feat: add missing sys_team and sys_team_member objects, unify auth-schema-config to use SystemObjectName constants

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

CHANGELOG.md

@@ -13,11 +13,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `ObjectSchema.create()` unless an explicit `tableName` is provided. This decouples the logical object name
   from the physical table name and enables unified routing, permissions, and discovery by domain.
 - **SystemObjectName constants** — Extended with all system objects: `ORGANIZATION`, `MEMBER`, `INVITATION`,
-  `API_KEY`, `TWO_FACTOR`, `ROLE`, `PERMISSION_SET`, `AUDIT_LOG` (in addition to existing `USER`, `SESSION`,
-  `ACCOUNT`, `VERIFICATION`, `METADATA`).
-- **plugin-auth system objects** — Added `SysOrganization`, `SysMember`, `SysInvitation`, `SysApiKey`,
-  `SysTwoFactor` object definitions with `namespace: 'sys'`. Existing objects (`SysUser`, `SysSession`,
-  `SysAccount`, `SysVerification`) migrated to use namespace convention.
+  `TEAM`, `TEAM_MEMBER`, `API_KEY`, `TWO_FACTOR`, `ROLE`, `PERMISSION_SET`, `AUDIT_LOG` (in addition to
+  existing `USER`, `SESSION`, `ACCOUNT`, `VERIFICATION`, `METADATA`).
+- **plugin-auth system objects** — Added `SysOrganization`, `SysMember`, `SysInvitation`, `SysTeam`,
+  `SysTeamMember`, `SysApiKey`, `SysTwoFactor` object definitions with `namespace: 'sys'`. Existing objects
+  (`SysUser`, `SysSession`, `SysAccount`, `SysVerification`) migrated to use namespace convention.
 - **plugin-security system objects** — Added `SysRole` and `SysPermissionSet` object definitions.
 - **plugin-audit** — New plugin package with `SysAuditLog` immutable audit trail object definition.
 - **StorageNameMapping.resolveTableName()** — Now supports namespace-aware auto-derivation

ROADMAP.md

@@ -325,6 +325,8 @@ Objects now declare `namespace: 'sys'` and a short `name` (e.g., `name: 'user'`)
 | `SystemObjectName.ORGANIZATION` | `sys_organization` | plugin-auth | Authentication: organization (multi-org) |
 | `SystemObjectName.MEMBER` | `sys_member` | plugin-auth | Authentication: organization member |
 | `SystemObjectName.INVITATION` | `sys_invitation` | plugin-auth | Authentication: organization invitation |
+| `SystemObjectName.TEAM` | `sys_team` | plugin-auth | Authentication: team within an organization |
+| `SystemObjectName.TEAM_MEMBER` | `sys_team_member` | plugin-auth | Authentication: team membership |
 | `SystemObjectName.API_KEY` | `sys_api_key` | plugin-auth | Authentication: API key for programmatic access |
 | `SystemObjectName.TWO_FACTOR` | `sys_two_factor` | plugin-auth | Authentication: two-factor credentials |
 | `SystemObjectName.ROLE` | `sys_role` | plugin-security | Security: RBAC role definition |

packages/plugins/plugin-auth/src/auth-schema-config.ts

@@ -157,7 +157,7 @@ export const AUTH_VERIFICATION_CONFIG = {
  * | updatedAt               | updated_at               |
  */
 export const AUTH_ORGANIZATION_SCHEMA = {
-  modelName: 'sys_organization',
+  modelName: SystemObjectName.ORGANIZATION, // 'sys_organization'
   fields: {
     createdAt: 'created_at',
     updatedAt: 'updated_at',
@@ -178,7 +178,7 @@ export const AUTH_ORGANIZATION_SCHEMA = {
  * | createdAt               | created_at               |
  */
 export const AUTH_MEMBER_SCHEMA = {
-  modelName: 'sys_member',
+  modelName: SystemObjectName.MEMBER, // 'sys_member'
   fields: {
     organizationId: 'organization_id',
     userId: 'user_id',
@@ -202,7 +202,7 @@ export const AUTH_MEMBER_SCHEMA = {
  * | teamId                  | team_id                  |
  */
 export const AUTH_INVITATION_SCHEMA = {
-  modelName: 'sys_invitation',
+  modelName: SystemObjectName.INVITATION, // 'sys_invitation'
   fields: {
     organizationId: 'organization_id',
     inviterId: 'inviter_id',
@@ -240,7 +240,7 @@ export const AUTH_ORG_SESSION_FIELDS = {
  * | updatedAt               | updated_at               |
  */
 export const AUTH_TEAM_SCHEMA = {
-  modelName: 'sys_team',
+  modelName: SystemObjectName.TEAM, // 'sys_team'
   fields: {
     organizationId: 'organization_id',
     createdAt: 'created_at',
@@ -262,7 +262,7 @@ export const AUTH_TEAM_SCHEMA = {
  * | createdAt               | created_at               |
  */
 export const AUTH_TEAM_MEMBER_SCHEMA = {
-  modelName: 'sys_team_member',
+  modelName: SystemObjectName.TEAM_MEMBER, // 'sys_team_member'
   fields: {
     teamId: 'team_id',
     userId: 'user_id',
@@ -283,7 +283,7 @@ export const AUTH_TEAM_MEMBER_SCHEMA = {
  * | userId                  | user_id                  |
  */
 export const AUTH_TWO_FACTOR_SCHEMA = {
-  modelName: 'sys_two_factor',
+  modelName: SystemObjectName.TWO_FACTOR, // 'sys_two_factor'
   fields: {
     backupCodes: 'backup_codes',
     userId: 'user_id',

packages/plugins/plugin-auth/src/objects/index.ts

@@ -21,6 +21,8 @@ export { SysVerification } from './sys-verification.object.js';
 export { SysOrganization } from './sys-organization.object.js';
 export { SysMember } from './sys-member.object.js';
 export { SysInvitation } from './sys-invitation.object.js';
+export { SysTeam } from './sys-team.object.js';
+export { SysTeamMember } from './sys-team-member.object.js';
 
 // ── Additional Auth Objects ────────────────────────────────────────────────
 export { SysApiKey } from './sys-api-key.object.js';

packages/plugins/plugin-auth/src/objects/sys-team-member.object.ts

@@ -0,0 +1,61 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { ObjectSchema, Field } from '@objectstack/spec/data';
+
+/**
+ * sys_team_member — System Team Member Object
+ *
+ * Links users to teams within organizations.
+ * Backed by better-auth's organization plugin (teams feature).
+ *
+ * @namespace sys
+ */
+export const SysTeamMember = ObjectSchema.create({
+  namespace: 'sys',
+  name: 'team_member',
+  label: 'Team Member',
+  pluralLabel: 'Team Members',
+  icon: 'user-plus',
+  isSystem: true,
+  description: 'Team membership records linking users to teams',
+  titleFormat: '{user_id} in {team_id}',
+  compactLayout: ['user_id', 'team_id', 'created_at'],
+  
+  fields: {
+    id: Field.text({
+      label: 'Team Member ID',
+      required: true,
+      readonly: true,
+    }),
+    
+    created_at: Field.datetime({
+      label: 'Created At',
+      defaultValue: 'NOW()',
+      readonly: true,
+    }),
+    
+    team_id: Field.text({
+      label: 'Team ID',
+      required: true,
+    }),
+    
+    user_id: Field.text({
+      label: 'User ID',
+      required: true,
+    }),
+  },
+  
+  indexes: [
+    { fields: ['team_id', 'user_id'], unique: true },
+    { fields: ['user_id'] },
+  ],
+  
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    apiMethods: ['get', 'list', 'create', 'delete'],
+    trash: false,
+    mru: false,
+  },
+});

packages/plugins/plugin-auth/src/objects/sys-team.object.ts

@@ -0,0 +1,69 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { ObjectSchema, Field } from '@objectstack/spec/data';
+
+/**
+ * sys_team — System Team Object
+ *
+ * Teams within an organization for fine-grained grouping.
+ * Backed by better-auth's organization plugin (teams feature).
+ *
+ * @namespace sys
+ */
+export const SysTeam = ObjectSchema.create({
+  namespace: 'sys',
+  name: 'team',
+  label: 'Team',
+  pluralLabel: 'Teams',
+  icon: 'users',
+  isSystem: true,
+  description: 'Teams within organizations for fine-grained grouping',
+  titleFormat: '{name}',
+  compactLayout: ['name', 'organization_id', 'created_at'],
+  
+  fields: {
+    id: Field.text({
+      label: 'Team ID',
+      required: true,
+      readonly: true,
+    }),
+    
+    created_at: Field.datetime({
+      label: 'Created At',
+      defaultValue: 'NOW()',
+      readonly: true,
+    }),
+    
+    updated_at: Field.datetime({
+      label: 'Updated At',
+      defaultValue: 'NOW()',
+      readonly: true,
+    }),
+    
+    name: Field.text({
+      label: 'Name',
+      required: true,
+      searchable: true,
+      maxLength: 255,
+    }),
+    
+    organization_id: Field.text({
+      label: 'Organization ID',
+      required: true,
+    }),
+  },
+  
+  indexes: [
+    { fields: ['organization_id'] },
+    { fields: ['name', 'organization_id'], unique: true },
+  ],
+  
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ['get', 'list', 'create', 'update', 'delete'],
+    trash: true,
+    mru: false,
+  },
+});

packages/spec/src/system/constants/system-names.test.ts

@@ -18,6 +18,8 @@ describe('SystemObjectName', () => {
     expect(SystemObjectName.ORGANIZATION).toBe('sys_organization');
     expect(SystemObjectName.MEMBER).toBe('sys_member');
     expect(SystemObjectName.INVITATION).toBe('sys_invitation');
+    expect(SystemObjectName.TEAM).toBe('sys_team');
+    expect(SystemObjectName.TEAM_MEMBER).toBe('sys_team_member');
     expect(SystemObjectName.API_KEY).toBe('sys_api_key');
     expect(SystemObjectName.TWO_FACTOR).toBe('sys_two_factor');
     expect(SystemObjectName.ROLE).toBe('sys_role');
@@ -31,6 +33,8 @@ describe('SystemObjectName', () => {
     expect(names).toContain('sys_user');
     expect(names).toContain('sys_session');
     expect(names).toContain('sys_organization');
+    expect(names).toContain('sys_team');
+    expect(names).toContain('sys_team_member');
     expect(names).toContain('sys_role');
     expect(names).toContain('sys_audit_log');
   });
@@ -44,6 +48,8 @@ describe('SystemObjectName', () => {
     expect(keys).toContain('ORGANIZATION');
     expect(keys).toContain('MEMBER');
     expect(keys).toContain('INVITATION');
+    expect(keys).toContain('TEAM');
+    expect(keys).toContain('TEAM_MEMBER');
     expect(keys).toContain('API_KEY');
     expect(keys).toContain('TWO_FACTOR');
     expect(keys).toContain('ROLE');

packages/spec/src/system/constants/system-names.ts

@@ -34,6 +34,10 @@ export const SystemObjectName = {
   MEMBER: 'sys_member',
   /** Authentication: organization invitation */
   INVITATION: 'sys_invitation',
+  /** Authentication: team within an organization */
+  TEAM: 'sys_team',
+  /** Authentication: team membership */
+  TEAM_MEMBER: 'sys_team_member',
   /** Authentication: API key for programmatic access */
   API_KEY: 'sys_api_key',
   /** Authentication: two-factor authentication credentials */