# `AshOnetime.Scope`
[🔗](https://github.com/baselabs/ash_onetime/blob/v1.5.0/lib/ash_onetime/scope.ex#L1)

Closed, explicit scope algebra for collision isolation.

The `context` map passed to the `resolve/2` callback is the BOUNDED callback context:
`%{resource:, action:}` — the trusted local facts the admission path derives itself
(AGENTS.md: "verification callbacks return trusted local facts"). Caller-supplied context
(actor, tenant, etc.) is NOT forwarded; see `AshOnetime.Verifier` for the same contract.

# `component`

```elixir
@type component() ::
  {:tenant, module()}
  | {:argument, atom()}
  | {:attribute, atom()}
  | {:static, binary()}
```

# `resolve`

```elixir
@callback resolve(Ash.Changeset.t() | Ash.ActionInput.t(), map()) ::
  {:ok, AshOnetime.Canonical.value()} | {:error, term()}
```

# `normalize`

```elixir
@spec normalize(term()) :: {:ok, [component()]} | {:error, String.t()}
```

# `references`

```elixir
@spec references([component()]) :: %{arguments: [atom()], attributes: [atom()]}
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*