@fayz-ai/core 0.14.0 → 0.16.0

package/dist/access/engine.d.ts

@@ -12,6 +12,19 @@ export interface AccessSubject {
     profile: PermissionProfile | null;
     /** The tenant's currently-active plan. */
     plan: Plan | null;
+    /**
+     * Extra role a person has INSIDE a given unit, keyed by unit id.
+     *
+     * Additive, never subtractive: the org role applies everywhere and a unit role
+     * only adds inside its unit. That choice is what makes this shippable — the
+     * answer without a unit is a strict SUBSET of the answer with one, so every
+     * existing call site keeps its exact meaning and none of them had to change.
+     * The alternative (a unit role that overrides) can take access away by
+     * accident, and every screen would have to explain which role won.
+     */
+    unitProfiles?: Record<string, PermissionProfile>;
+    /** The unit the person is looking at, used when a check does not name one. */
+    activeUnitId?: string;
 }
 /**
  * The org owner has every permission implicitly. Owner is represented by the
@@ -41,6 +54,21 @@ export declare function profileHasSystemPermission(profile: PermissionProfile |
  * open rather than silently locking.
  */
 export declare function isEntitledByPlan(plan: Plan | null, feature: string): boolean;
+/**
+ * Union two profiles. Grants merge per feature, system permissions merge, and
+ * the result is never smaller than either input — the additive rule, in code.
+ *
+ * `manage` is not expanded here: {@link profileHasPermission} already treats it
+ * as satisfying any action, so expanding it would be a second implementation of
+ * the same rule waiting to disagree with the first.
+ */
+export declare function mergeProfiles(base: PermissionProfile | null, overlay: PermissionProfile | null): PermissionProfile | null;
+/**
+ * The profile that applies where the person is standing: their org role, plus
+ * whatever the unit adds. With no unit — or no binding in it — this is exactly
+ * the org role, which is why nothing that predates units changes behaviour.
+ */
+export declare function effectiveProfileFor(subject: AccessSubject, unitId?: string): PermissionProfile | null;
 /**
  * The single access decision: role FIRST, then plan.
  *
@@ -50,7 +78,9 @@ export declare function isEntitledByPlan(plan: Plan | null, feature: string): bo
  * 2. Plan — even the owner does NOT bypass the plan: upgrading is the tenant's
  *    decision, not a role power. Denied → `{ allowed:false, reason:'plan' }`.
  */
-export declare function resolveAccess(subject: AccessSubject, feature: string, action?: PermissionAction): AccessDecision;
+export declare function resolveAccess(subject: AccessSubject, feature: string, action?: PermissionAction, options?: {
+    unitId?: string;
+}): AccessDecision;
 /**
  * Pure numeric side of a limit: given the plan cap, whether a countable
  * declaration exists, and the current usage, derive the limit math. Unlimited

package/dist/access/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/access/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACjG,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAe5C,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;AAElD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACjC,0CAA0C;IAC1C,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAElE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GAAG,IAAI,EACjC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAeT;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,GAAG,IAAI,EACjC,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,gBAAgB,GACxB,cAAc,CAQhB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IACxG,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;CACnB,CAOA"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/access/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACjG,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAe5C,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;AAElD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACjC,0CAA0C;IAC1C,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAChD,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAElE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GAAG,IAAI,EACjC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAeT;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,GAAG,IAAI,EACjC,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5E;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,iBAAiB,GAAG,IAAI,EAC9B,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAChC,iBAAiB,GAAG,IAAI,CAmB1B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,aAAa,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,iBAAiB,GAAG,IAAI,CAG1B;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5B,cAAc,CAShB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IACxG,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;CACnB,CAOA"}

package/dist/access/index.d.ts

@@ -1,4 +1,4 @@
-export { isOwnerProfile, profileHasPermission, profileHasSystemPermission, isEntitledByPlan, resolveAccess, resolveLimit, } from './engine';
+export { isOwnerProfile, profileHasPermission, profileHasSystemPermission, isEntitledByPlan, resolveAccess, resolveLimit, mergeProfiles, effectiveProfileFor, } from './engine';
 export type { DenyReason, AccessDecision, AccessSubject } from './engine';
 export { UPGRADE_URL, agentDenial } from './denial';
 export type { AgentDenial, AgentDenialLimit, AgentGuardResult } from './denial';

package/dist/access/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,aAAa,EACb,YAAY,GACb,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAEzE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AACnD,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,mBAAmB,GACpB,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAEzE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AACnD,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA"}

package/dist/access/index.js

@@ -18,8 +18,29 @@ function profileHasSystemPermission(profile, permission) {
 function isEntitledByPlan(plan, feature) {
   return plan?.entitlements?.features?.[feature] !== false;
 }
-function resolveAccess(subject, feature, action) {
-  if (!profileHasPermission(subject.profile, feature, action)) {
+function mergeProfiles(base, overlay) {
+  if (!overlay) return base;
+  if (!base) return overlay;
+  if (isOwnerProfile(base)) return base;
+  const grants = { ...base.grants };
+  for (const [feature, actions] of Object.entries(overlay.grants ?? {})) {
+    const merged = /* @__PURE__ */ new Set([...grants[feature] ?? [], ...actions]);
+    grants[feature] = [...merged];
+  }
+  const system = /* @__PURE__ */ new Set([...base.systemPermissions ?? [], ...overlay.systemPermissions ?? []]);
+  return {
+    ...base,
+    grants,
+    systemPermissions: system.size > 0 ? [...system] : void 0
+  };
+}
+function effectiveProfileFor(subject, unitId) {
+  if (!unitId) return subject.profile;
+  return mergeProfiles(subject.profile, subject.unitProfiles?.[unitId] ?? null);
+}
+function resolveAccess(subject, feature, action, options) {
+  const profile = effectiveProfileFor(subject, options?.unitId ?? subject.activeUnitId);
+  if (!profileHasPermission(profile, feature, action)) {
     return { allowed: false, reason: "role" };
   }
   if (!isEntitledByPlan(subject.plan, feature)) {
@@ -51,6 +72,6 @@ function mergeLimitDeclarations(...layers) {
   return Array.from(byKey.values());
 }
 
-export { UPGRADE_URL, agentDenial, isEntitledByPlan, isOwnerProfile, mergeLimitDeclarations, profileHasPermission, profileHasSystemPermission, resolveAccess, resolveLimit };
+export { UPGRADE_URL, agentDenial, effectiveProfileFor, isEntitledByPlan, isOwnerProfile, mergeLimitDeclarations, mergeProfiles, profileHasPermission, profileHasSystemPermission, resolveAccess, resolveLimit };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/access/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/access/engine.ts","../../src/access/denial.ts","../../src/access/limits.ts"],"names":[],"mappings":";AAuCO,SAAS,eAAe,OAAA,EAAqC;AAClE,EAAA,OAAO,QAAQ,EAAA,KAAO,OAAA,IAAW,OAAA,CAAQ,IAAA,EAAM,aAAY,KAAM,OAAA;AACnE;AAOO,SAAS,oBAAA,CACd,OAAA,EACA,OAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AAMrB,EAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG,OAAO,IAAA;AAEpC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA;AAErB,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA;AAErC,EAAA,OAAO,QAAQ,QAAA,CAAS,MAAM,CAAA,IAAK,OAAA,CAAQ,SAAS,QAAQ,CAAA;AAC9D;AAQO,SAAS,0BAAA,CACd,SACA,UAAA,EACS;AACT,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,OAAO,OAAA,CAAQ,iBAAA,EAAmB,QAAA,CAAS,UAAU,CAAA,IAAK,KAAA;AAC5D;AAQO,SAAS,gBAAA,CAAiB,MAAmB,OAAA,EAA0B;AAC5E,EAAA,OAAO,IAAA,EAAM,YAAA,EAAc,QAAA,GAAW,OAAO,CAAA,KAAM,KAAA;AACrD;AAWO,SAAS,aAAA,CACd,OAAA,EACA,OAAA,EACA,MAAA,EACgB;AAChB,EAAA,IAAI,CAAC,oBAAA,CAAqB,OAAA,CAAQ,OAAA,EAAS,OAAA,EAAS,MAAM,CAAA,EAAG;AAC3D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAO;AAAA,EAC1C;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,EAAG;AAC5C,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAO;AAAA,EAC1C;AACA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AAOO,SAAS,aAAa,MAAA,EAM3B;AACA,EAAA,MAAM,EAAE,GAAA,EAAK,cAAA,EAAgB,IAAA,EAAK,GAAI,MAAA;AACtC,EAAA,MAAM,SAAA,GAAY,CAAC,cAAA,IAAkB,GAAA,KAAQ,UAAa,GAAA,KAAQ,EAAA;AAClE,EAAA,MAAM,GAAA,GAAM,YAAY,QAAA,GAAW,GAAA;AACnC,EAAA,MAAM,YAAY,SAAA,GAAY,QAAA,GAAW,KAAK,GAAA,CAAI,CAAA,EAAG,MAAM,IAAI,CAAA;AAC/D,EAAA,MAAM,OAAA,GAAU,CAAC,SAAA,IAAa,IAAA,IAAQ,GAAA;AACtC,EAAA,OAAO,EAAE,GAAA,EAAK,IAAA,EAAM,SAAA,EAAW,SAAS,SAAA,EAAU;AACpD;;;AC5HO,IAAM,WAAA,GAAc;AAmBpB,SAAS,WAAA,CAAY,QAAoB,KAAA,EAAuC;AACrF,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,GAAI,KAAA,GAAQ,EAAE,KAAA,EAAM,GAAI,EAAC,EAAI,UAAA,EAAY,WAAA,EAAY;AACxF;;;ACvBO,SAAS,0BACX,MAAA,EACiB;AACpB,EAAA,MAAM,KAAA,uBAAY,GAAA,EAA8B;AAChD,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,KAAA,MAAW,IAAA,IAAQ,SAAS,EAAC,QAAS,GAAA,CAAI,IAAA,CAAK,KAAK,IAAI,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,CAAA;AAClC","file":"index.js","sourcesContent":["import type { PermissionProfile, PermissionAction, SystemPermission } from '../types/permissions'\nimport type { Plan } from '../types/billing'\n\n// ---------------------------------------------------------------------------\n// The access engine — the ONE implementation of the role × plan × limit\n// decision, shared by every runtime that gates anything:\n//\n//   - browser (saas AccessProvider / PermissionsProvider re-export from here)\n//   - headless client-plane (saas access/headless.ts)\n//   - the Fayz broker (server-side agent authorization imports this package)\n//\n// Hard constraint: this module (and everything under core/src/access) must stay\n// free of React, zustand and supabase — pure functions over plain data — so the\n// exact same code runs in Node/edge. Guarded by scripts/check-access-purity.mjs.\n// ---------------------------------------------------------------------------\n\n/** Why an access request was denied. `limit` only occurs on guarded writes. */\nexport type DenyReason = 'role' | 'plan' | 'limit'\n\nexport interface AccessDecision {\n  allowed: boolean\n  reason?: DenyReason\n}\n\n/** The minimal subject a decision needs — a projection of any richer session. */\nexport interface AccessSubject {\n  /** Effective RBAC profile — the previewed role during impersonation. */\n  profile: PermissionProfile | null\n  /** The tenant's currently-active plan. */\n  plan: Plan | null\n}\n\n/**\n * The org owner has every permission implicitly. Owner is represented by the\n * canonical role id `owner` across adapters (see org/adapters/supabase.ts\n * buildPermissionProfiles, which also grants owner all catalog perms, and the\n * mock adapter's `owner` fallback). We match by id first, falling back to the\n * (possibly localized) name for safety.\n */\nexport function isOwnerProfile(profile: PermissionProfile): boolean {\n  return profile.id === 'owner' || profile.name?.toLowerCase() === 'owner'\n}\n\n/**\n * The single role-side permission check. The plan axis composes ON TOP of it in\n * {@link resolveAccess} instead of reimplementing owner-bypass / `manage`\n * semantics.\n */\nexport function profileHasPermission(\n  profile: PermissionProfile | null,\n  feature: string,\n  action?: string,\n): boolean {\n  if (!profile) return true\n\n  // Owner bypass: never lock the owner out, even if the RBAC catalog is empty\n  // or still loading. Because permission checks read the *effective* profile,\n  // an owner previewing a non-owner role correctly loses this bypass — the\n  // preview stays honest.\n  if (isOwnerProfile(profile)) return true\n\n  const actions = profile.grants[feature]\n  if (!actions) return false\n\n  if (!action) return actions.length > 0\n\n  return actions.includes(action) || actions.includes('manage')\n}\n\n/**\n * The org-management side of a profile: managing team, billing, settings and\n * permissions themselves. Separate axis from `grants` — these gate the settings\n * tabs, not a feature's rows — and it follows the same owner bypass, so the one\n * person who can hand out access is never locked out of doing it.\n */\nexport function profileHasSystemPermission(\n  profile: PermissionProfile | null,\n  permission: SystemPermission,\n): boolean {\n  if (!profile) return true\n  if (isOwnerProfile(profile)) return true\n  return profile.systemPermissions?.includes(permission) ?? false\n}\n\n/**\n * Does the current plan entitle `feature`? A plan gates a feature ONLY with an\n * explicit `false`; absent means \"not gated by this plan\" (allowed). This keeps\n * entitlements additive and safe: a feature the plan has never heard of stays\n * open rather than silently locking.\n */\nexport function isEntitledByPlan(plan: Plan | null, feature: string): boolean {\n  return plan?.entitlements?.features?.[feature] !== false\n}\n\n/**\n * The single access decision: role FIRST, then plan.\n *\n * 1. Role — reuses `profileHasPermission` (owner bypass + `manage` semantics\n *    live there, and impersonation composes for free because `profile` is the\n *    previewed role). Denied → `{ allowed:false, reason:'role' }`.\n * 2. Plan — even the owner does NOT bypass the plan: upgrading is the tenant's\n *    decision, not a role power. Denied → `{ allowed:false, reason:'plan' }`.\n */\nexport function resolveAccess(\n  subject: AccessSubject,\n  feature: string,\n  action?: PermissionAction,\n): AccessDecision {\n  if (!profileHasPermission(subject.profile, feature, action)) {\n    return { allowed: false, reason: 'role' }\n  }\n  if (!isEntitledByPlan(subject.plan, feature)) {\n    return { allowed: false, reason: 'plan' }\n  }\n  return { allowed: true }\n}\n\n/**\n * Pure numeric side of a limit: given the plan cap, whether a countable\n * declaration exists, and the current usage, derive the limit math. Unlimited\n * when there's no declaration to count, no cap on the plan, or the cap is `-1`.\n */\nexport function resolveLimit(params: { cap: number | undefined; hasDeclaration: boolean; used: number }): {\n  max: number\n  used: number\n  remaining: number\n  atLimit: boolean\n  unlimited: boolean\n} {\n  const { cap, hasDeclaration, used } = params\n  const unlimited = !hasDeclaration || cap === undefined || cap === -1\n  const max = unlimited ? Infinity : cap\n  const remaining = unlimited ? Infinity : Math.max(0, max - used)\n  const atLimit = !unlimited && used >= max\n  return { max, used, remaining, atLimit, unlimited }\n}\n","import type { DenyReason } from './engine'\n\n// ---------------------------------------------------------------------------\n// The structured denial an AGENT surface returns instead of failing silently\n// (docs/saas/ENTITLEMENTS.md § \"Superfície de agentes de IA\"). One shape for every\n// executor — FAB client-plane, the Fayz broker, and the pool RPCs (which emit\n// its jsonb mirror in their `denial` field) — so the model can explain the\n// denial and offer the upgrade path conversationally.\n// ---------------------------------------------------------------------------\n\n/** Where a denied tenant goes to upgrade — the conversational UpgradeModal. */\nexport const UPGRADE_URL = '/settings/subscription'\n\nexport interface AgentDenialLimit {\n  key: string\n  max: number\n  used: number\n}\n\nexport interface AgentDenial {\n  allowed: false\n  reason: DenyReason\n  /** Present when `reason === 'limit'`. */\n  limit?: AgentDenialLimit\n  upgradeUrl: string\n}\n\nexport type AgentGuardResult = { allowed: true } | AgentDenial\n\n/** Build a denial with the canonical upgrade URL attached. */\nexport function agentDenial(reason: DenyReason, limit?: AgentDenialLimit): AgentDenial {\n  return { allowed: false, reason, ...(limit ? { limit } : {}), upgradeUrl: UPGRADE_URL }\n}\n","import type { LimitDeclaration } from '../types/entitlements'\n\n/**\n * The 4-layer limit-declaration merge, extracted so the browser AccessProvider\n * and the manifest derivation (`fayz manifest emit`) resolve the EXACT same\n * final set: core built-ins < entity-derived < plugin `declaredLimits` < app\n * overrides. Later layers win by key. Pure: pass the layers in, get the merge\n * out — deriving a declaration FROM an entity stays at the call site.\n */\nexport function mergeLimitDeclarations(\n  ...layers: Array<LimitDeclaration[] | undefined>\n): LimitDeclaration[] {\n  const byKey = new Map<string, LimitDeclaration>()\n  for (const layer of layers) {\n    for (const decl of layer ?? []) byKey.set(decl.key, decl)\n  }\n  return Array.from(byKey.values())\n}\n"]}
+{"version":3,"sources":["../../src/access/engine.ts","../../src/access/denial.ts","../../src/access/limits.ts"],"names":[],"mappings":";AAoDO,SAAS,eAAe,OAAA,EAAqC;AAClE,EAAA,OAAO,QAAQ,EAAA,KAAO,OAAA,IAAW,OAAA,CAAQ,IAAA,EAAM,aAAY,KAAM,OAAA;AACnE;AAOO,SAAS,oBAAA,CACd,OAAA,EACA,OAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AAMrB,EAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG,OAAO,IAAA;AAEpC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA;AAErB,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA;AAErC,EAAA,OAAO,QAAQ,QAAA,CAAS,MAAM,CAAA,IAAK,OAAA,CAAQ,SAAS,QAAQ,CAAA;AAC9D;AAQO,SAAS,0BAAA,CACd,SACA,UAAA,EACS;AACT,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,OAAO,OAAA,CAAQ,iBAAA,EAAmB,QAAA,CAAS,UAAU,CAAA,IAAK,KAAA;AAC5D;AAQO,SAAS,gBAAA,CAAiB,MAAmB,OAAA,EAA0B;AAC5E,EAAA,OAAO,IAAA,EAAM,YAAA,EAAc,QAAA,GAAW,OAAO,CAAA,KAAM,KAAA;AACrD;AAUO,SAAS,aAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI,CAAC,MAAM,OAAO,OAAA;AAElB,EAAA,IAAI,cAAA,CAAe,IAAI,CAAA,EAAG,OAAO,IAAA;AAEjC,EAAA,MAAM,MAAA,GAA6C,EAAE,GAAG,IAAA,CAAK,MAAA,EAAO;AACpE,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,OAAO,CAAA,IAAK,MAAA,CAAO,QAAQ,OAAA,CAAQ,MAAA,IAAU,EAAE,CAAA,EAAG;AACrE,IAAA,MAAM,MAAA,mBAAS,IAAI,GAAA,CAAI,CAAC,GAAI,MAAA,CAAO,OAAO,CAAA,IAAK,EAAC,EAAI,GAAG,OAAO,CAAC,CAAA;AAC/D,IAAA,MAAA,CAAO,OAAO,CAAA,GAAI,CAAC,GAAG,MAAM,CAAA;AAAA,EAC9B;AAEA,EAAA,MAAM,MAAA,mBAAS,IAAI,GAAA,CAAI,CAAC,GAAI,IAAA,CAAK,iBAAA,IAAqB,EAAC,EAAI,GAAI,OAAA,CAAQ,iBAAA,IAAqB,EAAG,CAAC,CAAA;AAEhG,EAAA,OAAO;AAAA,IACL,GAAG,IAAA;AAAA,IACH,MAAA;AAAA,IACA,mBAAmB,MAAA,CAAO,IAAA,GAAO,IAAI,CAAC,GAAG,MAAM,CAAA,GAAI;AAAA,GACrD;AACF;AAOO,SAAS,mBAAA,CACd,SACA,MAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,OAAA,CAAQ,OAAA;AAC5B,EAAA,OAAO,cAAc,OAAA,CAAQ,OAAA,EAAS,QAAQ,YAAA,GAAe,MAAM,KAAK,IAAI,CAAA;AAC9E;AAWO,SAAS,aAAA,CACd,OAAA,EACA,OAAA,EACA,MAAA,EACA,OAAA,EACgB;AAChB,EAAA,MAAM,UAAU,mBAAA,CAAoB,OAAA,EAAS,OAAA,EAAS,MAAA,IAAU,QAAQ,YAAY,CAAA;AACpF,EAAA,IAAI,CAAC,oBAAA,CAAqB,OAAA,EAAS,OAAA,EAAS,MAAM,CAAA,EAAG;AACnD,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAO;AAAA,EAC1C;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,EAAG;AAC5C,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAO;AAAA,EAC1C;AACA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AAOO,SAAS,aAAa,MAAA,EAM3B;AACA,EAAA,MAAM,EAAE,GAAA,EAAK,cAAA,EAAgB,IAAA,EAAK,GAAI,MAAA;AACtC,EAAA,MAAM,SAAA,GAAY,CAAC,cAAA,IAAkB,GAAA,KAAQ,UAAa,GAAA,KAAQ,EAAA;AAClE,EAAA,MAAM,GAAA,GAAM,YAAY,QAAA,GAAW,GAAA;AACnC,EAAA,MAAM,YAAY,SAAA,GAAY,QAAA,GAAW,KAAK,GAAA,CAAI,CAAA,EAAG,MAAM,IAAI,CAAA;AAC/D,EAAA,MAAM,OAAA,GAAU,CAAC,SAAA,IAAa,IAAA,IAAQ,GAAA;AACtC,EAAA,OAAO,EAAE,GAAA,EAAK,IAAA,EAAM,SAAA,EAAW,SAAS,SAAA,EAAU;AACpD;;;ACxLO,IAAM,WAAA,GAAc;AAmBpB,SAAS,WAAA,CAAY,QAAoB,KAAA,EAAuC;AACrF,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,GAAI,KAAA,GAAQ,EAAE,KAAA,EAAM,GAAI,EAAC,EAAI,UAAA,EAAY,WAAA,EAAY;AACxF;;;ACvBO,SAAS,0BACX,MAAA,EACiB;AACpB,EAAA,MAAM,KAAA,uBAAY,GAAA,EAA8B;AAChD,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,KAAA,MAAW,IAAA,IAAQ,SAAS,EAAC,QAAS,GAAA,CAAI,IAAA,CAAK,KAAK,IAAI,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,CAAA;AAClC","file":"index.js","sourcesContent":["import type { PermissionProfile, PermissionAction, SystemPermission } from '../types/permissions'\nimport type { Plan } from '../types/billing'\n\n// ---------------------------------------------------------------------------\n// The access engine — the ONE implementation of the role × plan × limit\n// decision, shared by every runtime that gates anything:\n//\n//   - browser (saas AccessProvider / PermissionsProvider re-export from here)\n//   - headless client-plane (saas access/headless.ts)\n//   - the Fayz broker (server-side agent authorization imports this package)\n//\n// Hard constraint: this module (and everything under core/src/access) must stay\n// free of React, zustand and supabase — pure functions over plain data — so the\n// exact same code runs in Node/edge. Guarded by scripts/check-access-purity.mjs.\n// ---------------------------------------------------------------------------\n\n/** Why an access request was denied. `limit` only occurs on guarded writes. */\nexport type DenyReason = 'role' | 'plan' | 'limit'\n\nexport interface AccessDecision {\n  allowed: boolean\n  reason?: DenyReason\n}\n\n/** The minimal subject a decision needs — a projection of any richer session. */\nexport interface AccessSubject {\n  /** Effective RBAC profile — the previewed role during impersonation. */\n  profile: PermissionProfile | null\n  /** The tenant's currently-active plan. */\n  plan: Plan | null\n  /**\n   * Extra role a person has INSIDE a given unit, keyed by unit id.\n   *\n   * Additive, never subtractive: the org role applies everywhere and a unit role\n   * only adds inside its unit. That choice is what makes this shippable — the\n   * answer without a unit is a strict SUBSET of the answer with one, so every\n   * existing call site keeps its exact meaning and none of them had to change.\n   * The alternative (a unit role that overrides) can take access away by\n   * accident, and every screen would have to explain which role won.\n   */\n  unitProfiles?: Record<string, PermissionProfile>\n  /** The unit the person is looking at, used when a check does not name one. */\n  activeUnitId?: string\n}\n\n/**\n * The org owner has every permission implicitly. Owner is represented by the\n * canonical role id `owner` across adapters (see org/adapters/supabase.ts\n * buildPermissionProfiles, which also grants owner all catalog perms, and the\n * mock adapter's `owner` fallback). We match by id first, falling back to the\n * (possibly localized) name for safety.\n */\nexport function isOwnerProfile(profile: PermissionProfile): boolean {\n  return profile.id === 'owner' || profile.name?.toLowerCase() === 'owner'\n}\n\n/**\n * The single role-side permission check. The plan axis composes ON TOP of it in\n * {@link resolveAccess} instead of reimplementing owner-bypass / `manage`\n * semantics.\n */\nexport function profileHasPermission(\n  profile: PermissionProfile | null,\n  feature: string,\n  action?: string,\n): boolean {\n  if (!profile) return true\n\n  // Owner bypass: never lock the owner out, even if the RBAC catalog is empty\n  // or still loading. Because permission checks read the *effective* profile,\n  // an owner previewing a non-owner role correctly loses this bypass — the\n  // preview stays honest.\n  if (isOwnerProfile(profile)) return true\n\n  const actions = profile.grants[feature]\n  if (!actions) return false\n\n  if (!action) return actions.length > 0\n\n  return actions.includes(action) || actions.includes('manage')\n}\n\n/**\n * The org-management side of a profile: managing team, billing, settings and\n * permissions themselves. Separate axis from `grants` — these gate the settings\n * tabs, not a feature's rows — and it follows the same owner bypass, so the one\n * person who can hand out access is never locked out of doing it.\n */\nexport function profileHasSystemPermission(\n  profile: PermissionProfile | null,\n  permission: SystemPermission,\n): boolean {\n  if (!profile) return true\n  if (isOwnerProfile(profile)) return true\n  return profile.systemPermissions?.includes(permission) ?? false\n}\n\n/**\n * Does the current plan entitle `feature`? A plan gates a feature ONLY with an\n * explicit `false`; absent means \"not gated by this plan\" (allowed). This keeps\n * entitlements additive and safe: a feature the plan has never heard of stays\n * open rather than silently locking.\n */\nexport function isEntitledByPlan(plan: Plan | null, feature: string): boolean {\n  return plan?.entitlements?.features?.[feature] !== false\n}\n\n/**\n * Union two profiles. Grants merge per feature, system permissions merge, and\n * the result is never smaller than either input — the additive rule, in code.\n *\n * `manage` is not expanded here: {@link profileHasPermission} already treats it\n * as satisfying any action, so expanding it would be a second implementation of\n * the same rule waiting to disagree with the first.\n */\nexport function mergeProfiles(\n  base: PermissionProfile | null,\n  overlay: PermissionProfile | null,\n): PermissionProfile | null {\n  if (!overlay) return base\n  if (!base) return overlay\n  // An owner already has everything; merging onto it can only produce noise.\n  if (isOwnerProfile(base)) return base\n\n  const grants: Record<string, PermissionAction[]> = { ...base.grants }\n  for (const [feature, actions] of Object.entries(overlay.grants ?? {})) {\n    const merged = new Set([...(grants[feature] ?? []), ...actions])\n    grants[feature] = [...merged]\n  }\n\n  const system = new Set([...(base.systemPermissions ?? []), ...(overlay.systemPermissions ?? [])])\n\n  return {\n    ...base,\n    grants,\n    systemPermissions: system.size > 0 ? [...system] : undefined,\n  }\n}\n\n/**\n * The profile that applies where the person is standing: their org role, plus\n * whatever the unit adds. With no unit — or no binding in it — this is exactly\n * the org role, which is why nothing that predates units changes behaviour.\n */\nexport function effectiveProfileFor(\n  subject: AccessSubject,\n  unitId?: string,\n): PermissionProfile | null {\n  if (!unitId) return subject.profile\n  return mergeProfiles(subject.profile, subject.unitProfiles?.[unitId] ?? null)\n}\n\n/**\n * The single access decision: role FIRST, then plan.\n *\n * 1. Role — reuses `profileHasPermission` (owner bypass + `manage` semantics\n *    live there, and impersonation composes for free because `profile` is the\n *    previewed role). Denied → `{ allowed:false, reason:'role' }`.\n * 2. Plan — even the owner does NOT bypass the plan: upgrading is the tenant's\n *    decision, not a role power. Denied → `{ allowed:false, reason:'plan' }`.\n */\nexport function resolveAccess(\n  subject: AccessSubject,\n  feature: string,\n  action?: PermissionAction,\n  options?: { unitId?: string },\n): AccessDecision {\n  const profile = effectiveProfileFor(subject, options?.unitId ?? subject.activeUnitId)\n  if (!profileHasPermission(profile, feature, action)) {\n    return { allowed: false, reason: 'role' }\n  }\n  if (!isEntitledByPlan(subject.plan, feature)) {\n    return { allowed: false, reason: 'plan' }\n  }\n  return { allowed: true }\n}\n\n/**\n * Pure numeric side of a limit: given the plan cap, whether a countable\n * declaration exists, and the current usage, derive the limit math. Unlimited\n * when there's no declaration to count, no cap on the plan, or the cap is `-1`.\n */\nexport function resolveLimit(params: { cap: number | undefined; hasDeclaration: boolean; used: number }): {\n  max: number\n  used: number\n  remaining: number\n  atLimit: boolean\n  unlimited: boolean\n} {\n  const { cap, hasDeclaration, used } = params\n  const unlimited = !hasDeclaration || cap === undefined || cap === -1\n  const max = unlimited ? Infinity : cap\n  const remaining = unlimited ? Infinity : Math.max(0, max - used)\n  const atLimit = !unlimited && used >= max\n  return { max, used, remaining, atLimit, unlimited }\n}\n","import type { DenyReason } from './engine'\n\n// ---------------------------------------------------------------------------\n// The structured denial an AGENT surface returns instead of failing silently\n// (docs/saas/ENTITLEMENTS.md § \"Superfície de agentes de IA\"). One shape for every\n// executor — FAB client-plane, the Fayz broker, and the pool RPCs (which emit\n// its jsonb mirror in their `denial` field) — so the model can explain the\n// denial and offer the upgrade path conversationally.\n// ---------------------------------------------------------------------------\n\n/** Where a denied tenant goes to upgrade — the conversational UpgradeModal. */\nexport const UPGRADE_URL = '/settings/subscription'\n\nexport interface AgentDenialLimit {\n  key: string\n  max: number\n  used: number\n}\n\nexport interface AgentDenial {\n  allowed: false\n  reason: DenyReason\n  /** Present when `reason === 'limit'`. */\n  limit?: AgentDenialLimit\n  upgradeUrl: string\n}\n\nexport type AgentGuardResult = { allowed: true } | AgentDenial\n\n/** Build a denial with the canonical upgrade URL attached. */\nexport function agentDenial(reason: DenyReason, limit?: AgentDenialLimit): AgentDenial {\n  return { allowed: false, reason, ...(limit ? { limit } : {}), upgradeUrl: UPGRADE_URL }\n}\n","import type { LimitDeclaration } from '../types/entitlements'\n\n/**\n * The 4-layer limit-declaration merge, extracted so the browser AccessProvider\n * and the manifest derivation (`fayz manifest emit`) resolve the EXACT same\n * final set: core built-ins < entity-derived < plugin `declaredLimits` < app\n * overrides. Later layers win by key. Pure: pass the layers in, get the merge\n * out — deriving a declaration FROM an entity stays at the call site.\n */\nexport function mergeLimitDeclarations(\n  ...layers: Array<LimitDeclaration[] | undefined>\n): LimitDeclaration[] {\n  const byKey = new Map<string, LimitDeclaration>()\n  for (const layer of layers) {\n    for (const decl of layer ?? []) byKey.set(decl.key, decl)\n  }\n  return Array.from(byKey.values())\n}\n"]}

package/dist/app/app-config.d.ts

@@ -0,0 +1,101 @@
+import type { TenantPluginBinding } from '../types/plugins';
+/** One activation row: a plugin, or one facet of it. */
+export interface AppConfigPlugin {
+    plugin: string;
+    /** null for the plugin itself; a name for one of its parts. */
+    facet: string | null;
+    status: 'active' | 'disabled';
+    /** Who turned it on — manual, plan, trial, agent, default. */
+    source: string;
+    config: Record<string, unknown>;
+    /** When a trial or courtesy ends; null is forever. */
+    expires_at: string | null;
+}
+/** The tenant's difference over the menu the plugins offer. */
+export interface AppConfigNavEntry {
+    key: string;
+    hidden: boolean;
+    label: string | null;
+    section: 'main' | 'secondary' | 'settings' | null;
+    position: number | null;
+}
+export interface AppConfig {
+    tenant_id: string | null;
+    branding?: Record<string, unknown>;
+    settings?: Record<string, unknown>;
+    plugins: AppConfigPlugin[];
+    nav: AppConfigNavEntry[];
+    permissions?: string[];
+    generated_at?: string;
+}
+/** What a caller with no resolvable tenant gets: nothing, legibly. */
+export declare const EMPTY_APP_CONFIG: AppConfig;
+/**
+ * Reads the whole configuration in one round trip.
+ *
+ * Never throws: a shell that cannot render because the configuration call
+ * failed is worse than a shell that renders the defaults. The failure is
+ * returned as an empty configuration, which is the same thing the RPC returns
+ * for a caller with no tenant — and both are visible in one place rather than
+ * as a blank screen.
+ */
+export declare function fetchAppConfig(client: unknown, options?: {
+    tenantId?: string;
+    force?: boolean;
+}): Promise<AppConfig>;
+/** Drops what is cached — called after any write through the config RPCs. */
+export declare function invalidateAppConfig(tenantId?: string): void;
+export declare function normalizeAppConfig(raw: Partial<AppConfig>): AppConfig;
+/**
+ * The activation rows as the plugin runtime already understands them.
+ *
+ * `resolvePluginRuntime` has accepted `tenantPlugins: TenantPluginBinding[]`
+ * since it was written and nothing ever supplied them from anywhere but a file.
+ * This is that supply — facet rows are folded into their plugin's config under
+ * `facets`, because a facet is a part of a plugin and not a plugin.
+ */
+export declare function toTenantPluginBindings(config: AppConfig): TenantPluginBinding[];
+/**
+ * Applies the tenant's menu composition to what the plugins offer.
+ *
+ * Only the difference is stored, so an entry with no row here keeps exactly the
+ * position and label its plugin gave it — which is what lets a plugin ship a new
+ * entry and have it reach every tenant.
+ */
+export declare function applyNavComposition<T extends {
+    key: string;
+    label?: string;
+    section?: string;
+    position?: number;
+}>(entries: T[], nav: AppConfigNavEntry[]): T[];
+/** The keys a generated app must NOT ship in a file: they are per-tenant. */
+export declare const TENANT_OWNED_MANIFEST_KEYS: readonly ["theme", "branding", "locale"];
+export interface ManifestLike {
+    [key: string]: unknown;
+    theme?: Record<string, unknown>;
+    branding?: Record<string, unknown>;
+    locale?: Record<string, unknown>;
+    surfaces?: Record<string, {
+        plugins?: Array<{
+            id: string;
+            config?: Record<string, unknown>;
+        }>;
+    } & Record<string, unknown>>;
+}
+/**
+ * Folds the tenant's configuration over the bundle's manifest.
+ *
+ * What stays the manifest's: the surfaces, their scaffolds, and which plugin
+ * ids the bundle can load at all — an import-graph fact that no database row can
+ * change, because the code either shipped or it did not.
+ *
+ * What the database decides: branding, locale, and whether each of those
+ * plugins is on for this tenant, with its settings. That is the whole point of
+ * ADR 0023 — eleven customers stop needing eleven repositories, and turning a
+ * feature on stops being a deploy.
+ *
+ * An empty config changes nothing, so a pool that has not run migration 150 yet
+ * renders exactly what it rendered before.
+ */
+export declare function applyAppConfigToManifest<T extends ManifestLike>(manifest: T, config: AppConfig): T;
+//# sourceMappingURL=app-config.d.ts.map

package/dist/app/app-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/app/app-config.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAA;IAC7B,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,sDAAsD;IACtD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,GAAG,IAAI,CAAA;IACjD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,OAAO,EAAE,eAAe,EAAE,CAAA;IAC1B,GAAG,EAAE,iBAAiB,EAAE,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,EAAE,SAKhB,CAAA;AAcf;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,OAAO,EACf,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GACnD,OAAO,CAAC,SAAS,CAAC,CAcpB;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAG3D;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CAUrE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,mBAAmB,EAAE,CA2B/E;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAChH,OAAO,EAAE,CAAC,EAAE,EACZ,GAAG,EAAE,iBAAiB,EAAE,GACvB,CAAC,EAAE,CAeL;AAQD,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,0CAA2C,CAAA;AAElF,MAAM,WAAW,YAAY;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAC3H;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS,YAAY,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,GAAG,CAAC,CAoClG"}

package/dist/app/service-client.d.ts

@@ -0,0 +1,69 @@
+/** Why a call did not produce a value. Each one has a different right answer. */
+export type ServiceRefusal = 
+/** The service is not registered, or was turned off. */
+'unknown_service'
+/** No tenant in scope — a caller that cannot be placed. */
+ | 'no_tenant'
+/** The caller lacks the permission the service requires. */
+ | 'forbidden'
+/** The tenant has not contracted it: an upsell, not an error. */
+ | 'not_contracted'
+/** It did not answer in time. */
+ | 'timeout'
+/** It answered with a failure. */
+ | 'failed'
+/** There is nothing to call through (no client, no session). */
+ | 'unavailable';
+export interface ServiceSuccess<T> {
+    ok: true;
+    data: T;
+    durationMs: number;
+}
+export interface ServiceFailure {
+    ok: false;
+    reason: ServiceRefusal;
+    /** What the user can still do, as the service itself declared it. */
+    manualFallback?: string;
+    /** For `not_contracted`: what to offer. */
+    entitlement?: string;
+    plugin?: string;
+    /** For `forbidden`: what would be needed. */
+    permission?: string;
+    message?: string;
+}
+export type ServiceResult<T> = ServiceSuccess<T> | ServiceFailure;
+export interface CallServiceOptions {
+    /** Overrides the timeout the registry declares for this service. */
+    timeoutMs?: number;
+    /** The edge function that performs the HTTP leg. Defaults to 'service-router'. */
+    router?: string;
+    /**
+     * Calls on behalf of a tenant with no session — the event consumer's 2am
+     * reaction (#278). Requires a service-role client; a browser client passing
+     * this is refused by the router, not by trust.
+     */
+    tenantId?: string;
+}
+/**
+ * Calls a service by name.
+ *
+ * Two round trips by design. The first asks the database whether the call is
+ * allowed — which costs nothing and answers the same way everywhere, so a
+ * refusal never leaves the cluster and an unentitled tenant never reaches the
+ * service at all. Only an allowed call makes the second.
+ */
+export declare function callService<T = unknown>(client: unknown, name: string, payload?: Record<string, unknown>, options?: CallServiceOptions): Promise<ServiceResult<T>>;
+/**
+ * Calls a service for a tenant with no user present — the worker draining the
+ * event log (#277) reacting to a fact at 2am (#278).
+ *
+ * Same door, same refusals, same never-throws contract. What differs is who is
+ * asking: there is no person, so there is no permission to check, and the
+ * entitlement rule carries the whole decision because a tenant's contract is a
+ * property of the tenant rather than of who is looking.
+ *
+ * The client must hold the service role. A browser client that passes a tenant
+ * is refused by the router, which checks rather than trusts.
+ */
+export declare function callServiceForTenant<T = unknown>(client: unknown, tenantId: string, name: string, payload?: Record<string, unknown>, options?: Omit<CallServiceOptions, 'tenantId'>): Promise<ServiceResult<T>>;
+//# sourceMappingURL=service-client.d.ts.map

package/dist/app/service-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-client.d.ts","sourceRoot":"","sources":["../../src/app/service-client.ts"],"names":[],"mappings":"AAgBA,iFAAiF;AACjF,MAAM,MAAM,cAAc;AACxB,wDAAwD;AACtD,iBAAiB;AACnB,2DAA2D;GACzD,WAAW;AACb,4DAA4D;GAC1D,WAAW;AACb,iEAAiE;GAC/D,gBAAgB;AAClB,iCAAiC;GAC/B,SAAS;AACX,kCAAkC;GAChC,QAAQ;AACV,gEAAgE;GAC9D,aAAa,CAAA;AAEjB,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,EAAE,EAAE,IAAI,CAAA;IACR,IAAI,EAAE,CAAC,CAAA;IACP,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,cAAc,CAAA;IACtB,qEAAqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAA;AAajE,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,CAAC,GAAG,OAAO,EAC3C,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACrC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CA6D3B;AA2CD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,GAAG,OAAO,EAC9C,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACrC,OAAO,GAAE,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAM,GACjD,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAE3B"}

package/dist/{chunk-S5FOFKR4.js → chunk-2ZAUJVYP.js}

@@ -1,4 +1,4 @@
-import { globalCache, getActiveTenantId, getSupabaseClientOptional, parseRangeFilter, matchesRange, applyRangeToQuery, isFilterObject, stableKey, DEFAULT_CACHE_TTL, createSupabaseProvider } from './chunk-KFBEKFII.js';
+import { globalCache, getActiveTenantId, getSupabaseClientOptional, parseRangeFilter, matchesRange, applyUnitScope, applyRangeToQuery, isFilterObject, stableKey, DEFAULT_CACHE_TTL, getScopedResource, createSupabaseProvider, resolveUnitScope, clearGlobalCache } from './chunk-BCI743RH.js';
 import { declaredCustomFields, validateEntityRecordData } from './chunk-EWKX4VUM.js';
 import * as React from 'react';
 
@@ -303,14 +303,15 @@ var ARCHETYPE_CONFIG = {
 };
 var CUSTOM_FIELDS_COLUMN = "custom_fields";
 var CUSTOM_FIELD_FILTER_PREFIX = "custom.";
+var UNIT_COLUMN = "unit_id";
 var ARCHETYPE_COLUMNS = {
-  person: /* @__PURE__ */ new Set(["name", "email", "phone", "document_number", "avatar_url", "date_of_birth", "address", "city", "state", "country", "postal_code", "tags", "is_active", "notes", "metadata", CUSTOM_FIELDS_COLUMN]),
-  category: /* @__PURE__ */ new Set(["name", "slug", "parent_id", "icon", "color", "sort_order", "is_active", "metadata", CUSTOM_FIELDS_COLUMN]),
-  product: /* @__PURE__ */ new Set(["name", "description", "sku", "price", "cost", "currency", "unit", "image_url", "stock", "min_stock", "status", "is_active", "tags", "metadata", "category_id", CUSTOM_FIELDS_COLUMN]),
-  service: /* @__PURE__ */ new Set(["name", "description", "price", "cost", "currency", "duration_minutes", "image_url", "status", "is_active", "tags", "metadata", "category_id", CUSTOM_FIELDS_COLUMN]),
+  person: /* @__PURE__ */ new Set(["name", "email", "phone", "document_number", "avatar_url", "date_of_birth", "address", "city", "state", "country", "postal_code", "tags", "is_active", "is_bookable", "notes", "metadata", CUSTOM_FIELDS_COLUMN, UNIT_COLUMN]),
+  category: /* @__PURE__ */ new Set(["name", "slug", "parent_id", "icon", "color", "sort_order", "is_active", "metadata", CUSTOM_FIELDS_COLUMN, UNIT_COLUMN]),
+  product: /* @__PURE__ */ new Set(["name", "description", "sku", "price", "cost", "currency", "unit", "image_url", "stock", "min_stock", "status", "is_active", "tags", "metadata", "category_id", CUSTOM_FIELDS_COLUMN, UNIT_COLUMN]),
+  service: /* @__PURE__ */ new Set(["name", "description", "price", "cost", "currency", "duration_minutes", "image_url", "status", "is_active", "tags", "metadata", "category_id", CUSTOM_FIELDS_COLUMN, UNIT_COLUMN]),
   location: /* @__PURE__ */ new Set(["name", "email", "phone", "address", "city", "state", "country", "postal_code", "is_headquarters", "is_active", "tags", "notes", "metadata", CUSTOM_FIELDS_COLUMN]),
   order: /* @__PURE__ */ new Set(["reference_number", "status", "party_id", "assignee_id", "location_id", "subtotal", "discount", "tax", "total", "currency", "due_at", "completed_at", "notes", "tags", "metadata", CUSTOM_FIELDS_COLUMN]),
-  transaction: /* @__PURE__ */ new Set(["order_id", "party_id", "amount", "currency", "payment_method", "reference", "status", "transacted_at", "notes", "metadata", CUSTOM_FIELDS_COLUMN]),
+  transaction: /* @__PURE__ */ new Set(["order_id", "party_id", "amount", "currency", "payment_method", "reference", "status", "transacted_at", "notes", "metadata", CUSTOM_FIELDS_COLUMN, UNIT_COLUMN]),
   schedule: /* @__PURE__ */ new Set(["assignee_id", "location_id", "day_of_week", "specific_date", "starts_at", "ends_at", "is_active", "metadata", CUSTOM_FIELDS_COLUMN])
 };
 function camelToSnake(str) {
@@ -338,11 +339,14 @@ function createArchetypeProvider(config) {
   function coreClient() {
     return getClient2();
   }
+  function unitScope() {
+    return resolveUnitScope(config);
+  }
   function splitFields(data) {
     const archetypeData = {};
     const projectData = {};
     for (const [key, value] of Object.entries(data)) {
-      if (["id", "createdAt", "updatedAt", "createdBy", "tenantId", fkColumn].includes(key)) continue;
+      if (["id", "createdAt", "updatedAt", "createdBy", "ownerId", "tenantId", fkColumn].includes(key)) continue;
       const snakeKey = camelToSnake(key);
       if (archetypeColumns.has(snakeKey)) {
         archetypeData[snakeKey] = value;
@@ -364,6 +368,7 @@ function createArchetypeProvider(config) {
       if (!tenantId) return { data: [], total: 0 };
       const countOpts = query.countMode === "none" ? void 0 : { count: "exact" };
       let q = isPure ? coreClient().from(ac.table).select("*", countOpts).eq("tenant_id", tenantId) : getClient2().from(viewName).select("*", countOpts).eq("tenant_id", tenantId);
+      q = applyUnitScope(q, unitScope());
       if (isPure && HAS_KIND.has(config.archetype)) {
         q = q.eq("kind", config.archetypeKind);
       }
@@ -413,6 +418,10 @@ function createArchetypeProvider(config) {
       if (HAS_KIND.has(config.archetype)) {
         archetypeData.kind = config.archetypeKind;
       }
+      const scope = unitScope();
+      if (scope && archetypeData[scope.column] === void 0) {
+        archetypeData[scope.column] = scope.id;
+      }
       const { data: archetypeRow, error: archetypeError } = await coreClient().from(ac.table).insert(archetypeData).select().single();
       if (archetypeError) throw archetypeError;
       const archetypeId = archetypeRow.id;
@@ -465,8 +474,9 @@ function createArchetypeProvider(config) {
 function cachePrefixFor(tenantId, table) {
   return `${tenantId ?? "_"}:${table}`;
 }
-function cacheKeyFor(tenantId, table, query) {
-  return `${cachePrefixFor(tenantId, table)}:${stableKey(query)}`;
+function cacheKeyFor(tenantId, table, query, unitId) {
+  const keyed = unitId ? { ...query, __unit: unitId } : query;
+  return `${cachePrefixFor(tenantId, table)}:${stableKey(keyed)}`;
 }
 function withCache(provider, options) {
   function prefix() {
@@ -474,7 +484,7 @@ function withCache(provider, options) {
   }
   return {
     async list(query) {
-      const key = cacheKeyFor(options.tenantId(), options.table, query);
+      const key = cacheKeyFor(options.tenantId(), options.table, query, options.unitId?.());
       const cached = globalCache.get(key);
       if (cached) return { ...cached, cached: true };
       const result = await provider.list(query);
@@ -1034,8 +1044,8 @@ var REPLICA_MAX_ROWS = 5e3;
 var REPLICA_FIRST_DELAY_MS = 1500;
 var REPLICA_REFRESH_DELAY_MS = 3e3;
 var REPLICA_MIN_INTERVAL_MS = 6e4;
-function replicaKeyFor(tenantId, table) {
-  return `replica:${cachePrefixFor(tenantId, table)}`;
+function replicaKeyFor(tenantId, table, unitId) {
+  return `replica:${cachePrefixFor(tenantId, table)}${unitId ? `@${unitId}` : ""}`;
 }
 function withOffline(provider, options) {
   if (options.policy === "online") return provider;
@@ -1044,14 +1054,14 @@ function withOffline(provider, options) {
   async function fromPersisted(query) {
     const l2 = getPersistentCache();
     if (!l2?.available) return void 0;
-    const entry = await l2.getStale(cacheKeyFor(options.tenantId(), options.table, query));
+    const entry = await l2.getStale(cacheKeyFor(options.tenantId(), options.table, query, options.unitId?.()));
     if (!entry) return void 0;
     return { ...entry.data, stale: true, staleAt: entry.storedAt };
   }
   async function fromReplica(query) {
     const l2 = getPersistentCache();
     if (!l2?.available) return void 0;
-    const snapshot = await l2.getReplica(replicaKeyFor(options.tenantId(), options.table));
+    const snapshot = await l2.getReplica(replicaKeyFor(options.tenantId(), options.table, options.unitId?.()));
     if (!snapshot) return void 0;
     const result = await localList(snapshot.rows, query, options.entityDef);
     return { ...result, stale: true, staleAt: snapshot.syncedAt };
@@ -1062,7 +1072,7 @@ function withOffline(provider, options) {
         const result = await provider.list(query);
         const l2 = getPersistentCache();
         if (options.policy === "cache" && l2?.available) {
-          l2.put(cacheKeyFor(options.tenantId(), options.table, query), result, Date.now() + ttl);
+          l2.put(cacheKeyFor(options.tenantId(), options.table, query, options.unitId?.()), result, Date.now() + ttl);
         }
         return result;
       } catch (err) {
@@ -1118,13 +1128,13 @@ async function syncReplica(provider, options) {
     if (result.data.length < pageSize) break;
   }
   const snapshot = rows.slice(0, maxRows);
-  l2.putReplica(replicaKeyFor(options.tenantId, options.table), snapshot);
+  l2.putReplica(replicaKeyFor(options.tenantId, options.table, options.unitId), snapshot);
   await l2.flush();
   return snapshot.length;
 }
 var replicaSyncs = /* @__PURE__ */ new Map();
 function ensureReplicaSync(provider, options) {
-  const key = replicaKeyFor(options.tenantId(), options.table);
+  const key = replicaKeyFor(options.tenantId(), options.table, options.unitId?.());
   if (replicaSyncs.has(key)) return;
   const state = {
     // Tenant read at sync time, not at registration: the first provider is often
@@ -1132,6 +1142,7 @@ function ensureReplicaSync(provider, options) {
     run: () => syncReplica(provider, {
       table: options.table,
       tenantId: options.tenantId(),
+      unitId: options.unitId?.(),
       pageSize: options.replicaPageSize,
       maxRows: options.replicaMaxRows
     }),
@@ -1149,7 +1160,7 @@ function ensureReplicaSync(provider, options) {
   scheduleReplicaSync(options, REPLICA_FIRST_DELAY_MS);
 }
 function scheduleReplicaSync(options, delayMs) {
-  const state = replicaSyncs.get(replicaKeyFor(options.tenantId(), options.table));
+  const state = replicaSyncs.get(replicaKeyFor(options.tenantId(), options.table, options.unitId?.()));
   if (!state || state.timer) return;
   state.timer = setTimeout(() => {
     state.timer = null;
@@ -1247,6 +1258,47 @@ function mergeCustomFields(current, patch) {
   }
   return merged;
 }
+var _activeUnitId;
+var _unitMode = false;
+var listeners = /* @__PURE__ */ new Set();
+function notify() {
+  clearGlobalCache();
+  for (const l of listeners) l();
+}
+function setActiveUnitId(id) {
+  if (id === _activeUnitId) return;
+  _activeUnitId = id;
+  notify();
+}
+function getActiveUnitId() {
+  return _unitMode ? _activeUnitId : void 0;
+}
+function setUnitMode(on) {
+  if (on === _unitMode) return;
+  _unitMode = on;
+  notify();
+}
+function isUnitMode() {
+  return _unitMode;
+}
+function subscribeActiveUnit(listener) {
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
+}
+function useActiveUnitId() {
+  return React.useSyncExternalStore(subscribeActiveUnit, getActiveUnitId, getActiveUnitId);
+}
+function useUnitMode() {
+  return React.useSyncExternalStore(subscribeActiveUnit, isUnitMode, isUnitMode);
+}
+function resetActiveUnit() {
+  if (_activeUnitId === void 0 && !_unitMode) return;
+  _activeUnitId = void 0;
+  _unitMode = false;
+  notify();
+}
 
 // src/data/custom-fields.ts
 var KEY = "customFields";
@@ -1311,10 +1363,20 @@ function resolveDataProvider(entityDef, mockData, options = {}) {
   const client = getSupabaseClientOptional();
   if (client && entityDef.data?.table) {
     const tenantId = () => getActiveTenantId();
+    const registered = getScopedResource(entityDef.data.table);
+    const unitScoped = entityDef.data.unitScoped ?? Boolean(registered);
+    const unitId = unitScoped ? () => getActiveUnitId() : void 0;
+    const unitConfig = {
+      unitScoped,
+      unitColumn: entityDef.data.unitIdColumn ?? registered?.unitColumn,
+      includeSharedRows: entityDef.data.includeSharedRows,
+      unitId
+    };
     const cacheOptions = {
       table: entityDef.data.archetypeKind ? `${entityDef.data.table}#${entityDef.data.archetypeKind}` : entityDef.data.table,
       tenantId,
-      ttl: entityDef.data.cacheTTL
+      ttl: entityDef.data.cacheTTL,
+      unitId
     };
     const offlinePolicy = entityDef.data.offline ?? "online";
     const cached = (p) => {
@@ -1327,7 +1389,8 @@ function resolveDataProvider(entityDef, mockData, options = {}) {
         archetypeKind: entityDef.data.archetypeKind,
         projectTable: entityDef.data.table,
         tenantId,
-        searchColumns: entityDef.data.searchColumns ?? entityDef.fields.filter((field) => field.searchable).map((field) => field.key)
+        searchColumns: entityDef.data.searchColumns ?? entityDef.fields.filter((field) => field.searchable).map((field) => field.key),
+        ...unitConfig
       }), entityDef.data.archetype));
     }
     return cached(createSupabaseProvider(entityDef.data.table, {
@@ -1338,7 +1401,8 @@ function resolveDataProvider(entityDef, mockData, options = {}) {
       selectColumns: entityDef.data.selectColumns,
       columnMap: entityDef.data.columnMap,
       filters: entityDef.data.filters,
-      defaults: entityDef.data.defaults
+      defaults: entityDef.data.defaults,
+      ...unitConfig
     }));
   }
   if (entityDef.data?.table) {
@@ -1349,6 +1413,21 @@ function resolveDataProvider(entityDef, mockData, options = {}) {
   return createMockProvider(entityDef, mockData);
 }
 
+// src/data/missing-objects.ts
+var missing = /* @__PURE__ */ new Set();
+function isKnownMissing(key) {
+  return missing.has(key);
+}
+function rememberIfMissing(key, error) {
+  if (!error) return false;
+  if (toDataError(error).kind !== "missing-object") return false;
+  missing.add(key);
+  return true;
+}
+function resetMissingObjects() {
+  missing.clear();
+}
+
 // src/data/query.ts
 var DEFAULT_TIMEOUT_MS = 15e3;
 var DEFAULT_RETRY_DELAY_MS = 150;
@@ -1613,6 +1692,6 @@ async function bulkRemove(provider, ids, options) {
   return { removed, failed };
 }
 
-export { CustomFieldsError, DATA_CHANGED_EVENT, DataError, FIELDS_TABLE, attachPersistentCache, bulkCreate, bulkRemove, cacheKeyFor, cachePrefixFor, clearCustomFieldsCache, countByTenant, createArchetypeProvider, createEventBus, createFayzApiProvider, createMockProvider, dataCall, dataQuery, emitDataChanged, eventBus, getPersistentCache, invalidateCount, localList, matchesDataChange, mergeCustomFields, registerDataTelemetry, replicaKeyFor, resolveCustomFields, resolveDataProvider, syncReplica, toDataError, useDataChanged, validateCustomFields, withCache, withOffline };
-//# sourceMappingURL=chunk-S5FOFKR4.js.map
-//# sourceMappingURL=chunk-S5FOFKR4.js.map
+export { CustomFieldsError, DATA_CHANGED_EVENT, DataError, FIELDS_TABLE, attachPersistentCache, bulkCreate, bulkRemove, cacheKeyFor, cachePrefixFor, clearCustomFieldsCache, countByTenant, createArchetypeProvider, createEventBus, createFayzApiProvider, createMockProvider, dataCall, dataQuery, emitDataChanged, eventBus, getActiveUnitId, getPersistentCache, invalidateCount, isKnownMissing, isUnitMode, localList, matchesDataChange, mergeCustomFields, registerDataTelemetry, rememberIfMissing, replicaKeyFor, resetActiveUnit, resetMissingObjects, resolveCustomFields, resolveDataProvider, setActiveUnitId, setUnitMode, subscribeActiveUnit, syncReplica, toDataError, useActiveUnitId, useDataChanged, useUnitMode, validateCustomFields, withCache, withOffline };
+//# sourceMappingURL=chunk-2ZAUJVYP.js.map
+//# sourceMappingURL=chunk-2ZAUJVYP.js.map