@litusarchieve18/agricore-utils 1.0.21 → 1.0.23

package/README.md

@@ -183,7 +183,15 @@ Run the publish command:
 Bash
 npm publish --access public
 📝 Version History
-V1.0.20 — add finance access and some top menu section that were missing
+V1.0.25 — 
+
+V1.0.24 — 
+
+V1.0.23 — add two more utility function getScopeAncestry, transformRoleAssignments, evaluateBaseAccess
+
+V1.0.22 — refactor session object to include multiple roles and privileges
+
+V1.0.21 — add finance access and some top menu section that were missing
 
 V1.0.20 — add inventory access reconcile
  

package/dist/{chunk-DZW2VL6D.mjs → chunk-V2DL7OTH.mjs}

@@ -84,6 +84,34 @@ var AccessLevel = {
   READ: "READ",
   WRITE: "WRITE"
 };
+var SESSION_SCHEMA = [
+  { key: "u", path: "userId", type: "scalar" },
+  { key: "n", path: "userName", type: "scalar" },
+  { key: "e", path: "userEmail", type: "scalar" },
+  { key: "c", path: "companyId", type: "scalar" },
+  { key: "a", path: "activeScopeId", type: "scalar" },
+  {
+    key: "cc",
+    path: "companyConfig",
+    type: "object",
+    fields: [{ key: "me", path: "isMultiEntity", type: "scalar" }]
+  },
+  { key: "m", path: "enabledModules", type: "scalar" },
+  { key: "ra", path: "roleAssignments", type: "scalar" },
+  {
+    key: "as",
+    path: "availableScopes",
+    type: "recordArray",
+    fields: [
+      { key: "ai", path: "authScopeId", type: "scalar" },
+      { key: "bi", path: "base44Id", type: "scalar" },
+      { key: "t", path: "type", type: "scalar", enum: ["company", "legalEntity", "facility"] },
+      { key: "nm", path: "name", type: "scalar" },
+      { key: "pi", path: "parentId", type: "scalar" }
+    ]
+  },
+  { key: "ro", path: "resourceOverrides", type: "scalar" }
+];
 var EnabledModule = {
   FARM_MANAGEMENT: "farm_management",
   PACKHOUSE: "packhouse",
@@ -932,6 +960,7 @@ export {
   UserRole,
   UserPrivilege,
   AccessLevel,
+  SESSION_SCHEMA,
   EnabledModule,
   FacilityType,
   LinkedStatus,

package/dist/{constants-BQmsBTQ7.d.mts → constants-BS1AZ5aN.d.mts}

@@ -7,10 +7,27 @@ interface AvailableScope {
     name: string;
     parentId: string | null;
 }
+interface RoleAssignment {
+    role: string;
+    privileges: string[];
+}
 interface CompanyConfig {
     isMultiEntity: boolean;
 }
 type UserRoleType = typeof UserRole[keyof typeof UserRole];
+type UserPrivilegeType = (typeof UserPrivilege)[keyof typeof UserPrivilege];
+interface UserRoleAssignment {
+    canonicalId: string;
+    userId: string;
+    companyId: string;
+    legalEntityId?: string;
+    facilityId?: string;
+    facilityIds?: string[];
+    authScopeId: string;
+    role: string;
+    privileges?: string[] | string;
+    isActive?: boolean;
+}
 type AccessLevelType = keyof typeof AccessLevel;
 /**
  * Deep map of scope IDs to resource paths and their permission levels.
@@ -28,15 +45,43 @@ interface AgriCoreSession {
     userName: string;
     userEmail: string;
     companyId: string;
-    activeScopeId: string | null;
-    companyConfig: CompanyConfig;
-    role: string;
-    privileges: string[];
+    activeScopeId: string;
+    companyConfig: {
+        isMultiEntity: boolean;
+    };
     enabledModules: string[];
-    readScopes: string[];
-    writeScopes: string[];
+    roleAssignments: Record<string, RoleAssignment>;
     availableScopes: AvailableScope[];
-    resourceOverrides: ResourceOverrides;
+    resourceOverrides: Record<string, Record<string, PermissionLevel>>;
+}
+type WireAvailableScope = [
+    authScopeId: string,
+    base44Id: string,
+    typeCode: number,
+    name: string,
+    parentId: string | null
+];
+interface WireSession {
+    u: string;
+    n: string;
+    e: string;
+    c: string;
+    a: string;
+    cc: {
+        me: boolean;
+    };
+    m: string[];
+    ra: Record<string, RoleAssignment>;
+    as: WireAvailableScope[];
+    ro: Record<string, Record<string, PermissionLevel>>;
+}
+type FieldType = "scalar" | "object" | "recordArray";
+interface SchemaField {
+    key: string;
+    path: string;
+    type: FieldType;
+    fields?: SchemaField[];
+    enum?: readonly string[];
 }
 interface ResolvedError {
     title: string;
@@ -216,6 +261,7 @@ declare const AccessLevel: {
     readonly READ: "READ";
     readonly WRITE: "WRITE";
 };
+declare const SESSION_SCHEMA: SchemaField[];
 declare const EnabledModule: {
     readonly FARM_MANAGEMENT: "farm_management";
     readonly PACKHOUSE: "packhouse";
@@ -634,4 +680,4 @@ declare const StockPolicyTier: {
     readonly BY_LOCATION: 3;
 };
 
-export { NettingType as $, ACCESS_RANK as A, BarcodeNamespace as B, CAR_SUPPORTED_EVIDENCE_MIME_TYPES as C, type CorrectiveActionCompileTaskMetadata as D, type CorrectiveActionGenerationSource as E, type CorrectiveActionStatus as F, CropCycleStatus as G, DOCUMENT_DISPLAY_INFO as H, DOCUMENT_MENU_MAP as I, DocumentCategory as J, DocumentType as K, ERROR_DICTIONARY as L, EVERYONE as M, EmitterType as N, EnabledModule as O, FORM_REGISTRY as P, FacilityType as Q, type FileUploadTaskType as R, type FormMeta as S, HarvestMethod as T, type InfrastructureFields as U, LinkedStatus as V, MOD as W, MODULE_LABELS as X, MicroclimateZone as Y, MimeType as Z, type ModCode as _, ACT as a, type NormalizedSignatureValue as a0, NotificationMode as a1, OrderStatus as a2, type PermissionLevel as a3, PhysicalState as a4, PlantingMethod as a5, ProductType as a6, type ProductTypeType as a7, ProductUnit as a8, type ProductUnitType as a9, type TemplateScopeLevel as aA, TransactionType as aB, TrellisType as aC, UserPrivilege as aD, UserRole as aE, type UserRoleType as aF, VigorRating as aG, WaterSource as aH, RESOURCE_MODULE_MAP as aa, RESOURCE_PATHS as ab, RESOURCE_REQUIREMENTS as ac, ROLE_SECTIONS_BY_KEY as ad, RelationshipType as ae, type ResolvedError as af, type ResourceOverrides as ag, type ResourceRequirement as ah, RowOrientation as ai, SENTINEL_UUID as aj, SIGNATURE_MODES as ak, type ScopeType as al, type SignatureInput as am, type SignatureMode as an, SoilTexture as ao, StockPolicyTier as ap, type StockPolicyTierType as aq, StoragePhases as ar, type StorageType as as, TASK_TYPE_REGISTRY as at, TEMPLATE_SCOPE_LEVELS as au, type TabConfig as av, TargetEntityType as aw, TaskStatus as ax, TaskType as ay, type TaskTypeConfig as az, AccessLevel as b, type AccessLevelType as c, type AgriCoreSession as d, ApprovalStatus as e, ApprovalType as f, AuditStatus as g, AuditType as h, type AuthScopeFields as i, type AvailableScope as j, type BarcodeNamespaceType as k, BarcodeType as l, type BarcodeTypeType as m, type Base44Id as n, CAR_SUPPORTED_SIGNATURE_MIME_TYPES as o, CAT as p, CATEGORY_TABS as q, CORRECTIVE_ACTION_GENERATION_SOURCES as r, CORRECTIVE_ACTION_STATUSES as s, type CanonicalId as t, type CarSupportedEvidenceMimeType as u, type CarSupportedSignatureMimeType as v, type CarTemplateFileMetadata as w, CatalogSyncStatus as x, type CatalogSyncStatusType as y, type CompanyConfig as z };
+export { NettingType as $, ACCESS_RANK as A, BarcodeNamespace as B, CAR_SUPPORTED_EVIDENCE_MIME_TYPES as C, type CorrectiveActionCompileTaskMetadata as D, type CorrectiveActionGenerationSource as E, type CorrectiveActionStatus as F, CropCycleStatus as G, DOCUMENT_DISPLAY_INFO as H, DOCUMENT_MENU_MAP as I, DocumentCategory as J, DocumentType as K, ERROR_DICTIONARY as L, EVERYONE as M, EmitterType as N, EnabledModule as O, FORM_REGISTRY as P, FacilityType as Q, type FileUploadTaskType as R, type FormMeta as S, HarvestMethod as T, type InfrastructureFields as U, LinkedStatus as V, MOD as W, MODULE_LABELS as X, MicroclimateZone as Y, MimeType as Z, type ModCode as _, ACT as a, type NormalizedSignatureValue as a0, NotificationMode as a1, OrderStatus as a2, type PermissionLevel as a3, PhysicalState as a4, PlantingMethod as a5, ProductType as a6, type ProductTypeType as a7, ProductUnit as a8, type ProductUnitType as a9, TaskStatus as aA, TaskType as aB, type TaskTypeConfig as aC, type TemplateScopeLevel as aD, TransactionType as aE, TrellisType as aF, UserPrivilege as aG, type UserPrivilegeType as aH, UserRole as aI, type UserRoleAssignment as aJ, type UserRoleType as aK, VigorRating as aL, WaterSource as aM, type WireSession as aN, RESOURCE_MODULE_MAP as aa, RESOURCE_PATHS as ab, RESOURCE_REQUIREMENTS as ac, ROLE_SECTIONS_BY_KEY as ad, RelationshipType as ae, type ResolvedError as af, type ResourceOverrides as ag, type ResourceRequirement as ah, type RoleAssignment as ai, RowOrientation as aj, SENTINEL_UUID as ak, SESSION_SCHEMA as al, SIGNATURE_MODES as am, type SchemaField as an, type ScopeType as ao, type SignatureInput as ap, type SignatureMode as aq, SoilTexture as ar, StockPolicyTier as as, type StockPolicyTierType as at, StoragePhases as au, type StorageType as av, TASK_TYPE_REGISTRY as aw, TEMPLATE_SCOPE_LEVELS as ax, type TabConfig as ay, TargetEntityType as az, AccessLevel as b, type AccessLevelType as c, type AgriCoreSession as d, ApprovalStatus as e, ApprovalType as f, AuditStatus as g, AuditType as h, type AuthScopeFields as i, type AvailableScope as j, type BarcodeNamespaceType as k, BarcodeType as l, type BarcodeTypeType as m, type Base44Id as n, CAR_SUPPORTED_SIGNATURE_MIME_TYPES as o, CAT as p, CATEGORY_TABS as q, CORRECTIVE_ACTION_GENERATION_SOURCES as r, CORRECTIVE_ACTION_STATUSES as s, type CanonicalId as t, type CarSupportedEvidenceMimeType as u, type CarSupportedSignatureMimeType as v, type CarTemplateFileMetadata as w, CatalogSyncStatus as x, type CatalogSyncStatusType as y, type CompanyConfig as z };

package/dist/{constants-BQmsBTQ7.d.ts → constants-BS1AZ5aN.d.ts}

@@ -7,10 +7,27 @@ interface AvailableScope {
     name: string;
     parentId: string | null;
 }
+interface RoleAssignment {
+    role: string;
+    privileges: string[];
+}
 interface CompanyConfig {
     isMultiEntity: boolean;
 }
 type UserRoleType = typeof UserRole[keyof typeof UserRole];
+type UserPrivilegeType = (typeof UserPrivilege)[keyof typeof UserPrivilege];
+interface UserRoleAssignment {
+    canonicalId: string;
+    userId: string;
+    companyId: string;
+    legalEntityId?: string;
+    facilityId?: string;
+    facilityIds?: string[];
+    authScopeId: string;
+    role: string;
+    privileges?: string[] | string;
+    isActive?: boolean;
+}
 type AccessLevelType = keyof typeof AccessLevel;
 /**
  * Deep map of scope IDs to resource paths and their permission levels.
@@ -28,15 +45,43 @@ interface AgriCoreSession {
     userName: string;
     userEmail: string;
     companyId: string;
-    activeScopeId: string | null;
-    companyConfig: CompanyConfig;
-    role: string;
-    privileges: string[];
+    activeScopeId: string;
+    companyConfig: {
+        isMultiEntity: boolean;
+    };
     enabledModules: string[];
-    readScopes: string[];
-    writeScopes: string[];
+    roleAssignments: Record<string, RoleAssignment>;
     availableScopes: AvailableScope[];
-    resourceOverrides: ResourceOverrides;
+    resourceOverrides: Record<string, Record<string, PermissionLevel>>;
+}
+type WireAvailableScope = [
+    authScopeId: string,
+    base44Id: string,
+    typeCode: number,
+    name: string,
+    parentId: string | null
+];
+interface WireSession {
+    u: string;
+    n: string;
+    e: string;
+    c: string;
+    a: string;
+    cc: {
+        me: boolean;
+    };
+    m: string[];
+    ra: Record<string, RoleAssignment>;
+    as: WireAvailableScope[];
+    ro: Record<string, Record<string, PermissionLevel>>;
+}
+type FieldType = "scalar" | "object" | "recordArray";
+interface SchemaField {
+    key: string;
+    path: string;
+    type: FieldType;
+    fields?: SchemaField[];
+    enum?: readonly string[];
 }
 interface ResolvedError {
     title: string;
@@ -216,6 +261,7 @@ declare const AccessLevel: {
     readonly READ: "READ";
     readonly WRITE: "WRITE";
 };
+declare const SESSION_SCHEMA: SchemaField[];
 declare const EnabledModule: {
     readonly FARM_MANAGEMENT: "farm_management";
     readonly PACKHOUSE: "packhouse";
@@ -634,4 +680,4 @@ declare const StockPolicyTier: {
     readonly BY_LOCATION: 3;
 };
 
-export { NettingType as $, ACCESS_RANK as A, BarcodeNamespace as B, CAR_SUPPORTED_EVIDENCE_MIME_TYPES as C, type CorrectiveActionCompileTaskMetadata as D, type CorrectiveActionGenerationSource as E, type CorrectiveActionStatus as F, CropCycleStatus as G, DOCUMENT_DISPLAY_INFO as H, DOCUMENT_MENU_MAP as I, DocumentCategory as J, DocumentType as K, ERROR_DICTIONARY as L, EVERYONE as M, EmitterType as N, EnabledModule as O, FORM_REGISTRY as P, FacilityType as Q, type FileUploadTaskType as R, type FormMeta as S, HarvestMethod as T, type InfrastructureFields as U, LinkedStatus as V, MOD as W, MODULE_LABELS as X, MicroclimateZone as Y, MimeType as Z, type ModCode as _, ACT as a, type NormalizedSignatureValue as a0, NotificationMode as a1, OrderStatus as a2, type PermissionLevel as a3, PhysicalState as a4, PlantingMethod as a5, ProductType as a6, type ProductTypeType as a7, ProductUnit as a8, type ProductUnitType as a9, type TemplateScopeLevel as aA, TransactionType as aB, TrellisType as aC, UserPrivilege as aD, UserRole as aE, type UserRoleType as aF, VigorRating as aG, WaterSource as aH, RESOURCE_MODULE_MAP as aa, RESOURCE_PATHS as ab, RESOURCE_REQUIREMENTS as ac, ROLE_SECTIONS_BY_KEY as ad, RelationshipType as ae, type ResolvedError as af, type ResourceOverrides as ag, type ResourceRequirement as ah, RowOrientation as ai, SENTINEL_UUID as aj, SIGNATURE_MODES as ak, type ScopeType as al, type SignatureInput as am, type SignatureMode as an, SoilTexture as ao, StockPolicyTier as ap, type StockPolicyTierType as aq, StoragePhases as ar, type StorageType as as, TASK_TYPE_REGISTRY as at, TEMPLATE_SCOPE_LEVELS as au, type TabConfig as av, TargetEntityType as aw, TaskStatus as ax, TaskType as ay, type TaskTypeConfig as az, AccessLevel as b, type AccessLevelType as c, type AgriCoreSession as d, ApprovalStatus as e, ApprovalType as f, AuditStatus as g, AuditType as h, type AuthScopeFields as i, type AvailableScope as j, type BarcodeNamespaceType as k, BarcodeType as l, type BarcodeTypeType as m, type Base44Id as n, CAR_SUPPORTED_SIGNATURE_MIME_TYPES as o, CAT as p, CATEGORY_TABS as q, CORRECTIVE_ACTION_GENERATION_SOURCES as r, CORRECTIVE_ACTION_STATUSES as s, type CanonicalId as t, type CarSupportedEvidenceMimeType as u, type CarSupportedSignatureMimeType as v, type CarTemplateFileMetadata as w, CatalogSyncStatus as x, type CatalogSyncStatusType as y, type CompanyConfig as z };
+export { NettingType as $, ACCESS_RANK as A, BarcodeNamespace as B, CAR_SUPPORTED_EVIDENCE_MIME_TYPES as C, type CorrectiveActionCompileTaskMetadata as D, type CorrectiveActionGenerationSource as E, type CorrectiveActionStatus as F, CropCycleStatus as G, DOCUMENT_DISPLAY_INFO as H, DOCUMENT_MENU_MAP as I, DocumentCategory as J, DocumentType as K, ERROR_DICTIONARY as L, EVERYONE as M, EmitterType as N, EnabledModule as O, FORM_REGISTRY as P, FacilityType as Q, type FileUploadTaskType as R, type FormMeta as S, HarvestMethod as T, type InfrastructureFields as U, LinkedStatus as V, MOD as W, MODULE_LABELS as X, MicroclimateZone as Y, MimeType as Z, type ModCode as _, ACT as a, type NormalizedSignatureValue as a0, NotificationMode as a1, OrderStatus as a2, type PermissionLevel as a3, PhysicalState as a4, PlantingMethod as a5, ProductType as a6, type ProductTypeType as a7, ProductUnit as a8, type ProductUnitType as a9, TaskStatus as aA, TaskType as aB, type TaskTypeConfig as aC, type TemplateScopeLevel as aD, TransactionType as aE, TrellisType as aF, UserPrivilege as aG, type UserPrivilegeType as aH, UserRole as aI, type UserRoleAssignment as aJ, type UserRoleType as aK, VigorRating as aL, WaterSource as aM, type WireSession as aN, RESOURCE_MODULE_MAP as aa, RESOURCE_PATHS as ab, RESOURCE_REQUIREMENTS as ac, ROLE_SECTIONS_BY_KEY as ad, RelationshipType as ae, type ResolvedError as af, type ResourceOverrides as ag, type ResourceRequirement as ah, type RoleAssignment as ai, RowOrientation as aj, SENTINEL_UUID as ak, SESSION_SCHEMA as al, SIGNATURE_MODES as am, type SchemaField as an, type ScopeType as ao, type SignatureInput as ap, type SignatureMode as aq, SoilTexture as ar, StockPolicyTier as as, type StockPolicyTierType as at, StoragePhases as au, type StorageType as av, TASK_TYPE_REGISTRY as aw, TEMPLATE_SCOPE_LEVELS as ax, type TabConfig as ay, TargetEntityType as az, AccessLevel as b, type AccessLevelType as c, type AgriCoreSession as d, ApprovalStatus as e, ApprovalType as f, AuditStatus as g, AuditType as h, type AuthScopeFields as i, type AvailableScope as j, type BarcodeNamespaceType as k, BarcodeType as l, type BarcodeTypeType as m, type Base44Id as n, CAR_SUPPORTED_SIGNATURE_MIME_TYPES as o, CAT as p, CATEGORY_TABS as q, CORRECTIVE_ACTION_GENERATION_SOURCES as r, CORRECTIVE_ACTION_STATUSES as s, type CanonicalId as t, type CarSupportedEvidenceMimeType as u, type CarSupportedSignatureMimeType as v, type CarTemplateFileMetadata as w, CatalogSyncStatus as x, type CatalogSyncStatusType as y, type CompanyConfig as z };

package/dist/constants.d.mts

@@ -1 +1 @@
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, ai as RowOrientation, aj as SENTINEL_UUID, ak as SIGNATURE_MODES, ao as SoilTexture, ap as StockPolicyTier, ar as StoragePhases, at as TASK_TYPE_REGISTRY, au as TEMPLATE_SCOPE_LEVELS, aw as TargetEntityType, ax as TaskStatus, ay as TaskType, aB as TransactionType, aC as TrellisType, aD as UserPrivilege, aE as UserRole, aG as VigorRating, aH as WaterSource } from './constants-BQmsBTQ7.mjs';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, ar as SoilTexture, as as StockPolicyTier, au as StoragePhases, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aI as UserRole, aL as VigorRating, aM as WaterSource } from './constants-BS1AZ5aN.mjs';

package/dist/constants.d.ts

@@ -1 +1 @@
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, ai as RowOrientation, aj as SENTINEL_UUID, ak as SIGNATURE_MODES, ao as SoilTexture, ap as StockPolicyTier, ar as StoragePhases, at as TASK_TYPE_REGISTRY, au as TEMPLATE_SCOPE_LEVELS, aw as TargetEntityType, ax as TaskStatus, ay as TaskType, aB as TransactionType, aC as TrellisType, aD as UserPrivilege, aE as UserRole, aG as VigorRating, aH as WaterSource } from './constants-BQmsBTQ7.js';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, ar as SoilTexture, as as StockPolicyTier, au as StoragePhases, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aI as UserRole, aL as VigorRating, aM as WaterSource } from './constants-BS1AZ5aN.js';

package/dist/constants.js

@@ -67,6 +67,7 @@ __export(constants_exports, {
   RelationshipType: () => RelationshipType,
   RowOrientation: () => RowOrientation,
   SENTINEL_UUID: () => SENTINEL_UUID,
+  SESSION_SCHEMA: () => SESSION_SCHEMA,
   SIGNATURE_MODES: () => SIGNATURE_MODES,
   SoilTexture: () => SoilTexture,
   StockPolicyTier: () => StockPolicyTier,
@@ -169,6 +170,34 @@ var AccessLevel = {
   READ: "READ",
   WRITE: "WRITE"
 };
+var SESSION_SCHEMA = [
+  { key: "u", path: "userId", type: "scalar" },
+  { key: "n", path: "userName", type: "scalar" },
+  { key: "e", path: "userEmail", type: "scalar" },
+  { key: "c", path: "companyId", type: "scalar" },
+  { key: "a", path: "activeScopeId", type: "scalar" },
+  {
+    key: "cc",
+    path: "companyConfig",
+    type: "object",
+    fields: [{ key: "me", path: "isMultiEntity", type: "scalar" }]
+  },
+  { key: "m", path: "enabledModules", type: "scalar" },
+  { key: "ra", path: "roleAssignments", type: "scalar" },
+  {
+    key: "as",
+    path: "availableScopes",
+    type: "recordArray",
+    fields: [
+      { key: "ai", path: "authScopeId", type: "scalar" },
+      { key: "bi", path: "base44Id", type: "scalar" },
+      { key: "t", path: "type", type: "scalar", enum: ["company", "legalEntity", "facility"] },
+      { key: "nm", path: "name", type: "scalar" },
+      { key: "pi", path: "parentId", type: "scalar" }
+    ]
+  },
+  { key: "ro", path: "resourceOverrides", type: "scalar" }
+];
 var EnabledModule = {
   FARM_MANAGEMENT: "farm_management",
   PACKHOUSE: "packhouse",
@@ -1055,6 +1084,7 @@ var StockPolicyTier = {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,

package/dist/constants.mjs

@@ -46,6 +46,7 @@ import {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,
@@ -61,7 +62,7 @@ import {
   UserRole,
   VigorRating,
   WaterSource
-} from "./chunk-DZW2VL6D.mjs";
+} from "./chunk-V2DL7OTH.mjs";
 export {
   ACCESS_RANK,
   ACT,
@@ -110,6 +111,7 @@ export {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { d as AgriCoreSession, aF as UserRoleType, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, av as TabConfig, af as ResolvedError } from './constants-BQmsBTQ7.mjs';
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RowOrientation, aj as SENTINEL_UUID, ak as SIGNATURE_MODES, al as ScopeType, am as SignatureInput, an as SignatureMode, ao as SoilTexture, ap as StockPolicyTier, aq as StockPolicyTierType, ar as StoragePhases, as as StorageType, at as TASK_TYPE_REGISTRY, au as TEMPLATE_SCOPE_LEVELS, aw as TargetEntityType, ax as TaskStatus, ay as TaskType, az as TaskTypeConfig, aA as TemplateScopeLevel, aB as TransactionType, aC as TrellisType, aD as UserPrivilege, aE as UserRole, aG as VigorRating, aH as WaterSource } from './constants-BQmsBTQ7.mjs';
+import { d as AgriCoreSession, ao as ScopeType, aN as WireSession, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError, aJ as UserRoleAssignment } from './constants-BS1AZ5aN.mjs';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserPrivilegeType, aI as UserRole, aK as UserRoleType, aL as VigorRating, aM as WaterSource } from './constants-BS1AZ5aN.mjs';
 
 declare const AgriLogger: {
     log(level: "INFO" | "WARN" | "ERROR", message: string, meta: any): void;
@@ -105,9 +105,33 @@ declare function generateCanonicalId(): string;
  */
 declare function generateInfrastructureFields(activeScope: AvailableScope, availableScopes: AvailableScope[]): InfrastructureFields;
 /**
- * Hard-throws if the user cannot write.
- * Use this on the backend (inside Deno functions) to enforce server-side.
+ * Walks up the scope tree from activeScopeId to the root (Company).
+ * Returns an array of scope IDs including the active one and all parents.
  */
+declare function getScopeAncestry(activeScopeId: string, availableScopes: AvailableScope[]): string[];
+declare function encodeSession(session: AgriCoreSession): WireSession;
+declare function decodeSession(short: WireSession): AgriCoreSession;
+/**
+ * Transforms flat UserRoleAssignment records into the roleAssignments map.
+ * Defensive by design: a single malformed row must not break token
+ * generation for the whole login. Bad rows are skipped and logged,
+ * never thrown — login should degrade gracefully, not fail hard.
+ */
+declare function transformRoleAssignments(assignments: UserRoleAssignment[]): Record<string, {
+    role: string;
+    privileges: string[];
+}>;
+/**
+ * "Does this user hold this role/privilege AT this specific scope?"
+ * This is the default choice for any authorization gate evaluating
+ * "can the user perform this action on the resource/scope they're
+ * currently acting on." No inheritance — only an explicit assignment
+ * at exactly this authScopeId counts, matching the no-inherit-write rule.
+ */
+declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
+declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
+declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
+declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
 /**
  * Full resolution: DB override → static config fallback → public default.
  * Returns 'NONE' | 'READ' | 'WRITE'.
@@ -115,11 +139,7 @@ declare function generateInfrastructureFields(activeScope: AvailableScope, avail
 declare function resolveAccess(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): 'NONE' | 'READ' | 'WRITE';
 declare function isTabVisible(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): boolean;
 declare function isTabWritable(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): boolean;
-declare function evaluateBaseAccess(resourcePath: string, session: {
-    role?: UserRoleType;
-    privileges?: string[];
-    enabledModules?: string[];
-}, requirements?: ResourceRequirement): AccessLevelType;
+declare function evaluateBaseAccess(resourcePath: string, session: AgriCoreSession, activeScopeId: string, requirements?: ResourceRequirement): AccessLevelType;
 /**
  * The Judge: Overrides win over base access (Specificity principle).
  */
@@ -129,7 +149,7 @@ declare function assertTenantBoundary(db: any, session: AgriCoreSession, // Pass
 targets: {
     targetUserId?: string;
     authScopeId?: string;
-    expectedScopeType?: 'company' | 'legalEntity' | 'facility';
+    expectedScopeType?: ScopeType;
 }): Promise<boolean>;
 declare function verifyAndExtractSession(token: string, secret: string): Promise<AgriCoreSession>;
 declare function getFormMeta(componentId: string): FormMeta | null;
@@ -163,4 +183,4 @@ declare function calculateFileMetadataMatch(criteria: {
     contextMatch?: string[];
 }, fileMetadata: Record<string, any>, auditContext: Record<string, any>): number;
 
-export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, TabConfig, UserRoleType, Validator, assertTenantBoundary, calculateFileMetadataMatch, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getTaskTypeOptions, handleAppErrorResponse, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, verifyAndExtractSession, withAgriLogging };
+export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, ScopeType, TabConfig, UserRoleAssignment, Validator, WireSession, assertTenantBoundary, calculateFileMetadataMatch, decodeSession, encodeSession, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getPrivilegesAt, getRoleAt, getScopeAncestry, getTaskTypeOptions, handleAppErrorResponse, hasPrivilegeAt, hasRoleAt, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, transformRoleAssignments, verifyAndExtractSession, withAgriLogging };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { d as AgriCoreSession, aF as UserRoleType, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, av as TabConfig, af as ResolvedError } from './constants-BQmsBTQ7.js';
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RowOrientation, aj as SENTINEL_UUID, ak as SIGNATURE_MODES, al as ScopeType, am as SignatureInput, an as SignatureMode, ao as SoilTexture, ap as StockPolicyTier, aq as StockPolicyTierType, ar as StoragePhases, as as StorageType, at as TASK_TYPE_REGISTRY, au as TEMPLATE_SCOPE_LEVELS, aw as TargetEntityType, ax as TaskStatus, ay as TaskType, az as TaskTypeConfig, aA as TemplateScopeLevel, aB as TransactionType, aC as TrellisType, aD as UserPrivilege, aE as UserRole, aG as VigorRating, aH as WaterSource } from './constants-BQmsBTQ7.js';
+import { d as AgriCoreSession, ao as ScopeType, aN as WireSession, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError, aJ as UserRoleAssignment } from './constants-BS1AZ5aN.js';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserPrivilegeType, aI as UserRole, aK as UserRoleType, aL as VigorRating, aM as WaterSource } from './constants-BS1AZ5aN.js';
 
 declare const AgriLogger: {
     log(level: "INFO" | "WARN" | "ERROR", message: string, meta: any): void;
@@ -105,9 +105,33 @@ declare function generateCanonicalId(): string;
  */
 declare function generateInfrastructureFields(activeScope: AvailableScope, availableScopes: AvailableScope[]): InfrastructureFields;
 /**
- * Hard-throws if the user cannot write.
- * Use this on the backend (inside Deno functions) to enforce server-side.
+ * Walks up the scope tree from activeScopeId to the root (Company).
+ * Returns an array of scope IDs including the active one and all parents.
  */
+declare function getScopeAncestry(activeScopeId: string, availableScopes: AvailableScope[]): string[];
+declare function encodeSession(session: AgriCoreSession): WireSession;
+declare function decodeSession(short: WireSession): AgriCoreSession;
+/**
+ * Transforms flat UserRoleAssignment records into the roleAssignments map.
+ * Defensive by design: a single malformed row must not break token
+ * generation for the whole login. Bad rows are skipped and logged,
+ * never thrown — login should degrade gracefully, not fail hard.
+ */
+declare function transformRoleAssignments(assignments: UserRoleAssignment[]): Record<string, {
+    role: string;
+    privileges: string[];
+}>;
+/**
+ * "Does this user hold this role/privilege AT this specific scope?"
+ * This is the default choice for any authorization gate evaluating
+ * "can the user perform this action on the resource/scope they're
+ * currently acting on." No inheritance — only an explicit assignment
+ * at exactly this authScopeId counts, matching the no-inherit-write rule.
+ */
+declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
+declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
+declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
+declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
 /**
  * Full resolution: DB override → static config fallback → public default.
  * Returns 'NONE' | 'READ' | 'WRITE'.
@@ -115,11 +139,7 @@ declare function generateInfrastructureFields(activeScope: AvailableScope, avail
 declare function resolveAccess(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): 'NONE' | 'READ' | 'WRITE';
 declare function isTabVisible(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): boolean;
 declare function isTabWritable(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): boolean;
-declare function evaluateBaseAccess(resourcePath: string, session: {
-    role?: UserRoleType;
-    privileges?: string[];
-    enabledModules?: string[];
-}, requirements?: ResourceRequirement): AccessLevelType;
+declare function evaluateBaseAccess(resourcePath: string, session: AgriCoreSession, activeScopeId: string, requirements?: ResourceRequirement): AccessLevelType;
 /**
  * The Judge: Overrides win over base access (Specificity principle).
  */
@@ -129,7 +149,7 @@ declare function assertTenantBoundary(db: any, session: AgriCoreSession, // Pass
 targets: {
     targetUserId?: string;
     authScopeId?: string;
-    expectedScopeType?: 'company' | 'legalEntity' | 'facility';
+    expectedScopeType?: ScopeType;
 }): Promise<boolean>;
 declare function verifyAndExtractSession(token: string, secret: string): Promise<AgriCoreSession>;
 declare function getFormMeta(componentId: string): FormMeta | null;
@@ -163,4 +183,4 @@ declare function calculateFileMetadataMatch(criteria: {
     contextMatch?: string[];
 }, fileMetadata: Record<string, any>, auditContext: Record<string, any>): number;
 
-export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, TabConfig, UserRoleType, Validator, assertTenantBoundary, calculateFileMetadataMatch, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getTaskTypeOptions, handleAppErrorResponse, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, verifyAndExtractSession, withAgriLogging };
+export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, ScopeType, TabConfig, UserRoleAssignment, Validator, WireSession, assertTenantBoundary, calculateFileMetadataMatch, decodeSession, encodeSession, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getPrivilegesAt, getRoleAt, getScopeAncestry, getTaskTypeOptions, handleAppErrorResponse, hasPrivilegeAt, hasRoleAt, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, transformRoleAssignments, verifyAndExtractSession, withAgriLogging };

package/dist/index.js

@@ -71,6 +71,7 @@ __export(index_exports, {
   RelationshipType: () => RelationshipType,
   RowOrientation: () => RowOrientation,
   SENTINEL_UUID: () => SENTINEL_UUID,
+  SESSION_SCHEMA: () => SESSION_SCHEMA,
   SIGNATURE_MODES: () => SIGNATURE_MODES,
   SoilTexture: () => SoilTexture,
   StockPolicyTier: () => StockPolicyTier,
@@ -89,6 +90,8 @@ __export(index_exports, {
   WaterSource: () => WaterSource,
   assertTenantBoundary: () => assertTenantBoundary,
   calculateFileMetadataMatch: () => calculateFileMetadataMatch,
+  decodeSession: () => decodeSession,
+  encodeSession: () => encodeSession,
   evaluateBaseAccess: () => evaluateBaseAccess,
   extractAppCode: () => extractAppCode,
   findSpecificOverride: () => findSpecificOverride,
@@ -99,14 +102,20 @@ __export(index_exports, {
   getApproveAction: () => getApproveAction,
   getFormMeta: () => getFormMeta,
   getFormsGroupedByModule: () => getFormsGroupedByModule,
+  getPrivilegesAt: () => getPrivilegesAt,
+  getRoleAt: () => getRoleAt,
+  getScopeAncestry: () => getScopeAncestry,
   getTaskTypeOptions: () => getTaskTypeOptions,
   handleAppErrorResponse: () => handleAppErrorResponse,
+  hasPrivilegeAt: () => hasPrivilegeAt,
+  hasRoleAt: () => hasRoleAt,
   isTabVisible: () => isTabVisible,
   isTabWritable: () => isTabWritable,
   resolveAccess: () => resolveAccess,
   resolveAppError: () => resolveAppError,
   resolveEffectiveAccess: () => resolveEffectiveAccess,
   resolveError: () => resolveError,
+  transformRoleAssignments: () => transformRoleAssignments,
   verifyAndExtractSession: () => verifyAndExtractSession,
   withAgriLogging: () => withAgriLogging
 });
@@ -385,6 +394,34 @@ var AccessLevel = {
   READ: "READ",
   WRITE: "WRITE"
 };
+var SESSION_SCHEMA = [
+  { key: "u", path: "userId", type: "scalar" },
+  { key: "n", path: "userName", type: "scalar" },
+  { key: "e", path: "userEmail", type: "scalar" },
+  { key: "c", path: "companyId", type: "scalar" },
+  { key: "a", path: "activeScopeId", type: "scalar" },
+  {
+    key: "cc",
+    path: "companyConfig",
+    type: "object",
+    fields: [{ key: "me", path: "isMultiEntity", type: "scalar" }]
+  },
+  { key: "m", path: "enabledModules", type: "scalar" },
+  { key: "ra", path: "roleAssignments", type: "scalar" },
+  {
+    key: "as",
+    path: "availableScopes",
+    type: "recordArray",
+    fields: [
+      { key: "ai", path: "authScopeId", type: "scalar" },
+      { key: "bi", path: "base44Id", type: "scalar" },
+      { key: "t", path: "type", type: "scalar", enum: ["company", "legalEntity", "facility"] },
+      { key: "nm", path: "name", type: "scalar" },
+      { key: "pi", path: "parentId", type: "scalar" }
+    ]
+  },
+  { key: "ro", path: "resourceOverrides", type: "scalar" }
+];
 var EnabledModule = {
   FARM_MANAGEMENT: "farm_management",
   PACKHOUSE: "packhouse",
@@ -1331,6 +1368,164 @@ function generateInfrastructureFields(activeScope, availableScopes) {
     authScopeId: activeScope.authScopeId
   };
 }
+function getScopeAncestry(activeScopeId, availableScopes) {
+  const ancestry = [activeScopeId];
+  let pointer = availableScopes.find((s) => s.authScopeId === activeScopeId);
+  let guard = 0;
+  while (pointer && pointer.parentId && guard++ < availableScopes.length) {
+    const parent = availableScopes.find((s) => s.base44Id === pointer.parentId);
+    if (!parent) break;
+    ancestry.push(parent.authScopeId);
+    pointer = parent;
+  }
+  return ancestry;
+}
+function encodeField(field, value) {
+  if (value === void 0) return void 0;
+  switch (field.type) {
+    case "object": {
+      const out = {};
+      for (const sub of field.fields ?? []) {
+        out[sub.key] = encodeField(sub, value[sub.path]);
+      }
+      return out;
+    }
+    case "recordArray": {
+      return value.map(
+        (record) => (field.fields ?? []).map((sub) => {
+          const raw = record[sub.path];
+          if (sub.enum) {
+            const code = sub.enum.indexOf(raw);
+            if (code === -1) {
+              throw new Error(
+                `sessionSchema: value "${raw}" for "${sub.path}" not in enum [${sub.enum.join(", ")}]. Add it to the enum in SESSION_SCHEMA before encoding.`
+              );
+            }
+            return code;
+          }
+          return raw;
+        })
+      );
+    }
+    default:
+      return value;
+  }
+}
+function decodeField(field, value) {
+  if (value === void 0) return void 0;
+  switch (field.type) {
+    case "object": {
+      const out = {};
+      for (const sub of field.fields ?? []) {
+        out[sub.path] = decodeField(sub, value[sub.key]);
+      }
+      return out;
+    }
+    case "recordArray": {
+      return value.map((tuple) => {
+        const out = {};
+        (field.fields ?? []).forEach((sub, i) => {
+          const raw = tuple[i];
+          out[sub.path] = sub.enum ? sub.enum[raw] : raw;
+        });
+        return out;
+      });
+    }
+    default:
+      return value;
+  }
+}
+function encodeSession(session) {
+  const out = {};
+  const sessionRecord = session;
+  for (const field of SESSION_SCHEMA) {
+    const encoded = encodeField(field, sessionRecord[field.path]);
+    if (encoded !== void 0) out[field.key] = encoded;
+  }
+  return out;
+}
+function decodeSession(short) {
+  const out = {};
+  const shortRecord = short;
+  for (const field of SESSION_SCHEMA) {
+    const decoded = decodeField(field, shortRecord[field.key]);
+    if (decoded !== void 0) out[field.path] = decoded;
+  }
+  return out;
+}
+function transformRoleAssignments(assignments) {
+  const result = {};
+  for (const assignment of assignments) {
+    if (!assignment.isActive || !assignment.authScopeId) continue;
+    if (!assignment.role) {
+      console.warn(
+        `[transformRoleAssignments] Skipping assignment ${assignment.canonicalId ?? "(no canonicalId)"} at scope ${assignment.authScopeId}: missing role.`
+      );
+      continue;
+    }
+    let privileges;
+    if (Array.isArray(assignment.privileges)) {
+      privileges = assignment.privileges;
+    } else if (typeof assignment.privileges === "string") {
+      try {
+        const parsed = JSON.parse(assignment.privileges);
+        if (!Array.isArray(parsed)) {
+          console.warn(
+            `[transformRoleAssignments] Privileges for scope ${assignment.authScopeId} parsed to non-array, defaulting to []. Raw: ${assignment.privileges}`
+          );
+          privileges = [];
+        } else {
+          privileges = parsed;
+        }
+      } catch {
+        console.warn(
+          `[transformRoleAssignments] Failed to parse privileges JSON for scope ${assignment.authScopeId}, defaulting to []. Raw: ${assignment.privileges}`
+        );
+        privileges = [];
+      }
+    } else {
+      privileges = [];
+    }
+    if (result[assignment.authScopeId]) {
+      console.warn(
+        `[transformRoleAssignments] UNEXPECTED: duplicate active assignment at scope ${assignment.authScopeId} (violates unique_user_scope_assignment constraint if this is real DB data) \u2014 overwriting role "${result[assignment.authScopeId].role}" with "${assignment.role}", merging privileges.`
+      );
+      privileges = [.../* @__PURE__ */ new Set([...result[assignment.authScopeId].privileges, ...privileges])];
+    }
+    result[assignment.authScopeId] = { role: assignment.role, privileges };
+  }
+  return result;
+}
+(function validateSchema(fields = SESSION_SCHEMA, seen = /* @__PURE__ */ new Set(), pathPrefix = "") {
+  for (const f of fields) {
+    if (seen.has(f.key)) {
+      throw new Error(
+        `sessionSchema: duplicate short key "${f.key}" detected near "${pathPrefix}${f.path}". Every key must be unique within its object level.`
+      );
+    }
+    seen.add(f.key);
+    if (f.fields && f.type === "object") {
+      validateSchema(f.fields, /* @__PURE__ */ new Set(), `${pathPrefix}${f.path}.`);
+    }
+  }
+})();
+function getRoleAt(session, scopeId) {
+  if (!scopeId) return null;
+  return session.roleAssignments?.[scopeId]?.role ?? null;
+}
+function hasRoleAt(session, scopeId, allowedRoles) {
+  const role = getRoleAt(session, scopeId);
+  if (!role) return false;
+  return allowedRoles instanceof Set ? allowedRoles.has(role) : allowedRoles.includes(role);
+}
+function getPrivilegesAt(session, scopeId) {
+  if (!scopeId) return [];
+  return session.roleAssignments?.[scopeId]?.privileges ?? [];
+}
+function hasPrivilegeAt(session, scopeId, requiredPrivileges) {
+  const privileges = getPrivilegesAt(session, scopeId);
+  return requiredPrivileges.some((p) => privileges.includes(p));
+}
 function resolveAccess(session, activeScopeId, tabConfig) {
   const resourcePath = tabConfig?.resourceId;
   const overrides = session.resourceOverrides?.[activeScopeId] ?? {};
@@ -1346,13 +1541,15 @@ function resolveAccess(session, activeScopeId, tabConfig) {
   const requiredPrivileges = tabConfig?.requiredPrivileges ?? [];
   const hasRestrictions = allowedRoles.length > 0 || requiredPrivileges.length > 0;
   if (hasRestrictions) {
-    const role = session?.role ?? "";
-    const privileges = session?.privileges ?? [];
+    const assignment = session?.roleAssignments?.[activeScopeId];
+    const role = assignment?.role ?? "";
+    const privileges = assignment?.privileges ?? [];
     const passesRole = allowedRoles.length > 0 && allowedRoles.includes(role);
     const passesPrivilege = requiredPrivileges.length > 0 && requiredPrivileges.some((p) => privileges.includes(p));
     return passesRole || passesPrivilege ? "WRITE" : "NONE";
   }
-  return "READ";
+  console.warn("");
+  return "NONE";
 }
 function isTabVisible(session, activeScopeId, tabConfig) {
   return resolveAccess(session, activeScopeId, tabConfig) !== "NONE";
@@ -1360,9 +1557,11 @@ function isTabVisible(session, activeScopeId, tabConfig) {
 function isTabWritable(session, activeScopeId, tabConfig) {
   return resolveAccess(session, activeScopeId, tabConfig) === "WRITE";
 }
-function evaluateBaseAccess(resourcePath, session, requirements = {}) {
-  if (!session?.role) return "NONE";
-  if (session.role === UserRole.OWNER) return "WRITE";
+function evaluateBaseAccess(resourcePath, session, activeScopeId, requirements = {}) {
+  const role = getRoleAt(session, activeScopeId);
+  const privileges = getPrivilegesAt(session, activeScopeId);
+  if (!role) return "NONE";
+  if (role === UserRole.OWNER) return "WRITE";
   const requiredModules = RESOURCE_MODULE_MAP[resourcePath] || [];
   if (requiredModules.length > 0) {
     const hasModule = requiredModules.some((m) => session.enabledModules?.includes(m));
@@ -1371,12 +1570,12 @@ function evaluateBaseAccess(resourcePath, session, requirements = {}) {
   const topLevel = resourcePath.split(".")[0];
   const defaultRoles = ROLE_SECTIONS_BY_KEY[topLevel] || [];
   const allowedRoles = requirements.allowedRoles?.length ? requirements.allowedRoles : defaultRoles;
-  if (!allowedRoles.includes(session.role)) return "NONE";
+  if (!allowedRoles.includes(role)) return "NONE";
   if (requirements.requiredPrivileges?.length) {
-    const hasPrivilege = requirements.requiredPrivileges.some((p) => session.privileges?.includes(p));
+    const hasPrivilege = requirements.requiredPrivileges.some((p) => privileges.includes(p));
     if (!hasPrivilege) return "NONE";
   }
-  return session.role === UserRole.MANAGER ? "WRITE" : "READ";
+  return role === UserRole.MANAGER ? "WRITE" : "READ";
 }
 function resolveEffectiveAccess(base, override) {
   return override === void 0 || override === null ? base : override;
@@ -1551,6 +1750,7 @@ function calculateFileMetadataMatch(criteria, fileMetadata, auditContext) {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,
@@ -1569,6 +1769,8 @@ function calculateFileMetadataMatch(criteria, fileMetadata, auditContext) {
   WaterSource,
   assertTenantBoundary,
   calculateFileMetadataMatch,
+  decodeSession,
+  encodeSession,
   evaluateBaseAccess,
   extractAppCode,
   findSpecificOverride,
@@ -1579,14 +1781,20 @@ function calculateFileMetadataMatch(criteria, fileMetadata, auditContext) {
   getApproveAction,
   getFormMeta,
   getFormsGroupedByModule,
+  getPrivilegesAt,
+  getRoleAt,
+  getScopeAncestry,
   getTaskTypeOptions,
   handleAppErrorResponse,
+  hasPrivilegeAt,
+  hasRoleAt,
   isTabVisible,
   isTabWritable,
   resolveAccess,
   resolveAppError,
   resolveEffectiveAccess,
   resolveError,
+  transformRoleAssignments,
   verifyAndExtractSession,
   withAgriLogging
 });

package/dist/index.mjs

@@ -46,6 +46,7 @@ import {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,
@@ -61,7 +62,7 @@ import {
   UserRole,
   VigorRating,
   WaterSource
-} from "./chunk-DZW2VL6D.mjs";
+} from "./chunk-V2DL7OTH.mjs";
 
 // src/index.ts
 import { jwtVerify } from "jose";
@@ -360,6 +361,164 @@ function generateInfrastructureFields(activeScope, availableScopes) {
     authScopeId: activeScope.authScopeId
   };
 }
+function getScopeAncestry(activeScopeId, availableScopes) {
+  const ancestry = [activeScopeId];
+  let pointer = availableScopes.find((s) => s.authScopeId === activeScopeId);
+  let guard = 0;
+  while (pointer && pointer.parentId && guard++ < availableScopes.length) {
+    const parent = availableScopes.find((s) => s.base44Id === pointer.parentId);
+    if (!parent) break;
+    ancestry.push(parent.authScopeId);
+    pointer = parent;
+  }
+  return ancestry;
+}
+function encodeField(field, value) {
+  if (value === void 0) return void 0;
+  switch (field.type) {
+    case "object": {
+      const out = {};
+      for (const sub of field.fields ?? []) {
+        out[sub.key] = encodeField(sub, value[sub.path]);
+      }
+      return out;
+    }
+    case "recordArray": {
+      return value.map(
+        (record) => (field.fields ?? []).map((sub) => {
+          const raw = record[sub.path];
+          if (sub.enum) {
+            const code = sub.enum.indexOf(raw);
+            if (code === -1) {
+              throw new Error(
+                `sessionSchema: value "${raw}" for "${sub.path}" not in enum [${sub.enum.join(", ")}]. Add it to the enum in SESSION_SCHEMA before encoding.`
+              );
+            }
+            return code;
+          }
+          return raw;
+        })
+      );
+    }
+    default:
+      return value;
+  }
+}
+function decodeField(field, value) {
+  if (value === void 0) return void 0;
+  switch (field.type) {
+    case "object": {
+      const out = {};
+      for (const sub of field.fields ?? []) {
+        out[sub.path] = decodeField(sub, value[sub.key]);
+      }
+      return out;
+    }
+    case "recordArray": {
+      return value.map((tuple) => {
+        const out = {};
+        (field.fields ?? []).forEach((sub, i) => {
+          const raw = tuple[i];
+          out[sub.path] = sub.enum ? sub.enum[raw] : raw;
+        });
+        return out;
+      });
+    }
+    default:
+      return value;
+  }
+}
+function encodeSession(session) {
+  const out = {};
+  const sessionRecord = session;
+  for (const field of SESSION_SCHEMA) {
+    const encoded = encodeField(field, sessionRecord[field.path]);
+    if (encoded !== void 0) out[field.key] = encoded;
+  }
+  return out;
+}
+function decodeSession(short) {
+  const out = {};
+  const shortRecord = short;
+  for (const field of SESSION_SCHEMA) {
+    const decoded = decodeField(field, shortRecord[field.key]);
+    if (decoded !== void 0) out[field.path] = decoded;
+  }
+  return out;
+}
+function transformRoleAssignments(assignments) {
+  const result = {};
+  for (const assignment of assignments) {
+    if (!assignment.isActive || !assignment.authScopeId) continue;
+    if (!assignment.role) {
+      console.warn(
+        `[transformRoleAssignments] Skipping assignment ${assignment.canonicalId ?? "(no canonicalId)"} at scope ${assignment.authScopeId}: missing role.`
+      );
+      continue;
+    }
+    let privileges;
+    if (Array.isArray(assignment.privileges)) {
+      privileges = assignment.privileges;
+    } else if (typeof assignment.privileges === "string") {
+      try {
+        const parsed = JSON.parse(assignment.privileges);
+        if (!Array.isArray(parsed)) {
+          console.warn(
+            `[transformRoleAssignments] Privileges for scope ${assignment.authScopeId} parsed to non-array, defaulting to []. Raw: ${assignment.privileges}`
+          );
+          privileges = [];
+        } else {
+          privileges = parsed;
+        }
+      } catch {
+        console.warn(
+          `[transformRoleAssignments] Failed to parse privileges JSON for scope ${assignment.authScopeId}, defaulting to []. Raw: ${assignment.privileges}`
+        );
+        privileges = [];
+      }
+    } else {
+      privileges = [];
+    }
+    if (result[assignment.authScopeId]) {
+      console.warn(
+        `[transformRoleAssignments] UNEXPECTED: duplicate active assignment at scope ${assignment.authScopeId} (violates unique_user_scope_assignment constraint if this is real DB data) \u2014 overwriting role "${result[assignment.authScopeId].role}" with "${assignment.role}", merging privileges.`
+      );
+      privileges = [.../* @__PURE__ */ new Set([...result[assignment.authScopeId].privileges, ...privileges])];
+    }
+    result[assignment.authScopeId] = { role: assignment.role, privileges };
+  }
+  return result;
+}
+(function validateSchema(fields = SESSION_SCHEMA, seen = /* @__PURE__ */ new Set(), pathPrefix = "") {
+  for (const f of fields) {
+    if (seen.has(f.key)) {
+      throw new Error(
+        `sessionSchema: duplicate short key "${f.key}" detected near "${pathPrefix}${f.path}". Every key must be unique within its object level.`
+      );
+    }
+    seen.add(f.key);
+    if (f.fields && f.type === "object") {
+      validateSchema(f.fields, /* @__PURE__ */ new Set(), `${pathPrefix}${f.path}.`);
+    }
+  }
+})();
+function getRoleAt(session, scopeId) {
+  if (!scopeId) return null;
+  return session.roleAssignments?.[scopeId]?.role ?? null;
+}
+function hasRoleAt(session, scopeId, allowedRoles) {
+  const role = getRoleAt(session, scopeId);
+  if (!role) return false;
+  return allowedRoles instanceof Set ? allowedRoles.has(role) : allowedRoles.includes(role);
+}
+function getPrivilegesAt(session, scopeId) {
+  if (!scopeId) return [];
+  return session.roleAssignments?.[scopeId]?.privileges ?? [];
+}
+function hasPrivilegeAt(session, scopeId, requiredPrivileges) {
+  const privileges = getPrivilegesAt(session, scopeId);
+  return requiredPrivileges.some((p) => privileges.includes(p));
+}
 function resolveAccess(session, activeScopeId, tabConfig) {
   const resourcePath = tabConfig?.resourceId;
   const overrides = session.resourceOverrides?.[activeScopeId] ?? {};
@@ -375,13 +534,15 @@ function resolveAccess(session, activeScopeId, tabConfig) {
   const requiredPrivileges = tabConfig?.requiredPrivileges ?? [];
   const hasRestrictions = allowedRoles.length > 0 || requiredPrivileges.length > 0;
   if (hasRestrictions) {
-    const role = session?.role ?? "";
-    const privileges = session?.privileges ?? [];
+    const assignment = session?.roleAssignments?.[activeScopeId];
+    const role = assignment?.role ?? "";
+    const privileges = assignment?.privileges ?? [];
     const passesRole = allowedRoles.length > 0 && allowedRoles.includes(role);
     const passesPrivilege = requiredPrivileges.length > 0 && requiredPrivileges.some((p) => privileges.includes(p));
     return passesRole || passesPrivilege ? "WRITE" : "NONE";
   }
-  return "READ";
+  console.warn("");
+  return "NONE";
 }
 function isTabVisible(session, activeScopeId, tabConfig) {
   return resolveAccess(session, activeScopeId, tabConfig) !== "NONE";
@@ -389,9 +550,11 @@ function isTabVisible(session, activeScopeId, tabConfig) {
 function isTabWritable(session, activeScopeId, tabConfig) {
   return resolveAccess(session, activeScopeId, tabConfig) === "WRITE";
 }
-function evaluateBaseAccess(resourcePath, session, requirements = {}) {
-  if (!session?.role) return "NONE";
-  if (session.role === UserRole.OWNER) return "WRITE";
+function evaluateBaseAccess(resourcePath, session, activeScopeId, requirements = {}) {
+  const role = getRoleAt(session, activeScopeId);
+  const privileges = getPrivilegesAt(session, activeScopeId);
+  if (!role) return "NONE";
+  if (role === UserRole.OWNER) return "WRITE";
   const requiredModules = RESOURCE_MODULE_MAP[resourcePath] || [];
   if (requiredModules.length > 0) {
     const hasModule = requiredModules.some((m) => session.enabledModules?.includes(m));
@@ -400,12 +563,12 @@ function evaluateBaseAccess(resourcePath, session, requirements = {}) {
   const topLevel = resourcePath.split(".")[0];
   const defaultRoles = ROLE_SECTIONS_BY_KEY[topLevel] || [];
   const allowedRoles = requirements.allowedRoles?.length ? requirements.allowedRoles : defaultRoles;
-  if (!allowedRoles.includes(session.role)) return "NONE";
+  if (!allowedRoles.includes(role)) return "NONE";
   if (requirements.requiredPrivileges?.length) {
-    const hasPrivilege = requirements.requiredPrivileges.some((p) => session.privileges?.includes(p));
+    const hasPrivilege = requirements.requiredPrivileges.some((p) => privileges.includes(p));
     if (!hasPrivilege) return "NONE";
   }
-  return session.role === UserRole.MANAGER ? "WRITE" : "READ";
+  return role === UserRole.MANAGER ? "WRITE" : "READ";
 }
 function resolveEffectiveAccess(base, override) {
   return override === void 0 || override === null ? base : override;
@@ -579,6 +742,7 @@ export {
   RelationshipType,
   RowOrientation,
   SENTINEL_UUID,
+  SESSION_SCHEMA,
   SIGNATURE_MODES,
   SoilTexture,
   StockPolicyTier,
@@ -597,6 +761,8 @@ export {
   WaterSource,
   assertTenantBoundary,
   calculateFileMetadataMatch,
+  decodeSession,
+  encodeSession,
   evaluateBaseAccess,
   extractAppCode,
   findSpecificOverride,
@@ -607,14 +773,20 @@ export {
   getApproveAction,
   getFormMeta,
   getFormsGroupedByModule,
+  getPrivilegesAt,
+  getRoleAt,
+  getScopeAncestry,
   getTaskTypeOptions,
   handleAppErrorResponse,
+  hasPrivilegeAt,
+  hasRoleAt,
   isTabVisible,
   isTabWritable,
   resolveAccess,
   resolveAppError,
   resolveEffectiveAccess,
   resolveError,
+  transformRoleAssignments,
   verifyAndExtractSession,
   withAgriLogging
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@litusarchieve18/agricore-utils",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "description": "Canonical Backend Utility Library for AgriCore",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",