@litusarchieve18/agricore-utils 1.0.21 → 1.0.22

package/README.md

@@ -183,7 +183,15 @@ Run the publish command:
 Bash
 npm publish --access public
 📝 Version History
-V1.0.20 — add finance access and some top menu section that were missing
+V1.0.25 — 
+
+V1.0.24 — 
+
+V1.0.23 — 
+
+V1.0.22 — refactor session object to include multiple roles and privileges
+
+V1.0.21 — add finance access and some top menu section that were missing
 
 V1.0.20 — add inventory access reconcile
  

package/dist/{chunk-DZW2VL6D.mjs → chunk-V2DL7OTH.mjs}

@@ -84,6 +84,34 @@ var AccessLevel = {
   READ: "READ",
   WRITE: "WRITE"
 };
+var SESSION_SCHEMA = [
+  { key: "u", path: "userId", type: "scalar" },
+  { key: "n", path: "userName", type: "scalar" },
+  { key: "e", path: "userEmail", type: "scalar" },
+  { key: "c", path: "companyId", type: "scalar" },
+  { key: "a", path: "activeScopeId", type: "scalar" },
+  {
+    key: "cc",
+    path: "companyConfig",
+    type: "object",
+    fields: [{ key: "me", path: "isMultiEntity", type: "scalar" }]
+  },
+  { key: "m", path: "enabledModules", type: "scalar" },
+  { key: "ra", path: "roleAssignments", type: "scalar" },
+  {
+    key: "as",
+    path: "availableScopes",
+    type: "recordArray",
+    fields: [
+      { key: "ai", path: "authScopeId", type: "scalar" },
+      { key: "bi", path: "base44Id", type: "scalar" },
+      { key: "t", path: "type", type: "scalar", enum: ["company", "legalEntity", "facility"] },
+      { key: "nm", path: "name", type: "scalar" },
+      { key: "pi", path: "parentId", type: "scalar" }
+    ]
+  },
+  { key: "ro", path: "resourceOverrides", type: "scalar" }
+];
 var EnabledModule = {
   FARM_MANAGEMENT: "farm_management",
   PACKHOUSE: "packhouse",
@@ -932,6 +960,7 @@ export {
   UserRole,
   UserPrivilege,
   AccessLevel,
+  SESSION_SCHEMA,
   EnabledModule,
   FacilityType,
   LinkedStatus,

package/dist/{constants-BQmsBTQ7.d.mts → constants-lhTP4wzB.d.mts}

@@ -7,6 +7,10 @@ interface AvailableScope {
     name: string;
     parentId: string | null;
 }
+interface RoleAssignment {
+    role: string;
+    privileges: string[];
+}
 interface CompanyConfig {
     isMultiEntity: boolean;
 }
@@ -28,15 +32,43 @@ interface AgriCoreSession {
     userName: string;
     userEmail: string;
     companyId: string;
-    activeScopeId: string | null;
-    companyConfig: CompanyConfig;
-    role: string;
-    privileges: string[];
+    activeScopeId: string;
+    companyConfig: {
+        isMultiEntity: boolean;
+    };
     enabledModules: string[];
-    readScopes: string[];
-    writeScopes: string[];
+    roleAssignments: Record<string, RoleAssignment>;
     availableScopes: AvailableScope[];
-    resourceOverrides: ResourceOverrides;
+    resourceOverrides: Record<string, Record<string, PermissionLevel>>;
+}
+type WireAvailableScope = [
+    authScopeId: string,
+    base44Id: string,
+    typeCode: number,
+    name: string,
+    parentId: string | null
+];
+interface WireSession {
+    u: string;
+    n: string;
+    e: string;
+    c: string;
+    a: string;
+    cc: {
+        me: boolean;
+    };
+    m: string[];
+    ra: Record<string, RoleAssignment>;
+    as: WireAvailableScope[];
+    ro: Record<string, Record<string, PermissionLevel>>;
+}
+type FieldType = "scalar" | "object" | "recordArray";
+interface SchemaField {
+    key: string;
+    path: string;
+    type: FieldType;
+    fields?: SchemaField[];
+    enum?: readonly string[];
 }
 interface ResolvedError {
     title: string;
@@ -216,6 +248,7 @@ declare const AccessLevel: {
     readonly READ: "READ";
     readonly WRITE: "WRITE";
 };
+declare const SESSION_SCHEMA: SchemaField[];
 declare const EnabledModule: {
     readonly FARM_MANAGEMENT: "farm_management";
     readonly PACKHOUSE: "packhouse";
@@ -634,4 +667,4 @@ declare const StockPolicyTier: {
     readonly BY_LOCATION: 3;
 };
 
-export { NettingType as $, ACCESS_RANK as A, BarcodeNamespace as B, CAR_SUPPORTED_EVIDENCE_MIME_TYPES as C, type CorrectiveActionCompileTaskMetadata as D, type CorrectiveActionGenerationSource as E, type CorrectiveActionStatus as F, CropCycleStatus as G, DOCUMENT_DISPLAY_INFO as H, DOCUMENT_MENU_MAP as I, DocumentCategory as J, DocumentType as K, ERROR_DICTIONARY as L, EVERYONE as M, EmitterType as N, EnabledModule as O, FORM_REGISTRY as P, FacilityType as Q, type FileUploadTaskType as R, type FormMeta as S, HarvestMethod as T, type InfrastructureFields as U, LinkedStatus as V, MOD as W, MODULE_LABELS as X, MicroclimateZone as Y, MimeType as Z, type ModCode as _, ACT as a, type NormalizedSignatureValue as a0, NotificationMode as a1, OrderStatus as a2, type PermissionLevel as a3, PhysicalState as a4, PlantingMethod as a5, ProductType as a6, type ProductTypeType as a7, ProductUnit as a8, type ProductUnitType as a9, type TemplateScopeLevel as aA, TransactionType as aB, TrellisType as aC, UserPrivilege as aD, UserRole as aE, type UserRoleType as aF, VigorRating as aG, WaterSource as aH, RESOURCE_MODULE_MAP as aa, RESOURCE_PATHS as ab, RESOURCE_REQUIREMENTS as ac, ROLE_SECTIONS_BY_KEY as ad, RelationshipType as ae, type ResolvedError as af, type ResourceOverrides as ag, type ResourceRequirement as ah, RowOrientation as ai, SENTINEL_UUID as aj, SIGNATURE_MODES as ak, type ScopeType as al, type SignatureInput as am, type SignatureMode as an, SoilTexture as ao, StockPolicyTier as ap, type StockPolicyTierType as aq, StoragePhases as ar, type StorageType as as, TASK_TYPE_REGISTRY as at, TEMPLATE_SCOPE_LEVELS as au, type TabConfig as av, TargetEntityType as aw, TaskStatus as ax, TaskType as ay, type TaskTypeConfig as az, AccessLevel as b, type AccessLevelType as c, type AgriCoreSession as d, ApprovalStatus as e, ApprovalType as f, AuditStatus as g, AuditType as h, type AuthScopeFields as i, type AvailableScope as j, type BarcodeNamespaceType as k, BarcodeType as l, type BarcodeTypeType as m, type Base44Id as n, CAR_SUPPORTED_SIGNATURE_MIME_TYPES as o, CAT as p, CATEGORY_TABS as q, CORRECTIVE_ACTION_GENERATION_SOURCES as r, CORRECTIVE_ACTION_STATUSES as s, type CanonicalId as t, type CarSupportedEvidenceMimeType as u, type CarSupportedSignatureMimeType as v, type CarTemplateFileMetadata as w, CatalogSyncStatus as x, type CatalogSyncStatusType as y, type CompanyConfig as z };
+export { NettingType as $, ACCESS_RANK as A, BarcodeNamespace as B, CAR_SUPPORTED_EVIDENCE_MIME_TYPES as C, type CorrectiveActionCompileTaskMetadata as D, type CorrectiveActionGenerationSource as E, type CorrectiveActionStatus as F, CropCycleStatus as G, DOCUMENT_DISPLAY_INFO as H, DOCUMENT_MENU_MAP as I, DocumentCategory as J, DocumentType as K, ERROR_DICTIONARY as L, EVERYONE as M, EmitterType as N, EnabledModule as O, FORM_REGISTRY as P, FacilityType as Q, type FileUploadTaskType as R, type FormMeta as S, HarvestMethod as T, type InfrastructureFields as U, LinkedStatus as V, MOD as W, MODULE_LABELS as X, MicroclimateZone as Y, MimeType as Z, type ModCode as _, ACT as a, type NormalizedSignatureValue as a0, NotificationMode as a1, OrderStatus as a2, type PermissionLevel as a3, PhysicalState as a4, PlantingMethod as a5, ProductType as a6, type ProductTypeType as a7, ProductUnit as a8, type ProductUnitType as a9, TaskStatus as aA, TaskType as aB, type TaskTypeConfig as aC, type TemplateScopeLevel as aD, TransactionType as aE, TrellisType as aF, UserPrivilege as aG, UserRole as aH, type UserRoleType as aI, VigorRating as aJ, WaterSource as aK, type WireSession as aL, RESOURCE_MODULE_MAP as aa, RESOURCE_PATHS as ab, RESOURCE_REQUIREMENTS as ac, ROLE_SECTIONS_BY_KEY as ad, RelationshipType as ae, type ResolvedError as af, type ResourceOverrides as ag, type ResourceRequirement as ah, type RoleAssignment as ai, RowOrientation as aj, SENTINEL_UUID as ak, SESSION_SCHEMA as al, SIGNATURE_MODES as am, type SchemaField as an, type ScopeType as ao, type SignatureInput as ap, type SignatureMode as aq, SoilTexture as ar, StockPolicyTier as as, type StockPolicyTierType as at, StoragePhases as au, type StorageType as av, TASK_TYPE_REGISTRY as aw, TEMPLATE_SCOPE_LEVELS as ax, type TabConfig as ay, TargetEntityType as az, AccessLevel as b, type AccessLevelType as c, type AgriCoreSession as d, ApprovalStatus as e, ApprovalType as f, AuditStatus as g, AuditType as h, type AuthScopeFields as i, type AvailableScope as j, type BarcodeNamespaceType as k, BarcodeType as l, type BarcodeTypeType as m, type Base44Id as n, CAR_SUPPORTED_SIGNATURE_MIME_TYPES as o, CAT as p, CATEGORY_TABS as q, CORRECTIVE_ACTION_GENERATION_SOURCES as r, CORRECTIVE_ACTION_STATUSES as s, type CanonicalId as t, type CarSupportedEvidenceMimeType as u, type CarSupportedSignatureMimeType as v, type CarTemplateFileMetadata as w, CatalogSyncStatus as x, type CatalogSyncStatusType as y, type CompanyConfig as z };

package/dist/{constants-BQmsBTQ7.d.ts → constants-lhTP4wzB.d.ts}

@@ -7,6 +7,10 @@ interface AvailableScope {
     name: string;
     parentId: string | null;
 }
+interface RoleAssignment {
+    role: string;
+    privileges: string[];
+}
 interface CompanyConfig {
     isMultiEntity: boolean;
 }
@@ -28,15 +32,43 @@ interface AgriCoreSession {
     userName: string;
     userEmail: string;
     companyId: string;
-    activeScopeId: string | null;
-    companyConfig: CompanyConfig;
-    role: string;
-    privileges: string[];
+    activeScopeId: string;
+    companyConfig: {
+        isMultiEntity: boolean;
+    };
     enabledModules: string[];
-    readScopes: string[];
-    writeScopes: string[];
+    roleAssignments: Record<string, RoleAssignment>;
     availableScopes: AvailableScope[];
-    resourceOverrides: ResourceOverrides;
+    resourceOverrides: Record<string, Record<string, PermissionLevel>>;
+}
+type WireAvailableScope = [
+    authScopeId: string,
+    base44Id: string,
+    typeCode: number,
+    name: string,
+    parentId: string | null
+];
+interface WireSession {
+    u: string;
+    n: string;
+    e: string;
+    c: string;
+    a: string;
+    cc: {
+        me: boolean;
+    };
+    m: string[];
+    ra: Record<string, RoleAssignment>;
+    as: WireAvailableScope[];
+    ro: Record<string, Record<string, PermissionLevel>>;
+}
+type FieldType = "scalar" | "object" | "recordArray";
+interface SchemaField {
+    key: string;
+    path: string;
+    type: FieldType;
+    fields?: SchemaField[];
+    enum?: readonly string[];
 }
 interface ResolvedError {
     title: string;
@@ -216,6 +248,7 @@ declare const AccessLevel: {
     readonly READ: "READ";
     readonly WRITE: "WRITE";
 };
+declare const SESSION_SCHEMA: SchemaField[];
 declare const EnabledModule: {
     readonly FARM_MANAGEMENT: "farm_management";
     readonly PACKHOUSE: "packhouse";
@@ -634,4 +667,4 @@ declare const StockPolicyTier: {
     readonly BY_LOCATION: 3;
 };
 
-export { NettingType as $, ACCESS_RANK as A, BarcodeNamespace as B, CAR_SUPPORTED_EVIDENCE_MIME_TYPES as C, type CorrectiveActionCompileTaskMetadata as D, type CorrectiveActionGenerationSource as E, type CorrectiveActionStatus as F, CropCycleStatus as G, DOCUMENT_DISPLAY_INFO as H, DOCUMENT_MENU_MAP as I, DocumentCategory as J, DocumentType as K, ERROR_DICTIONARY as L, EVERYONE as M, EmitterType as N, EnabledModule as O, FORM_REGISTRY as P, FacilityType as Q, type FileUploadTaskType as R, type FormMeta as S, HarvestMethod as T, type InfrastructureFields as U, LinkedStatus as V, MOD as W, MODULE_LABELS as X, MicroclimateZone as Y, MimeType as Z, type ModCode as _, ACT as a, type NormalizedSignatureValue as a0, NotificationMode as a1, OrderStatus as a2, type PermissionLevel as a3, PhysicalState as a4, PlantingMethod as a5, ProductType as a6, type ProductTypeType as a7, ProductUnit as a8, type ProductUnitType as a9, type TemplateScopeLevel as aA, TransactionType as aB, TrellisType as aC, UserPrivilege as aD, UserRole as aE, type UserRoleType as aF, VigorRating as aG, WaterSource as aH, RESOURCE_MODULE_MAP as aa, RESOURCE_PATHS as ab, RESOURCE_REQUIREMENTS as ac, ROLE_SECTIONS_BY_KEY as ad, RelationshipType as ae, type ResolvedError as af, type ResourceOverrides as ag, type ResourceRequirement as ah, RowOrientation as ai, SENTINEL_UUID as aj, SIGNATURE_MODES as ak, type ScopeType as al, type SignatureInput as am, type SignatureMode as an, SoilTexture as ao, StockPolicyTier as ap, type StockPolicyTierType as aq, StoragePhases as ar, type StorageType as as, TASK_TYPE_REGISTRY as at, TEMPLATE_SCOPE_LEVELS as au, type TabConfig as av, TargetEntityType as aw, TaskStatus as ax, TaskType as ay, type TaskTypeConfig as az, AccessLevel as b, type AccessLevelType as c, type AgriCoreSession as d, ApprovalStatus as e, ApprovalType as f, AuditStatus as g, AuditType as h, type AuthScopeFields as i, type AvailableScope as j, type BarcodeNamespaceType as k, BarcodeType as l, type BarcodeTypeType as m, type Base44Id as n, CAR_SUPPORTED_SIGNATURE_MIME_TYPES as o, CAT as p, CATEGORY_TABS as q, CORRECTIVE_ACTION_GENERATION_SOURCES as r, CORRECTIVE_ACTION_STATUSES as s, type CanonicalId as t, type CarSupportedEvidenceMimeType as u, type CarSupportedSignatureMimeType as v, type CarTemplateFileMetadata as w, CatalogSyncStatus as x, type CatalogSyncStatusType as y, type CompanyConfig as z };
+export { NettingType as $, ACCESS_RANK as A, BarcodeNamespace as B, CAR_SUPPORTED_EVIDENCE_MIME_TYPES as C, type CorrectiveActionCompileTaskMetadata as D, type CorrectiveActionGenerationSource as E, type CorrectiveActionStatus as F, CropCycleStatus as G, DOCUMENT_DISPLAY_INFO as H, DOCUMENT_MENU_MAP as I, DocumentCategory as J, DocumentType as K, ERROR_DICTIONARY as L, EVERYONE as M, EmitterType as N, EnabledModule as O, FORM_REGISTRY as P, FacilityType as Q, type FileUploadTaskType as R, type FormMeta as S, HarvestMethod as T, type InfrastructureFields as U, LinkedStatus as V, MOD as W, MODULE_LABELS as X, MicroclimateZone as Y, MimeType as Z, type ModCode as _, ACT as a, type NormalizedSignatureValue as a0, NotificationMode as a1, OrderStatus as a2, type PermissionLevel as a3, PhysicalState as a4, PlantingMethod as a5, ProductType as a6, type ProductTypeType as a7, ProductUnit as a8, type ProductUnitType as a9, TaskStatus as aA, TaskType as aB, type TaskTypeConfig as aC, type TemplateScopeLevel as aD, TransactionType as aE, TrellisType as aF, UserPrivilege as aG, UserRole as aH, type UserRoleType as aI, VigorRating as aJ, WaterSource as aK, type WireSession as aL, RESOURCE_MODULE_MAP as aa, RESOURCE_PATHS as ab, RESOURCE_REQUIREMENTS as ac, ROLE_SECTIONS_BY_KEY as ad, RelationshipType as ae, type ResolvedError as af, type ResourceOverrides as ag, type ResourceRequirement as ah, type RoleAssignment as ai, RowOrientation as aj, SENTINEL_UUID as ak, SESSION_SCHEMA as al, SIGNATURE_MODES as am, type SchemaField as an, type ScopeType as ao, type SignatureInput as ap, type SignatureMode as aq, SoilTexture as ar, StockPolicyTier as as, type StockPolicyTierType as at, StoragePhases as au, type StorageType as av, TASK_TYPE_REGISTRY as aw, TEMPLATE_SCOPE_LEVELS as ax, type TabConfig as ay, TargetEntityType as az, AccessLevel as b, type AccessLevelType as c, type AgriCoreSession as d, ApprovalStatus as e, ApprovalType as f, AuditStatus as g, AuditType as h, type AuthScopeFields as i, type AvailableScope as j, type BarcodeNamespaceType as k, BarcodeType as l, type BarcodeTypeType as m, type Base44Id as n, CAR_SUPPORTED_SIGNATURE_MIME_TYPES as o, CAT as p, CATEGORY_TABS as q, CORRECTIVE_ACTION_GENERATION_SOURCES as r, CORRECTIVE_ACTION_STATUSES as s, type CanonicalId as t, type CarSupportedEvidenceMimeType as u, type CarSupportedSignatureMimeType as v, type CarTemplateFileMetadata as w, CatalogSyncStatus as x, type CatalogSyncStatusType as y, type CompanyConfig as z };

package/dist/constants.d.mts

@@ -1 +1 @@
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, ai as RowOrientation, aj as SENTINEL_UUID, ak as SIGNATURE_MODES, ao as SoilTexture, ap as StockPolicyTier, ar as StoragePhases, at as TASK_TYPE_REGISTRY, au as TEMPLATE_SCOPE_LEVELS, aw as TargetEntityType, ax as TaskStatus, ay as TaskType, aB as TransactionType, aC as TrellisType, aD as UserPrivilege, aE as UserRole, aG as VigorRating, aH as WaterSource } from './constants-BQmsBTQ7.mjs';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, ar as SoilTexture, as as StockPolicyTier, au as StoragePhases, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserRole, aJ as VigorRating, aK as WaterSource } from './constants-lhTP4wzB.mjs';

package/dist/constants.d.ts

@@ -1 +1 @@
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, ai as RowOrientation, aj as SENTINEL_UUID, ak as SIGNATURE_MODES, ao as SoilTexture, ap as StockPolicyTier, ar as StoragePhases, at as TASK_TYPE_REGISTRY, au as TEMPLATE_SCOPE_LEVELS, aw as TargetEntityType, ax as TaskStatus, ay as TaskType, aB as TransactionType, aC as TrellisType, aD as UserPrivilege, aE as UserRole, aG as VigorRating, aH as WaterSource } from './constants-BQmsBTQ7.js';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, ar as SoilTexture, as as StockPolicyTier, au as StoragePhases, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserRole, aJ as VigorRating, aK as WaterSource } from './constants-lhTP4wzB.js';

package/dist/constants.js

@@ -67,6 +67,7 @@ __export(constants_exports, {
   RelationshipType: () => RelationshipType,
   RowOrientation: () => RowOrientation,
   SENTINEL_UUID: () => SENTINEL_UUID,
+  SESSION_SCHEMA: () => SESSION_SCHEMA,
   SIGNATURE_MODES: () => SIGNATURE_MODES,
   SoilTexture: () => SoilTexture,
   StockPolicyTier: () => StockPolicyTier,
@@ -169,6 +170,34 @@ var AccessLevel = {
   READ: "READ",
   WRITE: "WRITE"
 };
+var SESSION_SCHEMA = [
+  { key: "u", path: "userId", type: "scalar" },
+  { key: "n", path: "userName", type: "scalar" },
+  { key: "e", path: "userEmail", type: "scalar" },
+  { key: "c", path: "companyId", type: "scalar" },
+  { key: "a", path: "activeScopeId", type: "scalar" },
+  {
+    key: "cc",
+    path: "companyConfig",
+    type: "object",
+    fields: [{ key: "me", path: "isMultiEntity", type: "scalar" }]
+  },
+  { key: "m", path: "enabledModules", type: "scalar" },
+  { key: "ra", path: "roleAssignments", type: "scalar" },
+  {
+    key: "as",
+    path: "availableScopes",
+    type: "recordArray",
+    fields: [
+      { key: "ai", path: "authScopeId", type: "scalar" },
+      { key: "bi", path: "base44Id", type: "scalar" },
+      { key: "t", path: "type", type: "scalar", enum: ["company", "legalEntity", "facility"] },
+      { key: "nm", path: "name", type: "scalar" },
+      { key: "pi", path: "parentId", type: "scalar" }
+    ]
+  },
+  { key: "ro", path: "resourceOverrides", type: "scalar" }
+];
 var EnabledModule = {
   FARM_MANAGEMENT: "farm_management",
   PACKHOUSE: "packhouse",
@@ -1055,6 +1084,7 @@ var StockPolicyTier = {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,

package/dist/constants.mjs

@@ -46,6 +46,7 @@ import {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,
@@ -61,7 +62,7 @@ import {
   UserRole,
   VigorRating,
   WaterSource
-} from "./chunk-DZW2VL6D.mjs";
+} from "./chunk-V2DL7OTH.mjs";
 export {
   ACCESS_RANK,
   ACT,
@@ -110,6 +111,7 @@ export {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { d as AgriCoreSession, aF as UserRoleType, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, av as TabConfig, af as ResolvedError } from './constants-BQmsBTQ7.mjs';
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RowOrientation, aj as SENTINEL_UUID, ak as SIGNATURE_MODES, al as ScopeType, am as SignatureInput, an as SignatureMode, ao as SoilTexture, ap as StockPolicyTier, aq as StockPolicyTierType, ar as StoragePhases, as as StorageType, at as TASK_TYPE_REGISTRY, au as TEMPLATE_SCOPE_LEVELS, aw as TargetEntityType, ax as TaskStatus, ay as TaskType, az as TaskTypeConfig, aA as TemplateScopeLevel, aB as TransactionType, aC as TrellisType, aD as UserPrivilege, aE as UserRole, aG as VigorRating, aH as WaterSource } from './constants-BQmsBTQ7.mjs';
+import { d as AgriCoreSession, ao as ScopeType, aL as WireSession, aI as UserRoleType, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError } from './constants-lhTP4wzB.mjs';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserRole, aJ as VigorRating, aK as WaterSource } from './constants-lhTP4wzB.mjs';
 
 declare const AgriLogger: {
     log(level: "INFO" | "WARN" | "ERROR", message: string, meta: any): void;
@@ -104,10 +104,21 @@ declare function generateCanonicalId(): string;
  * Standardizes the creation of new entities by walking up the scope tree.
  */
 declare function generateInfrastructureFields(activeScope: AvailableScope, availableScopes: AvailableScope[]): InfrastructureFields;
+declare function encodeSession(session: AgriCoreSession): WireSession;
+declare function decodeSession(short: WireSession): AgriCoreSession;
+declare function hasRoleAnywhere(session: AgriCoreSession, role: string): boolean;
+declare function hasPrivilegeAnywhere(session: AgriCoreSession, privilege: string): boolean;
 /**
- * Hard-throws if the user cannot write.
- * Use this on the backend (inside Deno functions) to enforce server-side.
+ * "Does this user hold this role/privilege AT this specific scope?"
+ * This is the default choice for any authorization gate evaluating
+ * "can the user perform this action on the resource/scope they're
+ * currently acting on." No inheritance — only an explicit assignment
+ * at exactly this authScopeId counts, matching the no-inherit-write rule.
  */
+declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
+declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
+declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
+declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
 /**
  * Full resolution: DB override → static config fallback → public default.
  * Returns 'NONE' | 'READ' | 'WRITE'.
@@ -129,7 +140,7 @@ declare function assertTenantBoundary(db: any, session: AgriCoreSession, // Pass
 targets: {
     targetUserId?: string;
     authScopeId?: string;
-    expectedScopeType?: 'company' | 'legalEntity' | 'facility';
+    expectedScopeType?: ScopeType;
 }): Promise<boolean>;
 declare function verifyAndExtractSession(token: string, secret: string): Promise<AgriCoreSession>;
 declare function getFormMeta(componentId: string): FormMeta | null;
@@ -163,4 +174,4 @@ declare function calculateFileMetadataMatch(criteria: {
     contextMatch?: string[];
 }, fileMetadata: Record<string, any>, auditContext: Record<string, any>): number;
 
-export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, TabConfig, UserRoleType, Validator, assertTenantBoundary, calculateFileMetadataMatch, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getTaskTypeOptions, handleAppErrorResponse, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, verifyAndExtractSession, withAgriLogging };
+export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, ScopeType, TabConfig, UserRoleType, Validator, WireSession, assertTenantBoundary, calculateFileMetadataMatch, decodeSession, encodeSession, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getPrivilegesAt, getRoleAt, getTaskTypeOptions, handleAppErrorResponse, hasPrivilegeAnywhere, hasPrivilegeAt, hasRoleAnywhere, hasRoleAt, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, verifyAndExtractSession, withAgriLogging };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { d as AgriCoreSession, aF as UserRoleType, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, av as TabConfig, af as ResolvedError } from './constants-BQmsBTQ7.js';
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RowOrientation, aj as SENTINEL_UUID, ak as SIGNATURE_MODES, al as ScopeType, am as SignatureInput, an as SignatureMode, ao as SoilTexture, ap as StockPolicyTier, aq as StockPolicyTierType, ar as StoragePhases, as as StorageType, at as TASK_TYPE_REGISTRY, au as TEMPLATE_SCOPE_LEVELS, aw as TargetEntityType, ax as TaskStatus, ay as TaskType, az as TaskTypeConfig, aA as TemplateScopeLevel, aB as TransactionType, aC as TrellisType, aD as UserPrivilege, aE as UserRole, aG as VigorRating, aH as WaterSource } from './constants-BQmsBTQ7.js';
+import { d as AgriCoreSession, ao as ScopeType, aL as WireSession, aI as UserRoleType, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError } from './constants-lhTP4wzB.js';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserRole, aJ as VigorRating, aK as WaterSource } from './constants-lhTP4wzB.js';
 
 declare const AgriLogger: {
     log(level: "INFO" | "WARN" | "ERROR", message: string, meta: any): void;
@@ -104,10 +104,21 @@ declare function generateCanonicalId(): string;
  * Standardizes the creation of new entities by walking up the scope tree.
  */
 declare function generateInfrastructureFields(activeScope: AvailableScope, availableScopes: AvailableScope[]): InfrastructureFields;
+declare function encodeSession(session: AgriCoreSession): WireSession;
+declare function decodeSession(short: WireSession): AgriCoreSession;
+declare function hasRoleAnywhere(session: AgriCoreSession, role: string): boolean;
+declare function hasPrivilegeAnywhere(session: AgriCoreSession, privilege: string): boolean;
 /**
- * Hard-throws if the user cannot write.
- * Use this on the backend (inside Deno functions) to enforce server-side.
+ * "Does this user hold this role/privilege AT this specific scope?"
+ * This is the default choice for any authorization gate evaluating
+ * "can the user perform this action on the resource/scope they're
+ * currently acting on." No inheritance — only an explicit assignment
+ * at exactly this authScopeId counts, matching the no-inherit-write rule.
  */
+declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
+declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
+declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
+declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
 /**
  * Full resolution: DB override → static config fallback → public default.
  * Returns 'NONE' | 'READ' | 'WRITE'.
@@ -129,7 +140,7 @@ declare function assertTenantBoundary(db: any, session: AgriCoreSession, // Pass
 targets: {
     targetUserId?: string;
     authScopeId?: string;
-    expectedScopeType?: 'company' | 'legalEntity' | 'facility';
+    expectedScopeType?: ScopeType;
 }): Promise<boolean>;
 declare function verifyAndExtractSession(token: string, secret: string): Promise<AgriCoreSession>;
 declare function getFormMeta(componentId: string): FormMeta | null;
@@ -163,4 +174,4 @@ declare function calculateFileMetadataMatch(criteria: {
     contextMatch?: string[];
 }, fileMetadata: Record<string, any>, auditContext: Record<string, any>): number;
 
-export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, TabConfig, UserRoleType, Validator, assertTenantBoundary, calculateFileMetadataMatch, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getTaskTypeOptions, handleAppErrorResponse, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, verifyAndExtractSession, withAgriLogging };
+export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, ScopeType, TabConfig, UserRoleType, Validator, WireSession, assertTenantBoundary, calculateFileMetadataMatch, decodeSession, encodeSession, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getPrivilegesAt, getRoleAt, getTaskTypeOptions, handleAppErrorResponse, hasPrivilegeAnywhere, hasPrivilegeAt, hasRoleAnywhere, hasRoleAt, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, verifyAndExtractSession, withAgriLogging };

package/dist/index.js

@@ -71,6 +71,7 @@ __export(index_exports, {
   RelationshipType: () => RelationshipType,
   RowOrientation: () => RowOrientation,
   SENTINEL_UUID: () => SENTINEL_UUID,
+  SESSION_SCHEMA: () => SESSION_SCHEMA,
   SIGNATURE_MODES: () => SIGNATURE_MODES,
   SoilTexture: () => SoilTexture,
   StockPolicyTier: () => StockPolicyTier,
@@ -89,6 +90,8 @@ __export(index_exports, {
   WaterSource: () => WaterSource,
   assertTenantBoundary: () => assertTenantBoundary,
   calculateFileMetadataMatch: () => calculateFileMetadataMatch,
+  decodeSession: () => decodeSession,
+  encodeSession: () => encodeSession,
   evaluateBaseAccess: () => evaluateBaseAccess,
   extractAppCode: () => extractAppCode,
   findSpecificOverride: () => findSpecificOverride,
@@ -99,8 +102,14 @@ __export(index_exports, {
   getApproveAction: () => getApproveAction,
   getFormMeta: () => getFormMeta,
   getFormsGroupedByModule: () => getFormsGroupedByModule,
+  getPrivilegesAt: () => getPrivilegesAt,
+  getRoleAt: () => getRoleAt,
   getTaskTypeOptions: () => getTaskTypeOptions,
   handleAppErrorResponse: () => handleAppErrorResponse,
+  hasPrivilegeAnywhere: () => hasPrivilegeAnywhere,
+  hasPrivilegeAt: () => hasPrivilegeAt,
+  hasRoleAnywhere: () => hasRoleAnywhere,
+  hasRoleAt: () => hasRoleAt,
   isTabVisible: () => isTabVisible,
   isTabWritable: () => isTabWritable,
   resolveAccess: () => resolveAccess,
@@ -385,6 +394,34 @@ var AccessLevel = {
   READ: "READ",
   WRITE: "WRITE"
 };
+var SESSION_SCHEMA = [
+  { key: "u", path: "userId", type: "scalar" },
+  { key: "n", path: "userName", type: "scalar" },
+  { key: "e", path: "userEmail", type: "scalar" },
+  { key: "c", path: "companyId", type: "scalar" },
+  { key: "a", path: "activeScopeId", type: "scalar" },
+  {
+    key: "cc",
+    path: "companyConfig",
+    type: "object",
+    fields: [{ key: "me", path: "isMultiEntity", type: "scalar" }]
+  },
+  { key: "m", path: "enabledModules", type: "scalar" },
+  { key: "ra", path: "roleAssignments", type: "scalar" },
+  {
+    key: "as",
+    path: "availableScopes",
+    type: "recordArray",
+    fields: [
+      { key: "ai", path: "authScopeId", type: "scalar" },
+      { key: "bi", path: "base44Id", type: "scalar" },
+      { key: "t", path: "type", type: "scalar", enum: ["company", "legalEntity", "facility"] },
+      { key: "nm", path: "name", type: "scalar" },
+      { key: "pi", path: "parentId", type: "scalar" }
+    ]
+  },
+  { key: "ro", path: "resourceOverrides", type: "scalar" }
+];
 var EnabledModule = {
   FARM_MANAGEMENT: "farm_management",
   PACKHOUSE: "packhouse",
@@ -1331,6 +1368,117 @@ function generateInfrastructureFields(activeScope, availableScopes) {
     authScopeId: activeScope.authScopeId
   };
 }
+function encodeField(field, value) {
+  if (value === void 0) return void 0;
+  switch (field.type) {
+    case "object": {
+      const out = {};
+      for (const sub of field.fields ?? []) {
+        out[sub.key] = encodeField(sub, value[sub.path]);
+      }
+      return out;
+    }
+    case "recordArray": {
+      return value.map(
+        (record) => (field.fields ?? []).map((sub) => {
+          const raw = record[sub.path];
+          if (sub.enum) {
+            const code = sub.enum.indexOf(raw);
+            if (code === -1) {
+              throw new Error(
+                `sessionSchema: value "${raw}" for "${sub.path}" not in enum [${sub.enum.join(", ")}]. Add it to the enum in SESSION_SCHEMA before encoding.`
+              );
+            }
+            return code;
+          }
+          return raw;
+        })
+      );
+    }
+    default:
+      return value;
+  }
+}
+function decodeField(field, value) {
+  if (value === void 0) return void 0;
+  switch (field.type) {
+    case "object": {
+      const out = {};
+      for (const sub of field.fields ?? []) {
+        out[sub.path] = decodeField(sub, value[sub.key]);
+      }
+      return out;
+    }
+    case "recordArray": {
+      return value.map((tuple) => {
+        const out = {};
+        (field.fields ?? []).forEach((sub, i) => {
+          const raw = tuple[i];
+          out[sub.path] = sub.enum ? sub.enum[raw] : raw;
+        });
+        return out;
+      });
+    }
+    default:
+      return value;
+  }
+}
+function encodeSession(session) {
+  const out = {};
+  const sessionRecord = session;
+  for (const field of SESSION_SCHEMA) {
+    const encoded = encodeField(field, sessionRecord[field.path]);
+    if (encoded !== void 0) out[field.key] = encoded;
+  }
+  return out;
+}
+function decodeSession(short) {
+  const out = {};
+  const shortRecord = short;
+  for (const field of SESSION_SCHEMA) {
+    const decoded = decodeField(field, shortRecord[field.key]);
+    if (decoded !== void 0) out[field.path] = decoded;
+  }
+  return out;
+}
+(function validateSchema(fields = SESSION_SCHEMA, seen = /* @__PURE__ */ new Set(), pathPrefix = "") {
+  for (const f of fields) {
+    if (seen.has(f.key)) {
+      throw new Error(
+        `sessionSchema: duplicate short key "${f.key}" detected near "${pathPrefix}${f.path}". Every key must be unique within its object level.`
+      );
+    }
+    seen.add(f.key);
+    if (f.fields && f.type === "object") {
+      validateSchema(f.fields, /* @__PURE__ */ new Set(), `${pathPrefix}${f.path}.`);
+    }
+  }
+})();
+function hasRoleAnywhere(session, role) {
+  return Object.values(session.roleAssignments ?? {}).some((a) => a.role === role);
+}
+function hasPrivilegeAnywhere(session, privilege) {
+  return Object.values(session.roleAssignments ?? {}).some(
+    (a) => a.privileges?.includes(privilege)
+  );
+}
+function getRoleAt(session, scopeId) {
+  if (!scopeId) return null;
+  return session.roleAssignments?.[scopeId]?.role ?? null;
+}
+function hasRoleAt(session, scopeId, allowedRoles) {
+  const role = getRoleAt(session, scopeId);
+  if (!role) return false;
+  return allowedRoles instanceof Set ? allowedRoles.has(role) : allowedRoles.includes(role);
+}
+function getPrivilegesAt(session, scopeId) {
+  if (!scopeId) return [];
+  return session.roleAssignments?.[scopeId]?.privileges ?? [];
+}
+function hasPrivilegeAt(session, scopeId, requiredPrivileges) {
+  const privileges = getPrivilegesAt(session, scopeId);
+  return requiredPrivileges.some((p) => privileges.includes(p));
+}
 function resolveAccess(session, activeScopeId, tabConfig) {
   const resourcePath = tabConfig?.resourceId;
   const overrides = session.resourceOverrides?.[activeScopeId] ?? {};
@@ -1346,13 +1494,14 @@ function resolveAccess(session, activeScopeId, tabConfig) {
   const requiredPrivileges = tabConfig?.requiredPrivileges ?? [];
   const hasRestrictions = allowedRoles.length > 0 || requiredPrivileges.length > 0;
   if (hasRestrictions) {
-    const role = session?.role ?? "";
-    const privileges = session?.privileges ?? [];
+    const assignment = session?.roleAssignments?.[activeScopeId];
+    const role = assignment?.role ?? "";
+    const privileges = assignment?.privileges ?? [];
     const passesRole = allowedRoles.length > 0 && allowedRoles.includes(role);
     const passesPrivilege = requiredPrivileges.length > 0 && requiredPrivileges.some((p) => privileges.includes(p));
     return passesRole || passesPrivilege ? "WRITE" : "NONE";
   }
-  return "READ";
+  return "NONE";
 }
 function isTabVisible(session, activeScopeId, tabConfig) {
   return resolveAccess(session, activeScopeId, tabConfig) !== "NONE";
@@ -1551,6 +1700,7 @@ function calculateFileMetadataMatch(criteria, fileMetadata, auditContext) {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,
@@ -1569,6 +1719,8 @@ function calculateFileMetadataMatch(criteria, fileMetadata, auditContext) {
   WaterSource,
   assertTenantBoundary,
   calculateFileMetadataMatch,
+  decodeSession,
+  encodeSession,
   evaluateBaseAccess,
   extractAppCode,
   findSpecificOverride,
@@ -1579,8 +1731,14 @@ function calculateFileMetadataMatch(criteria, fileMetadata, auditContext) {
   getApproveAction,
   getFormMeta,
   getFormsGroupedByModule,
+  getPrivilegesAt,
+  getRoleAt,
   getTaskTypeOptions,
   handleAppErrorResponse,
+  hasPrivilegeAnywhere,
+  hasPrivilegeAt,
+  hasRoleAnywhere,
+  hasRoleAt,
   isTabVisible,
   isTabWritable,
   resolveAccess,

package/dist/index.mjs

@@ -46,6 +46,7 @@ import {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,
@@ -61,7 +62,7 @@ import {
   UserRole,
   VigorRating,
   WaterSource
-} from "./chunk-DZW2VL6D.mjs";
+} from "./chunk-V2DL7OTH.mjs";
 
 // src/index.ts
 import { jwtVerify } from "jose";
@@ -360,6 +361,117 @@ function generateInfrastructureFields(activeScope, availableScopes) {
     authScopeId: activeScope.authScopeId
   };
 }
+function encodeField(field, value) {
+  if (value === void 0) return void 0;
+  switch (field.type) {
+    case "object": {
+      const out = {};
+      for (const sub of field.fields ?? []) {
+        out[sub.key] = encodeField(sub, value[sub.path]);
+      }
+      return out;
+    }
+    case "recordArray": {
+      return value.map(
+        (record) => (field.fields ?? []).map((sub) => {
+          const raw = record[sub.path];
+          if (sub.enum) {
+            const code = sub.enum.indexOf(raw);
+            if (code === -1) {
+              throw new Error(
+                `sessionSchema: value "${raw}" for "${sub.path}" not in enum [${sub.enum.join(", ")}]. Add it to the enum in SESSION_SCHEMA before encoding.`
+              );
+            }
+            return code;
+          }
+          return raw;
+        })
+      );
+    }
+    default:
+      return value;
+  }
+}
+function decodeField(field, value) {
+  if (value === void 0) return void 0;
+  switch (field.type) {
+    case "object": {
+      const out = {};
+      for (const sub of field.fields ?? []) {
+        out[sub.path] = decodeField(sub, value[sub.key]);
+      }
+      return out;
+    }
+    case "recordArray": {
+      return value.map((tuple) => {
+        const out = {};
+        (field.fields ?? []).forEach((sub, i) => {
+          const raw = tuple[i];
+          out[sub.path] = sub.enum ? sub.enum[raw] : raw;
+        });
+        return out;
+      });
+    }
+    default:
+      return value;
+  }
+}
+function encodeSession(session) {
+  const out = {};
+  const sessionRecord = session;
+  for (const field of SESSION_SCHEMA) {
+    const encoded = encodeField(field, sessionRecord[field.path]);
+    if (encoded !== void 0) out[field.key] = encoded;
+  }
+  return out;
+}
+function decodeSession(short) {
+  const out = {};
+  const shortRecord = short;
+  for (const field of SESSION_SCHEMA) {
+    const decoded = decodeField(field, shortRecord[field.key]);
+    if (decoded !== void 0) out[field.path] = decoded;
+  }
+  return out;
+}
+(function validateSchema(fields = SESSION_SCHEMA, seen = /* @__PURE__ */ new Set(), pathPrefix = "") {
+  for (const f of fields) {
+    if (seen.has(f.key)) {
+      throw new Error(
+        `sessionSchema: duplicate short key "${f.key}" detected near "${pathPrefix}${f.path}". Every key must be unique within its object level.`
+      );
+    }
+    seen.add(f.key);
+    if (f.fields && f.type === "object") {
+      validateSchema(f.fields, /* @__PURE__ */ new Set(), `${pathPrefix}${f.path}.`);
+    }
+  }
+})();
+function hasRoleAnywhere(session, role) {
+  return Object.values(session.roleAssignments ?? {}).some((a) => a.role === role);
+}
+function hasPrivilegeAnywhere(session, privilege) {
+  return Object.values(session.roleAssignments ?? {}).some(
+    (a) => a.privileges?.includes(privilege)
+  );
+}
+function getRoleAt(session, scopeId) {
+  if (!scopeId) return null;
+  return session.roleAssignments?.[scopeId]?.role ?? null;
+}
+function hasRoleAt(session, scopeId, allowedRoles) {
+  const role = getRoleAt(session, scopeId);
+  if (!role) return false;
+  return allowedRoles instanceof Set ? allowedRoles.has(role) : allowedRoles.includes(role);
+}
+function getPrivilegesAt(session, scopeId) {
+  if (!scopeId) return [];
+  return session.roleAssignments?.[scopeId]?.privileges ?? [];
+}
+function hasPrivilegeAt(session, scopeId, requiredPrivileges) {
+  const privileges = getPrivilegesAt(session, scopeId);
+  return requiredPrivileges.some((p) => privileges.includes(p));
+}
 function resolveAccess(session, activeScopeId, tabConfig) {
   const resourcePath = tabConfig?.resourceId;
   const overrides = session.resourceOverrides?.[activeScopeId] ?? {};
@@ -375,13 +487,14 @@ function resolveAccess(session, activeScopeId, tabConfig) {
   const requiredPrivileges = tabConfig?.requiredPrivileges ?? [];
   const hasRestrictions = allowedRoles.length > 0 || requiredPrivileges.length > 0;
   if (hasRestrictions) {
-    const role = session?.role ?? "";
-    const privileges = session?.privileges ?? [];
+    const assignment = session?.roleAssignments?.[activeScopeId];
+    const role = assignment?.role ?? "";
+    const privileges = assignment?.privileges ?? [];
     const passesRole = allowedRoles.length > 0 && allowedRoles.includes(role);
     const passesPrivilege = requiredPrivileges.length > 0 && requiredPrivileges.some((p) => privileges.includes(p));
     return passesRole || passesPrivilege ? "WRITE" : "NONE";
   }
-  return "READ";
+  return "NONE";
 }
 function isTabVisible(session, activeScopeId, tabConfig) {
   return resolveAccess(session, activeScopeId, tabConfig) !== "NONE";
@@ -579,6 +692,7 @@ export {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,
@@ -597,6 +711,8 @@ export {
   WaterSource,
   assertTenantBoundary,
   calculateFileMetadataMatch,
+  decodeSession,
+  encodeSession,
   evaluateBaseAccess,
   extractAppCode,
   findSpecificOverride,
@@ -607,8 +723,14 @@ export {
   getApproveAction,
   getFormMeta,
   getFormsGroupedByModule,
+  getPrivilegesAt,
+  getRoleAt,
   getTaskTypeOptions,
   handleAppErrorResponse,
+  hasPrivilegeAnywhere,
+  hasPrivilegeAt,
+  hasRoleAnywhere,
+  hasRoleAt,
   isTabVisible,
   isTabWritable,
   resolveAccess,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@litusarchieve18/agricore-utils",
-  "version": "1.0.21",
+  "version": "1.0.22",
   "description": "Canonical Backend Utility Library for AgriCore",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",