@stndrds/schema 0.1.0-alpha.14 → 0.1.0-alpha.16

package/dist/runtime.js

@@ -5,6 +5,9 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -27,20 +30,109 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/constants/default-roles.ts
+var default_roles_exports = {};
+__export(default_roles_exports, {
+  ALL_SYSTEM_RESOURCES: () => ALL_SYSTEM_RESOURCES,
+  DEFAULT_ROLES: () => DEFAULT_ROLES,
+  DEFAULT_ROLE_DESCRIPTIONS: () => DEFAULT_ROLE_DESCRIPTIONS,
+  DEFAULT_ROLE_LABELS: () => DEFAULT_ROLE_LABELS,
+  DEFAULT_ROLE_PERMISSIONS: () => DEFAULT_ROLE_PERMISSIONS,
+  SYSTEM_RESOURCES: () => SYSTEM_RESOURCES,
+  SYSTEM_RESOURCE_LABELS: () => SYSTEM_RESOURCE_LABELS,
+  isDefaultRole: () => isDefaultRole
+});
+function isDefaultRole(roleName) {
+  return Object.values(DEFAULT_ROLES).includes(roleName);
+}
+var SYSTEM_RESOURCES, ALL_SYSTEM_RESOURCES, SYSTEM_RESOURCE_LABELS, DEFAULT_ROLES, DEFAULT_ROLE_LABELS, DEFAULT_ROLE_DESCRIPTIONS, ALL_ACTIONS, MEMBER_ACTIONS, READ_ONLY, DEFAULT_ROLE_PERMISSIONS;
+var init_default_roles = __esm({
+  "src/constants/default-roles.ts"() {
+    "use strict";
+    SYSTEM_RESOURCES = {
+      /** User profiles and invitations management */
+      USERS: "users",
+      /** Object definitions and attributes management */
+      SCHEMA: "schema",
+      /** Roles and permissions management */
+      ROLES: "roles",
+      /** Tenant settings and configuration */
+      SETTINGS: "settings",
+      /** Audit logs and activity trail */
+      AUDIT: "audit"
+    };
+    ALL_SYSTEM_RESOURCES = [
+      SYSTEM_RESOURCES.USERS,
+      SYSTEM_RESOURCES.SCHEMA,
+      SYSTEM_RESOURCES.ROLES,
+      SYSTEM_RESOURCES.SETTINGS,
+      SYSTEM_RESOURCES.AUDIT
+    ];
+    SYSTEM_RESOURCE_LABELS = {
+      users: "Users",
+      schema: "Schema",
+      roles: "Roles & Permissions",
+      settings: "Settings",
+      audit: "Audit Logs"
+    };
+    DEFAULT_ROLES = {
+      /** Full platform access - can manage everything */
+      ADMIN: "admin",
+      /** Standard user - can work with business data but not platform settings */
+      MEMBER: "member",
+      /** Read-only access - can view but not modify */
+      GUEST: "guest"
+    };
+    DEFAULT_ROLE_LABELS = {
+      admin: "Administrator",
+      member: "Member",
+      guest: "Guest"
+    };
+    DEFAULT_ROLE_DESCRIPTIONS = {
+      admin: "Full access to all platform features and data",
+      member: "Can view, create and edit business data",
+      guest: "Read-only access to business data"
+    };
+    ALL_ACTIONS = ["read", "create", "update", "delete"];
+    MEMBER_ACTIONS = ["read", "create", "update"];
+    READ_ONLY = ["read"];
+    DEFAULT_ROLE_PERMISSIONS = {
+      admin: {
+        system: [{ target: "*", actions: ALL_ACTIONS }],
+        object: [{ target: "*", actions: ALL_ACTIONS }]
+      },
+      member: {
+        system: [],
+        // No access to system resources
+        object: [{ target: "*", actions: MEMBER_ACTIONS }]
+      },
+      guest: {
+        system: [],
+        // No access to system resources
+        object: [{ target: "*", actions: READ_ONLY }]
+      }
+    };
+  }
+});
+
 // src/runtime.ts
 var runtime_exports = {};
 __export(runtime_exports, {
+  AuditService: () => AuditService,
   DEFAULT_LABEL_FALLBACK: () => DEFAULT_LABEL_FALLBACK,
   FileService: () => FileService,
+  FlowService: () => FlowService,
   GeocodingService: () => GeocodingService,
   GlobalSearchService: () => GlobalSearchService,
   NoopGeocodingAdapter: () => NoopGeocodingAdapter,
   NoopHookRegistry: () => NoopHookRegistry,
   ObjectSchemaService: () => ObjectSchemaService,
+  PermissionService: () => PermissionService,
   RecordService: () => RecordService,
   RelationService: () => RelationService,
   UserProfileService: () => UserProfileService,
   ViewService: () => ViewService,
+  buildAuditChanges: () => buildAuditChanges,
   createMockAdapter: () => createMockAdapter,
   extractAttributeNames: () => extractAttributeNames,
   getSyncPreview: () => getSyncPreview,
@@ -375,6 +467,12 @@ function createMockUserProfilesRepository(stores) {
       }
       return Promise.resolve(results);
     },
+    countByRole(tenantId, role) {
+      const count = Array.from(stores.userProfiles.values()).filter(
+        (profile) => profile.tenantId === tenantId && profile.role === role
+      ).length;
+      return Promise.resolve(count);
+    },
     updateLastLogin(id) {
       const profile = stores.userProfiles.get(id);
       if (profile) {
@@ -468,12 +566,36 @@ function createMockFilesRepository(stores) {
 }
 function createMockObjectRecordsRepository(stores) {
   return {
+    hardDelete(id) {
+      stores.objectRecords.delete(id);
+      return Promise.resolve();
+    },
+    restore(id) {
+      const existing = stores.objectRecords.get(id);
+      if (!existing) {
+        return Promise.reject(new Error(`ObjectRecord ${id} not found`));
+      }
+      existing.deletedAt = null;
+      stores.objectRecords.set(id, existing);
+      return Promise.resolve(existing);
+    },
     findById(id) {
       const internal = stores.objectRecords.get(id);
       if (!internal) return Promise.resolve(null);
       const { tenantId: _, ...record } = internal;
       return Promise.resolve(record);
     },
+    findByIds(ids) {
+      const results = [];
+      for (const id of ids) {
+        const internal = stores.objectRecords.get(id);
+        if (internal) {
+          const { tenantId: _, ...record } = internal;
+          results.push(record);
+        }
+      }
+      return Promise.resolve(results);
+    },
     create(data) {
       const internal = {
         id: generateId(),
@@ -586,6 +708,85 @@ function createMockObjectRecordsRepository(stores) {
         };
       });
       return Promise.resolve({ results, total });
+    },
+    // -------------------------------------------------------------------------
+    // Schema Integrity Methods
+    // -------------------------------------------------------------------------
+    countRecordsReferencingId(targetId) {
+      const relationAttrs = [];
+      for (const attr of stores.attributes.values()) {
+        if (attr.type === "relation") {
+          relationAttrs.push({ objectId: attr.objectId, attrName: attr.name });
+        }
+      }
+      const countsByObjectId = /* @__PURE__ */ new Map();
+      for (const record of stores.objectRecords.values()) {
+        for (const { objectId, attrName } of relationAttrs) {
+          if (record.objectId !== objectId) continue;
+          const value = record.values[attrName];
+          let isReferencing = false;
+          if (typeof value === "string" && value === targetId) {
+            isReferencing = true;
+          } else if (Array.isArray(value) && value.includes(targetId)) {
+            isReferencing = true;
+          }
+          if (isReferencing) {
+            const current = countsByObjectId.get(objectId) ?? 0;
+            countsByObjectId.set(objectId, current + 1);
+          }
+        }
+      }
+      const results = [];
+      for (const [objectId, count] of countsByObjectId) {
+        const obj = stores.objects.get(objectId);
+        if (obj) {
+          results.push({
+            objectName: obj.name,
+            objectLabel: obj.label,
+            count
+          });
+        }
+      }
+      return Promise.resolve(results);
+    },
+    removeAttributeData(objectId, attributeName) {
+      let updated = 0;
+      for (const record of stores.objectRecords.values()) {
+        if (record.objectId === objectId && attributeName in record.values) {
+          delete record.values[attributeName];
+          record.updatedAt = /* @__PURE__ */ new Date();
+          updated++;
+        }
+      }
+      return Promise.resolve(updated);
+    },
+    batchRefreshLabels(objectId, computeLabel) {
+      let updated = 0;
+      for (const record of stores.objectRecords.values()) {
+        if (record.objectId === objectId) {
+          const newLabel = computeLabel(record.values);
+          if (newLabel !== record.label) {
+            record.label = newLabel;
+            record.updatedAt = /* @__PURE__ */ new Date();
+            updated++;
+          }
+        }
+      }
+      return Promise.resolve(updated);
+    },
+    batchRefreshStatus(objectId, computeStatus) {
+      let updated = 0;
+      for (const record of stores.objectRecords.values()) {
+        if (record.objectId === objectId) {
+          const newStatus = computeStatus(record.values);
+          if (newStatus !== record.completionStatus) {
+            record.completionStatus = newStatus;
+            record.updatedAt = /* @__PURE__ */ new Date();
+            updated++;
+          }
+        }
+      }
+      return Promise.resolve(updated);
     }
   };
 }
@@ -689,6 +890,157 @@ function createMockViewsRepository(stores) {
     }
   };
 }
+function createMockPermissionsRepository(stores) {
+  return {
+    getRolesByTenant(tenantId) {
+      const results = Array.from(stores.roles.values()).filter((r) => r.tenantId === tenantId);
+      return Promise.resolve(results);
+    },
+    getRoleById(roleId) {
+      return Promise.resolve(stores.roles.get(roleId) ?? null);
+    },
+    getRoleByName(tenantId, name) {
+      for (const role of stores.roles.values()) {
+        if (role.tenantId === tenantId && role.name === name) {
+          return Promise.resolve(role);
+        }
+      }
+      return Promise.resolve(null);
+    },
+    createRole(input) {
+      const role = {
+        id: generateId(),
+        tenantId: input.tenantId,
+        name: input.name,
+        label: input.label,
+        description: input.description,
+        system: false,
+        createdAt: /* @__PURE__ */ new Date(),
+        updatedAt: /* @__PURE__ */ new Date()
+      };
+      stores.roles.set(role.id, role);
+      return Promise.resolve(role);
+    },
+    updateRole(roleId, updates) {
+      const existing = stores.roles.get(roleId);
+      if (!existing) {
+        return Promise.reject(new Error(`Role ${roleId} not found`));
+      }
+      const updated = {
+        ...existing,
+        ...updates,
+        updatedAt: /* @__PURE__ */ new Date()
+      };
+      stores.roles.set(roleId, updated);
+      return Promise.resolve(updated);
+    },
+    deleteRole(roleId) {
+      const role = stores.roles.get(roleId);
+      if (role?.system) {
+        return Promise.reject(new Error(`Cannot delete system role ${roleId}`));
+      }
+      stores.roles.delete(roleId);
+      for (const [id, perm] of stores.permissions.entries()) {
+        if (perm.roleId === roleId) {
+          stores.permissions.delete(id);
+        }
+      }
+      for (const [id, ur] of stores.userRoles.entries()) {
+        if (ur.roleId === roleId) {
+          stores.userRoles.delete(id);
+        }
+      }
+      return Promise.resolve();
+    },
+    getPermissionsByRole(roleId) {
+      const results = Array.from(stores.permissions.values()).filter((p) => p.roleId === roleId);
+      return Promise.resolve(results);
+    },
+    setPermissions(roleId, permissions) {
+      for (const [id, perm] of stores.permissions.entries()) {
+        if (perm.roleId === roleId) {
+          stores.permissions.delete(id);
+        }
+      }
+      for (const input of permissions) {
+        const perm = {
+          id: generateId(),
+          roleId,
+          scope: input.scope,
+          target: input.target,
+          actions: input.actions,
+          filter: input.filter,
+          createdAt: /* @__PURE__ */ new Date()
+        };
+        stores.permissions.set(perm.id, perm);
+      }
+      return Promise.resolve();
+    },
+    getUserRoles(userProfileId, tenantId) {
+      const roleIds = Array.from(stores.userRoles.values()).filter((ur) => ur.userProfileId === userProfileId && ur.tenantId === tenantId).map((ur) => ur.roleId);
+      const roles = Array.from(stores.roles.values()).filter((r) => roleIds.includes(r.id));
+      return Promise.resolve(roles);
+    },
+    assignRole(input) {
+      for (const ur of stores.userRoles.values()) {
+        if (ur.userProfileId === input.userProfileId && ur.roleId === input.roleId && ur.tenantId === input.tenantId) {
+          return Promise.resolve(ur);
+        }
+      }
+      const userRole = {
+        id: generateId(),
+        userProfileId: input.userProfileId,
+        roleId: input.roleId,
+        tenantId: input.tenantId,
+        assignedAt: /* @__PURE__ */ new Date(),
+        assignedBy: input.assignedBy
+      };
+      stores.userRoles.set(userRole.id, userRole);
+      return Promise.resolve(userRole);
+    },
+    revokeRole(userProfileId, roleId, tenantId) {
+      for (const [id, ur] of stores.userRoles.entries()) {
+        if (ur.userProfileId === userProfileId && ur.roleId === roleId && ur.tenantId === tenantId) {
+          stores.userRoles.delete(id);
+          break;
+        }
+      }
+      return Promise.resolve();
+    },
+    getEffectivePermissions(userProfileId, tenantId) {
+      const userRoleIds = Array.from(stores.userRoles.values()).filter((ur) => ur.userProfileId === userProfileId && ur.tenantId === tenantId).map((ur) => ur.roleId);
+      const userRoles = Array.from(stores.roles.values()).filter((r) => userRoleIds.includes(r.id));
+      const isAdmin = userRoles.some((r) => r.name === "admin");
+      const userPermissions = Array.from(stores.permissions.values()).filter(
+        (p) => userRoleIds.includes(p.roleId)
+      );
+      const objectPermissions = {};
+      const systemPermissions = {};
+      for (const perm of userPermissions) {
+        if (perm.scope === "object") {
+          if (!objectPermissions[perm.target]) {
+            objectPermissions[perm.target] = [];
+          }
+          for (const action of perm.actions) {
+            if (!objectPermissions[perm.target].includes(action)) {
+              objectPermissions[perm.target].push(action);
+            }
+          }
+        } else if (perm.scope === "system") {
+          if (!systemPermissions[perm.target]) {
+            systemPermissions[perm.target] = [];
+          }
+          for (const action of perm.actions) {
+            if (!systemPermissions[perm.target].includes(action)) {
+              systemPermissions[perm.target].push(action);
+            }
+          }
+        }
+      }
+      return Promise.resolve({ isAdmin, objectPermissions, systemPermissions });
+    }
+  };
+}
 function createMockAdapter() {
   const stores = {
     objects: /* @__PURE__ */ new Map(),
@@ -696,7 +1048,10 @@ function createMockAdapter() {
     userProfiles: /* @__PURE__ */ new Map(),
     files: /* @__PURE__ */ new Map(),
     objectRecords: /* @__PURE__ */ new Map(),
-    views: /* @__PURE__ */ new Map()
+    views: /* @__PURE__ */ new Map(),
+    roles: /* @__PURE__ */ new Map(),
+    permissions: /* @__PURE__ */ new Map(),
+    userRoles: /* @__PURE__ */ new Map()
   };
   const adapter = {
     objects: createMockObjectsRepository(stores),
@@ -705,6 +1060,7 @@ function createMockAdapter() {
     files: createMockFilesRepository(stores),
     objectRecords: createMockObjectRecordsRepository(stores),
     views: createMockViewsRepository(stores),
+    permissions: createMockPermissionsRepository(stores),
     async transaction(callback) {
       return await callback(adapter);
     },
@@ -718,11 +1074,266 @@ function createMockAdapter() {
       stores.files.clear();
       stores.objectRecords.clear();
       stores.views.clear();
+      stores.roles.clear();
+      stores.permissions.clear();
+      stores.userRoles.clear();
     }
   };
   return adapter;
 }
 
+// src/runtime/services/audit.helpers.ts
+function buildAuditChanges(oldValues, newValues, fieldsToCheck) {
+  const changes = [];
+  for (const field of fieldsToCheck) {
+    if (newValues[field] !== void 0 && newValues[field] !== oldValues[field]) {
+      changes.push({
+        field: String(field),
+        oldValue: oldValues[field],
+        newValue: newValues[field]
+      });
+    }
+  }
+  return changes;
+}
+
+// src/runtime/services/audit.service.ts
+var SENSITIVE_PATTERNS = [
+  /password/i,
+  /token/i,
+  /secret/i,
+  /apiKey/i,
+  /api_key/i,
+  /creditCard/i,
+  /credit_card/i,
+  /ssn/i,
+  /cvv/i
+];
+var AuditService = class {
+  constructor(adapter, tenantId, options) {
+    this.adapter = adapter;
+    this.tenantId = tenantId;
+    this.options = options;
+    this.buffer = [];
+    this.flushTimer = null;
+    if (options?.async && options.flushIntervalMs) {
+      this.startFlushTimer();
+    }
+  }
+  // ============================================================================
+  // PUBLIC LOGGING METHODS
+  // ============================================================================
+  /**
+   * Log a record action (create, update, delete, restore)
+   */
+  async logRecordAction(params) {
+    const entry = {
+      tenantId: this.tenantId,
+      actorId: params.actorId,
+      actorEmail: params.actorEmail,
+      actorType: "user",
+      action: params.action,
+      resourceType: "record",
+      resourceId: params.recordId,
+      resourceLabel: params.recordLabel,
+      objectName: params.objectName,
+      objectId: params.objectId,
+      changes: params.changes ? this.redactSensitiveFields(params.changes) : void 0,
+      metadata: params.metadata
+    };
+    await this.log(entry);
+  }
+  /**
+   * Log a schema action (object/attribute changes)
+   */
+  async logSchemaAction(params) {
+    const entry = {
+      tenantId: this.tenantId,
+      actorId: params.actorId,
+      actorEmail: params.actorEmail,
+      actorType: "user",
+      action: params.action,
+      resourceType: params.resourceType,
+      resourceId: params.resourceId,
+      resourceLabel: params.resourceLabel,
+      objectName: params.objectName,
+      objectId: params.objectId,
+      changes: params.changes ? this.redactSensitiveFields(params.changes) : void 0,
+      metadata: params.metadata
+    };
+    await this.log(entry);
+  }
+  /**
+   * Log a user action
+   */
+  async logUserAction(params) {
+    const entry = {
+      tenantId: this.tenantId,
+      actorId: params.actorId,
+      actorEmail: params.actorEmail,
+      actorType: "user",
+      action: params.action,
+      resourceType: "user",
+      resourceId: params.targetUserId,
+      resourceLabel: params.targetUserEmail,
+      changes: params.changes ? this.redactSensitiveFields(params.changes) : void 0,
+      metadata: params.metadata
+    };
+    await this.log(entry);
+  }
+  /**
+   * Log a role action
+   */
+  async logRoleAction(params) {
+    const entry = {
+      tenantId: this.tenantId,
+      actorId: params.actorId,
+      actorEmail: params.actorEmail,
+      actorType: "user",
+      action: params.action,
+      resourceType: "role",
+      resourceId: params.roleId,
+      resourceLabel: params.roleLabel,
+      changes: params.changes ? this.redactSensitiveFields(params.changes) : void 0,
+      metadata: {
+        ...params.metadata,
+        targetUserId: params.targetUserId
+      }
+    };
+    await this.log(entry);
+  }
+  /**
+   * Log a system action (no actor)
+   */
+  async logSystemAction(params) {
+    const entry = {
+      tenantId: this.tenantId,
+      actorType: "system",
+      action: params.action,
+      resourceType: params.resourceType,
+      resourceId: params.resourceId,
+      resourceLabel: params.resourceLabel,
+      objectName: params.objectName,
+      objectId: params.objectId,
+      changes: params.changes ? this.redactSensitiveFields(params.changes) : void 0,
+      metadata: params.metadata
+    };
+    await this.log(entry);
+  }
+  // ============================================================================
+  // QUERY METHODS
+  // ============================================================================
+  /**
+   * List audit logs with filtering and pagination
+   */
+  async list(options) {
+    if (!this.adapter.audit) {
+      return { entries: [], total: 0 };
+    }
+    return await this.adapter.audit.list(this.tenantId, options);
+  }
+  /**
+   * Get audit history for a specific record
+   */
+  async getRecordHistory(recordId) {
+    if (!this.adapter.audit) {
+      return [];
+    }
+    return await this.adapter.audit.getByResource(this.tenantId, "record", recordId, {
+      orderDirection: "desc"
+    });
+  }
+  /**
+   * Get activity for a specific user
+   */
+  async getUserActivity(userId, options) {
+    if (!this.adapter.audit) {
+      return [];
+    }
+    return await this.adapter.audit.getByActor(this.tenantId, userId, options);
+  }
+  /**
+   * Get audit logs for a specific resource
+   */
+  async getResourceHistory(resourceType, resourceId) {
+    if (!this.adapter.audit) {
+      return [];
+    }
+    return await this.adapter.audit.getByResource(this.tenantId, resourceType, resourceId, {
+      orderDirection: "desc"
+    });
+  }
+  // ============================================================================
+  // BUFFER MANAGEMENT (ASYNC MODE)
+  // ============================================================================
+  /**
+   * Flush buffered logs to the database
+   */
+  async flush() {
+    if (this.buffer.length === 0 || !this.adapter.audit) {
+      return;
+    }
+    const entries = [...this.buffer];
+    this.buffer = [];
+    await this.adapter.audit.createMany(entries);
+  }
+  /**
+   * Clean up resources (stop timer, flush remaining logs)
+   */
+  async dispose() {
+    if (this.flushTimer) {
+      clearInterval(this.flushTimer);
+      this.flushTimer = null;
+    }
+    await this.flush();
+  }
+  // ============================================================================
+  // PRIVATE METHODS
+  // ============================================================================
+  /**
+   * Log an entry (sync or async based on options)
+   */
+  async log(entry) {
+    if (!this.adapter.audit) {
+      return;
+    }
+    if (this.options?.async) {
+      this.buffer.push(entry);
+      const batchSize = this.options.batchSize ?? 10;
+      if (this.buffer.length >= batchSize) {
+        await this.flush();
+      }
+    } else {
+      await this.adapter.audit.create(entry);
+    }
+  }
+  /**
+   * Start the flush timer for async mode
+   */
+  startFlushTimer() {
+    const intervalMs = this.options?.flushIntervalMs ?? 1e3;
+    this.flushTimer = setInterval(() => {
+      this.flush().catch(console.error);
+    }, intervalMs);
+  }
+  /**
+   * Redact sensitive fields from changes
+   */
+  redactSensitiveFields(changes) {
+    return changes.map((change) => {
+      const isSensitive = SENSITIVE_PATTERNS.some((pattern) => pattern.test(change.field));
+      if (isSensitive) {
+        return {
+          ...change,
+          oldValue: "[REDACTED]",
+          newValue: "[REDACTED]"
+        };
+      }
+      return change;
+    });
+  }
+};
+
 // src/runtime/services/file.service.ts
 var FileService = class {
   constructor(adapter, tenantId) {
@@ -923,63 +1534,330 @@ var FileService = class {
   }
 };
 
-// src/runtime/services/geocoding.service.ts
-var GeocodingService = class {
-  constructor(adapter) {
+// src/runtime/services/flow.service.ts
+var FlowService = class {
+  constructor(adapter, systemFlows = []) {
     this.adapter = adapter;
+    this.systemFlows = new Map(systemFlows.map((f) => [f.name, f]));
   }
   /**
-   * Search for address suggestions as the user types
+   * Get all flows for a tenant (system + custom)
    */
-  async autocomplete(params) {
-    if (!params.query || params.query.trim().length < 2) {
-      return [];
+  async getAllFlows(tenantId) {
+    const systemFlowsList = Array.from(this.systemFlows.values());
+    if (!this.adapter.flows) {
+      return systemFlowsList;
     }
-    return await this.adapter.autocomplete({
-      ...params,
-      query: params.query.trim(),
-      limit: params.limit ?? 5
-    });
+    const dbFlows = await this.adapter.flows.findAllForTenant(tenantId);
+    const customFlows = dbFlows.filter((f) => !f.system).map(this.convertDBFlowToDefinition);
+    return [...systemFlowsList, ...customFlows];
   }
   /**
-   * Reverse geocode coordinates to an address
+   * Get published flows only
    */
-  async reverse(params) {
-    if (!this.adapter.reverse) {
-      throw new Error("Reverse geocoding is not supported by the configured adapter");
-    }
-    return await this.adapter.reverse(params);
+  async getPublishedFlows(tenantId) {
+    const allFlows = await this.getAllFlows(tenantId);
+    return allFlows.filter((f) => f.status === "published");
   }
   /**
-   * Geocode a structured address to coordinates
+   * Get a specific flow by name
    */
-  async geocode(params) {
-    if (!this.adapter.geocode) {
-      throw new Error("Geocoding is not supported by the configured adapter");
+  async getFlow(name, tenantId) {
+    const systemFlow = this.systemFlows.get(name);
+    if (systemFlow) {
+      return systemFlow;
     }
-    return await this.adapter.geocode(params);
+    if (!this.adapter.flows) {
+      return null;
+    }
+    const dbFlow = await this.adapter.flows.findByName(tenantId, name);
+    if (dbFlow) {
+      return this.convertDBFlowToDefinition(dbFlow);
+    }
+    return null;
   }
-};
-
-// src/runtime/services/global-search.service.ts
-var GlobalSearchService = class {
-  constructor(adapter, tenantId) {
-    this.adapter = adapter;
-    this.tenantId = tenantId;
+  /**
+   * Get a flow by ID
+   */
+  async getFlowById(flowId) {
+    if (!this.adapter.flows) {
+      return null;
+    }
+    const dbFlow = await this.adapter.flows.findById(flowId);
+    if (dbFlow) {
+      return this.convertDBFlowToDefinition(dbFlow);
+    }
+    return null;
   }
   /**
-   * Search across all object records for the tenant
-   *
-   * @param query - Search query string
-   * @param options - Search options (pagination, object filters)
-   * @returns Matching records with object metadata and total count
-   *
-   * @example
-   * ```typescript
-   * // Basic search
-   * const { results, total } = await service.search("nike air");
-   *
-   * // With pagination
+   * Create a new custom flow (as draft)
+   */
+  async createFlow(input, tenantId) {
+    if (!this.adapter.flows) {
+      throw new Error("Flows feature is not enabled. Database adapter does not support flows.");
+    }
+    this.validateFlowName(input.name);
+    const existing = await this.adapter.flows.findByName(tenantId, input.name);
+    if (existing) {
+      throw new Error(`Flow "${input.name}" already exists`);
+    }
+    if (this.systemFlows.has(input.name)) {
+      throw new Error(
+        `Cannot create flow "${input.name}": a system flow with this name already exists`
+      );
+    }
+    this.validateFlowStructure(input);
+    const dbFlow = await this.adapter.flows.create({
+      tenantId,
+      name: input.name,
+      label: input.label,
+      description: input.description,
+      icon: input.icon,
+      status: "draft",
+      version: 1,
+      slots: input.slots,
+      pages: input.pages,
+      relations: input.relations,
+      system: false,
+      metadata: input.metadata
+    });
+    return this.convertDBFlowToDefinition(dbFlow);
+  }
+  /**
+   * Update a custom flow
+   */
+  async updateFlow(flowId, input) {
+    if (!this.adapter.flows) {
+      throw new Error("Flows feature is not enabled.");
+    }
+    const dbFlow = await this.adapter.flows.findById(flowId);
+    if (!dbFlow) {
+      throw new Error(`Flow with id "${flowId}" not found`);
+    }
+    if (dbFlow.system) {
+      throw new Error("Cannot modify system flows. System flows are protected.");
+    }
+    if (input.slots || input.pages || input.relations) {
+      this.validateFlowStructure({
+        name: dbFlow.name,
+        label: input.label ?? dbFlow.label,
+        slots: input.slots ?? dbFlow.slots,
+        pages: input.pages ?? dbFlow.pages,
+        relations: input.relations ?? dbFlow.relations
+      });
+    }
+    const updated = await this.adapter.flows.update(flowId, {
+      label: input.label,
+      description: input.description,
+      icon: input.icon,
+      slots: input.slots,
+      pages: input.pages,
+      relations: input.relations,
+      metadata: input.metadata
+    });
+    return this.convertDBFlowToDefinition(updated);
+  }
+  /**
+   * Publish a flow
+   */
+  async publishFlow(flowId) {
+    if (!this.adapter.flows) {
+      throw new Error("Flows feature is not enabled.");
+    }
+    const dbFlow = await this.adapter.flows.findById(flowId);
+    if (!dbFlow) {
+      throw new Error(`Flow with id "${flowId}" not found`);
+    }
+    if (dbFlow.system) {
+      throw new Error("Cannot publish system flows. They are always published.");
+    }
+    if (dbFlow.status === "published") {
+      return this.convertDBFlowToDefinition(dbFlow);
+    }
+    this.validateFlowStructure({
+      name: dbFlow.name,
+      label: dbFlow.label,
+      slots: dbFlow.slots,
+      pages: dbFlow.pages,
+      relations: dbFlow.relations
+    });
+    const updated = await this.adapter.flows.update(flowId, {
+      status: "published",
+      version: dbFlow.version + 1
+    });
+    return this.convertDBFlowToDefinition(updated);
+  }
+  /**
+   * Archive a flow
+   */
+  async archiveFlow(flowId) {
+    if (!this.adapter.flows) {
+      throw new Error("Flows feature is not enabled.");
+    }
+    const dbFlow = await this.adapter.flows.findById(flowId);
+    if (!dbFlow) {
+      throw new Error(`Flow with id "${flowId}" not found`);
+    }
+    if (dbFlow.system) {
+      throw new Error("Cannot archive system flows.");
+    }
+    const updated = await this.adapter.flows.update(flowId, {
+      status: "archived"
+    });
+    return this.convertDBFlowToDefinition(updated);
+  }
+  /**
+   * Delete a custom flow
+   */
+  async deleteFlow(flowId) {
+    if (!this.adapter.flows) {
+      throw new Error("Flows feature is not enabled.");
+    }
+    const dbFlow = await this.adapter.flows.findById(flowId);
+    if (!dbFlow) {
+      throw new Error(`Flow with id "${flowId}" not found`);
+    }
+    if (dbFlow.system) {
+      throw new Error("Cannot delete system flows. System flows are protected.");
+    }
+    await this.adapter.flows.delete(flowId);
+  }
+  // ============================================================================
+  // PRIVATE HELPERS
+  // ============================================================================
+  /**
+   * Validate flow name format (kebab-case)
+   */
+  validateFlowName(name) {
+    if (!name || name.length === 0) {
+      throw new Error("Flow name cannot be empty");
+    }
+    if (name.length > 63) {
+      throw new Error("Flow name is too long (max 63 characters)");
+    }
+    const kebabCaseRegex = /^[a-z][a-z0-9-]*$/;
+    if (!kebabCaseRegex.test(name)) {
+      throw new Error(
+        "Invalid flow name format. Name must be in kebab-case (e.g., 'couple-creation', 'new-contact')"
+      );
+    }
+  }
+  /**
+   * Validate flow structure (slots, pages, relations)
+   */
+  validateFlowStructure(input) {
+    if (!input.slots || input.slots.length === 0) {
+      throw new Error("Flow must have at least one slot");
+    }
+    if (!input.pages || input.pages.length === 0) {
+      throw new Error("Flow must have at least one page");
+    }
+    const slotIds = new Set(input.slots.map((s) => s.id));
+    if (slotIds.size !== input.slots.length) {
+      throw new Error("Duplicate slot IDs detected");
+    }
+    for (const page of input.pages) {
+      for (const row of page.rows) {
+        for (const field of row.fields) {
+          if (!slotIds.has(field.slotId)) {
+            throw new Error(`Field "${field.id}" references unknown slot "${field.slotId}"`);
+          }
+        }
+      }
+    }
+    for (const relation of input.relations) {
+      if (!slotIds.has(relation.sourceSlotId)) {
+        throw new Error(`Relation references unknown source slot "${relation.sourceSlotId}"`);
+      }
+      if (!slotIds.has(relation.targetSlotId)) {
+        throw new Error(`Relation references unknown target slot "${relation.targetSlotId}"`);
+      }
+      if (relation.sourceSlotId === relation.targetSlotId) {
+        throw new Error(`Relation cannot link a slot to itself: "${relation.sourceSlotId}"`);
+      }
+    }
+  }
+  /**
+   * Convert database flow to FlowDefinition
+   */
+  convertDBFlowToDefinition(dbFlow) {
+    return {
+      id: dbFlow.id,
+      name: dbFlow.name,
+      label: dbFlow.label,
+      description: dbFlow.description,
+      icon: dbFlow.icon,
+      status: dbFlow.status,
+      version: dbFlow.version,
+      slots: dbFlow.slots,
+      pages: dbFlow.pages,
+      relations: dbFlow.relations,
+      system: dbFlow.system,
+      tenantId: dbFlow.tenantId,
+      metadata: dbFlow.metadata,
+      createdAt: dbFlow.createdAt,
+      updatedAt: dbFlow.updatedAt
+    };
+  }
+};
+
+// src/runtime/services/geocoding.service.ts
+var GeocodingService = class {
+  constructor(adapter) {
+    this.adapter = adapter;
+  }
+  /**
+   * Search for address suggestions as the user types
+   */
+  async autocomplete(params) {
+    if (!params.query || params.query.trim().length < 2) {
+      return [];
+    }
+    return await this.adapter.autocomplete({
+      ...params,
+      query: params.query.trim(),
+      limit: params.limit ?? 5
+    });
+  }
+  /**
+   * Reverse geocode coordinates to an address
+   */
+  async reverse(params) {
+    if (!this.adapter.reverse) {
+      throw new Error("Reverse geocoding is not supported by the configured adapter");
+    }
+    return await this.adapter.reverse(params);
+  }
+  /**
+   * Geocode a structured address to coordinates
+   */
+  async geocode(params) {
+    if (!this.adapter.geocode) {
+      throw new Error("Geocoding is not supported by the configured adapter");
+    }
+    return await this.adapter.geocode(params);
+  }
+};
+
+// src/runtime/services/global-search.service.ts
+var GlobalSearchService = class {
+  constructor(adapter, tenantId) {
+    this.adapter = adapter;
+    this.tenantId = tenantId;
+  }
+  /**
+   * Search across all object records for the tenant
+   *
+   * @param query - Search query string
+   * @param options - Search options (pagination, object filters)
+   * @returns Matching records with object metadata and total count
+   *
+   * @example
+   * ```typescript
+   * // Basic search
+   * const { results, total } = await service.search("nike air");
+   *
+   * // With pagination
    * const { results, total } = await service.search("nike", {
    *   limit: 10,
    *   offset: 20
@@ -1042,8 +1920,11 @@ var GlobalSearchService = class {
 var import_constants = require("@stndrds/constants");
 var VALID_ICONS = new Set(import_constants.ICONS);
 
+// src/builders/flow-builder.ts
+var import_zod = require("zod");
+
 // src/builders/object-builder.ts
-var import_zod = __toESM(require("zod"));
+var import_zod2 = __toESM(require("zod"));
 var ObjectBuilder = class {
   constructor(config) {
     this.validateName(config.name);
@@ -1176,14 +2057,14 @@ The labelExpression defines how records are displayed in lists and relations.
     if (name === void 0) {
       return;
     }
-    const objectNameSchema = import_zod.default.string().min(1, "Object name cannot be empty").max(63, "Object name is too long (max 63 characters)").regex(/^[a-z][a-z0-9-]*$/, {
+    const objectNameSchema = import_zod2.default.string().min(1, "Object name cannot be empty").max(63, "Object name is too long (max 63 characters)").regex(/^[a-z][a-z0-9-]*$/, {
       message: "Invalid object name format.\nName must be in kebab-case (slug format):\n  \u2705 Valid: 'products', 'user-profiles', 'order-items'\n  \u274C Invalid: 'Products', 'userProfiles', 'user_profiles'"
     });
     try {
       objectNameSchema.parse(name);
     } catch (error) {
-      if (error instanceof import_zod.default.ZodError) {
-        throw new Error(`[ObjectBuilder] ${error.errors[0].message}`);
+      if (error instanceof import_zod2.default.ZodError) {
+        throw new Error(`[ObjectBuilder] ${error.issues[0].message}`);
       }
       throw error;
     }
@@ -1194,38 +2075,70 @@ function object(config) {
 }
 
 // src/builders/view-builder.ts
-var import_zod2 = require("zod");
+var import_zod3 = require("zod");
+
+// src/types/errors.ts
+var RecordReferencedError = class extends Error {
+  constructor(recordId, references) {
+    const total = references.reduce((sum, r) => sum + r.count, 0);
+    super(`Cannot delete record: referenced by ${total} record${total > 1 ? "s" : ""}`);
+    this.recordId = recordId;
+    this.references = references;
+    this.code = "RECORD_REFERENCED";
+    this.name = "RecordReferencedError";
+  }
+};
+var AttributeInUseError = class extends Error {
+  constructor(attributeName, usage) {
+    super(`Cannot delete attribute "${attributeName}": used in ${usage}`);
+    this.attributeName = attributeName;
+    this.usage = usage;
+    this.code = "ATTRIBUTE_IN_USE";
+    this.name = "AttributeInUseError";
+  }
+};
+var ObjectReferencedError = class extends Error {
+  constructor(objectName, referencingObjects) {
+    super(
+      `Cannot delete object "${objectName}": target of relations in ${referencingObjects.join(", ")}`
+    );
+    this.objectName = objectName;
+    this.referencingObjects = referencingObjects;
+    this.code = "OBJECT_REFERENCED";
+    this.name = "ObjectReferencedError";
+  }
+};
 
 // src/validation/validators.ts
-var import_zod3 = require("zod");
-var baseConfigSchema = import_zod3.z.object({
-  disabled: import_zod3.z.boolean().optional(),
-  placeholder: import_zod3.z.string().optional(),
-  description: import_zod3.z.string().optional(),
-  defaultValue: import_zod3.z.unknown().optional(),
-  icon: import_zod3.z.string().optional(),
-  order: import_zod3.z.number().int().optional(),
-  hidden: import_zod3.z.boolean().optional(),
-  archived: import_zod3.z.boolean().optional(),
-  deprecated: import_zod3.z.boolean().optional(),
-  metadata: import_zod3.z.record(import_zod3.z.unknown()).optional()
+var import_zod4 = require("zod");
+var baseConfigSchema = import_zod4.z.object({
+  disabled: import_zod4.z.boolean().optional(),
+  placeholder: import_zod4.z.string().optional(),
+  description: import_zod4.z.string().optional(),
+  defaultValue: import_zod4.z.unknown().optional(),
+  icon: import_zod4.z.string().optional(),
+  order: import_zod4.z.number().int().optional(),
+  hidden: import_zod4.z.boolean().optional(),
+  archived: import_zod4.z.boolean().optional(),
+  deprecated: import_zod4.z.boolean().optional(),
+  metadata: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()).optional()
 });
-var optionSchema = import_zod3.z.object({
-  id: import_zod3.z.string().min(1),
-  label: import_zod3.z.string().min(1),
-  value: import_zod3.z.string().min(1),
-  color: import_zod3.z.string().optional(),
-  icon: import_zod3.z.string().optional(),
-  description: import_zod3.z.string().optional(),
-  group: import_zod3.z.enum(["idle", "in_progress", "finished"]).optional()
+var optionSchema = import_zod4.z.object({
+  id: import_zod4.z.string().min(1),
+  label: import_zod4.z.string().min(1),
+  value: import_zod4.z.string().min(1),
+  color: import_zod4.z.string().optional(),
+  icon: import_zod4.z.string().optional(),
+  description: import_zod4.z.string().optional(),
+  group: import_zod4.z.enum(["idle", "in_progress", "finished"]).optional()
 });
-var relationTargetSchema = import_zod3.z.object({
-  object: import_zod3.z.string().min(1),
-  displayTemplate: import_zod3.z.string().optional(),
-  filter: import_zod3.z.record(import_zod3.z.unknown()).optional()
+var relationTargetSchema = import_zod4.z.object({
+  object: import_zod4.z.string().min(1),
+  displayTemplate: import_zod4.z.string().optional(),
+  filter: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()).optional()
 });
-var documentTypeConfigSchema = import_zod3.z.object({
-  type: import_zod3.z.enum([
+var documentTypeConfigSchema = import_zod4.z.object({
+  type: import_zod4.z.enum([
     "id_card",
     "passport",
     "incorporation_certificate",
@@ -1236,87 +2149,86 @@ var documentTypeConfigSchema = import_zod3.z.object({
     "proof_of_address",
     "custom"
   ]),
-  label: import_zod3.z.string(),
-  faces: import_zod3.z.array(import_zod3.z.enum(["front", "back", "single"])),
-  attributeMapping: import_zod3.z.array(
-    import_zod3.z.object({
-      attributeId: import_zod3.z.string(),
-      extractedKey: import_zod3.z.string(),
-      face: import_zod3.z.enum(["front", "back", "single"]).optional(),
-      required: import_zod3.z.boolean().optional()
+  label: import_zod4.z.string(),
+  faces: import_zod4.z.array(import_zod4.z.enum(["front", "back", "single"])),
+  attributeMapping: import_zod4.z.array(
+    import_zod4.z.object({
+      attributeId: import_zod4.z.string(),
+      extractedKey: import_zod4.z.string(),
+      face: import_zod4.z.enum(["front", "back", "single"]).optional(),
+      required: import_zod4.z.boolean().optional()
     })
   ).optional()
 });
-var fileVerificationConfigSchema = import_zod3.z.object({
-  enabled: import_zod3.z.boolean(),
-  documentTypes: import_zod3.z.array(documentTypeConfigSchema),
-  autoExtract: import_zod3.z.boolean().optional(),
-  autoValidate: import_zod3.z.boolean().optional()
+var fileVerificationConfigSchema = import_zod4.z.object({
+  enabled: import_zod4.z.boolean(),
+  documentTypes: import_zod4.z.array(documentTypeConfigSchema),
+  autoExtract: import_zod4.z.boolean().optional(),
+  autoValidate: import_zod4.z.boolean().optional()
 });
 var textConfigSchema = baseConfigSchema.extend({
-  minLength: import_zod3.z.number().int().min(0).optional(),
-  maxLength: import_zod3.z.number().int().min(1).optional(),
-  pattern: import_zod3.z.string().optional()
+  minLength: import_zod4.z.number().int().min(0).optional(),
+  maxLength: import_zod4.z.number().int().min(1).optional(),
+  pattern: import_zod4.z.string().optional()
 });
 var textareaConfigSchema = baseConfigSchema;
 var numberConfigSchema = baseConfigSchema.extend({
-  min: import_zod3.z.number().optional(),
-  max: import_zod3.z.number().optional(),
-  unit: import_zod3.z.enum(["integer", "decimal", "percentage"]).optional(),
-  decimals: import_zod3.z.number().int().min(0).optional()
+  min: import_zod4.z.number().optional(),
+  max: import_zod4.z.number().optional(),
+  unit: import_zod4.z.enum(["integer", "decimal", "percentage"]).optional(),
+  decimals: import_zod4.z.number().int().min(0).optional()
 });
 var checkboxConfigSchema = baseConfigSchema;
 var dateConfigSchema = baseConfigSchema.extend({
-  dateFormat: import_zod3.z.enum(["short", "long", "full", "relative"]).optional(),
-  minDate: import_zod3.z.string().optional(),
-  maxDate: import_zod3.z.string().optional()
+  dateFormat: import_zod4.z.enum(["short", "long", "full", "relative"]).optional(),
+  minDate: import_zod4.z.string().optional(),
+  maxDate: import_zod4.z.string().optional()
 });
 var phoneConfigSchema = baseConfigSchema.extend({
-  defaultCountryCode: import_zod3.z.string().length(3).optional()
+  defaultCountryCode: import_zod4.z.string().length(3).optional()
 });
 var currencyConfigSchema = baseConfigSchema.extend({
-  defaultCurrency: import_zod3.z.string().length(3).optional(),
-  allowedCurrencies: import_zod3.z.array(import_zod3.z.string().length(3)).optional()
+  defaultCurrency: import_zod4.z.string().length(3).optional(),
+  allowedCurrencies: import_zod4.z.array(import_zod4.z.string().length(3)).optional()
 });
 var statusConfigSchema = baseConfigSchema.extend({
-  options: import_zod3.z.array(optionSchema).min(1)
+  options: import_zod4.z.array(optionSchema).min(1)
 });
 var locationConfigSchema = baseConfigSchema.extend({
-  granularity: import_zod3.z.enum(["full", "address", "city", "state", "country", "coordinates"]),
-  enableAutocomplete: import_zod3.z.boolean().optional(),
-  enableMap: import_zod3.z.boolean().optional(),
-  defaultCountry: import_zod3.z.string().length(3).optional(),
-  allowedCountries: import_zod3.z.array(import_zod3.z.string().length(3)).optional(),
-  displayFormat: import_zod3.z.enum(["single_line", "multi_line", "compact"]).optional()
+  granularity: import_zod4.z.enum(["full", "address", "city", "state", "country", "coordinates"]),
+  enableAutocomplete: import_zod4.z.boolean().optional(),
+  enableMap: import_zod4.z.boolean().optional(),
+  defaultCountry: import_zod4.z.string().length(3).optional(),
+  allowedCountries: import_zod4.z.array(import_zod4.z.string().length(3)).optional(),
+  displayFormat: import_zod4.z.enum(["single_line", "multi_line", "compact"]).optional()
 });
 var timestampConfigSchema = baseConfigSchema.extend({
-  autoUpdate: import_zod3.z.boolean().optional()
+  autoUpdate: import_zod4.z.boolean().optional()
 });
 var selectConfigSchema = baseConfigSchema.extend({
-  options: import_zod3.z.array(optionSchema).min(1)
+  options: import_zod4.z.array(optionSchema).min(1)
 });
 var multiselectConfigSchema = baseConfigSchema.extend({
-  options: import_zod3.z.array(optionSchema).min(1)
+  options: import_zod4.z.array(optionSchema).min(1)
 });
 var fileConfigSchema = baseConfigSchema.extend({
-  maxFiles: import_zod3.z.number().int().min(1).optional(),
-  maxSize: import_zod3.z.number().int().min(1).optional(),
-  allowedTypes: import_zod3.z.array(import_zod3.z.string()).optional(),
+  maxFiles: import_zod4.z.number().int().min(1).optional(),
+  maxSize: import_zod4.z.number().int().min(1).optional(),
+  allowedTypes: import_zod4.z.array(import_zod4.z.string()).optional(),
   verification: fileVerificationConfigSchema.optional()
 });
 var userConfigSchema = baseConfigSchema.extend({
-  allowedRoles: import_zod3.z.array(import_zod3.z.string()).optional()
+  allowedRoles: import_zod4.z.array(import_zod4.z.string()).optional()
 });
 var relationConfigSchema = baseConfigSchema.extend({
-  targets: import_zod3.z.array(relationTargetSchema).min(1),
-  onDelete: import_zod3.z.enum(["restrict", "cascade", "set_null"]).optional(),
-  cardinality: import_zod3.z.enum(["one", "many"]),
-  minItems: import_zod3.z.number().int().min(0).optional(),
-  maxItems: import_zod3.z.number().int().min(1).optional()
+  targets: import_zod4.z.array(relationTargetSchema).min(1),
+  cardinality: import_zod4.z.enum(["one", "many"]),
+  minItems: import_zod4.z.number().int().min(0).optional(),
+  maxItems: import_zod4.z.number().int().min(1).optional()
 });
 var ratingConfigSchema = baseConfigSchema.extend({
-  max: import_zod3.z.number().int().min(1).optional(),
-  iconType: import_zod3.z.enum(["star", "heart", "thumbs", "number"]).optional()
+  max: import_zod4.z.number().int().min(1).optional(),
+  iconType: import_zod4.z.enum(["star", "heart", "thumbs", "number"]).optional()
 });
 var attributeConfigSchemas = {
   text: textConfigSchema,
@@ -1344,7 +2256,7 @@ function parseAttributeConfig(type, config) {
   return schema.strip().parse(config);
 }
 function createTextValidator(attr) {
-  let schema = import_zod3.z.string();
+  let schema = import_zod4.z.string();
   if (attr.minLength !== void 0) {
     schema = schema.min(
       attr.minLength,
@@ -1363,7 +2275,7 @@ function createTextValidator(attr) {
   return schema;
 }
 function createNumberValidator(attr) {
-  let schema = import_zod3.z.number();
+  let schema = import_zod4.z.number();
   if (attr.min !== void 0) {
     schema = schema.min(attr.min, `${attr.label} must be at least ${attr.min}`);
   }
@@ -1376,81 +2288,75 @@ function createNumberValidator(attr) {
   return schema;
 }
 function createCheckboxValidator(_attr) {
-  return import_zod3.z.boolean();
+  return import_zod4.z.boolean();
 }
 function createDateValidator(attr) {
-  return import_zod3.z.string().datetime({ message: `${attr.label} must be a valid ISO date` });
+  return import_zod4.z.string().datetime({ message: `${attr.label} must be a valid ISO date` });
 }
 function createPhoneValidator(_attr) {
-  return import_zod3.z.object({
-    countryCode: import_zod3.z.string().length(3),
-    phoneNumber: import_zod3.z.string().min(1)
+  return import_zod4.z.object({
+    countryCode: import_zod4.z.string().length(3),
+    phoneNumber: import_zod4.z.string().min(1)
   });
 }
 function createCurrencyValidator(_attr) {
-  return import_zod3.z.object({
-    code: import_zod3.z.string().length(3),
-    value: import_zod3.z.number().min(0)
+  return import_zod4.z.object({
+    code: import_zod4.z.string().length(3),
+    value: import_zod4.z.number().min(0)
   });
 }
 function createStatusValidator(attr) {
   const validValues = attr.options.map((opt) => opt.value);
-  return import_zod3.z.enum(validValues, {
-    errorMap: () => ({
-      message: `${attr.label} must be one of: ${validValues.join(", ")}`
-    })
+  return import_zod4.z.enum(validValues, {
+    error: `${attr.label} must be one of: ${validValues.join(", ")}`
   });
 }
 function createSelectValidator(attr) {
   const validValues = attr.options.map((opt) => opt.value);
-  return import_zod3.z.enum(validValues, {
-    errorMap: () => ({
-      message: `${attr.label} must be one of: ${validValues.join(", ")}`
-    })
+  return import_zod4.z.enum(validValues, {
+    error: `${attr.label} must be one of: ${validValues.join(", ")}`
   });
 }
 function createMultiselectValidator(attr) {
   const validValues = attr.options.map((opt) => opt.value);
-  return import_zod3.z.array(
-    import_zod3.z.enum(validValues, {
-      errorMap: () => ({
-        message: `Each value must be one of: ${validValues.join(", ")}`
-      })
+  return import_zod4.z.array(
+    import_zod4.z.enum(validValues, {
+      error: `Each value must be one of: ${validValues.join(", ")}`
     })
   );
 }
 function createLocationValidator(_attr) {
-  return import_zod3.z.object({
-    address: import_zod3.z.string().optional(),
-    address2: import_zod3.z.string().optional(),
-    city: import_zod3.z.string().optional(),
-    state: import_zod3.z.string().optional(),
-    postalCode: import_zod3.z.string().optional(),
-    country: import_zod3.z.string().length(3).optional(),
-    latitude: import_zod3.z.number().optional(),
-    longitude: import_zod3.z.number().optional()
+  return import_zod4.z.object({
+    address: import_zod4.z.string().optional(),
+    address2: import_zod4.z.string().optional(),
+    city: import_zod4.z.string().optional(),
+    state: import_zod4.z.string().optional(),
+    postalCode: import_zod4.z.string().optional(),
+    country: import_zod4.z.string().length(3).optional(),
+    latitude: import_zod4.z.number().optional(),
+    longitude: import_zod4.z.number().optional()
   });
 }
 function createTimestampValidator(_attr) {
-  return import_zod3.z.number().int().positive();
+  return import_zod4.z.number().int().positive();
 }
 function createFileValidator(_attr) {
-  return import_zod3.z.string().uuid();
+  return import_zod4.z.string().uuid();
 }
 function createUserValidator(_attr) {
-  return import_zod3.z.string().uuid();
+  return import_zod4.z.string().uuid();
 }
 function createSingleRelationValidator(attr) {
-  const uuidSchema = import_zod3.z.string().uuid({
+  const uuidSchema = import_zod4.z.string().uuid({
     message: `${attr.label} must be a valid record ID`
   });
-  return import_zod3.z.union([uuidSchema, import_zod3.z.null()]);
+  return import_zod4.z.union([uuidSchema, import_zod4.z.null()]);
 }
 function createMultiRelationValidator(attr) {
-  const uuidSchema = import_zod3.z.string().uuid({
+  const uuidSchema = import_zod4.z.string().uuid({
     message: `Each ${attr.label} item must be a valid record ID`
   });
-  let arraySchema = import_zod3.z.array(uuidSchema);
+  let arraySchema = import_zod4.z.array(uuidSchema);
   if (attr.minItems !== void 0) {
     arraySchema = arraySchema.min(
       attr.minItems,
@@ -1472,7 +2378,7 @@ function createRelationValidator(attr) {
   return createSingleRelationValidator(attr);
 }
 function createRatingValidator(attr) {
-  let schema = import_zod3.z.number().int().min(0);
+  let schema = import_zod4.z.number().int().min(0);
   if (attr.max !== void 0) {
     schema = schema.max(attr.max, `${attr.label} must be at most ${attr.max}`);
   }
@@ -1511,7 +2417,7 @@ function createAttributeValidator(attr) {
     case "rating":
       return createRatingValidator(attr);
     default:
-      return import_zod3.z.unknown();
+      return import_zod4.z.unknown();
   }
 }
 function createObjectValidator(objectDef) {
@@ -1523,7 +2429,7 @@ function createObjectValidator(objectDef) {
     }
     shape[attr.name] = validator;
   }
-  return import_zod3.z.object(shape);
+  return import_zod4.z.object(shape);
 }
 function validateObject(objectDef, data) {
   const validator = createObjectValidator(objectDef);
@@ -1536,7 +2442,7 @@ function validateObject(objectDef, data) {
   }
   return {
     success: false,
-    errors: result.error.errors.map((err) => ({
+    errors: result.error.issues.map((err) => ({
       path: err.path.map(String),
       message: err.message
     }))
@@ -1557,7 +2463,7 @@ function createDraftValidator(objectDef) {
     const validator = createAttributeValidator(attr).optional();
     shape[attr.name] = validator;
   }
-  return import_zod3.z.object(shape);
+  return import_zod4.z.object(shape);
 }
 function validateDraft(objectDef, data) {
   const validator = createDraftValidator(objectDef);
@@ -1570,7 +2476,7 @@ function validateDraft(objectDef, data) {
   }
   return {
     success: false,
-    errors: result.error.errors.map((err) => ({
+    errors: result.error.issues.map((err) => ({
       path: err.path.map(String),
       message: err.message
     }))
@@ -1617,9 +2523,12 @@ function computeRecordStatus(objectDef, data) {
 
 // src/runtime/services/object-schema.service.ts
 var ObjectSchemaService = class {
-  constructor(adapter, nativeRegistry) {
+  constructor(adapter, nativeRegistry, options) {
     this.adapter = adapter;
     this.nativeRegistry = nativeRegistry;
+    this.auditService = options?.auditService;
+    this.userId = options?.userId;
+    this.userEmail = options?.userEmail;
   }
   /**
    * Create a new custom object
@@ -1661,41 +2570,57 @@ var ObjectSchemaService = class {
       ...objectDef.metadata,
       icon: objectDef.icon
     };
-    const dbObject = await this.adapter.objects.create({
-      tenantId,
-      name: objectDef.name,
-      label: objectDef.label,
-      pluralLabel: objectDef.pluralLabel,
-      description: objectDef.description,
-      labelExpression: objectDef.labelExpression,
-      system: false,
-      // Always false for custom objects
-      metadata
-    });
-    const createdAttributes = [];
-    if (objectDef.attributes.length > 0) {
-      for (let i = 0; i < objectDef.attributes.length; i++) {
-        const attr = objectDef.attributes[i];
-        const config = validatedConfigs[i];
-        const dbAttr = await this.adapter.attributes.create({
-          objectId: dbObject.id,
-          name: attr.name,
-          label: attr.label,
-          type: attr.type,
-          required: attr.required ?? false,
-          unique: false,
-          system: false,
-          config
-        });
-        createdAttributes.push(this.convertDBAttributeToAttribute(dbAttr));
+    const { dbObject, createdAttributes } = await this.adapter.transaction(async (tx) => {
+      const dbObj = await tx.objects.create({
+        tenantId,
+        name: objectDef.name,
+        label: objectDef.label,
+        pluralLabel: objectDef.pluralLabel,
+        description: objectDef.description,
+        labelExpression: objectDef.labelExpression,
+        system: false,
+        // Always false for custom objects
+        metadata
+      });
+      const attrs = [];
+      if (objectDef.attributes.length > 0) {
+        for (let i = 0; i < objectDef.attributes.length; i++) {
+          const attr = objectDef.attributes[i];
+          const config = validatedConfigs[i];
+          const dbAttr = await tx.attributes.create({
+            objectId: dbObj.id,
+            name: attr.name,
+            label: attr.label,
+            type: attr.type,
+            required: attr.required ?? false,
+            unique: false,
+            system: false,
+            config
+          });
+          attrs.push(this.convertDBAttributeToAttribute(dbAttr));
+        }
       }
-    }
-    return {
+      return { dbObject: dbObj, createdAttributes: attrs };
+    });
+    const result = {
       ...objectDef,
       id: dbObject.id,
       attributes: createdAttributes,
       system: false
     };
+    if (this.auditService && this.userId) {
+      await this.auditService.logSchemaAction({
+        action: "object.created",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        resourceType: "object",
+        resourceId: dbObject.id,
+        resourceLabel: dbObject.label,
+        objectName: dbObject.name,
+        objectId: dbObject.id
+      });
+    }
+    return result;
   }
   /**
    * Add a custom attribute to an existing object
@@ -1731,6 +2656,18 @@ var ObjectSchemaService = class {
       // Always false for attributes added via API
       config
     });
+    if (this.auditService && this.userId) {
+      await this.auditService.logSchemaAction({
+        action: "attribute.created",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        resourceType: "attribute",
+        resourceId: dbAttr.id,
+        resourceLabel: dbAttr.label,
+        objectName: dbObject.name,
+        objectId: dbObject.id
+      });
+    }
     return this.convertDBAttributeToAttribute(dbAttr);
   }
   /**
@@ -1774,11 +2711,39 @@ var ObjectSchemaService = class {
     if (dbAttr.type === "relation" && updates.targets) {
       await this.validateRelationTargets(mergedInput, tenantId);
     }
+    const oldValues = {
+      label: dbAttr.label,
+      required: dbAttr.required
+    };
     const updatedDbAttr = await this.adapter.attributes.update(attributeId, {
       label: updates.label,
       required: updates.required,
       config
     });
+    if (this.auditService && this.userId) {
+      const changes = buildAuditChanges(oldValues, updates, ["label", "required"]);
+      if (changes.length > 0) {
+        const dbObject = await this.adapter.objects.findById(dbAttr.objectId);
+        await this.auditService.logSchemaAction({
+          action: "attribute.updated",
+          actorId: this.userId,
+          actorEmail: this.userEmail,
+          resourceType: "attribute",
+          resourceId: attributeId,
+          resourceLabel: updatedDbAttr.label,
+          objectName: dbObject?.name,
+          objectId: dbAttr.objectId,
+          changes
+        });
+      }
+    }
+    if (updates.required !== void 0 && updates.required !== oldValues.required) {
+      const schema = await this.getObjectSchema(dbAttr.objectId);
+      await this.adapter.objectRecords.batchRefreshStatus(
+        dbAttr.objectId,
+        (values) => computeRecordStatus(schema, values)
+      );
+    }
     return this.convertDBAttributeToAttribute(updatedDbAttr);
   }
   /**
@@ -1797,7 +2762,27 @@ var ObjectSchemaService = class {
         `Cannot delete system attribute "${dbAttr.name}". System attributes are protected.`
       );
     }
+    const dbObject = await this.adapter.objects.findById(dbAttr.objectId);
+    if (dbObject?.labelExpression) {
+      const usedAttributes = extractAttributeNames(dbObject.labelExpression);
+      if (usedAttributes.includes(dbAttr.name)) {
+        throw new AttributeInUseError(dbAttr.name, "labelExpression");
+      }
+    }
     await this.adapter.attributes.delete(attributeId);
+    await this.adapter.objectRecords.removeAttributeData(dbAttr.objectId, dbAttr.name);
+    if (this.auditService && this.userId) {
+      await this.auditService.logSchemaAction({
+        action: "attribute.deleted",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        resourceType: "attribute",
+        resourceId: attributeId,
+        resourceLabel: dbAttr.label,
+        objectName: dbObject?.name,
+        objectId: dbAttr.objectId
+      });
+    }
   }
   /**
    * List attributes for an object
@@ -1842,6 +2827,13 @@ var ObjectSchemaService = class {
         `Cannot modify system object "${dbObject.name}". System objects are protected.`
       );
     }
+    const oldValues = {
+      label: dbObject.label,
+      pluralLabel: dbObject.pluralLabel,
+      description: dbObject.description,
+      labelExpression: dbObject.labelExpression,
+      icon: dbObject.metadata?.icon
+    };
     let metadata = dbObject.metadata;
     if (updates.icon !== void 0 || updates.metadata !== void 0) {
       metadata = {
@@ -1857,6 +2849,35 @@ var ObjectSchemaService = class {
       labelExpression: updates.labelExpression,
       metadata
     });
+    if (this.auditService && this.userId) {
+      const changes = buildAuditChanges(oldValues, { ...updates, icon: updates.icon }, [
+        "label",
+        "pluralLabel",
+        "description",
+        "labelExpression",
+        "icon"
+      ]);
+      if (changes.length > 0) {
+        await this.auditService.logSchemaAction({
+          action: "object.updated",
+          actorId: this.userId,
+          actorEmail: this.userEmail,
+          resourceType: "object",
+          resourceId: objectId,
+          resourceLabel: updatedDbObject.label,
+          objectName: updatedDbObject.name,
+          objectId,
+          changes
+        });
+      }
+    }
+    if (updates.labelExpression !== void 0 && updates.labelExpression !== oldValues.labelExpression) {
+      const newExpression = updates.labelExpression;
+      await this.adapter.objectRecords.batchRefreshLabels(
+        objectId,
+        (values) => renderLabelExpression(newExpression, values)
+      );
+    }
     const dbAttributes = await this.adapter.attributes.findByObjectId(objectId);
     return this.convertDBObjectToDefinition(updatedDbObject, dbAttributes);
   }
@@ -1872,7 +2893,7 @@ var ObjectSchemaService = class {
    * await service.deleteObject("obj-123");
    * ```
    */
-  async deleteObject(objectId) {
+  async deleteObject(objectId, tenantId) {
     const dbObject = await this.adapter.objects.findById(objectId);
     if (!dbObject) {
       throw new Error(`Object with id "${objectId}" not found`);
@@ -1882,7 +2903,29 @@ var ObjectSchemaService = class {
         `Cannot delete system object "${dbObject.name}". System objects are protected.`
       );
     }
+    const effectiveTenantId = tenantId ?? dbObject.tenantId;
+    if (effectiveTenantId) {
+      const referencingObjects = await this.findObjectsWithRelationTo(
+        dbObject.name,
+        effectiveTenantId
+      );
+      if (referencingObjects.length > 0) {
+        throw new ObjectReferencedError(dbObject.name, referencingObjects);
+      }
+    }
     await this.adapter.objects.delete(objectId);
+    if (this.auditService && this.userId) {
+      await this.auditService.logSchemaAction({
+        action: "object.deleted",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        resourceType: "object",
+        resourceId: objectId,
+        resourceLabel: dbObject.label,
+        objectName: dbObject.name,
+        objectId
+      });
+    }
   }
   /**
    * Validate attribute name format (variable identifier)
@@ -1975,148 +3018,654 @@ var ObjectSchemaService = class {
     return schemas;
   }
   /**
-   * Merge native object from registry with custom attributes from DB
-   * @internal
+   * Merge native object from registry with custom attributes from DB
+   * @internal
+   */
+  mergeNativeObject(dbObject, dbAttributes) {
+    const nativeObject = this.nativeRegistry.getByName(dbObject.name);
+    if (!nativeObject) {
+      throw new Error(
+        `Native object "${dbObject.name}" not found in registry. Make sure to register it before querying.`
+      );
+    }
+    const systemAttributesFromDB = dbAttributes.filter((attr) => attr.system);
+    const customAttributes = dbAttributes.filter((attr) => !attr.system);
+    const dbAttrByName = new Map(systemAttributesFromDB.map((attr) => [attr.name, attr]));
+    const systemAttrs = nativeObject.attributes.map((registryAttr) => {
+      const dbAttr = dbAttrByName.get(registryAttr.name);
+      if (dbAttr) {
+        return {
+          ...registryAttr,
+          id: dbAttr.id
+        };
+      }
+      return registryAttr;
+    });
+    const customAttrs = customAttributes.map(
+      (dbAttr) => this.convertDBAttributeToAttribute(dbAttr)
+    );
+    return {
+      ...nativeObject,
+      id: dbObject.id,
+      attributes: [
+        ...systemAttrs,
+        // System attributes from registry (with DB IDs if synced)
+        ...customAttrs
+        // Custom attributes from DB
+      ]
+    };
+  }
+  /**
+   * Convert DB object + attributes to ObjectDefinition
+   * @internal
+   */
+  convertDBObjectToDefinition(dbObject, dbAttributes) {
+    const attributes = dbAttributes.map(
+      (dbAttr) => this.convertDBAttributeToAttribute(dbAttr)
+    );
+    return {
+      id: dbObject.id,
+      name: dbObject.name,
+      label: dbObject.label,
+      pluralLabel: dbObject.pluralLabel,
+      description: dbObject.description,
+      icon: dbObject.metadata?.icon,
+      labelExpression: dbObject.labelExpression,
+      attributes,
+      system: dbObject.system,
+      metadata: dbObject.metadata
+    };
+  }
+  /**
+   * Validate attribute input and return parsed config
+   * Validates: name format, config schema, relation targets
+   * @internal
+   */
+  async validateAttributeInput(attribute, tenantId) {
+    this.validateAttributeName(attribute.name);
+    const config = this.buildAttributeConfig(attribute);
+    if (attribute.type === "relation") {
+      await this.validateRelationTargets(attribute, tenantId);
+    }
+    return config;
+  }
+  /**
+   * Build and validate attribute config from input
+   * Uses Zod schema to validate and strip unknown properties
+   * @internal
+   */
+  buildAttributeConfig(attribute) {
+    const DB_COLUMN_FIELDS = ["name", "label", "type", "required", "unique"];
+    const configInput = {};
+    for (const [key, value] of Object.entries(attribute)) {
+      if (!DB_COLUMN_FIELDS.includes(key)) {
+        configInput[key] = value;
+      }
+    }
+    try {
+      return parseAttributeConfig(attribute.type, configInput);
+    } catch (error) {
+      if (error instanceof Error) {
+        throw new Error(`Invalid config for ${attribute.type} attribute: ${error.message}`);
+      }
+      throw error;
+    }
+  }
+  /**
+   * Check if an object exists (in tenant, system, or native registry)
+   * @internal
+   */
+  async objectExists(name, tenantId) {
+    if (tenantId) {
+      const obj = await this.adapter.objects.findByName(tenantId, name);
+      if (obj) return true;
+    }
+    const systemObj = await this.adapter.objects.findSystemByName(name);
+    if (systemObj) return true;
+    return this.nativeRegistry.getByName(name) !== void 0;
+  }
+  /**
+   * Validate that relation target objects exist
+   * @internal
+   */
+  async validateRelationTargets(attribute, tenantId) {
+    const targets = attribute.targets;
+    if (!targets || targets.length === 0) {
+      throw new Error("Relation attribute must have at least one target object");
+    }
+    const cardinality = attribute.cardinality;
+    const isValidCardinality = cardinality === "one" || cardinality === "many";
+    if (!isValidCardinality) {
+      throw new Error("Relation attribute must specify cardinality: 'one' or 'many'");
+    }
+    for (const target of targets) {
+      if (!target.object) {
+        throw new Error("Each relation target must specify an object name");
+      }
+      const exists = await this.objectExists(target.object, tenantId);
+      if (!exists) {
+        throw new Error(
+          `Relation target object "${target.object}" does not exist. Make sure the object is created before adding a relation to it.`
+        );
+      }
+    }
+  }
+  /**
+   * Find objects that have a relation attribute targeting the given object.
+   * Used to prevent deletion of objects that are relation targets.
+   * @internal
+   */
+  async findObjectsWithRelationTo(targetObjectName, tenantId) {
+    const allObjects = await this.adapter.objects.list(tenantId);
+    const referencing = [];
+    for (const obj of allObjects) {
+      if (obj.name === targetObjectName) continue;
+      const attrs = await this.adapter.attributes.findByObjectId(obj.id);
+      const hasRelationToTarget = attrs.some((attr) => {
+        if (attr.type !== "relation") return false;
+        const config = attr.config;
+        return config?.targets?.some((t) => t.object === targetObjectName) ?? false;
+      });
+      if (hasRelationToTarget) {
+        referencing.push(obj.name);
+      }
+    }
+    return referencing;
+  }
+  /**
+   * Convert DB attribute to Attribute type
+   * @internal
+   */
+  convertDBAttributeToAttribute(dbAttr) {
+    const baseAttr = {
+      ...dbAttr.config,
+      id: dbAttr.id,
+      name: dbAttr.name,
+      label: dbAttr.label,
+      type: dbAttr.type,
+      required: dbAttr.required,
+      system: dbAttr.system,
+      unique: dbAttr.unique
+    };
+    return baseAttr;
+  }
+};
+
+// src/exceptions.ts
+var SchemaErrorCode = {
+  // Generic
+  UNKNOWN: "SCHEMA_UNKNOWN_ERROR",
+  // Not Found
+  OBJECT_NOT_FOUND: "SCHEMA_OBJECT_NOT_FOUND",
+  ATTRIBUTE_NOT_FOUND: "SCHEMA_ATTRIBUTE_NOT_FOUND",
+  RECORD_NOT_FOUND: "SCHEMA_RECORD_NOT_FOUND",
+  USER_PROFILE_NOT_FOUND: "SCHEMA_USER_PROFILE_NOT_FOUND",
+  FILE_NOT_FOUND: "SCHEMA_FILE_NOT_FOUND",
+  ROLE_NOT_FOUND: "SCHEMA_ROLE_NOT_FOUND",
+  // Validation
+  VALIDATION_FAILED: "SCHEMA_VALIDATION_FAILED",
+  INVALID_ATTRIBUTE_NAME: "SCHEMA_INVALID_ATTRIBUTE_NAME",
+  INVALID_OBJECT_NAME: "SCHEMA_INVALID_OBJECT_NAME",
+  // Protected Resources
+  PROTECTED_OBJECT: "SCHEMA_PROTECTED_OBJECT",
+  PROTECTED_ATTRIBUTE: "SCHEMA_PROTECTED_ATTRIBUTE",
+  PROTECTED_ROLE: "SCHEMA_PROTECTED_ROLE",
+  // Permissions
+  FORBIDDEN: "SCHEMA_FORBIDDEN",
+  // Sync
+  SYNC_FAILED: "SCHEMA_SYNC_FAILED",
+  NOT_SYSTEM_OBJECT: "SCHEMA_NOT_SYSTEM_OBJECT",
+  // Duplicates
+  DUPLICATE_OBJECT: "SCHEMA_DUPLICATE_OBJECT",
+  DUPLICATE_ATTRIBUTE: "SCHEMA_DUPLICATE_ATTRIBUTE"
+};
+var SchemaError = class extends Error {
+  constructor(message, code = SchemaErrorCode.UNKNOWN, details) {
+    super(message);
+    this.name = "SchemaError";
+    this.code = code;
+    this.details = details;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      code: this.code,
+      message: this.message,
+      details: this.details
+    };
+  }
+};
+var ForbiddenError = class extends SchemaError {
+  constructor(objectName, action, userId) {
+    super(`No ${action} permission on object "${objectName}"`, SchemaErrorCode.FORBIDDEN, {
+      objectName,
+      action,
+      userId
+    });
+    this.name = "ForbiddenError";
+    this.objectName = objectName;
+    this.action = action;
+    this.userId = userId;
+  }
+};
+
+// src/runtime/services/permission.service.ts
+var PermissionService = class {
+  constructor(adapter, tenantId, options) {
+    this.adapter = adapter;
+    this.tenantId = tenantId;
+    this.cache = /* @__PURE__ */ new Map();
+    if (!adapter.permissions) {
+      throw new Error(
+        "PermissionService requires a DatabaseAdapter with permissions repository. Make sure your adapter implements the permissions property."
+      );
+    }
+    this.permissionsRepo = adapter.permissions;
+    this.cacheTtlMs = options?.cacheTtlMs ?? 6e4;
+    this.maxCacheSize = options?.maxCacheSize ?? 1e4;
+    this.auditService = options?.auditService;
+    this.userId = options?.userId;
+    this.userEmail = options?.userEmail;
+  }
+  // ============================================================================
+  // PERMISSION CHECKS
+  // ============================================================================
+  /**
+   * Check if user can perform an action on an object.
+   *
+   * @param userProfileId - User profile ID to check
+   * @param objectName - Object name to check access for
+   * @param action - Action to check (read, create, update, delete)
+   * @returns true if user has permission, false otherwise
+   */
+  async canAccessObject(userProfileId, objectName, action) {
+    const permissions = await this.getEffectivePermissions(userProfileId);
+    if (permissions.isAdmin) {
+      return true;
+    }
+    const wildcardPerms = permissions.objectPermissions["*"];
+    if (wildcardPerms?.includes(action)) {
+      return true;
+    }
+    const objectPerms = permissions.objectPermissions[objectName];
+    return objectPerms?.includes(action) ?? false;
+  }
+  /**
+   * Check if user can access an object, throw ForbiddenError if not.
+   *
+   * @param userProfileId - User profile ID to check
+   * @param objectName - Object name to check access for
+   * @param action - Action to check
+   * @throws ForbiddenError if user lacks permission
+   */
+  async checkObjectAccess(userProfileId, objectName, action) {
+    const canAccess = await this.canAccessObject(userProfileId, objectName, action);
+    if (!canAccess) {
+      throw new ForbiddenError(objectName, action, userProfileId);
+    }
+  }
+  /**
+   * Get permissions for a specific object as boolean flags.
+   * Optimized to fetch permissions once and compute all flags.
+   *
+   * @param userProfileId - User profile ID to check
+   * @param objectName - Object name to check
+   * @returns Object with canRead, canCreate, canUpdate, canDelete flags
+   */
+  async getObjectPermissions(userProfileId, objectName) {
+    const permissions = await this.getEffectivePermissions(userProfileId);
+    if (permissions.isAdmin) {
+      return { canRead: true, canCreate: true, canUpdate: true, canDelete: true };
+    }
+    const wildcardPerms = permissions.objectPermissions["*"] ?? [];
+    const objectPerms = permissions.objectPermissions[objectName] ?? [];
+    const allPerms = /* @__PURE__ */ new Set([...wildcardPerms, ...objectPerms]);
+    return {
+      canRead: allPerms.has("read"),
+      canCreate: allPerms.has("create"),
+      canUpdate: allPerms.has("update"),
+      canDelete: allPerms.has("delete")
+    };
+  }
+  // ============================================================================
+  // SYSTEM PERMISSION CHECKS
+  // ============================================================================
+  /**
+   * Check if user can perform an action on a system resource.
+   *
+   * @param userProfileId - User profile ID to check
+   * @param resource - System resource (users, schema, roles, settings)
+   * @param action - Action to check (read, create, update, delete)
+   * @returns true if user has permission, false otherwise
+   */
+  async canAccessSystem(userProfileId, resource, action) {
+    const permissions = await this.getEffectivePermissions(userProfileId);
+    if (permissions.isAdmin) {
+      return true;
+    }
+    const wildcardPerms = permissions.systemPermissions?.["*"];
+    if (wildcardPerms?.includes(action)) {
+      return true;
+    }
+    const resourcePerms = permissions.systemPermissions?.[resource];
+    return resourcePerms?.includes(action) ?? false;
+  }
+  /**
+   * Check if user can access a system resource, throw ForbiddenError if not.
+   *
+   * @param userProfileId - User profile ID to check
+   * @param resource - System resource to check access for
+   * @param action - Action to check
+   * @throws ForbiddenError if user lacks permission
+   */
+  async checkSystemAccess(userProfileId, resource, action) {
+    const canAccess = await this.canAccessSystem(userProfileId, resource, action);
+    if (!canAccess) {
+      throw new ForbiddenError(`_${resource}`, action, userProfileId);
+    }
+  }
+  /**
+   * Get permissions for a specific system resource as boolean flags.
+   * Optimized to fetch permissions once and compute all flags.
+   *
+   * @param userProfileId - User profile ID to check
+   * @param resource - System resource to check
+   * @returns Object with canRead, canCreate, canUpdate, canDelete flags
+   */
+  async getSystemPermissions(userProfileId, resource) {
+    const permissions = await this.getEffectivePermissions(userProfileId);
+    if (permissions.isAdmin) {
+      return { canRead: true, canCreate: true, canUpdate: true, canDelete: true };
+    }
+    const wildcardPerms = permissions.systemPermissions?.["*"] ?? [];
+    const resourcePerms = permissions.systemPermissions?.[resource] ?? [];
+    const allPerms = /* @__PURE__ */ new Set([...wildcardPerms, ...resourcePerms]);
+    return {
+      canRead: allPerms.has("read"),
+      canCreate: allPerms.has("create"),
+      canUpdate: allPerms.has("update"),
+      canDelete: allPerms.has("delete")
+    };
+  }
+  // ============================================================================
+  // EFFECTIVE PERMISSIONS
+  // ============================================================================
+  /**
+   * Get effective permissions for a user.
+   * Results are cached with TTL and size limit.
+   *
+   * @param userProfileId - User profile ID
+   * @returns Merged permissions from all user's roles
+   */
+  async getEffectivePermissions(userProfileId) {
+    const cacheKey = this.getCacheKey(userProfileId);
+    const cached = this.cache.get(cacheKey);
+    if (cached && cached.expiresAt > Date.now()) {
+      return cached.permissions;
+    }
+    const permissions = await this.permissionsRepo.getEffectivePermissions(
+      userProfileId,
+      this.tenantId
+    );
+    if (this.cache.size >= this.maxCacheSize) {
+      const firstKey = this.cache.keys().next().value;
+      if (firstKey) {
+        this.cache.delete(firstKey);
+      }
+    }
+    this.cache.set(cacheKey, {
+      permissions,
+      expiresAt: Date.now() + this.cacheTtlMs
+    });
+    return permissions;
+  }
+  // ============================================================================
+  // CACHE MANAGEMENT
+  // ============================================================================
+  /**
+   * Invalidate cached permissions for a specific user.
+   * Call this after role/permission changes.
+   */
+  invalidateCache(userProfileId) {
+    this.cache.delete(this.getCacheKey(userProfileId));
+  }
+  /**
+   * Invalidate all cached permissions.
+   * Call this after bulk role/permission changes.
+   */
+  invalidateAllCache() {
+    this.cache.clear();
+  }
+  /**
+   * Get current cache size (for monitoring).
+   */
+  getCacheSize() {
+    return this.cache.size;
+  }
+  getCacheKey(userProfileId) {
+    return `${this.tenantId}:${userProfileId}`;
+  }
+  // ============================================================================
+  // ROLE MANAGEMENT
+  // ============================================================================
+  /**
+   * Get all roles for the current tenant.
+   */
+  async getRoles() {
+    return await this.permissionsRepo.getRolesByTenant(this.tenantId);
+  }
+  /**
+   * Get a role by ID.
+   */
+  async getRoleById(roleId) {
+    return await this.permissionsRepo.getRoleById(roleId);
+  }
+  /**
+   * Create a new role.
+   */
+  async createRole(input) {
+    const role = await this.permissionsRepo.createRole({
+      ...input,
+      tenantId: this.tenantId
+    });
+    if (this.auditService && this.userId) {
+      await this.auditService.logRoleAction({
+        action: "role.created",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        roleId: role.id,
+        roleLabel: role.label
+      });
+    }
+    return role;
+  }
+  /**
+   * Update a role.
+   */
+  async updateRole(roleId, updates) {
+    const oldRole = await this.permissionsRepo.getRoleById(roleId);
+    const role = await this.permissionsRepo.updateRole(roleId, updates);
+    if (this.auditService && this.userId && oldRole) {
+      const changes = [];
+      if (updates.label !== void 0 && updates.label !== oldRole.label) {
+        changes.push({ field: "label", oldValue: oldRole.label, newValue: updates.label });
+      }
+      if (updates.description !== void 0 && updates.description !== oldRole.description) {
+        changes.push({
+          field: "description",
+          oldValue: oldRole.description,
+          newValue: updates.description
+        });
+      }
+      if (changes.length > 0) {
+        await this.auditService.logRoleAction({
+          action: "role.updated",
+          actorId: this.userId,
+          actorEmail: this.userEmail,
+          roleId: role.id,
+          roleLabel: role.label,
+          changes
+        });
+      }
+    }
+    return role;
+  }
+  /**
+   * Delete a role.
+   */
+  async deleteRole(roleId) {
+    const role = await this.permissionsRepo.getRoleById(roleId);
+    await this.permissionsRepo.deleteRole(roleId);
+    this.invalidateAllCache();
+    if (this.auditService && this.userId && role) {
+      await this.auditService.logRoleAction({
+        action: "role.deleted",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        roleId,
+        roleLabel: role.label
+      });
+    }
+  }
+  // ============================================================================
+  // PERMISSION MANAGEMENT
+  // ============================================================================
+  /**
+   * Get all permissions for a role.
    */
-  mergeNativeObject(dbObject, dbAttributes) {
-    const nativeObject = this.nativeRegistry.getByName(dbObject.name);
-    if (!nativeObject) {
-      throw new Error(
-        `Native object "${dbObject.name}" not found in registry. Make sure to register it before querying.`
-      );
+  async getPermissionsByRole(roleId) {
+    return await this.permissionsRepo.getPermissionsByRole(roleId);
+  }
+  /**
+   * Set permissions for a role (replaces existing).
+   */
+  async setPermissions(roleId, permissions) {
+    await this.permissionsRepo.setPermissions(roleId, permissions);
+    this.invalidateAllCache();
+    if (this.auditService && this.userId) {
+      const role = await this.permissionsRepo.getRoleById(roleId);
+      await this.auditService.logRoleAction({
+        action: "role.updated",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        roleId,
+        roleLabel: role?.label ?? roleId,
+        metadata: { permissionsUpdated: true, permissionCount: permissions.length }
+      });
     }
-    const systemAttributesFromDB = dbAttributes.filter((attr) => attr.system);
-    const customAttributes = dbAttributes.filter((attr) => !attr.system);
-    const dbAttrByName = new Map(systemAttributesFromDB.map((attr) => [attr.name, attr]));
-    const systemAttrs = nativeObject.attributes.map((registryAttr) => {
-      const dbAttr = dbAttrByName.get(registryAttr.name);
-      if (dbAttr) {
-        return {
-          ...registryAttr,
-          id: dbAttr.id
-        };
-      }
-      return registryAttr;
-    });
-    const customAttrs = customAttributes.map(
-      (dbAttr) => this.convertDBAttributeToAttribute(dbAttr)
-    );
-    return {
-      ...nativeObject,
-      id: dbObject.id,
-      attributes: [
-        ...systemAttrs,
-        // System attributes from registry (with DB IDs if synced)
-        ...customAttrs
-        // Custom attributes from DB
-      ]
-    };
   }
+  // ============================================================================
+  // USER ROLE MANAGEMENT
+  // ============================================================================
   /**
-   * Convert DB object + attributes to ObjectDefinition
-   * @internal
+   * Get all roles assigned to a user.
    */
-  convertDBObjectToDefinition(dbObject, dbAttributes) {
-    const attributes = dbAttributes.map(
-      (dbAttr) => this.convertDBAttributeToAttribute(dbAttr)
-    );
-    return {
-      id: dbObject.id,
-      name: dbObject.name,
-      label: dbObject.label,
-      pluralLabel: dbObject.pluralLabel,
-      description: dbObject.description,
-      icon: dbObject.metadata?.icon,
-      labelExpression: dbObject.labelExpression,
-      attributes,
-      system: dbObject.system,
-      metadata: dbObject.metadata
-    };
+  async getUserRoles(userProfileId) {
+    return await this.permissionsRepo.getUserRoles(userProfileId, this.tenantId);
   }
   /**
-   * Validate attribute input and return parsed config
-   * Validates: name format, config schema, relation targets
-   * @internal
+   * Assign a role to a user.
    */
-  async validateAttributeInput(attribute, tenantId) {
-    this.validateAttributeName(attribute.name);
-    const config = this.buildAttributeConfig(attribute);
-    if (attribute.type === "relation") {
-      await this.validateRelationTargets(attribute, tenantId);
+  async assignRole(userProfileId, roleId, assignedBy) {
+    const result = await this.permissionsRepo.assignRole({
+      userProfileId,
+      roleId,
+      tenantId: this.tenantId,
+      assignedBy
+    });
+    this.invalidateCache(userProfileId);
+    if (this.auditService && this.userId) {
+      const role = await this.permissionsRepo.getRoleById(roleId);
+      await this.auditService.logRoleAction({
+        action: "role.assigned",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        roleId,
+        roleLabel: role?.label ?? roleId,
+        targetUserId: userProfileId
+      });
     }
-    return config;
+    return result;
   }
   /**
-   * Build and validate attribute config from input
-   * Uses Zod schema to validate and strip unknown properties
-   * @internal
+   * Revoke a role from a user.
    */
-  buildAttributeConfig(attribute) {
-    const {
-      name: _,
-      label: __,
-      type: ___,
-      required: ____,
-      unique: _____,
-      ...configInput
-    } = attribute;
-    try {
-      return parseAttributeConfig(attribute.type, configInput);
-    } catch (error) {
-      if (error instanceof Error) {
-        throw new Error(`Invalid config for ${attribute.type} attribute: ${error.message}`);
-      }
-      throw error;
+  async revokeRole(userProfileId, roleId) {
+    const role = await this.permissionsRepo.getRoleById(roleId);
+    await this.permissionsRepo.revokeRole(userProfileId, roleId, this.tenantId);
+    this.invalidateCache(userProfileId);
+    if (this.auditService && this.userId) {
+      await this.auditService.logRoleAction({
+        action: "role.revoked",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        roleId,
+        roleLabel: role?.label ?? roleId,
+        targetUserId: userProfileId
+      });
     }
   }
+  // ============================================================================
+  // INITIALIZATION
+  // ============================================================================
   /**
-   * Validate that relation target objects exist
-   * @internal
+   * Initialize default roles for the tenant if they don't exist.
+   *
+   * Creates the following roles with their default permissions:
+   * - **admin**: Full access to all system resources and objects
+   * - **member**: No system access, can read/create/update objects (no delete)
+   * - **guest**: No system access, read-only access to objects
+   *
+   * This method is idempotent - it only creates roles that don't already exist.
+   * Should be called during tenant bootstrap or on first admin login.
+   *
+   * @example
+   * ```typescript
+   * const service = new PermissionService(adapter, tenantId);
+   * await service.initializeDefaultRoles();
+   * ```
    */
-  async validateRelationTargets(attribute, tenantId) {
-    const targets = attribute.targets;
-    if (!targets || targets.length === 0) {
-      throw new Error("Relation attribute must have at least one target object");
-    }
-    const cardinality = attribute.cardinality;
-    if (!(cardinality && ["one", "many"].includes(cardinality))) {
-      throw new Error("Relation attribute must specify cardinality: 'one' or 'many'");
-    }
-    for (const target of targets) {
-      if (!target.object) {
-        throw new Error("Each relation target must specify an object name");
+  async initializeDefaultRoles() {
+    const {
+      DEFAULT_ROLES: DEFAULT_ROLES2,
+      DEFAULT_ROLE_LABELS: DEFAULT_ROLE_LABELS2,
+      DEFAULT_ROLE_DESCRIPTIONS: DEFAULT_ROLE_DESCRIPTIONS2,
+      DEFAULT_ROLE_PERMISSIONS: DEFAULT_ROLE_PERMISSIONS2
+    } = await Promise.resolve().then(() => (init_default_roles(), default_roles_exports));
+    const existingRoles = await this.getRoles();
+    const existingRoleNames = new Set(existingRoles.map((r) => r.name));
+    for (const roleName of Object.values(DEFAULT_ROLES2)) {
+      if (existingRoleNames.has(roleName)) {
+        continue;
       }
-      let targetObject = tenantId ? await this.adapter.objects.findByName(tenantId, target.object) : null;
-      if (!targetObject) {
-        targetObject = await this.adapter.objects.findSystemByName(target.object);
+      const role = await this.permissionsRepo.createRole({
+        tenantId: this.tenantId,
+        name: roleName,
+        label: DEFAULT_ROLE_LABELS2[roleName],
+        description: DEFAULT_ROLE_DESCRIPTIONS2[roleName]
+      });
+      const permConfig = DEFAULT_ROLE_PERMISSIONS2[roleName];
+      const permissionInputs = [];
+      for (const perm of permConfig.system) {
+        permissionInputs.push({
+          scope: "system",
+          target: perm.target,
+          actions: perm.actions
+        });
       }
-      if (!targetObject) {
-        const nativeObject = this.nativeRegistry.getByName(target.object);
-        if (!nativeObject) {
-          throw new Error(
-            `Relation target object "${target.object}" does not exist. Make sure the object is created before adding a relation to it.`
-          );
-        }
+      for (const perm of permConfig.object) {
+        permissionInputs.push({
+          scope: "object",
+          target: perm.target,
+          actions: perm.actions
+        });
+      }
+      if (permissionInputs.length > 0) {
+        await this.setPermissions(role.id, permissionInputs);
       }
     }
   }
-  /**
-   * Convert DB attribute to Attribute type
-   * @internal
-   */
-  convertDBAttributeToAttribute(dbAttr) {
-    const baseAttr = {
-      ...dbAttr.config,
-      id: dbAttr.id,
-      name: dbAttr.name,
-      label: dbAttr.label,
-      type: dbAttr.type,
-      required: dbAttr.required,
-      system: dbAttr.system,
-      unique: dbAttr.unique
-    };
-    return baseAttr;
-  }
 };
 
 // src/native/registry.ts
@@ -2439,8 +3988,7 @@ var RelationService = class {
           objectName: objectSchema.name,
           objectLabel: objectSchema.label,
           objectIcon: objectSchema.icon,
-          label,
-          data: record.values
+          label
         });
       }
     }
@@ -2455,40 +4003,58 @@ var RelationService = class {
    * Resolve record IDs to their display labels
    * Useful for displaying current values in the UI
    *
+   * Uses batch fetching for performance - fetches all records in one query,
+   * then groups by objectId to minimize schema lookups.
+   *
    * @param ids - Record IDs to resolve
-   * @param tenantId - Tenant ID for multi-tenant isolation
+   * @param _tenantId - Tenant ID for multi-tenant isolation (unused but kept for API compatibility)
+   * @param attributeId - Relation attribute ID to use its displayTemplate for label rendering
    *
    * @example
    * ```typescript
-   * const resolved = await relationService.resolveIds(["rec-1", "rec-2"], "tenant-1");
+   * const resolved = await relationService.resolveIds(["rec-1", "rec-2"], "tenant-1", "attr-123");
    * // [{ id: "rec-1", label: "Nike Air Max", objectName: "products", ... }]
    * ```
    */
-  async resolveIds(ids, tenantId) {
+  async resolveIds(ids, _tenantId, attributeId) {
     if (!ids || ids.length === 0) {
       return [];
     }
-    const recordService = new RecordService(this.adapter, tenantId);
+    const attribute = await this.findAttributeById(attributeId);
+    const records = await this.adapter.objectRecords.findByIds(ids);
+    if (records.length === 0) {
+      return [];
+    }
+    const recordsByObjectId = /* @__PURE__ */ new Map();
+    for (const record of records) {
+      const existing = recordsByObjectId.get(record.objectId) ?? [];
+      existing.push(record);
+      recordsByObjectId.set(record.objectId, existing);
+    }
     const resolved = [];
-    for (const id of ids) {
-      const record = await recordService.getRecord(id);
-      if (!record) {
-        continue;
-      }
-      const objectSchema = await this.schemaService.getObjectSchema(record.objectId);
+    for (const [objectId, objectRecords] of recordsByObjectId) {
+      const objectSchema = await this.schemaService.getObjectSchema(objectId);
       if (!objectSchema) {
         continue;
       }
-      const label = renderLabelExpression(objectSchema.labelExpression, record.values);
-      resolved.push({
-        id: record.id,
-        objectId: record.objectId,
-        objectName: objectSchema.name,
-        objectLabel: objectSchema.label,
-        objectIcon: objectSchema.icon,
-        label,
-        data: record.values
-      });
+      let template = objectSchema.labelExpression;
+      if (attribute?.targets) {
+        const targetConfig = attribute.targets.find((t) => t.object === objectSchema.name);
+        if (targetConfig?.displayTemplate) {
+          template = targetConfig.displayTemplate;
+        }
+      }
+      for (const record of objectRecords) {
+        const label = renderLabelExpression(template, record.values);
+        resolved.push({
+          id: record.id,
+          objectId: record.objectId,
+          objectName: objectSchema.name,
+          objectLabel: objectSchema.label,
+          objectIcon: objectSchema.icon,
+          label
+        });
+      }
     }
     return resolved;
   }
@@ -2515,6 +4081,70 @@ var RecordService = class {
     this.schemaService = new ObjectSchemaService(adapter, registry);
     this.relationService = new RelationService(adapter, registry);
     this.hookRegistry = options?.hookRegistry ?? new NoopHookRegistry();
+    this.permissionService = options?.permissionService;
+    this.auditService = options?.auditService;
+    this.userId = options?.userId;
+    this.userEmail = options?.userEmail;
+  }
+  /**
+   * Check permission for an action on an object.
+   * Only checks if permissionService and userId are configured.
+   * @internal
+   */
+  async checkPermission(objectName, action) {
+    if (this.permissionService && this.userId) {
+      await this.permissionService.checkObjectAccess(this.userId, objectName, action);
+    }
+  }
+  /**
+   * Resolve relation IDs to their display labels
+   * @internal
+   */
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: complexity is ok here
+  async resolveRelationLabels(relationAttrs, values) {
+    const resolvedMap = /* @__PURE__ */ new Map();
+    const idsWithAttrId = [];
+    const idsWithoutAttrId = [];
+    for (const attr of relationAttrs) {
+      const val = values[attr.name];
+      const ids = this.extractRelationIds(val);
+      if (ids.length > 0) {
+        if (attr.id) {
+          idsWithAttrId.push({ attrId: attr.id, ids });
+        } else {
+          idsWithoutAttrId.push(...ids);
+        }
+      }
+    }
+    await Promise.all(
+      idsWithAttrId.map(async ({ attrId, ids }) => {
+        const resolved = await this.relationService.resolveIds(ids, this.tenantId, attrId);
+        for (const r of resolved) {
+          resolvedMap.set(r.id, r.label);
+        }
+      })
+    );
+    if (idsWithoutAttrId.length > 0) {
+      const uniqueIds = [...new Set(idsWithoutAttrId)].filter((id) => !resolvedMap.has(id));
+      if (uniqueIds.length > 0) {
+        const records = await this.adapter.objectRecords.findByIds(uniqueIds);
+        for (const record of records) {
+          if (record.label) {
+            resolvedMap.set(record.id, record.label);
+          }
+        }
+      }
+    }
+    return resolvedMap;
+  }
+  /**
+   * Extract relation IDs from a value (string or array)
+   * @internal
+   */
+  extractRelationIds(val) {
+    if (typeof val === "string") return [val];
+    if (Array.isArray(val) && typeof val[0] === "string") return [val[0]];
+    return [];
   }
   /**
    * Compute display label from schema expression
@@ -2529,27 +4159,16 @@ var RecordService = class {
     if (relationAttrs.length === 0) {
       return renderLabelExpression(schema.labelExpression, values);
     }
-    const idsToResolve = [];
-    for (const attr of relationAttrs) {
-      const val = values[attr.name];
-      if (typeof val === "string") {
-        idsToResolve.push(val);
-      } else if (Array.isArray(val) && typeof val[0] === "string") {
-        idsToResolve.push(val[0]);
-      }
-    }
-    if (idsToResolve.length === 0) {
+    const resolvedMap = await this.resolveRelationLabels(relationAttrs, values);
+    if (resolvedMap.size === 0) {
       return renderLabelExpression(schema.labelExpression, values);
     }
-    const resolved = await this.relationService.resolveIds(idsToResolve, this.tenantId);
-    const resolvedMap = new Map(resolved.map((r) => [r.id, r.label]));
     const enrichedValues = { ...values };
     for (const attr of relationAttrs) {
       const val = values[attr.name];
-      if (typeof val === "string" && resolvedMap.has(val)) {
-        enrichedValues[attr.name] = resolvedMap.get(val);
-      } else if (Array.isArray(val) && typeof val[0] === "string" && resolvedMap.has(val[0])) {
-        enrichedValues[attr.name] = resolvedMap.get(val[0]);
+      const ids = this.extractRelationIds(val);
+      if (ids.length > 0 && resolvedMap.has(ids[0])) {
+        enrichedValues[attr.name] = resolvedMap.get(ids[0]);
       }
     }
     return renderLabelExpression(schema.labelExpression, enrichedValues);
@@ -2585,6 +4204,7 @@ var RecordService = class {
    */
   async createRecord(objectId, data, options) {
     const schema = await this.schemaService.getObjectSchema(objectId);
+    await this.checkPermission(schema.name, "create");
     const hookCtx = this.buildCreateHookContext(schema, data, options?.hookMetadata);
     if (!options?.skipHooks) {
       await this.hookRegistry.execute("beforeCreate", schema.name, hookCtx);
@@ -2616,6 +4236,18 @@ var RecordService = class {
       };
       await this.hookRegistry.execute("afterCreate", schema.name, afterCtx);
     }
+    if (this.auditService && this.userId) {
+      await this.auditService.logRecordAction({
+        action: "record.created",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        objectName: schema.name,
+        objectId: schema.id,
+        recordId: record.id,
+        recordLabel: record.label,
+        metadata: options?.hookMetadata
+      });
+    }
     return record;
   }
   /**
@@ -2674,6 +4306,7 @@ var RecordService = class {
   async updateRecord(recordId, data, options) {
     const existing = await this.getRecordOrThrow(recordId);
     const schema = await this.schemaService.getObjectSchema(existing.objectId);
+    await this.checkPermission(schema.name, "update");
     const mergedData = { ...existing.values, ...data };
     const changedAttributes = Object.keys(data).filter((key) => existing.values[key] !== data[key]);
     const hookCtx = this.buildHookContext(
@@ -2711,6 +4344,24 @@ var RecordService = class {
       };
       await this.hookRegistry.execute("afterUpdate", schema.name, afterCtx);
     }
+    if (this.auditService && this.userId && changedAttributes.length > 0) {
+      const changes = changedAttributes.map((attr) => ({
+        field: attr,
+        oldValue: hookCtx.oldValues?.[attr],
+        newValue: data[attr]
+      }));
+      await this.auditService.logRecordAction({
+        action: "record.updated",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        objectName: schema.name,
+        objectId: schema.id,
+        recordId: updated.id,
+        recordLabel: updated.label,
+        changes,
+        metadata: options?.hookMetadata
+      });
+    }
     return updated;
   }
   /**
@@ -2800,11 +4451,18 @@ var RecordService = class {
   async deleteRecord(recordId, options) {
     const record = await this.getRecordOrThrow(recordId);
     const schema = await this.schemaService.getObjectSchema(record.objectId);
+    await this.checkPermission(schema.name, "delete");
     if (options?.checkSystem) {
       if (schema.system) {
         throw new Error(`Cannot delete record of system object "${schema.label}"`);
       }
     }
+    if (!options?.skipReferenceCheck) {
+      const references = await this.adapter.objectRecords.countRecordsReferencingId(recordId);
+      if (references.length > 0) {
+        throw new RecordReferencedError(recordId, references);
+      }
+    }
     const hookCtx = this.buildDeleteHookContext(schema, record, options?.hookMetadata);
     if (!options?.skipHooks) {
       await this.hookRegistry.execute("beforeDelete", schema.name, hookCtx);
@@ -2813,6 +4471,110 @@ var RecordService = class {
     if (!options?.skipHooks) {
       await this.hookRegistry.execute("afterDelete", schema.name, hookCtx);
     }
+    if (this.auditService && this.userId) {
+      await this.auditService.logRecordAction({
+        action: "record.deleted",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        objectName: schema.name,
+        objectId: schema.id,
+        recordId: record.id,
+        recordLabel: record.label,
+        metadata: options?.hookMetadata
+      });
+    }
+  }
+  /**
+   * Restore a soft-deleted record
+   *
+   * Triggers beforeRestore and afterRestore hooks if a HookRegistry is configured.
+   *
+   * @param recordId - Record UUID
+   * @param options - Restore options
+   * @returns Restored record
+   *
+   * @example
+   * ```typescript
+   * // Restore a deleted record
+   * const restored = await service.restoreRecord("rec-123");
+   * console.log(restored.deletedAt); // null
+   * ```
+   */
+  async restoreRecord(recordId, options) {
+    const record = await this.getRecordOrThrow(recordId);
+    if (!record.deletedAt) {
+      throw new Error(`Record "${recordId}" is not deleted`);
+    }
+    const schema = await this.schemaService.getObjectSchema(record.objectId);
+    await this.checkPermission(schema.name, "update");
+    const hookCtx = this.buildRestoreHookContext(schema, record, options?.hookMetadata);
+    if (!options?.skipHooks) {
+      await this.hookRegistry.execute("beforeRestore", schema.name, hookCtx);
+    }
+    const restored = await this.adapter.objectRecords.restore(recordId);
+    if (!options?.skipHooks) {
+      const afterCtx = {
+        ...hookCtx,
+        record: restored
+      };
+      await this.hookRegistry.execute("afterRestore", schema.name, afterCtx);
+    }
+    if (this.auditService && this.userId) {
+      await this.auditService.logRecordAction({
+        action: "record.restored",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        objectName: schema.name,
+        objectId: schema.id,
+        recordId: restored.id,
+        recordLabel: restored.label,
+        metadata: options?.hookMetadata
+      });
+    }
+    return restored;
+  }
+  /**
+   * Build hook context for restore operations
+   * @internal
+   */
+  buildRestoreHookContext(schema, record, metadata) {
+    return {
+      objectId: schema.id,
+      objectName: schema.name,
+      recordId: record.id,
+      tenantId: this.tenantId,
+      record,
+      oldValues: record.values,
+      newValues: record.values,
+      changedAttributes: [],
+      getChange: (attr) => ({
+        oldValue: record.values[attr],
+        newValue: record.values[attr],
+        changed: false
+      }),
+      metadata: metadata ?? {},
+      timestamp: /* @__PURE__ */ new Date()
+    };
+  }
+  /**
+   * Permanently delete a record (hard delete)
+   *
+   * This cannot be undone. Use with caution - prefer soft delete for data safety.
+   * Does NOT trigger delete hooks (already triggered on soft delete).
+   *
+   * @param recordId - Record UUID
+   *
+   * @example
+   * ```typescript
+   * // Permanently delete a record
+   * await service.hardDeleteRecord("rec-123");
+   * ```
+   */
+  async hardDeleteRecord(recordId) {
+    const record = await this.getRecordOrThrow(recordId);
+    const schema = await this.schemaService.getObjectSchema(record.objectId);
+    await this.checkPermission(schema.name, "delete");
+    await this.adapter.objectRecords.hardDelete(recordId);
   }
   /**
    * List records for an object with pagination
@@ -2822,6 +4584,10 @@ var RecordService = class {
    * @returns Records and total count
    */
   async listRecords(objectId, options) {
+    if (this.permissionService && this.userId) {
+      const schema = await this.schemaService.getObjectSchema(objectId);
+      await this.checkPermission(schema.name, "read");
+    }
     return await this.adapter.objectRecords.list(this.tenantId, objectId, options);
   }
   /**
@@ -2833,6 +4599,10 @@ var RecordService = class {
    * @returns Matching records and total count
    */
   async searchRecords(objectId, query, options) {
+    if (this.permissionService && this.userId) {
+      const schema = await this.schemaService.getObjectSchema(objectId);
+      await this.checkPermission(schema.name, "read");
+    }
     return await this.adapter.objectRecords.search(this.tenantId, objectId, query, options);
   }
   /**
@@ -2880,9 +4650,12 @@ var RecordService = class {
 
 // src/runtime/services/user-profile.service.ts
 var UserProfileService = class {
-  constructor(adapter, tenantId) {
+  constructor(adapter, tenantId, options) {
     this.adapter = adapter;
     this.tenantId = tenantId;
+    this.auditService = options?.auditService;
+    this.userId = options?.userId;
+    this.userEmail = options?.userEmail;
   }
   /**
    * Create a new user profile (typically after first auth)
@@ -2920,7 +4693,17 @@ var UserProfileService = class {
     if (existingEmail) {
       throw new Error(`User profile with email "${data.email}" already exists in this tenant`);
     }
-    return await this.adapter.userProfiles.create(data);
+    const profile = await this.adapter.userProfiles.create(data);
+    if (this.auditService && this.userId) {
+      await this.auditService.logUserAction({
+        action: "user.created",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        targetUserId: profile.id,
+        targetUserEmail: profile.email
+      });
+    }
+    return profile;
   }
   /**
    * Get user profile by ID
@@ -2981,8 +4764,27 @@ var UserProfileService = class {
    * Update user profile
    */
   async updateProfile(profileId, data) {
-    await this.getProfileOrThrow(profileId);
-    return await this.adapter.userProfiles.update(profileId, data);
+    const existing = await this.getProfileOrThrow(profileId);
+    const updated = await this.adapter.userProfiles.update(profileId, data);
+    if (this.auditService && this.userId) {
+      const changes = buildAuditChanges(existing, data, [
+        "firstName",
+        "lastName",
+        "role",
+        "status"
+      ]);
+      if (changes.length > 0) {
+        await this.auditService.logUserAction({
+          action: "user.updated",
+          actorId: this.userId,
+          actorEmail: this.userEmail,
+          targetUserId: profileId,
+          targetUserEmail: updated.email,
+          changes
+        });
+      }
+    }
+    return updated;
   }
   /**
    * Delete user profile
@@ -2991,17 +4793,25 @@ var UserProfileService = class {
    * @param options - Delete options
    */
   async deleteProfile(profileId, options) {
+    const profile = await this.getProfileOrThrow(profileId);
     if (options?.checkAdmin) {
-      const profile = await this.getProfileOrThrow(profileId);
       if (profile.role === "admin") {
-        const allProfiles = await this.listProfiles();
-        const adminCount = allProfiles.filter((p) => p.role === "admin").length;
+        const adminCount = await this.adapter.userProfiles.countByRole(this.tenantId, "admin");
         if (adminCount <= 1) {
           throw new Error("Cannot delete the last admin user");
         }
       }
     }
     await this.adapter.userProfiles.delete(profileId);
+    if (this.auditService && this.userId) {
+      await this.auditService.logUserAction({
+        action: "user.deleted",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        targetUserId: profileId,
+        targetUserEmail: profile.email
+      });
+    }
   }
   /**
    * List all user profiles for the tenant
@@ -3138,9 +4948,6 @@ var ViewService = class {
         `Cannot create view "${input.name}": a system view with this name already exists`
       );
     }
-    if (!input.tabs || input.tabs.length === 0) {
-      throw new Error("View must have at least one tab");
-    }
     const dbView = await this.adapter.views.create({
       tenantId,
       objectName: input.objectName,
@@ -3148,7 +4955,7 @@ var ViewService = class {
       label: input.label,
       description: input.description,
       icon: input.icon,
-      tabs: input.tabs,
+      tabs: input.tabs ?? [],
       default: input.default ?? false,
       system: false,
       // Custom views are never system
@@ -3171,9 +4978,6 @@ var ViewService = class {
     if (dbView.system) {
       throw new Error("Cannot modify system views. System views are protected.");
     }
-    if (input.tabs && input.tabs.length === 0) {
-      throw new Error("View must have at least one tab");
-    }
     const updated = await this.adapter.views.update(viewId, {
       label: input.label,
       description: input.description,
@@ -3601,17 +5405,21 @@ var NoopGeocodingAdapter = class {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AuditService,
   DEFAULT_LABEL_FALLBACK,
   FileService,
+  FlowService,
   GeocodingService,
   GlobalSearchService,
   NoopGeocodingAdapter,
   NoopHookRegistry,
   ObjectSchemaService,
+  PermissionService,
   RecordService,
   RelationService,
   UserProfileService,
   ViewService,
+  buildAuditChanges,
   createMockAdapter,
   extractAttributeNames,
   getSyncPreview,