/**
 * Data-range discriminator for student queries in the agent-tool layer.
 *
 * - `manageAll`:  The principal may read every student unconditionally
 *    (super admin or equivalent "full student scope" capability).
 * - `teacher`:    The principal is restricted to active students in the
 *    classes where they are a {@link ClassTeacher} (userId must be set).
 *
 * NEVER propagate a raw boolean `isSuperAdmin` into new Agent APIs —
 * use this discriminated union so callers are explicit about intent.
 */
export type StudentAccessScope =
  | { readonly type: 'manageAll' }
  | { readonly type: 'teacher'; readonly userId: number };
