export interface AuthenticatedUserLike {
  id: string;
  tenantId?: string | null;
  teamId?: string | null;
  organizationId?: string | null;
  orgId?: string | null;
}

export interface ActorTenantScope {
  userId: string;
  tenantId: string;
}

/**
 * Build the immutable server-derived scope used for Tess session operations.
 * Current Mosaic auth is user-scoped; future org/team claims can populate one
 * of the tenant fields without allowing clients to choose another tenant.
 */
export function scopeFromUser(user: AuthenticatedUserLike): ActorTenantScope {
  return {
    userId: user.id,
    tenantId: user.tenantId ?? user.teamId ?? user.organizationId ?? user.orgId ?? user.id,
  };
}