@happyvertical/smrt-fields 0.40.61 → 0.40.63

package/dist/index.js

@@ -1,1211 +1,1202 @@
-import { APP_FIELD_POLICY_SCOPE_KEY, FIELD_POLICY_SCOPE_TYPES, FIELD_POLICY_VISIBILITIES } from "./types.js";
+import { C as setCachedFieldPolicy, D as ensureFieldPolicyPermissionsRegistered, E as PERSONALIZE_FIELD_POLICY_PERMISSION, O as __exportAll, S as invalidateFieldPolicyCache, T as MANAGE_FIELD_POLICY_PERMISSION, _ as requireRegisteredObject, a as buildCodeSeedDelta, b as getCachedFieldPolicy, c as getCodeSeedGroup, d as isPolicyAddressableField, f as isRequiredField, g as isUsableRequiredDefault, h as isTransientField, i as assertDefaultValueMatchesFieldType, l as getFieldReadPermission, m as isStorableReferenceId, o as buildCodeSeedVisibility, p as isSensitiveField, r as FieldPolicy, s as getCodeDefault, t as FieldPolicyCollection, u as getObjectFieldMap, v as sanitizeFieldUIHints, w as FIELD_POLICY_PERMISSION_DEFINITIONS, x as getFieldPolicyCacheTtlMs, y as clearFieldPolicyCache } from "./chunks/FieldPolicyCollection--RxukfCX.js";
+import { APP_FIELD_POLICY_SCOPE_KEY, FIELD_POLICY_SCOPE_TYPES, FIELD_POLICY_SUGGESTION_KINDS, FIELD_POLICY_SUGGESTION_STATUSES, FIELD_POLICY_VISIBILITIES } from "./types.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, crossPackageRef, field, smrt } from "@happyvertical/smrt-core";
-import { MembershipCollection, assertOperationPermission, checkOperationPermission, getCurrentSessionPermissionContext, registerPermissionDefinitions } from "@happyvertical/smrt-users";
+import { assertOperationPermission } from "@happyvertical/smrt-users";
 import { TenantIsolationError, assertTenantReadAllowed, getCurrentTenant, isSuperAdminBypass, tenantId } from "@happyvertical/smrt-tenancy";
 import { importWorkspaceModule } from "@happyvertical/smrt-core/utils/import-workspace-module";
-//#region \0rolldown/runtime.js
-var __defProp$2 = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp$2(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp$2(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-//#endregion
 //#region src/__smrt-register__.ts
-ObjectRegistry.registerPackageManifest(JSON.parse("{\"version\":\"1.0.0\",\"timestamp\":0,\"packageName\":\"@happyvertical/smrt-fields\",\"packageVersion\":\"0.40.61\",\"objects\":{\"@happyvertical/smrt-fields:FieldPolicyCollection\":{\"name\":\"fieldpolicycollection\",\"className\":\"FieldPolicyCollection\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldPolicyCollection\",\"collection\":\"fieldpolicies\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/collections/FieldPolicyCollection.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{},\"methods\":{\"policyAudit\":{\"name\":\"policyAudit\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<FieldPolicyAuditSnapshot>\",\"isStatic\":false,\"isPublic\":true},\"getAppRows\":{\"name\":\"getAppRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Map<string, FieldPolicy>>\",\"isStatic\":false,\"isPublic\":true},\"getTenantRows\":{\"name\":\"getTenantRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false},{\"name\":\"tenantIds\",\"type\":\"string[]\",\"optional\":false}],\"returnType\":\"Promise<Map<string, Map<string, FieldPolicy>>>\",\"isStatic\":false,\"isPublic\":true},\"getUserRows\":{\"name\":\"getUserRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false},{\"name\":\"userId\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Map<string, FieldPolicy>>\",\"isStatic\":false,\"isPublic\":true},\"resolveBatch\":{\"name\":\"resolveBatch\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<FieldPolicyBatchResult>\",\"isStatic\":false,\"isPublic\":true},\"getEditorState\":{\"name\":\"getEditorState\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<FieldPolicyEditorStateResult>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"conflictColumns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"api\":{\"include\":[\"create\",\"update\",\"delete\",\"resolveBatch\",\"getEditorState\",\"policyAudit\"],\"principalContext\":true,\"routes\":{\"resolveBatch\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"resolve\"},\"getEditorState\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"editor-state\"},\"policyAudit\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"policy-audit\"}}},\"cli\":false,\"mcp\":false,\"tableName\":\"_smrt_field_policies\"},\"extends\":\"SmrtCollection\",\"extendsTypeArg\":\"FieldPolicy\",\"exportName\":\"FieldPolicyCollection\",\"collectionExportName\":\"FieldPolicyCollectionCollection\",\"schema\":{\"tableName\":\"_smrt_field_policies\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_policies\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"}},\"indexes\":[{\"name\":\"_smrt_field_policies_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_policies_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"unique\":true}],\"version\":\"13aa748c\"}},\"@happyvertical/smrt-fields:FieldPolicy\":{\"name\":\"fieldpolicy\",\"className\":\"FieldPolicy\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldPolicy\",\"collection\":\"fieldpolicies\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/models/FieldPolicy.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{\"objectRef\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"fieldName\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"scopeType\":{\"type\":\"text\",\"required\":true,\"default\":\"app\",\"_meta\":{\"required\":true}},\"tenantId\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"sqlType\":\"UUID\",\"nullable\":true,\"__tenancy\":{\"isTenantIdField\":true,\"autoFilter\":true,\"required\":false,\"autoPopulate\":true,\"nullable\":true}}},\"userId\":{\"type\":\"crossPackageRef\",\"required\":false,\"related\":\"@happyvertical/smrt-users:User\",\"_meta\":{\"nullable\":true}},\"scopeKey\":{\"type\":\"text\",\"required\":true,\"_meta\":{\"required\":true}},\"defaultValue\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"visibility\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"help\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"label\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"displayOrder\":{\"type\":\"integer\",\"required\":false,\"_meta\":{\"nullable\":true}},\"locked\":{\"type\":\"boolean\",\"required\":false,\"_meta\":{\"nullable\":true}},\"updatedBy\":{\"type\":\"crossPackageRef\",\"required\":false,\"related\":\"@happyvertical/smrt-users:User\",\"_meta\":{\"nullable\":true}}},\"methods\":{\"getDefaultValue\":{\"name\":\"getDefaultValue\",\"async\":false,\"parameters\":[],\"returnType\":\"any\",\"isStatic\":false,\"isPublic\":true},\"setDefaultValue\":{\"name\":\"setDefaultValue\",\"async\":false,\"parameters\":[{\"name\":\"value\",\"type\":\"any\",\"optional\":false}],\"returnType\":\"void\",\"isStatic\":false,\"isPublic\":true},\"save\":{\"name\":\"save\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise\",\"isStatic\":false,\"isPublic\":true},\"delete\":{\"name\":\"delete\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise<void>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"tableName\":\"_smrt_field_policies\",\"conflictColumns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"api\":{\"include\":[\"create\",\"update\",\"delete\"],\"principalContext\":true},\"cli\":{\"include\":[\"create\",\"update\",\"delete\"],\"exclude\":[\"getDefaultValue\",\"setDefaultValue\"]},\"mcp\":{\"include\":[]}},\"extends\":\"SmrtObject\",\"exportName\":\"FieldPolicy\",\"collectionExportName\":\"FieldPolicyCollection\",\"validationRules\":[{\"field\":\"objectRef\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"fieldName\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"scopeType\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"scopeKey\",\"rule\":\"required\",\"fieldType\":\"text\"}],\"schema\":{\"tableName\":\"_smrt_field_policies\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_policies\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"object_ref\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"field_name\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"scope_type\\\" TEXT NOT NULL DEFAULT 'app',\\n  \\\"tenant_id\\\" UUID,\\n  \\\"user_id\\\" UUID,\\n  \\\"scope_key\\\" TEXT NOT NULL,\\n  \\\"default_value\\\" TEXT,\\n  \\\"visibility\\\" TEXT,\\n  \\\"help\\\" TEXT,\\n  \\\"label\\\" TEXT,\\n  \\\"display_order\\\" INTEGER,\\n  \\\"locked\\\" BOOLEAN,\\n  \\\"updated_by\\\" UUID\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"object_ref\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"field_name\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"scope_type\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"app\"},\"tenant_id\":{\"type\":\"UUID\",\"referenceKind\":\"tenantId\",\"notNull\":false,\"unique\":false},\"user_id\":{\"type\":\"UUID\",\"referenceKind\":\"crossPackageRef\",\"notNull\":false,\"unique\":false},\"scope_key\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false},\"default_value\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"visibility\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"help\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"label\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"display_order\":{\"type\":\"INTEGER\",\"notNull\":false,\"unique\":false},\"locked\":{\"type\":\"BOOLEAN\",\"notNull\":false,\"unique\":false},\"updated_by\":{\"type\":\"UUID\",\"referenceKind\":\"crossPackageRef\",\"notNull\":false,\"unique\":false}},\"indexes\":[{\"name\":\"_smrt_field_policies_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_policies_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"unique\":true}],\"version\":\"34b355cc\"}}},\"moduleType\":\"smrt\",\"smrtDependencies\":[\"@happyvertical/smrt-core\",\"@happyvertical/smrt-tenancy\",\"@happyvertical/smrt-users\"]}"));
-//#endregion
-//#region src/permissions.ts
-var MANAGE_FIELD_POLICY_PERMISSION = "fields.policy.manage";
-var PERSONALIZE_FIELD_POLICY_PERMISSION = "fields.policy.personalize";
-var FIELD_POLICY_PERMISSION_DEFINITIONS = [{
-	slug: MANAGE_FIELD_POLICY_PERMISSION,
-	category: "fields",
-	name: "Manage Field Policies",
-	description: "Manage application and tenant field-policy overrides"
-}, {
-	slug: PERSONALIZE_FIELD_POLICY_PERMISSION,
-	category: "fields",
-	name: "Personalize Field Policies",
-	description: "Manage the caller’s own field-policy overrides"
-}];
-var registered = false;
-function ensureFieldPolicyPermissionsRegistered() {
-	if (registered) return;
-	registered = true;
-	registerPermissionDefinitions(FIELD_POLICY_PERMISSION_DEFINITIONS);
-}
+ObjectRegistry.registerPackageManifest(JSON.parse("{\"version\":\"1.0.0\",\"timestamp\":0,\"packageName\":\"@happyvertical/smrt-fields\",\"packageVersion\":\"0.40.63\",\"objects\":{\"@happyvertical/smrt-fields:FieldUsageLearningAgent\":{\"name\":\"fieldusagelearningagent\",\"className\":\"FieldUsageLearningAgent\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldUsageLearningAgent\",\"collection\":\"fieldusagelearningagents\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/usage-learning.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{},\"methods\":{\"runUsageMaintenance\":{\"name\":\"runUsageMaintenance\",\"async\":true,\"parameters\":[{\"name\":\"args\",\"type\":\"Record<string>\",\"optional\":true}],\"returnType\":\"Promise<FieldUsageMaintenanceSummary>\",\"isStatic\":false,\"isPublic\":true},\"runSuggestionGeneration\":{\"name\":\"runSuggestionGeneration\",\"async\":true,\"parameters\":[{\"name\":\"args\",\"type\":\"Record<string>\",\"optional\":true}],\"returnType\":\"Promise<FieldUsageSuggestionRunSummary>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"tableName\":\"_smrt_field_usage_learning_agents\",\"api\":{\"include\":[]},\"cli\":false,\"mcp\":{\"include\":[]}},\"extends\":\"SmrtObject\",\"exportName\":\"FieldUsageLearningAgent\",\"collectionExportName\":\"FieldUsageLearningAgentCollection\",\"schema\":{\"tableName\":\"_smrt_field_usage_learning_agents\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_usage_learning_agents\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"}},\"indexes\":[{\"name\":\"_smrt_field_usage_learning_agents_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_usage_learning_agents_slug_context_idx\",\"columns\":[\"slug\",\"context\"],\"unique\":true}],\"version\":\"183ee1d8\"}},\"@happyvertical/smrt-fields:FieldPolicyCollection\":{\"name\":\"fieldpolicycollection\",\"className\":\"FieldPolicyCollection\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldPolicyCollection\",\"collection\":\"fieldpolicies\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/collections/FieldPolicyCollection.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{},\"methods\":{\"policyAudit\":{\"name\":\"policyAudit\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<FieldPolicyAuditSnapshot>\",\"isStatic\":false,\"isPublic\":true},\"getAppRows\":{\"name\":\"getAppRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Map<string, FieldPolicy>>\",\"isStatic\":false,\"isPublic\":true},\"getTenantRows\":{\"name\":\"getTenantRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false},{\"name\":\"tenantIds\",\"type\":\"string[]\",\"optional\":false}],\"returnType\":\"Promise<Map<string, Map<string, FieldPolicy>>>\",\"isStatic\":false,\"isPublic\":true},\"getUserRows\":{\"name\":\"getUserRows\",\"async\":true,\"parameters\":[{\"name\":\"objectRef\",\"type\":\"string\",\"optional\":false},{\"name\":\"userId\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"Promise<Map<string, FieldPolicy>>\",\"isStatic\":false,\"isPublic\":true},\"resolveBatch\":{\"name\":\"resolveBatch\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<FieldPolicyBatchResult>\",\"isStatic\":false,\"isPublic\":true},\"getEditorState\":{\"name\":\"getEditorState\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<FieldPolicyEditorStateResult>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"conflictColumns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"api\":{\"include\":[\"create\",\"update\",\"delete\",\"resolveBatch\",\"getEditorState\",\"policyAudit\"],\"principalContext\":true,\"routes\":{\"resolveBatch\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"resolve\"},\"getEditorState\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"editor-state\"},\"policyAudit\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"policy-audit\"}}},\"cli\":false,\"mcp\":false,\"tableName\":\"_smrt_field_policies\"},\"extends\":\"SmrtCollection\",\"extendsTypeArg\":\"FieldPolicy\",\"exportName\":\"FieldPolicyCollection\",\"collectionExportName\":\"FieldPolicyCollectionCollection\",\"schema\":{\"tableName\":\"_smrt_field_policies\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_policies\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"}},\"indexes\":[{\"name\":\"_smrt_field_policies_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_policies_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"unique\":true}],\"version\":\"13aa748c\"}},\"@happyvertical/smrt-fields:FieldPolicySuggestionCollection\":{\"name\":\"fieldpolicysuggestioncollection\",\"className\":\"FieldPolicySuggestionCollection\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldPolicySuggestionCollection\",\"collection\":\"fieldpolicysuggestions\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/collections/FieldPolicySuggestionCollection.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{},\"methods\":{\"pendingSuggestions\":{\"name\":\"pendingSuggestions\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<PendingFieldPolicySuggestionsResult>\",\"isStatic\":false,\"isPublic\":true},\"acceptSuggestion\":{\"name\":\"acceptSuggestion\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<AcceptFieldPolicySuggestionResult>\",\"isStatic\":false,\"isPublic\":true},\"dismissSuggestion\":{\"name\":\"dismissSuggestion\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<DismissFieldPolicySuggestionResult>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"conflictColumns\":[\"object_ref\",\"field_name\",\"tenant_id\",\"kind\",\"active_key\"],\"api\":{\"include\":[\"pendingSuggestions\",\"acceptSuggestion\",\"dismissSuggestion\"],\"principalContext\":true,\"routes\":{\"pendingSuggestions\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"pending\"},\"acceptSuggestion\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"accept\"},\"dismissSuggestion\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"dismiss\"}}},\"cli\":false,\"mcp\":false,\"tableName\":\"_smrt_field_policy_suggestions\"},\"extends\":\"SmrtCollection\",\"extendsTypeArg\":\"FieldPolicySuggestion\",\"exportName\":\"FieldPolicySuggestionCollection\",\"collectionExportName\":\"FieldPolicySuggestionCollectionCollection\",\"schema\":{\"tableName\":\"_smrt_field_policy_suggestions\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_policy_suggestions\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"}},\"indexes\":[{\"name\":\"_smrt_field_policy_suggestions_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_policy_suggestions_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"tenant_id\",\"kind\",\"active_key\"],\"unique\":true}],\"version\":\"853df86d\"}},\"@happyvertical/smrt-fields:FieldUsageCounterCollection\":{\"name\":\"fieldusagecountercollection\",\"className\":\"FieldUsageCounterCollection\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldUsageCounterCollection\",\"collection\":\"fieldusagecounters\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/collections/FieldUsageCounterCollection.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{},\"methods\":{\"reportUsage\":{\"name\":\"reportUsage\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":true}],\"returnType\":\"Promise<FieldUsageReportResult>\",\"isStatic\":false,\"isPublic\":true},\"listWindow\":{\"name\":\"listWindow\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":false}],\"returnType\":\"Promise<FieldUsageCounter[]>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"conflictColumns\":[\"object_ref\",\"field_name\",\"tenant_id\",\"period\"],\"api\":{\"include\":[\"reportUsage\"],\"principalContext\":true,\"routes\":{\"reportUsage\":{\"scope\":\"collection\",\"method\":\"POST\",\"path\":\"report\"}}},\"cli\":false,\"mcp\":false,\"tableName\":\"_smrt_field_usage_counters\"},\"extends\":\"SmrtCollection\",\"extendsTypeArg\":\"FieldUsageCounter\",\"exportName\":\"FieldUsageCounterCollection\",\"collectionExportName\":\"FieldUsageCounterCollectionCollection\",\"schema\":{\"tableName\":\"_smrt_field_usage_counters\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_usage_counters\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"}},\"indexes\":[{\"name\":\"_smrt_field_usage_counters_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_usage_counters_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"tenant_id\",\"period\"],\"unique\":true}],\"version\":\"8bd9beae\"}},\"@happyvertical/smrt-fields:FieldUsageReportReceiptCollection\":{\"name\":\"fieldusagereportreceiptcollection\",\"className\":\"FieldUsageReportReceiptCollection\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldUsageReportReceiptCollection\",\"collection\":\"fieldusagereportreceipts\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/collections/FieldUsageCounterCollection.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{},\"methods\":{\"claim\":{\"name\":\"claim\",\"async\":true,\"parameters\":[{\"name\":\"options\",\"type\":\"object\",\"optional\":false}],\"returnType\":\"Promise<boolean>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"conflictColumns\":[\"tenant_id\",\"user_id\",\"object_ref\",\"field_name\",\"period\"],\"api\":false,\"cli\":false,\"mcp\":false,\"tableName\":\"_smrt_field_usage_report_receipts\"},\"extends\":\"SmrtCollection\",\"extendsTypeArg\":\"FieldUsageReportReceipt\",\"exportName\":\"FieldUsageReportReceiptCollection\",\"collectionExportName\":\"FieldUsageReportReceiptCollectionCollection\",\"schema\":{\"tableName\":\"_smrt_field_usage_report_receipts\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_usage_report_receipts\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"}},\"indexes\":[{\"name\":\"_smrt_field_usage_report_receipts_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_usage_report_receipts_tenant_id_user_id_idx\",\"columns\":[\"tenant_id\",\"user_id\",\"object_ref\",\"field_name\",\"period\"],\"unique\":true}],\"version\":\"2e77b775\"}},\"@happyvertical/smrt-fields:FieldPolicy\":{\"name\":\"fieldpolicy\",\"className\":\"FieldPolicy\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldPolicy\",\"collection\":\"fieldpolicies\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/models/FieldPolicy.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{\"objectRef\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"fieldName\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"scopeType\":{\"type\":\"text\",\"required\":true,\"default\":\"app\",\"_meta\":{\"required\":true}},\"tenantId\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"sqlType\":\"UUID\",\"nullable\":true,\"__tenancy\":{\"isTenantIdField\":true,\"autoFilter\":true,\"required\":false,\"autoPopulate\":true,\"nullable\":true}}},\"userId\":{\"type\":\"crossPackageRef\",\"required\":false,\"related\":\"@happyvertical/smrt-users:User\",\"_meta\":{\"nullable\":true}},\"scopeKey\":{\"type\":\"text\",\"required\":true,\"_meta\":{\"required\":true}},\"defaultValue\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"visibility\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"help\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"label\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"displayOrder\":{\"type\":\"integer\",\"required\":false,\"_meta\":{\"nullable\":true}},\"locked\":{\"type\":\"boolean\",\"required\":false,\"_meta\":{\"nullable\":true}},\"updatedBy\":{\"type\":\"crossPackageRef\",\"required\":false,\"related\":\"@happyvertical/smrt-users:User\",\"_meta\":{\"nullable\":true}}},\"methods\":{\"getDefaultValue\":{\"name\":\"getDefaultValue\",\"async\":false,\"parameters\":[],\"returnType\":\"any\",\"isStatic\":false,\"isPublic\":true},\"setDefaultValue\":{\"name\":\"setDefaultValue\",\"async\":false,\"parameters\":[{\"name\":\"value\",\"type\":\"any\",\"optional\":false}],\"returnType\":\"void\",\"isStatic\":false,\"isPublic\":true},\"save\":{\"name\":\"save\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise\",\"isStatic\":false,\"isPublic\":true},\"delete\":{\"name\":\"delete\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise<void>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"tableName\":\"_smrt_field_policies\",\"conflictColumns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"api\":{\"include\":[\"create\",\"update\",\"delete\"],\"principalContext\":true},\"cli\":{\"include\":[\"create\",\"update\",\"delete\"],\"exclude\":[\"getDefaultValue\",\"setDefaultValue\"]},\"mcp\":{\"include\":[]}},\"extends\":\"SmrtObject\",\"exportName\":\"FieldPolicy\",\"collectionExportName\":\"FieldPolicyCollection\",\"validationRules\":[{\"field\":\"objectRef\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"fieldName\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"scopeType\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"scopeKey\",\"rule\":\"required\",\"fieldType\":\"text\"}],\"schema\":{\"tableName\":\"_smrt_field_policies\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_policies\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"object_ref\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"field_name\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"scope_type\\\" TEXT NOT NULL DEFAULT 'app',\\n  \\\"tenant_id\\\" UUID,\\n  \\\"user_id\\\" UUID,\\n  \\\"scope_key\\\" TEXT NOT NULL,\\n  \\\"default_value\\\" TEXT,\\n  \\\"visibility\\\" TEXT,\\n  \\\"help\\\" TEXT,\\n  \\\"label\\\" TEXT,\\n  \\\"display_order\\\" INTEGER,\\n  \\\"locked\\\" BOOLEAN,\\n  \\\"updated_by\\\" UUID\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"object_ref\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"field_name\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"scope_type\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"app\"},\"tenant_id\":{\"type\":\"UUID\",\"referenceKind\":\"tenantId\",\"notNull\":false,\"unique\":false},\"user_id\":{\"type\":\"UUID\",\"referenceKind\":\"crossPackageRef\",\"notNull\":false,\"unique\":false},\"scope_key\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false},\"default_value\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"visibility\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"help\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"label\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"display_order\":{\"type\":\"INTEGER\",\"notNull\":false,\"unique\":false},\"locked\":{\"type\":\"BOOLEAN\",\"notNull\":false,\"unique\":false},\"updated_by\":{\"type\":\"UUID\",\"referenceKind\":\"crossPackageRef\",\"notNull\":false,\"unique\":false}},\"indexes\":[{\"name\":\"_smrt_field_policies_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_policies_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"scope_type\",\"scope_key\"],\"unique\":true}],\"version\":\"34b355cc\"}},\"@happyvertical/smrt-fields:FieldPolicySuggestion\":{\"name\":\"fieldpolicysuggestion\",\"className\":\"FieldPolicySuggestion\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldPolicySuggestion\",\"collection\":\"fieldpolicysuggestions\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/models/FieldPolicySuggestion.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{\"objectRef\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"fieldName\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"tenantId\":{\"type\":\"text\",\"required\":true,\"_meta\":{\"sqlType\":\"UUID\",\"__tenancy\":{\"isTenantIdField\":true,\"autoFilter\":true,\"required\":true,\"autoPopulate\":true,\"nullable\":false}}},\"kind\":{\"type\":\"text\",\"required\":true,\"default\":\"promote\",\"_meta\":{\"required\":true}},\"proposedValue\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"evidence\":{\"type\":\"text\",\"required\":false,\"_meta\":{}},\"status\":{\"type\":\"text\",\"required\":true,\"default\":\"pending\",\"_meta\":{\"required\":true}},\"activeKey\":{\"type\":\"text\",\"required\":true,\"_meta\":{\"required\":true}},\"cooldownUntil\":{\"type\":\"datetime\",\"required\":false,\"_meta\":{\"nullable\":true}},\"decidedBy\":{\"type\":\"crossPackageRef\",\"required\":false,\"related\":\"@happyvertical/smrt-users:User\",\"_meta\":{\"nullable\":true}},\"decidedAt\":{\"type\":\"datetime\",\"required\":false,\"_meta\":{\"nullable\":true}}},\"methods\":{\"getEvidence\":{\"name\":\"getEvidence\",\"async\":false,\"parameters\":[],\"returnType\":\"Record<string>\",\"isStatic\":false,\"isPublic\":true},\"setEvidence\":{\"name\":\"setEvidence\",\"async\":false,\"parameters\":[{\"name\":\"evidence\",\"type\":\"Record<string>\",\"optional\":false}],\"returnType\":\"void\",\"isStatic\":false,\"isPublic\":true},\"getProposedValue\":{\"name\":\"getProposedValue\",\"async\":false,\"parameters\":[],\"returnType\":\"any\",\"isStatic\":false,\"isPublic\":true},\"toSuggestionData\":{\"name\":\"toSuggestionData\",\"async\":false,\"parameters\":[],\"returnType\":\"FieldPolicySuggestionData\",\"isStatic\":false,\"isPublic\":true},\"save\":{\"name\":\"save\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise\",\"isStatic\":false,\"isPublic\":true},\"delete\":{\"name\":\"delete\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise<void>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"tableName\":\"_smrt_field_policy_suggestions\",\"conflictColumns\":[\"object_ref\",\"field_name\",\"tenant_id\",\"kind\",\"active_key\"],\"api\":{\"include\":[]},\"cli\":false,\"mcp\":{\"include\":[]}},\"extends\":\"SmrtObject\",\"exportName\":\"FieldPolicySuggestion\",\"collectionExportName\":\"FieldPolicySuggestionCollection\",\"validationRules\":[{\"field\":\"objectRef\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"fieldName\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"tenantId\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"kind\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"status\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"activeKey\",\"rule\":\"required\",\"fieldType\":\"text\"}],\"schema\":{\"tableName\":\"_smrt_field_policy_suggestions\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_policy_suggestions\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"object_ref\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"field_name\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"tenant_id\\\" UUID NOT NULL,\\n  \\\"kind\\\" TEXT NOT NULL DEFAULT 'promote',\\n  \\\"proposed_value\\\" TEXT,\\n  \\\"evidence\\\" TEXT,\\n  \\\"status\\\" TEXT NOT NULL DEFAULT 'pending',\\n  \\\"active_key\\\" TEXT NOT NULL,\\n  \\\"cooldown_until\\\" TIMESTAMP,\\n  \\\"decided_by\\\" UUID,\\n  \\\"decided_at\\\" TIMESTAMP\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"object_ref\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"field_name\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"tenant_id\":{\"type\":\"UUID\",\"referenceKind\":\"tenantId\",\"notNull\":true,\"unique\":false},\"kind\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"promote\"},\"proposed_value\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"evidence\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"status\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"pending\"},\"active_key\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false},\"cooldown_until\":{\"type\":\"TIMESTAMP\",\"notNull\":false,\"unique\":false},\"decided_by\":{\"type\":\"UUID\",\"referenceKind\":\"crossPackageRef\",\"notNull\":false,\"unique\":false},\"decided_at\":{\"type\":\"TIMESTAMP\",\"notNull\":false,\"unique\":false}},\"indexes\":[{\"name\":\"_smrt_field_policy_suggestions_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_policy_suggestions_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"tenant_id\",\"kind\",\"active_key\"],\"unique\":true}],\"version\":\"1bc8c6e5\"}},\"@happyvertical/smrt-fields:FieldUsageCounter\":{\"name\":\"fieldusagecounter\",\"className\":\"FieldUsageCounter\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldUsageCounter\",\"collection\":\"fieldusagecounters\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/models/FieldUsageCounter.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{\"objectRef\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"fieldName\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"tenantId\":{\"type\":\"text\",\"required\":true,\"_meta\":{\"sqlType\":\"UUID\",\"__tenancy\":{\"isTenantIdField\":true,\"autoFilter\":true,\"required\":true,\"autoPopulate\":true,\"nullable\":false}}},\"period\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"submissionCount\":{\"type\":\"integer\",\"required\":false,\"_meta\":{}},\"setCount\":{\"type\":\"integer\",\"required\":false,\"_meta\":{}},\"distinctUserCount\":{\"type\":\"integer\",\"required\":false,\"_meta\":{}},\"distinctUserIds\":{\"type\":\"text\",\"required\":false,\"_meta\":{}},\"distinctUsersOverflowed\":{\"type\":\"boolean\",\"required\":false,\"_meta\":{}},\"valueHistogram\":{\"type\":\"text\",\"required\":false,\"_meta\":{\"nullable\":true}},\"valueHistogramOverflowed\":{\"type\":\"boolean\",\"required\":false,\"_meta\":{}}},\"methods\":{\"getDistinctUserIds\":{\"name\":\"getDistinctUserIds\",\"async\":false,\"parameters\":[],\"returnType\":\"string[]\",\"isStatic\":false,\"isPublic\":true},\"addDistinctUser\":{\"name\":\"addDistinctUser\",\"async\":false,\"parameters\":[{\"name\":\"userId\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"void\",\"isStatic\":false,\"isPublic\":true},\"getValueHistogram\":{\"name\":\"getValueHistogram\",\"async\":false,\"parameters\":[],\"returnType\":\"Record<string, number>\",\"isStatic\":false,\"isPublic\":true},\"recordHistogramSample\":{\"name\":\"recordHistogramSample\",\"async\":false,\"parameters\":[{\"name\":\"key\",\"type\":\"string\",\"optional\":false}],\"returnType\":\"void\",\"isStatic\":false,\"isPublic\":true},\"isLegacyBucket\":{\"name\":\"isLegacyBucket\",\"async\":false,\"parameters\":[],\"returnType\":\"boolean\",\"isStatic\":false,\"isPublic\":true},\"save\":{\"name\":\"save\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise\",\"isStatic\":false,\"isPublic\":true},\"delete\":{\"name\":\"delete\",\"async\":true,\"parameters\":[],\"returnType\":\"Promise<void>\",\"isStatic\":false,\"isPublic\":true}},\"decoratorConfig\":{\"tableName\":\"_smrt_field_usage_counters\",\"conflictColumns\":[\"object_ref\",\"field_name\",\"tenant_id\",\"period\"],\"api\":{\"include\":[]},\"cli\":false,\"mcp\":{\"include\":[]}},\"extends\":\"SmrtObject\",\"exportName\":\"FieldUsageCounter\",\"collectionExportName\":\"FieldUsageCounterCollection\",\"validationRules\":[{\"field\":\"objectRef\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"fieldName\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"tenantId\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"period\",\"rule\":\"required\",\"fieldType\":\"text\"}],\"schema\":{\"tableName\":\"_smrt_field_usage_counters\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_usage_counters\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"object_ref\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"field_name\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"tenant_id\\\" UUID NOT NULL,\\n  \\\"period\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"submission_count\\\" INTEGER,\\n  \\\"set_count\\\" INTEGER,\\n  \\\"distinct_user_count\\\" INTEGER,\\n  \\\"distinct_user_ids\\\" TEXT,\\n  \\\"distinct_users_overflowed\\\" BOOLEAN,\\n  \\\"value_histogram\\\" TEXT,\\n  \\\"value_histogram_overflowed\\\" BOOLEAN\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"object_ref\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"field_name\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"tenant_id\":{\"type\":\"UUID\",\"referenceKind\":\"tenantId\",\"notNull\":true,\"unique\":false},\"period\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"submission_count\":{\"type\":\"INTEGER\",\"notNull\":false,\"unique\":false},\"set_count\":{\"type\":\"INTEGER\",\"notNull\":false,\"unique\":false},\"distinct_user_count\":{\"type\":\"INTEGER\",\"notNull\":false,\"unique\":false},\"distinct_user_ids\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"distinct_users_overflowed\":{\"type\":\"BOOLEAN\",\"notNull\":false,\"unique\":false},\"value_histogram\":{\"type\":\"TEXT\",\"notNull\":false,\"unique\":false},\"value_histogram_overflowed\":{\"type\":\"BOOLEAN\",\"notNull\":false,\"unique\":false}},\"indexes\":[{\"name\":\"_smrt_field_usage_counters_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_usage_counters_object_ref_field_name_idx\",\"columns\":[\"object_ref\",\"field_name\",\"tenant_id\",\"period\"],\"unique\":true}],\"version\":\"46fcebc6\"}},\"@happyvertical/smrt-fields:FieldUsageReportReceipt\":{\"name\":\"fieldusagereportreceipt\",\"className\":\"FieldUsageReportReceipt\",\"qualifiedName\":\"@happyvertical/smrt-fields:FieldUsageReportReceipt\",\"collection\":\"fieldusagereportreceipts\",\"filePath\":\"/home/runner/_work/smrt/smrt/packages/fields/src/models/FieldUsageReportReceipt.ts\",\"packageName\":\"@happyvertical/smrt-fields\",\"fields\":{\"tenantId\":{\"type\":\"text\",\"required\":true,\"_meta\":{\"sqlType\":\"UUID\",\"__tenancy\":{\"isTenantIdField\":true,\"autoFilter\":true,\"required\":true,\"autoPopulate\":true,\"nullable\":false}}},\"userId\":{\"type\":\"crossPackageRef\",\"required\":false,\"related\":\"@happyvertical/smrt-users:User\"},\"objectRef\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"fieldName\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}},\"period\":{\"type\":\"text\",\"required\":true,\"default\":\"\",\"_meta\":{\"required\":true}}},\"methods\":{},\"decoratorConfig\":{\"tableName\":\"_smrt_field_usage_report_receipts\",\"conflictColumns\":[\"tenant_id\",\"user_id\",\"object_ref\",\"field_name\",\"period\"],\"api\":{\"include\":[]},\"cli\":false,\"mcp\":{\"include\":[]}},\"extends\":\"SmrtObject\",\"exportName\":\"FieldUsageReportReceipt\",\"collectionExportName\":\"FieldUsageReportReceiptCollection\",\"validationRules\":[{\"field\":\"tenantId\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"objectRef\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"fieldName\",\"rule\":\"required\",\"fieldType\":\"text\"},{\"field\":\"period\",\"rule\":\"required\",\"fieldType\":\"text\"}],\"schema\":{\"tableName\":\"_smrt_field_usage_report_receipts\",\"ddl\":\"CREATE TABLE IF NOT EXISTS \\\"_smrt_field_usage_report_receipts\\\" (\\n  \\\"id\\\" UUID PRIMARY KEY NOT NULL,\\n  \\\"slug\\\" TEXT NOT NULL,\\n  \\\"context\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"created_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"updated_at\\\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\\n  \\\"tenant_id\\\" UUID NOT NULL,\\n  \\\"user_id\\\" UUID,\\n  \\\"object_ref\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"field_name\\\" TEXT NOT NULL DEFAULT '',\\n  \\\"period\\\" TEXT NOT NULL DEFAULT ''\\n);\",\"columns\":{\"id\":{\"type\":\"UUID\",\"primaryKey\":true,\"referenceKind\":\"id\",\"notNull\":true},\"slug\":{\"type\":\"TEXT\",\"notNull\":true},\"context\":{\"type\":\"TEXT\",\"notNull\":true,\"default\":\"\"},\"created_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"updated_at\":{\"type\":\"TIMESTAMP\",\"notNull\":true,\"default\":\"current_timestamp\"},\"tenant_id\":{\"type\":\"UUID\",\"referenceKind\":\"tenantId\",\"notNull\":true,\"unique\":false},\"user_id\":{\"type\":\"UUID\",\"referenceKind\":\"crossPackageRef\",\"notNull\":false,\"unique\":false},\"object_ref\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"field_name\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"},\"period\":{\"type\":\"TEXT\",\"notNull\":true,\"unique\":false,\"default\":\"\"}},\"indexes\":[{\"name\":\"_smrt_field_usage_report_receipts_id_idx\",\"columns\":[\"id\"]},{\"name\":\"_smrt_field_usage_report_receipts_tenant_id_user_id_idx\",\"columns\":[\"tenant_id\",\"user_id\",\"object_ref\",\"field_name\",\"period\"],\"unique\":true}],\"version\":\"c3119047\"}}},\"moduleType\":\"smrt\",\"smrtDependencies\":[\"@happyvertical/smrt-core\",\"@happyvertical/smrt-tenancy\",\"@happyvertical/smrt-users\"]}"));
 //#endregion
-//#region src/cache.ts
-var FIELD_POLICY_CACHE_TTL_MS = 3e4;
-var fieldPolicyCache = /* @__PURE__ */ new Map();
-var dbInstanceIds = /* @__PURE__ */ new WeakMap();
-var nextDbId = 1;
-function getDbNamespace(db) {
-	if (!db) return "no-db";
-	if (typeof db === "string") return `db:${db}`;
-	if (typeof db === "object") {
-		const dbObject = db;
-		if (typeof dbObject.query === "function") {
-			if (!dbInstanceIds.has(dbObject)) dbInstanceIds.set(dbObject, `db-instance:${nextDbId++}`);
-			const namespace = dbInstanceIds.get(dbObject);
-			if (namespace) return namespace;
-			return "db-instance:unknown";
-		}
-		try {
-			return `db-config:${JSON.stringify(dbObject)}`;
-		} catch {
-			return "db-config:opaque";
-		}
-	}
-	return "db:unknown";
-}
-var hierarchyLoaderIds = /* @__PURE__ */ new WeakMap();
-var nextLoaderId = 1;
-function getHierarchyLoaderNamespace(loader) {
-	if (typeof loader !== "function") return "loader:default";
-	const key = loader;
-	if (!hierarchyLoaderIds.has(key)) hierarchyLoaderIds.set(key, `loader:${nextLoaderId++}`);
-	return hierarchyLoaderIds.get(key) ?? "loader:unknown";
-}
-function buildCacheKey(objectRef, tenantId, userId, db, hierarchyLoader) {
-	return `${getDbNamespace(db)}::${objectRef}::${tenantId ?? "app"}::${userId ?? "user:none"}::${getHierarchyLoaderNamespace(hierarchyLoader)}`;
-}
-function getFieldPolicyCacheTtlMs() {
-	return FIELD_POLICY_CACHE_TTL_MS;
-}
-function getCachedFieldPolicy(objectRef, tenantId, userId, db, hierarchyLoader) {
-	const cacheKey = buildCacheKey(objectRef, tenantId, userId, db, hierarchyLoader);
-	const cached = fieldPolicyCache.get(cacheKey);
-	if (!cached) return null;
-	if (cached.expiresAt <= Date.now()) {
-		fieldPolicyCache.delete(cacheKey);
-		return null;
-	}
-	return cached.value;
-}
-function setCachedFieldPolicy(objectRef, tenantId, userId, db, value, hierarchyLoader) {
-	fieldPolicyCache.set(buildCacheKey(objectRef, tenantId, userId, db, hierarchyLoader), {
-		expiresAt: Date.now() + FIELD_POLICY_CACHE_TTL_MS,
-		value
-	});
-}
-function invalidateFieldPolicyCache(objectRef, db) {
-	const keyPrefix = `${getDbNamespace(db)}::${objectRef}::`;
-	for (const cacheKey of fieldPolicyCache.keys()) if (cacheKey.startsWith(keyPrefix)) fieldPolicyCache.delete(cacheKey);
-}
-function clearFieldPolicyCache() {
-	fieldPolicyCache.clear();
-}
-//#endregion
-//#region src/field-definitions.ts
-function requireRegisteredObject(objectRef) {
-	if (!objectRef?.includes(":")) throw new Error(`Field policy objectRef must be a qualified class name ("@package/name:ClassName"), got "${objectRef}"`);
-	if (!ObjectRegistry.getClassByQualifiedName(objectRef)) throw new Error(`Unknown field policy objectRef "${objectRef}": no class with that qualified name is registered`);
-}
-async function getObjectFieldMap(objectRef) {
-	requireRegisteredObject(objectRef);
-	return ObjectRegistry.getAllFields(objectRef);
-}
-function sanitizeFieldUIHints(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return;
-	const raw = value;
-	const ui = {
-		...typeof raw.basic === "boolean" ? { basic: raw.basic } : {},
-		...typeof raw.group === "string" ? { group: raw.group } : {},
-		...typeof raw.order === "number" && Number.isFinite(raw.order) ? { order: raw.order } : {},
-		...typeof raw.locked === "boolean" ? { locked: raw.locked } : {}
-	};
-	return Object.keys(ui).length > 0 ? ui : void 0;
-}
-function isSensitiveField(field) {
-	return field.sensitive === true || field._meta?.sensitive === true;
-}
-function getFieldReadPermission(field) {
-	if (typeof field.readPermission === "string") return field.readPermission;
-	const metaPermission = field._meta?.readPermission;
-	return typeof metaPermission === "string" ? metaPermission : void 0;
-}
-function isTransientField(field) {
-	return field.transient === true || field._meta?.transient === true;
-}
-function isPolicyAddressableField(field) {
-	return field._meta?.__smrtSystemField !== true && field.type !== "oneToMany" && field.type !== "manyToMany" && field.type !== "meta";
-}
-function isRequiredField(field) {
-	if (field.nullable === true || field._meta?.nullable === true) return false;
-	return field.required === true || field._meta?.required === true;
-}
-function getCodeDefault(field) {
-	if (field.default !== void 0) return { value: field.default };
-	if (field._meta?.default !== void 0) return { value: field._meta.default };
-}
-function isUsableRequiredDefault(defaultBox) {
-	if (!defaultBox) return false;
-	return defaultBox.value !== null && defaultBox.value !== "";
-}
-function buildCodeSeedVisibility(fields) {
-	let hasBasicMarkers = false;
-	const hints = /* @__PURE__ */ new Map();
-	for (const [name, field] of fields) {
-		const ui = sanitizeFieldUIHints(field._meta?.ui);
-		hints.set(name, ui);
-		if (ui?.basic === true) hasBasicMarkers = true;
-	}
-	const visibility = /* @__PURE__ */ new Map();
-	for (const [name] of fields) {
-		const ui = hints.get(name);
-		if (ui?.basic === true) visibility.set(name, "basic");
-		else if (ui?.basic === false || hasBasicMarkers) visibility.set(name, "advanced");
-		else visibility.set(name, "basic");
-	}
-	return visibility;
-}
-function buildCodeSeedDelta(field, visibility) {
-	const ui = sanitizeFieldUIHints(field._meta?.ui);
-	const help = typeof field.description === "string" ? field.description : typeof field._meta?.description === "string" ? field._meta.description : void 0;
-	const codeDefault = getCodeDefault(field);
-	return {
-		...codeDefault ? { default: codeDefault } : {},
-		visibility,
-		...help !== void 0 ? { help } : {},
-		...ui?.order !== void 0 ? { order: ui.order } : {},
-		...ui?.locked === true ? { locked: true } : {}
-	};
-}
-function getCodeSeedGroup(field) {
-	return sanitizeFieldUIHints(field._meta?.ui)?.group ?? null;
-}
-var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function usesTextIdStorage(field) {
-	return field.idType === "text" || field._meta?.idType === "text";
-}
-function assertDefaultValueMatchesFieldType(objectRef, fieldName, field, value) {
-	const label = `Field policy default for "${objectRef}.${fieldName}"`;
-	if (value === null) {
-		if (isRequiredField(field)) throw new Error(`${label} may not be null: the field is required, so a null default is never a usable default`);
-		return;
-	}
-	switch (field.type) {
-		case "text":
-			if (typeof value !== "string") throw new Error(`${label} must be a string (field type "text")`);
-			return;
-		case "integer":
-			if (typeof value !== "number" || !Number.isInteger(value)) throw new Error(`${label} must be an integer (field type "integer")`);
-			return;
-		case "decimal":
-			if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${label} must be a finite number (field type "decimal")`);
-			return;
-		case "boolean":
-			if (typeof value !== "boolean") throw new Error(`${label} must be a boolean (field type "boolean")`);
-			return;
-		case "datetime":
-			if (typeof value !== "string" || Number.isNaN(Date.parse(value))) throw new Error(`${label} must be a date-parseable string (field type "datetime")`);
-			return;
-		case "json": return;
-		case "foreignKey":
-		case "crossPackageRef":
-			if (typeof value !== "string") throw new Error(`${label} must be a string id (field type "${field.type}")`);
-			if (!usesTextIdStorage(field) && !UUID_PATTERN.test(value)) throw new Error(`${label} must be a UUID string (the reference column stores native UUIDs; declare idType 'text' on the field to store arbitrary ids)`);
-			return;
-		default: throw new Error(`${label} is not supported: defaults cannot target "${String(field.type)}" fields`);
-	}
+//#region src/deterministic-id.ts
+async function deterministicFieldsUuid(parts) {
+	const bytes = new TextEncoder().encode(JSON.stringify(parts));
+	const uuid = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)).slice(0, 16);
+	uuid[6] = uuid[6] & 15 | 80;
+	uuid[8] = uuid[8] & 63 | 128;
+	const hex = Array.from(uuid, (byte) => byte.toString(16).padStart(2, "0")).join("");
+	return [
+		hex.slice(0, 8),
+		hex.slice(8, 12),
+		hex.slice(12, 16),
+		hex.slice(16, 20),
+		hex.slice(20)
+	].join("-");
 }
 //#endregion
-//#region src/models/FieldPolicy.ts
-var __defProp$1 = Object.defineProperty;
-var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
-var __decorateClass$1 = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
+//#region src/models/FieldPolicySuggestion.ts
+var __defProp$5 = Object.defineProperty;
+var __getOwnPropDesc$5 = Object.getOwnPropertyDescriptor;
+var __decorateClass$5 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$5(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp$1(target, key, result);
+	if (kind && result) __defProp$5(target, key, result);
 	return result;
 };
-ensureFieldPolicyPermissionsRegistered();
-var FIELD_POLICY_SCOPE_DENIAL_MESSAGE = "Field policy scope is not permitted for this principal.";
-function getFieldPolicyAmbientContext() {
-	const tenantContext = getCurrentTenant();
-	if (tenantContext) return {
-		permissions: tenantContext.permissions,
-		superAdminBypass: isSuperAdminBypass(),
-		tenantId: tenantContext.tenantId,
-		userId: tenantContext.userId
-	};
-	const sessionContext = getCurrentSessionPermissionContext();
-	if (!sessionContext?.tenantId) return;
-	return {
-		permissions: sessionContext.permissionSet,
-		superAdminBypass: sessionContext.superAdminBypass,
-		tenantId: sessionContext.tenantId,
-		userId: sessionContext.userId ?? void 0
-	};
-}
-var FieldPolicyAuthorizationError = class extends Error {
-	code = "permission_denied";
-	status = 403;
-	constructor(message) {
-		super(message);
-		this.name = "FieldPolicyAuthorizationError";
-	}
-};
-var FieldPolicyTenantIsolationError = class extends TenantIsolationError {
-	publicMessage = FIELD_POLICY_SCOPE_DENIAL_MESSAGE;
-	status = 403;
-	constructor(diagnosticMessage, details) {
-		super(FIELD_POLICY_SCOPE_DENIAL_MESSAGE);
-		Object.defineProperty(this, "cause", {
-			configurable: true,
-			enumerable: false,
-			value: new Error(diagnosticMessage),
-			writable: false
-		});
-		Object.defineProperty(this, "diagnostic", {
-			configurable: true,
-			enumerable: false,
-			value: {
-				...details,
-				message: diagnosticMessage
-			},
-			writable: false
-		});
-	}
-};
-var FieldPolicy = class extends SmrtObject {
+var ACTIVE_SUGGESTION_KEY = "active";
+var FieldPolicySuggestion = class extends SmrtObject {
 	objectRef = "";
 	fieldName = "";
-	scopeType = "app";
-	tenantId = null;
-	userId = null;
-	scopeKey = "";
-	defaultValue = null;
-	visibility = null;
-	help = null;
-	label = null;
-	displayOrder = null;
-	locked = null;
-	updatedBy = null;
+	tenantId;
+	kind = "promote";
+	proposedValue = null;
+	evidence = "{}";
+	status = "pending";
+	activeKey = ACTIVE_SUGGESTION_KEY;
+	cooldownUntil = null;
+	decidedBy = null;
+	decidedAt = null;
 	constructor(options = {}) {
 		super(options);
 		if (options.objectRef !== void 0) this.objectRef = options.objectRef;
 		if (options.fieldName !== void 0) this.fieldName = options.fieldName;
-		if (options.scopeType !== void 0) this.scopeType = options.scopeType;
 		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
-		if (options.userId !== void 0) this.userId = options.userId;
-		if (options.defaultValue !== void 0 && options.defaultValueRaw !== void 0) throw new Error("FieldPolicy accepts either defaultValue (already JSON-encoded) or defaultValueRaw (a plain value to serialize), not both");
-		if (options.defaultValueRaw !== void 0) this.setDefaultValue(options.defaultValueRaw);
-		else if (options.defaultValue !== void 0) this.defaultValue = options.defaultValue;
-		if (options.visibility !== void 0) this.visibility = options.visibility;
-		if (options.help !== void 0) this.help = options.help;
-		if (options.label !== void 0) this.label = options.label;
-		if (options.displayOrder !== void 0) this.displayOrder = options.displayOrder;
-		if (options.locked !== void 0) this.locked = options.locked;
-		if (options.updatedBy !== void 0) this.updatedBy = options.updatedBy;
+		if (options.kind !== void 0) this.kind = options.kind;
+		if (options.proposedValue !== void 0) this.proposedValue = options.proposedValue;
+		if (options.evidence !== void 0) this.evidence = options.evidence;
+		if (options.status !== void 0) this.status = options.status;
+		if (options.cooldownUntil !== void 0) this.cooldownUntil = options.cooldownUntil;
+		if (options.decidedBy !== void 0) this.decidedBy = options.decidedBy;
+		if (options.decidedAt !== void 0) this.decidedAt = options.decidedAt;
 	}
-	/** Parse the stored JSON default. `undefined` = no stored default (inherit). */
-	getDefaultValue() {
-		if (this.defaultValue === null || this.defaultValue === void 0) return;
+	/** Parse the stored evidence object (guarded; junk parses as empty). */
+	getEvidence() {
 		try {
-			return JSON.parse(this.defaultValue);
+			const parsed = JSON.parse(this.evidence);
+			return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
 		} catch {
-			return;
+			return {};
 		}
 	}
-	/** Serialize a default value; `undefined` clears the override (inherit). */
-	setDefaultValue(value) {
-		this.defaultValue = value === void 0 ? null : JSON.stringify(value);
+	/** Serialize an evidence object into the stored JSON string. */
+	setEvidence(evidence) {
+		this.evidence = JSON.stringify(evidence);
 	}
-	async save() {
-		this.attributeScopeToAmbientContext();
-		const previousIdentity = await this.getPersistedIdentity();
-		if (previousIdentity) {
-			this.assertScopeOwnedByAmbientContext(previousIdentity, "save");
-			await this.assertScopePermission(previousIdentity);
+	/** Parse the proposed value; `undefined` when none is stored. */
+	getProposedValue() {
+		if (this.proposedValue === null || this.proposedValue === void 0) return;
+		try {
+			return JSON.parse(this.proposedValue);
+		} catch {
+			return;
 		}
-		this.assertScopeOwnedByAmbientContext(this, "save");
-		await this.assertScopePermission(this);
-		const ambientContext = getFieldPolicyAmbientContext();
-		if (ambientContext) this.updatedBy = ambientContext.userId ?? null;
-		this.normalizeDefaultValueForPersistence();
-		await this.validateFieldPolicy(previousIdentity);
-		this.scopeKey = this.computeScopeKey();
-		const identityChanged = previousIdentity && (previousIdentity.objectRef !== this.objectRef || previousIdentity.fieldName !== this.fieldName || previousIdentity.scopeType !== this.scopeType || previousIdentity.scopeKey !== this.scopeKey);
-		const result = identityChanged && previousIdentity ? await this.saveAfterIdentityChange() : await super.save();
-		if (identityChanged && previousIdentity) invalidateFieldPolicyCache(previousIdentity.objectRef, this.db);
-		invalidateFieldPolicyCache(this.objectRef, this.db);
-		return result;
 	}
-	async saveAfterIdentityChange() {
-		if (typeof this.db.beginTransaction === "function") return this.saveAfterIdentityChangeInTransaction();
-		return this.saveAfterIdentityChangeWithDeferredDelete();
+	/** Serialized row shape for the collection actions. */
+	toSuggestionData() {
+		return {
+			id: String(this.id),
+			objectRef: this.objectRef,
+			fieldName: this.fieldName,
+			tenantId: String(this.tenantId ?? ""),
+			kind: this.kind,
+			proposedValue: this.proposedValue ?? null,
+			evidence: this.getEvidence(),
+			status: this.status,
+			cooldownUntil: toIsoOrNull(this.cooldownUntil),
+			decidedBy: this.decidedBy ?? null,
+			decidedAt: toIsoOrNull(this.decidedAt)
+		};
 	}
-	async saveAfterIdentityChangeInTransaction() {
-		const originalDb = this._db;
-		const originalOptionsDb = this.options.db;
-		const tx = await this.db.beginTransaction?.();
-		if (!tx) return this.saveAfterIdentityChangeWithDeferredDelete();
-		try {
-			this._db = tx;
-			this.options.db = tx;
-			await super.delete();
-			const result = await super.save();
-			await tx.commit();
-			return result;
-		} catch (error) {
-			try {
-				await tx.rollback();
-			} catch {}
-			throw error;
-		} finally {
-			this._db = originalDb;
-			this.options.db = originalOptionsDb;
-		}
+	async save() {
+		await this.assertRowOwnedByAmbientContext("save");
+		await this.validateFieldPolicySuggestion();
+		this.applyActiveKey();
+		return super.save();
 	}
-	async saveAfterIdentityChangeWithDeferredDelete() {
-		const previousId = this.id;
-		if (!previousId) return super.save();
-		const replacementId = crypto.randomUUID();
-		let replacementSaved = false;
-		this.id = replacementId;
-		try {
-			const result = await super.save();
-			replacementSaved = true;
-			await this.db.delete(this.tableName, { id: previousId });
-			return result;
-		} catch (error) {
-			if (replacementSaved) try {
-				await this.db.delete(this.tableName, { id: replacementId });
-			} catch {}
-			this.id = previousId;
-			throw error;
+	/**
+	* Recompute the lifecycle-slot key: the shared sentinel while pending (so
+	* the unique index admits exactly one), the row's own id once settled (so
+	* history never competes for the slot and the freed slot allows a
+	* post-cool-down regeneration). A settled row that has not been persisted
+	* yet is assigned its id here — the key must be unique from the first write.
+	*/
+	applyActiveKey() {
+		if (this.status === "pending") {
+			this.activeKey = ACTIVE_SUGGESTION_KEY;
+			return;
 		}
+		if (!this.id) this.id = crypto.randomUUID();
+		this.activeKey = String(this.id);
 	}
 	async delete() {
-		const persisted = await this.getPersistedIdentity();
-		if (persisted) this.assertScopeOwnedByAmbientContext(persisted, "delete");
-		await this.assertScopePermission(persisted ?? this);
-		const objectRef = persisted?.objectRef ?? this.objectRef;
+		await this.assertRowOwnedByAmbientContext("delete");
 		await super.delete();
-		invalidateFieldPolicyCache(objectRef, this.db);
-		if (this.objectRef && this.objectRef !== objectRef) invalidateFieldPolicyCache(this.objectRef, this.db);
 	}
-	async validateFieldPolicy(previousIdentity) {
-		if (!this.objectRef || this.objectRef.trim() === "") throw new Error("FieldPolicy.objectRef is required");
-		if (!this.fieldName || this.fieldName.trim() === "") throw new Error("FieldPolicy.fieldName is required");
-		if (!FIELD_POLICY_SCOPE_TYPES.includes(this.scopeType)) throw new Error(`FieldPolicy.scopeType must be one of ${FIELD_POLICY_SCOPE_TYPES.join(", ")}; got "${this.scopeType}"`);
-		if (this.visibility !== null && !FIELD_POLICY_VISIBILITIES.includes(this.visibility)) throw new Error(`FieldPolicy.visibility must be null or one of ${FIELD_POLICY_VISIBILITIES.join(", ")}; got "${this.visibility}"`);
-		if (this.displayOrder !== null && (typeof this.displayOrder !== "number" || !Number.isInteger(this.displayOrder))) throw new Error("FieldPolicy.displayOrder must be null or an integer");
-		this.validateScopeConsistency();
-		this.validateTenantContextBoundary();
+	/**
+	* The "normal validation" the #1885 seam promises producers: registry-known
+	* field, policy-addressable, never sensitive/read-permission-gated/transient
+	* (those fields are count-only in usage data and get no suggestions), valid
+	* kind/status, and for `default` suggestions a JSON proposed value that
+	* type-checks against the manifest field type.
+	*/
+	async validateFieldPolicySuggestion() {
+		if (!this.objectRef || this.objectRef.trim() === "") throw new Error("FieldPolicySuggestion.objectRef is required");
+		if (!this.fieldName || this.fieldName.trim() === "") throw new Error("FieldPolicySuggestion.fieldName is required");
+		if (!this.tenantId) throw new Error("FieldPolicySuggestion.tenantId is required");
+		if (!FIELD_POLICY_SUGGESTION_KINDS.includes(this.kind)) throw new Error(`FieldPolicySuggestion.kind must be one of ${FIELD_POLICY_SUGGESTION_KINDS.join(", ")}; got "${this.kind}"`);
+		if (!FIELD_POLICY_SUGGESTION_STATUSES.includes(this.status)) throw new Error(`FieldPolicySuggestion.status must be one of ${FIELD_POLICY_SUGGESTION_STATUSES.join(", ")}; got "${this.status}"`);
 		const fieldDef = (await getObjectFieldMap(this.objectRef)).get(this.fieldName);
 		if (!fieldDef) throw new Error(`Unknown field "${this.fieldName}" on "${this.objectRef}"`);
-		if (fieldDef._meta?.__smrtSystemField === true) throw new Error(`Field "${this.fieldName}" on "${this.objectRef}" is a framework system field and is not policy-addressable`);
-		if (fieldDef.type === "oneToMany" || fieldDef.type === "manyToMany") throw new Error(`Field "${this.fieldName}" on "${this.objectRef}" is a relationship pseudo-field and is not policy-addressable`);
-		if (fieldDef.type === "meta") throw new Error(`Field "${this.fieldName}" on "${this.objectRef}" is STI meta storage and is not policy-addressable`);
-		if (this.locked !== null && this.scopeType === "user") throw new Error("FieldPolicy.locked may only be set on org rows (app or tenant scope)");
-		if (this.defaultValue !== null) {
-			this.validateDefaultAgainstSecurityRail(fieldDef);
-			const parsed = this.parseDefaultValueOrThrow();
+		if (fieldDef._meta?.__smrtSystemField === true || fieldDef.type === "oneToMany" || fieldDef.type === "manyToMany" || fieldDef.type === "meta") throw new Error(`Field "${this.fieldName}" on "${this.objectRef}" is not policy-addressable, so it cannot carry a suggestion`);
+		if (isSensitiveField(fieldDef) || getFieldReadPermission(fieldDef) !== void 0 || isTransientField(fieldDef)) throw new Error(`Field "${this.fieldName}" on "${this.objectRef}" is sensitive, read-permission-gated, or transient; usage data for it is count-only and it cannot carry a suggestion`);
+		if (this.kind === "default") {
+			if (this.proposedValue === null) throw new Error("FieldPolicySuggestion of kind 'default' requires a proposedValue");
+			let parsed;
+			try {
+				parsed = JSON.parse(this.proposedValue);
+			} catch (error) {
+				throw new Error(`FieldPolicySuggestion.proposedValue is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+			}
 			assertDefaultValueMatchesFieldType(this.objectRef, this.fieldName, fieldDef, parsed);
-		}
-		const demotesRequiredField = (this.visibility === "advanced" || this.visibility === "hidden") && isRequiredField(fieldDef);
-		const ownDefault = demotesRequiredField && this.defaultValue !== null ? { value: this.parseDefaultValueOrThrow() } : void 0;
-		const needsOrgDefault = demotesRequiredField && !isUsableRequiredDefault(ownDefault);
-		const needsLockCheck = this.scopeType === "user";
-		if (needsOrgDefault || needsLockCheck) {
-			const orgPolicy = await this.resolveOrgTierFieldPolicy(previousIdentity);
-			if (needsOrgDefault) {
-				if (!isUsableRequiredDefault(orgPolicy?.hasDefault ? { value: orgPolicy.defaultValue } : void 0)) throw new Error(`Cannot set visibility "${this.visibility}" for required field "${this.objectRef}.${this.fieldName}": no resolved default exists at or below this layer`);
+		} else if (this.proposedValue !== null) throw new Error("FieldPolicySuggestion of kind 'promote' must not carry a proposedValue");
+	}
+	/**
+	* Tenant write boundary (the FieldPolicy posture): inside a non-bypass
+	* tenant context a caller may only touch its own tenant's suggestions —
+	* checked against BOTH the in-memory scope and, for persisted rows, the
+	* PERSISTED tenant (a foreign row cannot be re-scoped into the caller's
+	* tenant). Trusted execution (no context / bypass) is exempt — that is what
+	* lets the scheduled generation job and platform flows operate.
+	*/
+	async assertRowOwnedByAmbientContext(operation) {
+		const context = getCurrentTenant();
+		if (!context || isSuperAdminBypass()) return;
+		if (this.tenantId !== context.tenantId) throw new TenantIsolationError(`Tenant isolation violation in FieldPolicySuggestion.${operation}: context tenant is '${context.tenantId}' but the row belongs to '${this.tenantId}'`, {
+			tenantId: context.tenantId,
+			attemptedTenantId: this.tenantId ?? void 0
+		});
+		if (this.id) {
+			const persisted = await this.db.get(this.tableName, { id: this.id });
+			if (persisted) {
+				const row = persisted;
+				const persistedTenant = row.tenantId ?? row.tenant_id ?? this.tenantId ?? null;
+				if (persistedTenant !== null && String(persistedTenant) !== context.tenantId) throw new TenantIsolationError(`Tenant isolation violation in FieldPolicySuggestion.${operation}: the persisted row belongs to '${String(persistedTenant)}'`, {
+					tenantId: context.tenantId,
+					attemptedTenantId: String(persistedTenant)
+				});
 			}
-			if (needsLockCheck && orgPolicy?.locked) throw new FieldPolicyAuthorizationError(`Field "${this.objectRef}.${this.fieldName}" is locked by org policy; user-scope overrides are not allowed`);
 		}
 	}
+};
+__decorateClass$5([field({ required: true })], FieldPolicySuggestion.prototype, "objectRef", 2);
+__decorateClass$5([field({ required: true })], FieldPolicySuggestion.prototype, "fieldName", 2);
+__decorateClass$5([tenantId()], FieldPolicySuggestion.prototype, "tenantId", 2);
+__decorateClass$5([field({ required: true })], FieldPolicySuggestion.prototype, "kind", 2);
+__decorateClass$5([field({
+	type: "text",
+	nullable: true
+})], FieldPolicySuggestion.prototype, "proposedValue", 2);
+__decorateClass$5([field({ type: "text" })], FieldPolicySuggestion.prototype, "evidence", 2);
+__decorateClass$5([field({ required: true })], FieldPolicySuggestion.prototype, "status", 2);
+__decorateClass$5([field({
+	type: "text",
+	required: true
+})], FieldPolicySuggestion.prototype, "activeKey", 2);
+__decorateClass$5([field({
+	type: "datetime",
+	nullable: true
+})], FieldPolicySuggestion.prototype, "cooldownUntil", 2);
+__decorateClass$5([crossPackageRef("@happyvertical/smrt-users:User", { nullable: true })], FieldPolicySuggestion.prototype, "decidedBy", 2);
+__decorateClass$5([field({
+	type: "datetime",
+	nullable: true
+})], FieldPolicySuggestion.prototype, "decidedAt", 2);
+FieldPolicySuggestion = __decorateClass$5([smrt({
+	tableName: "_smrt_field_policy_suggestions",
+	conflictColumns: [
+		"object_ref",
+		"field_name",
+		"tenant_id",
+		"kind",
+		"active_key"
+	],
+	api: { include: [] },
+	cli: false,
+	mcp: { include: [] }
+})], FieldPolicySuggestion);
+function toIsoOrNull(value) {
+	if (value === null || value === void 0) return null;
+	if (value instanceof Date) return value.toISOString();
+	const parsed = Date.parse(value);
+	return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+//#endregion
+//#region src/collections/FieldPolicySuggestionCollection.ts
+var __defProp$4 = Object.defineProperty;
+var __getOwnPropDesc$4 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$2 = (obj, key, value) => key in obj ? __defProp$4(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass$4 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$4(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$4(target, key, result);
+	return result;
+};
+var __publicField$2 = (obj, key, value) => __defNormalProp$2(obj, typeof key !== "symbol" ? key + "" : key, value);
+var FieldPolicySuggestionConflictError = class extends Error {
+	/** Core's generated-REST status contract (own integer property). */
+	httpStatus = 409;
+	/** The users-style shape mirrored by this package's authorization errors. */
+	status = 409;
+	constructor(operation, suggestionId) {
+		super(`${operation}: suggestion "${suggestionId}" was already decided by another request (it is no longer pending)`);
+		this.name = "FieldPolicySuggestionConflictError";
+	}
+};
+var FieldPolicySuggestionRequestContextError = class extends TenantIsolationError {
+	httpStatus = 403;
+	status = 403;
+	constructor(message, details) {
+		super(message, details);
+		this.name = "FieldPolicySuggestionRequestContextError";
+	}
+};
+function transactionBoundOptions(db) {
+	return {
+		db,
+		_reuseInitializedDb: true,
+		_deferRuntimeInitialization: true
+	};
+}
+async function claimSuggestionTransition(db, suggestionId, patch) {
+	return ((await db.query(`UPDATE _smrt_field_policy_suggestions
+        SET status = ?,
+            active_key = ?,
+            decided_at = ?,
+            decided_by = ?,
+            cooldown_until = ?
+      WHERE id = ? AND status = 'pending'
+      RETURNING id`, patch.status, patch.activeKey, patch.decidedAt.toISOString(), patch.decidedBy, patch.cooldownUntil ? patch.cooldownUntil.toISOString() : null, suggestionId))?.rows?.length ?? 0) > 0;
+}
+async function revertSuggestionToPending(db, suggestionId) {
+	await db.query(`UPDATE _smrt_field_policy_suggestions
+        SET status = 'pending',
+            active_key = ?,
+            decided_at = NULL,
+            decided_by = NULL,
+            cooldown_until = NULL
+      WHERE id = ?`, ACTIVE_SUGGESTION_KEY, suggestionId);
+}
+async function settleSuggestionActiveKey(db, suggestionId) {
+	await db.query(`UPDATE _smrt_field_policy_suggestions
+        SET active_key = ?
+      WHERE id = ?`, suggestionId, suggestionId);
+}
+var FieldPolicySuggestionCompensationError = class extends Error {
+	httpStatus = 500;
+	status = 500;
+	revertCause;
+	constructor(suggestionId, cause, revertCause) {
+		super(`acceptSuggestion: the policy write for suggestion "${suggestionId}" failed AND reverting it to pending also failed; the suggestion may be left accepted without its policy row and needs reconciliation (policy error: ${cause instanceof Error ? cause.message : String(cause)}; revert error: ${revertCause instanceof Error ? revertCause.message : String(revertCause)})`, { cause });
+		this.name = "FieldPolicySuggestionCompensationError";
+		this.revertCause = revertCause;
+	}
+};
+function fieldPolicyRowId(tenantId, objectRef, fieldName) {
+	return deterministicFieldsUuid([
+		"field-policy-row",
+		"tenant",
+		tenantId,
+		objectRef,
+		fieldName
+	]);
+}
+async function updatePolicyColumn(db, target) {
+	const id = ((await db.query(`UPDATE _smrt_field_policies
+        SET ${target.column} = ?,
+            updated_by = ?,
+            updated_at = ?
+      WHERE object_ref = ?
+        AND field_name = ?
+        AND scope_type = 'tenant'
+        AND tenant_id = ?
+      RETURNING id`, target.value, target.decidedBy, (/* @__PURE__ */ new Date()).toISOString(), target.objectRef, target.fieldName, target.tenantId))?.rows ?? [])[0]?.id;
+	return id === void 0 || id === null ? null : String(id);
+}
+async function assertAcceptedDefaultStillAllowed(suggestion) {
+	const fieldDef = await assertAcceptedPolicyTargetStillAllowed(suggestion);
+	if (suggestion.proposedValue === null) throw new Error("FieldPolicySuggestion of kind 'default' requires a proposedValue");
+	let parsed;
+	try {
+		parsed = JSON.parse(suggestion.proposedValue);
+	} catch (error) {
+		throw new Error(`FieldPolicySuggestion.proposedValue is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	assertDefaultValueMatchesFieldType(suggestion.objectRef, suggestion.fieldName, fieldDef, parsed);
+}
+async function assertAcceptedPolicyTargetStillAllowed(suggestion) {
+	const fieldDef = (await getObjectFieldMap(suggestion.objectRef)).get(suggestion.fieldName);
+	if (!fieldDef || !isPolicyAddressableField(fieldDef)) throw new Error(`Field "${suggestion.fieldName}" on "${suggestion.objectRef}" is not policy-addressable`);
+	if (isSensitiveField(fieldDef) || getFieldReadPermission(fieldDef) !== void 0 || isTransientField(fieldDef)) throw new Error(`Cannot apply a policy for "${suggestion.objectRef}.${suggestion.fieldName}": the field is sensitive, read-permission-gated, or transient`);
+	return fieldDef;
+}
+var DEFAULT_SUGGESTION_COOL_DOWN_MS = 720 * 60 * 60 * 1e3;
+var MIN_SUGGESTION_COOL_DOWN_MS = 3600 * 1e3;
+var MAX_SUGGESTION_COOL_DOWN_MS = 365 * 24 * 60 * 60 * 1e3;
+var MAX_PENDING_OBJECT_REFS = 100;
+var FieldPolicySuggestionCollection = class extends SmrtCollection {
 	/**
-	* Effective org-tier (code → app → tenant hierarchy) policy for this row's
-	* field, computed by the RESOLVER so write-time checks share the one
-	* precedence implementation — including ancestor-tenant cascades via the
-	* default hierarchy loader. The chain tenant is the row's own tenant for
-	* tenant-scope rows, the ambient context tenant for user-scope rows, and
-	* none for app-scope rows (their only lower layer is the code seed).
-	*
-	* During an update, the persisted row is excluded from the lower-layer
-	* projection. That makes a clear-default + required-field demotion validate
-	* the post-write policy rather than accidentally counting the row being
-	* replaced.
+	* The caller's tenant's PENDING suggestions (optionally filtered to a set
+	* of objectRefs), newest first, plus the total for the gear badge.
 	*/
-	async resolveOrgTierFieldPolicy(previousIdentity) {
-		const tenantIdForChain = this.scopeType === "tenant" ? this.tenantId : this.scopeType === "user" ? getFieldPolicyAmbientContext()?.tenantId ?? null : null;
-		const { resolveFieldPolicy } = await Promise.resolve().then(() => field_policy_resolver_exports);
-		return (await resolveFieldPolicy(this.objectRef, {
-			tenantId: tenantIdForChain,
-			db: this.options.db ?? this.options.persistence,
-			...previousIdentity ? { excludePolicyIds: /* @__PURE__ */ new Set([previousIdentity.id]) } : {}
-		})).fields[this.fieldName];
+	async pendingSuggestions(options = {}) {
+		const tenantId = await this.requireManageContext("pendingSuggestions");
+		const objectRefs = normalizeObjectRefsFilter(options.objectRefs);
+		const where = {
+			tenantId,
+			status: "pending"
+		};
+		if (objectRefs) where["objectRef in"] = objectRefs;
+		const rows = await this.list({
+			where,
+			orderBy: "created_at DESC"
+		});
+		return {
+			suggestions: rows.map((row) => row.toSuggestionData()),
+			total: rows.length
+		};
 	}
 	/**
-	* Exactly-one-owner scope shape: app rows carry neither id, tenant rows
-	* carry only `tenantId`, user rows carry only `userId` (the user tier is
-	* keyed by user alone so preferences follow the user across tenants).
+	* Accept a pending suggestion: CLAIM the pending→accepted transition, then
+	* write the corresponding org-scope `FieldPolicy` row THROUGH NORMAL
+	* VALIDATION (registry check, type check, security rail, required-field
+	* invariant, ownership boundary, and the #2049 permission split — the
+	* ambient caller must hold `fields.policy.manage`, which this action also
+	* asserts up front).
+	*
+	* An existing tenant row for the same `(objectRef, fieldName)` is UPDATED
+	* (read-modify-write), preserving its other sparse columns — never
+	* duplicated through the natural-key upsert.
+	*
+	* Concurrency: the claim is a compare-and-set on `status` (the jobs
+	* `writeOwnedJob` precedent — a guarded UPDATE with `RETURNING id`), so an
+	* overlapping accept/dismiss pair cannot both win; the loser throws
+	* {@link FieldPolicySuggestionConflictError} (409). Claim and policy write
+	* run in ONE transaction when the driver supports it, so a rejected policy
+	* write can never leave the suggestion settled without its policy (and vice
+	* versa). Drivers without transactions get an explicit compensating revert.
 	*/
-	validateScopeConsistency() {
-		if (this.scopeType === "app") {
-			if (this.tenantId !== null || this.userId !== null) throw new Error("App-scope field policy rows must have tenantId and userId null");
-			return;
+	async acceptSuggestion(options = {}) {
+		const tenantId = await this.requireManageContext("acceptSuggestion");
+		const suggestion = await this.loadOwnedPendingSuggestion("acceptSuggestion", options.id, tenantId);
+		const suggestionId = String(suggestion.id);
+		const decidedBy = getCurrentTenant()?.userId ?? null;
+		const decidedAt = /* @__PURE__ */ new Date();
+		const claim = {
+			status: "accepted",
+			activeKey: suggestionId,
+			decidedAt,
+			decidedBy,
+			cooldownUntil: null
+		};
+		const tx = await this.beginTransactionIfSupported();
+		if (tx) {
+			let policyRowId2;
+			try {
+				if (!await claimSuggestionTransition(tx, suggestionId, claim)) throw new FieldPolicySuggestionConflictError("acceptSuggestion", suggestionId);
+				policyRowId2 = await this.applyAcceptedPolicy(tx, suggestion, tenantId, decidedBy);
+				await tx.commit();
+			} catch (error) {
+				try {
+					await tx.rollback();
+				} catch {}
+				throw error;
+			}
+			invalidateFieldPolicyCache(suggestion.objectRef, this.db);
+			suggestion.status = "accepted";
+			suggestion.decidedAt = decidedAt;
+			suggestion.decidedBy = decidedBy;
+			return {
+				suggestion: suggestion.toSuggestionData(),
+				policyRowId: policyRowId2
+			};
 		}
-		if (this.scopeType === "tenant") {
-			if (!this.tenantId || this.userId !== null) throw new Error("Tenant-scope field policy rows must set tenantId and leave userId null");
-			return;
+		if (!await claimSuggestionTransition(this.db, suggestionId, {
+			...claim,
+			activeKey: "active"
+		})) throw new FieldPolicySuggestionConflictError("acceptSuggestion", suggestionId);
+		let policyRowId;
+		try {
+			policyRowId = await this.applyAcceptedPolicy(this.db, suggestion, tenantId, decidedBy);
+		} catch (error) {
+			try {
+				await revertSuggestionToPending(this.db, suggestionId);
+			} catch (revertError) {
+				throw new FieldPolicySuggestionCompensationError(suggestionId, error, revertError);
+			}
+			throw error;
 		}
-		if (!this.userId || this.tenantId !== null) throw new Error("User-scope field policy rows must set userId and leave tenantId null");
-	}
-	/** `userId ?? tenantId ?? '__app__'` — the `conflictColumns` scope key. */
-	computeScopeKey() {
-		return this.userId ?? this.tenantId ?? "__app__";
+		await settleSuggestionActiveKey(this.db, suggestionId);
+		invalidateFieldPolicyCache(suggestion.objectRef, this.db);
+		suggestion.status = "accepted";
+		suggestion.decidedAt = decidedAt;
+		suggestion.decidedBy = decidedBy;
+		return {
+			suggestion: suggestion.toSuggestionData(),
+			policyRowId
+		};
 	}
 	/**
-	* Derive a scope-owner column the transport could not carry (#2047).
-	*
-	* Core's mass-assignment guard treats `tenantId` as server-managed and
-	* strips it from EVERY generated create/update body, and `FieldPolicy` is
-	* deliberately not `@TenantScoped`, so the tenancy interceptor never
-	* repopulates it. A `POST {scopeType:'tenant', tenantId}` therefore always
-	* reached `validateScopeConsistency` with `tenantId === null`, making the
-	* org tier write-dead over every generated surface — the model, as the
-	* single validation authority for these rows, fills it in instead.
+	* Dismiss a pending suggestion: set status + a cool-down until which the
+	* generation job will NOT regenerate the same
+	* `(objectRef, fieldName, tenantId, kind)` suggestion.
 	*
-	* This grants nothing: `assertScopeOwnedByAmbientContext` already requires
-	* a non-bypass caller's tenant/user rows to name exactly the ambient
-	* tenant/user, so the derived value is the ONLY value that could ever have
-	* been accepted. An explicit value is never overwritten (a super-admin
-	* bypass caller keeps naming other scopes), and with neither tenancy nor
-	* authenticated-session context nothing is derived — scope-shape validation
-	* rejects the row as before.
-	* Consequence: a bypass caller writing ANOTHER tenant's row must pass
-	* `tenantId` through a server-side model call, because the generated routes
-	* still strip it.
+	* Validates OWNERSHIP and PENDING STATUS ONLY — deliberately NOT continued
+	* proposal eligibility. A queued suggestion whose field has since been
+	* removed, turned sensitive/`readPermission`-gated/transient, or retyped is
+	* exactly the row an operator most needs to clear; re-running proposal
+	* validation on the way out would reject the dismissal and, because pending
+	* rows are never pruned, wedge it in the queue forever. The claim is the same
+	* compare-and-set as accept, so it also bypasses the model's proposal
+	* validation by construction.
 	*/
-	attributeScopeToAmbientContext() {
-		const context = getFieldPolicyAmbientContext();
-		if (!context) return;
-		if (this.scopeType === "tenant" && this.tenantId === null) this.tenantId = context.tenantId;
-		if (this.scopeType === "user" && this.userId === null) this.userId = context.userId ?? null;
+	async dismissSuggestion(options = {}) {
+		const tenantId = await this.requireManageContext("dismissSuggestion");
+		const suggestion = await this.loadOwnedPendingSuggestion("dismissSuggestion", options.id, tenantId);
+		const suggestionId = String(suggestion.id);
+		const coolDownMs = normalizeCoolDownMs(options.coolDownMs);
+		const decidedAt = /* @__PURE__ */ new Date();
+		const decidedBy = getCurrentTenant()?.userId ?? null;
+		const cooldownUntil = new Date(decidedAt.getTime() + coolDownMs);
+		if (!await claimSuggestionTransition(this.db, suggestionId, {
+			status: "dismissed",
+			activeKey: suggestionId,
+			decidedAt,
+			decidedBy,
+			cooldownUntil
+		})) throw new FieldPolicySuggestionConflictError("dismissSuggestion", suggestionId);
+		suggestion.status = "dismissed";
+		suggestion.cooldownUntil = cooldownUntil;
+		suggestion.decidedAt = decidedAt;
+		suggestion.decidedBy = decidedBy;
+		return { suggestion: suggestion.toSuggestionData() };
 	}
 	/**
-	* Fail-closed write boundary against the ambient tenant context, applied to
-	* the NEW scope on save and to the PERSISTED scope on save/delete of an
-	* existing row.
+	* Write the org-scope policy column an accepted suggestion implies, bound to
+	* `db` so it participates in the caller's transaction.
 	*
-	* With NO ambient identity at all (neither tenant ALS nor authenticated
-	* session-permission ALS), only app-scope rows are accepted: tenant- and
-	* user-scope rows are unattributable without a context, so they are
-	* rejected outright rather than allowed by default. Inside a non-bypass
-	* context, a caller may only touch rows for its own tenant, and user rows
-	* only for its own user id — a context that carries NO user id may not
-	* touch the user tier at all.
-	* App-wide rows then require super-admin bypass (or a context-less/system
-	* caller).
+	* A `promote` and a `default` suggestion for the SAME field share one sparse
+	* `FieldPolicy` row but own DIFFERENT columns, and both may be accepted
+	* concurrently. A read-modify-save of the whole row therefore loses updates:
+	* each acceptance reads the row (or its absence) before the other's save
+	* lands, and the later full-row write erases the sibling's column — and, via
+	* the natural-key upsert, can even replace the row id, dangling the earlier
+	* caller's `policyRowId`. (Distinct from the suggestion-row race fixed
+	* earlier: that one guards the pending→settled transition; this one is on the
+	* shared policy row.) So this NEVER writes a whole row over an existing one:
 	*
-	* Package rule: a missing identity component DENIES, it never skips.
+	* 1. An ATOMIC partial UPDATE sets only this acceptance's column, keyed by
+	*    the policy natural key and `RETURNING id` — one statement, so no
+	*    interleaving can drop the sibling's column, and the returned id is
+	*    always the surviving row.
+	* 2. Only when no row exists yet does it CREATE through the model, so full
+	*    validation (registry, type check, security rail, required-field
+	*    invariant, ownership + permission split) runs on the row that is
+	*    actually inserted. The row carries a DETERMINISTIC id under strict
+	*    insert, so two concurrent creates cannot each mint a row: the loser
+	*    collides and falls back to step 1, applying only its own column.
+	*
+	* The update path skips the model, so BOTH kinds re-check live target
+	* addressability through the shared helpers (a field can turn sensitive,
+	* gated, transient, or disappear between queueing and acceptance). Defaults
+	* additionally re-check their value/type rail; a promotion to `basic` has no
+	* value payload, and the required-field invariant restricts only
+	* advanced/hidden. Org locks constrain the user tier, not org rows.
 	*/
-	assertScopeOwnedByAmbientContext(scope, operation) {
-		const context = getFieldPolicyAmbientContext();
-		if (!context) {
-			if (scope.scopeType === "tenant" || scope.scopeType === "user") throw new FieldPolicyTenantIsolationError(`${scope.scopeType === "tenant" ? "Tenant" : "User"}-scope field policy ${operation}s require an ambient tenant context (or super-admin bypass); without one the caller identity is unattributable`);
-			return;
-		}
-		if (context.superAdminBypass) return;
-		if (scope.scopeType === "app") throw new FieldPolicyTenantIsolationError(`App-scope field policy ${operation}s are not allowed inside a tenant context (use a system context or super-admin bypass)`, { tenantId: context.tenantId });
-		if (scope.scopeType === "tenant" && scope.tenantId !== context.tenantId) throw new FieldPolicyTenantIsolationError(`Tenant isolation violation in FieldPolicy.${operation}: context tenant is '${context.tenantId}' but the row belongs to '${scope.tenantId}'`, {
-			tenantId: context.tenantId,
-			attemptedTenantId: scope.tenantId ?? void 0
-		});
-		if (scope.scopeType === "user") {
-			if (context.userId === void 0) throw new FieldPolicyTenantIsolationError(`User-scope field policy ${operation}s require an ambient context that carries a user id; this context cannot attribute a user-scope write`, { tenantId: context.tenantId });
-			if (scope.userId !== context.userId) throw new FieldPolicyTenantIsolationError(`Tenant isolation violation in FieldPolicy.${operation}: context user is '${context.userId}' but the row belongs to '${scope.userId}'`, { tenantId: context.tenantId });
+	async applyAcceptedPolicy(db, suggestion, tenantId, decidedBy) {
+		if (suggestion.kind === "default") await assertAcceptedDefaultStillAllowed(suggestion);
+		else await assertAcceptedPolicyTargetStillAllowed(suggestion);
+		const target = {
+			objectRef: suggestion.objectRef,
+			fieldName: suggestion.fieldName,
+			tenantId,
+			column: suggestion.kind === "promote" ? "visibility" : "default_value",
+			value: suggestion.kind === "promote" ? "basic" : suggestion.proposedValue,
+			decidedBy
+		};
+		const updatedId = await updatePolicyColumn(db, target);
+		if (updatedId) return updatedId;
+		const { FieldPolicyCollection } = await import("./chunks/FieldPolicyCollection--RxukfCX.js").then((n) => n.n);
+		const policies = await FieldPolicyCollection.create(transactionBoundOptions(db));
+		const deterministicId = await fieldPolicyRowId(tenantId, suggestion.objectRef, suggestion.fieldName);
+		try {
+			const created = await policies.create({
+				id: deterministicId,
+				objectRef: suggestion.objectRef,
+				fieldName: suggestion.fieldName,
+				scopeType: "tenant",
+				tenantId,
+				...suggestion.kind === "promote" ? { visibility: "basic" } : { defaultValue: suggestion.proposedValue },
+				updatedBy: decidedBy,
+				_insertOnly: true
+			});
+			return String(created.id);
+		} catch (error) {
+			const racedId = await updatePolicyColumn(db, target);
+			if (racedId) return racedId;
+			throw error;
 		}
 	}
-	validateTenantContextBoundary() {
-		this.assertScopeOwnedByAmbientContext({
-			scopeType: this.scopeType,
-			tenantId: this.tenantId,
-			userId: this.userId
-		}, "save");
+	/**
+	* A driver transaction handle, or `null` when the driver has none (the
+	* `FieldPolicy.saveAfterIdentityChange` probe, same shape).
+	*/
+	async beginTransactionIfSupported() {
+		if (typeof this.db.beginTransaction !== "function") return null;
+		return await this.db.beginTransaction() ?? null;
 	}
 	/**
-	* Permission boundary for policy mutations. Scope ownership is checked
-	* separately (and first) because permission never grants cross-tenant or
-	* cross-user access. Existing rows are checked against their persisted
-	* scope before an identity-changing save can mutate or delete them.
+	* Ambient manage gate shared by the three actions: an ambient tenant
+	* context is required (no context ⇒ no identity ⇒ fail closed — the
+	* suggestion queue is never an anonymous surface), and the caller must hold
+	* `fields.policy.manage` unless running under super-admin bypass.
 	*/
-	async assertScopePermission(scope) {
-		const context = getFieldPolicyAmbientContext();
-		const [, , operation] = (scope.scopeType === "user" ? PERSONALIZE_FIELD_POLICY_PERMISSION : MANAGE_FIELD_POLICY_PERMISSION).split(".");
-		await assertOperationPermission({
+	async requireManageContext(action) {
+		const context = getCurrentTenant();
+		if (!context?.tenantId) throw new FieldPolicySuggestionRequestContextError(`${action} requires an ambient tenant context (fail closed): the suggestion queue is scoped to the caller tenant`);
+		if (!isSuperAdminBypass()) await assertOperationPermission({
 			collection: "fields.policy",
-			action: operation ?? "manage",
-			db: this.options.db ?? this.options.persistence,
-			tenantId: context?.tenantId ?? null,
-			userId: context?.userId ?? null,
-			permissionSet: context?.permissions
+			action: "fields.policy.manage".split(".").at(-1) ?? "manage",
+			db: this.db,
+			tenantId: context.tenantId,
+			userId: context.userId ?? null,
+			permissionSet: context.permissions
+		});
+		return context.tenantId;
+	}
+	async loadOwnedPendingSuggestion(action, id, tenantId) {
+		if (typeof id !== "string" || id.trim() === "") throw new Error(`${action} requires a suggestion "id" string`);
+		const suggestion = await this.get(id);
+		if (!suggestion) throw new Error(`${action}: no suggestion found for id "${id}"`);
+		if (suggestion.tenantId !== tenantId) throw new TenantIsolationError(`Tenant isolation violation in ${action}: the suggestion belongs to another tenant`, {
+			tenantId,
+			attemptedTenantId: suggestion.tenantId ?? void 0
 		});
+		if (suggestion.status !== "pending") throw new FieldPolicySuggestionConflictError(action, id);
+		return suggestion;
 	}
-	validateDefaultAgainstSecurityRail(fieldDef) {
-		if (isTransientField(fieldDef)) throw new Error(`Cannot store a default for transient field "${this.objectRef}.${this.fieldName}"`);
-		if (isSensitiveField(fieldDef)) throw new Error(`Cannot store a default for sensitive field "${this.objectRef}.${this.fieldName}"`);
-		const readPermission = getFieldReadPermission(fieldDef);
-		if (readPermission) throw new Error(`Cannot store a default for read-permission-gated field "${this.objectRef}.${this.fieldName}" (requires "${readPermission}")`);
+};
+__publicField$2(FieldPolicySuggestionCollection, "_itemClass", FieldPolicySuggestion);
+FieldPolicySuggestionCollection = __decorateClass$4([smrt({
+	conflictColumns: [
+		"object_ref",
+		"field_name",
+		"tenant_id",
+		"kind",
+		"active_key"
+	],
+	api: {
+		include: [
+			"pendingSuggestions",
+			"acceptSuggestion",
+			"dismissSuggestion"
+		],
+		principalContext: true,
+		routes: {
+			pendingSuggestions: {
+				scope: "collection",
+				method: "POST",
+				path: "pending"
+			},
+			acceptSuggestion: {
+				scope: "collection",
+				method: "POST",
+				path: "accept"
+			},
+			dismissSuggestion: {
+				scope: "collection",
+				method: "POST",
+				path: "dismiss"
+			}
+		}
+	},
+	cli: false,
+	mcp: false
+})], FieldPolicySuggestionCollection);
+function normalizeObjectRefsFilter(rawRefs) {
+	if (rawRefs === void 0) return null;
+	if (!Array.isArray(rawRefs) || rawRefs.length === 0) throw new Error("pendingSuggestions \"objectRefs\" must be a non-empty string array when provided");
+	if (rawRefs.some((ref) => typeof ref !== "string" || ref.trim() === "")) throw new Error("pendingSuggestions objectRefs must be non-empty strings");
+	const objectRefs = [...new Set(rawRefs)];
+	if (objectRefs.length > MAX_PENDING_OBJECT_REFS) throw new Error(`pendingSuggestions accepts at most ${MAX_PENDING_OBJECT_REFS} objectRefs per call (got ${objectRefs.length})`);
+	return objectRefs;
+}
+function normalizeCoolDownMs(raw) {
+	if (raw === void 0) return DEFAULT_SUGGESTION_COOL_DOWN_MS;
+	if (typeof raw !== "number" || !Number.isFinite(raw)) throw new Error("dismissSuggestion coolDownMs must be a finite number");
+	return Math.min(Math.max(raw, MIN_SUGGESTION_COOL_DOWN_MS), MAX_SUGGESTION_COOL_DOWN_MS);
+}
+//#endregion
+//#region src/models/FieldUsageCounter.ts
+var __defProp$3 = Object.defineProperty;
+var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
+var __decorateClass$3 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$3(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$3(target, key, result);
+	return result;
+};
+var MAX_DISTINCT_USERS_PER_BUCKET = 100;
+var MAX_VALUE_HISTOGRAM_BUCKETS = 25;
+var FIELD_USAGE_PERIOD_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+function fieldUsagePeriodForDate(date) {
+	return date.toISOString().slice(0, 10);
+}
+function emptyHistogram() {
+	return /* @__PURE__ */ Object.create(null);
+}
+var FieldUsageCounter = class extends SmrtObject {
+	objectRef = "";
+	fieldName = "";
+	tenantId;
+	period = "";
+	submissionCount = 0;
+	setCount = 0;
+	distinctUserCount = 0;
+	distinctUserIds = "[]";
+	distinctUsersOverflowed = false;
+	valueHistogram = null;
+	valueHistogramOverflowed = false;
+	constructor(options = {}) {
+		super(options);
+		if (options.objectRef !== void 0) this.objectRef = options.objectRef;
+		if (options.fieldName !== void 0) this.fieldName = options.fieldName;
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.period !== void 0) this.period = options.period;
+		if (options.submissionCount !== void 0) this.submissionCount = options.submissionCount;
+		if (options.setCount !== void 0) this.setCount = options.setCount;
+		if (options.distinctUserCount !== void 0) this.distinctUserCount = options.distinctUserCount;
+		if (options.distinctUserIds !== void 0) this.distinctUserIds = options.distinctUserIds;
+		if (options.distinctUsersOverflowed !== void 0) this.distinctUsersOverflowed = options.distinctUsersOverflowed;
+		if (options.valueHistogram !== void 0) this.valueHistogram = options.valueHistogram;
+		if (options.valueHistogramOverflowed !== void 0) this.valueHistogramOverflowed = options.valueHistogramOverflowed;
 	}
-	parseDefaultValueOrThrow() {
+	/** Parse the stored distinct-user set (guarded; junk parses as empty). */
+	getDistinctUserIds() {
 		try {
-			return JSON.parse(this.defaultValue);
-		} catch (error) {
-			throw new Error(`FieldPolicy default for "${this.objectRef}.${this.fieldName}" is not valid JSON: ${error instanceof Error ? error.message : String(error)}. The "defaultValue" option is the already-encoded channel; pass a plain value as "defaultValueRaw" (or call setDefaultValue()).`);
+			const parsed = JSON.parse(this.distinctUserIds);
+			return Array.isArray(parsed) ? parsed.filter((id) => typeof id === "string") : [];
+		} catch {
+			return [];
 		}
 	}
 	/**
-	* The persisted row this save/delete would replace, looked up by primary
-	* key and — when that misses — by the NATURAL key.
+	* Add a user to the distinct set, honoring the cap. At the cap the id is
+	* NOT added and the overflow marker is set instead, keeping
+	* {@link distinctUserCount} an honest lower bound.
+	*/
+	addDistinctUser(userId) {
+		const ids = this.getDistinctUserIds();
+		if (ids.includes(userId)) return;
+		if (ids.length >= 100) {
+			this.distinctUsersOverflowed = true;
+			return;
+		}
+		ids.push(userId);
+		this.distinctUserIds = JSON.stringify(ids);
+		this.distinctUserCount = ids.length;
+	}
+	/**
+	* Parse the stored histogram (guarded; junk parses as empty).
 	*
-	* The natural-key fallback is load-bearing for authorization: every
-	* generated create arrives with a freshly minted UUID, so a primary-key
-	* lookup always misses, yet the `conflictColumns` upsert still overwrites
-	* whatever row already occupies `(objectRef, fieldName, scopeType,
-	* scopeKey)`. Authorizing on the primary key alone therefore skipped the
-	* persisted-scope guard on exactly the path that can replace an existing
-	* row's contents.
+	* Returns a NULL-PROTOTYPE object. Histogram keys are user-supplied ids —
+	* an `idType: 'text'` reference may legitimately be `constructor`,
+	* `toString`, or `__proto__` — and on a plain object those inherit truthy
+	* prototype values (so a missing bucket reads as present) or, for
+	* `__proto__`, hit the prototype setter instead of creating an own key.
+	* Both would silently corrupt counts. See {@link emptyHistogram}.
 	*/
-	async getPersistedIdentity() {
-		const existing = await this.getPersistedRowById() ?? await this.getPersistedRowByNaturalKey();
-		if (!existing) return null;
-		const row = existing;
-		const read = (camel, snake, fallback) => {
-			if (row[camel] !== void 0 && row[camel] !== null) return String(row[camel]);
-			if (row[snake] !== void 0 && row[snake] !== null) return String(row[snake]);
-			return fallback;
-		};
-		const readNullable = (camel, snake) => {
-			const value = row[camel] !== void 0 ? row[camel] : row[snake];
-			return value === void 0 || value === null ? null : String(value);
-		};
-		return {
-			id: read("id", "id", String(this.id ?? "")),
-			objectRef: read("objectRef", "object_ref", this.objectRef),
-			fieldName: read("fieldName", "field_name", this.fieldName),
-			scopeType: read("scopeType", "scope_type", this.scopeType),
-			scopeKey: read("scopeKey", "scope_key", this.scopeKey),
-			tenantId: readNullable("tenantId", "tenant_id"),
-			userId: readNullable("userId", "user_id")
-		};
+	getValueHistogram() {
+		const histogram = emptyHistogram();
+		if (!this.valueHistogram) return histogram;
+		try {
+			const parsed = JSON.parse(this.valueHistogram);
+			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return histogram;
+			for (const [key, count] of Object.entries(parsed)) if (typeof count === "number" && Number.isFinite(count) && count > 0) histogram[key] = count;
+			return histogram;
+		} catch {
+			return emptyHistogram();
+		}
 	}
-	async getPersistedRowById() {
-		if (!this.id) return null;
-		return await this.db.get(this.tableName, { id: this.id }) ?? null;
+	/**
+	* Record one histogram sample under an already-serialized key, honoring the
+	* bucket cap (a NEW key past the cap is dropped and the overflow marker
+	* set; existing keys keep counting).
+	*
+	* Bucket presence is an OWN-key test, never a truthiness/`undefined` read,
+	* so prototype-shaped ids behave like any other key.
+	*/
+	recordHistogramSample(key) {
+		if (key.length === 0 || key.length > 64) return;
+		const histogram = this.getValueHistogram();
+		if (!Object.hasOwn(histogram, key)) {
+			if (Object.keys(histogram).length >= 25) {
+				this.valueHistogramOverflowed = true;
+				return;
+			}
+			histogram[key] = 1;
+		} else histogram[key] += 1;
+		this.valueHistogram = JSON.stringify(histogram);
 	}
 	/**
-	* The row occupying this row's `conflictColumns` tuple, if any. Column
-	* names are the physical snake_case ones: this reads the driver directly
-	* rather than through a collection (the model has no collection handle).
+	* Whether this bucket predates the {@link submissionCount} column (or was
+	* corrupted): it records deviations without a total, so no honest dominance
+	* ratio can be computed from it. The generation job skips `default`
+	* suggestions for any group containing such a bucket.
 	*/
-	async getPersistedRowByNaturalKey() {
-		if (!this.objectRef || !this.fieldName) return null;
-		return await this.db.get(this.tableName, {
-			object_ref: this.objectRef,
-			field_name: this.fieldName,
-			scope_type: this.scopeType,
-			scope_key: this.computeScopeKey()
-		}) ?? null;
+	isLegacyBucket() {
+		return this.submissionCount < this.setCount;
 	}
-	normalizeDefaultValueForPersistence() {
-		const raw = this.defaultValue;
-		if (raw === null || raw === void 0) {
-			this.defaultValue = null;
-			return;
-		}
-		if (typeof raw === "string") {
-			this.defaultValue = raw;
-			return;
-		}
-		this.defaultValue = JSON.stringify(raw);
+	async save() {
+		await this.assertRowOwnedByAmbientContext("save");
+		this.validateFieldUsageCounter();
+		return super.save();
+	}
+	async delete() {
+		await this.assertRowOwnedByAmbientContext("delete");
+		await super.delete();
+	}
+	validateFieldUsageCounter() {
+		if (!this.objectRef || this.objectRef.trim() === "") throw new Error("FieldUsageCounter.objectRef is required");
+		if (!this.fieldName || this.fieldName.trim() === "") throw new Error("FieldUsageCounter.fieldName is required");
+		if (!this.tenantId) throw new Error("FieldUsageCounter.tenantId is required");
+		if (!FIELD_USAGE_PERIOD_PATTERN.test(this.period)) throw new Error(`FieldUsageCounter.period must be a UTC day bucket (YYYY-MM-DD); got "${this.period}"`);
+		if (!Number.isInteger(this.submissionCount) || this.submissionCount < 0) throw new Error("FieldUsageCounter.submissionCount must be a non-negative integer");
+		if (!Number.isInteger(this.setCount) || this.setCount < 0) throw new Error("FieldUsageCounter.setCount must be a non-negative integer");
+		if (!Number.isInteger(this.distinctUserCount) || this.distinctUserCount < 0) throw new Error("FieldUsageCounter.distinctUserCount must be a non-negative integer");
+	}
+	/**
+	* Tenant write boundary (the FieldPolicy posture — no class-level
+	* `@TenantScoped`, because the learning jobs legitimately operate
+	* cross-tenant in trusted execution): inside a non-bypass tenant context a
+	* caller may only touch rows of its own tenant; without a context (system/
+	* job execution) writes are trusted.
+	*
+	* Checked against BOTH the in-memory tenant and — for a row that already
+	* exists — the PERSISTED one. The persisted check is what makes the boundary
+	* real: bucket ids are deterministic and the deriving helper is exported, so
+	* a foreign row is trivially addressable, and an in-memory-only check would
+	* let a caller load it, re-stamp `tenantId` with its own, and adopt or delete
+	* another tenant's counters (the #2047 FieldPolicy pattern).
+	*/
+	async assertRowOwnedByAmbientContext(operation) {
+		const context = getCurrentTenant();
+		if (!context || isSuperAdminBypass()) return;
+		if (this.tenantId !== context.tenantId) throw new TenantIsolationError(`Tenant isolation violation in FieldUsageCounter.${operation}: context tenant is '${context.tenantId}' but the row belongs to '${this.tenantId}'`, {
+			tenantId: context.tenantId,
+			attemptedTenantId: this.tenantId ?? void 0
+		});
+		const persistedTenantId = await this.getPersistedTenantId();
+		if (persistedTenantId !== null && persistedTenantId !== context.tenantId) throw new TenantIsolationError(`Tenant isolation violation in FieldUsageCounter.${operation}: the persisted row belongs to '${persistedTenantId}'`, {
+			tenantId: context.tenantId,
+			attemptedTenantId: persistedTenantId
+		});
+	}
+	/** The stored tenant for this row's id; `null` when it is not persisted. */
+	async getPersistedTenantId() {
+		if (!this.id) return null;
+		const existing = await this.db.get(this.tableName, { id: this.id });
+		if (!existing) return null;
+		const row = existing;
+		const value = row.tenantId ?? row.tenant_id;
+		return value === void 0 || value === null ? null : String(value);
 	}
 };
-__decorateClass$1([field({ required: true })], FieldPolicy.prototype, "objectRef", 2);
-__decorateClass$1([field({ required: true })], FieldPolicy.prototype, "fieldName", 2);
-__decorateClass$1([field({ required: true })], FieldPolicy.prototype, "scopeType", 2);
-__decorateClass$1([tenantId({ nullable: true })], FieldPolicy.prototype, "tenantId", 2);
-__decorateClass$1([crossPackageRef("@happyvertical/smrt-users:User", { nullable: true })], FieldPolicy.prototype, "userId", 2);
-__decorateClass$1([field({
-	type: "text",
-	required: true
-})], FieldPolicy.prototype, "scopeKey", 2);
-__decorateClass$1([field({
-	type: "text",
-	nullable: true
-})], FieldPolicy.prototype, "defaultValue", 2);
-__decorateClass$1([field({
+__decorateClass$3([field({ required: true })], FieldUsageCounter.prototype, "objectRef", 2);
+__decorateClass$3([field({ required: true })], FieldUsageCounter.prototype, "fieldName", 2);
+__decorateClass$3([tenantId()], FieldUsageCounter.prototype, "tenantId", 2);
+__decorateClass$3([field({ required: true })], FieldUsageCounter.prototype, "period", 2);
+__decorateClass$3([field({ type: "integer" })], FieldUsageCounter.prototype, "submissionCount", 2);
+__decorateClass$3([field({ type: "integer" })], FieldUsageCounter.prototype, "setCount", 2);
+__decorateClass$3([field({ type: "integer" })], FieldUsageCounter.prototype, "distinctUserCount", 2);
+__decorateClass$3([field({ type: "text" })], FieldUsageCounter.prototype, "distinctUserIds", 2);
+__decorateClass$3([field({ type: "boolean" })], FieldUsageCounter.prototype, "distinctUsersOverflowed", 2);
+__decorateClass$3([field({
 	type: "text",
 	nullable: true
-})], FieldPolicy.prototype, "visibility", 2);
-__decorateClass$1([field({
-	type: "text",
-	nullable: true
-})], FieldPolicy.prototype, "help", 2);
-__decorateClass$1([field({
-	type: "text",
-	nullable: true
-})], FieldPolicy.prototype, "label", 2);
-__decorateClass$1([field({
-	type: "integer",
-	nullable: true
-})], FieldPolicy.prototype, "displayOrder", 2);
-__decorateClass$1([field({
-	type: "boolean",
-	nullable: true
-})], FieldPolicy.prototype, "locked", 2);
-__decorateClass$1([crossPackageRef("@happyvertical/smrt-users:User", { nullable: true })], FieldPolicy.prototype, "updatedBy", 2);
-FieldPolicy = __decorateClass$1([smrt({
-	tableName: "_smrt_field_policies",
+})], FieldUsageCounter.prototype, "valueHistogram", 2);
+__decorateClass$3([field({ type: "boolean" })], FieldUsageCounter.prototype, "valueHistogramOverflowed", 2);
+FieldUsageCounter = __decorateClass$3([smrt({
+	tableName: "_smrt_field_usage_counters",
 	conflictColumns: [
 		"object_ref",
 		"field_name",
-		"scope_type",
-		"scope_key"
+		"tenant_id",
+		"period"
 	],
-	api: {
-		include: [
-			"create",
-			"update",
-			"delete"
-		],
-		principalContext: true
-	},
-	cli: {
-		include: [
-			"create",
-			"update",
-			"delete"
-		],
-		exclude: ["getDefaultValue", "setDefaultValue"]
-	},
+	api: { include: [] },
+	cli: false,
+	mcp: { include: [] }
+})], FieldUsageCounter);
+//#endregion
+//#region src/models/FieldUsageReportReceipt.ts
+var __defProp$2 = Object.defineProperty;
+var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
+var __decorateClass$2 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$2(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$2(target, key, result);
+	return result;
+};
+var FieldUsageReportReceipt = class extends SmrtObject {
+	tenantId;
+	userId = "";
+	objectRef = "";
+	fieldName = "";
+	period = "";
+	constructor(options = {}) {
+		super(options);
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.userId !== void 0) this.userId = options.userId;
+		if (options.objectRef !== void 0) this.objectRef = options.objectRef;
+		if (options.fieldName !== void 0) this.fieldName = options.fieldName;
+		if (options.period !== void 0) this.period = options.period;
+	}
+};
+__decorateClass$2([tenantId()], FieldUsageReportReceipt.prototype, "tenantId", 2);
+__decorateClass$2([crossPackageRef("@happyvertical/smrt-users:User")], FieldUsageReportReceipt.prototype, "userId", 2);
+__decorateClass$2([field({ required: true })], FieldUsageReportReceipt.prototype, "objectRef", 2);
+__decorateClass$2([field({ required: true })], FieldUsageReportReceipt.prototype, "fieldName", 2);
+__decorateClass$2([field({ required: true })], FieldUsageReportReceipt.prototype, "period", 2);
+FieldUsageReportReceipt = __decorateClass$2([smrt({
+	tableName: "_smrt_field_usage_report_receipts",
+	conflictColumns: [
+		"tenant_id",
+		"user_id",
+		"object_ref",
+		"field_name",
+		"period"
+	],
+	api: { include: [] },
+	cli: false,
 	mcp: { include: [] }
-})], FieldPolicy);
+})], FieldUsageReportReceipt);
 //#endregion
-//#region src/collections/FieldPolicyCollection.ts
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
+//#region src/collections/FieldUsageCounterCollection.ts
+var __defProp$1 = Object.defineProperty;
+var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, {
 	enumerable: true,
 	configurable: true,
 	writable: true,
 	value
 }) : obj[key] = value;
-var __decorateClass = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+var __decorateClass$1 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp(target, key, result);
+	if (kind && result) __defProp$1(target, key, result);
 	return result;
 };
-var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-var MAX_BATCH_OBJECT_REFS = 100;
-MAX_BATCH_OBJECT_REFS * 2;
-var FieldPolicyCollection = class extends SmrtCollection {
+var __publicField$1 = (obj, key, value) => __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
+function usageValuesEqual(a, b) {
+	if (a === b) return true;
+	try {
+		return JSON.stringify(a) === JSON.stringify(b);
+	} catch {
+		return false;
+	}
+}
+var MAX_USAGE_REPORT_ENTRIES = 100;
+var FieldUsageRequestContextError = class extends TenantIsolationError {
+	httpStatus = 403;
+	status = 403;
+	constructor(message, details) {
+		super(message, details);
+		this.name = "FieldUsageRequestContextError";
+	}
+};
+var FieldUsageCounterCollection = class extends SmrtCollection {
 	/**
-	* Permission-gated, tenant-scoped audit read for the defaults control
-	* panel. It returns editable own-tenant rows, read-only app summaries,
-	* projected user override counts, and identity-only manifest drift rows.
+	* Record a batch of field submissions into the current UTC-day counters.
+	*
+	* Identity is AMBIENT-ONLY (the resolveBatch posture): the tenant AND the
+	* user come exclusively from the tenant context established by the app's
+	* auth hook — the request body cannot attribute usage to another tenant or
+	* user. Both are REQUIRED and the call fails closed without them (#2047
+	* round-3 posture):
+	*
+	* - No ambient tenant ⇒ the report is unattributable.
+	* - No ambient USER ⇒ the caller is an unauthenticated principal (a
+	*   deployment that resolves the tenant from host/header alone). Such
+	*   callers could otherwise inflate counts and histograms without bound
+	*   (the batch cap is per call), and `distinctUsers` — the promote signal —
+	*   is meaningless without a principal. Consequence, accepted deliberately:
+	*   ANONYMOUS/PUBLIC FORMS DO NOT CONTRIBUTE USAGE. The learning loop is
+	*   for authenticated org users.
+	*
+	* Any authenticated in-tenant principal may report (no manage slug needed).
+	* A durable receipt admits at most one `(tenant, user, object, field, UTC
+	* day)` contribution, and the batch stays bounded per call
+	* ({@link MAX_USAGE_REPORT_ENTRIES}).
+	*
+	* Server-side derivation (the client is never the authority):
+	* - Fields are validated against the live `ObjectRegistry`; unknown or
+	*   non-usage-addressable entries (system, relationship pseudo-fields, STI
+	*   meta storage, transient) are DROPPED and counted, never failing the
+	*   batch (stale clients after a redeploy are expected).
+	* - Sensitivity comes from BOTH `field.sensitive` and `field._meta.sensitive`
+	*   (and `readPermission` in both places): such fields are recorded
+	*   COUNT-ONLY — their values are never persisted anywhere in usage data,
+	*   default-matching or not.
+	* - DEVIATION (`setCount`, distinct users) is decided by comparing the
+	*   submitted value against the default RESOLVED HERE for the calling
+	*   identity — never against a client claim. Every accepted entry also
+	*   increments `submissionCount`, the dominance denominator.
+	* - Values are histogrammed only for low-cardinality field types
+	*   (`boolean`, `foreignKey`, `crossPackageRef`) with type-checked samples;
+	*   free text is never histogrammed.
+	*
+	* Bounded trust in `matchedDefault`: an entry may omit `value` entirely
+	* (`collectFieldUsageEntries({ includeValues: false })` — apps that prefer
+	* no value transit). Only then is the entry's `matchedDefault` flag read, to
+	* decide the deviation bit alone. It can never create a histogram entry,
+	* never bypass the count-only rail, and never manufacture distinct users
+	* beyond the caller's own id. The once-per-field/day receipt means a lying
+	* client gets only one such contribution, so repeated POSTs cannot inflate
+	* thresholds or steer a `default` suggestion.
 	*/
-	async policyAudit(options = {}) {
-		const objectRefs = normalizeAuditRefs(options.objectRefs, "objectRefs", 100);
-		const countObjectRefs = normalizeAuditRefs(options.countObjectRefs ?? objectRefs, "countObjectRefs", 200);
+	async reportUsage(options = {}) {
+		const entries = validateEntriesInput(options.entries);
 		const context = getCurrentTenant();
-		const tenantId = context?.tenantId ?? null;
-		const userId = context?.userId ?? null;
-		const permissionOptions = {
-			collection: "fields.policy",
-			db: this.db,
-			tenantId,
-			userId,
-			permissionSet: context?.permissions,
-			onDeny: "return"
-		};
-		const manage = tenantId ? await checkOperationPermission({
-			...permissionOptions,
-			action: "fields.policy.manage".split(".").at(-1) ?? "manage"
-		}) : { allowed: false };
-		const personalize = userId ? await checkOperationPermission({
-			...permissionOptions,
-			action: "fields.policy.personalize".split(".").at(-1) ?? "personalize"
-		}) : { allowed: false };
-		const caller = {
-			tenantId,
-			userId,
-			canManageOrg: manage.allowed,
-			canPersonalize: personalize.allowed && userId !== null
-		};
-		if (!caller.canManageOrg || tenantId === null) return emptyAudit(caller);
-		if (options.summaryOnly === true) return emptyAudit(caller);
-		const fieldMaps = /* @__PURE__ */ new Map();
-		const fieldMapFor = (objectRef) => {
-			let loaded = fieldMaps.get(objectRef);
-			if (!loaded) {
-				loaded = getObjectFieldMap(objectRef).catch(() => null);
-				fieldMaps.set(objectRef, loaded);
+		const tenantId = context?.tenantId;
+		if (!tenantId) throw new FieldUsageRequestContextError("reportUsage requires an ambient tenant context: usage is unattributable without one, so the call fails closed");
+		const userId = context.userId;
+		if (!userId) throw new FieldUsageRequestContextError("reportUsage requires an ambient AUTHENTICATED user: an unauthenticated caller could inflate counters without bound and distinct-user thresholds are meaningless without a principal, so the call fails closed (anonymous forms do not contribute usage)", { tenantId });
+		const period = fieldUsagePeriodForDate(/* @__PURE__ */ new Date());
+		const receipts = await FieldUsageReportReceiptCollection.create({ db: this.db });
+		const groups = /* @__PURE__ */ new Map();
+		for (const entry of entries) {
+			let byField = groups.get(entry.objectRef);
+			if (!byField) {
+				byField = /* @__PURE__ */ new Map();
+				groups.set(entry.objectRef, byField);
 			}
-			return loaded;
-		};
-		const classify = async (row) => {
-			const fields = await fieldMapFor(row.objectRef);
-			if (!fields) return "unknown-object";
-			const definition = fields.get(row.fieldName);
-			if (!definition) return "unknown-field";
-			if (isSensitiveField(definition) || getFieldReadPermission(definition) !== void 0 || isTransientField(definition)) return "gated";
-			return isPolicyAddressableField(definition) ? "ok" : "excluded-field";
-		};
-		const [appRows, orgRows, ownUserRows] = objectRefs.length ? await Promise.all([
-			this.list({ where: {
-				scopeType: "app",
-				"objectRef in": objectRefs
-			} }),
-			this.list({ where: {
-				scopeType: "tenant",
-				tenantId,
-				"objectRef in": objectRefs
-			} }),
-			userId ? this.list({ where: {
-				scopeType: "user",
-				userId,
-				"objectRef in": objectRefs
-			} }) : Promise.resolve([])
-		]) : [
-			[],
-			[],
-			[]
-		];
-		const audit = {
-			...emptyAudit(caller),
-			policies: options.countsOnly ? {} : await this.resolveAuditPolicies(objectRefs, tenantId, fieldMapFor)
-		};
-		const append = async (row, target, driftPrunable) => {
-			const state = await classify(row);
-			if (state === "ok") target.push(toAuditRow(row));
-			else if (state !== "gated") audit.driftRows.push({
-				...toDriftIdentity(row),
-				reason: state,
-				prunable: driftPrunable
-			});
-		};
-		for (const row of orgRows) await append(row, audit.orgRows, true);
-		for (const row of appRows) await append(row, audit.appRows, isSuperAdminBypass());
-		for (const row of ownUserRows) {
-			const state = await classify(row);
-			if (state !== "ok" && state !== "gated") audit.driftRows.push({
-				...toDriftIdentity(row),
-				reason: state,
-				prunable: caller.canPersonalize
-			});
+			const samples = byField.get(entry.fieldName);
+			if (samples) samples.push(entry);
+			else byField.set(entry.fieldName, [entry]);
 		}
-		if (options.includeDrift === true) {
-			const [driftAppRows, driftOrgRows, driftUserRows] = await Promise.all([
-				this.list({
-					where: { scopeType: "app" },
-					limit: 100
-				}),
-				this.list({
-					where: {
-						scopeType: "tenant",
-						tenantId
-					},
-					limit: 100
-				}),
-				userId ? this.list({
-					where: {
-						scopeType: "user",
-						userId
-					},
-					limit: 100
-				}) : Promise.resolve([])
-			]);
-			const knownIds = new Set([
-				...appRows,
-				...orgRows,
-				...ownUserRows
-			].map((row) => String(row.id)));
-			for (const [rows, prunable] of [
-				[driftAppRows, isSuperAdminBypass()],
-				[driftOrgRows, true],
-				[driftUserRows, caller.canPersonalize]
-			]) for (const row of rows) {
-				if (knownIds.has(String(row.id))) continue;
-				const state = await classify(row);
-				if (state !== "ok" && state !== "gated") audit.driftRows.push({
-					...toDriftIdentity(row),
-					reason: state,
-					prunable
-				});
+		let accepted = 0;
+		let dropped = 0;
+		for (const [objectRef, byField] of groups) {
+			let fieldMap;
+			try {
+				fieldMap = await getObjectFieldMap(objectRef);
+			} catch {
+				for (const samples of byField.values()) dropped += samples.length;
+				continue;
 			}
-		}
-		const memberships = await MembershipCollection.create({ db: this.db });
-		const memberIds = [...new Set((await memberships.findActiveByTenant(tenantId)).map((membership) => membership.userId?.trim()).filter((id) => Boolean(id)))];
-		const projected = countObjectRefs.length && memberIds.length ? await this.list({
-			where: {
-				scopeType: "user",
-				"objectRef in": countObjectRefs,
-				"userId in": memberIds
-			},
-			select: ["objectRef", "fieldName"]
-		}) : [];
-		for (const row of projected) {
-			if (await classify(row) !== "ok") continue;
-			const byField = audit.userOverrideCounts[row.objectRef] ?? {};
-			audit.userOverrideCounts[row.objectRef] = byField;
-			byField[row.fieldName] = (byField[row.fieldName] ?? 0) + 1;
-		}
-		const { resolveSurvivingTenantChainIds } = await Promise.resolve().then(() => field_policy_resolver_exports);
-		const ancestorIds = (await resolveSurvivingTenantChainIds(tenantId, { db: this.db })).filter((id) => id !== tenantId);
-		if (ancestorIds.length && objectRefs.length) {
-			const ancestors = await this.list({ where: {
-				scopeType: "tenant",
-				"tenantId in": ancestorIds,
-				"objectRef in": objectRefs
-			} });
-			for (const row of ancestors) {
-				if (await classify(row) !== "ok") continue;
-				const names = audit.inheritedOrgKeys[row.objectRef] ?? [];
-				audit.inheritedOrgKeys[row.objectRef] = names;
-				if (!names.includes(row.fieldName)) names.push(row.fieldName);
+			const resolvedFields = await this.resolveDefaultsForCaller(objectRef, tenantId, userId);
+			if (!resolvedFields) {
+				for (const samples of byField.values()) dropped += samples.length;
+				continue;
 			}
-		}
-		audit.orgRows.sort(sortAuditRows);
-		audit.appRows.sort(sortAuditRows);
-		audit.driftRows.sort(sortDriftRows);
-		for (const names of Object.values(audit.inheritedOrgKeys)) names.sort();
-		return audit;
-	}
-	async resolveAuditPolicies(objectRefs, tenantId, fieldMapFor) {
-		const { resolveFieldPolicyExplained } = await Promise.resolve().then(() => field_policy_resolver_exports);
-		const policies = {};
-		for (const objectRef of objectRefs) {
-			if (!await fieldMapFor(objectRef)) continue;
-			const resolved = await resolveFieldPolicyExplained(objectRef, {
-				tenantId,
-				db: this.db
-			});
-			policies[objectRef] = await this.gateExplainedForEditorResponse(resolved, {
-				manage: true,
-				personalize: false
-			}, true);
-		}
-		return policies;
-	}
-	/** All app-scope rows for an object, keyed by field name. */
-	async getAppRows(objectRef) {
-		const rows = await this.list({ where: {
-			objectRef,
-			scopeType: "app"
-		} });
-		const byField = /* @__PURE__ */ new Map();
-		for (const row of rows) byField.set(row.fieldName, row);
-		return byField;
-	}
-	/**
-	* All tenant-scope rows for an object across a tenant chain, keyed
-	* `tenantId → fieldName → row`.
-	*/
-	async getTenantRows(objectRef, tenantIds) {
-		const byTenant = /* @__PURE__ */ new Map();
-		if (tenantIds.length === 0) return byTenant;
-		const rows = await this.list({ where: {
-			objectRef,
-			scopeType: "tenant",
-			"tenantId in": tenantIds
-		} });
-		for (const row of rows) {
-			if (!row.tenantId) continue;
-			let byField = byTenant.get(row.tenantId);
-			if (!byField) {
-				byField = /* @__PURE__ */ new Map();
-				byTenant.set(row.tenantId, byField);
+			for (const [fieldName, samples] of byField) {
+				const fieldDef = fieldMap.get(fieldName);
+				if (!fieldDef || !isUsageAddressableField(fieldDef)) {
+					dropped += samples.length;
+					continue;
+				}
+				if (!await receipts.claim({
+					tenantId,
+					userId,
+					objectRef,
+					fieldName,
+					period
+				})) continue;
+				const sample = samples[0];
+				const histogramEligible = !(isSensitiveField(fieldDef) || getFieldReadPermission(fieldDef) !== void 0) && isHistogramEligibleField(fieldDef);
+				const resolved = resolvedFields[fieldName];
+				const hasDefault = resolved?.hasDefault === true;
+				const defaultValue = hasDefault ? resolved?.defaultValue : void 0;
+				let deviations = 0;
+				const histogramKeys = [];
+				if ("value" in sample) {
+					if (!hasDefault || !usageValuesEqual(sample.value, defaultValue)) deviations += 1;
+					if (histogramEligible) {
+						const key = serializeHistogramSample(fieldDef, sample.value);
+						if (key !== null) histogramKeys.push(key);
+					}
+				} else if (sample.matchedDefault !== true) deviations += 1;
+				await this.mergeIntoBucket({
+					objectRef,
+					fieldName,
+					tenantId,
+					period,
+					userId,
+					submissionCount: 1,
+					deviationCount: deviations,
+					histogramKeys
+				});
+				accepted += 1;
 			}
-			byField.set(row.fieldName, row);
 		}
-		return byTenant;
-	}
-	/** All user-scope rows for an object and user, keyed by field name. */
-	async getUserRows(objectRef, userId) {
-		const rows = await this.list({ where: {
-			objectRef,
-			scopeType: "user",
-			userId
-		} });
-		const byField = /* @__PURE__ */ new Map();
-		for (const row of rows) byField.set(row.fieldName, row);
-		return byField;
+		return {
+			accepted,
+			dropped
+		};
 	}
 	/**
-	* Resolve merged field policy for a set of objectRefs for the CURRENT
-	* caller, gated for public consumption.
+	* The defaults the CALLER's forms would have prefilled — the deviation
+	* authority. Resolved for the ambient `(tenant, user)` identity (the
+	* resolver's own TTL cache keeps repeat batches cheap).
 	*
-	* Caller identity comes exclusively from the ambient tenant context
-	* (established by the app's auth hook, e.g. smrt-users' session context) —
-	* the request body cannot select another tenant or user (fail closed).
-	* Server-side consumers wanting explicit identities call
-	* `resolveFieldPolicy()` directly instead.
-	*
-	* Field gating mirrors the REST serializer's derivation (`sensitive` /
-	* `readPermission` read from both the top level and `_meta`): sensitive and
-	* read-permission-gated fields are ABSENT from the response for every
-	* caller (the generated action route cannot convey per-caller grants to
-	* this method, so gated fields fail closed), and transient fields are
-	* stripped for parity with generated client field definitions.
+	* Ingestion is fire-and-forget, so a stored-layer read failure degrades to
+	* the CODE-SEED-only resolution (no db) rather than failing the request;
+	* `null` (both attempts failed) makes the caller drop the group.
 	*/
-	async resolveBatch(options = {}) {
-		const rawRefs = options.objectRefs;
-		if (!Array.isArray(rawRefs) || rawRefs.length === 0) throw new Error("resolveBatch requires a non-empty \"objectRefs\" string array");
-		if (rawRefs.some((ref) => typeof ref !== "string" || ref.trim() === "")) throw new Error("resolveBatch objectRefs must be non-empty strings");
-		const objectRefs = [...new Set(rawRefs)];
-		if (objectRefs.length > MAX_BATCH_OBJECT_REFS) throw new Error(`resolveBatch accepts at most ${MAX_BATCH_OBJECT_REFS} objectRefs per call (got ${objectRefs.length})`);
-		const context = getCurrentTenant();
-		const tenantId = context?.tenantId ?? null;
-		const userId = context?.userId ?? null;
+	async resolveDefaultsForCaller(objectRef, tenantId, userId) {
 		const { resolveFieldPolicy } = await Promise.resolve().then(() => field_policy_resolver_exports);
-		const policies = {};
-		for (const objectRef of objectRefs) {
-			const resolved = await resolveFieldPolicy(objectRef, {
+		try {
+			return (await resolveFieldPolicy(objectRef, {
 				tenantId,
 				userId,
 				db: this.db
-			});
-			policies[objectRef] = await this.gateResolvedForPublicResponse(resolved);
+			})).fields;
+		} catch {
+			try {
+				return (await resolveFieldPolicy(objectRef, {
+					tenantId,
+					userId
+				})).fields;
+			} catch {
+				return null;
+			}
 		}
-		return { policies };
 	}
 	/**
-	* Context-derived bootstrap data for the policy gear. This is deliberately
-	* a collection action instead of reopening list/get: a caller can inspect
-	* only their safe effective policy and rows/layers they are permitted to
-	* edit, never arbitrary tenant or user policy rows.
+	* Counter rows within a period window (inclusive bounds, lexicographic ISO
+	* day comparison), optionally restricted to one tenant — the read the
+	* suggestion-generation job consumes.
 	*/
-	async getEditorState(options = {}) {
-		const objectRef = options.objectRef;
-		if (typeof objectRef !== "string" || objectRef.trim() === "") throw new Error("getEditorState requires a non-empty \"objectRef\" string");
-		const context = getCurrentTenant();
-		const permissionOptions = {
-			collection: "fields.policy",
-			db: this.db,
-			tenantId: context?.tenantId ?? null,
-			userId: context?.userId ?? null,
-			permissionSet: context?.permissions,
-			onDeny: "return"
-		};
-		const manage = await checkOperationPermission({
-			...permissionOptions,
-			action: "fields.policy.manage".split(".").at(-1) ?? "manage"
-		});
-		const personalize = await checkOperationPermission({
-			...permissionOptions,
-			action: "fields.policy.personalize".split(".").at(-1) ?? "personalize"
+	async listWindow(options) {
+		const where = { "period >=": options.fromPeriod };
+		if (options.toPeriod) where["period <="] = options.toPeriod;
+		if (options.tenantId) where.tenantId = options.tenantId;
+		return this.list({
+			where,
+			orderBy: "period ASC"
 		});
-		const personalizeAllowed = personalize.allowed && typeof context?.userId === "string" && context.userId.length > 0;
-		if (!manage.allowed && !personalizeAllowed) return {
-			code: "permission_denied",
-			message: `Permission denied for '${personalize.permission ?? "fields.policy.manage"}'.`,
-			ok: false,
-			status: 403
-		};
-		const { resolveFieldPolicyExplained } = await Promise.resolve().then(() => field_policy_resolver_exports);
-		const resolved = await resolveFieldPolicyExplained(objectRef, {
-			tenantId: context?.tenantId ?? null,
-			userId: context?.userId ?? null,
-			db: this.db
-		});
-		const policy = await this.gateExplainedForEditorResponse(resolved, {
-			manage: manage.allowed,
-			personalize: personalizeAllowed
-		});
-		const fieldNames = new Set(Object.keys(policy.fields));
-		const personalLowerDefaultUsable = personalizeAllowed ? await this.getPersonalLowerDefaultUsability(objectRef, context?.tenantId ?? null, fieldNames) : {};
-		const appRows = manage.allowed ? this.toEditorRows(await this.getAppRows(objectRef), fieldNames) : [];
-		const tenantRows = manage.allowed && context?.tenantId ? this.toEditorRows((await this.getTenantRows(objectRef, [context.tenantId])).get(context.tenantId) ?? /* @__PURE__ */ new Map(), fieldNames) : [];
-		const userRows = personalizeAllowed && context?.userId ? this.toEditorRows(await this.getUserRows(objectRef, context.userId), fieldNames) : [];
-		return {
-			capabilities: {
-				manage: manage.allowed,
-				personalize: personalizeAllowed
-			},
-			personalLowerDefaultUsable,
-			policy,
-			rows: {
-				app: appRows,
-				tenant: tenantRows,
-				user: userRows
-			}
-		};
 	}
 	/**
-	* Compute the non-disclosing fallback signal used only by personal drafts.
-	* Passing no user id resolves exactly code/app/tenant precedence, including
-	* the real tenant hierarchy, while keeping every lower-layer value server
-	* side. The public map is limited to fields already admitted by the editor
-	* response's security rail.
+	* Idempotent read-modify-write merge into the deterministic day bucket.
+	* Counters are approximate by design: concurrent cross-process merges may
+	* lose an increment (documented on the model), while the deterministic id
+	* plus the natural-key unique index keep concurrent creates converging on
+	* one row.
 	*/
-	async getPersonalLowerDefaultUsability(objectRef, tenantId, fieldNames) {
-		const { resolveFieldPolicy } = await Promise.resolve().then(() => field_policy_resolver_exports);
-		const lowerPolicy = await resolveFieldPolicy(objectRef, {
-			tenantId,
-			db: this.db
+	async mergeIntoBucket(options) {
+		const id = await fieldUsageCounterId(options.tenantId, options.objectRef, options.fieldName, options.period);
+		const existing = await this.get(id);
+		const counter = existing ?? new FieldUsageCounter({
+			db: this.db,
+			id,
+			objectRef: options.objectRef,
+			fieldName: options.fieldName,
+			tenantId: options.tenantId,
+			period: options.period
 		});
-		return Object.fromEntries(Array.from(fieldNames, (fieldName) => {
-			const field = lowerPolicy.fields[fieldName];
-			return [fieldName, isUsableRequiredDefault(field?.hasDefault ? { value: field.defaultValue } : void 0)];
-		}));
-	}
-	async gateResolvedForPublicResponse(resolved) {
-		const fieldMap = await getObjectFieldMap(resolved.objectRef);
-		const fields = {};
-		for (const [fieldName, policy] of Object.entries(resolved.fields)) {
-			const fieldDef = fieldMap.get(fieldName);
-			if (!fieldDef) continue;
-			if (isSensitiveField(fieldDef) || getFieldReadPermission(fieldDef) !== void 0 || isTransientField(fieldDef)) continue;
-			fields[fieldName] = policy;
-		}
-		return {
-			objectRef: resolved.objectRef,
-			fields
-		};
-	}
-	async gateExplainedForEditorResponse(resolved, capabilities, includeCode = false) {
-		const fieldMap = await getObjectFieldMap(resolved.objectRef);
-		const fields = {};
-		const layers = {};
-		for (const [fieldName, policy] of Object.entries(resolved.fields)) {
-			const fieldDef = fieldMap.get(fieldName);
-			if (!fieldDef || isSensitiveField(fieldDef) || getFieldReadPermission(fieldDef) !== void 0 || isTransientField(fieldDef)) continue;
-			fields[fieldName] = policy;
-			layers[fieldName] = (resolved.layers[fieldName] ?? []).filter((layer) => includeCode && layer.layer === "code" || capabilities.manage && (layer.layer === "app" || layer.layer === "tenant") || capabilities.personalize && layer.layer === "user");
-		}
-		return {
-			objectRef: resolved.objectRef,
-			fields,
-			layers
-		};
-	}
-	toEditorRows(rows, allowedFieldNames) {
-		return Array.from(rows.values()).filter((row) => allowedFieldNames.has(row.fieldName)).map((row) => ({
-			defaultValue: row.defaultValue,
-			displayOrder: row.displayOrder,
-			fieldName: row.fieldName,
-			help: row.help,
-			id: String(row.id),
-			label: row.label,
-			locked: row.locked,
-			scopeType: row.scopeType,
-			tenantId: row.tenantId,
-			updatedBy: row.updatedBy,
-			userId: row.userId,
-			visibility: row.visibility
-		})).sort((left, right) => left.fieldName.localeCompare(right.fieldName));
+		counter.submissionCount += options.submissionCount;
+		counter.setCount += options.deviationCount;
+		if (options.deviationCount > 0) counter.addDistinctUser(options.userId);
+		for (const key of options.histogramKeys) counter.recordHistogramSample(key);
+		if (!existing) await counter.initialize();
+		await counter.save();
 	}
 };
-__publicField(FieldPolicyCollection, "_itemClass", FieldPolicy);
-FieldPolicyCollection = __decorateClass([smrt({
+__publicField$1(FieldUsageCounterCollection, "_itemClass", FieldUsageCounter);
+FieldUsageCounterCollection = __decorateClass$1([smrt({
 	conflictColumns: [
 		"object_ref",
 		"field_name",
-		"scope_type",
-		"scope_key"
+		"tenant_id",
+		"period"
 	],
 	api: {
-		include: [
-			"create",
-			"update",
-			"delete",
-			"resolveBatch",
-			"getEditorState",
-			"policyAudit"
-		],
+		include: ["reportUsage"],
 		principalContext: true,
-		routes: {
-			resolveBatch: {
-				scope: "collection",
-				method: "POST",
-				path: "resolve"
-			},
-			getEditorState: {
-				scope: "collection",
-				method: "POST",
-				path: "editor-state"
-			},
-			policyAudit: {
-				scope: "collection",
-				method: "POST",
-				path: "policy-audit"
-			}
-		}
+		routes: { reportUsage: {
+			scope: "collection",
+			method: "POST",
+			path: "report"
+		} }
 	},
 	cli: false,
 	mcp: false
-})], FieldPolicyCollection);
-function normalizeAuditRefs(value, label, maximum) {
-	if (value === void 0) return [];
-	if (!Array.isArray(value)) throw new Error(`policyAudit ${label} must be a string array`);
-	if (value.some((ref) => typeof ref !== "string" || ref.trim() === "")) throw new Error(`policyAudit ${label} must contain non-empty strings`);
-	const refs = [...new Set(value)];
-	if (refs.length > maximum) throw new Error(`policyAudit ${label} accepts at most ${maximum} objectRefs`);
-	return refs;
-}
-function emptyAudit(caller) {
-	return {
-		orgRows: [],
-		appRows: [],
-		inheritedOrgKeys: {},
-		userOverrideCounts: {},
-		driftRows: [],
-		policies: {},
-		caller
-	};
+})], FieldUsageCounterCollection);
+var FieldUsageReportReceiptCollection = class extends SmrtCollection {
+	async claim(options) {
+		const id = await fieldUsageReportReceiptId(options.tenantId, options.userId, options.objectRef, options.fieldName, options.period);
+		if (await this.get(id)) return false;
+		try {
+			await this.create({
+				...options,
+				id,
+				_insertOnly: true
+			});
+			return true;
+		} catch (error) {
+			if (await this.get(id)) return false;
+			throw error;
+		}
+	}
+};
+__publicField$1(FieldUsageReportReceiptCollection, "_itemClass", FieldUsageReportReceipt);
+FieldUsageReportReceiptCollection = __decorateClass$1([smrt({
+	conflictColumns: [
+		"tenant_id",
+		"user_id",
+		"object_ref",
+		"field_name",
+		"period"
+	],
+	api: false,
+	cli: false,
+	mcp: false
+})], FieldUsageReportReceiptCollection);
+async function fieldUsageCounterId(tenantId, objectRef, fieldName, period) {
+	return deterministicFieldsUuid([
+		"field-usage-counter",
+		tenantId,
+		objectRef,
+		fieldName,
+		period
+	]);
 }
-function dateText(value) {
-	if (value instanceof Date) return value.toISOString();
-	return typeof value === "string" ? value : null;
+async function fieldUsageReportReceiptId(tenantId, userId, objectRef, fieldName, period) {
+	return deterministicFieldsUuid([
+		"field-usage-report-receipt",
+		tenantId,
+		userId,
+		objectRef,
+		fieldName,
+		period
+	]);
 }
-function toAuditRow(row) {
-	return {
-		objectRef: row.objectRef,
-		defaultValue: row.defaultValue,
-		displayOrder: row.displayOrder,
-		fieldName: row.fieldName,
-		help: row.help,
-		id: String(row.id),
-		label: row.label,
-		locked: row.locked,
-		scopeType: row.scopeType,
-		tenantId: row.tenantId,
-		updatedBy: row.updatedBy,
-		userId: row.userId,
-		visibility: row.visibility,
-		createdAt: dateText(row.createdAt),
-		updatedAt: dateText(row.updatedAt)
-	};
+function isUsageAddressableField(field) {
+	if (field._meta?.__smrtSystemField === true) return false;
+	if (field.type === "oneToMany" || field.type === "manyToMany" || field.type === "meta") return false;
+	return !isTransientField(field);
 }
-function toDriftIdentity(row) {
-	return {
-		id: String(row.id),
-		objectRef: row.objectRef,
-		fieldName: row.fieldName,
-		scopeType: row.scopeType,
-		tenantId: row.tenantId,
-		userId: row.userId,
-		updatedBy: row.updatedBy,
-		createdAt: dateText(row.createdAt),
-		updatedAt: dateText(row.updatedAt)
-	};
+function isHistogramEligibleField(field) {
+	return field.type === "boolean" || field.type === "foreignKey" || field.type === "crossPackageRef";
 }
-function sortAuditRows(left, right) {
-	return left.objectRef.localeCompare(right.objectRef) || left.fieldName.localeCompare(right.fieldName);
+function serializeHistogramSample(field, value) {
+	if (field.type === "boolean") return typeof value === "boolean" ? String(value) : null;
+	if (isStorableReferenceId(field, value) && value.length <= 64) return value;
+	return null;
 }
-function sortDriftRows(left, right) {
-	return left.objectRef.localeCompare(right.objectRef) || left.fieldName.localeCompare(right.fieldName) || left.scopeType.localeCompare(right.scopeType);
+function decodeHistogramKey(field, key) {
+	if (field.type === "boolean") return key === "true";
+	return key;
+}
+function validateEntriesInput(rawEntries) {
+	if (!Array.isArray(rawEntries) || rawEntries.length === 0) throw new Error("reportUsage requires a non-empty \"entries\" array of { objectRef, fieldName, value?, matchedDefault? } samples");
+	if (rawEntries.length > 100) throw new Error(`reportUsage accepts at most 100 entries per call (got ${rawEntries.length})`);
+	for (const entry of rawEntries) if (!entry || typeof entry !== "object" || typeof entry.objectRef !== "string" || entry.objectRef.trim() === "" || typeof entry.fieldName !== "string" || entry.fieldName.trim() === "") throw new Error("reportUsage entries must carry non-empty objectRef and fieldName strings");
+	return rawEntries;
 }
 //#endregion
 //#region src/field-policy-resolver.ts
@@ -1399,7 +1390,7 @@ async function defaultTenantHierarchyLoader(options) {
 		throw error;
 	}
 }
-var MISSING_MODULE_TARGET_PATTERN = /Cannot find (?:package|module) '([^']+)'/;
+var MISSING_MODULE_TARGET_PATTERN$1 = /Cannot find (?:package|module) '([^']+)'/;
 function isUsersSpecifier(target) {
 	return target === "@happyvertical/smrt-users" || target.startsWith("@happyvertical/smrt-users/");
 }
@@ -1408,7 +1399,7 @@ function isMissingUsersDependency(error) {
 	const seen = /* @__PURE__ */ new Set();
 	while (current instanceof Error && !seen.has(current)) {
 		seen.add(current);
-		const match = current.message.match(MISSING_MODULE_TARGET_PATTERN);
+		const match = current.message.match(MISSING_MODULE_TARGET_PATTERN$1);
 		if (match && isUsersSpecifier(match[1])) return true;
 		if (current.message.includes("Failed to load @happyvertical/smrt-users for")) return true;
 		current = current.cause;
@@ -1625,9 +1616,506 @@ function spaced(value) {
 	return value.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]/g, " ");
 }
 //#endregion
+//#region src/usage-learning.ts
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp(target, key, result);
+	return result;
+};
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var DAY_MS = 1440 * 60 * 1e3;
+var FIELD_USAGE_MAINTENANCE_DEFAULTS = {
+	counterMaxAgeMs: 90 * DAY_MS,
+	counterMaxRows: 1e5,
+	suggestionAcceptedMaxAgeMs: 180 * DAY_MS
+};
+var FIELD_USAGE_SUGGESTION_DEFAULTS = {
+	windowDays: 30,
+	minDistinctUsers: 5,
+	minSetCount: 10,
+	defaultDominanceRatio: .8
+};
+async function pruneFieldUsageCounters(db, retention) {
+	const { maxAgeMs, maxRows } = retention;
+	if (maxAgeMs == null && maxRows == null) throw new Error("pruneFieldUsageCounters requires maxAgeMs and/or maxRows");
+	if (maxAgeMs != null && (!Number.isFinite(maxAgeMs) || maxAgeMs < 0)) throw new Error(`pruneFieldUsageCounters maxAgeMs must be >= 0, got ${maxAgeMs}`);
+	if (maxRows != null && (!Number.isFinite(maxRows) || maxRows < 0)) throw new Error(`pruneFieldUsageCounters maxRows must be >= 0, got ${maxRows}`);
+	const tenantCondition = retention.tenantId ? " AND tenant_id = ?" : "";
+	const tenantParams = retention.tenantId ? [retention.tenantId] : [];
+	let pruned = 0;
+	if (maxAgeMs != null) {
+		const cutoffDay = fieldUsagePeriodForDate(new Date(Date.now() - maxAgeMs));
+		pruned += await deleteCounted(db, `period < ?${tenantCondition}`, [cutoffDay, ...tenantParams]);
+	}
+	if (maxRows != null) {
+		const excess = numberFromRow(getQueryRows(await db.query(`SELECT COUNT(*) AS total FROM _smrt_field_usage_counters${retention.tenantId ? " WHERE tenant_id = ?" : ""}`, ...tenantParams))[0] ?? {}, "total") - Math.floor(maxRows);
+		if (excess > 0) {
+			await db.query(`DELETE FROM _smrt_field_usage_counters
+          WHERE id IN (
+            SELECT id FROM _smrt_field_usage_counters
+            ${retention.tenantId ? "WHERE tenant_id = ?" : ""}
+            ORDER BY period ASC, id ASC
+            LIMIT ${excess}
+          )`, ...tenantParams);
+			pruned += excess;
+		}
+	}
+	return { pruned };
+}
+async function pruneFieldUsageReportReceipts(db, options) {
+	if (!Number.isFinite(options.maxAgeMs) || options.maxAgeMs < 0) throw new Error(`pruneFieldUsageReportReceipts maxAgeMs must be >= 0, got ${options.maxAgeMs}`);
+	const cutoffDay = fieldUsagePeriodForDate(new Date(Date.now() - options.maxAgeMs));
+	const tenantCondition = options.tenantId ? " AND tenant_id = ?" : "";
+	const tenantParams = options.tenantId ? [options.tenantId] : [];
+	return { pruned: await deleteCounted(db, `period < ?${tenantCondition}`, [cutoffDay, ...tenantParams], "_smrt_field_usage_report_receipts") };
+}
+async function pruneFieldPolicySuggestions(db, retention) {
+	const { acceptedMaxAgeMs } = retention;
+	if (!Number.isFinite(acceptedMaxAgeMs) || acceptedMaxAgeMs < 0) throw new Error(`pruneFieldPolicySuggestions acceptedMaxAgeMs must be >= 0, got ${acceptedMaxAgeMs}`);
+	const now = retention.now ?? /* @__PURE__ */ new Date();
+	const acceptedCutoff = new Date(now.getTime() - acceptedMaxAgeMs);
+	const tenantCondition = retention.tenantId ? " AND tenant_id = ?" : "";
+	const tenantParams = retention.tenantId ? [retention.tenantId] : [];
+	return { pruned: await deleteCounted(db, `((status = 'dismissed' AND cooldown_until IS NOT NULL AND cooldown_until <= ?) OR (status = 'accepted' AND decided_at IS NOT NULL AND decided_at <= ?))${tenantCondition}`, [
+		now.toISOString(),
+		acceptedCutoff.toISOString(),
+		...tenantParams
+	], "_smrt_field_policy_suggestions") };
+}
+async function runFieldUsageMaintenance(options) {
+	const config = normalizeMaintenanceConfig(options);
+	const ambientTenantId = restrictingTenantId();
+	const counters = await pruneFieldUsageCounters(options.db, {
+		maxAgeMs: config.counterMaxAgeMs,
+		maxRows: config.counterMaxRows,
+		tenantId: ambientTenantId
+	});
+	const receipts = await pruneFieldUsageReportReceipts(options.db, {
+		maxAgeMs: config.counterMaxAgeMs,
+		tenantId: ambientTenantId
+	});
+	const suggestions = await pruneFieldPolicySuggestions(options.db, {
+		acceptedMaxAgeMs: config.suggestionAcceptedMaxAgeMs,
+		tenantId: ambientTenantId
+	});
+	return {
+		countersPruned: counters.pruned,
+		receiptsPruned: receipts.pruned,
+		suggestionsPruned: suggestions.pruned
+	};
+}
+async function runFieldPolicySuggestionGeneration(options) {
+	const config = normalizeSuggestionConfig(options);
+	const now = options.now ?? /* @__PURE__ */ new Date();
+	const ambientTenantId = restrictingTenantId();
+	const counters = await FieldUsageCounterCollection.create({ db: options.db });
+	const suggestions = await FieldPolicySuggestionCollection.create({ db: options.db });
+	const fromPeriod = fieldUsagePeriodForDate(/* @__PURE__ */ new Date(now.getTime() - (config.windowDays - 1) * DAY_MS));
+	const toPeriod = fieldUsagePeriodForDate(now);
+	const groups = groupCounters(await counters.listWindow({
+		fromPeriod,
+		toPeriod,
+		tenantId: ambientTenantId
+	}));
+	const fieldMaps = /* @__PURE__ */ new Map();
+	const resolvedPolicies = /* @__PURE__ */ new Map();
+	const summary = {
+		created: 0,
+		suppressed: 0,
+		groupsConsidered: 0,
+		groupsFailed: 0,
+		failures: []
+	};
+	for (const group of groups) {
+		summary.groupsConsidered += 1;
+		try {
+			await evaluateGroup(group);
+		} catch (error) {
+			summary.groupsFailed += 1;
+			if (summary.failures.length < 5) summary.failures.push(`${group.tenantId} ${group.objectRef}.${group.fieldName}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
+	return summary;
+	async function evaluateGroup(group) {
+		let fieldMap = fieldMaps.get(group.objectRef);
+		if (fieldMap === void 0) {
+			try {
+				fieldMap = await getObjectFieldMap(group.objectRef);
+			} catch {
+				fieldMap = null;
+			}
+			fieldMaps.set(group.objectRef, fieldMap);
+		}
+		if (!fieldMap) return;
+		const fieldDef = fieldMap.get(group.fieldName);
+		if (!fieldDef || isSensitiveField(fieldDef) || getFieldReadPermission(fieldDef) !== void 0 || isTransientField(fieldDef)) return;
+		const stats = mergeGroupStats(group.buckets);
+		const policyKey = `${group.tenantId}\0${group.objectRef}`;
+		let orgFields = resolvedPolicies.get(policyKey);
+		if (!orgFields) {
+			const { resolveFieldPolicy } = await Promise.resolve().then(() => field_policy_resolver_exports);
+			orgFields = (await resolveFieldPolicy(group.objectRef, {
+				tenantId: group.tenantId,
+				db: options.db
+			})).fields;
+			resolvedPolicies.set(policyKey, orgFields);
+		}
+		const fieldPolicy = orgFields[group.fieldName];
+		if (!fieldPolicy) return;
+		if (stats.distinctUsers >= config.minDistinctUsers && fieldPolicy.visibility !== "basic") if (await createUnlessSuppressed(suggestions, {
+			tenantId: group.tenantId,
+			objectRef: group.objectRef,
+			fieldName: group.fieldName,
+			kind: "promote",
+			proposedValue: null,
+			evidence: buildFieldUsageEvidence({
+				kind: "promote",
+				fieldName: group.fieldName,
+				objectRef: group.objectRef,
+				windowStart: fromPeriod,
+				windowEnd: toPeriod,
+				distinctUsers: stats.distinctUsers,
+				distinctUsersAtLeast: stats.distinctUsersOverflowed,
+				setCount: stats.setCount,
+				submissionCount: stats.submissionTotalKnown ? stats.submissionCount : void 0,
+				threshold: config.minDistinctUsers
+			}),
+			now
+		})) summary.created += 1;
+		else summary.suppressed += 1;
+		if (isHistogramEligibleField(fieldDef) && stats.submissionTotalKnown && stats.submissionCount >= config.minSetCount) {
+			const top = topHistogramEntry(stats.histogram);
+			if (top) {
+				const share = top.count / stats.submissionCount;
+				const proposed = decodeHistogramKey(fieldDef, top.key);
+				const currentDefault = fieldPolicy.hasDefault ? fieldPolicy.defaultValue : void 0;
+				if (share >= config.defaultDominanceRatio && !sameProposedValue(proposed, currentDefault)) if (await createUnlessSuppressed(suggestions, {
+					tenantId: group.tenantId,
+					objectRef: group.objectRef,
+					fieldName: group.fieldName,
+					kind: "default",
+					proposedValue: JSON.stringify(proposed),
+					evidence: buildFieldUsageEvidence({
+						kind: "default",
+						fieldName: group.fieldName,
+						objectRef: group.objectRef,
+						windowStart: fromPeriod,
+						windowEnd: toPeriod,
+						distinctUsers: stats.distinctUsers,
+						distinctUsersAtLeast: stats.distinctUsersOverflowed,
+						setCount: stats.setCount,
+						submissionCount: stats.submissionCount,
+						threshold: config.minSetCount,
+						topValue: proposed,
+						topValueShare: share
+					}),
+					now
+				})) summary.created += 1;
+				else summary.suppressed += 1;
+			}
+		}
+	}
+}
+var FieldUsageLearningAgent = class extends SmrtObject {
+	constructor(options = {}) {
+		super(options);
+	}
+	/** Schedule entry point for {@link runFieldUsageMaintenance}. */
+	async runUsageMaintenance(args = {}) {
+		return runFieldUsageMaintenance({
+			db: this.db,
+			...pickFiniteNumbers(args, [
+				"counterMaxAgeMs",
+				"counterMaxRows",
+				"suggestionAcceptedMaxAgeMs"
+			])
+		});
+	}
+	/** Schedule entry point for {@link runFieldPolicySuggestionGeneration}. */
+	async runSuggestionGeneration(args = {}) {
+		return runFieldPolicySuggestionGeneration({
+			db: this.db,
+			...pickFiniteNumbers(args, [
+				"windowDays",
+				"minDistinctUsers",
+				"minSetCount",
+				"defaultDominanceRatio"
+			])
+		});
+	}
+};
+/**
+* The smrt-jobs opt-in background allowlist (S5 contract): ONLY these two
+* methods are reachable from a persisted job/schedule row.
+*/
+__publicField(FieldUsageLearningAgent, "backgroundEligibleMethods", ["runUsageMaintenance", "runSuggestionGeneration"]);
+FieldUsageLearningAgent = __decorateClass([smrt({
+	tableName: "_smrt_field_usage_learning_agents",
+	api: { include: [] },
+	cli: false,
+	mcp: { include: [] }
+})], FieldUsageLearningAgent);
+function buildFieldUsageEvidence(input) {
+	const users = `${input.distinctUsersAtLeast ? "at least " : ""}${input.distinctUsers} user${input.distinctUsers === 1 && !input.distinctUsersAtLeast ? "" : "s"}`;
+	const deviations = `${input.setCount} of ` + (input.submissionCount === void 0 ? "an unrecorded number of submissions" : `${input.submissionCount} submission${input.submissionCount === 1 ? "" : "s"}`);
+	const base = `${users} set "${input.fieldName}" to a non-default value in ${deviations} between ${input.windowStart} and ${input.windowEnd}.`;
+	return {
+		summary: input.kind === "default" ? `${base} ${Math.round((input.topValueShare ?? 0) * 100)}% of all ${input.submissionCount ?? 0} submissions used the value ${JSON.stringify(input.topValue)}.` : base,
+		objectRef: input.objectRef,
+		fieldName: input.fieldName,
+		windowStart: input.windowStart,
+		windowEnd: input.windowEnd,
+		distinctUsers: input.distinctUsers,
+		...input.distinctUsersAtLeast ? { distinctUsersAtLeast: true } : {},
+		setCount: input.setCount,
+		...input.submissionCount !== void 0 ? { submissionCount: input.submissionCount } : { submissionCountUnknown: true },
+		threshold: input.threshold,
+		...input.topValue !== void 0 ? { topValue: input.topValue } : {},
+		...input.topValueShare !== void 0 ? { topValueShare: Number(input.topValueShare.toFixed(4)) } : {}
+	};
+}
+function groupCounters(rows) {
+	const byKey = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		if (!row.tenantId) continue;
+		const key = `${row.tenantId}\0${row.objectRef}\0${row.fieldName}`;
+		let group = byKey.get(key);
+		if (!group) {
+			group = {
+				tenantId: row.tenantId,
+				objectRef: row.objectRef,
+				fieldName: row.fieldName,
+				buckets: []
+			};
+			byKey.set(key, group);
+		}
+		group.buckets.push(row);
+	}
+	return [...byKey.values()];
+}
+function mergeGroupStats(buckets) {
+	let submissionCount = 0;
+	let submissionTotalKnown = true;
+	let setCount = 0;
+	let overflowed = false;
+	const users = /* @__PURE__ */ new Set();
+	const histogram = emptyHistogram();
+	for (const bucket of buckets) {
+		submissionCount += bucket.submissionCount;
+		if (bucket.isLegacyBucket()) submissionTotalKnown = false;
+		setCount += bucket.setCount;
+		overflowed = overflowed || bucket.distinctUsersOverflowed;
+		for (const id of bucket.getDistinctUserIds()) users.add(id);
+		for (const [key, count] of Object.entries(bucket.getValueHistogram())) histogram[key] = (Object.hasOwn(histogram, key) ? histogram[key] : 0) + count;
+	}
+	return {
+		submissionCount,
+		submissionTotalKnown,
+		setCount,
+		distinctUsers: users.size,
+		distinctUsersOverflowed: overflowed,
+		histogram
+	};
+}
+function topHistogramEntry(histogram) {
+	let top = null;
+	for (const [key, count] of Object.entries(histogram)) if (!top || count > top.count) top = {
+		key,
+		count
+	};
+	return top;
+}
+function sameProposedValue(a, b) {
+	if (a === b) return true;
+	try {
+		return JSON.stringify(a) === JSON.stringify(b);
+	} catch {
+		return false;
+	}
+}
+async function createUnlessSuppressed(suggestions, candidate) {
+	if ((await suggestions.list({ where: {
+		tenantId: candidate.tenantId,
+		objectRef: candidate.objectRef,
+		fieldName: candidate.fieldName,
+		kind: candidate.kind
+	} })).some((row) => row.activeKey === "active" || row.status === "dismissed" && isWithinCoolDown(row, candidate.now))) return false;
+	await suggestions.create({
+		tenantId: candidate.tenantId,
+		objectRef: candidate.objectRef,
+		fieldName: candidate.fieldName,
+		kind: candidate.kind,
+		proposedValue: candidate.proposedValue,
+		evidence: JSON.stringify(candidate.evidence),
+		status: "pending"
+	});
+	return true;
+}
+function isWithinCoolDown(row, now) {
+	const raw = row.cooldownUntil;
+	if (raw === null || raw === void 0) return false;
+	const until = raw instanceof Date ? raw.getTime() : Date.parse(String(raw));
+	return Number.isFinite(until) && until > now.getTime();
+}
+function restrictingTenantId() {
+	const context = getCurrentTenant();
+	if (!context || isSuperAdminBypass()) return null;
+	return context.tenantId;
+}
+function normalizeMaintenanceConfig(options) {
+	return {
+		counterMaxAgeMs: nonNegativeOrDefault(options.counterMaxAgeMs, FIELD_USAGE_MAINTENANCE_DEFAULTS.counterMaxAgeMs),
+		counterMaxRows: nonNegativeOrDefault(options.counterMaxRows, FIELD_USAGE_MAINTENANCE_DEFAULTS.counterMaxRows),
+		suggestionAcceptedMaxAgeMs: nonNegativeOrDefault(options.suggestionAcceptedMaxAgeMs, FIELD_USAGE_MAINTENANCE_DEFAULTS.suggestionAcceptedMaxAgeMs)
+	};
+}
+function normalizeSuggestionConfig(options) {
+	const ratio = positiveOrDefault(options.defaultDominanceRatio, FIELD_USAGE_SUGGESTION_DEFAULTS.defaultDominanceRatio);
+	return {
+		windowDays: Math.max(1, Math.floor(positiveOrDefault(options.windowDays, FIELD_USAGE_SUGGESTION_DEFAULTS.windowDays))),
+		minDistinctUsers: Math.max(1, Math.floor(positiveOrDefault(options.minDistinctUsers, FIELD_USAGE_SUGGESTION_DEFAULTS.minDistinctUsers))),
+		minSetCount: Math.max(1, Math.floor(positiveOrDefault(options.minSetCount, FIELD_USAGE_SUGGESTION_DEFAULTS.minSetCount))),
+		defaultDominanceRatio: Math.min(Math.max(ratio, .01), 1)
+	};
+}
+function positiveOrDefault(value, fallback) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : fallback;
+}
+function nonNegativeOrDefault(value, fallback) {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : fallback;
+}
+function pickFiniteNumbers(args, keys) {
+	const picked = {};
+	if (!args || typeof args !== "object") return picked;
+	for (const key of keys) {
+		const value = args[key];
+		if (typeof value === "number" && Number.isFinite(value)) picked[key] = value;
+	}
+	return picked;
+}
+async function deleteCounted(db, condition, params, table = "_smrt_field_usage_counters") {
+	const total = numberFromRow(getQueryRows(await db.query(`SELECT COUNT(*) AS total FROM ${table} WHERE ${condition}`, ...params))[0] ?? {}, "total");
+	if (total > 0) await db.query(`DELETE FROM ${table} WHERE ${condition}`, ...params);
+	return total;
+}
+function getQueryRows(result) {
+	return Array.isArray(result) ? result : result?.rows ?? [];
+}
+function numberFromRow(row, key) {
+	const value = row[key];
+	if (typeof value === "number") return value;
+	if (typeof value === "bigint") return Number(value);
+	if (typeof value === "string") return Number.parseFloat(value) || 0;
+	return 0;
+}
+//#endregion
+//#region src/users-module.ts
+var MISSING_MODULE_TARGET_PATTERN = /Cannot find (?:package|module) '([^']+)'/;
+function isPackageSpecifier(target, packageName) {
+	return target === packageName || target.startsWith(`${packageName}/`);
+}
+function isMissingWorkspaceDependency(error, packageName) {
+	let current = error;
+	const seen = /* @__PURE__ */ new Set();
+	while (current instanceof Error && !seen.has(current)) {
+		seen.add(current);
+		const match = current.message.match(MISSING_MODULE_TARGET_PATTERN);
+		if (match && isPackageSpecifier(match[1], packageName)) return true;
+		if (current.message.includes(`Failed to load ${packageName} for`)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+//#endregion
+//#region src/usage-schedules.ts
+var FIELD_USAGE_LEARNING_AGENT_TYPE = "@happyvertical/smrt-fields:FieldUsageLearningAgent";
+var FIELD_USAGE_MAINTENANCE_METHOD = "runUsageMaintenance";
+var FIELD_USAGE_SUGGESTION_METHOD = "runSuggestionGeneration";
+function fieldUsageScheduleId(method) {
+	return deterministicFieldsUuid([
+		"field-usage-learning-schedule",
+		FIELD_USAGE_LEARNING_AGENT_TYPE,
+		method
+	]);
+}
+async function ensureFieldUsageLearningSchedules(options) {
+	const context = getCurrentTenant();
+	if (context && !isSuperAdminBypass()) throw new TenantIsolationError("ensureFieldUsageLearningSchedules installs GLOBAL schedules and must run from trusted execution (no ambient tenant context, or super-admin bypass)", { tenantId: context.tenantId });
+	let agentsModule = options.agentsModule;
+	if (!agentsModule) try {
+		agentsModule = await importWorkspaceModule({
+			packageName: "@happyvertical/smrt-agents",
+			sourceEntry: "packages/agents/src/index.ts",
+			purpose: "field usage learning schedule installation"
+		});
+	} catch (error) {
+		if (isMissingWorkspaceDependency(error, "@happyvertical/smrt-agents")) return {
+			installed: false,
+			created: 0
+		};
+		throw error;
+	}
+	const schedules = await agentsModule.AgentScheduleCollection.create({ db: options.db });
+	const enabled = options.enabled ?? false;
+	let created = 0;
+	const definitions = [{
+		method: FIELD_USAGE_MAINTENANCE_METHOD,
+		cron: options.maintenanceCron ?? "30 2 * * *",
+		methodArgs: options.maintenanceArgs ?? {}
+	}, {
+		method: FIELD_USAGE_SUGGESTION_METHOD,
+		cron: options.suggestionCron ?? "0 3 * * 1",
+		methodArgs: options.suggestionArgs ?? {}
+	}];
+	for (const definition of definitions) {
+		if ((await schedules.list({ where: {
+			agentType: "@happyvertical/smrt-fields:FieldUsageLearningAgent",
+			method: definition.method
+		} })).some(isGlobalScheduleRow)) continue;
+		const id = await fieldUsageScheduleId(definition.method);
+		let row;
+		try {
+			row = await schedules.create({
+				id,
+				tenantId: null,
+				agentType: FIELD_USAGE_LEARNING_AGENT_TYPE,
+				agentId: null,
+				cron: definition.cron,
+				method: definition.method,
+				agentConfig: {},
+				methodArgs: definition.methodArgs,
+				enabled,
+				status: enabled ? "active" : "disabled",
+				_insertOnly: true
+			});
+		} catch (error) {
+			if ((await schedules.list({ where: { id } })).length === 0) throw error;
+			continue;
+		}
+		await row.save?.();
+		created += 1;
+	}
+	return {
+		installed: true,
+		created
+	};
+}
+function isGlobalScheduleRow(row) {
+	return row.tenantId === null || row.tenantId === void 0;
+}
+//#endregion
 //#region src/index.ts
 ensureFieldPolicyPermissionsRegistered();
 //#endregion
-export { APP_FIELD_POLICY_SCOPE_KEY, FIELD_POLICY_PERMISSION_DEFINITIONS, FIELD_POLICY_SCOPE_TYPES, FIELD_POLICY_VISIBILITIES, FieldPolicy, FieldPolicyCollection, MANAGE_FIELD_POLICY_PERMISSION, PERSONALIZE_FIELD_POLICY_PERMISSION, assertDefaultValueMatchesFieldType, buildCodeSeedDelta, buildCodeSeedVisibility, buildFieldPolicySettingsCatalog, clearFieldPolicyCache, ensureFieldPolicyPermissionsRegistered, fieldPolicyCatalogItemId, getCodeDefault, getCodeSeedGroup, getFieldPolicyCacheTtlMs, getFieldReadPermission, getObjectFieldMap, invalidateFieldPolicyCache, isPolicyAddressableField, isRequiredField, isSensitiveField, isTransientField, isUsableRequiredDefault, parseFieldPolicyCatalogQuery, requireRegisteredObject, resolveFieldPolicy, resolveFieldPolicyExplained, resolveSurvivingTenantChainIds, sanitizeFieldUIHints };
+export { ACTIVE_SUGGESTION_KEY, APP_FIELD_POLICY_SCOPE_KEY, FIELD_POLICY_PERMISSION_DEFINITIONS, FIELD_POLICY_SCOPE_TYPES, FIELD_POLICY_VISIBILITIES, FIELD_USAGE_LEARNING_AGENT_TYPE, FieldPolicy, FieldPolicyCollection, FieldPolicySuggestion, FieldPolicySuggestionCollection, FieldPolicySuggestionConflictError, FieldUsageCounter, FieldUsageCounterCollection, FieldUsageLearningAgent, MANAGE_FIELD_POLICY_PERMISSION, MAX_DISTINCT_USERS_PER_BUCKET, MAX_USAGE_REPORT_ENTRIES, MAX_VALUE_HISTOGRAM_BUCKETS, PERSONALIZE_FIELD_POLICY_PERMISSION, assertDefaultValueMatchesFieldType, buildCodeSeedDelta, buildCodeSeedVisibility, buildFieldPolicySettingsCatalog, clearFieldPolicyCache, decodeHistogramKey, ensureFieldPolicyPermissionsRegistered, ensureFieldUsageLearningSchedules, fieldPolicyCatalogItemId, fieldUsagePeriodForDate, getCodeDefault, getCodeSeedGroup, getFieldPolicyCacheTtlMs, getFieldReadPermission, getObjectFieldMap, invalidateFieldPolicyCache, isHistogramEligibleField, isPolicyAddressableField, isRequiredField, isSensitiveField, isStorableReferenceId, isTransientField, isUsableRequiredDefault, parseFieldPolicyCatalogQuery, pruneFieldPolicySuggestions, pruneFieldUsageCounters, requireRegisteredObject, resolveFieldPolicy, resolveFieldPolicyExplained, resolveSurvivingTenantChainIds, runFieldPolicySuggestionGeneration, runFieldUsageMaintenance, sanitizeFieldUIHints, serializeHistogramSample, field_policy_resolver_exports as t };
 
 //# sourceMappingURL=index.js.map