@stndrds/schema 1.0.0-alpha.72 → 1.0.0-alpha.73

package/dist/{chunk-4GHZ6AUF.js → chunk-EWDCS5EE.js}

@@ -15,6 +15,9 @@ var _chunkNEVERCM3js = require('./chunk-NEVERCM3.js');
 var _chunk3WTK7ESHjs = require('./chunk-3WTK7ESH.js');
 
 
+var _chunkJZO52C3Fjs = require('./chunk-JZO52C3F.js');
+
+
 var _chunk3RG5ZIWIjs = require('./chunk-3RG5ZIWI.js');
 
 // src/runtime/auth/workflow-jwt.service.ts
@@ -3700,13 +3703,24 @@ function parsePipeExpression(pipeExpr) {
 }
 function renderLabelExpression(template, values, fallback = DEFAULT_LABEL_FALLBACK) {
   const result = template.replace(/\{\{\s*([^}]+)\s*\}\}/g, (_, expr) => {
-    const parts = expr.split("|").map((s) => s.trim());
-    const path = parts[0];
-    let value = getValue(values, path);
+    const orParts = expr.split("||").map((s) => s.trim());
+    const lastPart = orParts[orParts.length - 1];
+    const pipeSplit = lastPart.split("|").map((s) => s.trim());
+    orParts[orParts.length - 1] = pipeSplit[0];
+    const pipes = pipeSplit.slice(1).filter(Boolean);
+    const alternatives = orParts.filter(Boolean);
+    let value = "";
+    for (const alt of alternatives) {
+      const v = getValue(values, alt);
+      if (v != null && v !== "") {
+        value = v;
+        break;
+      }
+    }
     const isEmpty3 = value == null || value === "";
-    if (isEmpty3 && parts.length === 1) return "";
-    for (let i = 1; i < parts.length; i++) {
-      const { name: pipeName, args } = parsePipeExpression(parts[i]);
+    if (isEmpty3 && pipes.length === 0) return "";
+    for (const pipeExpr of pipes) {
+      const { name: pipeName, args } = parsePipeExpression(pipeExpr);
       const simpleFn = simplePipes[pipeName];
       if (simpleFn) {
         if (value != null && value !== "") {
@@ -3728,13 +3742,19 @@ function isLabelExpression(value) {
 }
 function extractAttributeNames(template) {
   const names = [];
-  const regex = /\{\{\s*([^|}]+)/g;
+  const regex = /\{\{\s*([^}]+)\s*\}\}/g;
   let match;
   while ((match = regex.exec(template)) !== null) {
-    const path = match[1].trim();
-    const rootName = path.split(".")[0];
-    if (rootName && !names.includes(rootName)) {
-      names.push(rootName);
+    const expr = match[1].trim();
+    const orParts = expr.split("||").map((s) => s.trim());
+    const lastPart = orParts[orParts.length - 1];
+    orParts[orParts.length - 1] = lastPart.split("|")[0].trim();
+    for (const part of orParts) {
+      if (!part) continue;
+      const rootName = part.split(".")[0];
+      if (rootName && !names.includes(rootName)) {
+        names.push(rootName);
+      }
     }
   }
   return names;
@@ -4303,7 +4323,6 @@ function createMockUserProfilesRepository(stores) {
         firstName: data.firstName,
         lastName: data.lastName,
         avatarUrl: data.avatarUrl,
-        role: _nullishCoalesce(data.role, () => ( "member")),
         status: _nullishCoalesce(data.status, () => ( "active")),
         createdAt: /* @__PURE__ */ new Date(),
         updatedAt: /* @__PURE__ */ new Date()
@@ -4336,12 +4355,23 @@ function createMockUserProfilesRepository(stores) {
       }
       return Promise.resolve(results);
     },
-    countByRole(role) {
+    getUsersWithRoles(filters) {
       const tenantId = getTenantId();
-      const count = Array.from(stores.userProfiles.values()).filter(
-        (profile) => profile.tenantId === tenantId && profile.role === role
-      ).length;
-      return Promise.resolve(count);
+      const profiles = Array.from(stores.userProfiles.values()).filter(
+        (p) => p.tenantId === tenantId
+      );
+      const results = [];
+      for (const profile of profiles) {
+        const roleIds = Array.from(stores.userRoles.values()).filter((ur) => ur.userProfileId === profile.id && ur.tenantId === tenantId).map((ur) => ur.roleId);
+        const roles = Array.from(stores.roles.values()).filter((r) => roleIds.includes(r.id));
+        if (_optionalChain([filters, 'optionalAccess', _87 => _87.allowedRoles]) && filters.allowedRoles.length > 0) {
+          const allowed = filters.allowedRoles;
+          const hasMatchingRole = roles.some((r) => allowed.includes(r.name));
+          if (!hasMatchingRole) continue;
+        }
+        results.push({ ...profile, roles });
+      }
+      return Promise.resolve(results);
     },
     updateLastLogin(id) {
       const profile = stores.userProfiles.get(id);
@@ -4360,7 +4390,6 @@ function createMockUserProfilesRepository(stores) {
         email: data.email,
         firstName: data.firstName,
         lastName: data.lastName,
-        role: _nullishCoalesce(data.role, () => ( "member")),
         status: "pending",
         createdAt: /* @__PURE__ */ new Date(),
         updatedAt: /* @__PURE__ */ new Date()
@@ -4419,7 +4448,7 @@ function createMockPermissionsRepository(stores) {
     },
     deleteRole(roleId) {
       const role = stores.roles.get(roleId);
-      if (_optionalChain([role, 'optionalAccess', _87 => _87.system])) {
+      if (_optionalChain([role, 'optionalAccess', _88 => _88.system])) {
         return Promise.reject(new Error(`Cannot delete system role ${roleId}`));
       }
       stores.roles.delete(roleId);
@@ -4452,7 +4481,6 @@ function createMockPermissionsRepository(stores) {
           scope: input.scope,
           target: input.target,
           actions: input.actions,
-          filter: input.filter,
           createdAt: /* @__PURE__ */ new Date()
         };
         stores.permissions.set(perm.id, perm);
@@ -4497,7 +4525,7 @@ function createMockPermissionsRepository(stores) {
       const tenantId = getTenantId();
       const userRoleIds = Array.from(stores.userRoles.values()).filter((ur) => ur.userProfileId === userProfileId && ur.tenantId === tenantId).map((ur) => ur.roleId);
       const userRoles = Array.from(stores.roles.values()).filter((r) => userRoleIds.includes(r.id));
-      const isAdmin = userRoles.some((r) => r.name === "admin");
+      const hasAdmin = userRoles.some((r) => _chunkJZO52C3Fjs.isAdminRole.call(void 0, r.name));
       const userPermissions = Array.from(stores.permissions.values()).filter(
         (p) => userRoleIds.includes(p.roleId)
       );
@@ -4524,7 +4552,18 @@ function createMockPermissionsRepository(stores) {
           }
         }
       }
-      return Promise.resolve({ isAdmin, objectPermissions, systemPermissions });
+      return Promise.resolve({ isAdmin: hasAdmin, objectPermissions, systemPermissions });
+    },
+    countUsersWithRole(roleName) {
+      const tenantId = getTenantId();
+      const role = Array.from(stores.roles.values()).find(
+        (r) => r.tenantId === tenantId && r.name === roleName
+      );
+      if (!role) return Promise.resolve(0);
+      const userIds = new Set(
+        Array.from(stores.userRoles.values()).filter((ur) => ur.roleId === role.id && ur.tenantId === tenantId).map((ur) => ur.userProfileId)
+      );
+      return Promise.resolve(userIds.size);
     }
   };
 }
@@ -4908,7 +4947,7 @@ function createMockWorkflowInstancesRepository(stores) {
         (i) => i.tenant_id === tenantId
       );
       const total = results.length;
-      if (_optionalChain([options, 'optionalAccess', _88 => _88.limit])) {
+      if (_optionalChain([options, 'optionalAccess', _89 => _89.limit])) {
         results = results.slice(_nullishCoalesce(options.offset, () => ( 0)), (_nullishCoalesce(options.offset, () => ( 0))) + options.limit);
       }
       return Promise.resolve({ instances: results, total });
@@ -4936,7 +4975,7 @@ function createMockWorkflowInstancesRepository(stores) {
         pending_action: _nullishCoalesce(data.pendingAction, () => ( null)),
         error: null,
         started_by: data.startedBy,
-        expires_at: _nullishCoalesce(_optionalChain([data, 'access', _89 => _89.expiresAt, 'optionalAccess', _90 => _90.toISOString, 'call', _91 => _91()]), () => ( null)),
+        expires_at: _nullishCoalesce(_optionalChain([data, 'access', _90 => _90.expiresAt, 'optionalAccess', _91 => _91.toISOString, 'call', _92 => _92()]), () => ( null)),
         created_at: now,
         updated_at: now,
         completed_at: null
@@ -4957,8 +4996,8 @@ function createMockWorkflowInstancesRepository(stores) {
         history: _nullishCoalesce(data.history, () => ( existing.history)),
         pending_action: data.pendingAction !== void 0 ? data.pendingAction : existing.pending_action,
         error: data.error !== void 0 ? data.error : existing.error,
-        expires_at: data.expiresAt !== void 0 ? _nullishCoalesce(_optionalChain([data, 'access', _92 => _92.expiresAt, 'optionalAccess', _93 => _93.toISOString, 'call', _94 => _94()]), () => ( null)) : existing.expires_at,
-        completed_at: data.completedAt !== void 0 ? _nullishCoalesce(_optionalChain([data, 'access', _95 => _95.completedAt, 'optionalAccess', _96 => _96.toISOString, 'call', _97 => _97()]), () => ( null)) : existing.completed_at,
+        expires_at: data.expiresAt !== void 0 ? _nullishCoalesce(_optionalChain([data, 'access', _93 => _93.expiresAt, 'optionalAccess', _94 => _94.toISOString, 'call', _95 => _95()]), () => ( null)) : existing.expires_at,
+        completed_at: data.completedAt !== void 0 ? _nullishCoalesce(_optionalChain([data, 'access', _96 => _96.completedAt, 'optionalAccess', _97 => _97.toISOString, 'call', _98 => _98()]), () => ( null)) : existing.completed_at,
         updated_at: (/* @__PURE__ */ new Date()).toISOString()
       };
       stores.workflowInstances.set(id, updated);
@@ -4991,7 +5030,7 @@ function createMockWorkflowInstancesRepository(stores) {
         pending_action: _nullishCoalesce(data.pendingAction, () => ( null)),
         error: null,
         started_by: data.startedBy,
-        expires_at: _nullishCoalesce(_optionalChain([data, 'access', _98 => _98.expiresAt, 'optionalAccess', _99 => _99.toISOString, 'call', _100 => _100()]), () => ( null)),
+        expires_at: _nullishCoalesce(_optionalChain([data, 'access', _99 => _99.expiresAt, 'optionalAccess', _100 => _100.toISOString, 'call', _101 => _101()]), () => ( null)),
         created_at: now,
         updated_at: now,
         completed_at: null
@@ -5014,13 +5053,13 @@ function createMockWorkflowInstancesRepository(stores) {
           return slotData.id === recordId;
         });
       });
-      if (_optionalChain([options, 'optionalAccess', _101 => _101.status])) {
+      if (_optionalChain([options, 'optionalAccess', _102 => _102.status])) {
         results = results.filter((i) => i.status === options.status);
       }
       const total = results.length;
-      if (_optionalChain([options, 'optionalAccess', _102 => _102.offset]) !== void 0 || _optionalChain([options, 'optionalAccess', _103 => _103.limit]) !== void 0) {
-        const start = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _104 => _104.offset]), () => ( 0));
-        const end = _optionalChain([options, 'optionalAccess', _105 => _105.limit]) ? start + options.limit : void 0;
+      if (_optionalChain([options, 'optionalAccess', _103 => _103.offset]) !== void 0 || _optionalChain([options, 'optionalAccess', _104 => _104.limit]) !== void 0) {
+        const start = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _105 => _105.offset]), () => ( 0));
+        const end = _optionalChain([options, 'optionalAccess', _106 => _106.limit]) ? start + options.limit : void 0;
         results = results.slice(start, end);
       }
       return Promise.resolve({ instances: results, total });
@@ -5076,7 +5115,7 @@ function createMockWorkflowInvitationsRepository(stores) {
       const updated = {
         ...existing,
         status: _nullishCoalesce(data.status, () => ( existing.status)),
-        accepted_at: data.acceptedAt !== void 0 ? _nullishCoalesce(_optionalChain([data, 'access', _106 => _106.acceptedAt, 'optionalAccess', _107 => _107.toISOString, 'call', _108 => _108()]), () => ( null)) : existing.accepted_at,
+        accepted_at: data.acceptedAt !== void 0 ? _nullishCoalesce(_optionalChain([data, 'access', _107 => _107.acceptedAt, 'optionalAccess', _108 => _108.toISOString, 'call', _109 => _109()]), () => ( null)) : existing.accepted_at,
         expires_at: data.expiresAt !== void 0 ? data.expiresAt.toISOString() : existing.expires_at
       };
       stores.workflowInvitations.set(id, updated);
@@ -5142,7 +5181,7 @@ function createMockWorkflowAccessGrantsRepository(stores) {
         ...existing,
         last_used_at: data.lastUsedAt !== void 0 ? data.lastUsedAt.toISOString() : existing.last_used_at,
         revoked_token_jtis: _nullishCoalesce(data.revokedTokenJtis, () => ( existing.revoked_token_jtis)),
-        revoked_at: data.revokedAt !== void 0 ? _nullishCoalesce(_optionalChain([data, 'access', _109 => _109.revokedAt, 'optionalAccess', _110 => _110.toISOString, 'call', _111 => _111()]), () => ( null)) : existing.revoked_at
+        revoked_at: data.revokedAt !== void 0 ? _nullishCoalesce(_optionalChain([data, 'access', _110 => _110.revokedAt, 'optionalAccess', _111 => _111.toISOString, 'call', _112 => _112()]), () => ( null)) : existing.revoked_at
       };
       stores.workflowAccessGrants.set(id, updated);
       return Promise.resolve(updated);
@@ -5351,7 +5390,7 @@ var BaseService = class {
    * @param key - Cache key to invalidate
    */
   async invalidateCache(key) {
-    await _optionalChain([this, 'access', _112 => _112.cache, 'optionalAccess', _113 => _113.delete, 'call', _114 => _114(key)]);
+    await _optionalChain([this, 'access', _113 => _113.cache, 'optionalAccess', _114 => _114.delete, 'call', _115 => _115(key)]);
   }
   /**
    * Invalidate all cache keys matching a pattern.
@@ -5359,7 +5398,7 @@ var BaseService = class {
    * @param pattern - Glob-style pattern (e.g., "schema:tenant-123:*")
    */
   async invalidateCachePattern(pattern) {
-    await _optionalChain([this, 'access', _115 => _115.cache, 'optionalAccess', _116 => _116.deletePattern, 'call', _117 => _117(pattern)]);
+    await _optionalChain([this, 'access', _116 => _116.cache, 'optionalAccess', _117 => _117.deletePattern, 'call', _118 => _118(pattern)]);
   }
   /**
    * Invalidate all cached lists for a resource.
@@ -5574,17 +5613,17 @@ function validateOptions(options, attributeName) {
   const ids = /* @__PURE__ */ new Set();
   const values = /* @__PURE__ */ new Set();
   for (const option of options) {
-    if (!_optionalChain([option, 'access', _118 => _118.id, 'optionalAccess', _119 => _119.trim, 'call', _120 => _120()])) {
+    if (!_optionalChain([option, 'access', _119 => _119.id, 'optionalAccess', _120 => _120.trim, 'call', _121 => _121()])) {
       throw new Error(
         `[AttributeBuilder] Option in "${attributeName}" has an empty or missing id.`
       );
     }
-    if (!_optionalChain([option, 'access', _121 => _121.value, 'optionalAccess', _122 => _122.trim, 'call', _123 => _123()])) {
+    if (!_optionalChain([option, 'access', _122 => _122.value, 'optionalAccess', _123 => _123.trim, 'call', _124 => _124()])) {
       throw new Error(
         `[AttributeBuilder] Option "${option.id}" in "${attributeName}" has an empty or missing value.`
       );
     }
-    if (!_optionalChain([option, 'access', _124 => _124.label, 'optionalAccess', _125 => _125.trim, 'call', _126 => _126()])) {
+    if (!_optionalChain([option, 'access', _125 => _125.label, 'optionalAccess', _126 => _126.trim, 'call', _127 => _127()])) {
       throw new Error(
         `[AttributeBuilder] Option "${option.id}" in "${attributeName}" has an empty or missing label.`
       );
@@ -5682,8 +5721,8 @@ var BaseAttributeBuilder = class {
   featureGate(flagName, options) {
     this.attr.featureGate = {
       flag: flagName,
-      expectedValue: _optionalChain([options, 'optionalAccess', _127 => _127.expectedValue]),
-      fallback: _optionalChain([options, 'optionalAccess', _128 => _128.fallback])
+      expectedValue: _optionalChain([options, 'optionalAccess', _128 => _128.expectedValue]),
+      fallback: _optionalChain([options, 'optionalAccess', _129 => _129.fallback])
     };
     return this;
   }
@@ -6126,7 +6165,7 @@ var BaseRelationAttributeBuilder = class extends BaseAttributeBuilder {
       object: objectName,
       ...options
     };
-    _optionalChain([this, 'access', _129 => _129.attr, 'access', _130 => _130.targets, 'optionalAccess', _131 => _131.push, 'call', _132 => _132(target)]);
+    _optionalChain([this, 'access', _130 => _130.attr, 'access', _131 => _131.targets, 'optionalAccess', _132 => _132.push, 'call', _133 => _133(target)]);
     return this;
   }
   /**
@@ -6224,9 +6263,9 @@ var MultiRelationAttributeBuilder = class extends BaseRelationAttributeBuilder {
   constructor(name, label, initOptions) {
     super("relation", name, label);
     this.attr.cardinality = "many";
-    this.attr.targets = _nullishCoalesce(_optionalChain([initOptions, 'optionalAccess', _133 => _133.targets]), () => ( []));
+    this.attr.targets = _nullishCoalesce(_optionalChain([initOptions, 'optionalAccess', _134 => _134.targets]), () => ( []));
     this.attr.defaultValue = [];
-    if (_optionalChain([initOptions, 'optionalAccess', _134 => _134.isRequired])) {
+    if (_optionalChain([initOptions, 'optionalAccess', _135 => _135.isRequired])) {
       this.setRequired(true);
     }
   }
@@ -6667,7 +6706,7 @@ var GroupBuilder = class {
    */
   fields(...names) {
     for (const name of names) {
-      _optionalChain([this, 'access', _135 => _135.data, 'access', _136 => _136.fields, 'optionalAccess', _137 => _137.push, 'call', _138 => _138({ attribute: name })]);
+      _optionalChain([this, 'access', _136 => _136.data, 'access', _137 => _137.fields, 'optionalAccess', _138 => _138.push, 'call', _139 => _139({ attribute: name })]);
     }
     return this;
   }
@@ -6676,7 +6715,7 @@ var GroupBuilder = class {
    * @example .field("name", { span: 8, readOnly: true })
    */
   field(attribute, options) {
-    _optionalChain([this, 'access', _139 => _139.data, 'access', _140 => _140.fields, 'optionalAccess', _141 => _141.push, 'call', _142 => _142({ attribute, ...options })]);
+    _optionalChain([this, 'access', _140 => _140.data, 'access', _141 => _141.fields, 'optionalAccess', _142 => _142.push, 'call', _143 => _143({ attribute, ...options })]);
     return this;
   }
   /**
@@ -6685,7 +6724,7 @@ var GroupBuilder = class {
    * @example .attributeGroup({ id: "address", label: "Address", attributes: ["street", "city", "postal_code"], displayTemplate: "{street}, {city}" })
    */
   attributeGroup(config, options) {
-    _optionalChain([this, 'access', _143 => _143.data, 'access', _144 => _144.fields, 'optionalAccess', _145 => _145.push, 'call', _146 => _146({ attributeGroup: config, ...options })]);
+    _optionalChain([this, 'access', _144 => _144.data, 'access', _145 => _145.fields, 'optionalAccess', _146 => _146.push, 'call', _147 => _147({ attributeGroup: config, ...options })]);
     return this;
   }
   /**
@@ -7753,8 +7792,8 @@ var WorkflowFormRowBuilder = class {
       id: `${this.rowData.id}-${slotId}-${attribute}`,
       slotId,
       attribute,
-      label: _optionalChain([options, 'optionalAccess', _147 => _147.label]),
-      required: _optionalChain([options, 'optionalAccess', _148 => _148.required])
+      label: _optionalChain([options, 'optionalAccess', _148 => _148.label]),
+      required: _optionalChain([options, 'optionalAccess', _149 => _149.required])
     };
     this.rowData.fields.push(field);
     return this;
@@ -8045,7 +8084,7 @@ var WorkflowBuilder = class {
    * @param options - Slot configuration
    */
   slot(id, objectName, options) {
-    if (_optionalChain([this, 'access', _149 => _149.data, 'access', _150 => _150.slots, 'optionalAccess', _151 => _151.some, 'call', _152 => _152((s) => s.id === id)])) {
+    if (_optionalChain([this, 'access', _150 => _150.data, 'access', _151 => _151.slots, 'optionalAccess', _152 => _152.some, 'call', _153 => _153((s) => s.id === id)])) {
       throw new Error(`[WorkflowBuilder] Duplicate slot id: "${id}"`);
     }
     const slot = {
@@ -8056,7 +8095,7 @@ var WorkflowBuilder = class {
       color: options.color,
       icon: options.icon
     };
-    _optionalChain([this, 'access', _153 => _153.data, 'access', _154 => _154.slots, 'optionalAccess', _155 => _155.push, 'call', _156 => _156(slot)]);
+    _optionalChain([this, 'access', _154 => _154.data, 'access', _155 => _155.slots, 'optionalAccess', _156 => _156.push, 'call', _157 => _157(slot)]);
     return this;
   }
   // ============================================================================
@@ -8188,7 +8227,7 @@ var WorkflowBuilder = class {
     }
   }
   validateSlotReferences() {
-    const slotIds = _nullishCoalesce(_optionalChain([this, 'access', _157 => _157.data, 'access', _158 => _158.slots, 'optionalAccess', _159 => _159.reduce, 'call', _160 => _160((set, s) => set.add(s.id), /* @__PURE__ */ new Set())]), () => ( /* @__PURE__ */ new Set()));
+    const slotIds = _nullishCoalesce(_optionalChain([this, 'access', _158 => _158.data, 'access', _159 => _159.slots, 'optionalAccess', _160 => _160.reduce, 'call', _161 => _161((set, s) => set.add(s.id), /* @__PURE__ */ new Set())]), () => ( /* @__PURE__ */ new Set()));
     for (const node of Object.values(_nullishCoalesce(this.data.nodes, () => ( {})))) {
       if (node.type === "form") {
         const referencedSlots = /* @__PURE__ */ new Set();
@@ -8506,7 +8545,7 @@ var ObjectSchemaService = class extends BaseService {
   constructor(adapter, nativeRegistry, options) {
     super(adapter);
     this.nativeRegistry = nativeRegistry;
-    this.auditService = _optionalChain([options, 'optionalAccess', _161 => _161.auditService]);
+    this.auditService = _optionalChain([options, 'optionalAccess', _162 => _162.auditService]);
     this.bilateralValidationService = new BilateralValidationService(adapter, this);
   }
   /**
@@ -8749,7 +8788,7 @@ var ObjectSchemaService = class extends BaseService {
           resourceType: "attribute",
           resourceId: attributeId,
           resourceLabel: updatedDbAttr.label,
-          objectName: _optionalChain([dbObject, 'optionalAccess', _162 => _162.name]),
+          objectName: _optionalChain([dbObject, 'optionalAccess', _163 => _163.name]),
           objectId: dbAttr.objectId,
           changes
         });
@@ -8782,7 +8821,7 @@ var ObjectSchemaService = class extends BaseService {
       );
     }
     const dbObject = await this.adapter.objects.findById(dbAttr.objectId);
-    if (_optionalChain([dbObject, 'optionalAccess', _163 => _163.labelExpression])) {
+    if (_optionalChain([dbObject, 'optionalAccess', _164 => _164.labelExpression])) {
       const usedAttributes = extractAttributeNames(dbObject.labelExpression);
       if (usedAttributes.includes(dbAttr.name)) {
         throw new AttributeInUseError(dbAttr.name, "labelExpression");
@@ -8798,7 +8837,7 @@ var ObjectSchemaService = class extends BaseService {
         resourceType: "attribute",
         resourceId: attributeId,
         resourceLabel: dbAttr.label,
-        objectName: _optionalChain([dbObject, 'optionalAccess', _164 => _164.name]),
+        objectName: _optionalChain([dbObject, 'optionalAccess', _165 => _165.name]),
         objectId: dbAttr.objectId
       });
     }
@@ -8813,9 +8852,9 @@ var ObjectSchemaService = class extends BaseService {
   async listAttributes(objectId, options) {
     const dbAttributes = await this.adapter.attributes.findByObjectId(objectId);
     let filtered = dbAttributes;
-    if (_optionalChain([options, 'optionalAccess', _165 => _165.systemOnly])) {
+    if (_optionalChain([options, 'optionalAccess', _166 => _166.systemOnly])) {
       filtered = dbAttributes.filter((attr) => attr.system);
-    } else if (_optionalChain([options, 'optionalAccess', _166 => _166.customOnly])) {
+    } else if (_optionalChain([options, 'optionalAccess', _167 => _167.customOnly])) {
       filtered = dbAttributes.filter((attr) => !attr.system);
     }
     return filtered.map((attr) => this.convertDBAttributeToAttribute(attr));
@@ -8851,14 +8890,14 @@ var ObjectSchemaService = class extends BaseService {
       pluralLabel: dbObject.pluralLabel,
       description: dbObject.description,
       labelExpression: dbObject.labelExpression,
-      icon: _optionalChain([dbObject, 'access', _167 => _167.metadata, 'optionalAccess', _168 => _168.icon])
+      icon: _optionalChain([dbObject, 'access', _168 => _168.metadata, 'optionalAccess', _169 => _169.icon])
     };
     let metadata = dbObject.metadata;
     if (updates.icon !== void 0 || updates.metadata !== void 0) {
       metadata = {
         ...dbObject.metadata,
         ...updates.metadata,
-        icon: _nullishCoalesce(updates.icon, () => ( _optionalChain([dbObject, 'access', _169 => _169.metadata, 'optionalAccess', _170 => _170.icon])))
+        icon: _nullishCoalesce(updates.icon, () => ( _optionalChain([dbObject, 'access', _170 => _170.metadata, 'optionalAccess', _171 => _171.icon])))
       };
     }
     const updatedDbObject = await this.adapter.objects.update(objectId, {
@@ -9101,7 +9140,7 @@ Reserved names: ${RESERVED_ATTRIBUTE_NAMES.join(", ")}`
       let properties = inverseDbAttr.config.properties;
       if (!properties) {
         const nativeObj = this.nativeRegistry.getByName(bilateral.object);
-        const nativeAttr = _optionalChain([nativeObj, 'optionalAccess', _171 => _171.attributes, 'access', _172 => _172.find, 'call', _173 => _173((a) => a.name === bilateral.attribute)]);
+        const nativeAttr = _optionalChain([nativeObj, 'optionalAccess', _172 => _172.attributes, 'access', _173 => _173.find, 'call', _174 => _174((a) => a.name === bilateral.attribute)]);
         if (nativeAttr && "properties" in nativeAttr) {
           properties = nativeAttr.properties;
         }
@@ -9190,7 +9229,7 @@ Reserved names: ${RESERVED_ATTRIBUTE_NAMES.join(", ")}`
       label: dbObject.label,
       pluralLabel: dbObject.pluralLabel,
       description: dbObject.description,
-      icon: _optionalChain([dbObject, 'access', _174 => _174.metadata, 'optionalAccess', _175 => _175.icon]),
+      icon: _optionalChain([dbObject, 'access', _175 => _175.metadata, 'optionalAccess', _176 => _176.icon]),
       labelExpression: dbObject.labelExpression,
       attributes,
       system: dbObject.system,
@@ -9290,7 +9329,7 @@ Reserved names: ${RESERVED_ATTRIBUTE_NAMES.join(", ")}`
       const hasRelationToTarget = attrs.some((attr) => {
         if (attr.type !== "relation") return false;
         const config = attr.config;
-        return _nullishCoalesce(_optionalChain([config, 'optionalAccess', _176 => _176.targets, 'optionalAccess', _177 => _177.some, 'call', _178 => _178((t) => t.object === targetObjectName)]), () => ( false));
+        return _nullishCoalesce(_optionalChain([config, 'optionalAccess', _177 => _177.targets, 'optionalAccess', _178 => _178.some, 'call', _179 => _179((t) => t.object === targetObjectName)]), () => ( false));
       });
       if (hasRelationToTarget) {
         referencing.push(obj.name);
@@ -9368,7 +9407,7 @@ Native objects must have system=true. Did you forget to call .system() in your b
       const existing = this.objects.get(object2.name);
       throw new Error(
         `[NativeObjectRegistry] Duplicate object name "${object2.name}":
-  - Existing: "${_optionalChain([existing, 'optionalAccess', _179 => _179.label])}" (id: ${_optionalChain([existing, 'optionalAccess', _180 => _180.id])})
+  - Existing: "${_optionalChain([existing, 'optionalAccess', _180 => _180.label])}" (id: ${_optionalChain([existing, 'optionalAccess', _181 => _181.id])})
   - New: "${object2.label}" (id: ${object2.id})
 Please use unique names for each native object.`
       );
@@ -9485,7 +9524,7 @@ var AuditService = class extends BaseService {
     this.isFlushing = false;
     /** Pending flush promise to allow waiting on concurrent flush */
     this.flushPromise = null;
-    if (_optionalChain([options, 'optionalAccess', _181 => _181.async]) && options.flushIntervalMs) {
+    if (_optionalChain([options, 'optionalAccess', _182 => _182.async]) && options.flushIntervalMs) {
       this.startFlushTimer();
     }
   }
@@ -9682,7 +9721,7 @@ var AuditService = class extends BaseService {
     if (!this.adapter.audit) {
       return;
     }
-    if (_optionalChain([this, 'access', _182 => _182.options, 'optionalAccess', _183 => _183.async])) {
+    if (_optionalChain([this, 'access', _183 => _183.options, 'optionalAccess', _184 => _184.async])) {
       this.buffer.push(entry);
       const batchSize = _nullishCoalesce(this.options.batchSize, () => ( 10));
       if (this.buffer.length >= batchSize) {
@@ -9696,7 +9735,7 @@ var AuditService = class extends BaseService {
    * Start the flush timer for async mode
    */
   startFlushTimer() {
-    const intervalMs = _nullishCoalesce(_optionalChain([this, 'access', _184 => _184.options, 'optionalAccess', _185 => _185.flushIntervalMs]), () => ( 1e3));
+    const intervalMs = _nullishCoalesce(_optionalChain([this, 'access', _185 => _185.options, 'optionalAccess', _186 => _186.flushIntervalMs]), () => ( 1e3));
     this.flushTimer = setInterval(() => {
       this.flush().catch(() => {
       });
@@ -9726,7 +9765,7 @@ var browserStub4 = {
   run: (_store, callback) => callback()
 };
 var AsyncLocalStorageClass4 = null;
-if (typeof process !== "undefined" && _optionalChain([process, 'access', _186 => _186.versions, 'optionalAccess', _187 => _187.node])) {
+if (typeof process !== "undefined" && _optionalChain([process, 'access', _187 => _187.versions, 'optionalAccess', _188 => _188.node])) {
   try {
     if (typeof _chunk3RG5ZIWIjs.__require !== "undefined") {
       const asyncHooks = _chunk3RG5ZIWIjs.__require.call(void 0, "async_hooks");
@@ -9785,7 +9824,7 @@ var BilateralSyncService = class extends BaseService {
     }
     const ctx = getSyncContext().getStore();
     const syncKey = `${sourceSchema.name}:${sourceRecordId}:${attributeName}`;
-    if (_optionalChain([ctx, 'optionalAccess', _188 => _188.syncing, 'access', _189 => _189.has, 'call', _190 => _190(syncKey)])) {
+    if (_optionalChain([ctx, 'optionalAccess', _189 => _189.syncing, 'access', _190 => _190.has, 'call', _191 => _191(syncKey)])) {
       return;
     }
     await this.runWithSyncContext(syncKey, async () => {
@@ -10010,7 +10049,7 @@ var BilateralSyncService = class extends BaseService {
     const storage = getSyncContext();
     const existingCtx = storage.getStore();
     const ctx = {
-      syncing: new Set(_nullishCoalesce(_optionalChain([existingCtx, 'optionalAccess', _191 => _191.syncing]), () => ( [])))
+      syncing: new Set(_nullishCoalesce(_optionalChain([existingCtx, 'optionalAccess', _192 => _192.syncing]), () => ( [])))
     };
     ctx.syncing.add(syncKey);
     return await storage.run(ctx, fn);
@@ -10072,6 +10111,21 @@ var UserService = class extends BaseService {
     }
     const users = await this.adapter.userProfiles.findByIds([...allIds]);
     const userMap = new Map(users.map((u) => [u.id, u]));
+    const allAllowedRoles = /* @__PURE__ */ new Set();
+    for (const [, { attr }] of attrIdMap) {
+      if (attr.allowedRoles && attr.allowedRoles.length > 0) {
+        for (const role of attr.allowedRoles) {
+          allAllowedRoles.add(role);
+        }
+      }
+    }
+    let userRolesMap;
+    if (allAllowedRoles.size > 0) {
+      const usersWithRoles = await this.adapter.userProfiles.getUsersWithRoles({
+        allowedRoles: [...allAllowedRoles]
+      });
+      userRolesMap = new Map(usersWithRoles.map((u) => [u.id, u.roles.map((r) => r.name)]));
+    }
     for (const [attrName, { attr, ids }] of attrIdMap) {
       const invalidIds = [];
       const roleErrors = [];
@@ -10085,8 +10139,10 @@ var UserService = class extends BaseService {
           invalidIds.push(id);
           continue;
         }
-        if (attr.allowedRoles && attr.allowedRoles.length > 0) {
-          if (!attr.allowedRoles.includes(user2.role)) {
+        if (attr.allowedRoles && attr.allowedRoles.length > 0 && userRolesMap) {
+          const userRoleNames = _nullishCoalesce(userRolesMap.get(id), () => ( []));
+          const hasAllowedRole = attr.allowedRoles.some((role) => userRoleNames.includes(role));
+          if (!hasAllowedRole) {
             roleErrors.push(id);
           }
         }
@@ -10101,7 +10157,7 @@ var UserService = class extends BaseService {
       if (roleErrors.length > 0) {
         errors.push({
           attribute: attrName,
-          message: `Users do not have required role for ${attr.label}. Allowed roles: ${_optionalChain([attr, 'access', _192 => _192.allowedRoles, 'optionalAccess', _193 => _193.join, 'call', _194 => _194(", ")])}`,
+          message: `Users do not have required role for ${attr.label}. Allowed roles: ${_optionalChain([attr, 'access', _193 => _193.allowedRoles, 'optionalAccess', _194 => _194.join, 'call', _195 => _195(", ")])}`,
           invalidIds: roleErrors
         });
       }
@@ -10625,7 +10681,7 @@ var RelationPropertiesService = class extends BaseService {
         }
       }
     }
-    const shouldStoreAsInverse = _optionalChain([attribute, 'access', _195 => _195.bilateral, 'optionalAccess', _196 => _196.storageOwner]) === false;
+    const shouldStoreAsInverse = _optionalChain([attribute, 'access', _196 => _196.bilateral, 'optionalAccess', _197 => _197.storageOwner]) === false;
     let storageFromObject = schema.name;
     let storageFromAttribute = attributeName;
     if (shouldStoreAsInverse && attribute.bilateral) {
@@ -10637,7 +10693,7 @@ var RelationPropertiesService = class extends BaseService {
       if (shouldStoreAsInverse) {
         const results = await Promise.all(
           normalized.map(
-            (item) => _optionalChain([adapter, 'access', _197 => _197.relationAttributes, 'optionalAccess', _198 => _198.findBySource, 'call', _199 => _199(
+            (item) => _optionalChain([adapter, 'access', _198 => _198.relationAttributes, 'optionalAccess', _199 => _199.findBySource, 'call', _200 => _200(
               storageFromObject,
               item.id,
               storageFromAttribute
@@ -10776,7 +10832,7 @@ var RecordQueryService = class extends BaseService {
     super(adapter);
     this.schemaService = schemaService;
     this.options = options;
-    this.policyRegistry = _optionalChain([options, 'optionalAccess', _200 => _200.policyRegistry]) === null ? null : _nullishCoalesce(_optionalChain([options, 'optionalAccess', _201 => _201.policyRegistry]), () => ( defaultPolicyRegistry));
+    this.policyRegistry = _optionalChain([options, 'optionalAccess', _201 => _201.policyRegistry]) === null ? null : _nullishCoalesce(_optionalChain([options, 'optionalAccess', _202 => _202.policyRegistry]), () => ( defaultPolicyRegistry));
     this.relationPropertiesService = new RelationPropertiesService(adapter);
   }
   // ============================================================================
@@ -10827,12 +10883,12 @@ var RecordQueryService = class extends BaseService {
    * Internal list query execution
    */
   async executeListQuery(schema, objectId, options) {
-    if (_optionalChain([this, 'access', _202 => _202.options, 'optionalAccess', _203 => _203.permissionService]) && this.userId) {
+    if (_optionalChain([this, 'access', _203 => _203.options, 'optionalAccess', _204 => _204.permissionService]) && this.userId) {
       await checkPermission(this.options.permissionService, this.userId, schema.name, "read");
     }
-    const policy = _optionalChain([options, 'optionalAccess', _204 => _204.skipPolicyFilter]) ? void 0 : getPolicy(this.policyRegistry, this.userId, schema.name);
+    const policy = _optionalChain([options, 'optionalAccess', _205 => _205.skipPolicyFilter]) ? void 0 : getPolicy(this.policyRegistry, this.userId, schema.name);
     let effectiveOptions = options;
-    if (_optionalChain([policy, 'optionalAccess', _205 => _205.applyListFilter]) && this.userId) {
+    if (_optionalChain([policy, 'optionalAccess', _206 => _206.applyListFilter]) && this.userId) {
       const ctx = buildPolicyContext(schema.name, this.userId, this.tenantId);
       effectiveOptions = policy.applyListFilter(ctx, options);
     }
@@ -10842,10 +10898,10 @@ var RecordQueryService = class extends BaseService {
     );
     let filteredRecords = result.records;
     let effectiveTotal = result.total;
-    if (_optionalChain([policy, 'optionalAccess', _206 => _206.canAccessRecord]) && this.userId) {
+    if (_optionalChain([policy, 'optionalAccess', _207 => _207.canAccessRecord]) && this.userId) {
       const ctx = buildPolicyContext(schema.name, this.userId, this.tenantId);
-      const requestedLimit = _nullishCoalesce(_optionalChain([effectiveOptions, 'optionalAccess', _207 => _207.limit]), () => ( 20));
-      const requestedOffset = _nullishCoalesce(_optionalChain([effectiveOptions, 'optionalAccess', _208 => _208.offset]), () => ( 0));
+      const requestedLimit = _nullishCoalesce(_optionalChain([effectiveOptions, 'optionalAccess', _208 => _208.limit]), () => ( 20));
+      const requestedOffset = _nullishCoalesce(_optionalChain([effectiveOptions, 'optionalAccess', _209 => _209.offset]), () => ( 0));
       const overfetchMultiplier = 5;
       const batchSize = requestedLimit * overfetchMultiplier;
       const maxScanRecords = 1e4;
@@ -10867,7 +10923,7 @@ var RecordQueryService = class extends BaseService {
           exhausted = true;
           break;
         }
-        const filtered = batch.records.filter((record) => _optionalChain([policy, 'access', _209 => _209.canAccessRecord, 'optionalCall', _210 => _210(ctx, record)]));
+        const filtered = batch.records.filter((record) => _optionalChain([policy, 'access', _210 => _210.canAccessRecord, 'optionalCall', _211 => _211(ctx, record)]));
         collected.push(...filtered);
         dbOffset += batch.records.length;
         totalScanned += batch.records.length;
@@ -10883,7 +10939,7 @@ var RecordQueryService = class extends BaseService {
       filteredRecords,
       schema
     );
-    if (!_optionalChain([options, 'optionalAccess', _211 => _211.skipFormulas])) {
+    if (!_optionalChain([options, 'optionalAccess', _212 => _212.skipFormulas])) {
       return {
         records: enrichRecordsWithFormulas(filteredRecords, schema),
         total: effectiveTotal
@@ -10943,7 +10999,7 @@ var RecordQueryService = class extends BaseService {
    * Internal search query execution
    */
   async executeSearchQuery(schema, objectId, query, options) {
-    if (_optionalChain([this, 'access', _212 => _212.options, 'optionalAccess', _213 => _213.permissionService]) && this.userId) {
+    if (_optionalChain([this, 'access', _213 => _213.options, 'optionalAccess', _214 => _214.permissionService]) && this.userId) {
       await checkPermission(this.options.permissionService, this.userId, schema.name, "read");
     }
     const result = await runWithSchemaContext(
@@ -10954,7 +11010,7 @@ var RecordQueryService = class extends BaseService {
       result.records,
       schema
     );
-    if (!_optionalChain([options, 'optionalAccess', _214 => _214.skipFormulas])) {
+    if (!_optionalChain([options, 'optionalAccess', _215 => _215.skipFormulas])) {
       return {
         records: enrichRecordsWithFormulas(enrichedRecords, schema),
         total: result.total
@@ -11137,7 +11193,7 @@ var RelationService = class extends BaseService {
     }
     const isUniversal = attr.targets.length === 1 && attr.targets[0].object === RELATION_TARGET_ANY;
     const validObjectIds = isUniversal ? null : await this.getValidObjectIds(attr.targets);
-    if (!isUniversal && _optionalChain([validObjectIds, 'optionalAccess', _215 => _215.size]) === 0) {
+    if (!isUniversal && _optionalChain([validObjectIds, 'optionalAccess', _216 => _216.size]) === 0) {
       errors.push({
         attribute: attr.name,
         message: `No valid target objects found for ${attr.label}`
@@ -11190,7 +11246,7 @@ var RelationService = class extends BaseService {
     for (const target of targets) {
       try {
         const objectSchema = await this.schemaService.getObjectSchemaByName(target.object);
-        if (_optionalChain([objectSchema, 'optionalAccess', _216 => _216.id])) {
+        if (_optionalChain([objectSchema, 'optionalAccess', _217 => _217.id])) {
           objectIds.add(objectSchema.id);
         }
       } catch (e15) {
@@ -11259,7 +11315,7 @@ var RelationService = class extends BaseService {
     const targetResults = await Promise.all(
       filteredTargets.map(async (target) => {
         const objectSchema = await this.schemaService.getObjectSchemaByName(target.object);
-        if (!_optionalChain([objectSchema, 'optionalAccess', _217 => _217.id])) return { options: [], total: 0 };
+        if (!_optionalChain([objectSchema, 'optionalAccess', _218 => _218.id])) return { options: [], total: 0 };
         const objectId = objectSchema.id;
         const result = query ? await queryService.searchRecords(objectId, query, queryOptions) : await queryService.listRecords(objectId, queryOptions);
         const options = await Promise.all(
@@ -11416,8 +11472,8 @@ var RelationService = class extends BaseService {
         continue;
       }
       const attribute = attributeMap.get(attributeId);
-      const targetConfig = _optionalChain([attribute, 'optionalAccess', _218 => _218.targets, 'optionalAccess', _219 => _219.find, 'call', _220 => _220((t) => t.object === objectSchema.name)]);
-      const customTemplate = _optionalChain([targetConfig, 'optionalAccess', _221 => _221.displayTemplate]);
+      const targetConfig = _optionalChain([attribute, 'optionalAccess', _219 => _219.targets, 'optionalAccess', _220 => _220.find, 'call', _221 => _221((t) => t.object === objectSchema.name)]);
+      const customTemplate = _optionalChain([targetConfig, 'optionalAccess', _222 => _222.displayTemplate]);
       const label = await this.resolveLabel(record, objectSchema, customTemplate);
       resolved.push({
         _compositeId: compositeId,
@@ -11580,14 +11636,14 @@ var RollupService = class extends BaseService {
     const sourceSchema = getSchemaByNameFromContext(sourceObjectName);
     let sourceObjectId;
     let reverseRelationAttrName;
-    if (_optionalChain([sourceSchema, 'optionalAccess', _222 => _222.id])) {
+    if (_optionalChain([sourceSchema, 'optionalAccess', _223 => _223.id])) {
       sourceObjectId = sourceSchema.id;
       const reverseRelationAttr = sourceSchema.attributes.find((attr) => {
         if (attr.type !== "relation") return false;
         const relationConfig = attr;
-        return _optionalChain([relationConfig, 'optionalAccess', _223 => _223.targets, 'optionalAccess', _224 => _224.some, 'call', _225 => _225((t) => t.object === schema.name)]);
+        return _optionalChain([relationConfig, 'optionalAccess', _224 => _224.targets, 'optionalAccess', _225 => _225.some, 'call', _226 => _226((t) => t.object === schema.name)]);
       });
-      reverseRelationAttrName = _optionalChain([reverseRelationAttr, 'optionalAccess', _226 => _226.name]);
+      reverseRelationAttrName = _optionalChain([reverseRelationAttr, 'optionalAccess', _227 => _227.name]);
     } else {
       const sourceObject = await this.adapter.objects.findByName(sourceObjectName);
       if (!sourceObject) {
@@ -11598,9 +11654,9 @@ var RollupService = class extends BaseService {
       const reverseRelationAttr = sourceAttributes.find((attr) => {
         if (attr.type !== "relation") return false;
         const relationConfig = attr.config;
-        return _optionalChain([relationConfig, 'optionalAccess', _227 => _227.targets, 'optionalAccess', _228 => _228.some, 'call', _229 => _229((t) => t.object === schema.name)]);
+        return _optionalChain([relationConfig, 'optionalAccess', _228 => _228.targets, 'optionalAccess', _229 => _229.some, 'call', _230 => _230((t) => t.object === schema.name)]);
       });
-      reverseRelationAttrName = _optionalChain([reverseRelationAttr, 'optionalAccess', _230 => _230.name]);
+      reverseRelationAttrName = _optionalChain([reverseRelationAttr, 'optionalAccess', _231 => _231.name]);
     }
     if (!reverseRelationAttrName) {
       return { value: null, recordCount: 0 };
@@ -11856,13 +11912,13 @@ var RollupService = class extends BaseService {
       if (!obj) continue;
       for (const rollupDbAttr of rollupAttrs) {
         const rollupConfig = rollupDbAttr.config;
-        if (!_optionalChain([rollupConfig, 'optionalAccess', _231 => _231.relationAttribute])) continue;
+        if (!_optionalChain([rollupConfig, 'optionalAccess', _232 => _232.relationAttribute])) continue;
         const relationAttr = attributes.find(
           (a) => a.type === "relation" && a.name === rollupConfig.relationAttribute
         );
         if (!relationAttr) continue;
         const relationConfig = relationAttr.config;
-        const targetsChangedObject = _optionalChain([relationConfig, 'optionalAccess', _232 => _232.targets, 'optionalAccess', _233 => _233.some, 'call', _234 => _234(
+        const targetsChangedObject = _optionalChain([relationConfig, 'optionalAccess', _233 => _233.targets, 'optionalAccess', _234 => _234.some, 'call', _235 => _235(
           (t) => t.object === changedSchema.name
         )]);
         if (!targetsChangedObject) continue;
@@ -11887,11 +11943,11 @@ var RecordService = class extends BaseService {
   constructor(adapter, options) {
     super(adapter);
     this.schemaService = new ObjectSchemaService(adapter, registry, {
-      auditService: _optionalChain([options, 'optionalAccess', _235 => _235.auditService])
+      auditService: _optionalChain([options, 'optionalAccess', _236 => _236.auditService])
     });
-    this.permissionService = _optionalChain([options, 'optionalAccess', _236 => _236.permissionService]);
-    this.auditService = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _237 => _237.auditService]), () => ( (adapter.audit ? new AuditService(adapter) : void 0)));
-    this.policyRegistry = _optionalChain([options, 'optionalAccess', _238 => _238.policyRegistry]) === null ? null : _nullishCoalesce(_optionalChain([options, 'optionalAccess', _239 => _239.policyRegistry]), () => ( defaultPolicyRegistry));
+    this.permissionService = _optionalChain([options, 'optionalAccess', _237 => _237.permissionService]);
+    this.auditService = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _238 => _238.auditService]), () => ( (adapter.audit ? new AuditService(adapter) : void 0)));
+    this.policyRegistry = _optionalChain([options, 'optionalAccess', _239 => _239.policyRegistry]) === null ? null : _nullishCoalesce(_optionalChain([options, 'optionalAccess', _240 => _240.policyRegistry]), () => ( defaultPolicyRegistry));
     this.recordResolver = new RecordResolverService(adapter);
     this.queryService = new RecordQueryService(adapter, this.schemaService, {
       permissionService: this.permissionService,
@@ -11906,7 +11962,7 @@ var RecordService = class extends BaseService {
       recordResolver: this.recordResolver
     });
     this.userService = new UserService(adapter);
-    this.hookRegistry = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _240 => _240.hookRegistry]), () => ( new NoopHookRegistry()));
+    this.hookRegistry = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _241 => _241.hookRegistry]), () => ( new NoopHookRegistry()));
     this.bilateralSyncService = new BilateralSyncService(
       adapter,
       this.schemaService,
@@ -11946,25 +12002,25 @@ var RecordService = class extends BaseService {
       schema,
       this.tenantId,
       dataWithDefaults,
-      _optionalChain([options, 'optionalAccess', _241 => _241.hookMetadata])
+      _optionalChain([options, 'optionalAccess', _242 => _242.hookMetadata])
     );
-    if (!_optionalChain([options, 'optionalAccess', _242 => _242.skipHooks])) {
+    if (!_optionalChain([options, 'optionalAccess', _243 => _243.skipHooks])) {
       await this.hookRegistry.execute("beforeCreate", schema.name, hookCtx);
     }
     const normalizedData = this.relationPropertiesService.normalizeRelationValuesForStorage(
       schema,
       dataWithDefaults
     );
-    if (_optionalChain([options, 'optionalAccess', _243 => _243.validate]) !== false) {
-      if (_optionalChain([options, 'optionalAccess', _244 => _244.allowDraft])) {
+    if (_optionalChain([options, 'optionalAccess', _244 => _244.validate]) !== false) {
+      if (_optionalChain([options, 'optionalAccess', _245 => _245.allowDraft])) {
         _chunk3WTK7ESHjs.validateDraftOrThrow.call(void 0, schema, normalizedData);
       } else {
         _chunk3WTK7ESHjs.validateObjectOrThrow.call(void 0, schema, normalizedData);
       }
-      if (!_optionalChain([options, 'optionalAccess', _245 => _245.skipRelationValidation])) {
+      if (!_optionalChain([options, 'optionalAccess', _246 => _246.skipRelationValidation])) {
         await this.relationService.validateRelationsOrThrow(schema, normalizedData);
       }
-      if (!_optionalChain([options, 'optionalAccess', _246 => _246.skipUserValidation])) {
+      if (!_optionalChain([options, 'optionalAccess', _247 => _247.skipUserValidation])) {
         await this.userService.validateUsersOrThrow(schema, normalizedData);
       }
     }
@@ -11975,12 +12031,12 @@ var RecordService = class extends BaseService {
       data: normalizedData,
       label,
       completionStatus,
-      metadata: _optionalChain([options, 'optionalAccess', _247 => _247.metadata]),
+      metadata: _optionalChain([options, 'optionalAccess', _248 => _248.metadata]),
       createdBy: this.userId
     });
     for (const [attrName, value] of Object.entries(dataWithDefaults)) {
       const attr = schema.attributes.find((a) => a.name === attrName);
-      if (_optionalChain([attr, 'optionalAccess', _248 => _248.type]) === "relation") {
+      if (_optionalChain([attr, 'optionalAccess', _249 => _249.type]) === "relation") {
         const hasProperties2 = attr.properties !== void 0;
         const isBilateral = isBilateralRelation(attr);
         if (hasProperties2 || isBilateral) {
@@ -11996,7 +12052,7 @@ var RecordService = class extends BaseService {
     }
     for (const [attrName, value] of Object.entries(normalizedData)) {
       const attr = schema.attributes.find((a) => a.name === attrName);
-      if (_optionalChain([attr, 'optionalAccess', _249 => _249.type]) === "relation" && isBilateralRelation(attr)) {
+      if (_optionalChain([attr, 'optionalAccess', _250 => _250.type]) === "relation" && isBilateralRelation(attr)) {
         await this.bilateralSyncService.syncBilateralRelation(
           schema,
           record.id,
@@ -12007,7 +12063,7 @@ var RecordService = class extends BaseService {
         );
       }
     }
-    if (!_optionalChain([options, 'optionalAccess', _250 => _250.skipHooks])) {
+    if (!_optionalChain([options, 'optionalAccess', _251 => _251.skipHooks])) {
       const afterCtx = {
         ...hookCtx,
         recordId: record.id,
@@ -12025,7 +12081,7 @@ var RecordService = class extends BaseService {
         objectId: schema.id,
         recordId: record.id,
         recordLabel: record.label,
-        metadata: _optionalChain([options, 'optionalAccess', _251 => _251.hookMetadata])
+        metadata: _optionalChain([options, 'optionalAccess', _252 => _252.hookMetadata])
       }).catch(() => {
       });
     }
@@ -12048,7 +12104,7 @@ var RecordService = class extends BaseService {
       return null;
     }
     const schema = await this.schemaService.getObjectSchema(record.objectId);
-    if (!_optionalChain([options, 'optionalAccess', _252 => _252.skipPolicyCheck])) {
+    if (!_optionalChain([options, 'optionalAccess', _253 => _253.skipPolicyCheck])) {
       const policy = getPolicy(this.policyRegistry, this.userId, schema.name);
       if (policy) {
         const ctx = buildPolicyContext(schema.name, this.userId, this.tenantId);
@@ -12058,11 +12114,11 @@ var RecordService = class extends BaseService {
       }
     }
     let enrichedRecord = record;
-    if (!_optionalChain([options, 'optionalAccess', _253 => _253.skipFormulas])) {
+    if (!_optionalChain([options, 'optionalAccess', _254 => _254.skipFormulas])) {
       enrichedRecord = enrichWithFormulas(record, schema);
     }
     enrichedRecord = await this.enrichRelationProperties(enrichedRecord, schema);
-    if (_optionalChain([options, 'optionalAccess', _254 => _254.includeSchema])) {
+    if (_optionalChain([options, 'optionalAccess', _255 => _255.includeSchema])) {
       const recordWithSchema = enrichedRecord;
       recordWithSchema.schema = schema;
       return recordWithSchema;
@@ -12124,9 +12180,9 @@ var RecordService = class extends BaseService {
       existing,
       mergedData,
       changedAttributes,
-      _optionalChain([options, 'optionalAccess', _255 => _255.hookMetadata])
+      _optionalChain([options, 'optionalAccess', _256 => _256.hookMetadata])
     );
-    if (!_optionalChain([options, 'optionalAccess', _256 => _256.skipHooks])) {
+    if (!_optionalChain([options, 'optionalAccess', _257 => _257.skipHooks])) {
       await this.hookRegistry.execute("beforeUpdate", schema.name, hookCtx);
     }
     const hookModifiedValues = {};
@@ -12141,16 +12197,16 @@ var RecordService = class extends BaseService {
       dataToUpdate
     );
     const normalizedMergedData = { ...existing.values, ...normalizedUpdate };
-    if (_optionalChain([options, 'optionalAccess', _257 => _257.validate]) !== false) {
-      if (_optionalChain([options, 'optionalAccess', _258 => _258.partial])) {
+    if (_optionalChain([options, 'optionalAccess', _258 => _258.validate]) !== false) {
+      if (_optionalChain([options, 'optionalAccess', _259 => _259.partial])) {
         _chunk3WTK7ESHjs.validateDraftOrThrow.call(void 0, schema, normalizedMergedData);
       } else {
         _chunk3WTK7ESHjs.validateObjectOrThrow.call(void 0, schema, normalizedMergedData);
       }
-      if (!_optionalChain([options, 'optionalAccess', _259 => _259.skipRelationValidation])) {
+      if (!_optionalChain([options, 'optionalAccess', _260 => _260.skipRelationValidation])) {
         await this.relationService.validateRelationsOrThrow(schema, normalizedUpdate);
       }
-      if (!_optionalChain([options, 'optionalAccess', _260 => _260.skipUserValidation])) {
+      if (!_optionalChain([options, 'optionalAccess', _261 => _261.skipUserValidation])) {
         await this.userService.validateUsersOrThrow(schema, normalizedUpdate);
       }
     }
@@ -12163,7 +12219,7 @@ var RecordService = class extends BaseService {
       __lastUpdatedBy: this.userId,
       __expectedUpdatedAt: existing.updatedAt instanceof Date ? existing.updatedAt.toISOString() : existing.updatedAt
     };
-    if (_optionalChain([options, 'optionalAccess', _261 => _261.metadata]) !== void 0) {
+    if (_optionalChain([options, 'optionalAccess', _262 => _262.metadata]) !== void 0) {
       const existingMetadata = _nullishCoalesce(existing.metadata, () => ( {}));
       const mergedMetadata = { ...existingMetadata, ...options.metadata };
       const cleanedMetadata = Object.fromEntries(
@@ -12174,7 +12230,7 @@ var RecordService = class extends BaseService {
     const bilateralOldValues = {};
     for (const attrName of Object.keys(normalizedUpdate)) {
       const attr = schema.attributes.find((a) => a.name === attrName);
-      if (_optionalChain([attr, 'optionalAccess', _262 => _262.type]) === "relation" && isBilateralRelation(attr)) {
+      if (_optionalChain([attr, 'optionalAccess', _263 => _263.type]) === "relation" && isBilateralRelation(attr)) {
         bilateralOldValues[attrName] = existing.values[attrName];
       }
     }
@@ -12182,7 +12238,7 @@ var RecordService = class extends BaseService {
     await this.invalidateRecordCaches(recordId, existing.objectId);
     for (const [attrName, value] of Object.entries(dataToUpdate)) {
       const attr = schema.attributes.find((a) => a.name === attrName);
-      if (_optionalChain([attr, 'optionalAccess', _263 => _263.type]) === "relation") {
+      if (_optionalChain([attr, 'optionalAccess', _264 => _264.type]) === "relation") {
         const hasProperties2 = attr.properties !== void 0;
         const isBilateral = isBilateralRelation(attr);
         if (hasProperties2 || isBilateral) {
@@ -12198,7 +12254,7 @@ var RecordService = class extends BaseService {
     }
     for (const [attrName, value] of Object.entries(normalizedUpdate)) {
       const attr = schema.attributes.find((a) => a.name === attrName);
-      if (_optionalChain([attr, 'optionalAccess', _264 => _264.type]) === "relation" && isBilateralRelation(attr)) {
+      if (_optionalChain([attr, 'optionalAccess', _265 => _265.type]) === "relation" && isBilateralRelation(attr)) {
         const oldValue = bilateralOldValues[attrName];
         await this.bilateralSyncService.syncBilateralRelation(
           schema,
@@ -12209,7 +12265,7 @@ var RecordService = class extends BaseService {
         );
       }
     }
-    if (!_optionalChain([options, 'optionalAccess', _265 => _265.skipHooks])) {
+    if (!_optionalChain([options, 'optionalAccess', _266 => _266.skipHooks])) {
       const afterCtx = {
         ...hookCtx,
         record: updated
@@ -12224,7 +12280,7 @@ var RecordService = class extends BaseService {
     if (this.auditService && this.userId && allChangedAttributes.length > 0) {
       const changes = allChangedAttributes.map((attr) => ({
         field: attr,
-        oldValue: _optionalChain([hookCtx, 'access', _266 => _266.oldValues, 'optionalAccess', _267 => _267[attr]]),
+        oldValue: _optionalChain([hookCtx, 'access', _267 => _267.oldValues, 'optionalAccess', _268 => _268[attr]]),
         newValue: hookCtx.newValues[attr]
       }));
       this.auditService.logRecordAction({
@@ -12235,7 +12291,7 @@ var RecordService = class extends BaseService {
         recordId: updated.id,
         recordLabel: updated.label,
         changes,
-        metadata: _optionalChain([options, 'optionalAccess', _268 => _268.hookMetadata])
+        metadata: _optionalChain([options, 'optionalAccess', _269 => _269.hookMetadata])
       }).catch(() => {
       });
     }
@@ -12267,17 +12323,17 @@ var RecordService = class extends BaseService {
       const ctx = buildPolicyContext(schema.name, this.userId, this.tenantId);
       checkRecordDeleteOrThrow(policy, record, ctx);
     }
-    if (_optionalChain([options, 'optionalAccess', _269 => _269.checkSystem]) && schema.system) {
+    if (_optionalChain([options, 'optionalAccess', _270 => _270.checkSystem]) && schema.system) {
       throw new ProtectedResourceError("object", schema.name, "delete");
     }
-    if (!_optionalChain([options, 'optionalAccess', _270 => _270.skipReferenceCheck])) {
+    if (!_optionalChain([options, 'optionalAccess', _271 => _271.skipReferenceCheck])) {
       const references = await this.adapter.objectRecords.countRecordsReferencingId(recordId);
       if (references.length > 0) {
         throw new RecordReferencedError(recordId, references);
       }
     }
-    const hookCtx = createContextForDelete(schema, this.tenantId, record, _optionalChain([options, 'optionalAccess', _271 => _271.hookMetadata]));
-    if (!_optionalChain([options, 'optionalAccess', _272 => _272.skipHooks])) {
+    const hookCtx = createContextForDelete(schema, this.tenantId, record, _optionalChain([options, 'optionalAccess', _272 => _272.hookMetadata]));
+    if (!_optionalChain([options, 'optionalAccess', _273 => _273.skipHooks])) {
       await this.hookRegistry.execute("beforeDelete", schema.name, hookCtx);
     }
     for (const attr of schema.attributes) {
@@ -12295,7 +12351,7 @@ var RecordService = class extends BaseService {
     }
     await this.adapter.objectRecords.delete(recordId);
     await this.invalidateRecordCaches(recordId, record.objectId);
-    if (!_optionalChain([options, 'optionalAccess', _273 => _273.skipHooks])) {
+    if (!_optionalChain([options, 'optionalAccess', _274 => _274.skipHooks])) {
       await this.hookRegistry.execute("afterDelete", schema.name, hookCtx);
     }
     await recalculateParentRollups(record, schema, this.rollupContext);
@@ -12307,7 +12363,7 @@ var RecordService = class extends BaseService {
         objectId: schema.id,
         recordId: record.id,
         recordLabel: record.label,
-        metadata: _optionalChain([options, 'optionalAccess', _274 => _274.hookMetadata])
+        metadata: _optionalChain([options, 'optionalAccess', _275 => _275.hookMetadata])
       }).catch(() => {
       });
     }
@@ -12368,13 +12424,13 @@ var RecordService = class extends BaseService {
       this.tenantId
     );
     await checkPermission(this.permissionService, this.userId, schema.name, "update");
-    const hookCtx = createContextForRestore(schema, this.tenantId, record, _optionalChain([options, 'optionalAccess', _275 => _275.hookMetadata]));
-    if (!_optionalChain([options, 'optionalAccess', _276 => _276.skipHooks])) {
+    const hookCtx = createContextForRestore(schema, this.tenantId, record, _optionalChain([options, 'optionalAccess', _276 => _276.hookMetadata]));
+    if (!_optionalChain([options, 'optionalAccess', _277 => _277.skipHooks])) {
       await this.hookRegistry.execute("beforeRestore", schema.name, hookCtx);
     }
     const restored = await this.adapter.objectRecords.restore(recordId);
     await this.invalidateRecordCaches(recordId, record.objectId);
-    if (!_optionalChain([options, 'optionalAccess', _277 => _277.skipHooks])) {
+    if (!_optionalChain([options, 'optionalAccess', _278 => _278.skipHooks])) {
       const afterCtx = {
         ...hookCtx,
         record: restored
@@ -12389,7 +12445,7 @@ var RecordService = class extends BaseService {
         objectId: schema.id,
         recordId: restored.id,
         recordLabel: restored.label,
-        metadata: _optionalChain([options, 'optionalAccess', _278 => _278.hookMetadata])
+        metadata: _optionalChain([options, 'optionalAccess', _279 => _279.hookMetadata])
       }).catch(() => {
       });
     }
@@ -12820,7 +12876,7 @@ var DocumentRendererService = class {
       throw new StorageDownloadNotSupportedError();
     }
     let storagePath = fileId;
-    if (_optionalChain([this, 'access', _279 => _279.options, 'optionalAccess', _280 => _280.filesRepository])) {
+    if (_optionalChain([this, 'access', _280 => _280.options, 'optionalAccess', _281 => _281.filesRepository])) {
       const file2 = await this.options.filesRepository.findById(fileId);
       if (!file2) {
         throw new Error(`Template file not found: ${fileId}`);
@@ -12838,8 +12894,8 @@ var DocumentRendererService = class {
     for (const field of fields) {
       const rawValue = getContextValue(context, field.contextPath);
       const attrInfo = await this.getAttributeInfo(field.contextPath, workflow2);
-      if (_optionalChain([attrInfo, 'optionalAccess', _281 => _281.attribute])) {
-        if (attrInfo.attribute.type === "relation" && rawValue && _optionalChain([this, 'access', _282 => _282.options, 'optionalAccess', _283 => _283.relationService])) {
+      if (_optionalChain([attrInfo, 'optionalAccess', _282 => _282.attribute])) {
+        if (attrInfo.attribute.type === "relation" && rawValue && _optionalChain([this, 'access', _283 => _283.options, 'optionalAccess', _284 => _284.relationService])) {
           const ids = Array.isArray(rawValue) ? rawValue : [rawValue];
           const stringIds = ids.filter((id) => typeof id === "string");
           if (stringIds.length > 0) {
@@ -12860,7 +12916,7 @@ var DocumentRendererService = class {
         resolved.set(field.id, this.formatValueSimple(rawValue, field.fallback));
       }
     }
-    if (relationBatch.length > 0 && _optionalChain([this, 'access', _284 => _284.options, 'optionalAccess', _285 => _285.relationService])) {
+    if (relationBatch.length > 0 && _optionalChain([this, 'access', _285 => _285.options, 'optionalAccess', _286 => _286.relationService])) {
       try {
         const batchResult = await this.options.relationService.resolveIdsBatch(
           relationBatch.map((r) => ({ attributeId: r.attributeId, ids: r.ids }))
@@ -12869,12 +12925,12 @@ var DocumentRendererService = class {
           const options = _nullishCoalesce(batchResult[attributeId], () => ( []));
           const labels = options.map((o) => o.label);
           const field = fields.find((f) => f.id === fieldId);
-          resolved.set(fieldId, labels.join(", ") || _optionalChain([field, 'optionalAccess', _286 => _286.fallback]) || "");
+          resolved.set(fieldId, labels.join(", ") || _optionalChain([field, 'optionalAccess', _287 => _287.fallback]) || "");
         }
       } catch (e17) {
         for (const { fieldId, ids } of relationBatch) {
           const field = fields.find((f) => f.id === fieldId);
-          resolved.set(fieldId, ids.join(", ") || _optionalChain([field, 'optionalAccess', _287 => _287.fallback]) || "");
+          resolved.set(fieldId, ids.join(", ") || _optionalChain([field, 'optionalAccess', _288 => _288.fallback]) || "");
         }
       }
     }
@@ -12885,7 +12941,7 @@ var DocumentRendererService = class {
    * Parses paths like "slots.client.firstName" to find the attribute definition
    */
   async getAttributeInfo(contextPath, workflow2) {
-    const schemaService = _optionalChain([this, 'access', _288 => _288.options, 'optionalAccess', _289 => _289.schemaService]);
+    const schemaService = _optionalChain([this, 'access', _289 => _289.options, 'optionalAccess', _290 => _290.schemaService]);
     if (!schemaService) {
       return null;
     }
@@ -12898,7 +12954,7 @@ var DocumentRendererService = class {
     }
     const slotId = parts[1];
     const attributeName = parts[2];
-    const slot = _optionalChain([workflow2, 'access', _290 => _290.slots, 'optionalAccess', _291 => _291.find, 'call', _292 => _292((s) => s.id === slotId)]);
+    const slot = _optionalChain([workflow2, 'access', _291 => _291.slots, 'optionalAccess', _292 => _292.find, 'call', _293 => _293((s) => s.id === slotId)]);
     if (!slot) {
       return null;
     }
@@ -13097,7 +13153,7 @@ var DocumentProcessingHook = class extends BaseService {
     const pendingIds = [];
     for (const [nodeId, doc] of Object.entries(context.documents)) {
       const metadata = doc.metadata;
-      if (_optionalChain([metadata, 'optionalAccess', _293 => _293.status]) === "pending") {
+      if (_optionalChain([metadata, 'optionalAccess', _294 => _294.status]) === "pending") {
         pendingIds.push(nodeId);
       }
     }
@@ -13148,12 +13204,12 @@ var DocumentProcessingHook = class extends BaseService {
     }
     for (const slotId of targetSlotIds) {
       try {
-        const recordId = _optionalChain([context, 'access', _294 => _294.createdRecordIds, 'optionalAccess', _295 => _295[slotId]]);
+        const recordId = _optionalChain([context, 'access', _295 => _295.createdRecordIds, 'optionalAccess', _296 => _296[slotId]]);
         if (!recordId) {
           continue;
         }
-        const slotDef = _optionalChain([workflow2, 'access', _296 => _296.slots, 'optionalAccess', _297 => _297.find, 'call', _298 => _298((s) => s.id === slotId)]);
-        const objectName = _optionalChain([slotDef, 'optionalAccess', _299 => _299.objectName]);
+        const slotDef = _optionalChain([workflow2, 'access', _297 => _297.slots, 'optionalAccess', _298 => _298.find, 'call', _299 => _299((s) => s.id === slotId)]);
+        const objectName = _optionalChain([slotDef, 'optionalAccess', _300 => _300.objectName]);
         if (!objectName) {
           continue;
         }
@@ -13170,7 +13226,7 @@ var DocumentProcessingHook = class extends BaseService {
         attachedDocumentIds.push(result.document.id);
         const record = await recordService.getRecord(recordId);
         if (record) {
-          const attachments = _nullishCoalesce(_optionalChain([record, 'access', _300 => _300.values, 'optionalAccess', _301 => _301.attachments]), () => ( []));
+          const attachments = _nullishCoalesce(_optionalChain([record, 'access', _301 => _301.values, 'optionalAccess', _302 => _302.attachments]), () => ( []));
           await recordService.updateRecord(
             recordId,
             { attachments: [...attachments, result.document.id] },
@@ -13436,7 +13492,7 @@ var WorkflowAccessGrantService = class extends BaseService {
    * Check if a specific token has been revoked.
    */
   isTokenRevoked(dbGrant, jti) {
-    return _nullishCoalesce(_optionalChain([dbGrant, 'access', _302 => _302.revoked_token_jtis, 'optionalAccess', _303 => _303.includes, 'call', _304 => _304(jti)]), () => ( false));
+    return _nullishCoalesce(_optionalChain([dbGrant, 'access', _303 => _303.revoked_token_jtis, 'optionalAccess', _304 => _304.includes, 'call', _305 => _305(jti)]), () => ( false));
   }
   /**
    * Validate access token payload against the grant.
@@ -13488,10 +13544,10 @@ var WorkflowInstanceService = class extends BaseService {
   constructor(adapter, workflowService, options) {
     super(adapter);
     this.workflowService = workflowService;
-    this.executorRegistry = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _305 => _305.executorRegistry]), () => ( getDefaultExecutorRegistry()));
-    this.schemaService = _optionalChain([options, 'optionalAccess', _306 => _306.schemaService]);
-    this.recordService = _optionalChain([options, 'optionalAccess', _307 => _307.recordService]);
-    this.documentProcessingHook = _optionalChain([options, 'optionalAccess', _308 => _308.documentProcessingHook]);
+    this.executorRegistry = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _306 => _306.executorRegistry]), () => ( getDefaultExecutorRegistry()));
+    this.schemaService = _optionalChain([options, 'optionalAccess', _307 => _307.schemaService]);
+    this.recordService = _optionalChain([options, 'optionalAccess', _308 => _308.recordService]);
+    this.documentProcessingHook = _optionalChain([options, 'optionalAccess', _309 => _309.documentProcessingHook]);
   }
   /**
    * Start a new workflow instance
@@ -13673,7 +13729,7 @@ var WorkflowInstanceService = class extends BaseService {
     if (!this.adapter.workflowInstances) {
       return { instances: [], total: 0 };
     }
-    if (_optionalChain([options, 'optionalAccess', _309 => _309.workflowName])) {
+    if (_optionalChain([options, 'optionalAccess', _310 => _310.workflowName])) {
       const allDbInstances = await this.adapter.workflowInstances.findByWorkflowName(
         options.workflowName,
         { status: options.status }
@@ -13687,11 +13743,11 @@ var WorkflowInstanceService = class extends BaseService {
       return { instances: instances2, total: total2 };
     }
     const { instances: dbInstances, total } = await this.adapter.workflowInstances.list({
-      limit: _optionalChain([options, 'optionalAccess', _310 => _310.limit]),
-      offset: _optionalChain([options, 'optionalAccess', _311 => _311.offset])
+      limit: _optionalChain([options, 'optionalAccess', _311 => _311.limit]),
+      offset: _optionalChain([options, 'optionalAccess', _312 => _312.offset])
     });
     let instances = dbInstances.map((db) => this.convertDBInstanceToInstance(db));
-    if (_optionalChain([options, 'optionalAccess', _312 => _312.status])) {
+    if (_optionalChain([options, 'optionalAccess', _313 => _313.status])) {
       instances = instances.filter((i) => i.status === options.status);
     }
     instances = await this.markExpiredInstances(instances);
@@ -13712,9 +13768,9 @@ var WorkflowInstanceService = class extends BaseService {
       return { instances: [], total: 0 };
     }
     const { instances: dbInstances, total } = await this.adapter.workflowInstances.findByRecordInSlots(objectName, recordId, {
-      status: _optionalChain([options, 'optionalAccess', _313 => _313.status]),
-      limit: _optionalChain([options, 'optionalAccess', _314 => _314.limit]),
-      offset: _optionalChain([options, 'optionalAccess', _315 => _315.offset])
+      status: _optionalChain([options, 'optionalAccess', _314 => _314.status]),
+      limit: _optionalChain([options, 'optionalAccess', _315 => _315.limit]),
+      offset: _optionalChain([options, 'optionalAccess', _316 => _316.offset])
     });
     const instances = dbInstances.map((db) => this.convertDBInstanceToInstance(db));
     return { instances, total };
@@ -13780,7 +13836,7 @@ var WorkflowInstanceService = class extends BaseService {
         try {
           const schemas = await Promise.all(
             current.workflowSnapshot.slots.map(
-              (slot) => _optionalChain([this, 'access', _316 => _316.schemaService, 'optionalAccess', _317 => _317.getObjectSchemaByName, 'call', _318 => _318(slot.objectName)])
+              (slot) => _optionalChain([this, 'access', _317 => _317.schemaService, 'optionalAccess', _318 => _318.getObjectSchemaByName, 'call', _319 => _319(slot.objectName)])
             )
           );
           objectDefinitions = schemas.filter(
@@ -14045,8 +14101,8 @@ var WorkflowInstanceService = class extends BaseService {
    */
   async snapshotRecord(recordId) {
     try {
-      const record = await _optionalChain([this, 'access', _319 => _319.recordService, 'optionalAccess', _320 => _320.getRecord, 'call', _321 => _321(recordId, { skipPolicyCheck: true })]);
-      return _optionalChain([record, 'optionalAccess', _322 => _322.values]);
+      const record = await _optionalChain([this, 'access', _320 => _320.recordService, 'optionalAccess', _321 => _321.getRecord, 'call', _322 => _322(recordId, { skipPolicyCheck: true })]);
+      return _optionalChain([record, 'optionalAccess', _323 => _323.values]);
     } catch (e21) {
       return void 0;
     }
@@ -14065,13 +14121,13 @@ var WorkflowInstanceService = class extends BaseService {
     for (const op of [...operations].reverse()) {
       try {
         if (op.operation === "create") {
-          await _optionalChain([this, 'access', _323 => _323.recordService, 'optionalAccess', _324 => _324.deleteRecord, 'call', _325 => _325(op.recordId, {
+          await _optionalChain([this, 'access', _324 => _324.recordService, 'optionalAccess', _325 => _325.deleteRecord, 'call', _326 => _326(op.recordId, {
             skipHooks: true,
             skipReferenceCheck: true
           })]);
           rolledBack.push(op.slotId);
         } else if (op.operation === "update" && op.previousData) {
-          await _optionalChain([this, 'access', _326 => _326.recordService, 'optionalAccess', _327 => _327.updateRecord, 'call', _328 => _328(op.recordId, op.previousData, {
+          await _optionalChain([this, 'access', _327 => _327.recordService, 'optionalAccess', _328 => _328.updateRecord, 'call', _329 => _329(op.recordId, op.previousData, {
             partial: false
           })]);
           rolledBack.push(op.slotId);
@@ -14195,7 +14251,7 @@ var WorkflowInstanceService = class extends BaseService {
     if (!this.adapter.workflowInstances) {
       return;
     }
-    const currentVersion = _nullishCoalesce(_optionalChain([instance, 'access', _329 => _329.context, 'access', _330 => _330.variables, 'optionalAccess', _331 => _331.__version]), () => ( 0));
+    const currentVersion = _nullishCoalesce(_optionalChain([instance, 'access', _330 => _330.context, 'access', _331 => _331.variables, 'optionalAccess', _332 => _332.__version]), () => ( 0));
     const nextVersion = currentVersion + 1;
     const instanceWithVersion = {
       ...instance,
@@ -14476,7 +14532,7 @@ var WorkflowRelationService = class extends BaseService {
         if (attr.type !== "relation") continue;
         for (const slot of slots) {
           const slotData = context.slots[slot.id];
-          const slotRecordId = _optionalChain([slotData, 'optionalAccess', _332 => _332.id]);
+          const slotRecordId = _optionalChain([slotData, 'optionalAccess', _333 => _333.id]);
           if (!slotRecordId) continue;
           const targetsSlotObject = attr.targets.some(
             (t) => t.object === slot.objectName
@@ -14544,7 +14600,7 @@ var WorkflowService = class extends BaseService {
     if (Array.isArray(options)) {
       this.systemWorkflows = new Map(options.map((w) => [w.name, w]));
     } else {
-      this.systemWorkflows = new Map((_nullishCoalesce(_optionalChain([options, 'optionalAccess', _333 => _333.systemWorkflows]), () => ( []))).map((w) => [w.name, w]));
+      this.systemWorkflows = new Map((_nullishCoalesce(_optionalChain([options, 'optionalAccess', _334 => _334.systemWorkflows]), () => ( []))).map((w) => [w.name, w]));
     }
   }
   // ============================================================================
@@ -14842,7 +14898,7 @@ var WorkflowService = class extends BaseService {
 var UserProfileService = class extends BaseService {
   constructor(adapter, options) {
     super(adapter);
-    this.auditService = _optionalChain([options, 'optionalAccess', _334 => _334.auditService]);
+    this.auditService = _optionalChain([options, 'optionalAccess', _335 => _335.auditService]);
   }
   // ============================================================================
   // CACHE MANAGEMENT
@@ -14877,7 +14933,6 @@ var UserProfileService = class extends BaseService {
    *   email: authUser.email,
    *   firstName: authUser.user_metadata.first_name,
    *   lastName: authUser.user_metadata.last_name,
-   *   role: "member",
    *   status: "active"
    * });
    * ```
@@ -14956,7 +15011,6 @@ var UserProfileService = class extends BaseService {
    *   {
    *     authId: authUser.id,
    *     email: authUser.email,
-   *     role: "member",
    *     status: "active"
    *   }
    * );
@@ -14981,7 +15035,6 @@ var UserProfileService = class extends BaseService {
       const changes = buildAuditChanges(existing, data, [
         "firstName",
         "lastName",
-        "role",
         "status"
       ]);
       if (changes.length > 0) {
@@ -15005,11 +15058,13 @@ var UserProfileService = class extends BaseService {
    */
   async deleteProfile(profileId, options) {
     const profile = await this.getProfileOrThrow(profileId);
-    if (_optionalChain([options, 'optionalAccess', _335 => _335.checkAdmin])) {
-      if (profile.role === "admin") {
-        const adminCount = await this.adapter.userProfiles.countByRole("admin");
-        if (adminCount <= 1) {
-          throw new Error("Cannot delete the last admin user");
+    if (_optionalChain([options, 'optionalAccess', _336 => _336.checkAdmin]) && this.adapter.permissions) {
+      const ownerCount = await this.adapter.permissions.countUsersWithRole("owner");
+      if (ownerCount <= 1) {
+        const userRoles = await this.adapter.permissions.getUserRoles(profileId);
+        const isOwner = userRoles.some((r) => r.name === "owner");
+        if (isOwner) {
+          throw new Error("Cannot delete the last owner user");
         }
       }
     }
@@ -15045,15 +15100,6 @@ var UserProfileService = class extends BaseService {
   async updateLastLogin(profileId) {
     await this.adapter.userProfiles.updateLastLogin(profileId);
   }
-  /**
-   * Change user role
-   *
-   * @param profileId - Profile UUID
-   * @param newRole - New role
-   */
-  async changeRole(profileId, newRole) {
-    return await this.updateProfile(profileId, { role: newRole });
-  }
   /**
    * Change user status
    *
@@ -15075,19 +15121,6 @@ var UserProfileService = class extends BaseService {
       () => this.adapter.userProfiles.findByEmail(email)
     );
   }
-  /**
-   * Check if user has role
-   */
-  async hasRole(profileId, role) {
-    const profile = await this.getProfile(profileId);
-    return _optionalChain([profile, 'optionalAccess', _336 => _336.role]) === role;
-  }
-  /**
-   * Check if user is admin
-   */
-  async isAdmin(profileId) {
-    return await this.hasRole(profileId, "admin");
-  }
   /**
    * Invite a new user by email.
    *
@@ -15108,7 +15141,6 @@ var UserProfileService = class extends BaseService {
    *   email: "john@example.com",
    *   firstName: "John",
    *   lastName: "Doe",
-   *   role: "member",
    *   redirectTo: "https://app.example.com/welcome",
    * });
    * // Email sent automatically, profile.status === "pending"
@@ -17348,7 +17380,7 @@ var PermissionService = class extends BaseService {
       DEFAULT_ROLE_LABELS,
       DEFAULT_ROLE_DESCRIPTIONS,
       DEFAULT_ROLE_PERMISSIONS
-    } = await Promise.resolve().then(() => _interopRequireWildcard(require("./default-roles-C3FYDYMN.js")));
+    } = await Promise.resolve().then(() => _interopRequireWildcard(require("./default-roles-76HUWY6T.js")));
     const existingRoles = await this.getRoles();
     const existingRoleNames = existingRoles.reduce((set, r) => set.add(r.name), /* @__PURE__ */ new Set());
     for (const roleName of Object.values(DEFAULT_ROLES)) {