@litusarchieve18/agricore-utils 1.0.22 → 1.0.24

package/README.md

@@ -185,9 +185,9 @@ npm publish --access public
 📝 Version History
 V1.0.25 — 
 
-V1.0.24 — 
+V1.0.24 — splitting role dependency into a new file
 
-V1.0.23 — 
+V1.0.23 — add two more utility function getScopeAncestry, transformRoleAssignments, evaluateBaseAccess
 
 V1.0.22 — refactor session object to include multiple roles and privileges
 

package/dist/{constants-lhTP4wzB.d.mts → constants-BS1AZ5aN.d.mts}

@@ -15,6 +15,19 @@ interface CompanyConfig {
     isMultiEntity: boolean;
 }
 type UserRoleType = typeof UserRole[keyof typeof UserRole];
+type UserPrivilegeType = (typeof UserPrivilege)[keyof typeof UserPrivilege];
+interface UserRoleAssignment {
+    canonicalId: string;
+    userId: string;
+    companyId: string;
+    legalEntityId?: string;
+    facilityId?: string;
+    facilityIds?: string[];
+    authScopeId: string;
+    role: string;
+    privileges?: string[] | string;
+    isActive?: boolean;
+}
 type AccessLevelType = keyof typeof AccessLevel;
 /**
  * Deep map of scope IDs to resource paths and their permission levels.
@@ -667,4 +680,4 @@ declare const StockPolicyTier: {
     readonly BY_LOCATION: 3;
 };
 
-export { NettingType as $, ACCESS_RANK as A, BarcodeNamespace as B, CAR_SUPPORTED_EVIDENCE_MIME_TYPES as C, type CorrectiveActionCompileTaskMetadata as D, type CorrectiveActionGenerationSource as E, type CorrectiveActionStatus as F, CropCycleStatus as G, DOCUMENT_DISPLAY_INFO as H, DOCUMENT_MENU_MAP as I, DocumentCategory as J, DocumentType as K, ERROR_DICTIONARY as L, EVERYONE as M, EmitterType as N, EnabledModule as O, FORM_REGISTRY as P, FacilityType as Q, type FileUploadTaskType as R, type FormMeta as S, HarvestMethod as T, type InfrastructureFields as U, LinkedStatus as V, MOD as W, MODULE_LABELS as X, MicroclimateZone as Y, MimeType as Z, type ModCode as _, ACT as a, type NormalizedSignatureValue as a0, NotificationMode as a1, OrderStatus as a2, type PermissionLevel as a3, PhysicalState as a4, PlantingMethod as a5, ProductType as a6, type ProductTypeType as a7, ProductUnit as a8, type ProductUnitType as a9, TaskStatus as aA, TaskType as aB, type TaskTypeConfig as aC, type TemplateScopeLevel as aD, TransactionType as aE, TrellisType as aF, UserPrivilege as aG, UserRole as aH, type UserRoleType as aI, VigorRating as aJ, WaterSource as aK, type WireSession as aL, RESOURCE_MODULE_MAP as aa, RESOURCE_PATHS as ab, RESOURCE_REQUIREMENTS as ac, ROLE_SECTIONS_BY_KEY as ad, RelationshipType as ae, type ResolvedError as af, type ResourceOverrides as ag, type ResourceRequirement as ah, type RoleAssignment as ai, RowOrientation as aj, SENTINEL_UUID as ak, SESSION_SCHEMA as al, SIGNATURE_MODES as am, type SchemaField as an, type ScopeType as ao, type SignatureInput as ap, type SignatureMode as aq, SoilTexture as ar, StockPolicyTier as as, type StockPolicyTierType as at, StoragePhases as au, type StorageType as av, TASK_TYPE_REGISTRY as aw, TEMPLATE_SCOPE_LEVELS as ax, type TabConfig as ay, TargetEntityType as az, AccessLevel as b, type AccessLevelType as c, type AgriCoreSession as d, ApprovalStatus as e, ApprovalType as f, AuditStatus as g, AuditType as h, type AuthScopeFields as i, type AvailableScope as j, type BarcodeNamespaceType as k, BarcodeType as l, type BarcodeTypeType as m, type Base44Id as n, CAR_SUPPORTED_SIGNATURE_MIME_TYPES as o, CAT as p, CATEGORY_TABS as q, CORRECTIVE_ACTION_GENERATION_SOURCES as r, CORRECTIVE_ACTION_STATUSES as s, type CanonicalId as t, type CarSupportedEvidenceMimeType as u, type CarSupportedSignatureMimeType as v, type CarTemplateFileMetadata as w, CatalogSyncStatus as x, type CatalogSyncStatusType as y, type CompanyConfig as z };
+export { NettingType as $, ACCESS_RANK as A, BarcodeNamespace as B, CAR_SUPPORTED_EVIDENCE_MIME_TYPES as C, type CorrectiveActionCompileTaskMetadata as D, type CorrectiveActionGenerationSource as E, type CorrectiveActionStatus as F, CropCycleStatus as G, DOCUMENT_DISPLAY_INFO as H, DOCUMENT_MENU_MAP as I, DocumentCategory as J, DocumentType as K, ERROR_DICTIONARY as L, EVERYONE as M, EmitterType as N, EnabledModule as O, FORM_REGISTRY as P, FacilityType as Q, type FileUploadTaskType as R, type FormMeta as S, HarvestMethod as T, type InfrastructureFields as U, LinkedStatus as V, MOD as W, MODULE_LABELS as X, MicroclimateZone as Y, MimeType as Z, type ModCode as _, ACT as a, type NormalizedSignatureValue as a0, NotificationMode as a1, OrderStatus as a2, type PermissionLevel as a3, PhysicalState as a4, PlantingMethod as a5, ProductType as a6, type ProductTypeType as a7, ProductUnit as a8, type ProductUnitType as a9, TaskStatus as aA, TaskType as aB, type TaskTypeConfig as aC, type TemplateScopeLevel as aD, TransactionType as aE, TrellisType as aF, UserPrivilege as aG, type UserPrivilegeType as aH, UserRole as aI, type UserRoleAssignment as aJ, type UserRoleType as aK, VigorRating as aL, WaterSource as aM, type WireSession as aN, RESOURCE_MODULE_MAP as aa, RESOURCE_PATHS as ab, RESOURCE_REQUIREMENTS as ac, ROLE_SECTIONS_BY_KEY as ad, RelationshipType as ae, type ResolvedError as af, type ResourceOverrides as ag, type ResourceRequirement as ah, type RoleAssignment as ai, RowOrientation as aj, SENTINEL_UUID as ak, SESSION_SCHEMA as al, SIGNATURE_MODES as am, type SchemaField as an, type ScopeType as ao, type SignatureInput as ap, type SignatureMode as aq, SoilTexture as ar, StockPolicyTier as as, type StockPolicyTierType as at, StoragePhases as au, type StorageType as av, TASK_TYPE_REGISTRY as aw, TEMPLATE_SCOPE_LEVELS as ax, type TabConfig as ay, TargetEntityType as az, AccessLevel as b, type AccessLevelType as c, type AgriCoreSession as d, ApprovalStatus as e, ApprovalType as f, AuditStatus as g, AuditType as h, type AuthScopeFields as i, type AvailableScope as j, type BarcodeNamespaceType as k, BarcodeType as l, type BarcodeTypeType as m, type Base44Id as n, CAR_SUPPORTED_SIGNATURE_MIME_TYPES as o, CAT as p, CATEGORY_TABS as q, CORRECTIVE_ACTION_GENERATION_SOURCES as r, CORRECTIVE_ACTION_STATUSES as s, type CanonicalId as t, type CarSupportedEvidenceMimeType as u, type CarSupportedSignatureMimeType as v, type CarTemplateFileMetadata as w, CatalogSyncStatus as x, type CatalogSyncStatusType as y, type CompanyConfig as z };

package/dist/{constants-lhTP4wzB.d.ts → constants-BS1AZ5aN.d.ts}

@@ -15,6 +15,19 @@ interface CompanyConfig {
     isMultiEntity: boolean;
 }
 type UserRoleType = typeof UserRole[keyof typeof UserRole];
+type UserPrivilegeType = (typeof UserPrivilege)[keyof typeof UserPrivilege];
+interface UserRoleAssignment {
+    canonicalId: string;
+    userId: string;
+    companyId: string;
+    legalEntityId?: string;
+    facilityId?: string;
+    facilityIds?: string[];
+    authScopeId: string;
+    role: string;
+    privileges?: string[] | string;
+    isActive?: boolean;
+}
 type AccessLevelType = keyof typeof AccessLevel;
 /**
  * Deep map of scope IDs to resource paths and their permission levels.
@@ -667,4 +680,4 @@ declare const StockPolicyTier: {
     readonly BY_LOCATION: 3;
 };
 
-export { NettingType as $, ACCESS_RANK as A, BarcodeNamespace as B, CAR_SUPPORTED_EVIDENCE_MIME_TYPES as C, type CorrectiveActionCompileTaskMetadata as D, type CorrectiveActionGenerationSource as E, type CorrectiveActionStatus as F, CropCycleStatus as G, DOCUMENT_DISPLAY_INFO as H, DOCUMENT_MENU_MAP as I, DocumentCategory as J, DocumentType as K, ERROR_DICTIONARY as L, EVERYONE as M, EmitterType as N, EnabledModule as O, FORM_REGISTRY as P, FacilityType as Q, type FileUploadTaskType as R, type FormMeta as S, HarvestMethod as T, type InfrastructureFields as U, LinkedStatus as V, MOD as W, MODULE_LABELS as X, MicroclimateZone as Y, MimeType as Z, type ModCode as _, ACT as a, type NormalizedSignatureValue as a0, NotificationMode as a1, OrderStatus as a2, type PermissionLevel as a3, PhysicalState as a4, PlantingMethod as a5, ProductType as a6, type ProductTypeType as a7, ProductUnit as a8, type ProductUnitType as a9, TaskStatus as aA, TaskType as aB, type TaskTypeConfig as aC, type TemplateScopeLevel as aD, TransactionType as aE, TrellisType as aF, UserPrivilege as aG, UserRole as aH, type UserRoleType as aI, VigorRating as aJ, WaterSource as aK, type WireSession as aL, RESOURCE_MODULE_MAP as aa, RESOURCE_PATHS as ab, RESOURCE_REQUIREMENTS as ac, ROLE_SECTIONS_BY_KEY as ad, RelationshipType as ae, type ResolvedError as af, type ResourceOverrides as ag, type ResourceRequirement as ah, type RoleAssignment as ai, RowOrientation as aj, SENTINEL_UUID as ak, SESSION_SCHEMA as al, SIGNATURE_MODES as am, type SchemaField as an, type ScopeType as ao, type SignatureInput as ap, type SignatureMode as aq, SoilTexture as ar, StockPolicyTier as as, type StockPolicyTierType as at, StoragePhases as au, type StorageType as av, TASK_TYPE_REGISTRY as aw, TEMPLATE_SCOPE_LEVELS as ax, type TabConfig as ay, TargetEntityType as az, AccessLevel as b, type AccessLevelType as c, type AgriCoreSession as d, ApprovalStatus as e, ApprovalType as f, AuditStatus as g, AuditType as h, type AuthScopeFields as i, type AvailableScope as j, type BarcodeNamespaceType as k, BarcodeType as l, type BarcodeTypeType as m, type Base44Id as n, CAR_SUPPORTED_SIGNATURE_MIME_TYPES as o, CAT as p, CATEGORY_TABS as q, CORRECTIVE_ACTION_GENERATION_SOURCES as r, CORRECTIVE_ACTION_STATUSES as s, type CanonicalId as t, type CarSupportedEvidenceMimeType as u, type CarSupportedSignatureMimeType as v, type CarTemplateFileMetadata as w, CatalogSyncStatus as x, type CatalogSyncStatusType as y, type CompanyConfig as z };
+export { NettingType as $, ACCESS_RANK as A, BarcodeNamespace as B, CAR_SUPPORTED_EVIDENCE_MIME_TYPES as C, type CorrectiveActionCompileTaskMetadata as D, type CorrectiveActionGenerationSource as E, type CorrectiveActionStatus as F, CropCycleStatus as G, DOCUMENT_DISPLAY_INFO as H, DOCUMENT_MENU_MAP as I, DocumentCategory as J, DocumentType as K, ERROR_DICTIONARY as L, EVERYONE as M, EmitterType as N, EnabledModule as O, FORM_REGISTRY as P, FacilityType as Q, type FileUploadTaskType as R, type FormMeta as S, HarvestMethod as T, type InfrastructureFields as U, LinkedStatus as V, MOD as W, MODULE_LABELS as X, MicroclimateZone as Y, MimeType as Z, type ModCode as _, ACT as a, type NormalizedSignatureValue as a0, NotificationMode as a1, OrderStatus as a2, type PermissionLevel as a3, PhysicalState as a4, PlantingMethod as a5, ProductType as a6, type ProductTypeType as a7, ProductUnit as a8, type ProductUnitType as a9, TaskStatus as aA, TaskType as aB, type TaskTypeConfig as aC, type TemplateScopeLevel as aD, TransactionType as aE, TrellisType as aF, UserPrivilege as aG, type UserPrivilegeType as aH, UserRole as aI, type UserRoleAssignment as aJ, type UserRoleType as aK, VigorRating as aL, WaterSource as aM, type WireSession as aN, RESOURCE_MODULE_MAP as aa, RESOURCE_PATHS as ab, RESOURCE_REQUIREMENTS as ac, ROLE_SECTIONS_BY_KEY as ad, RelationshipType as ae, type ResolvedError as af, type ResourceOverrides as ag, type ResourceRequirement as ah, type RoleAssignment as ai, RowOrientation as aj, SENTINEL_UUID as ak, SESSION_SCHEMA as al, SIGNATURE_MODES as am, type SchemaField as an, type ScopeType as ao, type SignatureInput as ap, type SignatureMode as aq, SoilTexture as ar, StockPolicyTier as as, type StockPolicyTierType as at, StoragePhases as au, type StorageType as av, TASK_TYPE_REGISTRY as aw, TEMPLATE_SCOPE_LEVELS as ax, type TabConfig as ay, TargetEntityType as az, AccessLevel as b, type AccessLevelType as c, type AgriCoreSession as d, ApprovalStatus as e, ApprovalType as f, AuditStatus as g, AuditType as h, type AuthScopeFields as i, type AvailableScope as j, type BarcodeNamespaceType as k, BarcodeType as l, type BarcodeTypeType as m, type Base44Id as n, CAR_SUPPORTED_SIGNATURE_MIME_TYPES as o, CAT as p, CATEGORY_TABS as q, CORRECTIVE_ACTION_GENERATION_SOURCES as r, CORRECTIVE_ACTION_STATUSES as s, type CanonicalId as t, type CarSupportedEvidenceMimeType as u, type CarSupportedSignatureMimeType as v, type CarTemplateFileMetadata as w, CatalogSyncStatus as x, type CatalogSyncStatusType as y, type CompanyConfig as z };

package/dist/constants.d.mts

@@ -1 +1 @@
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, ar as SoilTexture, as as StockPolicyTier, au as StoragePhases, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserRole, aJ as VigorRating, aK as WaterSource } from './constants-lhTP4wzB.mjs';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, ar as SoilTexture, as as StockPolicyTier, au as StoragePhases, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aI as UserRole, aL as VigorRating, aM as WaterSource } from './constants-BS1AZ5aN.mjs';

package/dist/constants.d.ts

@@ -1 +1 @@
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, ar as SoilTexture, as as StockPolicyTier, au as StoragePhases, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserRole, aJ as VigorRating, aK as WaterSource } from './constants-lhTP4wzB.js';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, ar as SoilTexture, as as StockPolicyTier, au as StoragePhases, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aI as UserRole, aL as VigorRating, aM as WaterSource } from './constants-BS1AZ5aN.js';

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { d as AgriCoreSession, ao as ScopeType, aL as WireSession, aI as UserRoleType, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError } from './constants-lhTP4wzB.mjs';
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserRole, aJ as VigorRating, aK as WaterSource } from './constants-lhTP4wzB.mjs';
+import { d as AgriCoreSession, aJ as UserRoleAssignment, ao as ScopeType, aN as WireSession, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError } from './constants-BS1AZ5aN.mjs';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserPrivilegeType, aI as UserRole, aK as UserRoleType, aL as VigorRating, aM as WaterSource } from './constants-BS1AZ5aN.mjs';
 
 declare const AgriLogger: {
     log(level: "INFO" | "WARN" | "ERROR", message: string, meta: any): void;
@@ -9,6 +9,15 @@ declare const AgriLogger: {
  */
 declare function withAgriLogging<T extends (...args: any[]) => Promise<any>>(fn: T, functionName: string, session?: AgriCoreSession): T;
 
+declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
+declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
+declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
+declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
+declare function transformRoleAssignments(assignments: UserRoleAssignment[]): Record<string, {
+    role: string;
+    privileges: string[];
+}>;
+
 declare const Validator: {
     /** * 1. Email: The classic. Uses a standard RFC 5322 regex.
      */
@@ -104,10 +113,13 @@ declare function generateCanonicalId(): string;
  * Standardizes the creation of new entities by walking up the scope tree.
  */
 declare function generateInfrastructureFields(activeScope: AvailableScope, availableScopes: AvailableScope[]): InfrastructureFields;
+/**
+ * Walks up the scope tree from activeScopeId to the root (Company).
+ * Returns an array of scope IDs including the active one and all parents.
+ */
+declare function getScopeAncestry(activeScopeId: string, availableScopes: AvailableScope[]): string[];
 declare function encodeSession(session: AgriCoreSession): WireSession;
 declare function decodeSession(short: WireSession): AgriCoreSession;
-declare function hasRoleAnywhere(session: AgriCoreSession, role: string): boolean;
-declare function hasPrivilegeAnywhere(session: AgriCoreSession, privilege: string): boolean;
 /**
  * "Does this user hold this role/privilege AT this specific scope?"
  * This is the default choice for any authorization gate evaluating
@@ -115,10 +127,6 @@ declare function hasPrivilegeAnywhere(session: AgriCoreSession, privilege: strin
  * currently acting on." No inheritance — only an explicit assignment
  * at exactly this authScopeId counts, matching the no-inherit-write rule.
  */
-declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
-declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
-declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
-declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
 /**
  * Full resolution: DB override → static config fallback → public default.
  * Returns 'NONE' | 'READ' | 'WRITE'.
@@ -126,11 +134,7 @@ declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | unde
 declare function resolveAccess(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): 'NONE' | 'READ' | 'WRITE';
 declare function isTabVisible(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): boolean;
 declare function isTabWritable(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): boolean;
-declare function evaluateBaseAccess(resourcePath: string, session: {
-    role?: UserRoleType;
-    privileges?: string[];
-    enabledModules?: string[];
-}, requirements?: ResourceRequirement): AccessLevelType;
+declare function evaluateBaseAccess(resourcePath: string, session: AgriCoreSession, activeScopeId: string, requirements?: ResourceRequirement): AccessLevelType;
 /**
  * The Judge: Overrides win over base access (Specificity principle).
  */
@@ -174,4 +178,4 @@ declare function calculateFileMetadataMatch(criteria: {
     contextMatch?: string[];
 }, fileMetadata: Record<string, any>, auditContext: Record<string, any>): number;
 
-export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, ScopeType, TabConfig, UserRoleType, Validator, WireSession, assertTenantBoundary, calculateFileMetadataMatch, decodeSession, encodeSession, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getPrivilegesAt, getRoleAt, getTaskTypeOptions, handleAppErrorResponse, hasPrivilegeAnywhere, hasPrivilegeAt, hasRoleAnywhere, hasRoleAt, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, verifyAndExtractSession, withAgriLogging };
+export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, ScopeType, TabConfig, UserRoleAssignment, Validator, WireSession, assertTenantBoundary, calculateFileMetadataMatch, decodeSession, encodeSession, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getPrivilegesAt, getRoleAt, getScopeAncestry, getTaskTypeOptions, handleAppErrorResponse, hasPrivilegeAt, hasRoleAt, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, transformRoleAssignments, verifyAndExtractSession, withAgriLogging };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { d as AgriCoreSession, ao as ScopeType, aL as WireSession, aI as UserRoleType, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError } from './constants-lhTP4wzB.js';
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserRole, aJ as VigorRating, aK as WaterSource } from './constants-lhTP4wzB.js';
+import { d as AgriCoreSession, aJ as UserRoleAssignment, ao as ScopeType, aN as WireSession, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError } from './constants-BS1AZ5aN.js';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserPrivilegeType, aI as UserRole, aK as UserRoleType, aL as VigorRating, aM as WaterSource } from './constants-BS1AZ5aN.js';
 
 declare const AgriLogger: {
     log(level: "INFO" | "WARN" | "ERROR", message: string, meta: any): void;
@@ -9,6 +9,15 @@ declare const AgriLogger: {
  */
 declare function withAgriLogging<T extends (...args: any[]) => Promise<any>>(fn: T, functionName: string, session?: AgriCoreSession): T;
 
+declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
+declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
+declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
+declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
+declare function transformRoleAssignments(assignments: UserRoleAssignment[]): Record<string, {
+    role: string;
+    privileges: string[];
+}>;
+
 declare const Validator: {
     /** * 1. Email: The classic. Uses a standard RFC 5322 regex.
      */
@@ -104,10 +113,13 @@ declare function generateCanonicalId(): string;
  * Standardizes the creation of new entities by walking up the scope tree.
  */
 declare function generateInfrastructureFields(activeScope: AvailableScope, availableScopes: AvailableScope[]): InfrastructureFields;
+/**
+ * Walks up the scope tree from activeScopeId to the root (Company).
+ * Returns an array of scope IDs including the active one and all parents.
+ */
+declare function getScopeAncestry(activeScopeId: string, availableScopes: AvailableScope[]): string[];
 declare function encodeSession(session: AgriCoreSession): WireSession;
 declare function decodeSession(short: WireSession): AgriCoreSession;
-declare function hasRoleAnywhere(session: AgriCoreSession, role: string): boolean;
-declare function hasPrivilegeAnywhere(session: AgriCoreSession, privilege: string): boolean;
 /**
  * "Does this user hold this role/privilege AT this specific scope?"
  * This is the default choice for any authorization gate evaluating
@@ -115,10 +127,6 @@ declare function hasPrivilegeAnywhere(session: AgriCoreSession, privilege: strin
  * currently acting on." No inheritance — only an explicit assignment
  * at exactly this authScopeId counts, matching the no-inherit-write rule.
  */
-declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
-declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
-declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
-declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
 /**
  * Full resolution: DB override → static config fallback → public default.
  * Returns 'NONE' | 'READ' | 'WRITE'.
@@ -126,11 +134,7 @@ declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | unde
 declare function resolveAccess(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): 'NONE' | 'READ' | 'WRITE';
 declare function isTabVisible(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): boolean;
 declare function isTabWritable(session: AgriCoreSession, activeScopeId: string, tabConfig: TabConfig): boolean;
-declare function evaluateBaseAccess(resourcePath: string, session: {
-    role?: UserRoleType;
-    privileges?: string[];
-    enabledModules?: string[];
-}, requirements?: ResourceRequirement): AccessLevelType;
+declare function evaluateBaseAccess(resourcePath: string, session: AgriCoreSession, activeScopeId: string, requirements?: ResourceRequirement): AccessLevelType;
 /**
  * The Judge: Overrides win over base access (Specificity principle).
  */
@@ -174,4 +178,4 @@ declare function calculateFileMetadataMatch(criteria: {
     contextMatch?: string[];
 }, fileMetadata: Record<string, any>, auditContext: Record<string, any>): number;
 
-export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, ScopeType, TabConfig, UserRoleType, Validator, WireSession, assertTenantBoundary, calculateFileMetadataMatch, decodeSession, encodeSession, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getPrivilegesAt, getRoleAt, getTaskTypeOptions, handleAppErrorResponse, hasPrivilegeAnywhere, hasPrivilegeAt, hasRoleAnywhere, hasRoleAt, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, verifyAndExtractSession, withAgriLogging };
+export { AccessLevelType, AgriCoreSession, AgriLogger, AppError, AvailableScope, Converter, ErrorFactory, FormMeta, InfrastructureFields, ResolvedError, ResourceRequirement, ScopeType, TabConfig, UserRoleAssignment, Validator, WireSession, assertTenantBoundary, calculateFileMetadataMatch, decodeSession, encodeSession, evaluateBaseAccess, extractAppCode, findSpecificOverride, generateCanonicalId, generateDocumentPath, generateInfrastructureFields, getAcceptedMimeTypes, getApproveAction, getFormMeta, getFormsGroupedByModule, getPrivilegesAt, getRoleAt, getScopeAncestry, getTaskTypeOptions, handleAppErrorResponse, hasPrivilegeAt, hasRoleAt, isTabVisible, isTabWritable, resolveAccess, resolveAppError, resolveEffectiveAccess, resolveError, transformRoleAssignments, verifyAndExtractSession, withAgriLogging };

package/dist/index.js

@@ -104,11 +104,10 @@ __export(index_exports, {
   getFormsGroupedByModule: () => getFormsGroupedByModule,
   getPrivilegesAt: () => getPrivilegesAt,
   getRoleAt: () => getRoleAt,
+  getScopeAncestry: () => getScopeAncestry,
   getTaskTypeOptions: () => getTaskTypeOptions,
   handleAppErrorResponse: () => handleAppErrorResponse,
-  hasPrivilegeAnywhere: () => hasPrivilegeAnywhere,
   hasPrivilegeAt: () => hasPrivilegeAt,
-  hasRoleAnywhere: () => hasRoleAnywhere,
   hasRoleAt: () => hasRoleAt,
   isTabVisible: () => isTabVisible,
   isTabWritable: () => isTabWritable,
@@ -116,6 +115,7 @@ __export(index_exports, {
   resolveAppError: () => resolveAppError,
   resolveEffectiveAccess: () => resolveEffectiveAccess,
   resolveError: () => resolveError,
+  transformRoleAssignments: () => transformRoleAssignments,
   verifyAndExtractSession: () => verifyAndExtractSession,
   withAgriLogging: () => withAgriLogging
 });
@@ -185,6 +185,68 @@ function withAgriLogging(fn, functionName, session) {
   });
 }
 
+// src/roleHelpers.ts
+function getRoleAt(session, scopeId) {
+  if (!scopeId) return null;
+  return session.roleAssignments?.[scopeId]?.role ?? null;
+}
+function hasRoleAt(session, scopeId, allowedRoles) {
+  const role = getRoleAt(session, scopeId);
+  if (!role) return false;
+  return allowedRoles instanceof Set ? allowedRoles.has(role) : allowedRoles.includes(role);
+}
+function getPrivilegesAt(session, scopeId) {
+  if (!scopeId) return [];
+  return session.roleAssignments?.[scopeId]?.privileges ?? [];
+}
+function hasPrivilegeAt(session, scopeId, requiredPrivileges) {
+  const privileges = getPrivilegesAt(session, scopeId);
+  return requiredPrivileges.some((p) => privileges.includes(p));
+}
+function transformRoleAssignments(assignments) {
+  const result = {};
+  for (const assignment of assignments) {
+    if (!assignment.isActive || !assignment.authScopeId) continue;
+    if (!assignment.role) {
+      console.warn(
+        `[transformRoleAssignments] Skipping assignment ${assignment.canonicalId ?? "(no canonicalId)"} at scope ${assignment.authScopeId}: missing role.`
+      );
+      continue;
+    }
+    let privileges;
+    if (Array.isArray(assignment.privileges)) {
+      privileges = assignment.privileges;
+    } else if (typeof assignment.privileges === "string") {
+      try {
+        const parsed = JSON.parse(assignment.privileges);
+        if (!Array.isArray(parsed)) {
+          console.warn(
+            `[transformRoleAssignments] Privileges for scope ${assignment.authScopeId} parsed to non-array, defaulting to []. Raw: ${assignment.privileges}`
+          );
+          privileges = [];
+        } else {
+          privileges = parsed;
+        }
+      } catch {
+        console.warn(
+          `[transformRoleAssignments] Failed to parse privileges JSON for scope ${assignment.authScopeId}, defaulting to []. Raw: ${assignment.privileges}`
+        );
+        privileges = [];
+      }
+    } else {
+      privileges = [];
+    }
+    if (result[assignment.authScopeId]) {
+      console.warn(
+        `[transformRoleAssignments] UNEXPECTED: duplicate active assignment at scope ${assignment.authScopeId} (violates unique_user_scope_assignment constraint if this is real DB data) \u2014 overwriting role "${result[assignment.authScopeId].role}" with "${assignment.role}", merging privileges.`
+      );
+      privileges = [.../* @__PURE__ */ new Set([...result[assignment.authScopeId].privileges, ...privileges])];
+    }
+    result[assignment.authScopeId] = { role: assignment.role, privileges };
+  }
+  return result;
+}
+
 // src/validators.ts
 var Validator = {
   /** * 1. Email: The classic. Uses a standard RFC 5322 regex.
@@ -1368,6 +1430,18 @@ function generateInfrastructureFields(activeScope, availableScopes) {
     authScopeId: activeScope.authScopeId
   };
 }
+function getScopeAncestry(activeScopeId, availableScopes) {
+  const ancestry = [activeScopeId];
+  let pointer = availableScopes.find((s) => s.authScopeId === activeScopeId);
+  let guard = 0;
+  while (pointer && pointer.parentId && guard++ < availableScopes.length) {
+    const parent = availableScopes.find((s) => s.base44Id === pointer.parentId);
+    if (!parent) break;
+    ancestry.push(parent.authScopeId);
+    pointer = parent;
+  }
+  return ancestry;
+}
 function encodeField(field, value) {
   if (value === void 0) return void 0;
   switch (field.type) {
@@ -1454,31 +1528,6 @@ function decodeSession(short) {
     }
   }
 })();
-function hasRoleAnywhere(session, role) {
-  return Object.values(session.roleAssignments ?? {}).some((a) => a.role === role);
-}
-function hasPrivilegeAnywhere(session, privilege) {
-  return Object.values(session.roleAssignments ?? {}).some(
-    (a) => a.privileges?.includes(privilege)
-  );
-}
-function getRoleAt(session, scopeId) {
-  if (!scopeId) return null;
-  return session.roleAssignments?.[scopeId]?.role ?? null;
-}
-function hasRoleAt(session, scopeId, allowedRoles) {
-  const role = getRoleAt(session, scopeId);
-  if (!role) return false;
-  return allowedRoles instanceof Set ? allowedRoles.has(role) : allowedRoles.includes(role);
-}
-function getPrivilegesAt(session, scopeId) {
-  if (!scopeId) return [];
-  return session.roleAssignments?.[scopeId]?.privileges ?? [];
-}
-function hasPrivilegeAt(session, scopeId, requiredPrivileges) {
-  const privileges = getPrivilegesAt(session, scopeId);
-  return requiredPrivileges.some((p) => privileges.includes(p));
-}
 function resolveAccess(session, activeScopeId, tabConfig) {
   const resourcePath = tabConfig?.resourceId;
   const overrides = session.resourceOverrides?.[activeScopeId] ?? {};
@@ -1501,6 +1550,7 @@ function resolveAccess(session, activeScopeId, tabConfig) {
     const passesPrivilege = requiredPrivileges.length > 0 && requiredPrivileges.some((p) => privileges.includes(p));
     return passesRole || passesPrivilege ? "WRITE" : "NONE";
   }
+  console.warn("");
   return "NONE";
 }
 function isTabVisible(session, activeScopeId, tabConfig) {
@@ -1509,9 +1559,11 @@ function isTabVisible(session, activeScopeId, tabConfig) {
 function isTabWritable(session, activeScopeId, tabConfig) {
   return resolveAccess(session, activeScopeId, tabConfig) === "WRITE";
 }
-function evaluateBaseAccess(resourcePath, session, requirements = {}) {
-  if (!session?.role) return "NONE";
-  if (session.role === UserRole.OWNER) return "WRITE";
+function evaluateBaseAccess(resourcePath, session, activeScopeId, requirements = {}) {
+  const role = getRoleAt(session, activeScopeId);
+  const privileges = getPrivilegesAt(session, activeScopeId);
+  if (!role) return "NONE";
+  if (role === UserRole.OWNER) return "WRITE";
   const requiredModules = RESOURCE_MODULE_MAP[resourcePath] || [];
   if (requiredModules.length > 0) {
     const hasModule = requiredModules.some((m) => session.enabledModules?.includes(m));
@@ -1520,12 +1572,12 @@ function evaluateBaseAccess(resourcePath, session, requirements = {}) {
   const topLevel = resourcePath.split(".")[0];
   const defaultRoles = ROLE_SECTIONS_BY_KEY[topLevel] || [];
   const allowedRoles = requirements.allowedRoles?.length ? requirements.allowedRoles : defaultRoles;
-  if (!allowedRoles.includes(session.role)) return "NONE";
+  if (!allowedRoles.includes(role)) return "NONE";
   if (requirements.requiredPrivileges?.length) {
-    const hasPrivilege = requirements.requiredPrivileges.some((p) => session.privileges?.includes(p));
+    const hasPrivilege = requirements.requiredPrivileges.some((p) => privileges.includes(p));
     if (!hasPrivilege) return "NONE";
   }
-  return session.role === UserRole.MANAGER ? "WRITE" : "READ";
+  return role === UserRole.MANAGER ? "WRITE" : "READ";
 }
 function resolveEffectiveAccess(base, override) {
   return override === void 0 || override === null ? base : override;
@@ -1733,11 +1785,10 @@ function calculateFileMetadataMatch(criteria, fileMetadata, auditContext) {
   getFormsGroupedByModule,
   getPrivilegesAt,
   getRoleAt,
+  getScopeAncestry,
   getTaskTypeOptions,
   handleAppErrorResponse,
-  hasPrivilegeAnywhere,
   hasPrivilegeAt,
-  hasRoleAnywhere,
   hasRoleAt,
   isTabVisible,
   isTabWritable,
@@ -1745,6 +1796,7 @@ function calculateFileMetadataMatch(criteria, fileMetadata, auditContext) {
   resolveAppError,
   resolveEffectiveAccess,
   resolveError,
+  transformRoleAssignments,
   verifyAndExtractSession,
   withAgriLogging
 });

package/dist/index.mjs

@@ -130,6 +130,68 @@ function withAgriLogging(fn, functionName, session) {
   });
 }
 
+// src/roleHelpers.ts
+function getRoleAt(session, scopeId) {
+  if (!scopeId) return null;
+  return session.roleAssignments?.[scopeId]?.role ?? null;
+}
+function hasRoleAt(session, scopeId, allowedRoles) {
+  const role = getRoleAt(session, scopeId);
+  if (!role) return false;
+  return allowedRoles instanceof Set ? allowedRoles.has(role) : allowedRoles.includes(role);
+}
+function getPrivilegesAt(session, scopeId) {
+  if (!scopeId) return [];
+  return session.roleAssignments?.[scopeId]?.privileges ?? [];
+}
+function hasPrivilegeAt(session, scopeId, requiredPrivileges) {
+  const privileges = getPrivilegesAt(session, scopeId);
+  return requiredPrivileges.some((p) => privileges.includes(p));
+}
+function transformRoleAssignments(assignments) {
+  const result = {};
+  for (const assignment of assignments) {
+    if (!assignment.isActive || !assignment.authScopeId) continue;
+    if (!assignment.role) {
+      console.warn(
+        `[transformRoleAssignments] Skipping assignment ${assignment.canonicalId ?? "(no canonicalId)"} at scope ${assignment.authScopeId}: missing role.`
+      );
+      continue;
+    }
+    let privileges;
+    if (Array.isArray(assignment.privileges)) {
+      privileges = assignment.privileges;
+    } else if (typeof assignment.privileges === "string") {
+      try {
+        const parsed = JSON.parse(assignment.privileges);
+        if (!Array.isArray(parsed)) {
+          console.warn(
+            `[transformRoleAssignments] Privileges for scope ${assignment.authScopeId} parsed to non-array, defaulting to []. Raw: ${assignment.privileges}`
+          );
+          privileges = [];
+        } else {
+          privileges = parsed;
+        }
+      } catch {
+        console.warn(
+          `[transformRoleAssignments] Failed to parse privileges JSON for scope ${assignment.authScopeId}, defaulting to []. Raw: ${assignment.privileges}`
+        );
+        privileges = [];
+      }
+    } else {
+      privileges = [];
+    }
+    if (result[assignment.authScopeId]) {
+      console.warn(
+        `[transformRoleAssignments] UNEXPECTED: duplicate active assignment at scope ${assignment.authScopeId} (violates unique_user_scope_assignment constraint if this is real DB data) \u2014 overwriting role "${result[assignment.authScopeId].role}" with "${assignment.role}", merging privileges.`
+      );
+      privileges = [.../* @__PURE__ */ new Set([...result[assignment.authScopeId].privileges, ...privileges])];
+    }
+    result[assignment.authScopeId] = { role: assignment.role, privileges };
+  }
+  return result;
+}
+
 // src/validators.ts
 var Validator = {
   /** * 1. Email: The classic. Uses a standard RFC 5322 regex.
@@ -361,6 +423,18 @@ function generateInfrastructureFields(activeScope, availableScopes) {
     authScopeId: activeScope.authScopeId
   };
 }
+function getScopeAncestry(activeScopeId, availableScopes) {
+  const ancestry = [activeScopeId];
+  let pointer = availableScopes.find((s) => s.authScopeId === activeScopeId);
+  let guard = 0;
+  while (pointer && pointer.parentId && guard++ < availableScopes.length) {
+    const parent = availableScopes.find((s) => s.base44Id === pointer.parentId);
+    if (!parent) break;
+    ancestry.push(parent.authScopeId);
+    pointer = parent;
+  }
+  return ancestry;
+}
 function encodeField(field, value) {
   if (value === void 0) return void 0;
   switch (field.type) {
@@ -447,31 +521,6 @@ function decodeSession(short) {
     }
   }
 })();
-function hasRoleAnywhere(session, role) {
-  return Object.values(session.roleAssignments ?? {}).some((a) => a.role === role);
-}
-function hasPrivilegeAnywhere(session, privilege) {
-  return Object.values(session.roleAssignments ?? {}).some(
-    (a) => a.privileges?.includes(privilege)
-  );
-}
-function getRoleAt(session, scopeId) {
-  if (!scopeId) return null;
-  return session.roleAssignments?.[scopeId]?.role ?? null;
-}
-function hasRoleAt(session, scopeId, allowedRoles) {
-  const role = getRoleAt(session, scopeId);
-  if (!role) return false;
-  return allowedRoles instanceof Set ? allowedRoles.has(role) : allowedRoles.includes(role);
-}
-function getPrivilegesAt(session, scopeId) {
-  if (!scopeId) return [];
-  return session.roleAssignments?.[scopeId]?.privileges ?? [];
-}
-function hasPrivilegeAt(session, scopeId, requiredPrivileges) {
-  const privileges = getPrivilegesAt(session, scopeId);
-  return requiredPrivileges.some((p) => privileges.includes(p));
-}
 function resolveAccess(session, activeScopeId, tabConfig) {
   const resourcePath = tabConfig?.resourceId;
   const overrides = session.resourceOverrides?.[activeScopeId] ?? {};
@@ -494,6 +543,7 @@ function resolveAccess(session, activeScopeId, tabConfig) {
     const passesPrivilege = requiredPrivileges.length > 0 && requiredPrivileges.some((p) => privileges.includes(p));
     return passesRole || passesPrivilege ? "WRITE" : "NONE";
   }
+  console.warn("");
   return "NONE";
 }
 function isTabVisible(session, activeScopeId, tabConfig) {
@@ -502,9 +552,11 @@ function isTabVisible(session, activeScopeId, tabConfig) {
 function isTabWritable(session, activeScopeId, tabConfig) {
   return resolveAccess(session, activeScopeId, tabConfig) === "WRITE";
 }
-function evaluateBaseAccess(resourcePath, session, requirements = {}) {
-  if (!session?.role) return "NONE";
-  if (session.role === UserRole.OWNER) return "WRITE";
+function evaluateBaseAccess(resourcePath, session, activeScopeId, requirements = {}) {
+  const role = getRoleAt(session, activeScopeId);
+  const privileges = getPrivilegesAt(session, activeScopeId);
+  if (!role) return "NONE";
+  if (role === UserRole.OWNER) return "WRITE";
   const requiredModules = RESOURCE_MODULE_MAP[resourcePath] || [];
   if (requiredModules.length > 0) {
     const hasModule = requiredModules.some((m) => session.enabledModules?.includes(m));
@@ -513,12 +565,12 @@ function evaluateBaseAccess(resourcePath, session, requirements = {}) {
   const topLevel = resourcePath.split(".")[0];
   const defaultRoles = ROLE_SECTIONS_BY_KEY[topLevel] || [];
   const allowedRoles = requirements.allowedRoles?.length ? requirements.allowedRoles : defaultRoles;
-  if (!allowedRoles.includes(session.role)) return "NONE";
+  if (!allowedRoles.includes(role)) return "NONE";
   if (requirements.requiredPrivileges?.length) {
-    const hasPrivilege = requirements.requiredPrivileges.some((p) => session.privileges?.includes(p));
+    const hasPrivilege = requirements.requiredPrivileges.some((p) => privileges.includes(p));
     if (!hasPrivilege) return "NONE";
   }
-  return session.role === UserRole.MANAGER ? "WRITE" : "READ";
+  return role === UserRole.MANAGER ? "WRITE" : "READ";
 }
 function resolveEffectiveAccess(base, override) {
   return override === void 0 || override === null ? base : override;
@@ -725,11 +777,10 @@ export {
   getFormsGroupedByModule,
   getPrivilegesAt,
   getRoleAt,
+  getScopeAncestry,
   getTaskTypeOptions,
   handleAppErrorResponse,
-  hasPrivilegeAnywhere,
   hasPrivilegeAt,
-  hasRoleAnywhere,
   hasRoleAt,
   isTabVisible,
   isTabWritable,
@@ -737,6 +788,7 @@ export {
   resolveAppError,
   resolveEffectiveAccess,
   resolveError,
+  transformRoleAssignments,
   verifyAndExtractSession,
   withAgriLogging
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@litusarchieve18/agricore-utils",
-  "version": "1.0.22",
+  "version": "1.0.24",
   "description": "Canonical Backend Utility Library for AgriCore",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",