@litusarchieve18/agricore-utils 1.0.12 → 1.0.14

package/dist/index.js

@@ -30,8 +30,12 @@ __export(index_exports, {
   AuditStatus: () => AuditStatus,
   AuditType: () => AuditType,
   CAT: () => CAT,
+  CATEGORY_TABS: () => CATEGORY_TABS,
   Converter: () => Converter,
   CropCycleStatus: () => CropCycleStatus,
+  DOCUMENT_DISPLAY_INFO: () => DOCUMENT_DISPLAY_INFO,
+  DOCUMENT_MENU_MAP: () => DOCUMENT_MENU_MAP,
+  DocumentCategory: () => DocumentCategory,
   DocumentType: () => DocumentType,
   ERROR_DICTIONARY: () => ERROR_DICTIONARY,
   EVERYONE: () => EVERYONE,
@@ -287,7 +291,7 @@ var Converter = {
   }
 };
 
-// src/index.ts
+// src/constants.ts
 var MOD = {
   OPERATIONS: "OPR",
   EQUIPMENT: "EQP",
@@ -301,7 +305,6 @@ var MOD = {
   ALERTS: "ALT",
   INFRA: "INF",
   SESSION: "SES"
-  // ← added: used in generateSessionContext but was missing from errorRegistry.js
 };
 var CAT = {
   SUBSCRIPTION: "1",
@@ -318,43 +321,6 @@ var ACT = {
   UPLOAD: "05"
 };
 var SENTINEL_UUID = "00000000-0000-0000-0000-000000000000";
-var AppError = class extends Error {
-  status;
-  appCode;
-  isOperational;
-  constructor(status, mod, cat, act, message) {
-    super(message);
-    this.status = status;
-    this.appCode = `${mod}-${status}-${cat}${act}`;
-    this.isOperational = true;
-    Object.setPrototypeOf(this, new.target.prototype);
-  }
-};
-var ErrorFactory = {
-  unauthorized: (mod, msg = "Authentication required") => new AppError(401, mod, CAT.PERMISSION, ACT.GENERIC, msg),
-  forbidden: (mod, act, msg = "Access denied") => new AppError(403, mod, CAT.PERMISSION, act, msg),
-  badRequest: (mod, act, msg = "Bad request") => new AppError(400, mod, CAT.VALIDATION, act, msg),
-  notFound: (mod, act = ACT.GENERIC, msg = "Record not found") => new AppError(404, mod, CAT.VALIDATION, act, msg),
-  conflict: (mod, act, msg = "Record already exists") => new AppError(409, mod, CAT.INTEGRITY, act, msg),
-  integrity: (mod, act = ACT.GENERIC, msg = "Data integrity violation") => new AppError(409, mod, CAT.INTEGRITY, act, msg),
-  subscription: (mod, msg = "Module locked or subscription required") => new AppError(403, mod, CAT.SUBSCRIPTION, ACT.GENERIC, msg),
-  internal: (mod, msg = "Internal server error") => new AppError(500, mod, CAT.INTEGRITY, ACT.GENERIC, msg)
-};
-var handleAppErrorResponse = (error, mod = MOD.ADMIN) => {
-  if (error instanceof AppError && error.isOperational) {
-    return Response.json(
-      { error: { appCode: error.appCode, message: error.message } },
-      { status: error.status }
-    );
-  }
-  const e = error;
-  console.error(`[${mod}] UNEXPECTED ERROR:`, e?.message);
-  console.error(`[${mod}] STACK:`, e?.stack);
-  return Response.json(
-    { error: { appCode: `${mod}-500-000`, message: "An unexpected server error occurred. Please try again." } },
-    { status: 500 }
-  );
-};
 var MODULE_LABELS = {
   [MOD.OPERATIONS]: "Operations",
   [MOD.EQUIPMENT]: "Equipment & Fleet",
@@ -392,147 +358,6 @@ var ERROR_DICTIONARY = {
   "403": { title: "Edit Conflict", text: "This record was recently updated by someone else. Please refresh and try again." },
   "404": { title: "Record In Use", text: "This record cannot be deleted because it is referenced by other data." }
 };
-var FALLBACK = {
-  title: "Something Went Wrong",
-  text: "An unexpected error occurred. Please try again or contact your administrator."
-};
-var resolveAppError = (appCode) => {
-  if (!appCode || typeof appCode !== "string") {
-    return { ...FALLBACK, module: "UNK", moduleLabel: "Unknown", status: 500, catAct: "000", isSubscriptionIssue: false, isPermissionIssue: false };
-  }
-  const parts = appCode.split("-");
-  if (parts.length !== 3) {
-    return { ...FALLBACK, module: "UNK", moduleLabel: "Unknown", status: 500, catAct: "000", isSubscriptionIssue: false, isPermissionIssue: false };
-  }
-  const [mod, status, catAct] = parts;
-  const details = ERROR_DICTIONARY[catAct] || FALLBACK;
-  return {
-    title: details.title,
-    text: details.text,
-    module: mod,
-    moduleLabel: MODULE_LABELS[mod] || mod,
-    status: parseInt(status, 10),
-    catAct,
-    isSubscriptionIssue: catAct.startsWith("1"),
-    isPermissionIssue: catAct.startsWith("2")
-  };
-};
-var extractAppCode = (error) => {
-  const e = error;
-  return e?.response?.data?.error?.appCode ?? e?.data?.error?.appCode ?? null;
-};
-var resolveError = (error) => {
-  const appCode = extractAppCode(error);
-  if (appCode) return resolveAppError(appCode);
-  const e = error;
-  return { ...FALLBACK, module: "UNK", moduleLabel: "Unknown", status: e?.status || 500, catAct: "000", isSubscriptionIssue: false, isPermissionIssue: false };
-};
-function generateCanonicalId() {
-  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
-    return crypto.randomUUID();
-  }
-  return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
-    const r = Math.random() * 16 | 0;
-    return (c === "x" ? r : r & 3 | 8).toString(16);
-  });
-}
-function generateInfrastructureFields(activeScope, availableScopes) {
-  if (!activeScope || !availableScopes?.length) {
-    throw ErrorFactory.unauthorized("[generateInfrastructureFields] Missing scope context.");
-  }
-  let companyId = null;
-  let legalEntityId = null;
-  let facilityId = null;
-  let pointer = activeScope;
-  while (pointer) {
-    if (pointer.type === "company") companyId = pointer.base44Id;
-    if (pointer.type === "legalEntity") legalEntityId = pointer.base44Id;
-    if (pointer.type === "facility") facilityId = pointer.base44Id;
-    const parentId = pointer.parentId ?? null;
-    pointer = parentId ? availableScopes.find((s) => s.base44Id === parentId) || null : null;
-  }
-  if (!companyId) {
-    throw ErrorFactory.unauthorized("[generateInfrastructureFields] Could not resolve companyId from scope tree.");
-  }
-  return {
-    canonicalId: crypto.randomUUID(),
-    companyId,
-    legalEntityId,
-    facilityId,
-    authScopeId: activeScope.authScopeId
-  };
-}
-function buildRlsFilter(session, extra = {}) {
-  return { ...extra, authScopeId: { $in: session.readScopes || [] } };
-}
-function canRead(session, authScopeId) {
-  return session.readScopes?.includes(authScopeId) ?? false;
-}
-function canWrite(session, authScopeId, resourcePath) {
-  const override = session.resourceOverrides?.[authScopeId]?.[resourcePath];
-  if (override === "WRITE") return true;
-  if (override === "NONE" || override === "READ") return false;
-  return session.writeScopes?.includes(authScopeId) ?? false;
-}
-function assertCanWrite(session, authScopeId, resourcePath) {
-  const override = session.resourceOverrides?.[authScopeId]?.[resourcePath];
-  if (override === "WRITE") return;
-  if (override === "NONE" || override === "READ") {
-    throw new AppError(
-      403,
-      MOD.SESSION,
-      CAT.PERMISSION,
-      ACT.GENERIC,
-      `You do not have write access to "${resourcePath}" in this scope.`
-    );
-  }
-  if (session.writeScopes?.includes(authScopeId)) return;
-  throw new AppError(
-    403,
-    MOD.SESSION,
-    CAT.PERMISSION,
-    ACT.GENERIC,
-    "You do not have permission to modify records in this scope."
-  );
-}
-function resolveAccess(session, activeScopeId, tabConfig) {
-  const resourcePath = tabConfig?.resourceId;
-  const overrides = session.resourceOverrides?.[activeScopeId] ?? {};
-  if (resourcePath) {
-    const segments = resourcePath.split(".");
-    for (let len = segments.length; len >= 1; len--) {
-      const path = segments.slice(0, len).join(".");
-      const override = overrides[path];
-      if (override === "NONE" || override === "READ" || override === "WRITE") return override;
-    }
-  }
-  const allowedRoles = tabConfig?.allowedRoles ?? [];
-  const requiredPrivileges = tabConfig?.requiredPrivileges ?? [];
-  const hasRestrictions = allowedRoles.length > 0 || requiredPrivileges.length > 0;
-  if (hasRestrictions) {
-    const role = session?.role ?? "";
-    const privileges = session?.privileges ?? [];
-    const passesRole = allowedRoles.length > 0 && allowedRoles.includes(role);
-    const passesPrivilege = requiredPrivileges.length > 0 && requiredPrivileges.some((p) => privileges.includes(p));
-    return passesRole || passesPrivilege ? "WRITE" : "NONE";
-  }
-  return "READ";
-}
-function resolveMenuVisibility(session, authScopeId, resourcePath) {
-  const override = session.resourceOverrides?.[authScopeId]?.[resourcePath];
-  if (override === "NONE") return "hidden";
-  if (override === "READ") return "read_only";
-  if (override === "WRITE") return "active";
-  if (session.writeScopes?.includes(authScopeId)) return "active";
-  if (session.readScopes?.includes(authScopeId)) return "read_only";
-  return "hidden";
-}
-function isTabVisible(session, activeScopeId, tabConfig) {
-  return resolveAccess(session, activeScopeId, tabConfig) !== "NONE";
-}
-function isTabWritable(session, activeScopeId, tabConfig) {
-  return resolveAccess(session, activeScopeId, tabConfig) === "WRITE";
-}
 var UserRole = {
   OWNER: "owner",
   MANAGER: "manager",
@@ -752,17 +577,6 @@ var FORM_REGISTRY = {
   // ── Audit & Compliance ───────────────────────────────────────────────────
   auditProjectForm: { label: "Audit Project", menuUrl: "/admin", module: "Audit & Compliance" }
 };
-function getFormMeta(componentId) {
-  return FORM_REGISTRY[componentId] ?? null;
-}
-function getFormsGroupedByModule() {
-  const groups = {};
-  for (const [id, meta] of Object.entries(FORM_REGISTRY)) {
-    if (!groups[meta.module]) groups[meta.module] = [];
-    groups[meta.module].push({ id, ...meta });
-  }
-  return groups;
-}
 var TASK_TYPE_REGISTRY = {
   INVOICE_OCR: {
     label: "Invoice / Receipt OCR",
@@ -797,20 +611,6 @@ var TASK_TYPE_REGISTRY = {
     approveAction: "ATTACH_REPORT_FILE"
   }
 };
-var getTaskTypeOptions = () => Object.entries(TASK_TYPE_REGISTRY).map(([value, config]) => ({
-  value,
-  label: config.label,
-  description: config.description,
-  mimeTypes: config.mimeTypes,
-  icon: config.icon
-}));
-var getAcceptedMimeTypes = (taskType) => {
-  const config = TASK_TYPE_REGISTRY[taskType];
-  return config ? config.mimeTypes.join(",") : "*/*";
-};
-var getApproveAction = (taskType) => {
-  return TASK_TYPE_REGISTRY[taskType]?.approveAction ?? null;
-};
 var RESOURCE_PATHS = {
   // ── Top-level menu sections ────────────────────────────────────────────────
   dashboard: "dashboard",
@@ -862,7 +662,6 @@ var AGRI_ONLY = [
 ];
 var RESOURCE_MODULE_MAP = {
   // ── Top-level menu sections ────────────────────────────────────────────────
-  // CORE features (accessible to everyone with an account)
   [RESOURCE_PATHS.dashboard]: [],
   [RESOURCE_PATHS.operations]: ALL_OPERATIONS,
   [RESOURCE_PATHS.equipment]: ALL_OPERATIONS,
@@ -917,17 +716,8 @@ var ROLE_SECTIONS_BY_KEY = {
 };
 var EVERYONE = Object.values(UserRole);
 var RESOURCE_REQUIREMENTS = {
-  [RESOURCE_PATHS.dashboard]: {
-    allowedRoles: EVERYONE
-  },
-  [RESOURCE_PATHS.operations]: {
-    allowedRoles: EVERYONE
-  },
-  // [RESOURCE_PATHS.equipment]: EVERYONE, 
-  // [RESOURCE_PATHS.safety]: ALL_OPERATIONS,
-  // [RESOURCE_PATHS.team]: ALL_OPERATIONS,
-  // [RESOURCE_PATHS.records]: ALL_OPERATIONS, 
-  // [RESOURCE_PATHS.adminSettings]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.dashboard]: { allowedRoles: EVERYONE },
+  [RESOURCE_PATHS.operations]: { allowedRoles: EVERYONE },
   // ── Records & Reports ──────────────────────────────────────────────────────
   [RESOURCE_PATHS.documentHub]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
@@ -949,7 +739,6 @@ var RESOURCE_REQUIREMENTS = {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
     requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
   },
-  // [RESOURCE_PATHS.analytics]: ALL_OPERATIONS,
   // ── Admin Settings ─────────────────────────────────────────────────────────
   [RESOURCE_PATHS.adminUserRoster]: {
     allowedRoles: [UserRole.OWNER],
@@ -966,101 +755,7 @@ var RESOURCE_REQUIREMENTS = {
   [RESOURCE_PATHS.adminCompanySettings]: {
     allowedRoles: [UserRole.OWNER]
   }
-  //  // ── Operations ────────────────────────────────────────────────────────────
-  // [RESOURCE_PATHS.farmManagement]: [EnabledModule.FARM_MANAGEMENT],
-  // [RESOURCE_PATHS.packhouse]: [EnabledModule.PACKHOUSE],
-  // [RESOURCE_PATHS.accommodation]: [EnabledModule.ACCOMMODATION],
-  //  // ── Equipment & Fleet ──────────────────────────────────────────────────────
-  // [RESOURCE_PATHS.equipPreStart]: ALL_OPERATIONS,
-  // [RESOURCE_PATHS.equipMaintenance]: ALL_OPERATIONS,
-  // [RESOURCE_PATHS.equipFuelRegister]: ALL_OPERATIONS,
-  // [RESOURCE_PATHS.equipCalibration]: AGRI_ONLY,
-  // [RESOURCE_PATHS.equipFleet]: ALL_OPERATIONS,
-  //  // ── Safety, Quality & Compliance ──────────────────────────────────────────
-  // [RESOURCE_PATHS.safetyAuditing]: ALL_OPERATIONS,
-  // [RESOURCE_PATHS.safetyFood]: AGRI_ONLY,
-  // [RESOURCE_PATHS.safetyWhs]: ALL_OPERATIONS,
-  // [RESOURCE_PATHS.safetyCleaning]: ALL_OPERATIONS,
-  //  // ── Team & HR ──────────────────────────────────────────────────────────────
-  // [RESOURCE_PATHS.teamStaff]: ALL_OPERATIONS,
-  // [RESOURCE_PATHS.teamTraining]: ALL_OPERATIONS,
 };
-function evaluateBaseAccess(resourcePath, session, requirements = {}) {
-  if (!session?.role) return "NONE";
-  if (session.role === UserRole.OWNER) return "WRITE";
-  const requiredModules = RESOURCE_MODULE_MAP[resourcePath] || [];
-  if (requiredModules.length > 0) {
-    const hasModule = requiredModules.some((m) => session.enabledModules?.includes(m));
-    if (!hasModule) return "NONE";
-  }
-  const topLevel = resourcePath.split(".")[0];
-  const defaultRoles = ROLE_SECTIONS_BY_KEY[topLevel] || [];
-  const allowedRoles = requirements.allowedRoles?.length ? requirements.allowedRoles : defaultRoles;
-  if (!allowedRoles.includes(session.role)) return "NONE";
-  if (requirements.requiredPrivileges?.length) {
-    const hasPrivilege = requirements.requiredPrivileges.some((p) => session.privileges?.includes(p));
-    if (!hasPrivilege) return "NONE";
-  }
-  return session.role === UserRole.MANAGER ? "WRITE" : "READ";
-}
-function resolveEffectiveAccess(base, override) {
-  return override === void 0 || override === null ? base : override;
-}
-function findSpecificOverride(session, activeScopeId, resourcePath) {
-  const scopeOverrides = session.resourceOverrides?.[activeScopeId];
-  if (!scopeOverrides) return null;
-  const parts = resourcePath.split(".");
-  let currentPath = "";
-  let bestOverride = null;
-  for (const part of parts) {
-    currentPath = currentPath ? `${currentPath}.${part}` : part;
-    if (scopeOverrides[currentPath] !== void 0) {
-      bestOverride = scopeOverrides[currentPath];
-    }
-  }
-  return bestOverride;
-}
-async function assertTenantBoundary(db, session, targets) {
-  if (!session.companyId) {
-    throw ErrorFactory.internal(MOD.ADMIN, "Missing requester company context.");
-  }
-  if (targets.targetUserId) {
-    const targetUserAssignments = await db.UserRoleAssignment.filter({
-      userId: targets.targetUserId,
-      companyId: session.companyId
-    });
-    if (targetUserAssignments.length === 0) {
-      console.error(`[SECURITY BREACH] User tried to modify targetUserId ${targets.targetUserId}`);
-      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid target user.");
-    }
-  }
-  if (targets.authScopeId) {
-    const matchedScope = session.availableScopes?.find(
-      (scope) => scope.authScopeId === targets.authScopeId
-    );
-    if (!matchedScope) {
-      console.error(`[SECURITY BREACH] Scope ${targets.authScopeId} not found in user's permitted list.`);
-      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Tenant boundary violation.");
-    }
-    if (targets.expectedScopeType && matchedScope.type !== targets.expectedScopeType) {
-      console.error(`[VALIDATION ERROR] Expected type ${targets.expectedScopeType} but got ${matchedScope.type}`);
-      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level.");
-    }
-  }
-  return true;
-}
-async function verifyAndExtractSession(token, secret) {
-  if (!token) {
-    throw ErrorFactory.unauthorized(MOD.SESSION, "UNAUTHORIZED: No secure session token provided.");
-  }
-  try {
-    const secretKey = new TextEncoder().encode(secret);
-    const { payload } = await (0, import_jose.jwtVerify)(token, secretKey);
-    return payload;
-  } catch (error) {
-    throw ErrorFactory.unauthorized(MOD.SESSION, "UNAUTHORIZED: No secure session token provided.");
-  }
-}
 var DocumentType = /* @__PURE__ */ ((DocumentType2) => {
   DocumentType2["SPRAY_RECORD"] = "SPRAY_RECORD";
   DocumentType2["FERTIGATION_RECORD"] = "FERTIGATION_RECORD";
@@ -1097,6 +792,510 @@ var DocumentType = /* @__PURE__ */ ((DocumentType2) => {
   DocumentType2["SENSITIVE_IDENTITY"] = "SENSITIVE_IDENTITY";
   return DocumentType2;
 })(DocumentType || {});
+var DocumentCategory = /* @__PURE__ */ ((DocumentCategory2) => {
+  DocumentCategory2["AGRONOMY_TESTING"] = "Agronomy & Testing";
+  DocumentCategory2["FARM_OPERATIONS"] = "Farm Operations";
+  DocumentCategory2["COMPLIANCE_QA"] = "Compliance & Quality";
+  DocumentCategory2["INVENTORY_LOG"] = "Inventory & Logistics";
+  DocumentCategory2["ASSETS_MAINT"] = "Assets & Maintenance";
+  DocumentCategory2["HR_LEGAL_SAFETY"] = "HR, Legal & Safety";
+  DocumentCategory2["FINANCE_ADMIN"] = "Finance & Admin";
+  return DocumentCategory2;
+})(DocumentCategory || {});
+var DOCUMENT_DISPLAY_INFO = {
+  // --- AGRONOMY & TESTING ---
+  ["SOIL_TEST" /* SOIL_TEST */]: {
+    label: "Soil Analysis",
+    description: "Detailed lab results for soil nutrients, pH, and health.",
+    category: "Agronomy & Testing" /* AGRONOMY_TESTING */
+  },
+  ["LEAF_TEST" /* LEAF_TEST */]: {
+    label: "Leaf & Tissue Test",
+    description: "Nutrient analysis of plant tissue samples.",
+    category: "Agronomy & Testing" /* AGRONOMY_TESTING */
+  },
+  ["WATER_TEST" /* WATER_TEST */]: {
+    label: "Water Quality Test",
+    description: "Testing for irrigation suitability and microbial levels.",
+    category: "Agronomy & Testing" /* AGRONOMY_TESTING */
+  },
+  ["MRL_TESTING" /* MRL_TESTING */]: {
+    label: "MRL Residue Analysis",
+    description: "Maximum Residue Limit reports for chemical compliance.",
+    category: "Agronomy & Testing" /* AGRONOMY_TESTING */
+  },
+  ["HEAVY_METAL" /* HEAVY_METAL */]: {
+    label: "Heavy Metal Analysis",
+    description: "Testing for lead, cadmium, and other metal contaminants.",
+    category: "Agronomy & Testing" /* AGRONOMY_TESTING */
+  },
+  ["MICROBIAL" /* MICROBIAL */]: {
+    label: "Microbial Testing",
+    description: "Pathogen detection reports (e.g., E. coli, Salmonella).",
+    category: "Agronomy & Testing" /* AGRONOMY_TESTING */
+  },
+  // --- FARM OPERATIONS ---
+  ["SPRAY_RECORD" /* SPRAY_RECORD */]: {
+    label: "Spray Operations",
+    description: "Chemical application logs and weather conditions.",
+    category: "Farm Operations" /* FARM_OPERATIONS */
+  },
+  ["FERTIGATION_RECORD" /* FERTIGATION_RECORD */]: {
+    label: "Fertigation Logs",
+    description: "Records of liquid fertilizer applied via irrigation.",
+    category: "Farm Operations" /* FARM_OPERATIONS */
+  },
+  ["FERTILIZER_RECORD" /* FERTILIZER_RECORD */]: {
+    label: "Fertilizer Records",
+    description: "Manual granular or bulk fertilizer application logs.",
+    category: "Farm Operations" /* FARM_OPERATIONS */
+  },
+  ["HARVEST_LOG" /* HARVEST_LOG */]: {
+    label: "Harvest Manifests",
+    description: "Daily picking volumes and block yield data.",
+    category: "Farm Operations" /* FARM_OPERATIONS */
+  },
+  ["PACKHOUSE_INSPECTION" /* PACKHOUSE_INSPECTION */]: {
+    label: "Packhouse Inspections",
+    description: "Quality and hygiene checks conducted in the packhouse.",
+    category: "Farm Operations" /* FARM_OPERATIONS */
+  },
+  ["MAPPING_TRAFIC_MANAGEMENT" /* MAPPING_TRAFIC_MANAGEMENT */]: {
+    label: "Traffic Management",
+    description: "Maps and rules for vehicle and heavy machinery movement.",
+    category: "Farm Operations" /* FARM_OPERATIONS */
+  },
+  // --- COMPLIANCE & QUALITY ---
+  ["QA" /* QA */]: {
+    label: "Quality Assurance",
+    description: "General product quality checks and grading standards.",
+    category: "Compliance & Quality" /* COMPLIANCE_QA */
+  },
+  ["PEST" /* PEST */]: {
+    label: "Pest & Disease Monitoring",
+    description: "Scouting reports and pest pressure assessments.",
+    category: "Compliance & Quality" /* COMPLIANCE_QA */
+  },
+  ["AUDIT_REPORT" /* AUDIT_REPORT */]: {
+    label: "External Audit Reports",
+    description: "Final results from Freshcare, GlobalGAP, or Organic audits.",
+    category: "Compliance & Quality" /* COMPLIANCE_QA */
+  },
+  ["RISK_ASSESSMENTS" /* RISK_ASSESSMENTS */]: {
+    label: "Risk Assessments",
+    description: "Operational hazard identification and safety mitigations.",
+    category: "Compliance & Quality" /* COMPLIANCE_QA */
+  },
+  // --- ASSETS & MAINTENANCE ---
+  ["SERVICING_MAINTENANCE" /* SERVICING_MAINTENANCE */]: {
+    label: "Equipment Maintenance",
+    description: "Service history and repair logs for farm machinery.",
+    category: "Assets & Maintenance" /* ASSETS_MAINT */
+  },
+  ["EQUIPMENT_CALIBRATION_RECORD" /* EQUIPMENT_CALIBRATION_RECORD */]: {
+    label: "Calibration Records",
+    description: "Accuracy checks for sprayers, scales, and moisture probes.",
+    category: "Assets & Maintenance" /* ASSETS_MAINT */
+  },
+  ["CLEANING" /* CLEANING */]: {
+    label: "Sanitation Logs",
+    description: "Daily/weekly cleaning schedules for tools and facilities.",
+    category: "Assets & Maintenance" /* ASSETS_MAINT */
+  },
+  ["MAPPING_FARM_MAPS" /* MAPPING_FARM_MAPS */]: {
+    label: "Farm Infrastructure Maps",
+    description: "Layouts of blocks, irrigation, and fixed assets.",
+    category: "Assets & Maintenance" /* ASSETS_MAINT */
+  },
+  // --- INVENTORY & LOGISTICS ---
+  ["INVENTORY_CHEMICALS" /* INVENTORY_CHEMICALS */]: {
+    label: "Chemical Inventory",
+    description: "Manifests for stored pesticides and fertilizers.",
+    category: "Inventory & Logistics" /* INVENTORY_LOG */
+  },
+  ["INVENTORY_BOX_CARTON" /* INVENTORY_BOX_CARTON */]: {
+    label: "Packaging Inventory",
+    description: "Stock levels for cartons, bins, and packaging materials.",
+    category: "Inventory & Logistics" /* INVENTORY_LOG */
+  },
+  ["INVENTORY_CONSUMABLES" /* INVENTORY_CONSUMABLES */]: {
+    label: "General Consumables",
+    description: "Stock tracking for fuel, PPE, and workshop supplies.",
+    category: "Inventory & Logistics" /* INVENTORY_LOG */
+  },
+  ["STOCKTAKE" /* STOCKTAKE */]: {
+    label: "Physical Stocktake",
+    description: "Periodic audits of physical vs. recorded stock levels.",
+    category: "Inventory & Logistics" /* INVENTORY_LOG */
+  },
+  ["STOCKTAKE_MSDS" /* STOCKTAKE_MSDS */]: {
+    label: "MSDS / Safety Data",
+    description: "Material Safety Data Sheets for stored chemicals.",
+    category: "Inventory & Logistics" /* INVENTORY_LOG */
+  },
+  // --- HR, LEGAL & SAFETY ---
+  ["TRAINING_RECORDS" /* TRAINING_RECORDS */]: {
+    label: "Staff Inductions",
+    description: "General staff onboarding and safety training logs.",
+    category: "HR, Legal & Safety" /* HR_LEGAL_SAFETY */
+  },
+  ["TRAINING_CERTIFICATE" /* TRAINING_CERTIFICATE */]: {
+    label: "Training Certificates",
+    description: "External licenses, ChemCert, and first aid tickets.",
+    category: "HR, Legal & Safety" /* HR_LEGAL_SAFETY */
+  },
+  ["SOPS" /* SOPS */]: {
+    label: "Standard Procedures (SOPs)",
+    description: "Formalized instructions for farm and packhouse tasks.",
+    category: "HR, Legal & Safety" /* HR_LEGAL_SAFETY */
+  },
+  ["LEGAL_CONTRACT" /* LEGAL_CONTRACT */]: {
+    label: "Legal Contracts",
+    description: "Lease agreements, supply contracts, and employment terms.",
+    category: "HR, Legal & Safety" /* HR_LEGAL_SAFETY */
+  },
+  ["INCIDENT_REPORT" /* INCIDENT_REPORT */]: {
+    label: "Incident Reports",
+    description: "Logs of injuries, near-misses, or property damage.",
+    category: "HR, Legal & Safety" /* HR_LEGAL_SAFETY */
+  },
+  ["SENSITIVE_IDENTITY" /* SENSITIVE_IDENTITY */]: {
+    label: "Identity & Visas",
+    description: "Sensitive data: Passports, ID cards, and work permits.",
+    category: "HR, Legal & Safety" /* HR_LEGAL_SAFETY */
+  },
+  ["MAPPING_EMERGENCY" /* MAPPING_EMERGENCY */]: {
+    label: "Emergency Response Maps",
+    description: "Evacuation routes and emergency assembly points.",
+    category: "HR, Legal & Safety" /* HR_LEGAL_SAFETY */
+  },
+  // --- FINANCE & ADMIN ---
+  ["INVOICE" /* INVOICE */]: {
+    label: "Supplier Invoices",
+    description: "Billing records for inputs, utilities, and services.",
+    category: "Finance & Admin" /* FINANCE_ADMIN */
+  }
+};
+var CATEGORY_TABS = [
+  "All",
+  ...Object.values(DocumentCategory)
+];
+var DOCUMENT_MENU_MAP = {
+  ["SPRAY_RECORD" /* SPRAY_RECORD */]: [RESOURCE_PATHS.farmManagement],
+  ["FERTIGATION_RECORD" /* FERTIGATION_RECORD */]: [RESOURCE_PATHS.farmManagement],
+  ["FERTILIZER_RECORD" /* FERTILIZER_RECORD */]: [RESOURCE_PATHS.farmManagement],
+  ["QA" /* QA */]: [RESOURCE_PATHS.safetyAuditing],
+  ["CLEANING" /* CLEANING */]: [RESOURCE_PATHS.safetyCleaning],
+  ["PEST" /* PEST */]: [RESOURCE_PATHS.farmManagement],
+  ["EQUIPMENT_CALIBRATION_RECORD" /* EQUIPMENT_CALIBRATION_RECORD */]: [RESOURCE_PATHS.equipCalibration],
+  ["SERVICING_MAINTENANCE" /* SERVICING_MAINTENANCE */]: [RESOURCE_PATHS.equipMaintenance],
+  ["INVENTORY_CONSUMABLES" /* INVENTORY_CONSUMABLES */]: [RESOURCE_PATHS.packhouse],
+  ["INVENTORY_BOX_CARTON" /* INVENTORY_BOX_CARTON */]: [RESOURCE_PATHS.packhouse],
+  ["INVENTORY_CHEMICALS" /* INVENTORY_CHEMICALS */]: [RESOURCE_PATHS.packhouse, RESOURCE_PATHS.farmManagement],
+  ["STOCKTAKE" /* STOCKTAKE */]: [RESOURCE_PATHS.packhouse],
+  ["STOCKTAKE_MSDS" /* STOCKTAKE_MSDS */]: [RESOURCE_PATHS.safetyWhs],
+  ["MAPPING_FARM_MAPS" /* MAPPING_FARM_MAPS */]: [RESOURCE_PATHS.adminBlueprintsSites],
+  ["MAPPING_TRAFIC_MANAGEMENT" /* MAPPING_TRAFIC_MANAGEMENT */]: [RESOURCE_PATHS.adminBlueprintsSites],
+  ["MAPPING_EMERGENCY" /* MAPPING_EMERGENCY */]: [RESOURCE_PATHS.adminBlueprintsSites],
+  ["INCIDENT_REPORT" /* INCIDENT_REPORT */]: [RESOURCE_PATHS.safetyWhs],
+  ["RISK_ASSESSMENTS" /* RISK_ASSESSMENTS */]: [RESOURCE_PATHS.safetyWhs],
+  ["TRAINING_RECORDS" /* TRAINING_RECORDS */]: [RESOURCE_PATHS.teamTraining],
+  ["TRAINING_CERTIFICATE" /* TRAINING_CERTIFICATE */]: [RESOURCE_PATHS.teamTraining],
+  ["SOPS" /* SOPS */]: [RESOURCE_PATHS.documentHubTemplates],
+  ["SOIL_TEST" /* SOIL_TEST */]: [RESOURCE_PATHS.farmManagement],
+  ["LEAF_TEST" /* LEAF_TEST */]: [RESOURCE_PATHS.farmManagement],
+  ["WATER_TEST" /* WATER_TEST */]: [RESOURCE_PATHS.farmManagement, RESOURCE_PATHS.safetyFood],
+  ["MRL_TESTING" /* MRL_TESTING */]: [RESOURCE_PATHS.safetyFood],
+  ["HEAVY_METAL" /* HEAVY_METAL */]: [RESOURCE_PATHS.safetyFood],
+  ["MICROBIAL" /* MICROBIAL */]: [RESOURCE_PATHS.safetyFood],
+  ["HARVEST_LOG" /* HARVEST_LOG */]: [RESOURCE_PATHS.farmManagement],
+  ["PACKHOUSE_INSPECTION" /* PACKHOUSE_INSPECTION */]: [RESOURCE_PATHS.packhouse],
+  ["INVOICE" /* INVOICE */]: [RESOURCE_PATHS.documentHub],
+  ["LEGAL_CONTRACT" /* LEGAL_CONTRACT */]: [RESOURCE_PATHS.documentHub],
+  ["AUDIT_REPORT" /* AUDIT_REPORT */]: [RESOURCE_PATHS.safetyAuditing, RESOURCE_PATHS.dashboard],
+  ["SENSITIVE_IDENTITY" /* SENSITIVE_IDENTITY */]: [RESOURCE_PATHS.adminUserRoster]
+};
+
+// src/index.ts
+var AppError = class extends Error {
+  status;
+  appCode;
+  isOperational;
+  constructor(status, mod, cat, act, message) {
+    super(message);
+    this.status = status;
+    this.appCode = `${mod}-${status}-${cat}${act}`;
+    this.isOperational = true;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var ErrorFactory = {
+  unauthorized: (mod, msg = "Authentication required") => new AppError(401, mod, CAT.PERMISSION, ACT.GENERIC, msg),
+  forbidden: (mod, act, msg = "Access denied") => new AppError(403, mod, CAT.PERMISSION, act, msg),
+  badRequest: (mod, act, msg = "Bad request") => new AppError(400, mod, CAT.VALIDATION, act, msg),
+  notFound: (mod, act = ACT.GENERIC, msg = "Record not found") => new AppError(404, mod, CAT.VALIDATION, act, msg),
+  conflict: (mod, act, msg = "Record already exists") => new AppError(409, mod, CAT.INTEGRITY, act, msg),
+  integrity: (mod, act = ACT.GENERIC, msg = "Data integrity violation") => new AppError(409, mod, CAT.INTEGRITY, act, msg),
+  subscription: (mod, msg = "Module locked or subscription required") => new AppError(403, mod, CAT.SUBSCRIPTION, ACT.GENERIC, msg),
+  internal: (mod, msg = "Internal server error") => new AppError(500, mod, CAT.INTEGRITY, ACT.GENERIC, msg)
+};
+var handleAppErrorResponse = (error, mod = MOD.ADMIN) => {
+  if (error instanceof AppError && error.isOperational) {
+    return Response.json(
+      { error: { appCode: error.appCode, message: error.message } },
+      { status: error.status }
+    );
+  }
+  const e = error;
+  console.error(`[${mod}] UNEXPECTED ERROR:`, e?.message);
+  console.error(`[${mod}] STACK:`, e?.stack);
+  return Response.json(
+    { error: { appCode: `${mod}-500-000`, message: "An unexpected server error occurred. Please try again." } },
+    { status: 500 }
+  );
+};
+var FALLBACK = {
+  title: "Something Went Wrong",
+  text: "An unexpected error occurred. Please try again or contact your administrator."
+};
+var resolveAppError = (appCode) => {
+  if (!appCode || typeof appCode !== "string") {
+    return { ...FALLBACK, module: "UNK", moduleLabel: "Unknown", status: 500, catAct: "000", isSubscriptionIssue: false, isPermissionIssue: false };
+  }
+  const parts = appCode.split("-");
+  if (parts.length !== 3) {
+    return { ...FALLBACK, module: "UNK", moduleLabel: "Unknown", status: 500, catAct: "000", isSubscriptionIssue: false, isPermissionIssue: false };
+  }
+  const [mod, status, catAct] = parts;
+  const details = ERROR_DICTIONARY[catAct] || FALLBACK;
+  return {
+    title: details.title,
+    text: details.text,
+    module: mod,
+    moduleLabel: MODULE_LABELS[mod] || mod,
+    status: parseInt(status, 10),
+    catAct,
+    isSubscriptionIssue: catAct.startsWith("1"),
+    isPermissionIssue: catAct.startsWith("2")
+  };
+};
+var extractAppCode = (error) => {
+  const e = error;
+  return e?.response?.data?.error?.appCode ?? e?.data?.error?.appCode ?? null;
+};
+var resolveError = (error) => {
+  const appCode = extractAppCode(error);
+  if (appCode) return resolveAppError(appCode);
+  const e = error;
+  return { ...FALLBACK, module: "UNK", moduleLabel: "Unknown", status: e?.status || 500, catAct: "000", isSubscriptionIssue: false, isPermissionIssue: false };
+};
+function generateCanonicalId() {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
+    return crypto.randomUUID();
+  }
+  return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
+    const r = Math.random() * 16 | 0;
+    return (c === "x" ? r : r & 3 | 8).toString(16);
+  });
+}
+function generateInfrastructureFields(activeScope, availableScopes) {
+  if (!activeScope || !availableScopes?.length) {
+    throw ErrorFactory.unauthorized("[generateInfrastructureFields] Missing scope context.");
+  }
+  let companyId = null;
+  let legalEntityId = null;
+  let facilityId = null;
+  let pointer = activeScope;
+  while (pointer) {
+    if (pointer.type === "company") companyId = pointer.base44Id;
+    if (pointer.type === "legalEntity") legalEntityId = pointer.base44Id;
+    if (pointer.type === "facility") facilityId = pointer.base44Id;
+    const parentId = pointer.parentId ?? null;
+    pointer = parentId ? availableScopes.find((s) => s.base44Id === parentId) || null : null;
+  }
+  if (!companyId) {
+    throw ErrorFactory.unauthorized("[generateInfrastructureFields] Could not resolve companyId from scope tree.");
+  }
+  return {
+    canonicalId: crypto.randomUUID(),
+    companyId,
+    legalEntityId,
+    facilityId,
+    authScopeId: activeScope.authScopeId
+  };
+}
+function buildRlsFilter(session, extra = {}) {
+  return { ...extra, authScopeId: { $in: session.readScopes || [] } };
+}
+function canRead(session, authScopeId) {
+  return session.readScopes?.includes(authScopeId) ?? false;
+}
+function canWrite(session, authScopeId, resourcePath) {
+  const override = session.resourceOverrides?.[authScopeId]?.[resourcePath];
+  if (override === "WRITE") return true;
+  if (override === "NONE" || override === "READ") return false;
+  return session.writeScopes?.includes(authScopeId) ?? false;
+}
+function assertCanWrite(session, authScopeId, resourcePath) {
+  const override = session.resourceOverrides?.[authScopeId]?.[resourcePath];
+  if (override === "WRITE") return;
+  if (override === "NONE" || override === "READ") {
+    throw new AppError(
+      403,
+      MOD.SESSION,
+      CAT.PERMISSION,
+      ACT.GENERIC,
+      `You do not have write access to "${resourcePath}" in this scope.`
+    );
+  }
+  if (session.writeScopes?.includes(authScopeId)) return;
+  throw new AppError(
+    403,
+    MOD.SESSION,
+    CAT.PERMISSION,
+    ACT.GENERIC,
+    "You do not have permission to modify records in this scope."
+  );
+}
+function resolveAccess(session, activeScopeId, tabConfig) {
+  const resourcePath = tabConfig?.resourceId;
+  const overrides = session.resourceOverrides?.[activeScopeId] ?? {};
+  if (resourcePath) {
+    const segments = resourcePath.split(".");
+    for (let len = segments.length; len >= 1; len--) {
+      const path = segments.slice(0, len).join(".");
+      const override = overrides[path];
+      if (override === "NONE" || override === "READ" || override === "WRITE") return override;
+    }
+  }
+  const allowedRoles = tabConfig?.allowedRoles ?? [];
+  const requiredPrivileges = tabConfig?.requiredPrivileges ?? [];
+  const hasRestrictions = allowedRoles.length > 0 || requiredPrivileges.length > 0;
+  if (hasRestrictions) {
+    const role = session?.role ?? "";
+    const privileges = session?.privileges ?? [];
+    const passesRole = allowedRoles.length > 0 && allowedRoles.includes(role);
+    const passesPrivilege = requiredPrivileges.length > 0 && requiredPrivileges.some((p) => privileges.includes(p));
+    return passesRole || passesPrivilege ? "WRITE" : "NONE";
+  }
+  return "READ";
+}
+function resolveMenuVisibility(session, authScopeId, resourcePath) {
+  const override = session.resourceOverrides?.[authScopeId]?.[resourcePath];
+  if (override === "NONE") return "hidden";
+  if (override === "READ") return "read_only";
+  if (override === "WRITE") return "active";
+  if (session.writeScopes?.includes(authScopeId)) return "active";
+  if (session.readScopes?.includes(authScopeId)) return "read_only";
+  return "hidden";
+}
+function isTabVisible(session, activeScopeId, tabConfig) {
+  return resolveAccess(session, activeScopeId, tabConfig) !== "NONE";
+}
+function isTabWritable(session, activeScopeId, tabConfig) {
+  return resolveAccess(session, activeScopeId, tabConfig) === "WRITE";
+}
+function evaluateBaseAccess(resourcePath, session, requirements = {}) {
+  if (!session?.role) return "NONE";
+  if (session.role === UserRole.OWNER) return "WRITE";
+  const requiredModules = RESOURCE_MODULE_MAP[resourcePath] || [];
+  if (requiredModules.length > 0) {
+    const hasModule = requiredModules.some((m) => session.enabledModules?.includes(m));
+    if (!hasModule) return "NONE";
+  }
+  const topLevel = resourcePath.split(".")[0];
+  const defaultRoles = ROLE_SECTIONS_BY_KEY[topLevel] || [];
+  const allowedRoles = requirements.allowedRoles?.length ? requirements.allowedRoles : defaultRoles;
+  if (!allowedRoles.includes(session.role)) return "NONE";
+  if (requirements.requiredPrivileges?.length) {
+    const hasPrivilege = requirements.requiredPrivileges.some((p) => session.privileges?.includes(p));
+    if (!hasPrivilege) return "NONE";
+  }
+  return session.role === UserRole.MANAGER ? "WRITE" : "READ";
+}
+function resolveEffectiveAccess(base, override) {
+  return override === void 0 || override === null ? base : override;
+}
+function findSpecificOverride(session, activeScopeId, resourcePath) {
+  const scopeOverrides = session.resourceOverrides?.[activeScopeId];
+  if (!scopeOverrides) return null;
+  const parts = resourcePath.split(".");
+  let currentPath = "";
+  let bestOverride = null;
+  for (const part of parts) {
+    currentPath = currentPath ? `${currentPath}.${part}` : part;
+    if (scopeOverrides[currentPath] !== void 0) {
+      bestOverride = scopeOverrides[currentPath];
+    }
+  }
+  return bestOverride;
+}
+async function assertTenantBoundary(db, session, targets) {
+  if (!session.companyId) {
+    throw ErrorFactory.internal(MOD.ADMIN, "Missing requester company context.");
+  }
+  if (targets.targetUserId) {
+    const targetUserAssignments = await db.UserRoleAssignment.filter({
+      userId: targets.targetUserId,
+      companyId: session.companyId
+    });
+    if (targetUserAssignments.length === 0) {
+      console.error(`[SECURITY BREACH] User tried to modify targetUserId ${targets.targetUserId}`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid target user.");
+    }
+  }
+  if (targets.authScopeId) {
+    const matchedScope = session.availableScopes?.find(
+      (scope) => scope.authScopeId === targets.authScopeId
+    );
+    if (!matchedScope) {
+      console.error(`[SECURITY BREACH] Scope ${targets.authScopeId} not found in user's permitted list.`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Tenant boundary violation.");
+    }
+    if (targets.expectedScopeType && matchedScope.type !== targets.expectedScopeType) {
+      console.error(`[VALIDATION ERROR] Expected type ${targets.expectedScopeType} but got ${matchedScope.type}`);
+      throw ErrorFactory.forbidden(MOD.ADMIN, ACT.EDIT, "Invalid authorization scope level.");
+    }
+  }
+  return true;
+}
+async function verifyAndExtractSession(token, secret) {
+  if (!token) {
+    throw ErrorFactory.unauthorized(MOD.SESSION, "UNAUTHORIZED: No secure session token provided.");
+  }
+  try {
+    const secretKey = new TextEncoder().encode(secret);
+    const { payload } = await (0, import_jose.jwtVerify)(token, secretKey);
+    return payload;
+  } catch (error) {
+    throw ErrorFactory.unauthorized(MOD.SESSION, "UNAUTHORIZED: No secure session token provided.");
+  }
+}
+function getFormMeta(componentId) {
+  return FORM_REGISTRY[componentId] ?? null;
+}
+function getFormsGroupedByModule() {
+  const groups = {};
+  for (const [id, meta] of Object.entries(FORM_REGISTRY)) {
+    if (!groups[meta.module]) groups[meta.module] = [];
+    groups[meta.module].push({ id, ...meta });
+  }
+  return groups;
+}
+var getTaskTypeOptions = () => Object.entries(TASK_TYPE_REGISTRY).map(([value, config]) => ({
+  value,
+  label: config.label,
+  description: config.description,
+  mimeTypes: config.mimeTypes,
+  icon: config.icon
+}));
+var getAcceptedMimeTypes = (taskType) => {
+  const config = TASK_TYPE_REGISTRY[taskType];
+  return config ? config.mimeTypes.join(",") : "*/*";
+};
+var getApproveAction = (taskType) => {
+  return TASK_TYPE_REGISTRY[taskType]?.approveAction ?? null;
+};
 function generateDocumentPath(params) {
   const sanitizedName = params.siteName.replace(/[^a-z0-9]/gi, "_");
   if (params.isStatic) {
@@ -1146,8 +1345,12 @@ function calculateFileMetadataMatch(criteria, fileMetadata, auditContext) {
   AuditStatus,
   AuditType,
   CAT,
+  CATEGORY_TABS,
   Converter,
   CropCycleStatus,
+  DOCUMENT_DISPLAY_INFO,
+  DOCUMENT_MENU_MAP,
+  DocumentCategory,
   DocumentType,
   ERROR_DICTIONARY,
   EVERYONE,