@stndrds/schema 1.0.0-alpha.72 → 1.0.0-alpha.74

package/dist/{chunk-INXFKM4S.mjs → chunk-KQMGNSDK.mjs}

@@ -13,6 +13,9 @@ import {
   validateObject,
   validateObjectOrThrow
 } from "./chunk-5SZ5OISG.mjs";
+import {
+  isAdminRole
+} from "./chunk-6P3NPTYV.mjs";
 import {
   __require
 } from "./chunk-Y6FXYEAI.mjs";
@@ -2138,7 +2141,7 @@ var EndExecutor = class {
     this.nodeType = "end";
   }
   execute(node, _context) {
-    return complete(node.status ?? "completed");
+    return complete(node.status || "completed");
   }
   canExecute(_node, _context) {
     return true;
@@ -2261,10 +2264,20 @@ var FormExecutor = class {
     const fieldRefs = this.collectFieldRefs(node);
     for (const fieldRef of fieldRefs) {
       const slot = slots.find((s) => s.id === fieldRef.slotId);
-      if (!slot) continue;
+      if (!slot) {
+        console.warn(
+          `[FormExecutor] Slot "${fieldRef.slotId}" not found in workflow definition, skipping validation`
+        );
+        continue;
+      }
       if (slot.mode === "select") continue;
       const object2 = objects.find((o) => o.name === slot.objectName);
-      if (!object2) continue;
+      if (!object2) {
+        console.warn(
+          `[FormExecutor] Object "${slot.objectName}" not found for slot "${fieldRef.slotId}", skipping validation`
+        );
+        continue;
+      }
       const attribute = object2.attributes.find((a) => a.name === fieldRef.attribute);
       if (!attribute?.required) continue;
       const slotInput = input[fieldRef.slotId];
@@ -2309,7 +2322,7 @@ var StartExecutor = class {
   }
   execute(node, _context) {
     if (!node.next) {
-      throw new Error(`StartNode "${node.id}" has no 'next' target defined`);
+      return error("MISSING_NEXT", `StartNode "${node.id}" has no 'next' target defined`);
     }
     return success(node.next);
   }
@@ -2523,13 +2536,11 @@ function hasRelationReferences(expression) {
   return regex.test(expression);
 }
 function flattenRelationsForEval(resolvedRelations) {
-  const flat = {};
+  const result = {};
   for (const [relationName, values] of Object.entries(resolvedRelations)) {
-    for (const [key, value] of Object.entries(values)) {
-      flat[`${relationName}.${key}`] = value;
-    }
+    result[relationName] = { ...values };
   }
-  return flat;
+  return result;
 }
 async function evaluateFormulaWithRelations(expression, record, schema, resolver) {
   const relationNames = extractRelationNames(expression);
@@ -2799,6 +2810,15 @@ function createMockAIConversationsRepository(stores) {
     },
     addMessage(input) {
       const now = /* @__PURE__ */ new Date();
+      const conversation = stores.aiConversations.get(input.conversationId);
+      if (!conversation) {
+        return Promise.reject(new Error("Conversation not found"));
+      }
+      const tenantId = getTenantId();
+      const userId = requireUserId();
+      if (conversation.tenantId !== tenantId || conversation.userId !== userId) {
+        return Promise.reject(new Error("Conversation not found or access denied"));
+      }
       const message = {
         id: generateId(),
         conversationId: input.conversationId,
@@ -2816,17 +2836,23 @@ function createMockAIConversationsRepository(stores) {
         createdAt: now
       };
       stores.aiMessages.set(message.id, message);
-      const conversation = stores.aiConversations.get(input.conversationId);
-      if (conversation) {
-        conversation.messageCount++;
-        conversation.totalTokens += (input.inputTokens ?? 0) + (input.outputTokens ?? 0);
-        conversation.totalCost += input.cost ?? 0;
-        conversation.updatedAt = now;
-        stores.aiConversations.set(input.conversationId, conversation);
-      }
+      conversation.messageCount++;
+      conversation.totalTokens += (input.inputTokens ?? 0) + (input.outputTokens ?? 0);
+      conversation.totalCost += input.cost ?? 0;
+      conversation.updatedAt = now;
+      stores.aiConversations.set(input.conversationId, conversation);
       return Promise.resolve(message);
     },
     listMessages(conversationId, options) {
+      const conversation = stores.aiConversations.get(conversationId);
+      if (!conversation) {
+        return Promise.resolve({ messages: [], total: 0 });
+      }
+      const tenantId = getTenantId();
+      const userId = requireUserId();
+      if (conversation.tenantId !== tenantId || conversation.userId !== userId) {
+        return Promise.resolve({ messages: [], total: 0 });
+      }
       let results = Array.from(stores.aiMessages.values()).filter((m) => m.conversationId === conversationId).sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());
       const total = results.length;
       if (options?.limit) {
@@ -2835,6 +2861,15 @@ function createMockAIConversationsRepository(stores) {
       return Promise.resolve({ messages: results, total });
     },
     getRecentMessages(conversationId, count = 20) {
+      const conversation = stores.aiConversations.get(conversationId);
+      if (!conversation) {
+        return Promise.resolve([]);
+      }
+      const tenantId = getTenantId();
+      const userId = requireUserId();
+      if (conversation.tenantId !== tenantId || conversation.userId !== userId) {
+        return Promise.resolve([]);
+      }
       const results = Array.from(stores.aiMessages.values()).filter((m) => m.conversationId === conversationId).sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime()).slice(-count);
       return Promise.resolve(results);
     }
@@ -3101,7 +3136,12 @@ function createMockFilesRepository(stores) {
 function createMockObjectsRepository(stores) {
   return {
     findById(id) {
-      return Promise.resolve(stores.objects.get(id) ?? null);
+      const tenantId = getTenantId();
+      const obj = stores.objects.get(id);
+      if (!obj || obj.tenantId !== tenantId) {
+        return Promise.resolve(null);
+      }
+      return Promise.resolve(obj);
     },
     findByName(name) {
       const tenantId = getTenantId();
@@ -3141,8 +3181,9 @@ function createMockObjectsRepository(stores) {
       return Promise.resolve(obj);
     },
     update(id, data) {
+      const tenantId = getTenantId();
       const existing = stores.objects.get(id);
-      if (!existing) {
+      if (!existing || existing.tenantId !== tenantId) {
         return Promise.reject(new Error(`Object ${id} not found`));
       }
       const updated = {
@@ -3154,6 +3195,11 @@ function createMockObjectsRepository(stores) {
       return Promise.resolve(updated);
     },
     delete(id) {
+      const tenantId = getTenantId();
+      const existing = stores.objects.get(id);
+      if (!existing || existing.tenantId !== tenantId) {
+        return Promise.reject(new Error(`Object ${id} not found`));
+      }
       stores.objects.delete(id);
       return Promise.resolve();
     },
@@ -3167,7 +3213,7 @@ function createMockObjectsRepository(stores) {
     upsert(data) {
       const tenantId = getTenantId();
       for (const obj of stores.objects.values()) {
-        if (obj.system && obj.name === data.name) {
+        if (obj.tenantId === tenantId && obj.system && obj.name === data.name) {
           const updated = {
             ...obj,
             label: data.label,
@@ -3700,13 +3746,24 @@ function parsePipeExpression(pipeExpr) {
 }
 function renderLabelExpression(template, values, fallback = DEFAULT_LABEL_FALLBACK) {
   const result = template.replace(/\{\{\s*([^}]+)\s*\}\}/g, (_, expr) => {
-    const parts = expr.split("|").map((s) => s.trim());
-    const path = parts[0];
-    let value = getValue(values, path);
+    const orParts = expr.split("||").map((s) => s.trim());
+    const lastPart = orParts[orParts.length - 1];
+    const pipeSplit = lastPart.split("|").map((s) => s.trim());
+    orParts[orParts.length - 1] = pipeSplit[0];
+    const pipes = pipeSplit.slice(1).filter(Boolean);
+    const alternatives = orParts.filter(Boolean);
+    let value = "";
+    for (const alt of alternatives) {
+      const v = getValue(values, alt);
+      if (v != null && v !== "") {
+        value = v;
+        break;
+      }
+    }
     const isEmpty3 = value == null || value === "";
-    if (isEmpty3 && parts.length === 1) return "";
-    for (let i = 1; i < parts.length; i++) {
-      const { name: pipeName, args } = parsePipeExpression(parts[i]);
+    if (isEmpty3 && pipes.length === 0) return "";
+    for (const pipeExpr of pipes) {
+      const { name: pipeName, args } = parsePipeExpression(pipeExpr);
       const simpleFn = simplePipes[pipeName];
       if (simpleFn) {
         if (value != null && value !== "") {
@@ -3728,13 +3785,19 @@ function isLabelExpression(value) {
 }
 function extractAttributeNames(template) {
   const names = [];
-  const regex = /\{\{\s*([^|}]+)/g;
+  const regex = /\{\{\s*([^}]+)\s*\}\}/g;
   let match;
   while ((match = regex.exec(template)) !== null) {
-    const path = match[1].trim();
-    const rootName = path.split(".")[0];
-    if (rootName && !names.includes(rootName)) {
-      names.push(rootName);
+    const expr = match[1].trim();
+    const orParts = expr.split("||").map((s) => s.trim());
+    const lastPart = orParts[orParts.length - 1];
+    orParts[orParts.length - 1] = lastPart.split("|")[0].trim();
+    for (const part of orParts) {
+      if (!part) continue;
+      const rootName = part.split(".")[0];
+      if (rootName && !names.includes(rootName)) {
+        names.push(rootName);
+      }
     }
   }
   return names;
@@ -3822,6 +3885,7 @@ function createMockObjectRecordsRepository(stores) {
     findById(id) {
       const internal = stores.objectRecords.get(id);
       if (!internal) return Promise.resolve(null);
+      if (internal.deletedAt) return Promise.resolve(null);
       const { tenantId: _, ...record } = internal;
       return Promise.resolve(record);
     },
@@ -3829,7 +3893,7 @@ function createMockObjectRecordsRepository(stores) {
       const results = [];
       for (const id of ids) {
         const internal = stores.objectRecords.get(id);
-        if (internal) {
+        if (internal && !internal.deletedAt) {
           const { tenantId: _, ...record } = internal;
           results.push(record);
         }
@@ -3890,13 +3954,18 @@ function createMockObjectRecordsRepository(stores) {
       return Promise.resolve(record);
     },
     delete(id) {
-      stores.objectRecords.delete(id);
+      const existing = stores.objectRecords.get(id);
+      if (!existing) {
+        return Promise.reject(new Error(`ObjectRecord ${id} not found`));
+      }
+      existing.deletedAt = /* @__PURE__ */ new Date();
+      stores.objectRecords.set(id, existing);
       return Promise.resolve();
     },
     list(objectId, options) {
       const tenantId = getTenantId();
       let results = Array.from(stores.objectRecords.values()).filter(
-        (r) => r.tenantId === tenantId && r.objectId === objectId
+        (r) => r.tenantId === tenantId && r.objectId === objectId && !r.deletedAt
       );
       const total = results.length;
       if (options?.limit) {
@@ -3909,7 +3978,7 @@ function createMockObjectRecordsRepository(stores) {
       const tenantId = getTenantId();
       const lowerQuery = query.toLowerCase();
       let results = Array.from(stores.objectRecords.values()).filter((r) => {
-        if (r.tenantId !== tenantId || r.objectId !== objectId) return false;
+        if (r.tenantId !== tenantId || r.objectId !== objectId || r.deletedAt) return false;
         return Object.values(r.values).some(
           (val) => String(val).toLowerCase().includes(lowerQuery)
         );
@@ -3943,7 +4012,7 @@ function createMockObjectRecordsRepository(stores) {
         }
       }
       let matchingRecords = Array.from(stores.objectRecords.values()).filter((r) => {
-        if (r.tenantId !== tenantId) return false;
+        if (r.tenantId !== tenantId || r.deletedAt) return false;
         if (!allowedObjectIds.has(r.objectId)) return false;
         return Object.values(r.values).some(
           (val) => String(val).toLowerCase().includes(lowerQuery)
@@ -4098,12 +4167,12 @@ function createMockObjectRecordsRepository(stores) {
       }
       return Promise.resolve(updated);
     },
-    findByRelation(objectName, relationAttributeName, targetRecordId) {
-      const obj = Array.from(stores.objects.values()).find((o) => o.name === objectName);
+    findByRelation(objectId, relationAttributeName, targetRecordId) {
+      const obj = stores.objects.get(objectId);
       if (!obj) return Promise.resolve([]);
       const results = [];
       for (const record of stores.objectRecords.values()) {
-        if (record.objectId !== obj.id) continue;
+        if (record.objectId !== objectId) continue;
         const value = record.values[relationAttributeName];
         let matches = false;
         if (typeof value === "string" && value === targetRecordId) {
@@ -4263,7 +4332,12 @@ function createEmptyStores() {
 function createMockUserProfilesRepository(stores) {
   return {
     findById(id) {
-      return Promise.resolve(stores.userProfiles.get(id) ?? null);
+      const tenantId = getTenantId();
+      const profile = stores.userProfiles.get(id);
+      if (!profile || profile.tenantId !== tenantId) {
+        return Promise.resolve(null);
+      }
+      return Promise.resolve(profile);
     },
     findByIds(ids) {
       const tenantId = getTenantId();
@@ -4277,8 +4351,9 @@ function createMockUserProfilesRepository(stores) {
       return Promise.resolve(results);
     },
     findByAuthId(authId) {
+      const tenantId = getTenantId();
       for (const profile of stores.userProfiles.values()) {
-        if (profile.authId === authId) {
+        if (profile.tenantId === tenantId && profile.authId === authId) {
           return Promise.resolve(profile);
         }
       }
@@ -4303,7 +4378,6 @@ function createMockUserProfilesRepository(stores) {
         firstName: data.firstName,
         lastName: data.lastName,
         avatarUrl: data.avatarUrl,
-        role: data.role ?? "member",
         status: data.status ?? "active",
         createdAt: /* @__PURE__ */ new Date(),
         updatedAt: /* @__PURE__ */ new Date()
@@ -4336,12 +4410,23 @@ function createMockUserProfilesRepository(stores) {
       }
       return Promise.resolve(results);
     },
-    countByRole(role) {
+    getUsersWithRoles(filters) {
       const tenantId = getTenantId();
-      const count = Array.from(stores.userProfiles.values()).filter(
-        (profile) => profile.tenantId === tenantId && profile.role === role
-      ).length;
-      return Promise.resolve(count);
+      const profiles = Array.from(stores.userProfiles.values()).filter(
+        (p) => p.tenantId === tenantId
+      );
+      const results = [];
+      for (const profile of profiles) {
+        const roleIds = Array.from(stores.userRoles.values()).filter((ur) => ur.userProfileId === profile.id && ur.tenantId === tenantId).map((ur) => ur.roleId);
+        const roles = Array.from(stores.roles.values()).filter((r) => roleIds.includes(r.id));
+        if (filters?.allowedRoles && filters.allowedRoles.length > 0) {
+          const allowed = filters.allowedRoles;
+          const hasMatchingRole = roles.some((r) => allowed.includes(r.name));
+          if (!hasMatchingRole) continue;
+        }
+        results.push({ ...profile, roles });
+      }
+      return Promise.resolve(results);
     },
     updateLastLogin(id) {
       const profile = stores.userProfiles.get(id);
@@ -4360,7 +4445,6 @@ function createMockUserProfilesRepository(stores) {
         email: data.email,
         firstName: data.firstName,
         lastName: data.lastName,
-        role: data.role ?? "member",
         status: "pending",
         createdAt: /* @__PURE__ */ new Date(),
         updatedAt: /* @__PURE__ */ new Date()
@@ -4452,7 +4536,6 @@ function createMockPermissionsRepository(stores) {
           scope: input.scope,
           target: input.target,
           actions: input.actions,
-          filter: input.filter,
           createdAt: /* @__PURE__ */ new Date()
         };
         stores.permissions.set(perm.id, perm);
@@ -4497,7 +4580,7 @@ function createMockPermissionsRepository(stores) {
       const tenantId = getTenantId();
       const userRoleIds = Array.from(stores.userRoles.values()).filter((ur) => ur.userProfileId === userProfileId && ur.tenantId === tenantId).map((ur) => ur.roleId);
       const userRoles = Array.from(stores.roles.values()).filter((r) => userRoleIds.includes(r.id));
-      const isAdmin = userRoles.some((r) => r.name === "admin");
+      const hasAdmin = userRoles.some((r) => isAdminRole(r.name));
       const userPermissions = Array.from(stores.permissions.values()).filter(
         (p) => userRoleIds.includes(p.roleId)
       );
@@ -4524,7 +4607,18 @@ function createMockPermissionsRepository(stores) {
           }
         }
       }
-      return Promise.resolve({ isAdmin, objectPermissions, systemPermissions });
+      return Promise.resolve({ isAdmin: hasAdmin, objectPermissions, systemPermissions });
+    },
+    countUsersWithRole(roleName) {
+      const tenantId = getTenantId();
+      const role = Array.from(stores.roles.values()).find(
+        (r) => r.tenantId === tenantId && r.name === roleName
+      );
+      if (!role) return Promise.resolve(0);
+      const userIds = new Set(
+        Array.from(stores.userRoles.values()).filter((ur) => ur.roleId === role.id && ur.tenantId === tenantId).map((ur) => ur.userProfileId)
+      );
+      return Promise.resolve(userIds.size);
     }
   };
 }
@@ -4847,6 +4941,10 @@ function createMockWorkflowsRepository(stores) {
       if (!existing) {
         return Promise.reject(new Error(`Workflow ${id} not found`));
       }
+      const tenantId = getTenantId();
+      if (existing.tenant_id !== tenantId && !existing.system) {
+        return Promise.reject(new Error(`Workflow ${id} not found`));
+      }
       const updated = {
         ...existing,
         label: data.label ?? existing.label,
@@ -4867,6 +4965,13 @@ function createMockWorkflowsRepository(stores) {
       return Promise.resolve(updated);
     },
     delete(id) {
+      const existing = stores.workflows.get(id);
+      if (existing) {
+        const tenantId = getTenantId();
+        if (existing.tenant_id !== tenantId && !existing.system) {
+          return Promise.reject(new Error(`Workflow ${id} not found`));
+        }
+      }
       stores.workflows.delete(id);
       return Promise.resolve();
     },
@@ -4949,6 +5054,10 @@ function createMockWorkflowInstancesRepository(stores) {
       if (!existing) {
         return Promise.reject(new Error(`WorkflowInstance ${id} not found`));
       }
+      const tenantId = getTenantId();
+      if (existing.tenant_id !== tenantId) {
+        return Promise.reject(new Error(`WorkflowInstance ${id} not found`));
+      }
       const updated = {
         ...existing,
         status: data.status ?? existing.status,
@@ -5073,6 +5182,10 @@ function createMockWorkflowInvitationsRepository(stores) {
       if (!existing) {
         return Promise.reject(new Error(`WorkflowInvitation ${id} not found`));
       }
+      const tenantId = getTenantId();
+      if (existing.tenant_id !== tenantId) {
+        return Promise.reject(new Error(`WorkflowInvitation ${id} not found`));
+      }
       const updated = {
         ...existing,
         status: data.status ?? existing.status,
@@ -5138,6 +5251,10 @@ function createMockWorkflowAccessGrantsRepository(stores) {
       if (!existing) {
         return Promise.reject(new Error(`WorkflowAccessGrant ${id} not found`));
       }
+      const tenantId = getTenantId();
+      if (existing.tenant_id !== tenantId) {
+        return Promise.reject(new Error(`WorkflowAccessGrant ${id} not found`));
+      }
       const updated = {
         ...existing,
         last_used_at: data.lastUsedAt !== void 0 ? data.lastUsedAt.toISOString() : existing.last_used_at,
@@ -5271,6 +5388,20 @@ var PolicyRegistry = class {
 };
 var defaultPolicyRegistry = new PolicyRegistry();
 
+// src/runtime/search.ts
+var SORTABLE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set([
+  "text",
+  "textarea",
+  "number",
+  "date",
+  "select",
+  "status",
+  "multiselect",
+  "checkbox",
+  "rating",
+  "currency"
+]);
+
 // src/runtime/services/base.service.ts
 var BaseService = class {
   constructor(adapter) {
@@ -5490,6 +5621,15 @@ function isBilateralRelation(attr) {
 function inferInverseCardinality(cardinality) {
   return cardinality === "one" ? "many" : "many";
 }
+var NON_SORTABLE_TYPES = /* @__PURE__ */ new Set([
+  "richtext",
+  "file",
+  "document",
+  "location"
+]);
+function isAttributeSortable(attr) {
+  return !NON_SORTABLE_TYPES.has(attr.type);
+}
 
 // src/types/relation-properties.ts
 var FORBIDDEN_PROPERTY_TYPES = [
@@ -6209,6 +6349,20 @@ var SingleRelationAttributeBuilder = class extends BaseRelationAttributeBuilder
         isRequired: this.attr.required
       }
     );
+    if (this.attr.system) multiBuilder.system();
+    if (this.attr.hidden) multiBuilder.hidden();
+    if (this.attr.disabled) multiBuilder.disabled();
+    if (this.attr.placeholder) multiBuilder.placeholder(this.attr.placeholder);
+    if (this.attr.description) multiBuilder.description(this.attr.description);
+    if (this.attr.icon) multiBuilder.icon(this.attr.icon);
+    if (this.attr.order !== void 0) multiBuilder.order(this.attr.order);
+    if (this.attr.metadata) multiBuilder.metadata(this.attr.metadata);
+    if (this.attr.featureGate) {
+      multiBuilder.featureGate(this.attr.featureGate.flag, {
+        expectedValue: this.attr.featureGate.expectedValue,
+        fallback: this.attr.featureGate.fallback
+      });
+    }
     return multiBuilder;
   }
   required() {
@@ -6449,6 +6603,13 @@ var DocumentAttributeBuilder = class extends BaseAttributeBuilder {
     this.setRequired(true);
     return this;
   }
+  /**
+   * Mark this attribute as optional (undo required).
+   */
+  optional() {
+    this.setRequired(false);
+    return this;
+  }
 };
 function document(config) {
   return new DocumentAttributeBuilder(config.name, config.label);
@@ -8901,6 +9062,19 @@ var ObjectSchemaService = class extends BaseService {
         });
       });
       await this.invalidateCachePattern(cacheKeys.allResolvedRelations(this.tenantId));
+      if (this.adapter.search) {
+        const { records } = await this.adapter.objectRecords.list(objectId, { limit: 1e4 });
+        this.adapter.search.bulkIndex(
+          records.map((r) => ({
+            record: r,
+            objectName: updatedDbObject.name,
+            objectLabel: updatedDbObject.label,
+            attributes
+          }))
+        ).catch(
+          (err) => console.error("[search] Bulk re-index after label refresh failed", objectId, err)
+        );
+      }
     }
     return this.convertDBObjectToDefinition(updatedDbObject, dbAttributes);
   }
@@ -10072,6 +10246,21 @@ var UserService = class extends BaseService {
     }
     const users = await this.adapter.userProfiles.findByIds([...allIds]);
     const userMap = new Map(users.map((u) => [u.id, u]));
+    const allAllowedRoles = /* @__PURE__ */ new Set();
+    for (const [, { attr }] of attrIdMap) {
+      if (attr.allowedRoles && attr.allowedRoles.length > 0) {
+        for (const role of attr.allowedRoles) {
+          allAllowedRoles.add(role);
+        }
+      }
+    }
+    let userRolesMap;
+    if (allAllowedRoles.size > 0) {
+      const usersWithRoles = await this.adapter.userProfiles.getUsersWithRoles({
+        allowedRoles: [...allAllowedRoles]
+      });
+      userRolesMap = new Map(usersWithRoles.map((u) => [u.id, u.roles.map((r) => r.name)]));
+    }
     for (const [attrName, { attr, ids }] of attrIdMap) {
       const invalidIds = [];
       const roleErrors = [];
@@ -10085,8 +10274,10 @@ var UserService = class extends BaseService {
           invalidIds.push(id);
           continue;
         }
-        if (attr.allowedRoles && attr.allowedRoles.length > 0) {
-          if (!attr.allowedRoles.includes(user2.role)) {
+        if (attr.allowedRoles && attr.allowedRoles.length > 0 && userRolesMap) {
+          const userRoleNames = userRolesMap.get(id) ?? [];
+          const hasAllowedRole = attr.allowedRoles.some((role) => userRoleNames.includes(role));
+          if (!hasAllowedRole) {
             roleErrors.push(id);
           }
         }
@@ -10946,10 +11137,29 @@ var RecordQueryService = class extends BaseService {
     if (this.options?.permissionService && this.userId) {
       await checkPermission(this.options.permissionService, this.userId, schema.name, "read");
     }
-    const result = await runWithSchemaContext(
-      [schema],
-      () => this.adapter.objectRecords.search(objectId, query, options)
-    );
+    let result;
+    if (this.adapter.search) {
+      try {
+        result = await this.adapter.search.searchRecords(objectId, query, {
+          limit: options?.limit,
+          offset: options?.offset,
+          sorts: options?.sorts,
+          filters: options?.filters,
+          attributes: schema.attributes
+        });
+        result = await this.healSearchResults(result);
+      } catch {
+        result = await runWithSchemaContext(
+          [schema],
+          () => this.adapter.objectRecords.search(objectId, query, options)
+        );
+      }
+    } else {
+      result = await runWithSchemaContext(
+        [schema],
+        () => this.adapter.objectRecords.search(objectId, query, options)
+      );
+    }
     const enrichedRecords = await this.relationPropertiesService.enrichRecordsBatch(
       result.records,
       schema
@@ -10965,6 +11175,32 @@ var RecordQueryService = class extends BaseService {
       total: result.total
     };
   }
+  // ==========================================================================
+  // Self-healing: ghost record cleanup
+  // ==========================================================================
+  /**
+   * Verify Meilisearch results against PostgreSQL and remove ghost records.
+   * Fire-and-forget cleanup of records that no longer exist in PG.
+   */
+  async healSearchResults(meiliResult) {
+    const { search } = this.adapter;
+    if (!search || meiliResult.records.length === 0) {
+      return meiliResult;
+    }
+    const ids = meiliResult.records.map((r) => r.id);
+    const existing = await this.adapter.objectRecords.findByIds(ids);
+    const existingSet = new Set(existing.map((r) => r.id));
+    const ghosts = ids.filter((id) => !existingSet.has(id));
+    if (ghosts.length > 0) {
+      Promise.all(ghosts.map((id) => search.removeRecord(id))).catch(
+        (err) => console.error("[search] Failed to clean ghost records from per-object search", err)
+      );
+    }
+    return {
+      records: meiliResult.records.filter((r) => existingSet.has(r.id)),
+      total: meiliResult.total - ghosts.length
+    };
+  }
 };
 
 // src/runtime/services/record/record-resolver.service.ts
@@ -11785,7 +12021,7 @@ var RollupService = class extends BaseService {
       if (typeof relatedId === "string" && relatedId.length > 0) {
         affectedIds.push(relatedId);
       } else if (Array.isArray(relatedId)) {
-        affectedIds.push(...relatedId.filter((id) => typeof id === "string"));
+        affectedIds.push(...relatedId.filter((id) => typeof id === "string" && id.length > 0));
       }
     }
     return [...new Set(affectedIds)];
@@ -12017,6 +12253,11 @@ var RecordService = class extends BaseService {
     }
     await recalculateParentRollups(record, schema, this.rollupContext);
     await this.invalidateRecordCaches(record.id, objectId);
+    this.adapter.search?.indexRecord(record, {
+      objectName: schema.name,
+      objectLabel: schema.label,
+      attributes: schema.attributes
+    }).catch((err) => console.error("[search] Failed to index created record", record.id, err));
     if (this.auditService && this.userId) {
       this.auditService.logRecordAction({
         action: "record.created",
@@ -12180,6 +12421,11 @@ var RecordService = class extends BaseService {
     }
     const updated = await this.adapter.objectRecords.update(recordId, updatePayload);
     await this.invalidateRecordCaches(recordId, existing.objectId);
+    this.adapter.search?.indexRecord(updated, {
+      objectName: schema.name,
+      objectLabel: schema.label,
+      attributes: schema.attributes
+    }).catch((err) => console.error("[search] Failed to index updated record", updated.id, err));
     for (const [attrName, value] of Object.entries(dataToUpdate)) {
       const attr = schema.attributes.find((a) => a.name === attrName);
       if (attr?.type === "relation") {
@@ -12295,6 +12541,7 @@ var RecordService = class extends BaseService {
     }
     await this.adapter.objectRecords.delete(recordId);
     await this.invalidateRecordCaches(recordId, record.objectId);
+    this.adapter.search?.removeRecord(recordId).catch((err) => console.error("[search] Failed to remove deleted record", recordId, err));
     if (!options?.skipHooks) {
       await this.hookRegistry.execute("afterDelete", schema.name, hookCtx);
     }
@@ -12374,6 +12621,11 @@ var RecordService = class extends BaseService {
     }
     const restored = await this.adapter.objectRecords.restore(recordId);
     await this.invalidateRecordCaches(recordId, record.objectId);
+    this.adapter.search?.indexRecord(restored, {
+      objectName: schema.name,
+      objectLabel: schema.label,
+      attributes: schema.attributes
+    }).catch((err) => console.error("[search] Failed to index restored record", restored.id, err));
     if (!options?.skipHooks) {
       const afterCtx = {
         ...hookCtx,
@@ -14877,7 +15129,6 @@ var UserProfileService = class extends BaseService {
    *   email: authUser.email,
    *   firstName: authUser.user_metadata.first_name,
    *   lastName: authUser.user_metadata.last_name,
-   *   role: "member",
    *   status: "active"
    * });
    * ```
@@ -14956,7 +15207,6 @@ var UserProfileService = class extends BaseService {
    *   {
    *     authId: authUser.id,
    *     email: authUser.email,
-   *     role: "member",
    *     status: "active"
    *   }
    * );
@@ -14981,7 +15231,6 @@ var UserProfileService = class extends BaseService {
       const changes = buildAuditChanges(existing, data, [
         "firstName",
         "lastName",
-        "role",
         "status"
       ]);
       if (changes.length > 0) {
@@ -15005,11 +15254,13 @@ var UserProfileService = class extends BaseService {
    */
   async deleteProfile(profileId, options) {
     const profile = await this.getProfileOrThrow(profileId);
-    if (options?.checkAdmin) {
-      if (profile.role === "admin") {
-        const adminCount = await this.adapter.userProfiles.countByRole("admin");
-        if (adminCount <= 1) {
-          throw new Error("Cannot delete the last admin user");
+    if (options?.checkAdmin && this.adapter.permissions) {
+      const ownerCount = await this.adapter.permissions.countUsersWithRole("owner");
+      if (ownerCount <= 1) {
+        const userRoles = await this.adapter.permissions.getUserRoles(profileId);
+        const isOwner = userRoles.some((r) => r.name === "owner");
+        if (isOwner) {
+          throw new Error("Cannot delete the last owner user");
         }
       }
     }
@@ -15045,15 +15296,6 @@ var UserProfileService = class extends BaseService {
   async updateLastLogin(profileId) {
     await this.adapter.userProfiles.updateLastLogin(profileId);
   }
-  /**
-   * Change user role
-   *
-   * @param profileId - Profile UUID
-   * @param newRole - New role
-   */
-  async changeRole(profileId, newRole) {
-    return await this.updateProfile(profileId, { role: newRole });
-  }
   /**
    * Change user status
    *
@@ -15075,19 +15317,6 @@ var UserProfileService = class extends BaseService {
       () => this.adapter.userProfiles.findByEmail(email)
     );
   }
-  /**
-   * Check if user has role
-   */
-  async hasRole(profileId, role) {
-    const profile = await this.getProfile(profileId);
-    return profile?.role === role;
-  }
-  /**
-   * Check if user is admin
-   */
-  async isAdmin(profileId) {
-    return await this.hasRole(profileId, "admin");
-  }
   /**
    * Invite a new user by email.
    *
@@ -15108,7 +15337,6 @@ var UserProfileService = class extends BaseService {
    *   email: "john@example.com",
    *   firstName: "John",
    *   lastName: "Doe",
-   *   role: "member",
    *   redirectTo: "https://app.example.com/welcome",
    * });
    * // Email sent automatically, profile.status === "pending"
@@ -16967,16 +17195,24 @@ var GlobalSearchService = class extends BaseService {
     if (!query || query.trim().length === 0) {
       return { results: [], total: 0 };
     }
-    return this.cachedList(
-      "globalSearch",
-      "search",
-      { query: query.trim(), ...options },
-      () => this.adapter.objectRecords.globalSearch(query.trim(), {
-        limit: options?.limit ?? 20,
-        offset: options?.offset ?? 0,
-        objectNames: options?.objectNames
-      })
-    );
+    const trimmed = query.trim();
+    if (this.adapter.search) {
+      try {
+        const raw = await this.adapter.search.globalSearch(trimmed, {
+          objectNames: options?.objectNames,
+          limit: options?.limit ?? 20,
+          offset: options?.offset ?? 0
+        });
+        return await this.healGlobalSearchResults(raw);
+      } catch (err) {
+        console.error("[search] External search failed, falling back to PostgreSQL", err);
+      }
+    }
+    return this.adapter.objectRecords.globalSearch(trimmed, {
+      limit: options?.limit ?? 20,
+      offset: options?.offset ?? 0,
+      objectNames: options?.objectNames
+    });
   }
   /**
    * Search and group results by object type.
@@ -16990,15 +17226,72 @@ var GlobalSearchService = class extends BaseService {
     if (!query || query.trim().length === 0) {
       return { groups: [], total: 0 };
     }
-    return this.cachedList(
-      "globalSearch",
-      "grouped",
-      { query: query.trim(), ...options },
-      () => this.adapter.objectRecords.globalSearchGrouped(query.trim(), {
-        objectNames: options?.objectNames,
-        limitPerGroup: options?.limitPerGroup ?? 5
-      })
-    );
+    const trimmed = query.trim();
+    if (this.adapter.search) {
+      try {
+        const raw = await this.adapter.search.globalSearchGrouped(trimmed, {
+          objectNames: options?.objectNames
+        });
+        return await this.healGroupedSearchResults(raw);
+      } catch (err) {
+        console.error("[search] External grouped search failed, falling back to PostgreSQL", err);
+      }
+    }
+    return this.adapter.objectRecords.globalSearchGrouped(trimmed, {
+      objectNames: options?.objectNames,
+      limitPerGroup: options?.limitPerGroup ?? 5
+    });
+  }
+  // ==========================================================================
+  // Self-healing: ghost record cleanup
+  // ==========================================================================
+  /**
+   * Verify Meilisearch results against PostgreSQL and remove ghost records.
+   * GlobalSearchResultItem uses `recordId` (not `id`) as the record identifier.
+   */
+  async healGlobalSearchResults(meiliResult) {
+    const { search } = this.adapter;
+    if (!search || meiliResult.results.length === 0) {
+      return meiliResult;
+    }
+    const ids = meiliResult.results.map((r) => r.recordId);
+    const existing = await this.adapter.objectRecords.findByIds(ids);
+    const existingSet = new Set(existing.map((r) => r.id));
+    const ghosts = ids.filter((id) => !existingSet.has(id));
+    if (ghosts.length > 0) {
+      Promise.all(ghosts.map((id) => search.removeRecord(id))).catch(
+        (err) => console.error("[search] Failed to clean ghost records", err)
+      );
+    }
+    return {
+      results: meiliResult.results.filter((r) => existingSet.has(r.recordId)),
+      total: meiliResult.total - ghosts.length
+    };
+  }
+  /**
+   * Verify grouped Meilisearch results against PostgreSQL and remove ghost records.
+   * Filters ghosts from each group and removes empty groups.
+   */
+  async healGroupedSearchResults(raw) {
+    const { search } = this.adapter;
+    if (!search) return raw;
+    const allIds = raw.groups.flatMap((g) => g.results.map((r) => r.recordId));
+    if (allIds.length === 0) return raw;
+    const existing = await this.adapter.objectRecords.findByIds(allIds);
+    const existingSet = new Set(existing.map((r) => r.id));
+    const ghosts = allIds.filter((id) => !existingSet.has(id));
+    if (ghosts.length > 0) {
+      Promise.all(ghosts.map((id) => search.removeRecord(id))).catch(
+        (err) => console.error("[search] Failed to clean ghost records", err)
+      );
+    }
+    return {
+      groups: raw.groups.map((g) => {
+        const filtered = g.results.filter((r) => existingSet.has(r.recordId));
+        return { ...g, results: filtered, totalInGroup: filtered.length };
+      }).filter((g) => g.results.length > 0),
+      total: raw.total - ghosts.length
+    };
   }
 };
 
@@ -17348,7 +17641,7 @@ var PermissionService = class extends BaseService {
       DEFAULT_ROLE_LABELS,
       DEFAULT_ROLE_DESCRIPTIONS,
       DEFAULT_ROLE_PERMISSIONS
-    } = await import("./default-roles-42X3TJI5.mjs");
+    } = await import("./default-roles-OAMHLOCS.mjs");
     const existingRoles = await this.getRoles();
     const existingRoleNames = existingRoles.reduce((set, r) => set.add(r.name), /* @__PURE__ */ new Set());
     for (const roleName of Object.values(DEFAULT_ROLES)) {
@@ -18186,7 +18479,7 @@ async function syncSingleObject(adapter, nativeObject, result, options) {
         `Cannot sync shared object "${nativeObject.name}": masterTenantId must be configured in tenant options`
       );
     }
-    if (options.tenantId && options.tenantId !== options.masterTenantId) {
+    if (!options.tenantId || options.tenantId !== options.masterTenantId) {
       throw new Error(
         `Cannot sync shared object "${nativeObject.name}": only master tenant "${options.masterTenantId}" can sync shared objects (current: "${options.tenantId}")`
       );
@@ -18194,12 +18487,13 @@ async function syncSingleObject(adapter, nativeObject, result, options) {
   }
   const existingObject = await adapter.objects.findSystemByName(nativeObject.name);
   const isNew = !existingObject;
-  updateObjectStats(result, isNew);
   if (options.dryRun) {
+    updateObjectStats(result, isNew);
     await handleDryRun(adapter, nativeObject, existingObject, result, options, isNew);
     return;
   }
   const dbObject = await upsertObject(adapter, nativeObject, options);
+  updateObjectStats(result, isNew);
   await syncAttributes(adapter, nativeObject, dbObject, existingObject, result);
   if (!isNew) {
     await cleanupAttributes(adapter, dbObject.id, nativeObject, result);
@@ -18228,6 +18522,11 @@ async function handleDryRun(adapter, nativeObject, existingObject, result, optio
     }
     result.attributesSynced++;
   }
+  const codeAttributeNames = nativeObject.attributes.map((attr) => attr.name);
+  const wouldBeDeleted = existingAttrs.filter(
+    (a) => a.system && !codeAttributeNames.includes(a.name)
+  );
+  result.attributesDeleted += wouldBeDeleted.length;
 }
 async function upsertObject(adapter, nativeObject, _options) {
   return await adapter.objects.upsert({
@@ -18342,6 +18641,8 @@ export {
   isUniversalRelation,
   isBilateralRelation,
   inferInverseCardinality,
+  NON_SORTABLE_TYPES,
+  isAttributeSortable,
   RecordReferencedError,
   AttributeInUseError,
   ObjectReferencedError,
@@ -18593,6 +18894,7 @@ export {
   createMockAdapter,
   PolicyRegistry,
   defaultPolicyRegistry,
+  SORTABLE_ATTRIBUTE_TYPES,
   BaseService,
   BaseRepository,
   SchemaContextAwareRepository,