@objectstack/spec 3.0.9 → 3.0.10

package/dist/index.js

@@ -21,6 +21,8 @@ __export(shared_exports, {
   FieldNameSchema: () => FieldNameSchema,
   FlowNameSchema: () => FlowNameSchema,
   HttpMethod: () => HttpMethod,
+  HttpMethodSchema: () => HttpMethodSchema,
+  HttpRequestSchema: () => HttpRequestSchema,
   IsolationLevelEnum: () => IsolationLevelEnum,
   MAP_SUPPORTED_FIELDS: () => MAP_SUPPORTED_FIELDS,
   METADATA_ALIASES: () => METADATA_ALIASES,
@@ -108,6 +110,14 @@ var HttpMethod = zod.z.enum([
   "HEAD",
   "OPTIONS"
 ]);
+var HttpMethodSchema = zod.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]);
+var HttpRequestSchema = zod.z.object({
+  url: zod.z.string().describe("API endpoint URL"),
+  method: HttpMethodSchema.optional().default("GET").describe("HTTP method"),
+  headers: zod.z.record(zod.z.string(), zod.z.string()).optional().describe("Custom HTTP headers"),
+  params: zod.z.record(zod.z.string(), zod.z.unknown()).optional().describe("Query parameters"),
+  body: zod.z.unknown().optional().describe("Request body for POST/PUT/PATCH")
+});
 var CorsConfigSchema = zod.z.object({
   /**
    * Enable CORS
@@ -1111,6 +1121,8 @@ __export(data_exports, {
   ReplicationConfigSchema: () => ReplicationConfigSchema,
   SQLDialectSchema: () => SQLDialectSchema,
   SQLDriverConfigSchema: () => SQLDriverConfigSchema,
+  SQLiteAlterTableLimitations: () => SQLiteAlterTableLimitations,
+  SQLiteDataTypeMappingDefaults: () => SQLiteDataTypeMappingDefaults,
   SSLConfigSchema: () => SSLConfigSchema,
   ScriptValidationSchema: () => ScriptValidationSchema,
   SearchConfigSchema: () => SearchConfigSchema,
@@ -1124,15 +1136,22 @@ __export(data_exports, {
   StringOperatorSchema: () => StringOperatorSchema,
   SubscriptionEventType: () => SubscriptionEventType,
   TenancyConfigSchema: () => TenancyConfigSchema,
+  TenantDatabaseLifecycleSchema: () => TenantDatabaseLifecycleSchema,
+  TenantResolverStrategySchema: () => TenantResolverStrategySchema,
   TimeUpdateInterval: () => TimeUpdateInterval,
   TransformType: () => TransformType,
+  TursoGroupSchema: () => TursoGroupSchema,
+  TursoMultiTenantConfigSchema: () => TursoMultiTenantConfigSchema,
   UniquenessValidationSchema: () => UniquenessValidationSchema,
+  VALID_AST_OPERATORS: () => VALID_AST_OPERATORS,
   ValidationRuleSchema: () => ValidationRuleSchema,
   VectorConfigSchema: () => VectorConfigSchema,
   VersioningConfigSchema: () => VersioningConfigSchema,
   WindowFunction: () => WindowFunction,
   WindowFunctionNodeSchema: () => WindowFunctionNodeSchema,
-  WindowSpecSchema: () => WindowSpecSchema
+  WindowSpecSchema: () => WindowSpecSchema,
+  isFilterAST: () => isFilterAST,
+  parseFilterAST: () => parseFilterAST
 });
 var FieldReferenceSchema = zod.z.object({
   $field: zod.z.string().describe("Field Reference/Column Name")
@@ -1238,6 +1257,108 @@ var NormalizedFilterSchema = zod.z.lazy(
     ]).optional()
   })
 );
+var VALID_AST_OPERATORS = /* @__PURE__ */ new Set([
+  "=",
+  "==",
+  "!=",
+  "<>",
+  ">",
+  ">=",
+  "<",
+  "<=",
+  "in",
+  "nin",
+  "not_in",
+  "contains",
+  "like",
+  "startswith",
+  "starts_with",
+  "endswith",
+  "ends_with",
+  "between",
+  "is_null",
+  "is_not_null"
+]);
+function isFilterAST(filter) {
+  if (!Array.isArray(filter) || filter.length === 0) return false;
+  const first = filter[0];
+  if (typeof first === "string") {
+    const lower = first.toLowerCase();
+    if (lower === "and" || lower === "or") {
+      return filter.length >= 2 && filter.slice(1).every((child) => isFilterAST(child));
+    }
+    if (filter.length >= 2 && typeof filter[1] === "string") {
+      return VALID_AST_OPERATORS.has(filter[1].toLowerCase());
+    }
+  }
+  if (filter.every((item) => isFilterAST(item))) {
+    return filter.length > 0;
+  }
+  return false;
+}
+var AST_OPERATOR_MAP = {
+  "=": "$eq",
+  "==": "$eq",
+  "!=": "$ne",
+  "<>": "$ne",
+  ">": "$gt",
+  ">=": "$gte",
+  "<": "$lt",
+  "<=": "$lte",
+  "in": "$in",
+  "nin": "$nin",
+  "not_in": "$nin",
+  "contains": "$contains",
+  "like": "$contains",
+  "startswith": "$startsWith",
+  "starts_with": "$startsWith",
+  "endswith": "$endsWith",
+  "ends_with": "$endsWith",
+  "between": "$between",
+  "is_null": "$null",
+  "is_not_null": "$null"
+};
+function convertComparison(node) {
+  const [field, operator, value] = node;
+  const op = operator.toLowerCase();
+  if (op === "=" || op === "==") {
+    return { [field]: value };
+  }
+  if (op === "is_null") {
+    return { [field]: { $null: true } };
+  }
+  if (op === "is_not_null") {
+    return { [field]: { $null: false } };
+  }
+  const mapped = AST_OPERATOR_MAP[op];
+  if (mapped) {
+    return { [field]: { [mapped]: value } };
+  }
+  return { [field]: { [`$${op}`]: value } };
+}
+function parseFilterAST(filter) {
+  if (filter == null) return void 0;
+  if (!Array.isArray(filter)) return filter;
+  if (filter.length === 0) return void 0;
+  const first = filter[0];
+  if (typeof first === "string" && (first.toLowerCase() === "and" || first.toLowerCase() === "or")) {
+    const logicOp = `$${first.toLowerCase()}`;
+    const children = filter.slice(1).map((child) => parseFilterAST(child)).filter(Boolean);
+    if (children.length === 0) return void 0;
+    if (children.length === 1) return children[0];
+    return { [logicOp]: children };
+  }
+  if (filter.length >= 2 && typeof first === "string") {
+    return convertComparison(filter);
+  }
+  if (filter.every((item) => Array.isArray(item))) {
+    const children = filter.map((child) => parseFilterAST(child)).filter(Boolean);
+    if (children.length === 0) return void 0;
+    if (children.length === 1) return children[0];
+    return { $and: children };
+  }
+  return void 0;
+}
 var FILTER_OPERATORS = [
   // Equality
   "$eq",
@@ -2690,6 +2811,37 @@ var SQLDriverConfigSchema = DriverConfigSchema.extend({
 }, {
   message: "sslConfig is required when ssl is true"
 });
+var SQLiteDataTypeMappingDefaults = {
+  text: "TEXT",
+  number: "REAL",
+  boolean: "INTEGER",
+  date: "TEXT",
+  datetime: "TEXT",
+  json: "TEXT",
+  uuid: "TEXT",
+  binary: "BLOB"
+};
+var SQLiteAlterTableLimitations = {
+  /** SQLite supports ADD COLUMN */
+  supportsAddColumn: true,
+  /** SQLite supports RENAME COLUMN (3.25.0+) */
+  supportsRenameColumn: true,
+  /** SQLite supports DROP COLUMN (3.35.0+) */
+  supportsDropColumn: true,
+  /** SQLite does NOT support MODIFY/ALTER COLUMN type */
+  supportsModifyColumn: false,
+  /** SQLite does NOT support adding constraints to existing columns */
+  supportsAddConstraint: false,
+  /**
+   * When an unsupported alteration is needed, the migration planner
+   * must use the 12-step table rebuild strategy:
+   * 1. CREATE new table with desired schema
+   * 2. Copy data from old table
+   * 3. DROP old table
+   * 4. RENAME new table to old name
+   */
+  rebuildStrategy: "create_copy_drop_rename"
+};
 var NoSQLDatabaseTypeSchema = zod.z.enum([
   "mongodb",
   "couchdb",
@@ -3696,6 +3848,119 @@ var RecordSubscriptionSchema = zod.z.object({
   /** Timestamps */
   createdAt: zod.z.string().datetime().describe("Subscription creation timestamp")
 });
+var TenantResolverStrategySchema = zod.z.enum([
+  "header",
+  // Resolve from X-Tenant-ID request header
+  "subdomain",
+  // Resolve from subdomain (e.g., acme.app.com → acme)
+  "path",
+  // Resolve from URL path segment (e.g., /api/acme/...)
+  "token",
+  // Resolve from JWT claim (e.g., tenant_id in access token)
+  "lookup"
+  // Resolve from control-plane database lookup
+]).describe("Strategy for resolving tenant identity from request context");
+var TursoGroupSchema = zod.z.object({
+  /**
+   * Group name identifier.
+   * Used to reference the group when creating new tenant databases.
+   */
+  name: zod.z.string().min(1).describe("Turso database group name"),
+  /**
+   * Primary location for the group (Turso region code).
+   * Example: 'iad' (US East), 'lhr' (London), 'nrt' (Tokyo)
+   */
+  primaryLocation: zod.z.string().min(2).describe("Primary Turso region code (e.g., iad, lhr, nrt)"),
+  /**
+   * Additional replica locations for read performance.
+   * Databases in this group will have read replicas in these regions.
+   */
+  replicaLocations: zod.z.array(zod.z.string().min(2)).default([]).describe("Additional replica region codes"),
+  /**
+   * Schema database name within the group.
+   * When using multi-db schemas, this is the "parent" database
+   * whose schema is shared by all child (tenant) databases.
+   */
+  schemaDatabase: zod.z.string().optional().describe("Schema database name for multi-db schemas")
+}).describe("Turso database group configuration");
+var TenantDatabaseLifecycleSchema = zod.z.object({
+  /**
+   * Hook executed when a new tenant is created.
+   * Defines how the tenant database is provisioned.
+   */
+  onTenantCreate: zod.z.object({
+    /** Whether to automatically create a Turso database */
+    autoCreate: zod.z.boolean().default(true).describe("Auto-create database on tenant registration"),
+    /** Database group to create the database in */
+    group: zod.z.string().optional().describe("Turso group for the new database"),
+    /** Whether to apply schema from the group schema database */
+    applyGroupSchema: zod.z.boolean().default(true).describe("Apply shared schema from group"),
+    /** Seed data to populate on creation */
+    seedData: zod.z.boolean().default(false).describe("Populate seed data on creation")
+  }).describe("Tenant creation hook"),
+  /**
+   * Hook executed when a tenant is deleted/destroyed.
+   */
+  onTenantDelete: zod.z.object({
+    /** Whether to destroy the database immediately or schedule for deletion */
+    immediate: zod.z.boolean().default(false).describe("Destroy database immediately"),
+    /** Grace period in hours before permanent deletion (soft-delete) */
+    gracePeriodHours: zod.z.number().int().min(0).default(72).describe("Grace period before permanent deletion"),
+    /** Whether to create a final backup before deletion */
+    createBackup: zod.z.boolean().default(true).describe("Create backup before deletion")
+  }).describe("Tenant deletion hook"),
+  /**
+   * Hook executed when a tenant is suspended (e.g., unpaid, policy violation).
+   */
+  onTenantSuspend: zod.z.object({
+    /** Whether to revoke auth tokens on suspension */
+    revokeTokens: zod.z.boolean().default(true).describe("Revoke auth tokens on suspension"),
+    /** Whether to set database to read-only mode */
+    readOnly: zod.z.boolean().default(true).describe("Set database to read-only on suspension")
+  }).describe("Tenant suspension hook")
+}).describe("Tenant database lifecycle hooks");
+var TursoMultiTenantConfigSchema = zod.z.object({
+  /**
+   * Turso organization slug.
+   * Used for Platform API calls and URL construction.
+   */
+  organizationSlug: zod.z.string().min(1).describe("Turso organization slug"),
+  /**
+   * URL template for constructing tenant database URLs.
+   * Use `{tenant_id}` as placeholder for the tenant identifier.
+   *
+   * Example: 'libsql://{tenant_id}-myorg.turso.io'
+   */
+  urlTemplate: zod.z.string().min(1).describe("URL template with {tenant_id} placeholder"),
+  /**
+   * Group-level auth token for Turso Platform API operations.
+   * Used for database creation, deletion, and management.
+   * This token has full access to all databases in the group.
+   */
+  groupAuthToken: zod.z.string().min(1).describe("Group-level auth token for platform operations"),
+  /**
+   * Strategy for resolving tenant identity from the request context.
+   */
+  tenantResolverStrategy: TenantResolverStrategySchema.default("token"),
+  /**
+   * Turso database group configuration.
+   */
+  group: TursoGroupSchema.optional().describe("Database group configuration"),
+  /**
+   * Lifecycle hooks for tenant database management.
+   */
+  lifecycle: TenantDatabaseLifecycleSchema.optional().describe("Lifecycle hooks"),
+  /**
+   * Maximum number of cached tenant database connections.
+   * Connections are evicted using LRU strategy when the limit is reached.
+   */
+  maxCachedConnections: zod.z.number().int().min(1).default(100).describe("Max cached tenant connections (LRU)"),
+  /**
+   * Connection cache TTL in seconds.
+   * Cached connections are refreshed after this period.
+   */
+  connectionCacheTTL: zod.z.number().int().min(0).default(300).describe("Connection cache TTL in seconds")
+}).describe("Turso multi-tenant router configuration");
 
 // src/security/index.ts
 var security_exports = {};
@@ -4390,6 +4655,7 @@ __export(ui_exports, {
   DashboardWidgetSchema: () => DashboardWidgetSchema,
   DateFormatSchema: () => DateFormatSchema,
   DensityMode: () => DensityMode,
+  DensityModeSchema: () => DensityModeSchema,
   DndConfigSchema: () => DndConfigSchema,
   DragConstraintSchema: () => DragConstraintSchema,
   DragHandleSchema: () => DragHandleSchema,
@@ -4492,6 +4758,7 @@ __export(ui_exports, {
   SwipeGestureConfigSchema: () => SwipeGestureConfigSchema,
   SyncConfigSchema: () => SyncConfigSchema,
   ThemeMode: () => ThemeMode,
+  ThemeModeSchema: () => ThemeModeSchema,
   ThemeSchema: () => ThemeSchema,
   TimelineConfigSchema: () => TimelineConfigSchema,
   TouchInteractionSchema: () => TouchInteractionSchema,
@@ -4502,11 +4769,13 @@ __export(ui_exports, {
   UrlNavItemSchema: () => UrlNavItemSchema,
   UserActionsConfigSchema: () => UserActionsConfigSchema,
   ViewDataSchema: () => ViewDataSchema,
+  ViewFilterRuleSchema: () => ViewFilterRuleSchema,
   ViewSchema: () => ViewSchema,
   ViewSharingSchema: () => ViewSharingSchema,
   ViewTabSchema: () => ViewTabSchema,
   VisualizationTypeSchema: () => VisualizationTypeSchema,
   WcagContrastLevel: () => WcagContrastLevel,
+  WcagContrastLevelSchema: () => WcagContrastLevelSchema,
   WidgetActionTypeSchema: () => WidgetActionTypeSchema,
   WidgetColorVariantSchema: () => WidgetColorVariantSchema,
   WidgetEventSchema: () => WidgetEventSchema,
@@ -4945,14 +5214,6 @@ var App = {
 function defineApp(config) {
   return AppSchema.parse(config);
 }
-var HttpMethodSchema = zod.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]);
-var HttpRequestSchema = zod.z.object({
-  url: zod.z.string().describe("API endpoint URL"),
-  method: HttpMethodSchema.optional().default("GET").describe("HTTP method"),
-  headers: zod.z.record(zod.z.string(), zod.z.string()).optional().describe("Custom HTTP headers"),
-  params: zod.z.record(zod.z.string(), zod.z.unknown()).optional().describe("Query parameters"),
-  body: zod.z.unknown().optional().describe("Request body for POST/PUT/PATCH")
-});
 var ViewDataSchema = zod.z.discriminatedUnion("provider", [
   zod.z.object({
     provider: zod.z.literal("object"),
@@ -4968,6 +5229,14 @@ var ViewDataSchema = zod.z.discriminatedUnion("provider", [
     items: zod.z.array(zod.z.unknown()).describe("Static data array")
   })
 ]);
+var ViewFilterRuleSchema = zod.z.object({
+  /** Field name to filter on */
+  field: zod.z.string().describe("Field name to filter on"),
+  /** Filter operator */
+  operator: zod.z.string().describe("Filter operator (e.g. equals, not_equals, contains, this_quarter)"),
+  /** Filter value (optional for unary operators like is_null, this_quarter) */
+  value: zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean(), zod.z.null(), zod.z.array(zod.z.union([zod.z.string(), zod.z.number()]))]).optional().describe("Filter value")
+}).describe("View filter rule");
 var ColumnSummarySchema = zod.z.enum([
   "none",
   "count",
@@ -5075,7 +5344,7 @@ var ViewTabSchema = zod.z.object({
   label: I18nLabelSchema.optional().describe("Display label"),
   icon: zod.z.string().optional().describe("Tab icon name"),
   view: zod.z.string().optional().describe("Referenced list view name from listViews"),
-  filter: zod.z.array(zod.z.unknown()).optional().describe("Tab-specific filter criteria"),
+  filter: zod.z.array(ViewFilterRuleSchema).optional().describe("Tab-specific filter criteria"),
   order: zod.z.number().int().min(0).optional().describe("Tab display order"),
   pinned: zod.z.boolean().default(false).describe("Pin tab (cannot be removed by users)"),
   isDefault: zod.z.boolean().default(false).describe("Set as the default active tab"),
@@ -5160,7 +5429,7 @@ var ListViewSchema = zod.z.object({
     zod.z.array(ListColumnSchema)
     // Enhanced: detailed column config
   ]).describe("Fields to display as columns"),
-  filter: zod.z.array(zod.z.unknown()).optional().describe("Filter criteria (JSON Rules)"),
+  filter: zod.z.array(ViewFilterRuleSchema).optional().describe("Filter criteria (JSON Rules)"),
   sort: zod.z.union([
     zod.z.string(),
     //Legacy "field desc"
@@ -5177,7 +5446,7 @@ var ListViewSchema = zod.z.object({
     field: zod.z.string().describe("Field name to filter by"),
     label: zod.z.string().optional().describe("Display label for the chip"),
     operator: zod.z.enum(["equals", "not_equals", "contains", "in", "is_null", "is_not_null"]).default("equals").describe("Filter operator"),
-    value: zod.z.unknown().optional().describe("Preset filter value")
+    value: zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean(), zod.z.null(), zod.z.array(zod.z.union([zod.z.string(), zod.z.number()]))]).optional().describe("Preset filter value")
   })).optional().describe("One-click filter chips for quick record filtering"),
   /** Grid Features */
   resizable: zod.z.boolean().optional().describe("Enable column resizing"),
@@ -5240,7 +5509,11 @@ var ListViewSchema = zod.z.object({
     icon: zod.z.string().optional()
   }).optional().describe("Empty state configuration when no records found"),
   /** ARIA accessibility attributes */
-  aria: AriaPropsSchema.optional().describe("ARIA accessibility attributes for the list view")
+  aria: AriaPropsSchema.optional().describe("ARIA accessibility attributes for the list view"),
+  /** Responsive layout overrides per breakpoint */
+  responsive: ResponsiveConfigSchema.optional().describe("Responsive layout configuration"),
+  /** Performance optimization settings */
+  performance: PerformanceConfigSchema.optional().describe("Performance optimization settings")
 });
 var FormFieldSchema = zod.z.object({
   field: zod.z.string().describe("Field name (snake_case)"),
@@ -5320,9 +5593,11 @@ var WidgetColorVariantSchema = zod.z.enum([
   "danger"
 ]).describe("Widget color variant");
 var WidgetActionTypeSchema = zod.z.enum([
+  "script",
   "url",
   "modal",
-  "flow"
+  "flow",
+  "api"
 ]).describe("Widget action type");
 var DashboardHeaderActionSchema = zod.z.object({
   /** Action label */
@@ -5353,6 +5628,8 @@ var WidgetMeasureSchema = zod.z.object({
   format: zod.z.string().optional().describe("Number format string")
 }).describe("Widget measure definition");
 var DashboardWidgetSchema = zod.z.object({
+  /** Unique widget identifier (snake_case, used for targetWidgets references) */
+  id: SnakeCaseIdentifierSchema.describe("Unique widget identifier (snake_case)"),
   /** Widget Title */
   title: I18nLabelSchema.optional().describe("Widget title"),
   /** Widget Description (displayed below the title) */
@@ -5420,13 +5697,13 @@ var GlobalFilterSchema = zod.z.object({
   type: zod.z.enum(["text", "select", "date", "number", "lookup"]).optional().describe("Filter input type"),
   /** Static options for select/lookup filters */
   options: zod.z.array(zod.z.object({
-    value: zod.z.any(),
+    value: zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean()]).describe("Option value"),
     label: I18nLabelSchema
   })).optional().describe("Static filter options"),
   /** Dynamic data binding for filter options */
   optionsFrom: GlobalFilterOptionsFromSchema.optional().describe("Dynamic filter options from object"),
   /** Default filter value */
-  defaultValue: zod.z.any().optional().describe("Default filter value"),
+  defaultValue: zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean()]).optional().describe("Default filter value"),
   /** Filter application scope */
   scope: zod.z.enum(["dashboard", "widget"]).default("dashboard").describe("Filter application scope"),
   /** Widget IDs to apply this filter to (when scope is widget) */
@@ -5627,7 +5904,7 @@ var PageComponentType = zod.z.enum([
 var ElementDataSourceSchema = zod.z.object({
   object: zod.z.string().describe("Object to query"),
   view: zod.z.string().optional().describe("Named view to apply"),
-  filter: zod.z.any().optional().describe("Additional filter criteria"),
+  filter: FilterConditionSchema.optional().describe("Additional filter criteria"),
   sort: zod.z.array(SortItemSchema).optional().describe("Sort order"),
   limit: zod.z.number().int().positive().optional().describe("Max records to display")
 });
@@ -5718,14 +5995,14 @@ var PageTypeSchema = zod.z.enum([
 ]).describe("Page type \u2014 platform or interface page types");
 var RecordReviewConfigSchema = zod.z.object({
   object: zod.z.string().describe("Target object for review"),
-  filter: zod.z.any().optional().describe("Filter criteria for review queue"),
+  filter: FilterConditionSchema.optional().describe("Filter criteria for review queue"),
   sort: zod.z.array(SortItemSchema).optional().describe("Sort order for review queue"),
   displayFields: zod.z.array(zod.z.string()).optional().describe("Fields to display on the review page"),
   actions: zod.z.array(zod.z.object({
     label: zod.z.string().describe("Action button label"),
     type: zod.z.enum(["approve", "reject", "skip", "custom"]).describe("Action type"),
     field: zod.z.string().optional().describe("Field to update on action"),
-    value: zod.z.any().optional().describe("Value to set on action"),
+    value: zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean()]).optional().describe("Value to set on action"),
     nextRecord: zod.z.boolean().optional().default(true).describe("Auto-advance to next record after action")
   })).describe("Review actions"),
   navigation: zod.z.enum(["sequential", "random", "filtered"]).optional().default("sequential").describe("Record navigation mode"),
@@ -5735,7 +6012,7 @@ var InterfacePageConfigSchema = zod.z.object({
   /** Data binding */
   source: zod.z.string().optional().describe("Source object name for the page"),
   levels: zod.z.number().int().min(1).optional().describe("Number of hierarchy levels to display"),
-  filterBy: zod.z.array(zod.z.unknown()).optional().describe("Page-level filter criteria"),
+  filterBy: zod.z.array(ViewFilterRuleSchema).optional().describe("Page-level filter criteria"),
   /** Appearance */
   appearance: AppearanceConfigSchema.optional().describe("Appearance and visualization configuration"),
   /** User filters */
@@ -5779,6 +6056,21 @@ var PageSchema = zod.z.object({
   interfaceConfig: InterfacePageConfigSchema.optional().describe("Interface-level page configuration (for Airtable-style interface pages)"),
   /** ARIA accessibility attributes */
   aria: AriaPropsSchema.optional().describe("ARIA accessibility attributes")
+}).superRefine((data, ctx) => {
+  if (data.type === "record_review" && !data.recordReview) {
+    ctx.addIssue({
+      code: zod.z.ZodIssueCode.custom,
+      path: ["recordReview"],
+      message: 'recordReview is required when type is "record_review"'
+    });
+  }
+  if (data.type === "blank" && !data.blankLayout) {
+    ctx.addIssue({
+      code: zod.z.ZodIssueCode.custom,
+      path: ["blankLayout"],
+      message: 'blankLayout is required when type is "blank"'
+    });
+  }
 });
 var WidgetLifecycleSchema = zod.z.object({
   /**
@@ -6103,7 +6395,7 @@ var RecordRelatedListProps = zod.z.object({
     }))
   ]).optional().describe("Sort order for related records"),
   limit: zod.z.number().int().positive().default(5).describe("Number of records to display initially"),
-  filter: zod.z.array(zod.z.unknown()).optional().describe("Additional filter criteria for related records"),
+  filter: zod.z.array(ViewFilterRuleSchema).optional().describe("Additional filter criteria for related records"),
   title: I18nLabelSchema.optional().describe("Custom title for the related list"),
   showViewAll: zod.z.boolean().default(true).describe('Show "View All" link to see all related records'),
   actions: zod.z.array(zod.z.string()).optional().describe("Action IDs available for related records"),
@@ -6194,7 +6486,7 @@ var ElementNumberPropsSchema = zod.z.object({
   object: zod.z.string().describe("Source object"),
   field: zod.z.string().optional().describe("Field to aggregate"),
   aggregate: zod.z.enum(["count", "sum", "avg", "min", "max"]).describe("Aggregation function"),
-  filter: zod.z.any().optional().describe("Filter criteria"),
+  filter: FilterConditionSchema.optional().describe("Filter criteria"),
   format: zod.z.enum(["number", "currency", "percent"]).optional().describe("Number display format"),
   prefix: zod.z.string().optional().describe('Prefix text (e.g. "$")'),
   suffix: zod.z.string().optional().describe('Suffix text (e.g. "%")'),
@@ -6241,7 +6533,7 @@ var ElementRecordPickerPropsSchema = zod.z.object({
   object: zod.z.string().describe("Object to pick records from"),
   displayField: zod.z.string().describe("Field to display as the record label"),
   searchFields: zod.z.array(zod.z.string()).optional().describe("Fields to search against"),
-  filter: zod.z.any().optional().describe("Filter criteria for available records"),
+  filter: FilterConditionSchema.optional().describe("Filter criteria for available records"),
   multiple: zod.z.boolean().optional().default(false).describe("Allow multiple record selection"),
   targetVariable: zod.z.string().optional().describe("Page variable to bind selected record ID(s)"),
   placeholder: I18nLabelSchema.optional().describe("Placeholder text"),
@@ -6469,9 +6761,9 @@ var AnimationSchema = zod.z.object({
   timing: zod.z.object({
     linear: zod.z.string().optional().describe("Linear timing function"),
     ease: zod.z.string().optional().describe("Ease timing function"),
-    easeIn: zod.z.string().optional().describe("Ease-in timing function"),
-    easeOut: zod.z.string().optional().describe("Ease-out timing function"),
-    easeInOut: zod.z.string().optional().describe("Ease-in-out timing function")
+    ease_in: zod.z.string().optional().describe("Ease-in timing function"),
+    ease_out: zod.z.string().optional().describe("Ease-out timing function"),
+    ease_in_out: zod.z.string().optional().describe("Ease-in-out timing function")
   }).optional()
 });
 var ZIndexSchema = zod.z.object({
@@ -6484,15 +6776,18 @@ var ZIndexSchema = zod.z.object({
   popover: zod.z.number().optional().describe("Popover z-index (e.g., 1060)"),
   tooltip: zod.z.number().optional().describe("Tooltip z-index (e.g., 1070)")
 });
-var ThemeMode = zod.z.enum(["light", "dark", "auto"]);
-var DensityMode = zod.z.enum(["compact", "regular", "spacious"]);
-var WcagContrastLevel = zod.z.enum(["AA", "AAA"]);
+var ThemeModeSchema = zod.z.enum(["light", "dark", "auto"]);
+var ThemeMode = ThemeModeSchema;
+var DensityModeSchema = zod.z.enum(["compact", "regular", "spacious"]);
+var DensityMode = DensityModeSchema;
+var WcagContrastLevelSchema = zod.z.enum(["AA", "AAA"]);
+var WcagContrastLevel = WcagContrastLevelSchema;
 var ThemeSchema = zod.z.object({
   name: SnakeCaseIdentifierSchema.describe("Unique theme identifier (snake_case)"),
   label: zod.z.string().describe("Human-readable theme name"),
   description: zod.z.string().optional().describe("Theme description"),
   /** Theme mode */
-  mode: ThemeMode.default("light").describe("Theme mode (light, dark, or auto)"),
+  mode: ThemeModeSchema.default("light").describe("Theme mode (light, dark, or auto)"),
   /** Color system */
   colors: ColorPaletteSchema.describe("Color palette configuration"),
   /** Typography */
@@ -6520,9 +6815,9 @@ var ThemeSchema = zod.z.object({
   /** Extends another theme */
   extends: zod.z.string().optional().describe("Base theme to extend from"),
   /** Display density mode */
-  density: DensityMode.optional().describe("Display density: compact, regular, or spacious"),
+  density: DensityModeSchema.optional().describe("Display density: compact, regular, or spacious"),
   /** WCAG contrast level requirement */
-  wcagContrast: WcagContrastLevel.optional().describe("WCAG color contrast level (AA or AAA)"),
+  wcagContrast: WcagContrastLevelSchema.optional().describe("WCAG color contrast level (AA or AAA)"),
   /** Right-to-left language support */
   rtl: zod.z.boolean().optional().describe("Enable right-to-left layout direction"),
   /** Touch target accessibility configuration */
@@ -6599,7 +6894,8 @@ var TransitionConfigSchema = zod.z.object({
   duration: zod.z.number().optional().describe("Transition duration in milliseconds"),
   easing: EasingFunctionSchema.optional().describe("Easing function for the transition"),
   delay: zod.z.number().optional().describe("Delay before transition starts in milliseconds"),
-  customKeyframes: zod.z.string().optional().describe("CSS @keyframes name for custom animations")
+  customKeyframes: zod.z.string().optional().describe("CSS @keyframes name for custom animations"),
+  themeToken: zod.z.string().optional().describe('Reference to a theme animation token (e.g. "animation.duration.fast")')
 }).describe("Animation transition configuration");
 var AnimationTriggerSchema = zod.z.enum([
   "on_mount",
@@ -6722,6 +7018,10 @@ __export(system_exports, {
   AccessControlConfigSchema: () => AccessControlConfigSchema,
   AddFieldOperation: () => AddFieldOperation,
   AnalyzerConfigSchema: () => AnalyzerConfigSchema,
+  AppCompatibilityCheckSchema: () => AppCompatibilityCheckSchema,
+  AppInstallRequestSchema: () => AppInstallRequestSchema,
+  AppInstallResultSchema: () => AppInstallResultSchema,
+  AppManifestSchema: () => AppManifestSchema,
   AuditConfigSchema: () => AuditConfigSchema,
   AuditEventActorSchema: () => AuditEventActorSchema,
   AuditEventChangeSchema: () => AuditEventChangeSchema,
@@ -6730,8 +7030,12 @@ __export(system_exports, {
   AuditEventSeverity: () => AuditEventSeverity,
   AuditEventTargetSchema: () => AuditEventTargetSchema,
   AuditEventType: () => AuditEventType,
+  AuditFindingSchema: () => AuditFindingSchema,
+  AuditFindingSeveritySchema: () => AuditFindingSeveritySchema,
+  AuditFindingStatusSchema: () => AuditFindingStatusSchema,
   AuditLogConfigSchema: () => AuditLogConfigSchema,
   AuditRetentionPolicySchema: () => AuditRetentionPolicySchema,
+  AuditScheduleSchema: () => AuditScheduleSchema,
   AuditStorageConfigSchema: () => AuditStorageConfigSchema,
   AuthConfigSchema: () => AuthConfigSchema,
   AuthPluginConfigSchema: () => AuthPluginConfigSchema,
@@ -6770,6 +7074,7 @@ __export(system_exports, {
   ComplianceAuditRequirementSchema: () => ComplianceAuditRequirementSchema,
   ComplianceConfigSchema: () => ComplianceConfigSchema,
   ComplianceEncryptionRequirementSchema: () => ComplianceEncryptionRequirementSchema,
+  ComplianceFrameworkSchema: () => ComplianceFrameworkSchema,
   ConsoleDestinationConfigSchema: () => ConsoleDestinationConfigSchema,
   ConsumerConfigSchema: () => ConsumerConfigSchema,
   CoreServiceName: () => CoreServiceName,
@@ -6782,9 +7087,17 @@ __export(system_exports, {
   CursorUpdateSchema: () => CursorUpdateSchema,
   DEFAULT_SUSPICIOUS_ACTIVITY_RULES: () => DEFAULT_SUSPICIOUS_ACTIVITY_RULES,
   DataClassificationPolicySchema: () => DataClassificationPolicySchema,
+  DataClassificationSchema: () => DataClassificationSchema,
   DatabaseLevelIsolationStrategySchema: () => DatabaseLevelIsolationStrategySchema,
+  DatabaseProviderSchema: () => DatabaseProviderSchema,
   DeadLetterQueueSchema: () => DeadLetterQueueSchema,
   DeleteObjectOperation: () => DeleteObjectOperation,
+  DeployBundleSchema: () => DeployBundleSchema,
+  DeployDiffSchema: () => DeployDiffSchema,
+  DeployManifestSchema: () => DeployManifestSchema,
+  DeployStatusEnum: () => DeployStatusEnum,
+  DeployValidationIssueSchema: () => DeployValidationIssueSchema,
+  DeployValidationResultSchema: () => DeployValidationResultSchema,
   DisasterRecoveryPlanSchema: () => DisasterRecoveryPlanSchema,
   DistributedCacheConfigSchema: () => DistributedCacheConfigSchema,
   EmailTemplateSchema: () => EmailTemplateSchema,
@@ -6809,6 +7122,14 @@ __export(system_exports, {
   HttpServerConfig: () => HttpServerConfig,
   HttpServerConfigSchema: () => HttpServerConfigSchema,
   InAppNotificationSchema: () => InAppNotificationSchema,
+  IncidentCategorySchema: () => IncidentCategorySchema,
+  IncidentNotificationMatrixSchema: () => IncidentNotificationMatrixSchema,
+  IncidentNotificationRuleSchema: () => IncidentNotificationRuleSchema,
+  IncidentResponsePhaseSchema: () => IncidentResponsePhaseSchema,
+  IncidentResponsePolicySchema: () => IncidentResponsePolicySchema,
+  IncidentSchema: () => IncidentSchema,
+  IncidentSeveritySchema: () => IncidentSeveritySchema,
+  IncidentStatusSchema: () => IncidentStatusSchema,
   IntervalScheduleSchema: () => IntervalScheduleSchema,
   JobExecutionSchema: () => JobExecutionSchema,
   JobExecutionStatus: () => JobExecutionStatus,
@@ -6868,6 +7189,8 @@ __export(system_exports, {
   MiddlewareType: () => MiddlewareType,
   MigrationDependencySchema: () => MigrationDependencySchema,
   MigrationOperationSchema: () => MigrationOperationSchema,
+  MigrationPlanSchema: () => MigrationPlanSchema,
+  MigrationStatementSchema: () => MigrationStatementSchema,
   ModifyFieldOperation: () => ModifyFieldOperation,
   MultipartUploadConfigSchema: () => MultipartUploadConfigSchema,
   MutualTLSConfigSchema: () => MutualTLSConfigSchema,
@@ -6890,9 +7213,11 @@ __export(system_exports, {
   PNCounterSchema: () => PNCounterSchema,
   PlanSchema: () => PlanSchema,
   PresignedUrlConfigSchema: () => PresignedUrlConfigSchema,
+  ProvisioningStepSchema: () => ProvisioningStepSchema,
   PushNotificationSchema: () => PushNotificationSchema,
   QueueConfig: () => QueueConfig,
   QueueConfigSchema: () => QueueConfigSchema,
+  QuotaEnforcementResultSchema: () => QuotaEnforcementResultSchema,
   RPOSchema: () => RPOSchema,
   RTOSchema: () => RTOSchema,
   RegistryConfigSchema: () => RegistryConfigSchema,
@@ -6908,6 +7233,7 @@ __export(system_exports, {
   SamplingDecision: () => SamplingDecision,
   SamplingStrategyType: () => SamplingStrategyType,
   ScheduleSchema: () => ScheduleSchema,
+  SchemaChangeSchema: () => SchemaChangeSchema,
   SchemaLevelIsolationStrategySchema: () => SchemaLevelIsolationStrategySchema,
   SearchConfigSchema: () => SearchConfigSchema2,
   SearchIndexConfigSchema: () => SearchIndexConfigSchema,
@@ -6938,6 +7264,11 @@ __export(system_exports, {
   StorageProviderSchema: () => StorageProviderSchema,
   StorageScopeSchema: () => StorageScopeSchema,
   StructuredLogEntrySchema: () => StructuredLogEntrySchema,
+  SupplierAssessmentStatusSchema: () => SupplierAssessmentStatusSchema,
+  SupplierRiskLevelSchema: () => SupplierRiskLevelSchema,
+  SupplierSecurityAssessmentSchema: () => SupplierSecurityAssessmentSchema,
+  SupplierSecurityPolicySchema: () => SupplierSecurityPolicySchema,
+  SupplierSecurityRequirementSchema: () => SupplierSecurityRequirementSchema,
   SuspiciousActivityRuleSchema: () => SuspiciousActivityRuleSchema,
   SystemFieldName: () => SystemFieldName,
   SystemObjectName: () => SystemObjectName,
@@ -6948,11 +7279,18 @@ __export(system_exports, {
   TaskRetryPolicySchema: () => TaskRetryPolicySchema,
   TaskSchema: () => TaskSchema,
   TaskStatus: () => TaskStatus,
+  TenantConnectionConfigSchema: () => TenantConnectionConfigSchema,
   TenantIsolationConfigSchema: () => TenantIsolationConfigSchema,
   TenantIsolationLevel: () => TenantIsolationLevel,
+  TenantPlanSchema: () => TenantPlanSchema,
+  TenantProvisioningRequestSchema: () => TenantProvisioningRequestSchema,
+  TenantProvisioningResultSchema: () => TenantProvisioningResultSchema,
+  TenantProvisioningStatusEnum: () => TenantProvisioningStatusEnum,
   TenantQuotaSchema: () => TenantQuotaSchema,
+  TenantRegionSchema: () => TenantRegionSchema,
   TenantSchema: () => TenantSchema,
   TenantSecurityPolicySchema: () => TenantSecurityPolicySchema,
+  TenantUsageSchema: () => TenantUsageSchema,
   TextCRDTOperationSchema: () => TextCRDTOperationSchema,
   TextCRDTStateSchema: () => TextCRDTStateSchema,
   TimeSeriesDataPointSchema: () => TimeSeriesDataPointSchema,
@@ -6965,6 +7303,11 @@ __export(system_exports, {
   TraceSamplingConfigSchema: () => TraceSamplingConfigSchema,
   TraceStateSchema: () => TraceStateSchema,
   TracingConfigSchema: () => TracingConfigSchema,
+  TrainingCategorySchema: () => TrainingCategorySchema,
+  TrainingCompletionStatusSchema: () => TrainingCompletionStatusSchema,
+  TrainingCourseSchema: () => TrainingCourseSchema,
+  TrainingPlanSchema: () => TrainingPlanSchema,
+  TrainingRecordSchema: () => TrainingRecordSchema,
   TranslationBundleSchema: () => TranslationBundleSchema,
   TranslationConfigSchema: () => TranslationConfigSchema,
   TranslationDataSchema: () => TranslationDataSchema,
@@ -10014,6 +10357,70 @@ var TracingConfigSchema = zod.z.object({
     exportInterval: zod.z.number().int().positive().optional().default(5e3)
   }).optional()
 }).describe("Tracing configuration");
+var DataClassificationSchema = zod.z.enum([
+  "pii",
+  "phi",
+  "pci",
+  "financial",
+  "confidential",
+  "internal",
+  "public"
+]).describe("Data classification level");
+var ComplianceFrameworkSchema = zod.z.enum([
+  "gdpr",
+  "hipaa",
+  "sox",
+  "pci_dss",
+  "ccpa",
+  "iso27001"
+]).describe("Compliance framework identifier");
+var ComplianceAuditRequirementSchema = zod.z.object({
+  framework: ComplianceFrameworkSchema.describe("Compliance framework identifier"),
+  requiredEvents: zod.z.array(zod.z.string()).describe('Audit event types required by this framework (e.g., "data.delete", "auth.login")'),
+  retentionDays: zod.z.number().min(1).describe("Minimum audit log retention period required by this framework (in days)"),
+  alertOnMissing: zod.z.boolean().default(true).describe("Raise alert if a required audit event is not being captured")
+}).describe("Compliance framework audit event requirements");
+var ComplianceEncryptionRequirementSchema = zod.z.object({
+  framework: ComplianceFrameworkSchema.describe("Compliance framework identifier"),
+  dataClassifications: zod.z.array(DataClassificationSchema).describe("Data classifications that must be encrypted under this framework"),
+  minimumAlgorithm: zod.z.enum(["aes-256-gcm", "aes-256-cbc", "chacha20-poly1305"]).default("aes-256-gcm").describe("Minimum encryption algorithm strength required"),
+  keyRotationMaxDays: zod.z.number().min(1).default(90).describe("Maximum key rotation interval required (in days)")
+}).describe("Compliance framework encryption requirements");
+var MaskingVisibilityRuleSchema = zod.z.object({
+  dataClassification: DataClassificationSchema.describe("Data classification this rule applies to"),
+  defaultMasked: zod.z.boolean().default(true).describe("Whether data is masked by default"),
+  unmaskRoles: zod.z.array(zod.z.string()).optional().describe("Roles allowed to view unmasked data"),
+  auditUnmask: zod.z.boolean().default(true).describe("Log an audit event when data is unmasked"),
+  requireApproval: zod.z.boolean().default(false).describe("Require explicit approval before unmasking"),
+  approvalRoles: zod.z.array(zod.z.string()).optional().describe("Roles that can approve unmasking requests")
+}).describe("Masking visibility and audit rule per data classification");
+var SecurityEventCorrelationSchema = zod.z.object({
+  enabled: zod.z.boolean().default(true).describe("Enable cross-subsystem security event correlation"),
+  correlationId: zod.z.boolean().default(true).describe("Inject a shared correlation ID into audit, encryption, and masking events"),
+  linkAuthToAudit: zod.z.boolean().default(true).describe("Link authentication events to subsequent data operation audit trails"),
+  linkEncryptionToAudit: zod.z.boolean().default(true).describe("Log encryption/decryption operations in the audit trail"),
+  linkMaskingToAudit: zod.z.boolean().default(true).describe("Log masking/unmasking operations in the audit trail")
+}).describe("Cross-subsystem security event correlation configuration");
+var DataClassificationPolicySchema = zod.z.object({
+  classification: DataClassificationSchema.describe("Data classification level"),
+  requireEncryption: zod.z.boolean().default(false).describe("Encryption required for this classification"),
+  requireMasking: zod.z.boolean().default(false).describe("Masking required for this classification"),
+  requireAudit: zod.z.boolean().default(false).describe("Audit trail required for access to this classification"),
+  retentionDays: zod.z.number().optional().describe("Data retention limit in days (for compliance)")
+}).describe("Security policy for a specific data classification level");
+var SecurityContextConfigSchema = zod.z.object({
+  enabled: zod.z.boolean().default(true).describe("Enable unified security context governance"),
+  complianceAuditRequirements: zod.z.array(ComplianceAuditRequirementSchema).optional().describe("Compliance-driven audit event requirements"),
+  complianceEncryptionRequirements: zod.z.array(ComplianceEncryptionRequirementSchema).optional().describe("Compliance-driven encryption requirements by data classification"),
+  maskingVisibility: zod.z.array(MaskingVisibilityRuleSchema).optional().describe("Masking visibility rules per data classification"),
+  dataClassifications: zod.z.array(DataClassificationPolicySchema).optional().describe("Data classification policies for unified security enforcement"),
+  eventCorrelation: SecurityEventCorrelationSchema.optional().describe("Cross-subsystem security event correlation settings"),
+  enforceOnWrite: zod.z.boolean().default(true).describe("Enforce encryption and masking requirements on data write operations"),
+  enforceOnRead: zod.z.boolean().default(true).describe("Enforce masking and audit requirements on data read operations"),
+  failOpen: zod.z.boolean().default(false).describe("When false (default), deny access if security context cannot be evaluated")
+}).describe("Unified security context governance configuration");
+
+// src/system/change-management.zod.ts
 var ChangeTypeSchema = zod.z.enum([
   "standard",
   // Pre-approved, low-risk changes
@@ -10188,6 +10595,39 @@ var ChangeRequestSchema = zod.z.object({
      */
     actualEnd: zod.z.number().optional().describe("Actual end time")
   }).optional().describe("Schedule"),
+  /**
+   * Security impact assessment for the change (A.8.32)
+   */
+  securityImpact: zod.z.object({
+    /**
+     * Whether a security impact assessment has been performed
+     */
+    assessed: zod.z.boolean().describe("Whether security impact has been assessed"),
+    /**
+     * Security risk level of this change
+     */
+    riskLevel: zod.z.enum(["none", "low", "medium", "high", "critical"]).optional().describe("Security risk level"),
+    /**
+     * Data classifications affected by this change
+     */
+    affectedDataClassifications: zod.z.array(DataClassificationSchema).optional().describe("Affected data classifications"),
+    /**
+     * Whether the change requires security team approval
+     */
+    requiresSecurityApproval: zod.z.boolean().default(false).describe("Whether security team approval is required"),
+    /**
+     * Security reviewer user ID
+     */
+    reviewedBy: zod.z.string().optional().describe("Security reviewer user ID"),
+    /**
+     * Security review completion timestamp (Unix milliseconds)
+     */
+    reviewedAt: zod.z.number().optional().describe("Security review timestamp"),
+    /**
+     * Security review notes or conditions
+     */
+    reviewNotes: zod.z.string().optional().describe("Security review notes or conditions")
+  }).optional().describe("Security impact assessment per ISO 27001:2022 A.8.32"),
   /**
    * Approval workflow configuration
    */
@@ -10399,81 +10839,648 @@ var AuditLogConfigSchema = zod.z.object({
     "failed-login"
   ])).describe("Event types to capture in the audit log")
 }).describe("Audit log configuration for compliance and security monitoring");
+var AuditFindingSeveritySchema = zod.z.enum([
+  "critical",
+  // Immediate remediation required
+  "major",
+  // Significant non-conformity
+  "minor",
+  // Minor non-conformity
+  "observation"
+  // Improvement opportunity
+]);
+var AuditFindingStatusSchema = zod.z.enum([
+  "open",
+  // Finding identified, not yet addressed
+  "in_remediation",
+  // Remediation in progress
+  "remediated",
+  // Remediation completed, pending verification
+  "verified",
+  // Remediation verified and accepted
+  "accepted_risk",
+  // Risk accepted by management
+  "closed"
+  // Finding closed
+]);
+var AuditFindingSchema = zod.z.object({
+  /**
+   * Unique finding identifier
+   */
+  id: zod.z.string().describe("Unique finding identifier"),
+  /**
+   * Short descriptive title
+   */
+  title: zod.z.string().describe("Finding title"),
+  /**
+   * Detailed description of the finding
+   */
+  description: zod.z.string().describe("Finding description"),
+  /**
+   * Finding severity
+   */
+  severity: AuditFindingSeveritySchema.describe("Finding severity"),
+  /**
+   * Current status
+   */
+  status: AuditFindingStatusSchema.describe("Finding status"),
+  /**
+   * ISO 27001 control reference (e.g., "A.5.35", "A.8.15")
+   */
+  controlReference: zod.z.string().optional().describe("ISO 27001 control reference"),
+  /**
+   * Compliance framework
+   */
+  framework: ComplianceFrameworkSchema.optional().describe("Related compliance framework"),
+  /**
+   * Timestamp when finding was identified (Unix milliseconds)
+   */
+  identifiedAt: zod.z.number().describe("Identification timestamp"),
+  /**
+   * User or entity who identified the finding
+   */
+  identifiedBy: zod.z.string().describe("Identifier (auditor name or system)"),
+  /**
+   * Planned remediation actions
+   */
+  remediationPlan: zod.z.string().optional().describe("Remediation plan"),
+  /**
+   * Remediation deadline (Unix milliseconds)
+   */
+  remediationDeadline: zod.z.number().optional().describe("Remediation deadline timestamp"),
+  /**
+   * Timestamp when remediation was verified (Unix milliseconds)
+   */
+  verifiedAt: zod.z.number().optional().describe("Verification timestamp"),
+  /**
+   * Verifier name or role
+   */
+  verifiedBy: zod.z.string().optional().describe("Verifier name or role"),
+  /**
+   * Notes or comments
+   */
+  notes: zod.z.string().optional().describe("Additional notes")
+}).describe("Audit finding with remediation tracking per ISO 27001:2022 A.5.35");
+var AuditScheduleSchema = zod.z.object({
+  /**
+   * Unique audit schedule identifier
+   */
+  id: zod.z.string().describe("Unique audit schedule identifier"),
+  /**
+   * Audit title or name
+   */
+  title: zod.z.string().describe("Audit title"),
+  /**
+   * Scope of areas to audit
+   */
+  scope: zod.z.array(zod.z.string()).describe("Audit scope areas"),
+  /**
+   * Target compliance framework
+   */
+  framework: ComplianceFrameworkSchema.describe("Target compliance framework"),
+  /**
+   * Scheduled audit date (Unix milliseconds)
+   */
+  scheduledAt: zod.z.number().describe("Scheduled audit timestamp"),
+  /**
+   * Actual completion date (Unix milliseconds)
+   */
+  completedAt: zod.z.number().optional().describe("Completion timestamp"),
+  /**
+   * Assessor name, team, or external firm
+   */
+  assessor: zod.z.string().describe("Assessor or audit team"),
+  /**
+   * Whether this is an external (independent) audit
+   */
+  isExternal: zod.z.boolean().default(false).describe("Whether this is an external audit"),
+  /**
+   * Recurrence interval in months (0 = one-time)
+   */
+  recurrenceMonths: zod.z.number().default(0).describe("Recurrence interval in months (0 = one-time)"),
+  /**
+   * Findings from this audit
+   */
+  findings: zod.z.array(AuditFindingSchema).optional().describe("Audit findings")
+}).describe("Audit schedule for independent security reviews per ISO 27001:2022 A.5.35");
 var ComplianceConfigSchema = zod.z.object({
   gdpr: GDPRConfigSchema.optional().describe("GDPR compliance settings"),
   hipaa: HIPAAConfigSchema.optional().describe("HIPAA compliance settings"),
   pciDss: PCIDSSConfigSchema.optional().describe("PCI-DSS compliance settings"),
-  auditLog: AuditLogConfigSchema.describe("Audit log configuration")
-}).describe("Unified compliance configuration spanning GDPR, HIPAA, and PCI-DSS");
-var ComplianceAuditRequirementSchema = zod.z.object({
-  framework: zod.z.enum(["gdpr", "hipaa", "sox", "pci_dss", "ccpa", "iso27001"]).describe("Compliance framework identifier"),
-  requiredEvents: zod.z.array(zod.z.string()).describe('Audit event types required by this framework (e.g., "data.delete", "auth.login")'),
-  retentionDays: zod.z.number().min(1).describe("Minimum audit log retention period required by this framework (in days)"),
-  alertOnMissing: zod.z.boolean().default(true).describe("Raise alert if a required audit event is not being captured")
-}).describe("Compliance framework audit event requirements");
-var ComplianceEncryptionRequirementSchema = zod.z.object({
-  framework: zod.z.enum(["gdpr", "hipaa", "sox", "pci_dss", "ccpa", "iso27001"]).describe("Compliance framework identifier"),
-  dataClassifications: zod.z.array(zod.z.enum([
-    "pii",
-    "phi",
-    "pci",
-    "financial",
-    "confidential",
-    "internal",
-    "public"
-  ])).describe("Data classifications that must be encrypted under this framework"),
-  minimumAlgorithm: zod.z.enum(["aes-256-gcm", "aes-256-cbc", "chacha20-poly1305"]).default("aes-256-gcm").describe("Minimum encryption algorithm strength required"),
-  keyRotationMaxDays: zod.z.number().min(1).default(90).describe("Maximum key rotation interval required (in days)")
-}).describe("Compliance framework encryption requirements");
-var MaskingVisibilityRuleSchema = zod.z.object({
-  dataClassification: zod.z.enum([
-    "pii",
-    "phi",
-    "pci",
-    "financial",
-    "confidential",
-    "internal",
-    "public"
-  ]).describe("Data classification this rule applies to"),
-  defaultMasked: zod.z.boolean().default(true).describe("Whether data is masked by default"),
-  unmaskRoles: zod.z.array(zod.z.string()).optional().describe("Roles allowed to view unmasked data"),
-  auditUnmask: zod.z.boolean().default(true).describe("Log an audit event when data is unmasked"),
-  requireApproval: zod.z.boolean().default(false).describe("Require explicit approval before unmasking"),
-  approvalRoles: zod.z.array(zod.z.string()).optional().describe("Roles that can approve unmasking requests")
-}).describe("Masking visibility and audit rule per data classification");
-var SecurityEventCorrelationSchema = zod.z.object({
-  enabled: zod.z.boolean().default(true).describe("Enable cross-subsystem security event correlation"),
-  correlationId: zod.z.boolean().default(true).describe("Inject a shared correlation ID into audit, encryption, and masking events"),
-  linkAuthToAudit: zod.z.boolean().default(true).describe("Link authentication events to subsequent data operation audit trails"),
-  linkEncryptionToAudit: zod.z.boolean().default(true).describe("Log encryption/decryption operations in the audit trail"),
-  linkMaskingToAudit: zod.z.boolean().default(true).describe("Log masking/unmasking operations in the audit trail")
-}).describe("Cross-subsystem security event correlation configuration");
-var DataClassificationPolicySchema = zod.z.object({
-  classification: zod.z.enum([
-    "pii",
-    "phi",
-    "pci",
-    "financial",
-    "confidential",
-    "internal",
-    "public"
-  ]).describe("Data classification level"),
-  requireEncryption: zod.z.boolean().default(false).describe("Encryption required for this classification"),
-  requireMasking: zod.z.boolean().default(false).describe("Masking required for this classification"),
-  requireAudit: zod.z.boolean().default(false).describe("Audit trail required for access to this classification"),
-  retentionDays: zod.z.number().optional().describe("Data retention limit in days (for compliance)")
-}).describe("Security policy for a specific data classification level");
-var SecurityContextConfigSchema = zod.z.object({
-  enabled: zod.z.boolean().default(true).describe("Enable unified security context governance"),
-  complianceAuditRequirements: zod.z.array(ComplianceAuditRequirementSchema).optional().describe("Compliance-driven audit event requirements"),
-  complianceEncryptionRequirements: zod.z.array(ComplianceEncryptionRequirementSchema).optional().describe("Compliance-driven encryption requirements by data classification"),
-  maskingVisibility: zod.z.array(MaskingVisibilityRuleSchema).optional().describe("Masking visibility rules per data classification"),
-  dataClassifications: zod.z.array(DataClassificationPolicySchema).optional().describe("Data classification policies for unified security enforcement"),
-  eventCorrelation: SecurityEventCorrelationSchema.optional().describe("Cross-subsystem security event correlation settings"),
-  enforceOnWrite: zod.z.boolean().default(true).describe("Enforce encryption and masking requirements on data write operations"),
-  enforceOnRead: zod.z.boolean().default(true).describe("Enforce masking and audit requirements on data read operations"),
-  failOpen: zod.z.boolean().default(false).describe("When false (default), deny access if security context cannot be evaluated")
-}).describe("Unified security context governance configuration");
+  auditLog: AuditLogConfigSchema.describe("Audit log configuration"),
+  auditSchedules: zod.z.array(AuditScheduleSchema).optional().describe("Scheduled compliance audits (A.5.35)")
+}).describe("Unified compliance configuration spanning GDPR, HIPAA, PCI-DSS, and audit governance");
+var IncidentSeveritySchema = zod.z.enum([
+  "critical",
+  // Immediate threat to business operations or data integrity
+  "high",
+  // Significant impact requiring urgent response
+  "medium",
+  // Moderate impact with controlled response timeline
+  "low"
+  // Minor impact with standard response procedures
+]);
+var IncidentCategorySchema = zod.z.enum([
+  "data_breach",
+  // Unauthorized access or disclosure of data
+  "malware",
+  // Malicious software detection
+  "unauthorized_access",
+  // Unauthorized system or data access
+  "denial_of_service",
+  // Service availability attack
+  "social_engineering",
+  // Phishing, pretexting, or manipulation
+  "insider_threat",
+  // Threat originating from internal actors
+  "physical_security",
+  // Physical security breach
+  "configuration_error",
+  // Security misconfiguration
+  "vulnerability_exploit",
+  // Exploitation of known vulnerability
+  "policy_violation",
+  // Violation of security policies
+  "other"
+  // Other security incidents
+]);
+var IncidentStatusSchema = zod.z.enum([
+  "reported",
+  // Initial report received
+  "triaged",
+  // Severity and category assessed
+  "investigating",
+  // Active investigation in progress
+  "containing",
+  // Containment measures being applied
+  "eradicating",
+  // Root cause being removed
+  "recovering",
+  // Systems being restored to normal
+  "resolved",
+  // Incident resolved
+  "closed"
+  // Post-incident review complete
+]);
+var IncidentResponsePhaseSchema = zod.z.object({
+  /**
+   * Phase name identifier
+   */
+  phase: zod.z.enum([
+    "identification",
+    "containment",
+    "eradication",
+    "recovery",
+    "lessons_learned"
+  ]).describe("Response phase name"),
+  /**
+   * Phase description and objectives
+   */
+  description: zod.z.string().describe("Phase description and objectives"),
+  /**
+   * Responsible team or role for this phase
+   */
+  assignedTo: zod.z.string().describe("Responsible team or role"),
+  /**
+   * Target completion time in hours from incident start
+   */
+  targetHours: zod.z.number().min(0).describe("Target completion time in hours"),
+  /**
+   * Actual completion timestamp (Unix milliseconds)
+   */
+  completedAt: zod.z.number().optional().describe("Actual completion timestamp"),
+  /**
+   * Notes and findings during this phase
+   */
+  notes: zod.z.string().optional().describe("Phase notes and findings")
+}).describe("Incident response phase with timing and assignment");
+var IncidentNotificationRuleSchema = zod.z.object({
+  /**
+   * Minimum severity level that triggers this notification
+   */
+  severity: IncidentSeveritySchema.describe("Minimum severity to trigger notification"),
+  /**
+   * Notification channels to use
+   */
+  channels: zod.z.array(zod.z.enum([
+    "email",
+    "sms",
+    "slack",
+    "pagerduty",
+    "webhook"
+  ])).describe("Notification channels"),
+  /**
+   * Roles or teams to notify
+   */
+  recipients: zod.z.array(zod.z.string()).describe("Roles or teams to notify"),
+  /**
+   * Maximum time in minutes to send notification after incident detection
+   */
+  withinMinutes: zod.z.number().min(1).describe("Notification deadline in minutes from detection"),
+  /**
+   * Whether to notify external regulators (for data breaches)
+   */
+  notifyRegulators: zod.z.boolean().default(false).describe("Whether to notify regulatory authorities"),
+  /**
+   * Regulatory notification deadline in hours (e.g., GDPR 72h)
+   */
+  regulatorDeadlineHours: zod.z.number().optional().describe("Regulatory notification deadline in hours")
+}).describe("Incident notification rule per severity level");
+var IncidentNotificationMatrixSchema = zod.z.object({
+  /**
+   * Notification rules ordered by severity
+   */
+  rules: zod.z.array(IncidentNotificationRuleSchema).describe("Notification rules by severity level"),
+  /**
+   * Default escalation timeout in minutes before auto-escalation
+   */
+  escalationTimeoutMinutes: zod.z.number().default(30).describe("Auto-escalation timeout in minutes"),
+  /**
+   * Escalation chain: ordered list of roles to escalate to
+   */
+  escalationChain: zod.z.array(zod.z.string()).default([]).describe("Ordered escalation chain of roles")
+}).describe("Incident notification matrix with escalation policies");
+var IncidentSchema = zod.z.object({
+  /**
+   * Unique incident identifier
+   */
+  id: zod.z.string().describe("Unique incident identifier"),
+  /**
+   * Short descriptive title of the incident
+   */
+  title: zod.z.string().describe("Incident title"),
+  /**
+   * Detailed description of the security event
+   */
+  description: zod.z.string().describe("Detailed incident description"),
+  /**
+   * Severity classification
+   */
+  severity: IncidentSeveritySchema.describe("Incident severity level"),
+  /**
+   * Incident category / type
+   */
+  category: IncidentCategorySchema.describe("Incident category"),
+  /**
+   * Current status in the incident lifecycle
+   */
+  status: IncidentStatusSchema.describe("Current incident status"),
+  /**
+   * User or system that reported the incident
+   */
+  reportedBy: zod.z.string().describe("Reporter user ID or system name"),
+  /**
+   * Timestamp when the incident was reported (Unix milliseconds)
+   */
+  reportedAt: zod.z.number().describe("Report timestamp"),
+  /**
+   * Timestamp when the incident was detected (may differ from reported)
+   */
+  detectedAt: zod.z.number().optional().describe("Detection timestamp"),
+  /**
+   * Timestamp when the incident was resolved
+   */
+  resolvedAt: zod.z.number().optional().describe("Resolution timestamp"),
+  /**
+   * Systems affected by the incident
+   */
+  affectedSystems: zod.z.array(zod.z.string()).describe("Affected systems"),
+  /**
+   * Data classifications affected (for data breach assessment)
+   */
+  affectedDataClassifications: zod.z.array(DataClassificationSchema).optional().describe("Affected data classifications"),
+  /**
+   * Structured response phases tracking
+   */
+  responsePhases: zod.z.array(IncidentResponsePhaseSchema).optional().describe("Incident response phases"),
+  /**
+   * Root cause analysis (completed post-incident)
+   */
+  rootCause: zod.z.string().optional().describe("Root cause analysis"),
+  /**
+   * Corrective actions taken or planned
+   */
+  correctiveActions: zod.z.array(zod.z.string()).optional().describe("Corrective actions taken or planned"),
+  /**
+   * Lessons learned from the incident (A.5.28)
+   */
+  lessonsLearned: zod.z.string().optional().describe("Lessons learned from the incident"),
+  /**
+   * Related change request IDs (if changes resulted from incident)
+   */
+  relatedChangeRequestIds: zod.z.array(zod.z.string()).optional().describe("Related change request IDs"),
+  /**
+   * Custom metadata for extensibility
+   */
+  metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional().describe("Custom metadata key-value pairs")
+}).describe("Security incident record per ISO 27001:2022 A.5.24\u2013A.5.28");
+var IncidentResponsePolicySchema = zod.z.object({
+  /**
+   * Whether incident response is enabled
+   */
+  enabled: zod.z.boolean().default(true).describe("Enable incident response management"),
+  /**
+   * Notification matrix configuration
+   */
+  notificationMatrix: IncidentNotificationMatrixSchema.describe("Notification and escalation matrix"),
+  /**
+   * Default response team or role
+   */
+  defaultResponseTeam: zod.z.string().describe("Default incident response team or role"),
+  /**
+   * Maximum time in hours to begin initial triage
+   */
+  triageDeadlineHours: zod.z.number().default(1).describe("Maximum hours to begin triage after detection"),
+  /**
+   * Whether to require post-incident review for all incidents
+   */
+  requirePostIncidentReview: zod.z.boolean().default(true).describe("Require post-incident review for all incidents"),
+  /**
+   * Minimum severity level that requires regulatory notification
+   */
+  regulatoryNotificationThreshold: IncidentSeveritySchema.default("high").describe("Minimum severity requiring regulatory notification"),
+  /**
+   * Retention period for incident records in days
+   */
+  retentionDays: zod.z.number().default(2555).describe("Incident record retention period in days (default ~7 years)")
+}).describe("Organization-level incident response policy per ISO 27001:2022");
+var SupplierRiskLevelSchema = zod.z.enum([
+  "critical",
+  // Direct access to sensitive data or core infrastructure
+  "high",
+  // Significant data processing or service dependency
+  "medium",
+  // Limited data access with moderate dependency
+  "low"
+  // Minimal data access and low service dependency
+]);
+var SupplierAssessmentStatusSchema = zod.z.enum([
+  "pending",
+  // Assessment not yet started
+  "in_progress",
+  // Assessment currently underway
+  "completed",
+  // Assessment completed
+  "expired",
+  // Assessment past its validity period
+  "failed"
+  // Supplier did not meet security requirements
+]);
+var SupplierSecurityRequirementSchema = zod.z.object({
+  /**
+   * Requirement identifier
+   */
+  id: zod.z.string().describe("Requirement identifier"),
+  /**
+   * Requirement description
+   */
+  description: zod.z.string().describe("Requirement description"),
+  /**
+   * ISO 27001 control reference (e.g., "A.5.19")
+   */
+  controlReference: zod.z.string().optional().describe("ISO 27001 control reference"),
+  /**
+   * Whether this requirement is mandatory
+   */
+  mandatory: zod.z.boolean().default(true).describe("Whether this requirement is mandatory"),
+  /**
+   * Compliance status
+   */
+  compliant: zod.z.boolean().optional().describe("Whether the supplier meets this requirement"),
+  /**
+   * Evidence or notes for compliance assessment
+   */
+  evidence: zod.z.string().optional().describe("Compliance evidence or assessment notes")
+}).describe("Individual supplier security requirement");
+var SupplierSecurityAssessmentSchema = zod.z.object({
+  /**
+   * Unique supplier identifier
+   */
+  supplierId: zod.z.string().describe("Unique supplier identifier"),
+  /**
+   * Supplier name
+   */
+  supplierName: zod.z.string().describe("Supplier display name"),
+  /**
+   * Risk classification
+   */
+  riskLevel: SupplierRiskLevelSchema.describe("Supplier risk classification"),
+  /**
+   * Assessment status
+   */
+  status: SupplierAssessmentStatusSchema.describe("Assessment status"),
+  /**
+   * User or team who performed the assessment
+   */
+  assessedBy: zod.z.string().describe("Assessor user ID or team"),
+  /**
+   * Assessment completion timestamp (Unix milliseconds)
+   */
+  assessedAt: zod.z.number().describe("Assessment timestamp"),
+  /**
+   * Assessment validity expiry (Unix milliseconds)
+   */
+  validUntil: zod.z.number().describe("Assessment validity expiry timestamp"),
+  /**
+   * Security requirements assessed
+   */
+  requirements: zod.z.array(SupplierSecurityRequirementSchema).describe("Security requirements and their compliance status"),
+  /**
+   * Overall compliance result
+   */
+  overallCompliant: zod.z.boolean().describe("Whether supplier meets all mandatory requirements"),
+  /**
+   * Data classifications shared with this supplier
+   */
+  dataClassificationsShared: zod.z.array(DataClassificationSchema).optional().describe("Data classifications shared with supplier"),
+  /**
+   * Services provided by the supplier
+   */
+  servicesProvided: zod.z.array(zod.z.string()).optional().describe("Services provided by this supplier"),
+  /**
+   * Certifications held by the supplier
+   */
+  certifications: zod.z.array(zod.z.string()).optional().describe("Supplier certifications (e.g., ISO 27001, SOC 2)"),
+  /**
+   * Remediation items for non-compliant requirements
+   */
+  remediationItems: zod.z.array(zod.z.object({
+    requirementId: zod.z.string().describe("Non-compliant requirement ID"),
+    action: zod.z.string().describe("Required remediation action"),
+    deadline: zod.z.number().describe("Remediation deadline timestamp"),
+    status: zod.z.enum(["pending", "in_progress", "completed"]).default("pending").describe("Remediation status")
+  })).optional().describe("Remediation items for non-compliant requirements"),
+  /**
+   * Custom metadata
+   */
+  metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional().describe("Custom metadata key-value pairs")
+}).describe("Supplier security assessment record per ISO 27001:2022 A.5.19\u2013A.5.21");
+var SupplierSecurityPolicySchema = zod.z.object({
+  /**
+   * Whether supplier security management is enabled
+   */
+  enabled: zod.z.boolean().default(true).describe("Enable supplier security management"),
+  /**
+   * Reassessment interval in days
+   */
+  reassessmentIntervalDays: zod.z.number().default(365).describe("Supplier reassessment interval in days"),
+  /**
+   * Whether to require supplier security assessment before onboarding
+   */
+  requirePreOnboardingAssessment: zod.z.boolean().default(true).describe("Require security assessment before supplier onboarding"),
+  /**
+   * Minimum risk level that requires formal assessment
+   */
+  formalAssessmentThreshold: SupplierRiskLevelSchema.default("medium").describe("Minimum risk level requiring formal assessment"),
+  /**
+   * Whether to monitor supplier security changes (A.5.22)
+   */
+  monitorChanges: zod.z.boolean().default(true).describe("Monitor supplier security posture changes"),
+  /**
+   * Required certifications for critical suppliers
+   */
+  requiredCertifications: zod.z.array(zod.z.string()).default([]).describe("Required certifications for critical-risk suppliers")
+}).describe("Organization-level supplier security management policy per ISO 27001:2022");
+var TrainingCategorySchema = zod.z.enum([
+  "security_awareness",
+  // General security awareness
+  "data_protection",
+  // Data handling and privacy
+  "incident_response",
+  // Incident reporting and response
+  "access_control",
+  // Access management best practices
+  "phishing_awareness",
+  // Phishing and social engineering
+  "compliance",
+  // Regulatory compliance (GDPR, HIPAA, etc.)
+  "secure_development",
+  // Secure coding and development practices
+  "physical_security",
+  // Physical security awareness
+  "business_continuity",
+  // Business continuity and disaster recovery
+  "other"
+  // Other training categories
+]);
+var TrainingCompletionStatusSchema = zod.z.enum([
+  "not_started",
+  // Training not yet begun
+  "in_progress",
+  // Training currently underway
+  "completed",
+  // Training completed successfully
+  "failed",
+  // Training assessment not passed
+  "expired"
+  // Training certification has expired
+]);
+var TrainingCourseSchema = zod.z.object({
+  /**
+   * Unique course identifier
+   */
+  id: zod.z.string().describe("Unique course identifier"),
+  /**
+   * Course title
+   */
+  title: zod.z.string().describe("Course title"),
+  /**
+   * Course description and objectives
+   */
+  description: zod.z.string().describe("Course description and learning objectives"),
+  /**
+   * Training category
+   */
+  category: TrainingCategorySchema.describe("Training category"),
+  /**
+   * Estimated duration in minutes
+   */
+  durationMinutes: zod.z.number().min(1).describe("Estimated course duration in minutes"),
+  /**
+   * Whether this training is mandatory
+   */
+  mandatory: zod.z.boolean().default(false).describe("Whether training is mandatory"),
+  /**
+   * Target roles or groups for this training
+   */
+  targetRoles: zod.z.array(zod.z.string()).describe("Target roles or groups"),
+  /**
+   * Validity period in days before recertification is needed
+   */
+  validityDays: zod.z.number().optional().describe("Certification validity period in days"),
+  /**
+   * Minimum passing score (percentage) for assessment
+   */
+  passingScore: zod.z.number().min(0).max(100).optional().describe("Minimum passing score percentage"),
+  /**
+   * Course version for tracking content updates
+   */
+  version: zod.z.string().optional().describe("Course content version")
+}).describe("Security training course definition");
+var TrainingRecordSchema = zod.z.object({
+  /**
+   * Reference to the course ID
+   */
+  courseId: zod.z.string().describe("Training course identifier"),
+  /**
+   * User who completed (or is assigned) the training
+   */
+  userId: zod.z.string().describe("User identifier"),
+  /**
+   * Completion status
+   */
+  status: TrainingCompletionStatusSchema.describe("Training completion status"),
+  /**
+   * Training assignment date (Unix milliseconds)
+   */
+  assignedAt: zod.z.number().describe("Assignment timestamp"),
+  /**
+   * Training completion date (Unix milliseconds)
+   */
+  completedAt: zod.z.number().optional().describe("Completion timestamp"),
+  /**
+   * Assessment score (percentage)
+   */
+  score: zod.z.number().min(0).max(100).optional().describe("Assessment score percentage"),
+  /**
+   * Certification expiry date (Unix milliseconds)
+   */
+  expiresAt: zod.z.number().optional().describe("Certification expiry timestamp"),
+  /**
+   * Notes or comments from instructor or system
+   */
+  notes: zod.z.string().optional().describe("Training notes or comments")
+}).describe("Individual training completion record");
+var TrainingPlanSchema = zod.z.object({
+  /**
+   * Whether training management is enabled
+   */
+  enabled: zod.z.boolean().default(true).describe("Enable training management"),
+  /**
+   * Training courses in the plan
+   */
+  courses: zod.z.array(TrainingCourseSchema).describe("Training courses"),
+  /**
+   * Default recertification interval in days
+   */
+  recertificationIntervalDays: zod.z.number().default(365).describe("Default recertification interval in days"),
+  /**
+   * Whether to track training completion for compliance reporting
+   */
+  trackCompletion: zod.z.boolean().default(true).describe("Track training completion for compliance"),
+  /**
+   * Grace period in days after expiry before non-compliance escalation
+   */
+  gracePeriodDays: zod.z.number().default(30).describe("Grace period in days after certification expiry"),
+  /**
+   * Whether to send reminders for upcoming training deadlines
+   */
+  sendReminders: zod.z.boolean().default(true).describe("Send reminders for upcoming training deadlines"),
+  /**
+   * Days before deadline to send first reminder
+   */
+  reminderDaysBefore: zod.z.number().default(14).describe("Days before deadline to send first reminder")
+}).describe("Organizational training plan per ISO 27001:2022 A.6.3");
 var CronScheduleSchema = zod.z.object({
   type: zod.z.literal("cron"),
   expression: zod.z.string().describe('Cron expression (e.g., "0 0 * * *" for daily at midnight)'),
@@ -11734,6 +12741,22 @@ var TenantIsolationLevel = zod.z.enum([
   "isolated_db"
   // Separate database per tenant (maximum isolation)
 ]);
+var DatabaseProviderSchema = zod.z.enum([
+  "turso",
+  // Turso/libSQL (DB-per-Tenant, edge-native)
+  "postgres",
+  // PostgreSQL (traditional, self-hosted or managed)
+  "memory"
+  // In-memory (testing/development only)
+]).describe("Database provider for tenant data");
+var TenantConnectionConfigSchema = zod.z.object({
+  /** Database connection URL */
+  url: zod.z.string().min(1).describe("Database connection URL"),
+  /** Authentication token (JWT for Turso, password for Postgres) */
+  authToken: zod.z.string().optional().describe("Database auth token (encrypted at rest)"),
+  /** Turso database group name */
+  group: zod.z.string().optional().describe("Turso database group name")
+}).describe("Tenant database connection configuration");
 var TenantQuotaSchema = zod.z.object({
   /**
    * Maximum number of users allowed for this tenant
@@ -11746,8 +12769,52 @@ var TenantQuotaSchema = zod.z.object({
   /**
    * API rate limit (requests per minute)
    */
-  apiRateLimit: zod.z.number().int().positive().optional().describe("API requests per minute")
-});
+  apiRateLimit: zod.z.number().int().positive().optional().describe("API requests per minute"),
+  /**
+   * Maximum number of custom objects the tenant can create
+   */
+  maxObjects: zod.z.number().int().positive().optional().describe("Maximum number of custom objects"),
+  /**
+   * Maximum records per object/table
+   */
+  maxRecordsPerObject: zod.z.number().int().positive().optional().describe("Maximum records per object"),
+  /**
+   * Maximum deployments allowed per day
+   */
+  maxDeploymentsPerDay: zod.z.number().int().positive().optional().describe("Maximum deployments per day"),
+  /**
+   * Maximum storage in bytes
+   */
+  maxStorageBytes: zod.z.number().int().positive().optional().describe("Maximum storage in bytes")
+});
+var TenantUsageSchema = zod.z.object({
+  /** Current number of custom objects */
+  currentObjectCount: zod.z.number().int().min(0).default(0).describe("Current number of custom objects"),
+  /** Current total record count across all objects */
+  currentRecordCount: zod.z.number().int().min(0).default(0).describe("Total records across all objects"),
+  /** Current storage usage in bytes */
+  currentStorageBytes: zod.z.number().int().min(0).default(0).describe("Current storage usage in bytes"),
+  /** Deployments executed today */
+  deploymentsToday: zod.z.number().int().min(0).default(0).describe("Deployments executed today"),
+  /** Current number of active users */
+  currentUsers: zod.z.number().int().min(0).default(0).describe("Current number of active users"),
+  /** API requests in the current minute */
+  apiRequestsThisMinute: zod.z.number().int().min(0).default(0).describe("API requests in the current minute"),
+  /** Last updated timestamp (ISO 8601) */
+  lastUpdatedAt: zod.z.string().datetime().optional().describe("Last usage update time")
+}).describe("Current tenant resource usage");
+var QuotaEnforcementResultSchema = zod.z.object({
+  /** Whether the operation is allowed */
+  allowed: zod.z.boolean().describe("Whether the operation is within quota"),
+  /** Quota that would be exceeded (if not allowed) */
+  exceededQuota: zod.z.string().optional().describe("Name of the exceeded quota"),
+  /** Current usage value */
+  currentUsage: zod.z.number().optional().describe("Current usage value"),
+  /** Quota limit value */
+  limit: zod.z.number().optional().describe("Quota limit"),
+  /** Human-readable message */
+  message: zod.z.string().optional().describe("Human-readable quota message")
+}).describe("Quota enforcement check result");
 var TenantSchema = zod.z.object({
   /**
    * Unique tenant identifier
@@ -11761,6 +12828,28 @@ var TenantSchema = zod.z.object({
    * Data isolation level
    */
   isolationLevel: TenantIsolationLevel,
+  /**
+   * Database provider for this tenant
+   */
+  databaseProvider: DatabaseProviderSchema.optional().describe("Database provider"),
+  /**
+   * Database connection configuration (encrypted at rest)
+   */
+  connectionConfig: TenantConnectionConfigSchema.optional().describe("Database connection config"),
+  /**
+   * Current provisioning status
+   */
+  provisioningStatus: zod.z.enum([
+    "provisioning",
+    "active",
+    "suspended",
+    "failed",
+    "destroying"
+  ]).optional().describe("Current provisioning lifecycle status"),
+  /**
+   * Tenant subscription plan
+   */
+  plan: zod.z.enum(["free", "pro", "enterprise"]).optional().describe("Subscription plan"),
   /**
    * Custom configuration values
    */
@@ -12237,6 +13326,274 @@ var RegistryConfigSchema = zod.z.object({
     priority: zod.z.number().int().min(1).default(1)
   })).optional().describe("Mirror registries for redundancy")
 });
+var TenantProvisioningStatusEnum = zod.z.enum([
+  "provisioning",
+  // Database creation in progress
+  "active",
+  // Fully provisioned and operational
+  "suspended",
+  // Temporarily disabled (billing, policy)
+  "failed",
+  // Provisioning failed (requires retry or manual intervention)
+  "destroying"
+  // Deletion in progress
+]).describe("Tenant provisioning lifecycle status");
+var TenantPlanSchema = zod.z.enum([
+  "free",
+  // Free tier with limited quotas
+  "pro",
+  // Professional tier with higher quotas
+  "enterprise"
+  // Enterprise tier with custom quotas and SLAs
+]).describe("Tenant subscription plan");
+var TenantRegionSchema = zod.z.enum([
+  "us-east",
+  // US East (Virginia)
+  "us-west",
+  // US West (Oregon)
+  "eu-west",
+  // EU West (Ireland)
+  "eu-central",
+  // EU Central (Frankfurt)
+  "ap-southeast",
+  // Asia Pacific (Singapore)
+  "ap-northeast"
+  // Asia Pacific (Tokyo)
+]).describe("Available deployment region");
+var ProvisioningStepSchema = zod.z.object({
+  /** Step identifier */
+  name: zod.z.string().min(1).describe("Step name (e.g., create_database, sync_schema)"),
+  /** Step execution status */
+  status: zod.z.enum(["pending", "running", "completed", "failed", "skipped"]).describe("Step status"),
+  /** When the step started (ISO 8601) */
+  startedAt: zod.z.string().datetime().optional().describe("Step start time"),
+  /** When the step completed (ISO 8601) */
+  completedAt: zod.z.string().datetime().optional().describe("Step completion time"),
+  /** Duration in milliseconds */
+  durationMs: zod.z.number().int().min(0).optional().describe("Step duration in ms"),
+  /** Error message if the step failed */
+  error: zod.z.string().optional().describe("Error message on failure")
+}).describe("Individual provisioning step status");
+var TenantProvisioningRequestSchema = zod.z.object({
+  /** Organization ID that owns this tenant */
+  orgId: zod.z.string().min(1).describe("Organization ID"),
+  /** Requested subscription plan */
+  plan: TenantPlanSchema.default("free"),
+  /** Preferred deployment region */
+  region: TenantRegionSchema.default("us-east"),
+  /** Optional tenant display name */
+  displayName: zod.z.string().optional().describe("Tenant display name"),
+  /** Optional initial admin user email */
+  adminEmail: zod.z.string().email().optional().describe("Initial admin user email"),
+  /** Optional metadata to attach to the tenant */
+  metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional().describe("Additional metadata")
+}).describe("Tenant provisioning request");
+var TenantProvisioningResultSchema = zod.z.object({
+  /** Unique tenant identifier */
+  tenantId: zod.z.string().min(1).describe("Provisioned tenant ID"),
+  /** Database connection URL (libsql:// or https://) */
+  connectionUrl: zod.z.string().min(1).describe("Database connection URL"),
+  /** Current provisioning status */
+  status: TenantProvisioningStatusEnum,
+  /** Deployment region */
+  region: TenantRegionSchema,
+  /** Active subscription plan */
+  plan: TenantPlanSchema,
+  /** Provisioning pipeline steps with status */
+  steps: zod.z.array(ProvisioningStepSchema).default([]).describe("Pipeline step statuses"),
+  /** Total provisioning duration in milliseconds */
+  totalDurationMs: zod.z.number().int().min(0).optional().describe("Total provisioning duration"),
+  /** Provisioned timestamp (ISO 8601) */
+  provisionedAt: zod.z.string().datetime().optional().describe("Provisioning completion time"),
+  /** Error message if provisioning failed */
+  error: zod.z.string().optional().describe("Error message on failure")
+}).describe("Tenant provisioning result");
+var DeployStatusEnum = zod.z.enum([
+  "validating",
+  // Zod schema validation in progress
+  "diffing",
+  // Comparing desired state vs current state
+  "migrating",
+  // Executing DDL statements
+  "registering",
+  // Updating metadata registry
+  "ready",
+  // Deployment complete and live
+  "failed",
+  // Deployment failed at some stage
+  "rolling_back"
+  // Rollback in progress
+]).describe("Deployment lifecycle status");
+var SchemaChangeSchema = zod.z.object({
+  /** Type of entity being changed */
+  entityType: zod.z.enum(["object", "field", "index", "view", "flow", "permission"]).describe("Entity type"),
+  /** Name of the entity */
+  entityName: zod.z.string().min(1).describe("Entity name"),
+  /** Parent entity name (e.g., object name for a field change) */
+  parentEntity: zod.z.string().optional().describe("Parent entity name"),
+  /** Type of change */
+  changeType: zod.z.enum(["added", "modified", "removed"]).describe("Change type"),
+  /** Previous value (for modified/removed) */
+  oldValue: zod.z.unknown().optional().describe("Previous value"),
+  /** New value (for added/modified) */
+  newValue: zod.z.unknown().optional().describe("New value")
+}).describe("Individual schema change");
+var DeployDiffSchema = zod.z.object({
+  /** List of all schema changes */
+  changes: zod.z.array(SchemaChangeSchema).default([]).describe("List of schema changes"),
+  /** Summary counts */
+  summary: zod.z.object({
+    added: zod.z.number().int().min(0).default(0).describe("Number of added entities"),
+    modified: zod.z.number().int().min(0).default(0).describe("Number of modified entities"),
+    removed: zod.z.number().int().min(0).default(0).describe("Number of removed entities")
+  }).describe("Change summary counts"),
+  /** Whether the diff contains breaking changes (e.g., column removal) */
+  hasBreakingChanges: zod.z.boolean().default(false).describe("Whether diff contains breaking changes")
+}).describe("Schema diff between current and desired state");
+var MigrationStatementSchema = zod.z.object({
+  /** SQL DDL statement to execute */
+  sql: zod.z.string().min(1).describe("SQL DDL statement"),
+  /** Whether this statement is reversible */
+  reversible: zod.z.boolean().default(true).describe("Whether the statement can be reversed"),
+  /** Reverse SQL statement (for rollback) */
+  rollbackSql: zod.z.string().optional().describe("Reverse SQL for rollback"),
+  /** Execution order (lower = earlier) */
+  order: zod.z.number().int().min(0).describe("Execution order")
+}).describe("Single DDL migration statement");
+var MigrationPlanSchema = zod.z.object({
+  /** Ordered list of migration statements */
+  statements: zod.z.array(MigrationStatementSchema).default([]).describe("Ordered DDL statements"),
+  /** SQL dialect the statements are written for */
+  dialect: zod.z.string().min(1).describe("Target SQL dialect"),
+  /** Whether the entire plan is reversible */
+  reversible: zod.z.boolean().default(true).describe("Whether the plan can be fully rolled back"),
+  /** Estimated execution time in milliseconds */
+  estimatedDurationMs: zod.z.number().int().min(0).optional().describe("Estimated execution time")
+}).describe("Ordered migration plan");
+var DeployValidationIssueSchema = zod.z.object({
+  /** Severity of the issue */
+  severity: zod.z.enum(["error", "warning", "info"]).describe("Issue severity"),
+  /** Entity path where the issue was found */
+  path: zod.z.string().describe("Entity path (e.g., objects.project_task.fields.name)"),
+  /** Human-readable issue description */
+  message: zod.z.string().describe("Issue description"),
+  /** Zod error code if applicable */
+  code: zod.z.string().optional().describe("Validation error code")
+}).describe("Validation issue");
+var DeployValidationResultSchema = zod.z.object({
+  /** Whether the bundle passed validation */
+  valid: zod.z.boolean().describe("Whether the bundle is valid"),
+  /** List of validation issues */
+  issues: zod.z.array(DeployValidationIssueSchema).default([]).describe("Validation issues"),
+  /** Number of errors */
+  errorCount: zod.z.number().int().min(0).default(0).describe("Number of errors"),
+  /** Number of warnings */
+  warningCount: zod.z.number().int().min(0).default(0).describe("Number of warnings")
+}).describe("Bundle validation result");
+var DeployManifestSchema = zod.z.object({
+  /** Deployment version (semver) */
+  version: zod.z.string().min(1).describe("Deployment version"),
+  /** SHA256 checksum of the bundle contents */
+  checksum: zod.z.string().optional().describe("SHA256 checksum"),
+  /** Object definitions included in this deployment */
+  objects: zod.z.array(zod.z.string()).default([]).describe("Object names included"),
+  /** View definitions included */
+  views: zod.z.array(zod.z.string()).default([]).describe("View names included"),
+  /** Flow definitions included */
+  flows: zod.z.array(zod.z.string()).default([]).describe("Flow names included"),
+  /** Permission definitions included */
+  permissions: zod.z.array(zod.z.string()).default([]).describe("Permission names included"),
+  /** Timestamp of bundle creation (ISO 8601) */
+  createdAt: zod.z.string().datetime().optional().describe("Bundle creation time")
+}).describe("Deployment manifest");
+var DeployBundleSchema = zod.z.object({
+  /** Bundle manifest with version and contents list */
+  manifest: DeployManifestSchema,
+  /** Object definitions (JSON-serialized ObjectStack objects) */
+  objects: zod.z.array(zod.z.record(zod.z.string(), zod.z.unknown())).default([]).describe("Object definitions"),
+  /** View definitions */
+  views: zod.z.array(zod.z.record(zod.z.string(), zod.z.unknown())).default([]).describe("View definitions"),
+  /** Flow definitions */
+  flows: zod.z.array(zod.z.record(zod.z.string(), zod.z.unknown())).default([]).describe("Flow definitions"),
+  /** Permission definitions */
+  permissions: zod.z.array(zod.z.record(zod.z.string(), zod.z.unknown())).default([]).describe("Permission definitions"),
+  /** Seed data records to populate after schema migration */
+  seedData: zod.z.array(zod.z.record(zod.z.string(), zod.z.unknown())).default([]).describe("Seed data records")
+}).describe("Deploy bundle containing all metadata for deployment");
+var AppManifestSchema = zod.z.object({
+  /** Unique app identifier (snake_case) */
+  name: zod.z.string().regex(/^[a-z_][a-z0-9_]*$/).describe("App identifier (snake_case)"),
+  /** Display label for the app */
+  label: zod.z.string().min(1).describe("App display label"),
+  /** App version (semver) */
+  version: zod.z.string().min(1).describe("App version (semver)"),
+  /** App description */
+  description: zod.z.string().optional().describe("App description"),
+  /** Minimum kernel version required */
+  minKernelVersion: zod.z.string().optional().describe("Minimum required kernel version"),
+  /** Object definitions provided by this app */
+  objects: zod.z.array(zod.z.string()).default([]).describe("Object names provided"),
+  /** View definitions provided */
+  views: zod.z.array(zod.z.string()).default([]).describe("View names provided"),
+  /** Flow definitions provided */
+  flows: zod.z.array(zod.z.string()).default([]).describe("Flow names provided"),
+  /** Whether seed data is included */
+  hasSeedData: zod.z.boolean().default(false).describe("Whether app includes seed data"),
+  /** Seed data records to populate on install */
+  seedData: zod.z.array(zod.z.record(zod.z.string(), zod.z.unknown())).default([]).describe("Seed data records"),
+  /** App dependencies (other apps that must be installed first) */
+  dependencies: zod.z.array(zod.z.string()).default([]).describe("Required app dependencies")
+}).describe("App manifest for marketplace installation");
+var AppCompatibilityCheckSchema = zod.z.object({
+  /** Whether the app is compatible with the current environment */
+  compatible: zod.z.boolean().describe("Whether the app is compatible"),
+  /** Compatibility issues found */
+  issues: zod.z.array(zod.z.object({
+    /** Issue severity */
+    severity: zod.z.enum(["error", "warning"]).describe("Issue severity"),
+    /** Issue description */
+    message: zod.z.string().describe("Issue description"),
+    /** Issue category */
+    category: zod.z.enum([
+      "kernel_version",
+      // Kernel version mismatch
+      "object_conflict",
+      // Object name already exists
+      "dependency_missing",
+      // Required dependency not installed
+      "quota_exceeded"
+      // Tenant quota would be exceeded
+    ]).describe("Issue category")
+  })).default([]).describe("Compatibility issues")
+}).describe("App compatibility check result");
+var AppInstallRequestSchema = zod.z.object({
+  /** Target tenant ID */
+  tenantId: zod.z.string().min(1).describe("Target tenant ID"),
+  /** App identifier to install */
+  appId: zod.z.string().min(1).describe("App identifier"),
+  /** Optional configuration overrides */
+  configOverrides: zod.z.record(zod.z.string(), zod.z.unknown()).optional().describe("Configuration overrides"),
+  /** Whether to skip seed data */
+  skipSeedData: zod.z.boolean().default(false).describe("Skip seed data population")
+}).describe("App install request");
+var AppInstallResultSchema = zod.z.object({
+  /** Whether the installation succeeded */
+  success: zod.z.boolean().describe("Whether installation succeeded"),
+  /** App identifier that was installed */
+  appId: zod.z.string().describe("Installed app identifier"),
+  /** App version installed */
+  version: zod.z.string().describe("Installed app version"),
+  /** Objects created or updated */
+  installedObjects: zod.z.array(zod.z.string()).default([]).describe("Objects created/updated"),
+  /** Tables created in the database */
+  createdTables: zod.z.array(zod.z.string()).default([]).describe("Database tables created"),
+  /** Number of seed records inserted */
+  seededRecords: zod.z.number().int().min(0).default(0).describe("Seed records inserted"),
+  /** Installation duration in milliseconds */
+  durationMs: zod.z.number().int().min(0).optional().describe("Installation duration"),
+  /** Error message if installation failed */
+  error: zod.z.string().optional().describe("Error message on failure")
+}).describe("App install result");
 
 // src/system/constants/paths.ts
 var PKG_CONVENTIONS = {
@@ -12586,6 +13943,7 @@ __export(kernel_exports, {
   ServiceUnregisteredEventSchema: () => ServiceUnregisteredEventSchema,
   StartupOptionsSchema: () => StartupOptionsSchema,
   StartupOrchestrationResultSchema: () => StartupOrchestrationResultSchema,
+  TenantRuntimeContextSchema: () => TenantRuntimeContextSchema,
   UninstallPackageRequestSchema: () => UninstallPackageRequestSchema,
   UninstallPackageResponseSchema: () => UninstallPackageResponseSchema,
   UpgradeContextSchema: () => UpgradeContextSchema,
@@ -12929,6 +14287,18 @@ var KernelContextSchema = zod.z.object({
    */
   previewMode: PreviewModeConfigSchema.optional().describe('Preview/demo mode configuration (used when mode is "preview")')
 });
+var TenantRuntimeContextSchema = KernelContextSchema.extend({
+  /** Unique tenant identifier resolved from the current session */
+  tenantId: zod.z.string().min(1).describe("Resolved tenant identifier"),
+  /** Tenant subscription plan */
+  tenantPlan: zod.z.enum(["free", "pro", "enterprise"]).describe("Tenant subscription plan"),
+  /** Tenant deployment region */
+  tenantRegion: zod.z.string().optional().describe("Tenant deployment region"),
+  /** Tenant database connection URL */
+  tenantDbUrl: zod.z.string().min(1).describe("Tenant database connection URL"),
+  /** Optional tenant quotas for the current plan */
+  tenantQuotas: TenantQuotaSchema.optional().describe("Tenant resource quotas")
+}).describe("Tenant-aware kernel runtime context");
 var DependencyStatusEnum = zod.z.enum([
   "satisfied",
   // Already installed and version compatible
@@ -25516,6 +26886,7 @@ __export(api_exports, {
   GraphQLScalarType: () => GraphQLScalarType,
   GraphQLSubscriptionConfigSchema: () => GraphQLSubscriptionConfigSchema,
   GraphQLTypeConfigSchema: () => GraphQLTypeConfigSchema,
+  HttpFindQueryParamsSchema: () => HttpFindQueryParamsSchema,
   HttpMethod: () => HttpMethod,
   HttpStatusCode: () => HttpStatusCode,
   IdRequestSchema: () => IdRequestSchema,
@@ -27971,9 +29342,26 @@ var FindDataResponseSchema = zod.z.object({
   nextCursor: zod.z.string().optional().describe("Cursor for the next page of results (cursor-based pagination)."),
   hasMore: zod.z.boolean().optional().describe("True if there are more records available (pagination).")
 });
+var HttpFindQueryParamsSchema = zod.z.object({
+  /** @canonical Singular form — the standard going forward. JSON string of filter expression or AST. */
+  filter: zod.z.string().optional().describe("JSON-encoded filter expression (canonical, singular)."),
+  /** @deprecated Use `filter` (singular). Accepted for backward compatibility. */
+  filters: zod.z.string().optional().describe("JSON-encoded filter expression (deprecated plural alias)."),
+  select: zod.z.string().optional().describe("Comma-separated list of fields to retrieve."),
+  sort: zod.z.string().optional().describe('Sort expression (e.g. "name asc,created_at desc" or "-created_at").'),
+  orderBy: zod.z.string().optional().describe("Alias for sort (OData compatibility)."),
+  top: zod.z.coerce.number().optional().describe("Max records to return (limit)."),
+  skip: zod.z.coerce.number().optional().describe("Records to skip (offset)."),
+  expand: zod.z.string().optional().describe("Comma-separated list of relations to eager-load."),
+  search: zod.z.string().optional().describe("Full-text search query."),
+  distinct: zod.z.coerce.boolean().optional().describe("SELECT DISTINCT flag."),
+  count: zod.z.coerce.boolean().optional().describe("Include total count in response.")
+});
 var GetDataRequestSchema = zod.z.object({
   object: zod.z.string().describe("The object name."),
-  id: zod.z.string().describe("The unique record identifier (primary key).")
+  id: zod.z.string().describe("The unique record identifier (primary key)."),
+  select: zod.z.array(zod.z.string()).optional().describe("Fields to include in the response (allowlisted query param)."),
+  expand: zod.z.array(zod.z.string()).optional().describe("Relations to eager-load (allowlisted query param).")
 });
 var GetDataResponseSchema = zod.z.object({
   object: zod.z.string().describe("The object name."),
@@ -34074,7 +35462,7 @@ __export(integration_exports, {
   DataSyncConfigSchema: () => DataSyncConfigSchema2,
   DatabaseConnectorSchema: () => DatabaseConnectorSchema,
   DatabasePoolConfigSchema: () => DatabasePoolConfigSchema,
-  DatabaseProviderSchema: () => DatabaseProviderSchema,
+  DatabaseProviderSchema: () => DatabaseProviderSchema2,
   DatabaseTableSchema: () => DatabaseTableSchema,
   DeliveryGuaranteeSchema: () => DeliveryGuaranteeSchema,
   DeploymentConfigSchema: () => DeploymentConfigSchema,
@@ -34743,7 +36131,7 @@ var hubspotConnectorExample = {
   status: "active",
   enabled: true
 };
-var DatabaseProviderSchema = zod.z.enum([
+var DatabaseProviderSchema2 = zod.z.enum([
   "postgresql",
   "mysql",
   "mariadb",
@@ -34806,7 +36194,7 @@ var DatabaseConnectorSchema = ConnectorSchema2.extend({
   /**
    * Database provider
    */
-  provider: DatabaseProviderSchema.describe("Database provider type"),
+  provider: DatabaseProviderSchema2.describe("Database provider type"),
   /**
    * Connection configuration
    */
@@ -37420,6 +38808,68 @@ function validateCrossReferences(config) {
       }
     }
   }
+  if (config.data) {
+    for (const dataset of config.data) {
+      if (dataset.object && !objectNames.has(dataset.object)) {
+        errors.push(
+          `Seed data references object '${dataset.object}' which is not defined in objects.`
+        );
+      }
+    }
+  }
+  if (config.apps) {
+    const dashboardNames = /* @__PURE__ */ new Set();
+    if (config.dashboards) {
+      for (const d of config.dashboards) {
+        dashboardNames.add(d.name);
+      }
+    }
+    const pageNames = /* @__PURE__ */ new Set();
+    if (config.pages) {
+      for (const p of config.pages) {
+        pageNames.add(p.name);
+      }
+    }
+    const reportNames = /* @__PURE__ */ new Set();
+    if (config.reports) {
+      for (const r of config.reports) {
+        reportNames.add(r.name);
+      }
+    }
+    for (const app of config.apps) {
+      if (!app.navigation) continue;
+      const checkNavItems = (items, appName) => {
+        for (const item of items) {
+          if (!item || typeof item !== "object") continue;
+          const nav = item;
+          if (nav.type === "object" && typeof nav.objectName === "string" && !objectNames.has(nav.objectName)) {
+            errors.push(
+              `App '${appName}' navigation references object '${nav.objectName}' which is not defined in objects.`
+            );
+          }
+          if (nav.type === "dashboard" && typeof nav.dashboardName === "string" && dashboardNames.size > 0 && !dashboardNames.has(nav.dashboardName)) {
+            errors.push(
+              `App '${appName}' navigation references dashboard '${nav.dashboardName}' which is not defined in dashboards.`
+            );
+          }
+          if (nav.type === "page" && typeof nav.pageName === "string" && pageNames.size > 0 && !pageNames.has(nav.pageName)) {
+            errors.push(
+              `App '${appName}' navigation references page '${nav.pageName}' which is not defined in pages.`
+            );
+          }
+          if (nav.type === "report" && typeof nav.reportName === "string" && reportNames.size > 0 && !reportNames.has(nav.reportName)) {
+            errors.push(
+              `App '${appName}' navigation references report '${nav.reportName}' which is not defined in reports.`
+            );
+          }
+          if (nav.type === "group" && Array.isArray(nav.children)) {
+            checkNavItems(nav.children, appName);
+          }
+        }
+      };
+      checkNavItems(app.navigation, app.name);
+    }
+  }
   return errors;
 }
 function defineStack(config, options) {