@objectstack/plugin-sharing 7.3.0 → 7.4.0

package/dist/index.mjs

@@ -1,5 +1,1662 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/translations/en.objects.generated.ts
+var enObjects;
+var init_en_objects_generated = __esm({
+  "src/translations/en.objects.generated.ts"() {
+    "use strict";
+    enObjects = {
+      sys_record_share: {
+        label: "Record Share",
+        pluralLabel: "Record Shares",
+        description: "Per-record sharing grant \u2014 extends OWD with explicit access",
+        fields: {
+          id: {
+            label: "Share ID"
+          },
+          object_name: {
+            label: "Object",
+            help: "Short object name of the shared record"
+          },
+          record_id: {
+            label: "Record",
+            help: "Primary key of the shared record within object_name"
+          },
+          recipient_type: {
+            label: "Recipient Type",
+            help: "Kind of principal that holds the grant",
+            options: {
+              user: "user",
+              group: "group",
+              role: "role",
+              role_and_subordinates: "role_and_subordinates",
+              guest: "guest"
+            }
+          },
+          recipient_id: {
+            label: "Recipient",
+            help: "ID of the user/group/role that receives access"
+          },
+          access_level: {
+            label: "Access Level",
+            help: "What the recipient can do \u2014 read | edit | full (transfer/share/delete)",
+            options: {
+              read: "read",
+              edit: "edit",
+              full: "full"
+            }
+          },
+          source: {
+            label: "Source",
+            help: "Why this grant exists \u2014 used by the rule evaluator to reconcile",
+            options: {
+              manual: "manual",
+              rule: "rule",
+              team: "team",
+              inherited: "inherited"
+            }
+          },
+          source_id: {
+            label: "Source ID",
+            help: "Rule name / team id when source != manual"
+          },
+          granted_by: {
+            label: "Granted By",
+            help: "User that created the grant (manual only)"
+          },
+          reason: {
+            label: "Reason",
+            help: "Optional free-text explanation surfaced to the recipient"
+          },
+          created_at: {
+            label: "Created At"
+          },
+          updated_at: {
+            label: "Updated At"
+          }
+        },
+        _views: {
+          granted_to_me: {
+            label: "Granted to Me"
+          },
+          granted_by_me: {
+            label: "Granted by Me"
+          },
+          by_object: {
+            label: "By Object"
+          },
+          manual_grants: {
+            label: "Manual Grants"
+          },
+          rule_grants: {
+            label: "Rule Grants"
+          },
+          all_shares: {
+            label: "All"
+          }
+        }
+      },
+      sys_sharing_rule: {
+        label: "Sharing Rule",
+        pluralLabel: "Sharing Rules",
+        description: "Declarative sharing rule that auto-materialises sys_record_share grants. Authored via defineSharingRule() in code or the Studio criteria builder.",
+        fields: {
+          id: {
+            label: "Rule ID"
+          },
+          organization_id: {
+            label: "Organization",
+            help: "Tenant that owns this rule; null = global"
+          },
+          name: {
+            label: "Name",
+            help: "Unique snake_case rule name"
+          },
+          label: {
+            label: "Display Label"
+          },
+          description: {
+            label: "Description"
+          },
+          object_name: {
+            label: "Object",
+            help: "Short object name (e.g. opportunity, account)"
+          },
+          criteria_json: {
+            label: "Criteria (FilterCondition JSON)",
+            help: "JSON FilterCondition matched against records of object_name. Empty = match all."
+          },
+          recipient_type: {
+            label: "Recipient Type",
+            help: "Kind of principal that receives access \u2014 expanded to user grants at evaluation time. `department` walks the parent_department_id tree; `team` is flat (better-auth).",
+            options: {
+              user: "user",
+              team: "team",
+              department: "department",
+              role: "role",
+              queue: "queue"
+            }
+          },
+          recipient_id: {
+            label: "Recipient",
+            help: "department id / team id / role name / queue name / user id depending on recipient_type"
+          },
+          access_level: {
+            label: "Access Level",
+            options: {
+              read: "read",
+              edit: "edit",
+              full: "full"
+            }
+          },
+          active: {
+            label: "Active",
+            help: "Only active rules participate in lifecycle evaluation"
+          },
+          created_at: {
+            label: "Created At"
+          },
+          updated_at: {
+            label: "Updated At"
+          }
+        },
+        _views: {
+          active: {
+            label: "Active"
+          },
+          inactive: {
+            label: "Inactive"
+          },
+          by_object: {
+            label: "By Object"
+          },
+          all_rules: {
+            label: "All"
+          }
+        }
+      },
+      sys_share_link: {
+        label: "Share Link",
+        pluralLabel: "Share Links",
+        description: "Opaque capability token granting access to a single record. Notion/Figma-style public link sharing.",
+        fields: {
+          id: {
+            label: "Link ID"
+          },
+          token: {
+            label: "Token",
+            help: "Opaque URL-safe random token (\u2265 22 chars). The only secret in this row."
+          },
+          object_name: {
+            label: "Object",
+            help: "Short object name of the shared record (e.g. ai_conversation, contracts_contract)"
+          },
+          record_id: {
+            label: "Record",
+            help: "Primary key of the shared record within object_name"
+          },
+          permission: {
+            label: "Permission",
+            help: "What the link holder can do with the record",
+            options: {
+              view: "View",
+              comment: "Comment",
+              edit: "Edit"
+            }
+          },
+          audience: {
+            label: "Audience",
+            help: "Gating layer applied on top of the token check",
+            options: {
+              public: "Public (indexable)",
+              link_only: "Anyone with the link",
+              signed_in: "Signed-in users",
+              email: "Specific emails"
+            }
+          },
+          expires_at: {
+            label: "Expires At",
+            help: "When set, resolveToken returns null after this timestamp"
+          },
+          email_allowlist: {
+            label: "Email Allowlist",
+            help: "Lowercased addresses checked when audience=email"
+          },
+          password_hash: {
+            label: "Password Hash",
+            help: "Argon2/bcrypt hash. When set, the UI prompts for a password before rendering."
+          },
+          redact_fields: {
+            label: "Per-Link Redactions",
+            help: "Extra fields stripped from the response, on top of the object-default set"
+          },
+          label: {
+            label: "Label",
+            help: 'Free-text shown in the share dialog (e.g. "ACME Q3 contract")'
+          },
+          revoked_at: {
+            label: "Revoked At",
+            help: "When set, the link is permanently disabled"
+          },
+          created_by: {
+            label: "Created By",
+            help: "Issuer of the link"
+          },
+          created_at: {
+            label: "Created At"
+          },
+          last_used_at: {
+            label: "Last Used At",
+            help: "Stamped by resolveToken; used by the dashboard to highlight active links"
+          },
+          use_count: {
+            label: "Use Count",
+            help: "Incremented by resolveToken on every successful resolution"
+          }
+        },
+        _views: {
+          active_links: {
+            label: "Active"
+          },
+          by_me: {
+            label: "Created by Me"
+          },
+          revoked: {
+            label: "Revoked"
+          },
+          all_links: {
+            label: "All"
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/translations/zh-CN.objects.generated.ts
+var zhCNObjects;
+var init_zh_CN_objects_generated = __esm({
+  "src/translations/zh-CN.objects.generated.ts"() {
+    "use strict";
+    zhCNObjects = {
+      sys_record_share: {
+        label: "\u8BB0\u5F55\u5171\u4EAB",
+        pluralLabel: "\u8BB0\u5F55\u5171\u4EAB",
+        description: "\u6309\u8BB0\u5F55\u7C92\u5EA6\u7684\u5171\u4EAB\u6388\u6743\u2014\u2014\u5728 OWD \u57FA\u7840\u4E0A\u63D0\u4F9B\u663E\u5F0F\u8BBF\u95EE",
+        fields: {
+          id: {
+            label: "\u5171\u4EAB ID"
+          },
+          object_name: {
+            label: "\u5BF9\u8C61",
+            help: "\u88AB\u5171\u4EAB\u8BB0\u5F55\u7684\u77ED\u5BF9\u8C61\u540D"
+          },
+          record_id: {
+            label: "\u8BB0\u5F55",
+            help: "object_name \u5BF9\u5E94\u5BF9\u8C61\u5185\u8BE5\u5171\u4EAB\u8BB0\u5F55\u7684\u4E3B\u952E"
+          },
+          recipient_type: {
+            label: "\u63A5\u6536\u65B9\u7C7B\u578B",
+            help: "\u6301\u6709\u8BE5\u6388\u6743\u7684\u4E3B\u4F53\u7C7B\u578B",
+            options: {
+              user: "\u7528\u6237",
+              group: "\u7EC4",
+              role: "\u89D2\u8272",
+              role_and_subordinates: "\u89D2\u8272\u53CA\u4E0B\u7EA7",
+              guest: "\u8BBF\u5BA2"
+            }
+          },
+          recipient_id: {
+            label: "\u63A5\u6536\u65B9",
+            help: "\u83B7\u5F97\u8BBF\u95EE\u6743\u9650\u7684\u7528\u6237 / \u7EC4 / \u89D2\u8272 ID"
+          },
+          access_level: {
+            label: "\u8BBF\u95EE\u7EA7\u522B",
+            help: "\u63A5\u6536\u65B9\u53EF\u4EE5\u6267\u884C\u7684\u64CD\u4F5C\u2014\u2014read | edit | full\uFF08\u8F6C\u79FB / \u5171\u4EAB / \u5220\u9664\uFF09",
+            options: {
+              read: "\u8BFB\u53D6",
+              edit: "\u7F16\u8F91",
+              full: "\u5B8C\u5168\u8BBF\u95EE"
+            }
+          },
+          source: {
+            label: "\u6765\u6E90",
+            help: "\u8BE5\u6388\u6743\u5B58\u5728\u7684\u539F\u56E0\u2014\u2014\u4F9B\u89C4\u5219\u6C42\u503C\u5668\u5BF9\u8D26\u4F7F\u7528",
+            options: {
+              manual: "\u624B\u52A8",
+              rule: "\u89C4\u5219",
+              team: "\u56E2\u961F",
+              inherited: "\u7EE7\u627F"
+            }
+          },
+          source_id: {
+            label: "\u6765\u6E90 ID",
+            help: "\u5F53 source != manual \u65F6\uFF0C\u5BF9\u5E94\u89C4\u5219\u540D / \u56E2\u961F ID"
+          },
+          granted_by: {
+            label: "\u6388\u6743\u4EBA",
+            help: "\u521B\u5EFA\u8BE5\u6388\u6743\u7684\u7528\u6237\uFF08\u4EC5\u624B\u52A8\u6388\u6743\uFF09"
+          },
+          reason: {
+            label: "\u539F\u56E0",
+            help: "\u53EF\u9009\u7684\u81EA\u7531\u6587\u672C\u8BF4\u660E\uFF0C\u4F1A\u5C55\u793A\u7ED9\u63A5\u6536\u65B9"
+          },
+          created_at: {
+            label: "\u521B\u5EFA\u65F6\u95F4"
+          },
+          updated_at: {
+            label: "\u66F4\u65B0\u65F6\u95F4"
+          }
+        },
+        _views: {
+          granted_to_me: {
+            label: "\u6388\u4E88\u6211\u7684"
+          },
+          granted_by_me: {
+            label: "\u6211\u6388\u4E88\u7684"
+          },
+          by_object: {
+            label: "\u6309\u5BF9\u8C61"
+          },
+          manual_grants: {
+            label: "\u624B\u52A8\u6388\u6743"
+          },
+          rule_grants: {
+            label: "\u89C4\u5219\u6388\u6743"
+          },
+          all_shares: {
+            label: "\u5168\u90E8"
+          }
+        }
+      },
+      sys_sharing_rule: {
+        label: "\u5171\u4EAB\u89C4\u5219",
+        pluralLabel: "\u5171\u4EAB\u89C4\u5219",
+        description: "\u58F0\u660E\u5F0F\u5171\u4EAB\u89C4\u5219\uFF0C\u4F1A\u81EA\u52A8\u751F\u6210 sys_record_share \u6388\u6743\u3002\u53EF\u5728\u4EE3\u7801\u4E2D\u901A\u8FC7 defineSharingRule() \u7F16\u5199\uFF0C\u6216\u5728 Studio \u6761\u4EF6\u6784\u5EFA\u5668\u4E2D\u7EF4\u62A4\u3002",
+        fields: {
+          id: {
+            label: "\u89C4\u5219 ID"
+          },
+          organization_id: {
+            label: "\u7EC4\u7EC7",
+            help: "\u62E5\u6709\u8BE5\u89C4\u5219\u7684\u79DF\u6237\uFF1Bnull = \u5168\u5C40"
+          },
+          name: {
+            label: "\u540D\u79F0",
+            help: "\u552F\u4E00\u7684 snake_case \u89C4\u5219\u540D\u79F0"
+          },
+          label: {
+            label: "\u663E\u793A\u6807\u7B7E"
+          },
+          description: {
+            label: "\u63CF\u8FF0"
+          },
+          object_name: {
+            label: "\u5BF9\u8C61",
+            help: "\u77ED\u5BF9\u8C61\u540D\uFF08\u4F8B\u5982 opportunity\u3001account\uFF09"
+          },
+          criteria_json: {
+            label: "\u6761\u4EF6\uFF08FilterCondition JSON\uFF09",
+            help: "\u9488\u5BF9 object_name \u8BB0\u5F55\u5339\u914D\u7684 JSON FilterCondition\u3002\u4E3A\u7A7A\u8868\u793A\u5339\u914D\u5168\u90E8\u3002"
+          },
+          recipient_type: {
+            label: "\u63A5\u6536\u65B9\u7C7B\u578B",
+            help: "\u63A5\u6536\u8BBF\u95EE\u6743\u9650\u7684\u4E3B\u4F53\u7C7B\u578B\u2014\u2014\u6C42\u503C\u65F6\u4F1A\u5C55\u5F00\u4E3A\u7528\u6237\u6388\u6743\u3002`department` \u4F1A\u6CBF parent_department_id \u6811\u5C55\u5F00\uFF1B`team` \u4E3A\u6241\u5E73\u7ED3\u6784\uFF08better-auth\uFF09\u3002",
+            options: {
+              user: "\u7528\u6237",
+              team: "\u56E2\u961F",
+              department: "\u90E8\u95E8",
+              role: "\u89D2\u8272",
+              queue: "\u961F\u5217"
+            }
+          },
+          recipient_id: {
+            label: "\u63A5\u6536\u65B9",
+            help: "\u6839\u636E recipient_type \u586B\u5199 department id / team id / role name / queue name / user id"
+          },
+          access_level: {
+            label: "\u8BBF\u95EE\u7EA7\u522B",
+            options: {
+              read: "\u8BFB\u53D6",
+              edit: "\u7F16\u8F91",
+              full: "\u5B8C\u5168\u8BBF\u95EE"
+            }
+          },
+          active: {
+            label: "\u542F\u7528",
+            help: "\u53EA\u6709\u542F\u7528\u7684\u89C4\u5219\u624D\u4F1A\u53C2\u4E0E\u751F\u547D\u5468\u671F\u6C42\u503C"
+          },
+          created_at: {
+            label: "\u521B\u5EFA\u65F6\u95F4"
+          },
+          updated_at: {
+            label: "\u66F4\u65B0\u65F6\u95F4"
+          }
+        },
+        _views: {
+          active: {
+            label: "\u542F\u7528"
+          },
+          inactive: {
+            label: "\u505C\u7528"
+          },
+          by_object: {
+            label: "\u6309\u5BF9\u8C61"
+          },
+          all_rules: {
+            label: "\u5168\u90E8"
+          }
+        }
+      },
+      sys_share_link: {
+        label: "\u5171\u4EAB\u94FE\u63A5",
+        pluralLabel: "\u5171\u4EAB\u94FE\u63A5",
+        description: "\u6388\u4E88\u5BF9\u5355\u6761\u8BB0\u5F55\u8BBF\u95EE\u6743\u9650\u7684\u4E0D\u900F\u660E\u80FD\u529B\u4EE4\u724C\u3002\u7C7B\u4F3C Notion/Figma \u7684\u516C\u5F00\u94FE\u63A5\u5171\u4EAB\u3002",
+        fields: {
+          id: {
+            label: "\u94FE\u63A5 ID"
+          },
+          token: {
+            label: "\u4EE4\u724C",
+            help: "URL \u5B89\u5168\u7684\u4E0D\u900F\u660E\u968F\u673A\u4EE4\u724C\uFF08\u2265 22 \u4E2A\u5B57\u7B26\uFF09\u3002\u672C\u8BB0\u5F55\u4E2D\u552F\u4E00\u7684\u673A\u5BC6\u4FE1\u606F\u3002"
+          },
+          object_name: {
+            label: "\u5BF9\u8C61",
+            help: "\u6240\u5171\u4EAB\u8BB0\u5F55\u7684\u5BF9\u8C61\u77ED\u540D\u79F0\uFF08\u4F8B\u5982 ai_conversation\u3001contracts_contract\uFF09"
+          },
+          record_id: {
+            label: "\u8BB0\u5F55",
+            help: "object_name \u5185\u6240\u5171\u4EAB\u8BB0\u5F55\u7684\u4E3B\u952E"
+          },
+          permission: {
+            label: "\u6743\u9650",
+            help: "\u94FE\u63A5\u6301\u6709\u8005\u53EF\u5BF9\u8BE5\u8BB0\u5F55\u6267\u884C\u7684\u64CD\u4F5C",
+            options: {
+              view: "\u67E5\u770B",
+              comment: "\u8BC4\u8BBA",
+              edit: "\u7F16\u8F91"
+            }
+          },
+          audience: {
+            label: "\u53D7\u4F17",
+            help: "\u5728\u4EE4\u724C\u6821\u9A8C\u4E4B\u4E0A\u989D\u5916\u65BD\u52A0\u7684\u8BBF\u95EE\u9650\u5236\u5C42",
+            options: {
+              public: "\u516C\u5F00\uFF08\u53EF\u88AB\u7D22\u5F15\uFF09",
+              link_only: "\u4EFB\u4F55\u6301\u6709\u94FE\u63A5\u7684\u4EBA",
+              signed_in: "\u5DF2\u767B\u5F55\u7528\u6237",
+              email: "\u6307\u5B9A\u90AE\u7BB1"
+            }
+          },
+          expires_at: {
+            label: "\u8FC7\u671F\u65F6\u95F4",
+            help: "\u8BBE\u7F6E\u540E\uFF0C\u8D85\u8FC7\u6B64\u65F6\u95F4\u70B9 resolveToken \u5C06\u8FD4\u56DE null"
+          },
+          email_allowlist: {
+            label: "\u90AE\u7BB1\u767D\u540D\u5355",
+            help: "\u5F53 audience=email \u65F6\u6821\u9A8C\u7684\u5C0F\u5199\u90AE\u7BB1\u5730\u5740"
+          },
+          password_hash: {
+            label: "\u5BC6\u7801\u54C8\u5E0C",
+            help: "Argon2/bcrypt \u54C8\u5E0C\u503C\u3002\u8BBE\u7F6E\u540E\uFF0C\u754C\u9762\u4F1A\u5728\u5448\u73B0\u5185\u5BB9\u524D\u63D0\u793A\u8F93\u5165\u5BC6\u7801\u3002"
+          },
+          redact_fields: {
+            label: "\u6309\u94FE\u63A5\u8131\u654F\u5B57\u6BB5",
+            help: "\u5728\u5BF9\u8C61\u9ED8\u8BA4\u8131\u654F\u96C6\u4E4B\u4E0A\uFF0C\u4ECE\u54CD\u5E94\u4E2D\u989D\u5916\u5254\u9664\u7684\u5B57\u6BB5"
+          },
+          label: {
+            label: "\u6807\u7B7E",
+            help: '\u5728\u5171\u4EAB\u5BF9\u8BDD\u6846\u4E2D\u663E\u793A\u7684\u81EA\u7531\u6587\u672C\uFF08\u4F8B\u5982 "ACME Q3 \u5408\u540C"\uFF09'
+          },
+          revoked_at: {
+            label: "\u64A4\u9500\u65F6\u95F4",
+            help: "\u8BBE\u7F6E\u540E\uFF0C\u8BE5\u94FE\u63A5\u5C06\u88AB\u6C38\u4E45\u505C\u7528"
+          },
+          created_by: {
+            label: "\u521B\u5EFA\u4EBA",
+            help: "\u94FE\u63A5\u7684\u7B7E\u53D1\u8005"
+          },
+          created_at: {
+            label: "\u521B\u5EFA\u65F6\u95F4"
+          },
+          last_used_at: {
+            label: "\u6700\u8FD1\u4F7F\u7528\u65F6\u95F4",
+            help: "\u7531 resolveToken \u6807\u8BB0\uFF1B\u4EEA\u8868\u76D8\u636E\u6B64\u9AD8\u4EAE\u663E\u793A\u6D3B\u8DC3\u94FE\u63A5"
+          },
+          use_count: {
+            label: "\u4F7F\u7528\u6B21\u6570",
+            help: "\u6BCF\u6B21\u6210\u529F\u89E3\u6790\u65F6\u7531 resolveToken \u9012\u589E"
+          }
+        },
+        _views: {
+          active_links: {
+            label: "\u6D3B\u8DC3"
+          },
+          by_me: {
+            label: "\u6211\u521B\u5EFA\u7684"
+          },
+          revoked: {
+            label: "\u5DF2\u64A4\u9500"
+          },
+          all_links: {
+            label: "\u5168\u90E8"
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/translations/ja-JP.objects.generated.ts
+var jaJPObjects;
+var init_ja_JP_objects_generated = __esm({
+  "src/translations/ja-JP.objects.generated.ts"() {
+    "use strict";
+    jaJPObjects = {
+      sys_record_share: {
+        label: "\u30EC\u30B3\u30FC\u30C9\u5171\u6709",
+        pluralLabel: "\u30EC\u30B3\u30FC\u30C9\u5171\u6709",
+        description: "\u30EC\u30B3\u30FC\u30C9\u3054\u3068\u306E\u5171\u6709\u4ED8\u4E0E \u2014 OWD \u306B\u660E\u793A\u7684\u306A\u30A2\u30AF\u30BB\u30B9\u3092\u8FFD\u52A0",
+        fields: {
+          id: {
+            label: "\u5171\u6709 ID"
+          },
+          object_name: {
+            label: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8",
+            help: "\u5171\u6709\u30EC\u30B3\u30FC\u30C9\u306E\u77ED\u3044\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u540D"
+          },
+          record_id: {
+            label: "\u30EC\u30B3\u30FC\u30C9",
+            help: "object_name \u5185\u306E\u5171\u6709\u30EC\u30B3\u30FC\u30C9\u306E\u4E3B\u30AD\u30FC"
+          },
+          recipient_type: {
+            label: "\u53D7\u4FE1\u8005\u30BF\u30A4\u30D7",
+            help: "\u4ED8\u4E0E\u3092\u4FDD\u6301\u3059\u308B\u30D7\u30EA\u30F3\u30B7\u30D1\u30EB\u306E\u7A2E\u5225",
+            options: {
+              user: "\u30E6\u30FC\u30B6\u30FC",
+              group: "\u30B0\u30EB\u30FC\u30D7",
+              role: "\u30ED\u30FC\u30EB",
+              role_and_subordinates: "\u30ED\u30FC\u30EB\u3068\u4E0B\u4F4D\u968E\u5C64",
+              guest: "\u30B2\u30B9\u30C8"
+            }
+          },
+          recipient_id: {
+            label: "\u53D7\u4FE1\u8005",
+            help: "\u30A2\u30AF\u30BB\u30B9\u3092\u53D7\u3051\u53D6\u308B\u30E6\u30FC\u30B6\u30FC/\u30B0\u30EB\u30FC\u30D7/\u30ED\u30FC\u30EB\u306E ID"
+          },
+          access_level: {
+            label: "\u30A2\u30AF\u30BB\u30B9\u30EC\u30D9\u30EB",
+            help: "\u53D7\u4FE1\u8005\u306B\u8A31\u53EF\u3055\u308C\u308B\u64CD\u4F5C \u2014 read | edit | full\uFF08\u8EE2\u9001/\u5171\u6709/\u524A\u9664\uFF09",
+            options: {
+              read: "\u95B2\u89A7",
+              edit: "\u7DE8\u96C6",
+              full: "\u30D5\u30EB\u30A2\u30AF\u30BB\u30B9"
+            }
+          },
+          source: {
+            label: "\u30BD\u30FC\u30B9",
+            help: "\u3053\u306E\u4ED8\u4E0E\u304C\u5B58\u5728\u3059\u308B\u7406\u7531 \u2014 \u30EB\u30FC\u30EB\u8A55\u4FA1\u8005\u304C\u8ABF\u6574\u306B\u4F7F\u7528",
+            options: {
+              manual: "\u624B\u52D5",
+              rule: "\u30EB\u30FC\u30EB",
+              team: "\u30C1\u30FC\u30E0",
+              inherited: "\u7D99\u627F"
+            }
+          },
+          source_id: {
+            label: "\u30BD\u30FC\u30B9 ID",
+            help: "source != manual \u306E\u5834\u5408\u306E\u30EB\u30FC\u30EB\u540D / \u30C1\u30FC\u30E0 ID"
+          },
+          granted_by: {
+            label: "\u4ED8\u4E0E\u8005",
+            help: "\u4ED8\u4E0E\u3092\u4F5C\u6210\u3057\u305F\u30E6\u30FC\u30B6\u30FC\uFF08\u624B\u52D5\u306E\u307F\uFF09"
+          },
+          reason: {
+            label: "\u7406\u7531",
+            help: "\u53D7\u4FE1\u8005\u306B\u8868\u793A\u3055\u308C\u308B\u30AA\u30D7\u30B7\u30E7\u30F3\u306E\u81EA\u7531\u8A18\u8FF0\u8AAC\u660E"
+          },
+          created_at: {
+            label: "\u4F5C\u6210\u65E5\u6642"
+          },
+          updated_at: {
+            label: "\u66F4\u65B0\u65E5\u6642"
+          }
+        },
+        _views: {
+          granted_to_me: {
+            label: "\u81EA\u5206\u3078\u306E\u4ED8\u4E0E"
+          },
+          granted_by_me: {
+            label: "\u81EA\u5206\u306B\u3088\u308B\u4ED8\u4E0E"
+          },
+          by_object: {
+            label: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u5225"
+          },
+          manual_grants: {
+            label: "\u624B\u52D5\u4ED8\u4E0E"
+          },
+          rule_grants: {
+            label: "\u30EB\u30FC\u30EB\u4ED8\u4E0E"
+          },
+          all_shares: {
+            label: "\u3059\u3079\u3066"
+          }
+        }
+      },
+      sys_sharing_rule: {
+        label: "\u5171\u6709\u30EB\u30FC\u30EB",
+        pluralLabel: "\u5171\u6709\u30EB\u30FC\u30EB",
+        description: "sys_record_share \u4ED8\u4E0E\u3092\u81EA\u52D5\u30DE\u30C6\u30EA\u30A2\u30E9\u30A4\u30BA\u3059\u308B\u5BA3\u8A00\u7684\u5171\u6709\u30EB\u30FC\u30EB\u3002\u30B3\u30FC\u30C9\u306E defineSharingRule() \u307E\u305F\u306F Studio \u306E\u6761\u4EF6\u30D3\u30EB\u30C0\u30FC\u3067\u4F5C\u6210\u3057\u307E\u3059\u3002",
+        fields: {
+          id: {
+            label: "\u30EB\u30FC\u30EB ID"
+          },
+          organization_id: {
+            label: "\u7D44\u7E54",
+            help: "\u3053\u306E\u30EB\u30FC\u30EB\u3092\u6240\u6709\u3059\u308B\u30C6\u30CA\u30F3\u30C8\u3002null = \u30B0\u30ED\u30FC\u30D0\u30EB"
+          },
+          name: {
+            label: "\u540D\u524D",
+            help: "\u4E00\u610F\u306E snake_case \u30EB\u30FC\u30EB\u540D"
+          },
+          label: {
+            label: "\u8868\u793A\u540D"
+          },
+          description: {
+            label: "\u8AAC\u660E"
+          },
+          object_name: {
+            label: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8",
+            help: "\u77ED\u3044\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u540D\uFF08\u4F8B: opportunity\u3001account\uFF09"
+          },
+          criteria_json: {
+            label: "\u6761\u4EF6\uFF08FilterCondition JSON\uFF09",
+            help: "object_name \u306E\u30EC\u30B3\u30FC\u30C9\u306B\u5BFE\u3057\u3066\u30DE\u30C3\u30C1\u3059\u308B JSON FilterCondition\u3002\u7A7A = \u3059\u3079\u3066\u306B\u30DE\u30C3\u30C1\u3002"
+          },
+          recipient_type: {
+            label: "\u53D7\u4FE1\u8005\u30BF\u30A4\u30D7",
+            help: "\u30A2\u30AF\u30BB\u30B9\u3092\u53D7\u3051\u53D6\u308B\u30D7\u30EA\u30F3\u30B7\u30D1\u30EB\u306E\u7A2E\u5225 \u2014 \u8A55\u4FA1\u6642\u306B\u30E6\u30FC\u30B6\u30FC\u4ED8\u4E0E\u306B\u5C55\u958B\u3055\u308C\u307E\u3059\u3002`department` \u306F parent_department_id \u30C4\u30EA\u30FC\u3092\u305F\u3069\u308A\u307E\u3059\u3002`team` \u306F\u30D5\u30E9\u30C3\u30C8\uFF08better-auth\uFF09\u3002",
+            options: {
+              user: "\u30E6\u30FC\u30B6\u30FC",
+              team: "\u30C1\u30FC\u30E0",
+              department: "\u90E8\u9580",
+              role: "\u30ED\u30FC\u30EB",
+              queue: "\u30AD\u30E5\u30FC"
+            }
+          },
+          recipient_id: {
+            label: "\u53D7\u4FE1\u8005",
+            help: "recipient_type \u306B\u5FDC\u3058\u305F\u90E8\u9580 ID / \u30C1\u30FC\u30E0 ID / \u30ED\u30FC\u30EB\u540D / \u30AD\u30E5\u30FC\u540D / \u30E6\u30FC\u30B6\u30FC ID"
+          },
+          access_level: {
+            label: "\u30A2\u30AF\u30BB\u30B9\u30EC\u30D9\u30EB",
+            options: {
+              read: "\u95B2\u89A7",
+              edit: "\u7DE8\u96C6",
+              full: "\u30D5\u30EB\u30A2\u30AF\u30BB\u30B9"
+            }
+          },
+          active: {
+            label: "\u6709\u52B9",
+            help: "\u6709\u52B9\u306A\u30EB\u30FC\u30EB\u306E\u307F\u304C\u30E9\u30A4\u30D5\u30B5\u30A4\u30AF\u30EB\u8A55\u4FA1\u306B\u53C2\u52A0\u3057\u307E\u3059"
+          },
+          created_at: {
+            label: "\u4F5C\u6210\u65E5\u6642"
+          },
+          updated_at: {
+            label: "\u66F4\u65B0\u65E5\u6642"
+          }
+        },
+        _views: {
+          active: {
+            label: "\u6709\u52B9"
+          },
+          inactive: {
+            label: "\u7121\u52B9"
+          },
+          by_object: {
+            label: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u5225"
+          },
+          all_rules: {
+            label: "\u3059\u3079\u3066"
+          }
+        }
+      },
+      sys_share_link: {
+        label: "\u5171\u6709\u30EA\u30F3\u30AF",
+        pluralLabel: "\u5171\u6709\u30EA\u30F3\u30AF",
+        description: "\u5358\u4E00\u30EC\u30B3\u30FC\u30C9\u3078\u306E\u30A2\u30AF\u30BB\u30B9\u3092\u8A31\u53EF\u3059\u308B\u4E0D\u900F\u660E\u306A\u30B1\u30FC\u30D1\u30D3\u30EA\u30C6\u30A3\u30C8\u30FC\u30AF\u30F3\u3002Notion / Figma \u30B9\u30BF\u30A4\u30EB\u306E\u516C\u958B\u30EA\u30F3\u30AF\u5171\u6709\u3002",
+        fields: {
+          id: {
+            label: "\u30EA\u30F3\u30AF ID"
+          },
+          token: {
+            label: "\u30C8\u30FC\u30AF\u30F3",
+            help: "URL \u30BB\u30FC\u30D5\u306A\u4E0D\u900F\u660E\u30E9\u30F3\u30C0\u30E0\u30C8\u30FC\u30AF\u30F3\uFF0822 \u6587\u5B57\u4EE5\u4E0A\uFF09\u3002\u3053\u306E\u884C\u3067\u552F\u4E00\u306E\u6A5F\u5BC6\u60C5\u5831\u3067\u3059\u3002"
+          },
+          object_name: {
+            label: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8",
+            help: "\u5171\u6709\u5BFE\u8C61\u30EC\u30B3\u30FC\u30C9\u306E\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u77ED\u7E2E\u540D\uFF08\u4F8B: ai_conversation\u3001contracts_contract\uFF09"
+          },
+          record_id: {
+            label: "\u30EC\u30B3\u30FC\u30C9",
+            help: "object_name \u5185\u306B\u304A\u3051\u308B\u5171\u6709\u5BFE\u8C61\u30EC\u30B3\u30FC\u30C9\u306E\u4E3B\u30AD\u30FC"
+          },
+          permission: {
+            label: "\u6A29\u9650",
+            help: "\u30EA\u30F3\u30AF\u4FDD\u6301\u8005\u304C\u30EC\u30B3\u30FC\u30C9\u306B\u5BFE\u3057\u3066\u5B9F\u884C\u3067\u304D\u308B\u64CD\u4F5C",
+            options: {
+              view: "\u95B2\u89A7",
+              comment: "\u30B3\u30E1\u30F3\u30C8",
+              edit: "\u7DE8\u96C6"
+            }
+          },
+          audience: {
+            label: "\u5BFE\u8C61\u8005",
+            help: "\u30C8\u30FC\u30AF\u30F3\u691C\u8A3C\u306E\u4E0A\u306B\u9069\u7528\u3055\u308C\u308B\u30A2\u30AF\u30BB\u30B9\u5236\u5FA1\u30EC\u30A4\u30E4\u30FC",
+            options: {
+              public: "\u516C\u958B\uFF08\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u53EF\u80FD\uFF09",
+              link_only: "\u30EA\u30F3\u30AF\u3092\u77E5\u3063\u3066\u3044\u308B\u5168\u54E1",
+              signed_in: "\u30B5\u30A4\u30F3\u30A4\u30F3\u6E08\u307F\u30E6\u30FC\u30B6\u30FC",
+              email: "\u7279\u5B9A\u306E\u30E1\u30FC\u30EB\u30A2\u30C9\u30EC\u30B9"
+            }
+          },
+          expires_at: {
+            label: "\u6709\u52B9\u671F\u9650",
+            help: "\u8A2D\u5B9A\u3059\u308B\u3068\u3001\u3053\u306E\u30BF\u30A4\u30E0\u30B9\u30BF\u30F3\u30D7\u4EE5\u964D\u306F resolveToken \u304C null \u3092\u8FD4\u3057\u307E\u3059"
+          },
+          email_allowlist: {
+            label: "\u30E1\u30FC\u30EB\u8A31\u53EF\u30EA\u30B9\u30C8",
+            help: "audience=email \u306E\u3068\u304D\u306B\u7167\u5408\u3055\u308C\u308B\u5C0F\u6587\u5B57\u306E\u30E1\u30FC\u30EB\u30A2\u30C9\u30EC\u30B9"
+          },
+          password_hash: {
+            label: "\u30D1\u30B9\u30EF\u30FC\u30C9\u30CF\u30C3\u30B7\u30E5",
+            help: "Argon2/bcrypt \u30CF\u30C3\u30B7\u30E5\u3002\u8A2D\u5B9A\u3059\u308B\u3068\u3001\u8868\u793A\u524D\u306B UI \u304C\u30D1\u30B9\u30EF\u30FC\u30C9\u306E\u5165\u529B\u3092\u6C42\u3081\u307E\u3059\u3002"
+          },
+          redact_fields: {
+            label: "\u30EA\u30F3\u30AF\u5358\u4F4D\u306E\u30DE\u30B9\u30AD\u30F3\u30B0",
+            help: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u65E2\u5B9A\u306E\u30DE\u30B9\u30AD\u30F3\u30B0\u96C6\u5408\u306B\u52A0\u3048\u3066\u3001\u30EC\u30B9\u30DD\u30F3\u30B9\u304B\u3089\u9664\u5916\u3059\u308B\u8FFD\u52A0\u30D5\u30A3\u30FC\u30EB\u30C9"
+          },
+          label: {
+            label: "\u30E9\u30D9\u30EB",
+            help: '\u5171\u6709\u30C0\u30A4\u30A2\u30ED\u30B0\u306B\u8868\u793A\u3055\u308C\u308B\u81EA\u7531\u8A18\u8FF0\u30C6\u30AD\u30B9\u30C8\uFF08\u4F8B: "ACME Q3 contract"\uFF09'
+          },
+          revoked_at: {
+            label: "\u5931\u52B9\u65E5\u6642",
+            help: "\u8A2D\u5B9A\u3059\u308B\u3068\u3001\u30EA\u30F3\u30AF\u306F\u6052\u4E45\u7684\u306B\u7121\u52B9\u5316\u3055\u308C\u307E\u3059"
+          },
+          created_by: {
+            label: "\u4F5C\u6210\u8005",
+            help: "\u30EA\u30F3\u30AF\u306E\u767A\u884C\u8005"
+          },
+          created_at: {
+            label: "\u4F5C\u6210\u65E5\u6642"
+          },
+          last_used_at: {
+            label: "\u6700\u7D42\u4F7F\u7528\u65E5\u6642",
+            help: "resolveToken \u306B\u3088\u3063\u3066\u8A18\u9332\u3055\u308C\u307E\u3059\u3002\u30C0\u30C3\u30B7\u30E5\u30DC\u30FC\u30C9\u3067\u30A2\u30AF\u30C6\u30A3\u30D6\u306A\u30EA\u30F3\u30AF\u3092\u5F37\u8ABF\u8868\u793A\u3059\u308B\u305F\u3081\u306B\u4F7F\u7528\u3055\u308C\u307E\u3059"
+          },
+          use_count: {
+            label: "\u4F7F\u7528\u56DE\u6570",
+            help: "\u89E3\u6C7A\u304C\u6210\u529F\u3059\u308B\u305F\u3073\u306B resolveToken \u306B\u3088\u3063\u3066\u52A0\u7B97\u3055\u308C\u307E\u3059"
+          }
+        },
+        _views: {
+          active_links: {
+            label: "\u30A2\u30AF\u30C6\u30A3\u30D6"
+          },
+          by_me: {
+            label: "\u81EA\u5206\u304C\u4F5C\u6210"
+          },
+          revoked: {
+            label: "\u5931\u52B9\u6E08\u307F"
+          },
+          all_links: {
+            label: "\u3059\u3079\u3066"
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/translations/es-ES.objects.generated.ts
+var esESObjects;
+var init_es_ES_objects_generated = __esm({
+  "src/translations/es-ES.objects.generated.ts"() {
+    "use strict";
+    esESObjects = {
+      sys_record_share: {
+        label: "Compartici\xF3n de registro",
+        pluralLabel: "Comparticiones de registro",
+        description: "Concesi\xF3n de compartici\xF3n por registro; ampl\xEDa OWD con acceso expl\xEDcito.",
+        fields: {
+          id: {
+            label: "ID de compartici\xF3n"
+          },
+          object_name: {
+            label: "Objeto",
+            help: "Nombre corto del objeto del registro compartido."
+          },
+          record_id: {
+            label: "Registro",
+            help: "Clave primaria del registro compartido dentro de object_name."
+          },
+          recipient_type: {
+            label: "Tipo de destinatario",
+            help: "Tipo de principal que posee la concesi\xF3n.",
+            options: {
+              user: "Usuario",
+              group: "Grupo",
+              role: "Rol",
+              role_and_subordinates: "Rol y subordinados",
+              guest: "Invitado"
+            }
+          },
+          recipient_id: {
+            label: "Destinatario",
+            help: "ID del usuario/grupo/rol que recibe acceso."
+          },
+          access_level: {
+            label: "Nivel de acceso",
+            help: "Lo que puede hacer el destinatario: read | edit | full (transfer/share/delete).",
+            options: {
+              read: "Leer",
+              edit: "Editar",
+              full: "Total"
+            }
+          },
+          source: {
+            label: "Origen",
+            help: "Motivo por el que existe esta concesi\xF3n; lo utiliza el evaluador de reglas para reconciliar.",
+            options: {
+              manual: "Manual",
+              rule: "Regla",
+              team: "Equipo",
+              inherited: "Heredado"
+            }
+          },
+          source_id: {
+            label: "ID de origen",
+            help: "Nombre de la regla / ID del equipo cuando source != manual."
+          },
+          granted_by: {
+            label: "Concedido por",
+            help: "Usuario que cre\xF3 la concesi\xF3n (solo manual)."
+          },
+          reason: {
+            label: "Motivo",
+            help: "Explicaci\xF3n opcional en texto libre que se muestra al destinatario."
+          },
+          created_at: {
+            label: "Creado el"
+          },
+          updated_at: {
+            label: "Actualizado el"
+          }
+        },
+        _views: {
+          granted_to_me: {
+            label: "Concedidos a m\xED"
+          },
+          granted_by_me: {
+            label: "Concedidos por m\xED"
+          },
+          by_object: {
+            label: "Por objeto"
+          },
+          manual_grants: {
+            label: "Concesiones manuales"
+          },
+          rule_grants: {
+            label: "Concesiones por regla"
+          },
+          all_shares: {
+            label: "Todas"
+          }
+        }
+      },
+      sys_sharing_rule: {
+        label: "Regla de compartici\xF3n",
+        pluralLabel: "Reglas de compartici\xF3n",
+        description: "Regla de compartici\xF3n declarativa que materializa autom\xE1ticamente concesiones de sys_record_share. Se define mediante defineSharingRule() en c\xF3digo o con el generador de criterios de Studio.",
+        fields: {
+          id: {
+            label: "ID de regla"
+          },
+          organization_id: {
+            label: "Organizaci\xF3n",
+            help: "Tenant que posee esta regla; null = global."
+          },
+          name: {
+            label: "Nombre",
+            help: "Nombre de regla snake_case \xFAnico."
+          },
+          label: {
+            label: "Nombre visible"
+          },
+          description: {
+            label: "Descripci\xF3n"
+          },
+          object_name: {
+            label: "Objeto",
+            help: "Nombre corto del objeto (p. ej. opportunity, account)."
+          },
+          criteria_json: {
+            label: "Criterios (JSON de FilterCondition)",
+            help: "FilterCondition JSON comparado con los registros de object_name. Vac\xEDo = coincide con todos."
+          },
+          recipient_type: {
+            label: "Tipo de destinatario",
+            help: "Tipo de principal que recibe acceso; se expande a concesiones de usuario durante la evaluaci\xF3n. `department` recorre el \xE1rbol parent_department_id; `team` es plano (better-auth).",
+            options: {
+              user: "Usuario",
+              team: "Equipo",
+              department: "Departamento",
+              role: "Rol",
+              queue: "Cola"
+            }
+          },
+          recipient_id: {
+            label: "Destinatario",
+            help: "ID de departamento / ID de equipo / nombre del rol / nombre de la cola / ID del usuario seg\xFAn recipient_type."
+          },
+          access_level: {
+            label: "Nivel de acceso",
+            options: {
+              read: "Leer",
+              edit: "Editar",
+              full: "Total"
+            }
+          },
+          active: {
+            label: "Activo",
+            help: "Solo las reglas activas participan en la evaluaci\xF3n del ciclo de vida."
+          },
+          created_at: {
+            label: "Creado el"
+          },
+          updated_at: {
+            label: "Actualizado el"
+          }
+        },
+        _views: {
+          active: {
+            label: "Activo"
+          },
+          inactive: {
+            label: "Inactivo"
+          },
+          by_object: {
+            label: "Por objeto"
+          },
+          all_rules: {
+            label: "Todas"
+          }
+        }
+      },
+      sys_share_link: {
+        label: "Enlace de uso compartido",
+        pluralLabel: "Enlaces de uso compartido",
+        description: "Token de capacidad opaco que concede acceso a un \xFAnico registro. Uso compartido mediante enlace p\xFAblico al estilo de Notion/Figma.",
+        fields: {
+          id: {
+            label: "ID del enlace"
+          },
+          token: {
+            label: "Token",
+            help: "Token aleatorio opaco seguro para URL (\u2265 22 caracteres). El \xFAnico secreto de esta fila."
+          },
+          object_name: {
+            label: "Objeto",
+            help: "Nombre corto del objeto del registro compartido (p. ej. ai_conversation, contracts_contract)"
+          },
+          record_id: {
+            label: "Registro",
+            help: "Clave principal del registro compartido dentro de object_name"
+          },
+          permission: {
+            label: "Permiso",
+            help: "Lo que el titular del enlace puede hacer con el registro",
+            options: {
+              view: "Ver",
+              comment: "Comentar",
+              edit: "Editar"
+            }
+          },
+          audience: {
+            label: "Audiencia",
+            help: "Capa de control aplicada por encima de la verificaci\xF3n del token",
+            options: {
+              public: "P\xFAblico (indexable)",
+              link_only: "Cualquier persona con el enlace",
+              signed_in: "Usuarios con sesi\xF3n iniciada",
+              email: "Correos espec\xEDficos"
+            }
+          },
+          expires_at: {
+            label: "Caduca el",
+            help: "Cuando se establece, resolveToken devuelve null despu\xE9s de esta marca de tiempo"
+          },
+          email_allowlist: {
+            label: "Lista de correos permitidos",
+            help: "Direcciones en min\xFAsculas que se comprueban cuando audience=email"
+          },
+          password_hash: {
+            label: "Hash de contrase\xF1a",
+            help: "Hash Argon2/bcrypt. Cuando se establece, la interfaz solicita una contrase\xF1a antes de mostrar el contenido."
+          },
+          redact_fields: {
+            label: "Campos ocultos por enlace",
+            help: "Campos adicionales que se eliminan de la respuesta, adem\xE1s del conjunto predeterminado del objeto"
+          },
+          label: {
+            label: "Etiqueta",
+            help: 'Texto libre que se muestra en el cuadro de di\xE1logo de uso compartido (p. ej. "ACME Q3 contract")'
+          },
+          revoked_at: {
+            label: "Revocado el",
+            help: "Cuando se establece, el enlace queda deshabilitado permanentemente"
+          },
+          created_by: {
+            label: "Creado por",
+            help: "Emisor del enlace"
+          },
+          created_at: {
+            label: "Creado el"
+          },
+          last_used_at: {
+            label: "\xDAltimo uso el",
+            help: "Lo registra resolveToken; el panel lo usa para resaltar los enlaces activos"
+          },
+          use_count: {
+            label: "N\xFAmero de usos",
+            help: "Lo incrementa resolveToken en cada resoluci\xF3n correcta"
+          }
+        },
+        _views: {
+          active_links: {
+            label: "Activos"
+          },
+          by_me: {
+            label: "Creados por m\xED"
+          },
+          revoked: {
+            label: "Revocados"
+          },
+          all_links: {
+            label: "Todos"
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/translations/index.ts
+var translations_exports = {};
+__export(translations_exports, {
+  SharingTranslations: () => SharingTranslations
+});
+var SharingTranslations;
+var init_translations = __esm({
+  "src/translations/index.ts"() {
+    "use strict";
+    init_en_objects_generated();
+    init_zh_CN_objects_generated();
+    init_ja_JP_objects_generated();
+    init_es_ES_objects_generated();
+    SharingTranslations = {
+      en: { objects: enObjects },
+      "zh-CN": { objects: zhCNObjects },
+      "ja-JP": { objects: jaJPObjects },
+      "es-ES": { objects: esESObjects }
+    };
+  }
+});
+
+// src/objects/sys-record-share.object.ts
+import { ObjectSchema, Field } from "@objectstack/spec/data";
+var SysRecordShare = ObjectSchema.create({
+  name: "sys_record_share",
+  label: "Record Share",
+  pluralLabel: "Record Shares",
+  icon: "share",
+  isSystem: true,
+  managedBy: "system",
+  description: "Per-record sharing grant \u2014 extends OWD with explicit access",
+  titleFormat: "{object_name}/{record_id} \u2192 {recipient_id} ({access_level})",
+  compactLayout: ["object_name", "record_id", "recipient_id", "access_level", "source"],
+  listViews: {
+    granted_to_me: {
+      type: "grid",
+      name: "granted_to_me",
+      label: "Granted to Me",
+      data: { provider: "object", object: "sys_record_share" },
+      columns: ["object_name", "record_id", "access_level", "source", "granted_by", "created_at"],
+      filter: [
+        { field: "recipient_type", operator: "equals", value: "user" },
+        { field: "recipient_id", operator: "equals", value: "{current_user_id}" }
+      ],
+      sort: [{ field: "created_at", order: "desc" }],
+      pagination: { pageSize: 50 }
+    },
+    granted_by_me: {
+      type: "grid",
+      name: "granted_by_me",
+      label: "Granted by Me",
+      data: { provider: "object", object: "sys_record_share" },
+      columns: ["object_name", "record_id", "recipient_id", "access_level", "source", "created_at"],
+      filter: [
+        { field: "granted_by", operator: "equals", value: "{current_user_id}" }
+      ],
+      sort: [{ field: "created_at", order: "desc" }],
+      pagination: { pageSize: 50 }
+    },
+    by_object: {
+      type: "grid",
+      name: "by_object",
+      label: "By Object",
+      data: { provider: "object", object: "sys_record_share" },
+      columns: ["object_name", "record_id", "recipient_id", "access_level", "source", "created_at"],
+      sort: [{ field: "object_name", order: "asc" }, { field: "created_at", order: "desc" }],
+      grouping: { fields: [{ field: "object_name", order: "asc", collapsed: false }] },
+      pagination: { pageSize: 100 }
+    },
+    manual_grants: {
+      type: "grid",
+      name: "manual_grants",
+      label: "Manual Grants",
+      data: { provider: "object", object: "sys_record_share" },
+      columns: ["object_name", "record_id", "recipient_id", "access_level", "granted_by", "reason", "created_at"],
+      filter: [{ field: "source", operator: "equals", value: "manual" }],
+      sort: [{ field: "created_at", order: "desc" }],
+      pagination: { pageSize: 50 }
+    },
+    rule_grants: {
+      type: "grid",
+      name: "rule_grants",
+      label: "Rule Grants",
+      data: { provider: "object", object: "sys_record_share" },
+      columns: ["object_name", "record_id", "recipient_id", "access_level", "source_id", "created_at"],
+      filter: [{ field: "source", operator: "in", value: ["rule", "team", "inherited"] }],
+      sort: [{ field: "source_id", order: "asc" }, { field: "created_at", order: "desc" }],
+      pagination: { pageSize: 50 }
+    },
+    all_shares: {
+      type: "grid",
+      name: "all_shares",
+      label: "All",
+      data: { provider: "object", object: "sys_record_share" },
+      columns: ["object_name", "record_id", "recipient_type", "recipient_id", "access_level", "source", "created_at"],
+      sort: [{ field: "created_at", order: "desc" }],
+      pagination: { pageSize: 100 }
+    }
+  },
+  fields: {
+    id: Field.text({
+      label: "Share ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    // ── Target (which record is being shared) ────────────────────
+    object_name: Field.text({
+      label: "Object",
+      required: true,
+      maxLength: 100,
+      description: "Short object name of the shared record",
+      group: "Target"
+    }),
+    record_id: Field.text({
+      label: "Record",
+      required: true,
+      maxLength: 100,
+      description: "Primary key of the shared record within object_name",
+      group: "Target"
+    }),
+    // ── Recipient (who receives access) ──────────────────────────
+    recipient_type: Field.select(
+      ["user", "group", "role", "role_and_subordinates", "guest"],
+      {
+        label: "Recipient Type",
+        required: true,
+        defaultValue: "user",
+        description: "Kind of principal that holds the grant",
+        group: "Recipient"
+      }
+    ),
+    recipient_id: Field.text({
+      label: "Recipient",
+      required: true,
+      maxLength: 100,
+      description: "ID of the user/group/role that receives access",
+      group: "Recipient"
+    }),
+    access_level: Field.select(
+      ["read", "edit", "full"],
+      {
+        label: "Access Level",
+        required: true,
+        defaultValue: "read",
+        description: "What the recipient can do \u2014 read | edit | full (transfer/share/delete)",
+        group: "Recipient"
+      }
+    ),
+    // ── Provenance ───────────────────────────────────────────────
+    source: Field.select(
+      ["manual", "rule", "team", "inherited"],
+      {
+        label: "Source",
+        required: true,
+        defaultValue: "manual",
+        description: "Why this grant exists \u2014 used by the rule evaluator to reconcile",
+        group: "Provenance"
+      }
+    ),
+    source_id: Field.text({
+      label: "Source ID",
+      required: false,
+      maxLength: 200,
+      description: "Rule name / team id when source != manual",
+      group: "Provenance"
+    }),
+    granted_by: Field.lookup("sys_user", {
+      label: "Granted By",
+      required: false,
+      description: "User that created the grant (manual only)",
+      group: "Provenance"
+    }),
+    reason: Field.text({
+      label: "Reason",
+      required: false,
+      maxLength: 500,
+      description: "Optional free-text explanation surfaced to the recipient",
+      group: "Provenance"
+    }),
+    // ── Lifecycle ────────────────────────────────────────────────
+    created_at: Field.datetime({
+      label: "Created At",
+      required: true,
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      required: false,
+      group: "System"
+    })
+  },
+  indexes: [
+    // Hot path: "all records visible to user U on object O" — the
+    // middleware reads (object_name, recipient_type, recipient_id) to
+    // build the `id IN (...)` predicate on every find.
+    { fields: ["object_name", "recipient_type", "recipient_id"] },
+    // "all grants on this record" — used by the share-management UI
+    // and by canEdit() to look up explicit grants.
+    { fields: ["object_name", "record_id"] },
+    // Reconciliation key for rule-driven shares.
+    { fields: ["source", "source_id"] }
+  ]
+});
+
+// src/objects/sys-sharing-rule.object.ts
+import { ObjectSchema as ObjectSchema2, Field as Field2 } from "@objectstack/spec/data";
+var SysSharingRule = ObjectSchema2.create({
+  name: "sys_sharing_rule",
+  label: "Sharing Rule",
+  pluralLabel: "Sharing Rules",
+  icon: "shield-check",
+  isSystem: true,
+  managedBy: "config",
+  // Sharing rules can now be authored visually via the Studio criteria
+  // builder (apps/studio/src/components/SharingCriteriaBuilder.tsx).
+  // We still recommend `defineSharingRule({...})` for repo-controlled
+  // baselines, but admins can safely create/edit/delete from the UI.
+  userActions: { create: true, edit: true, delete: true, import: false },
+  description: "Declarative sharing rule that auto-materialises sys_record_share grants. Authored via defineSharingRule() in code or the Studio criteria builder.",
+  displayNameField: "name",
+  titleFormat: "{label}",
+  compactLayout: ["name", "object_name", "recipient_type", "recipient_id", "access_level", "active"],
+  listViews: {
+    active: {
+      type: "grid",
+      name: "active",
+      label: "Active",
+      data: { provider: "object", object: "sys_sharing_rule" },
+      columns: ["label", "object_name", "recipient_type", "recipient_id", "access_level", "updated_at"],
+      filter: [{ field: "active", operator: "equals", value: true }],
+      sort: [{ field: "object_name", order: "asc" }, { field: "label", order: "asc" }],
+      pagination: { pageSize: 50 }
+    },
+    inactive: {
+      type: "grid",
+      name: "inactive",
+      label: "Inactive",
+      data: { provider: "object", object: "sys_sharing_rule" },
+      columns: ["label", "object_name", "recipient_type", "recipient_id", "updated_at"],
+      filter: [{ field: "active", operator: "equals", value: false }],
+      sort: [{ field: "label", order: "asc" }],
+      pagination: { pageSize: 50 }
+    },
+    by_object: {
+      type: "grid",
+      name: "by_object",
+      label: "By Object",
+      data: { provider: "object", object: "sys_sharing_rule" },
+      columns: ["object_name", "label", "recipient_type", "access_level", "active"],
+      sort: [{ field: "object_name", order: "asc" }, { field: "label", order: "asc" }],
+      grouping: { fields: [{ field: "object_name", order: "asc", collapsed: false }] },
+      pagination: { pageSize: 100 }
+    },
+    all_rules: {
+      type: "grid",
+      name: "all_rules",
+      label: "All",
+      data: { provider: "object", object: "sys_sharing_rule" },
+      columns: ["label", "object_name", "recipient_type", "recipient_id", "access_level", "active", "updated_at"],
+      sort: [{ field: "label", order: "asc" }],
+      pagination: { pageSize: 50 }
+    }
+  },
+  fields: {
+    id: Field2.text({ label: "Rule ID", required: true, readonly: true, group: "System" }),
+    organization_id: Field2.lookup("sys_organization", {
+      label: "Organization",
+      required: false,
+      group: "System",
+      description: "Tenant that owns this rule; null = global"
+    }),
+    name: Field2.text({
+      label: "Name",
+      required: true,
+      maxLength: 100,
+      description: "Unique snake_case rule name",
+      group: "Identity"
+    }),
+    label: Field2.text({
+      label: "Display Label",
+      required: true,
+      maxLength: 200,
+      group: "Identity"
+    }),
+    description: Field2.textarea({
+      label: "Description",
+      required: false,
+      group: "Identity"
+    }),
+    object_name: Field2.text({
+      label: "Object",
+      required: true,
+      maxLength: 100,
+      description: "Short object name (e.g. opportunity, account)",
+      group: "Target"
+    }),
+    criteria_json: Field2.textarea({
+      label: "Criteria (FilterCondition JSON)",
+      required: false,
+      description: "JSON FilterCondition matched against records of object_name. Empty = match all.",
+      group: "Target"
+    }),
+    recipient_type: Field2.select(
+      ["user", "team", "department", "role", "queue"],
+      {
+        label: "Recipient Type",
+        required: true,
+        defaultValue: "department",
+        description: "Kind of principal that receives access \u2014 expanded to user grants at evaluation time. `department` walks the parent_department_id tree; `team` is flat (better-auth).",
+        group: "Recipient"
+      }
+    ),
+    recipient_id: Field2.text({
+      label: "Recipient",
+      required: true,
+      maxLength: 200,
+      description: "department id / team id / role name / queue name / user id depending on recipient_type",
+      group: "Recipient"
+    }),
+    access_level: Field2.select(
+      ["read", "edit", "full"],
+      {
+        label: "Access Level",
+        required: true,
+        defaultValue: "read",
+        group: "Recipient"
+      }
+    ),
+    active: Field2.boolean({
+      label: "Active",
+      required: false,
+      defaultValue: true,
+      description: "Only active rules participate in lifecycle evaluation",
+      group: "Lifecycle"
+    }),
+    created_at: Field2.datetime({
+      label: "Created At",
+      required: true,
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: Field2.datetime({
+      label: "Updated At",
+      required: false,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["object_name", "active"] },
+    { fields: ["name"], unique: true },
+    { fields: ["organization_id"] }
+  ]
+});
+
+// src/objects/sys-share-link.object.ts
+import { ObjectSchema as ObjectSchema3, Field as Field3 } from "@objectstack/spec/data";
+var SysShareLink = ObjectSchema3.create({
+  name: "sys_share_link",
+  label: "Share Link",
+  pluralLabel: "Share Links",
+  icon: "link-2",
+  isSystem: true,
+  managedBy: "system",
+  description: "Opaque capability token granting access to a single record. Notion/Figma-style public link sharing.",
+  titleFormat: "{object_name}/{record_id} ({permission})",
+  compactLayout: ["object_name", "record_id", "permission", "audience", "expires_at", "revoked_at"],
+  listViews: {
+    active_links: {
+      type: "grid",
+      name: "active_links",
+      label: "Active",
+      data: { provider: "object", object: "sys_share_link" },
+      columns: ["object_name", "record_id", "permission", "audience", "expires_at", "use_count", "last_used_at"],
+      filter: [{ field: "revoked_at", operator: "isNull" }],
+      sort: [{ field: "created_at", order: "desc" }],
+      pagination: { pageSize: 100 }
+    },
+    by_me: {
+      type: "grid",
+      name: "by_me",
+      label: "Created by Me",
+      data: { provider: "object", object: "sys_share_link" },
+      columns: ["object_name", "record_id", "permission", "audience", "expires_at", "revoked_at"],
+      filter: [{ field: "created_by", operator: "equals", value: "{current_user_id}" }],
+      sort: [{ field: "created_at", order: "desc" }],
+      pagination: { pageSize: 100 }
+    },
+    revoked: {
+      type: "grid",
+      name: "revoked",
+      label: "Revoked",
+      data: { provider: "object", object: "sys_share_link" },
+      columns: ["object_name", "record_id", "revoked_at", "created_by"],
+      filter: [{ field: "revoked_at", operator: "isNotNull" }],
+      sort: [{ field: "revoked_at", order: "desc" }],
+      pagination: { pageSize: 50 }
+    },
+    all_links: {
+      type: "grid",
+      name: "all_links",
+      label: "All",
+      data: { provider: "object", object: "sys_share_link" },
+      columns: ["object_name", "record_id", "permission", "audience", "expires_at", "revoked_at", "created_at"],
+      sort: [{ field: "created_at", order: "desc" }],
+      pagination: { pageSize: 200 }
+    }
+  },
+  fields: {
+    id: Field3.text({
+      label: "Link ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    // ── Token (the secret) ───────────────────────────────────────
+    token: Field3.text({
+      label: "Token",
+      required: true,
+      maxLength: 64,
+      description: "Opaque URL-safe random token (\u2265 22 chars). The only secret in this row.",
+      group: "Token"
+    }),
+    // ── Target ───────────────────────────────────────────────────
+    object_name: Field3.text({
+      label: "Object",
+      required: true,
+      maxLength: 100,
+      description: "Short object name of the shared record (e.g. ai_conversation, contracts_contract)",
+      group: "Target"
+    }),
+    record_id: Field3.text({
+      label: "Record",
+      required: true,
+      maxLength: 100,
+      description: "Primary key of the shared record within object_name",
+      group: "Target"
+    }),
+    // ── Access Policy ────────────────────────────────────────────
+    permission: Field3.select(
+      [
+        { label: "View", value: "view" },
+        { label: "Comment", value: "comment" },
+        { label: "Edit", value: "edit" }
+      ],
+      {
+        label: "Permission",
+        required: true,
+        defaultValue: "view",
+        description: "What the link holder can do with the record",
+        group: "Access Policy"
+      }
+    ),
+    audience: Field3.select(
+      [
+        { label: "Public (indexable)", value: "public" },
+        { label: "Anyone with the link", value: "link_only" },
+        { label: "Signed-in users", value: "signed_in" },
+        { label: "Specific emails", value: "email" }
+      ],
+      {
+        label: "Audience",
+        required: true,
+        defaultValue: "link_only",
+        description: "Gating layer applied on top of the token check",
+        group: "Access Policy"
+      }
+    ),
+    expires_at: Field3.datetime({
+      label: "Expires At",
+      description: "When set, resolveToken returns null after this timestamp",
+      group: "Access Policy"
+    }),
+    email_allowlist: Field3.json({
+      label: "Email Allowlist",
+      description: "Lowercased addresses checked when audience=email",
+      group: "Access Policy"
+    }),
+    password_hash: Field3.text({
+      label: "Password Hash",
+      maxLength: 256,
+      description: "Argon2/bcrypt hash. When set, the UI prompts for a password before rendering.",
+      group: "Access Policy"
+    }),
+    redact_fields: Field3.json({
+      label: "Per-Link Redactions",
+      description: "Extra fields stripped from the response, on top of the object-default set",
+      group: "Access Policy"
+    }),
+    label: Field3.text({
+      label: "Label",
+      maxLength: 200,
+      description: 'Free-text shown in the share dialog (e.g. "ACME Q3 contract")',
+      group: "Metadata"
+    }),
+    // ── Lifecycle ────────────────────────────────────────────────
+    revoked_at: Field3.datetime({
+      label: "Revoked At",
+      readonly: true,
+      description: "When set, the link is permanently disabled",
+      group: "Lifecycle"
+    }),
+    created_by: Field3.lookup("sys_user", {
+      label: "Created By",
+      readonly: true,
+      description: "Issuer of the link",
+      group: "Lifecycle"
+    }),
+    created_at: Field3.datetime({
+      label: "Created At",
+      required: true,
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "Lifecycle"
+    }),
+    last_used_at: Field3.datetime({
+      label: "Last Used At",
+      readonly: true,
+      description: "Stamped by resolveToken; used by the dashboard to highlight active links",
+      group: "Lifecycle"
+    }),
+    use_count: Field3.number({
+      label: "Use Count",
+      defaultValue: 0,
+      readonly: true,
+      description: "Incremented by resolveToken on every successful resolution",
+      group: "Lifecycle"
+    })
+  },
+  indexes: [
+    // Hot path: resolveToken — one row lookup per public request.
+    { fields: ["token"], unique: true },
+    // Management UI: "all links for this record".
+    { fields: ["object_name", "record_id"] },
+    // "Active links I issued".
+    { fields: ["created_by", "revoked_at"] },
+    // Reaper for expired rows (background sweep).
+    { fields: ["expires_at"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    // The /api/v1/share-links endpoints are the authoritative surface;
+    // the generic data API is exposed read-only for the admin grid.
+    apiMethods: ["get", "list"],
+    trash: false,
+    mru: false,
+    clone: false
+  }
+});
+
 // src/index.ts
-import { SysRecordShare as SysRecordShare2, SysSharingRule as SysSharingRule2, SysShareLink as SysShareLink2 } from "@objectstack/platform-objects/security";
 import { SysDepartment as SysDepartment2, SysDepartmentMember as SysDepartmentMember2 } from "@objectstack/platform-objects/identity";
 
 // src/sharing-service.ts
@@ -1217,7 +2874,6 @@ function unbindAllRuleHooks(engine) {
 }
 
 // src/sharing-plugin.ts
-import { SysRecordShare, SysSharingRule, SysShareLink } from "@objectstack/platform-objects/security";
 import { SysDepartment, SysDepartmentMember } from "@objectstack/platform-objects/identity";
 var SharingServicePlugin = class {
   constructor(options = {}) {
@@ -1236,8 +2892,36 @@ var SharingServicePlugin = class {
       scope: "system",
       defaultDatasource: "cloud",
       namespace: "sys",
-      objects: [SysRecordShare, SysSharingRule, SysDepartment, SysDepartmentMember, SysShareLink]
+      objects: [SysRecordShare, SysSharingRule, SysDepartment, SysDepartmentMember, SysShareLink],
+      // ADR-0029 D7 — contribute the sharing entries into the Setup app's
+      // `group_access_control` slot (priority 200 so they sit after plugin-
+      // security's Roles / Permission Sets). This plugin owns these objects (K2).
+      navigationContributions: [
+        {
+          app: "setup",
+          group: "group_access_control",
+          priority: 200,
+          items: [
+            { id: "nav_sharing_rules", type: "object", label: "Sharing Rules", objectName: "sys_sharing_rule", icon: "share-2", requiresObject: "sys_sharing_rule", requiredPermissions: ["manage_platform_settings"] },
+            { id: "nav_record_shares", type: "object", label: "Record Shares", objectName: "sys_record_share", icon: "link", requiresObject: "sys_record_share", requiredPermissions: ["manage_platform_settings"] }
+          ]
+        }
+      ]
     });
+    if (typeof ctx.hook === "function") {
+      ctx.hook("kernel:ready", async () => {
+        try {
+          const i18n = ctx.getService("i18n");
+          if (i18n && typeof i18n.loadTranslations === "function") {
+            const { SharingTranslations: SharingTranslations2 } = await Promise.resolve().then(() => (init_translations(), translations_exports));
+            for (const [locale, data] of Object.entries(SharingTranslations2)) {
+              i18n.loadTranslations(locale, data);
+            }
+          }
+        } catch {
+        }
+      });
+    }
     ctx.logger.info("SharingServicePlugin: schema registered");
   }
   async start(ctx) {
@@ -1388,9 +3072,9 @@ export {
   SharingServicePlugin,
   SysDepartment2 as SysDepartment,
   SysDepartmentMember2 as SysDepartmentMember,
-  SysRecordShare2 as SysRecordShare,
-  SysShareLink2 as SysShareLink,
-  SysSharingRule2 as SysSharingRule,
+  SysRecordShare,
+  SysShareLink,
+  SysSharingRule,
   TeamGraphService,
   bindRuleHooks,
   buildSharingMiddleware,