@happyvertical/smrt-fields 0.40.60 → 0.40.62

package/dist/types.d.ts

@@ -1,203 +1,316 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { SmrtObjectOptions } from '@happyvertical/smrt-core';
-
-/**
- * `scopeKey` value for app-scope rows. `scopeKey` exists ONLY so the
- * `conflictColumns` unique index stays total while `tenantId`/`userId` are
- * nullable (nullable columns would allow duplicate NULL rows) — the same
- * trick as `PromptOverride.context`.
- */
-export declare const APP_FIELD_POLICY_SCOPE_KEY = "__app__";
-
-/**
- * Explain variant: merged result plus the ordered per-layer contributions for
- * each field, so admin/gear UIs (#2049/#2050) never re-derive precedence.
- * Layers are listed in application order (code, app, tenant chain root → leaf,
- * user) and contain ONLY contributions that survive into the merged result:
- * tenant ancestors discarded by a permission-inheritance break and user rows
- * suppressed by an effective org lock are omitted, so sequentially replaying
- * the listed deltas reproduces the merged policy.
- */
-export declare interface ExplainedObjectFieldPolicy extends ResolvedObjectFieldPolicy {
-    layers: Record<string, FieldPolicyLayerContribution[]>;
-}
-
-export declare const FIELD_POLICY_SCOPE_TYPES: readonly FieldPolicyScopeType[];
-
-export declare const FIELD_POLICY_VISIBILITIES: readonly FieldPolicyVisibility[];
-
-/** Result shape of the batch resolve action (`FieldPolicyCollection.resolveBatch`). */
-export declare interface FieldPolicyBatchResult {
-    policies: Record<string, ResolvedObjectFieldPolicy>;
-}
-
-/**
- * The sparse contribution of one layer (code seed or one stored row).
- *
- * `default` is boxed so an explicit JSON `null` default (meaning "default to
- * null") stays distinguishable from "this layer contributes no default".
- */
-export declare interface FieldPolicyDelta {
-    default?: {
-        value: unknown;
-    };
-    visibility?: FieldPolicyVisibility;
-    help?: string;
-    label?: string;
-    order?: number;
-    locked?: boolean;
-}
-
-/** One layer's contribution to a field's resolved policy (explain variant). */
-export declare interface FieldPolicyLayerContribution {
-    layer: 'code' | 'app' | 'tenant' | 'user';
-    /** Chain node id for `tenant` layers (root → leaf order). */
-    tenantId?: string;
-    /** User id for the `user` layer. */
-    userId?: string;
-    delta: FieldPolicyDelta;
-}
-
-export declare interface FieldPolicyOptions extends SmrtObjectOptions {
-    objectRef?: string;
-    fieldName?: string;
-    scopeType?: FieldPolicyScopeType;
-    tenantId?: string | null;
-    userId?: string | null;
-    /**
-     * ENCODED channel: an already-JSON-encoded default, exactly as the column
-     * stores it (`'"Net 30"'`, `'42'`, `'null'`), or `null` to inherit.
-     *
-     * This is the wire contract: the generated write routes hand the request
-     * body straight to the constructor, and the #2049/#2050 gear posts
-     * `JSON.stringify(draft.defaultValue)`. It must therefore keep meaning
-     * "already encoded" — auto-serializing here would double-encode every gear
-     * write.
-     *
-     * Use {@link FieldPolicyOptions.defaultValueRaw} for a plain value. The two
-     * are mutually exclusive: `'"TBD"'` and `'TBD'` are indistinguishable once
-     * a single option carries both meanings, so the channel must be explicit
-     * rather than sniffed.
-     */
-    defaultValue?: string | null;
-    /**
-     * PLAIN channel: any value, always serialized — strings included. The
-     * constructor-option twin of {@link FieldPolicy.setDefaultValue}, so
-     * `{ defaultValueRaw: 'Net 30' }` stores `'"Net 30"'` rather than the
-     * unparseable literal `Net 30`.
-     */
-    defaultValueRaw?: unknown;
-    visibility?: FieldPolicyVisibility | null;
-    help?: string | null;
-    label?: string | null;
-    displayOrder?: number | null;
-    locked?: boolean | null;
-    updatedBy?: string | null;
-}
-
-/**
- * Scope tier a {@link FieldPolicy} row belongs to.
- *
- * Resolution precedence is code seed → `app` → `tenant` (hierarchy walk,
- * root → leaf) → `user`. Unlike smrt-features (which ships only
- * `global`/`tenant`), the user tier is implemented end to end here — both
- * defaults and visibility resolve through it.
- */
-export declare type FieldPolicyScopeType = 'app' | 'tenant' | 'user';
-
-/**
- * Loader-function DI seam (NOT a container registration): the resolver calls
- * it lazily and treats `null` as "no hierarchy available" (flat-tenant
- * fallback). The default loader dynamic-imports `@happyvertical/smrt-users`
- * and returns `null` when it is not installed.
- */
-export declare type FieldPolicyTenantHierarchyLoader = (options: SmrtClassOptions) => Promise<FieldPolicyTenantHierarchyProvider | null>;
-
-/** Provider returning the root → leaf tenant chain (mirrors smrt-features). */
-export declare interface FieldPolicyTenantHierarchyProvider {
-    getChain(tenantId: string): Promise<FieldPolicyTenantNode[]>;
-}
-
-/** Minimal tenant node consumed by the hierarchy walk (mirrors smrt-features). */
-export declare interface FieldPolicyTenantNode {
-    id: string;
-    inheritPermissions: boolean;
-    cascadePermissions: boolean;
-}
-
-export declare interface FieldPolicyUsersModule {
-    TenantCollection: {
-        create(options: SmrtClassOptions): Promise<{
-            get(criteria: {
-                id: string;
-            }): Promise<FieldPolicyUsersTenantRecord | null>;
-            getAncestorsFromRoot(tenantId: string): Promise<FieldPolicyUsersTenantRecord[]>;
-        }>;
-    };
-}
-
-/**
- * Minimal structural shape of the tenant surface loaded from
- * `@happyvertical/smrt-users` by the default hierarchy loader. Only the
- * permission-cascade fields consumed by the chain walk are modeled.
- */
-export declare interface FieldPolicyUsersTenantRecord {
-    id: string;
-    inheritPermissions?: boolean;
-    cascadePermissions?: boolean;
-}
-
-/**
- * Visibility tier for a field in generated/consuming form UIs.
- *
- * - `basic`: shown before the advanced disclosure
- * - `advanced`: shown behind the advanced disclosure
- * - `hidden`: not rendered (requires the field to be optional or have a
- *   resolved default — the required-field invariant)
- */
-export declare type FieldPolicyVisibility = 'basic' | 'advanced' | 'hidden';
-
-/** Fully merged policy for a single field. */
-export declare interface ResolvedFieldPolicy {
-    fieldName: string;
-    /** True when any layer resolved a default (including an explicit null). */
-    hasDefault: boolean;
-    /** Parsed default value; `undefined` when {@link hasDefault} is false. */
-    defaultValue: unknown;
-    visibility: FieldPolicyVisibility;
-    help: string | null;
-    label: string | null;
-    order: number | null;
-    /** Grouping key — code-seed only (`ui.group`), not overridable by rows. */
-    group: string | null;
-    locked: boolean;
-    /** Mirror of the manifest required flag (nullable fields are optional). */
-    required: boolean;
-    /**
-     * True when the resolver forced `basic` visibility because the field is
-     * required and no usable default resolved (the resolver-side safety net for
-     * the required-field invariant).
-     */
-    visibilityForced?: boolean;
-}
-
-/** Merged policy for every field of one object. */
-export declare interface ResolvedObjectFieldPolicy {
-    objectRef: string;
-    fields: Record<string, ResolvedFieldPolicy>;
-}
-
-export declare interface ResolveFieldPolicyOptions {
-    tenantId?: string | null;
-    userId?: string | null;
-    /**
-     * Database holding `_smrt_field_policies`. Without it, only the code seed
-     * resolves (stored layers are skipped) — the smrt-prompts precedent.
-     */
-    db?: SmrtClassOptions['db'];
-    tenantHierarchyLoader?: FieldPolicyTenantHierarchyLoader;
-}
-
-export { SmrtClassOptions }
-
-export { }
+import { SmrtClassOptions, SmrtObjectOptions } from '@happyvertical/smrt-core';
+/**
+ * Scope tier a {@link FieldPolicy} row belongs to.
+ *
+ * Resolution precedence is code seed → `app` → `tenant` (hierarchy walk,
+ * root → leaf) → `user`. Unlike smrt-features (which ships only
+ * `global`/`tenant`), the user tier is implemented end to end here — both
+ * defaults and visibility resolve through it.
+ */
+export type FieldPolicyScopeType = 'app' | 'tenant' | 'user';
+/**
+ * Visibility tier for a field in generated/consuming form UIs.
+ *
+ * - `basic`: shown before the advanced disclosure
+ * - `advanced`: shown behind the advanced disclosure
+ * - `hidden`: not rendered (requires the field to be optional or have a
+ *   resolved default — the required-field invariant)
+ */
+export type FieldPolicyVisibility = 'basic' | 'advanced' | 'hidden';
+/**
+ * `scopeKey` value for app-scope rows. `scopeKey` exists ONLY so the
+ * `conflictColumns` unique index stays total while `tenantId`/`userId` are
+ * nullable (nullable columns would allow duplicate NULL rows) — the same
+ * trick as `PromptOverride.context`.
+ */
+export declare const APP_FIELD_POLICY_SCOPE_KEY = "__app__";
+export declare const FIELD_POLICY_SCOPE_TYPES: readonly FieldPolicyScopeType[];
+export declare const FIELD_POLICY_VISIBILITIES: readonly FieldPolicyVisibility[];
+export interface FieldPolicyOptions extends SmrtObjectOptions {
+    objectRef?: string;
+    fieldName?: string;
+    scopeType?: FieldPolicyScopeType;
+    tenantId?: string | null;
+    userId?: string | null;
+    /**
+     * ENCODED channel: an already-JSON-encoded default, exactly as the column
+     * stores it (`'"Net 30"'`, `'42'`, `'null'`), or `null` to inherit.
+     *
+     * This is the wire contract: the generated write routes hand the request
+     * body straight to the constructor, and the #2049/#2050 gear posts
+     * `JSON.stringify(draft.defaultValue)`. It must therefore keep meaning
+     * "already encoded" — auto-serializing here would double-encode every gear
+     * write.
+     *
+     * Use {@link FieldPolicyOptions.defaultValueRaw} for a plain value. The two
+     * are mutually exclusive: `'"TBD"'` and `'TBD'` are indistinguishable once
+     * a single option carries both meanings, so the channel must be explicit
+     * rather than sniffed.
+     */
+    defaultValue?: string | null;
+    /**
+     * PLAIN channel: any value, always serialized — strings included. The
+     * constructor-option twin of {@link FieldPolicy.setDefaultValue}, so
+     * `{ defaultValueRaw: 'Net 30' }` stores `'"Net 30"'` rather than the
+     * unparseable literal `Net 30`.
+     */
+    defaultValueRaw?: unknown;
+    visibility?: FieldPolicyVisibility | null;
+    help?: string | null;
+    label?: string | null;
+    displayOrder?: number | null;
+    locked?: boolean | null;
+    updatedBy?: string | null;
+}
+/**
+ * The sparse contribution of one layer (code seed or one stored row).
+ *
+ * `default` is boxed so an explicit JSON `null` default (meaning "default to
+ * null") stays distinguishable from "this layer contributes no default".
+ */
+export interface FieldPolicyDelta {
+    default?: {
+        value: unknown;
+    };
+    visibility?: FieldPolicyVisibility;
+    help?: string;
+    label?: string;
+    order?: number;
+    locked?: boolean;
+}
+/** One layer's contribution to a field's resolved policy (explain variant). */
+export interface FieldPolicyLayerContribution {
+    layer: 'code' | 'app' | 'tenant' | 'user';
+    /** Chain node id for `tenant` layers (root → leaf order). */
+    tenantId?: string;
+    /** User id for the `user` layer. */
+    userId?: string;
+    delta: FieldPolicyDelta;
+}
+/** Fully merged policy for a single field. */
+export interface ResolvedFieldPolicy {
+    fieldName: string;
+    /** True when any layer resolved a default (including an explicit null). */
+    hasDefault: boolean;
+    /** Parsed default value; `undefined` when {@link hasDefault} is false. */
+    defaultValue: unknown;
+    visibility: FieldPolicyVisibility;
+    help: string | null;
+    label: string | null;
+    order: number | null;
+    /** Grouping key — code-seed only (`ui.group`), not overridable by rows. */
+    group: string | null;
+    locked: boolean;
+    /** Mirror of the manifest required flag (nullable fields are optional). */
+    required: boolean;
+    /**
+     * True when the resolver forced `basic` visibility because the field is
+     * required and no usable default resolved (the resolver-side safety net for
+     * the required-field invariant).
+     */
+    visibilityForced?: boolean;
+}
+/** Merged policy for every field of one object. */
+export interface ResolvedObjectFieldPolicy {
+    objectRef: string;
+    fields: Record<string, ResolvedFieldPolicy>;
+}
+/**
+ * Explain variant: merged result plus the ordered per-layer contributions for
+ * each field, so admin/gear UIs (#2049/#2050) never re-derive precedence.
+ * Layers are listed in application order (code, app, tenant chain root → leaf,
+ * user) and contain ONLY contributions that survive into the merged result:
+ * tenant ancestors discarded by a permission-inheritance break and user rows
+ * suppressed by an effective org lock are omitted, so sequentially replaying
+ * the listed deltas reproduces the merged policy.
+ */
+export interface ExplainedObjectFieldPolicy extends ResolvedObjectFieldPolicy {
+    layers: Record<string, FieldPolicyLayerContribution[]>;
+}
+/** Minimal tenant node consumed by the hierarchy walk (mirrors smrt-features). */
+export interface FieldPolicyTenantNode {
+    id: string;
+    inheritPermissions: boolean;
+    cascadePermissions: boolean;
+}
+/** Provider returning the root → leaf tenant chain (mirrors smrt-features). */
+export interface FieldPolicyTenantHierarchyProvider {
+    getChain(tenantId: string): Promise<FieldPolicyTenantNode[]>;
+}
+/**
+ * Loader-function DI seam (NOT a container registration): the resolver calls
+ * it lazily and treats `null` as "no hierarchy available" (flat-tenant
+ * fallback). The default loader dynamic-imports `@happyvertical/smrt-users`
+ * and returns `null` when it is not installed.
+ */
+export type FieldPolicyTenantHierarchyLoader = (options: SmrtClassOptions) => Promise<FieldPolicyTenantHierarchyProvider | null>;
+export interface ResolveFieldPolicyOptions {
+    tenantId?: string | null;
+    userId?: string | null;
+    /**
+     * Database holding `_smrt_field_policies`. Without it, only the code seed
+     * resolves (stored layers are skipped) — the smrt-prompts precedent.
+     */
+    db?: SmrtClassOptions['db'];
+    tenantHierarchyLoader?: FieldPolicyTenantHierarchyLoader;
+    /**
+     * Internal write-validation seam: omit persisted rows while evaluating a
+     * proposed replacement. Excluded resolutions bypass the shared cache so a
+     * projected result can never poison ordinary reads.
+     */
+    excludePolicyIds?: ReadonlySet<string>;
+}
+/**
+ * Minimal structural shape of the tenant surface loaded from
+ * `@happyvertical/smrt-users` by the default hierarchy loader. Only the
+ * permission-cascade fields consumed by the chain walk are modeled.
+ */
+export interface FieldPolicyUsersTenantRecord {
+    id: string;
+    inheritPermissions?: boolean;
+    cascadePermissions?: boolean;
+}
+export interface FieldPolicyUsersModule {
+    TenantCollection: {
+        create(options: SmrtClassOptions): Promise<{
+            get(criteria: {
+                id: string;
+            }): Promise<FieldPolicyUsersTenantRecord | null>;
+            getAncestorsFromRoot(tenantId: string): Promise<FieldPolicyUsersTenantRecord[]>;
+        }>;
+    };
+}
+/** Result shape of the batch resolve action (`FieldPolicyCollection.resolveBatch`). */
+export interface FieldPolicyBatchResult {
+    policies: Record<string, ResolvedObjectFieldPolicy>;
+}
+/** A policy row safe to expose through the context-scoped gear action. */
+export interface FieldPolicyEditorRow {
+    defaultValue: string | null;
+    displayOrder: number | null;
+    fieldName: string;
+    help: string | null;
+    id: string;
+    label: string | null;
+    locked: boolean | null;
+    scopeType: FieldPolicyScopeType;
+    tenantId: string | null;
+    updatedBy: string | null;
+    userId: string | null;
+    visibility: FieldPolicyVisibility | null;
+}
+/** Context-derived authorization state for the field-policy gear. */
+export interface FieldPolicyEditorCapabilities {
+    manage: boolean;
+    personalize: boolean;
+}
+/**
+ * Gear bootstrap response. `policy` is always filtered by the public-field
+ * rail; raw rows and explanation layers appear only for scopes the caller is
+ * authorized to mutate. Row ids are present for reset/delete operations.
+ */
+export interface FieldPolicyEditorState {
+    capabilities: FieldPolicyEditorCapabilities;
+    /**
+     * For the caller's personal layer only, whether removing that layer's
+     * default still leaves a usable default at code/app/tenant precedence.
+     * This intentionally exposes no lower-layer rows or default values.
+     */
+    personalLowerDefaultUsable: Record<string, boolean>;
+    policy: ExplainedObjectFieldPolicy;
+    rows: {
+        app: FieldPolicyEditorRow[];
+        tenant: FieldPolicyEditorRow[];
+        user: FieldPolicyEditorRow[];
+    };
+}
+/** A stored organization row with the immutable audit metadata needed by #2050. */
+export interface FieldPolicyAuditRow extends FieldPolicyEditorRow {
+    objectRef: string;
+    createdAt: string | null;
+    updatedAt: string | null;
+}
+/** Why a persisted policy row is no longer usable by the live registry. */
+export type FieldPolicyDriftReason = 'unknown-object' | 'unknown-field' | 'excluded-field';
+/** Drift is deliberately identity-only: stale values are never serialized. */
+export interface FieldPolicyDriftRow {
+    id: string;
+    objectRef: string;
+    fieldName: string;
+    scopeType: FieldPolicyScopeType;
+    tenantId: string | null;
+    userId: string | null;
+    updatedBy: string | null;
+    createdAt: string | null;
+    updatedAt: string | null;
+    reason: FieldPolicyDriftReason;
+    prunable: boolean;
+}
+/**
+ * Tenant-admin catalog read surface. Foreign user rows are represented only
+ * by counts; their values and identifiers never leave the collection.
+ */
+export interface FieldPolicyAuditSnapshot {
+    orgRows: FieldPolicyAuditRow[];
+    appRows: FieldPolicyAuditRow[];
+    inheritedOrgKeys: Record<string, string[]>;
+    userOverrideCounts: Record<string, Record<string, number>>;
+    driftRows: FieldPolicyDriftRow[];
+    policies: Record<string, ExplainedObjectFieldPolicy>;
+    caller: {
+        tenantId: string | null;
+        userId: string | null;
+        canManageOrg: boolean;
+        canPersonalize: boolean;
+    };
+}
+/** Explicit 403 result used by generated custom-action transports. */
+export interface FieldPolicyEditorStateDenied {
+    code: 'permission_denied';
+    message: string;
+    ok: false;
+    status: 403;
+}
+export type FieldPolicyEditorStateResult = FieldPolicyEditorState | FieldPolicyEditorStateDenied;
+export type FieldPolicySuggestionKind = 'promote' | 'default';
+export declare const FIELD_POLICY_SUGGESTION_KINDS: readonly FieldPolicySuggestionKind[];
+export type FieldPolicySuggestionStatus = 'pending' | 'accepted' | 'dismissed';
+export declare const FIELD_POLICY_SUGGESTION_STATUSES: readonly FieldPolicySuggestionStatus[];
+/** One bounded client-side form submission sample. */
+export interface FieldUsageReportEntry {
+    objectRef: string;
+    fieldName: string;
+    value?: unknown;
+    /** Used only for value-less samples; server comparison wins when present. */
+    matchedDefault?: boolean;
+}
+export interface FieldUsageReportResult {
+    accepted: number;
+    dropped: number;
+}
+export interface FieldPolicySuggestionData {
+    id: string;
+    objectRef: string;
+    fieldName: string;
+    tenantId: string;
+    kind: FieldPolicySuggestionKind;
+    proposedValue: string | null;
+    evidence: Record<string, unknown>;
+    status: FieldPolicySuggestionStatus;
+    cooldownUntil: string | null;
+    decidedBy: string | null;
+    decidedAt: string | null;
+}
+export interface PendingFieldPolicySuggestionsResult {
+    suggestions: FieldPolicySuggestionData[];
+    total: number;
+}
+export interface AcceptFieldPolicySuggestionResult {
+    suggestion: FieldPolicySuggestionData;
+    policyRowId: string;
+}
+export interface DismissFieldPolicySuggestionResult {
+    suggestion: FieldPolicySuggestionData;
+}
+export type { SmrtClassOptions };
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD,eAAO,MAAM,wBAAwB,EAAE,SAAS,oBAAoB,EAInE,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,SAAS,qBAAqB,EAIrE,CAAC;AAEF,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,UAAU,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC1C,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,+EAA+E;AAC/E,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC1C,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,0EAA0E;IAC1E,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,qBAAqB,CAAC;IAClC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,mDAAmD;AACnD,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC7C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA2B,SAAQ,yBAAyB;IAC3E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;CACxD;AAED,kFAAkF;AAClF,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB,EAAE,OAAO,CAAC;IAC5B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,+EAA+E;AAC/E,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;CAC9D;AAED;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAC7C,OAAO,EAAE,gBAAgB,KACtB,OAAO,CAAC,kCAAkC,GAAG,IAAI,CAAC,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;OAGG;IACH,EAAE,CAAC,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC5B,qBAAqB,CAAC,EAAE,gCAAgC,CAAC;IACzD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,EAAE;QAChB,MAAM,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC;YACzC,GAAG,CAAC,QAAQ,EAAE;gBACZ,EAAE,EAAE,MAAM,CAAC;aACZ,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;YACjD,oBAAoB,CAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAAC;SAC5C,CAAC,CAAC;KACJ,CAAC;CACH;AAED,uFAAuF;AACvF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;CACrD;AAED,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,oBAAoB,CAAC;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC1C;AAED,qEAAqE;AACrE,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,6BAA6B,CAAC;IAC5C;;;;OAIG;IACH,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,EAAE,0BAA0B,CAAC;IACnC,IAAI,EAAE;QACJ,GAAG,EAAE,oBAAoB,EAAE,CAAC;QAC5B,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC/B,IAAI,EAAE,oBAAoB,EAAE,CAAC;KAC9B,CAAC;CACH;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAoB,SAAQ,oBAAoB;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,eAAe,GACf,gBAAgB,CAAC;AAErB,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,oBAAoB,CAAC;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACrD,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,YAAY,EAAE,OAAO,CAAC;QACtB,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC;CACH;AAED,sEAAsE;AACtE,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,GAAG,CAAC;CACb;AAED,MAAM,MAAM,4BAA4B,GACpC,sBAAsB,GACtB,4BAA4B,CAAC;AAMjC,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,SAAS,CAAC;AAC9D,eAAO,MAAM,6BAA6B,EAAE,SAAS,yBAAyB,EACtD,CAAC;AAEzB,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;AAC/E,eAAO,MAAM,gCAAgC,EAAE,SAAS,2BAA2B,EAC7C,CAAC;AAEvC,sDAAsD;AACtD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,yBAAyB,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,EAAE,2BAA2B,CAAC;IACpC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,mCAAmC;IAClD,WAAW,EAAE,yBAAyB,EAAE,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iCAAiC;IAChD,UAAU,EAAE,yBAAyB,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,yBAAyB,CAAC;CACvC;AAED,YAAY,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/types.js

@@ -10,7 +10,13 @@ var FIELD_POLICY_VISIBILITIES = [
 	"advanced",
 	"hidden"
 ];
+var FIELD_POLICY_SUGGESTION_KINDS = ["promote", "default"];
+var FIELD_POLICY_SUGGESTION_STATUSES = [
+	"pending",
+	"accepted",
+	"dismissed"
+];
 //#endregion
-export { APP_FIELD_POLICY_SCOPE_KEY, FIELD_POLICY_SCOPE_TYPES, FIELD_POLICY_VISIBILITIES };
+export { APP_FIELD_POLICY_SCOPE_KEY, FIELD_POLICY_SCOPE_TYPES, FIELD_POLICY_SUGGESTION_KINDS, FIELD_POLICY_SUGGESTION_STATUSES, FIELD_POLICY_VISIBILITIES };
 
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../src/types.ts"],"sourcesContent":["import type {\n  SmrtClassOptions,\n  SmrtObjectOptions,\n} from '@happyvertical/smrt-core';\n\n/**\n * Scope tier a {@link FieldPolicy} row belongs to.\n *\n * Resolution precedence is code seed → `app` → `tenant` (hierarchy walk,\n * root → leaf) → `user`. Unlike smrt-features (which ships only\n * `global`/`tenant`), the user tier is implemented end to end here — both\n * defaults and visibility resolve through it.\n */\nexport type FieldPolicyScopeType = 'app' | 'tenant' | 'user';\n\n/**\n * Visibility tier for a field in generated/consuming form UIs.\n *\n * - `basic`: shown before the advanced disclosure\n * - `advanced`: shown behind the advanced disclosure\n * - `hidden`: not rendered (requires the field to be optional or have a\n *   resolved default — the required-field invariant)\n */\nexport type FieldPolicyVisibility = 'basic' | 'advanced' | 'hidden';\n\n/**\n * `scopeKey` value for app-scope rows. `scopeKey` exists ONLY so the\n * `conflictColumns` unique index stays total while `tenantId`/`userId` are\n * nullable (nullable columns would allow duplicate NULL rows) — the same\n * trick as `PromptOverride.context`.\n */\nexport const APP_FIELD_POLICY_SCOPE_KEY = '__app__';\n\nexport const FIELD_POLICY_SCOPE_TYPES: readonly FieldPolicyScopeType[] = [\n  'app',\n  'tenant',\n  'user',\n];\n\nexport const FIELD_POLICY_VISIBILITIES: readonly FieldPolicyVisibility[] = [\n  'basic',\n  'advanced',\n  'hidden',\n];\n\nexport interface FieldPolicyOptions extends SmrtObjectOptions {\n  objectRef?: string;\n  fieldName?: string;\n  scopeType?: FieldPolicyScopeType;\n  tenantId?: string | null;\n  userId?: string | null;\n  /**\n   * ENCODED channel: an already-JSON-encoded default, exactly as the column\n   * stores it (`'\"Net 30\"'`, `'42'`, `'null'`), or `null` to inherit.\n   *\n   * This is the wire contract: the generated write routes hand the request\n   * body straight to the constructor, and the #2049/#2050 gear posts\n   * `JSON.stringify(draft.defaultValue)`. It must therefore keep meaning\n   * \"already encoded\" — auto-serializing here would double-encode every gear\n   * write.\n   *\n   * Use {@link FieldPolicyOptions.defaultValueRaw} for a plain value. The two\n   * are mutually exclusive: `'\"TBD\"'` and `'TBD'` are indistinguishable once\n   * a single option carries both meanings, so the channel must be explicit\n   * rather than sniffed.\n   */\n  defaultValue?: string | null;\n  /**\n   * PLAIN channel: any value, always serialized — strings included. The\n   * constructor-option twin of {@link FieldPolicy.setDefaultValue}, so\n   * `{ defaultValueRaw: 'Net 30' }` stores `'\"Net 30\"'` rather than the\n   * unparseable literal `Net 30`.\n   */\n  defaultValueRaw?: unknown;\n  visibility?: FieldPolicyVisibility | null;\n  help?: string | null;\n  label?: string | null;\n  displayOrder?: number | null;\n  locked?: boolean | null;\n  updatedBy?: string | null;\n}\n\n/**\n * The sparse contribution of one layer (code seed or one stored row).\n *\n * `default` is boxed so an explicit JSON `null` default (meaning \"default to\n * null\") stays distinguishable from \"this layer contributes no default\".\n */\nexport interface FieldPolicyDelta {\n  default?: { value: unknown };\n  visibility?: FieldPolicyVisibility;\n  help?: string;\n  label?: string;\n  order?: number;\n  locked?: boolean;\n}\n\n/** One layer's contribution to a field's resolved policy (explain variant). */\nexport interface FieldPolicyLayerContribution {\n  layer: 'code' | 'app' | 'tenant' | 'user';\n  /** Chain node id for `tenant` layers (root → leaf order). */\n  tenantId?: string;\n  /** User id for the `user` layer. */\n  userId?: string;\n  delta: FieldPolicyDelta;\n}\n\n/** Fully merged policy for a single field. */\nexport interface ResolvedFieldPolicy {\n  fieldName: string;\n  /** True when any layer resolved a default (including an explicit null). */\n  hasDefault: boolean;\n  /** Parsed default value; `undefined` when {@link hasDefault} is false. */\n  defaultValue: unknown;\n  visibility: FieldPolicyVisibility;\n  help: string | null;\n  label: string | null;\n  order: number | null;\n  /** Grouping key — code-seed only (`ui.group`), not overridable by rows. */\n  group: string | null;\n  locked: boolean;\n  /** Mirror of the manifest required flag (nullable fields are optional). */\n  required: boolean;\n  /**\n   * True when the resolver forced `basic` visibility because the field is\n   * required and no usable default resolved (the resolver-side safety net for\n   * the required-field invariant).\n   */\n  visibilityForced?: boolean;\n}\n\n/** Merged policy for every field of one object. */\nexport interface ResolvedObjectFieldPolicy {\n  objectRef: string;\n  fields: Record<string, ResolvedFieldPolicy>;\n}\n\n/**\n * Explain variant: merged result plus the ordered per-layer contributions for\n * each field, so admin/gear UIs (#2049/#2050) never re-derive precedence.\n * Layers are listed in application order (code, app, tenant chain root → leaf,\n * user) and contain ONLY contributions that survive into the merged result:\n * tenant ancestors discarded by a permission-inheritance break and user rows\n * suppressed by an effective org lock are omitted, so sequentially replaying\n * the listed deltas reproduces the merged policy.\n */\nexport interface ExplainedObjectFieldPolicy extends ResolvedObjectFieldPolicy {\n  layers: Record<string, FieldPolicyLayerContribution[]>;\n}\n\n/** Minimal tenant node consumed by the hierarchy walk (mirrors smrt-features). */\nexport interface FieldPolicyTenantNode {\n  id: string;\n  inheritPermissions: boolean;\n  cascadePermissions: boolean;\n}\n\n/** Provider returning the root → leaf tenant chain (mirrors smrt-features). */\nexport interface FieldPolicyTenantHierarchyProvider {\n  getChain(tenantId: string): Promise<FieldPolicyTenantNode[]>;\n}\n\n/**\n * Loader-function DI seam (NOT a container registration): the resolver calls\n * it lazily and treats `null` as \"no hierarchy available\" (flat-tenant\n * fallback). The default loader dynamic-imports `@happyvertical/smrt-users`\n * and returns `null` when it is not installed.\n */\nexport type FieldPolicyTenantHierarchyLoader = (\n  options: SmrtClassOptions,\n) => Promise<FieldPolicyTenantHierarchyProvider | null>;\n\nexport interface ResolveFieldPolicyOptions {\n  tenantId?: string | null;\n  userId?: string | null;\n  /**\n   * Database holding `_smrt_field_policies`. Without it, only the code seed\n   * resolves (stored layers are skipped) — the smrt-prompts precedent.\n   */\n  db?: SmrtClassOptions['db'];\n  tenantHierarchyLoader?: FieldPolicyTenantHierarchyLoader;\n}\n\n/**\n * Minimal structural shape of the tenant surface loaded from\n * `@happyvertical/smrt-users` by the default hierarchy loader. Only the\n * permission-cascade fields consumed by the chain walk are modeled.\n */\nexport interface FieldPolicyUsersTenantRecord {\n  id: string;\n  inheritPermissions?: boolean;\n  cascadePermissions?: boolean;\n}\n\nexport interface FieldPolicyUsersModule {\n  TenantCollection: {\n    create(options: SmrtClassOptions): Promise<{\n      get(criteria: {\n        id: string;\n      }): Promise<FieldPolicyUsersTenantRecord | null>;\n      getAncestorsFromRoot(\n        tenantId: string,\n      ): Promise<FieldPolicyUsersTenantRecord[]>;\n    }>;\n  };\n}\n\n/** Result shape of the batch resolve action (`FieldPolicyCollection.resolveBatch`). */\nexport interface FieldPolicyBatchResult {\n  policies: Record<string, ResolvedObjectFieldPolicy>;\n}\n\nexport type { SmrtClassOptions };\n"],"mappings":";AA+BO,IAAM,6BAA6B;AAEnC,IAAM,2BAA4D;CACvE;CACA;CACA;AACF;AAEO,IAAM,4BAA8D;CACzE;CACA;CACA;AACF"}
+{"version":3,"file":"types.js","names":[],"sources":["../src/types.ts"],"sourcesContent":["import type {\n  SmrtClassOptions,\n  SmrtObjectOptions,\n} from '@happyvertical/smrt-core';\n\n/**\n * Scope tier a {@link FieldPolicy} row belongs to.\n *\n * Resolution precedence is code seed → `app` → `tenant` (hierarchy walk,\n * root → leaf) → `user`. Unlike smrt-features (which ships only\n * `global`/`tenant`), the user tier is implemented end to end here — both\n * defaults and visibility resolve through it.\n */\nexport type FieldPolicyScopeType = 'app' | 'tenant' | 'user';\n\n/**\n * Visibility tier for a field in generated/consuming form UIs.\n *\n * - `basic`: shown before the advanced disclosure\n * - `advanced`: shown behind the advanced disclosure\n * - `hidden`: not rendered (requires the field to be optional or have a\n *   resolved default — the required-field invariant)\n */\nexport type FieldPolicyVisibility = 'basic' | 'advanced' | 'hidden';\n\n/**\n * `scopeKey` value for app-scope rows. `scopeKey` exists ONLY so the\n * `conflictColumns` unique index stays total while `tenantId`/`userId` are\n * nullable (nullable columns would allow duplicate NULL rows) — the same\n * trick as `PromptOverride.context`.\n */\nexport const APP_FIELD_POLICY_SCOPE_KEY = '__app__';\n\nexport const FIELD_POLICY_SCOPE_TYPES: readonly FieldPolicyScopeType[] = [\n  'app',\n  'tenant',\n  'user',\n];\n\nexport const FIELD_POLICY_VISIBILITIES: readonly FieldPolicyVisibility[] = [\n  'basic',\n  'advanced',\n  'hidden',\n];\n\nexport interface FieldPolicyOptions extends SmrtObjectOptions {\n  objectRef?: string;\n  fieldName?: string;\n  scopeType?: FieldPolicyScopeType;\n  tenantId?: string | null;\n  userId?: string | null;\n  /**\n   * ENCODED channel: an already-JSON-encoded default, exactly as the column\n   * stores it (`'\"Net 30\"'`, `'42'`, `'null'`), or `null` to inherit.\n   *\n   * This is the wire contract: the generated write routes hand the request\n   * body straight to the constructor, and the #2049/#2050 gear posts\n   * `JSON.stringify(draft.defaultValue)`. It must therefore keep meaning\n   * \"already encoded\" — auto-serializing here would double-encode every gear\n   * write.\n   *\n   * Use {@link FieldPolicyOptions.defaultValueRaw} for a plain value. The two\n   * are mutually exclusive: `'\"TBD\"'` and `'TBD'` are indistinguishable once\n   * a single option carries both meanings, so the channel must be explicit\n   * rather than sniffed.\n   */\n  defaultValue?: string | null;\n  /**\n   * PLAIN channel: any value, always serialized — strings included. The\n   * constructor-option twin of {@link FieldPolicy.setDefaultValue}, so\n   * `{ defaultValueRaw: 'Net 30' }` stores `'\"Net 30\"'` rather than the\n   * unparseable literal `Net 30`.\n   */\n  defaultValueRaw?: unknown;\n  visibility?: FieldPolicyVisibility | null;\n  help?: string | null;\n  label?: string | null;\n  displayOrder?: number | null;\n  locked?: boolean | null;\n  updatedBy?: string | null;\n}\n\n/**\n * The sparse contribution of one layer (code seed or one stored row).\n *\n * `default` is boxed so an explicit JSON `null` default (meaning \"default to\n * null\") stays distinguishable from \"this layer contributes no default\".\n */\nexport interface FieldPolicyDelta {\n  default?: { value: unknown };\n  visibility?: FieldPolicyVisibility;\n  help?: string;\n  label?: string;\n  order?: number;\n  locked?: boolean;\n}\n\n/** One layer's contribution to a field's resolved policy (explain variant). */\nexport interface FieldPolicyLayerContribution {\n  layer: 'code' | 'app' | 'tenant' | 'user';\n  /** Chain node id for `tenant` layers (root → leaf order). */\n  tenantId?: string;\n  /** User id for the `user` layer. */\n  userId?: string;\n  delta: FieldPolicyDelta;\n}\n\n/** Fully merged policy for a single field. */\nexport interface ResolvedFieldPolicy {\n  fieldName: string;\n  /** True when any layer resolved a default (including an explicit null). */\n  hasDefault: boolean;\n  /** Parsed default value; `undefined` when {@link hasDefault} is false. */\n  defaultValue: unknown;\n  visibility: FieldPolicyVisibility;\n  help: string | null;\n  label: string | null;\n  order: number | null;\n  /** Grouping key — code-seed only (`ui.group`), not overridable by rows. */\n  group: string | null;\n  locked: boolean;\n  /** Mirror of the manifest required flag (nullable fields are optional). */\n  required: boolean;\n  /**\n   * True when the resolver forced `basic` visibility because the field is\n   * required and no usable default resolved (the resolver-side safety net for\n   * the required-field invariant).\n   */\n  visibilityForced?: boolean;\n}\n\n/** Merged policy for every field of one object. */\nexport interface ResolvedObjectFieldPolicy {\n  objectRef: string;\n  fields: Record<string, ResolvedFieldPolicy>;\n}\n\n/**\n * Explain variant: merged result plus the ordered per-layer contributions for\n * each field, so admin/gear UIs (#2049/#2050) never re-derive precedence.\n * Layers are listed in application order (code, app, tenant chain root → leaf,\n * user) and contain ONLY contributions that survive into the merged result:\n * tenant ancestors discarded by a permission-inheritance break and user rows\n * suppressed by an effective org lock are omitted, so sequentially replaying\n * the listed deltas reproduces the merged policy.\n */\nexport interface ExplainedObjectFieldPolicy extends ResolvedObjectFieldPolicy {\n  layers: Record<string, FieldPolicyLayerContribution[]>;\n}\n\n/** Minimal tenant node consumed by the hierarchy walk (mirrors smrt-features). */\nexport interface FieldPolicyTenantNode {\n  id: string;\n  inheritPermissions: boolean;\n  cascadePermissions: boolean;\n}\n\n/** Provider returning the root → leaf tenant chain (mirrors smrt-features). */\nexport interface FieldPolicyTenantHierarchyProvider {\n  getChain(tenantId: string): Promise<FieldPolicyTenantNode[]>;\n}\n\n/**\n * Loader-function DI seam (NOT a container registration): the resolver calls\n * it lazily and treats `null` as \"no hierarchy available\" (flat-tenant\n * fallback). The default loader dynamic-imports `@happyvertical/smrt-users`\n * and returns `null` when it is not installed.\n */\nexport type FieldPolicyTenantHierarchyLoader = (\n  options: SmrtClassOptions,\n) => Promise<FieldPolicyTenantHierarchyProvider | null>;\n\nexport interface ResolveFieldPolicyOptions {\n  tenantId?: string | null;\n  userId?: string | null;\n  /**\n   * Database holding `_smrt_field_policies`. Without it, only the code seed\n   * resolves (stored layers are skipped) — the smrt-prompts precedent.\n   */\n  db?: SmrtClassOptions['db'];\n  tenantHierarchyLoader?: FieldPolicyTenantHierarchyLoader;\n  /**\n   * Internal write-validation seam: omit persisted rows while evaluating a\n   * proposed replacement. Excluded resolutions bypass the shared cache so a\n   * projected result can never poison ordinary reads.\n   */\n  excludePolicyIds?: ReadonlySet<string>;\n}\n\n/**\n * Minimal structural shape of the tenant surface loaded from\n * `@happyvertical/smrt-users` by the default hierarchy loader. Only the\n * permission-cascade fields consumed by the chain walk are modeled.\n */\nexport interface FieldPolicyUsersTenantRecord {\n  id: string;\n  inheritPermissions?: boolean;\n  cascadePermissions?: boolean;\n}\n\nexport interface FieldPolicyUsersModule {\n  TenantCollection: {\n    create(options: SmrtClassOptions): Promise<{\n      get(criteria: {\n        id: string;\n      }): Promise<FieldPolicyUsersTenantRecord | null>;\n      getAncestorsFromRoot(\n        tenantId: string,\n      ): Promise<FieldPolicyUsersTenantRecord[]>;\n    }>;\n  };\n}\n\n/** Result shape of the batch resolve action (`FieldPolicyCollection.resolveBatch`). */\nexport interface FieldPolicyBatchResult {\n  policies: Record<string, ResolvedObjectFieldPolicy>;\n}\n\n/** A policy row safe to expose through the context-scoped gear action. */\nexport interface FieldPolicyEditorRow {\n  defaultValue: string | null;\n  displayOrder: number | null;\n  fieldName: string;\n  help: string | null;\n  id: string;\n  label: string | null;\n  locked: boolean | null;\n  scopeType: FieldPolicyScopeType;\n  tenantId: string | null;\n  updatedBy: string | null;\n  userId: string | null;\n  visibility: FieldPolicyVisibility | null;\n}\n\n/** Context-derived authorization state for the field-policy gear. */\nexport interface FieldPolicyEditorCapabilities {\n  manage: boolean;\n  personalize: boolean;\n}\n\n/**\n * Gear bootstrap response. `policy` is always filtered by the public-field\n * rail; raw rows and explanation layers appear only for scopes the caller is\n * authorized to mutate. Row ids are present for reset/delete operations.\n */\nexport interface FieldPolicyEditorState {\n  capabilities: FieldPolicyEditorCapabilities;\n  /**\n   * For the caller's personal layer only, whether removing that layer's\n   * default still leaves a usable default at code/app/tenant precedence.\n   * This intentionally exposes no lower-layer rows or default values.\n   */\n  personalLowerDefaultUsable: Record<string, boolean>;\n  policy: ExplainedObjectFieldPolicy;\n  rows: {\n    app: FieldPolicyEditorRow[];\n    tenant: FieldPolicyEditorRow[];\n    user: FieldPolicyEditorRow[];\n  };\n}\n\n/** A stored organization row with the immutable audit metadata needed by #2050. */\nexport interface FieldPolicyAuditRow extends FieldPolicyEditorRow {\n  objectRef: string;\n  createdAt: string | null;\n  updatedAt: string | null;\n}\n\n/** Why a persisted policy row is no longer usable by the live registry. */\nexport type FieldPolicyDriftReason =\n  | 'unknown-object'\n  | 'unknown-field'\n  | 'excluded-field';\n\n/** Drift is deliberately identity-only: stale values are never serialized. */\nexport interface FieldPolicyDriftRow {\n  id: string;\n  objectRef: string;\n  fieldName: string;\n  scopeType: FieldPolicyScopeType;\n  tenantId: string | null;\n  userId: string | null;\n  updatedBy: string | null;\n  createdAt: string | null;\n  updatedAt: string | null;\n  reason: FieldPolicyDriftReason;\n  prunable: boolean;\n}\n\n/**\n * Tenant-admin catalog read surface. Foreign user rows are represented only\n * by counts; their values and identifiers never leave the collection.\n */\nexport interface FieldPolicyAuditSnapshot {\n  orgRows: FieldPolicyAuditRow[];\n  appRows: FieldPolicyAuditRow[];\n  inheritedOrgKeys: Record<string, string[]>;\n  userOverrideCounts: Record<string, Record<string, number>>;\n  driftRows: FieldPolicyDriftRow[];\n  policies: Record<string, ExplainedObjectFieldPolicy>;\n  caller: {\n    tenantId: string | null;\n    userId: string | null;\n    canManageOrg: boolean;\n    canPersonalize: boolean;\n  };\n}\n\n/** Explicit 403 result used by generated custom-action transports. */\nexport interface FieldPolicyEditorStateDenied {\n  code: 'permission_denied';\n  message: string;\n  ok: false;\n  status: 403;\n}\n\nexport type FieldPolicyEditorStateResult =\n  | FieldPolicyEditorState\n  | FieldPolicyEditorStateDenied;\n\n// ---------------------------------------------------------------------------\n// Usage capture + promotion suggestions (#2051)\n// ---------------------------------------------------------------------------\n\nexport type FieldPolicySuggestionKind = 'promote' | 'default';\nexport const FIELD_POLICY_SUGGESTION_KINDS: readonly FieldPolicySuggestionKind[] =\n  ['promote', 'default'];\n\nexport type FieldPolicySuggestionStatus = 'pending' | 'accepted' | 'dismissed';\nexport const FIELD_POLICY_SUGGESTION_STATUSES: readonly FieldPolicySuggestionStatus[] =\n  ['pending', 'accepted', 'dismissed'];\n\n/** One bounded client-side form submission sample. */\nexport interface FieldUsageReportEntry {\n  objectRef: string;\n  fieldName: string;\n  value?: unknown;\n  /** Used only for value-less samples; server comparison wins when present. */\n  matchedDefault?: boolean;\n}\n\nexport interface FieldUsageReportResult {\n  accepted: number;\n  dropped: number;\n}\n\nexport interface FieldPolicySuggestionData {\n  id: string;\n  objectRef: string;\n  fieldName: string;\n  tenantId: string;\n  kind: FieldPolicySuggestionKind;\n  proposedValue: string | null;\n  evidence: Record<string, unknown>;\n  status: FieldPolicySuggestionStatus;\n  cooldownUntil: string | null;\n  decidedBy: string | null;\n  decidedAt: string | null;\n}\n\nexport interface PendingFieldPolicySuggestionsResult {\n  suggestions: FieldPolicySuggestionData[];\n  total: number;\n}\n\nexport interface AcceptFieldPolicySuggestionResult {\n  suggestion: FieldPolicySuggestionData;\n  policyRowId: string;\n}\n\nexport interface DismissFieldPolicySuggestionResult {\n  suggestion: FieldPolicySuggestionData;\n}\n\nexport type { SmrtClassOptions };\n"],"mappings":";AA+BO,IAAM,6BAA6B;AAEnC,IAAM,2BAA4D;CACvE;CACA;CACA;AACF;AAEO,IAAM,4BAA8D;CACzE;CACA;CACA;AACF;AA0RO,IAAM,gCACX,CAAC,WAAW,SAAS;AAGhB,IAAM,mCACX;CAAC;CAAW;CAAY;AAAW"}