@objectstack/platform-objects 0.1.0

package/dist/index.mjs

@@ -0,0 +1,4160 @@
+import { ObjectSchema, Field } from '@objectstack/spec/data';
+import { Dashboard } from '@objectstack/spec/ui';
+
+// src/identity/sys-user.object.ts
+var SysUser = ObjectSchema.create({
+  name: "sys_user",
+  label: "User",
+  pluralLabel: "Users",
+  icon: "user",
+  isSystem: true,
+  description: "User accounts for authentication",
+  displayNameField: "name",
+  titleFormat: "{name}",
+  compactLayout: ["name", "email", "email_verified"],
+  fields: {
+    // ── Identity (primary business fields) ───────────────────────
+    name: Field.text({
+      label: "Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    email: Field.email({
+      label: "Email",
+      required: true,
+      searchable: true,
+      group: "Identity"
+    }),
+    email_verified: Field.boolean({
+      label: "Email Verified",
+      defaultValue: false,
+      group: "Identity"
+    }),
+    two_factor_enabled: Field.boolean({
+      label: "Two-Factor Enabled",
+      defaultValue: false,
+      group: "Identity",
+      description: "Whether two-factor authentication is enabled for this user. Maintained by the better-auth `twoFactor` plugin."
+    }),
+    // ── Profile ──────────────────────────────────────────────────
+    image: Field.url({
+      label: "Profile Image",
+      required: false,
+      group: "Profile"
+    }),
+    // ── System (auto-managed, hidden from create/edit forms) ─────
+    id: Field.text({
+      label: "User ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["email"], unique: true },
+    { fields: ["created_at"], unique: false }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: true
+  },
+  validations: [
+    {
+      name: "email_unique",
+      type: "unique",
+      severity: "error",
+      message: "Email must be unique",
+      fields: ["email"],
+      caseSensitive: false
+    }
+  ]
+});
+var SysSession = ObjectSchema.create({
+  name: "sys_session",
+  label: "Session",
+  pluralLabel: "Sessions",
+  icon: "key",
+  isSystem: true,
+  description: "Active user sessions",
+  displayNameField: "user_id",
+  titleFormat: "Session \u2014 {user_id}",
+  compactLayout: ["user_id", "ip_address", "expires_at"],
+  fields: {
+    // ── Session owner & expiry ──────────────────────────────────
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      searchable: true,
+      group: "Session"
+    }),
+    expires_at: Field.datetime({
+      label: "Expires At",
+      required: true,
+      group: "Session"
+    }),
+    // ── Active context (multi-org/team) ──────────────────────────
+    active_organization_id: Field.lookup("sys_organization", {
+      label: "Active Organization",
+      required: false,
+      group: "Context"
+    }),
+    active_team_id: Field.lookup("sys_team", {
+      label: "Active Team",
+      required: false,
+      group: "Context"
+    }),
+    // ── Client fingerprint ───────────────────────────────────────
+    ip_address: Field.text({
+      label: "IP Address",
+      required: false,
+      maxLength: 45,
+      // Support IPv6
+      group: "Client"
+    }),
+    user_agent: Field.textarea({
+      label: "User Agent",
+      required: false,
+      group: "Client"
+    }),
+    // ── Secret (hidden by default) ──────────────────────────────
+    token: Field.text({
+      label: "Session Token",
+      required: true,
+      hidden: true,
+      readonly: true,
+      description: "Opaque session token \u2014 never exposed in UI",
+      group: "Secret"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: Field.text({
+      label: "Session ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["token"], unique: true },
+    { fields: ["user_id"], unique: false },
+    { fields: ["expires_at"], unique: false }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "delete"],
+    trash: false,
+    mru: false,
+    clone: false
+  }
+});
+var SysAccount = ObjectSchema.create({
+  name: "sys_account",
+  label: "Account",
+  pluralLabel: "Accounts",
+  icon: "link",
+  isSystem: true,
+  description: "OAuth and authentication provider accounts",
+  titleFormat: "{provider_id} - {account_id}",
+  compactLayout: ["provider_id", "user_id", "account_id"],
+  fields: {
+    id: Field.text({
+      label: "Account ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    provider_id: Field.text({
+      label: "Provider ID",
+      required: true,
+      description: "OAuth provider identifier (google, github, etc.)"
+    }),
+    account_id: Field.text({
+      label: "Provider Account ID",
+      required: true,
+      description: "User's ID in the provider's system"
+    }),
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      description: "Link to user table"
+    }),
+    access_token: Field.textarea({
+      label: "Access Token",
+      required: false
+    }),
+    refresh_token: Field.textarea({
+      label: "Refresh Token",
+      required: false
+    }),
+    id_token: Field.textarea({
+      label: "ID Token",
+      required: false
+    }),
+    access_token_expires_at: Field.datetime({
+      label: "Access Token Expires At",
+      required: false
+    }),
+    refresh_token_expires_at: Field.datetime({
+      label: "Refresh Token Expires At",
+      required: false
+    }),
+    scope: Field.text({
+      label: "OAuth Scope",
+      required: false
+    }),
+    password: Field.text({
+      label: "Password Hash",
+      required: false,
+      description: "Hashed password for email/password provider"
+    })
+  },
+  indexes: [
+    { fields: ["user_id"], unique: false },
+    { fields: ["provider_id", "account_id"], unique: true }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var SysVerification = ObjectSchema.create({
+  name: "sys_verification",
+  label: "Verification",
+  pluralLabel: "Verifications",
+  icon: "shield-check",
+  isSystem: true,
+  description: "Email and phone verification tokens",
+  titleFormat: "Verification for {identifier}",
+  compactLayout: ["identifier", "expires_at", "created_at"],
+  fields: {
+    id: Field.text({
+      label: "Verification ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    value: Field.text({
+      label: "Verification Token",
+      required: true,
+      description: "Token or code for verification"
+    }),
+    expires_at: Field.datetime({
+      label: "Expires At",
+      required: true
+    }),
+    identifier: Field.text({
+      label: "Identifier",
+      required: true,
+      description: "Email address or phone number"
+    })
+  },
+  indexes: [
+    { fields: ["value"], unique: true },
+    { fields: ["identifier"], unique: false },
+    { fields: ["expires_at"], unique: false }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "create", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysOrganization = ObjectSchema.create({
+  name: "sys_organization",
+  label: "Organization",
+  pluralLabel: "Organizations",
+  icon: "building-2",
+  isSystem: true,
+  description: "Organizations for multi-tenant grouping",
+  displayNameField: "name",
+  titleFormat: "{name}",
+  compactLayout: ["name", "slug"],
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    name: Field.text({
+      label: "Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    slug: Field.text({
+      label: "Slug",
+      required: false,
+      searchable: true,
+      maxLength: 255,
+      description: "URL-friendly identifier",
+      group: "Identity"
+    }),
+    // ── Branding ─────────────────────────────────────────────────
+    logo: Field.url({
+      label: "Logo",
+      required: false,
+      group: "Branding"
+    }),
+    // ── Configuration ────────────────────────────────────────────
+    metadata: Field.textarea({
+      label: "Metadata",
+      required: false,
+      description: "JSON-serialized organization metadata",
+      group: "Configuration"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: Field.text({
+      label: "Organization ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["slug"], unique: true },
+    { fields: ["name"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: true
+  }
+});
+var SysMember = ObjectSchema.create({
+  name: "sys_member",
+  label: "Member",
+  pluralLabel: "Members",
+  icon: "user-check",
+  isSystem: true,
+  description: "Organization membership records",
+  titleFormat: "{user_id} in {organization_id}",
+  compactLayout: ["user_id", "organization_id", "role"],
+  fields: {
+    id: Field.text({
+      label: "Member ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    organization_id: Field.lookup("sys_organization", {
+      label: "Organization",
+      required: true
+    }),
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: true
+    }),
+    role: Field.text({
+      label: "Role",
+      required: false,
+      description: "Member role within the organization (e.g. admin, member)",
+      maxLength: 100
+    })
+  },
+  indexes: [
+    { fields: ["organization_id", "user_id"], unique: true },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysInvitation = ObjectSchema.create({
+  name: "sys_invitation",
+  label: "Invitation",
+  pluralLabel: "Invitations",
+  icon: "mail",
+  isSystem: true,
+  description: "Organization invitations for user onboarding",
+  titleFormat: "Invitation to {organization_id}",
+  compactLayout: ["email", "organization_id", "status"],
+  fields: {
+    id: Field.text({
+      label: "Invitation ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    organization_id: Field.lookup("sys_organization", {
+      label: "Organization",
+      required: true
+    }),
+    email: Field.email({
+      label: "Email",
+      required: true,
+      description: "Email address of the invited user"
+    }),
+    role: Field.text({
+      label: "Role",
+      required: false,
+      maxLength: 100,
+      description: "Role to assign upon acceptance"
+    }),
+    status: Field.select(["pending", "accepted", "rejected", "expired", "canceled"], {
+      label: "Status",
+      required: true,
+      defaultValue: "pending"
+    }),
+    inviter_id: Field.lookup("sys_user", {
+      label: "Inviter",
+      required: true,
+      description: "User who sent the invitation"
+    }),
+    expires_at: Field.datetime({
+      label: "Expires At",
+      required: true
+    }),
+    team_id: Field.lookup("sys_team", {
+      label: "Team",
+      required: false,
+      description: "Optional team to assign upon acceptance"
+    })
+  },
+  indexes: [
+    { fields: ["organization_id"] },
+    { fields: ["email"] },
+    { fields: ["expires_at"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysTeam = ObjectSchema.create({
+  name: "sys_team",
+  label: "Team",
+  pluralLabel: "Teams",
+  icon: "users",
+  isSystem: true,
+  description: "Teams within organizations for fine-grained grouping",
+  displayNameField: "name",
+  titleFormat: "{name}",
+  compactLayout: ["name", "organization_id"],
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    name: Field.text({
+      label: "Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    organization_id: Field.lookup("sys_organization", {
+      label: "Organization",
+      required: true,
+      description: "Parent organization for this team",
+      group: "Identity"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: Field.text({
+      label: "Team ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["organization_id"] },
+    { fields: ["name", "organization_id"], unique: true }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var SysTeamMember = ObjectSchema.create({
+  name: "sys_team_member",
+  label: "Team Member",
+  pluralLabel: "Team Members",
+  icon: "user-plus",
+  isSystem: true,
+  description: "Team membership records linking users to teams",
+  titleFormat: "{user_id} in {team_id}",
+  compactLayout: ["user_id", "team_id", "created_at"],
+  fields: {
+    id: Field.text({
+      label: "Team Member ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    team_id: Field.lookup("sys_team", {
+      label: "Team",
+      required: true
+    }),
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: true
+    })
+  },
+  indexes: [
+    { fields: ["team_id", "user_id"], unique: true },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysApiKey = ObjectSchema.create({
+  name: "sys_api_key",
+  label: "API Key",
+  pluralLabel: "API Keys",
+  icon: "key-round",
+  isSystem: true,
+  description: "API keys for programmatic access",
+  displayNameField: "name",
+  titleFormat: "{name}",
+  compactLayout: ["name", "prefix", "user_id", "expires_at", "revoked"],
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    name: Field.text({
+      label: "Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      description: "Human-readable label for the API key",
+      group: "Identity"
+    }),
+    prefix: Field.text({
+      label: "Prefix",
+      required: false,
+      maxLength: 16,
+      description: 'Visible prefix for identifying the key (e.g., "osk_")',
+      group: "Identity"
+    }),
+    user_id: Field.lookup("sys_user", {
+      label: "Owner",
+      required: true,
+      description: "User who owns this API key",
+      group: "Identity"
+    }),
+    // ── Access ───────────────────────────────────────────────────
+    scopes: Field.textarea({
+      label: "Scopes",
+      required: false,
+      description: "JSON array of permission scopes",
+      group: "Access"
+    }),
+    // ── Lifecycle ────────────────────────────────────────────────
+    expires_at: Field.datetime({
+      label: "Expires At",
+      required: false,
+      group: "Lifecycle"
+    }),
+    last_used_at: Field.datetime({
+      label: "Last Used At",
+      required: false,
+      readonly: true,
+      description: "Automatically updated on each API call",
+      group: "Lifecycle"
+    }),
+    revoked: Field.boolean({
+      label: "Revoked",
+      defaultValue: false,
+      group: "Lifecycle"
+    }),
+    // ── Secret (hidden by default) ──────────────────────────────
+    key: Field.text({
+      label: "Hashed Key",
+      required: true,
+      hidden: true,
+      readonly: true,
+      description: "Hashed API key value \u2014 never exposed to clients",
+      group: "Secret"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: Field.text({
+      label: "API Key ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["key"], unique: true },
+    { fields: ["user_id"] },
+    { fields: ["prefix"] },
+    { fields: ["revoked"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysTwoFactor = ObjectSchema.create({
+  name: "sys_two_factor",
+  label: "Two Factor",
+  pluralLabel: "Two Factor Credentials",
+  icon: "smartphone",
+  isSystem: true,
+  description: "Two-factor authentication credentials",
+  titleFormat: "Two-factor for {user_id}",
+  compactLayout: ["user_id", "created_at"],
+  fields: {
+    id: Field.text({
+      label: "Two Factor ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: true
+    }),
+    secret: Field.text({
+      label: "Secret",
+      required: true,
+      description: "TOTP secret key"
+    }),
+    backup_codes: Field.textarea({
+      label: "Backup Codes",
+      required: false,
+      description: "JSON-serialized backup recovery codes"
+    })
+  },
+  indexes: [
+    { fields: ["user_id"], unique: true }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysDeviceCode = ObjectSchema.create({
+  name: "sys_device_code",
+  label: "Device Code",
+  pluralLabel: "Device Codes",
+  icon: "key-round",
+  isSystem: true,
+  description: "OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests",
+  titleFormat: "{user_code}",
+  compactLayout: ["user_code", "status", "client_id", "expires_at"],
+  fields: {
+    id: Field.text({
+      label: "Device Code ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    /** High-entropy token returned to the device (CLI). Polled at /device/token. */
+    device_code: Field.text({
+      label: "Device Code",
+      required: true,
+      description: "High-entropy token returned to the polling device"
+    }),
+    /** Human-readable short code displayed to the user (e.g. ABCD-EFGH). */
+    user_code: Field.text({
+      label: "User Code",
+      required: true,
+      description: "Short user-facing code (e.g. ABCD-EFGH)"
+    }),
+    /** Owning user — populated when the request is approved. */
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: false,
+      description: "User who approved the device authorization"
+    }),
+    expires_at: Field.datetime({
+      label: "Expires At",
+      required: true,
+      description: "When the device & user codes are no longer valid"
+    }),
+    /** 'pending' | 'approved' | 'denied' */
+    status: Field.text({
+      label: "Status",
+      required: true,
+      description: "Current status: 'pending' | 'approved' | 'denied'"
+    }),
+    last_polled_at: Field.datetime({
+      label: "Last Polled At",
+      required: false,
+      description: "Timestamp of the most recent /device/token poll"
+    }),
+    polling_interval: Field.number({
+      label: "Polling Interval (ms)",
+      required: false,
+      description: "Server-recommended minimum polling interval, in ms"
+    }),
+    client_id: Field.text({
+      label: "Client ID",
+      required: false,
+      description: "OAuth client identifier of the requesting device"
+    }),
+    scope: Field.text({
+      label: "Scope",
+      required: false,
+      description: "Space-separated OAuth scopes requested by the device"
+    })
+  },
+  indexes: [
+    { fields: ["device_code"], unique: true },
+    { fields: ["user_code"], unique: true },
+    { fields: ["status"], unique: false }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysUserPreference = ObjectSchema.create({
+  name: "sys_user_preference",
+  label: "User Preference",
+  pluralLabel: "User Preferences",
+  icon: "settings",
+  isSystem: true,
+  description: "Per-user key-value preferences (theme, locale, etc.)",
+  titleFormat: "{key}",
+  compactLayout: ["user_id", "key"],
+  fields: {
+    id: Field.text({
+      label: "Preference ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      description: "Owner user of this preference"
+    }),
+    key: Field.text({
+      label: "Key",
+      required: true,
+      maxLength: 255,
+      description: "Preference key (e.g., theme, locale, plugin.ai.auto_save)"
+    }),
+    value: Field.json({
+      label: "Value",
+      description: "Preference value (any JSON-serializable type)"
+    })
+  },
+  indexes: [
+    { fields: ["user_id", "key"], unique: true },
+    { fields: ["user_id"], unique: false }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysOauthApplication = ObjectSchema.create({
+  name: "sys_oauth_application",
+  label: "OAuth Application",
+  pluralLabel: "OAuth Applications",
+  icon: "key-round",
+  isSystem: true,
+  description: "Registered OAuth/OIDC client applications",
+  displayNameField: "name",
+  titleFormat: "{name}",
+  compactLayout: ["name", "client_id", "type", "disabled"],
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    id: Field.text({
+      label: "ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    name: Field.text({
+      label: "Name",
+      required: false,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    icon: Field.url({
+      label: "Icon",
+      required: false,
+      description: "Logo URL shown on the consent screen",
+      group: "Identity"
+    }),
+    uri: Field.url({
+      label: "Home URI",
+      required: false,
+      description: "Public homepage of the registered client",
+      group: "Identity"
+    }),
+    contacts: Field.textarea({
+      label: "Contacts",
+      required: false,
+      description: "JSON-serialized list of contact email addresses",
+      group: "Identity"
+    }),
+    tos: Field.url({
+      label: "Terms of Service",
+      required: false,
+      group: "Identity"
+    }),
+    policy: Field.url({
+      label: "Privacy Policy",
+      required: false,
+      group: "Identity"
+    }),
+    metadata: Field.textarea({
+      label: "Metadata",
+      required: false,
+      description: "JSON-serialized application metadata",
+      group: "Identity"
+    }),
+    // ── OAuth Credentials ────────────────────────────────────────
+    client_id: Field.text({
+      label: "Client ID",
+      required: true,
+      readonly: true,
+      maxLength: 255,
+      description: "Public OAuth client identifier",
+      group: "Credentials"
+    }),
+    client_secret: Field.text({
+      label: "Client Secret",
+      required: false,
+      maxLength: 1024,
+      description: "OAuth client secret (hashed/encrypted at rest)",
+      group: "Credentials"
+    }),
+    redirect_uris: Field.textarea({
+      label: "Redirect URIs",
+      required: true,
+      description: "JSON-serialized list of allowed redirect URIs",
+      group: "Credentials"
+    }),
+    post_logout_redirect_uris: Field.textarea({
+      label: "Post-logout Redirect URIs",
+      required: false,
+      description: "JSON-serialized list of allowed post-logout redirect URIs",
+      group: "Credentials"
+    }),
+    type: Field.select(["web", "native", "user-agent-based", "public"], {
+      label: "Client Type",
+      required: false,
+      defaultValue: "web",
+      group: "Credentials"
+    }),
+    public: Field.boolean({
+      label: "Public Client",
+      required: false,
+      description: "Marks the client as a public (non-confidential) OAuth client",
+      group: "Credentials"
+    }),
+    require_pkce: Field.boolean({
+      label: "Require PKCE",
+      required: false,
+      group: "Credentials"
+    }),
+    token_endpoint_auth_method: Field.text({
+      label: "Token Endpoint Auth Method",
+      required: false,
+      maxLength: 64,
+      description: "e.g. client_secret_basic, client_secret_post, none",
+      group: "Credentials"
+    }),
+    grant_types: Field.textarea({
+      label: "Grant Types",
+      required: false,
+      description: "JSON-serialized list of allowed grant types",
+      group: "Credentials"
+    }),
+    response_types: Field.textarea({
+      label: "Response Types",
+      required: false,
+      description: "JSON-serialized list of allowed response types",
+      group: "Credentials"
+    }),
+    scopes: Field.textarea({
+      label: "Allowed Scopes",
+      required: false,
+      description: "JSON-serialized list of scopes the client may request",
+      group: "Credentials"
+    }),
+    subject_type: Field.text({
+      label: "Subject Type",
+      required: false,
+      maxLength: 32,
+      description: "OIDC subject type (e.g. public, pairwise)",
+      group: "Credentials"
+    }),
+    // ── Behaviour flags ──────────────────────────────────────────
+    disabled: Field.boolean({
+      label: "Disabled",
+      required: false,
+      defaultValue: false,
+      group: "Behaviour"
+    }),
+    skip_consent: Field.boolean({
+      label: "Skip Consent",
+      required: false,
+      description: "Treat as a trusted client and bypass the consent screen",
+      group: "Behaviour"
+    }),
+    enable_end_session: Field.boolean({
+      label: "Enable End Session",
+      required: false,
+      description: "Allow the client to call the OIDC end-session endpoint",
+      group: "Behaviour"
+    }),
+    // ── Software statement (RFC 7591 §2.3) ───────────────────────
+    software_id: Field.text({
+      label: "Software ID",
+      required: false,
+      maxLength: 255,
+      group: "Software"
+    }),
+    software_version: Field.text({
+      label: "Software Version",
+      required: false,
+      maxLength: 64,
+      group: "Software"
+    }),
+    software_statement: Field.textarea({
+      label: "Software Statement",
+      required: false,
+      description: "Signed JWT asserting the client metadata (RFC 7591 \xA72.3)",
+      group: "Software"
+    }),
+    // ── Ownership / system ───────────────────────────────────────
+    user_id: Field.lookup("sys_user", {
+      label: "Owner User",
+      required: false,
+      description: "User who registered this application",
+      group: "System"
+    }),
+    reference_id: Field.text({
+      label: "Reference ID",
+      required: false,
+      maxLength: 255,
+      description: "Caller-supplied correlation identifier",
+      group: "System"
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["client_id"], unique: true },
+    { fields: ["user_id"] },
+    { fields: ["reference_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysOauthAccessToken = ObjectSchema.create({
+  name: "sys_oauth_access_token",
+  label: "OAuth Access Token",
+  pluralLabel: "OAuth Access Tokens",
+  icon: "ticket",
+  isSystem: true,
+  description: "Opaque OAuth access tokens issued to client applications",
+  compactLayout: ["client_id", "user_id", "expires_at"],
+  fields: {
+    id: Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    token: Field.text({
+      label: "Token",
+      required: true,
+      maxLength: 1024,
+      description: "Opaque access token value"
+    }),
+    client_id: Field.text({
+      label: "Client ID",
+      required: true,
+      description: "Foreign key to sys_oauth_application.client_id"
+    }),
+    session_id: Field.lookup("sys_session", {
+      label: "Session",
+      required: false,
+      description: "Foreign key to sys_session.id"
+    }),
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: false,
+      description: "Foreign key to sys_user.id"
+    }),
+    refresh_id: Field.lookup("sys_oauth_refresh_token", {
+      label: "Refresh Token",
+      required: false,
+      description: "Foreign key to sys_oauth_refresh_token.id"
+    }),
+    reference_id: Field.text({
+      label: "Reference ID",
+      required: false,
+      maxLength: 255,
+      description: "Caller-supplied correlation identifier"
+    }),
+    scopes: Field.textarea({
+      label: "Scopes",
+      required: true,
+      description: "JSON-serialized list of scopes granted to this token"
+    }),
+    expires_at: Field.datetime({
+      label: "Expires At",
+      required: true
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["token"], unique: true },
+    { fields: ["client_id"] },
+    { fields: ["session_id"] },
+    { fields: ["user_id"] },
+    { fields: ["refresh_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
+var SysOauthRefreshToken = ObjectSchema.create({
+  name: "sys_oauth_refresh_token",
+  label: "OAuth Refresh Token",
+  pluralLabel: "OAuth Refresh Tokens",
+  icon: "refresh-cw",
+  isSystem: true,
+  description: "Opaque OAuth refresh tokens (linked to a session)",
+  compactLayout: ["client_id", "user_id", "expires_at"],
+  fields: {
+    id: Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    token: Field.text({
+      label: "Token",
+      required: true,
+      maxLength: 1024,
+      description: "Opaque refresh token value"
+    }),
+    client_id: Field.text({
+      label: "Client ID",
+      required: true,
+      description: "Foreign key to sys_oauth_application.client_id"
+    }),
+    session_id: Field.lookup("sys_session", {
+      label: "Session",
+      required: false,
+      description: "Foreign key to sys_session.id"
+    }),
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      description: "Foreign key to sys_user.id"
+    }),
+    reference_id: Field.text({
+      label: "Reference ID",
+      required: false,
+      maxLength: 255,
+      description: "Caller-supplied correlation identifier"
+    }),
+    scopes: Field.textarea({
+      label: "Scopes",
+      required: true,
+      description: "JSON-serialized list of scopes granted to this token"
+    }),
+    expires_at: Field.datetime({
+      label: "Expires At",
+      required: true
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    revoked: Field.datetime({
+      label: "Revoked At",
+      required: false,
+      description: "Timestamp at which this refresh token was revoked"
+    }),
+    auth_time: Field.datetime({
+      label: "Auth Time",
+      required: false,
+      description: "When the user originally authenticated for this token chain"
+    })
+  },
+  indexes: [
+    { fields: ["token"], unique: true },
+    { fields: ["client_id"] },
+    { fields: ["session_id"] },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
+var SysOauthConsent = ObjectSchema.create({
+  name: "sys_oauth_consent",
+  label: "OAuth Consent",
+  pluralLabel: "OAuth Consents",
+  icon: "shield-check",
+  isSystem: true,
+  description: "User consent records for OAuth client applications",
+  compactLayout: ["client_id", "user_id", "scopes"],
+  fields: {
+    id: Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    client_id: Field.text({
+      label: "Client ID",
+      required: true,
+      description: "Foreign key to sys_oauth_application.client_id"
+    }),
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: false,
+      description: "Foreign key to sys_user.id"
+    }),
+    reference_id: Field.text({
+      label: "Reference ID",
+      required: false,
+      maxLength: 255,
+      description: "Caller-supplied correlation identifier"
+    }),
+    scopes: Field.textarea({
+      label: "Scopes",
+      required: true,
+      description: "JSON-serialized list of scopes the user consented to"
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["client_id"] },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
+var SysJwks = ObjectSchema.create({
+  name: "sys_jwks",
+  label: "JWKS Key",
+  pluralLabel: "JWKS Keys",
+  icon: "key",
+  isSystem: true,
+  description: "Asymmetric key pairs used to sign and verify issued JWTs",
+  compactLayout: ["id", "created_at", "expires_at"],
+  fields: {
+    id: Field.text({
+      label: "Key ID",
+      required: true,
+      readonly: true,
+      description: "JWK `kid` value"
+    }),
+    public_key: Field.textarea({
+      label: "Public Key",
+      required: true,
+      description: "JSON-serialized JWK public key"
+    }),
+    private_key: Field.textarea({
+      label: "Private Key",
+      required: true,
+      description: "JSON-serialized JWK private key (encrypted at rest)"
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      required: true,
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    expires_at: Field.datetime({
+      label: "Expires At",
+      required: false,
+      description: "When the key may no longer be used to verify tokens"
+    })
+  },
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
+var SysRole = ObjectSchema.create({
+  name: "sys_role",
+  label: "Role",
+  pluralLabel: "Roles",
+  icon: "shield",
+  isSystem: true,
+  description: "Role definitions for RBAC access control",
+  displayNameField: "label",
+  titleFormat: "{label}",
+  compactLayout: ["label", "name", "active", "is_default"],
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    label: Field.text({
+      label: "Display Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    name: Field.text({
+      label: "API Name",
+      required: true,
+      searchable: true,
+      maxLength: 100,
+      description: "Unique machine name for the role (e.g. admin, editor, viewer)",
+      group: "Identity"
+    }),
+    description: Field.textarea({
+      label: "Description",
+      required: false,
+      group: "Identity"
+    }),
+    // ── Configuration ────────────────────────────────────────────
+    permissions: Field.textarea({
+      label: "Permissions",
+      required: false,
+      description: "JSON-serialized array of permission strings",
+      group: "Configuration"
+    }),
+    // ── Status ───────────────────────────────────────────────────
+    active: Field.boolean({
+      label: "Active",
+      defaultValue: true,
+      group: "Status"
+    }),
+    is_default: Field.boolean({
+      label: "Default Role",
+      defaultValue: false,
+      description: "Automatically assigned to new users",
+      group: "Status"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: Field.text({
+      label: "Role ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["name"], unique: true },
+    { fields: ["active"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: true
+  }
+});
+var SysPermissionSet = ObjectSchema.create({
+  name: "sys_permission_set",
+  label: "Permission Set",
+  pluralLabel: "Permission Sets",
+  icon: "lock",
+  isSystem: true,
+  description: "Named permission groupings for fine-grained access control",
+  displayNameField: "label",
+  titleFormat: "{label}",
+  compactLayout: ["label", "name", "active"],
+  fields: {
+    // ── Identity ─────────────────────────────────────────────────
+    label: Field.text({
+      label: "Display Name",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      group: "Identity"
+    }),
+    name: Field.text({
+      label: "API Name",
+      required: true,
+      searchable: true,
+      maxLength: 100,
+      description: "Unique machine name for the permission set",
+      group: "Identity"
+    }),
+    description: Field.textarea({
+      label: "Description",
+      required: false,
+      group: "Identity"
+    }),
+    // ── Permissions ──────────────────────────────────────────────
+    object_permissions: Field.textarea({
+      label: "Object Permissions",
+      required: false,
+      description: "JSON-serialized object-level CRUD permissions",
+      group: "Permissions"
+    }),
+    field_permissions: Field.textarea({
+      label: "Field Permissions",
+      required: false,
+      description: "JSON-serialized field-level read/write permissions",
+      group: "Permissions"
+    }),
+    // ── Status ───────────────────────────────────────────────────
+    active: Field.boolean({
+      label: "Active",
+      defaultValue: true,
+      group: "Status"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: Field.text({
+      label: "Permission Set ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["name"], unique: true },
+    { fields: ["active"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: true
+  }
+});
+var SysAuditLog = ObjectSchema.create({
+  name: "sys_audit_log",
+  label: "Audit Log",
+  pluralLabel: "Audit Logs",
+  icon: "scroll-text",
+  isSystem: true,
+  description: "Immutable audit trail for platform events",
+  displayNameField: "action",
+  titleFormat: "{action} \xB7 {object_name}",
+  compactLayout: ["created_at", "action", "object_name", "record_id", "user_id"],
+  fields: {
+    // ── Event ────────────────────────────────────────────────────
+    created_at: Field.datetime({
+      label: "Timestamp",
+      required: true,
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "Event"
+    }),
+    action: Field.select(
+      ["create", "update", "delete", "restore", "login", "logout", "permission_change", "config_change", "export", "import"],
+      {
+        label: "Action",
+        required: true,
+        readonly: true,
+        searchable: true,
+        description: "Action type (snake_case)",
+        group: "Event"
+      }
+    ),
+    user_id: Field.lookup("sys_user", {
+      label: "Actor",
+      required: false,
+      readonly: true,
+      searchable: true,
+      description: "User who performed the action (null for system actions)",
+      group: "Event"
+    }),
+    // ── Target record ────────────────────────────────────────────
+    object_name: Field.text({
+      label: "Object",
+      required: false,
+      readonly: true,
+      searchable: true,
+      maxLength: 255,
+      description: "Target object (e.g. sys_user, project_task)",
+      group: "Target"
+    }),
+    record_id: Field.text({
+      label: "Record ID",
+      required: false,
+      readonly: true,
+      searchable: true,
+      description: "ID of the affected record",
+      group: "Target"
+    }),
+    // ── Change payload ───────────────────────────────────────────
+    old_value: Field.textarea({
+      label: "Old Value",
+      required: false,
+      readonly: true,
+      description: "JSON-serialized previous state",
+      group: "Changes"
+    }),
+    new_value: Field.textarea({
+      label: "New Value",
+      required: false,
+      readonly: true,
+      description: "JSON-serialized new state",
+      group: "Changes"
+    }),
+    // ── Client fingerprint ───────────────────────────────────────
+    ip_address: Field.text({
+      label: "IP Address",
+      required: false,
+      readonly: true,
+      maxLength: 45,
+      group: "Client"
+    }),
+    user_agent: Field.textarea({
+      label: "User Agent",
+      required: false,
+      readonly: true,
+      group: "Client"
+    }),
+    // ── Context ──────────────────────────────────────────────────
+    tenant_id: Field.lookup("sys_organization", {
+      label: "Tenant",
+      required: false,
+      readonly: true,
+      description: "Tenant context for multi-tenant isolation",
+      group: "Context"
+    }),
+    metadata: Field.textarea({
+      label: "Metadata",
+      required: false,
+      readonly: true,
+      description: "JSON-serialized additional context",
+      group: "Context"
+    }),
+    // ── System ───────────────────────────────────────────────────
+    id: Field.text({
+      label: "Audit Log ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["created_at"] },
+    { fields: ["user_id"] },
+    { fields: ["object_name", "record_id"] },
+    { fields: ["action"] },
+    { fields: ["tenant_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    // Audit logs are themselves the audit trail
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list"],
+    // Read-only — creation happens via internal system hooks only
+    trash: false,
+    // Never soft-delete audit logs
+    mru: false,
+    clone: false
+  }
+});
+var SysPresence = ObjectSchema.create({
+  name: "sys_presence",
+  label: "Presence",
+  pluralLabel: "Presences",
+  icon: "wifi",
+  isSystem: true,
+  description: "Real-time user presence and activity tracking",
+  titleFormat: "{user_id} ({status})",
+  compactLayout: ["user_id", "status", "last_seen"],
+  fields: {
+    id: Field.text({
+      label: "Presence ID",
+      required: true,
+      readonly: true
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      searchable: true
+    }),
+    session_id: Field.lookup("sys_session", {
+      label: "Session",
+      required: true
+    }),
+    status: Field.select({
+      label: "Status",
+      required: true,
+      defaultValue: "online",
+      options: [
+        { value: "online", label: "Online" },
+        { value: "away", label: "Away" },
+        { value: "busy", label: "Busy" },
+        { value: "offline", label: "Offline" }
+      ]
+    }),
+    last_seen: Field.datetime({
+      label: "Last Seen",
+      required: true,
+      defaultValue: "NOW()"
+    }),
+    current_location: Field.text({
+      label: "Current Location",
+      required: false,
+      maxLength: 500
+    }),
+    device: Field.select({
+      label: "Device",
+      required: false,
+      options: [
+        { value: "desktop", label: "Desktop" },
+        { value: "mobile", label: "Mobile" },
+        { value: "tablet", label: "Tablet" },
+        { value: "other", label: "Other" }
+      ]
+    }),
+    custom_status: Field.text({
+      label: "Custom Status",
+      required: false,
+      maxLength: 255
+    }),
+    metadata: Field.json({
+      label: "Metadata",
+      required: false,
+      description: "Arbitrary JSON metadata associated with the presence state (matches PresenceStateSchema.metadata)."
+    })
+  },
+  indexes: [
+    { fields: ["user_id"], unique: false },
+    { fields: ["session_id"], unique: true },
+    { fields: ["status"], unique: false }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysActivity = ObjectSchema.create({
+  name: "sys_activity",
+  label: "Activity",
+  pluralLabel: "Activities",
+  icon: "activity",
+  isSystem: true,
+  description: "Recent activity stream entries (lightweight, denormalized)",
+  displayNameField: "summary",
+  titleFormat: "{type} \xB7 {summary}",
+  compactLayout: ["timestamp", "type", "actor_name", "summary"],
+  fields: {
+    id: Field.text({
+      label: "Activity ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    timestamp: Field.datetime({
+      label: "Timestamp",
+      required: true,
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "Event"
+    }),
+    type: Field.select(
+      [
+        "created",
+        "updated",
+        "deleted",
+        "commented",
+        "mentioned",
+        "shared",
+        "assigned",
+        "completed",
+        "login",
+        "logout",
+        "system"
+      ],
+      {
+        label: "Type",
+        required: true,
+        readonly: true,
+        searchable: true,
+        group: "Event"
+      }
+    ),
+    summary: Field.text({
+      label: "Summary",
+      required: true,
+      readonly: true,
+      maxLength: 500,
+      searchable: true,
+      description: "Human-readable one-line summary",
+      group: "Event"
+    }),
+    // ── Actor ───────────────────────────────────────────────────
+    actor_id: Field.lookup("sys_user", {
+      label: "Actor",
+      required: false,
+      readonly: true,
+      searchable: true,
+      group: "Actor"
+    }),
+    actor_name: Field.text({
+      label: "Actor Name",
+      required: false,
+      readonly: true,
+      group: "Actor"
+    }),
+    actor_avatar_url: Field.url({
+      label: "Actor Avatar",
+      required: false,
+      readonly: true,
+      group: "Actor"
+    }),
+    // ── Target ───────────────────────────────────────────────────
+    object_name: Field.text({
+      label: "Object",
+      required: false,
+      readonly: true,
+      searchable: true,
+      maxLength: 255,
+      description: "Target object short name (e.g. account, sys_user)",
+      group: "Target"
+    }),
+    record_id: Field.text({
+      label: "Record ID",
+      required: false,
+      readonly: true,
+      searchable: true,
+      group: "Target"
+    }),
+    record_label: Field.text({
+      label: "Record Label",
+      required: false,
+      readonly: true,
+      maxLength: 255,
+      description: "Display label of the target record at write time",
+      group: "Target"
+    }),
+    url: Field.url({
+      label: "URL",
+      required: false,
+      readonly: true,
+      description: "Optional deep-link to the activity target",
+      group: "Target"
+    }),
+    // ── Context ──────────────────────────────────────────────────
+    project_id: Field.lookup("sys_project", {
+      label: "Project",
+      required: false,
+      readonly: true,
+      searchable: true,
+      description: "Project context (multi-project deployments)",
+      group: "Context"
+    }),
+    metadata: Field.textarea({
+      label: "Metadata",
+      required: false,
+      readonly: true,
+      description: "JSON-serialized additional context",
+      group: "Context"
+    })
+  },
+  indexes: [
+    { fields: ["timestamp"] },
+    { fields: ["actor_id"] },
+    { fields: ["object_name", "record_id"] },
+    { fields: ["type"] },
+    { fields: ["project_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list"],
+    trash: false,
+    mru: false,
+    clone: false
+  }
+});
+var SysComment = ObjectSchema.create({
+  name: "sys_comment",
+  label: "Comment",
+  pluralLabel: "Comments",
+  icon: "message-square",
+  isSystem: true,
+  description: "Threaded comments attached to records via thread_id",
+  displayNameField: "body",
+  titleFormat: "{author_name}: {body}",
+  compactLayout: ["created_at", "author_name", "body"],
+  fields: {
+    id: Field.text({
+      label: "Comment ID",
+      required: true,
+      readonly: true,
+      group: "System"
+    }),
+    // ── Thread ───────────────────────────────────────────────────
+    thread_id: Field.text({
+      label: "Thread",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      description: "Thread identifier \u2014 conventionally `{object}:{record_id}` (e.g. `sys_user:abc123`)",
+      group: "Thread"
+    }),
+    parent_id: Field.lookup("sys_comment", {
+      label: "Parent Comment",
+      required: false,
+      description: "Optional parent comment for nested replies",
+      group: "Thread"
+    }),
+    reply_count: Field.number({
+      label: "Reply Count",
+      defaultValue: 0,
+      readonly: true,
+      group: "Thread"
+    }),
+    // ── Author ───────────────────────────────────────────────────
+    author_id: Field.lookup("sys_user", {
+      label: "Author",
+      required: true,
+      searchable: true,
+      group: "Author"
+    }),
+    author_name: Field.text({
+      label: "Author Name",
+      required: false,
+      group: "Author"
+    }),
+    author_avatar_url: Field.url({
+      label: "Author Avatar",
+      required: false,
+      group: "Author"
+    }),
+    // ── Body ─────────────────────────────────────────────────────
+    body: Field.textarea({
+      label: "Body",
+      required: true,
+      searchable: true,
+      description: "Comment text (Markdown supported)",
+      group: "Body"
+    }),
+    mentions: Field.textarea({
+      label: "Mentions",
+      required: false,
+      description: "JSON array of @mention objects",
+      group: "Body"
+    }),
+    reactions: Field.textarea({
+      label: "Reactions",
+      required: false,
+      description: "JSON array of emoji reaction objects",
+      group: "Body"
+    }),
+    // ── Lifecycle ────────────────────────────────────────────────
+    is_edited: Field.boolean({
+      label: "Edited",
+      defaultValue: false,
+      group: "Lifecycle"
+    }),
+    edited_at: Field.datetime({
+      label: "Edited At",
+      required: false,
+      group: "Lifecycle"
+    }),
+    visibility: Field.select(
+      ["public", "internal", "private"],
+      {
+        label: "Visibility",
+        defaultValue: "public",
+        group: "Lifecycle"
+      }
+    ),
+    created_at: Field.datetime({
+      label: "Created At",
+      required: true,
+      defaultValue: "NOW()",
+      readonly: true,
+      group: "System"
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      required: false,
+      group: "System"
+    })
+  },
+  indexes: [
+    { fields: ["thread_id", "created_at"] },
+    { fields: ["parent_id"] },
+    { fields: ["author_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    trash: true,
+    mru: false,
+    clone: false
+  }
+});
+var SysProject = ObjectSchema.create({
+  name: "sys_project",
+  label: "Project",
+  pluralLabel: "Projects",
+  icon: "layers",
+  isSystem: true,
+  description: "Control-plane registry of tenant projects (prod/test/dev/sandbox).",
+  titleFormat: "{display_name}",
+  compactLayout: ["display_name", "status", "is_default"],
+  fields: {
+    id: Field.text({
+      label: "Project ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the project (stable, never reused)."
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp."
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp."
+    }),
+    organization_id: Field.lookup("sys_organization", {
+      label: "Organization",
+      required: true,
+      description: "Foreign key to sys_organization."
+    }),
+    display_name: Field.text({
+      label: "Display Name",
+      required: true,
+      maxLength: 255,
+      description: "Display name shown in Studio and APIs."
+    }),
+    is_default: Field.boolean({
+      label: "Is Default",
+      required: true,
+      defaultValue: false,
+      description: "Whether this is the default project for the organization. Exactly one per org."
+    }),
+    is_system: Field.boolean({
+      label: "Is System",
+      required: true,
+      defaultValue: false,
+      description: "Whether this is a system project (platform infrastructure, not user data)."
+    }),
+    plan: Field.select({
+      label: "Plan",
+      required: true,
+      defaultValue: "free",
+      description: "Plan tier applied to this project for quota and billing.",
+      options: [
+        { value: "free", label: "Free" },
+        { value: "starter", label: "Starter" },
+        { value: "pro", label: "Pro" },
+        { value: "enterprise", label: "Enterprise" },
+        { value: "custom", label: "Custom" }
+      ]
+    }),
+    status: Field.select({
+      label: "Status",
+      required: true,
+      defaultValue: "provisioning",
+      description: "Project lifecycle status.",
+      options: [
+        { value: "provisioning", label: "Provisioning" },
+        { value: "active", label: "Active" },
+        { value: "suspended", label: "Suspended" },
+        { value: "archived", label: "Archived" },
+        { value: "failed", label: "Failed" },
+        { value: "migrating", label: "Migrating" }
+      ]
+    }),
+    created_by: Field.lookup("sys_user", {
+      label: "Created By",
+      required: true,
+      description: "User that created the project."
+    }),
+    database_url: Field.url({
+      label: "Database URL",
+      required: false,
+      description: "Connection URL for the project database (e.g. libsql://proj-uuid.turso.io). Set after provisioning."
+    }),
+    database_driver: Field.text({
+      label: "Database Driver",
+      required: false,
+      maxLength: 50,
+      description: "Data-plane driver key (turso, libsql, sqlite, memory, postgres)."
+    }),
+    storage_limit_mb: Field.number({
+      label: "Storage Limit (MB)",
+      required: false,
+      defaultValue: 1024,
+      description: "Storage quota in megabytes."
+    }),
+    provisioned_at: Field.datetime({
+      label: "Provisioned At",
+      required: false,
+      description: "When the physical database was provisioned."
+    }),
+    metadata: Field.textarea({
+      label: "Metadata",
+      required: false,
+      description: "JSON-serialized free-form metadata (feature flags, tags, \u2026)."
+    }),
+    hostname: Field.text({
+      label: "Hostname",
+      required: false,
+      maxLength: 255,
+      unique: true,
+      description: "Canonical hostname for this project (e.g. acme-dev.objectstack.app or api.acme.com). UNIQUE. Auto-set on creation; can be overridden for custom domains."
+    })
+  },
+  indexes: [
+    { fields: ["organization_id"] },
+    { fields: ["organization_id", "is_default"] },
+    { fields: ["status"] },
+    { fields: ["database_driver"] },
+    { fields: ["hostname"], unique: true }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: true
+  }
+});
+var SysProjectMember = ObjectSchema.create({
+  name: "sys_project_member",
+  label: "Project Member",
+  pluralLabel: "Project Members",
+  icon: "users",
+  isSystem: true,
+  description: "Per-project user/role assignments.",
+  titleFormat: "{user_id} @ {project_id}",
+  compactLayout: ["user_id", "project_id", "role"],
+  fields: {
+    id: Field.text({
+      label: "Membership ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the membership."
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp."
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp."
+    }),
+    project_id: Field.lookup("sys_project", {
+      label: "Project",
+      required: true,
+      description: "Foreign key to sys_project."
+    }),
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      description: "Foreign key to sys_user."
+    }),
+    role: Field.select({
+      label: "Role",
+      required: true,
+      description: "Per-project role (owner/admin/maker/reader/guest).",
+      options: [
+        { value: "owner", label: "Owner" },
+        { value: "admin", label: "Administrator" },
+        { value: "maker", label: "Maker / Developer" },
+        { value: "reader", label: "Reader" },
+        { value: "guest", label: "Guest" }
+      ]
+    }),
+    invited_by: Field.lookup("sys_user", {
+      label: "Invited By",
+      required: true,
+      description: "User that granted this membership."
+    })
+  },
+  indexes: [
+    { fields: ["project_id", "user_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["user_id"] },
+    { fields: ["role"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var SysProjectCredential = ObjectSchema.create({
+  name: "sys_project_credential",
+  label: "Project Credential",
+  pluralLabel: "Project Credentials",
+  icon: "key",
+  isSystem: true,
+  description: "Rotatable encrypted credentials for project databases.",
+  titleFormat: "{id}",
+  compactLayout: ["project_id", "status", "authorization", "expires_at"],
+  fields: {
+    id: Field.text({
+      label: "Credential ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the credential."
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp."
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp."
+    }),
+    project_id: Field.lookup("sys_project", {
+      label: "Project",
+      required: true,
+      description: "Foreign key to sys_project."
+    }),
+    secret_ciphertext: Field.textarea({
+      label: "Secret Ciphertext",
+      required: true,
+      description: "Encrypted auth token or secret (never store plaintext)."
+    }),
+    encryption_key_id: Field.text({
+      label: "Encryption Key ID",
+      required: true,
+      maxLength: 255,
+      description: "KMS/encryption key ID that produced the ciphertext."
+    }),
+    authorization: Field.select({
+      label: "Authorization",
+      required: true,
+      defaultValue: "full_access",
+      description: "Authorization scope for this credential.",
+      options: [
+        { value: "full_access", label: "Full Access" },
+        { value: "read_only", label: "Read Only" }
+      ]
+    }),
+    status: Field.select({
+      label: "Status",
+      required: true,
+      defaultValue: "active",
+      description: "Credential lifecycle status.",
+      options: [
+        { value: "active", label: "Active" },
+        { value: "rotating", label: "Rotating" },
+        { value: "revoked", label: "Revoked" }
+      ]
+    }),
+    expires_at: Field.datetime({
+      label: "Expires At",
+      required: false,
+      description: "Optional expiry \u2014 after this timestamp the credential must be rotated."
+    }),
+    revoked_at: Field.datetime({
+      label: "Revoked At",
+      required: false,
+      description: "Timestamp when the credential was revoked (null while active)."
+    })
+  },
+  indexes: [
+    { fields: ["project_id"] },
+    { fields: ["project_id", "status"] },
+    { fields: ["status"] },
+    { fields: ["expires_at"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update"],
+    trash: false,
+    mru: false
+  }
+});
+var SysApp = ObjectSchema.create({
+  name: "sys_app",
+  label: "App",
+  pluralLabel: "Apps",
+  icon: "layout-grid",
+  isSystem: true,
+  description: "Org-scoped catalog of apps across all projects (sys_app).",
+  titleFormat: "{label}",
+  compactLayout: ["label", "project_name", "source", "active"],
+  fields: {
+    id: Field.text({
+      label: "App Catalog ID",
+      required: true,
+      readonly: true,
+      description: "UUID of this catalog entry (stable, never reused)."
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp (ISO-8601)."
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp (ISO-8601)."
+    }),
+    organization_id: Field.lookup("sys_organization", {
+      label: "Organization",
+      required: true,
+      description: "Foreign key to sys_organization. Drives tenant isolation \u2014 ControlPlaneProxyDriver auto-injects this filter on all reads."
+    }),
+    project_id: Field.lookup("sys_project", {
+      label: "Project",
+      required: true,
+      description: "Foreign key to sys_project. The project this app lives in."
+    }),
+    project_name: Field.text({
+      label: "Project Name",
+      required: false,
+      description: "Denormalized project display name. Cached here so the catalog list avoids a JOIN against sys_project for card rendering."
+    }),
+    name: Field.text({
+      label: "App Name",
+      required: true,
+      description: "Short, machine name of the app (snake_case). Unique within a project."
+    }),
+    label: Field.text({
+      label: "Display Label",
+      required: false,
+      description: "Human-readable display label shown on the catalog card."
+    }),
+    icon: Field.text({
+      label: "Icon",
+      required: false,
+      description: "Icon identifier (e.g. lucide name, emoji, or URL)."
+    }),
+    branding: Field.textarea({
+      label: "Branding",
+      required: false,
+      description: "JSON-serialized branding subset (color, logo, \u2026) used for catalog rendering."
+    }),
+    is_default: Field.boolean({
+      label: "Is Default",
+      required: false,
+      defaultValue: false,
+      description: "Whether this is the default app for its project."
+    }),
+    active: Field.boolean({
+      label: "Active",
+      required: true,
+      defaultValue: true,
+      description: "Whether the app is currently enabled in its project kernel."
+    }),
+    source: Field.select({
+      label: "Source",
+      required: true,
+      defaultValue: "package",
+      description: "Where this app originates from.",
+      options: [
+        { value: "package", label: "Package" },
+        { value: "user", label: "User" }
+      ]
+    }),
+    package_id: Field.lookup("sys_package", {
+      label: "Package",
+      required: false,
+      description: "Foreign key to sys_package when source = package. Null for user-created apps."
+    })
+  },
+  indexes: [
+    { fields: ["project_id", "name"], unique: true },
+    { fields: ["organization_id"] },
+    { fields: ["project_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysPackage = ObjectSchema.create({
+  name: "sys_package",
+  label: "Package",
+  pluralLabel: "Packages",
+  icon: "package",
+  isSystem: true,
+  description: "Control-plane registry of installable packages / solutions (sys_package).",
+  titleFormat: "{display_name}",
+  compactLayout: ["display_name", "manifest_id", "visibility", "created_at"],
+  fields: {
+    id: Field.text({
+      label: "Package ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the package (stable, never reused)."
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp (ISO-8601)."
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp (ISO-8601)."
+    }),
+    manifest_id: Field.text({
+      label: "Manifest ID",
+      required: true,
+      readonly: true,
+      maxLength: 255,
+      description: "Globally unique reverse-domain package identifier (e.g. com.acme.crm). Immutable once set. Used as the stable public key for dependency declarations."
+    }),
+    owner_org_id: Field.lookup("sys_organization", {
+      label: "Owner Organization",
+      required: true,
+      description: "Organization that owns and publishes this package."
+    }),
+    display_name: Field.text({
+      label: "Display Name",
+      required: true,
+      maxLength: 128,
+      description: "Human-readable name shown in Studio and Marketplace."
+    }),
+    description: Field.textarea({
+      label: "Description",
+      required: false,
+      description: "Short package description shown in search results and install dialogs (max 512 chars)."
+    }),
+    readme: Field.textarea({
+      label: "Readme",
+      required: false,
+      description: "Long-form package documentation (markdown). Displayed on the Marketplace detail page."
+    }),
+    visibility: Field.select({
+      label: "Visibility",
+      required: true,
+      defaultValue: "private",
+      description: "Controls who can discover and install the package. private = owner org only; org = all envs in owner org; marketplace = public registry.",
+      options: [
+        { value: "private", label: "Private" },
+        { value: "org", label: "Organization" },
+        { value: "marketplace", label: "Marketplace" }
+      ]
+    }),
+    category: Field.text({
+      label: "Category",
+      required: false,
+      maxLength: 100,
+      description: "Primary category for Marketplace filtering (e.g. crm, hr, finance, devtools)."
+    }),
+    tags: Field.textarea({
+      label: "Tags",
+      required: false,
+      description: 'JSON-serialized array of search/filter tags (e.g. ["salesforce","sync","crm"]).'
+    }),
+    icon_url: Field.url({
+      label: "Icon URL",
+      required: false,
+      description: "URL to the package icon image displayed in Studio and Marketplace."
+    }),
+    homepage_url: Field.url({
+      label: "Homepage URL",
+      required: false,
+      description: "URL to the package homepage or external documentation site."
+    }),
+    license: Field.text({
+      label: "License",
+      required: false,
+      maxLength: 64,
+      description: "SPDX license identifier (e.g. MIT, Apache-2.0, proprietary)."
+    }),
+    created_by: Field.lookup("sys_user", {
+      label: "Created By",
+      required: true,
+      description: "User that registered this package in the Control Plane."
+    })
+  },
+  indexes: [
+    { fields: ["manifest_id"], unique: true },
+    { fields: ["owner_org_id"] },
+    { fields: ["visibility"] },
+    { fields: ["owner_org_id", "visibility"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update"],
+    trash: false,
+    mru: false
+  }
+});
+var SysPackageVersion = ObjectSchema.create({
+  name: "sys_package_version",
+  label: "Package Version",
+  pluralLabel: "Package Versions",
+  icon: "tag",
+  isSystem: true,
+  description: "Immutable release snapshot of a package (sys_package_version).",
+  titleFormat: "{package_id} v{version}",
+  compactLayout: ["package_id", "version", "status", "published_at"],
+  fields: {
+    id: Field.text({
+      label: "Version ID",
+      required: true,
+      readonly: true,
+      description: "UUID of this package version row (stable, never reused)."
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp (ISO-8601)."
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp (ISO-8601). Only modified while status is draft."
+    }),
+    package_id: Field.lookup("sys_package", {
+      label: "Package",
+      required: true,
+      description: "Foreign key to sys_package (the parent package)."
+    }),
+    version: Field.text({
+      label: "Version",
+      required: true,
+      maxLength: 64,
+      description: "Semantic version string (e.g. 1.2.3, 2.0.0-beta.1). Follows semver spec."
+    }),
+    status: Field.select({
+      label: "Status",
+      required: true,
+      defaultValue: "draft",
+      description: "Lifecycle status. draft = being authored, may be mutated. published = immutable snapshot, installable in any environment. deprecated = published but superseded; new installs blocked.",
+      options: [
+        { value: "draft", label: "Draft" },
+        { value: "published", label: "Published" },
+        { value: "deprecated", label: "Deprecated" }
+      ]
+    }),
+    manifest_json: Field.textarea({
+      label: "Manifest JSON",
+      required: false,
+      description: "Full package manifest serialized as JSON. Frozen on publish \u2014 writing to this field after status = published is rejected by the service layer."
+    }),
+    checksum: Field.text({
+      label: "Checksum",
+      required: false,
+      maxLength: 64,
+      readonly: true,
+      description: "SHA-256 hex digest of manifest_json. Computed and set on publish. Used for tamper detection."
+    }),
+    release_notes: Field.textarea({
+      label: "Release Notes",
+      required: false,
+      description: "Human-readable changelog for this version (markdown). Optional."
+    }),
+    min_platform_version: Field.text({
+      label: "Min Platform Version",
+      required: false,
+      maxLength: 32,
+      description: "Minimum ObjectStack platform version required to run this version (semver, e.g. 4.0.0). Denormalized from manifest_json for fast validation."
+    }),
+    is_pre_release: Field.boolean({
+      label: "Pre-release",
+      required: true,
+      defaultValue: false,
+      description: 'Whether this is a pre-release version (alpha, beta, rc). Pre-release versions are not installed by default when resolving "latest".'
+    }),
+    published_at: Field.datetime({
+      label: "Published At",
+      required: false,
+      description: "Timestamp when this version was published. Null while status is draft."
+    }),
+    published_by: Field.lookup("sys_user", {
+      label: "Published By",
+      required: false,
+      description: "User who published this version. Set on the draft \u2192 published transition."
+    }),
+    created_by: Field.lookup("sys_user", {
+      label: "Created By",
+      required: true,
+      description: "User that created this version row."
+    })
+  },
+  indexes: [
+    { fields: ["package_id", "version"], unique: true },
+    { fields: ["package_id"] },
+    { fields: ["status"] },
+    { fields: ["package_id", "status"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update"],
+    trash: false,
+    mru: false
+  }
+});
+var SysPackageInstallation = ObjectSchema.create({
+  name: "sys_package_installation",
+  label: "Package Installation",
+  pluralLabel: "Package Installations",
+  icon: "package",
+  isSystem: true,
+  description: "Per-project package installation registry (sys_package_installation).",
+  titleFormat: "{package_id} @ {project_id}",
+  compactLayout: ["package_version_id", "project_id", "status", "installed_at"],
+  fields: {
+    id: Field.text({
+      label: "Installation ID",
+      required: true,
+      readonly: true,
+      description: "UUID of this installation record (stable, never reused)."
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Creation timestamp (ISO-8601)."
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true,
+      description: "Last update timestamp \u2014 changes on upgrade, rollback, enable/disable (ISO-8601)."
+    }),
+    project_id: Field.lookup("sys_project", {
+      label: "Project",
+      required: true,
+      description: "Foreign key to sys_project. The project that owns this installation."
+    }),
+    package_version_id: Field.lookup("sys_package_version", {
+      label: "Package Version",
+      required: true,
+      description: "Foreign key to sys_package_version. The specific, immutable release snapshot currently installed in this project. Upgrading = swapping this field to a newer version. Rollback = swapping to an older version."
+    }),
+    package_id: Field.lookup("sys_package", {
+      label: "Package",
+      required: true,
+      description: "Foreign key to sys_package. Denormalized from the linked package_version row at install time to enforce the UNIQUE (project_id, package_id) constraint without a JOIN."
+    }),
+    status: Field.select({
+      label: "Status",
+      required: true,
+      defaultValue: "installed",
+      description: "Current lifecycle status of this installation within the project.",
+      options: [
+        { value: "installed", label: "Installed" },
+        { value: "installing", label: "Installing" },
+        { value: "upgrading", label: "Upgrading" },
+        { value: "disabled", label: "Disabled" },
+        { value: "error", label: "Error" }
+      ]
+    }),
+    enabled: Field.boolean({
+      label: "Enabled",
+      required: true,
+      defaultValue: true,
+      description: "Whether the package metadata is actively loaded into this project. Disabled packages are installed but their schema is not visible to the runtime."
+    }),
+    settings: Field.textarea({
+      label: "Settings",
+      required: false,
+      description: "JSON-serialized per-installation configuration overrides. Keys mirror the package manifest configurationSchema.properties."
+    }),
+    installed_at: Field.datetime({
+      label: "Installed At",
+      required: true,
+      defaultValue: "NOW()",
+      description: "Timestamp when this installation was first created (ISO-8601)."
+    }),
+    installed_by: Field.lookup("sys_user", {
+      label: "Installed By",
+      required: false,
+      description: "User who performed the initial install. Null for system-automated installs."
+    }),
+    error_message: Field.textarea({
+      label: "Error Message",
+      required: false,
+      description: "Error details when status is error. Cleared on next successful install/upgrade."
+    })
+  },
+  indexes: [
+    { fields: ["project_id", "package_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["package_id"] },
+    { fields: ["package_version_id"] },
+    { fields: ["status"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false,
+    mru: false
+  }
+});
+var SysMetadataObject = ObjectSchema.create({
+  name: "sys_metadata",
+  label: "System Metadata",
+  pluralLabel: "System Metadata",
+  icon: "settings",
+  isSystem: true,
+  description: "Stores platform and user-scope metadata records (objects, views, flows, etc.)",
+  fields: {
+    /** Primary Key (UUID) */
+    id: Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    /** Machine name — unique identifier used in code references */
+    name: Field.text({
+      label: "Name",
+      required: true,
+      searchable: true,
+      maxLength: 255
+    }),
+    /** Metadata type (e.g. "object", "view", "flow") */
+    type: Field.text({
+      label: "Metadata Type",
+      required: true,
+      searchable: true,
+      maxLength: 100
+    }),
+    /** Namespace / module grouping (e.g. "crm", "core") */
+    namespace: Field.text({
+      label: "Namespace",
+      required: false,
+      defaultValue: "default",
+      maxLength: 100
+    }),
+    /** Package that owns/delivered this metadata (legacy string identifier, kept for compat) */
+    package_id: Field.text({
+      label: "Package ID",
+      required: false,
+      maxLength: 255,
+      description: "Legacy package manifest ID string. Use package_version_id for new records."
+    }),
+    /**
+     * FK → sys_package_version (UUID). Set for metadata that belongs to a specific
+     * package release snapshot. NULL = platform-built-in or environment override.
+     */
+    package_version_id: Field.lookup("sys_package_version", {
+      label: "Package Version",
+      required: false,
+      description: "Foreign key to sys_package_version (UUID). Null = platform-built-in or env-level override."
+    }),
+    /** Who manages this record: package, platform, or user */
+    managed_by: Field.select(["package", "platform", "user"], {
+      label: "Managed By",
+      required: false
+    }),
+    /** Scope: system (code), platform (admin DB), user (personal DB) */
+    scope: Field.select(["system", "platform", "user"], {
+      label: "Scope",
+      required: true,
+      defaultValue: "platform"
+    }),
+    /** JSON payload — the actual metadata configuration */
+    metadata: Field.textarea({
+      label: "Metadata",
+      required: true,
+      description: "JSON-serialized metadata payload"
+    }),
+    /** Parent metadata name for extension/override */
+    extends: Field.text({
+      label: "Extends",
+      required: false,
+      maxLength: 255
+    }),
+    /** Merge strategy when extending parent metadata */
+    strategy: Field.select(["merge", "replace"], {
+      label: "Strategy",
+      required: false,
+      defaultValue: "merge"
+    }),
+    /** Owner user ID (for user-scope items) */
+    owner: Field.text({
+      label: "Owner",
+      required: false,
+      maxLength: 255
+    }),
+    /** Lifecycle state */
+    state: Field.select(["draft", "active", "archived", "deprecated"], {
+      label: "State",
+      required: false,
+      defaultValue: "active"
+    }),
+    /** Organization ID for multi-tenant isolation */
+    organization_id: Field.lookup("sys_organization", {
+      label: "Organization",
+      required: false,
+      description: "Organization for multi-tenant isolation."
+    }),
+    /** Project ID — null = platform-global, set = project-scoped */
+    project_id: Field.lookup("sys_project", {
+      label: "Project",
+      required: false,
+      description: "Foreign key to sys_project (UUID). Null = platform-global."
+    }),
+    /** Version number for optimistic concurrency */
+    version: Field.number({
+      label: "Version",
+      required: false,
+      defaultValue: 1
+    }),
+    /** Content checksum for change detection */
+    checksum: Field.text({
+      label: "Checksum",
+      required: false,
+      maxLength: 64
+    }),
+    /** Origin of this metadata record */
+    source: Field.select(["filesystem", "database", "api", "migration"], {
+      label: "Source",
+      required: false
+    }),
+    /** Classification tags (JSON array) */
+    tags: Field.textarea({
+      label: "Tags",
+      required: false,
+      description: "JSON-serialized array of classification tags"
+    }),
+    /** Audit fields */
+    created_by: Field.lookup("sys_user", {
+      label: "Created By",
+      required: false,
+      readonly: true
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      required: false,
+      readonly: true
+    }),
+    updated_by: Field.lookup("sys_user", {
+      label: "Updated By",
+      required: false
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      required: false
+    })
+  },
+  indexes: [
+    { fields: ["type", "name", "project_id"], unique: true },
+    { fields: ["type", "scope"] },
+    { fields: ["organization_id"] },
+    { fields: ["project_id"] },
+    { fields: ["package_version_id"] },
+    { fields: ["state"] },
+    { fields: ["namespace"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: false
+  }
+});
+var SysMetadataHistoryObject = ObjectSchema.create({
+  name: "sys_metadata_history",
+  label: "Metadata History",
+  pluralLabel: "Metadata History",
+  icon: "history",
+  isSystem: true,
+  description: "Version history and audit trail for metadata changes",
+  fields: {
+    /** Primary Key (UUID) */
+    id: Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    /** Foreign key to sys_metadata.id */
+    metadata_id: Field.lookup("sys_metadata", {
+      label: "Metadata",
+      required: true,
+      readonly: true
+    }),
+    /** Machine name (denormalized for easier querying) */
+    name: Field.text({
+      label: "Name",
+      required: true,
+      searchable: true,
+      readonly: true,
+      maxLength: 255
+    }),
+    /** Metadata type (denormalized for easier querying) */
+    type: Field.text({
+      label: "Metadata Type",
+      required: true,
+      searchable: true,
+      readonly: true,
+      maxLength: 100
+    }),
+    /** Version number at this snapshot */
+    version: Field.number({
+      label: "Version",
+      required: true,
+      readonly: true
+    }),
+    /** Type of operation that created this history entry */
+    operation_type: Field.select(["create", "update", "publish", "revert", "delete"], {
+      label: "Operation Type",
+      required: true,
+      readonly: true
+    }),
+    /** Historical metadata snapshot (JSON payload) */
+    metadata: Field.textarea({
+      label: "Metadata",
+      required: true,
+      readonly: true,
+      description: "JSON-serialized metadata snapshot at this version"
+    }),
+    /** SHA-256 checksum of metadata content */
+    checksum: Field.text({
+      label: "Checksum",
+      required: true,
+      readonly: true,
+      maxLength: 64
+    }),
+    /** Checksum of the previous version */
+    previous_checksum: Field.text({
+      label: "Previous Checksum",
+      required: false,
+      readonly: true,
+      maxLength: 64
+    }),
+    /** Human-readable description of changes */
+    change_note: Field.textarea({
+      label: "Change Note",
+      required: false,
+      readonly: true,
+      description: "Description of what changed in this version"
+    }),
+    /** Organization ID for multi-tenant isolation */
+    organization_id: Field.lookup("sys_organization", {
+      label: "Organization",
+      required: false,
+      readonly: true,
+      description: "Organization for multi-tenant isolation."
+    }),
+    /** Environment ID — null = platform-global, set = env-scoped */
+    project_id: Field.text({
+      label: "Environment ID",
+      required: false,
+      readonly: true,
+      maxLength: 255,
+      description: "Scopes this history entry to a specific environment."
+    }),
+    /** User who made this change */
+    recorded_by: Field.lookup("sys_user", {
+      label: "Recorded By",
+      required: false,
+      readonly: true
+    }),
+    /** When was this version recorded */
+    recorded_at: Field.datetime({
+      label: "Recorded At",
+      required: true,
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["metadata_id", "version"], unique: true },
+    { fields: ["metadata_id", "recorded_at"] },
+    { fields: ["type", "name"] },
+    { fields: ["recorded_at"] },
+    { fields: ["operation_type"] },
+    { fields: ["organization_id"] },
+    { fields: ["project_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    // Don't track history of history records
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ["get", "list"],
+    // Read-only via API
+    trash: false
+  }
+});
+var SysObject = ObjectSchema.create({
+  name: "sys_object",
+  label: "Object Definition",
+  pluralLabel: "Object Definitions",
+  description: "Metadata for business objects",
+  icon: "database",
+  isSystem: true,
+  fields: {
+    // Core Identity
+    name: Field.text({
+      label: "Object Name",
+      required: true,
+      maxLength: 255,
+      description: "Machine name (snake_case)"
+    }),
+    project_id: Field.text({
+      label: "Environment ID",
+      maxLength: 255,
+      description: "Project/environment scope \u2014 null = control-plane global"
+    }),
+    label: Field.text({
+      label: "Display Label",
+      required: true,
+      maxLength: 255
+    }),
+    plural_label: Field.text({
+      label: "Plural Label",
+      maxLength: 255
+    }),
+    description: Field.textarea({
+      label: "Description"
+    }),
+    icon: Field.text({
+      label: "Icon",
+      maxLength: 100
+    }),
+    // Classification
+    namespace: Field.text({
+      label: "Namespace",
+      maxLength: 100,
+      description: "Logical domain namespace"
+    }),
+    tags: Field.text({
+      label: "Tags",
+      description: "Comma-separated categorization tags"
+    }),
+    active: Field.boolean({
+      label: "Active",
+      defaultValue: true
+    }),
+    is_system: Field.boolean({
+      label: "System Object",
+      defaultValue: false,
+      description: "Protected from deletion"
+    }),
+    abstract: Field.boolean({
+      label: "Abstract",
+      defaultValue: false,
+      description: "Cannot be instantiated"
+    }),
+    // Storage
+    datasource: Field.text({
+      label: "Datasource",
+      maxLength: 100,
+      defaultValue: "default"
+    }),
+    table_name: Field.text({
+      label: "Table Name",
+      maxLength: 255,
+      description: "Physical table/collection name"
+    }),
+    // Complex Data (stored as JSON)
+    fields_json: Field.textarea({
+      label: "Fields (JSON)",
+      description: "Field definitions as JSON"
+    }),
+    indexes_json: Field.textarea({
+      label: "Indexes (JSON)",
+      description: "Index definitions as JSON"
+    }),
+    validations_json: Field.textarea({
+      label: "Validations (JSON)",
+      description: "Validation rules as JSON"
+    }),
+    state_machines_json: Field.textarea({
+      label: "State Machines (JSON)",
+      description: "State machine definitions as JSON"
+    }),
+    capabilities_json: Field.textarea({
+      label: "Capabilities (JSON)",
+      description: "Enabled system features as JSON"
+    }),
+    // Denormalized Fields
+    field_count: Field.number({
+      label: "Field Count",
+      description: "Number of fields defined"
+    }),
+    // Display
+    display_name_field: Field.text({
+      label: "Display Name Field",
+      maxLength: 100,
+      description: "Field to use as record display name"
+    }),
+    title_format: Field.text({
+      label: "Title Format",
+      maxLength: 255,
+      description: "Title expression template"
+    }),
+    compact_layout: Field.text({
+      label: "Compact Layout",
+      description: "Comma-separated field names for cards"
+    }),
+    // Capabilities
+    track_history: Field.boolean({
+      label: "Track History",
+      defaultValue: false
+    }),
+    searchable: Field.boolean({
+      label: "Searchable",
+      defaultValue: true
+    }),
+    api_enabled: Field.boolean({
+      label: "API Enabled",
+      defaultValue: true
+    }),
+    files: Field.boolean({
+      label: "Files",
+      defaultValue: false
+    }),
+    feeds: Field.boolean({
+      label: "Feeds",
+      defaultValue: false
+    }),
+    activities: Field.boolean({
+      label: "Activities",
+      defaultValue: false
+    }),
+    trash: Field.boolean({
+      label: "Trash",
+      defaultValue: true
+    }),
+    mru: Field.boolean({
+      label: "MRU",
+      defaultValue: true
+    }),
+    clone: Field.boolean({
+      label: "Clone",
+      defaultValue: true
+    }),
+    // Package Management
+    package_id: Field.lookup("sys_package", {
+      label: "Package"
+    }),
+    managed_by: Field.select({
+      label: "Managed By",
+      options: [
+        { value: "package", label: "Package" },
+        { value: "platform", label: "Platform" },
+        { value: "user", label: "User" }
+      ]
+    }),
+    // Audit
+    created_by: Field.lookup("sys_user", { label: "Created By" }),
+    created_at: Field.datetime({ label: "Created At" }),
+    updated_by: Field.lookup("sys_user", { label: "Updated By" }),
+    updated_at: Field.datetime({ label: "Updated At" })
+  },
+  indexes: [
+    { fields: ["name", "project_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["namespace"] },
+    { fields: ["package_id"] },
+    { fields: ["active"] },
+    { fields: ["is_system"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    trash: true,
+    mru: true
+  }
+});
+var SysView = ObjectSchema.create({
+  name: "sys_view",
+  label: "View Definition",
+  pluralLabel: "View Definitions",
+  description: "Metadata for UI views (grid, kanban, calendar, etc.)",
+  icon: "layout-grid",
+  isSystem: true,
+  fields: {
+    // Core Identity
+    name: Field.text({
+      label: "View Name",
+      required: true,
+      maxLength: 255
+    }),
+    project_id: Field.text({
+      label: "Environment ID",
+      maxLength: 255,
+      description: "Project/environment scope \u2014 null = control-plane global"
+    }),
+    label: Field.text({
+      label: "Display Label",
+      required: true,
+      maxLength: 255
+    }),
+    description: Field.textarea({
+      label: "Description"
+    }),
+    // Reference to Object
+    object_name: Field.text({
+      label: "Object Name",
+      required: true,
+      maxLength: 255,
+      description: "The object this view displays"
+    }),
+    // View Type
+    view_type: Field.select({
+      label: "View Type",
+      required: true,
+      options: [
+        { value: "grid", label: "Grid" },
+        { value: "kanban", label: "Kanban" },
+        { value: "calendar", label: "Calendar" },
+        { value: "gantt", label: "Gantt" },
+        { value: "form", label: "Form" },
+        { value: "timeline", label: "Timeline" }
+      ]
+    }),
+    // Complex Configuration
+    columns_json: Field.textarea({
+      label: "Columns (JSON)",
+      description: "Column definitions as JSON"
+    }),
+    filters_json: Field.textarea({
+      label: "Filters (JSON)",
+      description: "Filter definitions as JSON"
+    }),
+    sort_json: Field.textarea({
+      label: "Sort (JSON)",
+      description: "Sort configuration as JSON"
+    }),
+    config_json: Field.textarea({
+      label: "Configuration (JSON)",
+      description: "View-specific configuration as JSON"
+    }),
+    // Display Options
+    page_size: Field.number({
+      label: "Page Size",
+      defaultValue: 25,
+      min: 1,
+      max: 200
+    }),
+    show_search: Field.boolean({
+      label: "Show Search",
+      defaultValue: true
+    }),
+    show_filters: Field.boolean({
+      label: "Show Filters",
+      defaultValue: true
+    }),
+    // Classification
+    namespace: Field.text({
+      label: "Namespace",
+      maxLength: 100
+    }),
+    // Package Management
+    package_id: Field.lookup("sys_package", {
+      label: "Package"
+    }),
+    managed_by: Field.select({
+      label: "Managed By",
+      options: [
+        { value: "package", label: "Package" },
+        { value: "platform", label: "Platform" },
+        { value: "user", label: "User" }
+      ]
+    }),
+    // Audit
+    created_by: Field.lookup("sys_user", { label: "Created By" }),
+    created_at: Field.datetime({ label: "Created At" }),
+    updated_by: Field.lookup("sys_user", { label: "Updated By" }),
+    updated_at: Field.datetime({ label: "Updated At" })
+  },
+  indexes: [
+    { fields: ["name", "project_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["object_name"] },
+    { fields: ["view_type"] },
+    { fields: ["namespace"] },
+    { fields: ["package_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    trash: true,
+    mru: true
+  }
+});
+var SysAgent = ObjectSchema.create({
+  name: "sys_agent",
+  label: "AI Agent",
+  pluralLabel: "AI Agents",
+  description: "AI agent definitions",
+  icon: "bot",
+  isSystem: true,
+  fields: {
+    // Core Identity
+    name: Field.text({
+      label: "Agent Name",
+      required: true,
+      maxLength: 255
+    }),
+    project_id: Field.text({
+      label: "Environment ID",
+      maxLength: 255,
+      description: "Project/environment scope \u2014 null = control-plane global"
+    }),
+    label: Field.text({
+      label: "Display Label",
+      required: true,
+      maxLength: 255
+    }),
+    description: Field.textarea({
+      label: "Description"
+    }),
+    // Agent Type
+    agent_type: Field.select({
+      label: "Agent Type",
+      options: [
+        { value: "conversational", label: "Conversational" },
+        { value: "task", label: "Task-Based" },
+        { value: "analytical", label: "Analytical" },
+        { value: "workflow", label: "Workflow" }
+      ]
+    }),
+    // Model Configuration
+    model: Field.text({
+      label: "Model ID",
+      maxLength: 255,
+      description: "AI model identifier"
+    }),
+    temperature: Field.number({
+      label: "Temperature",
+      min: 0,
+      max: 2,
+      defaultValue: 0.7
+    }),
+    max_tokens: Field.number({
+      label: "Max Tokens",
+      min: 1,
+      max: 1e5
+    }),
+    top_p: Field.number({
+      label: "Top P",
+      min: 0,
+      max: 1
+    }),
+    // System Prompt
+    system_prompt: Field.textarea({
+      label: "System Prompt",
+      description: "Instructions for the AI agent"
+    }),
+    // Tools Configuration
+    tools_json: Field.textarea({
+      label: "Tools (JSON)",
+      description: "Available tools as JSON array"
+    }),
+    // Skills Configuration
+    skills_json: Field.textarea({
+      label: "Skills (JSON)",
+      description: "Available skills as JSON array"
+    }),
+    // Memory Configuration
+    memory_enabled: Field.boolean({
+      label: "Memory Enabled",
+      defaultValue: false
+    }),
+    memory_window: Field.number({
+      label: "Memory Window",
+      description: "Number of conversation turns to remember",
+      defaultValue: 10
+    }),
+    // Classification
+    namespace: Field.text({
+      label: "Namespace",
+      maxLength: 100
+    }),
+    // Package Management
+    package_id: Field.lookup("sys_package", {
+      label: "Package"
+    }),
+    managed_by: Field.select({
+      label: "Managed By",
+      options: [
+        { value: "package", label: "Package" },
+        { value: "platform", label: "Platform" },
+        { value: "user", label: "User" }
+      ]
+    }),
+    // Audit
+    created_by: Field.lookup("sys_user", { label: "Created By" }),
+    created_at: Field.datetime({ label: "Created At" }),
+    updated_by: Field.lookup("sys_user", { label: "Updated By" }),
+    updated_at: Field.datetime({ label: "Updated At" })
+  },
+  indexes: [
+    { fields: ["name", "project_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["agent_type"] },
+    { fields: ["namespace"] },
+    { fields: ["package_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    trash: true,
+    mru: true
+  }
+});
+var SysTool = ObjectSchema.create({
+  name: "sys_tool",
+  label: "AI Tool",
+  pluralLabel: "AI Tools",
+  description: "AI tool definitions",
+  icon: "wrench",
+  isSystem: true,
+  fields: {
+    // Core Identity
+    name: Field.text({
+      label: "Tool Name",
+      required: true,
+      maxLength: 255
+    }),
+    project_id: Field.text({
+      label: "Environment ID",
+      maxLength: 255,
+      description: "Project/environment scope \u2014 null = control-plane global"
+    }),
+    label: Field.text({
+      label: "Display Label",
+      required: true,
+      maxLength: 255
+    }),
+    description: Field.textarea({
+      label: "Description",
+      required: true
+    }),
+    // Parameters
+    parameters_json: Field.textarea({
+      label: "Parameters (JSON)",
+      description: "Tool parameter schema as JSON"
+    }),
+    // Implementation
+    handler_code: Field.textarea({
+      label: "Handler Code",
+      description: "Tool implementation code"
+    }),
+    // Classification
+    namespace: Field.text({
+      label: "Namespace",
+      maxLength: 100
+    }),
+    // Package Management
+    package_id: Field.lookup("sys_package", {
+      label: "Package"
+    }),
+    managed_by: Field.select({
+      label: "Managed By",
+      options: [
+        { value: "package", label: "Package" },
+        { value: "platform", label: "Platform" },
+        { value: "user", label: "User" }
+      ]
+    }),
+    // Audit
+    created_by: Field.lookup("sys_user", { label: "Created By" }),
+    created_at: Field.datetime({ label: "Created At" }),
+    updated_by: Field.lookup("sys_user", { label: "Updated By" }),
+    updated_at: Field.datetime({ label: "Updated At" })
+  },
+  indexes: [
+    { fields: ["name", "project_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["namespace"] },
+    { fields: ["package_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    trash: true,
+    mru: true
+  }
+});
+var SysFlow = ObjectSchema.create({
+  name: "sys_flow",
+  label: "Flow",
+  pluralLabel: "Flows",
+  description: "Visual logic flow definitions",
+  icon: "workflow",
+  isSystem: true,
+  fields: {
+    // Core Identity
+    name: Field.text({
+      label: "Flow Name",
+      required: true,
+      maxLength: 255
+    }),
+    project_id: Field.text({
+      label: "Environment ID",
+      maxLength: 255,
+      description: "Project/environment scope \u2014 null = control-plane global"
+    }),
+    label: Field.text({
+      label: "Display Label",
+      required: true,
+      maxLength: 255
+    }),
+    description: Field.textarea({
+      label: "Description"
+    }),
+    // Flow Type
+    flow_type: Field.select({
+      label: "Flow Type",
+      required: true,
+      options: [
+        { value: "autolaunched", label: "Autolaunched" },
+        { value: "screen", label: "Screen Flow" },
+        { value: "schedule", label: "Scheduled" },
+        { value: "trigger", label: "Trigger-Based" }
+      ]
+    }),
+    // Flow Definition
+    nodes_json: Field.textarea({
+      label: "Nodes (JSON)",
+      description: "Flow nodes as JSON"
+    }),
+    edges_json: Field.textarea({
+      label: "Edges (JSON)",
+      description: "Flow edges as JSON"
+    }),
+    variables_json: Field.textarea({
+      label: "Variables (JSON)",
+      description: "Flow variables as JSON"
+    }),
+    // Trigger Configuration
+    trigger_type: Field.select({
+      label: "Trigger Type",
+      options: [
+        { value: "record_created", label: "Record Created" },
+        { value: "record_updated", label: "Record Updated" },
+        { value: "record_deleted", label: "Record Deleted" },
+        { value: "schedule", label: "Schedule" },
+        { value: "platform_event", label: "Platform Event" }
+      ]
+    }),
+    trigger_object: Field.text({
+      label: "Trigger Object",
+      maxLength: 255
+    }),
+    // Status
+    active: Field.boolean({
+      label: "Active",
+      defaultValue: false
+    }),
+    // Classification
+    namespace: Field.text({
+      label: "Namespace",
+      maxLength: 100
+    }),
+    // Package Management
+    package_id: Field.lookup("sys_package", {
+      label: "Package"
+    }),
+    managed_by: Field.select({
+      label: "Managed By",
+      options: [
+        { value: "package", label: "Package" },
+        { value: "platform", label: "Platform" },
+        { value: "user", label: "User" }
+      ]
+    }),
+    // Audit
+    created_by: Field.lookup("sys_user", { label: "Created By" }),
+    created_at: Field.datetime({ label: "Created At" }),
+    updated_by: Field.lookup("sys_user", { label: "Updated By" }),
+    updated_at: Field.datetime({ label: "Updated At" })
+  },
+  indexes: [
+    { fields: ["name", "project_id"], unique: true },
+    { fields: ["project_id"] },
+    { fields: ["flow_type"] },
+    { fields: ["active"] },
+    { fields: ["namespace"] },
+    { fields: ["package_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    trash: true,
+    mru: true
+  }
+});
+
+// src/apps/setup.app.ts
+var SETUP_APP = {
+  name: "setup",
+  label: "Setup",
+  description: "Platform settings and administration",
+  icon: "settings",
+  active: true,
+  isDefault: false,
+  branding: {
+    primaryColor: "#475569"
+    // Slate-600 — neutral admin palette
+  },
+  requiredPermissions: ["setup.access"],
+  navigation: [
+    {
+      id: "group_overview",
+      type: "group",
+      label: "Overview",
+      icon: "layout-dashboard",
+      children: [
+        { id: "nav_system_overview", type: "dashboard", label: "System Overview", dashboardName: "system_overview", icon: "activity" },
+        { id: "nav_security_overview", type: "dashboard", label: "Security Overview", dashboardName: "security_overview", icon: "shield" }
+      ]
+    },
+    {
+      id: "group_administration",
+      type: "group",
+      label: "Administration",
+      icon: "shield",
+      children: [
+        { id: "nav_users", type: "object", label: "Users", objectName: "sys_user", icon: "users" },
+        { id: "nav_organizations", type: "object", label: "Organizations", objectName: "sys_organization", icon: "building-2" },
+        { id: "nav_teams", type: "object", label: "Teams", objectName: "sys_team", icon: "users-round" },
+        { id: "nav_api_keys", type: "object", label: "API Keys", objectName: "sys_api_key", icon: "key" },
+        { id: "nav_roles", type: "object", label: "Roles", objectName: "sys_role", icon: "shield-check" },
+        { id: "nav_permission_sets", type: "object", label: "Permission Sets", objectName: "sys_permission_set", icon: "lock" },
+        { id: "nav_oauth_apps", type: "object", label: "OAuth Apps", objectName: "sys_oauth_application", icon: "app-window" },
+        { id: "nav_jwks", type: "object", label: "Signing Keys", objectName: "sys_jwks", icon: "key-round" }
+      ]
+    },
+    {
+      id: "group_platform",
+      type: "group",
+      label: "Platform",
+      icon: "layers",
+      children: [
+        { id: "nav_objects", type: "object", label: "Objects", objectName: "sys_object", icon: "database" },
+        { id: "nav_views", type: "object", label: "Views", objectName: "sys_view", icon: "table" },
+        { id: "nav_flows", type: "object", label: "Flows", objectName: "sys_flow", icon: "workflow" },
+        { id: "nav_agents", type: "object", label: "AI Agents", objectName: "sys_agent", icon: "bot" },
+        { id: "nav_tools", type: "object", label: "AI Tools", objectName: "sys_tool", icon: "wrench" },
+        { id: "nav_apps", type: "object", label: "Apps", objectName: "sys_app", icon: "layout-grid" },
+        { id: "nav_packages", type: "object", label: "Packages", objectName: "sys_package", icon: "package" },
+        { id: "nav_package_installations", type: "object", label: "Installations", objectName: "sys_package_installation", icon: "package-check" },
+        { id: "nav_metadata", type: "object", label: "All Metadata", objectName: "sys_metadata", icon: "file-cog" }
+      ]
+    },
+    {
+      id: "group_system",
+      type: "group",
+      label: "System",
+      icon: "settings",
+      children: [
+        { id: "nav_sessions", type: "object", label: "Sessions", objectName: "sys_session", icon: "monitor" },
+        { id: "nav_audit_logs", type: "object", label: "Audit Logs", objectName: "sys_audit_log", icon: "scroll-text" },
+        { id: "nav_activity", type: "object", label: "Activity", objectName: "sys_activity", icon: "activity" },
+        { id: "nav_comments", type: "object", label: "Comments", objectName: "sys_comment", icon: "message-square" }
+      ]
+    }
+  ]
+};
+
+// src/apps/views/users.view.ts
+var UsersView = {
+  name: "users",
+  label: "Users",
+  type: "grid",
+  data: {
+    provider: "object",
+    object: "sys_user"
+  },
+  columns: [
+    { field: "name", label: "Name", sortable: true },
+    { field: "email", label: "Email", sortable: true },
+    { field: "phone", label: "Phone" },
+    { field: "status", label: "Status", sortable: true },
+    { field: "active", label: "Active", sortable: true },
+    { field: "created_at", label: "Created", sortable: true }
+  ],
+  sort: [{ field: "created_at", order: "desc" }],
+  filter: [],
+  searchableFields: ["name", "email"],
+  pagination: {
+    pageSize: 20
+  }
+};
+
+// src/apps/views/organizations.view.ts
+var OrganizationsView = {
+  name: "organizations",
+  label: "Organizations",
+  type: "grid",
+  data: {
+    provider: "object",
+    object: "sys_organization"
+  },
+  columns: [
+    { field: "name", label: "Name", sortable: true },
+    { field: "status", label: "Status", sortable: true },
+    { field: "plan_tier", label: "Plan Tier" },
+    { field: "member_count", label: "Members" },
+    { field: "created_at", label: "Created", sortable: true }
+  ],
+  sort: [{ field: "created_at", order: "desc" }],
+  filter: [],
+  searchableFields: ["name"],
+  pagination: {
+    pageSize: 20
+  }
+};
+
+// src/apps/views/roles.view.ts
+var RolesView = {
+  name: "roles",
+  label: "Roles",
+  type: "grid",
+  data: {
+    provider: "object",
+    object: "sys_role"
+  },
+  columns: [
+    { field: "name", label: "Name", sortable: true },
+    { field: "description", label: "Description" },
+    { field: "is_system", label: "System Role" },
+    { field: "created_at", label: "Created", sortable: true }
+  ],
+  sort: [{ field: "created_at", order: "desc" }],
+  filter: [],
+  searchableFields: ["name", "description"],
+  pagination: {
+    pageSize: 20
+  }
+};
+
+// src/apps/views/sessions.view.ts
+var SessionsView = {
+  name: "sessions",
+  label: "Sessions",
+  type: "grid",
+  data: {
+    provider: "object",
+    object: "sys_session"
+  },
+  columns: [
+    { field: "user_id", label: "User", sortable: true },
+    { field: "ip_address", label: "IP Address" },
+    { field: "created_at", label: "Created", sortable: true },
+    { field: "expires_at", label: "Expires", sortable: true }
+  ],
+  sort: [{ field: "created_at", order: "desc" }],
+  filter: [],
+  searchableFields: ["user_id"],
+  pagination: {
+    pageSize: 20
+  }
+};
+
+// src/apps/views/audit_logs.view.ts
+var AuditLogsView = {
+  name: "audit_logs",
+  label: "Audit Logs",
+  type: "grid",
+  data: {
+    provider: "object",
+    object: "sys_audit_log"
+  },
+  columns: [
+    { field: "created_at", label: "Timestamp", sortable: true },
+    { field: "action", label: "Action", sortable: true },
+    { field: "user_id", label: "Actor" },
+    { field: "object_name", label: "Object" },
+    { field: "record_id", label: "Record ID" }
+  ],
+  sort: [{ field: "created_at", order: "desc" }],
+  filter: [],
+  searchableFields: ["action", "object_name", "record_id"],
+  pagination: {
+    pageSize: 20
+  }
+};
+
+// src/apps/views/package_installations.view.ts
+var PackageInstallationsView = {
+  name: "package_installations",
+  label: "Package Installations",
+  type: "grid",
+  data: {
+    provider: "object",
+    object: "sys_package_installation"
+  },
+  columns: [
+    { field: "package_id", label: "Package", sortable: true },
+    { field: "project_id", label: "Project", sortable: true },
+    { field: "package_version_id", label: "Version" },
+    { field: "status", label: "Status", sortable: true },
+    { field: "installed_at", label: "Installed", sortable: true }
+  ],
+  sort: [{ field: "installed_at", order: "desc" }],
+  filter: [],
+  searchableFields: ["package_id", "project_id"],
+  pagination: {
+    pageSize: 20
+  }
+};
+var SystemOverviewDashboard = Dashboard.create({
+  name: "system_overview",
+  label: "System Overview",
+  description: "Platform health, sessions, and audit activity",
+  // 12-column grid matches the widget `w` values below (3, 6, 12). Without
+  // this, the renderer falls back to a 4-column grid and `w: 3` becomes 75%
+  // width per metric — so KPI cards stack vertically instead of forming a
+  // 4-up row.
+  columns: 12,
+  gap: 4,
+  widgets: [
+    // ── Active Sessions Widget ──────────────────────────────────────
+    {
+      id: "widget_active_sessions",
+      title: "Active Sessions",
+      type: "metric",
+      object: "sys_session",
+      layout: {
+        x: 0,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      aggregate: "count",
+      colorVariant: "blue",
+      description: "Number of currently active user sessions"
+    },
+    // ── Total Users Widget ──────────────────────────────────────────
+    {
+      id: "widget_total_users",
+      title: "Total Users",
+      type: "metric",
+      object: "sys_user",
+      layout: {
+        x: 3,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      aggregate: "count",
+      colorVariant: "teal",
+      description: "Total registered users in the system"
+    },
+    // ── Organizations Widget ────────────────────────────────────────
+    {
+      id: "widget_organizations",
+      title: "Organizations",
+      type: "metric",
+      object: "sys_organization",
+      layout: {
+        x: 6,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      aggregate: "count",
+      colorVariant: "orange",
+      description: "Total organizations on the platform"
+    },
+    // ── Packages Installed Widget ───────────────────────────────────
+    {
+      id: "widget_packages_installed",
+      title: "Packages Installed",
+      type: "metric",
+      object: "sys_package_installation",
+      layout: {
+        x: 9,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      filter: {
+        field: "status",
+        operator: "equals",
+        value: "installed"
+      },
+      aggregate: "count",
+      colorVariant: "success",
+      description: "Active package installations across projects"
+    },
+    // ── Audit Actions by Type (last 7 days) ─────────────────────────
+    {
+      id: "widget_audit_actions",
+      title: "Audit Actions (7d)",
+      description: "Distribution of audit events by action type",
+      type: "pie",
+      object: "sys_audit_log",
+      layout: {
+        x: 0,
+        y: 2,
+        w: 6,
+        h: 4
+      },
+      categoryField: "action",
+      aggregate: "count",
+      filter: {
+        field: "created_at",
+        operator: "gte",
+        value: "NOW() - INTERVAL 7 DAY"
+      }
+    },
+    // ── Session Status Overview ─────────────────────────────────────
+    {
+      id: "widget_active_orgs",
+      title: "Sessions by Organization",
+      description: "Active sessions grouped by organization",
+      type: "bar",
+      object: "sys_session",
+      layout: {
+        x: 6,
+        y: 2,
+        w: 6,
+        h: 4
+      },
+      categoryField: "active_organization_id",
+      aggregate: "count"
+    },
+    // ── Recent Audit Log (Table) ────────────────────────────────────
+    {
+      id: "widget_recent_events",
+      title: "Recent Audit Events",
+      description: "Latest platform events",
+      type: "metric",
+      object: "sys_audit_log",
+      layout: {
+        x: 0,
+        y: 6,
+        w: 12,
+        h: 3
+      },
+      aggregate: "count",
+      colorVariant: "default"
+    }
+  ],
+  globalFilters: [
+    {
+      field: "created_at",
+      type: "date",
+      label: "Date Range",
+      scope: "dashboard",
+      defaultValue: "last_7_days"
+    }
+  ]
+});
+var SecurityOverviewDashboard = Dashboard.create({
+  name: "security_overview",
+  label: "Security Overview",
+  description: "Security events, authentication, and audit trails",
+  // 12-column grid matches the widget `w` values below.
+  columns: 12,
+  gap: 4,
+  widgets: [
+    // ── Failed Login Attempts Widget ────────────────────────────────
+    {
+      id: "widget_failed_logins",
+      title: "Failed Login Attempts",
+      type: "metric",
+      object: "sys_audit_log",
+      layout: {
+        x: 0,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      filter: {
+        field: "action",
+        operator: "equals",
+        value: "login"
+      },
+      aggregate: "count",
+      colorVariant: "danger",
+      description: "Failed authentication attempts (24h)"
+    },
+    // ── Permission Changes Widget ───────────────────────────────────
+    {
+      id: "widget_permission_changes",
+      title: "Permission Changes",
+      type: "metric",
+      object: "sys_audit_log",
+      layout: {
+        x: 3,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      filter: {
+        field: "action",
+        operator: "equals",
+        value: "permission_change"
+      },
+      aggregate: "count",
+      colorVariant: "warning",
+      description: "Recent permission and role modifications"
+    },
+    // ── System Config Changes Widget ────────────────────────────────
+    {
+      id: "widget_config_changes",
+      title: "Config Changes",
+      type: "metric",
+      object: "sys_audit_log",
+      layout: {
+        x: 6,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      filter: {
+        field: "action",
+        operator: "equals",
+        value: "config_change"
+      },
+      aggregate: "count",
+      colorVariant: "blue",
+      description: "System configuration modifications"
+    },
+    // ── Active Sessions Widget ──────────────────────────────────────
+    {
+      id: "widget_active_sessions",
+      title: "Active Sessions",
+      type: "metric",
+      object: "sys_session",
+      layout: {
+        x: 9,
+        y: 0,
+        w: 3,
+        h: 2
+      },
+      aggregate: "count",
+      colorVariant: "success",
+      description: "Currently active user sessions"
+    },
+    // ── Audit Events by Type ────────────────────────────────────────
+    {
+      id: "widget_events_by_type",
+      title: "Audit Events by Type",
+      description: "Distribution of security and audit events",
+      type: "pie",
+      object: "sys_audit_log",
+      layout: {
+        x: 0,
+        y: 2,
+        w: 6,
+        h: 4
+      },
+      categoryField: "action",
+      aggregate: "count"
+    },
+    // ── Audit Events by User ────────────────────────────────────────
+    {
+      id: "widget_events_by_user",
+      title: "Events by User",
+      description: "Activity distribution across users",
+      type: "bar",
+      object: "sys_audit_log",
+      layout: {
+        x: 6,
+        y: 2,
+        w: 6,
+        h: 4
+      },
+      categoryField: "user_id",
+      aggregate: "count"
+    },
+    // ── Recent Security Events (Table) ──────────────────────────────
+    {
+      id: "widget_recent_security_events",
+      title: "Recent Security Events",
+      description: "Latest permission and config changes",
+      type: "metric",
+      object: "sys_audit_log",
+      layout: {
+        x: 0,
+        y: 6,
+        w: 12,
+        h: 3
+      },
+      aggregate: "count",
+      colorVariant: "default"
+    }
+  ],
+  globalFilters: [
+    {
+      field: "created_at",
+      type: "date",
+      label: "Date Range",
+      scope: "dashboard",
+      defaultValue: "last_7_days"
+    }
+  ]
+});
+
+export { AuditLogsView, OrganizationsView, PackageInstallationsView, RolesView, SETUP_APP, SecurityOverviewDashboard, SessionsView, SysAccount, SysActivity, SysAgent, SysApiKey, SysApp, SysAuditLog, SysComment, SysDeviceCode, SysFlow, SysInvitation, SysJwks, SysMember, SysMetadataObject as SysMetadata, SysMetadataHistoryObject, SysMetadataObject, SysOauthAccessToken, SysOauthApplication, SysOauthConsent, SysOauthRefreshToken, SysObject, SysOrganization, SysPackage, SysPackageInstallation, SysPackageVersion, SysPermissionSet, SysPresence, SysProject, SysProjectCredential, SysProjectMember, SysRole, SysSession, SysTeam, SysTeamMember, SysTool, SysTwoFactor, SysUser, SysUserPreference, SysVerification, SysView, SystemOverviewDashboard, UsersView };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map