@litusarchieve18/agricore-utils 1.0.20 → 1.0.22

package/dist/constants.mjs

@@ -46,6 +46,7 @@ import {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,
@@ -61,7 +62,7 @@ import {
   UserRole,
   VigorRating,
   WaterSource
-} from "./chunk-XD36URZU.mjs";
+} from "./chunk-V2DL7OTH.mjs";
 export {
   ACCESS_RANK,
   ACT,
@@ -110,6 +111,7 @@ export {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { d as AgriCoreSession, aF as UserRoleType, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, av as TabConfig, af as ResolvedError } from './constants-C_Pwif6Q.mjs';
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RowOrientation, aj as SENTINEL_UUID, ak as SIGNATURE_MODES, al as ScopeType, am as SignatureInput, an as SignatureMode, ao as SoilTexture, ap as StockPolicyTier, aq as StockPolicyTierType, ar as StoragePhases, as as StorageType, at as TASK_TYPE_REGISTRY, au as TEMPLATE_SCOPE_LEVELS, aw as TargetEntityType, ax as TaskStatus, ay as TaskType, az as TaskTypeConfig, aA as TemplateScopeLevel, aB as TransactionType, aC as TrellisType, aD as UserPrivilege, aE as UserRole, aG as VigorRating, aH as WaterSource } from './constants-C_Pwif6Q.mjs';
+import { d as AgriCoreSession, ao as ScopeType, aL as WireSession, aI as UserRoleType, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError } from './constants-lhTP4wzB.mjs';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserRole, aJ as VigorRating, aK as WaterSource } from './constants-lhTP4wzB.mjs';
 
 declare const AgriLogger: {
     log(level: "INFO" | "WARN" | "ERROR", message: string, meta: any): void;
@@ -104,24 +104,26 @@ declare function generateCanonicalId(): string;
  * Standardizes the creation of new entities by walking up the scope tree.
  */
 declare function generateInfrastructureFields(activeScope: AvailableScope, availableScopes: AvailableScope[]): InfrastructureFields;
-declare function buildRlsFilter(session: AgriCoreSession, extra?: Record<string, any>): {
-    authScopeId: {
-        $in: string[];
-    };
-};
-declare function canRead(session: AgriCoreSession, authScopeId: string): boolean;
-declare function canWrite(session: AgriCoreSession, authScopeId: string, resourcePath: string): boolean;
+declare function encodeSession(session: AgriCoreSession): WireSession;
+declare function decodeSession(short: WireSession): AgriCoreSession;
+declare function hasRoleAnywhere(session: AgriCoreSession, role: string): boolean;
+declare function hasPrivilegeAnywhere(session: AgriCoreSession, privilege: string): boolean;
 /**
- * Hard-throws if the user cannot write.
- * Use this on the backend (inside Deno functions) to enforce server-side.
+ * "Does this user hold this role/privilege AT this specific scope?"
+ * This is the default choice for any authorization gate evaluating
+ * "can the user perform this action on the resource/scope they're
+ * currently acting on." No inheritance — only an explicit assignment
+ * at exactly this authScopeId counts, matching the no-inherit-write rule.
  */
-declare function assertCanWrite(session: AgriCoreSession, authScopeId: string, resourcePath: string): void;
+declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
+declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
+declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
+declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
 /**
  * Full resolution: DB override → static config fallback → public default.
  * Returns 'NONE' | 'READ' | 'WRITE'.
  */
 declare function resolveAccess(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): 'NONE' | 'READ' | 'WRITE';
-declare function resolveMenuVisibility(session: AgriCoreSession, authScopeId: string, resourcePath: string): 'hidden' | 'read_only' | 'active';
 declare function isTabVisible(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): boolean;
 declare function isTabWritable(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): boolean;
 declare function evaluateBaseAccess(resourcePath: string, session: {
@@ -138,7 +140,7 @@ declare function assertTenantBoundary(db: any, session: AgriCoreSession, // Pass
 targets: {
     targetUserId?: string;
     authScopeId?: string;
-    expectedScopeType?: 'company' | 'legalEntity' | 'facility';
+    expectedScopeType?: ScopeType;
 }): Promise<boolean>;
 declare function verifyAndExtractSession(token: string, secret: string): Promise<AgriCoreSession>;
 declare function getFormMeta(componentId: string): FormMeta | null;
@@ -172,4 +174,4 @@ declare function calculateFileMetadataMatch(criteria: {
     contextMatch?: string[];
 }, fileMetadata: Record<string, any>, auditContext: Record<string, any>): number;
 
-export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, TabConfig, UserRoleType, Validator, assertCanWrite, assertTenantBoundary, buildRlsFilter, calculateFileMetadataMatch, canRead, canWrite, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getTaskTypeOptions, handleAppErrorResponse, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, resolveMenuVisibility, verifyAndExtractSession, withAgriLogging };
+export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, ScopeType, TabConfig, UserRoleType, Validator, WireSession, assertTenantBoundary, calculateFileMetadataMatch, decodeSession, encodeSession, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getPrivilegesAt, getRoleAt, getTaskTypeOptions, handleAppErrorResponse, hasPrivilegeAnywhere, hasPrivilegeAt, hasRoleAnywhere, hasRoleAt, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, verifyAndExtractSession, withAgriLogging };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { d as AgriCoreSession, aF as UserRoleType, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, av as TabConfig, af as ResolvedError } from './constants-C_Pwif6Q.js';
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RowOrientation, aj as SENTINEL_UUID, ak as SIGNATURE_MODES, al as ScopeType, am as SignatureInput, an as SignatureMode, ao as SoilTexture, ap as StockPolicyTier, aq as StockPolicyTierType, ar as StoragePhases, as as StorageType, at as TASK_TYPE_REGISTRY, au as TEMPLATE_SCOPE_LEVELS, aw as TargetEntityType, ax as TaskStatus, ay as TaskType, az as TaskTypeConfig, aA as TemplateScopeLevel, aB as TransactionType, aC as TrellisType, aD as UserPrivilege, aE as UserRole, aG as VigorRating, aH as WaterSource } from './constants-C_Pwif6Q.js';
+import { d as AgriCoreSession, ao as ScopeType, aL as WireSession, aI as UserRoleType, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError } from './constants-lhTP4wzB.js';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserRole, aJ as VigorRating, aK as WaterSource } from './constants-lhTP4wzB.js';
 
 declare const AgriLogger: {
     log(level: "INFO" | "WARN" | "ERROR", message: string, meta: any): void;
@@ -104,24 +104,26 @@ declare function generateCanonicalId(): string;
  * Standardizes the creation of new entities by walking up the scope tree.
  */
 declare function generateInfrastructureFields(activeScope: AvailableScope, availableScopes: AvailableScope[]): InfrastructureFields;
-declare function buildRlsFilter(session: AgriCoreSession, extra?: Record<string, any>): {
-    authScopeId: {
-        $in: string[];
-    };
-};
-declare function canRead(session: AgriCoreSession, authScopeId: string): boolean;
-declare function canWrite(session: AgriCoreSession, authScopeId: string, resourcePath: string): boolean;
+declare function encodeSession(session: AgriCoreSession): WireSession;
+declare function decodeSession(short: WireSession): AgriCoreSession;
+declare function hasRoleAnywhere(session: AgriCoreSession, role: string): boolean;
+declare function hasPrivilegeAnywhere(session: AgriCoreSession, privilege: string): boolean;
 /**
- * Hard-throws if the user cannot write.
- * Use this on the backend (inside Deno functions) to enforce server-side.
+ * "Does this user hold this role/privilege AT this specific scope?"
+ * This is the default choice for any authorization gate evaluating
+ * "can the user perform this action on the resource/scope they're
+ * currently acting on." No inheritance — only an explicit assignment
+ * at exactly this authScopeId counts, matching the no-inherit-write rule.
  */
-declare function assertCanWrite(session: AgriCoreSession, authScopeId: string, resourcePath: string): void;
+declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
+declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
+declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
+declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
 /**
  * Full resolution: DB override → static config fallback → public default.
  * Returns 'NONE' | 'READ' | 'WRITE'.
  */
 declare function resolveAccess(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): 'NONE' | 'READ' | 'WRITE';
-declare function resolveMenuVisibility(session: AgriCoreSession, authScopeId: string, resourcePath: string): 'hidden' | 'read_only' | 'active';
 declare function isTabVisible(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): boolean;
 declare function isTabWritable(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): boolean;
 declare function evaluateBaseAccess(resourcePath: string, session: {
@@ -138,7 +140,7 @@ declare function assertTenantBoundary(db: any, session: AgriCoreSession, // Pass
 targets: {
     targetUserId?: string;
     authScopeId?: string;
-    expectedScopeType?: 'company' | 'legalEntity' | 'facility';
+    expectedScopeType?: ScopeType;
 }): Promise<boolean>;
 declare function verifyAndExtractSession(token: string, secret: string): Promise<AgriCoreSession>;
 declare function getFormMeta(componentId: string): FormMeta | null;
@@ -172,4 +174,4 @@ declare function calculateFileMetadataMatch(criteria: {
     contextMatch?: string[];
 }, fileMetadata: Record<string, any>, auditContext: Record<string, any>): number;
 
-export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, TabConfig, UserRoleType, Validator, assertCanWrite, assertTenantBoundary, buildRlsFilter, calculateFileMetadataMatch, canRead, canWrite, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getTaskTypeOptions, handleAppErrorResponse, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, resolveMenuVisibility, verifyAndExtractSession, withAgriLogging };
+export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, ScopeType, TabConfig, UserRoleType, Validator, WireSession, assertTenantBoundary, calculateFileMetadataMatch, decodeSession, encodeSession, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getPrivilegesAt, getRoleAt, getTaskTypeOptions, handleAppErrorResponse, hasPrivilegeAnywhere, hasPrivilegeAt, hasRoleAnywhere, hasRoleAt, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, verifyAndExtractSession, withAgriLogging };

package/dist/index.js

@@ -71,6 +71,7 @@ __export(index_exports, {
   RelationshipType: () => RelationshipType,
   RowOrientation: () => RowOrientation,
   SENTINEL_UUID: () => SENTINEL_UUID,
+  SESSION_SCHEMA: () => SESSION_SCHEMA,
   SIGNATURE_MODES: () => SIGNATURE_MODES,
   SoilTexture: () => SoilTexture,
   StockPolicyTier: () => StockPolicyTier,
@@ -87,12 +88,10 @@ __export(index_exports, {
   Validator: () => Validator,
   VigorRating: () => VigorRating,
   WaterSource: () => WaterSource,
-  assertCanWrite: () => assertCanWrite,
   assertTenantBoundary: () => assertTenantBoundary,
-  buildRlsFilter: () => buildRlsFilter,
   calculateFileMetadataMatch: () => calculateFileMetadataMatch,
-  canRead: () => canRead,
-  canWrite: () => canWrite,
+  decodeSession: () => decodeSession,
+  encodeSession: () => encodeSession,
   evaluateBaseAccess: () => evaluateBaseAccess,
   extractAppCode: () => extractAppCode,
   findSpecificOverride: () => findSpecificOverride,
@@ -103,15 +102,20 @@ __export(index_exports, {
   getApproveAction: () => getApproveAction,
   getFormMeta: () => getFormMeta,
   getFormsGroupedByModule: () => getFormsGroupedByModule,
+  getPrivilegesAt: () => getPrivilegesAt,
+  getRoleAt: () => getRoleAt,
   getTaskTypeOptions: () => getTaskTypeOptions,
   handleAppErrorResponse: () => handleAppErrorResponse,
+  hasPrivilegeAnywhere: () => hasPrivilegeAnywhere,
+  hasPrivilegeAt: () => hasPrivilegeAt,
+  hasRoleAnywhere: () => hasRoleAnywhere,
+  hasRoleAt: () => hasRoleAt,
   isTabVisible: () => isTabVisible,
   isTabWritable: () => isTabWritable,
   resolveAccess: () => resolveAccess,
   resolveAppError: () => resolveAppError,
   resolveEffectiveAccess: () => resolveEffectiveAccess,
   resolveError: () => resolveError,
-  resolveMenuVisibility: () => resolveMenuVisibility,
   verifyAndExtractSession: () => verifyAndExtractSession,
   withAgriLogging: () => withAgriLogging
 });
@@ -390,6 +394,34 @@ var AccessLevel = {
   READ: "READ",
   WRITE: "WRITE"
 };
+var SESSION_SCHEMA = [
+  { key: "u", path: "userId", type: "scalar" },
+  { key: "n", path: "userName", type: "scalar" },
+  { key: "e", path: "userEmail", type: "scalar" },
+  { key: "c", path: "companyId", type: "scalar" },
+  { key: "a", path: "activeScopeId", type: "scalar" },
+  {
+    key: "cc",
+    path: "companyConfig",
+    type: "object",
+    fields: [{ key: "me", path: "isMultiEntity", type: "scalar" }]
+  },
+  { key: "m", path: "enabledModules", type: "scalar" },
+  { key: "ra", path: "roleAssignments", type: "scalar" },
+  {
+    key: "as",
+    path: "availableScopes",
+    type: "recordArray",
+    fields: [
+      { key: "ai", path: "authScopeId", type: "scalar" },
+      { key: "bi", path: "base44Id", type: "scalar" },
+      { key: "t", path: "type", type: "scalar", enum: ["company", "legalEntity", "facility"] },
+      { key: "nm", path: "name", type: "scalar" },
+      { key: "pi", path: "parentId", type: "scalar" }
+    ]
+  },
+  { key: "ro", path: "resourceOverrides", type: "scalar" }
+];
 var EnabledModule = {
   FARM_MANAGEMENT: "farm_management",
   PACKHOUSE: "packhouse",
@@ -651,38 +683,47 @@ var RESOURCE_PATHS = {
   // ── Operations ────────────────────────────────────────────────────────────
   farmManagement: "operations.farmManagement",
   packhouse: "operations.packhouse",
+  accommodation: "operations.accommodation",
   // ── Inventory ────────────────────────────────────────────────────────────
   // === Consumables ===
+  inventory: "inventory",
+  inventoryConsumable: "inventory.consumable",
   inventoryConsumableProduct: "inventory.consumable.product",
   inventoryConsumableStock: "inventory.consumable.stock",
   inventoryConsumableStockEditThreshold: "inventory.consumable.stock.editThreshold",
   inventoryConsumableStockReconcile: "inventory.consumable.stock.reconcile",
   inventoryConsumableStockMovement: "inventory.consumable.stockMovement",
   inventoryConsumableStockMovementTransfer: "inventory.consumable.stockMovement.transfer",
-  inventoryConsumableStockMovementPurchase: "inventory.consumable.stockMovement.purchase",
+  // inventoryConsumableStockMovementPurchase: "inventory.consumable.stockMovement.purchase",
   // === Chemicals ===
+  inventoryChemical: "inventory.chemical",
   inventoryChemicalProduct: "inventory.chemical.product",
   inventoryChemicalStock: "inventory.chemical.stock",
   inventoryChemicalStockEditThreshold: "inventory.chemical.stock.editThreshold",
   inventoryChemicalStockReconcile: "inventory.chemical.stock.reconcile",
   inventoryChemicalStockMovement: "inventory.chemical.stockMovement",
   inventoryChemicalStockMovementTransfer: "inventory.chemical.stockMovement.transfer",
-  inventoryChemicalStockMovementPurchase: "inventory.chemical.stockMovement.purchase",
+  // inventoryChemicalStockMovementPurchase: "inventory.chemical.stockMovement.purchase",
   // === Maintenance Parts ===
+  inventoryMaintenancePart: "inventory.maintenancePart",
   inventoryMaintenancePartProduct: "inventory.maintenancePart.product",
   inventoryMaintenancePartStock: "inventory.maintenancePart.stock",
   inventoryMaintenancePartStockEditThreshold: "inventory.maintenancePart.stock.editThreshold",
   inventoryMaintenancePartStockReconcile: "inventory.maintenancePart.stock.reconcile",
   inventoryMaintenancePartStockMovement: "inventory.maintenancePart.stockMovement",
   inventoryMaintenancePartStockMovementTransfer: "inventory.maintenancePart.stockMovement.transfer",
-  inventoryMaintenancePartStockMovementPurchase: "inventory.maintenancePart.stockMovement.purchase",
-  accommodation: "operations.accommodation",
+  // inventoryMaintenancePartStockMovementPurchase: "inventory.maintenancePart.stockMovement.purchase",
   // ── Equipment & Fleet ──────────────────────────────────────────────────────
   equipPreStart: "equipment.preStart",
   equipMaintenance: "equipment.maintenance",
   equipFuelRegister: "equipment.fuelRegister",
   equipCalibration: "equipment.calibration",
   equipFleet: "equipment.fleetManagement",
+  finance: "finance",
+  financeProductRequisition: "finance.product.requistion",
+  financeDashboard: "finance.dashboard",
+  financeTransaction: "finance.transaction",
+  financeBudgetAllocation: "finance.budgetAllocation",
   // ── Safety, Quality & Compliance ──────────────────────────────────────────
   safetyAuditing: "safety.auditing",
   safetyFood: "safety.foodSafety",
@@ -708,14 +749,20 @@ var RESOURCE_MODULE_MAP = {
   [RESOURCE_PATHS.equipment]: ALL_OPERATIONS,
   [RESOURCE_PATHS.safety]: ALL_OPERATIONS,
   [RESOURCE_PATHS.team]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.inventory]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.finance]: ALL_OPERATIONS,
   [RESOURCE_PATHS.records]: ALL_OPERATIONS,
   [RESOURCE_PATHS.adminSettings]: ALL_OPERATIONS,
   // ── Inventory ──────────────────────────────────────────────────────
+  [RESOURCE_PATHS.inventoryConsumable]: ALL_OPERATIONS,
   [RESOURCE_PATHS.inventoryConsumableProduct]: ALL_OPERATIONS,
   [RESOURCE_PATHS.inventoryConsumableStock]: ALL_OPERATIONS,
   [RESOURCE_PATHS.inventoryConsumableStockMovement]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.inventoryChemical]: ALL_OPERATIONS,
   [RESOURCE_PATHS.inventoryChemicalProduct]: ALL_OPERATIONS,
   [RESOURCE_PATHS.inventoryChemicalStock]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.inventoryChemicalStockMovement]: ALL_OPERATIONS,
+  [RESOURCE_PATHS.inventoryMaintenancePart]: ALL_OPERATIONS,
   [RESOURCE_PATHS.inventoryMaintenancePartProduct]: ALL_OPERATIONS,
   [RESOURCE_PATHS.inventoryMaintenancePartStock]: ALL_OPERATIONS,
   [RESOURCE_PATHS.inventoryMaintenancePartStockMovement]: ALL_OPERATIONS,
@@ -804,9 +851,9 @@ var RESOURCE_REQUIREMENTS = {
   [RESOURCE_PATHS.inventoryConsumableStockMovementTransfer]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR]
   },
-  [RESOURCE_PATHS.inventoryConsumableStockMovementPurchase]: {
-    allowedRoles: [UserRole.OWNER, UserRole.MANAGER]
-  },
+  // [RESOURCE_PATHS.inventoryConsumableStockMovementPurchase]: { 
+  //   allowedRoles: [UserRole.OWNER, UserRole.MANAGER] 
+  // },
   // CHEMICALS PERMISSIONS
   [RESOURCE_PATHS.inventoryChemicalProduct]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR]
@@ -822,9 +869,9 @@ var RESOURCE_REQUIREMENTS = {
   [RESOURCE_PATHS.inventoryChemicalStockMovementTransfer]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR]
   },
-  [RESOURCE_PATHS.inventoryChemicalStockMovementPurchase]: {
-    allowedRoles: [UserRole.OWNER, UserRole.MANAGER]
-  },
+  // [RESOURCE_PATHS.inventoryChemicalStockMovementPurchase]: { 
+  //   allowedRoles: [UserRole.OWNER, UserRole.MANAGER] 
+  // },
   [RESOURCE_PATHS.inventoryMaintenancePartProduct]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR]
   },
@@ -836,11 +883,24 @@ var RESOURCE_REQUIREMENTS = {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR]
   },
   [RESOURCE_PATHS.inventoryMaintenancePartStockMovement]: { allowedRoles: EVERYONE },
-  [RESOURCE_PATHS.inventoryMaintenancePartStockMovementPurchase]: {
+  // [RESOURCE_PATHS.inventoryMaintenancePartStockMovementPurchase]: { 
+  //   allowedRoles: [UserRole.OWNER, UserRole.MANAGER] 
+  // },
+  // ── Finance ────────────────────────────────────────────────────────────────
+  [RESOURCE_PATHS.financeProductRequisition]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER]
   },
-  [RESOURCE_PATHS.inventoryMaintenancePartStockMovementPurchase]: {
-    allowedRoles: [UserRole.OWNER, UserRole.MANAGER]
+  [RESOURCE_PATHS.financeBudgetAllocation]: {
+    allowedRoles: [UserRole.OWNER],
+    requiredPrivileges: [UserPrivilege.FINANCE]
+  },
+  [RESOURCE_PATHS.financeDashboard]: {
+    allowedRoles: [UserRole.OWNER],
+    requiredPrivileges: [UserPrivilege.FINANCE]
+  },
+  [RESOURCE_PATHS.financeTransaction]: {
+    allowedRoles: [UserRole.OWNER],
+    requiredPrivileges: [UserPrivilege.FINANCE]
   },
   // ── Admin Settings ─────────────────────────────────────────────────────────
   [RESOURCE_PATHS.adminUserRoster]: {
@@ -1308,39 +1368,117 @@ function generateInfrastructureFields(activeScope, availableScopes) {
     authScopeId: activeScope.authScopeId
   };
 }
-function buildRlsFilter(session, extra = {}) {
-  return { ...extra, authScopeId: { $in: session.readScopes || [] } };
+function encodeField(field, value) {
+  if (value === void 0) return void 0;
+  switch (field.type) {
+    case "object": {
+      const out = {};
+      for (const sub of field.fields ?? []) {
+        out[sub.key] = encodeField(sub, value[sub.path]);
+      }
+      return out;
+    }
+    case "recordArray": {
+      return value.map(
+        (record) => (field.fields ?? []).map((sub) => {
+          const raw = record[sub.path];
+          if (sub.enum) {
+            const code = sub.enum.indexOf(raw);
+            if (code === -1) {
+              throw new Error(
+                `sessionSchema: value "${raw}" for "${sub.path}" not in enum [${sub.enum.join(", ")}]. Add it to the enum in SESSION_SCHEMA before encoding.`
+              );
+            }
+            return code;
+          }
+          return raw;
+        })
+      );
+    }
+    default:
+      return value;
+  }
+}
+function decodeField(field, value) {
+  if (value === void 0) return void 0;
+  switch (field.type) {
+    case "object": {
+      const out = {};
+      for (const sub of field.fields ?? []) {
+        out[sub.path] = decodeField(sub, value[sub.key]);
+      }
+      return out;
+    }
+    case "recordArray": {
+      return value.map((tuple) => {
+        const out = {};
+        (field.fields ?? []).forEach((sub, i) => {
+          const raw = tuple[i];
+          out[sub.path] = sub.enum ? sub.enum[raw] : raw;
+        });
+        return out;
+      });
+    }
+    default:
+      return value;
+  }
 }
-function canRead(session, authScopeId) {
-  return session.readScopes?.includes(authScopeId) ?? false;
+function encodeSession(session) {
+  const out = {};
+  const sessionRecord = session;
+  for (const field of SESSION_SCHEMA) {
+    const encoded = encodeField(field, sessionRecord[field.path]);
+    if (encoded !== void 0) out[field.key] = encoded;
+  }
+  return out;
 }
-function canWrite(session, authScopeId, resourcePath) {
-  const override = session.resourceOverrides?.[authScopeId]?.[resourcePath];
-  if (override === "WRITE") return true;
-  if (override === "NONE" || override === "READ") return false;
-  return session.writeScopes?.includes(authScopeId) ?? false;
+function decodeSession(short) {
+  const out = {};
+  const shortRecord = short;
+  for (const field of SESSION_SCHEMA) {
+    const decoded = decodeField(field, shortRecord[field.key]);
+    if (decoded !== void 0) out[field.path] = decoded;
+  }
+  return out;
 }
-function assertCanWrite(session, authScopeId, resourcePath) {
-  const override = session.resourceOverrides?.[authScopeId]?.[resourcePath];
-  if (override === "WRITE") return;
-  if (override === "NONE" || override === "READ") {
-    throw new AppError(
-      403,
-      MOD.SESSION,
-      CAT.PERMISSION,
-      ACT.GENERIC,
-      `You do not have write access to "${resourcePath}" in this scope.`
-    );
+(function validateSchema(fields = SESSION_SCHEMA, seen = /* @__PURE__ */ new Set(), pathPrefix = "") {
+  for (const f of fields) {
+    if (seen.has(f.key)) {
+      throw new Error(
+        `sessionSchema: duplicate short key "${f.key}" detected near "${pathPrefix}${f.path}". Every key must be unique within its object level.`
+      );
+    }
+    seen.add(f.key);
+    if (f.fields && f.type === "object") {
+      validateSchema(f.fields, /* @__PURE__ */ new Set(), `${pathPrefix}${f.path}.`);
+    }
   }
-  if (session.writeScopes?.includes(authScopeId)) return;
-  throw new AppError(
-    403,
-    MOD.SESSION,
-    CAT.PERMISSION,
-    ACT.GENERIC,
-    "You do not have permission to modify records in this scope."
+})();
+function hasRoleAnywhere(session, role) {
+  return Object.values(session.roleAssignments ?? {}).some((a) => a.role === role);
+}
+function hasPrivilegeAnywhere(session, privilege) {
+  return Object.values(session.roleAssignments ?? {}).some(
+    (a) => a.privileges?.includes(privilege)
   );
 }
+function getRoleAt(session, scopeId) {
+  if (!scopeId) return null;
+  return session.roleAssignments?.[scopeId]?.role ?? null;
+}
+function hasRoleAt(session, scopeId, allowedRoles) {
+  const role = getRoleAt(session, scopeId);
+  if (!role) return false;
+  return allowedRoles instanceof Set ? allowedRoles.has(role) : allowedRoles.includes(role);
+}
+function getPrivilegesAt(session, scopeId) {
+  if (!scopeId) return [];
+  return session.roleAssignments?.[scopeId]?.privileges ?? [];
+}
+function hasPrivilegeAt(session, scopeId, requiredPrivileges) {
+  const privileges = getPrivilegesAt(session, scopeId);
+  return requiredPrivileges.some((p) => privileges.includes(p));
+}
 function resolveAccess(session, activeScopeId, tabConfig) {
   const resourcePath = tabConfig?.resourceId;
   const overrides = session.resourceOverrides?.[activeScopeId] ?? {};
@@ -1356,22 +1494,14 @@ function resolveAccess(session, activeScopeId, tabConfig) {
   const requiredPrivileges = tabConfig?.requiredPrivileges ?? [];
   const hasRestrictions = allowedRoles.length > 0 || requiredPrivileges.length > 0;
   if (hasRestrictions) {
-    const role = session?.role ?? "";
-    const privileges = session?.privileges ?? [];
+    const assignment = session?.roleAssignments?.[activeScopeId];
+    const role = assignment?.role ?? "";
+    const privileges = assignment?.privileges ?? [];
     const passesRole = allowedRoles.length > 0 && allowedRoles.includes(role);
     const passesPrivilege = requiredPrivileges.length > 0 && requiredPrivileges.some((p) => privileges.includes(p));
     return passesRole || passesPrivilege ? "WRITE" : "NONE";
   }
-  return "READ";
-}
-function resolveMenuVisibility(session, authScopeId, resourcePath) {
-  const override = session.resourceOverrides?.[authScopeId]?.[resourcePath];
-  if (override === "NONE") return "hidden";
-  if (override === "READ") return "read_only";
-  if (override === "WRITE") return "active";
-  if (session.writeScopes?.includes(authScopeId)) return "active";
-  if (session.readScopes?.includes(authScopeId)) return "read_only";
-  return "hidden";
+  return "NONE";
 }
 function isTabVisible(session, activeScopeId, tabConfig) {
   return resolveAccess(session, activeScopeId, tabConfig) !== "NONE";
@@ -1570,6 +1700,7 @@ function calculateFileMetadataMatch(criteria, fileMetadata, auditContext) {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,
@@ -1586,12 +1717,10 @@ function calculateFileMetadataMatch(criteria, fileMetadata, auditContext) {
   Validator,
   VigorRating,
   WaterSource,
-  assertCanWrite,
   assertTenantBoundary,
-  buildRlsFilter,
   calculateFileMetadataMatch,
-  canRead,
-  canWrite,
+  decodeSession,
+  encodeSession,
   evaluateBaseAccess,
   extractAppCode,
   findSpecificOverride,
@@ -1602,15 +1731,20 @@ function calculateFileMetadataMatch(criteria, fileMetadata, auditContext) {
   getApproveAction,
   getFormMeta,
   getFormsGroupedByModule,
+  getPrivilegesAt,
+  getRoleAt,
   getTaskTypeOptions,
   handleAppErrorResponse,
+  hasPrivilegeAnywhere,
+  hasPrivilegeAt,
+  hasRoleAnywhere,
+  hasRoleAt,
   isTabVisible,
   isTabWritable,
   resolveAccess,
   resolveAppError,
   resolveEffectiveAccess,
   resolveError,
-  resolveMenuVisibility,
   verifyAndExtractSession,
   withAgriLogging
 });