@objectstack/platform-objects 0.1.0

package/dist/index.js

@@ -0,0 +1,4209 @@
+'use strict';
+
+var data = require('@objectstack/spec/data');
+var ui = require('@objectstack/spec/ui');
+
+// src/identity/sys-user.object.ts
+var SysUser = data.ObjectSchema.create({
+  name: "sys_user",
+  label: "User",
+  pluralLabel: "Users",
+  icon: "user",
+  isSystem: true,
+  description: "User accounts for authentication",
+  displayNameField: "name",
+  titleFormat: "{name}",
+  compactLayout: ["name", "email", "email_verified"],
+  fields: {
+    // ── Identity (primary business fields) ───────────────────────
+    name: data.Field.text({
+      label: "Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    email: data.Field.email({
+      label: "Email",
+      required: true,
+      searchable: true,
+      group: "Identity"
+    }),
+    email_verified: data.Field.boolean({
+      label: "Email Verified",
+      defaultValue: false,
+      group: "Identity"
+    }),
+    two_factor_enabled: data.Field.boolean({
+      label: "Two-Factor Enabled",
+      defaultValue: false,
+      group: "Identity",
+      description: "Whether two-factor authentication is enabled for this user. Maintained by the better-auth `twoFactor` plugin."
+    }),
+    // ── Profile ──────────────────────────────────────────────────
+    image: data.Field.url({
+      label: "Profile Image",
+      required: false,
+      group: "Profile"
+    }),
+    // ── System (auto-managed, hidden from create/edit forms) ─────
+    id: data.Field.text({
+      label: "User ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["email"], unique: true },
+    { fields: ["created_at"], unique: false }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: true
+  },
+  validations: [
+    {
+      name: "email_unique",
+      type: "unique",
+      severity: "error",
+      message: "Email must be unique",
+      fields: ["email"],
+      caseSensitive: false
+    }
+  ]
+});
+var SysSession = data.ObjectSchema.create({
+  name: "sys_session",
+  label: "Session",
+  pluralLabel: "Sessions",
+  icon: "key",
+  isSystem: true,
+  description: "Active user sessions",
+  displayNameField: "user_id",
+  titleFormat: "Session \u2014 {user_id}",
+  compactLayout: ["user_id", "ip_address", "expires_at"],
+  fields: {
+    // ── Session owner & expiry ──────────────────────────────────
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      searchable: true,
+      group: "Session"
+    }),
+    expires_at: data.Field.datetime({
+      label: "Expires At",
+      required: true,
+      group: "Session"
+    }),
+    // ── Active context (multi-org/team) ──────────────────────────
+    active_organization_id: data.Field.lookup("sys_organization", {
+      label: "Active Organization",
+      required: false,
+      group: "Context"
+    }),
+    active_team_id: data.Field.lookup("sys_team", {
+      label: "Active Team",
+      required: false,
+      group: "Context"
+    }),
+    // ── Client fingerprint ───────────────────────────────────────
+    ip_address: data.Field.text({
+      label: "IP Address",
+      required: false,
+      maxLength: 45,
+      // Support IPv6
+      group: "Client"
+    }),
+    user_agent: data.Field.textarea({
+      label: "User Agent",
+      required: false,
+      group: "Client"
+    }),
+    // ── Secret (hidden by default) ──────────────────────────────
+    token: data.Field.text({
+      label: "Session Token",
+      required: true,
+      hidden: true,
+      readonly: true,
+      description: "Opaque session token \u2014 never exposed in UI",
+      group: "Secret"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: data.Field.text({
+      label: "Session ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["token"], unique: true },
+    { fields: ["user_id"], unique: false },
+    { fields: ["expires_at"], unique: false }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "delete"],
+    trash: false,
+    mru: false,
+    clone: false
+  }
+});
+var SysAccount = data.ObjectSchema.create({
+  name: "sys_account",
+  label: "Account",
+  pluralLabel: "Accounts",
+  icon: "link",
+  isSystem: true,
+  description: "OAuth and authentication provider accounts",
+  titleFormat: "{provider_id} - {account_id}",
+  compactLayout: ["provider_id", "user_id", "account_id"],
+  fields: {
+    id: data.Field.text({
+      label: "Account ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    provider_id: data.Field.text({
+      label: "Provider ID",
+      required: true,
+      description: "OAuth provider identifier (google, github, etc.)"
+    }),
+    account_id: data.Field.text({
+      label: "Provider Account ID",
+      required: true,
+      description: "User's ID in the provider's system"
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      description: "Link to user table"
+    }),
+    access_token: data.Field.textarea({
+      label: "Access Token",
+      required: false
+    }),
+    refresh_token: data.Field.textarea({
+      label: "Refresh Token",
+      required: false
+    }),
+    id_token: data.Field.textarea({
+      label: "ID Token",
+      required: false
+    }),
+    access_token_expires_at: data.Field.datetime({
+      label: "Access Token Expires At",
+      required: false
+    }),
+    refresh_token_expires_at: data.Field.datetime({
+      label: "Refresh Token Expires At",
+      required: false
+    }),
+    scope: data.Field.text({
+      label: "OAuth Scope",
+      required: false
+    }),
+    password: data.Field.text({
+      label: "Password Hash",
+      required: false,
+      description: "Hashed password for email/password provider"
+    })
+  },
+  indexes: [
+    { fields: ["user_id"], unique: false },
+    { fields: ["provider_id", "account_id"], unique: true }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var SysVerification = data.ObjectSchema.create({
+  name: "sys_verification",
+  label: "Verification",
+  pluralLabel: "Verifications",
+  icon: "shield-check",
+  isSystem: true,
+  description: "Email and phone verification tokens",
+  titleFormat: "Verification for {identifier}",
+  compactLayout: ["identifier", "expires_at", "created_at"],
+  fields: {
+    id: data.Field.text({
+      label: "Verification ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    value: data.Field.text({
+      label: "Verification Token",
+      required: true,
+      description: "Token or code for verification"
+    }),
+    expires_at: data.Field.datetime({
+      label: "Expires At",
+      required: true
+    }),
+    identifier: data.Field.text({
+      label: "Identifier",
+      required: true,
+      description: "Email address or phone number"
+    })
+  },
+  indexes: [
+    { fields: ["value"], unique: true },
+    { fields: ["identifier"], unique: false },
+    { fields: ["expires_at"], unique: false }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "create", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysOrganization = data.ObjectSchema.create({
+  name: "sys_organization",
+  label: "Organization",
+  pluralLabel: "Organizations",
+  icon: "building-2",
+  isSystem: true,
+  description: "Organizations for multi-tenant grouping",
+  displayNameField: "name",
+  titleFormat: "{name}",
+  compactLayout: ["name", "slug"],
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    name: data.Field.text({
+      label: "Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    slug: data.Field.text({
+      label: "Slug",
+      required: false,
+      searchable: true,
+      maxLength: 255,
+      description: "URL-friendly identifier",
+      group: "Identity"
+    }),
+    // ── Branding ─────────────────────────────────────────────────
+    logo: data.Field.url({
+      label: "Logo",
+      required: false,
+      group: "Branding"
+    }),
+    // ── Configuration ────────────────────────────────────────────
+    metadata: data.Field.textarea({
+      label: "Metadata",
+      required: false,
+      description: "JSON-serialized organization metadata",
+      group: "Configuration"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: data.Field.text({
+      label: "Organization ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["slug"], unique: true },
+    { fields: ["name"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: true
+  }
+});
+var SysMember = data.ObjectSchema.create({
+  name: "sys_member",
+  label: "Member",
+  pluralLabel: "Members",
+  icon: "user-check",
+  isSystem: true,
+  description: "Organization membership records",
+  titleFormat: "{user_id} in {organization_id}",
+  compactLayout: ["user_id", "organization_id", "role"],
+  fields: {
+    id: data.Field.text({
+      label: "Member ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    organization_id: data.Field.lookup("sys_organization", {
+      label: "Organization",
+      required: true
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: true
+    }),
+    role: data.Field.text({
+      label: "Role",
+      required: false,
+      description: "Member role within the organization (e.g. admin, member)",
+      maxLength: 100
+    })
+  },
+  indexes: [
+    { fields: ["organization_id", "user_id"], unique: true },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysInvitation = data.ObjectSchema.create({
+  name: "sys_invitation",
+  label: "Invitation",
+  pluralLabel: "Invitations",
+  icon: "mail",
+  isSystem: true,
+  description: "Organization invitations for user onboarding",
+  titleFormat: "Invitation to {organization_id}",
+  compactLayout: ["email", "organization_id", "status"],
+  fields: {
+    id: data.Field.text({
+      label: "Invitation ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    organization_id: data.Field.lookup("sys_organization", {
+      label: "Organization",
+      required: true
+    }),
+    email: data.Field.email({
+      label: "Email",
+      required: true,
+      description: "Email address of the invited user"
+    }),
+    role: data.Field.text({
+      label: "Role",
+      required: false,
+      maxLength: 100,
+      description: "Role to assign upon acceptance"
+    }),
+    status: data.Field.select(["pending", "accepted", "rejected", "expired", "canceled"], {
+      label: "Status",
+      required: true,
+      defaultValue: "pending"
+    }),
+    inviter_id: data.Field.lookup("sys_user", {
+      label: "Inviter",
+      required: true,
+      description: "User who sent the invitation"
+    }),
+    expires_at: data.Field.datetime({
+      label: "Expires At",
+      required: true
+    }),
+    team_id: data.Field.lookup("sys_team", {
+      label: "Team",
+      required: false,
+      description: "Optional team to assign upon acceptance"
+    })
+  },
+  indexes: [
+    { fields: ["organization_id"] },
+    { fields: ["email"] },
+    { fields: ["expires_at"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysTeam = data.ObjectSchema.create({
+  name: "sys_team",
+  label: "Team",
+  pluralLabel: "Teams",
+  icon: "users",
+  isSystem: true,
+  description: "Teams within organizations for fine-grained grouping",
+  displayNameField: "name",
+  titleFormat: "{name}",
+  compactLayout: ["name", "organization_id"],
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    name: data.Field.text({
+      label: "Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    organization_id: data.Field.lookup("sys_organization", {
+      label: "Organization",
+      required: true,
+      description: "Parent organization for this team",
+      group: "Identity"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: data.Field.text({
+      label: "Team ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["organization_id"] },
+    { fields: ["name", "organization_id"], unique: true }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var SysTeamMember = data.ObjectSchema.create({
+  name: "sys_team_member",
+  label: "Team Member",
+  pluralLabel: "Team Members",
+  icon: "user-plus",
+  isSystem: true,
+  description: "Team membership records linking users to teams",
+  titleFormat: "{user_id} in {team_id}",
+  compactLayout: ["user_id", "team_id", "created_at"],
+  fields: {
+    id: data.Field.text({
+      label: "Team Member ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    team_id: data.Field.lookup("sys_team", {
+      label: "Team",
+      required: true
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: true
+    })
+  },
+  indexes: [
+    { fields: ["team_id", "user_id"], unique: true },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysApiKey = data.ObjectSchema.create({
+  name: "sys_api_key",
+  label: "API Key",
+  pluralLabel: "API Keys",
+  icon: "key-round",
+  isSystem: true,
+  description: "API keys for programmatic access",
+  displayNameField: "name",
+  titleFormat: "{name}",
+  compactLayout: ["name", "prefix", "user_id", "expires_at", "revoked"],
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    name: data.Field.text({
+      label: "Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      description: "Human-readable label for the API key",
+      group: "Identity"
+    }),
+    prefix: data.Field.text({
+      label: "Prefix",
+      required: false,
+      maxLength: 16,
+      description: 'Visible prefix for identifying the key (e.g., "osk_")',
+      group: "Identity"
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "Owner",
+      required: true,
+      description: "User who owns this API key",
+      group: "Identity"
+    }),
+    // ── Access ───────────────────────────────────────────────────
+    scopes: data.Field.textarea({
+      label: "Scopes",
+      required: false,
+      description: "JSON array of permission scopes",
+      group: "Access"
+    }),
+    // ── Lifecycle ────────────────────────────────────────────────
+    expires_at: data.Field.datetime({
+      label: "Expires At",
+      required: false,
+      group: "Lifecycle"
+    }),
+    last_used_at: data.Field.datetime({
+      label: "Last Used At",
+      required: false,
+      readonly: true,
+      description: "Automatically updated on each API call",
+      group: "Lifecycle"
+    }),
+    revoked: data.Field.boolean({
+      label: "Revoked",
+      defaultValue: false,
+      group: "Lifecycle"
+    }),
+    // ── Secret (hidden by default) ──────────────────────────────
+    key: data.Field.text({
+      label: "Hashed Key",
+      required: true,
+      hidden: true,
+      readonly: true,
+      description: "Hashed API key value \u2014 never exposed to clients",
+      group: "Secret"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: data.Field.text({
+      label: "API Key ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["key"], unique: true },
+    { fields: ["user_id"] },
+    { fields: ["prefix"] },
+    { fields: ["revoked"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysTwoFactor = data.ObjectSchema.create({
+  name: "sys_two_factor",
+  label: "Two Factor",
+  pluralLabel: "Two Factor Credentials",
+  icon: "smartphone",
+  isSystem: true,
+  description: "Two-factor authentication credentials",
+  titleFormat: "Two-factor for {user_id}",
+  compactLayout: ["user_id", "created_at"],
+  fields: {
+    id: data.Field.text({
+      label: "Two Factor ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: true
+    }),
+    secret: data.Field.text({
+      label: "Secret",
+      required: true,
+      description: "TOTP secret key"
+    }),
+    backup_codes: data.Field.textarea({
+      label: "Backup Codes",
+      required: false,
+      description: "JSON-serialized backup recovery codes"
+    })
+  },
+  indexes: [
+    { fields: ["user_id"], unique: true }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysDeviceCode = data.ObjectSchema.create({
+  name: "sys_device_code",
+  label: "Device Code",
+  pluralLabel: "Device Codes",
+  icon: "key-round",
+  isSystem: true,
+  description: "OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests",
+  titleFormat: "{user_code}",
+  compactLayout: ["user_code", "status", "client_id", "expires_at"],
+  fields: {
+    id: data.Field.text({
+      label: "Device Code ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    /** High-entropy token returned to the device (CLI). Polled at /device/token. */
+    device_code: data.Field.text({
+      label: "Device Code",
+      required: true,
+      description: "High-entropy token returned to the polling device"
+    }),
+    /** Human-readable short code displayed to the user (e.g. ABCD-EFGH). */
+    user_code: data.Field.text({
+      label: "User Code",
+      required: true,
+      description: "Short user-facing code (e.g. ABCD-EFGH)"
+    }),
+    /** Owning user — populated when the request is approved. */
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: false,
+      description: "User who approved the device authorization"
+    }),
+    expires_at: data.Field.datetime({
+      label: "Expires At",
+      required: true,
+      description: "When the device & user codes are no longer valid"
+    }),
+    /** 'pending' | 'approved' | 'denied' */
+    status: data.Field.text({
+      label: "Status",
+      required: true,
+      description: "Current status: 'pending' | 'approved' | 'denied'"
+    }),
+    last_polled_at: data.Field.datetime({
+      label: "Last Polled At",
+      required: false,
+      description: "Timestamp of the most recent /device/token poll"
+    }),
+    polling_interval: data.Field.number({
+      label: "Polling Interval (ms)",
+      required: false,
+      description: "Server-recommended minimum polling interval, in ms"
+    }),
+    client_id: data.Field.text({
+      label: "Client ID",
+      required: false,
+      description: "OAuth client identifier of the requesting device"
+    }),
+    scope: data.Field.text({
+      label: "Scope",
+      required: false,
+      description: "Space-separated OAuth scopes requested by the device"
+    })
+  },
+  indexes: [
+    { fields: ["device_code"], unique: true },
+    { fields: ["user_code"], unique: true },
+    { fields: ["status"], unique: false }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysUserPreference = data.ObjectSchema.create({
+  name: "sys_user_preference",
+  label: "User Preference",
+  pluralLabel: "User Preferences",
+  icon: "settings",
+  isSystem: true,
+  description: "Per-user key-value preferences (theme, locale, etc.)",
+  titleFormat: "{key}",
+  compactLayout: ["user_id", "key"],
+  fields: {
+    id: data.Field.text({
+      label: "Preference ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      description: "Owner user of this preference"
+    }),
+    key: data.Field.text({
+      label: "Key",
+      required: true,
+      maxLength: 255,
+      description: "Preference key (e.g., theme, locale, plugin.ai.auto_save)"
+    }),
+    value: data.Field.json({
+      label: "Value",
+      description: "Preference value (any JSON-serializable type)"
+    })
+  },
+  indexes: [
+    { fields: ["user_id", "key"], unique: true },
+    { fields: ["user_id"], unique: false }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysOauthApplication = data.ObjectSchema.create({
+  name: "sys_oauth_application",
+  label: "OAuth Application",
+  pluralLabel: "OAuth Applications",
+  icon: "key-round",
+  isSystem: true,
+  description: "Registered OAuth/OIDC client applications",
+  displayNameField: "name",
+  titleFormat: "{name}",
+  compactLayout: ["name", "client_id", "type", "disabled"],
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    id: data.Field.text({
+      label: "ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    name: data.Field.text({
+      label: "Name",
+      required: false,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    icon: data.Field.url({
+      label: "Icon",
+      required: false,
+      description: "Logo URL shown on the consent screen",
+      group: "Identity"
+    }),
+    uri: data.Field.url({
+      label: "Home URI",
+      required: false,
+      description: "Public homepage of the registered client",
+      group: "Identity"
+    }),
+    contacts: data.Field.textarea({
+      label: "Contacts",
+      required: false,
+      description: "JSON-serialized list of contact email addresses",
+      group: "Identity"
+    }),
+    tos: data.Field.url({
+      label: "Terms of Service",
+      required: false,
+      group: "Identity"
+    }),
+    policy: data.Field.url({
+      label: "Privacy Policy",
+      required: false,
+      group: "Identity"
+    }),
+    metadata: data.Field.textarea({
+      label: "Metadata",
+      required: false,
+      description: "JSON-serialized application metadata",
+      group: "Identity"
+    }),
+    // ── OAuth Credentials ────────────────────────────────────────
+    client_id: data.Field.text({
+      label: "Client ID",
+      required: true,
+      readonly: true,
+      maxLength: 255,
+      description: "Public OAuth client identifier",
+      group: "Credentials"
+    }),
+    client_secret: data.Field.text({
+      label: "Client Secret",
+      required: false,
+      maxLength: 1024,
+      description: "OAuth client secret (hashed/encrypted at rest)",
+      group: "Credentials"
+    }),
+    redirect_uris: data.Field.textarea({
+      label: "Redirect URIs",
+      required: true,
+      description: "JSON-serialized list of allowed redirect URIs",
+      group: "Credentials"
+    }),
+    post_logout_redirect_uris: data.Field.textarea({
+      label: "Post-logout Redirect URIs",
+      required: false,
+      description: "JSON-serialized list of allowed post-logout redirect URIs",
+      group: "Credentials"
+    }),
+    type: data.Field.select(["web", "native", "user-agent-based", "public"], {
+      label: "Client Type",
+      required: false,
+      defaultValue: "web",
+      group: "Credentials"
+    }),
+    public: data.Field.boolean({
+      label: "Public Client",
+      required: false,
+      description: "Marks the client as a public (non-confidential) OAuth client",
+      group: "Credentials"
+    }),
+    require_pkce: data.Field.boolean({
+      label: "Require PKCE",
+      required: false,
+      group: "Credentials"
+    }),
+    token_endpoint_auth_method: data.Field.text({
+      label: "Token Endpoint Auth Method",
+      required: false,
+      maxLength: 64,
+      description: "e.g. client_secret_basic, client_secret_post, none",
+      group: "Credentials"
+    }),
+    grant_types: data.Field.textarea({
+      label: "Grant Types",
+      required: false,
+      description: "JSON-serialized list of allowed grant types",
+      group: "Credentials"
+    }),
+    response_types: data.Field.textarea({
+      label: "Response Types",
+      required: false,
+      description: "JSON-serialized list of allowed response types",
+      group: "Credentials"
+    }),
+    scopes: data.Field.textarea({
+      label: "Allowed Scopes",
+      required: false,
+      description: "JSON-serialized list of scopes the client may request",
+      group: "Credentials"
+    }),
+    subject_type: data.Field.text({
+      label: "Subject Type",
+      required: false,
+      maxLength: 32,
+      description: "OIDC subject type (e.g. public, pairwise)",
+      group: "Credentials"
+    }),
+    // ── Behaviour flags ──────────────────────────────────────────
+    disabled: data.Field.boolean({
+      label: "Disabled",
+      required: false,
+      defaultValue: false,
+      group: "Behaviour"
+    }),
+    skip_consent: data.Field.boolean({
+      label: "Skip Consent",
+      required: false,
+      description: "Treat as a trusted client and bypass the consent screen",
+      group: "Behaviour"
+    }),
+    enable_end_session: data.Field.boolean({
+      label: "Enable End Session",
+      required: false,
+      description: "Allow the client to call the OIDC end-session endpoint",
+      group: "Behaviour"
+    }),
+    // ── Software statement (RFC 7591 §2.3) ───────────────────────
+    software_id: data.Field.text({
+      label: "Software ID",
+      required: false,
+      maxLength: 255,
+      group: "Software"
+    }),
+    software_version: data.Field.text({
+      label: "Software Version",
+      required: false,
+      maxLength: 64,
+      group: "Software"
+    }),
+    software_statement: data.Field.textarea({
+      label: "Software Statement",
+      required: false,
+      description: "Signed JWT asserting the client metadata (RFC 7591 \xA72.3)",
+      group: "Software"
+    }),
+    // ── Ownership / system ───────────────────────────────────────
+    user_id: data.Field.lookup("sys_user", {
+      label: "Owner User",
+      required: false,
+      description: "User who registered this application",
+      group: "System"
+    }),
+    reference_id: data.Field.text({
+      label: "Reference ID",
+      required: false,
+      maxLength: 255,
+      description: "Caller-supplied correlation identifier",
+      group: "System"
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["client_id"], unique: true },
+    { fields: ["user_id"] },
+    { fields: ["reference_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysOauthAccessToken = data.ObjectSchema.create({
+  name: "sys_oauth_access_token",
+  label: "OAuth Access Token",
+  pluralLabel: "OAuth Access Tokens",
+  icon: "ticket",
+  isSystem: true,
+  description: "Opaque OAuth access tokens issued to client applications",
+  compactLayout: ["client_id", "user_id", "expires_at"],
+  fields: {
+    id: data.Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    token: data.Field.text({
+      label: "Token",
+      required: true,
+      maxLength: 1024,
+      description: "Opaque access token value"
+    }),
+    client_id: data.Field.text({
+      label: "Client ID",
+      required: true,
+      description: "Foreign key to sys_oauth_application.client_id"
+    }),
+    session_id: data.Field.lookup("sys_session", {
+      label: "Session",
+      required: false,
+      description: "Foreign key to sys_session.id"
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: false,
+      description: "Foreign key to sys_user.id"
+    }),
+    refresh_id: data.Field.lookup("sys_oauth_refresh_token", {
+      label: "Refresh Token",
+      required: false,
+      description: "Foreign key to sys_oauth_refresh_token.id"
+    }),
+    reference_id: data.Field.text({
+      label: "Reference ID",
+      required: false,
+      maxLength: 255,
+      description: "Caller-supplied correlation identifier"
+    }),
+    scopes: data.Field.textarea({
+      label: "Scopes",
+      required: true,
+      description: "JSON-serialized list of scopes granted to this token"
+    }),
+    expires_at: data.Field.datetime({
+      label: "Expires At",
+      required: true
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["token"], unique: true },
+    { fields: ["client_id"] },
+    { fields: ["session_id"] },
+    { fields: ["user_id"] },
+    { fields: ["refresh_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
+var SysOauthRefreshToken = data.ObjectSchema.create({
+  name: "sys_oauth_refresh_token",
+  label: "OAuth Refresh Token",
+  pluralLabel: "OAuth Refresh Tokens",
+  icon: "refresh-cw",
+  isSystem: true,
+  description: "Opaque OAuth refresh tokens (linked to a session)",
+  compactLayout: ["client_id", "user_id", "expires_at"],
+  fields: {
+    id: data.Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    token: data.Field.text({
+      label: "Token",
+      required: true,
+      maxLength: 1024,
+      description: "Opaque refresh token value"
+    }),
+    client_id: data.Field.text({
+      label: "Client ID",
+      required: true,
+      description: "Foreign key to sys_oauth_application.client_id"
+    }),
+    session_id: data.Field.lookup("sys_session", {
+      label: "Session",
+      required: false,
+      description: "Foreign key to sys_session.id"
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      description: "Foreign key to sys_user.id"
+    }),
+    reference_id: data.Field.text({
+      label: "Reference ID",
+      required: false,
+      maxLength: 255,
+      description: "Caller-supplied correlation identifier"
+    }),
+    scopes: data.Field.textarea({
+      label: "Scopes",
+      required: true,
+      description: "JSON-serialized list of scopes granted to this token"
+    }),
+    expires_at: data.Field.datetime({
+      label: "Expires At",
+      required: true
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    revoked: data.Field.datetime({
+      label: "Revoked At",
+      required: false,
+      description: "Timestamp at which this refresh token was revoked"
+    }),
+    auth_time: data.Field.datetime({
+      label: "Auth Time",
+      required: false,
+      description: "When the user originally authenticated for this token chain"
+    })
+  },
+  indexes: [
+    { fields: ["token"], unique: true },
+    { fields: ["client_id"] },
+    { fields: ["session_id"] },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
+var SysOauthConsent = data.ObjectSchema.create({
+  name: "sys_oauth_consent",
+  label: "OAuth Consent",
+  pluralLabel: "OAuth Consents",
+  icon: "shield-check",
+  isSystem: true,
+  description: "User consent records for OAuth client applications",
+  compactLayout: ["client_id", "user_id", "scopes"],
+  fields: {
+    id: data.Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    client_id: data.Field.text({
+      label: "Client ID",
+      required: true,
+      description: "Foreign key to sys_oauth_application.client_id"
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: false,
+      description: "Foreign key to sys_user.id"
+    }),
+    reference_id: data.Field.text({
+      label: "Reference ID",
+      required: false,
+      maxLength: 255,
+      description: "Caller-supplied correlation identifier"
+    }),
+    scopes: data.Field.textarea({
+      label: "Scopes",
+      required: true,
+      description: "JSON-serialized list of scopes the user consented to"
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["client_id"] },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
+var SysJwks = data.ObjectSchema.create({
+  name: "sys_jwks",
+  label: "JWKS Key",
+  pluralLabel: "JWKS Keys",
+  icon: "key",
+  isSystem: true,
+  description: "Asymmetric key pairs used to sign and verify issued JWTs",
+  compactLayout: ["id", "created_at", "expires_at"],
+  fields: {
+    id: data.Field.text({
+      label: "Key ID",
+      required: true,
+      readonly: true,
+      description: "JWK `kid` value"
+    }),
+    public_key: data.Field.textarea({
+      label: "Public Key",
+      required: true,
+      description: "JSON-serialized JWK public key"
+    }),
+    private_key: data.Field.textarea({
+      label: "Private Key",
+      required: true,
+      description: "JSON-serialized JWK private key (encrypted at rest)"
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      required: true,
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    expires_at: data.Field.datetime({
+      label: "Expires At",
+      required: false,
+      description: "When the key may no longer be used to verify tokens"
+    })
+  },
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
+var SysRole = data.ObjectSchema.create({
+  name: "sys_role",
+  label: "Role",
+  pluralLabel: "Roles",
+  icon: "shield",
+  isSystem: true,
+  description: "Role definitions for RBAC access control",
+  displayNameField: "label",
+  titleFormat: "{label}",
+  compactLayout: ["label", "name", "active", "is_default"],
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    label: data.Field.text({
+      label: "Display Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    name: data.Field.text({
+      label: "API Name",
+      required: true,
+      searchable: true,
+      maxLength: 100,
+      description: "Unique machine name for the role (e.g. admin, editor, viewer)",
+      group: "Identity"
+    }),
+    description: data.Field.textarea({
+      label: "Description",
+      required: false,
+      group: "Identity"
+    }),
+    // ── Configuration ────────────────────────────────────────────
+    permissions: data.Field.textarea({
+      label: "Permissions",
+      required: false,
+      description: "JSON-serialized array of permission strings",
+      group: "Configuration"
+    }),
+    // ── Status ───────────────────────────────────────────────────
+    active: data.Field.boolean({
+      label: "Active",
+      defaultValue: true,
+      group: "Status"
+    }),
+    is_default: data.Field.boolean({
+      label: "Default Role",
+      defaultValue: false,
+      description: "Automatically assigned to new users",
+      group: "Status"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: data.Field.text({
+      label: "Role ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["name"], unique: true },
+    { fields: ["active"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: true
+  }
+});
+var SysPermissionSet = data.ObjectSchema.create({
+  name: "sys_permission_set",
+  label: "Permission Set",
+  pluralLabel: "Permission Sets",
+  icon: "lock",
+  isSystem: true,
+  description: "Named permission groupings for fine-grained access control",
+  displayNameField: "label",
+  titleFormat: "{label}",
+  compactLayout: ["label", "name", "active"],
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    label: data.Field.text({
+      label: "Display Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    name: data.Field.text({
+      label: "API Name",
+      required: true,
+      searchable: true,
+      maxLength: 100,
+      description: "Unique machine name for the permission set",
+      group: "Identity"
+    }),
+    description: data.Field.textarea({
+      label: "Description",
+      required: false,
+      group: "Identity"
+    }),
+    // ── Permissions ──────────────────────────────────────────────
+    object_permissions: data.Field.textarea({
+      label: "Object Permissions",
+      required: false,
+      description: "JSON-serialized object-level CRUD permissions",
+      group: "Permissions"
+    }),
+    field_permissions: data.Field.textarea({
+      label: "Field Permissions",
+      required: false,
+      description: "JSON-serialized field-level read/write permissions",
+      group: "Permissions"
+    }),
+    // ── Status ───────────────────────────────────────────────────
+    active: data.Field.boolean({
+      label: "Active",
+      defaultValue: true,
+      group: "Status"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: data.Field.text({
+      label: "Permission Set ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["name"], unique: true },
+    { fields: ["active"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: true
+  }
+});
+var SysAuditLog = data.ObjectSchema.create({
+  name: "sys_audit_log",
+  label: "Audit Log",
+  pluralLabel: "Audit Logs",
+  icon: "scroll-text",
+  isSystem: true,
+  description: "Immutable audit trail for platform events",
+  displayNameField: "action",
+  titleFormat: "{action} \xB7 {object_name}",
+  compactLayout: ["created_at", "action", "object_name", "record_id", "user_id"],
+  fields: {
+    // ── Event ────────────────────────────────────────────────────
+    created_at: data.Field.datetime({
+      label: "Timestamp",
+      required: true,
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "Event"
+    }),
+    action: data.Field.select(
+      ["create", "update", "delete", "restore", "login", "logout", "permission_change", "config_change", "export", "import"],
+      {
+        label: "Action",
+        required: true,
+        readonly: true,
+        searchable: true,
+        description: "Action type (snake_case)",
+        group: "Event"
+      }
+    ),
+    user_id: data.Field.lookup("sys_user", {
+      label: "Actor",
+      required: false,
+      readonly: true,
+      searchable: true,
+      description: "User who performed the action (null for system actions)",
+      group: "Event"
+    }),
+    // ── Target record ────────────────────────────────────────────
+    object_name: data.Field.text({
+      label: "Object",
+      required: false,
+      readonly: true,
+      searchable: true,
+      maxLength: 255,
+      description: "Target object (e.g. sys_user, project_task)",
+      group: "Target"
+    }),
+    record_id: data.Field.text({
+      label: "Record ID",
+      required: false,
+      readonly: true,
+      searchable: true,
+      description: "ID of the affected record",
+      group: "Target"
+    }),
+    // ── Change payload ───────────────────────────────────────────
+    old_value: data.Field.textarea({
+      label: "Old Value",
+      required: false,
+      readonly: true,
+      description: "JSON-serialized previous state",
+      group: "Changes"
+    }),
+    new_value: data.Field.textarea({
+      label: "New Value",
+      required: false,
+      readonly: true,
+      description: "JSON-serialized new state",
+      group: "Changes"
+    }),
+    // ── Client fingerprint ───────────────────────────────────────
+    ip_address: data.Field.text({
+      label: "IP Address",
+      required: false,
+      readonly: true,
+      maxLength: 45,
+      group: "Client"
+    }),
+    user_agent: data.Field.textarea({
+      label: "User Agent",
+      required: false,
+      readonly: true,
+      group: "Client"
+    }),
+    // ── Context ──────────────────────────────────────────────────
+    tenant_id: data.Field.lookup("sys_organization", {
+      label: "Tenant",
+      required: false,
+      readonly: true,
+      description: "Tenant context for multi-tenant isolation",
+      group: "Context"
+    }),
+    metadata: data.Field.textarea({
+      label: "Metadata",
+      required: false,
+      readonly: true,
+      description: "JSON-serialized additional context",
+      group: "Context"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: data.Field.text({
+      label: "Audit Log ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["created_at"] },
+    { fields: ["user_id"] },
+    { fields: ["object_name", "record_id"] },
+    { fields: ["action"] },
+    { fields: ["tenant_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    // Audit logs are themselves the audit trail
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list"],
+    // Read-only — creation happens via internal system hooks only
+    trash: false,
+    // Never soft-delete audit logs
+    mru: false,
+    clone: false
+  }
+});
+var SysPresence = data.ObjectSchema.create({
+  name: "sys_presence",
+  label: "Presence",
+  pluralLabel: "Presences",
+  icon: "wifi",
+  isSystem: true,
+  description: "Real-time user presence and activity tracking",
+  titleFormat: "{user_id} ({status})",
+  compactLayout: ["user_id", "status", "last_seen"],
+  fields: {
+    id: data.Field.text({
+      label: "Presence ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      searchable: true
+    }),
+    session_id: data.Field.lookup("sys_session", {
+      label: "Session",
+      required: true
+    }),
+    status: data.Field.select({
+      label: "Status",
+      required: true,
+      defaultValue: "online",
+      options: [
+        { value: "online", label: "Online" },
+        { value: "away", label: "Away" },
+        { value: "busy", label: "Busy" },
+        { value: "offline", label: "Offline" }
+      ]
+    }),
+    last_seen: data.Field.datetime({
+      label: "Last Seen",
+      required: true,
+      defaultValue: "NOW()"
+    }),
+    current_location: data.Field.text({
+      label: "Current Location",
+      required: false,
+      maxLength: 500
+    }),
+    device: data.Field.select({
+      label: "Device",
+      required: false,
+      options: [
+        { value: "desktop", label: "Desktop" },
+        { value: "mobile", label: "Mobile" },
+        { value: "tablet", label: "Tablet" },
+        { value: "other", label: "Other" }
+      ]
+    }),
+    custom_status: data.Field.text({
+      label: "Custom Status",
+      required: false,
+      maxLength: 255
+    }),
+    metadata: data.Field.json({
+      label: "Metadata",
+      required: false,
+      description: "Arbitrary JSON metadata associated with the presence state (matches PresenceStateSchema.metadata)."
+    })
+  },
+  indexes: [
+    { fields: ["user_id"], unique: false },
+    { fields: ["session_id"], unique: true },
+    { fields: ["status"], unique: false }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysActivity = data.ObjectSchema.create({
+  name: "sys_activity",
+  label: "Activity",
+  pluralLabel: "Activities",
+  icon: "activity",
+  isSystem: true,
+  description: "Recent activity stream entries (lightweight, denormalized)",
+  displayNameField: "summary",
+  titleFormat: "{type} \xB7 {summary}",
+  compactLayout: ["timestamp", "type", "actor_name", "summary"],
+  fields: {
+    id: data.Field.text({
+      label: "Activity ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    timestamp: data.Field.datetime({
+      label: "Timestamp",
+      required: true,
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "Event"
+    }),
+    type: data.Field.select(
+      [
+        "created",
+        "updated",
+        "deleted",
+        "commented",
+        "mentioned",
+        "shared",
+        "assigned",
+        "completed",
+        "login",
+        "logout",
+        "system"
+      ],
+      {
+        label: "Type",
+        required: true,
+        readonly: true,
+        searchable: true,
+        group: "Event"
+      }
+    ),
+    summary: data.Field.text({
+      label: "Summary",
+      required: true,
+      readonly: true,
+      maxLength: 500,
+      searchable: true,
+      description: "Human-readable one-line summary",
+      group: "Event"
+    }),
+    // ── Actor ───────────────────────────────────────────────────
+    actor_id: data.Field.lookup("sys_user", {
+      label: "Actor",
+      required: false,
+      readonly: true,
+      searchable: true,
+      group: "Actor"
+    }),
+    actor_name: data.Field.text({
+      label: "Actor Name",
+      required: false,
+      readonly: true,
+      group: "Actor"
+    }),
+    actor_avatar_url: data.Field.url({
+      label: "Actor Avatar",
+      required: false,
+      readonly: true,
+      group: "Actor"
+    }),
+    // ── Target ───────────────────────────────────────────────────
+    object_name: data.Field.text({
+      label: "Object",
+      required: false,
+      readonly: true,
+      searchable: true,
+      maxLength: 255,
+      description: "Target object short name (e.g. account, sys_user)",
+      group: "Target"
+    }),
+    record_id: data.Field.text({
+      label: "Record ID",
+      required: false,
+      readonly: true,
+      searchable: true,
+      group: "Target"
+    }),
+    record_label: data.Field.text({
+      label: "Record Label",
+      required: false,
+      readonly: true,
+      maxLength: 255,
+      description: "Display label of the target record at write time",
+      group: "Target"
+    }),
+    url: data.Field.url({
+      label: "URL",
+      required: false,
+      readonly: true,
+      description: "Optional deep-link to the activity target",
+      group: "Target"
+    }),
+    // ── Context ──────────────────────────────────────────────────
+    project_id: data.Field.lookup("sys_project", {
+      label: "Project",
+      required: false,
+      readonly: true,
+      searchable: true,
+      description: "Project context (multi-project deployments)",
+      group: "Context"
+    }),
+    metadata: data.Field.textarea({
+      label: "Metadata",
+      required: false,
+      readonly: true,
+      description: "JSON-serialized additional context",
+      group: "Context"
+    })
+  },
+  indexes: [
+    { fields: ["timestamp"] },
+    { fields: ["actor_id"] },
+    { fields: ["object_name", "record_id"] },
+    { fields: ["type"] },
+    { fields: ["project_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list"],
+    trash: false,
+    mru: false,
+    clone: false
+  }
+});
+var SysComment = data.ObjectSchema.create({
+  name: "sys_comment",
+  label: "Comment",
+  pluralLabel: "Comments",
+  icon: "message-square",
+  isSystem: true,
+  description: "Threaded comments attached to records via thread_id",
+  displayNameField: "body",
+  titleFormat: "{author_name}: {body}",
+  compactLayout: ["created_at", "author_name", "body"],
+  fields: {
+    id: data.Field.text({
+      label: "Comment ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    // ── Thread ───────────────────────────────────────────────────
+    thread_id: data.Field.text({
+      label: "Thread",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      description: "Thread identifier \u2014 conventionally `{object}:{record_id}` (e.g. `sys_user:abc123`)",
+      group: "Thread"
+    }),
+    parent_id: data.Field.lookup("sys_comment", {
+      label: "Parent Comment",
+      required: false,
+      description: "Optional parent comment for nested replies",
+      group: "Thread"
+    }),
+    reply_count: data.Field.number({
+      label: "Reply Count",
+      defaultValue: 0,
+      readonly: true,
+      group: "Thread"
+    }),
+    // ── Author ───────────────────────────────────────────────────
+    author_id: data.Field.lookup("sys_user", {
+      label: "Author",
+      required: true,
+      searchable: true,
+      group: "Author"
+    }),
+    author_name: data.Field.text({
+      label: "Author Name",
+      required: false,
+      group: "Author"
+    }),
+    author_avatar_url: data.Field.url({
+      label: "Author Avatar",
+      required: false,
+      group: "Author"
+    }),
+    // ── Body ─────────────────────────────────────────────────────
+    body: data.Field.textarea({
+      label: "Body",
+      required: true,
+      searchable: true,
+      description: "Comment text (Markdown supported)",
+      group: "Body"
+    }),
+    mentions: data.Field.textarea({
+      label: "Mentions",
+      required: false,
+      description: "JSON array of @mention objects",
+      group: "Body"
+    }),
+    reactions: data.Field.textarea({
+      label: "Reactions",
+      required: false,
+      description: "JSON array of emoji reaction objects",
+      group: "Body"
+    }),
+    // ── Lifecycle ────────────────────────────────────────────────
+    is_edited: data.Field.boolean({
+      label: "Edited",
+      defaultValue: false,
+      group: "Lifecycle"
+    }),
+    edited_at: data.Field.datetime({
+      label: "Edited At",
+      required: false,
+      group: "Lifecycle"
+    }),
+    visibility: data.Field.select(
+      ["public", "internal", "private"],
+      {
+        label: "Visibility",
+        defaultValue: "public",
+        group: "Lifecycle"
+      }
+    ),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      required: true,
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      required: false,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["thread_id", "created_at"] },
+    { fields: ["parent_id"] },
+    { fields: ["author_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    trash: true,
+    mru: false,
+    clone: false
+  }
+});
+var SysProject = data.ObjectSchema.create({
+  name: "sys_project",
+  label: "Project",
+  pluralLabel: "Projects",
+  icon: "layers",
+  isSystem: true,
+  description: "Control-plane registry of tenant projects (prod/test/dev/sandbox).",
+  titleFormat: "{display_name}",
+  compactLayout: ["display_name", "status", "is_default"],
+  fields: {
+    id: data.Field.text({
+      label: "Project ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the project (stable, never reused)."
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp."
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp."
+    }),
+    organization_id: data.Field.lookup("sys_organization", {
+      label: "Organization",
+      required: true,
+      description: "Foreign key to sys_organization."
+    }),
+    display_name: data.Field.text({
+      label: "Display Name",
+      required: true,
+      maxLength: 255,
+      description: "Display name shown in Studio and APIs."
+    }),
+    is_default: data.Field.boolean({
+      label: "Is Default",
+      required: true,
+      defaultValue: false,
+      description: "Whether this is the default project for the organization. Exactly one per org."
+    }),
+    is_system: data.Field.boolean({
+      label: "Is System",
+      required: true,
+      defaultValue: false,
+      description: "Whether this is a system project (platform infrastructure, not user data)."
+    }),
+    plan: data.Field.select({
+      label: "Plan",
+      required: true,
+      defaultValue: "free",
+      description: "Plan tier applied to this project for quota and billing.",
+      options: [
+        { value: "free", label: "Free" },
+        { value: "starter", label: "Starter" },
+        { value: "pro", label: "Pro" },
+        { value: "enterprise", label: "Enterprise" },
+        { value: "custom", label: "Custom" }
+      ]
+    }),
+    status: data.Field.select({
+      label: "Status",
+      required: true,
+      defaultValue: "provisioning",
+      description: "Project lifecycle status.",
+      options: [
+        { value: "provisioning", label: "Provisioning" },
+        { value: "active", label: "Active" },
+        { value: "suspended", label: "Suspended" },
+        { value: "archived", label: "Archived" },
+        { value: "failed", label: "Failed" },
+        { value: "migrating", label: "Migrating" }
+      ]
+    }),
+    created_by: data.Field.lookup("sys_user", {
+      label: "Created By",
+      required: true,
+      description: "User that created the project."
+    }),
+    database_url: data.Field.url({
+      label: "Database URL",
+      required: false,
+      description: "Connection URL for the project database (e.g. libsql://proj-uuid.turso.io). Set after provisioning."
+    }),
+    database_driver: data.Field.text({
+      label: "Database Driver",
+      required: false,
+      maxLength: 50,
+      description: "Data-plane driver key (turso, libsql, sqlite, memory, postgres)."
+    }),
+    storage_limit_mb: data.Field.number({
+      label: "Storage Limit (MB)",
+      required: false,
+      defaultValue: 1024,
+      description: "Storage quota in megabytes."
+    }),
+    provisioned_at: data.Field.datetime({
+      label: "Provisioned At",
+      required: false,
+      description: "When the physical database was provisioned."
+    }),
+    metadata: data.Field.textarea({
+      label: "Metadata",
+      required: false,
+      description: "JSON-serialized free-form metadata (feature flags, tags, \u2026)."
+    }),
+    hostname: data.Field.text({
+      label: "Hostname",
+      required: false,
+      maxLength: 255,
+      unique: true,
+      description: "Canonical hostname for this project (e.g. acme-dev.objectstack.app or api.acme.com). UNIQUE. Auto-set on creation; can be overridden for custom domains."
+    })
+  },
+  indexes: [
+    { fields: ["organization_id"] },
+    { fields: ["organization_id", "is_default"] },
+    { fields: ["status"] },
+    { fields: ["database_driver"] },
+    { fields: ["hostname"], unique: true }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: true
+  }
+});
+var SysProjectMember = data.ObjectSchema.create({
+  name: "sys_project_member",
+  label: "Project Member",
+  pluralLabel: "Project Members",
+  icon: "users",
+  isSystem: true,
+  description: "Per-project user/role assignments.",
+  titleFormat: "{user_id} @ {project_id}",
+  compactLayout: ["user_id", "project_id", "role"],
+  fields: {
+    id: data.Field.text({
+      label: "Membership ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the membership."
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp."
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp."
+    }),
+    project_id: data.Field.lookup("sys_project", {
+      label: "Project",
+      required: true,
+      description: "Foreign key to sys_project."
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      description: "Foreign key to sys_user."
+    }),
+    role: data.Field.select({
+      label: "Role",
+      required: true,
+      description: "Per-project role (owner/admin/maker/reader/guest).",
+      options: [
+        { value: "owner", label: "Owner" },
+        { value: "admin", label: "Administrator" },
+        { value: "maker", label: "Maker / Developer" },
+        { value: "reader", label: "Reader" },
+        { value: "guest", label: "Guest" }
+      ]
+    }),
+    invited_by: data.Field.lookup("sys_user", {
+      label: "Invited By",
+      required: true,
+      description: "User that granted this membership."
+    })
+  },
+  indexes: [
+    { fields: ["project_id", "user_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["user_id"] },
+    { fields: ["role"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var SysProjectCredential = data.ObjectSchema.create({
+  name: "sys_project_credential",
+  label: "Project Credential",
+  pluralLabel: "Project Credentials",
+  icon: "key",
+  isSystem: true,
+  description: "Rotatable encrypted credentials for project databases.",
+  titleFormat: "{id}",
+  compactLayout: ["project_id", "status", "authorization", "expires_at"],
+  fields: {
+    id: data.Field.text({
+      label: "Credential ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the credential."
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp."
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp."
+    }),
+    project_id: data.Field.lookup("sys_project", {
+      label: "Project",
+      required: true,
+      description: "Foreign key to sys_project."
+    }),
+    secret_ciphertext: data.Field.textarea({
+      label: "Secret Ciphertext",
+      required: true,
+      description: "Encrypted auth token or secret (never store plaintext)."
+    }),
+    encryption_key_id: data.Field.text({
+      label: "Encryption Key ID",
+      required: true,
+      maxLength: 255,
+      description: "KMS/encryption key ID that produced the ciphertext."
+    }),
+    authorization: data.Field.select({
+      label: "Authorization",
+      required: true,
+      defaultValue: "full_access",
+      description: "Authorization scope for this credential.",
+      options: [
+        { value: "full_access", label: "Full Access" },
+        { value: "read_only", label: "Read Only" }
+      ]
+    }),
+    status: data.Field.select({
+      label: "Status",
+      required: true,
+      defaultValue: "active",
+      description: "Credential lifecycle status.",
+      options: [
+        { value: "active", label: "Active" },
+        { value: "rotating", label: "Rotating" },
+        { value: "revoked", label: "Revoked" }
+      ]
+    }),
+    expires_at: data.Field.datetime({
+      label: "Expires At",
+      required: false,
+      description: "Optional expiry \u2014 after this timestamp the credential must be rotated."
+    }),
+    revoked_at: data.Field.datetime({
+      label: "Revoked At",
+      required: false,
+      description: "Timestamp when the credential was revoked (null while active)."
+    })
+  },
+  indexes: [
+    { fields: ["project_id"] },
+    { fields: ["project_id", "status"] },
+    { fields: ["status"] },
+    { fields: ["expires_at"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update"],
+    trash: false,
+    mru: false
+  }
+});
+var SysApp = data.ObjectSchema.create({
+  name: "sys_app",
+  label: "App",
+  pluralLabel: "Apps",
+  icon: "layout-grid",
+  isSystem: true,
+  description: "Org-scoped catalog of apps across all projects (sys_app).",
+  titleFormat: "{label}",
+  compactLayout: ["label", "project_name", "source", "active"],
+  fields: {
+    id: data.Field.text({
+      label: "App Catalog ID",
+      required: true,
+      readonly: true,
+      description: "UUID of this catalog entry (stable, never reused)."
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp (ISO-8601)."
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp (ISO-8601)."
+    }),
+    organization_id: data.Field.lookup("sys_organization", {
+      label: "Organization",
+      required: true,
+      description: "Foreign key to sys_organization. Drives tenant isolation \u2014 ControlPlaneProxyDriver auto-injects this filter on all reads."
+    }),
+    project_id: data.Field.lookup("sys_project", {
+      label: "Project",
+      required: true,
+      description: "Foreign key to sys_project. The project this app lives in."
+    }),
+    project_name: data.Field.text({
+      label: "Project Name",
+      required: false,
+      description: "Denormalized project display name. Cached here so the catalog list avoids a JOIN against sys_project for card rendering."
+    }),
+    name: data.Field.text({
+      label: "App Name",
+      required: true,
+      description: "Short, machine name of the app (snake_case). Unique within a project."
+    }),
+    label: data.Field.text({
+      label: "Display Label",
+      required: false,
+      description: "Human-readable display label shown on the catalog card."
+    }),
+    icon: data.Field.text({
+      label: "Icon",
+      required: false,
+      description: "Icon identifier (e.g. lucide name, emoji, or URL)."
+    }),
+    branding: data.Field.textarea({
+      label: "Branding",
+      required: false,
+      description: "JSON-serialized branding subset (color, logo, \u2026) used for catalog rendering."
+    }),
+    is_default: data.Field.boolean({
+      label: "Is Default",
+      required: false,
+      defaultValue: false,
+      description: "Whether this is the default app for its project."
+    }),
+    active: data.Field.boolean({
+      label: "Active",
+      required: true,
+      defaultValue: true,
+      description: "Whether the app is currently enabled in its project kernel."
+    }),
+    source: data.Field.select({
+      label: "Source",
+      required: true,
+      defaultValue: "package",
+      description: "Where this app originates from.",
+      options: [
+        { value: "package", label: "Package" },
+        { value: "user", label: "User" }
+      ]
+    }),
+    package_id: data.Field.lookup("sys_package", {
+      label: "Package",
+      required: false,
+      description: "Foreign key to sys_package when source = package. Null for user-created apps."
+    })
+  },
+  indexes: [
+    { fields: ["project_id", "name"], unique: true },
+    { fields: ["organization_id"] },
+    { fields: ["project_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysPackage = data.ObjectSchema.create({
+  name: "sys_package",
+  label: "Package",
+  pluralLabel: "Packages",
+  icon: "package",
+  isSystem: true,
+  description: "Control-plane registry of installable packages / solutions (sys_package).",
+  titleFormat: "{display_name}",
+  compactLayout: ["display_name", "manifest_id", "visibility", "created_at"],
+  fields: {
+    id: data.Field.text({
+      label: "Package ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the package (stable, never reused)."
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp (ISO-8601)."
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp (ISO-8601)."
+    }),
+    manifest_id: data.Field.text({
+      label: "Manifest ID",
+      required: true,
+      readonly: true,
+      maxLength: 255,
+      description: "Globally unique reverse-domain package identifier (e.g. com.acme.crm). Immutable once set. Used as the stable public key for dependency declarations."
+    }),
+    owner_org_id: data.Field.lookup("sys_organization", {
+      label: "Owner Organization",
+      required: true,
+      description: "Organization that owns and publishes this package."
+    }),
+    display_name: data.Field.text({
+      label: "Display Name",
+      required: true,
+      maxLength: 128,
+      description: "Human-readable name shown in Studio and Marketplace."
+    }),
+    description: data.Field.textarea({
+      label: "Description",
+      required: false,
+      description: "Short package description shown in search results and install dialogs (max 512 chars)."
+    }),
+    readme: data.Field.textarea({
+      label: "Readme",
+      required: false,
+      description: "Long-form package documentation (markdown). Displayed on the Marketplace detail page."
+    }),
+    visibility: data.Field.select({
+      label: "Visibility",
+      required: true,
+      defaultValue: "private",
+      description: "Controls who can discover and install the package. private = owner org only; org = all envs in owner org; marketplace = public registry.",
+      options: [
+        { value: "private", label: "Private" },
+        { value: "org", label: "Organization" },
+        { value: "marketplace", label: "Marketplace" }
+      ]
+    }),
+    category: data.Field.text({
+      label: "Category",
+      required: false,
+      maxLength: 100,
+      description: "Primary category for Marketplace filtering (e.g. crm, hr, finance, devtools)."
+    }),
+    tags: data.Field.textarea({
+      label: "Tags",
+      required: false,
+      description: 'JSON-serialized array of search/filter tags (e.g. ["salesforce","sync","crm"]).'
+    }),
+    icon_url: data.Field.url({
+      label: "Icon URL",
+      required: false,
+      description: "URL to the package icon image displayed in Studio and Marketplace."
+    }),
+    homepage_url: data.Field.url({
+      label: "Homepage URL",
+      required: false,
+      description: "URL to the package homepage or external documentation site."
+    }),
+    license: data.Field.text({
+      label: "License",
+      required: false,
+      maxLength: 64,
+      description: "SPDX license identifier (e.g. MIT, Apache-2.0, proprietary)."
+    }),
+    created_by: data.Field.lookup("sys_user", {
+      label: "Created By",
+      required: true,
+      description: "User that registered this package in the Control Plane."
+    })
+  },
+  indexes: [
+    { fields: ["manifest_id"], unique: true },
+    { fields: ["owner_org_id"] },
+    { fields: ["visibility"] },
+    { fields: ["owner_org_id", "visibility"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update"],
+    trash: false,
+    mru: false
+  }
+});
+var SysPackageVersion = data.ObjectSchema.create({
+  name: "sys_package_version",
+  label: "Package Version",
+  pluralLabel: "Package Versions",
+  icon: "tag",
+  isSystem: true,
+  description: "Immutable release snapshot of a package (sys_package_version).",
+  titleFormat: "{package_id} v{version}",
+  compactLayout: ["package_id", "version", "status", "published_at"],
+  fields: {
+    id: data.Field.text({
+      label: "Version ID",
+      required: true,
+      readonly: true,
+      description: "UUID of this package version row (stable, never reused)."
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp (ISO-8601)."
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp (ISO-8601). Only modified while status is draft."
+    }),
+    package_id: data.Field.lookup("sys_package", {
+      label: "Package",
+      required: true,
+      description: "Foreign key to sys_package (the parent package)."
+    }),
+    version: data.Field.text({
+      label: "Version",
+      required: true,
+      maxLength: 64,
+      description: "Semantic version string (e.g. 1.2.3, 2.0.0-beta.1). Follows semver spec."
+    }),
+    status: data.Field.select({
+      label: "Status",
+      required: true,
+      defaultValue: "draft",
+      description: "Lifecycle status. draft = being authored, may be mutated. published = immutable snapshot, installable in any environment. deprecated = published but superseded; new installs blocked.",
+      options: [
+        { value: "draft", label: "Draft" },
+        { value: "published", label: "Published" },
+        { value: "deprecated", label: "Deprecated" }
+      ]
+    }),
+    manifest_json: data.Field.textarea({
+      label: "Manifest JSON",
+      required: false,
+      description: "Full package manifest serialized as JSON. Frozen on publish \u2014 writing to this field after status = published is rejected by the service layer."
+    }),
+    checksum: data.Field.text({
+      label: "Checksum",
+      required: false,
+      maxLength: 64,
+      readonly: true,
+      description: "SHA-256 hex digest of manifest_json. Computed and set on publish. Used for tamper detection."
+    }),
+    release_notes: data.Field.textarea({
+      label: "Release Notes",
+      required: false,
+      description: "Human-readable changelog for this version (markdown). Optional."
+    }),
+    min_platform_version: data.Field.text({
+      label: "Min Platform Version",
+      required: false,
+      maxLength: 32,
+      description: "Minimum ObjectStack platform version required to run this version (semver, e.g. 4.0.0). Denormalized from manifest_json for fast validation."
+    }),
+    is_pre_release: data.Field.boolean({
+      label: "Pre-release",
+      required: true,
+      defaultValue: false,
+      description: 'Whether this is a pre-release version (alpha, beta, rc). Pre-release versions are not installed by default when resolving "latest".'
+    }),
+    published_at: data.Field.datetime({
+      label: "Published At",
+      required: false,
+      description: "Timestamp when this version was published. Null while status is draft."
+    }),
+    published_by: data.Field.lookup("sys_user", {
+      label: "Published By",
+      required: false,
+      description: "User who published this version. Set on the draft \u2192 published transition."
+    }),
+    created_by: data.Field.lookup("sys_user", {
+      label: "Created By",
+      required: true,
+      description: "User that created this version row."
+    })
+  },
+  indexes: [
+    { fields: ["package_id", "version"], unique: true },
+    { fields: ["package_id"] },
+    { fields: ["status"] },
+    { fields: ["package_id", "status"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update"],
+    trash: false,
+    mru: false
+  }
+});
+var SysPackageInstallation = data.ObjectSchema.create({
+  name: "sys_package_installation",
+  label: "Package Installation",
+  pluralLabel: "Package Installations",
+  icon: "package",
+  isSystem: true,
+  description: "Per-project package installation registry (sys_package_installation).",
+  titleFormat: "{package_id} @ {project_id}",
+  compactLayout: ["package_version_id", "project_id", "status", "installed_at"],
+  fields: {
+    id: data.Field.text({
+      label: "Installation ID",
+      required: true,
+      readonly: true,
+      description: "UUID of this installation record (stable, never reused)."
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp (ISO-8601)."
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp \u2014 changes on upgrade, rollback, enable/disable (ISO-8601)."
+    }),
+    project_id: data.Field.lookup("sys_project", {
+      label: "Project",
+      required: true,
+      description: "Foreign key to sys_project. The project that owns this installation."
+    }),
+    package_version_id: data.Field.lookup("sys_package_version", {
+      label: "Package Version",
+      required: true,
+      description: "Foreign key to sys_package_version. The specific, immutable release snapshot currently installed in this project. Upgrading = swapping this field to a newer version. Rollback = swapping to an older version."
+    }),
+    package_id: data.Field.lookup("sys_package", {
+      label: "Package",
+      required: true,
+      description: "Foreign key to sys_package. Denormalized from the linked package_version row at install time to enforce the UNIQUE (project_id, package_id) constraint without a JOIN."
+    }),
+    status: data.Field.select({
+      label: "Status",
+      required: true,
+      defaultValue: "installed",
+      description: "Current lifecycle status of this installation within the project.",
+      options: [
+        { value: "installed", label: "Installed" },
+        { value: "installing", label: "Installing" },
+        { value: "upgrading", label: "Upgrading" },
+        { value: "disabled", label: "Disabled" },
+        { value: "error", label: "Error" }
+      ]
+    }),
+    enabled: data.Field.boolean({
+      label: "Enabled",
+      required: true,
+      defaultValue: true,
+      description: "Whether the package metadata is actively loaded into this project. Disabled packages are installed but their schema is not visible to the runtime."
+    }),
+    settings: data.Field.textarea({
+      label: "Settings",
+      required: false,
+      description: "JSON-serialized per-installation configuration overrides. Keys mirror the package manifest configurationSchema.properties."
+    }),
+    installed_at: data.Field.datetime({
+      label: "Installed At",
+      required: true,
+      defaultValue: "NOW()",
+      description: "Timestamp when this installation was first created (ISO-8601)."
+    }),
+    installed_by: data.Field.lookup("sys_user", {
+      label: "Installed By",
+      required: false,
+      description: "User who performed the initial install. Null for system-automated installs."
+    }),
+    error_message: data.Field.textarea({
+      label: "Error Message",
+      required: false,
+      description: "Error details when status is error. Cleared on next successful install/upgrade."
+    })
+  },
+  indexes: [
+    { fields: ["project_id", "package_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["package_id"] },
+    { fields: ["package_version_id"] },
+    { fields: ["status"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysMetadataObject = data.ObjectSchema.create({
+  name: "sys_metadata",
+  label: "System Metadata",
+  pluralLabel: "System Metadata",
+  icon: "settings",
+  isSystem: true,
+  description: "Stores platform and user-scope metadata records (objects, views, flows, etc.)",
+  fields: {
+    /** Primary Key (UUID) */
+    id: data.Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    /** Machine name — unique identifier used in code references */
+    name: data.Field.text({
+      label: "Name",
+      required: true,
+      searchable: true,
+      maxLength: 255
+    }),
+    /** Metadata type (e.g. "object", "view", "flow") */
+    type: data.Field.text({
+      label: "Metadata Type",
+      required: true,
+      searchable: true,
+      maxLength: 100
+    }),
+    /** Namespace / module grouping (e.g. "crm", "core") */
+    namespace: data.Field.text({
+      label: "Namespace",
+      required: false,
+      defaultValue: "default",
+      maxLength: 100
+    }),
+    /** Package that owns/delivered this metadata (legacy string identifier, kept for compat) */
+    package_id: data.Field.text({
+      label: "Package ID",
+      required: false,
+      maxLength: 255,
+      description: "Legacy package manifest ID string. Use package_version_id for new records."
+    }),
+    /**
+     * FK → sys_package_version (UUID). Set for metadata that belongs to a specific
+     * package release snapshot. NULL = platform-built-in or environment override.
+     */
+    package_version_id: data.Field.lookup("sys_package_version", {
+      label: "Package Version",
+      required: false,
+      description: "Foreign key to sys_package_version (UUID). Null = platform-built-in or env-level override."
+    }),
+    /** Who manages this record: package, platform, or user */
+    managed_by: data.Field.select(["package", "platform", "user"], {
+      label: "Managed By",
+      required: false
+    }),
+    /** Scope: system (code), platform (admin DB), user (personal DB) */
+    scope: data.Field.select(["system", "platform", "user"], {
+      label: "Scope",
+      required: true,
+      defaultValue: "platform"
+    }),
+    /** JSON payload — the actual metadata configuration */
+    metadata: data.Field.textarea({
+      label: "Metadata",
+      required: true,
+      description: "JSON-serialized metadata payload"
+    }),
+    /** Parent metadata name for extension/override */
+    extends: data.Field.text({
+      label: "Extends",
+      required: false,
+      maxLength: 255
+    }),
+    /** Merge strategy when extending parent metadata */
+    strategy: data.Field.select(["merge", "replace"], {
+      label: "Strategy",
+      required: false,
+      defaultValue: "merge"
+    }),
+    /** Owner user ID (for user-scope items) */
+    owner: data.Field.text({
+      label: "Owner",
+      required: false,
+      maxLength: 255
+    }),
+    /** Lifecycle state */
+    state: data.Field.select(["draft", "active", "archived", "deprecated"], {
+      label: "State",
+      required: false,
+      defaultValue: "active"
+    }),
+    /** Organization ID for multi-tenant isolation */
+    organization_id: data.Field.lookup("sys_organization", {
+      label: "Organization",
+      required: false,
+      description: "Organization for multi-tenant isolation."
+    }),
+    /** Project ID — null = platform-global, set = project-scoped */
+    project_id: data.Field.lookup("sys_project", {
+      label: "Project",
+      required: false,
+      description: "Foreign key to sys_project (UUID). Null = platform-global."
+    }),
+    /** Version number for optimistic concurrency */
+    version: data.Field.number({
+      label: "Version",
+      required: false,
+      defaultValue: 1
+    }),
+    /** Content checksum for change detection */
+    checksum: data.Field.text({
+      label: "Checksum",
+      required: false,
+      maxLength: 64
+    }),
+    /** Origin of this metadata record */
+    source: data.Field.select(["filesystem", "database", "api", "migration"], {
+      label: "Source",
+      required: false
+    }),
+    /** Classification tags (JSON array) */
+    tags: data.Field.textarea({
+      label: "Tags",
+      required: false,
+      description: "JSON-serialized array of classification tags"
+    }),
+    /** Audit fields */
+    created_by: data.Field.lookup("sys_user", {
+      label: "Created By",
+      required: false,
+      readonly: true
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      required: false,
+      readonly: true
+    }),
+    updated_by: data.Field.lookup("sys_user", {
+      label: "Updated By",
+      required: false
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      required: false
+    })
+  },
+  indexes: [
+    { fields: ["type", "name", "project_id"], unique: true },
+    { fields: ["type", "scope"] },
+    { fields: ["organization_id"] },
+    { fields: ["project_id"] },
+    { fields: ["package_version_id"] },
+    { fields: ["state"] },
+    { fields: ["namespace"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false
+  }
+});
+var SysMetadataHistoryObject = data.ObjectSchema.create({
+  name: "sys_metadata_history",
+  label: "Metadata History",
+  pluralLabel: "Metadata History",
+  icon: "history",
+  isSystem: true,
+  description: "Version history and audit trail for metadata changes",
+  fields: {
+    /** Primary Key (UUID) */
+    id: data.Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    /** Foreign key to sys_metadata.id */
+    metadata_id: data.Field.lookup("sys_metadata", {
+      label: "Metadata",
+      required: true,
+      readonly: true
+    }),
+    /** Machine name (denormalized for easier querying) */
+    name: data.Field.text({
+      label: "Name",
+      required: true,
+      searchable: true,
+      readonly: true,
+      maxLength: 255
+    }),
+    /** Metadata type (denormalized for easier querying) */
+    type: data.Field.text({
+      label: "Metadata Type",
+      required: true,
+      searchable: true,
+      readonly: true,
+      maxLength: 100
+    }),
+    /** Version number at this snapshot */
+    version: data.Field.number({
+      label: "Version",
+      required: true,
+      readonly: true
+    }),
+    /** Type of operation that created this history entry */
+    operation_type: data.Field.select(["create", "update", "publish", "revert", "delete"], {
+      label: "Operation Type",
+      required: true,
+      readonly: true
+    }),
+    /** Historical metadata snapshot (JSON payload) */
+    metadata: data.Field.textarea({
+      label: "Metadata",
+      required: true,
+      readonly: true,
+      description: "JSON-serialized metadata snapshot at this version"
+    }),
+    /** SHA-256 checksum of metadata content */
+    checksum: data.Field.text({
+      label: "Checksum",
+      required: true,
+      readonly: true,
+      maxLength: 64
+    }),
+    /** Checksum of the previous version */
+    previous_checksum: data.Field.text({
+      label: "Previous Checksum",
+      required: false,
+      readonly: true,
+      maxLength: 64
+    }),
+    /** Human-readable description of changes */
+    change_note: data.Field.textarea({
+      label: "Change Note",
+      required: false,
+      readonly: true,
+      description: "Description of what changed in this version"
+    }),
+    /** Organization ID for multi-tenant isolation */
+    organization_id: data.Field.lookup("sys_organization", {
+      label: "Organization",
+      required: false,
+      readonly: true,
+      description: "Organization for multi-tenant isolation."
+    }),
+    /** Environment ID — null = platform-global, set = env-scoped */
+    project_id: data.Field.text({
+      label: "Environment ID",
+      required: false,
+      readonly: true,
+      maxLength: 255,
+      description: "Scopes this history entry to a specific environment."
+    }),
+    /** User who made this change */
+    recorded_by: data.Field.lookup("sys_user", {
+      label: "Recorded By",
+      required: false,
+      readonly: true
+    }),
+    /** When was this version recorded */
+    recorded_at: data.Field.datetime({
+      label: "Recorded At",
+      required: true,
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["metadata_id", "version"], unique: true },
+    { fields: ["metadata_id", "recorded_at"] },
+    { fields: ["type", "name"] },
+    { fields: ["recorded_at"] },
+    { fields: ["operation_type"] },
+    { fields: ["organization_id"] },
+    { fields: ["project_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    // Don't track history of history records
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list"],
+    // Read-only via API
+    trash: false
+  }
+});
+var SysObject = data.ObjectSchema.create({
+  name: "sys_object",
+  label: "Object Definition",
+  pluralLabel: "Object Definitions",
+  description: "Metadata for business objects",
+  icon: "database",
+  isSystem: true,
+  fields: {
+    // Core Identity
+    name: data.Field.text({
+      label: "Object Name",
+      required: true,
+      maxLength: 255,
+      description: "Machine name (snake_case)"
+    }),
+    project_id: data.Field.text({
+      label: "Environment ID",
+      maxLength: 255,
+      description: "Project/environment scope \u2014 null = control-plane global"
+    }),
+    label: data.Field.text({
+      label: "Display Label",
+      required: true,
+      maxLength: 255
+    }),
+    plural_label: data.Field.text({
+      label: "Plural Label",
+      maxLength: 255
+    }),
+    description: data.Field.textarea({
+      label: "Description"
+    }),
+    icon: data.Field.text({
+      label: "Icon",
+      maxLength: 100
+    }),
+    // Classification
+    namespace: data.Field.text({
+      label: "Namespace",
+      maxLength: 100,
+      description: "Logical domain namespace"
+    }),
+    tags: data.Field.text({
+      label: "Tags",
+      description: "Comma-separated categorization tags"
+    }),
+    active: data.Field.boolean({
+      label: "Active",
+      defaultValue: true
+    }),
+    is_system: data.Field.boolean({
+      label: "System Object",
+      defaultValue: false,
+      description: "Protected from deletion"
+    }),
+    abstract: data.Field.boolean({
+      label: "Abstract",
+      defaultValue: false,
+      description: "Cannot be instantiated"
+    }),
+    // Storage
+    datasource: data.Field.text({
+      label: "Datasource",
+      maxLength: 100,
+      defaultValue: "default"
+    }),
+    table_name: data.Field.text({
+      label: "Table Name",
+      maxLength: 255,
+      description: "Physical table/collection name"
+    }),
+    // Complex Data (stored as JSON)
+    fields_json: data.Field.textarea({
+      label: "Fields (JSON)",
+      description: "Field definitions as JSON"
+    }),
+    indexes_json: data.Field.textarea({
+      label: "Indexes (JSON)",
+      description: "Index definitions as JSON"
+    }),
+    validations_json: data.Field.textarea({
+      label: "Validations (JSON)",
+      description: "Validation rules as JSON"
+    }),
+    state_machines_json: data.Field.textarea({
+      label: "State Machines (JSON)",
+      description: "State machine definitions as JSON"
+    }),
+    capabilities_json: data.Field.textarea({
+      label: "Capabilities (JSON)",
+      description: "Enabled system features as JSON"
+    }),
+    // Denormalized Fields
+    field_count: data.Field.number({
+      label: "Field Count",
+      description: "Number of fields defined"
+    }),
+    // Display
+    display_name_field: data.Field.text({
+      label: "Display Name Field",
+      maxLength: 100,
+      description: "Field to use as record display name"
+    }),
+    title_format: data.Field.text({
+      label: "Title Format",
+      maxLength: 255,
+      description: "Title expression template"
+    }),
+    compact_layout: data.Field.text({
+      label: "Compact Layout",
+      description: "Comma-separated field names for cards"
+    }),
+    // Capabilities
+    track_history: data.Field.boolean({
+      label: "Track History",
+      defaultValue: false
+    }),
+    searchable: data.Field.boolean({
+      label: "Searchable",
+      defaultValue: true
+    }),
+    api_enabled: data.Field.boolean({
+      label: "API Enabled",
+      defaultValue: true
+    }),
+    files: data.Field.boolean({
+      label: "Files",
+      defaultValue: false
+    }),
+    feeds: data.Field.boolean({
+      label: "Feeds",
+      defaultValue: false
+    }),
+    activities: data.Field.boolean({
+      label: "Activities",
+      defaultValue: false
+    }),
+    trash: data.Field.boolean({
+      label: "Trash",
+      defaultValue: true
+    }),
+    mru: data.Field.boolean({
+      label: "MRU",
+      defaultValue: true
+    }),
+    clone: data.Field.boolean({
+      label: "Clone",
+      defaultValue: true
+    }),
+    // Package Management
+    package_id: data.Field.lookup("sys_package", {
+      label: "Package"
+    }),
+    managed_by: data.Field.select({
+      label: "Managed By",
+      options: [
+        { value: "package", label: "Package" },
+        { value: "platform", label: "Platform" },
+        { value: "user", label: "User" }
+      ]
+    }),
+    // Audit
+    created_by: data.Field.lookup("sys_user", { label: "Created By" }),
+    created_at: data.Field.datetime({ label: "Created At" }),
+    updated_by: data.Field.lookup("sys_user", { label: "Updated By" }),
+    updated_at: data.Field.datetime({ label: "Updated At" })
+  },
+  indexes: [
+    { fields: ["name", "project_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["namespace"] },
+    { fields: ["package_id"] },
+    { fields: ["active"] },
+    { fields: ["is_system"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    trash: true,
+    mru: true
+  }
+});
+var SysView = data.ObjectSchema.create({
+  name: "sys_view",
+  label: "View Definition",
+  pluralLabel: "View Definitions",
+  description: "Metadata for UI views (grid, kanban, calendar, etc.)",
+  icon: "layout-grid",
+  isSystem: true,
+  fields: {
+    // Core Identity
+    name: data.Field.text({
+      label: "View Name",
+      required: true,
+      maxLength: 255
+    }),
+    project_id: data.Field.text({
+      label: "Environment ID",
+      maxLength: 255,
+      description: "Project/environment scope \u2014 null = control-plane global"
+    }),
+    label: data.Field.text({
+      label: "Display Label",
+      required: true,
+      maxLength: 255
+    }),
+    description: data.Field.textarea({
+      label: "Description"
+    }),
+    // Reference to Object
+    object_name: data.Field.text({
+      label: "Object Name",
+      required: true,
+      maxLength: 255,
+      description: "The object this view displays"
+    }),
+    // View Type
+    view_type: data.Field.select({
+      label: "View Type",
+      required: true,
+      options: [
+        { value: "grid", label: "Grid" },
+        { value: "kanban", label: "Kanban" },
+        { value: "calendar", label: "Calendar" },
+        { value: "gantt", label: "Gantt" },
+        { value: "form", label: "Form" },
+        { value: "timeline", label: "Timeline" }
+      ]
+    }),
+    // Complex Configuration
+    columns_json: data.Field.textarea({
+      label: "Columns (JSON)",
+      description: "Column definitions as JSON"
+    }),
+    filters_json: data.Field.textarea({
+      label: "Filters (JSON)",
+      description: "Filter definitions as JSON"
+    }),
+    sort_json: data.Field.textarea({
+      label: "Sort (JSON)",
+      description: "Sort configuration as JSON"
+    }),
+    config_json: data.Field.textarea({
+      label: "Configuration (JSON)",
+      description: "View-specific configuration as JSON"
+    }),
+    // Display Options
+    page_size: data.Field.number({
+      label: "Page Size",
+      defaultValue: 25,
+      min: 1,
+      max: 200
+    }),
+    show_search: data.Field.boolean({
+      label: "Show Search",
+      defaultValue: true
+    }),
+    show_filters: data.Field.boolean({
+      label: "Show Filters",
+      defaultValue: true
+    }),
+    // Classification
+    namespace: data.Field.text({
+      label: "Namespace",
+      maxLength: 100
+    }),
+    // Package Management
+    package_id: data.Field.lookup("sys_package", {
+      label: "Package"
+    }),
+    managed_by: data.Field.select({
+      label: "Managed By",
+      options: [
+        { value: "package", label: "Package" },
+        { value: "platform", label: "Platform" },
+        { value: "user", label: "User" }
+      ]
+    }),
+    // Audit
+    created_by: data.Field.lookup("sys_user", { label: "Created By" }),
+    created_at: data.Field.datetime({ label: "Created At" }),
+    updated_by: data.Field.lookup("sys_user", { label: "Updated By" }),
+    updated_at: data.Field.datetime({ label: "Updated At" })
+  },
+  indexes: [
+    { fields: ["name", "project_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["object_name"] },
+    { fields: ["view_type"] },
+    { fields: ["namespace"] },
+    { fields: ["package_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    trash: true,
+    mru: true
+  }
+});
+var SysAgent = data.ObjectSchema.create({
+  name: "sys_agent",
+  label: "AI Agent",
+  pluralLabel: "AI Agents",
+  description: "AI agent definitions",
+  icon: "bot",
+  isSystem: true,
+  fields: {
+    // Core Identity
+    name: data.Field.text({
+      label: "Agent Name",
+      required: true,
+      maxLength: 255
+    }),
+    project_id: data.Field.text({
+      label: "Environment ID",
+      maxLength: 255,
+      description: "Project/environment scope \u2014 null = control-plane global"
+    }),
+    label: data.Field.text({
+      label: "Display Label",
+      required: true,
+      maxLength: 255
+    }),
+    description: data.Field.textarea({
+      label: "Description"
+    }),
+    // Agent Type
+    agent_type: data.Field.select({
+      label: "Agent Type",
+      options: [
+        { value: "conversational", label: "Conversational" },
+        { value: "task", label: "Task-Based" },
+        { value: "analytical", label: "Analytical" },
+        { value: "workflow", label: "Workflow" }
+      ]
+    }),
+    // Model Configuration
+    model: data.Field.text({
+      label: "Model ID",
+      maxLength: 255,
+      description: "AI model identifier"
+    }),
+    temperature: data.Field.number({
+      label: "Temperature",
+      min: 0,
+      max: 2,
+      defaultValue: 0.7
+    }),
+    max_tokens: data.Field.number({
+      label: "Max Tokens",
+      min: 1,
+      max: 1e5
+    }),
+    top_p: data.Field.number({
+      label: "Top P",
+      min: 0,
+      max: 1
+    }),
+    // System Prompt
+    system_prompt: data.Field.textarea({
+      label: "System Prompt",
+      description: "Instructions for the AI agent"
+    }),
+    // Tools Configuration
+    tools_json: data.Field.textarea({
+      label: "Tools (JSON)",
+      description: "Available tools as JSON array"
+    }),
+    // Skills Configuration
+    skills_json: data.Field.textarea({
+      label: "Skills (JSON)",
+      description: "Available skills as JSON array"
+    }),
+    // Memory Configuration
+    memory_enabled: data.Field.boolean({
+      label: "Memory Enabled",
+      defaultValue: false
+    }),
+    memory_window: data.Field.number({
+      label: "Memory Window",
+      description: "Number of conversation turns to remember",
+      defaultValue: 10
+    }),
+    // Classification
+    namespace: data.Field.text({
+      label: "Namespace",
+      maxLength: 100
+    }),
+    // Package Management
+    package_id: data.Field.lookup("sys_package", {
+      label: "Package"
+    }),
+    managed_by: data.Field.select({
+      label: "Managed By",
+      options: [
+        { value: "package", label: "Package" },
+        { value: "platform", label: "Platform" },
+        { value: "user", label: "User" }
+      ]
+    }),
+    // Audit
+    created_by: data.Field.lookup("sys_user", { label: "Created By" }),
+    created_at: data.Field.datetime({ label: "Created At" }),
+    updated_by: data.Field.lookup("sys_user", { label: "Updated By" }),
+    updated_at: data.Field.datetime({ label: "Updated At" })
+  },
+  indexes: [
+    { fields: ["name", "project_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["agent_type"] },
+    { fields: ["namespace"] },
+    { fields: ["package_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    trash: true,
+    mru: true
+  }
+});
+var SysTool = data.ObjectSchema.create({
+  name: "sys_tool",
+  label: "AI Tool",
+  pluralLabel: "AI Tools",
+  description: "AI tool definitions",
+  icon: "wrench",
+  isSystem: true,
+  fields: {
+    // Core Identity
+    name: data.Field.text({
+      label: "Tool Name",
+      required: true,
+      maxLength: 255
+    }),
+    project_id: data.Field.text({
+      label: "Environment ID",
+      maxLength: 255,
+      description: "Project/environment scope \u2014 null = control-plane global"
+    }),
+    label: data.Field.text({
+      label: "Display Label",
+      required: true,
+      maxLength: 255
+    }),
+    description: data.Field.textarea({
+      label: "Description",
+      required: true
+    }),
+    // Parameters
+    parameters_json: data.Field.textarea({
+      label: "Parameters (JSON)",
+      description: "Tool parameter schema as JSON"
+    }),
+    // Implementation
+    handler_code: data.Field.textarea({
+      label: "Handler Code",
+      description: "Tool implementation code"
+    }),
+    // Classification
+    namespace: data.Field.text({
+      label: "Namespace",
+      maxLength: 100
+    }),
+    // Package Management
+    package_id: data.Field.lookup("sys_package", {
+      label: "Package"
+    }),
+    managed_by: data.Field.select({
+      label: "Managed By",
+      options: [
+        { value: "package", label: "Package" },
+        { value: "platform", label: "Platform" },
+        { value: "user", label: "User" }
+      ]
+    }),
+    // Audit
+    created_by: data.Field.lookup("sys_user", { label: "Created By" }),
+    created_at: data.Field.datetime({ label: "Created At" }),
+    updated_by: data.Field.lookup("sys_user", { label: "Updated By" }),
+    updated_at: data.Field.datetime({ label: "Updated At" })
+  },
+  indexes: [
+    { fields: ["name", "project_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["namespace"] },
+    { fields: ["package_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    trash: true,
+    mru: true
+  }
+});
+var SysFlow = data.ObjectSchema.create({
+  name: "sys_flow",
+  label: "Flow",
+  pluralLabel: "Flows",
+  description: "Visual logic flow definitions",
+  icon: "workflow",
+  isSystem: true,
+  fields: {
+    // Core Identity
+    name: data.Field.text({
+      label: "Flow Name",
+      required: true,
+      maxLength: 255
+    }),
+    project_id: data.Field.text({
+      label: "Environment ID",
+      maxLength: 255,
+      description: "Project/environment scope \u2014 null = control-plane global"
+    }),
+    label: data.Field.text({
+      label: "Display Label",
+      required: true,
+      maxLength: 255
+    }),
+    description: data.Field.textarea({
+      label: "Description"
+    }),
+    // Flow Type
+    flow_type: data.Field.select({
+      label: "Flow Type",
+      required: true,
+      options: [
+        { value: "autolaunched", label: "Autolaunched" },
+        { value: "screen", label: "Screen Flow" },
+        { value: "schedule", label: "Scheduled" },
+        { value: "trigger", label: "Trigger-Based" }
+      ]
+    }),
+    // Flow Definition
+    nodes_json: data.Field.textarea({
+      label: "Nodes (JSON)",
+      description: "Flow nodes as JSON"
+    }),
+    edges_json: data.Field.textarea({
+      label: "Edges (JSON)",
+      description: "Flow edges as JSON"
+    }),
+    variables_json: data.Field.textarea({
+      label: "Variables (JSON)",
+      description: "Flow variables as JSON"
+    }),
+    // Trigger Configuration
+    trigger_type: data.Field.select({
+      label: "Trigger Type",
+      options: [
+        { value: "record_created", label: "Record Created" },
+        { value: "record_updated", label: "Record Updated" },
+        { value: "record_deleted", label: "Record Deleted" },
+        { value: "schedule", label: "Schedule" },
+        { value: "platform_event", label: "Platform Event" }
+      ]
+    }),
+    trigger_object: data.Field.text({
+      label: "Trigger Object",
+      maxLength: 255
+    }),
+    // Status
+    active: data.Field.boolean({
+      label: "Active",
+      defaultValue: false
+    }),
+    // Classification
+    namespace: data.Field.text({
+      label: "Namespace",
+      maxLength: 100
+    }),
+    // Package Management
+    package_id: data.Field.lookup("sys_package", {
+      label: "Package"
+    }),
+    managed_by: data.Field.select({
+      label: "Managed By",
+      options: [
+        { value: "package", label: "Package" },
+        { value: "platform", label: "Platform" },
+        { value: "user", label: "User" }
+      ]
+    }),
+    // Audit
+    created_by: data.Field.lookup("sys_user", { label: "Created By" }),
+    created_at: data.Field.datetime({ label: "Created At" }),
+    updated_by: data.Field.lookup("sys_user", { label: "Updated By" }),
+    updated_at: data.Field.datetime({ label: "Updated At" })
+  },
+  indexes: [
+    { fields: ["name", "project_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["flow_type"] },
+    { fields: ["active"] },
+    { fields: ["namespace"] },
+    { fields: ["package_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    trash: true,
+    mru: true
+  }
+});
+
+// src/apps/setup.app.ts
+var SETUP_APP = {
+  name: "setup",
+  label: "Setup",
+  description: "Platform settings and administration",
+  icon: "settings",
+  active: true,
+  isDefault: false,
+  branding: {
+    primaryColor: "#475569"
+    // Slate-600 — neutral admin palette
+  },
+  requiredPermissions: ["setup.access"],
+  navigation: [
+    {
+      id: "group_overview",
+      type: "group",
+      label: "Overview",
+      icon: "layout-dashboard",
+      children: [
+        { id: "nav_system_overview", type: "dashboard", label: "System Overview", dashboardName: "system_overview", icon: "activity" },
+        { id: "nav_security_overview", type: "dashboard", label: "Security Overview", dashboardName: "security_overview", icon: "shield" }
+      ]
+    },
+    {
+      id: "group_administration",
+      type: "group",
+      label: "Administration",
+      icon: "shield",
+      children: [
+        { id: "nav_users", type: "object", label: "Users", objectName: "sys_user", icon: "users" },
+        { id: "nav_organizations", type: "object", label: "Organizations", objectName: "sys_organization", icon: "building-2" },
+        { id: "nav_teams", type: "object", label: "Teams", objectName: "sys_team", icon: "users-round" },
+        { id: "nav_api_keys", type: "object", label: "API Keys", objectName: "sys_api_key", icon: "key" },
+        { id: "nav_roles", type: "object", label: "Roles", objectName: "sys_role", icon: "shield-check" },
+        { id: "nav_permission_sets", type: "object", label: "Permission Sets", objectName: "sys_permission_set", icon: "lock" },
+        { id: "nav_oauth_apps", type: "object", label: "OAuth Apps", objectName: "sys_oauth_application", icon: "app-window" },
+        { id: "nav_jwks", type: "object", label: "Signing Keys", objectName: "sys_jwks", icon: "key-round" }
+      ]
+    },
+    {
+      id: "group_platform",
+      type: "group",
+      label: "Platform",
+      icon: "layers",
+      children: [
+        { id: "nav_objects", type: "object", label: "Objects", objectName: "sys_object", icon: "database" },
+        { id: "nav_views", type: "object", label: "Views", objectName: "sys_view", icon: "table" },
+        { id: "nav_flows", type: "object", label: "Flows", objectName: "sys_flow", icon: "workflow" },
+        { id: "nav_agents", type: "object", label: "AI Agents", objectName: "sys_agent", icon: "bot" },
+        { id: "nav_tools", type: "object", label: "AI Tools", objectName: "sys_tool", icon: "wrench" },
+        { id: "nav_apps", type: "object", label: "Apps", objectName: "sys_app", icon: "layout-grid" },
+        { id: "nav_packages", type: "object", label: "Packages", objectName: "sys_package", icon: "package" },
+        { id: "nav_package_installations", type: "object", label: "Installations", objectName: "sys_package_installation", icon: "package-check" },
+        { id: "nav_metadata", type: "object", label: "All Metadata", objectName: "sys_metadata", icon: "file-cog" }
+      ]
+    },
+    {
+      id: "group_system",
+      type: "group",
+      label: "System",
+      icon: "settings",
+      children: [
+        { id: "nav_sessions", type: "object", label: "Sessions", objectName: "sys_session", icon: "monitor" },
+        { id: "nav_audit_logs", type: "object", label: "Audit Logs", objectName: "sys_audit_log", icon: "scroll-text" },
+        { id: "nav_activity", type: "object", label: "Activity", objectName: "sys_activity", icon: "activity" },
+        { id: "nav_comments", type: "object", label: "Comments", objectName: "sys_comment", icon: "message-square" }
+      ]
+    }
+  ]
+};
+
+// src/apps/views/users.view.ts
+var UsersView = {
+  name: "users",
+  label: "Users",
+  type: "grid",
+  data: {
+    provider: "object",
+    object: "sys_user"
+  },
+  columns: [
+    { field: "name", label: "Name", sortable: true },
+    { field: "email", label: "Email", sortable: true },
+    { field: "phone", label: "Phone" },
+    { field: "status", label: "Status", sortable: true },
+    { field: "active", label: "Active", sortable: true },
+    { field: "created_at", label: "Created", sortable: true }
+  ],
+  sort: [{ field: "created_at", order: "desc" }],
+  filter: [],
+  searchableFields: ["name", "email"],
+  pagination: {
+    pageSize: 20
+  }
+};
+
+// src/apps/views/organizations.view.ts
+var OrganizationsView = {
+  name: "organizations",
+  label: "Organizations",
+  type: "grid",
+  data: {
+    provider: "object",
+    object: "sys_organization"
+  },
+  columns: [
+    { field: "name", label: "Name", sortable: true },
+    { field: "status", label: "Status", sortable: true },
+    { field: "plan_tier", label: "Plan Tier" },
+    { field: "member_count", label: "Members" },
+    { field: "created_at", label: "Created", sortable: true }
+  ],
+  sort: [{ field: "created_at", order: "desc" }],
+  filter: [],
+  searchableFields: ["name"],
+  pagination: {
+    pageSize: 20
+  }
+};
+
+// src/apps/views/roles.view.ts
+var RolesView = {
+  name: "roles",
+  label: "Roles",
+  type: "grid",
+  data: {
+    provider: "object",
+    object: "sys_role"
+  },
+  columns: [
+    { field: "name", label: "Name", sortable: true },
+    { field: "description", label: "Description" },
+    { field: "is_system", label: "System Role" },
+    { field: "created_at", label: "Created", sortable: true }
+  ],
+  sort: [{ field: "created_at", order: "desc" }],
+  filter: [],
+  searchableFields: ["name", "description"],
+  pagination: {
+    pageSize: 20
+  }
+};
+
+// src/apps/views/sessions.view.ts
+var SessionsView = {
+  name: "sessions",
+  label: "Sessions",
+  type: "grid",
+  data: {
+    provider: "object",
+    object: "sys_session"
+  },
+  columns: [
+    { field: "user_id", label: "User", sortable: true },
+    { field: "ip_address", label: "IP Address" },
+    { field: "created_at", label: "Created", sortable: true },
+    { field: "expires_at", label: "Expires", sortable: true }
+  ],
+  sort: [{ field: "created_at", order: "desc" }],
+  filter: [],
+  searchableFields: ["user_id"],
+  pagination: {
+    pageSize: 20
+  }
+};
+
+// src/apps/views/audit_logs.view.ts
+var AuditLogsView = {
+  name: "audit_logs",
+  label: "Audit Logs",
+  type: "grid",
+  data: {
+    provider: "object",
+    object: "sys_audit_log"
+  },
+  columns: [
+    { field: "created_at", label: "Timestamp", sortable: true },
+    { field: "action", label: "Action", sortable: true },
+    { field: "user_id", label: "Actor" },
+    { field: "object_name", label: "Object" },
+    { field: "record_id", label: "Record ID" }
+  ],
+  sort: [{ field: "created_at", order: "desc" }],
+  filter: [],
+  searchableFields: ["action", "object_name", "record_id"],
+  pagination: {
+    pageSize: 20
+  }
+};
+
+// src/apps/views/package_installations.view.ts
+var PackageInstallationsView = {
+  name: "package_installations",
+  label: "Package Installations",
+  type: "grid",
+  data: {
+    provider: "object",
+    object: "sys_package_installation"
+  },
+  columns: [
+    { field: "package_id", label: "Package", sortable: true },
+    { field: "project_id", label: "Project", sortable: true },
+    { field: "package_version_id", label: "Version" },
+    { field: "status", label: "Status", sortable: true },
+    { field: "installed_at", label: "Installed", sortable: true }
+  ],
+  sort: [{ field: "installed_at", order: "desc" }],
+  filter: [],
+  searchableFields: ["package_id", "project_id"],
+  pagination: {
+    pageSize: 20
+  }
+};
+var SystemOverviewDashboard = ui.Dashboard.create({
+  name: "system_overview",
+  label: "System Overview",
+  description: "Platform health, sessions, and audit activity",
+  // 12-column grid matches the widget `w` values below (3, 6, 12). Without
+  // this, the renderer falls back to a 4-column grid and `w: 3` becomes 75%
+  // width per metric — so KPI cards stack vertically instead of forming a
+  // 4-up row.
+  columns: 12,
+  gap: 4,
+  widgets: [
+    // ── Active Sessions Widget ──────────────────────────────────────
+    {
+      id: "widget_active_sessions",
+      title: "Active Sessions",
+      type: "metric",
+      object: "sys_session",
+      layout: {
+        x: 0,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      aggregate: "count",
+      colorVariant: "blue",
+      description: "Number of currently active user sessions"
+    },
+    // ── Total Users Widget ──────────────────────────────────────────
+    {
+      id: "widget_total_users",
+      title: "Total Users",
+      type: "metric",
+      object: "sys_user",
+      layout: {
+        x: 3,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      aggregate: "count",
+      colorVariant: "teal",
+      description: "Total registered users in the system"
+    },
+    // ── Organizations Widget ────────────────────────────────────────
+    {
+      id: "widget_organizations",
+      title: "Organizations",
+      type: "metric",
+      object: "sys_organization",
+      layout: {
+        x: 6,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      aggregate: "count",
+      colorVariant: "orange",
+      description: "Total organizations on the platform"
+    },
+    // ── Packages Installed Widget ───────────────────────────────────
+    {
+      id: "widget_packages_installed",
+      title: "Packages Installed",
+      type: "metric",
+      object: "sys_package_installation",
+      layout: {
+        x: 9,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      filter: {
+        field: "status",
+        operator: "equals",
+        value: "installed"
+      },
+      aggregate: "count",
+      colorVariant: "success",
+      description: "Active package installations across projects"
+    },
+    // ── Audit Actions by Type (last 7 days) ─────────────────────────
+    {
+      id: "widget_audit_actions",
+      title: "Audit Actions (7d)",
+      description: "Distribution of audit events by action type",
+      type: "pie",
+      object: "sys_audit_log",
+      layout: {
+        x: 0,
+        y: 2,
+        w: 6,
+        h: 4
+      },
+      categoryField: "action",
+      aggregate: "count",
+      filter: {
+        field: "created_at",
+        operator: "gte",
+        value: "NOW() - INTERVAL 7 DAY"
+      }
+    },
+    // ── Session Status Overview ─────────────────────────────────────
+    {
+      id: "widget_active_orgs",
+      title: "Sessions by Organization",
+      description: "Active sessions grouped by organization",
+      type: "bar",
+      object: "sys_session",
+      layout: {
+        x: 6,
+        y: 2,
+        w: 6,
+        h: 4
+      },
+      categoryField: "active_organization_id",
+      aggregate: "count"
+    },
+    // ── Recent Audit Log (Table) ────────────────────────────────────
+    {
+      id: "widget_recent_events",
+      title: "Recent Audit Events",
+      description: "Latest platform events",
+      type: "metric",
+      object: "sys_audit_log",
+      layout: {
+        x: 0,
+        y: 6,
+        w: 12,
+        h: 3
+      },
+      aggregate: "count",
+      colorVariant: "default"
+    }
+  ],
+  globalFilters: [
+    {
+      field: "created_at",
+      type: "date",
+      label: "Date Range",
+      scope: "dashboard",
+      defaultValue: "last_7_days"
+    }
+  ]
+});
+var SecurityOverviewDashboard = ui.Dashboard.create({
+  name: "security_overview",
+  label: "Security Overview",
+  description: "Security events, authentication, and audit trails",
+  // 12-column grid matches the widget `w` values below.
+  columns: 12,
+  gap: 4,
+  widgets: [
+    // ── Failed Login Attempts Widget ────────────────────────────────
+    {
+      id: "widget_failed_logins",
+      title: "Failed Login Attempts",
+      type: "metric",
+      object: "sys_audit_log",
+      layout: {
+        x: 0,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      filter: {
+        field: "action",
+        operator: "equals",
+        value: "login"
+      },
+      aggregate: "count",
+      colorVariant: "danger",
+      description: "Failed authentication attempts (24h)"
+    },
+    // ── Permission Changes Widget ───────────────────────────────────
+    {
+      id: "widget_permission_changes",
+      title: "Permission Changes",
+      type: "metric",
+      object: "sys_audit_log",
+      layout: {
+        x: 3,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      filter: {
+        field: "action",
+        operator: "equals",
+        value: "permission_change"
+      },
+      aggregate: "count",
+      colorVariant: "warning",
+      description: "Recent permission and role modifications"
+    },
+    // ── System Config Changes Widget ────────────────────────────────
+    {
+      id: "widget_config_changes",
+      title: "Config Changes",
+      type: "metric",
+      object: "sys_audit_log",
+      layout: {
+        x: 6,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      filter: {
+        field: "action",
+        operator: "equals",
+        value: "config_change"
+      },
+      aggregate: "count",
+      colorVariant: "blue",
+      description: "System configuration modifications"
+    },
+    // ── Active Sessions Widget ──────────────────────────────────────
+    {
+      id: "widget_active_sessions",
+      title: "Active Sessions",
+      type: "metric",
+      object: "sys_session",
+      layout: {
+        x: 9,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      aggregate: "count",
+      colorVariant: "success",
+      description: "Currently active user sessions"
+    },
+    // ── Audit Events by Type ────────────────────────────────────────
+    {
+      id: "widget_events_by_type",
+      title: "Audit Events by Type",
+      description: "Distribution of security and audit events",
+      type: "pie",
+      object: "sys_audit_log",
+      layout: {
+        x: 0,
+        y: 2,
+        w: 6,
+        h: 4
+      },
+      categoryField: "action",
+      aggregate: "count"
+    },
+    // ── Audit Events by User ────────────────────────────────────────
+    {
+      id: "widget_events_by_user",
+      title: "Events by User",
+      description: "Activity distribution across users",
+      type: "bar",
+      object: "sys_audit_log",
+      layout: {
+        x: 6,
+        y: 2,
+        w: 6,
+        h: 4
+      },
+      categoryField: "user_id",
+      aggregate: "count"
+    },
+    // ── Recent Security Events (Table) ──────────────────────────────
+    {
+      id: "widget_recent_security_events",
+      title: "Recent Security Events",
+      description: "Latest permission and config changes",
+      type: "metric",
+      object: "sys_audit_log",
+      layout: {
+        x: 0,
+        y: 6,
+        w: 12,
+        h: 3
+      },
+      aggregate: "count",
+      colorVariant: "default"
+    }
+  ],
+  globalFilters: [
+    {
+      field: "created_at",
+      type: "date",
+      label: "Date Range",
+      scope: "dashboard",
+      defaultValue: "last_7_days"
+    }
+  ]
+});
+
+exports.AuditLogsView = AuditLogsView;
+exports.OrganizationsView = OrganizationsView;
+exports.PackageInstallationsView = PackageInstallationsView;
+exports.RolesView = RolesView;
+exports.SETUP_APP = SETUP_APP;
+exports.SecurityOverviewDashboard = SecurityOverviewDashboard;
+exports.SessionsView = SessionsView;
+exports.SysAccount = SysAccount;
+exports.SysActivity = SysActivity;
+exports.SysAgent = SysAgent;
+exports.SysApiKey = SysApiKey;
+exports.SysApp = SysApp;
+exports.SysAuditLog = SysAuditLog;
+exports.SysComment = SysComment;
+exports.SysDeviceCode = SysDeviceCode;
+exports.SysFlow = SysFlow;
+exports.SysInvitation = SysInvitation;
+exports.SysJwks = SysJwks;
+exports.SysMember = SysMember;
+exports.SysMetadata = SysMetadataObject;
+exports.SysMetadataHistoryObject = SysMetadataHistoryObject;
+exports.SysMetadataObject = SysMetadataObject;
+exports.SysOauthAccessToken = SysOauthAccessToken;
+exports.SysOauthApplication = SysOauthApplication;
+exports.SysOauthConsent = SysOauthConsent;
+exports.SysOauthRefreshToken = SysOauthRefreshToken;
+exports.SysObject = SysObject;
+exports.SysOrganization = SysOrganization;
+exports.SysPackage = SysPackage;
+exports.SysPackageInstallation = SysPackageInstallation;
+exports.SysPackageVersion = SysPackageVersion;
+exports.SysPermissionSet = SysPermissionSet;
+exports.SysPresence = SysPresence;
+exports.SysProject = SysProject;
+exports.SysProjectCredential = SysProjectCredential;
+exports.SysProjectMember = SysProjectMember;
+exports.SysRole = SysRole;
+exports.SysSession = SysSession;
+exports.SysTeam = SysTeam;
+exports.SysTeamMember = SysTeamMember;
+exports.SysTool = SysTool;
+exports.SysTwoFactor = SysTwoFactor;
+exports.SysUser = SysUser;
+exports.SysUserPreference = SysUserPreference;
+exports.SysVerification = SysVerification;
+exports.SysView = SysView;
+exports.SystemOverviewDashboard = SystemOverviewDashboard;
+exports.UsersView = UsersView;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map