@objectstack/spec 3.0.9 → 3.0.11

package/dist/system/index.mjs

@@ -660,6 +660,14 @@ var HttpMethod = z.enum([
   "HEAD",
   "OPTIONS"
 ]);
+var HttpMethodSchema = z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]);
+z.object({
+  url: z.string().describe("API endpoint URL"),
+  method: HttpMethodSchema.optional().default("GET").describe("HTTP method"),
+  headers: z.record(z.string(), z.string()).optional().describe("Custom HTTP headers"),
+  params: z.record(z.string(), z.unknown()).optional().describe("Query parameters"),
+  body: z.unknown().optional().describe("Request body for POST/PUT/PATCH")
+});
 var CorsConfigSchema = z.object({
   /**
    * Enable CORS
@@ -3111,6 +3119,70 @@ var TracingConfigSchema = z.object({
     exportInterval: z.number().int().positive().optional().default(5e3)
   }).optional()
 }).describe("Tracing configuration");
+var DataClassificationSchema = z.enum([
+  "pii",
+  "phi",
+  "pci",
+  "financial",
+  "confidential",
+  "internal",
+  "public"
+]).describe("Data classification level");
+var ComplianceFrameworkSchema = z.enum([
+  "gdpr",
+  "hipaa",
+  "sox",
+  "pci_dss",
+  "ccpa",
+  "iso27001"
+]).describe("Compliance framework identifier");
+var ComplianceAuditRequirementSchema = z.object({
+  framework: ComplianceFrameworkSchema.describe("Compliance framework identifier"),
+  requiredEvents: z.array(z.string()).describe('Audit event types required by this framework (e.g., "data.delete", "auth.login")'),
+  retentionDays: z.number().min(1).describe("Minimum audit log retention period required by this framework (in days)"),
+  alertOnMissing: z.boolean().default(true).describe("Raise alert if a required audit event is not being captured")
+}).describe("Compliance framework audit event requirements");
+var ComplianceEncryptionRequirementSchema = z.object({
+  framework: ComplianceFrameworkSchema.describe("Compliance framework identifier"),
+  dataClassifications: z.array(DataClassificationSchema).describe("Data classifications that must be encrypted under this framework"),
+  minimumAlgorithm: z.enum(["aes-256-gcm", "aes-256-cbc", "chacha20-poly1305"]).default("aes-256-gcm").describe("Minimum encryption algorithm strength required"),
+  keyRotationMaxDays: z.number().min(1).default(90).describe("Maximum key rotation interval required (in days)")
+}).describe("Compliance framework encryption requirements");
+var MaskingVisibilityRuleSchema = z.object({
+  dataClassification: DataClassificationSchema.describe("Data classification this rule applies to"),
+  defaultMasked: z.boolean().default(true).describe("Whether data is masked by default"),
+  unmaskRoles: z.array(z.string()).optional().describe("Roles allowed to view unmasked data"),
+  auditUnmask: z.boolean().default(true).describe("Log an audit event when data is unmasked"),
+  requireApproval: z.boolean().default(false).describe("Require explicit approval before unmasking"),
+  approvalRoles: z.array(z.string()).optional().describe("Roles that can approve unmasking requests")
+}).describe("Masking visibility and audit rule per data classification");
+var SecurityEventCorrelationSchema = z.object({
+  enabled: z.boolean().default(true).describe("Enable cross-subsystem security event correlation"),
+  correlationId: z.boolean().default(true).describe("Inject a shared correlation ID into audit, encryption, and masking events"),
+  linkAuthToAudit: z.boolean().default(true).describe("Link authentication events to subsequent data operation audit trails"),
+  linkEncryptionToAudit: z.boolean().default(true).describe("Log encryption/decryption operations in the audit trail"),
+  linkMaskingToAudit: z.boolean().default(true).describe("Log masking/unmasking operations in the audit trail")
+}).describe("Cross-subsystem security event correlation configuration");
+var DataClassificationPolicySchema = z.object({
+  classification: DataClassificationSchema.describe("Data classification level"),
+  requireEncryption: z.boolean().default(false).describe("Encryption required for this classification"),
+  requireMasking: z.boolean().default(false).describe("Masking required for this classification"),
+  requireAudit: z.boolean().default(false).describe("Audit trail required for access to this classification"),
+  retentionDays: z.number().optional().describe("Data retention limit in days (for compliance)")
+}).describe("Security policy for a specific data classification level");
+var SecurityContextConfigSchema = z.object({
+  enabled: z.boolean().default(true).describe("Enable unified security context governance"),
+  complianceAuditRequirements: z.array(ComplianceAuditRequirementSchema).optional().describe("Compliance-driven audit event requirements"),
+  complianceEncryptionRequirements: z.array(ComplianceEncryptionRequirementSchema).optional().describe("Compliance-driven encryption requirements by data classification"),
+  maskingVisibility: z.array(MaskingVisibilityRuleSchema).optional().describe("Masking visibility rules per data classification"),
+  dataClassifications: z.array(DataClassificationPolicySchema).optional().describe("Data classification policies for unified security enforcement"),
+  eventCorrelation: SecurityEventCorrelationSchema.optional().describe("Cross-subsystem security event correlation settings"),
+  enforceOnWrite: z.boolean().default(true).describe("Enforce encryption and masking requirements on data write operations"),
+  enforceOnRead: z.boolean().default(true).describe("Enforce masking and audit requirements on data read operations"),
+  failOpen: z.boolean().default(false).describe("When false (default), deny access if security context cannot be evaluated")
+}).describe("Unified security context governance configuration");
+
+// src/system/change-management.zod.ts
 var ChangeTypeSchema = z.enum([
   "standard",
   // Pre-approved, low-risk changes
@@ -3285,6 +3357,39 @@ var ChangeRequestSchema = z.object({
      */
     actualEnd: z.number().optional().describe("Actual end time")
   }).optional().describe("Schedule"),
+  /**
+   * Security impact assessment for the change (A.8.32)
+   */
+  securityImpact: z.object({
+    /**
+     * Whether a security impact assessment has been performed
+     */
+    assessed: z.boolean().describe("Whether security impact has been assessed"),
+    /**
+     * Security risk level of this change
+     */
+    riskLevel: z.enum(["none", "low", "medium", "high", "critical"]).optional().describe("Security risk level"),
+    /**
+     * Data classifications affected by this change
+     */
+    affectedDataClassifications: z.array(DataClassificationSchema).optional().describe("Affected data classifications"),
+    /**
+     * Whether the change requires security team approval
+     */
+    requiresSecurityApproval: z.boolean().default(false).describe("Whether security team approval is required"),
+    /**
+     * Security reviewer user ID
+     */
+    reviewedBy: z.string().optional().describe("Security reviewer user ID"),
+    /**
+     * Security review completion timestamp (Unix milliseconds)
+     */
+    reviewedAt: z.number().optional().describe("Security review timestamp"),
+    /**
+     * Security review notes or conditions
+     */
+    reviewNotes: z.string().optional().describe("Security review notes or conditions")
+  }).optional().describe("Security impact assessment per ISO 27001:2022 A.8.32"),
   /**
    * Approval workflow configuration
    */
@@ -4239,81 +4344,648 @@ var AuditLogConfigSchema = z.object({
     "failed-login"
   ])).describe("Event types to capture in the audit log")
 }).describe("Audit log configuration for compliance and security monitoring");
+var AuditFindingSeveritySchema = z.enum([
+  "critical",
+  // Immediate remediation required
+  "major",
+  // Significant non-conformity
+  "minor",
+  // Minor non-conformity
+  "observation"
+  // Improvement opportunity
+]);
+var AuditFindingStatusSchema = z.enum([
+  "open",
+  // Finding identified, not yet addressed
+  "in_remediation",
+  // Remediation in progress
+  "remediated",
+  // Remediation completed, pending verification
+  "verified",
+  // Remediation verified and accepted
+  "accepted_risk",
+  // Risk accepted by management
+  "closed"
+  // Finding closed
+]);
+var AuditFindingSchema = z.object({
+  /**
+   * Unique finding identifier
+   */
+  id: z.string().describe("Unique finding identifier"),
+  /**
+   * Short descriptive title
+   */
+  title: z.string().describe("Finding title"),
+  /**
+   * Detailed description of the finding
+   */
+  description: z.string().describe("Finding description"),
+  /**
+   * Finding severity
+   */
+  severity: AuditFindingSeveritySchema.describe("Finding severity"),
+  /**
+   * Current status
+   */
+  status: AuditFindingStatusSchema.describe("Finding status"),
+  /**
+   * ISO 27001 control reference (e.g., "A.5.35", "A.8.15")
+   */
+  controlReference: z.string().optional().describe("ISO 27001 control reference"),
+  /**
+   * Compliance framework
+   */
+  framework: ComplianceFrameworkSchema.optional().describe("Related compliance framework"),
+  /**
+   * Timestamp when finding was identified (Unix milliseconds)
+   */
+  identifiedAt: z.number().describe("Identification timestamp"),
+  /**
+   * User or entity who identified the finding
+   */
+  identifiedBy: z.string().describe("Identifier (auditor name or system)"),
+  /**
+   * Planned remediation actions
+   */
+  remediationPlan: z.string().optional().describe("Remediation plan"),
+  /**
+   * Remediation deadline (Unix milliseconds)
+   */
+  remediationDeadline: z.number().optional().describe("Remediation deadline timestamp"),
+  /**
+   * Timestamp when remediation was verified (Unix milliseconds)
+   */
+  verifiedAt: z.number().optional().describe("Verification timestamp"),
+  /**
+   * Verifier name or role
+   */
+  verifiedBy: z.string().optional().describe("Verifier name or role"),
+  /**
+   * Notes or comments
+   */
+  notes: z.string().optional().describe("Additional notes")
+}).describe("Audit finding with remediation tracking per ISO 27001:2022 A.5.35");
+var AuditScheduleSchema = z.object({
+  /**
+   * Unique audit schedule identifier
+   */
+  id: z.string().describe("Unique audit schedule identifier"),
+  /**
+   * Audit title or name
+   */
+  title: z.string().describe("Audit title"),
+  /**
+   * Scope of areas to audit
+   */
+  scope: z.array(z.string()).describe("Audit scope areas"),
+  /**
+   * Target compliance framework
+   */
+  framework: ComplianceFrameworkSchema.describe("Target compliance framework"),
+  /**
+   * Scheduled audit date (Unix milliseconds)
+   */
+  scheduledAt: z.number().describe("Scheduled audit timestamp"),
+  /**
+   * Actual completion date (Unix milliseconds)
+   */
+  completedAt: z.number().optional().describe("Completion timestamp"),
+  /**
+   * Assessor name, team, or external firm
+   */
+  assessor: z.string().describe("Assessor or audit team"),
+  /**
+   * Whether this is an external (independent) audit
+   */
+  isExternal: z.boolean().default(false).describe("Whether this is an external audit"),
+  /**
+   * Recurrence interval in months (0 = one-time)
+   */
+  recurrenceMonths: z.number().default(0).describe("Recurrence interval in months (0 = one-time)"),
+  /**
+   * Findings from this audit
+   */
+  findings: z.array(AuditFindingSchema).optional().describe("Audit findings")
+}).describe("Audit schedule for independent security reviews per ISO 27001:2022 A.5.35");
 var ComplianceConfigSchema = z.object({
   gdpr: GDPRConfigSchema.optional().describe("GDPR compliance settings"),
   hipaa: HIPAAConfigSchema.optional().describe("HIPAA compliance settings"),
   pciDss: PCIDSSConfigSchema.optional().describe("PCI-DSS compliance settings"),
-  auditLog: AuditLogConfigSchema.describe("Audit log configuration")
-}).describe("Unified compliance configuration spanning GDPR, HIPAA, and PCI-DSS");
-var ComplianceAuditRequirementSchema = z.object({
-  framework: z.enum(["gdpr", "hipaa", "sox", "pci_dss", "ccpa", "iso27001"]).describe("Compliance framework identifier"),
-  requiredEvents: z.array(z.string()).describe('Audit event types required by this framework (e.g., "data.delete", "auth.login")'),
-  retentionDays: z.number().min(1).describe("Minimum audit log retention period required by this framework (in days)"),
-  alertOnMissing: z.boolean().default(true).describe("Raise alert if a required audit event is not being captured")
-}).describe("Compliance framework audit event requirements");
-var ComplianceEncryptionRequirementSchema = z.object({
-  framework: z.enum(["gdpr", "hipaa", "sox", "pci_dss", "ccpa", "iso27001"]).describe("Compliance framework identifier"),
-  dataClassifications: z.array(z.enum([
-    "pii",
-    "phi",
-    "pci",
-    "financial",
-    "confidential",
-    "internal",
-    "public"
-  ])).describe("Data classifications that must be encrypted under this framework"),
-  minimumAlgorithm: z.enum(["aes-256-gcm", "aes-256-cbc", "chacha20-poly1305"]).default("aes-256-gcm").describe("Minimum encryption algorithm strength required"),
-  keyRotationMaxDays: z.number().min(1).default(90).describe("Maximum key rotation interval required (in days)")
-}).describe("Compliance framework encryption requirements");
-var MaskingVisibilityRuleSchema = z.object({
-  dataClassification: z.enum([
-    "pii",
-    "phi",
-    "pci",
-    "financial",
-    "confidential",
-    "internal",
-    "public"
-  ]).describe("Data classification this rule applies to"),
-  defaultMasked: z.boolean().default(true).describe("Whether data is masked by default"),
-  unmaskRoles: z.array(z.string()).optional().describe("Roles allowed to view unmasked data"),
-  auditUnmask: z.boolean().default(true).describe("Log an audit event when data is unmasked"),
-  requireApproval: z.boolean().default(false).describe("Require explicit approval before unmasking"),
-  approvalRoles: z.array(z.string()).optional().describe("Roles that can approve unmasking requests")
-}).describe("Masking visibility and audit rule per data classification");
-var SecurityEventCorrelationSchema = z.object({
-  enabled: z.boolean().default(true).describe("Enable cross-subsystem security event correlation"),
-  correlationId: z.boolean().default(true).describe("Inject a shared correlation ID into audit, encryption, and masking events"),
-  linkAuthToAudit: z.boolean().default(true).describe("Link authentication events to subsequent data operation audit trails"),
-  linkEncryptionToAudit: z.boolean().default(true).describe("Log encryption/decryption operations in the audit trail"),
-  linkMaskingToAudit: z.boolean().default(true).describe("Log masking/unmasking operations in the audit trail")
-}).describe("Cross-subsystem security event correlation configuration");
-var DataClassificationPolicySchema = z.object({
-  classification: z.enum([
-    "pii",
-    "phi",
-    "pci",
-    "financial",
-    "confidential",
-    "internal",
-    "public"
-  ]).describe("Data classification level"),
-  requireEncryption: z.boolean().default(false).describe("Encryption required for this classification"),
-  requireMasking: z.boolean().default(false).describe("Masking required for this classification"),
-  requireAudit: z.boolean().default(false).describe("Audit trail required for access to this classification"),
-  retentionDays: z.number().optional().describe("Data retention limit in days (for compliance)")
-}).describe("Security policy for a specific data classification level");
-var SecurityContextConfigSchema = z.object({
-  enabled: z.boolean().default(true).describe("Enable unified security context governance"),
-  complianceAuditRequirements: z.array(ComplianceAuditRequirementSchema).optional().describe("Compliance-driven audit event requirements"),
-  complianceEncryptionRequirements: z.array(ComplianceEncryptionRequirementSchema).optional().describe("Compliance-driven encryption requirements by data classification"),
-  maskingVisibility: z.array(MaskingVisibilityRuleSchema).optional().describe("Masking visibility rules per data classification"),
-  dataClassifications: z.array(DataClassificationPolicySchema).optional().describe("Data classification policies for unified security enforcement"),
-  eventCorrelation: SecurityEventCorrelationSchema.optional().describe("Cross-subsystem security event correlation settings"),
-  enforceOnWrite: z.boolean().default(true).describe("Enforce encryption and masking requirements on data write operations"),
-  enforceOnRead: z.boolean().default(true).describe("Enforce masking and audit requirements on data read operations"),
-  failOpen: z.boolean().default(false).describe("When false (default), deny access if security context cannot be evaluated")
-}).describe("Unified security context governance configuration");
+  auditLog: AuditLogConfigSchema.describe("Audit log configuration"),
+  auditSchedules: z.array(AuditScheduleSchema).optional().describe("Scheduled compliance audits (A.5.35)")
+}).describe("Unified compliance configuration spanning GDPR, HIPAA, PCI-DSS, and audit governance");
+var IncidentSeveritySchema = z.enum([
+  "critical",
+  // Immediate threat to business operations or data integrity
+  "high",
+  // Significant impact requiring urgent response
+  "medium",
+  // Moderate impact with controlled response timeline
+  "low"
+  // Minor impact with standard response procedures
+]);
+var IncidentCategorySchema = z.enum([
+  "data_breach",
+  // Unauthorized access or disclosure of data
+  "malware",
+  // Malicious software detection
+  "unauthorized_access",
+  // Unauthorized system or data access
+  "denial_of_service",
+  // Service availability attack
+  "social_engineering",
+  // Phishing, pretexting, or manipulation
+  "insider_threat",
+  // Threat originating from internal actors
+  "physical_security",
+  // Physical security breach
+  "configuration_error",
+  // Security misconfiguration
+  "vulnerability_exploit",
+  // Exploitation of known vulnerability
+  "policy_violation",
+  // Violation of security policies
+  "other"
+  // Other security incidents
+]);
+var IncidentStatusSchema = z.enum([
+  "reported",
+  // Initial report received
+  "triaged",
+  // Severity and category assessed
+  "investigating",
+  // Active investigation in progress
+  "containing",
+  // Containment measures being applied
+  "eradicating",
+  // Root cause being removed
+  "recovering",
+  // Systems being restored to normal
+  "resolved",
+  // Incident resolved
+  "closed"
+  // Post-incident review complete
+]);
+var IncidentResponsePhaseSchema = z.object({
+  /**
+   * Phase name identifier
+   */
+  phase: z.enum([
+    "identification",
+    "containment",
+    "eradication",
+    "recovery",
+    "lessons_learned"
+  ]).describe("Response phase name"),
+  /**
+   * Phase description and objectives
+   */
+  description: z.string().describe("Phase description and objectives"),
+  /**
+   * Responsible team or role for this phase
+   */
+  assignedTo: z.string().describe("Responsible team or role"),
+  /**
+   * Target completion time in hours from incident start
+   */
+  targetHours: z.number().min(0).describe("Target completion time in hours"),
+  /**
+   * Actual completion timestamp (Unix milliseconds)
+   */
+  completedAt: z.number().optional().describe("Actual completion timestamp"),
+  /**
+   * Notes and findings during this phase
+   */
+  notes: z.string().optional().describe("Phase notes and findings")
+}).describe("Incident response phase with timing and assignment");
+var IncidentNotificationRuleSchema = z.object({
+  /**
+   * Minimum severity level that triggers this notification
+   */
+  severity: IncidentSeveritySchema.describe("Minimum severity to trigger notification"),
+  /**
+   * Notification channels to use
+   */
+  channels: z.array(z.enum([
+    "email",
+    "sms",
+    "slack",
+    "pagerduty",
+    "webhook"
+  ])).describe("Notification channels"),
+  /**
+   * Roles or teams to notify
+   */
+  recipients: z.array(z.string()).describe("Roles or teams to notify"),
+  /**
+   * Maximum time in minutes to send notification after incident detection
+   */
+  withinMinutes: z.number().min(1).describe("Notification deadline in minutes from detection"),
+  /**
+   * Whether to notify external regulators (for data breaches)
+   */
+  notifyRegulators: z.boolean().default(false).describe("Whether to notify regulatory authorities"),
+  /**
+   * Regulatory notification deadline in hours (e.g., GDPR 72h)
+   */
+  regulatorDeadlineHours: z.number().optional().describe("Regulatory notification deadline in hours")
+}).describe("Incident notification rule per severity level");
+var IncidentNotificationMatrixSchema = z.object({
+  /**
+   * Notification rules ordered by severity
+   */
+  rules: z.array(IncidentNotificationRuleSchema).describe("Notification rules by severity level"),
+  /**
+   * Default escalation timeout in minutes before auto-escalation
+   */
+  escalationTimeoutMinutes: z.number().default(30).describe("Auto-escalation timeout in minutes"),
+  /**
+   * Escalation chain: ordered list of roles to escalate to
+   */
+  escalationChain: z.array(z.string()).default([]).describe("Ordered escalation chain of roles")
+}).describe("Incident notification matrix with escalation policies");
+var IncidentSchema = z.object({
+  /**
+   * Unique incident identifier
+   */
+  id: z.string().describe("Unique incident identifier"),
+  /**
+   * Short descriptive title of the incident
+   */
+  title: z.string().describe("Incident title"),
+  /**
+   * Detailed description of the security event
+   */
+  description: z.string().describe("Detailed incident description"),
+  /**
+   * Severity classification
+   */
+  severity: IncidentSeveritySchema.describe("Incident severity level"),
+  /**
+   * Incident category / type
+   */
+  category: IncidentCategorySchema.describe("Incident category"),
+  /**
+   * Current status in the incident lifecycle
+   */
+  status: IncidentStatusSchema.describe("Current incident status"),
+  /**
+   * User or system that reported the incident
+   */
+  reportedBy: z.string().describe("Reporter user ID or system name"),
+  /**
+   * Timestamp when the incident was reported (Unix milliseconds)
+   */
+  reportedAt: z.number().describe("Report timestamp"),
+  /**
+   * Timestamp when the incident was detected (may differ from reported)
+   */
+  detectedAt: z.number().optional().describe("Detection timestamp"),
+  /**
+   * Timestamp when the incident was resolved
+   */
+  resolvedAt: z.number().optional().describe("Resolution timestamp"),
+  /**
+   * Systems affected by the incident
+   */
+  affectedSystems: z.array(z.string()).describe("Affected systems"),
+  /**
+   * Data classifications affected (for data breach assessment)
+   */
+  affectedDataClassifications: z.array(DataClassificationSchema).optional().describe("Affected data classifications"),
+  /**
+   * Structured response phases tracking
+   */
+  responsePhases: z.array(IncidentResponsePhaseSchema).optional().describe("Incident response phases"),
+  /**
+   * Root cause analysis (completed post-incident)
+   */
+  rootCause: z.string().optional().describe("Root cause analysis"),
+  /**
+   * Corrective actions taken or planned
+   */
+  correctiveActions: z.array(z.string()).optional().describe("Corrective actions taken or planned"),
+  /**
+   * Lessons learned from the incident (A.5.28)
+   */
+  lessonsLearned: z.string().optional().describe("Lessons learned from the incident"),
+  /**
+   * Related change request IDs (if changes resulted from incident)
+   */
+  relatedChangeRequestIds: z.array(z.string()).optional().describe("Related change request IDs"),
+  /**
+   * Custom metadata for extensibility
+   */
+  metadata: z.record(z.string(), z.unknown()).optional().describe("Custom metadata key-value pairs")
+}).describe("Security incident record per ISO 27001:2022 A.5.24\u2013A.5.28");
+var IncidentResponsePolicySchema = z.object({
+  /**
+   * Whether incident response is enabled
+   */
+  enabled: z.boolean().default(true).describe("Enable incident response management"),
+  /**
+   * Notification matrix configuration
+   */
+  notificationMatrix: IncidentNotificationMatrixSchema.describe("Notification and escalation matrix"),
+  /**
+   * Default response team or role
+   */
+  defaultResponseTeam: z.string().describe("Default incident response team or role"),
+  /**
+   * Maximum time in hours to begin initial triage
+   */
+  triageDeadlineHours: z.number().default(1).describe("Maximum hours to begin triage after detection"),
+  /**
+   * Whether to require post-incident review for all incidents
+   */
+  requirePostIncidentReview: z.boolean().default(true).describe("Require post-incident review for all incidents"),
+  /**
+   * Minimum severity level that requires regulatory notification
+   */
+  regulatoryNotificationThreshold: IncidentSeveritySchema.default("high").describe("Minimum severity requiring regulatory notification"),
+  /**
+   * Retention period for incident records in days
+   */
+  retentionDays: z.number().default(2555).describe("Incident record retention period in days (default ~7 years)")
+}).describe("Organization-level incident response policy per ISO 27001:2022");
+var SupplierRiskLevelSchema = z.enum([
+  "critical",
+  // Direct access to sensitive data or core infrastructure
+  "high",
+  // Significant data processing or service dependency
+  "medium",
+  // Limited data access with moderate dependency
+  "low"
+  // Minimal data access and low service dependency
+]);
+var SupplierAssessmentStatusSchema = z.enum([
+  "pending",
+  // Assessment not yet started
+  "in_progress",
+  // Assessment currently underway
+  "completed",
+  // Assessment completed
+  "expired",
+  // Assessment past its validity period
+  "failed"
+  // Supplier did not meet security requirements
+]);
+var SupplierSecurityRequirementSchema = z.object({
+  /**
+   * Requirement identifier
+   */
+  id: z.string().describe("Requirement identifier"),
+  /**
+   * Requirement description
+   */
+  description: z.string().describe("Requirement description"),
+  /**
+   * ISO 27001 control reference (e.g., "A.5.19")
+   */
+  controlReference: z.string().optional().describe("ISO 27001 control reference"),
+  /**
+   * Whether this requirement is mandatory
+   */
+  mandatory: z.boolean().default(true).describe("Whether this requirement is mandatory"),
+  /**
+   * Compliance status
+   */
+  compliant: z.boolean().optional().describe("Whether the supplier meets this requirement"),
+  /**
+   * Evidence or notes for compliance assessment
+   */
+  evidence: z.string().optional().describe("Compliance evidence or assessment notes")
+}).describe("Individual supplier security requirement");
+var SupplierSecurityAssessmentSchema = z.object({
+  /**
+   * Unique supplier identifier
+   */
+  supplierId: z.string().describe("Unique supplier identifier"),
+  /**
+   * Supplier name
+   */
+  supplierName: z.string().describe("Supplier display name"),
+  /**
+   * Risk classification
+   */
+  riskLevel: SupplierRiskLevelSchema.describe("Supplier risk classification"),
+  /**
+   * Assessment status
+   */
+  status: SupplierAssessmentStatusSchema.describe("Assessment status"),
+  /**
+   * User or team who performed the assessment
+   */
+  assessedBy: z.string().describe("Assessor user ID or team"),
+  /**
+   * Assessment completion timestamp (Unix milliseconds)
+   */
+  assessedAt: z.number().describe("Assessment timestamp"),
+  /**
+   * Assessment validity expiry (Unix milliseconds)
+   */
+  validUntil: z.number().describe("Assessment validity expiry timestamp"),
+  /**
+   * Security requirements assessed
+   */
+  requirements: z.array(SupplierSecurityRequirementSchema).describe("Security requirements and their compliance status"),
+  /**
+   * Overall compliance result
+   */
+  overallCompliant: z.boolean().describe("Whether supplier meets all mandatory requirements"),
+  /**
+   * Data classifications shared with this supplier
+   */
+  dataClassificationsShared: z.array(DataClassificationSchema).optional().describe("Data classifications shared with supplier"),
+  /**
+   * Services provided by the supplier
+   */
+  servicesProvided: z.array(z.string()).optional().describe("Services provided by this supplier"),
+  /**
+   * Certifications held by the supplier
+   */
+  certifications: z.array(z.string()).optional().describe("Supplier certifications (e.g., ISO 27001, SOC 2)"),
+  /**
+   * Remediation items for non-compliant requirements
+   */
+  remediationItems: z.array(z.object({
+    requirementId: z.string().describe("Non-compliant requirement ID"),
+    action: z.string().describe("Required remediation action"),
+    deadline: z.number().describe("Remediation deadline timestamp"),
+    status: z.enum(["pending", "in_progress", "completed"]).default("pending").describe("Remediation status")
+  })).optional().describe("Remediation items for non-compliant requirements"),
+  /**
+   * Custom metadata
+   */
+  metadata: z.record(z.string(), z.unknown()).optional().describe("Custom metadata key-value pairs")
+}).describe("Supplier security assessment record per ISO 27001:2022 A.5.19\u2013A.5.21");
+var SupplierSecurityPolicySchema = z.object({
+  /**
+   * Whether supplier security management is enabled
+   */
+  enabled: z.boolean().default(true).describe("Enable supplier security management"),
+  /**
+   * Reassessment interval in days
+   */
+  reassessmentIntervalDays: z.number().default(365).describe("Supplier reassessment interval in days"),
+  /**
+   * Whether to require supplier security assessment before onboarding
+   */
+  requirePreOnboardingAssessment: z.boolean().default(true).describe("Require security assessment before supplier onboarding"),
+  /**
+   * Minimum risk level that requires formal assessment
+   */
+  formalAssessmentThreshold: SupplierRiskLevelSchema.default("medium").describe("Minimum risk level requiring formal assessment"),
+  /**
+   * Whether to monitor supplier security changes (A.5.22)
+   */
+  monitorChanges: z.boolean().default(true).describe("Monitor supplier security posture changes"),
+  /**
+   * Required certifications for critical suppliers
+   */
+  requiredCertifications: z.array(z.string()).default([]).describe("Required certifications for critical-risk suppliers")
+}).describe("Organization-level supplier security management policy per ISO 27001:2022");
+var TrainingCategorySchema = z.enum([
+  "security_awareness",
+  // General security awareness
+  "data_protection",
+  // Data handling and privacy
+  "incident_response",
+  // Incident reporting and response
+  "access_control",
+  // Access management best practices
+  "phishing_awareness",
+  // Phishing and social engineering
+  "compliance",
+  // Regulatory compliance (GDPR, HIPAA, etc.)
+  "secure_development",
+  // Secure coding and development practices
+  "physical_security",
+  // Physical security awareness
+  "business_continuity",
+  // Business continuity and disaster recovery
+  "other"
+  // Other training categories
+]);
+var TrainingCompletionStatusSchema = z.enum([
+  "not_started",
+  // Training not yet begun
+  "in_progress",
+  // Training currently underway
+  "completed",
+  // Training completed successfully
+  "failed",
+  // Training assessment not passed
+  "expired"
+  // Training certification has expired
+]);
+var TrainingCourseSchema = z.object({
+  /**
+   * Unique course identifier
+   */
+  id: z.string().describe("Unique course identifier"),
+  /**
+   * Course title
+   */
+  title: z.string().describe("Course title"),
+  /**
+   * Course description and objectives
+   */
+  description: z.string().describe("Course description and learning objectives"),
+  /**
+   * Training category
+   */
+  category: TrainingCategorySchema.describe("Training category"),
+  /**
+   * Estimated duration in minutes
+   */
+  durationMinutes: z.number().min(1).describe("Estimated course duration in minutes"),
+  /**
+   * Whether this training is mandatory
+   */
+  mandatory: z.boolean().default(false).describe("Whether training is mandatory"),
+  /**
+   * Target roles or groups for this training
+   */
+  targetRoles: z.array(z.string()).describe("Target roles or groups"),
+  /**
+   * Validity period in days before recertification is needed
+   */
+  validityDays: z.number().optional().describe("Certification validity period in days"),
+  /**
+   * Minimum passing score (percentage) for assessment
+   */
+  passingScore: z.number().min(0).max(100).optional().describe("Minimum passing score percentage"),
+  /**
+   * Course version for tracking content updates
+   */
+  version: z.string().optional().describe("Course content version")
+}).describe("Security training course definition");
+var TrainingRecordSchema = z.object({
+  /**
+   * Reference to the course ID
+   */
+  courseId: z.string().describe("Training course identifier"),
+  /**
+   * User who completed (or is assigned) the training
+   */
+  userId: z.string().describe("User identifier"),
+  /**
+   * Completion status
+   */
+  status: TrainingCompletionStatusSchema.describe("Training completion status"),
+  /**
+   * Training assignment date (Unix milliseconds)
+   */
+  assignedAt: z.number().describe("Assignment timestamp"),
+  /**
+   * Training completion date (Unix milliseconds)
+   */
+  completedAt: z.number().optional().describe("Completion timestamp"),
+  /**
+   * Assessment score (percentage)
+   */
+  score: z.number().min(0).max(100).optional().describe("Assessment score percentage"),
+  /**
+   * Certification expiry date (Unix milliseconds)
+   */
+  expiresAt: z.number().optional().describe("Certification expiry timestamp"),
+  /**
+   * Notes or comments from instructor or system
+   */
+  notes: z.string().optional().describe("Training notes or comments")
+}).describe("Individual training completion record");
+var TrainingPlanSchema = z.object({
+  /**
+   * Whether training management is enabled
+   */
+  enabled: z.boolean().default(true).describe("Enable training management"),
+  /**
+   * Training courses in the plan
+   */
+  courses: z.array(TrainingCourseSchema).describe("Training courses"),
+  /**
+   * Default recertification interval in days
+   */
+  recertificationIntervalDays: z.number().default(365).describe("Default recertification interval in days"),
+  /**
+   * Whether to track training completion for compliance reporting
+   */
+  trackCompletion: z.boolean().default(true).describe("Track training completion for compliance"),
+  /**
+   * Grace period in days after expiry before non-compliance escalation
+   */
+  gracePeriodDays: z.number().default(30).describe("Grace period in days after certification expiry"),
+  /**
+   * Whether to send reminders for upcoming training deadlines
+   */
+  sendReminders: z.boolean().default(true).describe("Send reminders for upcoming training deadlines"),
+  /**
+   * Days before deadline to send first reminder
+   */
+  reminderDaysBefore: z.number().default(14).describe("Days before deadline to send first reminder")
+}).describe("Organizational training plan per ISO 27001:2022 A.6.3");
 var CronScheduleSchema = z.object({
   type: z.literal("cron"),
   expression: z.string().describe('Cron expression (e.g., "0 0 * * *" for daily at midnight)'),
@@ -5574,6 +6246,22 @@ var TenantIsolationLevel = z.enum([
   "isolated_db"
   // Separate database per tenant (maximum isolation)
 ]);
+var DatabaseProviderSchema = z.enum([
+  "turso",
+  // Turso/libSQL (DB-per-Tenant, edge-native)
+  "postgres",
+  // PostgreSQL (traditional, self-hosted or managed)
+  "memory"
+  // In-memory (testing/development only)
+]).describe("Database provider for tenant data");
+var TenantConnectionConfigSchema = z.object({
+  /** Database connection URL */
+  url: z.string().min(1).describe("Database connection URL"),
+  /** Authentication token (JWT for Turso, password for Postgres) */
+  authToken: z.string().optional().describe("Database auth token (encrypted at rest)"),
+  /** Turso database group name */
+  group: z.string().optional().describe("Turso database group name")
+}).describe("Tenant database connection configuration");
 var TenantQuotaSchema = z.object({
   /**
    * Maximum number of users allowed for this tenant
@@ -5586,8 +6274,52 @@ var TenantQuotaSchema = z.object({
   /**
    * API rate limit (requests per minute)
    */
-  apiRateLimit: z.number().int().positive().optional().describe("API requests per minute")
-});
+  apiRateLimit: z.number().int().positive().optional().describe("API requests per minute"),
+  /**
+   * Maximum number of custom objects the tenant can create
+   */
+  maxObjects: z.number().int().positive().optional().describe("Maximum number of custom objects"),
+  /**
+   * Maximum records per object/table
+   */
+  maxRecordsPerObject: z.number().int().positive().optional().describe("Maximum records per object"),
+  /**
+   * Maximum deployments allowed per day
+   */
+  maxDeploymentsPerDay: z.number().int().positive().optional().describe("Maximum deployments per day"),
+  /**
+   * Maximum storage in bytes
+   */
+  maxStorageBytes: z.number().int().positive().optional().describe("Maximum storage in bytes")
+});
+var TenantUsageSchema = z.object({
+  /** Current number of custom objects */
+  currentObjectCount: z.number().int().min(0).default(0).describe("Current number of custom objects"),
+  /** Current total record count across all objects */
+  currentRecordCount: z.number().int().min(0).default(0).describe("Total records across all objects"),
+  /** Current storage usage in bytes */
+  currentStorageBytes: z.number().int().min(0).default(0).describe("Current storage usage in bytes"),
+  /** Deployments executed today */
+  deploymentsToday: z.number().int().min(0).default(0).describe("Deployments executed today"),
+  /** Current number of active users */
+  currentUsers: z.number().int().min(0).default(0).describe("Current number of active users"),
+  /** API requests in the current minute */
+  apiRequestsThisMinute: z.number().int().min(0).default(0).describe("API requests in the current minute"),
+  /** Last updated timestamp (ISO 8601) */
+  lastUpdatedAt: z.string().datetime().optional().describe("Last usage update time")
+}).describe("Current tenant resource usage");
+var QuotaEnforcementResultSchema = z.object({
+  /** Whether the operation is allowed */
+  allowed: z.boolean().describe("Whether the operation is within quota"),
+  /** Quota that would be exceeded (if not allowed) */
+  exceededQuota: z.string().optional().describe("Name of the exceeded quota"),
+  /** Current usage value */
+  currentUsage: z.number().optional().describe("Current usage value"),
+  /** Quota limit value */
+  limit: z.number().optional().describe("Quota limit"),
+  /** Human-readable message */
+  message: z.string().optional().describe("Human-readable quota message")
+}).describe("Quota enforcement check result");
 var TenantSchema = z.object({
   /**
    * Unique tenant identifier
@@ -5601,6 +6333,28 @@ var TenantSchema = z.object({
    * Data isolation level
    */
   isolationLevel: TenantIsolationLevel,
+  /**
+   * Database provider for this tenant
+   */
+  databaseProvider: DatabaseProviderSchema.optional().describe("Database provider"),
+  /**
+   * Database connection configuration (encrypted at rest)
+   */
+  connectionConfig: TenantConnectionConfigSchema.optional().describe("Database connection config"),
+  /**
+   * Current provisioning status
+   */
+  provisioningStatus: z.enum([
+    "provisioning",
+    "active",
+    "suspended",
+    "failed",
+    "destroying"
+  ]).optional().describe("Current provisioning lifecycle status"),
+  /**
+   * Tenant subscription plan
+   */
+  plan: z.enum(["free", "pro", "enterprise"]).optional().describe("Subscription plan"),
   /**
    * Custom configuration values
    */
@@ -6077,6 +6831,274 @@ var RegistryConfigSchema = z.object({
     priority: z.number().int().min(1).default(1)
   })).optional().describe("Mirror registries for redundancy")
 });
+var TenantProvisioningStatusEnum = z.enum([
+  "provisioning",
+  // Database creation in progress
+  "active",
+  // Fully provisioned and operational
+  "suspended",
+  // Temporarily disabled (billing, policy)
+  "failed",
+  // Provisioning failed (requires retry or manual intervention)
+  "destroying"
+  // Deletion in progress
+]).describe("Tenant provisioning lifecycle status");
+var TenantPlanSchema = z.enum([
+  "free",
+  // Free tier with limited quotas
+  "pro",
+  // Professional tier with higher quotas
+  "enterprise"
+  // Enterprise tier with custom quotas and SLAs
+]).describe("Tenant subscription plan");
+var TenantRegionSchema = z.enum([
+  "us-east",
+  // US East (Virginia)
+  "us-west",
+  // US West (Oregon)
+  "eu-west",
+  // EU West (Ireland)
+  "eu-central",
+  // EU Central (Frankfurt)
+  "ap-southeast",
+  // Asia Pacific (Singapore)
+  "ap-northeast"
+  // Asia Pacific (Tokyo)
+]).describe("Available deployment region");
+var ProvisioningStepSchema = z.object({
+  /** Step identifier */
+  name: z.string().min(1).describe("Step name (e.g., create_database, sync_schema)"),
+  /** Step execution status */
+  status: z.enum(["pending", "running", "completed", "failed", "skipped"]).describe("Step status"),
+  /** When the step started (ISO 8601) */
+  startedAt: z.string().datetime().optional().describe("Step start time"),
+  /** When the step completed (ISO 8601) */
+  completedAt: z.string().datetime().optional().describe("Step completion time"),
+  /** Duration in milliseconds */
+  durationMs: z.number().int().min(0).optional().describe("Step duration in ms"),
+  /** Error message if the step failed */
+  error: z.string().optional().describe("Error message on failure")
+}).describe("Individual provisioning step status");
+var TenantProvisioningRequestSchema = z.object({
+  /** Organization ID that owns this tenant */
+  orgId: z.string().min(1).describe("Organization ID"),
+  /** Requested subscription plan */
+  plan: TenantPlanSchema.default("free"),
+  /** Preferred deployment region */
+  region: TenantRegionSchema.default("us-east"),
+  /** Optional tenant display name */
+  displayName: z.string().optional().describe("Tenant display name"),
+  /** Optional initial admin user email */
+  adminEmail: z.string().email().optional().describe("Initial admin user email"),
+  /** Optional metadata to attach to the tenant */
+  metadata: z.record(z.string(), z.unknown()).optional().describe("Additional metadata")
+}).describe("Tenant provisioning request");
+var TenantProvisioningResultSchema = z.object({
+  /** Unique tenant identifier */
+  tenantId: z.string().min(1).describe("Provisioned tenant ID"),
+  /** Database connection URL (libsql:// or https://) */
+  connectionUrl: z.string().min(1).describe("Database connection URL"),
+  /** Current provisioning status */
+  status: TenantProvisioningStatusEnum,
+  /** Deployment region */
+  region: TenantRegionSchema,
+  /** Active subscription plan */
+  plan: TenantPlanSchema,
+  /** Provisioning pipeline steps with status */
+  steps: z.array(ProvisioningStepSchema).default([]).describe("Pipeline step statuses"),
+  /** Total provisioning duration in milliseconds */
+  totalDurationMs: z.number().int().min(0).optional().describe("Total provisioning duration"),
+  /** Provisioned timestamp (ISO 8601) */
+  provisionedAt: z.string().datetime().optional().describe("Provisioning completion time"),
+  /** Error message if provisioning failed */
+  error: z.string().optional().describe("Error message on failure")
+}).describe("Tenant provisioning result");
+var DeployStatusEnum = z.enum([
+  "validating",
+  // Zod schema validation in progress
+  "diffing",
+  // Comparing desired state vs current state
+  "migrating",
+  // Executing DDL statements
+  "registering",
+  // Updating metadata registry
+  "ready",
+  // Deployment complete and live
+  "failed",
+  // Deployment failed at some stage
+  "rolling_back"
+  // Rollback in progress
+]).describe("Deployment lifecycle status");
+var SchemaChangeSchema = z.object({
+  /** Type of entity being changed */
+  entityType: z.enum(["object", "field", "index", "view", "flow", "permission"]).describe("Entity type"),
+  /** Name of the entity */
+  entityName: z.string().min(1).describe("Entity name"),
+  /** Parent entity name (e.g., object name for a field change) */
+  parentEntity: z.string().optional().describe("Parent entity name"),
+  /** Type of change */
+  changeType: z.enum(["added", "modified", "removed"]).describe("Change type"),
+  /** Previous value (for modified/removed) */
+  oldValue: z.unknown().optional().describe("Previous value"),
+  /** New value (for added/modified) */
+  newValue: z.unknown().optional().describe("New value")
+}).describe("Individual schema change");
+var DeployDiffSchema = z.object({
+  /** List of all schema changes */
+  changes: z.array(SchemaChangeSchema).default([]).describe("List of schema changes"),
+  /** Summary counts */
+  summary: z.object({
+    added: z.number().int().min(0).default(0).describe("Number of added entities"),
+    modified: z.number().int().min(0).default(0).describe("Number of modified entities"),
+    removed: z.number().int().min(0).default(0).describe("Number of removed entities")
+  }).describe("Change summary counts"),
+  /** Whether the diff contains breaking changes (e.g., column removal) */
+  hasBreakingChanges: z.boolean().default(false).describe("Whether diff contains breaking changes")
+}).describe("Schema diff between current and desired state");
+var MigrationStatementSchema = z.object({
+  /** SQL DDL statement to execute */
+  sql: z.string().min(1).describe("SQL DDL statement"),
+  /** Whether this statement is reversible */
+  reversible: z.boolean().default(true).describe("Whether the statement can be reversed"),
+  /** Reverse SQL statement (for rollback) */
+  rollbackSql: z.string().optional().describe("Reverse SQL for rollback"),
+  /** Execution order (lower = earlier) */
+  order: z.number().int().min(0).describe("Execution order")
+}).describe("Single DDL migration statement");
+var MigrationPlanSchema = z.object({
+  /** Ordered list of migration statements */
+  statements: z.array(MigrationStatementSchema).default([]).describe("Ordered DDL statements"),
+  /** SQL dialect the statements are written for */
+  dialect: z.string().min(1).describe("Target SQL dialect"),
+  /** Whether the entire plan is reversible */
+  reversible: z.boolean().default(true).describe("Whether the plan can be fully rolled back"),
+  /** Estimated execution time in milliseconds */
+  estimatedDurationMs: z.number().int().min(0).optional().describe("Estimated execution time")
+}).describe("Ordered migration plan");
+var DeployValidationIssueSchema = z.object({
+  /** Severity of the issue */
+  severity: z.enum(["error", "warning", "info"]).describe("Issue severity"),
+  /** Entity path where the issue was found */
+  path: z.string().describe("Entity path (e.g., objects.project_task.fields.name)"),
+  /** Human-readable issue description */
+  message: z.string().describe("Issue description"),
+  /** Zod error code if applicable */
+  code: z.string().optional().describe("Validation error code")
+}).describe("Validation issue");
+var DeployValidationResultSchema = z.object({
+  /** Whether the bundle passed validation */
+  valid: z.boolean().describe("Whether the bundle is valid"),
+  /** List of validation issues */
+  issues: z.array(DeployValidationIssueSchema).default([]).describe("Validation issues"),
+  /** Number of errors */
+  errorCount: z.number().int().min(0).default(0).describe("Number of errors"),
+  /** Number of warnings */
+  warningCount: z.number().int().min(0).default(0).describe("Number of warnings")
+}).describe("Bundle validation result");
+var DeployManifestSchema = z.object({
+  /** Deployment version (semver) */
+  version: z.string().min(1).describe("Deployment version"),
+  /** SHA256 checksum of the bundle contents */
+  checksum: z.string().optional().describe("SHA256 checksum"),
+  /** Object definitions included in this deployment */
+  objects: z.array(z.string()).default([]).describe("Object names included"),
+  /** View definitions included */
+  views: z.array(z.string()).default([]).describe("View names included"),
+  /** Flow definitions included */
+  flows: z.array(z.string()).default([]).describe("Flow names included"),
+  /** Permission definitions included */
+  permissions: z.array(z.string()).default([]).describe("Permission names included"),
+  /** Timestamp of bundle creation (ISO 8601) */
+  createdAt: z.string().datetime().optional().describe("Bundle creation time")
+}).describe("Deployment manifest");
+var DeployBundleSchema = z.object({
+  /** Bundle manifest with version and contents list */
+  manifest: DeployManifestSchema,
+  /** Object definitions (JSON-serialized ObjectStack objects) */
+  objects: z.array(z.record(z.string(), z.unknown())).default([]).describe("Object definitions"),
+  /** View definitions */
+  views: z.array(z.record(z.string(), z.unknown())).default([]).describe("View definitions"),
+  /** Flow definitions */
+  flows: z.array(z.record(z.string(), z.unknown())).default([]).describe("Flow definitions"),
+  /** Permission definitions */
+  permissions: z.array(z.record(z.string(), z.unknown())).default([]).describe("Permission definitions"),
+  /** Seed data records to populate after schema migration */
+  seedData: z.array(z.record(z.string(), z.unknown())).default([]).describe("Seed data records")
+}).describe("Deploy bundle containing all metadata for deployment");
+var AppManifestSchema = z.object({
+  /** Unique app identifier (snake_case) */
+  name: z.string().regex(/^[a-z_][a-z0-9_]*$/).describe("App identifier (snake_case)"),
+  /** Display label for the app */
+  label: z.string().min(1).describe("App display label"),
+  /** App version (semver) */
+  version: z.string().min(1).describe("App version (semver)"),
+  /** App description */
+  description: z.string().optional().describe("App description"),
+  /** Minimum kernel version required */
+  minKernelVersion: z.string().optional().describe("Minimum required kernel version"),
+  /** Object definitions provided by this app */
+  objects: z.array(z.string()).default([]).describe("Object names provided"),
+  /** View definitions provided */
+  views: z.array(z.string()).default([]).describe("View names provided"),
+  /** Flow definitions provided */
+  flows: z.array(z.string()).default([]).describe("Flow names provided"),
+  /** Whether seed data is included */
+  hasSeedData: z.boolean().default(false).describe("Whether app includes seed data"),
+  /** Seed data records to populate on install */
+  seedData: z.array(z.record(z.string(), z.unknown())).default([]).describe("Seed data records"),
+  /** App dependencies (other apps that must be installed first) */
+  dependencies: z.array(z.string()).default([]).describe("Required app dependencies")
+}).describe("App manifest for marketplace installation");
+var AppCompatibilityCheckSchema = z.object({
+  /** Whether the app is compatible with the current environment */
+  compatible: z.boolean().describe("Whether the app is compatible"),
+  /** Compatibility issues found */
+  issues: z.array(z.object({
+    /** Issue severity */
+    severity: z.enum(["error", "warning"]).describe("Issue severity"),
+    /** Issue description */
+    message: z.string().describe("Issue description"),
+    /** Issue category */
+    category: z.enum([
+      "kernel_version",
+      // Kernel version mismatch
+      "object_conflict",
+      // Object name already exists
+      "dependency_missing",
+      // Required dependency not installed
+      "quota_exceeded"
+      // Tenant quota would be exceeded
+    ]).describe("Issue category")
+  })).default([]).describe("Compatibility issues")
+}).describe("App compatibility check result");
+var AppInstallRequestSchema = z.object({
+  /** Target tenant ID */
+  tenantId: z.string().min(1).describe("Target tenant ID"),
+  /** App identifier to install */
+  appId: z.string().min(1).describe("App identifier"),
+  /** Optional configuration overrides */
+  configOverrides: z.record(z.string(), z.unknown()).optional().describe("Configuration overrides"),
+  /** Whether to skip seed data */
+  skipSeedData: z.boolean().default(false).describe("Skip seed data population")
+}).describe("App install request");
+var AppInstallResultSchema = z.object({
+  /** Whether the installation succeeded */
+  success: z.boolean().describe("Whether installation succeeded"),
+  /** App identifier that was installed */
+  appId: z.string().describe("Installed app identifier"),
+  /** App version installed */
+  version: z.string().describe("Installed app version"),
+  /** Objects created or updated */
+  installedObjects: z.array(z.string()).default([]).describe("Objects created/updated"),
+  /** Tables created in the database */
+  createdTables: z.array(z.string()).default([]).describe("Database tables created"),
+  /** Number of seed records inserted */
+  seededRecords: z.number().int().min(0).default(0).describe("Seed records inserted"),
+  /** Installation duration in milliseconds */
+  durationMs: z.number().int().min(0).optional().describe("Installation duration"),
+  /** Error message if installation failed */
+  error: z.string().optional().describe("Error message on failure")
+}).describe("App install result");
 
 // src/system/constants/paths.ts
 var PKG_CONVENTIONS = {
@@ -6214,6 +7236,6 @@ var StorageNameMapping = {
   }
 };
 
-export { AccessControlConfigSchema, AddFieldOperation, AnalyzerConfigSchema, AuditConfigSchema, AuditEventActorSchema, AuditEventChangeSchema, AuditEventFilterSchema, AuditEventSchema, AuditEventSeverity, AuditEventTargetSchema, AuditEventType, AuditLogConfigSchema, AuditRetentionPolicySchema, AuditStorageConfigSchema, AuthConfigSchema, AuthPluginConfigSchema, AuthProviderConfigSchema, AwarenessEventSchema, AwarenessSessionSchema, AwarenessUpdateSchema, AwarenessUserStateSchema, BackupConfigSchema, BackupRetentionSchema, BackupStrategySchema, BatchProgressSchema, BatchTask, BatchTaskSchema, BucketConfigSchema, CRDTMergeResultSchema, CRDTStateSchema, CRDTType, CacheAvalanchePreventionSchema, CacheConfigSchema, CacheConsistencySchema, CacheInvalidationSchema, CacheStrategySchema, CacheTierSchema, CacheWarmupSchema, ChangeImpactSchema, ChangePrioritySchema, ChangeRequestSchema, ChangeSetSchema, ChangeStatusSchema, ChangeTypeSchema, CollaborationMode, CollaborationSessionConfigSchema, CollaborationSessionSchema, CollaborativeCursorSchema, ComplianceAuditRequirementSchema, ComplianceConfigSchema, ComplianceEncryptionRequirementSchema, ConsoleDestinationConfigSchema, ConsumerConfigSchema, CoreServiceName, CounterOperationSchema, CreateObjectOperation, CronScheduleSchema, CursorColorPreset, CursorSelectionSchema, CursorStyleSchema, CursorUpdateSchema, DEFAULT_SUSPICIOUS_ACTIVITY_RULES, DataClassificationPolicySchema, DatabaseLevelIsolationStrategySchema, DeadLetterQueueSchema, DeleteObjectOperation, DisasterRecoveryPlanSchema, DistributedCacheConfigSchema, EmailTemplateSchema, EncryptionAlgorithmSchema, EncryptionConfigSchema, ExecuteSqlOperation, ExtendedLogLevel, ExternalServiceDestinationConfigSchema, FacetConfigSchema, FailoverConfigSchema, FailoverModeSchema, FeatureSchema, FieldEncryptionSchema, FieldTranslationSchema, FileDestinationConfigSchema, FileMetadataSchema, GCounterSchema, GDPRConfigSchema, HIPAAConfigSchema, HistogramBucketConfigSchema, HttpDestinationConfigSchema, HttpServerConfig, HttpServerConfigSchema, InAppNotificationSchema, IntervalScheduleSchema, JobExecutionSchema, JobExecutionStatus, JobSchema, KernelServiceMapSchema, KeyManagementProviderSchema, KeyRotationPolicySchema, LWWRegisterSchema, LicenseMetricType, LicenseSchema, LifecycleActionSchema, LifecyclePolicyConfigSchema, LifecyclePolicyRuleSchema, LocaleSchema, LogDestinationSchema, LogDestinationType, LogEnrichmentConfigSchema, LogEntrySchema, LogFormat, LogLevel, LoggerConfigSchema, LoggingConfigSchema, MaskingConfigSchema, MaskingRuleSchema, MaskingStrategySchema, MaskingVisibilityRuleSchema, MessageQueueConfigSchema, MessageQueueProviderSchema, MetadataCollectionInfoSchema, MetadataExportOptionsSchema, MetadataFallbackStrategySchema, MetadataFormatSchema, MetadataImportOptionsSchema, MetadataLoadOptionsSchema, MetadataLoadResultSchema, MetadataLoaderContractSchema, MetadataManagerConfigSchema, MetadataRecordSchema, MetadataSaveOptionsSchema, MetadataSaveResultSchema, MetadataScopeSchema, MetadataSourceSchema, MetadataStateSchema, MetadataStatsSchema, MetadataWatchEventSchema, MetricAggregationConfigSchema, MetricAggregationType, MetricDataPointSchema, MetricDefinitionSchema, MetricExportConfigSchema, MetricLabelsSchema, MetricType, MetricUnit, MetricsConfigSchema, MiddlewareConfig, MiddlewareConfigSchema, MiddlewareType, MigrationDependencySchema, MigrationOperationSchema, ModifyFieldOperation, MultipartUploadConfigSchema, MutualTLSConfigSchema, NotificationChannelSchema, NotificationConfigSchema, ORSetElementSchema, ORSetSchema, OTComponentSchema, OTOperationSchema, OTOperationType, OTTransformResultSchema, ObjectMetadataSchema, ObjectStorageConfigSchema, ObjectTranslationDataSchema, OnceScheduleSchema, OpenTelemetryCompatibilitySchema, OtelExporterType, PCIDSSConfigSchema, PKG_CONVENTIONS, PNCounterSchema, PlanSchema, PresignedUrlConfigSchema, PushNotificationSchema, QueueConfig, QueueConfigSchema, RPOSchema, RTOSchema, RegistryConfigSchema, RegistrySyncPolicySchema, RegistryUpstreamSchema, RemoveFieldOperation, RenameObjectOperation, RetryPolicySchema, RollbackPlanSchema, RouteHandlerMetadataSchema, RowLevelIsolationStrategySchema, SMSTemplateSchema, SamplingDecision, SamplingStrategyType, ScheduleSchema, SchemaLevelIsolationStrategySchema, SearchConfigSchema, SearchIndexConfigSchema, SearchProviderSchema, SecurityContextConfigSchema, SecurityEventCorrelationSchema, ServerCapabilitiesSchema, ServerEventSchema, ServerEventType, ServerStatusSchema, ServiceConfigSchema, ServiceCriticalitySchema, ServiceLevelIndicatorSchema, ServiceLevelObjectiveSchema, ServiceRequirementDef, ServiceStatusSchema, SpanAttributeValueSchema, SpanAttributesSchema, SpanEventSchema, SpanKind, SpanLinkSchema, SpanSchema, SpanStatus, StorageAclSchema, StorageClassSchema, StorageConnectionSchema, StorageNameMapping, StorageProviderSchema, StorageScopeSchema, StructuredLogEntrySchema, SuspiciousActivityRuleSchema, SystemFieldName, SystemObjectName, TASK_PRIORITY_VALUES, Task, TaskExecutionResultSchema, TaskPriority, TaskRetryPolicySchema, TaskSchema, TaskStatus, TenantIsolationConfigSchema, TenantIsolationLevel, TenantQuotaSchema, TenantSchema, TenantSecurityPolicySchema, TextCRDTOperationSchema, TextCRDTStateSchema, TimeSeriesDataPointSchema, TimeSeriesSchema, TopicConfigSchema, TraceContextPropagationSchema, TraceContextSchema, TraceFlagsSchema, TracePropagationFormat, TraceSamplingConfigSchema, TraceStateSchema, TracingConfigSchema, TranslationBundleSchema, TranslationConfigSchema, TranslationDataSchema, TranslationFileOrganizationSchema, UserActivityStatus, VectorClockSchema, WorkerConfig, WorkerConfigSchema, WorkerStatsSchema, azureBlobStorageExample, gcsStorageExample, minioStorageExample, s3StorageExample };
+export { AccessControlConfigSchema, AddFieldOperation, AnalyzerConfigSchema, AppCompatibilityCheckSchema, AppInstallRequestSchema, AppInstallResultSchema, AppManifestSchema, AuditConfigSchema, AuditEventActorSchema, AuditEventChangeSchema, AuditEventFilterSchema, AuditEventSchema, AuditEventSeverity, AuditEventTargetSchema, AuditEventType, AuditFindingSchema, AuditFindingSeveritySchema, AuditFindingStatusSchema, AuditLogConfigSchema, AuditRetentionPolicySchema, AuditScheduleSchema, AuditStorageConfigSchema, AuthConfigSchema, AuthPluginConfigSchema, AuthProviderConfigSchema, AwarenessEventSchema, AwarenessSessionSchema, AwarenessUpdateSchema, AwarenessUserStateSchema, BackupConfigSchema, BackupRetentionSchema, BackupStrategySchema, BatchProgressSchema, BatchTask, BatchTaskSchema, BucketConfigSchema, CRDTMergeResultSchema, CRDTStateSchema, CRDTType, CacheAvalanchePreventionSchema, CacheConfigSchema, CacheConsistencySchema, CacheInvalidationSchema, CacheStrategySchema, CacheTierSchema, CacheWarmupSchema, ChangeImpactSchema, ChangePrioritySchema, ChangeRequestSchema, ChangeSetSchema, ChangeStatusSchema, ChangeTypeSchema, CollaborationMode, CollaborationSessionConfigSchema, CollaborationSessionSchema, CollaborativeCursorSchema, ComplianceAuditRequirementSchema, ComplianceConfigSchema, ComplianceEncryptionRequirementSchema, ComplianceFrameworkSchema, ConsoleDestinationConfigSchema, ConsumerConfigSchema, CoreServiceName, CounterOperationSchema, CreateObjectOperation, CronScheduleSchema, CursorColorPreset, CursorSelectionSchema, CursorStyleSchema, CursorUpdateSchema, DEFAULT_SUSPICIOUS_ACTIVITY_RULES, DataClassificationPolicySchema, DataClassificationSchema, DatabaseLevelIsolationStrategySchema, DatabaseProviderSchema, DeadLetterQueueSchema, DeleteObjectOperation, DeployBundleSchema, DeployDiffSchema, DeployManifestSchema, DeployStatusEnum, DeployValidationIssueSchema, DeployValidationResultSchema, DisasterRecoveryPlanSchema, DistributedCacheConfigSchema, EmailTemplateSchema, EncryptionAlgorithmSchema, EncryptionConfigSchema, ExecuteSqlOperation, ExtendedLogLevel, ExternalServiceDestinationConfigSchema, FacetConfigSchema, FailoverConfigSchema, FailoverModeSchema, FeatureSchema, FieldEncryptionSchema, FieldTranslationSchema, FileDestinationConfigSchema, FileMetadataSchema, GCounterSchema, GDPRConfigSchema, HIPAAConfigSchema, HistogramBucketConfigSchema, HttpDestinationConfigSchema, HttpServerConfig, HttpServerConfigSchema, InAppNotificationSchema, IncidentCategorySchema, IncidentNotificationMatrixSchema, IncidentNotificationRuleSchema, IncidentResponsePhaseSchema, IncidentResponsePolicySchema, IncidentSchema, IncidentSeveritySchema, IncidentStatusSchema, IntervalScheduleSchema, JobExecutionSchema, JobExecutionStatus, JobSchema, KernelServiceMapSchema, KeyManagementProviderSchema, KeyRotationPolicySchema, LWWRegisterSchema, LicenseMetricType, LicenseSchema, LifecycleActionSchema, LifecyclePolicyConfigSchema, LifecyclePolicyRuleSchema, LocaleSchema, LogDestinationSchema, LogDestinationType, LogEnrichmentConfigSchema, LogEntrySchema, LogFormat, LogLevel, LoggerConfigSchema, LoggingConfigSchema, MaskingConfigSchema, MaskingRuleSchema, MaskingStrategySchema, MaskingVisibilityRuleSchema, MessageQueueConfigSchema, MessageQueueProviderSchema, MetadataCollectionInfoSchema, MetadataExportOptionsSchema, MetadataFallbackStrategySchema, MetadataFormatSchema, MetadataImportOptionsSchema, MetadataLoadOptionsSchema, MetadataLoadResultSchema, MetadataLoaderContractSchema, MetadataManagerConfigSchema, MetadataRecordSchema, MetadataSaveOptionsSchema, MetadataSaveResultSchema, MetadataScopeSchema, MetadataSourceSchema, MetadataStateSchema, MetadataStatsSchema, MetadataWatchEventSchema, MetricAggregationConfigSchema, MetricAggregationType, MetricDataPointSchema, MetricDefinitionSchema, MetricExportConfigSchema, MetricLabelsSchema, MetricType, MetricUnit, MetricsConfigSchema, MiddlewareConfig, MiddlewareConfigSchema, MiddlewareType, MigrationDependencySchema, MigrationOperationSchema, MigrationPlanSchema, MigrationStatementSchema, ModifyFieldOperation, MultipartUploadConfigSchema, MutualTLSConfigSchema, NotificationChannelSchema, NotificationConfigSchema, ORSetElementSchema, ORSetSchema, OTComponentSchema, OTOperationSchema, OTOperationType, OTTransformResultSchema, ObjectMetadataSchema, ObjectStorageConfigSchema, ObjectTranslationDataSchema, OnceScheduleSchema, OpenTelemetryCompatibilitySchema, OtelExporterType, PCIDSSConfigSchema, PKG_CONVENTIONS, PNCounterSchema, PlanSchema, PresignedUrlConfigSchema, ProvisioningStepSchema, PushNotificationSchema, QueueConfig, QueueConfigSchema, QuotaEnforcementResultSchema, RPOSchema, RTOSchema, RegistryConfigSchema, RegistrySyncPolicySchema, RegistryUpstreamSchema, RemoveFieldOperation, RenameObjectOperation, RetryPolicySchema, RollbackPlanSchema, RouteHandlerMetadataSchema, RowLevelIsolationStrategySchema, SMSTemplateSchema, SamplingDecision, SamplingStrategyType, ScheduleSchema, SchemaChangeSchema, SchemaLevelIsolationStrategySchema, SearchConfigSchema, SearchIndexConfigSchema, SearchProviderSchema, SecurityContextConfigSchema, SecurityEventCorrelationSchema, ServerCapabilitiesSchema, ServerEventSchema, ServerEventType, ServerStatusSchema, ServiceConfigSchema, ServiceCriticalitySchema, ServiceLevelIndicatorSchema, ServiceLevelObjectiveSchema, ServiceRequirementDef, ServiceStatusSchema, SpanAttributeValueSchema, SpanAttributesSchema, SpanEventSchema, SpanKind, SpanLinkSchema, SpanSchema, SpanStatus, StorageAclSchema, StorageClassSchema, StorageConnectionSchema, StorageNameMapping, StorageProviderSchema, StorageScopeSchema, StructuredLogEntrySchema, SupplierAssessmentStatusSchema, SupplierRiskLevelSchema, SupplierSecurityAssessmentSchema, SupplierSecurityPolicySchema, SupplierSecurityRequirementSchema, SuspiciousActivityRuleSchema, SystemFieldName, SystemObjectName, TASK_PRIORITY_VALUES, Task, TaskExecutionResultSchema, TaskPriority, TaskRetryPolicySchema, TaskSchema, TaskStatus, TenantConnectionConfigSchema, TenantIsolationConfigSchema, TenantIsolationLevel, TenantPlanSchema, TenantProvisioningRequestSchema, TenantProvisioningResultSchema, TenantProvisioningStatusEnum, TenantQuotaSchema, TenantRegionSchema, TenantSchema, TenantSecurityPolicySchema, TenantUsageSchema, TextCRDTOperationSchema, TextCRDTStateSchema, TimeSeriesDataPointSchema, TimeSeriesSchema, TopicConfigSchema, TraceContextPropagationSchema, TraceContextSchema, TraceFlagsSchema, TracePropagationFormat, TraceSamplingConfigSchema, TraceStateSchema, TracingConfigSchema, TrainingCategorySchema, TrainingCompletionStatusSchema, TrainingCourseSchema, TrainingPlanSchema, TrainingRecordSchema, TranslationBundleSchema, TranslationConfigSchema, TranslationDataSchema, TranslationFileOrganizationSchema, UserActivityStatus, VectorClockSchema, WorkerConfig, WorkerConfigSchema, WorkerStatsSchema, azureBlobStorageExample, gcsStorageExample, minioStorageExample, s3StorageExample };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map