@happyvertical/smrt-fields 0.40.61 → 0.40.63

package/dist/chunks/FieldPolicyCollection--RxukfCX.js

@@ -0,0 +1,1218 @@
+import { FIELD_POLICY_SCOPE_TYPES, FIELD_POLICY_VISIBILITIES } from "../types.js";
+import { ObjectRegistry, SmrtCollection, SmrtObject, crossPackageRef, field, smrt } from "@happyvertical/smrt-core";
+import { MembershipCollection, assertOperationPermission, checkOperationPermission, getCurrentSessionPermissionContext, registerPermissionDefinitions } from "@happyvertical/smrt-users";
+import { TenantIsolationError, getCurrentTenant, isSuperAdminBypass, tenantId } from "@happyvertical/smrt-tenancy";
+//#region \0rolldown/runtime.js
+var __defProp$2 = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp$2(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp$2(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/permissions.ts
+var MANAGE_FIELD_POLICY_PERMISSION = "fields.policy.manage";
+var PERSONALIZE_FIELD_POLICY_PERMISSION = "fields.policy.personalize";
+var FIELD_POLICY_PERMISSION_DEFINITIONS = [{
+	slug: MANAGE_FIELD_POLICY_PERMISSION,
+	category: "fields",
+	name: "Manage Field Policies",
+	description: "Manage application and tenant field-policy overrides"
+}, {
+	slug: PERSONALIZE_FIELD_POLICY_PERMISSION,
+	category: "fields",
+	name: "Personalize Field Policies",
+	description: "Manage the caller’s own field-policy overrides"
+}];
+var registered = false;
+function ensureFieldPolicyPermissionsRegistered() {
+	if (registered) return;
+	registered = true;
+	registerPermissionDefinitions(FIELD_POLICY_PERMISSION_DEFINITIONS);
+}
+//#endregion
+//#region src/cache.ts
+var FIELD_POLICY_CACHE_TTL_MS = 3e4;
+var fieldPolicyCache = /* @__PURE__ */ new Map();
+var dbInstanceIds = /* @__PURE__ */ new WeakMap();
+var nextDbId = 1;
+function getDbNamespace(db) {
+	if (!db) return "no-db";
+	if (typeof db === "string") return `db:${db}`;
+	if (typeof db === "object") {
+		const dbObject = db;
+		if (typeof dbObject.query === "function") {
+			if (!dbInstanceIds.has(dbObject)) dbInstanceIds.set(dbObject, `db-instance:${nextDbId++}`);
+			const namespace = dbInstanceIds.get(dbObject);
+			if (namespace) return namespace;
+			return "db-instance:unknown";
+		}
+		try {
+			return `db-config:${JSON.stringify(dbObject)}`;
+		} catch {
+			return "db-config:opaque";
+		}
+	}
+	return "db:unknown";
+}
+var hierarchyLoaderIds = /* @__PURE__ */ new WeakMap();
+var nextLoaderId = 1;
+function getHierarchyLoaderNamespace(loader) {
+	if (typeof loader !== "function") return "loader:default";
+	const key = loader;
+	if (!hierarchyLoaderIds.has(key)) hierarchyLoaderIds.set(key, `loader:${nextLoaderId++}`);
+	return hierarchyLoaderIds.get(key) ?? "loader:unknown";
+}
+function buildCacheKey(objectRef, tenantId, userId, db, hierarchyLoader) {
+	return `${getDbNamespace(db)}::${objectRef}::${tenantId ?? "app"}::${userId ?? "user:none"}::${getHierarchyLoaderNamespace(hierarchyLoader)}`;
+}
+function getFieldPolicyCacheTtlMs() {
+	return FIELD_POLICY_CACHE_TTL_MS;
+}
+function getCachedFieldPolicy(objectRef, tenantId, userId, db, hierarchyLoader) {
+	const cacheKey = buildCacheKey(objectRef, tenantId, userId, db, hierarchyLoader);
+	const cached = fieldPolicyCache.get(cacheKey);
+	if (!cached) return null;
+	if (cached.expiresAt <= Date.now()) {
+		fieldPolicyCache.delete(cacheKey);
+		return null;
+	}
+	return cached.value;
+}
+function setCachedFieldPolicy(objectRef, tenantId, userId, db, value, hierarchyLoader) {
+	fieldPolicyCache.set(buildCacheKey(objectRef, tenantId, userId, db, hierarchyLoader), {
+		expiresAt: Date.now() + FIELD_POLICY_CACHE_TTL_MS,
+		value
+	});
+}
+function invalidateFieldPolicyCache(objectRef, db) {
+	const keyPrefix = `${getDbNamespace(db)}::${objectRef}::`;
+	for (const cacheKey of fieldPolicyCache.keys()) if (cacheKey.startsWith(keyPrefix)) fieldPolicyCache.delete(cacheKey);
+}
+function clearFieldPolicyCache() {
+	fieldPolicyCache.clear();
+}
+//#endregion
+//#region src/field-definitions.ts
+function requireRegisteredObject(objectRef) {
+	if (!objectRef?.includes(":")) throw new Error(`Field policy objectRef must be a qualified class name ("@package/name:ClassName"), got "${objectRef}"`);
+	if (!ObjectRegistry.getClassByQualifiedName(objectRef)) throw new Error(`Unknown field policy objectRef "${objectRef}": no class with that qualified name is registered`);
+}
+async function getObjectFieldMap(objectRef) {
+	requireRegisteredObject(objectRef);
+	return ObjectRegistry.getAllFields(objectRef);
+}
+function sanitizeFieldUIHints(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return;
+	const raw = value;
+	const ui = {
+		...typeof raw.basic === "boolean" ? { basic: raw.basic } : {},
+		...typeof raw.group === "string" ? { group: raw.group } : {},
+		...typeof raw.order === "number" && Number.isFinite(raw.order) ? { order: raw.order } : {},
+		...typeof raw.locked === "boolean" ? { locked: raw.locked } : {}
+	};
+	return Object.keys(ui).length > 0 ? ui : void 0;
+}
+function isSensitiveField(field) {
+	return field.sensitive === true || field._meta?.sensitive === true;
+}
+function getFieldReadPermission(field) {
+	if (typeof field.readPermission === "string") return field.readPermission;
+	const metaPermission = field._meta?.readPermission;
+	return typeof metaPermission === "string" ? metaPermission : void 0;
+}
+function isTransientField(field) {
+	return field.transient === true || field._meta?.transient === true;
+}
+function isPolicyAddressableField(field) {
+	return field._meta?.__smrtSystemField !== true && field.type !== "oneToMany" && field.type !== "manyToMany" && field.type !== "meta";
+}
+function isRequiredField(field) {
+	if (field.nullable === true || field._meta?.nullable === true) return false;
+	return field.required === true || field._meta?.required === true;
+}
+function getCodeDefault(field) {
+	if (field.default !== void 0) return { value: field.default };
+	if (field._meta?.default !== void 0) return { value: field._meta.default };
+}
+function isUsableRequiredDefault(defaultBox) {
+	if (!defaultBox) return false;
+	return defaultBox.value !== null && defaultBox.value !== "";
+}
+function buildCodeSeedVisibility(fields) {
+	let hasBasicMarkers = false;
+	const hints = /* @__PURE__ */ new Map();
+	for (const [name, field] of fields) {
+		const ui = sanitizeFieldUIHints(field._meta?.ui);
+		hints.set(name, ui);
+		if (ui?.basic === true) hasBasicMarkers = true;
+	}
+	const visibility = /* @__PURE__ */ new Map();
+	for (const [name] of fields) {
+		const ui = hints.get(name);
+		if (ui?.basic === true) visibility.set(name, "basic");
+		else if (ui?.basic === false || hasBasicMarkers) visibility.set(name, "advanced");
+		else visibility.set(name, "basic");
+	}
+	return visibility;
+}
+function buildCodeSeedDelta(field, visibility) {
+	const ui = sanitizeFieldUIHints(field._meta?.ui);
+	const help = typeof field.description === "string" ? field.description : typeof field._meta?.description === "string" ? field._meta.description : void 0;
+	const codeDefault = getCodeDefault(field);
+	return {
+		...codeDefault ? { default: codeDefault } : {},
+		visibility,
+		...help !== void 0 ? { help } : {},
+		...ui?.order !== void 0 ? { order: ui.order } : {},
+		...ui?.locked === true ? { locked: true } : {}
+	};
+}
+function getCodeSeedGroup(field) {
+	return sanitizeFieldUIHints(field._meta?.ui)?.group ?? null;
+}
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function usesTextIdStorage(field) {
+	return field.idType === "text" || field._meta?.idType === "text";
+}
+function isStorableReferenceId(field, value) {
+	if (typeof value !== "string" || value === "") return false;
+	return usesTextIdStorage(field) || UUID_PATTERN.test(value);
+}
+function assertDefaultValueMatchesFieldType(objectRef, fieldName, field, value) {
+	const label = `Field policy default for "${objectRef}.${fieldName}"`;
+	if (value === null) {
+		if (isRequiredField(field)) throw new Error(`${label} may not be null: the field is required, so a null default is never a usable default`);
+		return;
+	}
+	switch (field.type) {
+		case "text":
+			if (typeof value !== "string") throw new Error(`${label} must be a string (field type "text")`);
+			return;
+		case "integer":
+			if (typeof value !== "number" || !Number.isInteger(value)) throw new Error(`${label} must be an integer (field type "integer")`);
+			return;
+		case "decimal":
+			if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${label} must be a finite number (field type "decimal")`);
+			return;
+		case "boolean":
+			if (typeof value !== "boolean") throw new Error(`${label} must be a boolean (field type "boolean")`);
+			return;
+		case "datetime":
+			if (typeof value !== "string" || Number.isNaN(Date.parse(value))) throw new Error(`${label} must be a date-parseable string (field type "datetime")`);
+			return;
+		case "json": return;
+		case "foreignKey":
+		case "crossPackageRef":
+			if (typeof value !== "string") throw new Error(`${label} must be a string id (field type "${field.type}")`);
+			if (!isStorableReferenceId(field, value)) throw new Error(`${label} must be a UUID string (the reference column stores native UUIDs; declare idType 'text' on the field to store arbitrary ids)`);
+			return;
+		default: throw new Error(`${label} is not supported: defaults cannot target "${String(field.type)}" fields`);
+	}
+}
+//#endregion
+//#region src/models/FieldPolicy.ts
+var __defProp$1 = Object.defineProperty;
+var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __decorateClass$1 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$1(target, key, result);
+	return result;
+};
+ensureFieldPolicyPermissionsRegistered();
+var FIELD_POLICY_SCOPE_DENIAL_MESSAGE = "Field policy scope is not permitted for this principal.";
+function getFieldPolicyAmbientContext() {
+	const tenantContext = getCurrentTenant();
+	if (tenantContext) return {
+		permissions: tenantContext.permissions,
+		superAdminBypass: isSuperAdminBypass(),
+		tenantId: tenantContext.tenantId,
+		userId: tenantContext.userId
+	};
+	const sessionContext = getCurrentSessionPermissionContext();
+	if (!sessionContext?.tenantId) return;
+	return {
+		permissions: sessionContext.permissionSet,
+		superAdminBypass: sessionContext.superAdminBypass,
+		tenantId: sessionContext.tenantId,
+		userId: sessionContext.userId ?? void 0
+	};
+}
+var FieldPolicyAuthorizationError = class extends Error {
+	code = "permission_denied";
+	status = 403;
+	constructor(message) {
+		super(message);
+		this.name = "FieldPolicyAuthorizationError";
+	}
+};
+var FieldPolicyTenantIsolationError = class extends TenantIsolationError {
+	publicMessage = FIELD_POLICY_SCOPE_DENIAL_MESSAGE;
+	status = 403;
+	constructor(diagnosticMessage, details) {
+		super(FIELD_POLICY_SCOPE_DENIAL_MESSAGE);
+		Object.defineProperty(this, "cause", {
+			configurable: true,
+			enumerable: false,
+			value: new Error(diagnosticMessage),
+			writable: false
+		});
+		Object.defineProperty(this, "diagnostic", {
+			configurable: true,
+			enumerable: false,
+			value: {
+				...details,
+				message: diagnosticMessage
+			},
+			writable: false
+		});
+	}
+};
+var FieldPolicy = class extends SmrtObject {
+	objectRef = "";
+	fieldName = "";
+	scopeType = "app";
+	tenantId = null;
+	userId = null;
+	scopeKey = "";
+	defaultValue = null;
+	visibility = null;
+	help = null;
+	label = null;
+	displayOrder = null;
+	locked = null;
+	updatedBy = null;
+	constructor(options = {}) {
+		super(options);
+		if (options.objectRef !== void 0) this.objectRef = options.objectRef;
+		if (options.fieldName !== void 0) this.fieldName = options.fieldName;
+		if (options.scopeType !== void 0) this.scopeType = options.scopeType;
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.userId !== void 0) this.userId = options.userId;
+		if (options.defaultValue !== void 0 && options.defaultValueRaw !== void 0) throw new Error("FieldPolicy accepts either defaultValue (already JSON-encoded) or defaultValueRaw (a plain value to serialize), not both");
+		if (options.defaultValueRaw !== void 0) this.setDefaultValue(options.defaultValueRaw);
+		else if (options.defaultValue !== void 0) this.defaultValue = options.defaultValue;
+		if (options.visibility !== void 0) this.visibility = options.visibility;
+		if (options.help !== void 0) this.help = options.help;
+		if (options.label !== void 0) this.label = options.label;
+		if (options.displayOrder !== void 0) this.displayOrder = options.displayOrder;
+		if (options.locked !== void 0) this.locked = options.locked;
+		if (options.updatedBy !== void 0) this.updatedBy = options.updatedBy;
+	}
+	/** Parse the stored JSON default. `undefined` = no stored default (inherit). */
+	getDefaultValue() {
+		if (this.defaultValue === null || this.defaultValue === void 0) return;
+		try {
+			return JSON.parse(this.defaultValue);
+		} catch {
+			return;
+		}
+	}
+	/** Serialize a default value; `undefined` clears the override (inherit). */
+	setDefaultValue(value) {
+		this.defaultValue = value === void 0 ? null : JSON.stringify(value);
+	}
+	async save() {
+		this.attributeScopeToAmbientContext();
+		const previousIdentity = await this.getPersistedIdentity();
+		if (previousIdentity) {
+			this.assertScopeOwnedByAmbientContext(previousIdentity, "save");
+			await this.assertScopePermission(previousIdentity);
+		}
+		this.assertScopeOwnedByAmbientContext(this, "save");
+		await this.assertScopePermission(this);
+		const ambientContext = getFieldPolicyAmbientContext();
+		if (ambientContext) this.updatedBy = ambientContext.userId ?? null;
+		this.normalizeDefaultValueForPersistence();
+		await this.validateFieldPolicy(previousIdentity);
+		this.scopeKey = this.computeScopeKey();
+		const identityChanged = previousIdentity && (previousIdentity.objectRef !== this.objectRef || previousIdentity.fieldName !== this.fieldName || previousIdentity.scopeType !== this.scopeType || previousIdentity.scopeKey !== this.scopeKey);
+		const result = identityChanged && previousIdentity ? await this.saveAfterIdentityChange() : await super.save();
+		if (identityChanged && previousIdentity) invalidateFieldPolicyCache(previousIdentity.objectRef, this.db);
+		invalidateFieldPolicyCache(this.objectRef, this.db);
+		return result;
+	}
+	async saveAfterIdentityChange() {
+		if (typeof this.db.beginTransaction === "function") return this.saveAfterIdentityChangeInTransaction();
+		return this.saveAfterIdentityChangeWithDeferredDelete();
+	}
+	async saveAfterIdentityChangeInTransaction() {
+		const originalDb = this._db;
+		const originalOptionsDb = this.options.db;
+		const tx = await this.db.beginTransaction?.();
+		if (!tx) return this.saveAfterIdentityChangeWithDeferredDelete();
+		try {
+			this._db = tx;
+			this.options.db = tx;
+			await super.delete();
+			const result = await super.save();
+			await tx.commit();
+			return result;
+		} catch (error) {
+			try {
+				await tx.rollback();
+			} catch {}
+			throw error;
+		} finally {
+			this._db = originalDb;
+			this.options.db = originalOptionsDb;
+		}
+	}
+	async saveAfterIdentityChangeWithDeferredDelete() {
+		const previousId = this.id;
+		if (!previousId) return super.save();
+		const replacementId = crypto.randomUUID();
+		let replacementSaved = false;
+		this.id = replacementId;
+		try {
+			const result = await super.save();
+			replacementSaved = true;
+			await this.db.delete(this.tableName, { id: previousId });
+			return result;
+		} catch (error) {
+			if (replacementSaved) try {
+				await this.db.delete(this.tableName, { id: replacementId });
+			} catch {}
+			this.id = previousId;
+			throw error;
+		}
+	}
+	async delete() {
+		const persisted = await this.getPersistedIdentity();
+		if (persisted) this.assertScopeOwnedByAmbientContext(persisted, "delete");
+		await this.assertScopePermission(persisted ?? this);
+		const objectRef = persisted?.objectRef ?? this.objectRef;
+		await super.delete();
+		invalidateFieldPolicyCache(objectRef, this.db);
+		if (this.objectRef && this.objectRef !== objectRef) invalidateFieldPolicyCache(this.objectRef, this.db);
+	}
+	async validateFieldPolicy(previousIdentity) {
+		if (!this.objectRef || this.objectRef.trim() === "") throw new Error("FieldPolicy.objectRef is required");
+		if (!this.fieldName || this.fieldName.trim() === "") throw new Error("FieldPolicy.fieldName is required");
+		if (!FIELD_POLICY_SCOPE_TYPES.includes(this.scopeType)) throw new Error(`FieldPolicy.scopeType must be one of ${FIELD_POLICY_SCOPE_TYPES.join(", ")}; got "${this.scopeType}"`);
+		if (this.visibility !== null && !FIELD_POLICY_VISIBILITIES.includes(this.visibility)) throw new Error(`FieldPolicy.visibility must be null or one of ${FIELD_POLICY_VISIBILITIES.join(", ")}; got "${this.visibility}"`);
+		if (this.displayOrder !== null && (typeof this.displayOrder !== "number" || !Number.isInteger(this.displayOrder))) throw new Error("FieldPolicy.displayOrder must be null or an integer");
+		this.validateScopeConsistency();
+		this.validateTenantContextBoundary();
+		const fieldDef = (await getObjectFieldMap(this.objectRef)).get(this.fieldName);
+		if (!fieldDef) throw new Error(`Unknown field "${this.fieldName}" on "${this.objectRef}"`);
+		if (fieldDef._meta?.__smrtSystemField === true) throw new Error(`Field "${this.fieldName}" on "${this.objectRef}" is a framework system field and is not policy-addressable`);
+		if (fieldDef.type === "oneToMany" || fieldDef.type === "manyToMany") throw new Error(`Field "${this.fieldName}" on "${this.objectRef}" is a relationship pseudo-field and is not policy-addressable`);
+		if (fieldDef.type === "meta") throw new Error(`Field "${this.fieldName}" on "${this.objectRef}" is STI meta storage and is not policy-addressable`);
+		if (this.locked !== null && this.scopeType === "user") throw new Error("FieldPolicy.locked may only be set on org rows (app or tenant scope)");
+		if (this.defaultValue !== null) {
+			this.validateDefaultAgainstSecurityRail(fieldDef);
+			const parsed = this.parseDefaultValueOrThrow();
+			assertDefaultValueMatchesFieldType(this.objectRef, this.fieldName, fieldDef, parsed);
+		}
+		const demotesRequiredField = (this.visibility === "advanced" || this.visibility === "hidden") && isRequiredField(fieldDef);
+		const ownDefault = demotesRequiredField && this.defaultValue !== null ? { value: this.parseDefaultValueOrThrow() } : void 0;
+		const needsOrgDefault = demotesRequiredField && !isUsableRequiredDefault(ownDefault);
+		const needsLockCheck = this.scopeType === "user";
+		if (needsOrgDefault || needsLockCheck) {
+			const orgPolicy = await this.resolveOrgTierFieldPolicy(previousIdentity);
+			if (needsOrgDefault) {
+				if (!isUsableRequiredDefault(orgPolicy?.hasDefault ? { value: orgPolicy.defaultValue } : void 0)) throw new Error(`Cannot set visibility "${this.visibility}" for required field "${this.objectRef}.${this.fieldName}": no resolved default exists at or below this layer`);
+			}
+			if (needsLockCheck && orgPolicy?.locked) throw new FieldPolicyAuthorizationError(`Field "${this.objectRef}.${this.fieldName}" is locked by org policy; user-scope overrides are not allowed`);
+		}
+	}
+	/**
+	* Effective org-tier (code → app → tenant hierarchy) policy for this row's
+	* field, computed by the RESOLVER so write-time checks share the one
+	* precedence implementation — including ancestor-tenant cascades via the
+	* default hierarchy loader. The chain tenant is the row's own tenant for
+	* tenant-scope rows, the ambient context tenant for user-scope rows, and
+	* none for app-scope rows (their only lower layer is the code seed).
+	*
+	* During an update, the persisted row is excluded from the lower-layer
+	* projection. That makes a clear-default + required-field demotion validate
+	* the post-write policy rather than accidentally counting the row being
+	* replaced.
+	*/
+	async resolveOrgTierFieldPolicy(previousIdentity) {
+		const tenantIdForChain = this.scopeType === "tenant" ? this.tenantId : this.scopeType === "user" ? getFieldPolicyAmbientContext()?.tenantId ?? null : null;
+		const { resolveFieldPolicy } = await import("../index.js").then((n) => n.t);
+		return (await resolveFieldPolicy(this.objectRef, {
+			tenantId: tenantIdForChain,
+			db: this.options.db ?? this.options.persistence,
+			...previousIdentity ? { excludePolicyIds: /* @__PURE__ */ new Set([previousIdentity.id]) } : {}
+		})).fields[this.fieldName];
+	}
+	/**
+	* Exactly-one-owner scope shape: app rows carry neither id, tenant rows
+	* carry only `tenantId`, user rows carry only `userId` (the user tier is
+	* keyed by user alone so preferences follow the user across tenants).
+	*/
+	validateScopeConsistency() {
+		if (this.scopeType === "app") {
+			if (this.tenantId !== null || this.userId !== null) throw new Error("App-scope field policy rows must have tenantId and userId null");
+			return;
+		}
+		if (this.scopeType === "tenant") {
+			if (!this.tenantId || this.userId !== null) throw new Error("Tenant-scope field policy rows must set tenantId and leave userId null");
+			return;
+		}
+		if (!this.userId || this.tenantId !== null) throw new Error("User-scope field policy rows must set userId and leave tenantId null");
+	}
+	/** `userId ?? tenantId ?? '__app__'` — the `conflictColumns` scope key. */
+	computeScopeKey() {
+		return this.userId ?? this.tenantId ?? "__app__";
+	}
+	/**
+	* Derive a scope-owner column the transport could not carry (#2047).
+	*
+	* Core's mass-assignment guard treats `tenantId` as server-managed and
+	* strips it from EVERY generated create/update body, and `FieldPolicy` is
+	* deliberately not `@TenantScoped`, so the tenancy interceptor never
+	* repopulates it. A `POST {scopeType:'tenant', tenantId}` therefore always
+	* reached `validateScopeConsistency` with `tenantId === null`, making the
+	* org tier write-dead over every generated surface — the model, as the
+	* single validation authority for these rows, fills it in instead.
+	*
+	* This grants nothing: `assertScopeOwnedByAmbientContext` already requires
+	* a non-bypass caller's tenant/user rows to name exactly the ambient
+	* tenant/user, so the derived value is the ONLY value that could ever have
+	* been accepted. An explicit value is never overwritten (a super-admin
+	* bypass caller keeps naming other scopes), and with neither tenancy nor
+	* authenticated-session context nothing is derived — scope-shape validation
+	* rejects the row as before.
+	* Consequence: a bypass caller writing ANOTHER tenant's row must pass
+	* `tenantId` through a server-side model call, because the generated routes
+	* still strip it.
+	*/
+	attributeScopeToAmbientContext() {
+		const context = getFieldPolicyAmbientContext();
+		if (!context) return;
+		if (this.scopeType === "tenant" && this.tenantId === null) this.tenantId = context.tenantId;
+		if (this.scopeType === "user" && this.userId === null) this.userId = context.userId ?? null;
+	}
+	/**
+	* Fail-closed write boundary against the ambient tenant context, applied to
+	* the NEW scope on save and to the PERSISTED scope on save/delete of an
+	* existing row.
+	*
+	* With NO ambient identity at all (neither tenant ALS nor authenticated
+	* session-permission ALS), only app-scope rows are accepted: tenant- and
+	* user-scope rows are unattributable without a context, so they are
+	* rejected outright rather than allowed by default. Inside a non-bypass
+	* context, a caller may only touch rows for its own tenant, and user rows
+	* only for its own user id — a context that carries NO user id may not
+	* touch the user tier at all.
+	* App-wide rows then require super-admin bypass (or a context-less/system
+	* caller).
+	*
+	* Package rule: a missing identity component DENIES, it never skips.
+	*/
+	assertScopeOwnedByAmbientContext(scope, operation) {
+		const context = getFieldPolicyAmbientContext();
+		if (!context) {
+			if (scope.scopeType === "tenant" || scope.scopeType === "user") throw new FieldPolicyTenantIsolationError(`${scope.scopeType === "tenant" ? "Tenant" : "User"}-scope field policy ${operation}s require an ambient tenant context (or super-admin bypass); without one the caller identity is unattributable`);
+			return;
+		}
+		if (context.superAdminBypass) return;
+		if (scope.scopeType === "app") throw new FieldPolicyTenantIsolationError(`App-scope field policy ${operation}s are not allowed inside a tenant context (use a system context or super-admin bypass)`, { tenantId: context.tenantId });
+		if (scope.scopeType === "tenant" && scope.tenantId !== context.tenantId) throw new FieldPolicyTenantIsolationError(`Tenant isolation violation in FieldPolicy.${operation}: context tenant is '${context.tenantId}' but the row belongs to '${scope.tenantId}'`, {
+			tenantId: context.tenantId,
+			attemptedTenantId: scope.tenantId ?? void 0
+		});
+		if (scope.scopeType === "user") {
+			if (context.userId === void 0) throw new FieldPolicyTenantIsolationError(`User-scope field policy ${operation}s require an ambient context that carries a user id; this context cannot attribute a user-scope write`, { tenantId: context.tenantId });
+			if (scope.userId !== context.userId) throw new FieldPolicyTenantIsolationError(`Tenant isolation violation in FieldPolicy.${operation}: context user is '${context.userId}' but the row belongs to '${scope.userId}'`, { tenantId: context.tenantId });
+		}
+	}
+	validateTenantContextBoundary() {
+		this.assertScopeOwnedByAmbientContext({
+			scopeType: this.scopeType,
+			tenantId: this.tenantId,
+			userId: this.userId
+		}, "save");
+	}
+	/**
+	* Permission boundary for policy mutations. Scope ownership is checked
+	* separately (and first) because permission never grants cross-tenant or
+	* cross-user access. Existing rows are checked against their persisted
+	* scope before an identity-changing save can mutate or delete them.
+	*/
+	async assertScopePermission(scope) {
+		const context = getFieldPolicyAmbientContext();
+		const [, , operation] = (scope.scopeType === "user" ? PERSONALIZE_FIELD_POLICY_PERMISSION : MANAGE_FIELD_POLICY_PERMISSION).split(".");
+		await assertOperationPermission({
+			collection: "fields.policy",
+			action: operation ?? "manage",
+			db: this.options.db ?? this.options.persistence,
+			tenantId: context?.tenantId ?? null,
+			userId: context?.userId ?? null,
+			permissionSet: context?.permissions
+		});
+	}
+	validateDefaultAgainstSecurityRail(fieldDef) {
+		if (isTransientField(fieldDef)) throw new Error(`Cannot store a default for transient field "${this.objectRef}.${this.fieldName}"`);
+		if (isSensitiveField(fieldDef)) throw new Error(`Cannot store a default for sensitive field "${this.objectRef}.${this.fieldName}"`);
+		const readPermission = getFieldReadPermission(fieldDef);
+		if (readPermission) throw new Error(`Cannot store a default for read-permission-gated field "${this.objectRef}.${this.fieldName}" (requires "${readPermission}")`);
+	}
+	parseDefaultValueOrThrow() {
+		try {
+			return JSON.parse(this.defaultValue);
+		} catch (error) {
+			throw new Error(`FieldPolicy default for "${this.objectRef}.${this.fieldName}" is not valid JSON: ${error instanceof Error ? error.message : String(error)}. The "defaultValue" option is the already-encoded channel; pass a plain value as "defaultValueRaw" (or call setDefaultValue()).`);
+		}
+	}
+	/**
+	* The persisted row this save/delete would replace, looked up by primary
+	* key and — when that misses — by the NATURAL key.
+	*
+	* The natural-key fallback is load-bearing for authorization: every
+	* generated create arrives with a freshly minted UUID, so a primary-key
+	* lookup always misses, yet the `conflictColumns` upsert still overwrites
+	* whatever row already occupies `(objectRef, fieldName, scopeType,
+	* scopeKey)`. Authorizing on the primary key alone therefore skipped the
+	* persisted-scope guard on exactly the path that can replace an existing
+	* row's contents.
+	*/
+	async getPersistedIdentity() {
+		const existing = await this.getPersistedRowById() ?? await this.getPersistedRowByNaturalKey();
+		if (!existing) return null;
+		const row = existing;
+		const read = (camel, snake, fallback) => {
+			if (row[camel] !== void 0 && row[camel] !== null) return String(row[camel]);
+			if (row[snake] !== void 0 && row[snake] !== null) return String(row[snake]);
+			return fallback;
+		};
+		const readNullable = (camel, snake) => {
+			const value = row[camel] !== void 0 ? row[camel] : row[snake];
+			return value === void 0 || value === null ? null : String(value);
+		};
+		return {
+			id: read("id", "id", String(this.id ?? "")),
+			objectRef: read("objectRef", "object_ref", this.objectRef),
+			fieldName: read("fieldName", "field_name", this.fieldName),
+			scopeType: read("scopeType", "scope_type", this.scopeType),
+			scopeKey: read("scopeKey", "scope_key", this.scopeKey),
+			tenantId: readNullable("tenantId", "tenant_id"),
+			userId: readNullable("userId", "user_id")
+		};
+	}
+	async getPersistedRowById() {
+		if (!this.id) return null;
+		return await this.db.get(this.tableName, { id: this.id }) ?? null;
+	}
+	/**
+	* The row occupying this row's `conflictColumns` tuple, if any. Column
+	* names are the physical snake_case ones: this reads the driver directly
+	* rather than through a collection (the model has no collection handle).
+	*/
+	async getPersistedRowByNaturalKey() {
+		if (!this.objectRef || !this.fieldName) return null;
+		return await this.db.get(this.tableName, {
+			object_ref: this.objectRef,
+			field_name: this.fieldName,
+			scope_type: this.scopeType,
+			scope_key: this.computeScopeKey()
+		}) ?? null;
+	}
+	normalizeDefaultValueForPersistence() {
+		const raw = this.defaultValue;
+		if (raw === null || raw === void 0) {
+			this.defaultValue = null;
+			return;
+		}
+		if (typeof raw === "string") {
+			this.defaultValue = raw;
+			return;
+		}
+		this.defaultValue = JSON.stringify(raw);
+	}
+};
+__decorateClass$1([field({ required: true })], FieldPolicy.prototype, "objectRef", 2);
+__decorateClass$1([field({ required: true })], FieldPolicy.prototype, "fieldName", 2);
+__decorateClass$1([field({ required: true })], FieldPolicy.prototype, "scopeType", 2);
+__decorateClass$1([tenantId({ nullable: true })], FieldPolicy.prototype, "tenantId", 2);
+__decorateClass$1([crossPackageRef("@happyvertical/smrt-users:User", { nullable: true })], FieldPolicy.prototype, "userId", 2);
+__decorateClass$1([field({
+	type: "text",
+	required: true
+})], FieldPolicy.prototype, "scopeKey", 2);
+__decorateClass$1([field({
+	type: "text",
+	nullable: true
+})], FieldPolicy.prototype, "defaultValue", 2);
+__decorateClass$1([field({
+	type: "text",
+	nullable: true
+})], FieldPolicy.prototype, "visibility", 2);
+__decorateClass$1([field({
+	type: "text",
+	nullable: true
+})], FieldPolicy.prototype, "help", 2);
+__decorateClass$1([field({
+	type: "text",
+	nullable: true
+})], FieldPolicy.prototype, "label", 2);
+__decorateClass$1([field({
+	type: "integer",
+	nullable: true
+})], FieldPolicy.prototype, "displayOrder", 2);
+__decorateClass$1([field({
+	type: "boolean",
+	nullable: true
+})], FieldPolicy.prototype, "locked", 2);
+__decorateClass$1([crossPackageRef("@happyvertical/smrt-users:User", { nullable: true })], FieldPolicy.prototype, "updatedBy", 2);
+FieldPolicy = __decorateClass$1([smrt({
+	tableName: "_smrt_field_policies",
+	conflictColumns: [
+		"object_ref",
+		"field_name",
+		"scope_type",
+		"scope_key"
+	],
+	api: {
+		include: [
+			"create",
+			"update",
+			"delete"
+		],
+		principalContext: true
+	},
+	cli: {
+		include: [
+			"create",
+			"update",
+			"delete"
+		],
+		exclude: ["getDefaultValue", "setDefaultValue"]
+	},
+	mcp: { include: [] }
+})], FieldPolicy);
+//#endregion
+//#region src/collections/FieldPolicyCollection.ts
+var FieldPolicyCollection_exports = /* @__PURE__ */ __exportAll({
+	FieldPolicyCollection: () => FieldPolicyCollection,
+	MAX_FIELD_POLICY_AUDIT_COUNT_REFS: () => 200,
+	MAX_FIELD_POLICY_AUDIT_OBJECT_REFS: () => 100
+});
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp(target, key, result);
+	return result;
+};
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var MAX_BATCH_OBJECT_REFS = 100;
+MAX_BATCH_OBJECT_REFS * 2;
+var FieldPolicyCollection = class extends SmrtCollection {
+	/**
+	* Permission-gated, tenant-scoped audit read for the defaults control
+	* panel. It returns editable own-tenant rows, read-only app summaries,
+	* projected user override counts, and identity-only manifest drift rows.
+	*/
+	async policyAudit(options = {}) {
+		const objectRefs = normalizeAuditRefs(options.objectRefs, "objectRefs", 100);
+		const countObjectRefs = normalizeAuditRefs(options.countObjectRefs ?? objectRefs, "countObjectRefs", 200);
+		const context = getCurrentTenant();
+		const tenantId = context?.tenantId ?? null;
+		const userId = context?.userId ?? null;
+		const permissionOptions = {
+			collection: "fields.policy",
+			db: this.db,
+			tenantId,
+			userId,
+			permissionSet: context?.permissions,
+			onDeny: "return"
+		};
+		const manage = tenantId ? await checkOperationPermission({
+			...permissionOptions,
+			action: "fields.policy.manage".split(".").at(-1) ?? "manage"
+		}) : { allowed: false };
+		const personalize = userId ? await checkOperationPermission({
+			...permissionOptions,
+			action: "fields.policy.personalize".split(".").at(-1) ?? "personalize"
+		}) : { allowed: false };
+		const caller = {
+			tenantId,
+			userId,
+			canManageOrg: manage.allowed,
+			canPersonalize: personalize.allowed && userId !== null
+		};
+		if (!caller.canManageOrg || tenantId === null) return emptyAudit(caller);
+		if (options.summaryOnly === true) return emptyAudit(caller);
+		const fieldMaps = /* @__PURE__ */ new Map();
+		const fieldMapFor = (objectRef) => {
+			let loaded = fieldMaps.get(objectRef);
+			if (!loaded) {
+				loaded = getObjectFieldMap(objectRef).catch(() => null);
+				fieldMaps.set(objectRef, loaded);
+			}
+			return loaded;
+		};
+		const classify = async (row) => {
+			const fields = await fieldMapFor(row.objectRef);
+			if (!fields) return "unknown-object";
+			const definition = fields.get(row.fieldName);
+			if (!definition) return "unknown-field";
+			if (isSensitiveField(definition) || getFieldReadPermission(definition) !== void 0 || isTransientField(definition)) return "gated";
+			return isPolicyAddressableField(definition) ? "ok" : "excluded-field";
+		};
+		const [appRows, orgRows, ownUserRows] = objectRefs.length ? await Promise.all([
+			this.list({ where: {
+				scopeType: "app",
+				"objectRef in": objectRefs
+			} }),
+			this.list({ where: {
+				scopeType: "tenant",
+				tenantId,
+				"objectRef in": objectRefs
+			} }),
+			userId ? this.list({ where: {
+				scopeType: "user",
+				userId,
+				"objectRef in": objectRefs
+			} }) : Promise.resolve([])
+		]) : [
+			[],
+			[],
+			[]
+		];
+		const audit = {
+			...emptyAudit(caller),
+			policies: options.countsOnly ? {} : await this.resolveAuditPolicies(objectRefs, tenantId, fieldMapFor)
+		};
+		const append = async (row, target, driftPrunable) => {
+			const state = await classify(row);
+			if (state === "ok") target.push(toAuditRow(row));
+			else if (state !== "gated") audit.driftRows.push({
+				...toDriftIdentity(row),
+				reason: state,
+				prunable: driftPrunable
+			});
+		};
+		for (const row of orgRows) await append(row, audit.orgRows, true);
+		for (const row of appRows) await append(row, audit.appRows, isSuperAdminBypass());
+		for (const row of ownUserRows) {
+			const state = await classify(row);
+			if (state !== "ok" && state !== "gated") audit.driftRows.push({
+				...toDriftIdentity(row),
+				reason: state,
+				prunable: caller.canPersonalize
+			});
+		}
+		if (options.includeDrift === true) {
+			const [driftAppRows, driftOrgRows, driftUserRows] = await Promise.all([
+				this.list({
+					where: { scopeType: "app" },
+					limit: 100
+				}),
+				this.list({
+					where: {
+						scopeType: "tenant",
+						tenantId
+					},
+					limit: 100
+				}),
+				userId ? this.list({
+					where: {
+						scopeType: "user",
+						userId
+					},
+					limit: 100
+				}) : Promise.resolve([])
+			]);
+			const knownIds = new Set([
+				...appRows,
+				...orgRows,
+				...ownUserRows
+			].map((row) => String(row.id)));
+			for (const [rows, prunable] of [
+				[driftAppRows, isSuperAdminBypass()],
+				[driftOrgRows, true],
+				[driftUserRows, caller.canPersonalize]
+			]) for (const row of rows) {
+				if (knownIds.has(String(row.id))) continue;
+				const state = await classify(row);
+				if (state !== "ok" && state !== "gated") audit.driftRows.push({
+					...toDriftIdentity(row),
+					reason: state,
+					prunable
+				});
+			}
+		}
+		const memberships = await MembershipCollection.create({ db: this.db });
+		const memberIds = [...new Set((await memberships.findActiveByTenant(tenantId)).map((membership) => membership.userId?.trim()).filter((id) => Boolean(id)))];
+		const projected = countObjectRefs.length && memberIds.length ? await this.list({
+			where: {
+				scopeType: "user",
+				"objectRef in": countObjectRefs,
+				"userId in": memberIds
+			},
+			select: ["objectRef", "fieldName"]
+		}) : [];
+		for (const row of projected) {
+			if (await classify(row) !== "ok") continue;
+			const byField = audit.userOverrideCounts[row.objectRef] ?? {};
+			audit.userOverrideCounts[row.objectRef] = byField;
+			byField[row.fieldName] = (byField[row.fieldName] ?? 0) + 1;
+		}
+		const { resolveSurvivingTenantChainIds } = await import("../index.js").then((n) => n.t);
+		const ancestorIds = (await resolveSurvivingTenantChainIds(tenantId, { db: this.db })).filter((id) => id !== tenantId);
+		if (ancestorIds.length && objectRefs.length) {
+			const ancestors = await this.list({ where: {
+				scopeType: "tenant",
+				"tenantId in": ancestorIds,
+				"objectRef in": objectRefs
+			} });
+			for (const row of ancestors) {
+				if (await classify(row) !== "ok") continue;
+				const names = audit.inheritedOrgKeys[row.objectRef] ?? [];
+				audit.inheritedOrgKeys[row.objectRef] = names;
+				if (!names.includes(row.fieldName)) names.push(row.fieldName);
+			}
+		}
+		audit.orgRows.sort(sortAuditRows);
+		audit.appRows.sort(sortAuditRows);
+		audit.driftRows.sort(sortDriftRows);
+		for (const names of Object.values(audit.inheritedOrgKeys)) names.sort();
+		return audit;
+	}
+	async resolveAuditPolicies(objectRefs, tenantId, fieldMapFor) {
+		const { resolveFieldPolicyExplained } = await import("../index.js").then((n) => n.t);
+		const policies = {};
+		for (const objectRef of objectRefs) {
+			if (!await fieldMapFor(objectRef)) continue;
+			const resolved = await resolveFieldPolicyExplained(objectRef, {
+				tenantId,
+				db: this.db
+			});
+			policies[objectRef] = await this.gateExplainedForEditorResponse(resolved, {
+				manage: true,
+				personalize: false
+			}, true);
+		}
+		return policies;
+	}
+	/** All app-scope rows for an object, keyed by field name. */
+	async getAppRows(objectRef) {
+		const rows = await this.list({ where: {
+			objectRef,
+			scopeType: "app"
+		} });
+		const byField = /* @__PURE__ */ new Map();
+		for (const row of rows) byField.set(row.fieldName, row);
+		return byField;
+	}
+	/**
+	* All tenant-scope rows for an object across a tenant chain, keyed
+	* `tenantId → fieldName → row`.
+	*/
+	async getTenantRows(objectRef, tenantIds) {
+		const byTenant = /* @__PURE__ */ new Map();
+		if (tenantIds.length === 0) return byTenant;
+		const rows = await this.list({ where: {
+			objectRef,
+			scopeType: "tenant",
+			"tenantId in": tenantIds
+		} });
+		for (const row of rows) {
+			if (!row.tenantId) continue;
+			let byField = byTenant.get(row.tenantId);
+			if (!byField) {
+				byField = /* @__PURE__ */ new Map();
+				byTenant.set(row.tenantId, byField);
+			}
+			byField.set(row.fieldName, row);
+		}
+		return byTenant;
+	}
+	/** All user-scope rows for an object and user, keyed by field name. */
+	async getUserRows(objectRef, userId) {
+		const rows = await this.list({ where: {
+			objectRef,
+			scopeType: "user",
+			userId
+		} });
+		const byField = /* @__PURE__ */ new Map();
+		for (const row of rows) byField.set(row.fieldName, row);
+		return byField;
+	}
+	/**
+	* Resolve merged field policy for a set of objectRefs for the CURRENT
+	* caller, gated for public consumption.
+	*
+	* Caller identity comes exclusively from the ambient tenant context
+	* (established by the app's auth hook, e.g. smrt-users' session context) —
+	* the request body cannot select another tenant or user (fail closed).
+	* Server-side consumers wanting explicit identities call
+	* `resolveFieldPolicy()` directly instead.
+	*
+	* Field gating mirrors the REST serializer's derivation (`sensitive` /
+	* `readPermission` read from both the top level and `_meta`): sensitive and
+	* read-permission-gated fields are ABSENT from the response for every
+	* caller (the generated action route cannot convey per-caller grants to
+	* this method, so gated fields fail closed), and transient fields are
+	* stripped for parity with generated client field definitions.
+	*/
+	async resolveBatch(options = {}) {
+		const rawRefs = options.objectRefs;
+		if (!Array.isArray(rawRefs) || rawRefs.length === 0) throw new Error("resolveBatch requires a non-empty \"objectRefs\" string array");
+		if (rawRefs.some((ref) => typeof ref !== "string" || ref.trim() === "")) throw new Error("resolveBatch objectRefs must be non-empty strings");
+		const objectRefs = [...new Set(rawRefs)];
+		if (objectRefs.length > MAX_BATCH_OBJECT_REFS) throw new Error(`resolveBatch accepts at most ${MAX_BATCH_OBJECT_REFS} objectRefs per call (got ${objectRefs.length})`);
+		const context = getCurrentTenant();
+		const tenantId = context?.tenantId ?? null;
+		const userId = context?.userId ?? null;
+		const { resolveFieldPolicy } = await import("../index.js").then((n) => n.t);
+		const policies = {};
+		for (const objectRef of objectRefs) {
+			const resolved = await resolveFieldPolicy(objectRef, {
+				tenantId,
+				userId,
+				db: this.db
+			});
+			policies[objectRef] = await this.gateResolvedForPublicResponse(resolved);
+		}
+		return { policies };
+	}
+	/**
+	* Context-derived bootstrap data for the policy gear. This is deliberately
+	* a collection action instead of reopening list/get: a caller can inspect
+	* only their safe effective policy and rows/layers they are permitted to
+	* edit, never arbitrary tenant or user policy rows.
+	*/
+	async getEditorState(options = {}) {
+		const objectRef = options.objectRef;
+		if (typeof objectRef !== "string" || objectRef.trim() === "") throw new Error("getEditorState requires a non-empty \"objectRef\" string");
+		const context = getCurrentTenant();
+		const permissionOptions = {
+			collection: "fields.policy",
+			db: this.db,
+			tenantId: context?.tenantId ?? null,
+			userId: context?.userId ?? null,
+			permissionSet: context?.permissions,
+			onDeny: "return"
+		};
+		const manage = await checkOperationPermission({
+			...permissionOptions,
+			action: "fields.policy.manage".split(".").at(-1) ?? "manage"
+		});
+		const personalize = await checkOperationPermission({
+			...permissionOptions,
+			action: "fields.policy.personalize".split(".").at(-1) ?? "personalize"
+		});
+		const personalizeAllowed = personalize.allowed && typeof context?.userId === "string" && context.userId.length > 0;
+		if (!manage.allowed && !personalizeAllowed) return {
+			code: "permission_denied",
+			message: `Permission denied for '${personalize.permission ?? "fields.policy.manage"}'.`,
+			ok: false,
+			status: 403
+		};
+		const { resolveFieldPolicyExplained } = await import("../index.js").then((n) => n.t);
+		const resolved = await resolveFieldPolicyExplained(objectRef, {
+			tenantId: context?.tenantId ?? null,
+			userId: context?.userId ?? null,
+			db: this.db
+		});
+		const policy = await this.gateExplainedForEditorResponse(resolved, {
+			manage: manage.allowed,
+			personalize: personalizeAllowed
+		});
+		const fieldNames = new Set(Object.keys(policy.fields));
+		const personalLowerDefaultUsable = personalizeAllowed ? await this.getPersonalLowerDefaultUsability(objectRef, context?.tenantId ?? null, fieldNames) : {};
+		const appRows = manage.allowed ? this.toEditorRows(await this.getAppRows(objectRef), fieldNames) : [];
+		const tenantRows = manage.allowed && context?.tenantId ? this.toEditorRows((await this.getTenantRows(objectRef, [context.tenantId])).get(context.tenantId) ?? /* @__PURE__ */ new Map(), fieldNames) : [];
+		const userRows = personalizeAllowed && context?.userId ? this.toEditorRows(await this.getUserRows(objectRef, context.userId), fieldNames) : [];
+		return {
+			capabilities: {
+				manage: manage.allowed,
+				personalize: personalizeAllowed
+			},
+			personalLowerDefaultUsable,
+			policy,
+			rows: {
+				app: appRows,
+				tenant: tenantRows,
+				user: userRows
+			}
+		};
+	}
+	/**
+	* Compute the non-disclosing fallback signal used only by personal drafts.
+	* Passing no user id resolves exactly code/app/tenant precedence, including
+	* the real tenant hierarchy, while keeping every lower-layer value server
+	* side. The public map is limited to fields already admitted by the editor
+	* response's security rail.
+	*/
+	async getPersonalLowerDefaultUsability(objectRef, tenantId, fieldNames) {
+		const { resolveFieldPolicy } = await import("../index.js").then((n) => n.t);
+		const lowerPolicy = await resolveFieldPolicy(objectRef, {
+			tenantId,
+			db: this.db
+		});
+		return Object.fromEntries(Array.from(fieldNames, (fieldName) => {
+			const field = lowerPolicy.fields[fieldName];
+			return [fieldName, isUsableRequiredDefault(field?.hasDefault ? { value: field.defaultValue } : void 0)];
+		}));
+	}
+	async gateResolvedForPublicResponse(resolved) {
+		const fieldMap = await getObjectFieldMap(resolved.objectRef);
+		const fields = {};
+		for (const [fieldName, policy] of Object.entries(resolved.fields)) {
+			const fieldDef = fieldMap.get(fieldName);
+			if (!fieldDef) continue;
+			if (isSensitiveField(fieldDef) || getFieldReadPermission(fieldDef) !== void 0 || isTransientField(fieldDef)) continue;
+			fields[fieldName] = policy;
+		}
+		return {
+			objectRef: resolved.objectRef,
+			fields
+		};
+	}
+	async gateExplainedForEditorResponse(resolved, capabilities, includeCode = false) {
+		const fieldMap = await getObjectFieldMap(resolved.objectRef);
+		const fields = {};
+		const layers = {};
+		for (const [fieldName, policy] of Object.entries(resolved.fields)) {
+			const fieldDef = fieldMap.get(fieldName);
+			if (!fieldDef || isSensitiveField(fieldDef) || getFieldReadPermission(fieldDef) !== void 0 || isTransientField(fieldDef)) continue;
+			fields[fieldName] = policy;
+			layers[fieldName] = (resolved.layers[fieldName] ?? []).filter((layer) => includeCode && layer.layer === "code" || capabilities.manage && (layer.layer === "app" || layer.layer === "tenant") || capabilities.personalize && layer.layer === "user");
+		}
+		return {
+			objectRef: resolved.objectRef,
+			fields,
+			layers
+		};
+	}
+	toEditorRows(rows, allowedFieldNames) {
+		return Array.from(rows.values()).filter((row) => allowedFieldNames.has(row.fieldName)).map((row) => ({
+			defaultValue: row.defaultValue,
+			displayOrder: row.displayOrder,
+			fieldName: row.fieldName,
+			help: row.help,
+			id: String(row.id),
+			label: row.label,
+			locked: row.locked,
+			scopeType: row.scopeType,
+			tenantId: row.tenantId,
+			updatedBy: row.updatedBy,
+			userId: row.userId,
+			visibility: row.visibility
+		})).sort((left, right) => left.fieldName.localeCompare(right.fieldName));
+	}
+};
+__publicField(FieldPolicyCollection, "_itemClass", FieldPolicy);
+FieldPolicyCollection = __decorateClass([smrt({
+	conflictColumns: [
+		"object_ref",
+		"field_name",
+		"scope_type",
+		"scope_key"
+	],
+	api: {
+		include: [
+			"create",
+			"update",
+			"delete",
+			"resolveBatch",
+			"getEditorState",
+			"policyAudit"
+		],
+		principalContext: true,
+		routes: {
+			resolveBatch: {
+				scope: "collection",
+				method: "POST",
+				path: "resolve"
+			},
+			getEditorState: {
+				scope: "collection",
+				method: "POST",
+				path: "editor-state"
+			},
+			policyAudit: {
+				scope: "collection",
+				method: "POST",
+				path: "policy-audit"
+			}
+		}
+	},
+	cli: false,
+	mcp: false
+})], FieldPolicyCollection);
+function normalizeAuditRefs(value, label, maximum) {
+	if (value === void 0) return [];
+	if (!Array.isArray(value)) throw new Error(`policyAudit ${label} must be a string array`);
+	if (value.some((ref) => typeof ref !== "string" || ref.trim() === "")) throw new Error(`policyAudit ${label} must contain non-empty strings`);
+	const refs = [...new Set(value)];
+	if (refs.length > maximum) throw new Error(`policyAudit ${label} accepts at most ${maximum} objectRefs`);
+	return refs;
+}
+function emptyAudit(caller) {
+	return {
+		orgRows: [],
+		appRows: [],
+		inheritedOrgKeys: {},
+		userOverrideCounts: {},
+		driftRows: [],
+		policies: {},
+		caller
+	};
+}
+function dateText(value) {
+	if (value instanceof Date) return value.toISOString();
+	return typeof value === "string" ? value : null;
+}
+function toAuditRow(row) {
+	return {
+		objectRef: row.objectRef,
+		defaultValue: row.defaultValue,
+		displayOrder: row.displayOrder,
+		fieldName: row.fieldName,
+		help: row.help,
+		id: String(row.id),
+		label: row.label,
+		locked: row.locked,
+		scopeType: row.scopeType,
+		tenantId: row.tenantId,
+		updatedBy: row.updatedBy,
+		userId: row.userId,
+		visibility: row.visibility,
+		createdAt: dateText(row.createdAt),
+		updatedAt: dateText(row.updatedAt)
+	};
+}
+function toDriftIdentity(row) {
+	return {
+		id: String(row.id),
+		objectRef: row.objectRef,
+		fieldName: row.fieldName,
+		scopeType: row.scopeType,
+		tenantId: row.tenantId,
+		userId: row.userId,
+		updatedBy: row.updatedBy,
+		createdAt: dateText(row.createdAt),
+		updatedAt: dateText(row.updatedAt)
+	};
+}
+function sortAuditRows(left, right) {
+	return left.objectRef.localeCompare(right.objectRef) || left.fieldName.localeCompare(right.fieldName);
+}
+function sortDriftRows(left, right) {
+	return left.objectRef.localeCompare(right.objectRef) || left.fieldName.localeCompare(right.fieldName) || left.scopeType.localeCompare(right.scopeType);
+}
+//#endregion
+export { setCachedFieldPolicy as C, ensureFieldPolicyPermissionsRegistered as D, PERSONALIZE_FIELD_POLICY_PERMISSION as E, __exportAll as O, invalidateFieldPolicyCache as S, MANAGE_FIELD_POLICY_PERMISSION as T, requireRegisteredObject as _, buildCodeSeedDelta as a, getCachedFieldPolicy as b, getCodeSeedGroup as c, isPolicyAddressableField as d, isRequiredField as f, isUsableRequiredDefault as g, isTransientField as h, assertDefaultValueMatchesFieldType as i, getFieldReadPermission as l, isStorableReferenceId as m, FieldPolicyCollection_exports as n, buildCodeSeedVisibility as o, isSensitiveField as p, FieldPolicy as r, getCodeDefault as s, FieldPolicyCollection as t, getObjectFieldMap as u, sanitizeFieldUIHints as v, FIELD_POLICY_PERMISSION_DEFINITIONS as w, getFieldPolicyCacheTtlMs as x, clearFieldPolicyCache as y };
+
+//# sourceMappingURL=FieldPolicyCollection--RxukfCX.js.map