@stndrds/schema 1.0.0-alpha.77 → 1.0.0-alpha.78

package/dist/{chunk-JZO52C3F.js → chunk-7WT53FJ4.js}

@@ -2,16 +2,20 @@
 var SYSTEM_RESOURCES = {
   /** User profiles, invitations, roles and permissions management */
   PEOPLE: "people",
-  /** Object definitions, attributes, tenant settings and audit logs */
-  WORKSPACE: "workspace"
+  /** Tenant settings, audit logs, workflow execution, document generation */
+  WORKSPACE: "workspace",
+  /** Object definitions, attributes, views, workflow definitions */
+  ARCHITECT: "architect"
 };
 var ALL_SYSTEM_RESOURCES = [
   SYSTEM_RESOURCES.PEOPLE,
-  SYSTEM_RESOURCES.WORKSPACE
+  SYSTEM_RESOURCES.WORKSPACE,
+  SYSTEM_RESOURCES.ARCHITECT
 ];
 var SYSTEM_RESOURCE_LABELS = {
   people: "People",
-  workspace: "Workspace"
+  workspace: "Workspace",
+  architect: "Architect"
 };
 var DEFAULT_ROLES = {
   /** Full platform access - can manage everything */
@@ -34,16 +38,17 @@ var DEFAULT_ROLE_PERMISSIONS = {
     object: [{ target: "*", actions: ALL_ACTIONS }]
   },
   member: {
-    system: [{ target: "people", actions: ["read"] }],
+    system: [
+      { target: "people", actions: ["read"] },
+      { target: "workspace", actions: ["read"] }
+    ],
     object: [{ target: "*", actions: ALL_ACTIONS }]
   }
 };
+var DEFAULT_ROLE_FOR_NEW_USERS = "member";
 function isDefaultRole(roleName) {
   return Object.values(DEFAULT_ROLES).includes(roleName);
 }
-function isAdminRole(roleName) {
-  return roleName === DEFAULT_ROLES.OWNER;
-}
 
 
 
@@ -55,4 +60,4 @@ function isAdminRole(roleName) {
 
 
 
-exports.SYSTEM_RESOURCES = SYSTEM_RESOURCES; exports.ALL_SYSTEM_RESOURCES = ALL_SYSTEM_RESOURCES; exports.SYSTEM_RESOURCE_LABELS = SYSTEM_RESOURCE_LABELS; exports.DEFAULT_ROLES = DEFAULT_ROLES; exports.DEFAULT_ROLE_LABELS = DEFAULT_ROLE_LABELS; exports.DEFAULT_ROLE_DESCRIPTIONS = DEFAULT_ROLE_DESCRIPTIONS; exports.DEFAULT_ROLE_PERMISSIONS = DEFAULT_ROLE_PERMISSIONS; exports.isDefaultRole = isDefaultRole; exports.isAdminRole = isAdminRole;
+exports.SYSTEM_RESOURCES = SYSTEM_RESOURCES; exports.ALL_SYSTEM_RESOURCES = ALL_SYSTEM_RESOURCES; exports.SYSTEM_RESOURCE_LABELS = SYSTEM_RESOURCE_LABELS; exports.DEFAULT_ROLES = DEFAULT_ROLES; exports.DEFAULT_ROLE_LABELS = DEFAULT_ROLE_LABELS; exports.DEFAULT_ROLE_DESCRIPTIONS = DEFAULT_ROLE_DESCRIPTIONS; exports.DEFAULT_ROLE_PERMISSIONS = DEFAULT_ROLE_PERMISSIONS; exports.DEFAULT_ROLE_FOR_NEW_USERS = DEFAULT_ROLE_FOR_NEW_USERS; exports.isDefaultRole = isDefaultRole;

package/dist/{chunk-6P3NPTYV.mjs → chunk-AGBBH7PL.mjs}

@@ -2,16 +2,20 @@
 var SYSTEM_RESOURCES = {
   /** User profiles, invitations, roles and permissions management */
   PEOPLE: "people",
-  /** Object definitions, attributes, tenant settings and audit logs */
-  WORKSPACE: "workspace"
+  /** Tenant settings, audit logs, workflow execution, document generation */
+  WORKSPACE: "workspace",
+  /** Object definitions, attributes, views, workflow definitions */
+  ARCHITECT: "architect"
 };
 var ALL_SYSTEM_RESOURCES = [
   SYSTEM_RESOURCES.PEOPLE,
-  SYSTEM_RESOURCES.WORKSPACE
+  SYSTEM_RESOURCES.WORKSPACE,
+  SYSTEM_RESOURCES.ARCHITECT
 ];
 var SYSTEM_RESOURCE_LABELS = {
   people: "People",
-  workspace: "Workspace"
+  workspace: "Workspace",
+  architect: "Architect"
 };
 var DEFAULT_ROLES = {
   /** Full platform access - can manage everything */
@@ -34,16 +38,17 @@ var DEFAULT_ROLE_PERMISSIONS = {
     object: [{ target: "*", actions: ALL_ACTIONS }]
   },
   member: {
-    system: [{ target: "people", actions: ["read"] }],
+    system: [
+      { target: "people", actions: ["read"] },
+      { target: "workspace", actions: ["read"] }
+    ],
     object: [{ target: "*", actions: ALL_ACTIONS }]
   }
 };
+var DEFAULT_ROLE_FOR_NEW_USERS = "member";
 function isDefaultRole(roleName) {
   return Object.values(DEFAULT_ROLES).includes(roleName);
 }
-function isAdminRole(roleName) {
-  return roleName === DEFAULT_ROLES.OWNER;
-}
 
 export {
   SYSTEM_RESOURCES,
@@ -53,6 +58,6 @@ export {
   DEFAULT_ROLE_LABELS,
   DEFAULT_ROLE_DESCRIPTIONS,
   DEFAULT_ROLE_PERMISSIONS,
-  isDefaultRole,
-  isAdminRole
+  DEFAULT_ROLE_FOR_NEW_USERS,
+  isDefaultRole
 };

package/dist/{chunk-XF46EJU7.mjs → chunk-JYXUFVUD.mjs}

@@ -13,9 +13,6 @@ import {
   validateObject,
   validateObjectOrThrow
 } from "./chunk-5SZ5OISG.mjs";
-import {
-  isAdminRole
-} from "./chunk-6P3NPTYV.mjs";
 import {
   __require
 } from "./chunk-Y6FXYEAI.mjs";
@@ -4590,8 +4587,6 @@ function createMockPermissionsRepository(stores) {
     getEffectivePermissions(userProfileId) {
       const tenantId = getTenantId();
       const userRoleIds = Array.from(stores.userRoles.values()).filter((ur) => ur.userProfileId === userProfileId && ur.tenantId === tenantId).map((ur) => ur.roleId);
-      const userRoles = Array.from(stores.roles.values()).filter((r) => userRoleIds.includes(r.id));
-      const hasAdmin = userRoles.some((r) => isAdminRole(r.name));
       const userPermissions = Array.from(stores.permissions.values()).filter(
         (p) => userRoleIds.includes(p.roleId)
       );
@@ -4618,7 +4613,7 @@ function createMockPermissionsRepository(stores) {
           }
         }
       }
-      return Promise.resolve({ isAdmin: hasAdmin, objectPermissions, systemPermissions });
+      return Promise.resolve({ objectPermissions, systemPermissions });
     },
     countUsersWithRole(roleName) {
       const tenantId = getTenantId();
@@ -9867,15 +9862,31 @@ var AuditService = class extends BaseService {
     if (!this.adapter.audit) {
       return;
     }
+    const resolved = await this.resolveActorEmail(entry);
     if (this.options?.async) {
-      this.buffer.push(entry);
+      this.buffer.push(resolved);
       const batchSize = this.options.batchSize ?? 10;
       if (this.buffer.length >= batchSize) {
         await this.flush();
       }
     } else {
-      await this.adapter.audit.create(entry);
+      await this.adapter.audit.create(resolved);
+    }
+  }
+  /**
+   * Resolve actorEmail from user profiles if not already set
+   */
+  async resolveActorEmail(entry) {
+    if (!entry.actorEmail && entry.actorId) {
+      try {
+        const profile = await this.adapter.userProfiles.findById(entry.actorId);
+        if (profile?.email) {
+          return { ...entry, actorEmail: profile.email };
+        }
+      } catch {
+      }
     }
+    return entry;
   }
   /**
    * Start the flush timer for async mode
@@ -15123,6 +15134,74 @@ var UserProfileService = class extends BaseService {
       await this.invalidateCache(cacheKeys.userProfileByEmail(this.tenantId, email));
     }
   }
+  // ============================================================================
+  // AVATAR URL RESOLUTION
+  // ============================================================================
+  /**
+   * Resolve avatar storage path to a signed URL.
+   * External URLs (https://) pass through unchanged.
+   * Storage paths are resolved to fresh signed URLs (1h expiry).
+   */
+  async resolveAvatarUrl(profile) {
+    if (!profile.avatarUrl || profile.avatarUrl.startsWith("https://")) {
+      return profile;
+    }
+    if (!this.adapter.storage) return profile;
+    try {
+      const signedUrl = await this.adapter.storage.getSignedUrl(profile.avatarUrl, {
+        expiresIn: 3600
+      });
+      return { ...profile, avatarUrl: signedUrl };
+    } catch {
+      return profile;
+    }
+  }
+  async resolveAvatarUrls(profiles) {
+    return Promise.all(profiles.map((p) => this.resolveAvatarUrl(p)));
+  }
+  // ============================================================================
+  // AVATAR MANAGEMENT
+  // ============================================================================
+  /**
+   * Upload a new avatar for the user.
+   * Deletes previous avatar from storage if it was an internal upload.
+   * Stores the storagePath — resolved to signed URL at read time.
+   */
+  async uploadAvatar(profileId, input) {
+    if (!this.adapter.storage) {
+      throw new Error("StorageAdapter is not configured.");
+    }
+    if (!input.mimeType.startsWith("image/")) {
+      throw new Error("Only image files are allowed for avatars.");
+    }
+    const profile = await this.getProfileOrThrow(profileId);
+    if (profile.avatarUrl && !profile.avatarUrl.startsWith("https://")) {
+      await this.adapter.storage.delete(profile.avatarUrl).catch(() => void 0);
+    }
+    const result = await this.adapter.storage.upload({
+      content: input.content,
+      fileName: input.fileName,
+      mimeType: input.mimeType,
+      size: input.size,
+      tenantId: this.tenantId,
+      folderPath: "avatars"
+    });
+    return await this.updateProfile(profileId, { avatarUrl: result.storagePath });
+  }
+  /**
+   * Delete the user's avatar.
+   * Removes file from storage if it was an internal upload, then clears avatarUrl.
+   */
+  async deleteAvatar(profileId) {
+    const profile = await this.getProfileOrThrow(profileId);
+    if (profile.avatarUrl && !profile.avatarUrl.startsWith("https://")) {
+      await this.adapter.storage?.delete(profile.avatarUrl).catch(() => void 0);
+    }
+    return await this.updateProfile(profileId, { avatarUrl: null });
+  }
+  // ============================================================================
+  // CREATE
+  // ============================================================================
   /**
    * Create a new user profile (typically after first auth).
    * Automatically uses tenant context from AsyncLocalStorage.
@@ -15163,18 +15242,19 @@ var UserProfileService = class extends BaseService {
         targetUserEmail: profile.email
       });
     }
-    return profile;
+    return this.resolveAvatarUrl(profile);
   }
   /**
    * Get user profile by ID.
    * Results are cached if a CacheAdapter is configured.
    */
   async getProfile(profileId) {
-    return this.cachedBy(
+    const profile = await this.cachedBy(
       "userProfileById",
       profileId,
       () => this.adapter.userProfiles.findById(profileId)
     );
+    return profile ? this.resolveAvatarUrl(profile) : null;
   }
   /**
    * Get user profile by ID or throw
@@ -15196,11 +15276,12 @@ var UserProfileService = class extends BaseService {
    * @returns User profile or null
    */
   async getProfileByAuthId(authId) {
-    return this.cachedBy(
+    const profile = await this.cachedBy(
       "userProfileByAuthId",
       authId,
       () => this.adapter.userProfiles.findByAuthId(authId)
     );
+    return profile ? this.resolveAvatarUrl(profile) : null;
   }
   /**
    * Get or create user profile (idempotent operation)
@@ -15239,11 +15320,11 @@ var UserProfileService = class extends BaseService {
     const updated = await this.adapter.userProfiles.update(profileId, data);
     await this.invalidateProfileCache(updated.id, updated.authId, updated.email);
     if (this.auditService && this.userId) {
-      const changes = buildAuditChanges(existing, data, [
-        "firstName",
-        "lastName",
-        "status"
-      ]);
+      const changes = buildAuditChanges(
+        existing,
+        data,
+        ["firstName", "lastName", "status"]
+      );
       if (changes.length > 0) {
         await this.auditService.logUserAction({
           action: "user.updated",
@@ -15254,7 +15335,7 @@ var UserProfileService = class extends BaseService {
         });
       }
     }
-    return updated;
+    return this.resolveAvatarUrl(updated);
   }
   /**
    * Delete user profile.
@@ -15291,7 +15372,8 @@ var UserProfileService = class extends BaseService {
    * Automatically uses tenant context from AsyncLocalStorage.
    */
   async listProfiles(options) {
-    return await this.adapter.userProfiles.list(options);
+    const profiles = await this.adapter.userProfiles.list(options);
+    return this.resolveAvatarUrls(profiles);
   }
   /**
    * Update last login timestamp
@@ -15322,11 +15404,12 @@ var UserProfileService = class extends BaseService {
    * Automatically uses tenant context from AsyncLocalStorage.
    */
   async getProfileByEmail(email) {
-    return this.cachedBy(
+    const profile = await this.cachedBy(
       "userProfileByEmail",
       email,
       () => this.adapter.userProfiles.findByEmail(email)
     );
+    return profile ? this.resolveAvatarUrl(profile) : null;
   }
   /**
    * Invite a new user by email.
@@ -15359,6 +15442,21 @@ var UserProfileService = class extends BaseService {
       throw new Error(`User with email "${data.email}" already exists in this tenant`);
     }
     const profile = await this.adapter.userProfiles.invite(data);
+    if (this.adapter.permissions) {
+      try {
+        const roles = await this.adapter.permissions.getRoles();
+        const defaultRole = roles.find((r) => r.name === "member" && r.system);
+        if (defaultRole) {
+          await this.adapter.permissions.assignRole({
+            userProfileId: profile.id,
+            roleId: defaultRole.id,
+            tenantId: this.tenantId,
+            assignedBy: this.userId ?? void 0
+          });
+        }
+      } catch {
+      }
+    }
     await this.invalidateProfileCache(profile.id, profile.authId, profile.email);
     if (this.auditService && this.userId) {
       await this.auditService.logUserAction({
@@ -15368,7 +15466,7 @@ var UserProfileService = class extends BaseService {
         targetUserEmail: profile.email
       });
     }
-    return profile;
+    return this.resolveAvatarUrl(profile);
   }
 };
 
@@ -17041,14 +17139,11 @@ var FileService = class extends BaseService {
    * @param userId - User ID to check
    * @returns true if user can access the file
    */
-  async checkAccess(fileId, userId, options) {
+  async checkAccess(fileId, userId) {
     const file2 = await this.getFile(fileId);
     if (!file2) {
       return false;
     }
-    if (options?.isAdmin) {
-      return true;
-    }
     if (file2.visibility === "public") {
       return true;
     }
@@ -17332,9 +17427,6 @@ var PermissionService = class extends BaseService {
    */
   async canAccessObject(userProfileId, objectName, action) {
     const permissions = await this.getEffectivePermissions(userProfileId);
-    if (permissions.isAdmin) {
-      return true;
-    }
     const wildcardPerms = permissions.objectPermissions["*"];
     if (wildcardPerms?.includes(action)) {
       return true;
@@ -17366,9 +17458,6 @@ var PermissionService = class extends BaseService {
    */
   async getObjectPermissions(userProfileId, objectName) {
     const permissions = await this.getEffectivePermissions(userProfileId);
-    if (permissions.isAdmin) {
-      return { canRead: true, canCreate: true, canUpdate: true, canDelete: true };
-    }
     const wildcardPerms = permissions.objectPermissions["*"] ?? [];
     const objectPerms = permissions.objectPermissions[objectName] ?? [];
     const allPerms = /* @__PURE__ */ new Set([...wildcardPerms, ...objectPerms]);
@@ -17392,9 +17481,6 @@ var PermissionService = class extends BaseService {
    */
   async canAccessSystem(userProfileId, resource, action) {
     const permissions = await this.getEffectivePermissions(userProfileId);
-    if (permissions.isAdmin) {
-      return true;
-    }
     const wildcardPerms = permissions.systemPermissions?.["*"];
     if (wildcardPerms?.includes(action)) {
       return true;
@@ -17426,9 +17512,6 @@ var PermissionService = class extends BaseService {
    */
   async getSystemPermissions(userProfileId, resource) {
     const permissions = await this.getEffectivePermissions(userProfileId);
-    if (permissions.isAdmin) {
-      return { canRead: true, canCreate: true, canUpdate: true, canDelete: true };
-    }
     const wildcardPerms = permissions.systemPermissions?.["*"] ?? [];
     const resourcePerms = permissions.systemPermissions?.[resource] ?? [];
     const allPerms = /* @__PURE__ */ new Set([...wildcardPerms, ...resourcePerms]);
@@ -17633,9 +17716,8 @@ var PermissionService = class extends BaseService {
    * Initialize default roles for the tenant if they don't exist.
    *
    * Creates the following roles with their default permissions:
-   * - **admin**: Full access to all system resources and objects
-   * - **member**: No system access, can read/create/update objects (no delete)
-   * - **guest**: No system access, read-only access to objects
+   * - **owner**: Full access to all system resources and objects
+   * - **member**: Full CRUD on business data, read-only on system resources (people, workspace)
    *
    * This method is idempotent - it only creates roles that don't already exist.
    * Should be called during tenant bootstrap or on first admin login.
@@ -17652,7 +17734,7 @@ var PermissionService = class extends BaseService {
       DEFAULT_ROLE_LABELS,
       DEFAULT_ROLE_DESCRIPTIONS,
       DEFAULT_ROLE_PERMISSIONS
-    } = await import("./default-roles-OAMHLOCS.mjs");
+    } = await import("./default-roles-6D3HQ3DQ.mjs");
     const existingRoles = await this.getRoles();
     const existingRoleNames = existingRoles.reduce((set, r) => set.add(r.name), /* @__PURE__ */ new Set());
     for (const roleName of Object.values(DEFAULT_ROLES)) {
@@ -18591,9 +18673,7 @@ async function cleanupOrphanObjects(adapter, nativeObjects, result, options) {
   const registryNames = nativeObjects.map((obj) => obj.name);
   if (options.dryRun) {
     const allObjects = await adapter.objects.list();
-    const orphans = allObjects.filter(
-      (obj) => obj.system && !registryNames.includes(obj.name)
-    );
+    const orphans = allObjects.filter((obj) => obj.system && !registryNames.includes(obj.name));
     result.objectsDeleted += orphans.length;
     if (options.verbose && orphans.length > 0) {
       console.info(