@stndrds/schema 1.0.0-alpha.77 → 1.0.0-alpha.79

package/dist/{chunk-JZO52C3F.js → chunk-7WT53FJ4.js}

@@ -2,16 +2,20 @@
 var SYSTEM_RESOURCES = {
   /** User profiles, invitations, roles and permissions management */
   PEOPLE: "people",
-  /** Object definitions, attributes, tenant settings and audit logs */
-  WORKSPACE: "workspace"
+  /** Tenant settings, audit logs, workflow execution, document generation */
+  WORKSPACE: "workspace",
+  /** Object definitions, attributes, views, workflow definitions */
+  ARCHITECT: "architect"
 };
 var ALL_SYSTEM_RESOURCES = [
   SYSTEM_RESOURCES.PEOPLE,
-  SYSTEM_RESOURCES.WORKSPACE
+  SYSTEM_RESOURCES.WORKSPACE,
+  SYSTEM_RESOURCES.ARCHITECT
 ];
 var SYSTEM_RESOURCE_LABELS = {
   people: "People",
-  workspace: "Workspace"
+  workspace: "Workspace",
+  architect: "Architect"
 };
 var DEFAULT_ROLES = {
   /** Full platform access - can manage everything */
@@ -34,16 +38,17 @@ var DEFAULT_ROLE_PERMISSIONS = {
     object: [{ target: "*", actions: ALL_ACTIONS }]
   },
   member: {
-    system: [{ target: "people", actions: ["read"] }],
+    system: [
+      { target: "people", actions: ["read"] },
+      { target: "workspace", actions: ["read"] }
+    ],
     object: [{ target: "*", actions: ALL_ACTIONS }]
   }
 };
+var DEFAULT_ROLE_FOR_NEW_USERS = "member";
 function isDefaultRole(roleName) {
   return Object.values(DEFAULT_ROLES).includes(roleName);
 }
-function isAdminRole(roleName) {
-  return roleName === DEFAULT_ROLES.OWNER;
-}
 
 
 
@@ -55,4 +60,4 @@ function isAdminRole(roleName) {
 
 
 
-exports.SYSTEM_RESOURCES = SYSTEM_RESOURCES; exports.ALL_SYSTEM_RESOURCES = ALL_SYSTEM_RESOURCES; exports.SYSTEM_RESOURCE_LABELS = SYSTEM_RESOURCE_LABELS; exports.DEFAULT_ROLES = DEFAULT_ROLES; exports.DEFAULT_ROLE_LABELS = DEFAULT_ROLE_LABELS; exports.DEFAULT_ROLE_DESCRIPTIONS = DEFAULT_ROLE_DESCRIPTIONS; exports.DEFAULT_ROLE_PERMISSIONS = DEFAULT_ROLE_PERMISSIONS; exports.isDefaultRole = isDefaultRole; exports.isAdminRole = isAdminRole;
+exports.SYSTEM_RESOURCES = SYSTEM_RESOURCES; exports.ALL_SYSTEM_RESOURCES = ALL_SYSTEM_RESOURCES; exports.SYSTEM_RESOURCE_LABELS = SYSTEM_RESOURCE_LABELS; exports.DEFAULT_ROLES = DEFAULT_ROLES; exports.DEFAULT_ROLE_LABELS = DEFAULT_ROLE_LABELS; exports.DEFAULT_ROLE_DESCRIPTIONS = DEFAULT_ROLE_DESCRIPTIONS; exports.DEFAULT_ROLE_PERMISSIONS = DEFAULT_ROLE_PERMISSIONS; exports.DEFAULT_ROLE_FOR_NEW_USERS = DEFAULT_ROLE_FOR_NEW_USERS; exports.isDefaultRole = isDefaultRole;

package/dist/{chunk-6P3NPTYV.mjs → chunk-AGBBH7PL.mjs}

@@ -2,16 +2,20 @@
 var SYSTEM_RESOURCES = {
   /** User profiles, invitations, roles and permissions management */
   PEOPLE: "people",
-  /** Object definitions, attributes, tenant settings and audit logs */
-  WORKSPACE: "workspace"
+  /** Tenant settings, audit logs, workflow execution, document generation */
+  WORKSPACE: "workspace",
+  /** Object definitions, attributes, views, workflow definitions */
+  ARCHITECT: "architect"
 };
 var ALL_SYSTEM_RESOURCES = [
   SYSTEM_RESOURCES.PEOPLE,
-  SYSTEM_RESOURCES.WORKSPACE
+  SYSTEM_RESOURCES.WORKSPACE,
+  SYSTEM_RESOURCES.ARCHITECT
 ];
 var SYSTEM_RESOURCE_LABELS = {
   people: "People",
-  workspace: "Workspace"
+  workspace: "Workspace",
+  architect: "Architect"
 };
 var DEFAULT_ROLES = {
   /** Full platform access - can manage everything */
@@ -34,16 +38,17 @@ var DEFAULT_ROLE_PERMISSIONS = {
     object: [{ target: "*", actions: ALL_ACTIONS }]
   },
   member: {
-    system: [{ target: "people", actions: ["read"] }],
+    system: [
+      { target: "people", actions: ["read"] },
+      { target: "workspace", actions: ["read"] }
+    ],
     object: [{ target: "*", actions: ALL_ACTIONS }]
   }
 };
+var DEFAULT_ROLE_FOR_NEW_USERS = "member";
 function isDefaultRole(roleName) {
   return Object.values(DEFAULT_ROLES).includes(roleName);
 }
-function isAdminRole(roleName) {
-  return roleName === DEFAULT_ROLES.OWNER;
-}
 
 export {
   SYSTEM_RESOURCES,
@@ -53,6 +58,6 @@ export {
   DEFAULT_ROLE_LABELS,
   DEFAULT_ROLE_DESCRIPTIONS,
   DEFAULT_ROLE_PERMISSIONS,
-  isDefaultRole,
-  isAdminRole
+  DEFAULT_ROLE_FOR_NEW_USERS,
+  isDefaultRole
 };

package/dist/{chunk-XF46EJU7.mjs → chunk-K5MARJCD.mjs}

@@ -13,9 +13,6 @@ import {
   validateObject,
   validateObjectOrThrow
 } from "./chunk-5SZ5OISG.mjs";
-import {
-  isAdminRole
-} from "./chunk-6P3NPTYV.mjs";
 import {
   __require
 } from "./chunk-Y6FXYEAI.mjs";
@@ -1295,6 +1292,23 @@ function createQueryBuilder(recordService, adapter, objectName, options) {
   return new QueryBuilder(recordService, adapter, objectName, initialState);
 }
 
+// src/types/flows.ts
+function isFlowFieldsRow(row) {
+  return !row.type || row.type === "fields";
+}
+function isLayoutRow(row) {
+  return !!row.type && row.type !== "fields";
+}
+function isFlowDefinition(obj) {
+  return typeof obj === "object" && obj !== null && "slots" in obj && "pages" in obj && "relations" in obj && "status" in obj;
+}
+function isFlowPublished(flow) {
+  return flow.status === "published";
+}
+function isSystemFlow(flow) {
+  return flow.system === true;
+}
+
 // src/types/workflows/nodes.ts
 function isSimpleFormNode(node) {
   return node.fields !== void 0 && node.rows === void 0;
@@ -1462,6 +1476,11 @@ function setContextValue(context, path, value) {
   current[parts[parts.length - 1]] = value;
 }
 
+// src/types/workflows/form-context.ts
+function isFormFieldsRow(row) {
+  return !row.type || row.type === "fields";
+}
+
 // src/types/workflows/theme.ts
 var DEFAULT_THEME = {
   borderRadius: 8,
@@ -1554,14 +1573,40 @@ var FlowRowFieldSchema = z.object({
   id: z.string().min(1),
   slotId: z.string().min(1),
   attribute: z.string().min(1),
-  label: z.string().optional(),
+  label: z.string().max(200).optional(),
+  tooltip: z.string().max(1e3).optional(),
   required: z.boolean().optional()
 });
-var FlowRowSchema = z.object({
+var FlowFieldsRowSchema = z.object({
   id: z.string().min(1),
   order: z.number(),
+  type: z.literal("fields").optional(),
   fields: z.array(FlowRowFieldSchema)
 });
+var FlowHeadingRowSchema = z.object({
+  id: z.string().min(1),
+  order: z.number(),
+  type: z.literal("heading"),
+  content: z.string().min(1).max(200),
+  level: z.union([z.literal(1), z.literal(2), z.literal(3)]).optional()
+});
+var FlowSeparatorRowSchema = z.object({
+  id: z.string().min(1),
+  order: z.number(),
+  type: z.literal("separator")
+});
+var FlowTextRowSchema = z.object({
+  id: z.string().min(1),
+  order: z.number(),
+  type: z.literal("text"),
+  content: z.string().min(1).max(5e3)
+});
+var FlowRowSchema = z.union([
+  FlowHeadingRowSchema,
+  FlowSeparatorRowSchema,
+  FlowTextRowSchema,
+  FlowFieldsRowSchema
+]);
 var FormNodeSchema = z.object({
   type: z.literal("form"),
   id: z.string().min(1),
@@ -2237,9 +2282,11 @@ var FormExecutor = class {
     }
     if (node.rows) {
       for (const row of node.rows) {
-        for (const field of row.fields) {
-          if (field.slotId) {
-            slotIds.add(field.slotId);
+        if (isFlowFieldsRow(row)) {
+          for (const field of row.fields) {
+            if (field.slotId) {
+              slotIds.add(field.slotId);
+            }
           }
         }
       }
@@ -2304,9 +2351,11 @@ var FormExecutor = class {
     }
     if (node.rows) {
       for (const row of node.rows) {
-        for (const field of row.fields) {
-          if (field.slotId && field.attribute) {
-            refs.push({ slotId: field.slotId, attribute: field.attribute });
+        if (isFlowFieldsRow(row)) {
+          for (const field of row.fields) {
+            if (field.slotId && field.attribute) {
+              refs.push({ slotId: field.slotId, attribute: field.attribute });
+            }
           }
         }
       }
@@ -4401,9 +4450,12 @@ function createMockUserProfilesRepository(stores) {
       if (!existing) {
         return Promise.reject(new Error(`UserProfile ${id} not found`));
       }
+      const sanitized = Object.fromEntries(
+        Object.entries(data).map(([k, v]) => [k, v === null ? void 0 : v])
+      );
       const updated = {
         ...existing,
-        ...data,
+        ...sanitized,
         updatedAt: /* @__PURE__ */ new Date()
       };
       stores.userProfiles.set(id, updated);
@@ -4590,8 +4642,6 @@ function createMockPermissionsRepository(stores) {
     getEffectivePermissions(userProfileId) {
       const tenantId = getTenantId();
       const userRoleIds = Array.from(stores.userRoles.values()).filter((ur) => ur.userProfileId === userProfileId && ur.tenantId === tenantId).map((ur) => ur.roleId);
-      const userRoles = Array.from(stores.roles.values()).filter((r) => userRoleIds.includes(r.id));
-      const hasAdmin = userRoles.some((r) => isAdminRole(r.name));
       const userPermissions = Array.from(stores.permissions.values()).filter(
         (p) => userRoleIds.includes(p.roleId)
       );
@@ -4618,7 +4668,7 @@ function createMockPermissionsRepository(stores) {
           }
         }
       }
-      return Promise.resolve({ isAdmin: hasAdmin, objectPermissions, systemPermissions });
+      return Promise.resolve({ objectPermissions, systemPermissions });
     },
     countUsersWithRole(roleName) {
       const tenantId = getTenantId();
@@ -5636,7 +5686,10 @@ var NON_SORTABLE_TYPES = /* @__PURE__ */ new Set([
   "richtext",
   "file",
   "document",
-  "location"
+  "location",
+  "user",
+  "multiselect",
+  "relation"
 ]);
 function isAttributeSortable(attr) {
   return !NON_SORTABLE_TYPES.has(attr.type);
@@ -8371,8 +8424,10 @@ var WorkflowBuilder = class {
         }
         if (node.rows) {
           for (const row of node.rows) {
-            for (const field of row.fields) {
-              referencedSlots.add(field.slotId);
+            if (isFlowFieldsRow(row)) {
+              for (const field of row.fields) {
+                referencedSlots.add(field.slotId);
+              }
             }
           }
         }
@@ -9867,15 +9922,31 @@ var AuditService = class extends BaseService {
     if (!this.adapter.audit) {
       return;
     }
+    const resolved = await this.resolveActorEmail(entry);
     if (this.options?.async) {
-      this.buffer.push(entry);
+      this.buffer.push(resolved);
       const batchSize = this.options.batchSize ?? 10;
       if (this.buffer.length >= batchSize) {
         await this.flush();
       }
     } else {
-      await this.adapter.audit.create(entry);
+      await this.adapter.audit.create(resolved);
+    }
+  }
+  /**
+   * Resolve actorEmail from user profiles if not already set
+   */
+  async resolveActorEmail(entry) {
+    if (!entry.actorEmail && entry.actorId) {
+      try {
+        const profile = await this.adapter.userProfiles.findById(entry.actorId);
+        if (profile?.email) {
+          return { ...entry, actorEmail: profile.email };
+        }
+      } catch {
+      }
     }
+    return entry;
   }
   /**
    * Start the flush timer for async mode
@@ -15123,6 +15194,74 @@ var UserProfileService = class extends BaseService {
       await this.invalidateCache(cacheKeys.userProfileByEmail(this.tenantId, email));
     }
   }
+  // ============================================================================
+  // AVATAR URL RESOLUTION
+  // ============================================================================
+  /**
+   * Resolve avatar storage path to a signed URL.
+   * External URLs (https://) pass through unchanged.
+   * Storage paths are resolved to fresh signed URLs (1h expiry).
+   */
+  async resolveAvatarUrl(profile) {
+    if (!profile.avatarUrl || profile.avatarUrl.startsWith("https://")) {
+      return profile;
+    }
+    if (!this.adapter.storage) return profile;
+    try {
+      const signedUrl = await this.adapter.storage.getSignedUrl(profile.avatarUrl, {
+        expiresIn: 3600
+      });
+      return { ...profile, avatarUrl: signedUrl };
+    } catch {
+      return profile;
+    }
+  }
+  async resolveAvatarUrls(profiles) {
+    return Promise.all(profiles.map((p) => this.resolveAvatarUrl(p)));
+  }
+  // ============================================================================
+  // AVATAR MANAGEMENT
+  // ============================================================================
+  /**
+   * Upload a new avatar for the user.
+   * Deletes previous avatar from storage if it was an internal upload.
+   * Stores the storagePath — resolved to signed URL at read time.
+   */
+  async uploadAvatar(profileId, input) {
+    if (!this.adapter.storage) {
+      throw new Error("StorageAdapter is not configured.");
+    }
+    if (!input.mimeType.startsWith("image/")) {
+      throw new Error("Only image files are allowed for avatars.");
+    }
+    const profile = await this.getProfileOrThrow(profileId);
+    if (profile.avatarUrl && !profile.avatarUrl.startsWith("https://")) {
+      await this.adapter.storage.delete(profile.avatarUrl).catch(() => void 0);
+    }
+    const result = await this.adapter.storage.upload({
+      content: input.content,
+      fileName: input.fileName,
+      mimeType: input.mimeType,
+      size: input.size,
+      tenantId: this.tenantId,
+      folderPath: "avatars"
+    });
+    return await this.updateProfile(profileId, { avatarUrl: result.storagePath });
+  }
+  /**
+   * Delete the user's avatar.
+   * Removes file from storage if it was an internal upload, then clears avatarUrl.
+   */
+  async deleteAvatar(profileId) {
+    const profile = await this.getProfileOrThrow(profileId);
+    if (profile.avatarUrl && !profile.avatarUrl.startsWith("https://")) {
+      await this.adapter.storage?.delete(profile.avatarUrl).catch(() => void 0);
+    }
+    return await this.updateProfile(profileId, { avatarUrl: null });
+  }
+  // ============================================================================
+  // CREATE
+  // ============================================================================
   /**
    * Create a new user profile (typically after first auth).
    * Automatically uses tenant context from AsyncLocalStorage.
@@ -15163,18 +15302,19 @@ var UserProfileService = class extends BaseService {
         targetUserEmail: profile.email
       });
     }
-    return profile;
+    return this.resolveAvatarUrl(profile);
   }
   /**
    * Get user profile by ID.
    * Results are cached if a CacheAdapter is configured.
    */
   async getProfile(profileId) {
-    return this.cachedBy(
+    const profile = await this.cachedBy(
       "userProfileById",
       profileId,
       () => this.adapter.userProfiles.findById(profileId)
     );
+    return profile ? this.resolveAvatarUrl(profile) : null;
   }
   /**
    * Get user profile by ID or throw
@@ -15196,11 +15336,12 @@ var UserProfileService = class extends BaseService {
    * @returns User profile or null
    */
   async getProfileByAuthId(authId) {
-    return this.cachedBy(
+    const profile = await this.cachedBy(
       "userProfileByAuthId",
       authId,
       () => this.adapter.userProfiles.findByAuthId(authId)
     );
+    return profile ? this.resolveAvatarUrl(profile) : null;
   }
   /**
    * Get or create user profile (idempotent operation)
@@ -15239,11 +15380,11 @@ var UserProfileService = class extends BaseService {
     const updated = await this.adapter.userProfiles.update(profileId, data);
     await this.invalidateProfileCache(updated.id, updated.authId, updated.email);
     if (this.auditService && this.userId) {
-      const changes = buildAuditChanges(existing, data, [
-        "firstName",
-        "lastName",
-        "status"
-      ]);
+      const changes = buildAuditChanges(
+        existing,
+        data,
+        ["firstName", "lastName", "status"]
+      );
       if (changes.length > 0) {
         await this.auditService.logUserAction({
           action: "user.updated",
@@ -15254,7 +15395,7 @@ var UserProfileService = class extends BaseService {
         });
       }
     }
-    return updated;
+    return this.resolveAvatarUrl(updated);
   }
   /**
    * Delete user profile.
@@ -15291,7 +15432,8 @@ var UserProfileService = class extends BaseService {
    * Automatically uses tenant context from AsyncLocalStorage.
    */
   async listProfiles(options) {
-    return await this.adapter.userProfiles.list(options);
+    const profiles = await this.adapter.userProfiles.list(options);
+    return this.resolveAvatarUrls(profiles);
   }
   /**
    * Update last login timestamp
@@ -15322,11 +15464,12 @@ var UserProfileService = class extends BaseService {
    * Automatically uses tenant context from AsyncLocalStorage.
    */
   async getProfileByEmail(email) {
-    return this.cachedBy(
+    const profile = await this.cachedBy(
       "userProfileByEmail",
       email,
       () => this.adapter.userProfiles.findByEmail(email)
     );
+    return profile ? this.resolveAvatarUrl(profile) : null;
   }
   /**
    * Invite a new user by email.
@@ -15359,6 +15502,21 @@ var UserProfileService = class extends BaseService {
       throw new Error(`User with email "${data.email}" already exists in this tenant`);
     }
     const profile = await this.adapter.userProfiles.invite(data);
+    if (this.adapter.permissions) {
+      try {
+        const roles = await this.adapter.permissions.getRoles();
+        const defaultRole = roles.find((r) => r.name === "member" && r.system);
+        if (defaultRole) {
+          await this.adapter.permissions.assignRole({
+            userProfileId: profile.id,
+            roleId: defaultRole.id,
+            tenantId: this.tenantId,
+            assignedBy: this.userId ?? void 0
+          });
+        }
+      } catch {
+      }
+    }
     await this.invalidateProfileCache(profile.id, profile.authId, profile.email);
     if (this.auditService && this.userId) {
       await this.auditService.logUserAction({
@@ -15368,7 +15526,7 @@ var UserProfileService = class extends BaseService {
         targetUserEmail: profile.email
       });
     }
-    return profile;
+    return this.resolveAvatarUrl(profile);
   }
 };
 
@@ -17041,14 +17199,11 @@ var FileService = class extends BaseService {
    * @param userId - User ID to check
    * @returns true if user can access the file
    */
-  async checkAccess(fileId, userId, options) {
+  async checkAccess(fileId, userId) {
     const file2 = await this.getFile(fileId);
     if (!file2) {
       return false;
     }
-    if (options?.isAdmin) {
-      return true;
-    }
     if (file2.visibility === "public") {
       return true;
     }
@@ -17332,9 +17487,6 @@ var PermissionService = class extends BaseService {
    */
   async canAccessObject(userProfileId, objectName, action) {
     const permissions = await this.getEffectivePermissions(userProfileId);
-    if (permissions.isAdmin) {
-      return true;
-    }
     const wildcardPerms = permissions.objectPermissions["*"];
     if (wildcardPerms?.includes(action)) {
       return true;
@@ -17366,9 +17518,6 @@ var PermissionService = class extends BaseService {
    */
   async getObjectPermissions(userProfileId, objectName) {
     const permissions = await this.getEffectivePermissions(userProfileId);
-    if (permissions.isAdmin) {
-      return { canRead: true, canCreate: true, canUpdate: true, canDelete: true };
-    }
     const wildcardPerms = permissions.objectPermissions["*"] ?? [];
     const objectPerms = permissions.objectPermissions[objectName] ?? [];
     const allPerms = /* @__PURE__ */ new Set([...wildcardPerms, ...objectPerms]);
@@ -17392,9 +17541,6 @@ var PermissionService = class extends BaseService {
    */
   async canAccessSystem(userProfileId, resource, action) {
     const permissions = await this.getEffectivePermissions(userProfileId);
-    if (permissions.isAdmin) {
-      return true;
-    }
     const wildcardPerms = permissions.systemPermissions?.["*"];
     if (wildcardPerms?.includes(action)) {
       return true;
@@ -17426,9 +17572,6 @@ var PermissionService = class extends BaseService {
    */
   async getSystemPermissions(userProfileId, resource) {
     const permissions = await this.getEffectivePermissions(userProfileId);
-    if (permissions.isAdmin) {
-      return { canRead: true, canCreate: true, canUpdate: true, canDelete: true };
-    }
     const wildcardPerms = permissions.systemPermissions?.["*"] ?? [];
     const resourcePerms = permissions.systemPermissions?.[resource] ?? [];
     const allPerms = /* @__PURE__ */ new Set([...wildcardPerms, ...resourcePerms]);
@@ -17633,9 +17776,8 @@ var PermissionService = class extends BaseService {
    * Initialize default roles for the tenant if they don't exist.
    *
    * Creates the following roles with their default permissions:
-   * - **admin**: Full access to all system resources and objects
-   * - **member**: No system access, can read/create/update objects (no delete)
-   * - **guest**: No system access, read-only access to objects
+   * - **owner**: Full access to all system resources and objects
+   * - **member**: Full CRUD on business data, read-only on system resources (people, workspace)
    *
    * This method is idempotent - it only creates roles that don't already exist.
    * Should be called during tenant bootstrap or on first admin login.
@@ -17652,7 +17794,7 @@ var PermissionService = class extends BaseService {
       DEFAULT_ROLE_LABELS,
       DEFAULT_ROLE_DESCRIPTIONS,
       DEFAULT_ROLE_PERMISSIONS
-    } = await import("./default-roles-OAMHLOCS.mjs");
+    } = await import("./default-roles-6D3HQ3DQ.mjs");
     const existingRoles = await this.getRoles();
     const existingRoleNames = existingRoles.reduce((set, r) => set.add(r.name), /* @__PURE__ */ new Set());
     for (const roleName of Object.values(DEFAULT_ROLES)) {
@@ -18591,9 +18733,7 @@ async function cleanupOrphanObjects(adapter, nativeObjects, result, options) {
   const registryNames = nativeObjects.map((obj) => obj.name);
   if (options.dryRun) {
     const allObjects = await adapter.objects.list();
-    const orphans = allObjects.filter(
-      (obj) => obj.system && !registryNames.includes(obj.name)
-    );
+    const orphans = allObjects.filter((obj) => obj.system && !registryNames.includes(obj.name));
     result.objectsDeleted += orphans.length;
     if (options.verbose && orphans.length > 0) {
       console.info(
@@ -18681,6 +18821,11 @@ export {
   AttributeInUseError,
   ObjectReferencedError,
   getErrorMessage,
+  isFlowFieldsRow,
+  isLayoutRow,
+  isFlowDefinition,
+  isFlowPublished,
+  isSystemFlow,
   NoopGeocodingAdapter,
   SYSTEM_FIELD_NAMES,
   RESERVED_ATTRIBUTE_NAMES,
@@ -18723,6 +18868,7 @@ export {
   createEmptyContext,
   getContextValue,
   setContextValue,
+  isFormFieldsRow,
   DEFAULT_THEME,
   mergeWithDefaults,
   generateCssVariables,