@happyvertical/smrt-fields 0.40.57

package/dist/index.js

@@ -0,0 +1,936 @@
+import { APP_FIELD_POLICY_SCOPE_KEY, FIELD_POLICY_SCOPE_TYPES, FIELD_POLICY_VISIBILITIES } from "./types.js";
+import { ObjectRegistry, SmrtCollection, SmrtObject, crossPackageRef, field, smrt } from "@happyvertical/smrt-core";
+import { TenantIsolationError, assertTenantReadAllowed, getCurrentTenant, isSuperAdminBypass, tenantId } from "@happyvertical/smrt-tenancy";
+import { importWorkspaceModule } from "@happyvertical/smrt-core/utils/import-workspace-module";
+//#region \0rolldown/runtime.js
+var __defProp$2 = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp$2(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp$2(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/__smrt-register__.ts
+ObjectRegistry.registerPackageManifest(JSON.parse("{\"version\":\"1.0.0\",\"timestamp\":0,\"packageName\":\"@happyvertical/smrt-fields\",\"packageVersion\":\"0.40.57\",\"objects\":{\"@happyvertical/smrt-fields:FieldPolicyCollection\":{\"name\":\"fieldpolicycollection\",\"className\":\"FieldPolicyCollection\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldPolicyCollection\",\"collection\":\"fieldpolicies\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/collections/FieldPolicyCollection.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{},\"methods\":{\"getAppRows\":{\"name\":\"getAppRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Map<string, FieldPolicy>>\",\"isStatic\":false,\"isPublic\":true},\"getTenantRows\":{\"name\":\"getTenantRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false},{\"name\":\"tenantIds\",\"type\":\"string[]\",\"optional\":false}],\"returnType\":\"Promise<Map<string, Map<string, FieldPolicy>>>\",\"isStatic\":false,\"isPublic\":true},\"getUserRows\":{\"name\":\"getUserRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false},{\"name\":\"userId\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Map<string, FieldPolicy>>\",\"isStatic\":false,\"isPublic\":true},\"resolveBatch\":{\"name\":\"resolveBatch\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<FieldPolicyBatchResult>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"conflictColumns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"api\":{\"include\":[\"create\",\"update\",\"delete\",\"resolveBatch\"],\"routes\":{\"resolveBatch\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"resolve\"}}},\"cli\":false,\"mcp\":false,\"tableName\":\"_smrt_field_policies\"},\"extends\":\"SmrtCollection\",\"extendsTypeArg\":\"FieldPolicy\",\"exportName\":\"FieldPolicyCollection\",\"collectionExportName\":\"FieldPolicyCollectionCollection\",\"schema\":{\"tableName\":\"_smrt_field_policies\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_policies\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"}},\"indexes\":[{\"name\":\"_smrt_field_policies_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_policies_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"unique\":true}],\"version\":\"13aa748c\"}},\"@happyvertical/smrt-fields:FieldPolicy\":{\"name\":\"fieldpolicy\",\"className\":\"FieldPolicy\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldPolicy\",\"collection\":\"fieldpolicies\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/models/FieldPolicy.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{\"objectRef\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"fieldName\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"scopeType\":{\"type\":\"text\",\"required\":true,\"default\":\"app\",\"_meta\":{\"required\":true}},\"tenantId\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"sqlType\":\"UUID\",\"nullable\":true,\"__tenancy\":{\"isTenantIdField\":true,\"autoFilter\":true,\"required\":false,\"autoPopulate\":true,\"nullable\":true}}},\"userId\":{\"type\":\"crossPackageRef\",\"required\":false,\"related\":\"@happyvertical/smrt-users:User\",\"_meta\":{\"nullable\":true}},\"scopeKey\":{\"type\":\"text\",\"required\":true,\"_meta\":{\"required\":true}},\"defaultValue\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"visibility\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"help\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"label\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"displayOrder\":{\"type\":\"integer\",\"required\":false,\"_meta\":{\"nullable\":true}},\"locked\":{\"type\":\"boolean\",\"required\":false,\"_meta\":{\"nullable\":true}},\"updatedBy\":{\"type\":\"crossPackageRef\",\"required\":false,\"related\":\"@happyvertical/smrt-users:User\",\"_meta\":{\"nullable\":true}}},\"methods\":{\"getDefaultValue\":{\"name\":\"getDefaultValue\",\"async\":false,\"parameters\":[],\"returnType\":\"any\",\"isStatic\":false,\"isPublic\":true},\"setDefaultValue\":{\"name\":\"setDefaultValue\",\"async\":false,\"parameters\":[{\"name\":\"value\",\"type\":\"any\",\"optional\":false}],\"returnType\":\"void\",\"isStatic\":false,\"isPublic\":true},\"save\":{\"name\":\"save\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise\",\"isStatic\":false,\"isPublic\":true},\"delete\":{\"name\":\"delete\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise<void>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"tableName\":\"_smrt_field_policies\",\"conflictColumns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"api\":{\"include\":[\"create\",\"update\",\"delete\"]},\"cli\":{\"include\":[\"create\",\"update\",\"delete\"],\"exclude\":[\"getDefaultValue\",\"setDefaultValue\"]},\"mcp\":{\"include\":[]}},\"extends\":\"SmrtObject\",\"exportName\":\"FieldPolicy\",\"collectionExportName\":\"FieldPolicyCollection\",\"validationRules\":[{\"field\":\"objectRef\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"fieldName\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"scopeType\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"scopeKey\",\"rule\":\"required\",\"fieldType\":\"text\"}],\"schema\":{\"tableName\":\"_smrt_field_policies\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_policies\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"object_ref\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"field_name\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"scope_type\\\" TEXT NOT NULL DEFAULT 'app',\\n  \\\"tenant_id\\\" UUID,\\n  \\\"user_id\\\" UUID,\\n  \\\"scope_key\\\" TEXT NOT NULL,\\n  \\\"default_value\\\" TEXT,\\n  \\\"visibility\\\" TEXT,\\n  \\\"help\\\" TEXT,\\n  \\\"label\\\" TEXT,\\n  \\\"display_order\\\" INTEGER,\\n  \\\"locked\\\" BOOLEAN,\\n  \\\"updated_by\\\" UUID\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"object_ref\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"field_name\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"scope_type\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"app\"},\"tenant_id\":{\"type\":\"UUID\",\"referenceKind\":\"tenantId\",\"notNull\":false,\"unique\":false},\"user_id\":{\"type\":\"UUID\",\"referenceKind\":\"crossPackageRef\",\"notNull\":false,\"unique\":false},\"scope_key\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false},\"default_value\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"visibility\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"help\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"label\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"display_order\":{\"type\":\"INTEGER\",\"notNull\":false,\"unique\":false},\"locked\":{\"type\":\"BOOLEAN\",\"notNull\":false,\"unique\":false},\"updated_by\":{\"type\":\"UUID\",\"referenceKind\":\"crossPackageRef\",\"notNull\":false,\"unique\":false}},\"indexes\":[{\"name\":\"_smrt_field_policies_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_policies_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"unique\":true}],\"version\":\"34b355cc\"}}},\"moduleType\":\"smrt\",\"smrtDependencies\":[\"@happyvertical/smrt-core\",\"@happyvertical/smrt-tenancy\",\"@happyvertical/smrt-users\"]}"));
+//#endregion
+//#region src/cache.ts
+var FIELD_POLICY_CACHE_TTL_MS = 3e4;
+var fieldPolicyCache = /* @__PURE__ */ new Map();
+var dbInstanceIds = /* @__PURE__ */ new WeakMap();
+var nextDbId = 1;
+function getDbNamespace(db) {
+	if (!db) return "no-db";
+	if (typeof db === "string") return `db:${db}`;
+	if (typeof db === "object") {
+		const dbObject = db;
+		if (typeof dbObject.query === "function") {
+			if (!dbInstanceIds.has(dbObject)) dbInstanceIds.set(dbObject, `db-instance:${nextDbId++}`);
+			const namespace = dbInstanceIds.get(dbObject);
+			if (namespace) return namespace;
+			return "db-instance:unknown";
+		}
+		try {
+			return `db-config:${JSON.stringify(dbObject)}`;
+		} catch {
+			return "db-config:opaque";
+		}
+	}
+	return "db:unknown";
+}
+var hierarchyLoaderIds = /* @__PURE__ */ new WeakMap();
+var nextLoaderId = 1;
+function getHierarchyLoaderNamespace(loader) {
+	if (typeof loader !== "function") return "loader:default";
+	const key = loader;
+	if (!hierarchyLoaderIds.has(key)) hierarchyLoaderIds.set(key, `loader:${nextLoaderId++}`);
+	return hierarchyLoaderIds.get(key) ?? "loader:unknown";
+}
+function buildCacheKey(objectRef, tenantId, userId, db, hierarchyLoader) {
+	return `${getDbNamespace(db)}::${objectRef}::${tenantId ?? "app"}::${userId ?? "user:none"}::${getHierarchyLoaderNamespace(hierarchyLoader)}`;
+}
+function getFieldPolicyCacheTtlMs() {
+	return FIELD_POLICY_CACHE_TTL_MS;
+}
+function getCachedFieldPolicy(objectRef, tenantId, userId, db, hierarchyLoader) {
+	const cacheKey = buildCacheKey(objectRef, tenantId, userId, db, hierarchyLoader);
+	const cached = fieldPolicyCache.get(cacheKey);
+	if (!cached) return null;
+	if (cached.expiresAt <= Date.now()) {
+		fieldPolicyCache.delete(cacheKey);
+		return null;
+	}
+	return cached.value;
+}
+function setCachedFieldPolicy(objectRef, tenantId, userId, db, value, hierarchyLoader) {
+	fieldPolicyCache.set(buildCacheKey(objectRef, tenantId, userId, db, hierarchyLoader), {
+		expiresAt: Date.now() + FIELD_POLICY_CACHE_TTL_MS,
+		value
+	});
+}
+function invalidateFieldPolicyCache(objectRef, db) {
+	const keyPrefix = `${getDbNamespace(db)}::${objectRef}::`;
+	for (const cacheKey of fieldPolicyCache.keys()) if (cacheKey.startsWith(keyPrefix)) fieldPolicyCache.delete(cacheKey);
+}
+function clearFieldPolicyCache() {
+	fieldPolicyCache.clear();
+}
+//#endregion
+//#region src/field-definitions.ts
+function requireRegisteredObject(objectRef) {
+	if (!objectRef?.includes(":")) throw new Error(`Field policy objectRef must be a qualified class name ("@package/name:ClassName"), got "${objectRef}"`);
+	if (!ObjectRegistry.getClassByQualifiedName(objectRef)) throw new Error(`Unknown field policy objectRef "${objectRef}": no class with that qualified name is registered`);
+}
+async function getObjectFieldMap(objectRef) {
+	requireRegisteredObject(objectRef);
+	return ObjectRegistry.getAllFields(objectRef);
+}
+function sanitizeFieldUIHints(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return;
+	const raw = value;
+	const ui = {
+		...typeof raw.basic === "boolean" ? { basic: raw.basic } : {},
+		...typeof raw.group === "string" ? { group: raw.group } : {},
+		...typeof raw.order === "number" && Number.isFinite(raw.order) ? { order: raw.order } : {},
+		...typeof raw.locked === "boolean" ? { locked: raw.locked } : {}
+	};
+	return Object.keys(ui).length > 0 ? ui : void 0;
+}
+function isSensitiveField(field) {
+	return field.sensitive === true || field._meta?.sensitive === true;
+}
+function getFieldReadPermission(field) {
+	if (typeof field.readPermission === "string") return field.readPermission;
+	const metaPermission = field._meta?.readPermission;
+	return typeof metaPermission === "string" ? metaPermission : void 0;
+}
+function isTransientField(field) {
+	return field.transient === true || field._meta?.transient === true;
+}
+function isRequiredField(field) {
+	if (field.nullable === true || field._meta?.nullable === true) return false;
+	return field.required === true || field._meta?.required === true;
+}
+function getCodeDefault(field) {
+	if (field.default !== void 0) return { value: field.default };
+	if (field._meta?.default !== void 0) return { value: field._meta.default };
+}
+function isUsableRequiredDefault(defaultBox) {
+	if (!defaultBox) return false;
+	return defaultBox.value !== null && defaultBox.value !== "";
+}
+function buildCodeSeedVisibility(fields) {
+	let hasBasicMarkers = false;
+	const hints = /* @__PURE__ */ new Map();
+	for (const [name, field] of fields) {
+		const ui = sanitizeFieldUIHints(field._meta?.ui);
+		hints.set(name, ui);
+		if (ui?.basic === true) hasBasicMarkers = true;
+	}
+	const visibility = /* @__PURE__ */ new Map();
+	for (const [name] of fields) {
+		const ui = hints.get(name);
+		if (ui?.basic === true) visibility.set(name, "basic");
+		else if (ui?.basic === false || hasBasicMarkers) visibility.set(name, "advanced");
+		else visibility.set(name, "basic");
+	}
+	return visibility;
+}
+function buildCodeSeedDelta(field, visibility) {
+	const ui = sanitizeFieldUIHints(field._meta?.ui);
+	const help = typeof field.description === "string" ? field.description : typeof field._meta?.description === "string" ? field._meta.description : void 0;
+	const codeDefault = getCodeDefault(field);
+	return {
+		...codeDefault ? { default: codeDefault } : {},
+		visibility,
+		...help !== void 0 ? { help } : {},
+		...ui?.order !== void 0 ? { order: ui.order } : {},
+		...ui?.locked === true ? { locked: true } : {}
+	};
+}
+function getCodeSeedGroup(field) {
+	return sanitizeFieldUIHints(field._meta?.ui)?.group ?? null;
+}
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function usesTextIdStorage(field) {
+	return field.idType === "text" || field._meta?.idType === "text";
+}
+function assertDefaultValueMatchesFieldType(objectRef, fieldName, field, value) {
+	const label = `Field policy default for "${objectRef}.${fieldName}"`;
+	if (value === null) {
+		if (isRequiredField(field)) throw new Error(`${label} may not be null: the field is required, so a null default is never a usable default`);
+		return;
+	}
+	switch (field.type) {
+		case "text":
+			if (typeof value !== "string") throw new Error(`${label} must be a string (field type "text")`);
+			return;
+		case "integer":
+			if (typeof value !== "number" || !Number.isInteger(value)) throw new Error(`${label} must be an integer (field type "integer")`);
+			return;
+		case "decimal":
+			if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${label} must be a finite number (field type "decimal")`);
+			return;
+		case "boolean":
+			if (typeof value !== "boolean") throw new Error(`${label} must be a boolean (field type "boolean")`);
+			return;
+		case "datetime":
+			if (typeof value !== "string" || Number.isNaN(Date.parse(value))) throw new Error(`${label} must be a date-parseable string (field type "datetime")`);
+			return;
+		case "json": return;
+		case "foreignKey":
+		case "crossPackageRef":
+			if (typeof value !== "string") throw new Error(`${label} must be a string id (field type "${field.type}")`);
+			if (!usesTextIdStorage(field) && !UUID_PATTERN.test(value)) throw new Error(`${label} must be a UUID string (the reference column stores native UUIDs; declare idType 'text' on the field to store arbitrary ids)`);
+			return;
+		default: throw new Error(`${label} is not supported: defaults cannot target "${String(field.type)}" fields`);
+	}
+}
+//#endregion
+//#region src/models/FieldPolicy.ts
+var __defProp$1 = Object.defineProperty;
+var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __decorateClass$1 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$1(target, key, result);
+	return result;
+};
+var FieldPolicy = class extends SmrtObject {
+	objectRef = "";
+	fieldName = "";
+	scopeType = "app";
+	tenantId = null;
+	userId = null;
+	scopeKey = "";
+	defaultValue = null;
+	visibility = null;
+	help = null;
+	label = null;
+	displayOrder = null;
+	locked = null;
+	updatedBy = null;
+	constructor(options = {}) {
+		super(options);
+		if (options.objectRef !== void 0) this.objectRef = options.objectRef;
+		if (options.fieldName !== void 0) this.fieldName = options.fieldName;
+		if (options.scopeType !== void 0) this.scopeType = options.scopeType;
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.userId !== void 0) this.userId = options.userId;
+		if (options.defaultValue !== void 0 && options.defaultValueRaw !== void 0) throw new Error("FieldPolicy accepts either defaultValue (already JSON-encoded) or defaultValueRaw (a plain value to serialize), not both");
+		if (options.defaultValueRaw !== void 0) this.setDefaultValue(options.defaultValueRaw);
+		else if (options.defaultValue !== void 0) this.defaultValue = options.defaultValue;
+		if (options.visibility !== void 0) this.visibility = options.visibility;
+		if (options.help !== void 0) this.help = options.help;
+		if (options.label !== void 0) this.label = options.label;
+		if (options.displayOrder !== void 0) this.displayOrder = options.displayOrder;
+		if (options.locked !== void 0) this.locked = options.locked;
+		if (options.updatedBy !== void 0) this.updatedBy = options.updatedBy;
+	}
+	/** Parse the stored JSON default. `undefined` = no stored default (inherit). */
+	getDefaultValue() {
+		if (this.defaultValue === null || this.defaultValue === void 0) return;
+		try {
+			return JSON.parse(this.defaultValue);
+		} catch {
+			return;
+		}
+	}
+	/** Serialize a default value; `undefined` clears the override (inherit). */
+	setDefaultValue(value) {
+		this.defaultValue = value === void 0 ? null : JSON.stringify(value);
+	}
+	async save() {
+		this.attributeScopeToAmbientContext();
+		const previousIdentity = await this.getPersistedIdentity();
+		if (previousIdentity) this.assertScopeOwnedByAmbientContext(previousIdentity, "save");
+		const ambientContext = getCurrentTenant();
+		if (ambientContext) this.updatedBy = ambientContext.userId ?? null;
+		this.normalizeDefaultValueForPersistence();
+		await this.validateFieldPolicy();
+		this.scopeKey = this.computeScopeKey();
+		const identityChanged = previousIdentity && (previousIdentity.objectRef !== this.objectRef || previousIdentity.fieldName !== this.fieldName || previousIdentity.scopeType !== this.scopeType || previousIdentity.scopeKey !== this.scopeKey);
+		const result = identityChanged && previousIdentity ? await this.saveAfterIdentityChange() : await super.save();
+		if (identityChanged && previousIdentity) invalidateFieldPolicyCache(previousIdentity.objectRef, this.db);
+		invalidateFieldPolicyCache(this.objectRef, this.db);
+		return result;
+	}
+	async saveAfterIdentityChange() {
+		if (typeof this.db.beginTransaction === "function") return this.saveAfterIdentityChangeInTransaction();
+		return this.saveAfterIdentityChangeWithDeferredDelete();
+	}
+	async saveAfterIdentityChangeInTransaction() {
+		const originalDb = this._db;
+		const originalOptionsDb = this.options.db;
+		const tx = await this.db.beginTransaction?.();
+		if (!tx) return this.saveAfterIdentityChangeWithDeferredDelete();
+		try {
+			this._db = tx;
+			this.options.db = tx;
+			await super.delete();
+			const result = await super.save();
+			await tx.commit();
+			return result;
+		} catch (error) {
+			try {
+				await tx.rollback();
+			} catch {}
+			throw error;
+		} finally {
+			this._db = originalDb;
+			this.options.db = originalOptionsDb;
+		}
+	}
+	async saveAfterIdentityChangeWithDeferredDelete() {
+		const previousId = this.id;
+		if (!previousId) return super.save();
+		const replacementId = crypto.randomUUID();
+		let replacementSaved = false;
+		this.id = replacementId;
+		try {
+			const result = await super.save();
+			replacementSaved = true;
+			await this.db.delete(this.tableName, { id: previousId });
+			return result;
+		} catch (error) {
+			if (replacementSaved) try {
+				await this.db.delete(this.tableName, { id: replacementId });
+			} catch {}
+			this.id = previousId;
+			throw error;
+		}
+	}
+	async delete() {
+		const persisted = await this.getPersistedIdentity();
+		if (persisted) this.assertScopeOwnedByAmbientContext(persisted, "delete");
+		const objectRef = persisted?.objectRef ?? this.objectRef;
+		await super.delete();
+		invalidateFieldPolicyCache(objectRef, this.db);
+		if (this.objectRef && this.objectRef !== objectRef) invalidateFieldPolicyCache(this.objectRef, this.db);
+	}
+	async validateFieldPolicy() {
+		if (!this.objectRef || this.objectRef.trim() === "") throw new Error("FieldPolicy.objectRef is required");
+		if (!this.fieldName || this.fieldName.trim() === "") throw new Error("FieldPolicy.fieldName is required");
+		if (!FIELD_POLICY_SCOPE_TYPES.includes(this.scopeType)) throw new Error(`FieldPolicy.scopeType must be one of ${FIELD_POLICY_SCOPE_TYPES.join(", ")}; got "${this.scopeType}"`);
+		if (this.visibility !== null && !FIELD_POLICY_VISIBILITIES.includes(this.visibility)) throw new Error(`FieldPolicy.visibility must be null or one of ${FIELD_POLICY_VISIBILITIES.join(", ")}; got "${this.visibility}"`);
+		if (this.displayOrder !== null && (typeof this.displayOrder !== "number" || !Number.isInteger(this.displayOrder))) throw new Error("FieldPolicy.displayOrder must be null or an integer");
+		this.validateScopeConsistency();
+		this.validateTenantContextBoundary();
+		const fieldDef = (await getObjectFieldMap(this.objectRef)).get(this.fieldName);
+		if (!fieldDef) throw new Error(`Unknown field "${this.fieldName}" on "${this.objectRef}"`);
+		if (fieldDef._meta?.__smrtSystemField === true) throw new Error(`Field "${this.fieldName}" on "${this.objectRef}" is a framework system field and is not policy-addressable`);
+		if (fieldDef.type === "oneToMany" || fieldDef.type === "manyToMany") throw new Error(`Field "${this.fieldName}" on "${this.objectRef}" is a relationship pseudo-field and is not policy-addressable`);
+		if (fieldDef.type === "meta") throw new Error(`Field "${this.fieldName}" on "${this.objectRef}" is STI meta storage and is not policy-addressable`);
+		if (this.locked !== null && this.scopeType === "user") throw new Error("FieldPolicy.locked may only be set on org rows (app or tenant scope)");
+		if (this.defaultValue !== null) {
+			this.validateDefaultAgainstSecurityRail(fieldDef);
+			const parsed = this.parseDefaultValueOrThrow();
+			assertDefaultValueMatchesFieldType(this.objectRef, this.fieldName, fieldDef, parsed);
+		}
+		const demotesRequiredField = (this.visibility === "advanced" || this.visibility === "hidden") && isRequiredField(fieldDef);
+		const ownDefault = demotesRequiredField && this.defaultValue !== null ? { value: this.parseDefaultValueOrThrow() } : void 0;
+		const needsOrgDefault = demotesRequiredField && !isUsableRequiredDefault(ownDefault);
+		const needsLockCheck = this.scopeType === "user";
+		if (needsOrgDefault || needsLockCheck) {
+			const orgPolicy = await this.resolveOrgTierFieldPolicy();
+			if (needsOrgDefault) {
+				if (!isUsableRequiredDefault(orgPolicy?.hasDefault ? { value: orgPolicy.defaultValue } : void 0)) throw new Error(`Cannot set visibility "${this.visibility}" for required field "${this.objectRef}.${this.fieldName}": no resolved default exists at or below this layer`);
+			}
+			if (needsLockCheck && orgPolicy?.locked) throw new Error(`Field "${this.objectRef}.${this.fieldName}" is locked by org policy; user-scope overrides are not allowed`);
+		}
+	}
+	/**
+	* Effective org-tier (code → app → tenant hierarchy) policy for this row's
+	* field, computed by the RESOLVER so write-time checks share the one
+	* precedence implementation — including ancestor-tenant cascades via the
+	* default hierarchy loader. The chain tenant is the row's own tenant for
+	* tenant-scope rows, the ambient context tenant for user-scope rows, and
+	* none for app-scope rows (their only lower layer is the code seed).
+	*
+	* On updates the resolver sees this row's PERSISTED version (there is no
+	* self-exclusion), so a save that removes the only default while demoting
+	* can pass here; the resolver-side safety net stays authoritative at read
+	* time.
+	*/
+	async resolveOrgTierFieldPolicy() {
+		const tenantIdForChain = this.scopeType === "tenant" ? this.tenantId : this.scopeType === "user" ? getCurrentTenant()?.tenantId ?? null : null;
+		const { resolveFieldPolicy } = await Promise.resolve().then(() => field_policy_resolver_exports);
+		return (await resolveFieldPolicy(this.objectRef, {
+			tenantId: tenantIdForChain,
+			db: this.options.db ?? this.options.persistence
+		})).fields[this.fieldName];
+	}
+	/**
+	* Exactly-one-owner scope shape: app rows carry neither id, tenant rows
+	* carry only `tenantId`, user rows carry only `userId` (the user tier is
+	* keyed by user alone so preferences follow the user across tenants).
+	*/
+	validateScopeConsistency() {
+		if (this.scopeType === "app") {
+			if (this.tenantId !== null || this.userId !== null) throw new Error("App-scope field policy rows must have tenantId and userId null");
+			return;
+		}
+		if (this.scopeType === "tenant") {
+			if (!this.tenantId || this.userId !== null) throw new Error("Tenant-scope field policy rows must set tenantId and leave userId null");
+			return;
+		}
+		if (!this.userId || this.tenantId !== null) throw new Error("User-scope field policy rows must set userId and leave tenantId null");
+	}
+	/** `userId ?? tenantId ?? '__app__'` — the `conflictColumns` scope key. */
+	computeScopeKey() {
+		return this.userId ?? this.tenantId ?? "__app__";
+	}
+	/**
+	* Derive a scope-owner column the transport could not carry (#2047).
+	*
+	* Core's mass-assignment guard treats `tenantId` as server-managed and
+	* strips it from EVERY generated create/update body, and `FieldPolicy` is
+	* deliberately not `@TenantScoped`, so the tenancy interceptor never
+	* repopulates it. A `POST {scopeType:'tenant', tenantId}` therefore always
+	* reached `validateScopeConsistency` with `tenantId === null`, making the
+	* org tier write-dead over every generated surface — the model, as the
+	* single validation authority for these rows, fills it in instead.
+	*
+	* This grants nothing: `assertScopeOwnedByAmbientContext` already requires
+	* a non-bypass caller's tenant/user rows to name exactly the ambient
+	* tenant/user, so the derived value is the ONLY value that could ever have
+	* been accepted. An explicit value is never overwritten (a super-admin
+	* bypass caller keeps naming other scopes), and with no ambient context
+	* nothing is derived — scope-shape validation rejects the row as before.
+	* Consequence: a bypass caller writing ANOTHER tenant's row must pass
+	* `tenantId` through a server-side model call, because the generated routes
+	* still strip it.
+	*/
+	attributeScopeToAmbientContext() {
+		const context = getCurrentTenant();
+		if (!context) return;
+		if (this.scopeType === "tenant" && this.tenantId === null) this.tenantId = context.tenantId;
+		if (this.scopeType === "user" && this.userId === null) this.userId = context.userId ?? null;
+	}
+	/**
+	* Fail-closed write boundary against the ambient tenant context, applied to
+	* the NEW scope on save and to the PERSISTED scope on save/delete of an
+	* existing row.
+	*
+	* With NO ambient identity at all (no tenant context entered — e.g. a
+	* runtime API deployment whose auth middleware never enters the tenancy
+	* ALS), only app-scope rows are accepted: tenant- and user-scope rows are
+	* unattributable without a context, so they are rejected outright rather
+	* than allowed by default. Inside a non-bypass context, a caller may only
+	* touch rows for its own tenant, and user rows only for its own user id —
+	* a context that carries NO user id may not touch the user tier at all.
+	* App-wide rows then require super-admin bypass (or a context-less/system
+	* caller).
+	*
+	* Package rule: a missing identity component DENIES, it never skips.
+	*/
+	assertScopeOwnedByAmbientContext(scope, operation) {
+		const context = getCurrentTenant();
+		if (!context) {
+			if (scope.scopeType === "tenant" || scope.scopeType === "user") throw new TenantIsolationError(`${scope.scopeType === "tenant" ? "Tenant" : "User"}-scope field policy ${operation}s require an ambient tenant context (or super-admin bypass); without one the caller identity is unattributable`);
+			return;
+		}
+		if (isSuperAdminBypass()) return;
+		if (scope.scopeType === "app") throw new TenantIsolationError(`App-scope field policy ${operation}s are not allowed inside a tenant context (use a system context or super-admin bypass)`, { tenantId: context.tenantId });
+		if (scope.scopeType === "tenant" && scope.tenantId !== context.tenantId) throw new TenantIsolationError(`Tenant isolation violation in FieldPolicy.${operation}: context tenant is '${context.tenantId}' but the row belongs to '${scope.tenantId}'`, {
+			tenantId: context.tenantId,
+			attemptedTenantId: scope.tenantId ?? void 0
+		});
+		if (scope.scopeType === "user") {
+			if (context.userId === void 0) throw new TenantIsolationError(`User-scope field policy ${operation}s require an ambient context that carries a user id; this context cannot attribute a user-scope write`, { tenantId: context.tenantId });
+			if (scope.userId !== context.userId) throw new TenantIsolationError(`Tenant isolation violation in FieldPolicy.${operation}: context user is '${context.userId}' but the row belongs to '${scope.userId}'`, { tenantId: context.tenantId });
+		}
+	}
+	validateTenantContextBoundary() {
+		this.assertScopeOwnedByAmbientContext({
+			scopeType: this.scopeType,
+			tenantId: this.tenantId,
+			userId: this.userId
+		}, "save");
+	}
+	validateDefaultAgainstSecurityRail(fieldDef) {
+		if (isTransientField(fieldDef)) throw new Error(`Cannot store a default for transient field "${this.objectRef}.${this.fieldName}"`);
+		if (isSensitiveField(fieldDef)) throw new Error(`Cannot store a default for sensitive field "${this.objectRef}.${this.fieldName}"`);
+		const readPermission = getFieldReadPermission(fieldDef);
+		if (readPermission) throw new Error(`Cannot store a default for read-permission-gated field "${this.objectRef}.${this.fieldName}" (requires "${readPermission}")`);
+	}
+	parseDefaultValueOrThrow() {
+		try {
+			return JSON.parse(this.defaultValue);
+		} catch (error) {
+			throw new Error(`FieldPolicy default for "${this.objectRef}.${this.fieldName}" is not valid JSON: ${error instanceof Error ? error.message : String(error)}. The "defaultValue" option is the already-encoded channel; pass a plain value as "defaultValueRaw" (or call setDefaultValue()).`);
+		}
+	}
+	/**
+	* The persisted row this save/delete would replace, looked up by primary
+	* key and — when that misses — by the NATURAL key.
+	*
+	* The natural-key fallback is load-bearing for authorization: every
+	* generated create arrives with a freshly minted UUID, so a primary-key
+	* lookup always misses, yet the `conflictColumns` upsert still overwrites
+	* whatever row already occupies `(objectRef, fieldName, scopeType,
+	* scopeKey)`. Authorizing on the primary key alone therefore skipped the
+	* persisted-scope guard on exactly the path that can replace an existing
+	* row's contents.
+	*/
+	async getPersistedIdentity() {
+		const existing = await this.getPersistedRowById() ?? await this.getPersistedRowByNaturalKey();
+		if (!existing) return null;
+		const row = existing;
+		const read = (camel, snake, fallback) => {
+			if (row[camel] !== void 0 && row[camel] !== null) return String(row[camel]);
+			if (row[snake] !== void 0 && row[snake] !== null) return String(row[snake]);
+			return fallback;
+		};
+		const readNullable = (camel, snake) => {
+			const value = row[camel] !== void 0 ? row[camel] : row[snake];
+			return value === void 0 || value === null ? null : String(value);
+		};
+		return {
+			objectRef: read("objectRef", "object_ref", this.objectRef),
+			fieldName: read("fieldName", "field_name", this.fieldName),
+			scopeType: read("scopeType", "scope_type", this.scopeType),
+			scopeKey: read("scopeKey", "scope_key", this.scopeKey),
+			tenantId: readNullable("tenantId", "tenant_id"),
+			userId: readNullable("userId", "user_id")
+		};
+	}
+	async getPersistedRowById() {
+		if (!this.id) return null;
+		return await this.db.get(this.tableName, { id: this.id }) ?? null;
+	}
+	/**
+	* The row occupying this row's `conflictColumns` tuple, if any. Column
+	* names are the physical snake_case ones: this reads the driver directly
+	* rather than through a collection (the model has no collection handle).
+	*/
+	async getPersistedRowByNaturalKey() {
+		if (!this.objectRef || !this.fieldName) return null;
+		return await this.db.get(this.tableName, {
+			object_ref: this.objectRef,
+			field_name: this.fieldName,
+			scope_type: this.scopeType,
+			scope_key: this.computeScopeKey()
+		}) ?? null;
+	}
+	normalizeDefaultValueForPersistence() {
+		const raw = this.defaultValue;
+		if (raw === null || raw === void 0) {
+			this.defaultValue = null;
+			return;
+		}
+		if (typeof raw === "string") {
+			this.defaultValue = raw;
+			return;
+		}
+		this.defaultValue = JSON.stringify(raw);
+	}
+};
+__decorateClass$1([field({ required: true })], FieldPolicy.prototype, "objectRef", 2);
+__decorateClass$1([field({ required: true })], FieldPolicy.prototype, "fieldName", 2);
+__decorateClass$1([field({ required: true })], FieldPolicy.prototype, "scopeType", 2);
+__decorateClass$1([tenantId({ nullable: true })], FieldPolicy.prototype, "tenantId", 2);
+__decorateClass$1([crossPackageRef("@happyvertical/smrt-users:User", { nullable: true })], FieldPolicy.prototype, "userId", 2);
+__decorateClass$1([field({
+	type: "text",
+	required: true
+})], FieldPolicy.prototype, "scopeKey", 2);
+__decorateClass$1([field({
+	type: "text",
+	nullable: true
+})], FieldPolicy.prototype, "defaultValue", 2);
+__decorateClass$1([field({
+	type: "text",
+	nullable: true
+})], FieldPolicy.prototype, "visibility", 2);
+__decorateClass$1([field({
+	type: "text",
+	nullable: true
+})], FieldPolicy.prototype, "help", 2);
+__decorateClass$1([field({
+	type: "text",
+	nullable: true
+})], FieldPolicy.prototype, "label", 2);
+__decorateClass$1([field({
+	type: "integer",
+	nullable: true
+})], FieldPolicy.prototype, "displayOrder", 2);
+__decorateClass$1([field({
+	type: "boolean",
+	nullable: true
+})], FieldPolicy.prototype, "locked", 2);
+__decorateClass$1([crossPackageRef("@happyvertical/smrt-users:User", { nullable: true })], FieldPolicy.prototype, "updatedBy", 2);
+FieldPolicy = __decorateClass$1([smrt({
+	tableName: "_smrt_field_policies",
+	conflictColumns: [
+		"object_ref",
+		"field_name",
+		"scope_type",
+		"scope_key"
+	],
+	api: { include: [
+		"create",
+		"update",
+		"delete"
+	] },
+	cli: {
+		include: [
+			"create",
+			"update",
+			"delete"
+		],
+		exclude: ["getDefaultValue", "setDefaultValue"]
+	},
+	mcp: { include: [] }
+})], FieldPolicy);
+//#endregion
+//#region src/collections/FieldPolicyCollection.ts
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp(target, key, result);
+	return result;
+};
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var MAX_BATCH_OBJECT_REFS = 100;
+var FieldPolicyCollection = class extends SmrtCollection {
+	/** All app-scope rows for an object, keyed by field name. */
+	async getAppRows(objectRef) {
+		const rows = await this.list({ where: {
+			objectRef,
+			scopeType: "app"
+		} });
+		const byField = /* @__PURE__ */ new Map();
+		for (const row of rows) byField.set(row.fieldName, row);
+		return byField;
+	}
+	/**
+	* All tenant-scope rows for an object across a tenant chain, keyed
+	* `tenantId → fieldName → row`.
+	*/
+	async getTenantRows(objectRef, tenantIds) {
+		const byTenant = /* @__PURE__ */ new Map();
+		if (tenantIds.length === 0) return byTenant;
+		const rows = await this.list({ where: {
+			objectRef,
+			scopeType: "tenant",
+			"tenantId in": tenantIds
+		} });
+		for (const row of rows) {
+			if (!row.tenantId) continue;
+			let byField = byTenant.get(row.tenantId);
+			if (!byField) {
+				byField = /* @__PURE__ */ new Map();
+				byTenant.set(row.tenantId, byField);
+			}
+			byField.set(row.fieldName, row);
+		}
+		return byTenant;
+	}
+	/** All user-scope rows for an object and user, keyed by field name. */
+	async getUserRows(objectRef, userId) {
+		const rows = await this.list({ where: {
+			objectRef,
+			scopeType: "user",
+			userId
+		} });
+		const byField = /* @__PURE__ */ new Map();
+		for (const row of rows) byField.set(row.fieldName, row);
+		return byField;
+	}
+	/**
+	* Resolve merged field policy for a set of objectRefs for the CURRENT
+	* caller, gated for public consumption.
+	*
+	* Caller identity comes exclusively from the ambient tenant context
+	* (established by the app's auth hook, e.g. smrt-users' session context) —
+	* the request body cannot select another tenant or user (fail closed).
+	* Server-side consumers wanting explicit identities call
+	* `resolveFieldPolicy()` directly instead.
+	*
+	* Field gating mirrors the REST serializer's derivation (`sensitive` /
+	* `readPermission` read from both the top level and `_meta`): sensitive and
+	* read-permission-gated fields are ABSENT from the response for every
+	* caller (the generated action route cannot convey per-caller grants to
+	* this method, so gated fields fail closed), and transient fields are
+	* stripped for parity with generated client field definitions.
+	*/
+	async resolveBatch(options = {}) {
+		const rawRefs = options.objectRefs;
+		if (!Array.isArray(rawRefs) || rawRefs.length === 0) throw new Error("resolveBatch requires a non-empty \"objectRefs\" string array");
+		if (rawRefs.some((ref) => typeof ref !== "string" || ref.trim() === "")) throw new Error("resolveBatch objectRefs must be non-empty strings");
+		const objectRefs = [...new Set(rawRefs)];
+		if (objectRefs.length > MAX_BATCH_OBJECT_REFS) throw new Error(`resolveBatch accepts at most ${MAX_BATCH_OBJECT_REFS} objectRefs per call (got ${objectRefs.length})`);
+		const context = getCurrentTenant();
+		const tenantId = context?.tenantId ?? null;
+		const userId = context?.userId ?? null;
+		const { resolveFieldPolicy } = await Promise.resolve().then(() => field_policy_resolver_exports);
+		const policies = {};
+		for (const objectRef of objectRefs) {
+			const resolved = await resolveFieldPolicy(objectRef, {
+				tenantId,
+				userId,
+				db: this.db
+			});
+			policies[objectRef] = await this.gateResolvedForPublicResponse(resolved);
+		}
+		return { policies };
+	}
+	async gateResolvedForPublicResponse(resolved) {
+		const fieldMap = await getObjectFieldMap(resolved.objectRef);
+		const fields = {};
+		for (const [fieldName, policy] of Object.entries(resolved.fields)) {
+			const fieldDef = fieldMap.get(fieldName);
+			if (!fieldDef) continue;
+			if (isSensitiveField(fieldDef) || getFieldReadPermission(fieldDef) !== void 0 || isTransientField(fieldDef)) continue;
+			fields[fieldName] = policy;
+		}
+		return {
+			objectRef: resolved.objectRef,
+			fields
+		};
+	}
+};
+__publicField(FieldPolicyCollection, "_itemClass", FieldPolicy);
+FieldPolicyCollection = __decorateClass([smrt({
+	conflictColumns: [
+		"object_ref",
+		"field_name",
+		"scope_type",
+		"scope_key"
+	],
+	api: {
+		include: [
+			"create",
+			"update",
+			"delete",
+			"resolveBatch"
+		],
+		routes: { resolveBatch: {
+			scope: "collection",
+			method: "POST",
+			path: "resolve"
+		} }
+	},
+	cli: false,
+	mcp: false
+})], FieldPolicyCollection);
+//#endregion
+//#region src/field-policy-resolver.ts
+var field_policy_resolver_exports = /* @__PURE__ */ __exportAll({
+	isMissingUsersDependency: () => isMissingUsersDependency,
+	resolveFieldPolicy: () => resolveFieldPolicy,
+	resolveFieldPolicyExplained: () => resolveFieldPolicyExplained
+});
+async function resolveFieldPolicy(objectRef, options = {}) {
+	const explained = await resolveFieldPolicyExplained(objectRef, options);
+	return {
+		objectRef: explained.objectRef,
+		fields: explained.fields
+	};
+}
+async function resolveFieldPolicyExplained(objectRef, options = {}) {
+	const tenantId = options.tenantId ?? null;
+	const userId = options.userId ?? null;
+	assertResolutionAllowedInContext(tenantId, userId);
+	let collection = null;
+	let cacheDb = options.db;
+	if (options.db) {
+		collection = await FieldPolicyCollection.create({ db: options.db });
+		cacheDb = collection.db;
+	}
+	const fieldMap = await getObjectFieldMap(objectRef);
+	const cached = getCachedFieldPolicy(objectRef, tenantId, userId, cacheDb, options.tenantHierarchyLoader);
+	if (cached) return cached;
+	const policyFields = selectPolicyAddressableFields(fieldMap);
+	const codeVisibility = buildCodeSeedVisibility(fieldMap);
+	const appRows = collection ? await collection.getAppRows(objectRef) : /* @__PURE__ */ new Map();
+	let survivingChain = [];
+	let tenantRows = /* @__PURE__ */ new Map();
+	if (collection && tenantId) {
+		survivingChain = selectSurvivingChainSuffix(await resolveTenantChain(tenantId, options));
+		tenantRows = await collection.getTenantRows(objectRef, survivingChain.map((node) => node.id));
+	}
+	const userRows = collection && userId ? await collection.getUserRows(objectRef, userId) : /* @__PURE__ */ new Map();
+	const fields = {};
+	const layers = {};
+	for (const [fieldName, fieldDef] of policyFields) {
+		const contributions = [];
+		const codeDelta = buildCodeSeedDelta(fieldDef, codeVisibility.get(fieldName) ?? "basic");
+		contributions.push({
+			layer: "code",
+			delta: codeDelta
+		});
+		let state = applyDelta({ visibility: "basic" }, codeDelta);
+		const appRow = appRows.get(fieldName);
+		if (appRow) {
+			const delta = rowToDelta(appRow);
+			contributions.push({
+				layer: "app",
+				delta
+			});
+			state = applyDelta(state, delta);
+		}
+		for (const node of survivingChain) {
+			const row = tenantRows.get(node.id)?.get(fieldName);
+			if (row) {
+				const delta = rowToDelta(row);
+				contributions.push({
+					layer: "tenant",
+					tenantId: node.id,
+					delta
+				});
+				state = applyDelta(state, delta);
+			}
+		}
+		const orgLocked = state.locked === true;
+		const userRow = userId ? userRows.get(fieldName) : void 0;
+		if (userRow && !orgLocked) {
+			const delta = rowToDelta(userRow);
+			contributions.push({
+				layer: "user",
+				userId,
+				delta
+			});
+			state = applyDelta(state, delta);
+		}
+		const required = isRequiredField(fieldDef);
+		let visibilityForced = false;
+		if (required && !isUsableRequiredDefault(state.default) && state.visibility !== "basic") {
+			state = {
+				...state,
+				visibility: "basic"
+			};
+			visibilityForced = true;
+		}
+		fields[fieldName] = {
+			fieldName,
+			hasDefault: state.default !== void 0,
+			defaultValue: state.default?.value,
+			visibility: state.visibility,
+			help: state.help ?? null,
+			label: state.label ?? null,
+			order: state.order ?? null,
+			group: getCodeSeedGroup(fieldDef),
+			locked: state.locked === true,
+			required,
+			...visibilityForced ? { visibilityForced: true } : {}
+		};
+		layers[fieldName] = contributions;
+	}
+	const explained = {
+		objectRef,
+		fields,
+		layers
+	};
+	setCachedFieldPolicy(objectRef, tenantId, userId, cacheDb, explained, options.tenantHierarchyLoader);
+	return explained;
+}
+function assertResolutionAllowedInContext(tenantId, userId) {
+	if (tenantId) assertTenantReadAllowed(tenantId, "resolveFieldPolicy");
+	if (!userId) return;
+	const context = getCurrentTenant();
+	if (!context || isSuperAdminBypass()) return;
+	if (context.userId === void 0) throw new TenantIsolationError(`Tenant isolation violation in resolveFieldPolicy: the ambient context carries no user id, so user-scope resolution for '${userId}' is not attributable`, { tenantId: context.tenantId });
+	if (context.userId !== userId) throw new TenantIsolationError(`Tenant isolation violation in resolveFieldPolicy: context user is '${context.userId}' but resolution requested '${userId}'`, { tenantId: context.tenantId });
+}
+function selectPolicyAddressableFields(fieldMap) {
+	const selected = /* @__PURE__ */ new Map();
+	for (const [name, field] of fieldMap) {
+		if (field._meta?.__smrtSystemField === true) continue;
+		if (field.type === "oneToMany" || field.type === "manyToMany" || field.type === "meta") continue;
+		selected.set(name, field);
+	}
+	return selected;
+}
+function rowToDelta(row) {
+	const delta = {};
+	if (row.defaultValue !== null && row.defaultValue !== void 0) try {
+		delta.default = { value: JSON.parse(row.defaultValue) };
+	} catch {}
+	if (row.visibility !== null && row.visibility !== void 0) delta.visibility = row.visibility;
+	if (row.help !== null && row.help !== void 0) delta.help = row.help;
+	if (row.label !== null && row.label !== void 0) delta.label = row.label;
+	if (row.displayOrder !== null && row.displayOrder !== void 0) delta.order = row.displayOrder;
+	if (row.locked !== null && row.locked !== void 0) delta.locked = row.locked;
+	return delta;
+}
+function applyDelta(state, delta) {
+	return {
+		default: delta.default ?? state.default,
+		visibility: delta.visibility ?? state.visibility,
+		help: delta.help ?? state.help,
+		label: delta.label ?? state.label,
+		order: delta.order ?? state.order,
+		locked: delta.locked ?? state.locked
+	};
+}
+function selectSurvivingChainSuffix(chain) {
+	let survivingStart = 0;
+	for (let index = 1; index < chain.length; index++) if (!(chain[index - 1].cascadePermissions && chain[index].inheritPermissions)) survivingStart = index;
+	return chain.slice(survivingStart);
+}
+async function resolveTenantChain(tenantId, options) {
+	const provider = await (options.tenantHierarchyLoader || defaultTenantHierarchyLoader)({ db: options.db });
+	if (provider) {
+		const chain = await provider.getChain(tenantId);
+		if (chain.length > 0) return chain;
+	}
+	return [{
+		id: tenantId,
+		inheritPermissions: true,
+		cascadePermissions: true
+	}];
+}
+async function defaultTenantHierarchyLoader(options) {
+	try {
+		const tenantCollection = await (await importWorkspaceModule({
+			packageName: "@happyvertical/smrt-users",
+			sourceEntry: "packages/users/src/collections/index.ts",
+			purpose: "tenant-aware field policy resolution"
+		})).TenantCollection.create(options);
+		return { async getChain(tenantId) {
+			const tenant = await tenantCollection.get({ id: tenantId });
+			if (!tenant) return [];
+			return [...await tenantCollection.getAncestorsFromRoot(tenantId), tenant].map((node) => ({
+				id: String(node.id),
+				inheritPermissions: Boolean(node.inheritPermissions),
+				cascadePermissions: Boolean(node.cascadePermissions)
+			}));
+		} };
+	} catch (error) {
+		if (isMissingUsersDependency(error)) return null;
+		throw error;
+	}
+}
+var MISSING_MODULE_TARGET_PATTERN = /Cannot find (?:package|module) '([^']+)'/;
+function isUsersSpecifier(target) {
+	return target === "@happyvertical/smrt-users" || target.startsWith("@happyvertical/smrt-users/");
+}
+function isMissingUsersDependency(error) {
+	let current = error;
+	const seen = /* @__PURE__ */ new Set();
+	while (current instanceof Error && !seen.has(current)) {
+		seen.add(current);
+		const match = current.message.match(MISSING_MODULE_TARGET_PATTERN);
+		if (match && isUsersSpecifier(match[1])) return true;
+		if (current.message.includes("Failed to load @happyvertical/smrt-users for")) return true;
+		current = current.cause;
+	}
+	return false;
+}
+//#endregion
+export { APP_FIELD_POLICY_SCOPE_KEY, FIELD_POLICY_SCOPE_TYPES, FIELD_POLICY_VISIBILITIES, FieldPolicy, FieldPolicyCollection, assertDefaultValueMatchesFieldType, buildCodeSeedDelta, buildCodeSeedVisibility, clearFieldPolicyCache, getCodeDefault, getCodeSeedGroup, getFieldPolicyCacheTtlMs, getFieldReadPermission, getObjectFieldMap, invalidateFieldPolicyCache, isRequiredField, isSensitiveField, isTransientField, isUsableRequiredDefault, requireRegisteredObject, resolveFieldPolicy, resolveFieldPolicyExplained, sanitizeFieldUIHints };
+
+//# sourceMappingURL=index.js.map