@objectstack/spec 2.0.4 → 2.0.5

package/dist/index.d.ts

@@ -1,23 +1,24 @@
 import { z } from 'zod';
 import { C as CorsConfig, a as CorsConfigSchema, H as HttpMethod, R as RateLimitConfig, b as RateLimitConfigSchema, S as StaticMount, c as StaticMountSchema } from './index-BbtSaxHm.js';
 export { i as API } from './index-BbtSaxHm.js';
-export { i as Data } from './index-yvEIvpa3.js';
+export { i as Data } from './index-BPhGHW32.js';
+export { i as Security } from './index-CDN6TRx9.js';
 export { i as UI } from './index-CgkjUheS.js';
 export { i as System } from './index-BpP0MwlW.js';
-export { i as Kernel, P as PluginContext, d as definePlugin } from './index-DOuMlF5h.js';
+export { i as Kernel, P as PluginContext, d as definePlugin } from './index-DyawwLFZ.js';
 export { i as Hub } from './index-CEl7Law0.js';
 import { F as FilterGroup } from './index-CisfSmuF.js';
 export { i as AI } from './index-CisfSmuF.js';
 export { i as Automation } from './index-DqnBqATx.js';
 export { i as Integration } from './index-d9wYlv-g.js';
-export { i as Contracts } from './index-C8xlxqpA.js';
+export { i as Contracts } from './index-C6p-2KXV.js';
 export { i as Studio } from './index-cnIz7iRP.js';
 import { S as StateNodeConfig } from './state-machine.zod-DoC0JvQb.js';
 import { Q as QueryAST } from './field.zod-DuaF0Lcl.js';
 import { F as FilterCondition } from './filter.zod-CtZ3VJ3e.js';
 import { B as BaseValidationRuleShape } from './validation.zod-zTCn4LEC.js';
 import './package-registry.zod-CbS9FKeH.js';
-import './driver.zod-BJHWEbwG.js';
+import './driver.zod-E3C6n0W-.js';
 import './registry-config.zod-BCb7Z1Xs.js';
 import './plugin-security.zod-Cgwq94Q8.js';
 
@@ -291,801 +292,39 @@ type BaseMetadataRecord = z.infer<typeof BaseMetadataRecordSchema>;
  * Common schemas used across multiple modules
  */
 
-type index$3_AggregationFunction = AggregationFunction;
-declare const index$3_AggregationFunctionEnum: typeof AggregationFunctionEnum;
-type index$3_BaseMetadataRecord = BaseMetadataRecord;
-declare const index$3_BaseMetadataRecordSchema: typeof BaseMetadataRecordSchema;
-type index$3_CacheStrategy = CacheStrategy;
-declare const index$3_CacheStrategyEnum: typeof CacheStrategyEnum;
-declare const index$3_CorsConfig: typeof CorsConfig;
-declare const index$3_CorsConfigSchema: typeof CorsConfigSchema;
-type index$3_EventName = EventName;
-declare const index$3_EventNameSchema: typeof EventNameSchema;
-type index$3_FieldMapping = FieldMapping;
-declare const index$3_FieldMappingSchema: typeof FieldMappingSchema;
-declare const index$3_HttpMethod: typeof HttpMethod;
-type index$3_IsolationLevel = IsolationLevel;
-declare const index$3_IsolationLevelEnum: typeof IsolationLevelEnum;
-type index$3_MetadataFormat = MetadataFormat;
-declare const index$3_MetadataFormatSchema: typeof MetadataFormatSchema;
-type index$3_MutationEvent = MutationEvent;
-declare const index$3_MutationEventEnum: typeof MutationEventEnum;
-declare const index$3_RateLimitConfig: typeof RateLimitConfig;
-declare const index$3_RateLimitConfigSchema: typeof RateLimitConfigSchema;
-type index$3_SnakeCaseIdentifier = SnakeCaseIdentifier;
-declare const index$3_SnakeCaseIdentifierSchema: typeof SnakeCaseIdentifierSchema;
-type index$3_SortDirection = SortDirection;
-declare const index$3_SortDirectionEnum: typeof SortDirectionEnum;
-declare const index$3_StaticMount: typeof StaticMount;
-declare const index$3_StaticMountSchema: typeof StaticMountSchema;
-type index$3_SystemIdentifier = SystemIdentifier;
-declare const index$3_SystemIdentifierSchema: typeof SystemIdentifierSchema;
-type index$3_TransformType = TransformType;
-declare const index$3_TransformTypeSchema: typeof TransformTypeSchema;
-declare namespace index$3 {
-  export { type index$3_AggregationFunction as AggregationFunction, index$3_AggregationFunctionEnum as AggregationFunctionEnum, type index$3_BaseMetadataRecord as BaseMetadataRecord, index$3_BaseMetadataRecordSchema as BaseMetadataRecordSchema, type index$3_CacheStrategy as CacheStrategy, index$3_CacheStrategyEnum as CacheStrategyEnum, index$3_CorsConfig as CorsConfig, index$3_CorsConfigSchema as CorsConfigSchema, type index$3_EventName as EventName, index$3_EventNameSchema as EventNameSchema, type index$3_FieldMapping as FieldMapping, index$3_FieldMappingSchema as FieldMappingSchema, index$3_HttpMethod as HttpMethod, type index$3_IsolationLevel as IsolationLevel, index$3_IsolationLevelEnum as IsolationLevelEnum, type index$3_MetadataFormat as MetadataFormat, index$3_MetadataFormatSchema as MetadataFormatSchema, type index$3_MutationEvent as MutationEvent, index$3_MutationEventEnum as MutationEventEnum, index$3_RateLimitConfig as RateLimitConfig, index$3_RateLimitConfigSchema as RateLimitConfigSchema, type index$3_SnakeCaseIdentifier as SnakeCaseIdentifier, index$3_SnakeCaseIdentifierSchema as SnakeCaseIdentifierSchema, type index$3_SortDirection as SortDirection, index$3_SortDirectionEnum as SortDirectionEnum, index$3_StaticMount as StaticMount, index$3_StaticMountSchema as StaticMountSchema, type index$3_SystemIdentifier as SystemIdentifier, index$3_SystemIdentifierSchema as SystemIdentifierSchema, type index$3_TransformType as TransformType, index$3_TransformTypeSchema as TransformTypeSchema };
-}
-
-/**
- * Entity (Object) Level Permissions
- * Defines CRUD + VAMA (View All / Modify All) + Lifecycle access.
- *
- * Refined with enterprise data lifecycle controls:
- * - Transfer (Ownership change)
- * - Restore (Soft delete recovery)
- * - Purge (Hard delete / Compliance)
- */
-declare const ObjectPermissionSchema: z.ZodObject<{
-    allowCreate: z.ZodDefault<z.ZodBoolean>;
-    allowRead: z.ZodDefault<z.ZodBoolean>;
-    allowEdit: z.ZodDefault<z.ZodBoolean>;
-    allowDelete: z.ZodDefault<z.ZodBoolean>;
-    allowTransfer: z.ZodDefault<z.ZodBoolean>;
-    allowRestore: z.ZodDefault<z.ZodBoolean>;
-    allowPurge: z.ZodDefault<z.ZodBoolean>;
-    viewAllRecords: z.ZodDefault<z.ZodBoolean>;
-    modifyAllRecords: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip>;
-/**
- * Field Level Security (FLS)
- */
-declare const FieldPermissionSchema: z.ZodObject<{
-    readable: z.ZodDefault<z.ZodBoolean>;
-    editable: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip>;
-/**
- * Permission Set Schema
- * Defines a collection of permissions that can be assigned to users.
- *
- * DIFFERENTIATION:
- * - Profile: The ONE primary functional definition of a user (e.g. Standard User).
- * - Permission Set: Add-on capabilities assigned to users (e.g. Export Reports).
- * - Role: (Defined in src/system/role.zod.ts) Defines data visibility hierarchy.
- *
- * **NAMING CONVENTION:**
- * Permission set names MUST be lowercase snake_case to prevent security issues.
- *
- * @example Good permission set names
- * - 'read_only'
- * - 'system_admin'
- * - 'standard_user'
- * - 'api_access'
- *
- * @example Bad permission set names (will be rejected)
- * - 'ReadOnly' (camelCase)
- * - 'SystemAdmin' (mixed case)
- * - 'Read Only' (spaces)
- */
-declare const PermissionSetSchema: z.ZodObject<{
-    name: z.ZodString;
-    label: z.ZodOptional<z.ZodString>;
-    isProfile: z.ZodDefault<z.ZodBoolean>;
-    objects: z.ZodRecord<z.ZodString, z.ZodObject<{
-        allowCreate: z.ZodDefault<z.ZodBoolean>;
-        allowRead: z.ZodDefault<z.ZodBoolean>;
-        allowEdit: z.ZodDefault<z.ZodBoolean>;
-        allowDelete: z.ZodDefault<z.ZodBoolean>;
-        allowTransfer: z.ZodDefault<z.ZodBoolean>;
-        allowRestore: z.ZodDefault<z.ZodBoolean>;
-        allowPurge: z.ZodDefault<z.ZodBoolean>;
-        viewAllRecords: z.ZodDefault<z.ZodBoolean>;
-        modifyAllRecords: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip>>;
-    fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        readable: z.ZodDefault<z.ZodBoolean>;
-        editable: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip>>>;
-    systemPermissions: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    rowLevelSecurity: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        name: z.ZodString;
-        label: z.ZodOptional<z.ZodString>;
-        description: z.ZodOptional<z.ZodString>;
-        object: z.ZodString;
-        operation: z.ZodEnum<{
-            insert: "insert";
-            update: "update";
-            delete: "delete";
-            select: "select";
-            all: "all";
-        }>;
-        using: z.ZodOptional<z.ZodString>;
-        check: z.ZodOptional<z.ZodString>;
-        roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        enabled: z.ZodDefault<z.ZodBoolean>;
-        priority: z.ZodDefault<z.ZodNumber>;
-        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strip>>>;
-    contextVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-}, z.core.$strip>;
-type PermissionSet = z.infer<typeof PermissionSetSchema>;
-type ObjectPermission = z.infer<typeof ObjectPermissionSchema>;
-type FieldPermission = z.infer<typeof FieldPermissionSchema>;
-
-/**
- * Organization-Wide Defaults (OWD)
- * The baseline security posture for an object.
- */
-declare const OWDModel: z.ZodEnum<{
-    private: "private";
-    public_read: "public_read";
-    public_read_write: "public_read_write";
-    controlled_by_parent: "controlled_by_parent";
-}>;
-/**
- * Sharing Rule Type
- * How is the data shared?
- */
-declare const SharingRuleType: z.ZodEnum<{
-    owner: "owner";
-    criteria: "criteria";
-}>;
-/**
- * Sharing Level
- * What access is granted?
- */
-declare const SharingLevel: z.ZodEnum<{
-    full: "full";
-    read: "read";
-    edit: "edit";
-}>;
-/**
- * Recipient Type
- * Who receives the access?
- */
-declare const ShareRecipientType: z.ZodEnum<{
-    role: "role";
-    user: "user";
-    group: "group";
-    role_and_subordinates: "role_and_subordinates";
-    guest: "guest";
-}>;
-/**
- * 1. Criteria-Based Sharing Rule
- * Share records that meet specific field criteria.
- */
-declare const CriteriaSharingRuleSchema: z.ZodObject<{
-    name: z.ZodString;
-    label: z.ZodOptional<z.ZodString>;
-    description: z.ZodOptional<z.ZodString>;
-    object: z.ZodString;
-    active: z.ZodDefault<z.ZodBoolean>;
-    accessLevel: z.ZodDefault<z.ZodEnum<{
-        full: "full";
-        read: "read";
-        edit: "edit";
-    }>>;
-    sharedWith: z.ZodObject<{
-        type: z.ZodEnum<{
-            role: "role";
-            user: "user";
-            group: "group";
-            role_and_subordinates: "role_and_subordinates";
-            guest: "guest";
-        }>;
-        value: z.ZodString;
-    }, z.core.$strip>;
-    type: z.ZodLiteral<"criteria">;
-    condition: z.ZodString;
-}, z.core.$strip>;
-/**
- * 2. Owner-Based Sharing Rule
- * Share records owned by a specific group of users.
- */
-declare const OwnerSharingRuleSchema: z.ZodObject<{
-    name: z.ZodString;
-    label: z.ZodOptional<z.ZodString>;
-    description: z.ZodOptional<z.ZodString>;
-    object: z.ZodString;
-    active: z.ZodDefault<z.ZodBoolean>;
-    accessLevel: z.ZodDefault<z.ZodEnum<{
-        full: "full";
-        read: "read";
-        edit: "edit";
-    }>>;
-    sharedWith: z.ZodObject<{
-        type: z.ZodEnum<{
-            role: "role";
-            user: "user";
-            group: "group";
-            role_and_subordinates: "role_and_subordinates";
-            guest: "guest";
-        }>;
-        value: z.ZodString;
-    }, z.core.$strip>;
-    type: z.ZodLiteral<"owner">;
-    ownedBy: z.ZodObject<{
-        type: z.ZodEnum<{
-            role: "role";
-            user: "user";
-            group: "group";
-            role_and_subordinates: "role_and_subordinates";
-            guest: "guest";
-        }>;
-        value: z.ZodString;
-    }, z.core.$strip>;
-}, z.core.$strip>;
-/**
- * Master Sharing Rule Schema
- */
-declare const SharingRuleSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    name: z.ZodString;
-    label: z.ZodOptional<z.ZodString>;
-    description: z.ZodOptional<z.ZodString>;
-    object: z.ZodString;
-    active: z.ZodDefault<z.ZodBoolean>;
-    accessLevel: z.ZodDefault<z.ZodEnum<{
-        full: "full";
-        read: "read";
-        edit: "edit";
-    }>>;
-    sharedWith: z.ZodObject<{
-        type: z.ZodEnum<{
-            role: "role";
-            user: "user";
-            group: "group";
-            role_and_subordinates: "role_and_subordinates";
-            guest: "guest";
-        }>;
-        value: z.ZodString;
-    }, z.core.$strip>;
-    type: z.ZodLiteral<"criteria">;
-    condition: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-    name: z.ZodString;
-    label: z.ZodOptional<z.ZodString>;
-    description: z.ZodOptional<z.ZodString>;
-    object: z.ZodString;
-    active: z.ZodDefault<z.ZodBoolean>;
-    accessLevel: z.ZodDefault<z.ZodEnum<{
-        full: "full";
-        read: "read";
-        edit: "edit";
-    }>>;
-    sharedWith: z.ZodObject<{
-        type: z.ZodEnum<{
-            role: "role";
-            user: "user";
-            group: "group";
-            role_and_subordinates: "role_and_subordinates";
-            guest: "guest";
-        }>;
-        value: z.ZodString;
-    }, z.core.$strip>;
-    type: z.ZodLiteral<"owner">;
-    ownedBy: z.ZodObject<{
-        type: z.ZodEnum<{
-            role: "role";
-            user: "user";
-            group: "group";
-            role_and_subordinates: "role_and_subordinates";
-            guest: "guest";
-        }>;
-        value: z.ZodString;
-    }, z.core.$strip>;
-}, z.core.$strip>], "type">;
-type SharingRule = z.infer<typeof SharingRuleSchema>;
-type CriteriaSharingRule = z.infer<typeof CriteriaSharingRuleSchema>;
-type OwnerSharingRule = z.infer<typeof OwnerSharingRuleSchema>;
-
-/**
- * Territory Management Protocol
- * Defines a matrix reporting structure that exists parallel to the Role Hierarchy.
- *
- * USE CASE:
- * - Enterprise Sales Teams (Geo-based: "EMEA", "APAC")
- * - Industry Verticals (Industry-based: "Healthcare", "Financial")
- * - Strategic Accounts (Account-based: "Strategic Accounts")
- *
- * DIFFERENCE FROM ROLE:
- * - Role: Hierarchy of PEOPLE (Who reports to whom). Stable. HR-driven.
- * - Territory: Hierarchy of ACCOUNTS/REVENUE (Who owns which market). Flexible. Sales-driven.
- * - One User can be assigned to MANY Territories (Matrix).
- * - One User has only ONE Role (Tree).
- */
-declare const TerritoryType: z.ZodEnum<{
-    geography: "geography";
-    industry: "industry";
-    named_account: "named_account";
-    product_line: "product_line";
-}>;
-/**
- * Territory Model Schema
- * A container for a version of territory planning.
- * (e.g. "Fiscal Year 2024 Planning" vs "Fiscal Year 2025 Planning")
- */
-declare const TerritoryModelSchema: z.ZodObject<{
-    name: z.ZodString;
-    state: z.ZodDefault<z.ZodEnum<{
-        active: "active";
-        planning: "planning";
-        archived: "archived";
-    }>>;
-    startDate: z.ZodOptional<z.ZodString>;
-    endDate: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-/**
- * Territory Node Schema
- * A single node in the territory tree.
- *
- * **NAMING CONVENTION:**
- * Territory names are machine identifiers and must be lowercase snake_case.
- *
- * @example Good territory names
- * - 'west_coast'
- * - 'emea_region'
- * - 'healthcare_vertical'
- * - 'strategic_accounts'
- *
- * @example Bad territory names (will be rejected)
- * - 'WestCoast' (PascalCase)
- * - 'West Coast' (spaces)
- */
-declare const TerritorySchema: z.ZodObject<{
-    name: z.ZodString;
-    label: z.ZodString;
-    modelId: z.ZodString;
-    parent: z.ZodOptional<z.ZodString>;
-    type: z.ZodDefault<z.ZodEnum<{
-        geography: "geography";
-        industry: "industry";
-        named_account: "named_account";
-        product_line: "product_line";
-    }>>;
-    assignmentRule: z.ZodOptional<z.ZodString>;
-    assignedUsers: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    accountAccess: z.ZodDefault<z.ZodEnum<{
-        read: "read";
-        edit: "edit";
-    }>>;
-    opportunityAccess: z.ZodDefault<z.ZodEnum<{
-        read: "read";
-        edit: "edit";
-    }>>;
-    caseAccess: z.ZodDefault<z.ZodEnum<{
-        read: "read";
-        edit: "edit";
-    }>>;
-}, z.core.$strip>;
-type Territory = z.infer<typeof TerritorySchema>;
-type TerritoryModel = z.infer<typeof TerritoryModelSchema>;
-
-/**
- * # Row-Level Security (RLS) Protocol
- *
- * Implements fine-grained record-level access control inspired by PostgreSQL RLS
- * and Salesforce Criteria-Based Sharing Rules.
- *
- * ## Overview
- *
- * Row-Level Security (RLS) allows you to control which rows users can access
- * in database tables based on their identity and role. Unlike object-level
- * permissions (CRUD), RLS provides record-level filtering.
- *
- * ## Use Cases
- *
- * 1. **Multi-Tenant Data Isolation**
- *    - Users only see records from their organization
- *    - `using: "tenant_id = current_user.tenant_id"`
- *
- * 2. **Ownership-Based Access**
- *    - Users only see records they own
- *    - `using: "owner_id = current_user.id"`
- *
- * 3. **Department-Based Access**
- *    - Users only see records from their department
- *    - `using: "department = current_user.department"`
- *
- * 4. **Regional Access Control**
- *    - Sales reps only see accounts in their territory
- *    - `using: "region IN (current_user.assigned_regions)"`
- *
- * 5. **Time-Based Access**
- *    - Users can only access active records
- *    - `using: "status = 'active' AND expiry_date > NOW()"`
- *
- * ## PostgreSQL RLS Comparison
- *
- * PostgreSQL RLS Example:
- * ```sql
- * CREATE POLICY tenant_isolation ON accounts
- *   FOR SELECT
- *   USING (tenant_id = current_setting('app.current_tenant_id')::uuid);
- *
- * CREATE POLICY account_insert ON accounts
- *   FOR INSERT
- *   WITH CHECK (tenant_id = current_setting('app.current_tenant_id')::uuid);
- * ```
- *
- * ObjectStack RLS Equivalent:
- * ```typescript
- * {
- *   name: 'tenant_isolation',
- *   object: 'account',
- *   operation: 'select',
- *   using: 'tenant_id = current_user.tenant_id'
- * }
- * ```
- *
- * ## Salesforce Sharing Rules Comparison
- *
- * Salesforce uses "Sharing Rules" and "Role Hierarchy" for record-level access.
- * ObjectStack RLS provides similar functionality with more flexibility.
- *
- * Salesforce:
- * - Criteria-Based Sharing: Share records matching criteria with users/roles
- * - Owner-Based Sharing: Share records based on owner's role
- * - Manual Sharing: Individual record sharing
- *
- * ObjectStack RLS:
- * - More flexible formula-based conditions
- * - Direct SQL-like syntax
- * - Supports complex logic with AND/OR/NOT
- *
- * ## Best Practices
- *
- * 1. **Always Define SELECT Policy**: Control what users can view
- * 2. **Define INSERT/UPDATE CHECK Policies**: Prevent data leakage
- * 3. **Use Role-Based Policies**: Apply different rules to different roles
- * 4. **Test Thoroughly**: RLS can have complex interactions
- * 5. **Monitor Performance**: Complex RLS policies can impact query performance
- *
- * ## Security Considerations
- *
- * 1. **Defense in Depth**: RLS is one layer; use with object permissions
- * 2. **Default Deny**: If no policy matches, access is denied
- * 3. **Policy Precedence**: More permissive policy wins (OR logic)
- * 4. **Context Variables**: Ensure current_user context is always set
- *
- * @see https://www.postgresql.org/docs/current/ddl-rowsecurity.html
- * @see https://help.salesforce.com/s/articleView?id=sf.security_sharing_rules.htm
- */
-/**
- * RLS Operation Enum
- * Specifies which database operation this policy applies to.
- *
- * - **select**: Controls which rows can be read (SELECT queries)
- * - **insert**: Controls which rows can be inserted (INSERT statements)
- * - **update**: Controls which rows can be updated (UPDATE statements)
- * - **delete**: Controls which rows can be deleted (DELETE statements)
- * - **all**: Shorthand for all operations (equivalent to defining 4 separate policies)
- */
-declare const RLSOperation: z.ZodEnum<{
-    insert: "insert";
-    update: "update";
-    delete: "delete";
-    select: "select";
-    all: "all";
-}>;
-type RLSOperation = z.infer<typeof RLSOperation>;
-/**
- * Row-Level Security Policy Schema
- *
- * Defines a single RLS policy that filters records based on conditions.
- * Multiple policies can be defined for the same object, and they are
- * combined with OR logic (union of results).
- *
- * @example Multi-Tenant Isolation
- * ```typescript
- * {
- *   name: 'tenant_isolation',
- *   label: 'Multi-Tenant Data Isolation',
- *   object: 'account',
- *   operation: 'select',
- *   using: 'tenant_id = current_user.tenant_id',
- *   enabled: true
- * }
- * ```
- *
- * @example Owner-Based Access
- * ```typescript
- * {
- *   name: 'owner_access',
- *   label: 'Users Can View Their Own Records',
- *   object: 'opportunity',
- *   operation: 'select',
- *   using: 'owner_id = current_user.id',
- *   enabled: true
- * }
- * ```
- *
- * @example Manager Can View Team Records
- * ```typescript
- * {
- *   name: 'manager_team_access',
- *   label: 'Managers Can View Team Records',
- *   object: 'task',
- *   operation: 'select',
- *   using: 'assigned_to_id IN (SELECT id FROM users WHERE manager_id = current_user.id)',
- *   roles: ['manager', 'director'],
- *   enabled: true
- * }
- * ```
- *
- * @example Prevent Cross-Tenant Data Insertion
- * ```typescript
- * {
- *   name: 'tenant_insert_check',
- *   label: 'Prevent Cross-Tenant Data Creation',
- *   object: 'account',
- *   operation: 'insert',
- *   check: 'tenant_id = current_user.tenant_id',
- *   enabled: true
- * }
- * ```
- *
- * @example Regional Sales Access
- * ```typescript
- * {
- *   name: 'regional_sales_access',
- *   label: 'Sales Reps Access Regional Accounts',
- *   object: 'account',
- *   operation: 'select',
- *   using: 'region = current_user.region OR region IS NULL',
- *   roles: ['sales_rep'],
- *   enabled: true
- * }
- * ```
- *
- * @example Time-Based Access Control
- * ```typescript
- * {
- *   name: 'active_records_only',
- *   label: 'Users Only Access Active Records',
- *   object: 'contract',
- *   operation: 'select',
- *   using: 'status = "active" AND start_date <= NOW() AND end_date >= NOW()',
- *   enabled: true
- * }
- * ```
- *
- * @example Hierarchical Access (Role-Based)
- * ```typescript
- * {
- *   name: 'executive_full_access',
- *   label: 'Executives See All Records',
- *   object: 'account',
- *   operation: 'all',
- *   using: '1 = 1', // Always true - see everything
- *   roles: ['ceo', 'cfo', 'cto'],
- *   enabled: true
- * }
- * ```
- */
-declare const RowLevelSecurityPolicySchema: z.ZodObject<{
-    name: z.ZodString;
-    label: z.ZodOptional<z.ZodString>;
-    description: z.ZodOptional<z.ZodString>;
-    object: z.ZodString;
-    operation: z.ZodEnum<{
-        insert: "insert";
-        update: "update";
-        delete: "delete";
-        select: "select";
-        all: "all";
-    }>;
-    using: z.ZodOptional<z.ZodString>;
-    check: z.ZodOptional<z.ZodString>;
-    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    enabled: z.ZodDefault<z.ZodBoolean>;
-    priority: z.ZodDefault<z.ZodNumber>;
-    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-/**
- * RLS Configuration Schema
- *
- * Global configuration for the Row-Level Security system.
- * Defines how RLS is enforced across the entire platform.
- */
-declare const RLSConfigSchema: z.ZodObject<{
-    enabled: z.ZodDefault<z.ZodBoolean>;
-    defaultPolicy: z.ZodDefault<z.ZodEnum<{
-        deny: "deny";
-        allow: "allow";
-    }>>;
-    allowSuperuserBypass: z.ZodDefault<z.ZodBoolean>;
-    bypassRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    logEvaluations: z.ZodDefault<z.ZodBoolean>;
-    cacheResults: z.ZodDefault<z.ZodBoolean>;
-    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
-    prefetchUserContext: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip>;
-/**
- * User Context Schema
- *
- * Represents the current user's context for RLS evaluation.
- * This data is used to evaluate USING and CHECK clauses.
- */
-declare const RLSUserContextSchema: z.ZodObject<{
-    id: z.ZodString;
-    email: z.ZodOptional<z.ZodString>;
-    tenantId: z.ZodOptional<z.ZodString>;
-    role: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
-    department: z.ZodOptional<z.ZodString>;
-    attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-}, z.core.$strip>;
-/**
- * RLS Policy Evaluation Result
- *
- * Result of evaluating an RLS policy for a specific record.
- * Used for debugging and audit logging.
- */
-declare const RLSEvaluationResultSchema: z.ZodObject<{
-    policyName: z.ZodString;
-    granted: z.ZodBoolean;
-    durationMs: z.ZodOptional<z.ZodNumber>;
-    error: z.ZodOptional<z.ZodString>;
-    usingResult: z.ZodOptional<z.ZodBoolean>;
-    checkResult: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strip>;
-/**
- * Type exports
- */
-type RowLevelSecurityPolicy = z.infer<typeof RowLevelSecurityPolicySchema>;
-type RLSConfig = z.infer<typeof RLSConfigSchema>;
-type RLSUserContext = z.infer<typeof RLSUserContextSchema>;
-type RLSEvaluationResult = z.infer<typeof RLSEvaluationResultSchema>;
-/**
- * Helper factory for creating RLS policies
- */
-declare const RLS: {
-    /**
-     * Create a simple owner-based policy
-     */
-    readonly ownerPolicy: (object: string, ownerField?: string) => RowLevelSecurityPolicy;
-    /**
-     * Create a tenant isolation policy
-     */
-    readonly tenantPolicy: (object: string, tenantField?: string) => RowLevelSecurityPolicy;
-    /**
-     * Create a role-based policy
-     */
-    readonly rolePolicy: (object: string, roles: string[], condition: string) => RowLevelSecurityPolicy;
-    /**
-     * Create a permissive policy (allow all for specific roles)
-     */
-    readonly allowAllPolicy: (object: string, roles: string[]) => RowLevelSecurityPolicy;
-};
-
-/**
- * Password Complexity Policy
- */
-declare const PasswordPolicySchema: z.ZodObject<{
-    minLength: z.ZodDefault<z.ZodNumber>;
-    requireUppercase: z.ZodDefault<z.ZodBoolean>;
-    requireLowercase: z.ZodDefault<z.ZodBoolean>;
-    requireNumbers: z.ZodDefault<z.ZodBoolean>;
-    requireSymbols: z.ZodDefault<z.ZodBoolean>;
-    expirationDays: z.ZodOptional<z.ZodNumber>;
-    historyCount: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip>;
-/**
- * Network Access Policy (IP Whitelisting)
- */
-declare const NetworkPolicySchema: z.ZodObject<{
-    trustedRanges: z.ZodArray<z.ZodString>;
-    blockUnknown: z.ZodDefault<z.ZodBoolean>;
-    vpnRequired: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip>;
-/**
- * Session Policy
- */
-declare const SessionPolicySchema: z.ZodObject<{
-    idleTimeout: z.ZodDefault<z.ZodNumber>;
-    absoluteTimeout: z.ZodDefault<z.ZodNumber>;
-    forceMfa: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip>;
-/**
- * Audit Retention Policy
- */
-declare const AuditPolicySchema: z.ZodObject<{
-    logRetentionDays: z.ZodDefault<z.ZodNumber>;
-    sensitiveFields: z.ZodArray<z.ZodString>;
-    captureRead: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip>;
-/**
- * Security Policy Schema
- * "The Cloud Compliance Contract"
- */
-declare const PolicySchema: z.ZodObject<{
-    name: z.ZodString;
-    password: z.ZodOptional<z.ZodObject<{
-        minLength: z.ZodDefault<z.ZodNumber>;
-        requireUppercase: z.ZodDefault<z.ZodBoolean>;
-        requireLowercase: z.ZodDefault<z.ZodBoolean>;
-        requireNumbers: z.ZodDefault<z.ZodBoolean>;
-        requireSymbols: z.ZodDefault<z.ZodBoolean>;
-        expirationDays: z.ZodOptional<z.ZodNumber>;
-        historyCount: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip>>;
-    network: z.ZodOptional<z.ZodObject<{
-        trustedRanges: z.ZodArray<z.ZodString>;
-        blockUnknown: z.ZodDefault<z.ZodBoolean>;
-        vpnRequired: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip>>;
-    session: z.ZodOptional<z.ZodObject<{
-        idleTimeout: z.ZodDefault<z.ZodNumber>;
-        absoluteTimeout: z.ZodDefault<z.ZodNumber>;
-        forceMfa: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip>>;
-    audit: z.ZodOptional<z.ZodObject<{
-        logRetentionDays: z.ZodDefault<z.ZodNumber>;
-        sensitiveFields: z.ZodArray<z.ZodString>;
-        captureRead: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip>>;
-    isDefault: z.ZodDefault<z.ZodBoolean>;
-    assignedProfiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-type Policy = z.infer<typeof PolicySchema>;
-
-/**
- * Permission Protocol Exports
- *
- * Fine-grained Access Control
- * - Permission Sets (CRUD + Field-Level Security)
- * - Sharing Rules (Record Ownership)
- * - Territory Management (Geographic/Hierarchical)
- * - Row-Level Security (RLS - PostgreSQL-style)
- */
-
-declare const index$2_AuditPolicySchema: typeof AuditPolicySchema;
-type index$2_CriteriaSharingRule = CriteriaSharingRule;
-declare const index$2_CriteriaSharingRuleSchema: typeof CriteriaSharingRuleSchema;
-type index$2_FieldPermission = FieldPermission;
-declare const index$2_FieldPermissionSchema: typeof FieldPermissionSchema;
-declare const index$2_NetworkPolicySchema: typeof NetworkPolicySchema;
-declare const index$2_OWDModel: typeof OWDModel;
-type index$2_ObjectPermission = ObjectPermission;
-declare const index$2_ObjectPermissionSchema: typeof ObjectPermissionSchema;
-type index$2_OwnerSharingRule = OwnerSharingRule;
-declare const index$2_OwnerSharingRuleSchema: typeof OwnerSharingRuleSchema;
-declare const index$2_PasswordPolicySchema: typeof PasswordPolicySchema;
-type index$2_PermissionSet = PermissionSet;
-declare const index$2_PermissionSetSchema: typeof PermissionSetSchema;
-type index$2_Policy = Policy;
-declare const index$2_PolicySchema: typeof PolicySchema;
-declare const index$2_RLS: typeof RLS;
-type index$2_RLSConfig = RLSConfig;
-declare const index$2_RLSConfigSchema: typeof RLSConfigSchema;
-type index$2_RLSEvaluationResult = RLSEvaluationResult;
-declare const index$2_RLSEvaluationResultSchema: typeof RLSEvaluationResultSchema;
-type index$2_RLSOperation = RLSOperation;
-type index$2_RLSUserContext = RLSUserContext;
-declare const index$2_RLSUserContextSchema: typeof RLSUserContextSchema;
-type index$2_RowLevelSecurityPolicy = RowLevelSecurityPolicy;
-declare const index$2_RowLevelSecurityPolicySchema: typeof RowLevelSecurityPolicySchema;
-declare const index$2_SessionPolicySchema: typeof SessionPolicySchema;
-declare const index$2_ShareRecipientType: typeof ShareRecipientType;
-declare const index$2_SharingLevel: typeof SharingLevel;
-type index$2_SharingRule = SharingRule;
-declare const index$2_SharingRuleSchema: typeof SharingRuleSchema;
-declare const index$2_SharingRuleType: typeof SharingRuleType;
-type index$2_Territory = Territory;
-type index$2_TerritoryModel = TerritoryModel;
-declare const index$2_TerritoryModelSchema: typeof TerritoryModelSchema;
-declare const index$2_TerritorySchema: typeof TerritorySchema;
-declare const index$2_TerritoryType: typeof TerritoryType;
+type index$2_AggregationFunction = AggregationFunction;
+declare const index$2_AggregationFunctionEnum: typeof AggregationFunctionEnum;
+type index$2_BaseMetadataRecord = BaseMetadataRecord;
+declare const index$2_BaseMetadataRecordSchema: typeof BaseMetadataRecordSchema;
+type index$2_CacheStrategy = CacheStrategy;
+declare const index$2_CacheStrategyEnum: typeof CacheStrategyEnum;
+declare const index$2_CorsConfig: typeof CorsConfig;
+declare const index$2_CorsConfigSchema: typeof CorsConfigSchema;
+type index$2_EventName = EventName;
+declare const index$2_EventNameSchema: typeof EventNameSchema;
+type index$2_FieldMapping = FieldMapping;
+declare const index$2_FieldMappingSchema: typeof FieldMappingSchema;
+declare const index$2_HttpMethod: typeof HttpMethod;
+type index$2_IsolationLevel = IsolationLevel;
+declare const index$2_IsolationLevelEnum: typeof IsolationLevelEnum;
+type index$2_MetadataFormat = MetadataFormat;
+declare const index$2_MetadataFormatSchema: typeof MetadataFormatSchema;
+type index$2_MutationEvent = MutationEvent;
+declare const index$2_MutationEventEnum: typeof MutationEventEnum;
+declare const index$2_RateLimitConfig: typeof RateLimitConfig;
+declare const index$2_RateLimitConfigSchema: typeof RateLimitConfigSchema;
+type index$2_SnakeCaseIdentifier = SnakeCaseIdentifier;
+declare const index$2_SnakeCaseIdentifierSchema: typeof SnakeCaseIdentifierSchema;
+type index$2_SortDirection = SortDirection;
+declare const index$2_SortDirectionEnum: typeof SortDirectionEnum;
+declare const index$2_StaticMount: typeof StaticMount;
+declare const index$2_StaticMountSchema: typeof StaticMountSchema;
+type index$2_SystemIdentifier = SystemIdentifier;
+declare const index$2_SystemIdentifierSchema: typeof SystemIdentifierSchema;
+type index$2_TransformType = TransformType;
+declare const index$2_TransformTypeSchema: typeof TransformTypeSchema;
 declare namespace index$2 {
-  export { index$2_AuditPolicySchema as AuditPolicySchema, type index$2_CriteriaSharingRule as CriteriaSharingRule, index$2_CriteriaSharingRuleSchema as CriteriaSharingRuleSchema, type index$2_FieldPermission as FieldPermission, index$2_FieldPermissionSchema as FieldPermissionSchema, index$2_NetworkPolicySchema as NetworkPolicySchema, index$2_OWDModel as OWDModel, type index$2_ObjectPermission as ObjectPermission, index$2_ObjectPermissionSchema as ObjectPermissionSchema, type index$2_OwnerSharingRule as OwnerSharingRule, index$2_OwnerSharingRuleSchema as OwnerSharingRuleSchema, index$2_PasswordPolicySchema as PasswordPolicySchema, type index$2_PermissionSet as PermissionSet, index$2_PermissionSetSchema as PermissionSetSchema, type index$2_Policy as Policy, index$2_PolicySchema as PolicySchema, index$2_RLS as RLS, type index$2_RLSConfig as RLSConfig, index$2_RLSConfigSchema as RLSConfigSchema, type index$2_RLSEvaluationResult as RLSEvaluationResult, index$2_RLSEvaluationResultSchema as RLSEvaluationResultSchema, type index$2_RLSOperation as RLSOperation, type index$2_RLSUserContext as RLSUserContext, index$2_RLSUserContextSchema as RLSUserContextSchema, type index$2_RowLevelSecurityPolicy as RowLevelSecurityPolicy, index$2_RowLevelSecurityPolicySchema as RowLevelSecurityPolicySchema, index$2_SessionPolicySchema as SessionPolicySchema, index$2_ShareRecipientType as ShareRecipientType, index$2_SharingLevel as SharingLevel, type index$2_SharingRule as SharingRule, index$2_SharingRuleSchema as SharingRuleSchema, index$2_SharingRuleType as SharingRuleType, type index$2_Territory as Territory, type index$2_TerritoryModel as TerritoryModel, index$2_TerritoryModelSchema as TerritoryModelSchema, index$2_TerritorySchema as TerritorySchema, index$2_TerritoryType as TerritoryType };
+  export { type index$2_AggregationFunction as AggregationFunction, index$2_AggregationFunctionEnum as AggregationFunctionEnum, type index$2_BaseMetadataRecord as BaseMetadataRecord, index$2_BaseMetadataRecordSchema as BaseMetadataRecordSchema, type index$2_CacheStrategy as CacheStrategy, index$2_CacheStrategyEnum as CacheStrategyEnum, index$2_CorsConfig as CorsConfig, index$2_CorsConfigSchema as CorsConfigSchema, type index$2_EventName as EventName, index$2_EventNameSchema as EventNameSchema, type index$2_FieldMapping as FieldMapping, index$2_FieldMappingSchema as FieldMappingSchema, index$2_HttpMethod as HttpMethod, type index$2_IsolationLevel as IsolationLevel, index$2_IsolationLevelEnum as IsolationLevelEnum, type index$2_MetadataFormat as MetadataFormat, index$2_MetadataFormatSchema as MetadataFormatSchema, type index$2_MutationEvent as MutationEvent, index$2_MutationEventEnum as MutationEventEnum, index$2_RateLimitConfig as RateLimitConfig, index$2_RateLimitConfigSchema as RateLimitConfigSchema, type index$2_SnakeCaseIdentifier as SnakeCaseIdentifier, index$2_SnakeCaseIdentifierSchema as SnakeCaseIdentifierSchema, type index$2_SortDirection as SortDirection, index$2_SortDirectionEnum as SortDirectionEnum, index$2_StaticMount as StaticMount, index$2_StaticMountSchema as StaticMountSchema, type index$2_SystemIdentifier as SystemIdentifier, index$2_SystemIdentifierSchema as SystemIdentifierSchema, type index$2_TransformType as TransformType, index$2_TransformTypeSchema as TransformTypeSchema };
 }
 
 declare const TestContextSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
@@ -14366,4 +13605,4 @@ type ObjectUICapabilities = z.infer<typeof ObjectUICapabilitiesSchema>;
 type ObjectOSCapabilities = z.infer<typeof ObjectOSCapabilitiesSchema>;
 type ObjectStackCapabilities = z.infer<typeof ObjectStackCapabilitiesSchema>;
 
-export { index as Identity, type ObjectOSCapabilities, ObjectOSCapabilitiesSchema, type ObjectQLCapabilities, ObjectQLCapabilitiesSchema, type ObjectStack, type ObjectStackCapabilities, ObjectStackCapabilitiesSchema, type ObjectStackDefinition, ObjectStackDefinitionSchema, ObjectStackSchema, type ObjectUICapabilities, ObjectUICapabilitiesSchema, index$1 as QA, index$2 as Security, index$3 as Shared, defineStack };
+export { index as Identity, type ObjectOSCapabilities, ObjectOSCapabilitiesSchema, type ObjectQLCapabilities, ObjectQLCapabilitiesSchema, type ObjectStack, type ObjectStackCapabilities, ObjectStackCapabilitiesSchema, type ObjectStackDefinition, ObjectStackDefinitionSchema, ObjectStackSchema, type ObjectUICapabilities, ObjectUICapabilitiesSchema, index$1 as QA, index$2 as Shared, defineStack };