@stndrds/schema 1.0.0-alpha.351 → 1.0.0-alpha.353

package/dist/{index-Lp5dhlhc.d.mts → index-C9eOBRL6.d.mts}

@@ -1,21 +1,14 @@
 
-import { n as Attribute } from "./attributes-BrWmES5w.mjs";
-import { r as Uuid } from "./utils-Cl3b_6d8.mjs";
-import { i as ValidationResult, r as ValidationMessages } from "./index-DggAjGTr.mjs";
+import { n as Attribute } from "./attributes-0MFN3D1T.mjs";
+import { r as Uuid } from "./utils-ByfbrMxt.mjs";
+import { i as ValidationResult, r as ValidationMessages } from "./index-D9Zkc3Zp.mjs";
 import { z as z$1 } from "zod";
 import { IconName } from "@stndrds/constants";
 //#region src/types/document-layout.d.ts
 interface DocumentLayout {
-  /** Named sub-folders auto-created at the top of the record's drive when first used via attach --variant. */
-  variants?: Record<string, DocumentLayoutVariant>;
   /** Dev-declared folder structures the user can instantiate via the UI inside a record's drive. */
   presets?: FolderPreset[];
 }
-interface DocumentLayoutVariant {
-  /** Display title for the auto-created sub-folder. */
-  title: string;
-  description?: string;
-}
 interface FolderPreset {
   id: string;
   label: string;
@@ -33,6 +26,45 @@ interface PresetNode {
 /** Max depth allowed for preset.structure to keep instantiation predictable. */
 declare const MAX_PRESET_DEPTH = 5;
 //#endregion
+//#region src/types/record-access.d.ts
+/** Roles a record access grant can carry (spec §5.1). */
+declare const RECORD_ACCESS_ROLES: readonly ["reader", "editor"];
+type RecordAccessRole = (typeof RECORD_ACCESS_ROLES)[number];
+/**
+ * Why a grant exists — the equivalent of Salesforce's `RowCause` (spec §3):
+ * automatic grants are recomputed without ever touching manual shares.
+ */
+declare const RECORD_ACCESS_SOURCES: readonly ["manual", "meeting_attendee"];
+type RecordAccessSource = (typeof RECORD_ACCESS_SOURCES)[number];
+/** What the reading actor may do with a record (spec §6.6). */
+type ViewerAccess = "owner" | "editor" | "reader" | "workspace";
+/** One beneficiary of a private record: its effective role and every source that grants it. */
+interface RecordAudienceGrant {
+  actorId: Uuid;
+  role: RecordAccessRole;
+  sources: RecordAccessSource[];
+}
+/** Who can reach a record beyond its owner (`GET /records/:object/:id/access`). */
+interface RecordAudience {
+  recordId: Uuid;
+  visibility: ResourceVisibility;
+  ownedBy: Uuid | null;
+  grants: RecordAudienceGrant[];
+}
+/** Narrow an untrusted value (HTTP body, CLI flag) to a grant role. */
+declare function parseRecordAccessRole(value: unknown): RecordAccessRole;
+/**
+ * The single derivation of `viewerAccess`, from the row's owner and the
+ * `viewer_grant` storage computed FOR this viewer. A private record that is
+ * neither owned nor granted can only have been read by the system reader,
+ * which reads and never writes: `reader`.
+ */
+declare function deriveViewerAccess(record: {
+  visibility: ResourceVisibility;
+  ownedBy: string | null;
+  viewerGrant?: RecordAccessRole | null;
+}, actorIds: readonly string[]): ViewerAccess;
+//#endregion
 //#region src/types/objects.d.ts
 /** Visibility scopes shared by resources that can be workspace-wide or actor-private. */
 declare const RESOURCE_VISIBILITIES: readonly ["workspace", "private"];
@@ -151,6 +183,13 @@ interface ObjectRecord<TValues extends Record<string, unknown> = Record<string,
   visibility: ResourceVisibility;
   /** Owning actor for private records; always null for workspace records. */
   ownedBy: Uuid | null;
+  /**
+   * What the reading actor may do with this record (spec §6.6): its owner,
+   * an editor or reader by grant, or any member of a workspace record.
+   * Computed for the viewer that read the row; absent on records built in
+   * memory and on rows read without a viewer. Never broadcast nor indexed.
+   */
+  viewerAccess?: ViewerAccess;
   /**
    * Display label computed from the object's labelExpression.
    * Computed dynamically based on record values.
@@ -342,4 +381,4 @@ declare function getMissingRequiredAttributes(objectDef: ObjectDefinition, data:
  */
 declare function isRecordComplete(objectDef: ObjectDefinition, data: Record<string, unknown>): boolean;
 //#endregion
-export { FolderPreset as A, ResourceVisibility as C, parseResourceVisibility as D, Timestamps as E, PresetNode as M, DocumentLayout as O, ReservedObjectName as S, SystemFieldName as T, ObjectRecord as _, validateDraft as a, RESOURCE_VISIBILITIES as b, validateObjectOrThrow as c, createAttributeValidator as d, createFormAttributeValidator as f, ObjectDefinition as g, ObjectAttribute as h, validateAttribute as i, MAX_PRESET_DEPTH as j, DocumentLayoutVariant as k, createDraftValidator as l, ListViewTabVisibility as m, isRecordComplete as n, validateDraftOrThrow as o, LIST_VIEW_TAB_VISIBILITIES as p, rejectUnknownAttributesOrThrow as r, validateObject as s, getMissingRequiredAttributes as t, createObjectValidator as u, RESERVED_ATTRIBUTE_NAMES as v, SYSTEM_FIELD_NAMES as w, ReservedAttributeName as x, RESERVED_OBJECT_NAMES as y };
+export { RecordAccessRole as A, PresetNode as B, ResourceVisibility as C, parseResourceVisibility as D, Timestamps as E, deriveViewerAccess as F, parseRecordAccessRole as I, DocumentLayout as L, RecordAudience as M, RecordAudienceGrant as N, RECORD_ACCESS_ROLES as O, ViewerAccess as P, FolderPreset as R, ReservedObjectName as S, SystemFieldName as T, ObjectRecord as _, validateDraft as a, RESOURCE_VISIBILITIES as b, validateObjectOrThrow as c, createAttributeValidator as d, createFormAttributeValidator as f, ObjectDefinition as g, ObjectAttribute as h, validateAttribute as i, RecordAccessSource as j, RECORD_ACCESS_SOURCES as k, createDraftValidator as l, ListViewTabVisibility as m, isRecordComplete as n, validateDraftOrThrow as o, LIST_VIEW_TAB_VISIBILITIES as p, rejectUnknownAttributesOrThrow as r, validateObject as s, getMissingRequiredAttributes as t, createObjectValidator as u, RESERVED_ATTRIBUTE_NAMES as v, SYSTEM_FIELD_NAMES as w, ReservedAttributeName as x, RESERVED_OBJECT_NAMES as y, MAX_PRESET_DEPTH as z };

package/dist/{index-DggAjGTr.d.mts → index-D9Zkc3Zp.d.mts}

@@ -1,5 +1,5 @@
 
-import { n as Attribute } from "./attributes-BrWmES5w.mjs";
+import { n as Attribute } from "./attributes-0MFN3D1T.mjs";
 import { z as z$1 } from "zod";
 //#region src/validation/core/types.d.ts
 /**

package/dist/{index-DCw-X_sc.d.ts → index-DcLDUWZd.d.ts}

@@ -1,21 +1,14 @@
 
-import { n as Attribute } from "./attributes-DF899HOt.js";
-import { r as Uuid } from "./utils-Cuz_wSKI.js";
-import { i as ValidationResult, r as ValidationMessages } from "./index-OvRk1isl.js";
+import { n as Attribute } from "./attributes-D3wn8qoZ.js";
+import { r as Uuid } from "./utils-DiHsvBLK.js";
+import { i as ValidationResult, r as ValidationMessages } from "./index-BxM_oMmi.js";
 import { z as z$1 } from "zod";
 import { IconName } from "@stndrds/constants";
 //#region src/types/document-layout.d.ts
 interface DocumentLayout {
-  /** Named sub-folders auto-created at the top of the record's drive when first used via attach --variant. */
-  variants?: Record<string, DocumentLayoutVariant>;
   /** Dev-declared folder structures the user can instantiate via the UI inside a record's drive. */
   presets?: FolderPreset[];
 }
-interface DocumentLayoutVariant {
-  /** Display title for the auto-created sub-folder. */
-  title: string;
-  description?: string;
-}
 interface FolderPreset {
   id: string;
   label: string;
@@ -33,6 +26,45 @@ interface PresetNode {
 /** Max depth allowed for preset.structure to keep instantiation predictable. */
 declare const MAX_PRESET_DEPTH = 5;
 //#endregion
+//#region src/types/record-access.d.ts
+/** Roles a record access grant can carry (spec §5.1). */
+declare const RECORD_ACCESS_ROLES: readonly ["reader", "editor"];
+type RecordAccessRole = (typeof RECORD_ACCESS_ROLES)[number];
+/**
+ * Why a grant exists — the equivalent of Salesforce's `RowCause` (spec §3):
+ * automatic grants are recomputed without ever touching manual shares.
+ */
+declare const RECORD_ACCESS_SOURCES: readonly ["manual", "meeting_attendee"];
+type RecordAccessSource = (typeof RECORD_ACCESS_SOURCES)[number];
+/** What the reading actor may do with a record (spec §6.6). */
+type ViewerAccess = "owner" | "editor" | "reader" | "workspace";
+/** One beneficiary of a private record: its effective role and every source that grants it. */
+interface RecordAudienceGrant {
+  actorId: Uuid;
+  role: RecordAccessRole;
+  sources: RecordAccessSource[];
+}
+/** Who can reach a record beyond its owner (`GET /records/:object/:id/access`). */
+interface RecordAudience {
+  recordId: Uuid;
+  visibility: ResourceVisibility;
+  ownedBy: Uuid | null;
+  grants: RecordAudienceGrant[];
+}
+/** Narrow an untrusted value (HTTP body, CLI flag) to a grant role. */
+declare function parseRecordAccessRole(value: unknown): RecordAccessRole;
+/**
+ * The single derivation of `viewerAccess`, from the row's owner and the
+ * `viewer_grant` storage computed FOR this viewer. A private record that is
+ * neither owned nor granted can only have been read by the system reader,
+ * which reads and never writes: `reader`.
+ */
+declare function deriveViewerAccess(record: {
+  visibility: ResourceVisibility;
+  ownedBy: string | null;
+  viewerGrant?: RecordAccessRole | null;
+}, actorIds: readonly string[]): ViewerAccess;
+//#endregion
 //#region src/types/objects.d.ts
 /** Visibility scopes shared by resources that can be workspace-wide or actor-private. */
 declare const RESOURCE_VISIBILITIES: readonly ["workspace", "private"];
@@ -151,6 +183,13 @@ interface ObjectRecord<TValues extends Record<string, unknown> = Record<string,
   visibility: ResourceVisibility;
   /** Owning actor for private records; always null for workspace records. */
   ownedBy: Uuid | null;
+  /**
+   * What the reading actor may do with this record (spec §6.6): its owner,
+   * an editor or reader by grant, or any member of a workspace record.
+   * Computed for the viewer that read the row; absent on records built in
+   * memory and on rows read without a viewer. Never broadcast nor indexed.
+   */
+  viewerAccess?: ViewerAccess;
   /**
    * Display label computed from the object's labelExpression.
    * Computed dynamically based on record values.
@@ -342,4 +381,4 @@ declare function getMissingRequiredAttributes(objectDef: ObjectDefinition, data:
  */
 declare function isRecordComplete(objectDef: ObjectDefinition, data: Record<string, unknown>): boolean;
 //#endregion
-export { FolderPreset as A, ResourceVisibility as C, parseResourceVisibility as D, Timestamps as E, PresetNode as M, DocumentLayout as O, ReservedObjectName as S, SystemFieldName as T, ObjectRecord as _, validateDraft as a, RESOURCE_VISIBILITIES as b, validateObjectOrThrow as c, createAttributeValidator as d, createFormAttributeValidator as f, ObjectDefinition as g, ObjectAttribute as h, validateAttribute as i, MAX_PRESET_DEPTH as j, DocumentLayoutVariant as k, createDraftValidator as l, ListViewTabVisibility as m, isRecordComplete as n, validateDraftOrThrow as o, LIST_VIEW_TAB_VISIBILITIES as p, rejectUnknownAttributesOrThrow as r, validateObject as s, getMissingRequiredAttributes as t, createObjectValidator as u, RESERVED_ATTRIBUTE_NAMES as v, SYSTEM_FIELD_NAMES as w, ReservedAttributeName as x, RESERVED_OBJECT_NAMES as y };
+export { RecordAccessRole as A, PresetNode as B, ResourceVisibility as C, parseResourceVisibility as D, Timestamps as E, deriveViewerAccess as F, parseRecordAccessRole as I, DocumentLayout as L, RecordAudience as M, RecordAudienceGrant as N, RECORD_ACCESS_ROLES as O, ViewerAccess as P, FolderPreset as R, ReservedObjectName as S, SystemFieldName as T, ObjectRecord as _, validateDraft as a, RESOURCE_VISIBILITIES as b, validateObjectOrThrow as c, createAttributeValidator as d, createFormAttributeValidator as f, ObjectDefinition as g, ObjectAttribute as h, validateAttribute as i, RecordAccessSource as j, RECORD_ACCESS_SOURCES as k, createDraftValidator as l, ListViewTabVisibility as m, isRecordComplete as n, validateDraftOrThrow as o, LIST_VIEW_TAB_VISIBILITIES as p, rejectUnknownAttributesOrThrow as r, validateObject as s, getMissingRequiredAttributes as t, createObjectValidator as u, RESERVED_ATTRIBUTE_NAMES as v, SYSTEM_FIELD_NAMES as w, ReservedAttributeName as x, RESERVED_OBJECT_NAMES as y, MAX_PRESET_DEPTH as z };