@stndrds/schema 1.0.0-alpha.76 → 1.0.0-alpha.78

package/dist/{chunk-27O7E2WM.js → chunk-KGEV5PIT.js}

@@ -15,9 +15,6 @@ var _chunkNEVERCM3js = require('./chunk-NEVERCM3.js');
 var _chunk3WTK7ESHjs = require('./chunk-3WTK7ESH.js');
 
 
-var _chunkJZO52C3Fjs = require('./chunk-JZO52C3F.js');
-
-
 var _chunk3RG5ZIWIjs = require('./chunk-3RG5ZIWI.js');
 
 // src/runtime/auth/workflow-jwt.service.ts
@@ -3210,6 +3207,17 @@ function createMockObjectsRepository(stores) {
       );
       return Promise.resolve(results);
     },
+    deleteSystemNotInNames(excludeNames) {
+      const tenantId = getTenantId();
+      let count = 0;
+      for (const [id, obj] of stores.objects.entries()) {
+        if (obj.tenantId === tenantId && obj.system && !excludeNames.includes(obj.name)) {
+          stores.objects.delete(id);
+          count++;
+        }
+      }
+      return Promise.resolve(count);
+    },
     upsert(data) {
       const tenantId = getTenantId();
       for (const obj of stores.objects.values()) {
@@ -4579,8 +4587,6 @@ function createMockPermissionsRepository(stores) {
     getEffectivePermissions(userProfileId) {
       const tenantId = getTenantId();
       const userRoleIds = Array.from(stores.userRoles.values()).filter((ur) => ur.userProfileId === userProfileId && ur.tenantId === tenantId).map((ur) => ur.roleId);
-      const userRoles = Array.from(stores.roles.values()).filter((r) => userRoleIds.includes(r.id));
-      const hasAdmin = userRoles.some((r) => _chunkJZO52C3Fjs.isAdminRole.call(void 0, r.name));
       const userPermissions = Array.from(stores.permissions.values()).filter(
         (p) => userRoleIds.includes(p.roleId)
       );
@@ -4607,7 +4613,7 @@ function createMockPermissionsRepository(stores) {
           }
         }
       }
-      return Promise.resolve({ isAdmin: hasAdmin, objectPermissions, systemPermissions });
+      return Promise.resolve({ objectPermissions, systemPermissions });
     },
     countUsersWithRole(roleName) {
       const tenantId = getTenantId();
@@ -9856,21 +9862,37 @@ var AuditService = class extends BaseService {
     if (!this.adapter.audit) {
       return;
     }
+    const resolved = await this.resolveActorEmail(entry);
     if (_optionalChain([this, 'access', _183 => _183.options, 'optionalAccess', _184 => _184.async])) {
-      this.buffer.push(entry);
+      this.buffer.push(resolved);
       const batchSize = _nullishCoalesce(this.options.batchSize, () => ( 10));
       if (this.buffer.length >= batchSize) {
         await this.flush();
       }
     } else {
-      await this.adapter.audit.create(entry);
+      await this.adapter.audit.create(resolved);
+    }
+  }
+  /**
+   * Resolve actorEmail from user profiles if not already set
+   */
+  async resolveActorEmail(entry) {
+    if (!entry.actorEmail && entry.actorId) {
+      try {
+        const profile = await this.adapter.userProfiles.findById(entry.actorId);
+        if (_optionalChain([profile, 'optionalAccess', _185 => _185.email])) {
+          return { ...entry, actorEmail: profile.email };
+        }
+      } catch (e13) {
+      }
     }
+    return entry;
   }
   /**
    * Start the flush timer for async mode
    */
   startFlushTimer() {
-    const intervalMs = _nullishCoalesce(_optionalChain([this, 'access', _185 => _185.options, 'optionalAccess', _186 => _186.flushIntervalMs]), () => ( 1e3));
+    const intervalMs = _nullishCoalesce(_optionalChain([this, 'access', _186 => _186.options, 'optionalAccess', _187 => _187.flushIntervalMs]), () => ( 1e3));
     this.flushTimer = setInterval(() => {
       this.flush().catch(() => {
       });
@@ -9900,13 +9922,13 @@ var browserStub4 = {
   run: (_store, callback) => callback()
 };
 var AsyncLocalStorageClass4 = null;
-if (typeof process !== "undefined" && _optionalChain([process, 'access', _187 => _187.versions, 'optionalAccess', _188 => _188.node])) {
+if (typeof process !== "undefined" && _optionalChain([process, 'access', _188 => _188.versions, 'optionalAccess', _189 => _189.node])) {
   try {
     if (typeof _chunk3RG5ZIWIjs.__require !== "undefined") {
       const asyncHooks = _chunk3RG5ZIWIjs.__require.call(void 0, "async_hooks");
       AsyncLocalStorageClass4 = asyncHooks.AsyncLocalStorage;
     }
-  } catch (e13) {
+  } catch (e14) {
     try {
       const dynamicRequire = new Function(
         "m",
@@ -9916,7 +9938,7 @@ if (typeof process !== "undefined" && _optionalChain([process, 'access', _187 =>
       if (asyncHooks) {
         AsyncLocalStorageClass4 = asyncHooks.AsyncLocalStorage;
       }
-    } catch (e14) {
+    } catch (e15) {
     }
   }
 }
@@ -9959,7 +9981,7 @@ var BilateralSyncService = class extends BaseService {
     }
     const ctx = getSyncContext().getStore();
     const syncKey = `${sourceSchema.name}:${sourceRecordId}:${attributeName}`;
-    if (_optionalChain([ctx, 'optionalAccess', _189 => _189.syncing, 'access', _190 => _190.has, 'call', _191 => _191(syncKey)])) {
+    if (_optionalChain([ctx, 'optionalAccess', _190 => _190.syncing, 'access', _191 => _191.has, 'call', _192 => _192(syncKey)])) {
       return;
     }
     await this.runWithSyncContext(syncKey, async () => {
@@ -10184,7 +10206,7 @@ var BilateralSyncService = class extends BaseService {
     const storage = getSyncContext();
     const existingCtx = storage.getStore();
     const ctx = {
-      syncing: new Set(_nullishCoalesce(_optionalChain([existingCtx, 'optionalAccess', _192 => _192.syncing]), () => ( [])))
+      syncing: new Set(_nullishCoalesce(_optionalChain([existingCtx, 'optionalAccess', _193 => _193.syncing]), () => ( [])))
     };
     ctx.syncing.add(syncKey);
     return await storage.run(ctx, fn);
@@ -10292,7 +10314,7 @@ var UserService = class extends BaseService {
       if (roleErrors.length > 0) {
         errors.push({
           attribute: attrName,
-          message: `Users do not have required role for ${attr.label}. Allowed roles: ${_optionalChain([attr, 'access', _193 => _193.allowedRoles, 'optionalAccess', _194 => _194.join, 'call', _195 => _195(", ")])}`,
+          message: `Users do not have required role for ${attr.label}. Allowed roles: ${_optionalChain([attr, 'access', _194 => _194.allowedRoles, 'optionalAccess', _195 => _195.join, 'call', _196 => _196(", ")])}`,
           invalidIds: roleErrors
         });
       }
@@ -10816,7 +10838,7 @@ var RelationPropertiesService = class extends BaseService {
         }
       }
     }
-    const shouldStoreAsInverse = _optionalChain([attribute, 'access', _196 => _196.bilateral, 'optionalAccess', _197 => _197.storageOwner]) === false;
+    const shouldStoreAsInverse = _optionalChain([attribute, 'access', _197 => _197.bilateral, 'optionalAccess', _198 => _198.storageOwner]) === false;
     let storageFromObject = schema.name;
     let storageFromAttribute = attributeName;
     if (shouldStoreAsInverse && attribute.bilateral) {
@@ -10828,7 +10850,7 @@ var RelationPropertiesService = class extends BaseService {
       if (shouldStoreAsInverse) {
         const results = await Promise.all(
           normalized.map(
-            (item) => _optionalChain([adapter, 'access', _198 => _198.relationAttributes, 'optionalAccess', _199 => _199.findBySource, 'call', _200 => _200(
+            (item) => _optionalChain([adapter, 'access', _199 => _199.relationAttributes, 'optionalAccess', _200 => _200.findBySource, 'call', _201 => _201(
               storageFromObject,
               item.id,
               storageFromAttribute
@@ -10967,7 +10989,7 @@ var RecordQueryService = class extends BaseService {
     super(adapter);
     this.schemaService = schemaService;
     this.options = options;
-    this.policyRegistry = _optionalChain([options, 'optionalAccess', _201 => _201.policyRegistry]) === null ? null : _nullishCoalesce(_optionalChain([options, 'optionalAccess', _202 => _202.policyRegistry]), () => ( defaultPolicyRegistry));
+    this.policyRegistry = _optionalChain([options, 'optionalAccess', _202 => _202.policyRegistry]) === null ? null : _nullishCoalesce(_optionalChain([options, 'optionalAccess', _203 => _203.policyRegistry]), () => ( defaultPolicyRegistry));
     this.relationPropertiesService = new RelationPropertiesService(adapter);
   }
   // ============================================================================
@@ -11018,12 +11040,12 @@ var RecordQueryService = class extends BaseService {
    * Internal list query execution
    */
   async executeListQuery(schema, objectId, options) {
-    if (_optionalChain([this, 'access', _203 => _203.options, 'optionalAccess', _204 => _204.permissionService]) && this.userId) {
+    if (_optionalChain([this, 'access', _204 => _204.options, 'optionalAccess', _205 => _205.permissionService]) && this.userId) {
       await checkPermission(this.options.permissionService, this.userId, schema.name, "read");
     }
-    const policy = _optionalChain([options, 'optionalAccess', _205 => _205.skipPolicyFilter]) ? void 0 : getPolicy(this.policyRegistry, this.userId, schema.name);
+    const policy = _optionalChain([options, 'optionalAccess', _206 => _206.skipPolicyFilter]) ? void 0 : getPolicy(this.policyRegistry, this.userId, schema.name);
     let effectiveOptions = options;
-    if (_optionalChain([policy, 'optionalAccess', _206 => _206.applyListFilter]) && this.userId) {
+    if (_optionalChain([policy, 'optionalAccess', _207 => _207.applyListFilter]) && this.userId) {
       const ctx = buildPolicyContext(schema.name, this.userId, this.tenantId);
       effectiveOptions = policy.applyListFilter(ctx, options);
     }
@@ -11033,10 +11055,10 @@ var RecordQueryService = class extends BaseService {
     );
     let filteredRecords = result.records;
     let effectiveTotal = result.total;
-    if (_optionalChain([policy, 'optionalAccess', _207 => _207.canAccessRecord]) && this.userId) {
+    if (_optionalChain([policy, 'optionalAccess', _208 => _208.canAccessRecord]) && this.userId) {
       const ctx = buildPolicyContext(schema.name, this.userId, this.tenantId);
-      const requestedLimit = _nullishCoalesce(_optionalChain([effectiveOptions, 'optionalAccess', _208 => _208.limit]), () => ( 20));
-      const requestedOffset = _nullishCoalesce(_optionalChain([effectiveOptions, 'optionalAccess', _209 => _209.offset]), () => ( 0));
+      const requestedLimit = _nullishCoalesce(_optionalChain([effectiveOptions, 'optionalAccess', _209 => _209.limit]), () => ( 20));
+      const requestedOffset = _nullishCoalesce(_optionalChain([effectiveOptions, 'optionalAccess', _210 => _210.offset]), () => ( 0));
       const overfetchMultiplier = 5;
       const batchSize = requestedLimit * overfetchMultiplier;
       const maxScanRecords = 1e4;
@@ -11058,7 +11080,7 @@ var RecordQueryService = class extends BaseService {
           exhausted = true;
           break;
         }
-        const filtered = batch.records.filter((record) => _optionalChain([policy, 'access', _210 => _210.canAccessRecord, 'optionalCall', _211 => _211(ctx, record)]));
+        const filtered = batch.records.filter((record) => _optionalChain([policy, 'access', _211 => _211.canAccessRecord, 'optionalCall', _212 => _212(ctx, record)]));
         collected.push(...filtered);
         dbOffset += batch.records.length;
         totalScanned += batch.records.length;
@@ -11074,7 +11096,7 @@ var RecordQueryService = class extends BaseService {
       filteredRecords,
       schema
     );
-    if (!_optionalChain([options, 'optionalAccess', _212 => _212.skipFormulas])) {
+    if (!_optionalChain([options, 'optionalAccess', _213 => _213.skipFormulas])) {
       return {
         records: enrichRecordsWithFormulas(filteredRecords, schema),
         total: effectiveTotal
@@ -11134,21 +11156,21 @@ var RecordQueryService = class extends BaseService {
    * Internal search query execution
    */
   async executeSearchQuery(schema, objectId, query, options) {
-    if (_optionalChain([this, 'access', _213 => _213.options, 'optionalAccess', _214 => _214.permissionService]) && this.userId) {
+    if (_optionalChain([this, 'access', _214 => _214.options, 'optionalAccess', _215 => _215.permissionService]) && this.userId) {
       await checkPermission(this.options.permissionService, this.userId, schema.name, "read");
     }
     let result;
     if (this.adapter.search) {
       try {
         result = await this.adapter.search.searchRecords(objectId, query, {
-          limit: _optionalChain([options, 'optionalAccess', _215 => _215.limit]),
-          offset: _optionalChain([options, 'optionalAccess', _216 => _216.offset]),
-          sorts: _optionalChain([options, 'optionalAccess', _217 => _217.sorts]),
-          filters: _optionalChain([options, 'optionalAccess', _218 => _218.filters]),
+          limit: _optionalChain([options, 'optionalAccess', _216 => _216.limit]),
+          offset: _optionalChain([options, 'optionalAccess', _217 => _217.offset]),
+          sorts: _optionalChain([options, 'optionalAccess', _218 => _218.sorts]),
+          filters: _optionalChain([options, 'optionalAccess', _219 => _219.filters]),
           attributes: schema.attributes
         });
         result = await this.healSearchResults(result);
-      } catch (e15) {
+      } catch (e16) {
         result = await runWithSchemaContext(
           [schema],
           () => this.adapter.objectRecords.search(objectId, query, options)
@@ -11164,7 +11186,7 @@ var RecordQueryService = class extends BaseService {
       result.records,
       schema
     );
-    if (!_optionalChain([options, 'optionalAccess', _219 => _219.skipFormulas])) {
+    if (!_optionalChain([options, 'optionalAccess', _220 => _220.skipFormulas])) {
       return {
         records: enrichRecordsWithFormulas(enrichedRecords, schema),
         total: result.total
@@ -11373,7 +11395,7 @@ var RelationService = class extends BaseService {
     }
     const isUniversal = attr.targets.length === 1 && attr.targets[0].object === RELATION_TARGET_ANY;
     const validObjectIds = isUniversal ? null : await this.getValidObjectIds(attr.targets);
-    if (!isUniversal && _optionalChain([validObjectIds, 'optionalAccess', _220 => _220.size]) === 0) {
+    if (!isUniversal && _optionalChain([validObjectIds, 'optionalAccess', _221 => _221.size]) === 0) {
       errors.push({
         attribute: attr.name,
         message: `No valid target objects found for ${attr.label}`
@@ -11426,10 +11448,10 @@ var RelationService = class extends BaseService {
     for (const target of targets) {
       try {
         const objectSchema = await this.schemaService.getObjectSchemaByName(target.object);
-        if (_optionalChain([objectSchema, 'optionalAccess', _221 => _221.id])) {
+        if (_optionalChain([objectSchema, 'optionalAccess', _222 => _222.id])) {
           objectIds.add(objectSchema.id);
         }
-      } catch (e16) {
+      } catch (e17) {
       }
     }
     return objectIds;
@@ -11495,7 +11517,7 @@ var RelationService = class extends BaseService {
     const targetResults = await Promise.all(
       filteredTargets.map(async (target) => {
         const objectSchema = await this.schemaService.getObjectSchemaByName(target.object);
-        if (!_optionalChain([objectSchema, 'optionalAccess', _222 => _222.id])) return { options: [], total: 0 };
+        if (!_optionalChain([objectSchema, 'optionalAccess', _223 => _223.id])) return { options: [], total: 0 };
         const objectId = objectSchema.id;
         const result = query ? await queryService.searchRecords(objectId, query, queryOptions) : await queryService.listRecords(objectId, queryOptions);
         const options = await Promise.all(
@@ -11652,8 +11674,8 @@ var RelationService = class extends BaseService {
         continue;
       }
       const attribute = attributeMap.get(attributeId);
-      const targetConfig = _optionalChain([attribute, 'optionalAccess', _223 => _223.targets, 'optionalAccess', _224 => _224.find, 'call', _225 => _225((t) => t.object === objectSchema.name)]);
-      const customTemplate = _optionalChain([targetConfig, 'optionalAccess', _226 => _226.displayTemplate]);
+      const targetConfig = _optionalChain([attribute, 'optionalAccess', _224 => _224.targets, 'optionalAccess', _225 => _225.find, 'call', _226 => _226((t) => t.object === objectSchema.name)]);
+      const customTemplate = _optionalChain([targetConfig, 'optionalAccess', _227 => _227.displayTemplate]);
       const label = await this.resolveLabel(record, objectSchema, customTemplate);
       resolved.push({
         _compositeId: compositeId,
@@ -11816,14 +11838,14 @@ var RollupService = class extends BaseService {
     const sourceSchema = getSchemaByNameFromContext(sourceObjectName);
     let sourceObjectId;
     let reverseRelationAttrName;
-    if (_optionalChain([sourceSchema, 'optionalAccess', _227 => _227.id])) {
+    if (_optionalChain([sourceSchema, 'optionalAccess', _228 => _228.id])) {
       sourceObjectId = sourceSchema.id;
       const reverseRelationAttr = sourceSchema.attributes.find((attr) => {
         if (attr.type !== "relation") return false;
         const relationConfig = attr;
-        return _optionalChain([relationConfig, 'optionalAccess', _228 => _228.targets, 'optionalAccess', _229 => _229.some, 'call', _230 => _230((t) => t.object === schema.name)]);
+        return _optionalChain([relationConfig, 'optionalAccess', _229 => _229.targets, 'optionalAccess', _230 => _230.some, 'call', _231 => _231((t) => t.object === schema.name)]);
       });
-      reverseRelationAttrName = _optionalChain([reverseRelationAttr, 'optionalAccess', _231 => _231.name]);
+      reverseRelationAttrName = _optionalChain([reverseRelationAttr, 'optionalAccess', _232 => _232.name]);
     } else {
       const sourceObject = await this.adapter.objects.findByName(sourceObjectName);
       if (!sourceObject) {
@@ -11834,9 +11856,9 @@ var RollupService = class extends BaseService {
       const reverseRelationAttr = sourceAttributes.find((attr) => {
         if (attr.type !== "relation") return false;
         const relationConfig = attr.config;
-        return _optionalChain([relationConfig, 'optionalAccess', _232 => _232.targets, 'optionalAccess', _233 => _233.some, 'call', _234 => _234((t) => t.object === schema.name)]);
+        return _optionalChain([relationConfig, 'optionalAccess', _233 => _233.targets, 'optionalAccess', _234 => _234.some, 'call', _235 => _235((t) => t.object === schema.name)]);
       });
-      reverseRelationAttrName = _optionalChain([reverseRelationAttr, 'optionalAccess', _235 => _235.name]);
+      reverseRelationAttrName = _optionalChain([reverseRelationAttr, 'optionalAccess', _236 => _236.name]);
     }
     if (!reverseRelationAttrName) {
       return { value: null, recordCount: 0 };
@@ -12092,13 +12114,13 @@ var RollupService = class extends BaseService {
       if (!obj) continue;
       for (const rollupDbAttr of rollupAttrs) {
         const rollupConfig = rollupDbAttr.config;
-        if (!_optionalChain([rollupConfig, 'optionalAccess', _236 => _236.relationAttribute])) continue;
+        if (!_optionalChain([rollupConfig, 'optionalAccess', _237 => _237.relationAttribute])) continue;
         const relationAttr = attributes.find(
           (a) => a.type === "relation" && a.name === rollupConfig.relationAttribute
         );
         if (!relationAttr) continue;
         const relationConfig = relationAttr.config;
-        const targetsChangedObject = _optionalChain([relationConfig, 'optionalAccess', _237 => _237.targets, 'optionalAccess', _238 => _238.some, 'call', _239 => _239(
+        const targetsChangedObject = _optionalChain([relationConfig, 'optionalAccess', _238 => _238.targets, 'optionalAccess', _239 => _239.some, 'call', _240 => _240(
           (t) => t.object === changedSchema.name
         )]);
         if (!targetsChangedObject) continue;
@@ -12123,11 +12145,11 @@ var RecordService = class extends BaseService {
   constructor(adapter, options) {
     super(adapter);
     this.schemaService = new ObjectSchemaService(adapter, registry, {
-      auditService: _optionalChain([options, 'optionalAccess', _240 => _240.auditService])
+      auditService: _optionalChain([options, 'optionalAccess', _241 => _241.auditService])
     });
-    this.permissionService = _optionalChain([options, 'optionalAccess', _241 => _241.permissionService]);
-    this.auditService = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _242 => _242.auditService]), () => ( (adapter.audit ? new AuditService(adapter) : void 0)));
-    this.policyRegistry = _optionalChain([options, 'optionalAccess', _243 => _243.policyRegistry]) === null ? null : _nullishCoalesce(_optionalChain([options, 'optionalAccess', _244 => _244.policyRegistry]), () => ( defaultPolicyRegistry));
+    this.permissionService = _optionalChain([options, 'optionalAccess', _242 => _242.permissionService]);
+    this.auditService = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _243 => _243.auditService]), () => ( (adapter.audit ? new AuditService(adapter) : void 0)));
+    this.policyRegistry = _optionalChain([options, 'optionalAccess', _244 => _244.policyRegistry]) === null ? null : _nullishCoalesce(_optionalChain([options, 'optionalAccess', _245 => _245.policyRegistry]), () => ( defaultPolicyRegistry));
     this.recordResolver = new RecordResolverService(adapter);
     this.queryService = new RecordQueryService(adapter, this.schemaService, {
       permissionService: this.permissionService,
@@ -12142,7 +12164,7 @@ var RecordService = class extends BaseService {
       recordResolver: this.recordResolver
     });
     this.userService = new UserService(adapter);
-    this.hookRegistry = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _245 => _245.hookRegistry]), () => ( new NoopHookRegistry()));
+    this.hookRegistry = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _246 => _246.hookRegistry]), () => ( new NoopHookRegistry()));
     this.bilateralSyncService = new BilateralSyncService(
       adapter,
       this.schemaService,
@@ -12182,25 +12204,25 @@ var RecordService = class extends BaseService {
       schema,
       this.tenantId,
       dataWithDefaults,
-      _optionalChain([options, 'optionalAccess', _246 => _246.hookMetadata])
+      _optionalChain([options, 'optionalAccess', _247 => _247.hookMetadata])
     );
-    if (!_optionalChain([options, 'optionalAccess', _247 => _247.skipHooks])) {
+    if (!_optionalChain([options, 'optionalAccess', _248 => _248.skipHooks])) {
       await this.hookRegistry.execute("beforeCreate", schema.name, hookCtx);
     }
     const normalizedData = this.relationPropertiesService.normalizeRelationValuesForStorage(
       schema,
       dataWithDefaults
     );
-    if (_optionalChain([options, 'optionalAccess', _248 => _248.validate]) !== false) {
-      if (_optionalChain([options, 'optionalAccess', _249 => _249.allowDraft])) {
+    if (_optionalChain([options, 'optionalAccess', _249 => _249.validate]) !== false) {
+      if (_optionalChain([options, 'optionalAccess', _250 => _250.allowDraft])) {
         _chunk3WTK7ESHjs.validateDraftOrThrow.call(void 0, schema, normalizedData);
       } else {
         _chunk3WTK7ESHjs.validateObjectOrThrow.call(void 0, schema, normalizedData);
       }
-      if (!_optionalChain([options, 'optionalAccess', _250 => _250.skipRelationValidation])) {
+      if (!_optionalChain([options, 'optionalAccess', _251 => _251.skipRelationValidation])) {
         await this.relationService.validateRelationsOrThrow(schema, normalizedData);
       }
-      if (!_optionalChain([options, 'optionalAccess', _251 => _251.skipUserValidation])) {
+      if (!_optionalChain([options, 'optionalAccess', _252 => _252.skipUserValidation])) {
         await this.userService.validateUsersOrThrow(schema, normalizedData);
       }
     }
@@ -12211,12 +12233,12 @@ var RecordService = class extends BaseService {
       data: normalizedData,
       label,
       completionStatus,
-      metadata: _optionalChain([options, 'optionalAccess', _252 => _252.metadata]),
+      metadata: _optionalChain([options, 'optionalAccess', _253 => _253.metadata]),
       createdBy: this.userId
     });
     for (const [attrName, value] of Object.entries(dataWithDefaults)) {
       const attr = schema.attributes.find((a) => a.name === attrName);
-      if (_optionalChain([attr, 'optionalAccess', _253 => _253.type]) === "relation") {
+      if (_optionalChain([attr, 'optionalAccess', _254 => _254.type]) === "relation") {
         const hasProperties2 = attr.properties !== void 0;
         const isBilateral = isBilateralRelation(attr);
         if (hasProperties2 || isBilateral) {
@@ -12232,7 +12254,7 @@ var RecordService = class extends BaseService {
     }
     for (const [attrName, value] of Object.entries(normalizedData)) {
       const attr = schema.attributes.find((a) => a.name === attrName);
-      if (_optionalChain([attr, 'optionalAccess', _254 => _254.type]) === "relation" && isBilateralRelation(attr)) {
+      if (_optionalChain([attr, 'optionalAccess', _255 => _255.type]) === "relation" && isBilateralRelation(attr)) {
         await this.bilateralSyncService.syncBilateralRelation(
           schema,
           record.id,
@@ -12243,7 +12265,7 @@ var RecordService = class extends BaseService {
         );
       }
     }
-    if (!_optionalChain([options, 'optionalAccess', _255 => _255.skipHooks])) {
+    if (!_optionalChain([options, 'optionalAccess', _256 => _256.skipHooks])) {
       const afterCtx = {
         ...hookCtx,
         recordId: record.id,
@@ -12253,11 +12275,11 @@ var RecordService = class extends BaseService {
     }
     await recalculateParentRollups(record, schema, this.rollupContext);
     await this.invalidateRecordCaches(record.id, objectId);
-    _optionalChain([this, 'access', _256 => _256.adapter, 'access', _257 => _257.search, 'optionalAccess', _258 => _258.indexRecord, 'call', _259 => _259(record, {
+    _optionalChain([this, 'access', _257 => _257.adapter, 'access', _258 => _258.search, 'optionalAccess', _259 => _259.indexRecord, 'call', _260 => _260(record, {
       objectName: schema.name,
       objectLabel: schema.label,
       attributes: schema.attributes
-    }), 'access', _260 => _260.catch, 'call', _261 => _261((err) => console.error("[search] Failed to index created record", record.id, err))]);
+    }), 'access', _261 => _261.catch, 'call', _262 => _262((err) => console.error("[search] Failed to index created record", record.id, err))]);
     if (this.auditService && this.userId) {
       this.auditService.logRecordAction({
         action: "record.created",
@@ -12266,7 +12288,7 @@ var RecordService = class extends BaseService {
         objectId: schema.id,
         recordId: record.id,
         recordLabel: record.label,
-        metadata: _optionalChain([options, 'optionalAccess', _262 => _262.hookMetadata])
+        metadata: _optionalChain([options, 'optionalAccess', _263 => _263.hookMetadata])
       }).catch(() => {
       });
     }
@@ -12289,7 +12311,7 @@ var RecordService = class extends BaseService {
       return null;
     }
     const schema = await this.schemaService.getObjectSchema(record.objectId);
-    if (!_optionalChain([options, 'optionalAccess', _263 => _263.skipPolicyCheck])) {
+    if (!_optionalChain([options, 'optionalAccess', _264 => _264.skipPolicyCheck])) {
       const policy = getPolicy(this.policyRegistry, this.userId, schema.name);
       if (policy) {
         const ctx = buildPolicyContext(schema.name, this.userId, this.tenantId);
@@ -12299,11 +12321,11 @@ var RecordService = class extends BaseService {
       }
     }
     let enrichedRecord = record;
-    if (!_optionalChain([options, 'optionalAccess', _264 => _264.skipFormulas])) {
+    if (!_optionalChain([options, 'optionalAccess', _265 => _265.skipFormulas])) {
       enrichedRecord = enrichWithFormulas(record, schema);
     }
     enrichedRecord = await this.enrichRelationProperties(enrichedRecord, schema);
-    if (_optionalChain([options, 'optionalAccess', _265 => _265.includeSchema])) {
+    if (_optionalChain([options, 'optionalAccess', _266 => _266.includeSchema])) {
       const recordWithSchema = enrichedRecord;
       recordWithSchema.schema = schema;
       return recordWithSchema;
@@ -12353,7 +12375,7 @@ var RecordService = class extends BaseService {
       if (oldVal !== null && newVal !== null && typeof oldVal === "object" && typeof newVal === "object") {
         try {
           return JSON.stringify(oldVal) !== JSON.stringify(newVal);
-        } catch (e17) {
+        } catch (e18) {
           return true;
         }
       }
@@ -12365,9 +12387,9 @@ var RecordService = class extends BaseService {
       existing,
       mergedData,
       changedAttributes,
-      _optionalChain([options, 'optionalAccess', _266 => _266.hookMetadata])
+      _optionalChain([options, 'optionalAccess', _267 => _267.hookMetadata])
     );
-    if (!_optionalChain([options, 'optionalAccess', _267 => _267.skipHooks])) {
+    if (!_optionalChain([options, 'optionalAccess', _268 => _268.skipHooks])) {
       await this.hookRegistry.execute("beforeUpdate", schema.name, hookCtx);
     }
     const hookModifiedValues = {};
@@ -12382,16 +12404,16 @@ var RecordService = class extends BaseService {
       dataToUpdate
     );
     const normalizedMergedData = { ...existing.values, ...normalizedUpdate };
-    if (_optionalChain([options, 'optionalAccess', _268 => _268.validate]) !== false) {
-      if (_optionalChain([options, 'optionalAccess', _269 => _269.partial])) {
+    if (_optionalChain([options, 'optionalAccess', _269 => _269.validate]) !== false) {
+      if (_optionalChain([options, 'optionalAccess', _270 => _270.partial])) {
         _chunk3WTK7ESHjs.validateDraftOrThrow.call(void 0, schema, normalizedMergedData);
       } else {
         _chunk3WTK7ESHjs.validateObjectOrThrow.call(void 0, schema, normalizedMergedData);
       }
-      if (!_optionalChain([options, 'optionalAccess', _270 => _270.skipRelationValidation])) {
+      if (!_optionalChain([options, 'optionalAccess', _271 => _271.skipRelationValidation])) {
         await this.relationService.validateRelationsOrThrow(schema, normalizedUpdate);
       }
-      if (!_optionalChain([options, 'optionalAccess', _271 => _271.skipUserValidation])) {
+      if (!_optionalChain([options, 'optionalAccess', _272 => _272.skipUserValidation])) {
         await this.userService.validateUsersOrThrow(schema, normalizedUpdate);
       }
     }
@@ -12404,7 +12426,7 @@ var RecordService = class extends BaseService {
       __lastUpdatedBy: this.userId,
       __expectedUpdatedAt: existing.updatedAt instanceof Date ? existing.updatedAt.toISOString() : existing.updatedAt
     };
-    if (_optionalChain([options, 'optionalAccess', _272 => _272.metadata]) !== void 0) {
+    if (_optionalChain([options, 'optionalAccess', _273 => _273.metadata]) !== void 0) {
       const existingMetadata = _nullishCoalesce(existing.metadata, () => ( {}));
       const mergedMetadata = { ...existingMetadata, ...options.metadata };
       const cleanedMetadata = Object.fromEntries(
@@ -12415,20 +12437,20 @@ var RecordService = class extends BaseService {
     const bilateralOldValues = {};
     for (const attrName of Object.keys(normalizedUpdate)) {
       const attr = schema.attributes.find((a) => a.name === attrName);
-      if (_optionalChain([attr, 'optionalAccess', _273 => _273.type]) === "relation" && isBilateralRelation(attr)) {
+      if (_optionalChain([attr, 'optionalAccess', _274 => _274.type]) === "relation" && isBilateralRelation(attr)) {
         bilateralOldValues[attrName] = existing.values[attrName];
       }
     }
     const updated = await this.adapter.objectRecords.update(recordId, updatePayload);
     await this.invalidateRecordCaches(recordId, existing.objectId);
-    _optionalChain([this, 'access', _274 => _274.adapter, 'access', _275 => _275.search, 'optionalAccess', _276 => _276.indexRecord, 'call', _277 => _277(updated, {
+    _optionalChain([this, 'access', _275 => _275.adapter, 'access', _276 => _276.search, 'optionalAccess', _277 => _277.indexRecord, 'call', _278 => _278(updated, {
       objectName: schema.name,
       objectLabel: schema.label,
       attributes: schema.attributes
-    }), 'access', _278 => _278.catch, 'call', _279 => _279((err) => console.error("[search] Failed to index updated record", updated.id, err))]);
+    }), 'access', _279 => _279.catch, 'call', _280 => _280((err) => console.error("[search] Failed to index updated record", updated.id, err))]);
     for (const [attrName, value] of Object.entries(dataToUpdate)) {
       const attr = schema.attributes.find((a) => a.name === attrName);
-      if (_optionalChain([attr, 'optionalAccess', _280 => _280.type]) === "relation") {
+      if (_optionalChain([attr, 'optionalAccess', _281 => _281.type]) === "relation") {
         const hasProperties2 = attr.properties !== void 0;
         const isBilateral = isBilateralRelation(attr);
         if (hasProperties2 || isBilateral) {
@@ -12444,7 +12466,7 @@ var RecordService = class extends BaseService {
     }
     for (const [attrName, value] of Object.entries(normalizedUpdate)) {
       const attr = schema.attributes.find((a) => a.name === attrName);
-      if (_optionalChain([attr, 'optionalAccess', _281 => _281.type]) === "relation" && isBilateralRelation(attr)) {
+      if (_optionalChain([attr, 'optionalAccess', _282 => _282.type]) === "relation" && isBilateralRelation(attr)) {
         const oldValue = bilateralOldValues[attrName];
         await this.bilateralSyncService.syncBilateralRelation(
           schema,
@@ -12455,7 +12477,7 @@ var RecordService = class extends BaseService {
         );
       }
     }
-    if (!_optionalChain([options, 'optionalAccess', _282 => _282.skipHooks])) {
+    if (!_optionalChain([options, 'optionalAccess', _283 => _283.skipHooks])) {
       const afterCtx = {
         ...hookCtx,
         record: updated
@@ -12470,7 +12492,7 @@ var RecordService = class extends BaseService {
     if (this.auditService && this.userId && allChangedAttributes.length > 0) {
       const changes = allChangedAttributes.map((attr) => ({
         field: attr,
-        oldValue: _optionalChain([hookCtx, 'access', _283 => _283.oldValues, 'optionalAccess', _284 => _284[attr]]),
+        oldValue: _optionalChain([hookCtx, 'access', _284 => _284.oldValues, 'optionalAccess', _285 => _285[attr]]),
         newValue: hookCtx.newValues[attr]
       }));
       this.auditService.logRecordAction({
@@ -12481,7 +12503,7 @@ var RecordService = class extends BaseService {
         recordId: updated.id,
         recordLabel: updated.label,
         changes,
-        metadata: _optionalChain([options, 'optionalAccess', _285 => _285.hookMetadata])
+        metadata: _optionalChain([options, 'optionalAccess', _286 => _286.hookMetadata])
       }).catch(() => {
       });
     }
@@ -12513,17 +12535,17 @@ var RecordService = class extends BaseService {
       const ctx = buildPolicyContext(schema.name, this.userId, this.tenantId);
       checkRecordDeleteOrThrow(policy, record, ctx);
     }
-    if (_optionalChain([options, 'optionalAccess', _286 => _286.checkSystem]) && schema.system) {
+    if (_optionalChain([options, 'optionalAccess', _287 => _287.checkSystem]) && schema.system) {
       throw new ProtectedResourceError("object", schema.name, "delete");
     }
-    if (!_optionalChain([options, 'optionalAccess', _287 => _287.skipReferenceCheck])) {
+    if (!_optionalChain([options, 'optionalAccess', _288 => _288.skipReferenceCheck])) {
       const references = await this.adapter.objectRecords.countRecordsReferencingId(recordId);
       if (references.length > 0) {
         throw new RecordReferencedError(recordId, references);
       }
     }
-    const hookCtx = createContextForDelete(schema, this.tenantId, record, _optionalChain([options, 'optionalAccess', _288 => _288.hookMetadata]));
-    if (!_optionalChain([options, 'optionalAccess', _289 => _289.skipHooks])) {
+    const hookCtx = createContextForDelete(schema, this.tenantId, record, _optionalChain([options, 'optionalAccess', _289 => _289.hookMetadata]));
+    if (!_optionalChain([options, 'optionalAccess', _290 => _290.skipHooks])) {
       await this.hookRegistry.execute("beforeDelete", schema.name, hookCtx);
     }
     for (const attr of schema.attributes) {
@@ -12541,8 +12563,8 @@ var RecordService = class extends BaseService {
     }
     await this.adapter.objectRecords.delete(recordId);
     await this.invalidateRecordCaches(recordId, record.objectId);
-    _optionalChain([this, 'access', _290 => _290.adapter, 'access', _291 => _291.search, 'optionalAccess', _292 => _292.removeRecord, 'call', _293 => _293(recordId), 'access', _294 => _294.catch, 'call', _295 => _295((err) => console.error("[search] Failed to remove deleted record", recordId, err))]);
-    if (!_optionalChain([options, 'optionalAccess', _296 => _296.skipHooks])) {
+    _optionalChain([this, 'access', _291 => _291.adapter, 'access', _292 => _292.search, 'optionalAccess', _293 => _293.removeRecord, 'call', _294 => _294(recordId), 'access', _295 => _295.catch, 'call', _296 => _296((err) => console.error("[search] Failed to remove deleted record", recordId, err))]);
+    if (!_optionalChain([options, 'optionalAccess', _297 => _297.skipHooks])) {
       await this.hookRegistry.execute("afterDelete", schema.name, hookCtx);
     }
     await recalculateParentRollups(record, schema, this.rollupContext);
@@ -12554,7 +12576,7 @@ var RecordService = class extends BaseService {
         objectId: schema.id,
         recordId: record.id,
         recordLabel: record.label,
-        metadata: _optionalChain([options, 'optionalAccess', _297 => _297.hookMetadata])
+        metadata: _optionalChain([options, 'optionalAccess', _298 => _298.hookMetadata])
       }).catch(() => {
       });
     }
@@ -12615,18 +12637,18 @@ var RecordService = class extends BaseService {
       this.tenantId
     );
     await checkPermission(this.permissionService, this.userId, schema.name, "update");
-    const hookCtx = createContextForRestore(schema, this.tenantId, record, _optionalChain([options, 'optionalAccess', _298 => _298.hookMetadata]));
-    if (!_optionalChain([options, 'optionalAccess', _299 => _299.skipHooks])) {
+    const hookCtx = createContextForRestore(schema, this.tenantId, record, _optionalChain([options, 'optionalAccess', _299 => _299.hookMetadata]));
+    if (!_optionalChain([options, 'optionalAccess', _300 => _300.skipHooks])) {
       await this.hookRegistry.execute("beforeRestore", schema.name, hookCtx);
     }
     const restored = await this.adapter.objectRecords.restore(recordId);
     await this.invalidateRecordCaches(recordId, record.objectId);
-    _optionalChain([this, 'access', _300 => _300.adapter, 'access', _301 => _301.search, 'optionalAccess', _302 => _302.indexRecord, 'call', _303 => _303(restored, {
+    _optionalChain([this, 'access', _301 => _301.adapter, 'access', _302 => _302.search, 'optionalAccess', _303 => _303.indexRecord, 'call', _304 => _304(restored, {
       objectName: schema.name,
       objectLabel: schema.label,
       attributes: schema.attributes
-    }), 'access', _304 => _304.catch, 'call', _305 => _305((err) => console.error("[search] Failed to index restored record", restored.id, err))]);
-    if (!_optionalChain([options, 'optionalAccess', _306 => _306.skipHooks])) {
+    }), 'access', _305 => _305.catch, 'call', _306 => _306((err) => console.error("[search] Failed to index restored record", restored.id, err))]);
+    if (!_optionalChain([options, 'optionalAccess', _307 => _307.skipHooks])) {
       const afterCtx = {
         ...hookCtx,
         record: restored
@@ -12641,7 +12663,7 @@ var RecordService = class extends BaseService {
         objectId: schema.id,
         recordId: restored.id,
         recordLabel: restored.label,
-        metadata: _optionalChain([options, 'optionalAccess', _307 => _307.hookMetadata])
+        metadata: _optionalChain([options, 'optionalAccess', _308 => _308.hookMetadata])
       }).catch(() => {
       });
     }
@@ -13072,7 +13094,7 @@ var DocumentRendererService = class {
       throw new StorageDownloadNotSupportedError();
     }
     let storagePath = fileId;
-    if (_optionalChain([this, 'access', _308 => _308.options, 'optionalAccess', _309 => _309.filesRepository])) {
+    if (_optionalChain([this, 'access', _309 => _309.options, 'optionalAccess', _310 => _310.filesRepository])) {
       const file2 = await this.options.filesRepository.findById(fileId);
       if (!file2) {
         throw new Error(`Template file not found: ${fileId}`);
@@ -13090,8 +13112,8 @@ var DocumentRendererService = class {
     for (const field of fields) {
       const rawValue = getContextValue(context, field.contextPath);
       const attrInfo = await this.getAttributeInfo(field.contextPath, workflow2);
-      if (_optionalChain([attrInfo, 'optionalAccess', _310 => _310.attribute])) {
-        if (attrInfo.attribute.type === "relation" && rawValue && _optionalChain([this, 'access', _311 => _311.options, 'optionalAccess', _312 => _312.relationService])) {
+      if (_optionalChain([attrInfo, 'optionalAccess', _311 => _311.attribute])) {
+        if (attrInfo.attribute.type === "relation" && rawValue && _optionalChain([this, 'access', _312 => _312.options, 'optionalAccess', _313 => _313.relationService])) {
           const ids = Array.isArray(rawValue) ? rawValue : [rawValue];
           const stringIds = ids.filter((id) => typeof id === "string");
           if (stringIds.length > 0) {
@@ -13112,7 +13134,7 @@ var DocumentRendererService = class {
         resolved.set(field.id, this.formatValueSimple(rawValue, field.fallback));
       }
     }
-    if (relationBatch.length > 0 && _optionalChain([this, 'access', _313 => _313.options, 'optionalAccess', _314 => _314.relationService])) {
+    if (relationBatch.length > 0 && _optionalChain([this, 'access', _314 => _314.options, 'optionalAccess', _315 => _315.relationService])) {
       try {
         const batchResult = await this.options.relationService.resolveIdsBatch(
           relationBatch.map((r) => ({ attributeId: r.attributeId, ids: r.ids }))
@@ -13121,12 +13143,12 @@ var DocumentRendererService = class {
           const options = _nullishCoalesce(batchResult[attributeId], () => ( []));
           const labels = options.map((o) => o.label);
           const field = fields.find((f) => f.id === fieldId);
-          resolved.set(fieldId, labels.join(", ") || _optionalChain([field, 'optionalAccess', _315 => _315.fallback]) || "");
+          resolved.set(fieldId, labels.join(", ") || _optionalChain([field, 'optionalAccess', _316 => _316.fallback]) || "");
         }
-      } catch (e18) {
+      } catch (e19) {
         for (const { fieldId, ids } of relationBatch) {
           const field = fields.find((f) => f.id === fieldId);
-          resolved.set(fieldId, ids.join(", ") || _optionalChain([field, 'optionalAccess', _316 => _316.fallback]) || "");
+          resolved.set(fieldId, ids.join(", ") || _optionalChain([field, 'optionalAccess', _317 => _317.fallback]) || "");
         }
       }
     }
@@ -13137,7 +13159,7 @@ var DocumentRendererService = class {
    * Parses paths like "slots.client.firstName" to find the attribute definition
    */
   async getAttributeInfo(contextPath, workflow2) {
-    const schemaService = _optionalChain([this, 'access', _317 => _317.options, 'optionalAccess', _318 => _318.schemaService]);
+    const schemaService = _optionalChain([this, 'access', _318 => _318.options, 'optionalAccess', _319 => _319.schemaService]);
     if (!schemaService) {
       return null;
     }
@@ -13150,7 +13172,7 @@ var DocumentRendererService = class {
     }
     const slotId = parts[1];
     const attributeName = parts[2];
-    const slot = _optionalChain([workflow2, 'access', _319 => _319.slots, 'optionalAccess', _320 => _320.find, 'call', _321 => _321((s) => s.id === slotId)]);
+    const slot = _optionalChain([workflow2, 'access', _320 => _320.slots, 'optionalAccess', _321 => _321.find, 'call', _322 => _322((s) => s.id === slotId)]);
     if (!slot) {
       return null;
     }
@@ -13159,7 +13181,7 @@ var DocumentRendererService = class {
       try {
         schema = await schemaService.getObjectSchemaByName(slot.objectName);
         this.schemaCache.set(slot.objectName, schema);
-      } catch (e19) {
+      } catch (e20) {
         return null;
       }
     }
@@ -13349,7 +13371,7 @@ var DocumentProcessingHook = class extends BaseService {
     const pendingIds = [];
     for (const [nodeId, doc] of Object.entries(context.documents)) {
       const metadata = doc.metadata;
-      if (_optionalChain([metadata, 'optionalAccess', _322 => _322.status]) === "pending") {
+      if (_optionalChain([metadata, 'optionalAccess', _323 => _323.status]) === "pending") {
         pendingIds.push(nodeId);
       }
     }
@@ -13400,12 +13422,12 @@ var DocumentProcessingHook = class extends BaseService {
     }
     for (const slotId of targetSlotIds) {
       try {
-        const recordId = _optionalChain([context, 'access', _323 => _323.createdRecordIds, 'optionalAccess', _324 => _324[slotId]]);
+        const recordId = _optionalChain([context, 'access', _324 => _324.createdRecordIds, 'optionalAccess', _325 => _325[slotId]]);
         if (!recordId) {
           continue;
         }
-        const slotDef = _optionalChain([workflow2, 'access', _325 => _325.slots, 'optionalAccess', _326 => _326.find, 'call', _327 => _327((s) => s.id === slotId)]);
-        const objectName = _optionalChain([slotDef, 'optionalAccess', _328 => _328.objectName]);
+        const slotDef = _optionalChain([workflow2, 'access', _326 => _326.slots, 'optionalAccess', _327 => _327.find, 'call', _328 => _328((s) => s.id === slotId)]);
+        const objectName = _optionalChain([slotDef, 'optionalAccess', _329 => _329.objectName]);
         if (!objectName) {
           continue;
         }
@@ -13422,14 +13444,14 @@ var DocumentProcessingHook = class extends BaseService {
         attachedDocumentIds.push(result.document.id);
         const record = await recordService.getRecord(recordId);
         if (record) {
-          const attachments = _nullishCoalesce(_optionalChain([record, 'access', _329 => _329.values, 'optionalAccess', _330 => _330.attachments]), () => ( []));
+          const attachments = _nullishCoalesce(_optionalChain([record, 'access', _330 => _330.values, 'optionalAccess', _331 => _331.attachments]), () => ( []));
           await recordService.updateRecord(
             recordId,
             { attachments: [...attachments, result.document.id] },
             { partial: true }
           );
         }
-      } catch (e20) {
+      } catch (e21) {
       }
     }
     return attachedDocumentIds;
@@ -13688,7 +13710,7 @@ var WorkflowAccessGrantService = class extends BaseService {
    * Check if a specific token has been revoked.
    */
   isTokenRevoked(dbGrant, jti) {
-    return _nullishCoalesce(_optionalChain([dbGrant, 'access', _331 => _331.revoked_token_jtis, 'optionalAccess', _332 => _332.includes, 'call', _333 => _333(jti)]), () => ( false));
+    return _nullishCoalesce(_optionalChain([dbGrant, 'access', _332 => _332.revoked_token_jtis, 'optionalAccess', _333 => _333.includes, 'call', _334 => _334(jti)]), () => ( false));
   }
   /**
    * Validate access token payload against the grant.
@@ -13740,10 +13762,10 @@ var WorkflowInstanceService = class extends BaseService {
   constructor(adapter, workflowService, options) {
     super(adapter);
     this.workflowService = workflowService;
-    this.executorRegistry = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _334 => _334.executorRegistry]), () => ( getDefaultExecutorRegistry()));
-    this.schemaService = _optionalChain([options, 'optionalAccess', _335 => _335.schemaService]);
-    this.recordService = _optionalChain([options, 'optionalAccess', _336 => _336.recordService]);
-    this.documentProcessingHook = _optionalChain([options, 'optionalAccess', _337 => _337.documentProcessingHook]);
+    this.executorRegistry = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _335 => _335.executorRegistry]), () => ( getDefaultExecutorRegistry()));
+    this.schemaService = _optionalChain([options, 'optionalAccess', _336 => _336.schemaService]);
+    this.recordService = _optionalChain([options, 'optionalAccess', _337 => _337.recordService]);
+    this.documentProcessingHook = _optionalChain([options, 'optionalAccess', _338 => _338.documentProcessingHook]);
   }
   /**
    * Start a new workflow instance
@@ -13925,7 +13947,7 @@ var WorkflowInstanceService = class extends BaseService {
     if (!this.adapter.workflowInstances) {
       return { instances: [], total: 0 };
     }
-    if (_optionalChain([options, 'optionalAccess', _338 => _338.workflowName])) {
+    if (_optionalChain([options, 'optionalAccess', _339 => _339.workflowName])) {
       const allDbInstances = await this.adapter.workflowInstances.findByWorkflowName(
         options.workflowName,
         { status: options.status }
@@ -13939,11 +13961,11 @@ var WorkflowInstanceService = class extends BaseService {
       return { instances: instances2, total: total2 };
     }
     const { instances: dbInstances, total } = await this.adapter.workflowInstances.list({
-      limit: _optionalChain([options, 'optionalAccess', _339 => _339.limit]),
-      offset: _optionalChain([options, 'optionalAccess', _340 => _340.offset])
+      limit: _optionalChain([options, 'optionalAccess', _340 => _340.limit]),
+      offset: _optionalChain([options, 'optionalAccess', _341 => _341.offset])
     });
     let instances = dbInstances.map((db) => this.convertDBInstanceToInstance(db));
-    if (_optionalChain([options, 'optionalAccess', _341 => _341.status])) {
+    if (_optionalChain([options, 'optionalAccess', _342 => _342.status])) {
       instances = instances.filter((i) => i.status === options.status);
     }
     instances = await this.markExpiredInstances(instances);
@@ -13964,9 +13986,9 @@ var WorkflowInstanceService = class extends BaseService {
       return { instances: [], total: 0 };
     }
     const { instances: dbInstances, total } = await this.adapter.workflowInstances.findByRecordInSlots(objectName, recordId, {
-      status: _optionalChain([options, 'optionalAccess', _342 => _342.status]),
-      limit: _optionalChain([options, 'optionalAccess', _343 => _343.limit]),
-      offset: _optionalChain([options, 'optionalAccess', _344 => _344.offset])
+      status: _optionalChain([options, 'optionalAccess', _343 => _343.status]),
+      limit: _optionalChain([options, 'optionalAccess', _344 => _344.limit]),
+      offset: _optionalChain([options, 'optionalAccess', _345 => _345.offset])
     });
     const instances = dbInstances.map((db) => this.convertDBInstanceToInstance(db));
     return { instances, total };
@@ -14032,13 +14054,13 @@ var WorkflowInstanceService = class extends BaseService {
         try {
           const schemas = await Promise.all(
             current.workflowSnapshot.slots.map(
-              (slot) => _optionalChain([this, 'access', _345 => _345.schemaService, 'optionalAccess', _346 => _346.getObjectSchemaByName, 'call', _347 => _347(slot.objectName)])
+              (slot) => _optionalChain([this, 'access', _346 => _346.schemaService, 'optionalAccess', _347 => _347.getObjectSchemaByName, 'call', _348 => _348(slot.objectName)])
             )
           );
           objectDefinitions = schemas.filter(
             (s) => s !== void 0
           );
-        } catch (e21) {
+        } catch (e22) {
         }
       }
       const executorContext = {
@@ -14297,9 +14319,9 @@ var WorkflowInstanceService = class extends BaseService {
    */
   async snapshotRecord(recordId) {
     try {
-      const record = await _optionalChain([this, 'access', _348 => _348.recordService, 'optionalAccess', _349 => _349.getRecord, 'call', _350 => _350(recordId, { skipPolicyCheck: true })]);
-      return _optionalChain([record, 'optionalAccess', _351 => _351.values]);
-    } catch (e22) {
+      const record = await _optionalChain([this, 'access', _349 => _349.recordService, 'optionalAccess', _350 => _350.getRecord, 'call', _351 => _351(recordId, { skipPolicyCheck: true })]);
+      return _optionalChain([record, 'optionalAccess', _352 => _352.values]);
+    } catch (e23) {
       return void 0;
     }
   }
@@ -14317,18 +14339,18 @@ var WorkflowInstanceService = class extends BaseService {
     for (const op of [...operations].reverse()) {
       try {
         if (op.operation === "create") {
-          await _optionalChain([this, 'access', _352 => _352.recordService, 'optionalAccess', _353 => _353.deleteRecord, 'call', _354 => _354(op.recordId, {
+          await _optionalChain([this, 'access', _353 => _353.recordService, 'optionalAccess', _354 => _354.deleteRecord, 'call', _355 => _355(op.recordId, {
             skipHooks: true,
             skipReferenceCheck: true
           })]);
           rolledBack.push(op.slotId);
         } else if (op.operation === "update" && op.previousData) {
-          await _optionalChain([this, 'access', _355 => _355.recordService, 'optionalAccess', _356 => _356.updateRecord, 'call', _357 => _357(op.recordId, op.previousData, {
+          await _optionalChain([this, 'access', _356 => _356.recordService, 'optionalAccess', _357 => _357.updateRecord, 'call', _358 => _358(op.recordId, op.previousData, {
             partial: false
           })]);
           rolledBack.push(op.slotId);
         }
-      } catch (e23) {
+      } catch (e24) {
       }
     }
     return rolledBack;
@@ -14447,7 +14469,7 @@ var WorkflowInstanceService = class extends BaseService {
     if (!this.adapter.workflowInstances) {
       return;
     }
-    const currentVersion = _nullishCoalesce(_optionalChain([instance, 'access', _358 => _358.context, 'access', _359 => _359.variables, 'optionalAccess', _360 => _360.__version]), () => ( 0));
+    const currentVersion = _nullishCoalesce(_optionalChain([instance, 'access', _359 => _359.context, 'access', _360 => _360.variables, 'optionalAccess', _361 => _361.__version]), () => ( 0));
     const nextVersion = currentVersion + 1;
     const instanceWithVersion = {
       ...instance,
@@ -14728,7 +14750,7 @@ var WorkflowRelationService = class extends BaseService {
         if (attr.type !== "relation") continue;
         for (const slot of slots) {
           const slotData = context.slots[slot.id];
-          const slotRecordId = _optionalChain([slotData, 'optionalAccess', _361 => _361.id]);
+          const slotRecordId = _optionalChain([slotData, 'optionalAccess', _362 => _362.id]);
           if (!slotRecordId) continue;
           const targetsSlotObject = attr.targets.some(
             (t) => t.object === slot.objectName
@@ -14796,7 +14818,7 @@ var WorkflowService = class extends BaseService {
     if (Array.isArray(options)) {
       this.systemWorkflows = new Map(options.map((w) => [w.name, w]));
     } else {
-      this.systemWorkflows = new Map((_nullishCoalesce(_optionalChain([options, 'optionalAccess', _362 => _362.systemWorkflows]), () => ( []))).map((w) => [w.name, w]));
+      this.systemWorkflows = new Map((_nullishCoalesce(_optionalChain([options, 'optionalAccess', _363 => _363.systemWorkflows]), () => ( []))).map((w) => [w.name, w]));
     }
   }
   // ============================================================================
@@ -15094,7 +15116,7 @@ var WorkflowService = class extends BaseService {
 var UserProfileService = class extends BaseService {
   constructor(adapter, options) {
     super(adapter);
-    this.auditService = _optionalChain([options, 'optionalAccess', _363 => _363.auditService]);
+    this.auditService = _optionalChain([options, 'optionalAccess', _364 => _364.auditService]);
   }
   // ============================================================================
   // CACHE MANAGEMENT
@@ -15112,6 +15134,74 @@ var UserProfileService = class extends BaseService {
       await this.invalidateCache(cacheKeys.userProfileByEmail(this.tenantId, email));
     }
   }
+  // ============================================================================
+  // AVATAR URL RESOLUTION
+  // ============================================================================
+  /**
+   * Resolve avatar storage path to a signed URL.
+   * External URLs (https://) pass through unchanged.
+   * Storage paths are resolved to fresh signed URLs (1h expiry).
+   */
+  async resolveAvatarUrl(profile) {
+    if (!profile.avatarUrl || profile.avatarUrl.startsWith("https://")) {
+      return profile;
+    }
+    if (!this.adapter.storage) return profile;
+    try {
+      const signedUrl = await this.adapter.storage.getSignedUrl(profile.avatarUrl, {
+        expiresIn: 3600
+      });
+      return { ...profile, avatarUrl: signedUrl };
+    } catch (e25) {
+      return profile;
+    }
+  }
+  async resolveAvatarUrls(profiles) {
+    return Promise.all(profiles.map((p) => this.resolveAvatarUrl(p)));
+  }
+  // ============================================================================
+  // AVATAR MANAGEMENT
+  // ============================================================================
+  /**
+   * Upload a new avatar for the user.
+   * Deletes previous avatar from storage if it was an internal upload.
+   * Stores the storagePath — resolved to signed URL at read time.
+   */
+  async uploadAvatar(profileId, input) {
+    if (!this.adapter.storage) {
+      throw new Error("StorageAdapter is not configured.");
+    }
+    if (!input.mimeType.startsWith("image/")) {
+      throw new Error("Only image files are allowed for avatars.");
+    }
+    const profile = await this.getProfileOrThrow(profileId);
+    if (profile.avatarUrl && !profile.avatarUrl.startsWith("https://")) {
+      await this.adapter.storage.delete(profile.avatarUrl).catch(() => void 0);
+    }
+    const result = await this.adapter.storage.upload({
+      content: input.content,
+      fileName: input.fileName,
+      mimeType: input.mimeType,
+      size: input.size,
+      tenantId: this.tenantId,
+      folderPath: "avatars"
+    });
+    return await this.updateProfile(profileId, { avatarUrl: result.storagePath });
+  }
+  /**
+   * Delete the user's avatar.
+   * Removes file from storage if it was an internal upload, then clears avatarUrl.
+   */
+  async deleteAvatar(profileId) {
+    const profile = await this.getProfileOrThrow(profileId);
+    if (profile.avatarUrl && !profile.avatarUrl.startsWith("https://")) {
+      await _optionalChain([this, 'access', _365 => _365.adapter, 'access', _366 => _366.storage, 'optionalAccess', _367 => _367.delete, 'call', _368 => _368(profile.avatarUrl), 'access', _369 => _369.catch, 'call', _370 => _370(() => void 0)]);
+    }
+    return await this.updateProfile(profileId, { avatarUrl: null });
+  }
+  // ============================================================================
+  // CREATE
+  // ============================================================================
   /**
    * Create a new user profile (typically after first auth).
    * Automatically uses tenant context from AsyncLocalStorage.
@@ -15152,18 +15242,19 @@ var UserProfileService = class extends BaseService {
         targetUserEmail: profile.email
       });
     }
-    return profile;
+    return this.resolveAvatarUrl(profile);
   }
   /**
    * Get user profile by ID.
    * Results are cached if a CacheAdapter is configured.
    */
   async getProfile(profileId) {
-    return this.cachedBy(
+    const profile = await this.cachedBy(
       "userProfileById",
       profileId,
       () => this.adapter.userProfiles.findById(profileId)
     );
+    return profile ? this.resolveAvatarUrl(profile) : null;
   }
   /**
    * Get user profile by ID or throw
@@ -15185,11 +15276,12 @@ var UserProfileService = class extends BaseService {
    * @returns User profile or null
    */
   async getProfileByAuthId(authId) {
-    return this.cachedBy(
+    const profile = await this.cachedBy(
       "userProfileByAuthId",
       authId,
       () => this.adapter.userProfiles.findByAuthId(authId)
     );
+    return profile ? this.resolveAvatarUrl(profile) : null;
   }
   /**
    * Get or create user profile (idempotent operation)
@@ -15228,11 +15320,11 @@ var UserProfileService = class extends BaseService {
     const updated = await this.adapter.userProfiles.update(profileId, data);
     await this.invalidateProfileCache(updated.id, updated.authId, updated.email);
     if (this.auditService && this.userId) {
-      const changes = buildAuditChanges(existing, data, [
-        "firstName",
-        "lastName",
-        "status"
-      ]);
+      const changes = buildAuditChanges(
+        existing,
+        data,
+        ["firstName", "lastName", "status"]
+      );
       if (changes.length > 0) {
         await this.auditService.logUserAction({
           action: "user.updated",
@@ -15243,7 +15335,7 @@ var UserProfileService = class extends BaseService {
         });
       }
     }
-    return updated;
+    return this.resolveAvatarUrl(updated);
   }
   /**
    * Delete user profile.
@@ -15254,7 +15346,7 @@ var UserProfileService = class extends BaseService {
    */
   async deleteProfile(profileId, options) {
     const profile = await this.getProfileOrThrow(profileId);
-    if (_optionalChain([options, 'optionalAccess', _364 => _364.checkAdmin]) && this.adapter.permissions) {
+    if (_optionalChain([options, 'optionalAccess', _371 => _371.checkAdmin]) && this.adapter.permissions) {
       const ownerCount = await this.adapter.permissions.countUsersWithRole("owner");
       if (ownerCount <= 1) {
         const userRoles = await this.adapter.permissions.getUserRoles(profileId);
@@ -15280,7 +15372,8 @@ var UserProfileService = class extends BaseService {
    * Automatically uses tenant context from AsyncLocalStorage.
    */
   async listProfiles(options) {
-    return await this.adapter.userProfiles.list(options);
+    const profiles = await this.adapter.userProfiles.list(options);
+    return this.resolveAvatarUrls(profiles);
   }
   /**
    * Update last login timestamp
@@ -15311,11 +15404,12 @@ var UserProfileService = class extends BaseService {
    * Automatically uses tenant context from AsyncLocalStorage.
    */
   async getProfileByEmail(email) {
-    return this.cachedBy(
+    const profile = await this.cachedBy(
       "userProfileByEmail",
       email,
       () => this.adapter.userProfiles.findByEmail(email)
     );
+    return profile ? this.resolveAvatarUrl(profile) : null;
   }
   /**
    * Invite a new user by email.
@@ -15348,6 +15442,21 @@ var UserProfileService = class extends BaseService {
       throw new Error(`User with email "${data.email}" already exists in this tenant`);
     }
     const profile = await this.adapter.userProfiles.invite(data);
+    if (this.adapter.permissions) {
+      try {
+        const roles = await this.adapter.permissions.getRoles();
+        const defaultRole = roles.find((r) => r.name === "member" && r.system);
+        if (defaultRole) {
+          await this.adapter.permissions.assignRole({
+            userProfileId: profile.id,
+            roleId: defaultRole.id,
+            tenantId: this.tenantId,
+            assignedBy: _nullishCoalesce(this.userId, () => ( void 0))
+          });
+        }
+      } catch (e26) {
+      }
+    }
     await this.invalidateProfileCache(profile.id, profile.authId, profile.email);
     if (this.auditService && this.userId) {
       await this.auditService.logUserAction({
@@ -15357,7 +15466,7 @@ var UserProfileService = class extends BaseService {
         targetUserEmail: profile.email
       });
     }
-    return profile;
+    return this.resolveAvatarUrl(profile);
   }
 };
 
@@ -15742,7 +15851,7 @@ var DocumentTemplateService = class extends BaseService {
    * Includes both system templates and tenant-specific templates.
    */
   async listTemplates(options) {
-    if (_optionalChain([options, 'optionalAccess', _365 => _365.systemOnly])) {
+    if (_optionalChain([options, 'optionalAccess', _372 => _372.systemOnly])) {
       return SYSTEM_TEMPLATES;
     }
     const templates = [...SYSTEM_TEMPLATES];
@@ -15825,8 +15934,8 @@ var DocumentTemplateService = class extends BaseService {
 var DocumentService = class extends BaseService {
   constructor(adapter, options) {
     super(adapter);
-    this.templateService = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _366 => _366.templateService]), () => ( new DocumentTemplateService(adapter)));
-    this.fileService = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _367 => _367.fileService]), () => ( null));
+    this.templateService = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _373 => _373.templateService]), () => ( new DocumentTemplateService(adapter)));
+    this.fileService = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _374 => _374.fileService]), () => ( null));
   }
   // ============================================================================
   // CREATE
@@ -16077,7 +16186,7 @@ var DocumentService = class extends BaseService {
    */
   async isComplete(documentId) {
     const document2 = await this.getDocument(documentId);
-    return _optionalChain([document2, 'optionalAccess', _368 => _368.status]) !== "draft";
+    return _optionalChain([document2, 'optionalAccess', _375 => _375.status]) !== "draft";
   }
   /**
    * Get document with its template and slots.
@@ -16335,7 +16444,7 @@ var DocumentProcessingService = class extends BaseService {
       type: "signature",
       provider: this.config.signatureAdapter.name,
       input: { signers, ...options },
-      expiresAt: _optionalChain([options, 'optionalAccess', _369 => _369.expiresAt])
+      expiresAt: _optionalChain([options, 'optionalAccess', _376 => _376.expiresAt])
     });
     return job;
   }
@@ -16492,7 +16601,7 @@ var DocumentProcessingService = class extends BaseService {
     }
     const document2 = await this.documentService.getDocumentOrThrow(documentId);
     const template = await this.templateService.getTemplateOrThrow(document2.templateId);
-    if (!_optionalChain([template, 'access', _370 => _370.autoProcessing, 'optionalAccess', _371 => _371.identityVerification, 'optionalAccess', _372 => _372.enabled])) {
+    if (!_optionalChain([template, 'access', _377 => _377.autoProcessing, 'optionalAccess', _378 => _378.identityVerification, 'optionalAccess', _379 => _379.enabled])) {
       throw new Error("Identity verification is not enabled for this document type");
     }
     const job = await this.adapter.documentJobs.create({
@@ -16578,13 +16687,13 @@ var DocumentProcessingService = class extends BaseService {
     const template = await this.templateService.getTemplateOrThrow(document2.templateId);
     const slots = await this.documentService.getSlots(documentId);
     const jobs = [];
-    if (_optionalChain([template, 'access', _373 => _373.autoProcessing, 'optionalAccess', _374 => _374.ocr, 'optionalAccess', _375 => _375.enabled]) && this.config.ocrAdapter) {
+    if (_optionalChain([template, 'access', _380 => _380.autoProcessing, 'optionalAccess', _381 => _381.ocr, 'optionalAccess', _382 => _382.enabled]) && this.config.ocrAdapter) {
       for (const slot of slots) {
         const job = await this.processOcr(documentId, slot.slotName);
         jobs.push(job);
       }
     }
-    if (_optionalChain([template, 'access', _376 => _376.autoProcessing, 'optionalAccess', _377 => _377.identityVerification, 'optionalAccess', _378 => _378.enabled]) && this.config.identityAdapter) {
+    if (_optionalChain([template, 'access', _383 => _383.autoProcessing, 'optionalAccess', _384 => _384.identityVerification, 'optionalAccess', _385 => _385.enabled]) && this.config.identityAdapter) {
       const job = await this.verifyIdentity(documentId);
       jobs.push(job);
     }
@@ -16655,15 +16764,15 @@ var DocumentProcessingService = class extends BaseService {
     return {
       ocr: {
         available: !!this.config.ocrAdapter,
-        provider: _optionalChain([this, 'access', _379 => _379.config, 'access', _380 => _380.ocrAdapter, 'optionalAccess', _381 => _381.name])
+        provider: _optionalChain([this, 'access', _386 => _386.config, 'access', _387 => _387.ocrAdapter, 'optionalAccess', _388 => _388.name])
       },
       signature: {
         available: !!this.config.signatureAdapter,
-        provider: _optionalChain([this, 'access', _382 => _382.config, 'access', _383 => _383.signatureAdapter, 'optionalAccess', _384 => _384.name])
+        provider: _optionalChain([this, 'access', _389 => _389.config, 'access', _390 => _390.signatureAdapter, 'optionalAccess', _391 => _391.name])
       },
       identityVerification: {
         available: !!this.config.identityAdapter,
-        provider: _optionalChain([this, 'access', _385 => _385.config, 'access', _386 => _386.identityAdapter, 'optionalAccess', _387 => _387.name])
+        provider: _optionalChain([this, 'access', _392 => _392.config, 'access', _393 => _393.identityAdapter, 'optionalAccess', _394 => _394.name])
       }
     };
   }
@@ -16673,7 +16782,7 @@ var DocumentProcessingService = class extends BaseService {
 var FileService = class extends BaseService {
   constructor(adapter, options) {
     super(adapter);
-    this.auditService = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _388 => _388.auditService]), () => ( (adapter.audit ? new AuditService(adapter) : void 0)));
+    this.auditService = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _395 => _395.auditService]), () => ( (adapter.audit ? new AuditService(adapter) : void 0)));
   }
   // ============================================================================
   // UPLOAD (requires StorageAdapter)
@@ -16812,7 +16921,7 @@ var FileService = class extends BaseService {
    */
   async getFile(fileId) {
     const file2 = await this.adapter.files.findById(fileId);
-    if (_optionalChain([file2, 'optionalAccess', _389 => _389.deletedAt])) {
+    if (_optionalChain([file2, 'optionalAccess', _396 => _396.deletedAt])) {
       return null;
     }
     return file2;
@@ -16874,12 +16983,12 @@ var FileService = class extends BaseService {
    */
   async deleteFile(fileId, options) {
     const file2 = await this.getFileOrThrow(fileId);
-    if (_optionalChain([options, 'optionalAccess', _390 => _390.checkOwnership]) && options.userId) {
+    if (_optionalChain([options, 'optionalAccess', _397 => _397.checkOwnership]) && options.userId) {
       if (file2.uploadedBy !== options.userId) {
         throw new Error("You can only delete files you uploaded");
       }
     }
-    if (_optionalChain([options, 'optionalAccess', _391 => _391.hard])) {
+    if (_optionalChain([options, 'optionalAccess', _398 => _398.hard])) {
       await this.adapter.files.hardDelete(fileId);
     } else {
       await this.adapter.files.delete(fileId);
@@ -16910,7 +17019,7 @@ var FileService = class extends BaseService {
     }
     const file2 = await this.getFileOrThrow(fileId);
     await this.adapter.storage.delete(file2.storagePath);
-    if (_optionalChain([options, 'optionalAccess', _392 => _392.hard])) {
+    if (_optionalChain([options, 'optionalAccess', _399 => _399.hard])) {
       await this.adapter.files.hardDelete(fileId);
     } else {
       await this.adapter.files.delete(fileId);
@@ -16936,15 +17045,15 @@ var FileService = class extends BaseService {
     const fileResults = await Promise.all(fileIds.map((id) => this.getFile(id)));
     const files = fileResults.filter((f) => f !== null);
     if (files.length === 0) return;
-    if (_optionalChain([options, 'optionalAccess', _393 => _393.deleteFromStorage]) && this.adapter.storage) {
+    if (_optionalChain([options, 'optionalAccess', _400 => _400.deleteFromStorage]) && this.adapter.storage) {
       const BATCH_SIZE = 10;
       for (let i = 0; i < files.length; i += BATCH_SIZE) {
         const batch = files.slice(i, i + BATCH_SIZE);
-        await Promise.all(batch.map((file2) => _optionalChain([this, 'access', _394 => _394.adapter, 'access', _395 => _395.storage, 'optionalAccess', _396 => _396.delete, 'call', _397 => _397(file2.storagePath)])));
+        await Promise.all(batch.map((file2) => _optionalChain([this, 'access', _401 => _401.adapter, 'access', _402 => _402.storage, 'optionalAccess', _403 => _403.delete, 'call', _404 => _404(file2.storagePath)])));
       }
     }
     const idsToDelete = files.map((f) => f.id);
-    if (_optionalChain([options, 'optionalAccess', _398 => _398.hard])) {
+    if (_optionalChain([options, 'optionalAccess', _405 => _405.hard])) {
       await Promise.all(idsToDelete.map((id) => this.adapter.files.hardDelete(id)));
     } else {
       await Promise.all(idsToDelete.map((id) => this.adapter.files.delete(id)));
@@ -16952,12 +17061,12 @@ var FileService = class extends BaseService {
     if (this.auditService && this.userId) {
       await Promise.all(
         files.map(
-          (file2) => _optionalChain([this, 'access', _399 => _399.auditService, 'optionalAccess', _400 => _400.logFileAction, 'call', _401 => _401({
+          (file2) => _optionalChain([this, 'access', _406 => _406.auditService, 'optionalAccess', _407 => _407.logFileAction, 'call', _408 => _408({
             action: "file.deleted",
             actorId: _nullishCoalesce(this.userId, () => ( "")),
             fileId: file2.id,
             fileName: file2.name,
-            metadata: { deletedFromStorage: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _402 => _402.deleteFromStorage]), () => ( false)) }
+            metadata: { deletedFromStorage: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _409 => _409.deleteFromStorage]), () => ( false)) }
           })])
         )
       );
@@ -17030,14 +17139,11 @@ var FileService = class extends BaseService {
    * @param userId - User ID to check
    * @returns true if user can access the file
    */
-  async checkAccess(fileId, userId, options) {
+  async checkAccess(fileId, userId) {
     const file2 = await this.getFile(fileId);
     if (!file2) {
       return false;
     }
-    if (_optionalChain([options, 'optionalAccess', _403 => _403.isAdmin])) {
-      return true;
-    }
     if (file2.visibility === "public") {
       return true;
     }
@@ -17045,7 +17151,7 @@ var FileService = class extends BaseService {
       return true;
     }
     if (file2.visibility === "restricted") {
-      return _nullishCoalesce(_optionalChain([file2, 'access', _404 => _404.allowedUsers, 'optionalAccess', _405 => _405.includes, 'call', _406 => _406(userId)]), () => ( false));
+      return _nullishCoalesce(_optionalChain([file2, 'access', _410 => _410.allowedUsers, 'optionalAccess', _411 => _411.includes, 'call', _412 => _412(userId)]), () => ( false));
     }
     return false;
   }
@@ -17140,7 +17246,7 @@ function withTimeout(promise, ms, label) {
 var GeocodingService = class {
   constructor(adapter, options) {
     this.adapter = adapter;
-    this.timeoutMs = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _407 => _407.timeoutMs]), () => ( GEOCODING_TIMEOUT_MS));
+    this.timeoutMs = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _413 => _413.timeoutMs]), () => ( GEOCODING_TIMEOUT_MS));
   }
   /**
    * Search for address suggestions as the user types
@@ -17199,9 +17305,9 @@ var GlobalSearchService = class extends BaseService {
     if (this.adapter.search) {
       try {
         const raw = await this.adapter.search.globalSearch(trimmed, {
-          objectNames: _optionalChain([options, 'optionalAccess', _408 => _408.objectNames]),
-          limit: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _409 => _409.limit]), () => ( 20)),
-          offset: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _410 => _410.offset]), () => ( 0))
+          objectNames: _optionalChain([options, 'optionalAccess', _414 => _414.objectNames]),
+          limit: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _415 => _415.limit]), () => ( 20)),
+          offset: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _416 => _416.offset]), () => ( 0))
         });
         return await this.healGlobalSearchResults(raw);
       } catch (err) {
@@ -17209,9 +17315,9 @@ var GlobalSearchService = class extends BaseService {
       }
     }
     return this.adapter.objectRecords.globalSearch(trimmed, {
-      limit: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _411 => _411.limit]), () => ( 20)),
-      offset: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _412 => _412.offset]), () => ( 0)),
-      objectNames: _optionalChain([options, 'optionalAccess', _413 => _413.objectNames])
+      limit: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _417 => _417.limit]), () => ( 20)),
+      offset: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _418 => _418.offset]), () => ( 0)),
+      objectNames: _optionalChain([options, 'optionalAccess', _419 => _419.objectNames])
     });
   }
   /**
@@ -17230,7 +17336,7 @@ var GlobalSearchService = class extends BaseService {
     if (this.adapter.search) {
       try {
         const raw = await this.adapter.search.globalSearchGrouped(trimmed, {
-          objectNames: _optionalChain([options, 'optionalAccess', _414 => _414.objectNames])
+          objectNames: _optionalChain([options, 'optionalAccess', _420 => _420.objectNames])
         });
         return await this.healGroupedSearchResults(raw);
       } catch (err) {
@@ -17238,8 +17344,8 @@ var GlobalSearchService = class extends BaseService {
       }
     }
     return this.adapter.objectRecords.globalSearchGrouped(trimmed, {
-      objectNames: _optionalChain([options, 'optionalAccess', _415 => _415.objectNames]),
-      limitPerGroup: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _416 => _416.limitPerGroup]), () => ( 5))
+      objectNames: _optionalChain([options, 'optionalAccess', _421 => _421.objectNames]),
+      limitPerGroup: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _422 => _422.limitPerGroup]), () => ( 5))
     });
   }
   // ==========================================================================
@@ -17306,7 +17412,7 @@ var PermissionService = class extends BaseService {
     }
     this.permissionsRepo = adapter.permissions;
     this.permissionCache = _nullishCoalesce(adapter.cache, () => ( new NoopCacheAdapter()));
-    this.auditService = _optionalChain([options, 'optionalAccess', _417 => _417.auditService]);
+    this.auditService = _optionalChain([options, 'optionalAccess', _423 => _423.auditService]);
   }
   // ============================================================================
   // PERMISSION CHECKS
@@ -17321,15 +17427,12 @@ var PermissionService = class extends BaseService {
    */
   async canAccessObject(userProfileId, objectName, action) {
     const permissions = await this.getEffectivePermissions(userProfileId);
-    if (permissions.isAdmin) {
-      return true;
-    }
     const wildcardPerms = permissions.objectPermissions["*"];
-    if (_optionalChain([wildcardPerms, 'optionalAccess', _418 => _418.includes, 'call', _419 => _419(action)])) {
+    if (_optionalChain([wildcardPerms, 'optionalAccess', _424 => _424.includes, 'call', _425 => _425(action)])) {
       return true;
     }
     const objectPerms = permissions.objectPermissions[objectName];
-    return _nullishCoalesce(_optionalChain([objectPerms, 'optionalAccess', _420 => _420.includes, 'call', _421 => _421(action)]), () => ( false));
+    return _nullishCoalesce(_optionalChain([objectPerms, 'optionalAccess', _426 => _426.includes, 'call', _427 => _427(action)]), () => ( false));
   }
   /**
    * Check if user can access an object, throw ForbiddenError if not.
@@ -17355,9 +17458,6 @@ var PermissionService = class extends BaseService {
    */
   async getObjectPermissions(userProfileId, objectName) {
     const permissions = await this.getEffectivePermissions(userProfileId);
-    if (permissions.isAdmin) {
-      return { canRead: true, canCreate: true, canUpdate: true, canDelete: true };
-    }
     const wildcardPerms = _nullishCoalesce(permissions.objectPermissions["*"], () => ( []));
     const objectPerms = _nullishCoalesce(permissions.objectPermissions[objectName], () => ( []));
     const allPerms = /* @__PURE__ */ new Set([...wildcardPerms, ...objectPerms]);
@@ -17381,15 +17481,12 @@ var PermissionService = class extends BaseService {
    */
   async canAccessSystem(userProfileId, resource, action) {
     const permissions = await this.getEffectivePermissions(userProfileId);
-    if (permissions.isAdmin) {
+    const wildcardPerms = _optionalChain([permissions, 'access', _428 => _428.systemPermissions, 'optionalAccess', _429 => _429["*"]]);
+    if (_optionalChain([wildcardPerms, 'optionalAccess', _430 => _430.includes, 'call', _431 => _431(action)])) {
       return true;
     }
-    const wildcardPerms = _optionalChain([permissions, 'access', _422 => _422.systemPermissions, 'optionalAccess', _423 => _423["*"]]);
-    if (_optionalChain([wildcardPerms, 'optionalAccess', _424 => _424.includes, 'call', _425 => _425(action)])) {
-      return true;
-    }
-    const resourcePerms = _optionalChain([permissions, 'access', _426 => _426.systemPermissions, 'optionalAccess', _427 => _427[resource]]);
-    return _nullishCoalesce(_optionalChain([resourcePerms, 'optionalAccess', _428 => _428.includes, 'call', _429 => _429(action)]), () => ( false));
+    const resourcePerms = _optionalChain([permissions, 'access', _432 => _432.systemPermissions, 'optionalAccess', _433 => _433[resource]]);
+    return _nullishCoalesce(_optionalChain([resourcePerms, 'optionalAccess', _434 => _434.includes, 'call', _435 => _435(action)]), () => ( false));
   }
   /**
    * Check if user can access a system resource, throw ForbiddenError if not.
@@ -17415,11 +17512,8 @@ var PermissionService = class extends BaseService {
    */
   async getSystemPermissions(userProfileId, resource) {
     const permissions = await this.getEffectivePermissions(userProfileId);
-    if (permissions.isAdmin) {
-      return { canRead: true, canCreate: true, canUpdate: true, canDelete: true };
-    }
-    const wildcardPerms = _nullishCoalesce(_optionalChain([permissions, 'access', _430 => _430.systemPermissions, 'optionalAccess', _431 => _431["*"]]), () => ( []));
-    const resourcePerms = _nullishCoalesce(_optionalChain([permissions, 'access', _432 => _432.systemPermissions, 'optionalAccess', _433 => _433[resource]]), () => ( []));
+    const wildcardPerms = _nullishCoalesce(_optionalChain([permissions, 'access', _436 => _436.systemPermissions, 'optionalAccess', _437 => _437["*"]]), () => ( []));
+    const resourcePerms = _nullishCoalesce(_optionalChain([permissions, 'access', _438 => _438.systemPermissions, 'optionalAccess', _439 => _439[resource]]), () => ( []));
     const allPerms = /* @__PURE__ */ new Set([...wildcardPerms, ...resourcePerms]);
     return {
       canRead: allPerms.has("read"),
@@ -17562,7 +17656,7 @@ var PermissionService = class extends BaseService {
         action: "role.updated",
         actorId: this.userId,
         roleId,
-        roleLabel: _nullishCoalesce(_optionalChain([role, 'optionalAccess', _434 => _434.label]), () => ( roleId)),
+        roleLabel: _nullishCoalesce(_optionalChain([role, 'optionalAccess', _440 => _440.label]), () => ( roleId)),
         metadata: { permissionsUpdated: true, permissionCount: permissions.length }
       });
     }
@@ -17592,7 +17686,7 @@ var PermissionService = class extends BaseService {
         action: "role.assigned",
         actorId: this.userId,
         roleId,
-        roleLabel: _nullishCoalesce(_optionalChain([role, 'optionalAccess', _435 => _435.label]), () => ( roleId)),
+        roleLabel: _nullishCoalesce(_optionalChain([role, 'optionalAccess', _441 => _441.label]), () => ( roleId)),
         targetUserId: userProfileId
       });
     }
@@ -17610,7 +17704,7 @@ var PermissionService = class extends BaseService {
         action: "role.revoked",
         actorId: this.userId,
         roleId,
-        roleLabel: _nullishCoalesce(_optionalChain([role, 'optionalAccess', _436 => _436.label]), () => ( roleId)),
+        roleLabel: _nullishCoalesce(_optionalChain([role, 'optionalAccess', _442 => _442.label]), () => ( roleId)),
         targetUserId: userProfileId
       });
     }
@@ -17622,9 +17716,8 @@ var PermissionService = class extends BaseService {
    * Initialize default roles for the tenant if they don't exist.
    *
    * Creates the following roles with their default permissions:
-   * - **admin**: Full access to all system resources and objects
-   * - **member**: No system access, can read/create/update objects (no delete)
-   * - **guest**: No system access, read-only access to objects
+   * - **owner**: Full access to all system resources and objects
+   * - **member**: Full CRUD on business data, read-only on system resources (people, workspace)
    *
    * This method is idempotent - it only creates roles that don't already exist.
    * Should be called during tenant bootstrap or on first admin login.
@@ -17641,7 +17734,7 @@ var PermissionService = class extends BaseService {
       DEFAULT_ROLE_LABELS,
       DEFAULT_ROLE_DESCRIPTIONS,
       DEFAULT_ROLE_PERMISSIONS
-    } = await Promise.resolve().then(() => _interopRequireWildcard(require("./default-roles-76HUWY6T.js")));
+    } = await Promise.resolve().then(() => _interopRequireWildcard(require("./default-roles-5K3GHJTS.js")));
     const existingRoles = await this.getRoles();
     const existingRoleNames = existingRoles.reduce((set, r) => set.add(r.name), /* @__PURE__ */ new Set());
     for (const roleName of Object.values(DEFAULT_ROLES)) {
@@ -18085,7 +18178,7 @@ var ViewService = class extends BaseService {
       dbView.objectName,
       dbView.type,
       objectDefinition,
-      dbView.type === "detail" ? _nullishCoalesce(_optionalChain([dbView, 'access', _437 => _437.config, 'optionalAccess', _438 => _438.layout]), () => ( "page")) : void 0
+      dbView.type === "detail" ? _nullishCoalesce(_optionalChain([dbView, 'access', _443 => _443.config, 'optionalAccess', _444 => _444.layout]), () => ( "page")) : void 0
     );
     const newConfig = generated.config;
     const updated = await this.adapter.views.update(viewId, { config: newConfig });
@@ -18426,6 +18519,7 @@ async function syncNativeObjects(adapter, nativeRegistry, options = {}) {
   const result = {
     success: true,
     objectsSynced: 0,
+    objectsDeleted: 0,
     attributesSynced: 0,
     objectsCreated: 0,
     objectsUpdated: 0,
@@ -18451,6 +18545,7 @@ async function syncNativeObjects(adapter, nativeRegistry, options = {}) {
           });
         }
       }
+      await cleanupOrphanObjects(tx, nativeObjects, result, options);
     });
   } catch (error2) {
     result.success = false;
@@ -18462,7 +18557,7 @@ async function syncNativeObjects(adapter, nativeRegistry, options = {}) {
   if (options.verbose) {
     console.info(
       `[SyncService] ${result.success ? "\u2713" : "\u2717"} Sync complete:
-  Objects: ${result.objectsCreated} created, ${result.objectsUpdated} updated
+  Objects: ${result.objectsCreated} created, ${result.objectsUpdated} updated, ${result.objectsDeleted} deleted
   Attributes: ${result.attributesCreated} created, ${result.attributesUpdated} updated, ${result.attributesDeleted} deleted
   Errors: ${result.errors.length}`
     );
@@ -18574,6 +18669,25 @@ async function cleanupAttributes(adapter, objectId, nativeObject, result) {
   const deletedCount = await adapter.attributes.deleteSystemByNames(objectId, attributeNames);
   result.attributesDeleted += deletedCount;
 }
+async function cleanupOrphanObjects(adapter, nativeObjects, result, options) {
+  const registryNames = nativeObjects.map((obj) => obj.name);
+  if (options.dryRun) {
+    const allObjects = await adapter.objects.list();
+    const orphans = allObjects.filter((obj) => obj.system && !registryNames.includes(obj.name));
+    result.objectsDeleted += orphans.length;
+    if (options.verbose && orphans.length > 0) {
+      console.info(
+        `[SyncService] Would delete ${orphans.length} orphan system object(s): ${orphans.map((o) => o.name).join(", ")}`
+      );
+    }
+    return;
+  }
+  const deletedCount = await adapter.objects.deleteSystemNotInNames(registryNames);
+  result.objectsDeleted += deletedCount;
+  if (options.verbose && deletedCount > 0) {
+    console.info(`[SyncService] Deleted ${deletedCount} orphan system object(s)`);
+  }
+}
 function logSyncSuccess(nativeObject, options) {
   if (options.verbose) {
     console.info(