@objectstack/spec 0.3.2 → 0.4.1

package/dist/{system → hub}/tenant.zod.d.ts

@@ -46,7 +46,35 @@ export declare const TenantQuotaSchema: z.ZodObject<{
 export type TenantQuota = z.infer<typeof TenantQuotaSchema>;
 /**
  * Tenant Schema
- * Represents a tenant in a multi-tenant SaaS deployment
+ *
+ * @deprecated This schema is maintained for backward compatibility only.
+ * New implementations should use HubSpaceSchema which embeds tenant concepts.
+ *
+ * **Migration Guide:**
+ * ```typescript
+ * // Old approach (deprecated):
+ * const tenant: Tenant = {
+ *   id: 'tenant_123',
+ *   name: 'My Tenant',
+ *   isolationLevel: 'shared_schema',
+ *   quotas: { maxUsers: 100 }
+ * };
+ *
+ * // New approach (recommended):
+ * const space: HubSpace = {
+ *   id: '...uuid...',
+ *   name: 'My Tenant',
+ *   slug: 'my-tenant',
+ *   ownerId: 'user_id',
+ *   runtime: {
+ *     isolation: 'shared_schema',
+ *     quotas: { maxUsers: 100 }
+ *   },
+ *   bom: { ... }
+ * };
+ * ```
+ *
+ * See HubSpaceSchema in space.zod.ts for the recommended approach.
  */
 export declare const TenantSchema: z.ZodObject<{
     /**
@@ -54,21 +82,19 @@ export declare const TenantSchema: z.ZodObject<{
      */
     id: z.ZodString;
     /**
-     * Tenant name (display name)
+     * Tenant display name
      */
     name: z.ZodString;
     /**
-     * Data isolation level for this tenant
-     * Determines how tenant data is segregated from other tenants
+     * Data isolation level
      */
     isolationLevel: z.ZodEnum<["shared_schema", "isolated_schema", "isolated_db"]>;
     /**
-     * Custom configurations and metadata specific to this tenant
-     * Can store tenant-specific settings, branding, features, etc.
+     * Custom configuration values
      */
     customizations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     /**
-     * Resource quotas and limits for this tenant
+     * Resource quotas
      */
     quotas: z.ZodOptional<z.ZodObject<{
         /**
@@ -540,12 +566,12 @@ export declare const DatabaseLevelIsolationStrategySchema: z.ZodObject<{
         retentionDays: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
         strategy: "on_demand" | "individual" | "consolidated";
-        frequencyHours: number;
         retentionDays: number;
+        frequencyHours: number;
     }, {
         strategy?: "on_demand" | "individual" | "consolidated" | undefined;
-        frequencyHours?: number | undefined;
         retentionDays?: number | undefined;
+        frequencyHours?: number | undefined;
     }>>;
     /**
      * Encryption configuration
@@ -574,17 +600,17 @@ export declare const DatabaseLevelIsolationStrategySchema: z.ZodObject<{
     }>>;
 }, "strip", z.ZodTypeAny, {
     strategy: "isolated_db";
-    encryption?: {
-        perTenantKeys: boolean;
-        algorithm: string;
-        keyManagement?: "custom" | "aws_kms" | "azure_key_vault" | "gcp_kms" | "hashicorp_vault" | undefined;
-    } | undefined;
     database?: {
         namingPattern: string;
         serverStrategy: "shared" | "sharded" | "dedicated";
         separateCredentials: boolean;
         autoCreateDatabase: boolean;
     } | undefined;
+    encryption?: {
+        perTenantKeys: boolean;
+        algorithm: string;
+        keyManagement?: "custom" | "aws_kms" | "azure_key_vault" | "gcp_kms" | "hashicorp_vault" | undefined;
+    } | undefined;
     connectionPool?: {
         idleTimeout: number;
         poolSize: number;
@@ -593,22 +619,22 @@ export declare const DatabaseLevelIsolationStrategySchema: z.ZodObject<{
     } | undefined;
     backup?: {
         strategy: "on_demand" | "individual" | "consolidated";
-        frequencyHours: number;
         retentionDays: number;
+        frequencyHours: number;
     } | undefined;
 }, {
     strategy: "isolated_db";
-    encryption?: {
-        perTenantKeys?: boolean | undefined;
-        algorithm?: string | undefined;
-        keyManagement?: "custom" | "aws_kms" | "azure_key_vault" | "gcp_kms" | "hashicorp_vault" | undefined;
-    } | undefined;
     database?: {
         namingPattern?: string | undefined;
         serverStrategy?: "shared" | "sharded" | "dedicated" | undefined;
         separateCredentials?: boolean | undefined;
         autoCreateDatabase?: boolean | undefined;
     } | undefined;
+    encryption?: {
+        perTenantKeys?: boolean | undefined;
+        algorithm?: string | undefined;
+        keyManagement?: "custom" | "aws_kms" | "azure_key_vault" | "gcp_kms" | "hashicorp_vault" | undefined;
+    } | undefined;
     connectionPool?: {
         idleTimeout?: number | undefined;
         poolSize?: number | undefined;
@@ -617,8 +643,8 @@ export declare const DatabaseLevelIsolationStrategySchema: z.ZodObject<{
     } | undefined;
     backup?: {
         strategy?: "on_demand" | "individual" | "consolidated" | undefined;
-        frequencyHours?: number | undefined;
         retentionDays?: number | undefined;
+        frequencyHours?: number | undefined;
     } | undefined;
 }>;
 export type DatabaseLevelIsolationStrategy = z.infer<typeof DatabaseLevelIsolationStrategySchema>;
@@ -909,12 +935,12 @@ export declare const TenantIsolationConfigSchema: z.ZodDiscriminatedUnion<"strat
         retentionDays: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
         strategy: "on_demand" | "individual" | "consolidated";
-        frequencyHours: number;
         retentionDays: number;
+        frequencyHours: number;
     }, {
         strategy?: "on_demand" | "individual" | "consolidated" | undefined;
-        frequencyHours?: number | undefined;
         retentionDays?: number | undefined;
+        frequencyHours?: number | undefined;
     }>>;
     /**
      * Encryption configuration
@@ -943,17 +969,17 @@ export declare const TenantIsolationConfigSchema: z.ZodDiscriminatedUnion<"strat
     }>>;
 }, "strip", z.ZodTypeAny, {
     strategy: "isolated_db";
-    encryption?: {
-        perTenantKeys: boolean;
-        algorithm: string;
-        keyManagement?: "custom" | "aws_kms" | "azure_key_vault" | "gcp_kms" | "hashicorp_vault" | undefined;
-    } | undefined;
     database?: {
         namingPattern: string;
         serverStrategy: "shared" | "sharded" | "dedicated";
         separateCredentials: boolean;
         autoCreateDatabase: boolean;
     } | undefined;
+    encryption?: {
+        perTenantKeys: boolean;
+        algorithm: string;
+        keyManagement?: "custom" | "aws_kms" | "azure_key_vault" | "gcp_kms" | "hashicorp_vault" | undefined;
+    } | undefined;
     connectionPool?: {
         idleTimeout: number;
         poolSize: number;
@@ -962,22 +988,22 @@ export declare const TenantIsolationConfigSchema: z.ZodDiscriminatedUnion<"strat
     } | undefined;
     backup?: {
         strategy: "on_demand" | "individual" | "consolidated";
-        frequencyHours: number;
         retentionDays: number;
+        frequencyHours: number;
     } | undefined;
 }, {
     strategy: "isolated_db";
-    encryption?: {
-        perTenantKeys?: boolean | undefined;
-        algorithm?: string | undefined;
-        keyManagement?: "custom" | "aws_kms" | "azure_key_vault" | "gcp_kms" | "hashicorp_vault" | undefined;
-    } | undefined;
     database?: {
         namingPattern?: string | undefined;
         serverStrategy?: "shared" | "sharded" | "dedicated" | undefined;
         separateCredentials?: boolean | undefined;
         autoCreateDatabase?: boolean | undefined;
     } | undefined;
+    encryption?: {
+        perTenantKeys?: boolean | undefined;
+        algorithm?: string | undefined;
+        keyManagement?: "custom" | "aws_kms" | "azure_key_vault" | "gcp_kms" | "hashicorp_vault" | undefined;
+    } | undefined;
     connectionPool?: {
         idleTimeout?: number | undefined;
         poolSize?: number | undefined;
@@ -986,8 +1012,8 @@ export declare const TenantIsolationConfigSchema: z.ZodDiscriminatedUnion<"strat
     } | undefined;
     backup?: {
         strategy?: "on_demand" | "individual" | "consolidated" | undefined;
-        frequencyHours?: number | undefined;
         retentionDays?: number | undefined;
+        frequencyHours?: number | undefined;
     } | undefined;
 }>]>;
 export type TenantIsolationConfig = z.infer<typeof TenantIsolationConfigSchema>;
@@ -1110,12 +1136,6 @@ export declare const TenantSecurityPolicySchema: z.ZodObject<{
         inTransit: boolean;
         fieldLevel: boolean;
     } | undefined;
-    accessControl?: {
-        requireMFA: boolean;
-        requireSSO: boolean;
-        sessionTimeout: number;
-        ipWhitelist?: string[] | undefined;
-    } | undefined;
     compliance?: {
         requireAuditLog: boolean;
         auditRetentionDays: number;
@@ -1125,18 +1145,18 @@ export declare const TenantSecurityPolicySchema: z.ZodObject<{
             excludeRegions?: string[] | undefined;
         } | undefined;
     } | undefined;
+    accessControl?: {
+        requireMFA: boolean;
+        requireSSO: boolean;
+        sessionTimeout: number;
+        ipWhitelist?: string[] | undefined;
+    } | undefined;
 }, {
     encryption?: {
         atRest?: boolean | undefined;
         inTransit?: boolean | undefined;
         fieldLevel?: boolean | undefined;
     } | undefined;
-    accessControl?: {
-        requireMFA?: boolean | undefined;
-        requireSSO?: boolean | undefined;
-        ipWhitelist?: string[] | undefined;
-        sessionTimeout?: number | undefined;
-    } | undefined;
     compliance?: {
         standards?: ("sox" | "hipaa" | "gdpr" | "pci_dss" | "iso_27001" | "fedramp")[] | undefined;
         requireAuditLog?: boolean | undefined;
@@ -1146,6 +1166,12 @@ export declare const TenantSecurityPolicySchema: z.ZodObject<{
             excludeRegions?: string[] | undefined;
         } | undefined;
     } | undefined;
+    accessControl?: {
+        requireMFA?: boolean | undefined;
+        requireSSO?: boolean | undefined;
+        ipWhitelist?: string[] | undefined;
+        sessionTimeout?: number | undefined;
+    } | undefined;
 }>;
 export type TenantSecurityPolicy = z.infer<typeof TenantSecurityPolicySchema>;
 //# sourceMappingURL=tenant.zod.d.ts.map

package/dist/hub/tenant.zod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.zod.d.ts","sourceRoot":"","sources":["../../src/hub/tenant.zod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;GAWG;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,gEAI/B,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,iBAAiB;IAC5B;;OAEG;;IAGH;;OAEG;;IAGH;;OAEG;;;;;;;;;;EAEH,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,YAAY;IACvB;;OAEG;;IAGH;;OAEG;;IAGH;;OAEG;;IAGH;;OAEG;;IAGH;;OAEG;;QAzEH;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+DH,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD;;;;;GAKG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,+BAA+B;;IAG1C;;OAEG;;QAED;;WAEG;;QAGH;;WAEG;;QAOH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGL,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,kCAAkC;;IAG7C;;OAEG;;QAED;;;;WAIG;;QAGH;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAOH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGL,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,eAAO,MAAM,oCAAoC;;IAG/C;;OAEG;;QAED;;;;WAIG;;QAGH;;WAEG;;QAOH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAOH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGL,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;;IAzUtC;;OAEG;;QAED;;WAEG;;QAGH;;WAEG;;QAOH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuDL;;OAEG;;QAED;;;;WAIG;;QAGH;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAOH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0DL;;OAEG;;QAED;;;;WAIG;;QAGH;;WAEG;;QAOH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAOH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAiBL,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,0BAA0B;IACrC;;OAEG;;QAED;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;;;;;;;;;;;;IAIL;;OAEG;;QAED;;WAEG;;QAUH;;WAEG;;QAGH;;WAEG;;QAGH;;WAEG;;YAED;;eAEG;;YAGH;;eAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIP,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/{system → hub}/tenant.zod.js

@@ -43,7 +43,35 @@ exports.TenantQuotaSchema = zod_1.z.object({
 });
 /**
  * Tenant Schema
- * Represents a tenant in a multi-tenant SaaS deployment
+ *
+ * @deprecated This schema is maintained for backward compatibility only.
+ * New implementations should use HubSpaceSchema which embeds tenant concepts.
+ *
+ * **Migration Guide:**
+ * ```typescript
+ * // Old approach (deprecated):
+ * const tenant: Tenant = {
+ *   id: 'tenant_123',
+ *   name: 'My Tenant',
+ *   isolationLevel: 'shared_schema',
+ *   quotas: { maxUsers: 100 }
+ * };
+ *
+ * // New approach (recommended):
+ * const space: HubSpace = {
+ *   id: '...uuid...',
+ *   name: 'My Tenant',
+ *   slug: 'my-tenant',
+ *   ownerId: 'user_id',
+ *   runtime: {
+ *     isolation: 'shared_schema',
+ *     quotas: { maxUsers: 100 }
+ *   },
+ *   bom: { ... }
+ * };
+ * ```
+ *
+ * See HubSpaceSchema in space.zod.ts for the recommended approach.
  */
 exports.TenantSchema = zod_1.z.object({
     /**
@@ -51,23 +79,21 @@ exports.TenantSchema = zod_1.z.object({
      */
     id: zod_1.z.string().describe('Unique tenant identifier'),
     /**
-     * Tenant name (display name)
+     * Tenant display name
      */
     name: zod_1.z.string().describe('Tenant display name'),
     /**
-     * Data isolation level for this tenant
-     * Determines how tenant data is segregated from other tenants
+     * Data isolation level
      */
-    isolationLevel: exports.TenantIsolationLevel.describe('Data isolation strategy'),
+    isolationLevel: exports.TenantIsolationLevel,
     /**
-     * Custom configurations and metadata specific to this tenant
-     * Can store tenant-specific settings, branding, features, etc.
+     * Custom configuration values
      */
-    customizations: zod_1.z.record(zod_1.z.any()).optional().describe('Tenant-specific customizations'),
+    customizations: zod_1.z.record(zod_1.z.any()).optional().describe('Custom configuration values'),
     /**
-     * Resource quotas and limits for this tenant
+     * Resource quotas
      */
-    quotas: exports.TenantQuotaSchema.optional().describe('Resource quotas and limits'),
+    quotas: exports.TenantQuotaSchema.optional(),
 });
 /**
  * Tenant Isolation Strategy Documentation

package/dist/index.d.ts

@@ -10,10 +10,10 @@
  *
  * ### Style 1: Namespace Imports from Root
  * ```typescript
- * import { Data, UI, System, AI, API } from '@objectstack/spec';
+ * import { Data, UI, System, Auth, AI, API } from '@objectstack/spec';
  *
  * const field: Data.Field = { name: 'task_name', type: 'text' };
- * const user: System.User = { id: 'u1', email: 'user@example.com' };
+ * const user: Auth.User = { id: 'u1', email: 'user@example.com' };
  * ```
  *
  * ### Style 2: Namespace Imports via Subpath
@@ -21,23 +21,30 @@
  * import * as Data from '@objectstack/spec/data';
  * import * as UI from '@objectstack/spec/ui';
  * import * as System from '@objectstack/spec/system';
+ * import * as Auth from '@objectstack/spec/auth';
  *
  * const field: Data.Field = { name: 'task_name', type: 'text' };
- * const user: System.User = { id: 'u1', email: 'user@example.com' };
+ * const user: Auth.User = { id: 'u1', email: 'user@example.com' };
  * ```
  *
  * ### Style 3: Direct Subpath Imports
  * ```typescript
  * import { Field, FieldType } from '@objectstack/spec/data';
- * import { User, Session } from '@objectstack/spec/system';
+ * import { User, Session } from '@objectstack/spec/auth';
  *
  * const field: Field = { name: 'task_name', type: 'text' };
  * const user: User = { id: 'u1', email: 'user@example.com' };
  * ```
  */
+export * as Shared from './shared';
 export * as Data from './data';
+export * as Permission from './permission';
 export * as UI from './ui';
 export * as System from './system';
+export * as Auth from './auth';
+export * as Hub from './hub';
 export * as AI from './ai';
 export * as API from './api';
+export * as Automation from './automation';
+export * from './stack.zod';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAQH,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,KAAK,GAAG,MAAM,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAOH,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AACnC,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;AAC/B,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AACnC,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;AAC/B,OAAO,KAAK,GAAG,MAAM,OAAO,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,KAAK,GAAG,MAAM,OAAO,CAAC;AAC7B,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAE3C,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -11,10 +11,10 @@
  *
  * ### Style 1: Namespace Imports from Root
  * ```typescript
- * import { Data, UI, System, AI, API } from '@objectstack/spec';
+ * import { Data, UI, System, Auth, AI, API } from '@objectstack/spec';
  *
  * const field: Data.Field = { name: 'task_name', type: 'text' };
- * const user: System.User = { id: 'u1', email: 'user@example.com' };
+ * const user: Auth.User = { id: 'u1', email: 'user@example.com' };
  * ```
  *
  * ### Style 2: Namespace Imports via Subpath
@@ -22,15 +22,16 @@
  * import * as Data from '@objectstack/spec/data';
  * import * as UI from '@objectstack/spec/ui';
  * import * as System from '@objectstack/spec/system';
+ * import * as Auth from '@objectstack/spec/auth';
  *
  * const field: Data.Field = { name: 'task_name', type: 'text' };
- * const user: System.User = { id: 'u1', email: 'user@example.com' };
+ * const user: Auth.User = { id: 'u1', email: 'user@example.com' };
  * ```
  *
  * ### Style 3: Direct Subpath Imports
  * ```typescript
  * import { Field, FieldType } from '@objectstack/spec/data';
- * import { User, Session } from '@objectstack/spec/system';
+ * import { User, Session } from '@objectstack/spec/auth';
  *
  * const field: Field = { name: 'task_name', type: 'text' };
  * const user: User = { id: 'u1', email: 'user@example.com' };
@@ -69,15 +70,24 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.API = exports.AI = exports.System = exports.UI = exports.Data = void 0;
+exports.Automation = exports.API = exports.AI = exports.Hub = exports.Auth = exports.System = exports.UI = exports.Permission = exports.Data = exports.Shared = void 0;
 // ============================================================================
 // NAMESPACE EXPORTS
 // ============================================================================
 // Export protocol domains as namespaces to prevent naming conflicts
 // and establish clear boundaries between different protocol layers.
+exports.Shared = __importStar(require("./shared"));
 exports.Data = __importStar(require("./data"));
+exports.Permission = __importStar(require("./permission"));
 exports.UI = __importStar(require("./ui"));
 exports.System = __importStar(require("./system"));
+exports.Auth = __importStar(require("./auth"));
+exports.Hub = __importStar(require("./hub"));
 exports.AI = __importStar(require("./ai"));
 exports.API = __importStar(require("./api"));
+exports.Automation = __importStar(require("./automation"));
+__exportStar(require("./stack.zod"), exports);

package/dist/permission/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Permission Protocol Exports
+ *
+ * Fine-grained Access Control
+ * - Permission Sets (CRUD + Field-Level Security)
+ * - Sharing Rules (Record Ownership)
+ * - Territory Management (Geographic/Hierarchical)
+ * - Row-Level Security (RLS - PostgreSQL-style)
+ */
+export * from './permission.zod';
+export * from './sharing.zod';
+export * from './territory.zod';
+export * from './rls.zod';
+//# sourceMappingURL=index.d.ts.map

package/dist/permission/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permission/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC"}

package/dist/permission/index.js

@@ -0,0 +1,29 @@
+"use strict";
+/**
+ * Permission Protocol Exports
+ *
+ * Fine-grained Access Control
+ * - Permission Sets (CRUD + Field-Level Security)
+ * - Sharing Rules (Record Ownership)
+ * - Territory Management (Geographic/Hierarchical)
+ * - Row-Level Security (RLS - PostgreSQL-style)
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./permission.zod"), exports);
+__exportStar(require("./sharing.zod"), exports);
+__exportStar(require("./territory.zod"), exports);
+__exportStar(require("./rls.zod"), exports);

package/dist/{data → permission}/permission.zod.d.ts

@@ -1,7 +1,12 @@
 import { z } from 'zod';
 /**
  * Entity (Object) Level Permissions
- * Defines CRUD + VAMA (View All / Modify All) access.
+ * Defines CRUD + VAMA (View All / Modify All) + Lifecycle access.
+ *
+ * Refined with enterprise data lifecycle controls:
+ * - Transfer (Ownership change)
+ * - Restore (Soft delete recovery)
+ * - Purge (Hard delete / Compliance)
  */
 export declare const ObjectPermissionSchema: z.ZodObject<{
     /** C: Create */
@@ -12,6 +17,10 @@ export declare const ObjectPermissionSchema: z.ZodObject<{
     allowEdit: z.ZodDefault<z.ZodBoolean>;
     /** D: Delete (Owned records or Shared records) */
     allowDelete: z.ZodDefault<z.ZodBoolean>;
+    /** Lifecycle Operations */
+    allowTransfer: z.ZodDefault<z.ZodBoolean>;
+    allowRestore: z.ZodDefault<z.ZodBoolean>;
+    allowPurge: z.ZodDefault<z.ZodBoolean>;
     /**
      * View All Records: Super-user read access.
      * Bypasses Sharing Rules and Ownership checks.
@@ -29,6 +38,9 @@ export declare const ObjectPermissionSchema: z.ZodObject<{
     allowRead: boolean;
     allowEdit: boolean;
     allowDelete: boolean;
+    allowTransfer: boolean;
+    allowRestore: boolean;
+    allowPurge: boolean;
     viewAllRecords: boolean;
     modifyAllRecords: boolean;
 }, {
@@ -36,6 +48,9 @@ export declare const ObjectPermissionSchema: z.ZodObject<{
     allowRead?: boolean | undefined;
     allowEdit?: boolean | undefined;
     allowDelete?: boolean | undefined;
+    allowTransfer?: boolean | undefined;
+    allowRestore?: boolean | undefined;
+    allowPurge?: boolean | undefined;
     viewAllRecords?: boolean | undefined;
     modifyAllRecords?: boolean | undefined;
 }>;
@@ -62,6 +77,20 @@ export declare const FieldPermissionSchema: z.ZodObject<{
  * - Profile: The ONE primary functional definition of a user (e.g. Standard User).
  * - Permission Set: Add-on capabilities assigned to users (e.g. Export Reports).
  * - Role: (Defined in src/system/role.zod.ts) Defines data visibility hierarchy.
+ *
+ * **NAMING CONVENTION:**
+ * Permission set names MUST be lowercase snake_case to prevent security issues.
+ *
+ * @example Good permission set names
+ * - 'read_only'
+ * - 'system_admin'
+ * - 'standard_user'
+ * - 'api_access'
+ *
+ * @example Bad permission set names (will be rejected)
+ * - 'ReadOnly' (camelCase)
+ * - 'SystemAdmin' (mixed case)
+ * - 'Read Only' (spaces)
  */
 export declare const PermissionSetSchema: z.ZodObject<{
     /** Unique permission set name */
@@ -80,6 +109,10 @@ export declare const PermissionSetSchema: z.ZodObject<{
         allowEdit: z.ZodDefault<z.ZodBoolean>;
         /** D: Delete (Owned records or Shared records) */
         allowDelete: z.ZodDefault<z.ZodBoolean>;
+        /** Lifecycle Operations */
+        allowTransfer: z.ZodDefault<z.ZodBoolean>;
+        allowRestore: z.ZodDefault<z.ZodBoolean>;
+        allowPurge: z.ZodDefault<z.ZodBoolean>;
         /**
          * View All Records: Super-user read access.
          * Bypasses Sharing Rules and Ownership checks.
@@ -97,6 +130,9 @@ export declare const PermissionSetSchema: z.ZodObject<{
         allowRead: boolean;
         allowEdit: boolean;
         allowDelete: boolean;
+        allowTransfer: boolean;
+        allowRestore: boolean;
+        allowPurge: boolean;
         viewAllRecords: boolean;
         modifyAllRecords: boolean;
     }, {
@@ -104,6 +140,9 @@ export declare const PermissionSetSchema: z.ZodObject<{
         allowRead?: boolean | undefined;
         allowEdit?: boolean | undefined;
         allowDelete?: boolean | undefined;
+        allowTransfer?: boolean | undefined;
+        allowRestore?: boolean | undefined;
+        allowPurge?: boolean | undefined;
         viewAllRecords?: boolean | undefined;
         modifyAllRecords?: boolean | undefined;
     }>>;
@@ -130,14 +169,17 @@ export declare const PermissionSetSchema: z.ZodObject<{
         allowRead: boolean;
         allowEdit: boolean;
         allowDelete: boolean;
+        allowTransfer: boolean;
+        allowRestore: boolean;
+        allowPurge: boolean;
         viewAllRecords: boolean;
         modifyAllRecords: boolean;
     }>;
-    label?: string | undefined;
     fields?: Record<string, {
         readable: boolean;
         editable: boolean;
     }> | undefined;
+    label?: string | undefined;
     systemPermissions?: string[] | undefined;
 }, {
     name: string;
@@ -146,14 +188,17 @@ export declare const PermissionSetSchema: z.ZodObject<{
         allowRead?: boolean | undefined;
         allowEdit?: boolean | undefined;
         allowDelete?: boolean | undefined;
+        allowTransfer?: boolean | undefined;
+        allowRestore?: boolean | undefined;
+        allowPurge?: boolean | undefined;
         viewAllRecords?: boolean | undefined;
         modifyAllRecords?: boolean | undefined;
     }>;
-    label?: string | undefined;
     fields?: Record<string, {
         readable?: boolean | undefined;
         editable?: boolean | undefined;
     }> | undefined;
+    label?: string | undefined;
     isProfile?: boolean | undefined;
     systemPermissions?: string[] | undefined;
 }>;

package/dist/permission/permission.zod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.zod.d.ts","sourceRoot":"","sources":["../../src/permission/permission.zod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB;IACjC,gBAAgB;;IAEhB,gDAAgD;;IAEhD,gDAAgD;;IAEhD,kDAAkD;;IAGlD,2BAA2B;;;;IAK3B;;;;OAIG;;IAGH;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;EAEH,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,qBAAqB;IAChC,yBAAyB;;IAEzB,0BAA0B;;;;;;;;EAE1B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,mBAAmB;IAC9B,iCAAiC;;IAGjC,oBAAoB;;IAGpB,+CAA+C;;IAG/C,2DAA2D;;QAxE3D,gBAAgB;;QAEhB,gDAAgD;;QAEhD,gDAAgD;;QAEhD,kDAAkD;;QAGlD,2BAA2B;;;;QAK3B;;;;WAIG;;QAGH;;;;WAIG;;;;;;;;;;;;;;;;;;;;;;;IAkDH,uEAAuE;;QA1CvE,yBAAyB;;QAEzB,0BAA0B;;;;;;;;;IA2C1B,gDAAgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEhD,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}