@objectstack/plugin-security 9.9.1 → 9.11.0

package/dist/index.d.mts

@@ -89,6 +89,8 @@ declare class SecurityPlugin implements Plugin {
      */
     private metadata;
     private ql;
+    /** ADR-0055: cache the resolved master-detail relation per controlled_by_parent object. */
+    private cbpRelCache;
     private dbLoader?;
     private logger;
     constructor(options?: SecurityPluginOptions);
@@ -143,6 +145,45 @@ declare class SecurityPlugin implements Plugin {
      * applies (caller adds no filter).
      */
     private computeRlsFilter;
+    /**
+     * Resolve a controlled_by_parent object's master-detail relation (the FK field
+     * key + the master object name), or null. Prefers a required `master_detail`
+     * field; falls back to any `master_detail`, then a required `lookup`. Cached.
+     */
+    private resolveCbpRelation;
+    /**
+     * ADR-0055 — master-detail "controlled by parent" READ derivation.
+     *
+     * For an object whose `sharingModel` is `controlled_by_parent`, access is
+     * derived from the master: return a filter `masterFK IN (<master ids this user
+     * can read>)`. The id set is resolved by running the MASTER's own read RLS
+     * (reused via `computeRlsFilter`) under a system context — no middleware
+     * re-entry, so no recursion. An empty set yields `{ masterFK: { $in: [] } }`,
+     * which matches no rows (fail closed). A misconfigured object (no
+     * master_detail/lookup to derive from) denies all reads (defense-in-depth;
+     * spec validation should prevent authoring it). Returns null when the object is
+     * not controlled_by_parent.
+     *
+     * v1 scope (ADR-0055): single level — the master's OWN controlled_by_parent is
+     * not traversed transitively; master accessibility is the master's RLS filter
+     * (sharing-service grants on the master are not folded in).
+     */
+    private computeControlledByParentFilter;
+    /**
+     * ADR-0055 — master-detail "controlled by parent" WRITE enforcement.
+     *
+     * A by-id write (insert/update/delete) to a controlled_by_parent detail
+     * requires EDIT access to its master: the caller must hold CRUD `update` on the
+     * master object AND the master row must be visible under the master's write RLS.
+     * This is the write-side companion to the read derivation — the RLS read filter
+     * never applies to a by-id write (the #1994 class), so without this a member
+     * could mutate a detail under a master they cannot edit. Throws on denial;
+     * no-op when the object is not controlled_by_parent.
+     *
+     * v1 scope: single-id writes. Bulk writes flow through the AST and are already
+     * scoped by the controlled-by-parent READ filter (to readable masters).
+     */
+    private assertControlledByParentWrite;
     /**
      * Collect all RLS policies from permission sets applicable to the given object/operation.
      */
@@ -230,9 +271,19 @@ interface RLSUserContext {
      * current user (incl. self). Pre-resolved by the runtime so RLS can
      * scope identity tables like `sys_user` via
      * `id IN (current_user.org_user_ids)` without needing subquery
-     * support in the compiler.
+     * support in the compiler. This is the one well-known membership set;
+     * arbitrary §7.3.1 sets arrive via `ExecutionContext.rlsMembership`
+     * and are merged in under their own keys (see {@link RLSCompiler.compileFilter}).
      */
     org_user_ids?: string[];
+    /**
+     * The caller's unique, auth-enforced email. RLS expressions reference it as
+     * `current_user.email` for human-readable, *seedable* owner scoping
+     * (`owner = current_user.email`). Email is exposed because it is UNIQUE; the
+     * user's display `name` is deliberately NOT exposed — names collide, and a
+     * collision on an ownership predicate is an access-control leak.
+     */
+    email?: string;
     [key: string]: unknown;
 }
 /**
@@ -258,6 +309,11 @@ declare const RLS_DENY_FILTER: Record<string, unknown>;
  * Converts `using` / `check` expressions into ObjectQL-compatible filter conditions.
  */
 declare class RLSCompiler {
+    /** Optional logger so a SILENTLY-dropped (uncompilable-shape) policy is observable (ADR-0056 D4). */
+    private logger?;
+    setLogger(logger: {
+        warn?: (message: string, meta?: Record<string, unknown>) => void;
+    } | undefined): void;
     /**
      * Compile RLS policies into a query filter for the given user context.
      * Multiple policies for the same object/operation are OR-combined (any match allows access).
@@ -275,10 +331,17 @@ declare class RLSCompiler {
     /**
      * Compile a single RLS expression into a query filter.
      *
-     * Supports simple expressions like:
-     * - "field_name = current_user.property"
-     * - "field_name IN (current_user.array_property)"
-     * - "field_name = 'literal_value'"
+     * This reference compiler recognizes exactly four forms — anything else
+     * returns `null` and (via {@link compileFilter}) fails closed:
+     * - `field = current_user.property`     → `{ field: <value> }`
+     * - `field = 'literal_value'`           → `{ field: 'literal_value' }`
+     * - `field IN (current_user.array)`     → `{ field: { $in: [...] } }`
+     *   (the array may be a §7.3.1 pre-resolved membership set)
+     * - `1 = 1`                             → `{}` (always-true / no restriction)
+     *
+     * There is intentionally no support for subqueries, `LIKE`/`ILIKE`,
+     * regex, `ANY`/`ALL`, `AND`/`OR`/`NOT`, or `NULL` checks — express those
+     * needs as a `current_user.*` property the runtime pre-resolves instead.
      */
     compileExpression(expression: string, userCtx: RLSUserContext): Record<string, unknown> | null;
     /**
@@ -355,7 +418,7 @@ declare const securityObjects: ((Omit<{
     abstract: boolean;
     datasource: string;
     fields: Record<string, {
-        type: "number" | "boolean" | "tags" | "select" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "lookup" | "master_detail" | "currency" | "percent" | "password" | "secret" | "email" | "time" | "text" | "textarea" | "phone" | "markdown" | "html" | "richtext" | "toggle" | "multiselect" | "radio" | "checkboxes" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
+        type: "number" | "boolean" | "tags" | "select" | "email" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "lookup" | "master_detail" | "currency" | "percent" | "password" | "secret" | "time" | "text" | "textarea" | "phone" | "markdown" | "html" | "richtext" | "toggle" | "multiselect" | "radio" | "checkboxes" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
         required: boolean;
         searchable: boolean;
         multiple: boolean;
@@ -561,7 +624,7 @@ declare const securityObjects: ((Omit<{
     description?: string | undefined;
     icon?: string | undefined;
     tags?: string[] | undefined;
-    managedBy?: "system" | "platform" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
     userActions?: {
         create?: boolean | undefined;
         import?: boolean | undefined;
@@ -790,6 +853,29 @@ declare const securityObjects: ((Omit<{
             titleField: string;
             progressField?: string | undefined;
             dependenciesField?: string | undefined;
+            colorField?: string | undefined;
+            parentField?: string | undefined;
+            typeField?: string | undefined;
+            baselineStartField?: string | undefined;
+            baselineEndField?: string | undefined;
+            groupByField?: string | undefined;
+            resourceView?: boolean | undefined;
+            assigneeField?: string | undefined;
+            effortField?: string | undefined;
+            capacity?: number | undefined;
+            tooltipFields?: (string | {
+                field: string;
+                label?: string | undefined;
+            })[] | undefined;
+            quickFilters?: {
+                field: string;
+                label?: string | undefined;
+                options?: (string | {
+                    value: string | number;
+                    label?: string | undefined;
+                })[] | undefined;
+            }[] | undefined;
+            autoZoomToFilter?: boolean | undefined;
         } | undefined;
         gallery?: {
             coverFit: "cover" | "contain";
@@ -953,7 +1039,7 @@ declare const securityObjects: ((Omit<{
         clone: boolean;
         apiMethods?: ("aggregate" | "update" | "delete" | "restore" | "purge" | "search" | "create" | "import" | "list" | "get" | "upsert" | "bulk" | "history" | "export")[] | undefined;
     } | undefined;
-    sharingModel?: "full" | "read" | "private" | "read_write" | undefined;
+    sharingModel?: "full" | "read" | "private" | "public_read" | "public_read_write" | "controlled_by_parent" | "read_write" | undefined;
     publicSharing?: {
         enabled: boolean;
         allowedAudiences?: ("email" | "public" | "link_only" | "signed_in")[] | undefined;
@@ -985,7 +1071,7 @@ declare const securityObjects: ((Omit<{
         } | {
             language: "js";
             source: string;
-            capabilities: ("api.read" | "api.write" | "crypto.uuid" | "crypto.hash" | "log")[];
+            capabilities: ("api.read" | "api.write" | "api.transaction" | "crypto.uuid" | "crypto.hash" | "log")[];
             timeoutMs?: number | undefined;
             memoryMb?: number | undefined;
         } | undefined;
@@ -2677,7 +2763,7 @@ declare const securityObjects: ((Omit<{
     abstract: boolean;
     datasource: string;
     fields: Record<string, {
-        type: "number" | "boolean" | "tags" | "select" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "lookup" | "master_detail" | "currency" | "percent" | "password" | "secret" | "email" | "time" | "text" | "textarea" | "phone" | "markdown" | "html" | "richtext" | "toggle" | "multiselect" | "radio" | "checkboxes" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
+        type: "number" | "boolean" | "tags" | "select" | "email" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "lookup" | "master_detail" | "currency" | "percent" | "password" | "secret" | "time" | "text" | "textarea" | "phone" | "markdown" | "html" | "richtext" | "toggle" | "multiselect" | "radio" | "checkboxes" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
         required: boolean;
         searchable: boolean;
         multiple: boolean;
@@ -2883,7 +2969,7 @@ declare const securityObjects: ((Omit<{
     description?: string | undefined;
     icon?: string | undefined;
     tags?: string[] | undefined;
-    managedBy?: "system" | "platform" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
     userActions?: {
         create?: boolean | undefined;
         import?: boolean | undefined;
@@ -3112,6 +3198,29 @@ declare const securityObjects: ((Omit<{
             titleField: string;
             progressField?: string | undefined;
             dependenciesField?: string | undefined;
+            colorField?: string | undefined;
+            parentField?: string | undefined;
+            typeField?: string | undefined;
+            baselineStartField?: string | undefined;
+            baselineEndField?: string | undefined;
+            groupByField?: string | undefined;
+            resourceView?: boolean | undefined;
+            assigneeField?: string | undefined;
+            effortField?: string | undefined;
+            capacity?: number | undefined;
+            tooltipFields?: (string | {
+                field: string;
+                label?: string | undefined;
+            })[] | undefined;
+            quickFilters?: {
+                field: string;
+                label?: string | undefined;
+                options?: (string | {
+                    value: string | number;
+                    label?: string | undefined;
+                })[] | undefined;
+            }[] | undefined;
+            autoZoomToFilter?: boolean | undefined;
         } | undefined;
         gallery?: {
             coverFit: "cover" | "contain";
@@ -3275,7 +3384,7 @@ declare const securityObjects: ((Omit<{
         clone: boolean;
         apiMethods?: ("aggregate" | "update" | "delete" | "restore" | "purge" | "search" | "create" | "import" | "list" | "get" | "upsert" | "bulk" | "history" | "export")[] | undefined;
     } | undefined;
-    sharingModel?: "full" | "read" | "private" | "read_write" | undefined;
+    sharingModel?: "full" | "read" | "private" | "public_read" | "public_read_write" | "controlled_by_parent" | "read_write" | undefined;
     publicSharing?: {
         enabled: boolean;
         allowedAudiences?: ("email" | "public" | "link_only" | "signed_in")[] | undefined;
@@ -3307,7 +3416,7 @@ declare const securityObjects: ((Omit<{
         } | {
             language: "js";
             source: string;
-            capabilities: ("api.read" | "api.write" | "crypto.uuid" | "crypto.hash" | "log")[];
+            capabilities: ("api.read" | "api.write" | "api.transaction" | "crypto.uuid" | "crypto.hash" | "log")[];
             timeoutMs?: number | undefined;
             memoryMb?: number | undefined;
         } | undefined;
@@ -5428,7 +5537,7 @@ declare const securityObjects: ((Omit<{
     abstract: boolean;
     datasource: string;
     fields: Record<string, {
-        type: "number" | "boolean" | "tags" | "select" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "lookup" | "master_detail" | "currency" | "percent" | "password" | "secret" | "email" | "time" | "text" | "textarea" | "phone" | "markdown" | "html" | "richtext" | "toggle" | "multiselect" | "radio" | "checkboxes" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
+        type: "number" | "boolean" | "tags" | "select" | "email" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "lookup" | "master_detail" | "currency" | "percent" | "password" | "secret" | "time" | "text" | "textarea" | "phone" | "markdown" | "html" | "richtext" | "toggle" | "multiselect" | "radio" | "checkboxes" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
         required: boolean;
         searchable: boolean;
         multiple: boolean;
@@ -5634,7 +5743,7 @@ declare const securityObjects: ((Omit<{
     description?: string | undefined;
     icon?: string | undefined;
     tags?: string[] | undefined;
-    managedBy?: "system" | "platform" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
     userActions?: {
         create?: boolean | undefined;
         import?: boolean | undefined;
@@ -5863,6 +5972,29 @@ declare const securityObjects: ((Omit<{
             titleField: string;
             progressField?: string | undefined;
             dependenciesField?: string | undefined;
+            colorField?: string | undefined;
+            parentField?: string | undefined;
+            typeField?: string | undefined;
+            baselineStartField?: string | undefined;
+            baselineEndField?: string | undefined;
+            groupByField?: string | undefined;
+            resourceView?: boolean | undefined;
+            assigneeField?: string | undefined;
+            effortField?: string | undefined;
+            capacity?: number | undefined;
+            tooltipFields?: (string | {
+                field: string;
+                label?: string | undefined;
+            })[] | undefined;
+            quickFilters?: {
+                field: string;
+                label?: string | undefined;
+                options?: (string | {
+                    value: string | number;
+                    label?: string | undefined;
+                })[] | undefined;
+            }[] | undefined;
+            autoZoomToFilter?: boolean | undefined;
         } | undefined;
         gallery?: {
             coverFit: "cover" | "contain";
@@ -6026,7 +6158,7 @@ declare const securityObjects: ((Omit<{
         clone: boolean;
         apiMethods?: ("aggregate" | "update" | "delete" | "restore" | "purge" | "search" | "create" | "import" | "list" | "get" | "upsert" | "bulk" | "history" | "export")[] | undefined;
     } | undefined;
-    sharingModel?: "full" | "read" | "private" | "read_write" | undefined;
+    sharingModel?: "full" | "read" | "private" | "public_read" | "public_read_write" | "controlled_by_parent" | "read_write" | undefined;
     publicSharing?: {
         enabled: boolean;
         allowedAudiences?: ("email" | "public" | "link_only" | "signed_in")[] | undefined;
@@ -6058,7 +6190,7 @@ declare const securityObjects: ((Omit<{
         } | {
             language: "js";
             source: string;
-            capabilities: ("api.read" | "api.write" | "crypto.uuid" | "crypto.hash" | "log")[];
+            capabilities: ("api.read" | "api.write" | "api.transaction" | "crypto.uuid" | "crypto.hash" | "log")[];
             timeoutMs?: number | undefined;
             memoryMb?: number | undefined;
         } | undefined;
@@ -7271,7 +7403,7 @@ declare const securityObjects: ((Omit<{
     abstract: boolean;
     datasource: string;
     fields: Record<string, {
-        type: "number" | "boolean" | "tags" | "select" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "lookup" | "master_detail" | "currency" | "percent" | "password" | "secret" | "email" | "time" | "text" | "textarea" | "phone" | "markdown" | "html" | "richtext" | "toggle" | "multiselect" | "radio" | "checkboxes" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
+        type: "number" | "boolean" | "tags" | "select" | "email" | "date" | "record" | "file" | "code" | "datetime" | "signature" | "progress" | "url" | "lookup" | "master_detail" | "currency" | "percent" | "password" | "secret" | "time" | "text" | "textarea" | "phone" | "markdown" | "html" | "richtext" | "toggle" | "multiselect" | "radio" | "checkboxes" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "composite" | "repeater" | "location" | "address" | "json" | "color" | "rating" | "slider" | "qrcode" | "vector";
         required: boolean;
         searchable: boolean;
         multiple: boolean;
@@ -7477,7 +7609,7 @@ declare const securityObjects: ((Omit<{
     description?: string | undefined;
     icon?: string | undefined;
     tags?: string[] | undefined;
-    managedBy?: "system" | "platform" | "config" | "append-only" | "better-auth" | undefined;
+    managedBy?: "platform" | "system" | "config" | "append-only" | "better-auth" | undefined;
     userActions?: {
         create?: boolean | undefined;
         import?: boolean | undefined;
@@ -7706,6 +7838,29 @@ declare const securityObjects: ((Omit<{
             titleField: string;
             progressField?: string | undefined;
             dependenciesField?: string | undefined;
+            colorField?: string | undefined;
+            parentField?: string | undefined;
+            typeField?: string | undefined;
+            baselineStartField?: string | undefined;
+            baselineEndField?: string | undefined;
+            groupByField?: string | undefined;
+            resourceView?: boolean | undefined;
+            assigneeField?: string | undefined;
+            effortField?: string | undefined;
+            capacity?: number | undefined;
+            tooltipFields?: (string | {
+                field: string;
+                label?: string | undefined;
+            })[] | undefined;
+            quickFilters?: {
+                field: string;
+                label?: string | undefined;
+                options?: (string | {
+                    value: string | number;
+                    label?: string | undefined;
+                })[] | undefined;
+            }[] | undefined;
+            autoZoomToFilter?: boolean | undefined;
         } | undefined;
         gallery?: {
             coverFit: "cover" | "contain";
@@ -7869,7 +8024,7 @@ declare const securityObjects: ((Omit<{
         clone: boolean;
         apiMethods?: ("aggregate" | "update" | "delete" | "restore" | "purge" | "search" | "create" | "import" | "list" | "get" | "upsert" | "bulk" | "history" | "export")[] | undefined;
     } | undefined;
-    sharingModel?: "full" | "read" | "private" | "read_write" | undefined;
+    sharingModel?: "full" | "read" | "private" | "public_read" | "public_read_write" | "controlled_by_parent" | "read_write" | undefined;
     publicSharing?: {
         enabled: boolean;
         allowedAudiences?: ("email" | "public" | "link_only" | "signed_in")[] | undefined;
@@ -7901,7 +8056,7 @@ declare const securityObjects: ((Omit<{
         } | {
             language: "js";
             source: string;
-            capabilities: ("api.read" | "api.write" | "crypto.uuid" | "crypto.hash" | "log")[];
+            capabilities: ("api.read" | "api.write" | "api.transaction" | "crypto.uuid" | "crypto.hash" | "log")[];
             timeoutMs?: number | undefined;
             memoryMb?: number | undefined;
         } | undefined;
@@ -8800,6 +8955,7 @@ declare const securityObjects: ((Omit<{
 declare const securityDefaultPermissionSets: {
     name: string;
     isProfile: boolean;
+    isDefault: boolean;
     objects: Record<string, {
         allowCreate: boolean;
         allowRead: boolean;
@@ -8884,4 +9040,79 @@ declare function backfillOrgAdminGrants(ql: any, options?: {
     skipped: number;
 }>;
 
-export { FieldMasker, PermissionDeniedError, PermissionEvaluator, RLSCompiler, RLS_DENY_FILTER, SECURITY_PLUGIN_ID, SECURITY_PLUGIN_VERSION, SecurityPlugin, backfillOrgAdminGrants, isPermissionDeniedError, reconcileOrgAdminGrant, securityDefaultPermissionSets, securityObjects, securityPluginManifestHeader };
+/**
+ * bootstrapPlatformAdmin — first-boot platform admin promotion.
+ *
+ * Two responsibilities, both idempotent and run on `kernel:ready`:
+ *
+ *  1. **Seed `sys_permission_set` rows** for each `defaultPermissionSets`
+ *     entry (admin_full_access / member_default / viewer_readonly).
+ *
+ *  2. **Promote the first registered user to platform admin** by
+ *     inserting a `sys_user_permission_set` row that points at
+ *     `admin_full_access` with `organization_id = NULL` (= cross-tenant).
+ *     If a platform admin already exists, this is a no-op forever.
+ *
+ * The "create a Default Organization for the freshly-promoted admin"
+ * behavior moved to `@objectstack/plugin-org-scoping` (see
+ * `ensureDefaultOrganization`). Install that plugin to get
+ * multi-tenant bootstrap.
+ */
+
+interface BootstrapOptions {
+    /** Logger from PluginContext. */
+    logger?: {
+        info: (message: string, meta?: Record<string, any>) => void;
+        warn: (message: string, meta?: Record<string, any>) => void;
+    };
+}
+/**
+ * Persist seed permission sets and promote the first registered user to
+ * platform admin. Safe to call multiple times.
+ */
+declare function bootstrapPlatformAdmin(ql: any, bootstrapPermissionSets: PermissionSet[], options?: BootstrapOptions): Promise<{
+    seeded: number;
+    adminPromoted: boolean;
+    reason?: string;
+    /** Count of seeded rows re-owned to the freshly-promoted admin. */
+    ownershipClaimed?: number;
+}>;
+
+interface ClaimOwnershipOptions {
+    logger?: {
+        info: (message: string, meta?: Record<string, any>) => void;
+        warn: (message: string, meta?: Record<string, any>) => void;
+    };
+}
+/**
+ * Re-own every orphan seed row (owner_id NULL or usr_system) to `adminUserId`.
+ *
+ * Walks `ql.registry.getAllObjects()`, filters to schemas that
+ *   (a) are not `managedBy` (skip sys_/auth/platform tables),
+ *   (b) are not `sys_*`-namespaced,
+ *   (c) declare an `owner_id` field,
+ * and updates the unowned rows as `isSystem`. Returns a per-object summary.
+ */
+declare function claimSeedOwnership(ql: any, adminUserId: string, options?: ClaimOwnershipOptions): Promise<{
+    object: string;
+    count: number;
+}[]>;
+
+/**
+ * ADR-0056 D7 — resolve the app-declared default profile NAME from a stack's
+ * `permissions[]` array.
+ *
+ * A permission set marked `isProfile && isDefault` declares the app's default
+ * access posture for users with no explicit grants. The {@link SecurityPlugin}
+ * constructor scans its `defaultPermissionSets` option for that flag — but the
+ * CLI constructs `new SecurityPlugin()` with NO options, so an `isDefault`
+ * profile declared purely in app METADATA would never be honored. The CLI calls
+ * this helper to pull the name out of the stack and pass it as
+ * `fallbackPermissionSet`, wiring the declaration through to `pnpm dev`.
+ *
+ * Returns the first matching profile's `name`, or `undefined` when none is
+ * declared (callers then keep the built-in `member_default` fallback).
+ */
+declare function appDefaultProfileName(permissions: unknown): string | undefined;
+
+export { FieldMasker, PermissionDeniedError, PermissionEvaluator, RLSCompiler, RLS_DENY_FILTER, SECURITY_PLUGIN_ID, SECURITY_PLUGIN_VERSION, SecurityPlugin, appDefaultProfileName, backfillOrgAdminGrants, bootstrapPlatformAdmin, claimSeedOwnership, isPermissionDeniedError, reconcileOrgAdminGrant, securityDefaultPermissionSets, securityObjects, securityPluginManifestHeader };