@litusarchieve18/agricore-utils 1.0.23 → 1.0.25

package/README.md

@@ -183,9 +183,9 @@ Run the publish command:
 Bash
 npm publish --access public
 📝 Version History
-V1.0.25 — 
+V1.0.25 — adding privileges and changing RESOURCE_PATHS
 
-V1.0.24 — 
+V1.0.24 — splitting role dependency into a new file
 
 V1.0.23 — add two more utility function getScopeAncestry, transformRoleAssignments, evaluateBaseAccess
 

package/dist/{chunk-V2DL7OTH.mjs → chunk-OFNQBQP4.mjs}

@@ -77,7 +77,12 @@ var UserPrivilege = {
   HR: "hr",
   MECHANIC: "mechanic",
   AUDIT_COMPLIANCE: "auditCompliance",
-  ADMIN: "admin"
+  ADMIN: "admin",
+  DOCUMENT: "documents",
+  INVENTORY: "inventory",
+  FARM_MANAGEMENT: "farmManagement",
+  PACKHOUSE: "packhouse",
+  ACCOMMODATION: "accommodation"
 };
 var AccessLevel = {
   NONE: "NONE",
@@ -508,23 +513,23 @@ var RESOURCE_REQUIREMENTS = {
   // ── Records & Reports ──────────────────────────────────────────────────────
   [RESOURCE_PATHS.documentHub]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.DOCUMENT]
   },
   [RESOURCE_PATHS.documentHubTemplates]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.DOCUMENT]
   },
   [RESOURCE_PATHS.documentHubFolder]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.DOCUMENT]
   },
   [RESOURCE_PATHS.documentHubExtraction]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.DOCUMENT]
   },
   [RESOURCE_PATHS.documentHubQueue]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.DOCUMENT]
   },
   // CONSUMABLES PERMISSIONS
   [RESOURCE_PATHS.inventoryConsumableProduct]: {

package/dist/{constants-BS1AZ5aN.d.mts → constants-D5sndLi7.d.mts}

@@ -255,6 +255,11 @@ declare const UserPrivilege: {
     readonly MECHANIC: "mechanic";
     readonly AUDIT_COMPLIANCE: "auditCompliance";
     readonly ADMIN: "admin";
+    readonly DOCUMENT: "documents";
+    readonly INVENTORY: "inventory";
+    readonly FARM_MANAGEMENT: "farmManagement";
+    readonly PACKHOUSE: "packhouse";
+    readonly ACCOMMODATION: "accommodation";
 };
 declare const AccessLevel: {
     readonly NONE: "NONE";

package/dist/{constants-BS1AZ5aN.d.ts → constants-D5sndLi7.d.ts}

@@ -255,6 +255,11 @@ declare const UserPrivilege: {
     readonly MECHANIC: "mechanic";
     readonly AUDIT_COMPLIANCE: "auditCompliance";
     readonly ADMIN: "admin";
+    readonly DOCUMENT: "documents";
+    readonly INVENTORY: "inventory";
+    readonly FARM_MANAGEMENT: "farmManagement";
+    readonly PACKHOUSE: "packhouse";
+    readonly ACCOMMODATION: "accommodation";
 };
 declare const AccessLevel: {
     readonly NONE: "NONE";

package/dist/constants.d.mts

@@ -1 +1 @@
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, ar as SoilTexture, as as StockPolicyTier, au as StoragePhases, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aI as UserRole, aL as VigorRating, aM as WaterSource } from './constants-BS1AZ5aN.mjs';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, ar as SoilTexture, as as StockPolicyTier, au as StoragePhases, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aI as UserRole, aL as VigorRating, aM as WaterSource } from './constants-D5sndLi7.mjs';

package/dist/constants.d.ts

@@ -1 +1 @@
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, ar as SoilTexture, as as StockPolicyTier, au as StoragePhases, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aI as UserRole, aL as VigorRating, aM as WaterSource } from './constants-BS1AZ5aN.js';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, B as BarcodeNamespace, l as BarcodeType, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, x as CatalogSyncStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a1 as NotificationMode, a2 as OrderStatus, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a8 as ProductUnit, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ah as ResourceRequirement, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, ar as SoilTexture, as as StockPolicyTier, au as StoragePhases, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aI as UserRole, aL as VigorRating, aM as WaterSource } from './constants-D5sndLi7.js';

package/dist/constants.js

@@ -163,7 +163,12 @@ var UserPrivilege = {
   HR: "hr",
   MECHANIC: "mechanic",
   AUDIT_COMPLIANCE: "auditCompliance",
-  ADMIN: "admin"
+  ADMIN: "admin",
+  DOCUMENT: "documents",
+  INVENTORY: "inventory",
+  FARM_MANAGEMENT: "farmManagement",
+  PACKHOUSE: "packhouse",
+  ACCOMMODATION: "accommodation"
 };
 var AccessLevel = {
   NONE: "NONE",
@@ -594,23 +599,23 @@ var RESOURCE_REQUIREMENTS = {
   // ── Records & Reports ──────────────────────────────────────────────────────
   [RESOURCE_PATHS.documentHub]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.DOCUMENT]
   },
   [RESOURCE_PATHS.documentHubTemplates]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.DOCUMENT]
   },
   [RESOURCE_PATHS.documentHubFolder]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.DOCUMENT]
   },
   [RESOURCE_PATHS.documentHubExtraction]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.DOCUMENT]
   },
   [RESOURCE_PATHS.documentHubQueue]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.DOCUMENT]
   },
   // CONSUMABLES PERMISSIONS
   [RESOURCE_PATHS.inventoryConsumableProduct]: {

package/dist/constants.mjs

@@ -62,7 +62,7 @@ import {
   UserRole,
   VigorRating,
   WaterSource
-} from "./chunk-V2DL7OTH.mjs";
+} from "./chunk-OFNQBQP4.mjs";
 export {
   ACCESS_RANK,
   ACT,

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { d as AgriCoreSession, ao as ScopeType, aN as WireSession, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError, aJ as UserRoleAssignment } from './constants-BS1AZ5aN.mjs';
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserPrivilegeType, aI as UserRole, aK as UserRoleType, aL as VigorRating, aM as WaterSource } from './constants-BS1AZ5aN.mjs';
+import { d as AgriCoreSession, aJ as UserRoleAssignment, ao as ScopeType, aN as WireSession, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError } from './constants-D5sndLi7.mjs';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserPrivilegeType, aI as UserRole, aK as UserRoleType, aL as VigorRating, aM as WaterSource } from './constants-D5sndLi7.mjs';
 
 declare const AgriLogger: {
     log(level: "INFO" | "WARN" | "ERROR", message: string, meta: any): void;
@@ -9,6 +9,15 @@ declare const AgriLogger: {
  */
 declare function withAgriLogging<T extends (...args: any[]) => Promise<any>>(fn: T, functionName: string, session?: AgriCoreSession): T;
 
+declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
+declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
+declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
+declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
+declare function transformRoleAssignments(assignments: UserRoleAssignment[]): Record<string, {
+    role: string;
+    privileges: string[];
+}>;
+
 declare const Validator: {
     /** * 1. Email: The classic. Uses a standard RFC 5322 regex.
      */
@@ -111,16 +120,6 @@ declare function generateInfrastructureFields(activeScope: AvailableScope, avail
 declare function getScopeAncestry(activeScopeId: string, availableScopes: AvailableScope[]): string[];
 declare function encodeSession(session: AgriCoreSession): WireSession;
 declare function decodeSession(short: WireSession): AgriCoreSession;
-/**
- * Transforms flat UserRoleAssignment records into the roleAssignments map.
- * Defensive by design: a single malformed row must not break token
- * generation for the whole login. Bad rows are skipped and logged,
- * never thrown — login should degrade gracefully, not fail hard.
- */
-declare function transformRoleAssignments(assignments: UserRoleAssignment[]): Record<string, {
-    role: string;
-    privileges: string[];
-}>;
 /**
  * "Does this user hold this role/privilege AT this specific scope?"
  * This is the default choice for any authorization gate evaluating
@@ -128,10 +127,6 @@ declare function transformRoleAssignments(assignments: UserRoleAssignment[]): Re
  * currently acting on." No inheritance — only an explicit assignment
  * at exactly this authScopeId counts, matching the no-inherit-write rule.
  */
-declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
-declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
-declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
-declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
 /**
  * Full resolution: DB override → static config fallback → public default.
  * Returns 'NONE' | 'READ' | 'WRITE'.

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { d as AgriCoreSession, ao as ScopeType, aN as WireSession, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError, aJ as UserRoleAssignment } from './constants-BS1AZ5aN.js';
-export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserPrivilegeType, aI as UserRole, aK as UserRoleType, aL as VigorRating, aM as WaterSource } from './constants-BS1AZ5aN.js';
+import { d as AgriCoreSession, aJ as UserRoleAssignment, ao as ScopeType, aN as WireSession, ah as ResourceRequirement, c as AccessLevelType, j as AvailableScope, U as InfrastructureFields, S as FormMeta, ay as TabConfig, af as ResolvedError } from './constants-D5sndLi7.js';
+export { A as ACCESS_RANK, a as ACT, b as AccessLevel, e as ApprovalStatus, f as ApprovalType, g as AuditStatus, h as AuditType, i as AuthScopeFields, B as BarcodeNamespace, k as BarcodeNamespaceType, l as BarcodeType, m as BarcodeTypeType, n as Base44Id, C as CAR_SUPPORTED_EVIDENCE_MIME_TYPES, o as CAR_SUPPORTED_SIGNATURE_MIME_TYPES, p as CAT, q as CATEGORY_TABS, r as CORRECTIVE_ACTION_GENERATION_SOURCES, s as CORRECTIVE_ACTION_STATUSES, t as CanonicalId, u as CarSupportedEvidenceMimeType, v as CarSupportedSignatureMimeType, w as CarTemplateFileMetadata, x as CatalogSyncStatus, y as CatalogSyncStatusType, z as CompanyConfig, D as CorrectiveActionCompileTaskMetadata, E as CorrectiveActionGenerationSource, F as CorrectiveActionStatus, G as CropCycleStatus, H as DOCUMENT_DISPLAY_INFO, I as DOCUMENT_MENU_MAP, J as DocumentCategory, K as DocumentType, L as ERROR_DICTIONARY, M as EVERYONE, N as EmitterType, O as EnabledModule, P as FORM_REGISTRY, Q as FacilityType, R as FileUploadTaskType, T as HarvestMethod, V as LinkedStatus, W as MOD, X as MODULE_LABELS, Y as MicroclimateZone, Z as MimeType, _ as ModCode, $ as NettingType, a0 as NormalizedSignatureValue, a1 as NotificationMode, a2 as OrderStatus, a3 as PermissionLevel, a4 as PhysicalState, a5 as PlantingMethod, a6 as ProductType, a7 as ProductTypeType, a8 as ProductUnit, a9 as ProductUnitType, aa as RESOURCE_MODULE_MAP, ab as RESOURCE_PATHS, ac as RESOURCE_REQUIREMENTS, ad as ROLE_SECTIONS_BY_KEY, ae as RelationshipType, ag as ResourceOverrides, ai as RoleAssignment, aj as RowOrientation, ak as SENTINEL_UUID, al as SESSION_SCHEMA, am as SIGNATURE_MODES, an as SchemaField, ap as SignatureInput, aq as SignatureMode, ar as SoilTexture, as as StockPolicyTier, at as StockPolicyTierType, au as StoragePhases, av as StorageType, aw as TASK_TYPE_REGISTRY, ax as TEMPLATE_SCOPE_LEVELS, az as TargetEntityType, aA as TaskStatus, aB as TaskType, aC as TaskTypeConfig, aD as TemplateScopeLevel, aE as TransactionType, aF as TrellisType, aG as UserPrivilege, aH as UserPrivilegeType, aI as UserRole, aK as UserRoleType, aL as VigorRating, aM as WaterSource } from './constants-D5sndLi7.js';
 
 declare const AgriLogger: {
     log(level: "INFO" | "WARN" | "ERROR", message: string, meta: any): void;
@@ -9,6 +9,15 @@ declare const AgriLogger: {
  */
 declare function withAgriLogging<T extends (...args: any[]) => Promise<any>>(fn: T, functionName: string, session?: AgriCoreSession): T;
 
+declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
+declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
+declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
+declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
+declare function transformRoleAssignments(assignments: UserRoleAssignment[]): Record<string, {
+    role: string;
+    privileges: string[];
+}>;
+
 declare const Validator: {
     /** * 1. Email: The classic. Uses a standard RFC 5322 regex.
      */
@@ -111,16 +120,6 @@ declare function generateInfrastructureFields(activeScope: AvailableScope, avail
 declare function getScopeAncestry(activeScopeId: string, availableScopes: AvailableScope[]): string[];
 declare function encodeSession(session: AgriCoreSession): WireSession;
 declare function decodeSession(short: WireSession): AgriCoreSession;
-/**
- * Transforms flat UserRoleAssignment records into the roleAssignments map.
- * Defensive by design: a single malformed row must not break token
- * generation for the whole login. Bad rows are skipped and logged,
- * never thrown — login should degrade gracefully, not fail hard.
- */
-declare function transformRoleAssignments(assignments: UserRoleAssignment[]): Record<string, {
-    role: string;
-    privileges: string[];
-}>;
 /**
  * "Does this user hold this role/privilege AT this specific scope?"
  * This is the default choice for any authorization gate evaluating
@@ -128,10 +127,6 @@ declare function transformRoleAssignments(assignments: UserRoleAssignment[]): Re
  * currently acting on." No inheritance — only an explicit assignment
  * at exactly this authScopeId counts, matching the no-inherit-write rule.
  */
-declare function getRoleAt(session: AgriCoreSession, scopeId: string | undefined | null): string | null;
-declare function hasRoleAt(session: AgriCoreSession, scopeId: string | undefined | null, allowedRoles: Set<string> | string[]): boolean;
-declare function getPrivilegesAt(session: AgriCoreSession, scopeId: string | undefined | null): string[];
-declare function hasPrivilegeAt(session: AgriCoreSession, scopeId: string | undefined | null, requiredPrivileges: string[]): boolean;
 /**
  * Full resolution: DB override → static config fallback → public default.
  * Returns 'NONE' | 'READ' | 'WRITE'.

package/dist/index.js

@@ -185,6 +185,68 @@ function withAgriLogging(fn, functionName, session) {
   });
 }
 
+// src/roleHelpers.ts
+function getRoleAt(session, scopeId) {
+  if (!scopeId) return null;
+  return session.roleAssignments?.[scopeId]?.role ?? null;
+}
+function hasRoleAt(session, scopeId, allowedRoles) {
+  const role = getRoleAt(session, scopeId);
+  if (!role) return false;
+  return allowedRoles instanceof Set ? allowedRoles.has(role) : allowedRoles.includes(role);
+}
+function getPrivilegesAt(session, scopeId) {
+  if (!scopeId) return [];
+  return session.roleAssignments?.[scopeId]?.privileges ?? [];
+}
+function hasPrivilegeAt(session, scopeId, requiredPrivileges) {
+  const privileges = getPrivilegesAt(session, scopeId);
+  return requiredPrivileges.some((p) => privileges.includes(p));
+}
+function transformRoleAssignments(assignments) {
+  const result = {};
+  for (const assignment of assignments) {
+    if (!assignment.isActive || !assignment.authScopeId) continue;
+    if (!assignment.role) {
+      console.warn(
+        `[transformRoleAssignments] Skipping assignment ${assignment.canonicalId ?? "(no canonicalId)"} at scope ${assignment.authScopeId}: missing role.`
+      );
+      continue;
+    }
+    let privileges;
+    if (Array.isArray(assignment.privileges)) {
+      privileges = assignment.privileges;
+    } else if (typeof assignment.privileges === "string") {
+      try {
+        const parsed = JSON.parse(assignment.privileges);
+        if (!Array.isArray(parsed)) {
+          console.warn(
+            `[transformRoleAssignments] Privileges for scope ${assignment.authScopeId} parsed to non-array, defaulting to []. Raw: ${assignment.privileges}`
+          );
+          privileges = [];
+        } else {
+          privileges = parsed;
+        }
+      } catch {
+        console.warn(
+          `[transformRoleAssignments] Failed to parse privileges JSON for scope ${assignment.authScopeId}, defaulting to []. Raw: ${assignment.privileges}`
+        );
+        privileges = [];
+      }
+    } else {
+      privileges = [];
+    }
+    if (result[assignment.authScopeId]) {
+      console.warn(
+        `[transformRoleAssignments] UNEXPECTED: duplicate active assignment at scope ${assignment.authScopeId} (violates unique_user_scope_assignment constraint if this is real DB data) \u2014 overwriting role "${result[assignment.authScopeId].role}" with "${assignment.role}", merging privileges.`
+      );
+      privileges = [.../* @__PURE__ */ new Set([...result[assignment.authScopeId].privileges, ...privileges])];
+    }
+    result[assignment.authScopeId] = { role: assignment.role, privileges };
+  }
+  return result;
+}
+
 // src/validators.ts
 var Validator = {
   /** * 1. Email: The classic. Uses a standard RFC 5322 regex.
@@ -387,7 +449,12 @@ var UserPrivilege = {
   HR: "hr",
   MECHANIC: "mechanic",
   AUDIT_COMPLIANCE: "auditCompliance",
-  ADMIN: "admin"
+  ADMIN: "admin",
+  DOCUMENT: "documents",
+  INVENTORY: "inventory",
+  FARM_MANAGEMENT: "farmManagement",
+  PACKHOUSE: "packhouse",
+  ACCOMMODATION: "accommodation"
 };
 var AccessLevel = {
   NONE: "NONE",
@@ -818,23 +885,23 @@ var RESOURCE_REQUIREMENTS = {
   // ── Records & Reports ──────────────────────────────────────────────────────
   [RESOURCE_PATHS.documentHub]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.DOCUMENT]
   },
   [RESOURCE_PATHS.documentHubTemplates]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.DOCUMENT]
   },
   [RESOURCE_PATHS.documentHubFolder]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.DOCUMENT]
   },
   [RESOURCE_PATHS.documentHubExtraction]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.DOCUMENT]
   },
   [RESOURCE_PATHS.documentHubQueue]: {
     allowedRoles: [UserRole.OWNER, UserRole.MANAGER, UserRole.SUPERVISOR],
-    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.HR]
+    requiredPrivileges: [UserPrivilege.ADMIN, UserPrivilege.AUDIT_COMPLIANCE, UserPrivilege.FINANCE, UserPrivilege.DOCUMENT]
   },
   // CONSUMABLES PERMISSIONS
   [RESOURCE_PATHS.inventoryConsumableProduct]: {
@@ -1453,49 +1520,6 @@ function decodeSession(short) {
   }
   return out;
 }
-function transformRoleAssignments(assignments) {
-  const result = {};
-  for (const assignment of assignments) {
-    if (!assignment.isActive || !assignment.authScopeId) continue;
-    if (!assignment.role) {
-      console.warn(
-        `[transformRoleAssignments] Skipping assignment ${assignment.canonicalId ?? "(no canonicalId)"} at scope ${assignment.authScopeId}: missing role.`
-      );
-      continue;
-    }
-    let privileges;
-    if (Array.isArray(assignment.privileges)) {
-      privileges = assignment.privileges;
-    } else if (typeof assignment.privileges === "string") {
-      try {
-        const parsed = JSON.parse(assignment.privileges);
-        if (!Array.isArray(parsed)) {
-          console.warn(
-            `[transformRoleAssignments] Privileges for scope ${assignment.authScopeId} parsed to non-array, defaulting to []. Raw: ${assignment.privileges}`
-          );
-          privileges = [];
-        } else {
-          privileges = parsed;
-        }
-      } catch {
-        console.warn(
-          `[transformRoleAssignments] Failed to parse privileges JSON for scope ${assignment.authScopeId}, defaulting to []. Raw: ${assignment.privileges}`
-        );
-        privileges = [];
-      }
-    } else {
-      privileges = [];
-    }
-    if (result[assignment.authScopeId]) {
-      console.warn(
-        `[transformRoleAssignments] UNEXPECTED: duplicate active assignment at scope ${assignment.authScopeId} (violates unique_user_scope_assignment constraint if this is real DB data) \u2014 overwriting role "${result[assignment.authScopeId].role}" with "${assignment.role}", merging privileges.`
-      );
-      privileges = [.../* @__PURE__ */ new Set([...result[assignment.authScopeId].privileges, ...privileges])];
-    }
-    result[assignment.authScopeId] = { role: assignment.role, privileges };
-  }
-  return result;
-}
 (function validateSchema(fields = SESSION_SCHEMA, seen = /* @__PURE__ */ new Set(), pathPrefix = "") {
   for (const f of fields) {
     if (seen.has(f.key)) {
@@ -1509,23 +1533,6 @@ function transformRoleAssignments(assignments) {
     }
   }
 })();
-function getRoleAt(session, scopeId) {
-  if (!scopeId) return null;
-  return session.roleAssignments?.[scopeId]?.role ?? null;
-}
-function hasRoleAt(session, scopeId, allowedRoles) {
-  const role = getRoleAt(session, scopeId);
-  if (!role) return false;
-  return allowedRoles instanceof Set ? allowedRoles.has(role) : allowedRoles.includes(role);
-}
-function getPrivilegesAt(session, scopeId) {
-  if (!scopeId) return [];
-  return session.roleAssignments?.[scopeId]?.privileges ?? [];
-}
-function hasPrivilegeAt(session, scopeId, requiredPrivileges) {
-  const privileges = getPrivilegesAt(session, scopeId);
-  return requiredPrivileges.some((p) => privileges.includes(p));
-}
 function resolveAccess(session, activeScopeId, tabConfig) {
   const resourcePath = tabConfig?.resourceId;
   const overrides = session.resourceOverrides?.[activeScopeId] ?? {};

package/dist/index.mjs

@@ -62,7 +62,7 @@ import {
   UserRole,
   VigorRating,
   WaterSource
-} from "./chunk-V2DL7OTH.mjs";
+} from "./chunk-OFNQBQP4.mjs";
 
 // src/index.ts
 import { jwtVerify } from "jose";
@@ -130,6 +130,68 @@ function withAgriLogging(fn, functionName, session) {
   });
 }
 
+// src/roleHelpers.ts
+function getRoleAt(session, scopeId) {
+  if (!scopeId) return null;
+  return session.roleAssignments?.[scopeId]?.role ?? null;
+}
+function hasRoleAt(session, scopeId, allowedRoles) {
+  const role = getRoleAt(session, scopeId);
+  if (!role) return false;
+  return allowedRoles instanceof Set ? allowedRoles.has(role) : allowedRoles.includes(role);
+}
+function getPrivilegesAt(session, scopeId) {
+  if (!scopeId) return [];
+  return session.roleAssignments?.[scopeId]?.privileges ?? [];
+}
+function hasPrivilegeAt(session, scopeId, requiredPrivileges) {
+  const privileges = getPrivilegesAt(session, scopeId);
+  return requiredPrivileges.some((p) => privileges.includes(p));
+}
+function transformRoleAssignments(assignments) {
+  const result = {};
+  for (const assignment of assignments) {
+    if (!assignment.isActive || !assignment.authScopeId) continue;
+    if (!assignment.role) {
+      console.warn(
+        `[transformRoleAssignments] Skipping assignment ${assignment.canonicalId ?? "(no canonicalId)"} at scope ${assignment.authScopeId}: missing role.`
+      );
+      continue;
+    }
+    let privileges;
+    if (Array.isArray(assignment.privileges)) {
+      privileges = assignment.privileges;
+    } else if (typeof assignment.privileges === "string") {
+      try {
+        const parsed = JSON.parse(assignment.privileges);
+        if (!Array.isArray(parsed)) {
+          console.warn(
+            `[transformRoleAssignments] Privileges for scope ${assignment.authScopeId} parsed to non-array, defaulting to []. Raw: ${assignment.privileges}`
+          );
+          privileges = [];
+        } else {
+          privileges = parsed;
+        }
+      } catch {
+        console.warn(
+          `[transformRoleAssignments] Failed to parse privileges JSON for scope ${assignment.authScopeId}, defaulting to []. Raw: ${assignment.privileges}`
+        );
+        privileges = [];
+      }
+    } else {
+      privileges = [];
+    }
+    if (result[assignment.authScopeId]) {
+      console.warn(
+        `[transformRoleAssignments] UNEXPECTED: duplicate active assignment at scope ${assignment.authScopeId} (violates unique_user_scope_assignment constraint if this is real DB data) \u2014 overwriting role "${result[assignment.authScopeId].role}" with "${assignment.role}", merging privileges.`
+      );
+      privileges = [.../* @__PURE__ */ new Set([...result[assignment.authScopeId].privileges, ...privileges])];
+    }
+    result[assignment.authScopeId] = { role: assignment.role, privileges };
+  }
+  return result;
+}
+
 // src/validators.ts
 var Validator = {
   /** * 1. Email: The classic. Uses a standard RFC 5322 regex.
@@ -446,49 +508,6 @@ function decodeSession(short) {
   }
   return out;
 }
-function transformRoleAssignments(assignments) {
-  const result = {};
-  for (const assignment of assignments) {
-    if (!assignment.isActive || !assignment.authScopeId) continue;
-    if (!assignment.role) {
-      console.warn(
-        `[transformRoleAssignments] Skipping assignment ${assignment.canonicalId ?? "(no canonicalId)"} at scope ${assignment.authScopeId}: missing role.`
-      );
-      continue;
-    }
-    let privileges;
-    if (Array.isArray(assignment.privileges)) {
-      privileges = assignment.privileges;
-    } else if (typeof assignment.privileges === "string") {
-      try {
-        const parsed = JSON.parse(assignment.privileges);
-        if (!Array.isArray(parsed)) {
-          console.warn(
-            `[transformRoleAssignments] Privileges for scope ${assignment.authScopeId} parsed to non-array, defaulting to []. Raw: ${assignment.privileges}`
-          );
-          privileges = [];
-        } else {
-          privileges = parsed;
-        }
-      } catch {
-        console.warn(
-          `[transformRoleAssignments] Failed to parse privileges JSON for scope ${assignment.authScopeId}, defaulting to []. Raw: ${assignment.privileges}`
-        );
-        privileges = [];
-      }
-    } else {
-      privileges = [];
-    }
-    if (result[assignment.authScopeId]) {
-      console.warn(
-        `[transformRoleAssignments] UNEXPECTED: duplicate active assignment at scope ${assignment.authScopeId} (violates unique_user_scope_assignment constraint if this is real DB data) \u2014 overwriting role "${result[assignment.authScopeId].role}" with "${assignment.role}", merging privileges.`
-      );
-      privileges = [.../* @__PURE__ */ new Set([...result[assignment.authScopeId].privileges, ...privileges])];
-    }
-    result[assignment.authScopeId] = { role: assignment.role, privileges };
-  }
-  return result;
-}
 (function validateSchema(fields = SESSION_SCHEMA, seen = /* @__PURE__ */ new Set(), pathPrefix = "") {
   for (const f of fields) {
     if (seen.has(f.key)) {
@@ -502,23 +521,6 @@ function transformRoleAssignments(assignments) {
     }
   }
 })();
-function getRoleAt(session, scopeId) {
-  if (!scopeId) return null;
-  return session.roleAssignments?.[scopeId]?.role ?? null;
-}
-function hasRoleAt(session, scopeId, allowedRoles) {
-  const role = getRoleAt(session, scopeId);
-  if (!role) return false;
-  return allowedRoles instanceof Set ? allowedRoles.has(role) : allowedRoles.includes(role);
-}
-function getPrivilegesAt(session, scopeId) {
-  if (!scopeId) return [];
-  return session.roleAssignments?.[scopeId]?.privileges ?? [];
-}
-function hasPrivilegeAt(session, scopeId, requiredPrivileges) {
-  const privileges = getPrivilegesAt(session, scopeId);
-  return requiredPrivileges.some((p) => privileges.includes(p));
-}
 function resolveAccess(session, activeScopeId, tabConfig) {
   const resourcePath = tabConfig?.resourceId;
   const overrides = session.resourceOverrides?.[activeScopeId] ?? {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@litusarchieve18/agricore-utils",
-  "version": "1.0.23",
+  "version": "1.0.25",
   "description": "Canonical Backend Utility Library for AgriCore",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",