feat(spec)!: remove dead PolicySchema / definePolicy + stack policies (#1882, 11.0)

PolicySchema (org security policy: password/network/session/audit) was 100%
unenforced (no runtime reader). Per ADR-0049 enforce-or-remove, removed:

- spec: delete security/policy.zod.ts + drop the `policies` stack field and its
  collection wiring (MAP_SUPPORTED_FIELDS / METADATA_ALIASES in
  shared/metadata-collection.zod.ts + the stack key list).
- downstream-contract: drop DcPolicy fixture + contract case.
- examples app-crm/app-showcase: drop unused policy defs.
- regen api-surface (only the 8 Policy exports removed).

Verified downstream: ../hotcrm + ../templates have ZERO Policy-API usage
(templates only imports SharingRule, untouched). spec security 123 +
downstream-contract 14 + objectql 718 green; api-surface check ✓; spec/examples
build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

.changeset/v11-remove-policyschema.md

@@ -0,0 +1,22 @@
+---
+"@objectstack/spec": major
+---
+
+Remove the dead `PolicySchema` / `definePolicy` and the stack `policies` collection (#1882, ADR-0049).
+
+`PolicySchema` (password / network / session / audit "org security policy") was
+**100% unenforced** — no runtime consumer ever read it. Per ADR-0049
+(enforce-or-remove) it is removed rather than implemented:
+
+- `@objectstack/spec`: delete `security/policy.zod.ts` (`PolicySchema`,
+  `Password/Network/Session/AuditPolicySchema`, `definePolicy`); drop the
+  `policies` field from the stack schema and the `policies` collection wiring
+  (`MAP_SUPPORTED_FIELDS`, `METADATA_ALIASES`).
+- `@objectstack/downstream-contract`: drop the `DcPolicy` fixture/case (the
+  contract gate stays green — `SharingRule` / `PermissionSet` are unaffected).
+- Examples (`app-crm`, `app-showcase`): drop their unused policy definitions.
+
+No migration needed for consumers: `policies` was never enforced. `SharingRule`,
+`PermissionSet`, RLS, and all `*PolicySchema` siblings (retry/retention/RLS/etc.)
+are unrelated and unchanged. Verified: hotcrm + templates have zero Policy-API
+usage; downstream-contract gate green.

examples/app-crm/objectstack.config.ts

@@ -22,8 +22,6 @@ import {
   HighValueOpportunitySharingRule,
   RepLeadSharingRule,
   WonDealActivitySharingRule,
-  CrmDefaultPolicy,
-  CrmFinancePolicy,
 } from './src/security/index.js';
 import { CrmSeedData } from './src/data/index.js';
 import { LeadCsvImportMapping, ContactJsonSyncMapping } from './src/data/crm-mappings.js';
@@ -118,7 +116,6 @@ export default defineStack({
     RepLeadSharingRule,
     WonDealActivitySharingRule,
   ],
-  policies: [CrmDefaultPolicy, CrmFinancePolicy],
 
   // API
   apis: [PipelineSummaryEndpoint, LeadConvertEndpoint, MarketingWebhookEndpoint],

examples/app-crm/src/security/crm-policy.ts

@@ -14,4 +14,3 @@ export {
   WonDealActivitySharingRule,
 } from './sharing-rules.js';
 
-export { CrmDefaultPolicy, CrmFinancePolicy } from './crm-policy.js';

examples/app-crm/src/security/index.ts

@@ -33,7 +33,6 @@ import {
   allRoles,
   allPermissionSets,
   allSharingRules,
-  allPolicies,
 } from './src/security/index.js';
 import { allThemes } from './src/themes/index.js';
 import { ShowcaseTranslationBundle } from './src/translations/index.js';
@@ -174,7 +173,6 @@ export default defineStack({
   roles: allRoles,
   permissions: allPermissionSets,
   sharingRules: allSharingRules,
-  policies: allPolicies,
 
   // Seed data
   data: ShowcaseSeedData,

examples/app-showcase/objectstack.config.ts

@@ -172,24 +172,7 @@ export const ContributorTaskSharingRule = {
   active: true,
 };
 
-// ── Org security policy ─────────────────────────────────────────────────────
-export const ShowcasePolicy = {
-  name: 'showcase_default_policy',
-  password: {
-    minLength: 12,
-    requireUppercase: true,
-    requireLowercase: true,
-    requireNumbers: true,
-    requireSymbols: true,
-    expirationDays: 90,
-    historyCount: 5,
-  },
-  session: { idleTimeout: 30, absoluteTimeout: 480, forceMfa: false },
-  audit: { logRetentionDays: 365, sensitiveFields: ['budget', 'spent'], captureRead: false },
-  isDefault: true,
-};
 
 export const allRoles = [ContributorRole, ManagerRole, ExecRole];
 export const allPermissionSets = [ContributorPermissionSet, MemberDefaultProfile];
 export const allSharingRules = [RedProjectSharingRule, HighValueRedProjectRule, ContributorTaskSharingRule];
-export const allPolicies = [ShowcasePolicy];

examples/app-showcase/src/security/index.ts

@@ -7,7 +7,7 @@
 // and DO NOT edit them to make a failing spec change pass — see the README.
 import type { DatasourceInput, MappingInput, CubeInput, ObjectExtensionInput } from '@objectstack/spec/data';
 import type { ConnectorInput } from '@objectstack/spec/integration';
-import type { PolicyInput, SharingRuleInput, PermissionSetInput } from '@objectstack/spec/security';
+import type { SharingRuleInput, PermissionSetInput } from '@objectstack/spec/security';
 import type { RoleInput } from '@objectstack/spec/identity';
 import type { EmailTemplateDefinitionInput, TranslationBundleInput } from '@objectstack/spec/system';
 import type { WebhookInput } from '@objectstack/spec/automation';
@@ -43,13 +43,6 @@ export const DcConnector: ConnectorInput = {
   ],
 };
 
-export const DcPolicy: PolicyInput = {
-  name: 'dc_default_policy',
-  isDefault: true,
-  password: { minLength: 12, requireUppercase: true, requireNumbers: true },
-  session: { idleTimeout: 30, absoluteTimeout: 480 },
-};
-
 export const DcSharingRule: SharingRuleInput = {
   type: 'criteria',
   name: 'dc_share_customers',

packages/downstream-contract/src/additional-domains.fixtures.ts

@@ -4,7 +4,7 @@ import { describe, it, expect } from 'vitest';
 import { ActionSchema, ReportSchema, PageSchema, ThemeSchema } from '@objectstack/spec/ui';
 import { DatasourceSchema, MappingSchema, CubeSchema, ObjectExtensionSchema } from '@objectstack/spec/data';
 import { ConnectorSchema } from '@objectstack/spec/integration';
-import { PolicySchema, SharingRuleSchema, PermissionSetSchema } from '@objectstack/spec/security';
+import { SharingRuleSchema, PermissionSetSchema } from '@objectstack/spec/security';
 import { RoleSchema } from '@objectstack/spec/identity';
 import { EmailTemplateDefinitionSchema, TranslationBundleSchema } from '@objectstack/spec/system';
 import { WebhookSchema } from '@objectstack/spec/automation';
@@ -35,7 +35,6 @@ describe('downstream consumer contract (#2035)', () => {
   const cases: Array<[string, { parse: (v: unknown) => unknown }, unknown]> = [
     ['Datasource', DatasourceSchema, more.DcDatasource],
     ['Connector', ConnectorSchema, more.DcConnector],
-    ['Policy', PolicySchema, more.DcPolicy],
     ['SharingRule', SharingRuleSchema, more.DcSharingRule],
     ['Role', RoleSchema, more.DcRole],
     ['PermissionSet', PermissionSetSchema, more.DcPermissionSet],

packages/downstream-contract/test/contract.test.ts

@@ -14,7 +14,6 @@
   "defineObjectExtension": "sha256:5286253308912bb1",
   "definePage": "sha256:e80363c256809a11",
   "definePermissionSet": "sha256:67b188ae181994cd",
-  "definePolicy": "sha256:f66d2be4a3d5fe98",
   "defineReport": "sha256:f7e85ba0996a5824",
   "defineRole": "sha256:40b8e11786c4ecbb",
   "defineSharingRule": "sha256:03347645bbda2880",

packages/spec/api-surface-signatures.json

@@ -74,7 +74,6 @@
     "defineObjectExtension (function)",
     "definePage (function)",
     "definePermissionSet (function)",
-    "definePolicy (function)",
     "defineReport (function)",
     "defineRole (function)",
     "defineSharingRule (function)",
@@ -3777,26 +3776,20 @@
     "vercelStaticSiteConnectorExample (const)"
   ],
   "./security": [
-    "AuditPolicySchema (const)",
     "CriteriaSharingRule (type)",
     "CriteriaSharingRuleSchema (const)",
     "FieldPermission (type)",
     "FieldPermissionSchema (const)",
-    "NetworkPolicySchema (const)",
     "OWDModel (const)",
     "ObjectAccessScope (type)",
     "ObjectAccessScopeSchema (const)",
     "ObjectPermission (type)",
     "ObjectPermissionSchema (const)",
     "OwnerSharingRule (type)",
     "OwnerSharingRuleSchema (const)",
-    "PasswordPolicySchema (const)",
     "PermissionSet (type)",
     "PermissionSetInput (type)",
     "PermissionSetSchema (const)",
-    "Policy (type)",
-    "PolicyInput (type)",
-    "PolicySchema (const)",
     "RLS (const)",
     "RLSAuditConfig (type)",
     "RLSAuditConfigSchema (const)",
@@ -3811,7 +3804,6 @@
     "RLSUserContextSchema (const)",
     "RowLevelSecurityPolicy (type)",
     "RowLevelSecurityPolicySchema (const)",
-    "SessionPolicySchema (const)",
     "ShareRecipientType (const)",
     "SharingLevel (const)",
     "SharingRule (type)",
@@ -3824,7 +3816,6 @@
     "TerritorySchema (const)",
     "TerritoryType (const)",
     "definePermissionSet (function)",
-    "definePolicy (function)",
     "defineSharingRule (function)",
     "permissionForm (const)"
   ],