29\u9650\u30BB\u30C3\u30C8",
+        pluralLabel: "\u30ED\u30FC\u30EB\u6A29\u9650\u30BB\u30C3\u30C8",
+        description: "\u6A29\u9650\u30BB\u30C3\u30C8\u3092\u30ED\u30FC\u30EB\u306B\u30D0\u30A4\u30F3\u30C9\u3057\u307E\u3059\u3002",
+        fields: {
+          id: {
+            label: "\u30D0\u30A4\u30F3\u30C9 ID",
+            help: "\u30ED\u30FC\u30EB\u6A29\u9650\u30BB\u30C3\u30C8\u30D0\u30A4\u30F3\u30C9\u306E UUID\u3002"
+          },
+          role_id: {
+            label: "\u30ED\u30FC\u30EB",
+            help: "sys_role \u3078\u306E\u5916\u90E8\u30AD\u30FC\u3002"
+          },
+          permission_set_id: {
+            label: "\u6A29\u9650\u30BB\u30C3\u30C8",
+            help: "sys_permission_set \u3078\u306E\u5916\u90E8\u30AD\u30FC\u3002"
+          },
+          created_at: {
+            label: "\u4F5C\u6210\u65E5\u6642"
+          },
+          updated_at: {
+            label: "\u66F4\u65B0\u65E5\u6642"
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/translations/es-ES.objects.generated.ts
+var esESObjects;
+var init_es_ES_objects_generated = __esm({
+  "src/translations/es-ES.objects.generated.ts"() {
+    "use strict";
+    esESObjects = {
+      sys_role: {
+        label: "Rol",
+        pluralLabel: "Roles",
+        description: "Definiciones de rol para el control de acceso RBAC",
+        fields: {
+          label: {
+            label: "Nombre visible"
+          },
+          name: {
+            label: "Nombre de API",
+            help: "Nombre t\xE9cnico \xFAnico del rol (p. ej. admin, editor, viewer)."
+          },
+          description: {
+            label: "Descripci\xF3n"
+          },
+          permissions: {
+            label: "Permisos",
+            help: "Matriz serializada en JSON de cadenas de permisos."
+          },
+          active: {
+            label: "Activo"
+          },
+          is_default: {
+            label: "Rol predeterminado",
+            help: "Se asigna autom\xE1ticamente a los nuevos usuarios."
+          },
+          id: {
+            label: "ID de rol"
+          },
+          created_at: {
+            label: "Creado el"
+          },
+          updated_at: {
+            label: "Actualizado el"
+          }
+        },
+        _views: {
+          active: {
+            label: "Activo"
+          },
+          default_roles: {
+            label: "Predeterminado"
+          },
+          custom: {
+            label: "Personalizado"
+          },
+          all_roles: {
+            label: "Todos"
+          }
+        },
+        _actions: {
+          activate_role: {
+            label: "Activar rol",
+            successMessage: "Rol activado"
+          },
+          deactivate_role: {
+            label: "Desactivar rol",
+            confirmText: "\xBFDesactivar este rol? Los usuarios con el rol conservan su asignaci\xF3n, pero el rol deja de otorgar permisos hasta que se vuelva a activar.",
+            successMessage: "Rol desactivado"
+          },
+          set_default_role: {
+            label: "Establecer como predeterminado",
+            confirmText: "\xBFConvertir este en el rol predeterminado para los nuevos usuarios? Los usuarios existentes no se ven afectados.",
+            successMessage: "Rol predeterminado actualizado"
+          },
+          clone_role: {
+            label: "Clonar rol",
+            successMessage: "Rol clonado"
+          }
+        }
+      },
+      sys_permission_set: {
+        label: "Conjunto de permisos",
+        pluralLabel: "Conjuntos de permisos",
+        description: "Agrupaciones de permisos con nombre para un control de acceso detallado",
+        fields: {
+          label: {
+            label: "Nombre visible"
+          },
+          name: {
+            label: "Nombre de API",
+            help: "Nombre t\xE9cnico \xFAnico del conjunto de permisos."
+          },
+          description: {
+            label: "Descripci\xF3n"
+          },
+          object_permissions: {
+            label: "Permisos de objeto",
+            help: "Permisos CRUD a nivel de objeto serializados en JSON."
+          },
+          field_permissions: {
+            label: "Permisos de campo",
+            help: "Permisos de lectura/escritura a nivel de campo serializados en JSON."
+          },
+          system_permissions: {
+            label: "Permisos del sistema",
+            help: 'Array serializado en JSON de nombres de capacidades del sistema (p. ej. ["setup.access","studio.access","manage_users"])'
+          },
+          row_level_security: {
+            label: "Seguridad a nivel de fila",
+            help: "Array serializado en JSON de pol\xEDticas de seguridad a nivel de fila (cl\xE1usulas USING/CHECK)"
+          },
+          tab_permissions: {
+            label: "Permisos de pesta\xF1as",
+            help: "Mapa serializado en JSON de la visibilidad de las pesta\xF1as de la app (visible | hidden | default_on | default_off)"
+          },
+          active: {
+            label: "Activo"
+          },
+          id: {
+            label: "ID de conjunto de permisos"
+          },
+          created_at: {
+            label: "Creado el"
+          },
+          updated_at: {
+            label: "Actualizado el"
+          }
+        },
+        _views: {
+          active: {
+            label: "Activo"
+          },
+          inactive: {
+            label: "Inactivo"
+          },
+          all_permsets: {
+            label: "Todos"
+          }
+        },
+        _actions: {
+          activate_permission_set: {
+            label: "Activar",
+            successMessage: "Conjunto de permisos activado"
+          },
+          deactivate_permission_set: {
+            label: "Desactivar",
+            confirmText: "\xBFDesactivar este conjunto de permisos? Las asignaciones existentes se mantienen, pero dejan de otorgar acceso hasta que se vuelva a activar.",
+            successMessage: "Conjunto de permisos desactivado"
+          },
+          clone_permission_set: {
+            label: "Clonar",
+            successMessage: "Conjunto de permisos clonado"
+          }
+        }
+      },
+      sys_user_permission_set: {
+        label: "Conjunto de permisos de usuario",
+        pluralLabel: "Conjuntos de permisos de usuario",
+        description: "Asignaci\xF3n directa de un conjunto de permisos a un usuario (opcionalmente con \xE1mbito de organizaci\xF3n).",
+        fields: {
+          id: {
+            label: "ID de asignaci\xF3n",
+            help: "UUID de la asignaci\xF3n."
+          },
+          user_id: {
+            label: "Usuario",
+            help: "Clave for\xE1nea a sys_user."
+          },
+          permission_set_id: {
+            label: "Conjunto de permisos",
+            help: "Clave for\xE1nea a sys_permission_set."
+          },
+          organization_id: {
+            label: "Organizaci\xF3n",
+            help: "\xC1mbito de organizaci\xF3n opcional. NULL = se aplica en cualquier contexto de organizaci\xF3n."
+          },
+          granted_by: {
+            label: "Concedido por",
+            help: "Usuario que concedi\xF3 este conjunto de permisos."
+          },
+          created_at: {
+            label: "Creado el"
+          },
+          updated_at: {
+            label: "Actualizado el"
+          }
+        }
+      },
+      sys_role_permission_set: {
+        label: "Conjunto de permisos de rol",
+        pluralLabel: "Conjuntos de permisos de rol",
+        description: "Vincula un conjunto de permisos a un rol.",
+        fields: {
+          id: {
+            label: "ID de vinculaci\xF3n",
+            help: "UUID de la vinculaci\xF3n rol-conjunto de permisos."
+          },
+          role_id: {
+            label: "Rol",
+            help: "Clave for\xE1nea a sys_role."
+          },
+          permission_set_id: {
+            label: "Conjunto de permisos",
+            help: "Clave for\xE1nea a sys_permission_set."
+          },
+          created_at: {
+            label: "Creado el"
+          },
+          updated_at: {
+            label: "Actualizado el"
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/translations/index.ts
+var translations_exports = {};
+__export(translations_exports, {
+  SecurityTranslations: () => SecurityTranslations
+});
+var SecurityTranslations;
+var init_translations = __esm({
+  "src/translations/index.ts"() {
+    "use strict";
+    init_en_objects_generated();
+    init_zh_CN_objects_generated();
+    init_ja_JP_objects_generated();
+    init_es_ES_objects_generated();
+    SecurityTranslations = {
+      en: { objects: enObjects },
+      "zh-CN": { objects: zhCNObjects },
+      "ja-JP": { objects: jaJPObjects },
+      "es-ES": { objects: esESObjects }
+    };
+  }
+});
+
 // src/permission-evaluator.ts
 var OPERATION_TO_PERMISSION = {
   find: "allowRead",
@@ -316,6 +1204,7 @@ function isPermissionDeniedError(e) {
 }
 
 // src/bootstrap-platform-admin.ts
+import { SystemUserId } from "@objectstack/spec/system";
 var SYSTEM_CTX = { isSystem: true };
 async function tryFind(ql, object, where, limit = 100) {
   try {
@@ -382,17 +1271,20 @@ async function bootstrapPlatformAdmin(ql, bootstrapPermissionSets, options = {})
     ql,
     "sys_user_permission_set",
     { permission_set_id: adminPsId },
-    5
+    50
   );
-  if (existingAdminLinks.some((r) => !r.organization_id)) {
+  if (existingAdminLinks.some((r) => !r.organization_id && r.user_id !== SystemUserId.SYSTEM)) {
     return { seeded: seededCount, adminPromoted: false, reason: "already_have_admin" };
   }
   const allUsers = await tryFind(ql, "sys_user", {}, 50);
-  if (allUsers.length === 0) {
-    logger?.info?.("[security] no users yet \u2014 first sign-up will be promoted to platform admin");
+  const humanUsers = allUsers.filter(
+    (u) => u.id !== SystemUserId.SYSTEM && u.role !== "system"
+  );
+  if (humanUsers.length === 0) {
+    logger?.info?.("[security] no human users yet \u2014 first sign-up will be promoted to platform admin");
     return { seeded: seededCount, adminPromoted: false, reason: "no_users" };
   }
-  const sorted = [...allUsers].sort((a, b) => {
+  const sorted = [...humanUsers].sort((a, b) => {
     const ta = a.created_at ? new Date(a.created_at).getTime() : 0;
     const tb = b.created_at ? new Date(b.created_at).getTime() : 0;
     return ta - tb;
@@ -581,14 +1473,1015 @@ function extractMemberPairs(opCtx) {
   return Array.from(out.values());
 }
 
+// src/objects/sys-role.object.ts
+import { ObjectSchema, Field } from "@objectstack/spec/data";
+var SysRole = ObjectSchema.create({
+  name: "sys_role",
+  label: "Role",
+  pluralLabel: "Roles",
+  icon: "shield",
+  isSystem: true,
+  managedBy: "config",
+  // ADR-0010 §3.7 — RBAC primitive; tenants may add custom rows
+  // (created via UI / API) but the schema itself is locked.
+  protection: {
+    lock: "no-overlay",
+    reason: "RBAC schema is platform-defined \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "Role definitions for RBAC access control",
+  displayNameField: "label",
+  titleFormat: "{label}",
+  compactLayout: ["label", "name", "active", "is_default"],
+  // Custom actions — system roles drive RBAC and are edited rarely but
+  // require the four high-frequency sysadmin affordances every IdP
+  // (Salesforce, ServiceNow, Okta) ships: activate/deactivate (lifecycle
+  // without losing assignments), mark default (auto-assign to new users),
+  // and clone (template for new roles). All operations hit the generic
+  // data CRUD endpoint exposed by `apiEnabled` — no custom server route
+  // required because `managedBy: 'config'` allows direct mutation.
+  actions: [
+    {
+      name: "activate_role",
+      label: "Activate Role",
+      icon: "circle-check",
+      variant: "secondary",
+      mode: "custom",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "PATCH",
+      target: "/api/v1/data/sys_role/{id}",
+      bodyExtra: { active: true },
+      successMessage: "Role activated",
+      refreshAfter: true
+    },
+    {
+      name: "deactivate_role",
+      label: "Deactivate Role",
+      icon: "circle-off",
+      variant: "danger",
+      mode: "custom",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "PATCH",
+      target: "/api/v1/data/sys_role/{id}",
+      bodyExtra: { active: false },
+      confirmText: "Deactivate this role? Users with the role keep their assignment but the role stops granting permissions until re-activated.",
+      successMessage: "Role deactivated",
+      refreshAfter: true
+    },
+    {
+      name: "set_default_role",
+      label: "Set as Default",
+      icon: "star",
+      variant: "secondary",
+      mode: "custom",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "PATCH",
+      target: "/api/v1/data/sys_role/{id}",
+      bodyExtra: { is_default: true },
+      confirmText: "Make this the default role for new users? Existing users are unaffected.",
+      successMessage: "Default role updated",
+      refreshAfter: true
+    },
+    {
+      // Clone — POST a new sys_role row pre-filled from the source. The
+      // dialog asks only for the new API name / label so the operator
+      // can rename atomically; permissions JSON is copied wholesale via
+      // defaultFromRow.
+      name: "clone_role",
+      label: "Clone Role",
+      icon: "copy",
+      variant: "secondary",
+      mode: "custom",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "POST",
+      target: "/api/v1/data/sys_role",
+      bodyExtra: { is_default: false, active: true },
+      successMessage: "Role cloned",
+      refreshAfter: true,
+      params: [
+        { name: "label", label: "New Display Name", type: "text", required: true },
+        { name: "name", label: "New API Name", type: "text", required: true, helpText: "Unique snake_case machine name" },
+        { field: "description", defaultFromRow: true },
+        { field: "permissions", defaultFromRow: true }
+      ]
+    }
+  ],
+  listViews: {
+    active: {
+      type: "grid",
+      name: "active",
+      label: "Active",
+      data: { provider: "object", object: "sys_role" },
+      columns: ["label", "name", "is_default", "updated_at"],
+      filter: [{ field: "active", operator: "equals", value: true }],
+      sort: [{ field: "label", order: "asc" }],
+      pagination: { pageSize: 50 }
+    },
+    default_roles: {
+      type: "grid",
+      name: "default_roles",
+      label: "Default",
+      data: { provider: "object", object: "sys_role" },
+      columns: ["label", "name", "description", "active"],
+      filter: [{ field: "is_default", operator: "equals", value: true }],
+      sort: [{ field: "label", order: "asc" }],
+      pagination: { pageSize: 50 }
+    },
+    custom: {
+      type: "grid",
+      name: "custom",
+      label: "Custom",
+      data: { provider: "object", object: "sys_role" },
+      columns: ["label", "name", "active", "updated_at"],
+      filter: [{ field: "is_default", operator: "equals", value: false }],
+      sort: [{ field: "label", order: "asc" }],
+      pagination: { pageSize: 50 }
+    },
+    all_roles: {
+      type: "grid",
+      name: "all_roles",
+      label: "All",
+      data: { provider: "object", object: "sys_role" },
+      columns: ["label", "name", "active", "is_default", "updated_at"],
+      sort: [{ field: "label", order: "asc" }],
+      pagination: { pageSize: 50 }
+    }
+  },
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    label: Field.text({
+      label: "Display Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    name: Field.text({
+      label: "API Name",
+      required: true,
+      searchable: true,
+      maxLength: 100,
+      description: "Unique machine name for the role (e.g. admin, editor, viewer)",
+      group: "Identity"
+    }),
+    description: Field.textarea({
+      label: "Description",
+      required: false,
+      group: "Identity"
+    }),
+    // ── Configuration ────────────────────────────────────────────
+    permissions: Field.textarea({
+      label: "Permissions",
+      required: false,
+      description: "JSON-serialized array of permission strings",
+      group: "Configuration"
+    }),
+    // ── Status ───────────────────────────────────────────────────
+    active: Field.boolean({
+      label: "Active",
+      defaultValue: true,
+      group: "Status"
+    }),
+    is_default: Field.boolean({
+      label: "Default Role",
+      defaultValue: false,
+      description: "Automatically assigned to new users",
+      group: "Status"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: Field.text({
+      label: "Role ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["name"], unique: true },
+    { fields: ["active"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: true
+  }
+});
+
+// src/objects/sys-permission-set.object.ts
+import { ObjectSchema as ObjectSchema2, Field as Field2 } from "@objectstack/spec/data";
+var SysPermissionSet = ObjectSchema2.create({
+  name: "sys_permission_set",
+  label: "Permission Set",
+  pluralLabel: "Permission Sets",
+  icon: "lock",
+  isSystem: true,
+  managedBy: "config",
+  // ADR-0010 §3.7 — RBAC primitive; tenants may add custom rows
+  // (created via UI / API) but the schema itself is locked.
+  protection: {
+    lock: "no-overlay",
+    reason: "RBAC schema is platform-defined \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "Named permission groupings for fine-grained access control",
+  displayNameField: "label",
+  titleFormat: "{label}",
+  compactLayout: ["label", "name", "active"],
+  // Custom actions — permission sets are templates assigned to roles or
+  // users (via sys_role_permission_set / sys_user_permission_set). The
+  // sysadmin operations that don't live on the parent-detail tabs are
+  // lifecycle (activate/deactivate without losing assignments) and
+  // clone (build a new permset by tweaking an existing one). Both hit
+  // the generic data CRUD endpoint — managedBy: 'config' permits it.
+  actions: [
+    {
+      name: "activate_permission_set",
+      label: "Activate",
+      icon: "circle-check",
+      variant: "secondary",
+      mode: "custom",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "PATCH",
+      target: "/api/v1/data/sys_permission_set/{id}",
+      bodyExtra: { active: true },
+      successMessage: "Permission set activated",
+      refreshAfter: true
+    },
+    {
+      name: "deactivate_permission_set",
+      label: "Deactivate",
+      icon: "circle-off",
+      variant: "danger",
+      mode: "custom",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "PATCH",
+      target: "/api/v1/data/sys_permission_set/{id}",
+      bodyExtra: { active: false },
+      confirmText: "Deactivate this permission set? Existing assignments stay in place but stop granting access until re-activated.",
+      successMessage: "Permission set deactivated",
+      refreshAfter: true
+    },
+    {
+      name: "clone_permission_set",
+      label: "Clone",
+      icon: "copy",
+      variant: "secondary",
+      mode: "custom",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "POST",
+      target: "/api/v1/data/sys_permission_set",
+      bodyExtra: { active: true },
+      successMessage: "Permission set cloned",
+      refreshAfter: true,
+      params: [
+        { name: "label", label: "New Display Name", type: "text", required: true },
+        { name: "name", label: "New API Name", type: "text", required: true, helpText: "Unique snake_case machine name" },
+        { field: "description", defaultFromRow: true },
+        { field: "object_permissions", defaultFromRow: true },
+        { field: "field_permissions", defaultFromRow: true }
+      ]
+    }
+  ],
+  listViews: {
+    active: {
+      type: "grid",
+      name: "active",
+      label: "Active",
+      data: { provider: "object", object: "sys_permission_set" },
+      columns: ["label", "name", "description", "updated_at"],
+      filter: [{ field: "active", operator: "equals", value: true }],
+      sort: [{ field: "label", order: "asc" }],
+      pagination: { pageSize: 50 }
+    },
+    inactive: {
+      type: "grid",
+      name: "inactive",
+      label: "Inactive",
+      data: { provider: "object", object: "sys_permission_set" },
+      columns: ["label", "name", "updated_at"],
+      filter: [{ field: "active", operator: "equals", value: false }],
+      sort: [{ field: "label", order: "asc" }],
+      pagination: { pageSize: 50 }
+    },
+    all_permsets: {
+      type: "grid",
+      name: "all_permsets",
+      label: "All",
+      data: { provider: "object", object: "sys_permission_set" },
+      columns: ["label", "name", "active", "updated_at"],
+      sort: [{ field: "label", order: "asc" }],
+      pagination: { pageSize: 50 }
+    }
+  },
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    label: Field2.text({
+      label: "Display Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    name: Field2.text({
+      label: "API Name",
+      required: true,
+      searchable: true,
+      maxLength: 100,
+      description: "Unique machine name for the permission set",
+      group: "Identity"
+    }),
+    description: Field2.textarea({
+      label: "Description",
+      required: false,
+      group: "Identity"
+    }),
+    // ── Permissions ──────────────────────────────────────────────
+    object_permissions: Field2.textarea({
+      label: "Object Permissions",
+      required: false,
+      description: "JSON-serialized object-level CRUD permissions",
+      group: "Permissions"
+    }),
+    field_permissions: Field2.textarea({
+      label: "Field Permissions",
+      required: false,
+      description: "JSON-serialized field-level read/write permissions",
+      group: "Permissions"
+    }),
+    system_permissions: Field2.textarea({
+      label: "System Permissions",
+      required: false,
+      description: 'JSON-serialized array of system capability names (e.g. ["setup.access","studio.access","manage_users"])',
+      group: "Permissions"
+    }),
+    row_level_security: Field2.textarea({
+      label: "Row-Level Security",
+      required: false,
+      description: "JSON-serialized array of row-level security policies (USING/CHECK clauses)",
+      group: "Permissions"
+    }),
+    tab_permissions: Field2.textarea({
+      label: "Tab Permissions",
+      required: false,
+      description: "JSON-serialized map of app tab visibility (visible | hidden | default_on | default_off)",
+      group: "Permissions"
+    }),
+    // ── Status ───────────────────────────────────────────────────
+    active: Field2.boolean({
+      label: "Active",
+      defaultValue: true,
+      group: "Status"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: Field2.text({
+      label: "Permission Set ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: Field2.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: Field2.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["name"], unique: true },
+    { fields: ["active"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: true
+  }
+});
+
+// src/objects/sys-user-permission-set.object.ts
+import { ObjectSchema as ObjectSchema3, Field as Field3 } from "@objectstack/spec/data";
+var SysUserPermissionSet = ObjectSchema3.create({
+  name: "sys_user_permission_set",
+  label: "User Permission Set",
+  pluralLabel: "User Permission Sets",
+  icon: "user-check",
+  isSystem: true,
+  managedBy: "system",
+  description: "Direct assignment of a permission set to a user (optionally scoped to an organization).",
+  titleFormat: "{user_id} \u2192 {permission_set_id}",
+  compactLayout: ["user_id", "permission_set_id", "organization_id"],
+  fields: {
+    id: Field3.text({
+      label: "Assignment ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the assignment."
+    }),
+    user_id: Field3.lookup("sys_user", {
+      label: "User",
+      required: true,
+      description: "Foreign key to sys_user."
+    }),
+    permission_set_id: Field3.lookup("sys_permission_set", {
+      label: "Permission Set",
+      required: true,
+      description: "Foreign key to sys_permission_set."
+    }),
+    organization_id: Field3.lookup("sys_organization", {
+      label: "Organization",
+      required: false,
+      description: "Optional organization scope. NULL = applies in every org context."
+    }),
+    granted_by: Field3.lookup("sys_user", {
+      label: "Granted By",
+      required: false,
+      description: "User who granted this permission set."
+    }),
+    created_at: Field3.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field3.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["user_id", "permission_set_id", "organization_id"], unique: true },
+    { fields: ["user_id"] },
+    { fields: ["organization_id"] },
+    { fields: ["permission_set_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+
+// src/objects/sys-role-permission-set.object.ts
+import { ObjectSchema as ObjectSchema4, Field as Field4 } from "@objectstack/spec/data";
+var SysRolePermissionSet = ObjectSchema4.create({
+  name: "sys_role_permission_set",
+  label: "Role Permission Set",
+  pluralLabel: "Role Permission Sets",
+  icon: "shield-plus",
+  isSystem: true,
+  managedBy: "system",
+  description: "Binds a permission set to a role.",
+  titleFormat: "{role_id} \u2192 {permission_set_id}",
+  compactLayout: ["role_id", "permission_set_id"],
+  fields: {
+    id: Field4.text({
+      label: "Binding ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the role-permission-set binding."
+    }),
+    role_id: Field4.lookup("sys_role", {
+      label: "Role",
+      required: true,
+      description: "Foreign key to sys_role."
+    }),
+    permission_set_id: Field4.lookup("sys_permission_set", {
+      label: "Permission Set",
+      required: true,
+      description: "Foreign key to sys_permission_set."
+    }),
+    created_at: Field4.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field4.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["role_id", "permission_set_id"], unique: true },
+    { fields: ["role_id"] },
+    { fields: ["permission_set_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+
+// src/objects/default-permission-sets.ts
+import { PermissionSetSchema } from "@objectstack/spec/security";
+var BETTER_AUTH_MANAGED_OBJECTS = [
+  "sys_user",
+  "sys_account",
+  "sys_session",
+  "sys_organization",
+  "sys_member",
+  "sys_invitation",
+  "sys_team",
+  "sys_team_member",
+  "sys_api_key",
+  "sys_two_factor",
+  "sys_verification",
+  "sys_jwks",
+  "sys_device_code",
+  "sys_oauth_application",
+  "sys_oauth_access_token",
+  "sys_oauth_refresh_token",
+  "sys_oauth_consent"
+];
+var denyWritesOnManagedObjects = () => Object.fromEntries(
+  BETTER_AUTH_MANAGED_OBJECTS.map((name) => [
+    name,
+    { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false }
+  ])
+);
+var defaultPermissionSets = [
+  PermissionSetSchema.parse({
+    name: "admin_full_access",
+    label: "Administrator \u2014 Full Access",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: true,
+        allowEdit: true,
+        allowDelete: true,
+        viewAllRecords: true,
+        modifyAllRecords: true
+      }
+    },
+    systemPermissions: [
+      "manage_users",
+      "manage_metadata",
+      "manage_platform_settings",
+      "setup.access",
+      "studio.access"
+    ]
+  }),
+  // ── Organization Administrator ──────────────────────────────────────
+  //
+  // Third tier between platform admin (`admin_full_access`) and rank-and-file
+  // member. Lives at the *organization* scope: full CRUD on business
+  // objects within their org (governed by `tenant_isolation` RLS), plus
+  // `setup.access` so the Setup app shell is reachable.
+  //
+  // **Deliberately withheld** vs `admin_full_access`:
+  //   - `studio.access` — schema-design surfaces are platform-level (a
+  //     tenant cannot mutate the shared metadata) and Studio is hidden.
+  //   - `manage_metadata` — same reasoning.
+  //   - `manage_platform_settings` — global settings manifests
+  //     (mail / storage / AI / knowledge) and platform-only Setup pages
+  //     (sharing rules, audit logs, OAuth apps, JWKS, …) require this
+  //     and are hidden / 403'd for org admins. Tenant-scoped manifests
+  //     (`branding`, `feature_flags`) keep using `setup.access` so org
+  //     admins CAN configure their own org's branding.
+  //
+  // **Anti-escalation**: writes to the global RBAC tables
+  // (`sys_role`, `sys_permission_set`, `sys_role_permission_set`,
+  // `sys_user_permission_set`, `sys_user_role`) are denied. Allowing
+  // them would let an org admin bind `admin_full_access` (which has no
+  // RLS) to themselves and break out of tenant isolation. Reads are
+  // permitted so the Roles / Permission Sets nav entries still render.
+  //
+  // Auto-granted to every `sys_member` whose role contains `owner` or
+  // `admin` by `plugin-security/src/auto-org-admin-grant.ts`.
+  PermissionSetSchema.parse({
+    name: "organization_admin",
+    label: "Organization Administrator",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: true,
+        allowEdit: true,
+        allowDelete: true,
+        viewAllRecords: true,
+        modifyAllRecords: true
+      },
+      // Identity tables — go through better-auth endpoints (invite,
+      // accept, remove-member, transfer, …) rather than raw CRUD.
+      ...denyWritesOnManagedObjects(),
+      // RBAC tables — read-only to prevent privilege escalation.
+      sys_role: { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false },
+      sys_permission_set: { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false },
+      sys_role_permission_set: { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false },
+      sys_user_permission_set: { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false },
+      sys_user_role: { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false }
+    },
+    systemPermissions: ["manage_org_users", "setup.access"],
+    rowLevelSecurity: [
+      {
+        name: "tenant_isolation",
+        object: "*",
+        operation: "all",
+        using: "organization_id = current_user.organization_id"
+      },
+      // ── better-auth system tables that lack `organization_id` and would
+      //    otherwise be denied by the wildcard policy. Same self-only
+      //    carve-outs as `member_default` — an org admin does not get to
+      //    inspect cross-tenant identity rows.
+      {
+        name: "sys_organization_self",
+        object: "sys_organization",
+        operation: "all",
+        using: "id = current_user.organization_id"
+      },
+      {
+        name: "sys_user_self",
+        object: "sys_user",
+        operation: "select",
+        using: "id = current_user.id"
+      },
+      {
+        name: "sys_user_org_members",
+        object: "sys_user",
+        operation: "select",
+        using: "id IN (current_user.org_user_ids)"
+      },
+      {
+        name: "sys_session_self",
+        object: "sys_session",
+        operation: "all",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_account_self",
+        object: "sys_account",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_team_member_self",
+        object: "sys_team_member",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_two_factor_self",
+        object: "sys_two_factor",
+        operation: "all",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_user_preference_self",
+        object: "sys_user_preference",
+        operation: "all",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_api_key_self",
+        object: "sys_api_key",
+        operation: "all",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_device_code_self",
+        object: "sys_device_code",
+        operation: "all",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_oauth_access_token_self",
+        object: "sys_oauth_access_token",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_oauth_refresh_token_self",
+        object: "sys_oauth_refresh_token",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_oauth_consent_self",
+        object: "sys_oauth_consent",
+        operation: "all",
+        using: "user_id = current_user.id"
+      },
+      // OAuth applications a user has registered themselves (self-service
+      // developer flow exposed in the Account app's Developer section).
+      // `sys_oauth_application` has no `organization_id` so the wildcard
+      // `tenant_isolation` policy would otherwise deny every row.
+      {
+        name: "sys_oauth_application_self",
+        object: "sys_oauth_application",
+        operation: "all",
+        using: "user_id = current_user.id"
+      },
+      // Org-scoped visibility for organization-owned identity-adjacent
+      // tables. Org admins may inspect their own org's invitations and
+      // memberships (read; writes still flow through better-auth).
+      {
+        name: "sys_member_org",
+        object: "sys_member",
+        operation: "select",
+        using: "organization_id = current_user.organization_id"
+      },
+      {
+        name: "sys_invitation_org",
+        object: "sys_invitation",
+        operation: "select",
+        using: "organization_id = current_user.organization_id"
+      },
+      {
+        name: "sys_team_org",
+        object: "sys_team",
+        operation: "select",
+        using: "organization_id = current_user.organization_id"
+      }
+    ]
+  }),
+  PermissionSetSchema.parse({
+    name: "member_default",
+    label: "Member \u2014 Standard Access",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: true,
+        allowEdit: true,
+        allowDelete: true
+      },
+      // Identity tables are managed by better-auth — no direct writes.
+      ...denyWritesOnManagedObjects()
+    },
+    rowLevelSecurity: [
+      {
+        name: "tenant_isolation",
+        object: "*",
+        operation: "all",
+        using: "organization_id = current_user.organization_id"
+      },
+      {
+        name: "owner_only_writes",
+        object: "*",
+        operation: "update",
+        using: "owner_id = current_user.id"
+      },
+      {
+        name: "owner_only_deletes",
+        object: "*",
+        operation: "delete",
+        using: "owner_id = current_user.id"
+      },
+      // ── better-auth system tables that lack `organization_id` and would
+      //    otherwise be left unprotected by the wildcard rule above. ────
+      //
+      // The security plugin's RLS injector treats wildcard policies that
+      // target a missing field as `RLS_DENY_FILTER` (zero rows) unless a
+      // per-object policy contributes an alternate match. Each `*_self`
+      // policy below restores per-user visibility on a better-auth table
+      // that has `user_id` but no `organization_id`. Tables without
+      // `user_id` (`sys_verification`, `sys_jwks`, empty `sys_passkey`)
+      // stay DENY for non-admins by design — only platform admins (via
+      // `admin_full_access`, which has no RLS) should inspect them.
+      {
+        name: "sys_organization_self",
+        object: "sys_organization",
+        operation: "all",
+        using: "id = current_user.organization_id"
+      },
+      {
+        name: "sys_user_self",
+        object: "sys_user",
+        operation: "select",
+        using: "id = current_user.id"
+      },
+      // Org collaborators: members can see other users in the same
+      // organization. Without this, owner/assignee lookups, @-mention
+      // suggestions, reviewer pickers and team-roster surfaces all
+      // collapse to just the current user. `org_user_ids` is
+      // pre-resolved by runtime/resolve-execution-context from
+      // `sys_member` for the active organization. Sensitive credential
+      // tables (`sys_account`, `sys_session`, `sys_api_key`, …) keep
+      // their stricter self-only carve-outs above.
+      {
+        name: "sys_user_org_members",
+        object: "sys_user",
+        operation: "select",
+        using: "id IN (current_user.org_user_ids)"
+      },
+      {
+        name: "sys_session_self",
+        object: "sys_session",
+        operation: "all",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_account_self",
+        object: "sys_account",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_team_member_self",
+        object: "sys_team_member",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_two_factor_self",
+        object: "sys_two_factor",
+        operation: "all",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_user_preference_self",
+        object: "sys_user_preference",
+        operation: "all",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_api_key_self",
+        object: "sys_api_key",
+        operation: "all",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_device_code_self",
+        object: "sys_device_code",
+        operation: "all",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_oauth_access_token_self",
+        object: "sys_oauth_access_token",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_oauth_refresh_token_self",
+        object: "sys_oauth_refresh_token",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_oauth_consent_self",
+        object: "sys_oauth_consent",
+        operation: "all",
+        using: "user_id = current_user.id"
+      },
+      // OAuth applications a user has registered themselves (Account →
+      // Developer → OAuth Applications). `sys_oauth_application` has no
+      // `organization_id`, so without this carve-out the wildcard
+      // `tenant_isolation` policy returns zero rows even for the owner.
+      {
+        name: "sys_oauth_application_self",
+        object: "sys_oauth_application",
+        operation: "all",
+        using: "user_id = current_user.id"
+      }
+    ]
+  }),
+  PermissionSetSchema.parse({
+    name: "viewer_readonly",
+    label: "Viewer \u2014 Read-Only",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: false,
+        allowEdit: false,
+        allowDelete: false
+      },
+      // Belt-and-suspenders: explicit deny on managed objects even though
+      // the wildcard already denies — keeps the policy readable when
+      // future relaxations might widen the wildcard.
+      ...denyWritesOnManagedObjects()
+    },
+    rowLevelSecurity: [
+      {
+        name: "tenant_isolation",
+        object: "*",
+        operation: "select",
+        using: "organization_id = current_user.organization_id"
+      },
+      {
+        name: "sys_organization_self",
+        object: "sys_organization",
+        operation: "select",
+        using: "id = current_user.organization_id"
+      },
+      {
+        name: "sys_user_self",
+        object: "sys_user",
+        operation: "select",
+        using: "id = current_user.id"
+      },
+      // Org collaborators (read-only): see `sys_user_org_members` in
+      // `member_default` for rationale.
+      {
+        name: "sys_user_org_members",
+        object: "sys_user",
+        operation: "select",
+        using: "id IN (current_user.org_user_ids)"
+      },
+      {
+        name: "sys_session_self",
+        object: "sys_session",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_account_self",
+        object: "sys_account",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_team_member_self",
+        object: "sys_team_member",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_two_factor_self",
+        object: "sys_two_factor",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_user_preference_self",
+        object: "sys_user_preference",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_api_key_self",
+        object: "sys_api_key",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_device_code_self",
+        object: "sys_device_code",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_oauth_access_token_self",
+        object: "sys_oauth_access_token",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_oauth_refresh_token_self",
+        object: "sys_oauth_refresh_token",
+        operation: "select",
+        using: "user_id = current_user.id"
+      },
+      {
+        name: "sys_oauth_consent_self",
+        object: "sys_oauth_consent",
+        operation: "select",
+        using: "user_id = current_user.id"
+      }
+    ]
+  })
+];
+
 // src/manifest.ts
-import {
-  SysPermissionSet,
-  SysRole,
-  SysUserPermissionSet,
-  SysRolePermissionSet,
-  defaultPermissionSets
-} from "@objectstack/platform-objects/security";
 var SECURITY_PLUGIN_ID = "com.objectstack.plugin-security";
 var SECURITY_PLUGIN_VERSION = "1.0.0";
 var securityObjects = [
@@ -663,8 +2556,36 @@ var SecurityPlugin = class {
       // Permission sets ride along on the manifest so the metadata service
       // can resolve them by name when SecurityPlugin middleware queries
       // `metadata.list('permissions')`.
-      permissions: this.bootstrapPermissionSets
+      permissions: this.bootstrapPermissionSets,
+      // ADR-0029 D7 — contribute the RBAC entries into the Setup app's
+      // `group_access_control` slot. This plugin owns these objects (K2), so it
+      // ships their menu too; when the plugin is absent the entries don't appear.
+      navigationContributions: [
+        {
+          app: "setup",
+          group: "group_access_control",
+          priority: 100,
+          items: [
+            { id: "nav_roles", type: "object", label: "Roles", objectName: "sys_role", icon: "shield-check" },
+            { id: "nav_permission_sets", type: "object", label: "Permission Sets", objectName: "sys_permission_set", icon: "lock" }
+          ]
+        }
+      ]
     });
+    if (typeof ctx.hook === "function") {
+      ctx.hook("kernel:ready", async () => {
+        try {
+          const i18n = ctx.getService("i18n");
+          if (i18n && typeof i18n.loadTranslations === "function") {
+            const { SecurityTranslations: SecurityTranslations2 } = await Promise.resolve().then(() => (init_translations(), translations_exports));
+            for (const [locale, data] of Object.entries(SecurityTranslations2)) {
+              i18n.loadTranslations(locale, data);
+            }
+          }
+        } catch {
+        }
+      });
+    }
     ctx.logger.info("Security Plugin initialized", {
       defaultPermissionSets: this.bootstrapPermissionSets.map((p) => p.name)
     });