@carthooks/arcubase-cli 0.1.17 → 0.1.19

package/bundle/arcubase-admin.mjs

@@ -16081,7 +16081,7 @@ var AppCreateEntityReqVOSchema = external_exports.lazy(() => external_exports.ob
 var I18NTextSchema = external_exports.lazy(() => external_exports.record(external_exports.string(), external_exports.string()));
 var PermitColumnSchema = external_exports.lazy(() => external_exports.object({ "field_id": external_exports.number().optional(), "is_field": external_exports.boolean().optional(), "prop": external_exports.string().optional() }).strict());
 var PermitSearchColumnSchema = external_exports.lazy(() => external_exports.object({ "default": external_exports.boolean().optional(), "default_value": external_exports.array(external_exports.number()).optional(), "field_id": external_exports.number().optional(), "infilter": external_exports.boolean().optional(), "is_field": external_exports.boolean().optional(), "pinned": external_exports.boolean().optional(), "prop": external_exports.string().optional(), "wildcard": external_exports.boolean().optional() }).strict());
-var PermitEntityPropSchema = external_exports.lazy(() => external_exports.union([external_exports.literal("created"), external_exports.literal("updated"), external_exports.literal("creator")]));
+var PermitEntityPropSchema = external_exports.lazy(() => external_exports.string().min(1));
 var PermitValueFromSchema = external_exports.lazy(() => external_exports.union([external_exports.literal(1), external_exports.literal(2), external_exports.literal(3)]));
 var PermitRecordConditionSchema = external_exports.lazy(() => external_exports.object({ "column": PermitEntityPropSchema.optional(), "operator": external_exports.string().optional(), "subset": PermitConditionSetSchema.optional(), "value": external_exports.any().optional(), "value_from": PermitValueFromSchema.optional(), "value_relation": PermitEntityPropSchema.optional() }).strict());
 var PermitConditionSetSchema = external_exports.lazy(() => external_exports.object({ "conditions": external_exports.array(PermitRecordConditionSchema).optional(), "mode": external_exports.string().optional() }).strict());
@@ -17509,17 +17509,17 @@ function renderCommandHelp(scope, moduleName, commandName, env = process.env) {
       `  - hide field: ${JSON.stringify(buildHiddenFieldAccessRuleBody())}`,
       "success requires:",
       "  - result.enabled must be true",
-      '  - options.user_scope[].type is "user" for tenant users',
+      '  - options.user_scope[].type is "user", "department", or "actor"',
       '  - hidden fields use colon field keys such as ":1002"'
     ] : [],
     ...scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "assign-users" ? [
       "body-json example:",
-      '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+      '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}',
       "success requires:",
       "  - result.enabled must be true",
-      "  - result.options.user_scope must contain the assigned numeric arcubaseUserId values",
-      "  - PermitUserScope.id must be the numeric arcubaseUserId",
-      "  - Do not copy a non-numeric arcubaseUserId into PermitUserScope.id",
+      "  - result.options.user_scope must contain every assigned user, department, or actor scope",
+      "  - PermitUserScope.id must be the numeric arcubaseUserId, department ID, or actor ID",
+      "  - Do not copy a non-numeric BotWorks userId into PermitUserScope.id",
       "  - If result.enabled is false, enable the rule first and retry assign-users"
     ] : [],
     ...scope === "admin" && command.commandPath[0] === "app" && command.commandPath[1] === "create-from-bundle-url" ? [
@@ -17990,14 +17990,18 @@ function buildAssignUsersValidationDetails(scope, command, requestType, path3, m
     shapeHint: {
       update: ["user_scope"],
       options: {
-        user_scope: [{ type: "user", id: 2188889901 }]
+        user_scope: [
+          { type: "user", id: 2188889901 },
+          { type: "department", id: 2188881201 },
+          { type: "actor", id: 2188883301 }
+        ]
       }
     },
     commonMistakes: [
       "do not use user_scope at top level",
       "do not use users or allowedUsers",
-      "do not use non-numeric arcubaseUserId as id",
-      "id must be the numeric arcubaseUserId"
+      "do not use non-numeric BotWorks userId as id",
+      "id must be the numeric arcubaseUserId, department ID, or actor ID"
     ]
   };
 }
@@ -18278,7 +18282,7 @@ function validateAccessRuleUserScope(scope, command, requestType, userScope, env
   if (userScope === void 0) return;
   if (!Array.isArray(userScope)) {
     throwBodyValidationFailure(
-      'access-rule user_scope must be an array of {"type":"user","id":2188889901}',
+      'access-rule user_scope must be an array of {"type":"user","id":2188889901}, {"type":"department","id":2188881201}, or {"type":"actor","id":2188883301}',
       requestType,
       pathPrefix,
       scope,
@@ -18341,7 +18345,7 @@ function validateActionSpecificRawBody(scope, command, body, env) {
   if (isAssignUsersCommand(scope, command)) {
     if ("users" in body || "allowedUsers" in body || "user_scope" in body) {
       throwBodyValidationFailure(
-        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}',
         command.requestType,
         "body.options.user_scope",
         scope,
@@ -18462,7 +18466,7 @@ function validateActionSpecificBody(scope, command, flags, body, env) {
     const userScope = options && Array.isArray(options.user_scope) ? options.user_scope : void 0;
     if ("users" in body || "allowedUsers" in body) {
       throwBodyValidationFailure(
-        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}',
         command.requestType,
         "body.options.user_scope",
         scope,
@@ -18503,19 +18507,9 @@ function validateActionSpecificBody(scope, command, flags, body, env) {
           env
         );
       }
-      if (item.type !== "user") {
-        throwBodyValidationFailure(
-          'access-rule assign-users requires body.options.user_scope[].type to be "user"',
-          command.requestType,
-          `body.options.user_scope.${index}.type`,
-          scope,
-          command,
-          env
-        );
-      }
       if (typeof item.id !== "number" || !Number.isInteger(item.id) || item.id <= 0) {
         throwBodyValidationFailure(
-          "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId",
+          "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId, department ID, or actor ID",
           command.requestType,
           `body.options.user_scope.${index}.id`,
           scope,
@@ -19217,16 +19211,17 @@ async function executeCLI(scope, argv, env, fetchImpl = fetch) {
         const message = parsedBody.error.issues.map((issue2) => `${issue2.path.join(".")}: ${issue2.message}`).join("; ");
         if (isAssignUsersCommand(scope, command)) {
           const hasUserScopeIDIssue = parsedBody.error.issues.some((issue2) => issue2.path.join(".") === "options.user_scope.0.id" || issue2.path.join(".").startsWith("options.user_scope."));
+          const userScopeIDMessage = "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId, department ID, or actor ID";
           throw new CLIError(
             "BODY_VALIDATION_FAILED",
-            hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId" : message,
+            hasUserScopeIDIssue ? userScopeIDMessage : message,
             2,
             buildAssignUsersValidationDetails(
               scope,
               command,
               command.requestType,
               hasUserScopeIDIssue ? "body.options.user_scope" : "body",
-              hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId" : message,
+              hasUserScopeIDIssue ? userScopeIDMessage : message,
               runtimeEnv
             )
           );

package/bundle/arcubase.mjs

@@ -16081,7 +16081,7 @@ var AppCreateEntityReqVOSchema = external_exports.lazy(() => external_exports.ob
 var I18NTextSchema = external_exports.lazy(() => external_exports.record(external_exports.string(), external_exports.string()));
 var PermitColumnSchema = external_exports.lazy(() => external_exports.object({ "field_id": external_exports.number().optional(), "is_field": external_exports.boolean().optional(), "prop": external_exports.string().optional() }).strict());
 var PermitSearchColumnSchema = external_exports.lazy(() => external_exports.object({ "default": external_exports.boolean().optional(), "default_value": external_exports.array(external_exports.number()).optional(), "field_id": external_exports.number().optional(), "infilter": external_exports.boolean().optional(), "is_field": external_exports.boolean().optional(), "pinned": external_exports.boolean().optional(), "prop": external_exports.string().optional(), "wildcard": external_exports.boolean().optional() }).strict());
-var PermitEntityPropSchema = external_exports.lazy(() => external_exports.union([external_exports.literal("created"), external_exports.literal("updated"), external_exports.literal("creator")]));
+var PermitEntityPropSchema = external_exports.lazy(() => external_exports.string().min(1));
 var PermitValueFromSchema = external_exports.lazy(() => external_exports.union([external_exports.literal(1), external_exports.literal(2), external_exports.literal(3)]));
 var PermitRecordConditionSchema = external_exports.lazy(() => external_exports.object({ "column": PermitEntityPropSchema.optional(), "operator": external_exports.string().optional(), "subset": PermitConditionSetSchema.optional(), "value": external_exports.any().optional(), "value_from": PermitValueFromSchema.optional(), "value_relation": PermitEntityPropSchema.optional() }).strict());
 var PermitConditionSetSchema = external_exports.lazy(() => external_exports.object({ "conditions": external_exports.array(PermitRecordConditionSchema).optional(), "mode": external_exports.string().optional() }).strict());
@@ -17509,17 +17509,17 @@ function renderCommandHelp(scope, moduleName, commandName, env = process.env) {
       `  - hide field: ${JSON.stringify(buildHiddenFieldAccessRuleBody())}`,
       "success requires:",
       "  - result.enabled must be true",
-      '  - options.user_scope[].type is "user" for tenant users',
+      '  - options.user_scope[].type is "user", "department", or "actor"',
       '  - hidden fields use colon field keys such as ":1002"'
     ] : [],
     ...scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "assign-users" ? [
       "body-json example:",
-      '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+      '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}',
       "success requires:",
       "  - result.enabled must be true",
-      "  - result.options.user_scope must contain the assigned numeric arcubaseUserId values",
-      "  - PermitUserScope.id must be the numeric arcubaseUserId",
-      "  - Do not copy a non-numeric arcubaseUserId into PermitUserScope.id",
+      "  - result.options.user_scope must contain every assigned user, department, or actor scope",
+      "  - PermitUserScope.id must be the numeric arcubaseUserId, department ID, or actor ID",
+      "  - Do not copy a non-numeric BotWorks userId into PermitUserScope.id",
       "  - If result.enabled is false, enable the rule first and retry assign-users"
     ] : [],
     ...scope === "admin" && command.commandPath[0] === "app" && command.commandPath[1] === "create-from-bundle-url" ? [
@@ -17990,14 +17990,18 @@ function buildAssignUsersValidationDetails(scope, command, requestType, path3, m
     shapeHint: {
       update: ["user_scope"],
       options: {
-        user_scope: [{ type: "user", id: 2188889901 }]
+        user_scope: [
+          { type: "user", id: 2188889901 },
+          { type: "department", id: 2188881201 },
+          { type: "actor", id: 2188883301 }
+        ]
       }
     },
     commonMistakes: [
       "do not use user_scope at top level",
       "do not use users or allowedUsers",
-      "do not use non-numeric arcubaseUserId as id",
-      "id must be the numeric arcubaseUserId"
+      "do not use non-numeric BotWorks userId as id",
+      "id must be the numeric arcubaseUserId, department ID, or actor ID"
     ]
   };
 }
@@ -18278,7 +18282,7 @@ function validateAccessRuleUserScope(scope, command, requestType, userScope, env
   if (userScope === void 0) return;
   if (!Array.isArray(userScope)) {
     throwBodyValidationFailure(
-      'access-rule user_scope must be an array of {"type":"user","id":2188889901}',
+      'access-rule user_scope must be an array of {"type":"user","id":2188889901}, {"type":"department","id":2188881201}, or {"type":"actor","id":2188883301}',
       requestType,
       pathPrefix,
       scope,
@@ -18341,7 +18345,7 @@ function validateActionSpecificRawBody(scope, command, body, env) {
   if (isAssignUsersCommand(scope, command)) {
     if ("users" in body || "allowedUsers" in body || "user_scope" in body) {
       throwBodyValidationFailure(
-        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}',
         command.requestType,
         "body.options.user_scope",
         scope,
@@ -18462,7 +18466,7 @@ function validateActionSpecificBody(scope, command, flags, body, env) {
     const userScope = options && Array.isArray(options.user_scope) ? options.user_scope : void 0;
     if ("users" in body || "allowedUsers" in body) {
       throwBodyValidationFailure(
-        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}',
         command.requestType,
         "body.options.user_scope",
         scope,
@@ -18503,19 +18507,9 @@ function validateActionSpecificBody(scope, command, flags, body, env) {
           env
         );
       }
-      if (item.type !== "user") {
-        throwBodyValidationFailure(
-          'access-rule assign-users requires body.options.user_scope[].type to be "user"',
-          command.requestType,
-          `body.options.user_scope.${index}.type`,
-          scope,
-          command,
-          env
-        );
-      }
       if (typeof item.id !== "number" || !Number.isInteger(item.id) || item.id <= 0) {
         throwBodyValidationFailure(
-          "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId",
+          "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId, department ID, or actor ID",
           command.requestType,
           `body.options.user_scope.${index}.id`,
           scope,
@@ -19217,16 +19211,17 @@ async function executeCLI(scope, argv, env, fetchImpl = fetch) {
         const message = parsedBody.error.issues.map((issue2) => `${issue2.path.join(".")}: ${issue2.message}`).join("; ");
         if (isAssignUsersCommand(scope, command)) {
           const hasUserScopeIDIssue = parsedBody.error.issues.some((issue2) => issue2.path.join(".") === "options.user_scope.0.id" || issue2.path.join(".").startsWith("options.user_scope."));
+          const userScopeIDMessage = "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId, department ID, or actor ID";
           throw new CLIError(
             "BODY_VALIDATION_FAILED",
-            hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId" : message,
+            hasUserScopeIDIssue ? userScopeIDMessage : message,
             2,
             buildAssignUsersValidationDetails(
               scope,
               command,
               command.requestType,
               hasUserScopeIDIssue ? "body.options.user_scope" : "body",
-              hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId" : message,
+              hasUserScopeIDIssue ? userScopeIDMessage : message,
               runtimeEnv
             )
           );

package/dist/adapters/user_identity_adapter.d.ts

@@ -0,0 +1,7 @@
+import type { ArcubaseCliUserReference } from '../interface/user_identity.js';
+export type ApiTenantUserReference = {
+    tenantUserId: string;
+};
+export declare function toCliArcubaseUserId(input: ApiTenantUserReference): ArcubaseCliUserReference;
+export declare function toApiTenantUserId(input: ArcubaseCliUserReference): ApiTenantUserReference;
+//# sourceMappingURL=user_identity_adapter.d.ts.map

package/dist/adapters/user_identity_adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user_identity_adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/user_identity_adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAE7E,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,GAAG,wBAAwB,CAI3F;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,GAAG,sBAAsB,CAIzF"}

package/dist/adapters/user_identity_adapter.js

@@ -0,0 +1,10 @@
+export function toCliArcubaseUserId(input) {
+    return {
+        arcubaseUserId: input.tenantUserId,
+    };
+}
+export function toApiTenantUserId(input) {
+    return {
+        tenantUserId: input.arcubaseUserId,
+    };
+}

package/dist/generated/zod_registry.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zod_registry.generated.d.ts","sourceRoot":"","sources":["../../src/generated/zod_registry.generated.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,UAAwJ,CAAA;AAEtM,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,UAAgH,CAAA;AAE3J,eAAO,MAAM,cAAc,EAAE,CAAC,CAAC,UAA2D,CAAA;AAE1F,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,UAAsJ,CAAA;AAEzL,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,UAAoV,CAAA;AAE7X,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,UAAsG,CAAA;AAE7I,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,UAA8E,CAAA;AAEpH,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,UAAiT,CAAA;AAE7V,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,UAA8I,CAAA;AAEvL,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,UAA0M,CAAA;AAEpP,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,UAA4L,CAAA;AAEzO,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,UAAub,CAAA;AAEre,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAAiL,CAAA;AAEzN,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,UAA2Z,CAAA;AAE9b,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,UAAqL,CAAA;AAE3N,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,UAAoP,CAAA;AAE/R,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,UAAyS,CAAA;AAErV,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,UAA8M,CAAA;AAE1P,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,UAAgH,CAAA;AAEpJ,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,UAA8F,CAAA;AAE/H,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAAuf,CAAA;AAE/hB,eAAO,MAAM,8BAA8B,EAAE,CAAC,CAAC,UAAqX,CAAA;AAEpa,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,UAAkI,CAAA;AAEhL,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,UAAiJ,CAAA;AAE7L,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,UAA6O,CAAA;AAE9R,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,UAAkQ,CAAA;AAEhT,eAAO,MAAM,+BAA+B,EAAE,CAAC,CAAC,UAA4G,CAAA;AAE5J,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,UAAgZ,CAAA;AAE1b,eAAO,MAAM,8BAA8B,EAAE,CAAC,CAAC,UAAiZ,CAAA;AAEhc,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,UAAiH,CAAA;AAE1J,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,UAA2U,CAAA;AAElX,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,UAA6R,CAAA;AAE9U,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,UAA+E,CAAA;AAEzH,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,UAAgH,CAAA;AAE5J,eAAO,MAAM,YAAY,EAAE,CAAC,CAAC,UAAwD,CAAA;AAErF,eAAO,MAAM,YAAY,EAAE,CAAC,CAAC,UAAmK,CAAA;AAEhM,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,UAA8E,CAAA;AAExH,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,UAA+J,CAAA;AAErM,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,UAA6K,CAAA;AAE/M,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,UAAgR,CAAA;AAEhT,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,UAA4I,CAAA;AAE7K,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,UAAqH,CAAA;AAE5J,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,UAA8S,CAAA;AAEhV,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,UAA4gB,CAAA;AAEnjB,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,UAAmM,CAAA;AAEtO,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAAyI,CAAA;AAEjL,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,UAAgE,CAAA;AAE9G,eAAO,MAAM,kCAAkC,EAAE,CAAC,CAAC,UAA4E,CAAA;AAE/H,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,UAAmpC,CAAA;AAEvrC,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,UAAkf,CAAA;AAExhB,eAAO,MAAM,iCAAiC,EAAE,CAAC,CAAC,UAAiH,CAAA;AAEnK,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAA8Q,CAAA;AAEtT,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,UAAsM,CAAA;AAEvP,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAAgO,CAAA;AAExQ,eAAO,MAAM,qCAAqC,EAAE,CAAC,CAAC,UAA+L,CAAA;AAErP,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,UAAqX,CAAA;AAEla,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,UAAgI,CAAA;AAEvK,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,UAAoQ,CAAA;AAE/S,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,UAAgE,CAAA;AAEvG,eAAO,MAAM,+BAA+B,EAAE,CAAC,CAAC,UAAqM,CAAA;AAErP,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,UAAy8B,CAAA;AAEl/B,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,UAA6N,CAAA;AAEzQ,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,UAA8E,CAAA;AAE5H,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,UAA8E,CAAA;AAExH,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,UAAqR,CAAA;AAE9T,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAAgR,CAAA;AAExT,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,UAA6S,CAAA;AAEnV,eAAO,MAAM,+BAA+B,EAAE,CAAC,CAAC,UAA6K,CAAA;AAE7N,eAAO,MAAM,+BAA+B,EAAE,CAAC,CAAC,UAA6K,CAAA;AAE7N,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,UAAkF,CAAA;AAE5H,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,UAAwI,CAAA;AAE1K,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,UAAuK,CAAA;AAEpN,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAAqG,CAAA;AAE7I,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,UAAoH,CAAA;AAE7J,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,UAAgH,CAAA;AAElJ,eAAO,MAAM,YAAY,EAAE,CAAC,CAAC,UAA0mB,CAAA;AAEvoB,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,UAA0G,CAAA;AAE7I,eAAO,MAAM,UAAU,EAAE,CAAC,CAAC,UAA4c,CAAA;AAEve,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,UAAmsB,CAAA;AAEpuB,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,UAAmL,CAAA;AAEhO,eAAO,MAAM,qBAAqB,kkBAwBxB,CAAA;AAEV,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAA;AAEV,eAAO,MAAM,sBAAsB,IAEzB,CAAA;AAEV,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,WAAW,CAAA"}
+{"version":3,"file":"zod_registry.generated.d.ts","sourceRoot":"","sources":["../../src/generated/zod_registry.generated.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,UAAwJ,CAAA;AAEtM,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,UAAgH,CAAA;AAE3J,eAAO,MAAM,cAAc,EAAE,CAAC,CAAC,UAA2D,CAAA;AAE1F,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,UAAsJ,CAAA;AAEzL,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,UAAoV,CAAA;AAE7X,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,UAA4C,CAAA;AAEnF,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,UAA8E,CAAA;AAEpH,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,UAAiT,CAAA;AAE7V,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,UAA8I,CAAA;AAEvL,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,UAA0M,CAAA;AAEpP,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,UAA4L,CAAA;AAEzO,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,UAAub,CAAA;AAEre,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAAiL,CAAA;AAEzN,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,UAA2Z,CAAA;AAE9b,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,UAAqL,CAAA;AAE3N,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,UAAoP,CAAA;AAE/R,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,UAAyS,CAAA;AAErV,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,UAA8M,CAAA;AAE1P,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,UAAgH,CAAA;AAEpJ,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,UAA8F,CAAA;AAE/H,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAAuf,CAAA;AAE/hB,eAAO,MAAM,8BAA8B,EAAE,CAAC,CAAC,UAAqX,CAAA;AAEpa,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,UAAkI,CAAA;AAEhL,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,UAAiJ,CAAA;AAE7L,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,UAA6O,CAAA;AAE9R,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,UAAkQ,CAAA;AAEhT,eAAO,MAAM,+BAA+B,EAAE,CAAC,CAAC,UAA4G,CAAA;AAE5J,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,UAAgZ,CAAA;AAE1b,eAAO,MAAM,8BAA8B,EAAE,CAAC,CAAC,UAAiZ,CAAA;AAEhc,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,UAAiH,CAAA;AAE1J,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,UAA2U,CAAA;AAElX,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,UAA6R,CAAA;AAE9U,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,UAA+E,CAAA;AAEzH,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,UAAgH,CAAA;AAE5J,eAAO,MAAM,YAAY,EAAE,CAAC,CAAC,UAAwD,CAAA;AAErF,eAAO,MAAM,YAAY,EAAE,CAAC,CAAC,UAAmK,CAAA;AAEhM,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,UAA8E,CAAA;AAExH,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,UAA+J,CAAA;AAErM,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,UAA6K,CAAA;AAE/M,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,UAAgR,CAAA;AAEhT,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,UAA4I,CAAA;AAE7K,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,UAAqH,CAAA;AAE5J,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,UAA8S,CAAA;AAEhV,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,UAA4gB,CAAA;AAEnjB,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,UAAmM,CAAA;AAEtO,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAAyI,CAAA;AAEjL,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,UAAgE,CAAA;AAE9G,eAAO,MAAM,kCAAkC,EAAE,CAAC,CAAC,UAA4E,CAAA;AAE/H,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,UAAmpC,CAAA;AAEvrC,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,UAAkf,CAAA;AAExhB,eAAO,MAAM,iCAAiC,EAAE,CAAC,CAAC,UAAiH,CAAA;AAEnK,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAA8Q,CAAA;AAEtT,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,UAAsM,CAAA;AAEvP,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAAgO,CAAA;AAExQ,eAAO,MAAM,qCAAqC,EAAE,CAAC,CAAC,UAA+L,CAAA;AAErP,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,UAAqX,CAAA;AAEla,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,UAAgI,CAAA;AAEvK,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,UAAoQ,CAAA;AAE/S,eAAO,MAAM,sBAAsB,EAAE,CAAC,CAAC,UAAgE,CAAA;AAEvG,eAAO,MAAM,+BAA+B,EAAE,CAAC,CAAC,UAAqM,CAAA;AAErP,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,UAAy8B,CAAA;AAEl/B,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,UAA6N,CAAA;AAEzQ,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,UAA8E,CAAA;AAE5H,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,UAA8E,CAAA;AAExH,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,UAAqR,CAAA;AAE9T,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAAgR,CAAA;AAExT,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,UAA6S,CAAA;AAEnV,eAAO,MAAM,+BAA+B,EAAE,CAAC,CAAC,UAA6K,CAAA;AAE7N,eAAO,MAAM,+BAA+B,EAAE,CAAC,CAAC,UAA6K,CAAA;AAE7N,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,UAAkF,CAAA;AAE5H,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,UAAwI,CAAA;AAE1K,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,UAAuK,CAAA;AAEpN,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,UAAqG,CAAA;AAE7I,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,UAAoH,CAAA;AAE7J,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,UAAgH,CAAA;AAElJ,eAAO,MAAM,YAAY,EAAE,CAAC,CAAC,UAA0mB,CAAA;AAEvoB,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,UAA0G,CAAA;AAE7I,eAAO,MAAM,UAAU,EAAE,CAAC,CAAC,UAA4c,CAAA;AAEve,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,UAAmsB,CAAA;AAEpuB,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,UAAmL,CAAA;AAEhO,eAAO,MAAM,qBAAqB,kkBAwBxB,CAAA;AAEV,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAA;AAEV,eAAO,MAAM,sBAAsB,IAEzB,CAAA;AAEV,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,WAAW,CAAA"}

package/dist/generated/zod_registry.generated.js

@@ -5,7 +5,7 @@ export const AppCreateEntityReqVOSchema = z.lazy(() => z.object({ "name": z.stri
 export const I18NTextSchema = z.lazy(() => z.record(z.string(), z.string()));
 export const PermitColumnSchema = z.lazy(() => z.object({ "field_id": z.number().optional(), "is_field": z.boolean().optional(), "prop": z.string().optional() }).strict());
 export const PermitSearchColumnSchema = z.lazy(() => z.object({ "default": z.boolean().optional(), "default_value": z.array(z.number()).optional(), "field_id": z.number().optional(), "infilter": z.boolean().optional(), "is_field": z.boolean().optional(), "pinned": z.boolean().optional(), "prop": z.string().optional(), "wildcard": z.boolean().optional() }).strict());
-export const PermitEntityPropSchema = z.lazy(() => z.union([z.literal("created"), z.literal("updated"), z.literal("creator")]));
+export const PermitEntityPropSchema = z.lazy(() => z.string().min(1));
 export const PermitValueFromSchema = z.lazy(() => z.union([z.literal(1), z.literal(2), z.literal(3)]));
 export const PermitRecordConditionSchema = z.lazy(() => z.object({ "column": PermitEntityPropSchema.optional(), "operator": z.string().optional(), "subset": PermitConditionSetSchema.optional(), "value": z.any().optional(), "value_from": PermitValueFromSchema.optional(), "value_relation": PermitEntityPropSchema.optional() }).strict());
 export const PermitConditionSetSchema = z.lazy(() => z.object({ "conditions": z.array(PermitRecordConditionSchema).optional(), "mode": z.string().optional() }).strict());

package/dist/interface/index.d.ts

@@ -0,0 +1,3 @@
+export * from './user_identity.js';
+export * from './organization.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/interface/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/interface/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA"}

package/dist/interface/index.js

@@ -0,0 +1,2 @@
+export * from './user_identity.js';
+export * from './organization.js';

package/dist/interface/organization.d.ts

@@ -0,0 +1,14 @@
+import type { ArcubaseUserId } from './user_identity.js';
+export type ArcubaseCliDepartmentMember = {
+    arcubaseUserId: ArcubaseUserId;
+    name?: string;
+    departments?: string[];
+    roles?: string[];
+};
+export type ArcubaseCliRoleMember = {
+    arcubaseUserId: ArcubaseUserId;
+    name?: string;
+    departments?: string[];
+    roles?: string[];
+};
+//# sourceMappingURL=organization.d.ts.map

package/dist/interface/organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../src/interface/organization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,MAAM,MAAM,2BAA2B,GAAG;IACxC,cAAc,EAAE,cAAc,CAAA;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,cAAc,EAAE,cAAc,CAAA;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB,CAAA"}

package/dist/interface/organization.js

@@ -0,0 +1 @@
+export {};

package/dist/interface/user_identity.d.ts

@@ -0,0 +1,10 @@
+export type ArcubaseUserId = string;
+export type ArcubaseCliUserIdentity = {
+    arcubaseUserId: ArcubaseUserId;
+    name?: string;
+    email?: string;
+};
+export type ArcubaseCliUserReference = {
+    arcubaseUserId: ArcubaseUserId;
+};
+//# sourceMappingURL=user_identity.d.ts.map

package/dist/interface/user_identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user_identity.d.ts","sourceRoot":"","sources":["../../src/interface/user_identity.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,MAAM,CAAA;AAEnC,MAAM,MAAM,uBAAuB,GAAG;IACpC,cAAc,EAAE,cAAc,CAAA;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,cAAc,EAAE,cAAc,CAAA;CAC/B,CAAA"}

package/dist/interface/user_identity.js

@@ -0,0 +1 @@
+export {};

package/dist/runtime/execute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/runtime/execute.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AAG1D,OAAO,EAAyF,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAOhJ,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9B,CAAA;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAc1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE,QAAsB,GAAG,MAAM,CAoB7G;AAOD,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAMlD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,QAAsB,GAAG,MAAM,CA6HpI;AAowDD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,uBAAuB,CActH;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,GAAG,CAAC,CA6MrI"}
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/runtime/execute.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AAG1D,OAAO,EAAyF,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAOhJ,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9B,CAAA;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAc1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE,QAAsB,GAAG,MAAM,CAoB7G;AAOD,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAMlD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,QAAsB,GAAG,MAAM,CA6HpI;AA8vDD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,uBAAuB,CActH;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,GAAG,CAAC,CA8MrI"}

package/dist/runtime/execute.js

@@ -113,19 +113,19 @@ export function renderCommandHelp(scope, moduleName, commandName, env = process.
                 `  - hide field: ${JSON.stringify(buildHiddenFieldAccessRuleBody())}`,
                 'success requires:',
                 '  - result.enabled must be true',
-                '  - options.user_scope[].type is "user" for tenant users',
+                '  - options.user_scope[].type is "user", "department", or "actor"',
                 '  - hidden fields use colon field keys such as ":1002"',
             ]
             : []),
         ...(scope === 'admin' && command.commandPath[0] === 'access-rule' && command.commandPath[1] === 'assign-users'
             ? [
                 'body-json example:',
-                '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+                '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}',
                 'success requires:',
                 '  - result.enabled must be true',
-                '  - result.options.user_scope must contain the assigned numeric arcubaseUserId values',
-                '  - PermitUserScope.id must be the numeric arcubaseUserId',
-                '  - Do not copy a non-numeric arcubaseUserId into PermitUserScope.id',
+                '  - result.options.user_scope must contain every assigned user, department, or actor scope',
+                '  - PermitUserScope.id must be the numeric arcubaseUserId, department ID, or actor ID',
+                '  - Do not copy a non-numeric BotWorks userId into PermitUserScope.id',
                 '  - If result.enabled is false, enable the rule first and retry assign-users',
             ]
             : []),
@@ -628,14 +628,18 @@ function buildAssignUsersValidationDetails(scope, command, requestType, path, me
         shapeHint: {
             update: ['user_scope'],
             options: {
-                user_scope: [{ type: 'user', id: 2188889901 }],
+                user_scope: [
+                    { type: 'user', id: 2188889901 },
+                    { type: 'department', id: 2188881201 },
+                    { type: 'actor', id: 2188883301 },
+                ],
             },
         },
         commonMistakes: [
             'do not use user_scope at top level',
             'do not use users or allowedUsers',
-            'do not use non-numeric arcubaseUserId as id',
-            'id must be the numeric arcubaseUserId',
+            'do not use non-numeric BotWorks userId as id',
+            'id must be the numeric arcubaseUserId, department ID, or actor ID',
         ],
     };
 }
@@ -895,7 +899,7 @@ function validateAccessRuleUserScope(scope, command, requestType, userScope, env
     if (userScope === undefined)
         return;
     if (!Array.isArray(userScope)) {
-        throwBodyValidationFailure('access-rule user_scope must be an array of {"type":"user","id":2188889901}', requestType, pathPrefix, scope, command, env);
+        throwBodyValidationFailure('access-rule user_scope must be an array of {"type":"user","id":2188889901}, {"type":"department","id":2188881201}, or {"type":"actor","id":2188883301}', requestType, pathPrefix, scope, command, env);
     }
     const allowedTypes = new Set(['user', 'department', 'actor']);
     for (const [index, item] of userScope.entries()) {
@@ -924,7 +928,7 @@ function validateActionSpecificRawBody(scope, command, body, env) {
     }
     if (isAssignUsersCommand(scope, command)) {
         if ('users' in body || 'allowedUsers' in body || 'user_scope' in body) {
-            throwBodyValidationFailure('access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}', command.requestType, 'body.options.user_scope', scope, command, env);
+            throwBodyValidationFailure('access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}', command.requestType, 'body.options.user_scope', scope, command, env);
         }
     }
     if (isTableSchemaCommand(scope, command)) {
@@ -983,7 +987,7 @@ function validateActionSpecificBody(scope, command, flags, body, env) {
         const options = isRecord(body.options) ? body.options : undefined;
         const userScope = options && Array.isArray(options.user_scope) ? options.user_scope : undefined;
         if ('users' in body || 'allowedUsers' in body) {
-            throwBodyValidationFailure('access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}', command.requestType, 'body.options.user_scope', scope, command, env);
+            throwBodyValidationFailure('access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}', command.requestType, 'body.options.user_scope', scope, command, env);
         }
         if (!update.includes('user_scope')) {
             throwBodyValidationFailure('access-rule assign-users requires body.update to include "user_scope"', command.requestType, 'body.update', scope, command, env);
@@ -997,11 +1001,8 @@ function validateActionSpecificBody(scope, command, flags, body, env) {
             if (!isRecord(item)) {
                 throwBodyValidationFailure('access-rule assign-users requires each body.options.user_scope item to be an object', command.requestType, `body.options.user_scope.${index}`, scope, command, env);
             }
-            if (item.type !== 'user') {
-                throwBodyValidationFailure('access-rule assign-users requires body.options.user_scope[].type to be "user"', command.requestType, `body.options.user_scope.${index}.type`, scope, command, env);
-            }
             if (typeof item.id !== 'number' || !Number.isInteger(item.id) || item.id <= 0) {
-                throwBodyValidationFailure('access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId', command.requestType, `body.options.user_scope.${index}.id`, scope, command, env);
+                throwBodyValidationFailure('access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId, department ID, or actor ID', command.requestType, `body.options.user_scope.${index}.id`, scope, command, env);
             }
         }
     }
@@ -1714,7 +1715,8 @@ export async function executeCLI(scope, argv, env, fetchImpl = fetch) {
                 const message = parsedBody.error.issues.map((issue) => `${issue.path.join('.')}: ${issue.message}`).join('; ');
                 if (isAssignUsersCommand(scope, command)) {
                     const hasUserScopeIDIssue = parsedBody.error.issues.some((issue) => issue.path.join('.') === 'options.user_scope.0.id' || issue.path.join('.').startsWith('options.user_scope.'));
-                    throw new CLIError('BODY_VALIDATION_FAILED', hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId' : message, 2, buildAssignUsersValidationDetails(scope, command, command.requestType, hasUserScopeIDIssue ? 'body.options.user_scope' : 'body', hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId' : message, runtimeEnv));
+                    const userScopeIDMessage = 'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId, department ID, or actor ID';
+                    throw new CLIError('BODY_VALIDATION_FAILED', hasUserScopeIDIssue ? userScopeIDMessage : message, 2, buildAssignUsersValidationDetails(scope, command, command.requestType, hasUserScopeIDIssue ? 'body.options.user_scope' : 'body', hasUserScopeIDIssue ? userScopeIDMessage : message, runtimeEnv));
                 }
                 throw new CLIError('BODY_VALIDATION_FAILED', message, 2, buildBodyValidationDetails(scope, command, command.requestType, parsedBody.error.issues.map((issue) => ({
                     path: issue.path.length > 0 ? `body.${issue.path.join('.')}` : 'body',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carthooks/arcubase-cli",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "Arcubase runtime CLI for admin and user command execution",
   "type": "module",
   "main": "./dist/index.js",

package/sdk-dist/docs/runtime-reference/access-rule.md

@@ -4,9 +4,9 @@ Use `arcubase-admin access-rule` for app/table access.
 
 ## One Path
 
-1. Get the numeric `arcubaseUserId`.
+1. Get the numeric `arcubaseUserId`, department ID, or actor ID.
 2. Create an enabled rule with `options.policy`.
-3. Assign users with `options.user_scope`.
+3. Assign user scope with `options.user_scope`.
 4. Verify with `access-rule get`.
 
 ## User Mapping
@@ -17,8 +17,8 @@ arcubase-admin get-digiemployee-users
 
 Use the numeric `arcubaseUserId`.
 
-Do not use non-numeric Arcubase user ids in `user_scope[].id`.
-Use `user_scope[].type:"user"` for a tenant user. Do not use FieldVO field type `member` in access rules.
+Do not use non-numeric BotWorks user ids in `user_scope[].id`.
+Use `user_scope[].type:"user"` for a tenant user, `type:"department"` for a department, and `type:"actor"` for a role/actor. Do not use FieldVO field type `member` in access rules.
 
 ## Body Input
 
@@ -90,7 +90,7 @@ Rules:
 - field key is not the FieldVO `key`; do not use values like `vote_description`
 - preserve `list_options:{}` unless the existing rule has a known replacement
 
-## Assign Users Only
+## Assign User Scope Only
 
 Use this only when the rule already has the correct `policy`.
 
@@ -99,16 +99,18 @@ arcubase-admin access-rule assign-users \
   --app-id 2188893436 \
   --table-id 2188893443 \
   --rule-id 2188893557 \
-  --body-json '{"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}'
+  --body-json '{"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}'
 ```
 
 Rules:
 
-- `assign-users` preserves the existing policy.
+- `assign-users` preserves the existing policy and only replaces `options.user_scope`.
 - body must use `update:["user_scope"]`.
 - body must use `options.user_scope`.
-- `user_scope[].type` is `user` for Arcubase organization users.
-- `user_scope[].id` is the numeric `arcubaseUserId`.
+- `user_scope[].type` must be `user`, `department`, or `actor`.
+- `user_scope[].id` must be the numeric `arcubaseUserId`, department ID, or actor ID.
+- Multiple scope items are OR: any matching user, department membership, or actor membership can use the ingress.
+- Department scope includes child departments because Arcubase matches the user's department path.
 
 ## Verify
 
@@ -122,7 +124,7 @@ arcubase-admin access-rule get \
 Success:
 
 - `enabled=true`
-- `options.user_scope` contains the numeric user id
+- `options.user_scope` contains every expected `type/id` scope item
 - `options.policy.actions` contains `view`, `add`, `edit`
 - `options.policy.fields` contains hidden fields as `{"key":":1002","read":false,"write":false,"report":false}`
 - visible fields are explicitly present with `read/write=true` when `all_fields_read/write=false`

package/sdk-dist/generated/zod_registry.generated.ts

@@ -12,7 +12,7 @@ export const PermitColumnSchema: z.ZodTypeAny = z.lazy(() => z.object({ "field_i
 
 export const PermitSearchColumnSchema: z.ZodTypeAny = z.lazy(() => z.object({ "default": z.boolean().optional(), "default_value": z.array(z.number()).optional(), "field_id": z.number().optional(), "infilter": z.boolean().optional(), "is_field": z.boolean().optional(), "pinned": z.boolean().optional(), "prop": z.string().optional(), "wildcard": z.boolean().optional() }).strict())
 
-export const PermitEntityPropSchema: z.ZodTypeAny = z.lazy(() => z.union([z.literal("created"), z.literal("updated"), z.literal("creator")]))
+export const PermitEntityPropSchema: z.ZodTypeAny = z.lazy(() => z.string().min(1))
 
 export const PermitValueFromSchema: z.ZodTypeAny = z.lazy(() => z.union([z.literal(1), z.literal(2), z.literal(3)]))
 

package/sdk-dist/interface/index.ts

@@ -0,0 +1,2 @@
+export * from './user_identity.js'
+export * from './organization.js'

package/sdk-dist/interface/organization.ts

@@ -0,0 +1,15 @@
+import type { ArcubaseUserId } from './user_identity.js'
+
+export type ArcubaseCliDepartmentMember = {
+  arcubaseUserId: ArcubaseUserId
+  name?: string
+  departments?: string[]
+  roles?: string[]
+}
+
+export type ArcubaseCliRoleMember = {
+  arcubaseUserId: ArcubaseUserId
+  name?: string
+  departments?: string[]
+  roles?: string[]
+}

package/sdk-dist/interface/user_identity.ts

@@ -0,0 +1,11 @@
+export type ArcubaseUserId = string
+
+export type ArcubaseCliUserIdentity = {
+  arcubaseUserId: ArcubaseUserId
+  name?: string
+  email?: string
+}
+
+export type ArcubaseCliUserReference = {
+  arcubaseUserId: ArcubaseUserId
+}

package/sdk-dist/types/common.ts

@@ -291,6 +291,7 @@ export interface ActionBulkUpdateAction {
 
 export interface KioskConfig {
   interactiveMode?: string;
+  lookupCondition?: PermitConditionSet;
   lookupFields?: number[];
   options?: Record<string, any>;
   printers?: Record<string, any>[];

package/sdk-dist/types/entity.ts

@@ -11,7 +11,7 @@
  */
 
 /** @format int32 */
-import type { PermitEntityEvent, NotificationPayloadMode, NotificationNotificationType, MagicStringPartType, ActionBulkUpdate, ActionBulkUpdateAction, GormDeletedAt, KioskConfig, KioskScreen, AiOptions, ApiEndpoint, ApiEndpointParam, ApiOptions, App, AppOptions, Assets, Button, CustomAction, EntityFrontEvent, EntityKioskFlow, EntityOptions, EntityPrintTemplate, Fields, MagicString, MagicStringPart, PermitUserScope, ErrorResponse } from './common'
+import type { PermitValueFrom, PermitEntityProp, PermitEntityEvent, NotificationPayloadMode, NotificationNotificationType, MagicStringPartType, ActionBulkUpdate, ActionBulkUpdateAction, GormDeletedAt, KioskConfig, KioskScreen, AiOptions, ApiEndpoint, ApiEndpointParam, ApiOptions, App, AppOptions, Assets, Button, CustomAction, EntityFrontEvent, EntityKioskFlow, EntityOptions, EntityPrintTemplate, Fields, MagicString, MagicStringPart, PermitConditionSet, PermitRecordCondition, PermitUserScope, ErrorResponse } from './common'
 
 export enum FieldInitMode {
   FieldInitModeStatic = 0,

package/sdk-dist/types/kiosk-ui.ts

@@ -11,7 +11,7 @@
  */
 
 /** @format int32 */
-import type { WorkflowStateType, PermitEntityEvent, NotificationPayloadMode, NotificationNotificationType, PronounsType, MagicStringPartType, KioskConfig, KioskScreen, AiOptions, ApiEndpoint, ApiEndpointParam, ApiOptions, Button, CustomAction, DataRecord, EntityFrontEvent, EntityOptions, EntityVO, Fields, MagicString, MagicStringPart, DataRecordProcess, DataRecordResource, DataRecordTrans, PostqueryAppendData, PostqueryUserData, PostqueryAssetsData, PostqueryDepartmentData, PostqueryLinktoData, StorageUrlSets, ErrorResponse, OpenAPITenantInfo } from './common'
+import type { WorkflowStateType, PermitValueFrom, PermitEntityProp, PermitEntityEvent, NotificationPayloadMode, NotificationNotificationType, PronounsType, MagicStringPartType, KioskConfig, KioskScreen, AiOptions, ApiEndpoint, ApiEndpointParam, ApiOptions, Button, CustomAction, DataRecord, EntityFrontEvent, EntityOptions, EntityVO, Fields, MagicString, MagicStringPart, DataRecordProcess, DataRecordResource, DataRecordTrans, PermitConditionSet, PermitRecordCondition, PostqueryAppendData, PostqueryUserData, PostqueryAssetsData, PostqueryDepartmentData, PostqueryLinktoData, StorageUrlSets, ErrorResponse, OpenAPITenantInfo } from './common'
 
 export interface CheckPrintDuplicateReqVO {
   /** kiosk flow id */

package/sdk-dist/types/tenant.ts

@@ -11,7 +11,7 @@
  */
 
 /** @format int32 */
-import type { MagicStringPartType, GormDeletedAt, KioskConfig, KioskScreen, ApiEndpoint, ApiEndpointParam, EntityKioskFlow, MagicString, MagicStringPart, PermitUserScope, SqlNullTime, CommonPagination, ErrorResponse } from './common'
+import type { PermitValueFrom, PermitEntityProp, MagicStringPartType, GormDeletedAt, KioskConfig, KioskScreen, ApiEndpoint, ApiEndpointParam, EntityKioskFlow, MagicString, MagicStringPart, PermitConditionSet, PermitRecordCondition, PermitUserScope, SqlNullTime, CommonPagination, ErrorResponse } from './common'
 
 export enum TenantUserMetaDataPolicy {
   TenantUserMetaDataPolicyNone = 1,

package/src/adapters/user_identity_adapter.ts

@@ -0,0 +1,17 @@
+import type { ArcubaseCliUserReference } from '../interface/user_identity.js'
+
+export type ApiTenantUserReference = {
+  tenantUserId: string
+}
+
+export function toCliArcubaseUserId(input: ApiTenantUserReference): ArcubaseCliUserReference {
+  return {
+    arcubaseUserId: input.tenantUserId,
+  }
+}
+
+export function toApiTenantUserId(input: ArcubaseCliUserReference): ApiTenantUserReference {
+  return {
+    tenantUserId: input.arcubaseUserId,
+  }
+}

package/src/generated/zod_registry.generated.ts

@@ -12,7 +12,7 @@ export const PermitColumnSchema: z.ZodTypeAny = z.lazy(() => z.object({ "field_i
 
 export const PermitSearchColumnSchema: z.ZodTypeAny = z.lazy(() => z.object({ "default": z.boolean().optional(), "default_value": z.array(z.number()).optional(), "field_id": z.number().optional(), "infilter": z.boolean().optional(), "is_field": z.boolean().optional(), "pinned": z.boolean().optional(), "prop": z.string().optional(), "wildcard": z.boolean().optional() }).strict())
 
-export const PermitEntityPropSchema: z.ZodTypeAny = z.lazy(() => z.union([z.literal("created"), z.literal("updated"), z.literal("creator")]))
+export const PermitEntityPropSchema: z.ZodTypeAny = z.lazy(() => z.string().min(1))
 
 export const PermitValueFromSchema: z.ZodTypeAny = z.lazy(() => z.union([z.literal(1), z.literal(2), z.literal(3)]))
 

package/src/interface/index.ts

@@ -0,0 +1,2 @@
+export * from './user_identity.js'
+export * from './organization.js'

package/src/interface/organization.ts

@@ -0,0 +1,15 @@
+import type { ArcubaseUserId } from './user_identity.js'
+
+export type ArcubaseCliDepartmentMember = {
+  arcubaseUserId: ArcubaseUserId
+  name?: string
+  departments?: string[]
+  roles?: string[]
+}
+
+export type ArcubaseCliRoleMember = {
+  arcubaseUserId: ArcubaseUserId
+  name?: string
+  departments?: string[]
+  roles?: string[]
+}

package/src/interface/user_identity.ts

@@ -0,0 +1,11 @@
+export type ArcubaseUserId = string
+
+export type ArcubaseCliUserIdentity = {
+  arcubaseUserId: ArcubaseUserId
+  name?: string
+  email?: string
+}
+
+export type ArcubaseCliUserReference = {
+  arcubaseUserId: ArcubaseUserId
+}

package/src/runtime/execute.ts

@@ -130,19 +130,19 @@ export function renderCommandHelp(scope: CommandScope, moduleName: string, comma
           `  - hide field: ${JSON.stringify(buildHiddenFieldAccessRuleBody())}`,
           'success requires:',
           '  - result.enabled must be true',
-          '  - options.user_scope[].type is "user" for tenant users',
+          '  - options.user_scope[].type is "user", "department", or "actor"',
           '  - hidden fields use colon field keys such as ":1002"',
         ]
       : []),
     ...(scope === 'admin' && command.commandPath[0] === 'access-rule' && command.commandPath[1] === 'assign-users'
       ? [
           'body-json example:',
-          '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+          '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}',
           'success requires:',
           '  - result.enabled must be true',
-          '  - result.options.user_scope must contain the assigned numeric arcubaseUserId values',
-          '  - PermitUserScope.id must be the numeric arcubaseUserId',
-          '  - Do not copy a non-numeric arcubaseUserId into PermitUserScope.id',
+          '  - result.options.user_scope must contain every assigned user, department, or actor scope',
+          '  - PermitUserScope.id must be the numeric arcubaseUserId, department ID, or actor ID',
+          '  - Do not copy a non-numeric BotWorks userId into PermitUserScope.id',
           '  - If result.enabled is false, enable the rule first and retry assign-users',
         ]
       : []),
@@ -697,14 +697,18 @@ function buildAssignUsersValidationDetails(
     shapeHint: {
       update: ['user_scope'],
       options: {
-        user_scope: [{ type: 'user', id: 2188889901 }],
+        user_scope: [
+          { type: 'user', id: 2188889901 },
+          { type: 'department', id: 2188881201 },
+          { type: 'actor', id: 2188883301 },
+        ],
       },
     },
     commonMistakes: [
       'do not use user_scope at top level',
       'do not use users or allowedUsers',
-      'do not use non-numeric arcubaseUserId as id',
-      'id must be the numeric arcubaseUserId',
+      'do not use non-numeric BotWorks userId as id',
+      'id must be the numeric arcubaseUserId, department ID, or actor ID',
     ],
   }
 }
@@ -1004,7 +1008,7 @@ function validateAccessRuleUserScope(
   if (userScope === undefined) return
   if (!Array.isArray(userScope)) {
     throwBodyValidationFailure(
-      'access-rule user_scope must be an array of {"type":"user","id":2188889901}',
+        'access-rule user_scope must be an array of {"type":"user","id":2188889901}, {"type":"department","id":2188881201}, or {"type":"actor","id":2188883301}',
       requestType,
       pathPrefix,
       scope,
@@ -1081,7 +1085,7 @@ function validateActionSpecificRawBody(
   if (isAssignUsersCommand(scope, command)) {
     if ('users' in body || 'allowedUsers' in body || 'user_scope' in body) {
       throwBodyValidationFailure(
-        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}',
         command.requestType,
         'body.options.user_scope',
         scope,
@@ -1213,7 +1217,7 @@ function validateActionSpecificBody(
     const userScope = options && Array.isArray(options.user_scope) ? options.user_scope : undefined
     if ('users' in body || 'allowedUsers' in body) {
       throwBodyValidationFailure(
-        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
+        'access-rule assign-users only accepts body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}',
         command.requestType,
         'body.options.user_scope',
         scope,
@@ -1254,19 +1258,9 @@ function validateActionSpecificBody(
           env,
         )
       }
-      if (item.type !== 'user') {
-        throwBodyValidationFailure(
-          'access-rule assign-users requires body.options.user_scope[].type to be "user"',
-          command.requestType,
-          `body.options.user_scope.${index}.type`,
-          scope,
-          command,
-          env,
-        )
-      }
       if (typeof item.id !== 'number' || !Number.isInteger(item.id) || item.id <= 0) {
         throwBodyValidationFailure(
-          'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId',
+          'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId, department ID, or actor ID',
           command.requestType,
           `body.options.user_scope.${index}.id`,
           scope,
@@ -2108,16 +2102,17 @@ export async function executeCLI(scope: CommandScope, argv: string[], env?: Runt
         const message = parsedBody.error.issues.map((issue) => `${issue.path.join('.')}: ${issue.message}`).join('; ')
         if (isAssignUsersCommand(scope, command)) {
           const hasUserScopeIDIssue = parsedBody.error.issues.some((issue) => issue.path.join('.') === 'options.user_scope.0.id' || issue.path.join('.').startsWith('options.user_scope.'))
+          const userScopeIDMessage = 'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId, department ID, or actor ID'
           throw new CLIError(
             'BODY_VALIDATION_FAILED',
-            hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId' : message,
+            hasUserScopeIDIssue ? userScopeIDMessage : message,
             2,
             buildAssignUsersValidationDetails(
               scope,
               command,
               command.requestType,
               hasUserScopeIDIssue ? 'body.options.user_scope' : 'body',
-              hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId' : message,
+              hasUserScopeIDIssue ? userScopeIDMessage : message,
               runtimeEnv,
             )
           )

package/src/tests/execute_validation.test.ts

@@ -55,14 +55,18 @@ function assertAssignUsersGuidance(error: unknown, messagePattern?: RegExp): boo
   assert.deepEqual(error.details?.shapeHint, {
     update: ['user_scope'],
     options: {
-      user_scope: [{ type: 'user', id: 2188889901 }],
+      user_scope: [
+        { type: 'user', id: 2188889901 },
+        { type: 'department', id: 2188881201 },
+        { type: 'actor', id: 2188883301 },
+      ],
     },
   })
   assert.deepEqual(error.details?.commonMistakes, [
     'do not use user_scope at top level',
     'do not use users or allowedUsers',
-    'do not use non-numeric arcubaseUserId as id',
-    'id must be the numeric arcubaseUserId',
+    'do not use non-numeric BotWorks userId as id',
+    'id must be the numeric arcubaseUserId, department ID, or actor ID',
   ])
   assert.ok(error.details?.tsHints?.some((item) => item.symbol === 'AppIngressUpdateReqVO' && item.file === '/runtime/arcubase-sdk/types/ingress.ts'))
   assert.ok(error.details?.tsHints?.some((item) => item.symbol === 'EntityIngressOptions' && item.file === '/runtime/arcubase-sdk/types/ingress.ts'))
@@ -1318,7 +1322,7 @@ test('access-rule assign-users rejects top-level user_scope', async () => {
   }, (error: unknown) => assertAssignUsersGuidance(error, /options.user_scope/))
 })
 
-test('access-rule assign-users rejects non-user member scope type', async () => {
+test('access-rule assign-users rejects FieldVO member scope type', async () => {
   await assert.rejects(async () => {
     await executeCLI(
       'admin',
@@ -1326,10 +1330,10 @@ test('access-rule assign-users rejects non-user member scope type', async () =>
       env as any,
       async () => new Response('{}', { status: 200 }),
     )
-  }, (error: unknown) => assertAssignUsersGuidance(error, /type.*user/))
+  }, (error: unknown) => assertAssignUsersGuidance(error, /user.*department.*actor|FieldVO type "member"/))
 })
 
-test('access-rule assign-users rejects non-numeric arcubaseUserId', async () => {
+test('access-rule assign-users rejects non-numeric user scope id', async () => {
   await assert.rejects(async () => {
     await executeCLI(
       'admin',
@@ -1337,17 +1341,64 @@ test('access-rule assign-users rejects non-numeric arcubaseUserId', async () =>
       env as any,
       async () => new Response('{}', { status: 200 }),
     )
-  }, (error: unknown) => assertAssignUsersGuidance(error, /numeric arcubaseUserId/))
+  }, (error: unknown) => assertAssignUsersGuidance(error, /numeric arcubaseUserId, department ID, or actor ID/))
 })
 
-test('access-rule assign-users accepts canonical user_scope body', async () => {
+test('access-rule assign-users accepts canonical mixed user_scope body', async () => {
   const out = await executeCLI(
     'admin',
-    ['access-rule', 'assign-users', '--app-id', 'app_1', '--table-id', 'table_1', '--rule-id', 'rule_1', '--body-json', '{"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}'],
+    ['access-rule', 'assign-users', '--app-id', 'app_1', '--table-id', 'table_1', '--rule-id', 'rule_1', '--body-json', '{"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901},{"type":"department","id":2188881201},{"type":"actor","id":2188883301}]}}'],
     env as any,
     async (_url, init) => new Response(String(init?.body ?? '{}'), { status: 200 }),
   )
   assert.equal(out.kind, 'result')
   assert.deepEqual(out.data.update, ['user_scope'])
-  assert.deepEqual(out.data.options.user_scope, [{ type: 'user', id: 2188889901 }])
+  assert.deepEqual(out.data.options.user_scope, [
+    { type: 'user', id: 2188889901 },
+    { type: 'department', id: 2188881201 },
+    { type: 'actor', id: 2188883301 },
+  ])
+})
+
+test('access-rule create accepts nested custom policy condition with field columns', async () => {
+  const body = JSON.stringify({
+    name: 'Sales own or west region',
+    enabled: true,
+    type: 'form',
+    options: {
+      user_scope: [{ type: 'department', id: 2188881201 }],
+      policy: {
+        key: 'custom',
+        actions: ['view', 'add', 'edit'],
+        all_fields_read: true,
+        all_fields_write: true,
+        condition: {
+          mode: 'and',
+          conditions: [
+            {
+              subset: {
+                mode: 'or',
+                conditions: [
+                  { column: 'creator', operator: '$eq', value: '[[current_user]]' },
+                  { column: ':1002', operator: '$eq', value: '[[current_user]]' },
+                ],
+              },
+            },
+            { column: ':1003', operator: '$eq', value: '华东' },
+          ],
+        },
+      },
+      list_options: {},
+    },
+  })
+  const out = await executeCLI(
+    'admin',
+    ['access-rule', 'create', '--app-id', 'app_1', '--table-id', 'table_1', '--body-json', body],
+    env as any,
+    async (_url, init) => new Response(String(init?.body ?? '{}'), { status: 200 }),
+  )
+  assert.equal(out.kind, 'result')
+  assert.equal(out.data.options.policy.condition.mode, 'and')
+  assert.equal(out.data.options.policy.condition.conditions[0].subset.mode, 'or')
+  assert.equal(out.data.options.policy.condition.conditions[0].subset.conditions[1].column, ':1002')
 })

package/src/tests/help.test.ts

@@ -120,8 +120,10 @@ test('admin access-rule help gives update whitelist and assign-users body-json e
   const assign = await executeCLI('admin', ['access-rule', 'assign-users', '--help'], env as any, async () => new Response('{}'))
   assert.equal(assign.kind, 'help')
   assert.match(assign.text, /"update":\["user_scope"\]/)
-  assert.match(assign.text, /\{"update":\["user_scope"\],"options":\{"user_scope":\[\{"type":"user","id":2188889901\}\]\}\}/)
+  assert.match(assign.text, /\{"update":\["user_scope"\],"options":\{"user_scope":\[\{"type":"user","id":2188889901\},\{"type":"department","id":2188881201\},\{"type":"actor","id":2188883301\}\]\}\}/)
   assert.match(assign.text, /arcubaseUserId/)
+  assert.match(assign.text, /department ID/)
+  assert.match(assign.text, /actor ID/)
   assert.doesNotMatch(assign.text, forbiddenArcubaseUserTerms())
   assert.doesNotMatch(assign.text, /"type":"member"/)
   assert.doesNotMatch(assign.text, /"users"/)
@@ -135,6 +137,16 @@ test('admin assign-users help uses arcubaseUserId terminology', async () => {
   assert.match(help.text, /arcubaseUserId/)
 })
 
+test('CLI help does not expose tenantUserId', async () => {
+  for (const scope of ['admin', 'user'] as const satisfies readonly CommandScope[]) {
+    for (const command of listCommands(scope)) {
+      const out = await executeCLI(scope, [...command.commandPath, '--help'], env as any, async () => new Response('{}'))
+      assert.equal(out.kind, 'help')
+      assert.doesNotMatch(out.text, /tenantUserId/)
+    }
+  }
+})
+
 function forbiddenArcubaseUserTerms(): RegExp {
   return new RegExp(['tenant' + 'UserId', 'TenantUser' + String.raw`\.ID`, 'tenant user' + ' id'].join('|'), 'i')
 }

package/src/tests/terminology_boundary.test.ts

@@ -0,0 +1,43 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import test from 'node:test'
+import { fileURLToPath } from 'node:url'
+import { toApiTenantUserId, toCliArcubaseUserId } from '../adapters/user_identity_adapter.js'
+
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..')
+
+function walk(dir: string): string[] {
+  if (!fs.existsSync(dir)) return []
+  const out: string[] = []
+  for (const name of fs.readdirSync(dir)) {
+    const abs = path.join(dir, name)
+    const stat = fs.statSync(abs)
+    if (stat.isDirectory()) {
+      out.push(...walk(abs))
+    } else if (stat.isFile() && /\.(ts|md|js|mjs)$/.test(name)) {
+      out.push(abs)
+    }
+  }
+  return out
+}
+
+test('CLI interface types do not expose tenantUserId', () => {
+  const files = walk(path.join(packageRoot, 'src/interface'))
+  assert.ok(files.length > 0)
+  for (const file of files) {
+    assert.equal(fs.readFileSync(file, 'utf8').includes('tenantUserId'), false, file)
+  }
+})
+
+test('CLI adapter maps tenantUserId to arcubaseUserId', () => {
+  assert.deepEqual(toCliArcubaseUserId({ tenantUserId: '2188890296' }), {
+    arcubaseUserId: '2188890296',
+  })
+})
+
+test('CLI adapter maps arcubaseUserId to tenantUserId', () => {
+  assert.deepEqual(toApiTenantUserId({ arcubaseUserId: '2188890296' }), {
+    tenantUserId: '2188890296',
+  })
+})

package/src/tests/zod_registry.test.ts

@@ -41,6 +41,44 @@ test('EntityQueryReqVO search only accepts route-query string keys', () => {
   }
 })
 
+test('AppIngressCreateReqVO accepts nested ConditionSet with field EntityProp columns', () => {
+  const schema = getBodySchema('AppIngressCreateReqVO')
+  assert.ok(schema)
+
+  const result = schema.safeParse({
+    name: 'Sales own or west region',
+    enabled: true,
+    type: 'form',
+    options: {
+      user_scope: [{ type: 'department', id: 2188881201 }],
+      policy: {
+        key: 'custom',
+        actions: ['view', 'add', 'edit'],
+        all_fields_read: true,
+        all_fields_write: true,
+        condition: {
+          mode: 'and',
+          conditions: [
+            {
+              subset: {
+                mode: 'or',
+                conditions: [
+                  { column: 'creator', operator: '$eq', value: '[[current_user]]' },
+                  { column: ':1002', operator: '$eq', value: '[[current_user]]' },
+                ],
+              },
+            },
+            { column: ':1003', operator: '$eq', value: '华东' },
+          ],
+        },
+      },
+      list_options: {},
+    },
+  })
+
+  assert.equal(result.success, true)
+})
+
 test('unknown request type has no schema and no unsupported reason', () => {
   assert.equal(getBodySchema('DefinitelyMissingReqVO'), null)
   assert.equal(getUnsupportedBodySchemaReason('DefinitelyMissingReqVO'), null)