@objectstack/platform-objects 14.8.0 → 15.1.0

package/dist/identity/index.js

@@ -53,7 +53,7 @@ var SysUser = data.ObjectSchema.create({
       // "add a teammate" affordance — the Users list is always reachable —
       // and every add flows through better-auth invitations, never bespoke
       // sys_user CRUD.
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -64,9 +64,11 @@ var SysUser = data.ObjectSchema.create({
     // ── Platform admin operations (require better-auth `admin` plugin) ─
     //
     // These actions hit /api/v1/auth/admin/* endpoints that are only
-    // wired when `auth.plugins.admin` is enabled. When the plugin is
-    // disabled the actions still render (schema is static) but server
-    // returns 404. UI surfaces them under the row menu AND the
+    // wired when `auth.plugins.admin` is enabled, so each one is gated on
+    // `requiresFeature: 'admin'` (#2874) — when the plugin is off the UI
+    // hides them instead of rendering buttons that 404. SCIM deployments
+    // keep them: SCIM forces the admin plugin (and `features.admin`) on
+    // (ADR-0071). UI surfaces them under the row menu AND the
     // record-detail header (`record_header`, overflowing into the ⋯
     // "More" menu) so platform admins can manage an account from either
     // the Users list or an open user record — without dropping to SQL or
@@ -79,6 +81,7 @@ var SysUser = data.ObjectSchema.create({
       locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/ban-user",
+      requiresFeature: "admin",
       recordIdParam: "userId",
       successMessage: "User banned",
       refreshAfter: true,
@@ -95,6 +98,7 @@ var SysUser = data.ObjectSchema.create({
       locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/unban-user",
+      requiresFeature: "admin",
       recordIdParam: "userId",
       successMessage: "User unbanned",
       refreshAfter: true
@@ -110,6 +114,7 @@ var SysUser = data.ObjectSchema.create({
       locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/unlock-user",
+      requiresFeature: "admin",
       recordIdParam: "userId",
       successMessage: "Account unlocked",
       refreshAfter: true
@@ -129,7 +134,7 @@ var SysUser = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/admin/create-user",
-      visible: "features.admin == true",
+      requiresFeature: "admin",
       successMessage: "User created",
       refreshAfter: true,
       params: [
@@ -146,7 +151,7 @@ var SysUser = data.ObjectSchema.create({
           // otherwise the create-user endpoint rejects a phone with
           // "Phone numbers require the phoneNumber auth plugin". `features.phoneNumber`
           // is served in /api/v1/auth/config (getPublicConfig).
-          visible: "features.phoneNumber == true"
+          requiresFeature: "phoneNumber"
         },
         { field: "name", required: false },
         {
@@ -188,6 +193,7 @@ var SysUser = data.ObjectSchema.create({
       // legacy role scalar), can mint a temporary password, and stamps
       // must_change_password.
       target: "/api/v1/auth/admin/set-user-password",
+      requiresFeature: "admin",
       recordIdParam: "userId",
       successMessage: "Password updated",
       refreshAfter: false,
@@ -225,6 +231,7 @@ var SysUser = data.ObjectSchema.create({
       locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/set-role",
+      requiresFeature: "admin",
       recordIdParam: "userId",
       successMessage: "Role updated",
       refreshAfter: true,
@@ -240,6 +247,7 @@ var SysUser = data.ObjectSchema.create({
       locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/impersonate-user",
+      requiresFeature: "admin",
       recordIdParam: "userId",
       successMessage: "Now impersonating user",
       refreshAfter: true,
@@ -357,6 +365,7 @@ var SysUser = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/two-factor/enable",
       visible: "record.id == ctx.user.id && record.two_factor_enabled != true",
+      requiresFeature: "twoFactor",
       successMessage: "Two-factor authentication enabled. Scan the QR code or paste the otpauth URI into your authenticator app, then verify a code to complete setup.",
       refreshAfter: true,
       params: [
@@ -372,6 +381,7 @@ var SysUser = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/two-factor/disable",
       visible: "record.id == ctx.user.id && record.two_factor_enabled == true",
+      requiresFeature: "twoFactor",
       confirmText: "Turn off two-factor authentication? Your account will be less secure.",
       successMessage: "Two-factor authentication disabled.",
       refreshAfter: true,
@@ -388,6 +398,7 @@ var SysUser = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/two-factor/generate-backup-codes",
       visible: "record.id == ctx.user.id && record.two_factor_enabled == true",
+      requiresFeature: "twoFactor",
       confirmText: "Generate a new set of backup codes? Any previously generated codes will stop working.",
       successMessage: "New backup codes generated \u2014 save them somewhere safe.",
       refreshAfter: false,
@@ -1195,7 +1206,7 @@ var SysOrganization = data.ObjectSchema.create({
       // populated by the console/account shells from `/auth/config`;
       // we default to visible when the flag is undefined so we don't
       // accidentally hide the button while auth config is still loading.
-      visible: "features.multiOrgEnabled != false",
+      requiresFeature: "multiOrgEnabled",
       params: [
         { field: "name", required: true },
         { field: "slug", required: true },
@@ -1216,7 +1227,7 @@ var SysOrganization = data.ObjectSchema.create({
       // Org-admin actions are multi-org-only; hide them in single-org for
       // consistency with `create_organization` (the org list is empty there,
       // but this also guards direct record-URL access).
-      visible: "features.multiOrgEnabled != false",
+      requiresFeature: "multiOrgEnabled",
       successMessage: "Organization updated",
       refreshAfter: true,
       params: [
@@ -1235,7 +1246,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/delete",
       recordIdParam: "organizationId",
-      visible: "features.multiOrgEnabled != false",
+      requiresFeature: "multiOrgEnabled",
       confirmText: "Delete this organization? All members will lose access immediately. This cannot be undone.",
       successMessage: "Organization deleted",
       refreshAfter: true
@@ -1254,7 +1265,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/set-active",
       recordIdParam: "organizationId",
-      visible: "features.multiOrgEnabled != false",
+      requiresFeature: "multiOrgEnabled",
       successMessage: "Active organization switched",
       refreshAfter: true
     },
@@ -1271,7 +1282,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/leave",
       recordIdParam: "organizationId",
-      visible: "features.multiOrgEnabled != false",
+      requiresFeature: "multiOrgEnabled",
       confirmText: "Leave this organization? You will lose access to all of its resources.",
       successMessage: "You have left the organization",
       refreshAfter: true
@@ -1293,7 +1304,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/cloud/organizations/{id}/change-slug",
       method: "POST",
-      visible: "features.multiOrgEnabled != false",
+      requiresFeature: "multiOrgEnabled",
       confirmText: "Renaming the slug rewrites every platform subdomain for this org and parks the old slug for 90 days. Continue?",
       successMessage: "Organization slug changed",
       refreshAfter: true,
@@ -1431,7 +1442,7 @@ var SysMember = data.ObjectSchema.create({
       // better-auth endpoints resolve the session's active org, which
       // single-org mode now guarantees via plugin-auth's default-org
       // bootstrap. Same gate on every membership mutation below.
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Member added",
       refreshAfter: true,
       params: [
@@ -1449,7 +1460,7 @@ var SysMember = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Member role updated",
       refreshAfter: true,
       params: [
@@ -1466,7 +1477,7 @@ var SysMember = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-member",
       recordIdParam: "memberIdOrEmail",
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       confirmText: "Remove this member from the organization? They will lose access to all org resources.",
       successMessage: "Member removed",
       refreshAfter: true
@@ -1488,7 +1499,10 @@ var SysMember = data.ObjectSchema.create({
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
       bodyExtra: { role: "owner" },
-      visible: "record.role != 'owner' && features.organization != false",
+      // The residual row predicate stays hand-written; the feature gate is
+      // AND-composed onto it by the requiresFeature lowering.
+      visible: "record.role != 'owner'",
+      requiresFeature: "organization",
       confirmText: "Transfer ownership of this organization to the selected member? You will be demoted to admin and lose owner-only privileges.",
       successMessage: "Ownership transferred",
       refreshAfter: true
@@ -1596,7 +1610,7 @@ var SysInvitation = data.ObjectSchema.create({
       // sys_organization.create_organization). The recipient-side
       // accept/reject actions below stay record-gated — they are
       // unreachable in single-org anyway (no invitation rows exist).
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -1614,7 +1628,7 @@ var SysInvitation = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/cancel-invitation",
       recordIdParam: "invitationId",
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       confirmText: "Cancel this invitation? The recipient will no longer be able to accept it.",
       successMessage: "Invitation canceled",
       refreshAfter: true
@@ -1628,7 +1642,7 @@ var SysInvitation = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
       bodyExtra: { resend: true },
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Invitation resent",
       refreshAfter: true,
       params: [
@@ -1818,7 +1832,7 @@ var SysTeam = data.ObjectSchema.create({
       // Teams are nested inside organizations — a multi-org-only concept.
       // Gate every team mutation on the multi-org flag so the affordances
       // disappear in single-org (mirrors sys_organization.create_organization).
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Team created",
       refreshAfter: true,
       params: [
@@ -1839,7 +1853,7 @@ var SysTeam = data.ObjectSchema.create({
       target: "/api/v1/auth/organization/update-team",
       recordIdParam: "teamId",
       bodyShape: { wrap: "data" },
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Team updated",
       refreshAfter: true,
       params: [
@@ -1858,7 +1872,7 @@ var SysTeam = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-team",
       recordIdParam: "teamId",
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       confirmText: "Delete this team? Members will lose any team-scoped access. This cannot be undone.",
       successMessage: "Team deleted",
       refreshAfter: true
@@ -1972,7 +1986,7 @@ var SysTeamMember = data.ObjectSchema.create({
       // Team membership lives under organizations — multi-org-only. Gate
       // both mutations so they vanish in single-org (mirrors
       // sys_organization.create_organization).
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Team member added",
       refreshAfter: true,
       params: [
@@ -1993,7 +2007,7 @@ var SysTeamMember = data.ObjectSchema.create({
       locations: ["list_item"],
       type: "api",
       target: "/api/v1/auth/organization/remove-team-member",
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       confirmText: "Remove this user from the team? They will lose any team-scoped access.",
       successMessage: "Team member removed",
       refreshAfter: true,
@@ -2549,6 +2563,7 @@ var SysTwoFactor = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/two-factor/enable",
+      requiresFeature: "twoFactor",
       refreshAfter: true,
       params: [
         { name: "password", label: "Current Password", type: "text", required: true }
@@ -2571,6 +2586,7 @@ var SysTwoFactor = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/two-factor/disable",
+      requiresFeature: "twoFactor",
       confirmText: "Disable two-factor authentication on your account?",
       successMessage: "2FA disabled",
       refreshAfter: true,
@@ -2586,6 +2602,7 @@ var SysTwoFactor = data.ObjectSchema.create({
       locations: ["list_toolbar", "list_item"],
       type: "api",
       target: "/api/v1/auth/two-factor/generate-backup-codes",
+      requiresFeature: "twoFactor",
       confirmText: "Regenerate backup codes? All previous backup codes will stop working immediately.",
       refreshAfter: true,
       params: [
@@ -2900,6 +2917,7 @@ var SysOauthApplication = data.ObjectSchema.create({
       type: "api",
       method: "POST",
       target: "/api/v1/auth/admin/oauth2/toggle-disabled",
+      requiresFeature: "oidcProvider",
       confirmText: "Disable this OAuth application? Active access/refresh tokens issued to it will continue to be rejected at the token, authorize, and introspect endpoints. Existing integrations will stop working immediately.",
       successMessage: "OAuth application disabled",
       refreshAfter: true,
@@ -2919,6 +2937,7 @@ var SysOauthApplication = data.ObjectSchema.create({
       type: "api",
       method: "POST",
       target: "/api/v1/auth/admin/oauth2/toggle-disabled",
+      requiresFeature: "oidcProvider",
       confirmText: "Re-enable this OAuth application? Token issuance, authorization, and introspection will resume immediately.",
       successMessage: "OAuth application enabled",
       refreshAfter: true,
@@ -2938,6 +2957,7 @@ var SysOauthApplication = data.ObjectSchema.create({
       type: "api",
       method: "POST",
       target: "/api/v1/auth/sys-oauth-application/register",
+      requiresFeature: "oidcProvider",
       refreshAfter: true,
       params: [
         { name: "name", label: "Application Name", type: "text", required: true },
@@ -2969,6 +2989,7 @@ var SysOauthApplication = data.ObjectSchema.create({
       type: "api",
       method: "POST",
       target: "/api/v1/auth/oauth2/client/rotate-secret",
+      requiresFeature: "oidcProvider",
       confirmText: "Rotate this OAuth client's secret? The previous secret will stop working immediately and any integrations using it will break until they are updated with the new secret. The new secret is shown only once.",
       refreshAfter: true,
       params: [
@@ -2993,6 +3014,7 @@ var SysOauthApplication = data.ObjectSchema.create({
       type: "api",
       method: "POST",
       target: "/api/v1/auth/oauth2/delete-client",
+      requiresFeature: "oidcProvider",
       confirmText: "Permanently delete this OAuth application? All issued tokens and consents will be invalidated and integrations using this client_id will stop working immediately. This cannot be undone.",
       successMessage: "OAuth application deleted",
       refreshAfter: true,
@@ -3172,6 +3194,25 @@ var SysOauthApplication = data.ObjectSchema.create({
       description: "OIDC subject type (e.g. public, pairwise)",
       group: "Credentials"
     }),
+    jwks: data.Field.textarea({
+      label: "JWKS",
+      required: false,
+      description: "Client JSON Web Key Set (for private_key_jwt / signed-request verification)",
+      group: "Credentials"
+    }),
+    jwks_uri: data.Field.url({
+      label: "JWKS URI",
+      required: false,
+      description: "URL of the client JSON Web Key Set",
+      group: "Credentials"
+    }),
+    dpop_bound_access_tokens: data.Field.boolean({
+      label: "DPoP-bound Access Tokens",
+      required: false,
+      defaultValue: false,
+      description: "Require access tokens issued to this client to be DPoP-bound (RFC 9449)",
+      group: "Credentials"
+    }),
     // ── Behaviour flags ──────────────────────────────────────────
     disabled: data.Field.boolean({
       label: "Disabled",
@@ -3191,6 +3232,18 @@ var SysOauthApplication = data.ObjectSchema.create({
       description: "Allow the client to call the OIDC end-session endpoint",
       group: "Behaviour"
     }),
+    backchannel_logout_uri: data.Field.url({
+      label: "Back-channel Logout URI",
+      required: false,
+      description: "OIDC back-channel logout endpoint of the client",
+      group: "Behaviour"
+    }),
+    backchannel_logout_session_required: data.Field.boolean({
+      label: "Back-channel Logout Session Required",
+      required: false,
+      description: "Whether the back-channel logout token must include a sid claim",
+      group: "Behaviour"
+    }),
     // ── Software statement (RFC 7591 §2.3) ───────────────────────
     software_id: data.Field.text({
       label: "Software ID",
@@ -3316,6 +3369,22 @@ var SysOauthAccessToken = data.ObjectSchema.create({
       maxLength: 255,
       description: "Caller-supplied correlation identifier"
     }),
+    authorization_code_id: data.Field.text({
+      label: "Authorization Code ID",
+      required: false,
+      maxLength: 255,
+      description: "ID of the authorization-code grant this token originates from"
+    }),
+    resources: data.Field.textarea({
+      label: "Resources",
+      required: false,
+      description: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+    }),
+    requested_user_info_claims: data.Field.textarea({
+      label: "Requested UserInfo Claims",
+      required: false,
+      description: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+    }),
     scopes: data.Field.textarea({
       label: "Scopes",
       required: true,
@@ -3329,6 +3398,16 @@ var SysOauthAccessToken = data.ObjectSchema.create({
       label: "Created At",
       defaultValue: "NOW()",
       readonly: true
+    }),
+    revoked: data.Field.datetime({
+      label: "Revoked At",
+      required: false,
+      description: "Timestamp at which this access token was revoked"
+    }),
+    confirmation: data.Field.textarea({
+      label: "Confirmation",
+      required: false,
+      description: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
     })
   },
   indexes: [
@@ -3336,7 +3415,8 @@ var SysOauthAccessToken = data.ObjectSchema.create({
     { fields: ["client_id"] },
     { fields: ["session_id"] },
     { fields: ["user_id"] },
-    { fields: ["refresh_id"] }
+    { fields: ["refresh_id"] },
+    { fields: ["authorization_code_id"] }
   ],
   enable: {
     trackHistory: false,
@@ -3402,6 +3482,22 @@ var SysOauthRefreshToken = data.ObjectSchema.create({
       maxLength: 255,
       description: "Caller-supplied correlation identifier"
     }),
+    authorization_code_id: data.Field.text({
+      label: "Authorization Code ID",
+      required: false,
+      maxLength: 255,
+      description: "ID of the authorization-code grant this token chain originates from"
+    }),
+    resources: data.Field.textarea({
+      label: "Resources",
+      required: false,
+      description: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+    }),
+    requested_user_info_claims: data.Field.textarea({
+      label: "Requested UserInfo Claims",
+      required: false,
+      description: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+    }),
     scopes: data.Field.textarea({
       label: "Scopes",
       required: true,
@@ -3421,17 +3517,38 @@ var SysOauthRefreshToken = data.ObjectSchema.create({
       required: false,
       description: "Timestamp at which this refresh token was revoked"
     }),
+    rotated_at: data.Field.datetime({
+      label: "Rotated At",
+      required: false,
+      description: "Timestamp at which this token was rotated (superseded by a new row)"
+    }),
+    rotation_replay_response: data.Field.textarea({
+      label: "Rotation Replay Response",
+      required: false,
+      description: "Cached token response replayed when the old token is re-presented within the reuse interval"
+    }),
+    rotation_replay_expires_at: data.Field.datetime({
+      label: "Rotation Replay Expires At",
+      required: false,
+      description: "End of the post-rotation reuse interval during which the replay response is served"
+    }),
     auth_time: data.Field.datetime({
       label: "Auth Time",
       required: false,
       description: "When the user originally authenticated for this token chain"
+    }),
+    confirmation: data.Field.textarea({
+      label: "Confirmation",
+      required: false,
+      description: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
     })
   },
   indexes: [
     { fields: ["token"], unique: true },
     { fields: ["client_id"] },
     { fields: ["session_id"] },
-    { fields: ["user_id"] }
+    { fields: ["user_id"] },
+    { fields: ["authorization_code_id"] }
   ],
   enable: {
     trackHistory: false,
@@ -3481,6 +3598,16 @@ var SysOauthConsent = data.ObjectSchema.create({
       maxLength: 255,
       description: "Caller-supplied correlation identifier"
     }),
+    resources: data.Field.textarea({
+      label: "Resources",
+      required: false,
+      description: "JSON-serialized list of RFC 8707 resource indicators the consent covers"
+    }),
+    requested_user_info_claims: data.Field.textarea({
+      label: "Requested UserInfo Claims",
+      required: false,
+      description: "JSON-serialized list of OIDC claims the user consented to expose"
+    }),
     scopes: data.Field.textarea({
       label: "Scopes",
       required: true,
@@ -3510,6 +3637,215 @@ var SysOauthConsent = data.ObjectSchema.create({
     mru: false
   }
 });
+var SysOauthResource = data.ObjectSchema.create({
+  name: "sys_oauth_resource",
+  label: "OAuth Resource",
+  pluralLabel: "OAuth Resources",
+  icon: "server",
+  isSystem: true,
+  managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "Registered OAuth protected resources (RFC 8707 resource indicators)",
+  displayNameField: "name",
+  nameField: "name",
+  highlightFields: ["name", "identifier", "disabled"],
+  fields: {
+    id: data.Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    identifier: data.Field.text({
+      label: "Identifier",
+      required: true,
+      maxLength: 1024,
+      description: "Resource indicator URI presented in the RFC 8707 resource parameter"
+    }),
+    name: data.Field.text({
+      label: "Name",
+      required: true,
+      maxLength: 255
+    }),
+    access_token_ttl: data.Field.number({
+      label: "Access Token TTL",
+      required: false,
+      description: "Access-token lifetime in seconds for this resource (overrides the server default)"
+    }),
+    refresh_token_ttl: data.Field.number({
+      label: "Refresh Token TTL",
+      required: false,
+      description: "Refresh-token lifetime in seconds for this resource (overrides the server default)"
+    }),
+    signing_algorithm: data.Field.text({
+      label: "Signing Algorithm",
+      required: false,
+      maxLength: 32,
+      description: "JWS algorithm used to sign access tokens for this resource"
+    }),
+    signing_key_id: data.Field.text({
+      label: "Signing Key ID",
+      required: false,
+      maxLength: 255,
+      description: "Key id (kid) used to sign access tokens for this resource"
+    }),
+    allowed_scopes: data.Field.textarea({
+      label: "Allowed Scopes",
+      required: false,
+      description: "JSON-serialized list of scopes clients may request for this resource"
+    }),
+    custom_claims: data.Field.textarea({
+      label: "Custom Claims",
+      required: false,
+      description: "JSON object of extra claims stamped on access tokens for this resource"
+    }),
+    dpop_bound_access_tokens_required: data.Field.boolean({
+      label: "DPoP Required",
+      required: false,
+      defaultValue: false,
+      description: "Require access tokens for this resource to be DPoP-bound (RFC 9449)"
+    }),
+    disabled: data.Field.boolean({
+      label: "Disabled",
+      required: false,
+      defaultValue: false
+    }),
+    policy_version: data.Field.number({
+      label: "Policy Version",
+      required: false,
+      defaultValue: 1,
+      description: "Monotonic version of the resource token policy"
+    }),
+    metadata: data.Field.textarea({
+      label: "Metadata",
+      required: false,
+      description: "JSON object of additional resource metadata"
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["identifier"], unique: true }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
+var SysOauthClientResource = data.ObjectSchema.create({
+  name: "sys_oauth_client_resource",
+  label: "OAuth Client Resource",
+  pluralLabel: "OAuth Client Resources",
+  icon: "link",
+  isSystem: true,
+  managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "Grants allowing an OAuth client to request tokens for a protected resource",
+  highlightFields: ["client_id", "resource_id"],
+  fields: {
+    id: data.Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    client_id: data.Field.text({
+      label: "Client ID",
+      required: true,
+      description: "Foreign key to sys_oauth_application.client_id"
+    }),
+    resource_id: data.Field.text({
+      label: "Resource ID",
+      required: true,
+      maxLength: 1024,
+      description: "Foreign key to sys_oauth_resource.identifier"
+    }),
+    metadata: data.Field.textarea({
+      label: "Metadata",
+      required: false,
+      description: "JSON object of additional grant metadata"
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["client_id"] },
+    { fields: ["resource_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
+var SysOauthClientAssertion = data.ObjectSchema.create({
+  name: "sys_oauth_client_assertion",
+  label: "OAuth Client Assertion",
+  pluralLabel: "OAuth Client Assertions",
+  icon: "shield-check",
+  isSystem: true,
+  managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "Consumed OAuth client-assertion JTIs (RFC 7523 replay prevention)",
+  highlightFields: ["expires_at"],
+  fields: {
+    id: data.Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    expires_at: data.Field.datetime({
+      label: "Expires At",
+      required: true,
+      description: "Assertion expiry \u2014 rows past this instant are safe to prune"
+    })
+  },
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
 var SysJwks = data.ObjectSchema.create({
   name: "sys_jwks",
   label: "JWKS Key",
@@ -3551,6 +3887,21 @@ var SysJwks = data.ObjectSchema.create({
       required: true,
       description: "JSON-serialized JWK private key (encrypted at rest)"
     }),
+    // better-auth 1.7 records the key's signing algorithm and (for EdDSA/EC
+    // keys) its curve alongside the key material, so tokens can advertise the
+    // correct `alg`/`crv` in the JWKS response. Both are optional — legacy rows
+    // minted before 1.7 leave them null and better-auth falls back to the
+    // configured `keyPairConfig.alg` (default `EdDSA`).
+    alg: data.Field.text({
+      label: "Algorithm",
+      required: false,
+      description: "JWK signing algorithm, e.g. `EdDSA` (better-auth 1.7+)"
+    }),
+    crv: data.Field.text({
+      label: "Curve",
+      required: false,
+      description: "JWK curve for EdDSA/EC keys, e.g. `Ed25519` (better-auth 1.7+)"
+    }),
     created_at: data.Field.datetime({
       label: "Created At",
       required: true,
@@ -3593,7 +3944,7 @@ var SysSsoProvider = data.ObjectSchema.create({
   // Together: admins see all env providers; non-admins get 403. better-auth's
   // own endpoints already read via a system context. (Env-only object — no
   // control-plane cross-tenant risk.)
-  tenancy: { enabled: false, strategy: "shared" },
+  tenancy: { enabled: false },
   requiredPermissions: ["manage_platform_settings"],
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
   protection: {
@@ -3935,8 +4286,11 @@ exports.SysJwks = SysJwks;
 exports.SysMember = SysMember;
 exports.SysOauthAccessToken = SysOauthAccessToken;
 exports.SysOauthApplication = SysOauthApplication;
+exports.SysOauthClientAssertion = SysOauthClientAssertion;
+exports.SysOauthClientResource = SysOauthClientResource;
 exports.SysOauthConsent = SysOauthConsent;
 exports.SysOauthRefreshToken = SysOauthRefreshToken;
+exports.SysOauthResource = SysOauthResource;
 exports.SysOrganization = SysOrganization;
 exports.SysScimProvider = SysScimProvider;
 exports.SysSession = SysSession;