@stndrds/schema 0.1.0-alpha.21 → 0.1.0-alpha.23

package/dist/runtime.js

@@ -134,6 +134,8 @@ __export(runtime_exports, {
   NoopHookRegistry: () => NoopHookRegistry,
   ObjectSchemaService: () => ObjectSchemaService,
   PermissionService: () => PermissionService,
+  PolicyRegistry: () => PolicyRegistry,
+  PolicyViolationError: () => PolicyViolationError,
   QueryBuilder: () => QueryBuilder,
   QueryMultipleResultsError: () => QueryMultipleResultsError,
   QueryNoResultError: () => QueryNoResultError,
@@ -143,6 +145,9 @@ __export(runtime_exports, {
   RollupScheduler: () => RollupScheduler,
   RollupService: () => RollupService,
   SHORTCUT_TO_FILTER_OPERATOR: () => SHORTCUT_TO_FILTER_OPERATOR,
+  TenantAwareRepository: () => TenantAwareRepository,
+  TenantAwareService: () => TenantAwareService,
+  TenantContextError: () => TenantContextError,
   UserProfileService: () => UserProfileService,
   UserService: () => UserService,
   ViewService: () => ViewService,
@@ -150,6 +155,7 @@ __export(runtime_exports, {
   createDefaultState: () => createDefaultState,
   createMockAdapter: () => createMockAdapter,
   createQueryBuilder: () => createQueryBuilder,
+  defaultPolicyRegistry: () => defaultPolicyRegistry,
   enrichValuesWithSelectLabels: () => enrichValuesWithSelectLabels,
   evaluateFormula: () => evaluateFormula,
   evaluateFormulaAttribute: () => evaluateFormulaAttribute,
@@ -164,18 +170,24 @@ __export(runtime_exports, {
   formatFormulaResult: () => formatFormulaResult,
   formatRecord: () => formatRecord,
   formatRecords: () => formatRecords,
+  getContext: () => getContext,
   getPathDepth: () => getPathDepth,
   getRelationPath: () => getRelationPath,
   getSyncPreview: () => getSyncPreview,
   getTargetAttributeName: () => getTargetAttributeName,
+  getTenantId: () => getTenantId,
+  getUserId: () => getUserId,
   getViewSyncPreview: () => getViewSyncPreview,
+  hasContext: () => hasContext,
   hasRelationReferences: () => hasRelationReferences,
   isLabelExpression: () => isLabelExpression,
+  notesPolicy: () => notesPolicy,
   parsePath: () => parsePath,
   pathHasManyCardinality: () => pathHasManyCardinality,
   renderLabelExpression: () => renderLabelExpression,
   resolveMultiplePaths: () => resolveMultiplePaths,
   resolveSingleValue: () => resolveSingleValue,
+  runWithContext: () => runWithContext,
   syncAll: () => syncAll,
   syncNativeObjects: () => syncNativeObjects,
   syncNativeViews: () => syncNativeViews,
@@ -183,7 +195,8 @@ __export(runtime_exports, {
   validateFormulaExpression: () => validateFormulaExpression,
   validatePath: () => validatePath,
   verifyNativeObjectsSync: () => verifyNativeObjectsSync,
-  verifyNativeViewsSync: () => verifyNativeViewsSync
+  verifyNativeViewsSync: () => verifyNativeViewsSync,
+  withTenantContext: () => withTenantContext
 });
 module.exports = __toCommonJS(runtime_exports);
 
@@ -265,12 +278,12 @@ var QueryBuilder = class _QueryBuilder {
     });
   }
   /**
-   * Resolve object name to object ID (cached)
+   * Resolve object name to object ID (cached).
+   * Uses tenant context from AsyncLocalStorage.
    */
   async resolveObjectId() {
     if (this.objectId) return this.objectId;
-    const tenantId = this.recordService.tenantId;
-    const dbObject = await this.adapter.objects.findByName(tenantId, this.state.objectName);
+    const dbObject = await this.adapter.objects.findByName(this.state.objectName);
     if (!dbObject) {
       throw new Error(`Object "${this.state.objectName}" not found`);
     }
@@ -588,10 +601,10 @@ var QueryBuilder = class _QueryBuilder {
    *   .eq('id', 'rec-123')
    *   .update({ price: 899 });
    *
-   * // Update with metadata (replaces existing metadata)
+   * // Update with metadata (merged with existing, set undefined to remove)
    * const withMeta = await schema.from('products')
    *   .eq('id', 'rec-123')
-   *   .update({ price: 899 }, { metadata: { synced: true } });
+   *   .update({ price: 899 }, { metadata: { synced: true, oldKey: undefined } });
    * ```
    */
   async update(data, options) {
@@ -658,6 +671,49 @@ function createQueryBuilder(recordService, adapter, objectName) {
   return new QueryBuilder(recordService, adapter, objectName);
 }
 
+// src/runtime/context/errors.ts
+var TenantContextError = class _TenantContextError extends Error {
+  constructor(message) {
+    super(
+      message ?? "No tenant context found. This usually means:\n  - HTTP request: Missing TenantContextMiddleware/Interceptor\n  - Background job: Wrap with runWithContext()\n  - Test: Wrap test body with runWithContext()\n\nAll database operations require a tenant context for security."
+    );
+    this.name = "TenantContextError";
+    if ("captureStackTrace" in Error) {
+      Error.captureStackTrace(
+        this,
+        _TenantContextError
+      );
+    }
+  }
+};
+
+// src/runtime/context/tenant-context.ts
+var import_node_async_hooks = require("async_hooks");
+var storage = new import_node_async_hooks.AsyncLocalStorage();
+function getContext() {
+  const ctx = storage.getStore();
+  if (!ctx) {
+    throw new TenantContextError();
+  }
+  return ctx;
+}
+function getTenantId() {
+  return getContext().tenantId;
+}
+function getUserId() {
+  return getContext().userId;
+}
+function hasContext() {
+  return storage.getStore() !== void 0;
+}
+function runWithContext(context, fn) {
+  const frozenContext = Object.freeze({ ...context });
+  return storage.run(frozenContext, fn);
+}
+async function withTenantContext(tenantId, fn, userId) {
+  return await runWithContext({ tenantId, userId }, fn);
+}
+
 // src/runtime/formula/evaluator.ts
 var import_expr_eval = require("expr-eval");
 function createFormulaParser() {
@@ -1100,15 +1156,6 @@ function formatDate(value) {
   }
   return String(value);
 }
-function formatTimestamp(value) {
-  if (typeof value === "number") {
-    return new Date(value).toISOString();
-  }
-  if (value instanceof Date) {
-    return value.toISOString();
-  }
-  return String(value);
-}
 function formatPhone(value) {
   if (typeof value !== "object" || value === null) return String(value);
   const phone = value;
@@ -1193,8 +1240,6 @@ function formatAttributeValue(value, attribute) {
       return formatCurrency(value, attribute);
     case "date":
       return formatDate(value);
-    case "timestamp":
-      return formatTimestamp(value);
     case "phone":
       return formatPhone(value);
     case "location":
@@ -1299,7 +1344,8 @@ function createMockObjectsRepository(stores) {
     findById(id) {
       return Promise.resolve(stores.objects.get(id) ?? null);
     },
-    findByName(tenantId, name) {
+    findByName(name) {
+      const tenantId = getTenantId();
       for (const obj of stores.objects.values()) {
         if (obj.tenantId === tenantId && obj.name === name) {
           return Promise.resolve(obj);
@@ -1316,9 +1362,10 @@ function createMockObjectsRepository(stores) {
       return Promise.resolve(null);
     },
     create(data) {
+      const tenantId = getTenantId();
       const obj = {
         id: generateId(),
-        tenantId: data.tenantId,
+        tenantId,
         name: data.name,
         label: data.label,
         pluralLabel: data.pluralLabel,
@@ -1350,13 +1397,15 @@ function createMockObjectsRepository(stores) {
       stores.objects.delete(id);
       return Promise.resolve();
     },
-    list(tenantId) {
+    list() {
+      const tenantId = getTenantId();
       const results = Array.from(stores.objects.values()).filter(
         (obj) => obj.tenantId === tenantId
       );
       return Promise.resolve(results);
     },
     upsert(data) {
+      const tenantId = getTenantId();
       for (const obj of stores.objects.values()) {
         if (obj.system && obj.name === data.name) {
           const updated = {
@@ -1374,7 +1423,7 @@ function createMockObjectsRepository(stores) {
       }
       const newObj = {
         id: generateId(),
-        tenantId: data.tenantId,
+        tenantId,
         name: data.name,
         label: data.label,
         pluralLabel: data.pluralLabel,
@@ -1454,28 +1503,21 @@ function createMockAttributesRepository(stores) {
       return Promise.resolve(count);
     },
     upsert(data) {
-      for (const attr of stores.attributes.values()) {
-        if (attr.objectId === data.objectId && attr.name === data.name) {
-          const updated = {
-            ...attr,
-            label: data.label ?? attr.label,
-            type: data.type ?? attr.type,
-            description: data.description ?? attr.description,
-            icon: data.icon ?? attr.icon,
-            system: data.system ?? attr.system,
-            required: data.required ?? attr.required,
-            unique: data.unique ?? attr.unique,
-            order: data.order ?? attr.order,
-            hidden: data.hidden ?? attr.hidden,
-            archived: data.archived ?? attr.archived,
-            deprecated: data.deprecated ?? attr.deprecated,
-            defaultValue: data.defaultValue ?? attr.defaultValue,
-            config: data.config ?? attr.config,
-            updatedAt: /* @__PURE__ */ new Date()
-          };
-          stores.attributes.set(attr.id, updated);
-          return Promise.resolve(updated);
-        }
+      const existing = Array.from(stores.attributes.values()).find(
+        (attr) => attr.objectId === data.objectId && attr.name === data.name
+      );
+      if (existing) {
+        const updated = {
+          ...existing,
+          ...data,
+          id: existing.id,
+          objectId: existing.objectId,
+          name: existing.name,
+          createdAt: existing.createdAt,
+          updatedAt: /* @__PURE__ */ new Date()
+        };
+        stores.attributes.set(existing.id, updated);
+        return Promise.resolve(updated);
       }
       return this.create(data);
     }
@@ -1494,7 +1536,8 @@ function createMockUserProfilesRepository(stores) {
       }
       return Promise.resolve(null);
     },
-    findByEmail(tenantId, email) {
+    findByEmail(email) {
+      const tenantId = getTenantId();
       for (const profile of stores.userProfiles.values()) {
         if (profile.tenantId === tenantId && profile.email === email) {
           return Promise.resolve(profile);
@@ -1503,9 +1546,10 @@ function createMockUserProfilesRepository(stores) {
       return Promise.resolve(null);
     },
     create(data) {
+      const tenantId = getTenantId();
       const profile = {
         id: generateId(),
-        tenantId: data.tenantId,
+        tenantId,
         authId: data.authId,
         email: data.email,
         firstName: data.firstName,
@@ -1536,14 +1580,16 @@ function createMockUserProfilesRepository(stores) {
       stores.userProfiles.delete(id);
       return Promise.resolve();
     },
-    list(tenantId, options) {
+    list(options) {
+      const tenantId = getTenantId();
       let results = Array.from(stores.userProfiles.values()).filter((p) => p.tenantId === tenantId);
       if (options?.limit) {
         results = results.slice(options.offset ?? 0, (options.offset ?? 0) + options.limit);
       }
       return Promise.resolve(results);
     },
-    countByRole(tenantId, role) {
+    countByRole(role) {
+      const tenantId = getTenantId();
       const count = Array.from(stores.userProfiles.values()).filter(
         (profile) => profile.tenantId === tenantId && profile.role === role
       ).length;
@@ -1567,9 +1613,10 @@ function createMockFilesRepository(stores) {
       return Promise.resolve(file ?? null);
     },
     create(data) {
+      const tenantId = getTenantId();
       const file = {
         id: generateId(),
-        tenantId: data.tenantId,
+        tenantId,
         name: data.name,
         originalName: data.originalName,
         mimeType: data.mimeType,
@@ -1614,7 +1661,8 @@ function createMockFilesRepository(stores) {
       stores.files.delete(id);
       return Promise.resolve();
     },
-    list(tenantId, options) {
+    list(options) {
+      const tenantId = getTenantId();
       let results = Array.from(stores.files.values()).filter(
         (f) => f.tenantId === tenantId && !f.deletedAt
       );
@@ -1626,7 +1674,8 @@ function createMockFilesRepository(stores) {
       }
       return Promise.resolve(results);
     },
-    findByFolder(tenantId, folderPath) {
+    findByFolder(folderPath) {
+      const tenantId = getTenantId();
       const results = Array.from(stores.files.values()).filter(
         (f) => f.tenantId === tenantId && f.folderPath === folderPath && !f.deletedAt
       );
@@ -1673,19 +1722,23 @@ function createMockObjectRecordsRepository(stores) {
       return Promise.resolve(results);
     },
     create(data) {
+      const tenantId = getTenantId();
       const internal = {
         id: generateId(),
-        tenantId: data.tenantId,
+        tenantId,
         objectId: data.objectId,
         label: data.label,
         completionStatus: data.completionStatus,
         values: data.data,
         metadata: data.metadata ?? {},
         createdAt: /* @__PURE__ */ new Date(),
-        updatedAt: /* @__PURE__ */ new Date()
+        updatedAt: /* @__PURE__ */ new Date(),
+        createdBy: data.createdBy,
+        lastUpdatedBy: data.createdBy
+        // Same as createdBy on initial creation
       };
       stores.objectRecords.set(internal.id, internal);
-      const { tenantId: _, ...record } = internal;
+      const { tenantId: _t, ...record } = internal;
       return Promise.resolve(record);
     },
     update(id, data) {
@@ -1693,7 +1746,7 @@ function createMockObjectRecordsRepository(stores) {
       if (!existing) {
         return Promise.reject(new Error(`ObjectRecord ${id} not found`));
       }
-      const { __completionStatus, __label, __metadata, ...valueData } = data;
+      const { __completionStatus, __label, __metadata, __lastUpdatedBy, ...valueData } = data;
       const updated = {
         ...existing,
         label: __label ?? existing.label,
@@ -1701,7 +1754,8 @@ function createMockObjectRecordsRepository(stores) {
         // Metadata uses replace behavior (not merge)
         metadata: __metadata !== void 0 ? __metadata : existing.metadata,
         values: { ...existing.values, ...valueData },
-        updatedAt: /* @__PURE__ */ new Date()
+        updatedAt: /* @__PURE__ */ new Date(),
+        lastUpdatedBy: __lastUpdatedBy ?? existing.lastUpdatedBy
       };
       stores.objectRecords.set(id, updated);
       const { tenantId: _, ...record } = updated;
@@ -1711,7 +1765,8 @@ function createMockObjectRecordsRepository(stores) {
       stores.objectRecords.delete(id);
       return Promise.resolve();
     },
-    list(tenantId, objectId, options) {
+    list(objectId, options) {
+      const tenantId = getTenantId();
       let results = Array.from(stores.objectRecords.values()).filter(
         (r) => r.tenantId === tenantId && r.objectId === objectId
       );
@@ -1719,10 +1774,11 @@ function createMockObjectRecordsRepository(stores) {
       if (options?.limit) {
         results = results.slice(options.offset ?? 0, (options.offset ?? 0) + options.limit);
       }
-      const records = results.map(({ tenantId: _, ...r }) => r);
+      const records = results.map(({ tenantId: _t, ...r }) => r);
       return Promise.resolve({ records, total });
     },
-    search(tenantId, objectId, query, options) {
+    search(objectId, query, options) {
+      const tenantId = getTenantId();
       const lowerQuery = query.toLowerCase();
       let results = Array.from(stores.objectRecords.values()).filter((r) => {
         if (r.tenantId !== tenantId || r.objectId !== objectId) return false;
@@ -1734,10 +1790,12 @@ function createMockObjectRecordsRepository(stores) {
       if (options?.limit) {
         results = results.slice(options.offset ?? 0, (options.offset ?? 0) + options.limit);
       }
-      const records = results.map(({ tenantId: _, ...r }) => r);
+      const records = results.map(({ tenantId: _t, ...r }) => r);
       return Promise.resolve({ records, total });
     },
-    globalSearch(tenantId, query, options) {
+    // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: This is a mock adapter, we don't need to worry about complexity
+    globalSearch(query, options) {
+      const tenantId = getTenantId();
       const lowerQuery = query.toLowerCase();
       const objectsMap = /* @__PURE__ */ new Map();
       for (const obj of stores.objects.values()) {
@@ -1808,6 +1866,7 @@ function createMockObjectRecordsRepository(stores) {
     // -------------------------------------------------------------------------
     // Schema Integrity Methods
     // -------------------------------------------------------------------------
+    // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: This is a mock adapter, we don't need to worry about complexity
     countRecordsReferencingId(targetId) {
       const relationAttrs = [];
       for (const attr of stores.attributes.values()) {
@@ -1884,6 +1943,7 @@ function createMockObjectRecordsRepository(stores) {
       }
       return Promise.resolve(updated);
     },
+    // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: This is a mock adapter, we don't need to worry about complexity
     findByRelation(objectName, relationAttributeName, targetRecordId) {
       const obj = Array.from(stores.objects.values()).find((o) => o.name === objectName);
       if (!obj) return Promise.resolve([]);
@@ -1911,21 +1971,24 @@ function createMockViewsRepository(stores) {
     findById(id) {
       return Promise.resolve(stores.views.get(id) ?? null);
     },
-    findByName(tenantId, objectName, viewName) {
+    findByName(objectName, viewName) {
+      const tenantId = getTenantId();
       return Promise.resolve(
         Array.from(stores.views.values()).find(
           (v) => v.tenantId === tenantId && v.objectName === objectName && v.name === viewName
         ) ?? null
       );
     },
-    findByObjectName(tenantId, objectName) {
+    findByObjectName(objectName) {
+      const tenantId = getTenantId();
       return Promise.resolve(
         Array.from(stores.views.values()).filter(
           (v) => v.tenantId === tenantId && v.objectName === objectName
         )
       );
     },
-    findAllForTenant(tenantId) {
+    findAllForTenant() {
+      const tenantId = getTenantId();
       return Promise.resolve(
         Array.from(stores.views.values()).filter((v) => v.tenantId === tenantId)
       );
@@ -1943,11 +2006,12 @@ function createMockViewsRepository(stores) {
       );
     },
     create(data) {
+      const tenantId = getTenantId();
       const id = generateId();
       const now = /* @__PURE__ */ new Date();
       const dbView = {
         id,
-        tenantId: data.tenantId,
+        tenantId,
         objectName: data.objectName,
         name: data.name,
         label: data.label,
@@ -1991,7 +2055,7 @@ function createMockViewsRepository(stores) {
       return Promise.resolve(deleted);
     },
     async upsert(data) {
-      const existing = data.system ? await this.findSystemByName(data.objectName, data.name) : await this.findByName(data.tenantId, data.objectName, data.name);
+      const existing = data.system ? await this.findSystemByName(data.objectName, data.name) : await this.findByName(data.objectName, data.name);
       if (existing) {
         return this.update(existing.id, {
           label: data.label,
@@ -2008,14 +2072,16 @@ function createMockViewsRepository(stores) {
 }
 function createMockPermissionsRepository(stores) {
   return {
-    getRolesByTenant(tenantId) {
+    getRoles() {
+      const tenantId = getTenantId();
       const results = Array.from(stores.roles.values()).filter((r) => r.tenantId === tenantId);
       return Promise.resolve(results);
     },
     getRoleById(roleId) {
       return Promise.resolve(stores.roles.get(roleId) ?? null);
     },
-    getRoleByName(tenantId, name) {
+    getRoleByName(name) {
+      const tenantId = getTenantId();
       for (const role of stores.roles.values()) {
         if (role.tenantId === tenantId && role.name === name) {
           return Promise.resolve(role);
@@ -2024,9 +2090,10 @@ function createMockPermissionsRepository(stores) {
       return Promise.resolve(null);
     },
     createRole(input) {
+      const tenantId = getTenantId();
       const role = {
         id: generateId(),
-        tenantId: input.tenantId,
+        tenantId,
         name: input.name,
         label: input.label,
         description: input.description,
@@ -2092,7 +2159,8 @@ function createMockPermissionsRepository(stores) {
       }
       return Promise.resolve();
     },
-    getUserRoles(userProfileId, tenantId) {
+    getUserRoles(userProfileId) {
+      const tenantId = getTenantId();
       const roleIds = Array.from(stores.userRoles.values()).filter((ur) => ur.userProfileId === userProfileId && ur.tenantId === tenantId).map((ur) => ur.roleId);
       const roles = Array.from(stores.roles.values()).filter((r) => roleIds.includes(r.id));
       return Promise.resolve(roles);
@@ -2114,7 +2182,8 @@ function createMockPermissionsRepository(stores) {
       stores.userRoles.set(userRole.id, userRole);
       return Promise.resolve(userRole);
     },
-    revokeRole(userProfileId, roleId, tenantId) {
+    revokeRole(userProfileId, roleId) {
+      const tenantId = getTenantId();
       for (const [id, ur] of stores.userRoles.entries()) {
         if (ur.userProfileId === userProfileId && ur.roleId === roleId && ur.tenantId === tenantId) {
           stores.userRoles.delete(id);
@@ -2123,7 +2192,9 @@ function createMockPermissionsRepository(stores) {
       }
       return Promise.resolve();
     },
-    getEffectivePermissions(userProfileId, tenantId) {
+    // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: This is a mock adapter, we don't need to worry about complexity
+    getEffectivePermissions(userProfileId) {
+      const tenantId = getTenantId();
       const userRoleIds = Array.from(stores.userRoles.values()).filter((ur) => ur.userProfileId === userProfileId && ur.tenantId === tenantId).map((ur) => ur.roleId);
       const userRoles = Array.from(stores.roles.values()).filter((r) => userRoleIds.includes(r.id));
       const isAdmin = userRoles.some((r) => r.name === "admin");
@@ -2198,6 +2269,160 @@ function createMockAdapter() {
   return adapter;
 }
 
+// src/types/policies.ts
+var PolicyViolationError = class extends Error {
+  constructor(objectName, action, recordId) {
+    const message = recordId ? `Access denied: cannot ${action} record ${recordId} on ${objectName}` : `Access denied: cannot ${action} on ${objectName}`;
+    super(message);
+    this.objectName = objectName;
+    this.action = action;
+    this.recordId = recordId;
+    this.name = "PolicyViolationError";
+  }
+};
+
+// src/runtime/policies/policy.registry.ts
+var PolicyRegistry = class {
+  constructor() {
+    this.policies = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Register a policy for an object type.
+   * Overwrites any existing policy for the same object.
+   *
+   * @param policy - The policy to register
+   */
+  register(policy) {
+    this.policies.set(policy.objectName, policy);
+  }
+  /**
+   * Unregister a policy for an object type.
+   *
+   * @param objectName - The object name to unregister
+   * @returns true if a policy was removed, false if none existed
+   */
+  unregister(objectName) {
+    return this.policies.delete(objectName);
+  }
+  /**
+   * Get the policy for an object type.
+   *
+   * @param objectName - The object name to look up
+   * @returns The policy if registered, undefined otherwise
+   */
+  get(objectName) {
+    return this.policies.get(objectName);
+  }
+  /**
+   * Check if a policy is registered for an object type.
+   *
+   * @param objectName - The object name to check
+   * @returns true if a policy exists
+   */
+  has(objectName) {
+    return this.policies.has(objectName);
+  }
+  /**
+   * Get all registered object names.
+   */
+  listObjectNames() {
+    return Array.from(this.policies.keys());
+  }
+  /**
+   * Clear all registered policies.
+   */
+  clear() {
+    this.policies.clear();
+  }
+};
+var defaultPolicyRegistry = new PolicyRegistry();
+
+// src/runtime/policies/notes.policy.ts
+var notesPolicy = {
+  objectName: "notes",
+  /**
+   * Inject visibility filter for list/search operations.
+   *
+   * Creates: (visibility = 'shared') OR (createdBy = userId)
+   *
+   * This filters at the SQL level for better performance.
+   * canAccessRecord provides defense-in-depth as a secondary check.
+   *
+   * Note: When user filters exist, we preserve linkedTo filter (common for notes)
+   * but the visibility OR filter takes precedence. Full filter merging would require
+   * AdvancedFilterState support in the adapter.
+   */
+  applyListFilter(ctx, options) {
+    const visibilityRules = [
+      { attribute: "visibility", operator: "is", value: "shared" },
+      { attribute: "createdBy", operator: "is", value: ctx.userId }
+    ];
+    if (!options?.filters || options.filters.rules.length === 0) {
+      return {
+        ...options,
+        filters: { combinator: "or", rules: visibilityRules }
+      };
+    }
+    const linkedToFilter = options.filters.rules.find((r) => r.attribute === "linkedTo");
+    if (linkedToFilter) {
+      return {
+        ...options,
+        filters: {
+          combinator: "and",
+          rules: [linkedToFilter]
+        }
+      };
+    }
+    return {
+      ...options,
+      filters: { combinator: "or", rules: visibilityRules }
+    };
+  },
+  /**
+   * Check if user can access a specific note.
+   *
+   * Rules:
+   * - Shared notes: accessible by anyone in the tenant
+   * - Private notes: only accessible by the author (createdBy)
+   */
+  canAccessRecord(ctx, record) {
+    const visibility = record.values.visibility;
+    if (visibility === "shared") {
+      return true;
+    }
+    if (visibility === "private") {
+      return record.createdBy === ctx.userId;
+    }
+    return false;
+  },
+  /**
+   * Check if user can modify a note.
+   *
+   * Rules:
+   * - Private notes: only the author can modify
+   * - Shared notes: anyone can modify
+   */
+  canModifyRecord(ctx, record) {
+    const visibility = record.values.visibility;
+    if (visibility === "private") {
+      return record.createdBy === ctx.userId;
+    }
+    return true;
+  },
+  /**
+   * Check if user can delete a note.
+   *
+   * Rules:
+   * - Only the author (createdBy) can delete a note, regardless of visibility
+   */
+  canDeleteRecord(ctx, record) {
+    return record.createdBy === ctx.userId;
+  }
+};
+
+// src/runtime/policies/index.ts
+defaultPolicyRegistry.register(notesPolicy);
+
 // src/runtime/services/audit.helpers.ts
 function buildAuditChanges(oldValues, newValues, fieldsToCheck) {
   const changes = [];
@@ -2213,6 +2438,40 @@ function buildAuditChanges(oldValues, newValues, fieldsToCheck) {
   return changes;
 }
 
+// src/runtime/services/base.service.ts
+var TenantAwareService = class {
+  /**
+   * Get the current tenant ID from execution context.
+   * @throws TenantContextError if no context is set
+   */
+  get tenantId() {
+    return getTenantId();
+  }
+  /**
+   * Get the current user ID from execution context, if set.
+   * Returns undefined if no user is associated with the current context.
+   */
+  get userId() {
+    return getUserId();
+  }
+};
+var TenantAwareRepository = class {
+  /**
+   * Get the current tenant ID from execution context.
+   * @throws TenantContextError if no context is set
+   */
+  get tenantId() {
+    return getTenantId();
+  }
+  /**
+   * Get the current user ID from execution context, if set.
+   * Returns undefined if no user is associated with the current context.
+   */
+  get userId() {
+    return getUserId();
+  }
+};
+
 // src/runtime/services/audit.service.ts
 var SENSITIVE_PATTERNS = [
   /password/i,
@@ -2225,10 +2484,10 @@ var SENSITIVE_PATTERNS = [
   /ssn/i,
   /cvv/i
 ];
-var AuditService = class {
-  constructor(adapter, tenantId, options) {
+var AuditService = class extends TenantAwareService {
+  constructor(adapter, options) {
+    super();
     this.adapter = adapter;
-    this.tenantId = tenantId;
     this.options = options;
     this.buffer = [];
     this.flushTimer = null;
@@ -2248,9 +2507,7 @@ var AuditService = class {
    */
   async logRecordAction(params) {
     const entry = {
-      tenantId: this.tenantId,
       actorId: params.actorId,
-      actorEmail: params.actorEmail,
       actorType: "user",
       action: params.action,
       resourceType: "record",
@@ -2268,9 +2525,7 @@ var AuditService = class {
    */
   async logSchemaAction(params) {
     const entry = {
-      tenantId: this.tenantId,
       actorId: params.actorId,
-      actorEmail: params.actorEmail,
       actorType: "user",
       action: params.action,
       resourceType: params.resourceType,
@@ -2288,9 +2543,7 @@ var AuditService = class {
    */
   async logUserAction(params) {
     const entry = {
-      tenantId: this.tenantId,
       actorId: params.actorId,
-      actorEmail: params.actorEmail,
       actorType: "user",
       action: params.action,
       resourceType: "user",
@@ -2306,9 +2559,7 @@ var AuditService = class {
    */
   async logRoleAction(params) {
     const entry = {
-      tenantId: this.tenantId,
       actorId: params.actorId,
-      actorEmail: params.actorEmail,
       actorType: "user",
       action: params.action,
       resourceType: "role",
@@ -2327,9 +2578,7 @@ var AuditService = class {
    */
   async logFileAction(params) {
     const entry = {
-      tenantId: this.tenantId,
       actorId: params.actorId,
-      actorEmail: params.actorEmail,
       actorType: "user",
       action: params.action,
       resourceType: "file",
@@ -2345,7 +2594,6 @@ var AuditService = class {
    */
   async logSystemAction(params) {
     const entry = {
-      tenantId: this.tenantId,
       actorType: "system",
       action: params.action,
       resourceType: params.resourceType,
@@ -2368,7 +2616,7 @@ var AuditService = class {
     if (!this.adapter.audit) {
       return { entries: [], total: 0 };
     }
-    return await this.adapter.audit.list(this.tenantId, options);
+    return await this.adapter.audit.list(options);
   }
   /**
    * Get audit history for a specific record
@@ -2377,7 +2625,7 @@ var AuditService = class {
     if (!this.adapter.audit) {
       return [];
     }
-    return await this.adapter.audit.getByResource(this.tenantId, "record", recordId, {
+    return await this.adapter.audit.getByResource("record", recordId, {
       orderDirection: "desc"
     });
   }
@@ -2388,7 +2636,7 @@ var AuditService = class {
     if (!this.adapter.audit) {
       return [];
     }
-    return await this.adapter.audit.getByActor(this.tenantId, userId, options);
+    return await this.adapter.audit.getByActor(userId, options);
   }
   /**
    * Get audit logs for a specific resource
@@ -2397,7 +2645,7 @@ var AuditService = class {
     if (!this.adapter.audit) {
       return [];
     }
-    return await this.adapter.audit.getByResource(this.tenantId, resourceType, resourceId, {
+    return await this.adapter.audit.getByResource(resourceType, resourceId, {
       orderDirection: "desc"
     });
   }
@@ -2444,12 +2692,6 @@ var AuditService = class {
     if (!this.adapter.audit) {
       return;
     }
-    if (entry.actorId && !entry.actorEmail && entry.actorType === "user") {
-      const profile = await this.adapter.userProfiles.findById(entry.actorId);
-      if (profile) {
-        entry.actorEmail = profile.email;
-      }
-    }
     if (this.options?.async) {
       this.buffer.push(entry);
       const batchSize = this.options.batchSize ?? 10;
@@ -2488,13 +2730,11 @@ var AuditService = class {
 };
 
 // src/runtime/services/file.service.ts
-var FileService = class {
-  constructor(adapter, tenantId, options) {
+var FileService = class extends TenantAwareService {
+  constructor(adapter, options) {
+    super();
     this.adapter = adapter;
-    this.tenantId = tenantId;
-    this.auditService = options?.auditService ?? (adapter.audit ? new AuditService(adapter, tenantId) : void 0);
-    this.userId = options?.userId;
-    this.userEmail = options?.userEmail;
+    this.auditService = options?.auditService ?? (adapter.audit ? new AuditService(adapter) : void 0);
   }
   // ============================================================================
   // UPLOAD (requires StorageAdapter)
@@ -2542,7 +2782,6 @@ var FileService = class {
       folderPath: input.folderPath
     });
     const file = await this.adapter.files.create({
-      tenantId: this.tenantId,
       name: input.fileName,
       originalName: input.fileName,
       mimeType: input.mimeType,
@@ -2561,7 +2800,6 @@ var FileService = class {
       await this.auditService.logFileAction({
         action: "file.uploaded",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         fileId: file.id,
         fileName: file.name,
         metadata: {
@@ -2604,17 +2842,11 @@ var FileService = class {
    * ```
    */
   async createFile(data) {
-    if (data.tenantId !== this.tenantId) {
-      throw new Error(
-        `Tenant mismatch: service initialized with "${this.tenantId}" but data has "${data.tenantId}"`
-      );
-    }
     const file = await this.adapter.files.create(data);
     if (this.auditService && this.userId) {
       await this.auditService.logFileAction({
         action: "file.uploaded",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         fileId: file.id,
         fileName: file.name,
         metadata: {
@@ -2677,7 +2909,6 @@ var FileService = class {
         await this.auditService.logFileAction({
           action: "file.updated",
           actorId: this.userId,
-          actorEmail: this.userEmail,
           fileId,
           fileName: updatedFile.name,
           changes
@@ -2711,7 +2942,6 @@ var FileService = class {
       await this.auditService.logFileAction({
         action: "file.deleted",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         fileId,
         fileName: file.name
       });
@@ -2743,7 +2973,6 @@ var FileService = class {
       await this.auditService.logFileAction({
         action: "file.deleted",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         fileId,
         fileName: file.name,
         metadata: { deletedFromStorage: true }
@@ -2774,7 +3003,6 @@ var FileService = class {
         await this.auditService.logFileAction({
           action: "file.deleted",
           actorId: this.userId,
-          actorEmail: this.userEmail,
           fileId,
           fileName: file.name,
           metadata: { deletedFromStorage: options?.deleteFromStorage ?? false }
@@ -2789,13 +3017,13 @@ var FileService = class {
    * List files for the tenant
    */
   async listFiles(options) {
-    return await this.adapter.files.list(this.tenantId, options);
+    return await this.adapter.files.list(options);
   }
   /**
    * List files by folder
    */
   async listFilesByFolder(folderPath) {
-    return await this.adapter.files.findByFolder(this.tenantId, folderPath);
+    return await this.adapter.files.findByFolder(folderPath);
   }
   /**
    * List files uploaded by a specific user
@@ -3053,34 +3281,35 @@ var ForbiddenError = class extends SchemaError {
 };
 
 // src/runtime/services/flow.service.ts
-var FlowService = class {
+var FlowService = class extends TenantAwareService {
   constructor(adapter, systemFlows = []) {
+    super();
     this.adapter = adapter;
     this.systemFlows = new Map(systemFlows.map((f) => [f.name, f]));
   }
   /**
-   * Get all flows for a tenant (system + custom)
+   * Get all flows for current tenant (system + custom)
    */
-  async getAllFlows(tenantId) {
+  async getAllFlows() {
     const systemFlowsList = Array.from(this.systemFlows.values());
     if (!this.adapter.flows) {
       return systemFlowsList;
     }
-    const dbFlows = await this.adapter.flows.findAllForTenant(tenantId);
+    const dbFlows = await this.adapter.flows.findAllForTenant();
     const customFlows = dbFlows.filter((f) => !f.system).map(this.convertDBFlowToDefinition);
     return [...systemFlowsList, ...customFlows];
   }
   /**
    * Get published flows only
    */
-  async getPublishedFlows(tenantId) {
-    const allFlows = await this.getAllFlows(tenantId);
+  async getPublishedFlows() {
+    const allFlows = await this.getAllFlows();
     return allFlows.filter((f) => f.status === "published");
   }
   /**
    * Get a specific flow by name
    */
-  async getFlow(name, tenantId) {
+  async getFlow(name) {
     const systemFlow = this.systemFlows.get(name);
     if (systemFlow) {
       return systemFlow;
@@ -3088,7 +3317,7 @@ var FlowService = class {
     if (!this.adapter.flows) {
       return null;
     }
-    const dbFlow = await this.adapter.flows.findByName(tenantId, name);
+    const dbFlow = await this.adapter.flows.findByName(name);
     if (dbFlow) {
       return this.convertDBFlowToDefinition(dbFlow);
     }
@@ -3110,7 +3339,7 @@ var FlowService = class {
   /**
    * Create a new custom flow (as draft)
    */
-  async createFlow(input, tenantId) {
+  async createFlow(input) {
     if (!this.adapter.flows) {
       throw new SchemaError(
         "Flows feature is not enabled. Database adapter does not support flows.",
@@ -3119,7 +3348,7 @@ var FlowService = class {
       );
     }
     this.validateFlowName(input.name);
-    const existing = await this.adapter.flows.findByName(tenantId, input.name);
+    const existing = await this.adapter.flows.findByName(input.name);
     if (existing) {
       throw new SchemaError(
         `Flow "${input.name}" already exists`,
@@ -3136,7 +3365,6 @@ var FlowService = class {
     }
     this.validateFlowStructure(input);
     const dbFlow = await this.adapter.flows.create({
-      tenantId,
       name: input.name,
       label: input.label,
       description: input.description,
@@ -3289,6 +3517,12 @@ var FlowService = class {
    * Validate flow structure (slots, pages, relations)
    */
   validateFlowStructure(input) {
+    this.validateBasicFlowRequirements(input);
+    const slotIds = this.validateSlotIds(input.slots);
+    this.validateFieldReferences(input.pages, slotIds);
+    this.validateRelationReferences(input.relations, slotIds);
+  }
+  validateBasicFlowRequirements(input) {
     if (!input.slots || input.slots.length === 0) {
       throw new ValidationError("Flow must have at least one slot", [
         { path: ["slots"], message: "Flow must have at least one slot" }
@@ -3299,13 +3533,18 @@ var FlowService = class {
         { path: ["pages"], message: "Flow must have at least one page" }
       ]);
     }
-    const slotIds = new Set(input.slots.map((s) => s.id));
-    if (slotIds.size !== input.slots.length) {
+  }
+  validateSlotIds(slots) {
+    const slotIds = new Set(slots.map((s) => s.id));
+    if (slotIds.size !== slots.length) {
       throw new ValidationError("Duplicate slot IDs detected", [
         { path: ["slots"], message: "Duplicate slot IDs detected" }
       ]);
     }
-    for (const page of input.pages) {
+    return slotIds;
+  }
+  validateFieldReferences(pages, slotIds) {
+    for (const page of pages) {
       for (const row of page.rows) {
         for (const field of row.fields) {
           if (!slotIds.has(field.slotId)) {
@@ -3319,7 +3558,9 @@ var FlowService = class {
         }
       }
     }
-    for (const relation of input.relations) {
+  }
+  validateRelationReferences(relations, slotIds) {
+    for (const relation of relations) {
       if (!slotIds.has(relation.sourceSlotId)) {
         throw new ValidationError("Relation references unknown source slot", [
           {
@@ -3409,10 +3650,10 @@ var GeocodingService = class {
 };
 
 // src/runtime/services/global-search.service.ts
-var GlobalSearchService = class {
-  constructor(adapter, tenantId) {
+var GlobalSearchService = class extends TenantAwareService {
+  constructor(adapter) {
+    super();
     this.adapter = adapter;
-    this.tenantId = tenantId;
   }
   /**
    * Search across all object records for the tenant
@@ -3442,7 +3683,7 @@ var GlobalSearchService = class {
     if (!query || query.trim().length === 0) {
       return { results: [], total: 0 };
     }
-    return await this.adapter.objectRecords.globalSearch(this.tenantId, query.trim(), {
+    return await this.adapter.objectRecords.globalSearch(query.trim(), {
       limit: options?.limit ?? 20,
       offset: options?.offset ?? 0,
       objectNames: options?.objectNames,
@@ -3485,6 +3726,9 @@ var GlobalSearchService = class {
   }
 };
 
+// src/types/attributes.ts
+var RELATION_TARGET_ANY = "*";
+
 // src/builders/attribute-validators.ts
 var import_constants2 = require("@stndrds/constants");
 var VALID_ICONS = new Set(import_constants2.ICONS);
@@ -3678,6 +3922,79 @@ var ObjectReferencedError = class extends Error {
   }
 };
 
+// src/types/objects.ts
+var SYSTEM_FIELD_NAMES = [
+  "id",
+  "createdAt",
+  "updatedAt",
+  "createdBy",
+  "lastUpdatedBy"
+];
+var RESERVED_ATTRIBUTE_NAMES = [
+  // System fields (auto-managed)
+  ...SYSTEM_FIELD_NAMES,
+  // Other ObjectRecord properties
+  "objectId",
+  "label",
+  "completionStatus",
+  "values",
+  "metadata",
+  "deletedAt"
+];
+
+// src/types/system-attributes.ts
+var SYSTEM_ATTRIBUTES = {
+  createdAt: {
+    id: "system:createdAt",
+    name: "createdAt",
+    label: "Created time",
+    type: "date",
+    required: false,
+    disabled: true,
+    system: true,
+    icon: "clock-circle",
+    description: "When this record was created"
+  },
+  updatedAt: {
+    id: "system:updatedAt",
+    name: "updatedAt",
+    label: "Last edited time",
+    type: "date",
+    required: false,
+    disabled: true,
+    system: true,
+    icon: "clock-circle",
+    description: "When this record was last modified"
+  },
+  createdBy: {
+    id: "system:createdBy",
+    name: "createdBy",
+    label: "Created by",
+    type: "user",
+    required: false,
+    disabled: true,
+    system: true,
+    multiple: false,
+    icon: "user",
+    description: "User who created this record"
+  },
+  lastUpdatedBy: {
+    id: "system:lastUpdatedBy",
+    name: "lastUpdatedBy",
+    label: "Last edited by",
+    type: "user",
+    required: false,
+    disabled: true,
+    system: true,
+    multiple: false,
+    icon: "user",
+    description: "User who last modified this record"
+  }
+};
+function getSystemAttributeList() {
+  return Object.values(SYSTEM_ATTRIBUTES);
+}
+
 // src/validation/validators.ts
 var import_zod4 = require("zod");
 var baseConfigSchema = import_zod4.z.object({
@@ -3713,41 +4030,17 @@ var relationTargetSchema = import_zod4.z.object({
   displayTemplate: import_zod4.z.string().optional(),
   filter: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()).optional()
 });
-var documentTypeConfigSchema = import_zod4.z.object({
-  type: import_zod4.z.enum([
-    "id_card",
-    "passport",
-    "incorporation_certificate",
-    "driver_license",
-    "birth_certificate",
-    "residence_permit",
-    "bank_statement",
-    "proof_of_address",
-    "custom"
-  ]),
-  label: import_zod4.z.string(),
-  faces: import_zod4.z.array(import_zod4.z.enum(["front", "back", "single"])),
-  attributeMapping: import_zod4.z.array(
-    import_zod4.z.object({
-      attributeId: import_zod4.z.string(),
-      extractedKey: import_zod4.z.string(),
-      face: import_zod4.z.enum(["front", "back", "single"]).optional(),
-      required: import_zod4.z.boolean().optional()
-    })
-  ).optional()
-});
-var fileVerificationConfigSchema = import_zod4.z.object({
-  enabled: import_zod4.z.boolean(),
-  documentTypes: import_zod4.z.array(documentTypeConfigSchema),
-  autoExtract: import_zod4.z.boolean().optional(),
-  autoValidate: import_zod4.z.boolean().optional()
-});
 var textConfigSchema = baseConfigSchema.extend({
   minLength: import_zod4.z.number().int().min(0).optional(),
   maxLength: import_zod4.z.number().int().min(1).optional(),
   pattern: import_zod4.z.string().optional()
 });
 var textareaConfigSchema = baseConfigSchema;
+var richtextConfigSchema = baseConfigSchema.extend({
+  features: import_zod4.z.array(
+    import_zod4.z.enum(["headings", "bold", "italic", "lists", "links", "images", "codeBlocks", "tables"])
+  ).optional()
+});
 var numberConfigSchema = baseConfigSchema.extend({
   min: import_zod4.z.number().optional(),
   max: import_zod4.z.number().optional(),
@@ -3778,9 +4071,6 @@ var locationConfigSchema = baseConfigSchema.extend({
   allowedCountries: import_zod4.z.array(import_zod4.z.string().length(3)).optional(),
   displayFormat: import_zod4.z.enum(["single_line", "multi_line", "compact"]).optional()
 });
-var timestampConfigSchema = baseConfigSchema.extend({
-  autoUpdate: import_zod4.z.boolean().optional()
-});
 var selectConfigSchema = baseConfigSchema.extend({
   options: optionsArraySchema
 });
@@ -3791,7 +4081,6 @@ var fileConfigSchema = baseConfigSchema.extend({
   maxFiles: import_zod4.z.number().int().min(1).optional(),
   maxSize: import_zod4.z.number().int().min(1).optional(),
   allowedTypes: import_zod4.z.array(import_zod4.z.string()).optional(),
-  verification: fileVerificationConfigSchema.optional(),
   multiple: import_zod4.z.boolean().optional()
 });
 var userConfigSchema = baseConfigSchema.extend({
@@ -3819,24 +4108,40 @@ var rollupConfigSchema = baseConfigSchema.extend({
   relationPath: import_zod4.z.string().optional(),
   targetAttribute: import_zod4.z.string().min(1),
   function: import_zod4.z.enum([
+    // Numeric aggregates
     "sum",
-    "count",
     "avg",
-    "min",
-    "max",
+    // Date aggregates
+    "earliest",
+    "latest",
+    // Count (universal)
+    "count",
     "countValues",
+    "countUniqueValues",
     "countEmpty",
+    // Percent (universal)
     "percentEmpty",
-    "percentFilled",
-    "collect"
+    "percentNotEmpty"
   ]),
   decimals: import_zod4.z.number().int().min(0).max(10).optional(),
   showAsOriginal: import_zod4.z.boolean().optional(),
-  targetAttributeType: import_zod4.z.string().optional()
+  targetAttributeType: import_zod4.z.string().optional(),
+  targetAttributeOptions: import_zod4.z.array(
+    import_zod4.z.object({
+      id: import_zod4.z.string(),
+      label: import_zod4.z.string(),
+      value: import_zod4.z.string(),
+      color: import_zod4.z.string().optional(),
+      icon: import_zod4.z.string().optional(),
+      description: import_zod4.z.string().optional(),
+      group: import_zod4.z.enum(["idle", "in_progress", "finished"]).optional()
+    })
+  ).optional()
 });
 var attributeConfigSchemas = {
   text: textConfigSchema,
   textarea: textareaConfigSchema,
+  richtext: richtextConfigSchema,
   number: numberConfigSchema,
   checkbox: checkboxConfigSchema,
   date: dateConfigSchema,
@@ -3844,7 +4149,6 @@ var attributeConfigSchemas = {
   currency: currencyConfigSchema,
   status: statusConfigSchema,
   location: locationConfigSchema,
-  timestamp: timestampConfigSchema,
   select: selectConfigSchema,
   multiselect: multiselectConfigSchema,
   file: fileConfigSchema,
@@ -3943,9 +4247,6 @@ function createLocationValidator(_attr) {
     longitude: import_zod4.z.number().optional()
   });
 }
-function createTimestampValidator(_attr) {
-  return import_zod4.z.number().int().positive();
-}
 function createFileValidator(attr) {
   const uuidSchema = import_zod4.z.uuid({
     message: `${attr.label} must be a valid file ID`
@@ -4015,10 +4316,31 @@ function createFormulaValidator(_attr) {
 function createRollupValidator(_attr) {
   return import_zod4.z.unknown();
 }
+function createTextAreaValidator(_attr) {
+  return import_zod4.z.string();
+}
+var blockNoteBlockSchema = import_zod4.z.lazy(
+  () => import_zod4.z.object({
+    id: import_zod4.z.string().min(1, "Block must have an id"),
+    type: import_zod4.z.string().min(1, "Block must have a type"),
+    props: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.union([import_zod4.z.boolean(), import_zod4.z.number(), import_zod4.z.string()])),
+    content: import_zod4.z.any().optional(),
+    children: import_zod4.z.array(import_zod4.z.any())
+  })
+);
+function createRichtextValidator(attr) {
+  return import_zod4.z.array(blockNoteBlockSchema, {
+    message: `${attr.label} must be a valid BlockNote content array`
+  });
+}
 function createAttributeValidator(attr) {
   switch (attr.type) {
     case "text":
       return createTextValidator(attr);
+    case "textarea":
+      return createTextAreaValidator(attr);
+    case "richtext":
+      return createRichtextValidator(attr);
     case "number":
       return createNumberValidator(attr);
     case "checkbox":
@@ -4033,8 +4355,6 @@ function createAttributeValidator(attr) {
       return createStatusValidator(attr);
     case "location":
       return createLocationValidator(attr);
-    case "timestamp":
-      return createTimestampValidator(attr);
     case "select":
       return createSelectValidator(attr);
     case "multiselect":
@@ -4157,23 +4477,22 @@ function computeRecordStatus(objectDef, data) {
 }
 
 // src/runtime/services/object-schema.service.ts
-var _ObjectSchemaService = class _ObjectSchemaService {
+var ObjectSchemaService = class extends TenantAwareService {
   constructor(adapter, nativeRegistry, options) {
+    super();
     this.adapter = adapter;
     this.nativeRegistry = nativeRegistry;
     this.auditService = options?.auditService;
-    this.userId = options?.userId;
-    this.userEmail = options?.userEmail;
   }
   /**
-   * Create a new custom object
-   * Validates name format and ensures system=false
+   * Create a new custom object.
+   * Validates name format and ensures system=false.
+   * Automatically uses tenant context from AsyncLocalStorage.
    *
    * @param definition - Object definition (attributes can be raw definitions or builders)
-   * @param tenantId - Tenant ID owning the object
    * @returns Created ObjectDefinition
    */
-  async createCustomObject(definition, tenantId) {
+  async createCustomObject(definition) {
     const builder = object({
       name: definition.name,
       label: definition.label
@@ -4187,17 +4506,14 @@ var _ObjectSchemaService = class _ObjectSchemaService {
       builder.attributes(definition.attributes);
     }
     const objectDef = builder.build();
-    const existing = await this.adapter.objects.findByName(tenantId, objectDef.name);
+    const existing = await this.adapter.objects.findByName(objectDef.name);
     if (existing) {
       throw new Error(`Object with name "${objectDef.name}" already exists`);
     }
     const validatedConfigs = [];
     if (objectDef.attributes.length > 0) {
       for (const attr of objectDef.attributes) {
-        const config = await this.validateAttributeInput(
-          attr,
-          tenantId
-        );
+        const config = await this.validateAttributeInput(attr);
         validatedConfigs.push(config);
       }
     }
@@ -4207,7 +4523,6 @@ var _ObjectSchemaService = class _ObjectSchemaService {
     };
     const { dbObject, createdAttributes } = await this.adapter.transaction(async (tx) => {
       const dbObj = await tx.objects.create({
-        tenantId,
         name: objectDef.name,
         label: objectDef.label,
         pluralLabel: objectDef.pluralLabel,
@@ -4247,7 +4562,6 @@ var _ObjectSchemaService = class _ObjectSchemaService {
       await this.auditService.logSchemaAction({
         action: "object.created",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         resourceType: "object",
         resourceId: dbObject.id,
         resourceLabel: dbObject.label,
@@ -4258,16 +4572,16 @@ var _ObjectSchemaService = class _ObjectSchemaService {
     return result;
   }
   /**
-   * Add a custom attribute to an existing object
-   * Can be used on both custom and native objects
-   * Attributes added via API are always custom (system=false)
+   * Add a custom attribute to an existing object.
+   * Can be used on both custom and native objects.
+   * Attributes added via API are always custom (system=false).
+   * Automatically uses tenant context from AsyncLocalStorage.
    *
    * @param objectId - Object UUID from database
    * @param attribute - Attribute definition
-   * @param tenantId - Tenant ID (required for relation validation)
    * @returns Created Attribute
    */
-  async addAttributeToObject(objectId, attribute, tenantId) {
+  async addAttributeToObject(objectId, attribute) {
     const dbObject = await this.adapter.objects.findById(objectId);
     if (!dbObject) {
       throw new Error(`Object with id "${objectId}" not found`);
@@ -4279,7 +4593,7 @@ var _ObjectSchemaService = class _ObjectSchemaService {
         `Attribute with name "${attribute.name}" already exists on object "${dbObject.name}"`
       );
     }
-    const config = await this.validateAttributeInput(attribute, tenantId);
+    const config = await this.validateAttributeInput(attribute);
     const dbAttr = await this.adapter.attributes.create({
       objectId,
       name: attribute.name,
@@ -4295,7 +4609,6 @@ var _ObjectSchemaService = class _ObjectSchemaService {
       await this.auditService.logSchemaAction({
         action: "attribute.created",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         resourceType: "attribute",
         resourceId: dbAttr.id,
         resourceLabel: dbAttr.label,
@@ -4306,15 +4619,15 @@ var _ObjectSchemaService = class _ObjectSchemaService {
     return this.convertDBAttributeToAttribute(dbAttr);
   }
   /**
-   * Update an attribute
-   * Can only update custom attributes (system=false)
+   * Update an attribute.
+   * Can only update custom attributes (system=false).
+   * Automatically uses tenant context from AsyncLocalStorage.
    *
    * @param attributeId - Attribute UUID
    * @param updates - Partial attribute updates
-   * @param tenantId - Tenant ID (required for relation validation)
    * @returns Updated Attribute
    */
-  async updateAttribute(attributeId, updates, tenantId) {
+  async updateAttribute(attributeId, updates) {
     const dbAttr = await this.adapter.attributes.findById(attributeId);
     if (!dbAttr) {
       throw new Error(`Attribute with id "${attributeId}" not found`);
@@ -4344,7 +4657,7 @@ var _ObjectSchemaService = class _ObjectSchemaService {
     };
     const config = this.buildAttributeConfig(mergedInput);
     if (dbAttr.type === "relation" && updates.targets) {
-      await this.validateRelationTargets(mergedInput, tenantId);
+      await this.validateRelationTargets(mergedInput);
     }
     const oldValues = {
       label: dbAttr.label,
@@ -4362,7 +4675,6 @@ var _ObjectSchemaService = class _ObjectSchemaService {
         await this.auditService.logSchemaAction({
           action: "attribute.updated",
           actorId: this.userId,
-          actorEmail: this.userEmail,
           resourceType: "attribute",
           resourceId: attributeId,
           resourceLabel: updatedDbAttr.label,
@@ -4410,7 +4722,6 @@ var _ObjectSchemaService = class _ObjectSchemaService {
       await this.auditService.logSchemaAction({
         action: "attribute.deleted",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         resourceType: "attribute",
         resourceId: attributeId,
         resourceLabel: dbAttr.label,
@@ -4496,7 +4807,6 @@ var _ObjectSchemaService = class _ObjectSchemaService {
         await this.auditService.logSchemaAction({
           action: "object.updated",
           actorId: this.userId,
-          actorEmail: this.userEmail,
           resourceType: "object",
           resourceId: objectId,
           resourceLabel: updatedDbObject.label,
@@ -4518,9 +4828,10 @@ var _ObjectSchemaService = class _ObjectSchemaService {
     return this.convertDBObjectToDefinition(updatedDbObject, dbAttributes);
   }
   /**
-   * Delete a custom object
-   * Can only delete custom objects (system=false)
-   * This will also delete all associated attributes and records
+   * Delete a custom object.
+   * Can only delete custom objects (system=false).
+   * This will also delete all associated attributes and records.
+   * Automatically uses tenant context from AsyncLocalStorage.
    *
    * @param objectId - Object UUID
    *
@@ -4529,7 +4840,7 @@ var _ObjectSchemaService = class _ObjectSchemaService {
    * await service.deleteObject("obj-123");
    * ```
    */
-  async deleteObject(objectId, tenantId) {
+  async deleteObject(objectId) {
     const dbObject = await this.adapter.objects.findById(objectId);
     if (!dbObject) {
       throw new Error(`Object with id "${objectId}" not found`);
@@ -4539,22 +4850,15 @@ var _ObjectSchemaService = class _ObjectSchemaService {
         `Cannot delete system object "${dbObject.name}". System objects are protected.`
       );
     }
-    const effectiveTenantId = tenantId ?? dbObject.tenantId;
-    if (effectiveTenantId) {
-      const referencingObjects = await this.findObjectsWithRelationTo(
-        dbObject.name,
-        effectiveTenantId
-      );
-      if (referencingObjects.length > 0) {
-        throw new ObjectReferencedError(dbObject.name, referencingObjects);
-      }
+    const referencingObjects = await this.findObjectsWithRelationTo(dbObject.name);
+    if (referencingObjects.length > 0) {
+      throw new ObjectReferencedError(dbObject.name, referencingObjects);
     }
     await this.adapter.objects.delete(objectId);
     if (this.auditService && this.userId) {
       await this.auditService.logSchemaAction({
         action: "object.deleted",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         resourceType: "object",
         resourceId: objectId,
         resourceLabel: dbObject.label,
@@ -4580,41 +4884,29 @@ var _ObjectSchemaService = class _ObjectSchemaService {
         "Invalid attribute name format.\nName must be a valid variable identifier:\n  \u2705 Valid: 'firstName', 'first_name', 'FirstName', 'FIRST_NAME'\n  \u274C Invalid: 'first-name', 'first name', '123name', 'first.name'"
       );
     }
-    if (_ObjectSchemaService.RESERVED_ATTRIBUTE_NAMES.includes(
-      name
-    )) {
+    if (RESERVED_ATTRIBUTE_NAMES.includes(name)) {
       throw new Error(
         `"${name}" is a reserved name and cannot be used as an attribute name.
-Reserved names: ${_ObjectSchemaService.RESERVED_ATTRIBUTE_NAMES.join(", ")}`
+Reserved names: ${RESERVED_ATTRIBUTE_NAMES.join(", ")}`
       );
     }
   }
+  // ============================================================================
+  // SCHEMA RETRIEVAL (DRY - all methods use buildObjectDefinition)
+  // ============================================================================
   /**
-   * Get complete object schema (system + custom attributes)
-   * If object is native, merges registry definition with DB custom attributes
-   * If object is custom, returns DB definition only
+   * Get complete object schema (object attributes + system attributes)
+   * Includes system attributes (createdAt, updatedAt, createdBy, lastUpdatedBy)
    *
    * @param objectId - Object UUID from database
-   * @returns Complete ObjectDefinition with all attributes
-   *
-   * @example
-   * ```typescript
-   * const service = new ObjectSchemaService(adapter, registry);
-   * const productSchema = await service.getObjectSchema("obj-123");
-   *
-   * console.log(productSchema.attributes); // System + custom attributes
-   * ```
+   * @returns Complete ObjectDefinition with all attributes including system attributes
    */
   async getObjectSchema(objectId) {
     const dbObject = await this.adapter.objects.findById(objectId);
     if (!dbObject) {
       throw new Error(`Object with id "${objectId}" not found`);
     }
-    const dbAttributes = await this.adapter.attributes.findByObjectId(objectId);
-    if (dbObject.system) {
-      return this.mergeNativeObject(dbObject, dbAttributes);
-    }
-    return this.convertDBObjectToDefinition(dbObject, dbAttributes);
+    return this.buildObjectDefinition(dbObject);
   }
   /**
    * Get object schema by name (for system/native objects)
@@ -4625,41 +4917,54 @@ Reserved names: ${_ObjectSchemaService.RESERVED_ATTRIBUTE_NAMES.join(", ")}`
     if (!dbObject) {
       throw new Error(`Native object "${name}" not found in database`);
     }
-    const dbAttributes = await this.adapter.attributes.findByObjectId(dbObject.id);
-    return this.mergeNativeObject(dbObject, dbAttributes);
+    return this.buildObjectDefinition(dbObject);
   }
   /**
-   * Get object schema by name for a tenant (supports both native and custom objects)
+   * Get object schema by name (supports both native and custom objects).
+   * Automatically uses tenant context from AsyncLocalStorage.
    */
-  async getObjectSchemaByNameForTenant(name, tenantId) {
-    let dbObject = await this.adapter.objects.findByName(tenantId, name);
+  async getObjectSchemaByNameForTenant(name) {
+    let dbObject = await this.adapter.objects.findByName(name);
     if (!dbObject) {
       dbObject = await this.adapter.objects.findSystemByName(name);
     }
     if (!dbObject) {
       throw new Error(`Object "${name}" not found`);
     }
+    return this.buildObjectDefinition(dbObject);
+  }
+  /**
+   * List all object schemas.
+   * Automatically uses tenant context from AsyncLocalStorage.
+   */
+  async listObjectSchemas() {
+    const dbObjects = await this.adapter.objects.list();
+    return Promise.all(dbObjects.map((dbObject) => this.buildObjectDefinition(dbObject)));
+  }
+  // ============================================================================
+  // PRIVATE HELPERS - SCHEMA BUILDING
+  // ============================================================================
+  /**
+   * Build complete ObjectDefinition from DB object
+   * Handles both native (merged with registry) and custom objects
+   * Always appends system attributes at the end
+   * @internal
+   */
+  async buildObjectDefinition(dbObject) {
     const dbAttributes = await this.adapter.attributes.findByObjectId(dbObject.id);
-    if (dbObject.system) {
-      return this.mergeNativeObject(dbObject, dbAttributes);
-    }
-    return this.convertDBObjectToDefinition(dbObject, dbAttributes);
+    const baseDef = dbObject.system ? this.mergeNativeObject(dbObject, dbAttributes) : this.convertDBObjectToDefinition(dbObject, dbAttributes);
+    return this.withSystemAttributes(baseDef);
   }
   /**
-   * List all object schemas for a tenant
+   * Append system attributes to an ObjectDefinition
+   * System attributes are always available on all records (createdAt, updatedAt, createdBy, lastUpdatedBy)
+   * @internal
    */
-  async listObjectSchemas(tenantId) {
-    const dbObjects = await this.adapter.objects.list(tenantId);
-    const schemas = await Promise.all(
-      dbObjects.map(async (dbObject) => {
-        const dbAttributes = await this.adapter.attributes.findByObjectId(dbObject.id);
-        if (dbObject.system) {
-          return this.mergeNativeObject(dbObject, dbAttributes);
-        }
-        return this.convertDBObjectToDefinition(dbObject, dbAttributes);
-      })
-    );
-    return schemas;
+  withSystemAttributes(def) {
+    return {
+      ...def,
+      attributes: [...def.attributes, ...getSystemAttributeList()]
+    };
   }
   /**
    * Merge native object from registry with custom attributes from DB
@@ -4721,15 +5026,15 @@ Reserved names: ${_ObjectSchemaService.RESERVED_ATTRIBUTE_NAMES.join(", ")}`
     };
   }
   /**
-   * Validate attribute input and return parsed config
-   * Validates: name format, config schema, relation targets
+   * Validate attribute input and return parsed config.
+   * Validates: name format, config schema, relation targets.
    * @internal
    */
-  async validateAttributeInput(attribute, tenantId) {
+  async validateAttributeInput(attribute) {
     this.validateAttributeName(attribute.name);
     const config = this.buildAttributeConfig(attribute);
     if (attribute.type === "relation") {
-      await this.validateRelationTargets(attribute, tenantId);
+      await this.validateRelationTargets(attribute);
     }
     return config;
   }
@@ -4756,23 +5061,24 @@ Reserved names: ${_ObjectSchemaService.RESERVED_ATTRIBUTE_NAMES.join(", ")}`
     }
   }
   /**
-   * Check if an object exists (in tenant, system, or native registry)
+   * Check if an object exists (in tenant, system, or native registry).
+   * Automatically uses tenant context from AsyncLocalStorage.
    * @internal
    */
-  async objectExists(name, tenantId) {
-    if (tenantId) {
-      const obj = await this.adapter.objects.findByName(tenantId, name);
-      if (obj) return true;
-    }
+  async objectExists(name) {
+    const obj = await this.adapter.objects.findByName(name);
+    if (obj) return true;
     const systemObj = await this.adapter.objects.findSystemByName(name);
     if (systemObj) return true;
     return this.nativeRegistry.getByName(name) !== void 0;
   }
   /**
-   * Validate that relation target objects exist
+   * Validate that relation target objects exist.
+   * Skip validation for universal relations (toAny with target "*").
+   * Automatically uses tenant context from AsyncLocalStorage.
    * @internal
    */
-  async validateRelationTargets(attribute, tenantId) {
+  async validateRelationTargets(attribute) {
     const targets = attribute.targets;
     if (!targets || targets.length === 0) {
       throw new Error("Relation attribute must have at least one target object");
@@ -4782,11 +5088,14 @@ Reserved names: ${_ObjectSchemaService.RESERVED_ATTRIBUTE_NAMES.join(", ")}`
     if (!isValidCardinality) {
       throw new Error("Relation attribute must specify cardinality: 'one' or 'many'");
     }
+    if (targets.length === 1 && targets[0].object === RELATION_TARGET_ANY) {
+      return;
+    }
     for (const target of targets) {
       if (!target.object) {
         throw new Error("Each relation target must specify an object name");
       }
-      const exists = await this.objectExists(target.object, tenantId);
+      const exists = await this.objectExists(target.object);
       if (!exists) {
         throw new Error(
           `Relation target object "${target.object}" does not exist. Make sure the object is created before adding a relation to it.`
@@ -4797,10 +5106,11 @@ Reserved names: ${_ObjectSchemaService.RESERVED_ATTRIBUTE_NAMES.join(", ")}`
   /**
    * Find objects that have a relation attribute targeting the given object.
    * Used to prevent deletion of objects that are relation targets.
+   * Automatically uses tenant context from AsyncLocalStorage.
    * @internal
    */
-  async findObjectsWithRelationTo(targetObjectName, tenantId) {
-    const allObjects = await this.adapter.objects.list(tenantId);
+  async findObjectsWithRelationTo(targetObjectName) {
+    const allObjects = await this.adapter.objects.list();
     const referencing = [];
     for (const obj of allObjects) {
       if (obj.name === targetObjectName) continue;
@@ -4834,23 +5144,12 @@ Reserved names: ${_ObjectSchemaService.RESERVED_ATTRIBUTE_NAMES.join(", ")}`
     return baseAttr;
   }
 };
-/**
- * Reserved attribute names that cannot be used.
- * These names conflict with system fields on ObjectRecord.
- */
-_ObjectSchemaService.RESERVED_ATTRIBUTE_NAMES = [
-  "id",
-  "createdAt",
-  "updatedAt",
-  "metadata"
-];
-var ObjectSchemaService = _ObjectSchemaService;
 
 // src/runtime/services/permission.service.ts
-var PermissionService = class {
-  constructor(adapter, tenantId, options) {
+var PermissionService = class extends TenantAwareService {
+  constructor(adapter, options) {
+    super();
     this.adapter = adapter;
-    this.tenantId = tenantId;
     this.cache = /* @__PURE__ */ new Map();
     /** Track pending permission fetches to prevent duplicate concurrent requests */
     this.pendingFetches = /* @__PURE__ */ new Map();
@@ -4863,8 +5162,6 @@ var PermissionService = class {
     this.cacheTtlMs = options?.cacheTtlMs ?? 6e4;
     this.maxCacheSize = options?.maxCacheSize ?? 1e4;
     this.auditService = options?.auditService;
-    this.userId = options?.userId;
-    this.userEmail = options?.userEmail;
   }
   // ============================================================================
   // PERMISSION CHECKS
@@ -5019,10 +5316,7 @@ var PermissionService = class {
    * @internal
    */
   async fetchAndCachePermissions(userProfileId, cacheKey) {
-    const permissions = await this.permissionsRepo.getEffectivePermissions(
-      userProfileId,
-      this.tenantId
-    );
+    const permissions = await this.permissionsRepo.getEffectivePermissions(userProfileId);
     if (this.cache.size >= this.maxCacheSize) {
       const firstKey = this.cache.keys().next().value;
       if (firstKey) {
@@ -5066,9 +5360,10 @@ var PermissionService = class {
   // ============================================================================
   /**
    * Get all roles for the current tenant.
+   * Automatically uses tenant context from AsyncLocalStorage.
    */
   async getRoles() {
-    return await this.permissionsRepo.getRolesByTenant(this.tenantId);
+    return await this.permissionsRepo.getRoles();
   }
   /**
    * Get a role by ID.
@@ -5080,15 +5375,11 @@ var PermissionService = class {
    * Create a new role.
    */
   async createRole(input) {
-    const role = await this.permissionsRepo.createRole({
-      ...input,
-      tenantId: this.tenantId
-    });
+    const role = await this.permissionsRepo.createRole(input);
     if (this.auditService && this.userId) {
       await this.auditService.logRoleAction({
         action: "role.created",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         roleId: role.id,
         roleLabel: role.label
       });
@@ -5117,7 +5408,6 @@ var PermissionService = class {
         await this.auditService.logRoleAction({
           action: "role.updated",
           actorId: this.userId,
-          actorEmail: this.userEmail,
           roleId: role.id,
           roleLabel: role.label,
           changes
@@ -5137,7 +5427,6 @@ var PermissionService = class {
       await this.auditService.logRoleAction({
         action: "role.deleted",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         roleId,
         roleLabel: role.label
       });
@@ -5163,7 +5452,6 @@ var PermissionService = class {
       await this.auditService.logRoleAction({
         action: "role.updated",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         roleId,
         roleLabel: role?.label ?? roleId,
         metadata: { permissionsUpdated: true, permissionCount: permissions.length }
@@ -5177,7 +5465,7 @@ var PermissionService = class {
    * Get all roles assigned to a user.
    */
   async getUserRoles(userProfileId) {
-    return await this.permissionsRepo.getUserRoles(userProfileId, this.tenantId);
+    return await this.permissionsRepo.getUserRoles(userProfileId);
   }
   /**
    * Assign a role to a user.
@@ -5186,7 +5474,6 @@ var PermissionService = class {
     const result = await this.permissionsRepo.assignRole({
       userProfileId,
       roleId,
-      tenantId: this.tenantId,
       assignedBy
     });
     this.invalidateCache(userProfileId);
@@ -5195,7 +5482,6 @@ var PermissionService = class {
       await this.auditService.logRoleAction({
         action: "role.assigned",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         roleId,
         roleLabel: role?.label ?? roleId,
         targetUserId: userProfileId
@@ -5208,13 +5494,12 @@ var PermissionService = class {
    */
   async revokeRole(userProfileId, roleId) {
     const role = await this.permissionsRepo.getRoleById(roleId);
-    await this.permissionsRepo.revokeRole(userProfileId, roleId, this.tenantId);
+    await this.permissionsRepo.revokeRole(userProfileId, roleId);
     this.invalidateCache(userProfileId);
     if (this.auditService && this.userId) {
       await this.auditService.logRoleAction({
         action: "role.revoked",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         roleId,
         roleLabel: role?.label ?? roleId,
         targetUserId: userProfileId
@@ -5237,7 +5522,7 @@ var PermissionService = class {
    *
    * @example
    * ```typescript
-   * const service = new PermissionService(adapter, tenantId);
+   * const service = new PermissionService(adapter);
    * await service.initializeDefaultRoles();
    * ```
    */
@@ -5255,7 +5540,6 @@ var PermissionService = class {
         continue;
       }
       const role = await this.permissionsRepo.createRole({
-        tenantId: this.tenantId,
         name: roleName,
         label: DEFAULT_ROLE_LABELS2[roleName],
         description: DEFAULT_ROLE_DESCRIPTIONS2[roleName]
@@ -5430,8 +5714,9 @@ Available objects: ${this.listNames().join(", ")}`
 var registry = new NativeObjectRegistryClass();
 
 // src/runtime/services/relation.service.ts
-var RelationService = class {
+var RelationService = class extends TenantAwareService {
   constructor(adapter, nativeRegistry) {
+    super();
     this.adapter = adapter;
     this.schemaService = new ObjectSchemaService(adapter, nativeRegistry);
   }
@@ -5482,8 +5767,9 @@ var RelationService = class {
     if (ids.length === 0) {
       return errors;
     }
-    const validObjectIds = await this.getValidObjectIds(attr.targets);
-    if (validObjectIds.size === 0) {
+    const isUniversal = attr.targets.length === 1 && attr.targets[0].object === RELATION_TARGET_ANY;
+    const validObjectIds = isUniversal ? null : await this.getValidObjectIds(attr.targets);
+    if (!isUniversal && validObjectIds?.size === 0) {
       errors.push({
         attribute: attr.name,
         message: `No valid target objects found for ${attr.label}`
@@ -5497,7 +5783,7 @@ var RelationService = class {
         invalidIds.push(id);
         continue;
       }
-      if (!validObjectIds.has(record.objectId)) {
+      if (!isUniversal && validObjectIds && !validObjectIds.has(record.objectId)) {
         invalidIds.push(id);
       }
     }
@@ -5527,6 +5813,7 @@ var RelationService = class {
   }
   /**
    * Get valid object IDs from relation targets
+   * Note: Universal relations (toAny) are handled earlier in validateRelationAttribute
    */
   async getValidObjectIds(targets) {
     const objectIds = /* @__PURE__ */ new Set();
@@ -5558,23 +5845,23 @@ var RelationService = class {
   // OPTIONS & RESOLUTION
   // ============================================================================
   /**
-   * Get available options for a relation attribute
-   * Searches across all target objects defined in the relation
+   * Get available options for a relation attribute.
+   * Searches across all target objects defined in the relation.
+   * Automatically uses tenant context from AsyncLocalStorage.
    *
    * @param attribute - Relation attribute definition
-   * @param tenantId - Tenant ID for multi-tenant isolation
    * @param params - Query parameters
    *
    * @example
    * ```typescript
-   * const options = await relationService.getOptions(attribute, "tenant-1", {
+   * const options = await relationService.getOptions(attribute, {
    *   query: "nike",
    *   page: 1,
    *   pageSize: 20
    * });
    * ```
    */
-  async getOptions(attribute, tenantId, params = {}) {
+  async getOptions(attribute, params = {}) {
     const { query = "", page = 1, pageSize = 20, targetObject } = params;
     const targets = attribute.targets;
     const filteredTargets = targetObject ? targets.filter((t) => t.object === targetObject) : targets;
@@ -5583,7 +5870,7 @@ var RelationService = class {
     }
     const allOptions = [];
     let totalCount = 0;
-    const recordService = new RecordService(this.adapter, tenantId);
+    const recordService = new RecordService(this.adapter);
     for (const target of filteredTargets) {
       const objectSchema = await this.schemaService.getObjectSchemaByName(target.object);
       if (!objectSchema?.id) {
@@ -5619,23 +5906,22 @@ var RelationService = class {
     };
   }
   /**
-   * Resolve record IDs to their display labels
-   * Useful for displaying current values in the UI
+   * Resolve record IDs to their display labels.
+   * Useful for displaying current values in the UI.
    *
    * Uses batch fetching for performance - fetches all records in one query,
    * then groups by objectId to minimize schema lookups.
    *
    * @param ids - Record IDs to resolve
-   * @param _tenantId - Tenant ID for multi-tenant isolation (unused but kept for API compatibility)
    * @param attributeId - Relation attribute ID to use its displayTemplate for label rendering
    *
    * @example
    * ```typescript
-   * const resolved = await relationService.resolveIds(["rec-1", "rec-2"], "tenant-1", "attr-123");
+   * const resolved = await relationService.resolveIds(["rec-1", "rec-2"], "attr-123");
    * // [{ id: "rec-1", label: "Nike Air Max", objectName: "products", ... }]
    * ```
    */
-  async resolveIds(ids, _tenantId, attributeId) {
+  async resolveIds(ids, attributeId) {
     if (!ids || ids.length === 0) {
       return [];
     }
@@ -5770,13 +6056,8 @@ var RollupService = class {
     if (!record) {
       return { value: null, recordCount: 0 };
     }
-    const parentObject = await this.adapter.objects.findById(record.objectId);
-    if (!parentObject) {
-      return { value: null, recordCount: 0 };
-    }
-    const tenantId = parentObject.tenantId;
     const sourceObjectName = rollupAttr.relationAttribute;
-    const sourceObject = await this.adapter.objects.findByName(tenantId, sourceObjectName);
+    const sourceObject = await this.adapter.objects.findByName(sourceObjectName);
     if (!sourceObject) {
       return { value: null, recordCount: 0 };
     }
@@ -5790,7 +6071,6 @@ var RollupService = class {
       return { value: null, recordCount: 0 };
     }
     const relatedRecords = await this.adapter.objectRecords.findByRelation(
-      tenantId,
       sourceObject.id,
       reverseRelationAttr.name,
       recordId
@@ -5804,6 +6084,9 @@ var RollupService = class {
    * Extract and aggregate values from related records
    */
   aggregateValues(relatedRecords, rollupAttr) {
+    if (rollupAttr.function === "count") {
+      return { value: relatedRecords.length, recordCount: relatedRecords.length };
+    }
     const values = relatedRecords.map((r) => r.values[rollupAttr.targetAttribute]).filter((v) => v !== void 0 && v !== null);
     const aggregated = this.aggregate(values, rollupAttr.function);
     const result = typeof aggregated === "number" && rollupAttr.decimals !== void 0 ? Number(aggregated.toFixed(rollupAttr.decimals)) : aggregated;
@@ -5832,32 +6115,38 @@ var RollupService = class {
    */
   aggregate(values, fn) {
     switch (fn) {
+      // Numeric aggregates
       case "sum":
         return this.sumNumbers(values);
       case "avg":
         return this.averageNumbers(values);
-      case "min":
-        return this.minNumbers(values);
-      case "max":
-        return this.maxNumbers(values);
+      // Date aggregates
+      case "earliest":
+        return this.earliestDate(values);
+      case "latest":
+        return this.latestDate(values);
+      // Count functions
       case "count":
         return values.length;
       case "countValues":
         return values.filter((v) => v != null && v !== "").length;
+      case "countUniqueValues": {
+        const nonEmpty = values.filter((v) => v != null && v !== "");
+        return new Set(nonEmpty.map((v) => JSON.stringify(v))).size;
+      }
       case "countEmpty":
         return values.filter((v) => v == null || v === "").length;
-      case "percentFilled": {
+      // Percent functions
+      case "percentNotEmpty": {
         if (values.length === 0) return 0;
         const filled = values.filter((v) => v != null && v !== "").length;
-        return filled / values.length * 100;
+        return filled / values.length;
       }
       case "percentEmpty": {
         if (values.length === 0) return 0;
         const empty = values.filter((v) => v == null || v === "").length;
-        return empty / values.length * 100;
+        return empty / values.length;
       }
-      case "collect":
-        return values;
     }
   }
   /**
@@ -5868,16 +6157,15 @@ var RollupService = class {
       case "sum":
       case "count":
       case "countValues":
+      case "countUniqueValues":
       case "countEmpty":
       case "percentEmpty":
-      case "percentFilled":
+      case "percentNotEmpty":
         return 0;
       case "avg":
-      case "min":
-      case "max":
+      case "earliest":
+      case "latest":
         return null;
-      case "collect":
-        return [];
     }
   }
   /**
@@ -5895,20 +6183,22 @@ var RollupService = class {
     return nums.reduce((sum, n) => sum + n, 0) / nums.length;
   }
   /**
-   * Minimum numeric value
+   * Get earliest date from values
    */
-  minNumbers(values) {
-    const nums = values.filter((v) => typeof v === "number" && !Number.isNaN(v));
-    if (nums.length === 0) return null;
-    return Math.min(...nums);
+  earliestDate(values) {
+    const dates = values.filter((v) => v instanceof Date || typeof v === "string").map((v) => v instanceof Date ? v : new Date(v)).filter((d) => !Number.isNaN(d.getTime()));
+    if (dates.length === 0) return null;
+    const earliest = new Date(Math.min(...dates.map((d) => d.getTime())));
+    return earliest.toISOString();
   }
   /**
-   * Maximum numeric value
+   * Get latest date from values
    */
-  maxNumbers(values) {
-    const nums = values.filter((v) => typeof v === "number" && !Number.isNaN(v));
-    if (nums.length === 0) return null;
-    return Math.max(...nums);
+  latestDate(values) {
+    const dates = values.filter((v) => v instanceof Date || typeof v === "string").map((v) => v instanceof Date ? v : new Date(v)).filter((d) => !Number.isNaN(d.getTime()));
+    if (dates.length === 0) return null;
+    const latest = new Date(Math.max(...dates.map((d) => d.getTime())));
+    return latest.toISOString();
   }
   /**
    * Recalculate all rollup attributes for a record and update it
@@ -5969,12 +6259,7 @@ var RollupService = class {
    */
   async findRecordsWithForwardRollup(changedRecord, changedSchema) {
     const affectedRecords = [];
-    const recordObject = await this.adapter.objects.findById(changedRecord.objectId);
-    if (!recordObject) {
-      return affectedRecords;
-    }
-    const tenantId = recordObject.tenantId;
-    const allObjects = await this.adapter.objects.list(tenantId);
+    const allObjects = await this.adapter.objects.list();
     for (const obj of allObjects) {
       if (obj.id === changedRecord.objectId) {
         continue;
@@ -6003,7 +6288,6 @@ var RollupService = class {
           continue;
         }
         const recordsPointingToChanged = await this.adapter.objectRecords.findByRelation(
-          tenantId,
           obj.id,
           relationAttr.name,
           changedRecord.id
@@ -6020,10 +6304,10 @@ var RollupService = class {
 };
 
 // src/runtime/services/user.service.ts
-var UserService = class {
-  constructor(adapter, tenantId) {
+var UserService = class extends TenantAwareService {
+  constructor(adapter) {
+    super();
     this.adapter = adapter;
-    this.tenantId = tenantId;
   }
   /**
    * Validate all user attributes in the data
@@ -6137,23 +6421,32 @@ var UserService = class {
 };
 
 // src/runtime/services/record.service.ts
-var RecordService = class {
-  constructor(adapter, tenantId, options) {
+function applyDefaultValues(schema, data) {
+  const result = { ...data };
+  for (const attr of schema.attributes) {
+    if (attr.name in result && result[attr.name] !== void 0) {
+      continue;
+    }
+    if ("defaultValue" in attr && attr.defaultValue !== void 0 && attr.defaultValue !== null) {
+      result[attr.name] = attr.defaultValue;
+    }
+  }
+  return result;
+}
+var RecordService = class extends TenantAwareService {
+  constructor(adapter, options) {
+    super();
     this.adapter = adapter;
-    this.tenantId = tenantId;
     this.schemaService = new ObjectSchemaService(adapter, registry, {
-      userId: options?.userId,
-      userEmail: options?.userEmail,
       auditService: options?.auditService
     });
     this.relationService = new RelationService(adapter, registry);
-    this.userService = new UserService(adapter, tenantId);
+    this.userService = new UserService(adapter);
     this.rollupService = new RollupService(adapter);
     this.hookRegistry = options?.hookRegistry ?? new NoopHookRegistry();
     this.permissionService = options?.permissionService;
-    this.auditService = options?.auditService ?? (adapter.audit ? new AuditService(adapter, tenantId) : void 0);
-    this.userId = options?.userId;
-    this.userEmail = options?.userEmail;
+    this.auditService = options?.auditService ?? (adapter.audit ? new AuditService(adapter) : void 0);
+    this.policyRegistry = options?.policyRegistry === null ? null : options?.policyRegistry ?? defaultPolicyRegistry;
   }
   /**
    * Check permission for an action on an object.
@@ -6165,6 +6458,67 @@ var RecordService = class {
       await this.permissionService.checkObjectAccess(this.userId, objectName, action);
     }
   }
+  /**
+   * Get policy for an object if one exists and userId is configured.
+   * @internal
+   */
+  getPolicy(objectName) {
+    if (!(this.policyRegistry && this.userId)) {
+      return void 0;
+    }
+    return this.policyRegistry.get(objectName);
+  }
+  /**
+   * Build policy context for the current request.
+   * @internal
+   */
+  buildPolicyContext(objectName) {
+    return {
+      // biome-ignore lint/style/noNonNullAssertion: userId is guaranteed to be set
+      userId: this.userId,
+      tenantId: this.tenantId,
+      objectName
+    };
+  }
+  /**
+   * Check if user can access a record based on policy.
+   * Returns true if no policy exists or user can access.
+   * @internal
+   */
+  checkRecordAccess(policy, record) {
+    if (!policy.canAccessRecord) {
+      return true;
+    }
+    return policy.canAccessRecord(this.buildPolicyContext(policy.objectName), record);
+  }
+  /**
+   * Check if user can modify a record based on policy.
+   * Throws PolicyViolationError if denied.
+   * @internal
+   */
+  checkRecordModify(policy, record) {
+    if (!policy.canModifyRecord) {
+      return;
+    }
+    const canModify = policy.canModifyRecord(this.buildPolicyContext(policy.objectName), record);
+    if (!canModify) {
+      throw new PolicyViolationError(policy.objectName, "update", record.id);
+    }
+  }
+  /**
+   * Check if user can delete a record based on policy.
+   * Throws PolicyViolationError if denied.
+   * @internal
+   */
+  checkRecordDelete(policy, record) {
+    if (!policy.canDeleteRecord) {
+      return;
+    }
+    const canDelete = policy.canDeleteRecord(this.buildPolicyContext(policy.objectName), record);
+    if (!canDelete) {
+      throw new PolicyViolationError(policy.objectName, "delete", record.id);
+    }
+  }
   /**
    * Resolve relation IDs to their display labels
    * @internal
@@ -6187,7 +6541,7 @@ var RecordService = class {
     }
     await Promise.all(
       idsWithAttrId.map(async ({ attrId, ids }) => {
-        const resolved = await this.relationService.resolveIds(ids, this.tenantId, attrId);
+        const resolved = await this.relationService.resolveIds(ids, attrId);
         for (const r of resolved) {
           resolvedMap.set(r.id, r.label);
         }
@@ -6275,33 +6629,34 @@ var RecordService = class {
    */
   async createRecord(objectId, data, options) {
     const schema = await this.schemaService.getObjectSchema(objectId);
+    const dataWithDefaults = applyDefaultValues(schema, data);
     await this.checkPermission(schema.name, "create");
-    const hookCtx = this.buildCreateHookContext(schema, data, options?.hookMetadata);
+    const hookCtx = this.buildCreateHookContext(schema, dataWithDefaults, options?.hookMetadata);
     if (!options?.skipHooks) {
       await this.hookRegistry.execute("beforeCreate", schema.name, hookCtx);
     }
     if (options?.validate !== false) {
       if (options?.allowDraft) {
-        validateDraftOrThrow(schema, data);
+        validateDraftOrThrow(schema, dataWithDefaults);
       } else {
-        validateObjectOrThrow(schema, data);
+        validateObjectOrThrow(schema, dataWithDefaults);
       }
       if (!options?.skipRelationValidation) {
-        await this.relationService.validateRelationsOrThrow(schema, data);
+        await this.relationService.validateRelationsOrThrow(schema, dataWithDefaults);
       }
       if (!options?.skipUserValidation) {
-        await this.userService.validateUsersOrThrow(schema, data);
+        await this.userService.validateUsersOrThrow(schema, dataWithDefaults);
       }
     }
-    const completionStatus = computeRecordStatus(schema, data);
-    const label = await this.computeLabel(schema, data);
+    const completionStatus = computeRecordStatus(schema, dataWithDefaults);
+    const label = await this.computeLabel(schema, dataWithDefaults);
     const record = await this.adapter.objectRecords.create({
-      tenantId: this.tenantId,
       objectId,
-      data,
+      data: dataWithDefaults,
       label,
       completionStatus,
-      metadata: options?.metadata
+      metadata: options?.metadata,
+      createdBy: this.userId
     });
     if (!options?.skipHooks) {
       const afterCtx = {
@@ -6316,7 +6671,6 @@ var RecordService = class {
       await this.auditService.logRecordAction({
         action: "record.created",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         objectName: schema.name,
         objectId: schema.id,
         recordId: record.id,
@@ -6339,6 +6693,12 @@ var RecordService = class {
       return null;
     }
     const schema = await this.schemaService.getObjectSchema(record.objectId);
+    if (!options?.skipPolicyCheck) {
+      const policy = this.getPolicy(schema.name);
+      if (policy && !this.checkRecordAccess(policy, record)) {
+        return null;
+      }
+    }
     let enrichedRecord = record;
     if (!options?.skipFormulas) {
       enrichedRecord = this.enrichWithFormulas(record, schema);
@@ -6384,9 +6744,16 @@ var RecordService = class {
    * ```
    */
   async updateRecord(recordId, data, options) {
-    const existing = await this.getRecordOrThrow(recordId);
+    const existing = await this.adapter.objectRecords.findById(recordId);
+    if (!existing) {
+      throw new RecordNotFoundError(recordId);
+    }
     const schema = await this.schemaService.getObjectSchema(existing.objectId);
     await this.checkPermission(schema.name, "update");
+    const policy = this.getPolicy(schema.name);
+    if (policy) {
+      this.checkRecordModify(policy, existing);
+    }
     const mergedData = { ...existing.values, ...data };
     const changedAttributes = Object.keys(data).filter((key) => existing.values[key] !== data[key]);
     const hookCtx = this.buildHookContext(
@@ -6418,10 +6785,16 @@ var RecordService = class {
     const updatePayload = {
       ...data,
       __completionStatus: completionStatus,
-      __label: label
+      __label: label,
+      __lastUpdatedBy: this.userId
     };
     if (options?.metadata !== void 0) {
-      updatePayload.__metadata = options.metadata;
+      const existingMetadata = existing.metadata ?? {};
+      const mergedMetadata = { ...existingMetadata, ...options.metadata };
+      const cleanedMetadata = Object.fromEntries(
+        Object.entries(mergedMetadata).filter(([, value]) => value !== void 0)
+      );
+      updatePayload.__metadata = cleanedMetadata;
     }
     const updated = await this.adapter.objectRecords.update(recordId, updatePayload);
     if (!options?.skipHooks) {
@@ -6441,7 +6814,6 @@ var RecordService = class {
       await this.auditService.logRecordAction({
         action: "record.updated",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         objectName: schema.name,
         objectId: schema.id,
         recordId: updated.id,
@@ -6537,9 +6909,16 @@ var RecordService = class {
    * @param options - Delete options
    */
   async deleteRecord(recordId, options) {
-    const record = await this.getRecordOrThrow(recordId);
+    const record = await this.adapter.objectRecords.findById(recordId);
+    if (!record) {
+      throw new RecordNotFoundError(recordId);
+    }
     const schema = await this.schemaService.getObjectSchema(record.objectId);
     await this.checkPermission(schema.name, "delete");
+    const policy = this.getPolicy(schema.name);
+    if (policy) {
+      this.checkRecordDelete(policy, record);
+    }
     if (options?.checkSystem) {
       if (schema.system) {
         throw new ProtectedResourceError("object", schema.name, "delete");
@@ -6564,7 +6943,6 @@ var RecordService = class {
       await this.auditService.logRecordAction({
         action: "record.deleted",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         objectName: schema.name,
         objectId: schema.id,
         recordId: record.id,
@@ -6616,7 +6994,6 @@ var RecordService = class {
       await this.auditService.logRecordAction({
         action: "record.restored",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         objectName: schema.name,
         objectId: schema.id,
         recordId: restored.id,
@@ -6762,14 +7139,29 @@ var RecordService = class {
     if (this.permissionService && this.userId) {
       await this.checkPermission(schema.name, "read");
     }
-    const result = await this.adapter.objectRecords.list(this.tenantId, objectId, options);
+    const policy = options?.skipPolicyFilter ? void 0 : this.getPolicy(schema.name);
+    let effectiveOptions = options;
+    if (policy?.applyListFilter) {
+      effectiveOptions = policy.applyListFilter(this.buildPolicyContext(schema.name), options);
+    }
+    const result = await this.adapter.objectRecords.list(objectId, effectiveOptions);
+    let filteredRecords = result.records;
+    let effectiveTotal = result.total;
+    if (policy?.canAccessRecord) {
+      const ctx = this.buildPolicyContext(schema.name);
+      filteredRecords = result.records.filter((record) => policy.canAccessRecord?.(ctx, record));
+      effectiveTotal = filteredRecords.length;
+    }
     if (!options?.skipFormulas) {
       return {
-        records: this.enrichRecordsWithFormulas(result.records, schema),
-        total: result.total
+        records: this.enrichRecordsWithFormulas(filteredRecords, schema),
+        total: effectiveTotal
       };
     }
-    return result;
+    return {
+      records: filteredRecords,
+      total: effectiveTotal
+    };
   }
   /**
    * Search records using full-text search
@@ -6784,7 +7176,7 @@ var RecordService = class {
     if (this.permissionService && this.userId) {
       await this.checkPermission(schema.name, "read");
     }
-    const result = await this.adapter.objectRecords.search(this.tenantId, objectId, query, options);
+    const result = await this.adapter.objectRecords.search(objectId, query, options);
     if (!options?.skipFormulas) {
       return {
         records: this.enrichRecordsWithFormulas(result.records, schema),
@@ -6987,16 +7379,15 @@ var RollupScheduler = class {
     this.maxPending = options?.maxPending ?? 100;
   }
   /**
-   * Schedule a rollup recalculation for a parent record
+   * Schedule a rollup recalculation for a parent record.
    *
    * If the same record is already pending, the timer is reset.
    * If too many recalculations are pending, triggers an immediate flush.
    *
    * @param parentId - ID of the parent record to recalculate
    * @param parentObjectId - Object ID of the parent
-   * @param tenantId - Tenant ID
    */
-  scheduleRecalculation(parentId, parentObjectId, tenantId) {
+  scheduleRecalculation(parentId, parentObjectId) {
     const key = `${parentId}:${parentObjectId}`;
     const existing = this.pending.get(key);
     if (existing) {
@@ -7006,7 +7397,7 @@ var RollupScheduler = class {
       await this.executeRecalculation(parentId, parentObjectId);
       this.pending.delete(key);
     }, this.debounceMs);
-    this.pending.set(key, { parentId, parentObjectId, tenantId, timeout });
+    this.pending.set(key, { parentId, parentObjectId, timeout });
     if (this.pending.size >= this.maxPending) {
       this.flush();
     }
@@ -7020,16 +7411,11 @@ var RollupScheduler = class {
       clearTimeout(entry.timeout);
     }
     this.pending.clear();
-    const tenantMap = /* @__PURE__ */ new Map();
-    for (const [, entry] of entries) {
-      tenantMap.set(entry.parentId, entry.tenantId);
-    }
     const allIds = entries.map(([, entry]) => entry.parentId);
     const records = await this.adapter.objectRecords.findByIds(allIds);
     for (const record of records) {
       const schema = await this.getSchemaById(record.objectId);
-      const tenantId = tenantMap.get(record.id);
-      if (schema && tenantId) {
+      if (schema) {
         await this.rollupService.recalculateAndUpdate(record, schema);
       }
     }
@@ -7062,27 +7448,25 @@ var RollupScheduler = class {
 };
 
 // src/runtime/services/user-profile.service.ts
-var UserProfileService = class {
-  constructor(adapter, tenantId, options) {
+var UserProfileService = class extends TenantAwareService {
+  constructor(adapter, options) {
+    super();
     this.adapter = adapter;
-    this.tenantId = tenantId;
     this.auditService = options?.auditService;
-    this.userId = options?.userId;
-    this.userEmail = options?.userEmail;
   }
   /**
-   * Create a new user profile (typically after first auth)
+   * Create a new user profile (typically after first auth).
+   * Automatically uses tenant context from AsyncLocalStorage.
    *
-   * @param data - User profile creation data
+   * @param data - User profile creation data (without tenantId)
    * @returns Created user profile
    *
    * @example
    * ```typescript
-   * const service = new UserProfileService(adapter, "tenant-123");
+   * const service = new UserProfileService(adapter);
    *
    * // After Supabase auth
    * const profile = await service.createProfile({
-   *   tenantId: "tenant-123",
    *   authId: authUser.id,
    *   email: authUser.email,
    *   firstName: authUser.user_metadata.first_name,
@@ -7093,16 +7477,11 @@ var UserProfileService = class {
    * ```
    */
   async createProfile(data) {
-    if (data.tenantId !== this.tenantId) {
-      throw new Error(
-        `Tenant mismatch: service initialized with "${this.tenantId}" but data has "${data.tenantId}"`
-      );
-    }
     const existing = await this.adapter.userProfiles.findByAuthId(data.authId);
     if (existing) {
       throw new Error(`User profile with authId "${data.authId}" already exists`);
     }
-    const existingEmail = await this.adapter.userProfiles.findByEmail(this.tenantId, data.email);
+    const existingEmail = await this.adapter.userProfiles.findByEmail(data.email);
     if (existingEmail) {
       throw new Error(`User profile with email "${data.email}" already exists in this tenant`);
     }
@@ -7111,7 +7490,6 @@ var UserProfileService = class {
       await this.auditService.logUserAction({
         action: "user.created",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         targetUserId: profile.id,
         targetUserEmail: profile.email
       });
@@ -7157,7 +7535,6 @@ var UserProfileService = class {
    * const profile = await service.getOrCreateProfile(
    *   authUser.id,
    *   {
-   *     tenantId: "tenant-123",
    *     authId: authUser.id,
    *     email: authUser.email,
    *     role: "member",
@@ -7174,7 +7551,8 @@ var UserProfileService = class {
     return await this.createProfile(data);
   }
   /**
-   * Update user profile
+   * Update user profile.
+   * Automatically uses tenant context from AsyncLocalStorage.
    */
   async updateProfile(profileId, data) {
     const existing = await this.getProfileOrThrow(profileId);
@@ -7190,7 +7568,6 @@ var UserProfileService = class {
         await this.auditService.logUserAction({
           action: "user.updated",
           actorId: this.userId,
-          actorEmail: this.userEmail,
           targetUserId: profileId,
           targetUserEmail: updated.email,
           changes
@@ -7200,7 +7577,8 @@ var UserProfileService = class {
     return updated;
   }
   /**
-   * Delete user profile
+   * Delete user profile.
+   * Automatically uses tenant context from AsyncLocalStorage.
    *
    * @param profileId - Profile UUID
    * @param options - Delete options
@@ -7209,7 +7587,7 @@ var UserProfileService = class {
     const profile = await this.getProfileOrThrow(profileId);
     if (options?.checkAdmin) {
       if (profile.role === "admin") {
-        const adminCount = await this.adapter.userProfiles.countByRole(this.tenantId, "admin");
+        const adminCount = await this.adapter.userProfiles.countByRole("admin");
         if (adminCount <= 1) {
           throw new Error("Cannot delete the last admin user");
         }
@@ -7220,17 +7598,17 @@ var UserProfileService = class {
       await this.auditService.logUserAction({
         action: "user.deleted",
         actorId: this.userId,
-        actorEmail: this.userEmail,
         targetUserId: profileId,
         targetUserEmail: profile.email
       });
     }
   }
   /**
-   * List all user profiles for the tenant
+   * List all user profiles for the tenant.
+   * Automatically uses tenant context from AsyncLocalStorage.
    */
   async listProfiles(options) {
-    return await this.adapter.userProfiles.list(this.tenantId, options);
+    return await this.adapter.userProfiles.list(options);
   }
   /**
    * Update last login timestamp
@@ -7265,10 +7643,11 @@ var UserProfileService = class {
     return await this.updateProfile(profileId, { status: newStatus });
   }
   /**
-   * Get user by email
+   * Get user by email.
+   * Automatically uses tenant context from AsyncLocalStorage.
    */
   async getProfileByEmail(email) {
-    return await this.adapter.userProfiles.findByEmail(this.tenantId, email);
+    return await this.adapter.userProfiles.findByEmail(email);
   }
   /**
    * Check if user has role
@@ -7286,38 +7665,39 @@ var UserProfileService = class {
 };
 
 // src/runtime/services/view.service.ts
-var ViewService = class {
+var ViewService = class extends TenantAwareService {
   constructor(adapter, nativeViews) {
+    super();
     this.adapter = adapter;
     this.nativeViews = nativeViews;
   }
   /**
-   * Get all views for an object (native + custom)
+   * Get all views for an object (native + custom).
+   * Automatically uses tenant context from AsyncLocalStorage.
    *
    * @param objectName - Object name
-   * @param tenantId - Tenant ID
    * @returns All views for the object
    */
-  async getViewsForObject(objectName, tenantId) {
+  async getViewsForObject(objectName) {
     const nativeViewDefs = this.nativeViews.getByObjectName(objectName);
-    const dbViews = await this.adapter.views.findByObjectName(tenantId, objectName);
+    const dbViews = await this.adapter.views.findByObjectName(objectName);
     const customViews = dbViews.filter((v) => !v.system).map(this.convertDBViewToDefinition);
     return [...nativeViewDefs, ...customViews];
   }
   /**
-   * Get a specific view by name
+   * Get a specific view by name.
+   * Automatically uses tenant context from AsyncLocalStorage.
    *
    * @param objectName - Object name
    * @param viewName - View name
-   * @param tenantId - Tenant ID
    * @returns View definition or null
    */
-  async getView(objectName, viewName, tenantId) {
+  async getView(objectName, viewName) {
     const nativeView = this.nativeViews.get(objectName, viewName);
     if (nativeView) {
       return nativeView;
     }
-    const dbView = await this.adapter.views.findByName(tenantId, objectName, viewName);
+    const dbView = await this.adapter.views.findByName(objectName, viewName);
     if (dbView) {
       return this.convertDBViewToDefinition(dbView);
     }
@@ -7332,11 +7712,10 @@ var ViewService = class {
    * 3. First available view
    *
    * @param objectName - Object name
-   * @param tenantId - Tenant ID
    * @returns Default view or null
    */
-  async getDefaultView(objectName, tenantId) {
-    const views = await this.getViewsForObject(objectName, tenantId);
+  async getDefaultView(objectName) {
+    const views = await this.getViewsForObject(objectName);
     const customDefault = views.find((v) => v.default && !v.system);
     if (customDefault) return customDefault;
     const nativeDefault = views.find((v) => v.default && v.system);
@@ -7344,15 +7723,15 @@ var ViewService = class {
     return views[0] ?? null;
   }
   /**
-   * Create a custom view
+   * Create a custom view.
+   * Automatically uses tenant context from AsyncLocalStorage.
    *
    * @param input - View definition
-   * @param tenantId - Tenant ID
    * @returns Created view
    */
-  async createView(input, tenantId) {
+  async createView(input) {
     this.validateViewName(input.name);
-    const existing = await this.adapter.views.findByName(tenantId, input.objectName, input.name);
+    const existing = await this.adapter.views.findByName(input.objectName, input.name);
     if (existing) {
       throw new SchemaError(
         `View "${input.name}" already exists for object "${input.objectName}"`,
@@ -7368,7 +7747,6 @@ var ViewService = class {
       );
     }
     const dbView = await this.adapter.views.create({
-      tenantId,
       objectName: input.objectName,
       name: input.name,
       label: input.label,
@@ -7423,18 +7801,18 @@ var ViewService = class {
     await this.adapter.views.delete(viewId);
   }
   /**
-   * Set a view as default for its object
+   * Set a view as default for its object.
+   * Automatically uses tenant context from AsyncLocalStorage.
    *
    * @param viewId - View ID
-   * @param tenantId - Tenant ID
    * @returns Updated view
    */
-  async setDefaultView(viewId, tenantId) {
+  async setDefaultView(viewId) {
     const dbView = await this.adapter.views.findById(viewId);
     if (!dbView) {
       throw new NotFoundError("View", viewId);
     }
-    const currentViews = await this.adapter.views.findByObjectName(tenantId, dbView.objectName);
+    const currentViews = await this.adapter.views.findByObjectName(dbView.objectName);
     for (const v of currentViews) {
       if (v.default && v.id !== viewId && !v.system) {
         await this.adapter.views.update(v.id, { default: false });
@@ -7590,7 +7968,6 @@ async function syncSingleView(adapter, nativeView, result, options) {
     return;
   }
   await adapter.views.upsert({
-    tenantId: options.tenantId || "default",
     objectName: nativeView.object,
     name: nativeView.name,
     label: nativeView.label,
@@ -7730,9 +8107,8 @@ async function handleDryRun(adapter, nativeObject, existingObject, result, optio
     result.attributesSynced++;
   }
 }
-async function upsertObject(adapter, nativeObject, options) {
+async function upsertObject(adapter, nativeObject, _options) {
   return await adapter.objects.upsert({
-    tenantId: options.tenantId || "default",
     system: true,
     name: nativeObject.name,
     label: nativeObject.label,
@@ -7844,6 +8220,8 @@ var NoopGeocodingAdapter = class {
   NoopHookRegistry,
   ObjectSchemaService,
   PermissionService,
+  PolicyRegistry,
+  PolicyViolationError,
   QueryBuilder,
   QueryMultipleResultsError,
   QueryNoResultError,
@@ -7853,6 +8231,9 @@ var NoopGeocodingAdapter = class {
   RollupScheduler,
   RollupService,
   SHORTCUT_TO_FILTER_OPERATOR,
+  TenantAwareRepository,
+  TenantAwareService,
+  TenantContextError,
   UserProfileService,
   UserService,
   ViewService,
@@ -7860,6 +8241,7 @@ var NoopGeocodingAdapter = class {
   createDefaultState,
   createMockAdapter,
   createQueryBuilder,
+  defaultPolicyRegistry,
   enrichValuesWithSelectLabels,
   evaluateFormula,
   evaluateFormulaAttribute,
@@ -7874,18 +8256,24 @@ var NoopGeocodingAdapter = class {
   formatFormulaResult,
   formatRecord,
   formatRecords,
+  getContext,
   getPathDepth,
   getRelationPath,
   getSyncPreview,
   getTargetAttributeName,
+  getTenantId,
+  getUserId,
   getViewSyncPreview,
+  hasContext,
   hasRelationReferences,
   isLabelExpression,
+  notesPolicy,
   parsePath,
   pathHasManyCardinality,
   renderLabelExpression,
   resolveMultiplePaths,
   resolveSingleValue,
+  runWithContext,
   syncAll,
   syncNativeObjects,
   syncNativeViews,
@@ -7893,5 +8281,6 @@ var NoopGeocodingAdapter = class {
   validateFormulaExpression,
   validatePath,
   verifyNativeObjectsSync,
-  verifyNativeViewsSync
+  verifyNativeViewsSync,
+  withTenantContext
 });