@ai-matrx/kit 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.7.0 — 2026-08-29
+
+- `./short-link`: `currentAppPath()` — the current page (pathname + query + hash) as a shortenable path, so a sorted/filtered/configured view shortens to exactly that view.
+- `./short-link-react`: headless `useCopyShortLink` (mint-per-path cache + clipboard + self-resetting phase — the whole flow for any custom chrome such as menu rows and context-menu items); `CopyShortLinkButton` rebuilt on it and `path` is now optional (omitted = current page at click time); new `CopyPageShortLinkButton` alias for the zero-prop "share this exact view" affordance.
+
 ## 0.6.0 — 2026-08-29
 
 - `./short-link` grows the WHOLE client half: `mintShortLink(supabaseClient, { path, organizationId })` (calls the org-gated `public.shorten_app_url` door and returns the finished short URL) and `resolveShortLinkPath(supabaseClient, token)` (the anon resolver). Pass the Supabase client itself — no app writes shortener logic.

package/dist/short-link-react.cjs

@@ -21,7 +21,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/short-link-react.tsx
 var short_link_react_exports = {};
 __export(short_link_react_exports, {
+  CopyPageShortLinkButton: () => CopyPageShortLinkButton,
   CopyShortLinkButton: () => CopyShortLinkButton,
+  useCopyShortLink: () => useCopyShortLink,
   useShortLink: () => useShortLink
 });
 module.exports = __toCommonJS(short_link_react_exports);
@@ -76,6 +78,12 @@ async function mintShortLink(client, options) {
   }
   return { ok: true, token, path: shortLinkPath(token), url: shortLinkUrl(origin, token) };
 }
+function currentAppPath() {
+  if (typeof window === "undefined" || !window.location) return null;
+  const { pathname, search, hash } = window.location;
+  if (!pathname.startsWith("/") || pathname.startsWith("//")) return null;
+  return `${pathname}${search}${hash}`;
+}
 
 // src/short-link-react.tsx
 var import_jsx_runtime = require("react/jsx-runtime");
@@ -111,49 +119,78 @@ function useShortLink(client, options) {
   }, [client, options.path, options.organizationId, options.expiresAt, options.origin]);
   return { mint, url, minting, error };
 }
-function CopyShortLinkButton({
-  client,
-  label = "Copy short link",
-  className,
-  onCopied,
-  onError,
-  ...options
-}) {
-  const { mint, minting } = useShortLink(client, options);
+function useCopyShortLink(client, options) {
   const [phase, setPhase] = (0, import_react.useState)("idle");
+  const [lastUrl, setLastUrl] = (0, import_react.useState)(null);
+  const cache = (0, import_react.useRef)(/* @__PURE__ */ new Map());
   const resetTimer = (0, import_react.useRef)(null);
+  const { path, onCopied, onError, ...mintOptions } = options;
   const flash = (0, import_react.useCallback)((next) => {
     setPhase(next);
     if (resetTimer.current) clearTimeout(resetTimer.current);
     resetTimer.current = setTimeout(() => setPhase("idle"), 2e3);
   }, []);
-  const onClick = (0, import_react.useCallback)(async () => {
-    const result = await mint();
+  const copy = (0, import_react.useCallback)(async () => {
+    const targetPath = path ?? currentAppPath();
+    if (!targetPath) {
+      flash("error");
+      onError?.("No path to shorten");
+      return { ok: false, error: "No path to shorten" };
+    }
+    let result = cache.current.get(targetPath);
+    if (!result?.ok) {
+      setPhase("minting");
+      result = await mintShortLink(client, { ...mintOptions, path: targetPath });
+      cache.current.set(targetPath, result);
+    }
     if (!result.ok) {
       flash("error");
       onError?.(result.error);
-      return;
+      return { ok: false, error: result.error };
     }
     const copied = await writeClipboard(result.url);
-    if (copied) {
-      flash("copied");
-      onCopied?.(result.url);
-    } else {
+    if (!copied) {
       flash("error");
       onError?.("Could not write to the clipboard");
+      return { ok: false, error: "Could not write to the clipboard" };
     }
-  }, [mint, flash, onCopied, onError]);
-  const text = phase === "copied" ? "Copied" : phase === "error" ? "Copy failed" : minting ? "Creating\u2026" : label;
+    setLastUrl(result.url);
+    flash("copied");
+    onCopied?.(result.url);
+    return { ok: true, url: result.url };
+  }, [
+    client,
+    path,
+    mintOptions.organizationId,
+    mintOptions.expiresAt,
+    mintOptions.origin,
+    flash,
+    onCopied,
+    onError
+  ]);
+  return { copy, phase, lastUrl };
+}
+function CopyShortLinkButton({
+  client,
+  label = "Copy short link",
+  className,
+  ...options
+}) {
+  const { copy, phase } = useCopyShortLink(client, options);
+  const text = phase === "copied" ? "Copied" : phase === "error" ? "Copy failed" : phase === "minting" ? "Creating\u2026" : label;
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
     "button",
     {
       type: "button",
-      onClick,
-      disabled: minting,
+      onClick: copy,
+      disabled: phase === "minting",
       "aria-live": "polite",
       className: "inline-flex items-center gap-1.5 rounded-md border border-border bg-card px-2.5 py-1.5 text-sm font-medium text-foreground hover:bg-muted disabled:opacity-60 " + (phase === "error" ? "text-destructive " : "") + (className ?? ""),
       children: text
     }
   );
 }
+function CopyPageShortLinkButton(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(CopyShortLinkButton, { ...props });
+}
 //# sourceMappingURL=short-link-react.cjs.map

package/dist/short-link-react.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/short-link-react.tsx","../src/short-link.ts"],"sourcesContent":["/**\n * @ai-matrx/kit/short-link-react — the drop-in short-link UI.\n *\n * The five-minute story: import the button, hand it your Supabase client and a\n * path, done. The mint call (the org-gated `shorten_app_url` door), the URL\n * shape, the clipboard write, and the state feedback all live HERE — a\n * consuming app writes zero shortener logic.\n *\n *   <CopyShortLinkButton client={supabase} path={`/notes/${id}`} organizationId={orgId} />\n *\n * Runtime deps of this subpath: none beyond React.\n * Styling is the Matrx Tailwind semantic-token vocabulary;\n * override via `className` (last-wins merge is the host's concern — the class\n * string is appended).\n */\n\nimport { useCallback, useRef, useState } from \"react\";\n\nimport {\n  mintShortLink,\n  type MintShortLinkOptions,\n  type MintShortLinkResult,\n  type ShortLinkClient,\n} from \"./short-link\";\n\nasync function writeClipboard(text: string): Promise<boolean> {\n  try {\n    await navigator.clipboard.writeText(text);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport interface UseShortLinkResult {\n  /** Mint (once) and return the short URL; re-calls return the cached mint. */\n  mint: () => Promise<MintShortLinkResult>;\n  /** The minted URL, once `mint` has succeeded. */\n  url: string | null;\n  minting: boolean;\n  error: string | null;\n}\n\n/** Mint-on-demand with caching — the logic under `CopyShortLinkButton`. */\nexport function useShortLink(\n  client: ShortLinkClient,\n  options: MintShortLinkOptions,\n): UseShortLinkResult {\n  const [url, setUrl] = useState<string | null>(null);\n  const [minting, setMinting] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const cached = useRef<MintShortLinkResult | null>(null);\n\n  const mint = useCallback(async (): Promise<MintShortLinkResult> => {\n    if (cached.current?.ok) return cached.current;\n    setMinting(true);\n    setError(null);\n    try {\n      const result = await mintShortLink(client, options);\n      cached.current = result;\n      if (result.ok) {\n        setUrl(result.url);\n      } else {\n        setError(result.error);\n      }\n      return result;\n    } finally {\n      setMinting(false);\n    }\n  }, [client, options.path, options.organizationId, options.expiresAt, options.origin]);\n\n  return { mint, url, minting, error };\n}\n\nexport interface CopyShortLinkButtonProps extends MintShortLinkOptions {\n  /** Your Supabase client (anything with a compatible `.rpc`). */\n  client: ShortLinkClient;\n  /** Button label; default \"Copy short link\". */\n  label?: string;\n  className?: string;\n  /** Called with the short URL after it lands on the clipboard. */\n  onCopied?: (url: string) => void;\n  onError?: (error: string) => void;\n}\n\n/**\n * One click: mint (first time only), copy the short URL, confirm inline.\n * The mint is lazy — no short-link row exists until someone actually asks\n * for the link.\n */\nexport function CopyShortLinkButton({\n  client,\n  label = \"Copy short link\",\n  className,\n  onCopied,\n  onError,\n  ...options\n}: CopyShortLinkButtonProps) {\n  const { mint, minting } = useShortLink(client, options);\n  const [phase, setPhase] = useState<\"idle\" | \"copied\" | \"error\">(\"idle\");\n  const resetTimer = useRef<ReturnType<typeof setTimeout> | null>(null);\n\n  const flash = useCallback((next: \"copied\" | \"error\") => {\n    setPhase(next);\n    if (resetTimer.current) clearTimeout(resetTimer.current);\n    resetTimer.current = setTimeout(() => setPhase(\"idle\"), 2000);\n  }, []);\n\n  const onClick = useCallback(async () => {\n    const result = await mint();\n    if (!result.ok) {\n      flash(\"error\");\n      onError?.(result.error);\n      return;\n    }\n    const copied = await writeClipboard(result.url);\n    if (copied) {\n      flash(\"copied\");\n      onCopied?.(result.url);\n    } else {\n      flash(\"error\");\n      onError?.(\"Could not write to the clipboard\");\n    }\n  }, [mint, flash, onCopied, onError]);\n\n  const text =\n    phase === \"copied\" ? \"Copied\" : phase === \"error\" ? \"Copy failed\" : minting ? \"Creating…\" : label;\n\n  return (\n    <button\n      type=\"button\"\n      onClick={onClick}\n      disabled={minting}\n      aria-live=\"polite\"\n      className={\n        \"inline-flex items-center gap-1.5 rounded-md border border-border bg-card px-2.5 py-1.5 \" +\n        \"text-sm font-medium text-foreground hover:bg-muted disabled:opacity-60 \" +\n        (phase === \"error\" ? \"text-destructive \" : \"\") +\n        (className ?? \"\")\n      }\n    >\n      {text}\n    </button>\n  );\n}\n","/**\n * @ai-matrx/kit/short-link — the platform short-link CONTRACT, in one place.\n *\n * The primitive itself lives in the database (migration `0557_platform_short_links`):\n * `platform.short_links` holds `token → same-app path`, org-scoped and expiring;\n * `platform.create_short_link` mints (server-side only); `public.resolve_short_link`\n * resolves (anon-callable; answers with a PATH, never content — the target route's\n * own auth gates everything). The frontend redirect route is `/r/[token]`\n * (matrx-frontend `app/(public)/r/[token]`), and the notification spine mints per\n * SMS leg (aidream `services/notifications/short_links.py`).\n *\n * This module is the shared vocabulary every client needs to speak about those\n * tokens — alphabet, length, validation, and the URL shape — so no consumer ever\n * re-declares it. 🚨 `SHORT_LINK_TOKEN_ALPHABET` and `SHORT_LINK_TOKEN_LENGTH`\n * mirror `platform.create_short_link` EXACTLY; change one and you change both.\n *\n * 🚨 A short link is a URL, not a permission. The primitive that grants\n * anonymous access to content is `platform.share_links` (`/s/[token]`, 64-hex\n * tokens) — a different system, deliberately. Never shorten by minting a share\n * link, and never share by minting a short link.\n *\n * Pure logic — no DOM, no React, no network; safe in Server Components, route\n * handlers, workers, and Node scripts.\n */\n\n/**\n * 32 characters: digits 2–9 plus a–z minus `l` and `o`. 256 % 32 = 0, so the\n * mint maps random bytes without modulo bias; lowercase-only survives channels\n * that case-mangle (the resolver lowercases before lookup); the ambiguous\n * glyphs (`0/o`, `1/l`) never appear.\n */\nexport const SHORT_LINK_TOKEN_ALPHABET = \"23456789abcdefghijkmnpqrstuvwxyz\";\n\n/** 10 characters × 5 bits = 50 bits — unguessable at any realistic probe rate. */\nexport const SHORT_LINK_TOKEN_LENGTH = 10;\n\n/** The resolve route on the app origin (matrx-frontend `app/(public)/r/[token]`). */\nexport const SHORT_LINK_PATH_PREFIX = \"/r/\";\n\nconst TOKEN_RE = new RegExp(`^[${SHORT_LINK_TOKEN_ALPHABET}]{${SHORT_LINK_TOKEN_LENGTH}}$`);\n\n/**\n * Trim, lowercase, and shape-check a candidate token. Returns the normalized\n * token, or `null` for anything outside the contract — the resolver would\n * refuse it anyway, so callers can skip the round trip.\n */\nexport function normalizeShortLinkToken(candidate: string | null | undefined): string | null {\n  const token = (candidate ?? \"\").trim().toLowerCase();\n  return TOKEN_RE.test(token) ? token : null;\n}\n\n/** Whether a string is a well-formed short-link token (after normalization). */\nexport function isShortLinkToken(candidate: string | null | undefined): boolean {\n  return normalizeShortLinkToken(candidate) !== null;\n}\n\n/** The app-relative path a token resolves at: `/r/<token>`. */\nexport function shortLinkPath(token: string): string {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) {\n    throw new Error(\n      `shortLinkPath: ${JSON.stringify(token)} is not a short-link token ` +\n        `(${SHORT_LINK_TOKEN_LENGTH} chars of \"${SHORT_LINK_TOKEN_ALPHABET}\")`,\n    );\n  }\n  return `${SHORT_LINK_PATH_PREFIX}${normalized}`;\n}\n\n/**\n * The absolute short URL for a token on a given origin, e.g.\n * `shortLinkUrl(\"https://app.aimatrx.com\", token)` → `https://app.aimatrx.com/r/<token>`.\n */\nexport function shortLinkUrl(origin: string, token: string): string {\n  return `${origin.replace(/\\/+$/, \"\")}${shortLinkPath(token)}`;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The client half — the WHOLE mint/resolve logic, so a consumer adds nothing.\n//\n// Pass your Supabase client (or anything with a compatible `.rpc`) and you are\n// done: `mintShortLink(supabase, { path, organizationId })` calls the platform's\n// authenticated mint door (`public.shorten_app_url`, org-membership-gated) and\n// hands back the finished short URL; `resolveShortLinkPath(supabase, token)`\n// calls the anon resolver (`public.resolve_short_link`). No app writes its own\n// shortener logic, ever — the only thing outside this module is the shared\n// database that stores the tokens, which is exactly where shared state lives.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Anything with a Supabase-shaped `.rpc` — pass the Supabase client itself. */\nexport interface ShortLinkClient {\n  rpc(\n    fn: string,\n    args?: Record<string, unknown>,\n  ): PromiseLike<{ data: unknown; error: { message: string } | null }>;\n}\n\nexport interface MintShortLinkOptions {\n  /** Same-app path to shorten (must start with a single `/`). */\n  path: string;\n  /** The organization the link belongs to — the caller must be a member. */\n  organizationId: string;\n  /** ISO timestamp; the platform default (365 days) applies when omitted. */\n  expiresAt?: string;\n  /** Origin for the returned URL; defaults to `window.location.origin`. */\n  origin?: string;\n}\n\nexport type MintShortLinkResult =\n  | { ok: true; token: string; path: string; url: string }\n  | { ok: false; error: string };\n\nfunction resolveOrigin(origin?: string): string | null {\n  if (origin) return origin;\n  if (typeof window !== \"undefined\" && window.location?.origin) {\n    return window.location.origin;\n  }\n  return null;\n}\n\n/** Mint a short link through the platform's authenticated mint door. */\nexport async function mintShortLink(\n  client: ShortLinkClient,\n  options: MintShortLinkOptions,\n): Promise<MintShortLinkResult> {\n  if (!options.path.startsWith(\"/\") || options.path.startsWith(\"//\")) {\n    return { ok: false, error: \"Only a same-app path (starting with a single '/') can be shortened\" };\n  }\n  const origin = resolveOrigin(options.origin);\n  if (!origin) {\n    return { ok: false, error: \"No origin: pass options.origin outside a browser\" };\n  }\n  const { data, error } = await client.rpc(\"shorten_app_url\", {\n    p_path: options.path,\n    p_organization_id: options.organizationId,\n    ...(options.expiresAt ? { p_expires_at: options.expiresAt } : {}),\n  });\n  if (error) return { ok: false, error: error.message };\n  const result = data as { ok?: boolean; token?: string; error?: string } | null;\n  const token = result?.ok ? normalizeShortLinkToken(result.token) : null;\n  if (!token) {\n    return { ok: false, error: result?.error ?? \"The mint door returned no token\" };\n  }\n  return { ok: true, token, path: shortLinkPath(token), url: shortLinkUrl(origin, token) };\n}\n\nexport type ResolveShortLinkResult =\n  | { ok: true; targetPath: string }\n  | { ok: false };\n\n/**\n * Resolve a short token to its target path through the anon resolver.\n * `{ok:false}` covers invalid, unknown, and expired identically — the platform\n * deliberately does not distinguish them.\n */\nexport async function resolveShortLinkPath(\n  client: ShortLinkClient,\n  token: string,\n): Promise<ResolveShortLinkResult> {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) return { ok: false };\n  const { data, error } = await client.rpc(\"resolve_short_link\", { p_token: normalized });\n  if (error) return { ok: false };\n  const result = data as { ok?: boolean; target_path?: string } | null;\n  const targetPath = result?.ok ? result.target_path : undefined;\n  if (!targetPath || !targetPath.startsWith(\"/\") || targetPath.startsWith(\"//\")) {\n    return { ok: false };\n  }\n  return { ok: true, targetPath };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBA,mBAA8C;;;ACevC,IAAM,4BAA4B;AAGlC,IAAM,0BAA0B;AAGhC,IAAM,yBAAyB;AAEtC,IAAM,WAAW,IAAI,OAAO,KAAK,yBAAyB,KAAK,uBAAuB,IAAI;AAOnF,SAAS,wBAAwB,WAAqD;AAC3F,QAAM,SAAS,aAAa,IAAI,KAAK,EAAE,YAAY;AACnD,SAAO,SAAS,KAAK,KAAK,IAAI,QAAQ;AACxC;AAQO,SAAS,cAAc,OAAuB;AACnD,QAAM,aAAa,wBAAwB,KAAK;AAChD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR,kBAAkB,KAAK,UAAU,KAAK,CAAC,+BACjC,uBAAuB,cAAc,yBAAyB;AAAA,IACtE;AAAA,EACF;AACA,SAAO,GAAG,sBAAsB,GAAG,UAAU;AAC/C;AAMO,SAAS,aAAa,QAAgB,OAAuB;AAClE,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC,GAAG,cAAc,KAAK,CAAC;AAC7D;AAqCA,SAAS,cAAc,QAAgC;AACrD,MAAI,OAAQ,QAAO;AACnB,MAAI,OAAO,WAAW,eAAe,OAAO,UAAU,QAAQ;AAC5D,WAAO,OAAO,SAAS;AAAA,EACzB;AACA,SAAO;AACT;AAGA,eAAsB,cACpB,QACA,SAC8B;AAC9B,MAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,QAAQ,KAAK,WAAW,IAAI,GAAG;AAClE,WAAO,EAAE,IAAI,OAAO,OAAO,qEAAqE;AAAA,EAClG;AACA,QAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,IAAI,OAAO,OAAO,mDAAmD;AAAA,EAChF;AACA,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,mBAAmB;AAAA,IAC1D,QAAQ,QAAQ;AAAA,IAChB,mBAAmB,QAAQ;AAAA,IAC3B,GAAI,QAAQ,YAAY,EAAE,cAAc,QAAQ,UAAU,IAAI,CAAC;AAAA,EACjE,CAAC;AACD,MAAI,MAAO,QAAO,EAAE,IAAI,OAAO,OAAO,MAAM,QAAQ;AACpD,QAAM,SAAS;AACf,QAAM,QAAQ,QAAQ,KAAK,wBAAwB,OAAO,KAAK,IAAI;AACnE,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,SAAS,kCAAkC;AAAA,EAChF;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,MAAM,cAAc,KAAK,GAAG,KAAK,aAAa,QAAQ,KAAK,EAAE;AACzF;;;ADdI;AAxGJ,eAAe,eAAe,MAAgC;AAC5D,MAAI;AACF,UAAM,UAAU,UAAU,UAAU,IAAI;AACxC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYO,SAAS,aACd,QACA,SACoB;AACpB,QAAM,CAAC,KAAK,MAAM,QAAI,uBAAwB,IAAI;AAClD,QAAM,CAAC,SAAS,UAAU,QAAI,uBAAS,KAAK;AAC5C,QAAM,CAAC,OAAO,QAAQ,QAAI,uBAAwB,IAAI;AACtD,QAAM,aAAS,qBAAmC,IAAI;AAEtD,QAAM,WAAO,0BAAY,YAA0C;AACjE,QAAI,OAAO,SAAS,GAAI,QAAO,OAAO;AACtC,eAAW,IAAI;AACf,aAAS,IAAI;AACb,QAAI;AACF,YAAM,SAAS,MAAM,cAAc,QAAQ,OAAO;AAClD,aAAO,UAAU;AACjB,UAAI,OAAO,IAAI;AACb,eAAO,OAAO,GAAG;AAAA,MACnB,OAAO;AACL,iBAAS,OAAO,KAAK;AAAA,MACvB;AACA,aAAO;AAAA,IACT,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,QAAQ,QAAQ,MAAM,QAAQ,gBAAgB,QAAQ,WAAW,QAAQ,MAAM,CAAC;AAEpF,SAAO,EAAE,MAAM,KAAK,SAAS,MAAM;AACrC;AAkBO,SAAS,oBAAoB;AAAA,EAClC;AAAA,EACA,QAAQ;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,GAA6B;AAC3B,QAAM,EAAE,MAAM,QAAQ,IAAI,aAAa,QAAQ,OAAO;AACtD,QAAM,CAAC,OAAO,QAAQ,QAAI,uBAAsC,MAAM;AACtE,QAAM,iBAAa,qBAA6C,IAAI;AAEpE,QAAM,YAAQ,0BAAY,CAAC,SAA6B;AACtD,aAAS,IAAI;AACb,QAAI,WAAW,QAAS,cAAa,WAAW,OAAO;AACvD,eAAW,UAAU,WAAW,MAAM,SAAS,MAAM,GAAG,GAAI;AAAA,EAC9D,GAAG,CAAC,CAAC;AAEL,QAAM,cAAU,0BAAY,YAAY;AACtC,UAAM,SAAS,MAAM,KAAK;AAC1B,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,OAAO;AACb,gBAAU,OAAO,KAAK;AACtB;AAAA,IACF;AACA,UAAM,SAAS,MAAM,eAAe,OAAO,GAAG;AAC9C,QAAI,QAAQ;AACV,YAAM,QAAQ;AACd,iBAAW,OAAO,GAAG;AAAA,IACvB,OAAO;AACL,YAAM,OAAO;AACb,gBAAU,kCAAkC;AAAA,IAC9C;AAAA,EACF,GAAG,CAAC,MAAM,OAAO,UAAU,OAAO,CAAC;AAEnC,QAAM,OACJ,UAAU,WAAW,WAAW,UAAU,UAAU,gBAAgB,UAAU,mBAAc;AAE9F,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL;AAAA,MACA,UAAU;AAAA,MACV,aAAU;AAAA,MACV,WACE,oKAEC,UAAU,UAAU,sBAAsB,OAC1C,aAAa;AAAA,MAGf;AAAA;AAAA,EACH;AAEJ;","names":[]}
+{"version":3,"sources":["../src/short-link-react.tsx","../src/short-link.ts"],"sourcesContent":["/**\n * @ai-matrx/kit/short-link-react — the drop-in short-link UI, headless included.\n *\n * The five-minute story: import the button, hand it your Supabase client, done.\n * The mint call (the org-gated `shorten_app_url` door), the URL shape, the\n * clipboard write, and the state feedback all live HERE — a consuming app\n * writes zero shortener logic.\n *\n *   <CopyShortLinkButton client={supabase} path={`/notes/${id}`} organizationId={orgId} />\n *   <CopyPageShortLinkButton client={supabase} organizationId={orgId} />  // THIS page, query string and all\n *\n * Custom chrome (a menu row, a context-menu item, an icon button)? Use the\n * headless hook and keep only the markup:\n *\n *   const { copy, phase } = useCopyShortLink(supabase, { organizationId });\n *   <button onClick={copy}>{phase === \"copied\" ? \"Copied\" : \"Copy short link\"}</button>\n *\n * Omitting `path` means \"the current page at the moment of the click\" —\n * pathname + query + hash, so a sorted/filtered/column-configured view\n * shortens to exactly that view.\n *\n * Runtime deps of this subpath: none beyond React.\n * Styling is the Matrx Tailwind semantic-token vocabulary; override via\n * `className` (the class string is appended).\n */\n\nimport { useCallback, useRef, useState } from \"react\";\n\nimport {\n  currentAppPath,\n  mintShortLink,\n  type MintShortLinkOptions,\n  type MintShortLinkResult,\n  type ShortLinkClient,\n} from \"./short-link\";\n\nasync function writeClipboard(text: string): Promise<boolean> {\n  try {\n    await navigator.clipboard.writeText(text);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport interface UseShortLinkResult {\n  /** Mint (once) and return the short URL; re-calls return the cached mint. */\n  mint: () => Promise<MintShortLinkResult>;\n  /** The minted URL, once `mint` has succeeded. */\n  url: string | null;\n  minting: boolean;\n  error: string | null;\n}\n\n/** Mint-on-demand with caching — a fixed path known at render time. */\nexport function useShortLink(\n  client: ShortLinkClient,\n  options: MintShortLinkOptions,\n): UseShortLinkResult {\n  const [url, setUrl] = useState<string | null>(null);\n  const [minting, setMinting] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const cached = useRef<MintShortLinkResult | null>(null);\n\n  const mint = useCallback(async (): Promise<MintShortLinkResult> => {\n    if (cached.current?.ok) return cached.current;\n    setMinting(true);\n    setError(null);\n    try {\n      const result = await mintShortLink(client, options);\n      cached.current = result;\n      if (result.ok) {\n        setUrl(result.url);\n      } else {\n        setError(result.error);\n      }\n      return result;\n    } finally {\n      setMinting(false);\n    }\n  }, [client, options.path, options.organizationId, options.expiresAt, options.origin]);\n\n  return { mint, url, minting, error };\n}\n\nexport type CopyShortLinkPhase = \"idle\" | \"minting\" | \"copied\" | \"error\";\n\nexport interface UseCopyShortLinkOptions\n  extends Omit<MintShortLinkOptions, \"path\"> {\n  /**\n   * Path to shorten. Omit for \"the current page at click time\" (pathname +\n   * query + hash — the exact configured view).\n   */\n  path?: string;\n  /** Called with the short URL after it lands on the clipboard. */\n  onCopied?: (url: string) => void;\n  onError?: (error: string) => void;\n}\n\nexport interface UseCopyShortLinkResult {\n  /** Mint (cached per path) + copy to the clipboard. The whole flow. */\n  copy: () => Promise<{ ok: boolean; url?: string; error?: string }>;\n  phase: CopyShortLinkPhase;\n  /** The last successfully copied URL. */\n  lastUrl: string | null;\n}\n\n/**\n * The headless whole-flow hook: mint (cached per path), clipboard write, and a\n * self-resetting phase for feedback. Every piece of chrome — the buttons below,\n * a menu row, a context-menu item — sits on this.\n */\nexport function useCopyShortLink(\n  client: ShortLinkClient,\n  options: UseCopyShortLinkOptions,\n): UseCopyShortLinkResult {\n  const [phase, setPhase] = useState<CopyShortLinkPhase>(\"idle\");\n  const [lastUrl, setLastUrl] = useState<string | null>(null);\n  const cache = useRef<Map<string, MintShortLinkResult>>(new Map());\n  const resetTimer = useRef<ReturnType<typeof setTimeout> | null>(null);\n  const { path, onCopied, onError, ...mintOptions } = options;\n\n  const flash = useCallback((next: \"copied\" | \"error\") => {\n    setPhase(next);\n    if (resetTimer.current) clearTimeout(resetTimer.current);\n    resetTimer.current = setTimeout(() => setPhase(\"idle\"), 2000);\n  }, []);\n\n  const copy = useCallback(async () => {\n    const targetPath = path ?? currentAppPath();\n    if (!targetPath) {\n      flash(\"error\");\n      onError?.(\"No path to shorten\");\n      return { ok: false, error: \"No path to shorten\" };\n    }\n    let result = cache.current.get(targetPath);\n    if (!result?.ok) {\n      setPhase(\"minting\");\n      result = await mintShortLink(client, { ...mintOptions, path: targetPath });\n      cache.current.set(targetPath, result);\n    }\n    if (!result.ok) {\n      flash(\"error\");\n      onError?.(result.error);\n      return { ok: false, error: result.error };\n    }\n    const copied = await writeClipboard(result.url);\n    if (!copied) {\n      flash(\"error\");\n      onError?.(\"Could not write to the clipboard\");\n      return { ok: false, error: \"Could not write to the clipboard\" };\n    }\n    setLastUrl(result.url);\n    flash(\"copied\");\n    onCopied?.(result.url);\n    return { ok: true, url: result.url };\n  }, [\n    client,\n    path,\n    mintOptions.organizationId,\n    mintOptions.expiresAt,\n    mintOptions.origin,\n    flash,\n    onCopied,\n    onError,\n  ]);\n\n  return { copy, phase, lastUrl };\n}\n\nexport interface CopyShortLinkButtonProps extends UseCopyShortLinkOptions {\n  /** Your Supabase client (anything with a compatible `.rpc`). */\n  client: ShortLinkClient;\n  /** Button label; default \"Copy short link\". */\n  label?: string;\n  className?: string;\n}\n\n/**\n * One click: mint (first time only), copy the short URL, confirm inline.\n * The mint is lazy — no short-link row exists until someone actually asks\n * for the link. With no `path`, shortens the current page at click time.\n */\nexport function CopyShortLinkButton({\n  client,\n  label = \"Copy short link\",\n  className,\n  ...options\n}: CopyShortLinkButtonProps) {\n  const { copy, phase } = useCopyShortLink(client, options);\n\n  const text =\n    phase === \"copied\"\n      ? \"Copied\"\n      : phase === \"error\"\n        ? \"Copy failed\"\n        : phase === \"minting\"\n          ? \"Creating…\"\n          : label;\n\n  return (\n    <button\n      type=\"button\"\n      onClick={copy}\n      disabled={phase === \"minting\"}\n      aria-live=\"polite\"\n      className={\n        \"inline-flex items-center gap-1.5 rounded-md border border-border bg-card px-2.5 py-1.5 \" +\n        \"text-sm font-medium text-foreground hover:bg-muted disabled:opacity-60 \" +\n        (phase === \"error\" ? \"text-destructive \" : \"\") +\n        (className ?? \"\")\n      }\n    >\n      {text}\n    </button>\n  );\n}\n\nexport type CopyPageShortLinkButtonProps = Omit<CopyShortLinkButtonProps, \"path\">;\n\n/**\n * \"Copy a short link to THIS page\" — the zero-thought affordance. The path is\n * read at click time (pathname + query + hash), so whatever the person has\n * configured — sorts, filters, hidden columns, a hash target — is exactly what\n * the recipient opens.\n */\nexport function CopyPageShortLinkButton(props: CopyPageShortLinkButtonProps) {\n  return <CopyShortLinkButton {...props} />;\n}\n","/**\n * @ai-matrx/kit/short-link — the platform short-link CONTRACT, in one place.\n *\n * The primitive itself lives in the database (migration `0557_platform_short_links`):\n * `platform.short_links` holds `token → same-app path`, org-scoped and expiring;\n * `platform.create_short_link` mints (server-side only); `public.resolve_short_link`\n * resolves (anon-callable; answers with a PATH, never content — the target route's\n * own auth gates everything). The frontend redirect route is `/r/[token]`\n * (matrx-frontend `app/(public)/r/[token]`), and the notification spine mints per\n * SMS leg (aidream `services/notifications/short_links.py`).\n *\n * This module is the shared vocabulary every client needs to speak about those\n * tokens — alphabet, length, validation, and the URL shape — so no consumer ever\n * re-declares it. 🚨 `SHORT_LINK_TOKEN_ALPHABET` and `SHORT_LINK_TOKEN_LENGTH`\n * mirror `platform.create_short_link` EXACTLY; change one and you change both.\n *\n * 🚨 A short link is a URL, not a permission. The primitive that grants\n * anonymous access to content is `platform.share_links` (`/s/[token]`, 64-hex\n * tokens) — a different system, deliberately. Never shorten by minting a share\n * link, and never share by minting a short link.\n *\n * Pure logic — no DOM, no React, no network; safe in Server Components, route\n * handlers, workers, and Node scripts.\n */\n\n/**\n * 32 characters: digits 2–9 plus a–z minus `l` and `o`. 256 % 32 = 0, so the\n * mint maps random bytes without modulo bias; lowercase-only survives channels\n * that case-mangle (the resolver lowercases before lookup); the ambiguous\n * glyphs (`0/o`, `1/l`) never appear.\n */\nexport const SHORT_LINK_TOKEN_ALPHABET = \"23456789abcdefghijkmnpqrstuvwxyz\";\n\n/** 10 characters × 5 bits = 50 bits — unguessable at any realistic probe rate. */\nexport const SHORT_LINK_TOKEN_LENGTH = 10;\n\n/** The resolve route on the app origin (matrx-frontend `app/(public)/r/[token]`). */\nexport const SHORT_LINK_PATH_PREFIX = \"/r/\";\n\nconst TOKEN_RE = new RegExp(`^[${SHORT_LINK_TOKEN_ALPHABET}]{${SHORT_LINK_TOKEN_LENGTH}}$`);\n\n/**\n * Trim, lowercase, and shape-check a candidate token. Returns the normalized\n * token, or `null` for anything outside the contract — the resolver would\n * refuse it anyway, so callers can skip the round trip.\n */\nexport function normalizeShortLinkToken(candidate: string | null | undefined): string | null {\n  const token = (candidate ?? \"\").trim().toLowerCase();\n  return TOKEN_RE.test(token) ? token : null;\n}\n\n/** Whether a string is a well-formed short-link token (after normalization). */\nexport function isShortLinkToken(candidate: string | null | undefined): boolean {\n  return normalizeShortLinkToken(candidate) !== null;\n}\n\n/** The app-relative path a token resolves at: `/r/<token>`. */\nexport function shortLinkPath(token: string): string {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) {\n    throw new Error(\n      `shortLinkPath: ${JSON.stringify(token)} is not a short-link token ` +\n        `(${SHORT_LINK_TOKEN_LENGTH} chars of \"${SHORT_LINK_TOKEN_ALPHABET}\")`,\n    );\n  }\n  return `${SHORT_LINK_PATH_PREFIX}${normalized}`;\n}\n\n/**\n * The absolute short URL for a token on a given origin, e.g.\n * `shortLinkUrl(\"https://app.aimatrx.com\", token)` → `https://app.aimatrx.com/r/<token>`.\n */\nexport function shortLinkUrl(origin: string, token: string): string {\n  return `${origin.replace(/\\/+$/, \"\")}${shortLinkPath(token)}`;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The client half — the WHOLE mint/resolve logic, so a consumer adds nothing.\n//\n// Pass your Supabase client (or anything with a compatible `.rpc`) and you are\n// done: `mintShortLink(supabase, { path, organizationId })` calls the platform's\n// authenticated mint door (`public.shorten_app_url`, org-membership-gated) and\n// hands back the finished short URL; `resolveShortLinkPath(supabase, token)`\n// calls the anon resolver (`public.resolve_short_link`). No app writes its own\n// shortener logic, ever — the only thing outside this module is the shared\n// database that stores the tokens, which is exactly where shared state lives.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Anything with a Supabase-shaped `.rpc` — pass the Supabase client itself. */\nexport interface ShortLinkClient {\n  rpc(\n    fn: string,\n    args?: Record<string, unknown>,\n  ): PromiseLike<{ data: unknown; error: { message: string } | null }>;\n}\n\nexport interface MintShortLinkOptions {\n  /** Same-app path to shorten (must start with a single `/`). */\n  path: string;\n  /** The organization the link belongs to — the caller must be a member. */\n  organizationId: string;\n  /** ISO timestamp; the platform default (365 days) applies when omitted. */\n  expiresAt?: string;\n  /** Origin for the returned URL; defaults to `window.location.origin`. */\n  origin?: string;\n}\n\nexport type MintShortLinkResult =\n  | { ok: true; token: string; path: string; url: string }\n  | { ok: false; error: string };\n\nfunction resolveOrigin(origin?: string): string | null {\n  if (origin) return origin;\n  if (typeof window !== \"undefined\" && window.location?.origin) {\n    return window.location.origin;\n  }\n  return null;\n}\n\n/** Mint a short link through the platform's authenticated mint door. */\nexport async function mintShortLink(\n  client: ShortLinkClient,\n  options: MintShortLinkOptions,\n): Promise<MintShortLinkResult> {\n  if (!options.path.startsWith(\"/\") || options.path.startsWith(\"//\")) {\n    return { ok: false, error: \"Only a same-app path (starting with a single '/') can be shortened\" };\n  }\n  const origin = resolveOrigin(options.origin);\n  if (!origin) {\n    return { ok: false, error: \"No origin: pass options.origin outside a browser\" };\n  }\n  const { data, error } = await client.rpc(\"shorten_app_url\", {\n    p_path: options.path,\n    p_organization_id: options.organizationId,\n    ...(options.expiresAt ? { p_expires_at: options.expiresAt } : {}),\n  });\n  if (error) return { ok: false, error: error.message };\n  const result = data as { ok?: boolean; token?: string; error?: string } | null;\n  const token = result?.ok ? normalizeShortLinkToken(result.token) : null;\n  if (!token) {\n    return { ok: false, error: result?.error ?? \"The mint door returned no token\" };\n  }\n  return { ok: true, token, path: shortLinkPath(token), url: shortLinkUrl(origin, token) };\n}\n\nexport type ResolveShortLinkResult =\n  | { ok: true; targetPath: string }\n  | { ok: false };\n\n/**\n * Resolve a short token to its target path through the anon resolver.\n * `{ok:false}` covers invalid, unknown, and expired identically — the platform\n * deliberately does not distinguish them.\n */\nexport async function resolveShortLinkPath(\n  client: ShortLinkClient,\n  token: string,\n): Promise<ResolveShortLinkResult> {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) return { ok: false };\n  const { data, error } = await client.rpc(\"resolve_short_link\", { p_token: normalized });\n  if (error) return { ok: false };\n  const result = data as { ok?: boolean; target_path?: string } | null;\n  const targetPath = result?.ok ? result.target_path : undefined;\n  if (!targetPath || !targetPath.startsWith(\"/\") || targetPath.startsWith(\"//\")) {\n    return { ok: false };\n  }\n  return { ok: true, targetPath };\n}\n\n/**\n * The current page as a shortenable same-app path — pathname + query + hash,\n * exactly the \"this view, as I have it configured\" URL (sorts, filters, hidden\n * columns riding in the query string all survive). `null` outside a browser.\n */\nexport function currentAppPath(): string | null {\n  if (typeof window === \"undefined\" || !window.location) return null;\n  const { pathname, search, hash } = window.location;\n  if (!pathname.startsWith(\"/\") || pathname.startsWith(\"//\")) return null;\n  return `${pathname}${search}${hash}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0BA,mBAA8C;;;ACKvC,IAAM,4BAA4B;AAGlC,IAAM,0BAA0B;AAGhC,IAAM,yBAAyB;AAEtC,IAAM,WAAW,IAAI,OAAO,KAAK,yBAAyB,KAAK,uBAAuB,IAAI;AAOnF,SAAS,wBAAwB,WAAqD;AAC3F,QAAM,SAAS,aAAa,IAAI,KAAK,EAAE,YAAY;AACnD,SAAO,SAAS,KAAK,KAAK,IAAI,QAAQ;AACxC;AAQO,SAAS,cAAc,OAAuB;AACnD,QAAM,aAAa,wBAAwB,KAAK;AAChD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR,kBAAkB,KAAK,UAAU,KAAK,CAAC,+BACjC,uBAAuB,cAAc,yBAAyB;AAAA,IACtE;AAAA,EACF;AACA,SAAO,GAAG,sBAAsB,GAAG,UAAU;AAC/C;AAMO,SAAS,aAAa,QAAgB,OAAuB;AAClE,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC,GAAG,cAAc,KAAK,CAAC;AAC7D;AAqCA,SAAS,cAAc,QAAgC;AACrD,MAAI,OAAQ,QAAO;AACnB,MAAI,OAAO,WAAW,eAAe,OAAO,UAAU,QAAQ;AAC5D,WAAO,OAAO,SAAS;AAAA,EACzB;AACA,SAAO;AACT;AAGA,eAAsB,cACpB,QACA,SAC8B;AAC9B,MAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,QAAQ,KAAK,WAAW,IAAI,GAAG;AAClE,WAAO,EAAE,IAAI,OAAO,OAAO,qEAAqE;AAAA,EAClG;AACA,QAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,IAAI,OAAO,OAAO,mDAAmD;AAAA,EAChF;AACA,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,mBAAmB;AAAA,IAC1D,QAAQ,QAAQ;AAAA,IAChB,mBAAmB,QAAQ;AAAA,IAC3B,GAAI,QAAQ,YAAY,EAAE,cAAc,QAAQ,UAAU,IAAI,CAAC;AAAA,EACjE,CAAC;AACD,MAAI,MAAO,QAAO,EAAE,IAAI,OAAO,OAAO,MAAM,QAAQ;AACpD,QAAM,SAAS;AACf,QAAM,QAAQ,QAAQ,KAAK,wBAAwB,OAAO,KAAK,IAAI;AACnE,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,SAAS,kCAAkC;AAAA,EAChF;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,MAAM,cAAc,KAAK,GAAG,KAAK,aAAa,QAAQ,KAAK,EAAE;AACzF;AAgCO,SAAS,iBAAgC;AAC9C,MAAI,OAAO,WAAW,eAAe,CAAC,OAAO,SAAU,QAAO;AAC9D,QAAM,EAAE,UAAU,QAAQ,KAAK,IAAI,OAAO;AAC1C,MAAI,CAAC,SAAS,WAAW,GAAG,KAAK,SAAS,WAAW,IAAI,EAAG,QAAO;AACnE,SAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI;AACpC;;;ADqBI;AArKJ,eAAe,eAAe,MAAgC;AAC5D,MAAI;AACF,UAAM,UAAU,UAAU,UAAU,IAAI;AACxC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYO,SAAS,aACd,QACA,SACoB;AACpB,QAAM,CAAC,KAAK,MAAM,QAAI,uBAAwB,IAAI;AAClD,QAAM,CAAC,SAAS,UAAU,QAAI,uBAAS,KAAK;AAC5C,QAAM,CAAC,OAAO,QAAQ,QAAI,uBAAwB,IAAI;AACtD,QAAM,aAAS,qBAAmC,IAAI;AAEtD,QAAM,WAAO,0BAAY,YAA0C;AACjE,QAAI,OAAO,SAAS,GAAI,QAAO,OAAO;AACtC,eAAW,IAAI;AACf,aAAS,IAAI;AACb,QAAI;AACF,YAAM,SAAS,MAAM,cAAc,QAAQ,OAAO;AAClD,aAAO,UAAU;AACjB,UAAI,OAAO,IAAI;AACb,eAAO,OAAO,GAAG;AAAA,MACnB,OAAO;AACL,iBAAS,OAAO,KAAK;AAAA,MACvB;AACA,aAAO;AAAA,IACT,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,QAAQ,QAAQ,MAAM,QAAQ,gBAAgB,QAAQ,WAAW,QAAQ,MAAM,CAAC;AAEpF,SAAO,EAAE,MAAM,KAAK,SAAS,MAAM;AACrC;AA6BO,SAAS,iBACd,QACA,SACwB;AACxB,QAAM,CAAC,OAAO,QAAQ,QAAI,uBAA6B,MAAM;AAC7D,QAAM,CAAC,SAAS,UAAU,QAAI,uBAAwB,IAAI;AAC1D,QAAM,YAAQ,qBAAyC,oBAAI,IAAI,CAAC;AAChE,QAAM,iBAAa,qBAA6C,IAAI;AACpE,QAAM,EAAE,MAAM,UAAU,SAAS,GAAG,YAAY,IAAI;AAEpD,QAAM,YAAQ,0BAAY,CAAC,SAA6B;AACtD,aAAS,IAAI;AACb,QAAI,WAAW,QAAS,cAAa,WAAW,OAAO;AACvD,eAAW,UAAU,WAAW,MAAM,SAAS,MAAM,GAAG,GAAI;AAAA,EAC9D,GAAG,CAAC,CAAC;AAEL,QAAM,WAAO,0BAAY,YAAY;AACnC,UAAM,aAAa,QAAQ,eAAe;AAC1C,QAAI,CAAC,YAAY;AACf,YAAM,OAAO;AACb,gBAAU,oBAAoB;AAC9B,aAAO,EAAE,IAAI,OAAO,OAAO,qBAAqB;AAAA,IAClD;AACA,QAAI,SAAS,MAAM,QAAQ,IAAI,UAAU;AACzC,QAAI,CAAC,QAAQ,IAAI;AACf,eAAS,SAAS;AAClB,eAAS,MAAM,cAAc,QAAQ,EAAE,GAAG,aAAa,MAAM,WAAW,CAAC;AACzE,YAAM,QAAQ,IAAI,YAAY,MAAM;AAAA,IACtC;AACA,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,OAAO;AACb,gBAAU,OAAO,KAAK;AACtB,aAAO,EAAE,IAAI,OAAO,OAAO,OAAO,MAAM;AAAA,IAC1C;AACA,UAAM,SAAS,MAAM,eAAe,OAAO,GAAG;AAC9C,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO;AACb,gBAAU,kCAAkC;AAC5C,aAAO,EAAE,IAAI,OAAO,OAAO,mCAAmC;AAAA,IAChE;AACA,eAAW,OAAO,GAAG;AACrB,UAAM,QAAQ;AACd,eAAW,OAAO,GAAG;AACrB,WAAO,EAAE,IAAI,MAAM,KAAK,OAAO,IAAI;AAAA,EACrC,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO,EAAE,MAAM,OAAO,QAAQ;AAChC;AAeO,SAAS,oBAAoB;AAAA,EAClC;AAAA,EACA,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA6B;AAC3B,QAAM,EAAE,MAAM,MAAM,IAAI,iBAAiB,QAAQ,OAAO;AAExD,QAAM,OACJ,UAAU,WACN,WACA,UAAU,UACR,gBACA,UAAU,YACR,mBACA;AAEV,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,SAAS;AAAA,MACT,UAAU,UAAU;AAAA,MACpB,aAAU;AAAA,MACV,WACE,oKAEC,UAAU,UAAU,sBAAsB,OAC1C,aAAa;AAAA,MAGf;AAAA;AAAA,EACH;AAEJ;AAUO,SAAS,wBAAwB,OAAqC;AAC3E,SAAO,4CAAC,uBAAqB,GAAG,OAAO;AACzC;","names":[]}

package/dist/short-link-react.d.cts

@@ -37,23 +37,56 @@ interface UseShortLinkResult {
     minting: boolean;
     error: string | null;
 }
-/** Mint-on-demand with caching — the logic under `CopyShortLinkButton`. */
+/** Mint-on-demand with caching — a fixed path known at render time. */
 declare function useShortLink(client: ShortLinkClient, options: MintShortLinkOptions): UseShortLinkResult;
-interface CopyShortLinkButtonProps extends MintShortLinkOptions {
+type CopyShortLinkPhase = "idle" | "minting" | "copied" | "error";
+interface UseCopyShortLinkOptions extends Omit<MintShortLinkOptions, "path"> {
+    /**
+     * Path to shorten. Omit for "the current page at click time" (pathname +
+     * query + hash — the exact configured view).
+     */
+    path?: string;
+    /** Called with the short URL after it lands on the clipboard. */
+    onCopied?: (url: string) => void;
+    onError?: (error: string) => void;
+}
+interface UseCopyShortLinkResult {
+    /** Mint (cached per path) + copy to the clipboard. The whole flow. */
+    copy: () => Promise<{
+        ok: boolean;
+        url?: string;
+        error?: string;
+    }>;
+    phase: CopyShortLinkPhase;
+    /** The last successfully copied URL. */
+    lastUrl: string | null;
+}
+/**
+ * The headless whole-flow hook: mint (cached per path), clipboard write, and a
+ * self-resetting phase for feedback. Every piece of chrome — the buttons below,
+ * a menu row, a context-menu item — sits on this.
+ */
+declare function useCopyShortLink(client: ShortLinkClient, options: UseCopyShortLinkOptions): UseCopyShortLinkResult;
+interface CopyShortLinkButtonProps extends UseCopyShortLinkOptions {
     /** Your Supabase client (anything with a compatible `.rpc`). */
     client: ShortLinkClient;
     /** Button label; default "Copy short link". */
     label?: string;
     className?: string;
-    /** Called with the short URL after it lands on the clipboard. */
-    onCopied?: (url: string) => void;
-    onError?: (error: string) => void;
 }
 /**
  * One click: mint (first time only), copy the short URL, confirm inline.
  * The mint is lazy — no short-link row exists until someone actually asks
- * for the link.
+ * for the link. With no `path`, shortens the current page at click time.
+ */
+declare function CopyShortLinkButton({ client, label, className, ...options }: CopyShortLinkButtonProps): React.JSX.Element;
+type CopyPageShortLinkButtonProps = Omit<CopyShortLinkButtonProps, "path">;
+/**
+ * "Copy a short link to THIS page" — the zero-thought affordance. The path is
+ * read at click time (pathname + query + hash), so whatever the person has
+ * configured — sorts, filters, hidden columns, a hash target — is exactly what
+ * the recipient opens.
  */
-declare function CopyShortLinkButton({ client, label, className, onCopied, onError, ...options }: CopyShortLinkButtonProps): React.JSX.Element;
+declare function CopyPageShortLinkButton(props: CopyPageShortLinkButtonProps): React.JSX.Element;
 
-export { CopyShortLinkButton, type CopyShortLinkButtonProps, type UseShortLinkResult, useShortLink };
+export { CopyPageShortLinkButton, type CopyPageShortLinkButtonProps, CopyShortLinkButton, type CopyShortLinkButtonProps, type CopyShortLinkPhase, type UseCopyShortLinkOptions, type UseCopyShortLinkResult, type UseShortLinkResult, useCopyShortLink, useShortLink };

package/dist/short-link-react.d.ts

@@ -37,23 +37,56 @@ interface UseShortLinkResult {
     minting: boolean;
     error: string | null;
 }
-/** Mint-on-demand with caching — the logic under `CopyShortLinkButton`. */
+/** Mint-on-demand with caching — a fixed path known at render time. */
 declare function useShortLink(client: ShortLinkClient, options: MintShortLinkOptions): UseShortLinkResult;
-interface CopyShortLinkButtonProps extends MintShortLinkOptions {
+type CopyShortLinkPhase = "idle" | "minting" | "copied" | "error";
+interface UseCopyShortLinkOptions extends Omit<MintShortLinkOptions, "path"> {
+    /**
+     * Path to shorten. Omit for "the current page at click time" (pathname +
+     * query + hash — the exact configured view).
+     */
+    path?: string;
+    /** Called with the short URL after it lands on the clipboard. */
+    onCopied?: (url: string) => void;
+    onError?: (error: string) => void;
+}
+interface UseCopyShortLinkResult {
+    /** Mint (cached per path) + copy to the clipboard. The whole flow. */
+    copy: () => Promise<{
+        ok: boolean;
+        url?: string;
+        error?: string;
+    }>;
+    phase: CopyShortLinkPhase;
+    /** The last successfully copied URL. */
+    lastUrl: string | null;
+}
+/**
+ * The headless whole-flow hook: mint (cached per path), clipboard write, and a
+ * self-resetting phase for feedback. Every piece of chrome — the buttons below,
+ * a menu row, a context-menu item — sits on this.
+ */
+declare function useCopyShortLink(client: ShortLinkClient, options: UseCopyShortLinkOptions): UseCopyShortLinkResult;
+interface CopyShortLinkButtonProps extends UseCopyShortLinkOptions {
     /** Your Supabase client (anything with a compatible `.rpc`). */
     client: ShortLinkClient;
     /** Button label; default "Copy short link". */
     label?: string;
     className?: string;
-    /** Called with the short URL after it lands on the clipboard. */
-    onCopied?: (url: string) => void;
-    onError?: (error: string) => void;
 }
 /**
  * One click: mint (first time only), copy the short URL, confirm inline.
  * The mint is lazy — no short-link row exists until someone actually asks
- * for the link.
+ * for the link. With no `path`, shortens the current page at click time.
+ */
+declare function CopyShortLinkButton({ client, label, className, ...options }: CopyShortLinkButtonProps): React.JSX.Element;
+type CopyPageShortLinkButtonProps = Omit<CopyShortLinkButtonProps, "path">;
+/**
+ * "Copy a short link to THIS page" — the zero-thought affordance. The path is
+ * read at click time (pathname + query + hash), so whatever the person has
+ * configured — sorts, filters, hidden columns, a hash target — is exactly what
+ * the recipient opens.
  */
-declare function CopyShortLinkButton({ client, label, className, onCopied, onError, ...options }: CopyShortLinkButtonProps): React.JSX.Element;
+declare function CopyPageShortLinkButton(props: CopyPageShortLinkButtonProps): React.JSX.Element;
 
-export { CopyShortLinkButton, type CopyShortLinkButtonProps, type UseShortLinkResult, useShortLink };
+export { CopyPageShortLinkButton, type CopyPageShortLinkButtonProps, CopyShortLinkButton, type CopyShortLinkButtonProps, type CopyShortLinkPhase, type UseCopyShortLinkOptions, type UseCopyShortLinkResult, type UseShortLinkResult, useCopyShortLink, useShortLink };

package/dist/short-link-react.js

@@ -52,6 +52,12 @@ async function mintShortLink(client, options) {
   }
   return { ok: true, token, path: shortLinkPath(token), url: shortLinkUrl(origin, token) };
 }
+function currentAppPath() {
+  if (typeof window === "undefined" || !window.location) return null;
+  const { pathname, search, hash } = window.location;
+  if (!pathname.startsWith("/") || pathname.startsWith("//")) return null;
+  return `${pathname}${search}${hash}`;
+}
 
 // src/short-link-react.tsx
 import { jsx } from "react/jsx-runtime";
@@ -87,53 +93,84 @@ function useShortLink(client, options) {
   }, [client, options.path, options.organizationId, options.expiresAt, options.origin]);
   return { mint, url, minting, error };
 }
-function CopyShortLinkButton({
-  client,
-  label = "Copy short link",
-  className,
-  onCopied,
-  onError,
-  ...options
-}) {
-  const { mint, minting } = useShortLink(client, options);
+function useCopyShortLink(client, options) {
   const [phase, setPhase] = useState("idle");
+  const [lastUrl, setLastUrl] = useState(null);
+  const cache = useRef(/* @__PURE__ */ new Map());
   const resetTimer = useRef(null);
+  const { path, onCopied, onError, ...mintOptions } = options;
   const flash = useCallback((next) => {
     setPhase(next);
     if (resetTimer.current) clearTimeout(resetTimer.current);
     resetTimer.current = setTimeout(() => setPhase("idle"), 2e3);
   }, []);
-  const onClick = useCallback(async () => {
-    const result = await mint();
+  const copy = useCallback(async () => {
+    const targetPath = path ?? currentAppPath();
+    if (!targetPath) {
+      flash("error");
+      onError?.("No path to shorten");
+      return { ok: false, error: "No path to shorten" };
+    }
+    let result = cache.current.get(targetPath);
+    if (!result?.ok) {
+      setPhase("minting");
+      result = await mintShortLink(client, { ...mintOptions, path: targetPath });
+      cache.current.set(targetPath, result);
+    }
     if (!result.ok) {
       flash("error");
       onError?.(result.error);
-      return;
+      return { ok: false, error: result.error };
     }
     const copied = await writeClipboard(result.url);
-    if (copied) {
-      flash("copied");
-      onCopied?.(result.url);
-    } else {
+    if (!copied) {
       flash("error");
       onError?.("Could not write to the clipboard");
+      return { ok: false, error: "Could not write to the clipboard" };
     }
-  }, [mint, flash, onCopied, onError]);
-  const text = phase === "copied" ? "Copied" : phase === "error" ? "Copy failed" : minting ? "Creating\u2026" : label;
+    setLastUrl(result.url);
+    flash("copied");
+    onCopied?.(result.url);
+    return { ok: true, url: result.url };
+  }, [
+    client,
+    path,
+    mintOptions.organizationId,
+    mintOptions.expiresAt,
+    mintOptions.origin,
+    flash,
+    onCopied,
+    onError
+  ]);
+  return { copy, phase, lastUrl };
+}
+function CopyShortLinkButton({
+  client,
+  label = "Copy short link",
+  className,
+  ...options
+}) {
+  const { copy, phase } = useCopyShortLink(client, options);
+  const text = phase === "copied" ? "Copied" : phase === "error" ? "Copy failed" : phase === "minting" ? "Creating\u2026" : label;
   return /* @__PURE__ */ jsx(
     "button",
     {
       type: "button",
-      onClick,
-      disabled: minting,
+      onClick: copy,
+      disabled: phase === "minting",
       "aria-live": "polite",
       className: "inline-flex items-center gap-1.5 rounded-md border border-border bg-card px-2.5 py-1.5 text-sm font-medium text-foreground hover:bg-muted disabled:opacity-60 " + (phase === "error" ? "text-destructive " : "") + (className ?? ""),
       children: text
     }
   );
 }
+function CopyPageShortLinkButton(props) {
+  return /* @__PURE__ */ jsx(CopyShortLinkButton, { ...props });
+}
 export {
+  CopyPageShortLinkButton,
   CopyShortLinkButton,
+  useCopyShortLink,
   useShortLink
 };
 //# sourceMappingURL=short-link-react.js.map

package/dist/short-link-react.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/short-link-react.tsx","../src/short-link.ts"],"sourcesContent":["/**\n * @ai-matrx/kit/short-link-react — the drop-in short-link UI.\n *\n * The five-minute story: import the button, hand it your Supabase client and a\n * path, done. The mint call (the org-gated `shorten_app_url` door), the URL\n * shape, the clipboard write, and the state feedback all live HERE — a\n * consuming app writes zero shortener logic.\n *\n *   <CopyShortLinkButton client={supabase} path={`/notes/${id}`} organizationId={orgId} />\n *\n * Runtime deps of this subpath: none beyond React.\n * Styling is the Matrx Tailwind semantic-token vocabulary;\n * override via `className` (last-wins merge is the host's concern — the class\n * string is appended).\n */\n\nimport { useCallback, useRef, useState } from \"react\";\n\nimport {\n  mintShortLink,\n  type MintShortLinkOptions,\n  type MintShortLinkResult,\n  type ShortLinkClient,\n} from \"./short-link\";\n\nasync function writeClipboard(text: string): Promise<boolean> {\n  try {\n    await navigator.clipboard.writeText(text);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport interface UseShortLinkResult {\n  /** Mint (once) and return the short URL; re-calls return the cached mint. */\n  mint: () => Promise<MintShortLinkResult>;\n  /** The minted URL, once `mint` has succeeded. */\n  url: string | null;\n  minting: boolean;\n  error: string | null;\n}\n\n/** Mint-on-demand with caching — the logic under `CopyShortLinkButton`. */\nexport function useShortLink(\n  client: ShortLinkClient,\n  options: MintShortLinkOptions,\n): UseShortLinkResult {\n  const [url, setUrl] = useState<string | null>(null);\n  const [minting, setMinting] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const cached = useRef<MintShortLinkResult | null>(null);\n\n  const mint = useCallback(async (): Promise<MintShortLinkResult> => {\n    if (cached.current?.ok) return cached.current;\n    setMinting(true);\n    setError(null);\n    try {\n      const result = await mintShortLink(client, options);\n      cached.current = result;\n      if (result.ok) {\n        setUrl(result.url);\n      } else {\n        setError(result.error);\n      }\n      return result;\n    } finally {\n      setMinting(false);\n    }\n  }, [client, options.path, options.organizationId, options.expiresAt, options.origin]);\n\n  return { mint, url, minting, error };\n}\n\nexport interface CopyShortLinkButtonProps extends MintShortLinkOptions {\n  /** Your Supabase client (anything with a compatible `.rpc`). */\n  client: ShortLinkClient;\n  /** Button label; default \"Copy short link\". */\n  label?: string;\n  className?: string;\n  /** Called with the short URL after it lands on the clipboard. */\n  onCopied?: (url: string) => void;\n  onError?: (error: string) => void;\n}\n\n/**\n * One click: mint (first time only), copy the short URL, confirm inline.\n * The mint is lazy — no short-link row exists until someone actually asks\n * for the link.\n */\nexport function CopyShortLinkButton({\n  client,\n  label = \"Copy short link\",\n  className,\n  onCopied,\n  onError,\n  ...options\n}: CopyShortLinkButtonProps) {\n  const { mint, minting } = useShortLink(client, options);\n  const [phase, setPhase] = useState<\"idle\" | \"copied\" | \"error\">(\"idle\");\n  const resetTimer = useRef<ReturnType<typeof setTimeout> | null>(null);\n\n  const flash = useCallback((next: \"copied\" | \"error\") => {\n    setPhase(next);\n    if (resetTimer.current) clearTimeout(resetTimer.current);\n    resetTimer.current = setTimeout(() => setPhase(\"idle\"), 2000);\n  }, []);\n\n  const onClick = useCallback(async () => {\n    const result = await mint();\n    if (!result.ok) {\n      flash(\"error\");\n      onError?.(result.error);\n      return;\n    }\n    const copied = await writeClipboard(result.url);\n    if (copied) {\n      flash(\"copied\");\n      onCopied?.(result.url);\n    } else {\n      flash(\"error\");\n      onError?.(\"Could not write to the clipboard\");\n    }\n  }, [mint, flash, onCopied, onError]);\n\n  const text =\n    phase === \"copied\" ? \"Copied\" : phase === \"error\" ? \"Copy failed\" : minting ? \"Creating…\" : label;\n\n  return (\n    <button\n      type=\"button\"\n      onClick={onClick}\n      disabled={minting}\n      aria-live=\"polite\"\n      className={\n        \"inline-flex items-center gap-1.5 rounded-md border border-border bg-card px-2.5 py-1.5 \" +\n        \"text-sm font-medium text-foreground hover:bg-muted disabled:opacity-60 \" +\n        (phase === \"error\" ? \"text-destructive \" : \"\") +\n        (className ?? \"\")\n      }\n    >\n      {text}\n    </button>\n  );\n}\n","/**\n * @ai-matrx/kit/short-link — the platform short-link CONTRACT, in one place.\n *\n * The primitive itself lives in the database (migration `0557_platform_short_links`):\n * `platform.short_links` holds `token → same-app path`, org-scoped and expiring;\n * `platform.create_short_link` mints (server-side only); `public.resolve_short_link`\n * resolves (anon-callable; answers with a PATH, never content — the target route's\n * own auth gates everything). The frontend redirect route is `/r/[token]`\n * (matrx-frontend `app/(public)/r/[token]`), and the notification spine mints per\n * SMS leg (aidream `services/notifications/short_links.py`).\n *\n * This module is the shared vocabulary every client needs to speak about those\n * tokens — alphabet, length, validation, and the URL shape — so no consumer ever\n * re-declares it. 🚨 `SHORT_LINK_TOKEN_ALPHABET` and `SHORT_LINK_TOKEN_LENGTH`\n * mirror `platform.create_short_link` EXACTLY; change one and you change both.\n *\n * 🚨 A short link is a URL, not a permission. The primitive that grants\n * anonymous access to content is `platform.share_links` (`/s/[token]`, 64-hex\n * tokens) — a different system, deliberately. Never shorten by minting a share\n * link, and never share by minting a short link.\n *\n * Pure logic — no DOM, no React, no network; safe in Server Components, route\n * handlers, workers, and Node scripts.\n */\n\n/**\n * 32 characters: digits 2–9 plus a–z minus `l` and `o`. 256 % 32 = 0, so the\n * mint maps random bytes without modulo bias; lowercase-only survives channels\n * that case-mangle (the resolver lowercases before lookup); the ambiguous\n * glyphs (`0/o`, `1/l`) never appear.\n */\nexport const SHORT_LINK_TOKEN_ALPHABET = \"23456789abcdefghijkmnpqrstuvwxyz\";\n\n/** 10 characters × 5 bits = 50 bits — unguessable at any realistic probe rate. */\nexport const SHORT_LINK_TOKEN_LENGTH = 10;\n\n/** The resolve route on the app origin (matrx-frontend `app/(public)/r/[token]`). */\nexport const SHORT_LINK_PATH_PREFIX = \"/r/\";\n\nconst TOKEN_RE = new RegExp(`^[${SHORT_LINK_TOKEN_ALPHABET}]{${SHORT_LINK_TOKEN_LENGTH}}$`);\n\n/**\n * Trim, lowercase, and shape-check a candidate token. Returns the normalized\n * token, or `null` for anything outside the contract — the resolver would\n * refuse it anyway, so callers can skip the round trip.\n */\nexport function normalizeShortLinkToken(candidate: string | null | undefined): string | null {\n  const token = (candidate ?? \"\").trim().toLowerCase();\n  return TOKEN_RE.test(token) ? token : null;\n}\n\n/** Whether a string is a well-formed short-link token (after normalization). */\nexport function isShortLinkToken(candidate: string | null | undefined): boolean {\n  return normalizeShortLinkToken(candidate) !== null;\n}\n\n/** The app-relative path a token resolves at: `/r/<token>`. */\nexport function shortLinkPath(token: string): string {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) {\n    throw new Error(\n      `shortLinkPath: ${JSON.stringify(token)} is not a short-link token ` +\n        `(${SHORT_LINK_TOKEN_LENGTH} chars of \"${SHORT_LINK_TOKEN_ALPHABET}\")`,\n    );\n  }\n  return `${SHORT_LINK_PATH_PREFIX}${normalized}`;\n}\n\n/**\n * The absolute short URL for a token on a given origin, e.g.\n * `shortLinkUrl(\"https://app.aimatrx.com\", token)` → `https://app.aimatrx.com/r/<token>`.\n */\nexport function shortLinkUrl(origin: string, token: string): string {\n  return `${origin.replace(/\\/+$/, \"\")}${shortLinkPath(token)}`;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The client half — the WHOLE mint/resolve logic, so a consumer adds nothing.\n//\n// Pass your Supabase client (or anything with a compatible `.rpc`) and you are\n// done: `mintShortLink(supabase, { path, organizationId })` calls the platform's\n// authenticated mint door (`public.shorten_app_url`, org-membership-gated) and\n// hands back the finished short URL; `resolveShortLinkPath(supabase, token)`\n// calls the anon resolver (`public.resolve_short_link`). No app writes its own\n// shortener logic, ever — the only thing outside this module is the shared\n// database that stores the tokens, which is exactly where shared state lives.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Anything with a Supabase-shaped `.rpc` — pass the Supabase client itself. */\nexport interface ShortLinkClient {\n  rpc(\n    fn: string,\n    args?: Record<string, unknown>,\n  ): PromiseLike<{ data: unknown; error: { message: string } | null }>;\n}\n\nexport interface MintShortLinkOptions {\n  /** Same-app path to shorten (must start with a single `/`). */\n  path: string;\n  /** The organization the link belongs to — the caller must be a member. */\n  organizationId: string;\n  /** ISO timestamp; the platform default (365 days) applies when omitted. */\n  expiresAt?: string;\n  /** Origin for the returned URL; defaults to `window.location.origin`. */\n  origin?: string;\n}\n\nexport type MintShortLinkResult =\n  | { ok: true; token: string; path: string; url: string }\n  | { ok: false; error: string };\n\nfunction resolveOrigin(origin?: string): string | null {\n  if (origin) return origin;\n  if (typeof window !== \"undefined\" && window.location?.origin) {\n    return window.location.origin;\n  }\n  return null;\n}\n\n/** Mint a short link through the platform's authenticated mint door. */\nexport async function mintShortLink(\n  client: ShortLinkClient,\n  options: MintShortLinkOptions,\n): Promise<MintShortLinkResult> {\n  if (!options.path.startsWith(\"/\") || options.path.startsWith(\"//\")) {\n    return { ok: false, error: \"Only a same-app path (starting with a single '/') can be shortened\" };\n  }\n  const origin = resolveOrigin(options.origin);\n  if (!origin) {\n    return { ok: false, error: \"No origin: pass options.origin outside a browser\" };\n  }\n  const { data, error } = await client.rpc(\"shorten_app_url\", {\n    p_path: options.path,\n    p_organization_id: options.organizationId,\n    ...(options.expiresAt ? { p_expires_at: options.expiresAt } : {}),\n  });\n  if (error) return { ok: false, error: error.message };\n  const result = data as { ok?: boolean; token?: string; error?: string } | null;\n  const token = result?.ok ? normalizeShortLinkToken(result.token) : null;\n  if (!token) {\n    return { ok: false, error: result?.error ?? \"The mint door returned no token\" };\n  }\n  return { ok: true, token, path: shortLinkPath(token), url: shortLinkUrl(origin, token) };\n}\n\nexport type ResolveShortLinkResult =\n  | { ok: true; targetPath: string }\n  | { ok: false };\n\n/**\n * Resolve a short token to its target path through the anon resolver.\n * `{ok:false}` covers invalid, unknown, and expired identically — the platform\n * deliberately does not distinguish them.\n */\nexport async function resolveShortLinkPath(\n  client: ShortLinkClient,\n  token: string,\n): Promise<ResolveShortLinkResult> {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) return { ok: false };\n  const { data, error } = await client.rpc(\"resolve_short_link\", { p_token: normalized });\n  if (error) return { ok: false };\n  const result = data as { ok?: boolean; target_path?: string } | null;\n  const targetPath = result?.ok ? result.target_path : undefined;\n  if (!targetPath || !targetPath.startsWith(\"/\") || targetPath.startsWith(\"//\")) {\n    return { ok: false };\n  }\n  return { ok: true, targetPath };\n}\n"],"mappings":";;;AAgBA,SAAS,aAAa,QAAQ,gBAAgB;;;ACevC,IAAM,4BAA4B;AAGlC,IAAM,0BAA0B;AAGhC,IAAM,yBAAyB;AAEtC,IAAM,WAAW,IAAI,OAAO,KAAK,yBAAyB,KAAK,uBAAuB,IAAI;AAOnF,SAAS,wBAAwB,WAAqD;AAC3F,QAAM,SAAS,aAAa,IAAI,KAAK,EAAE,YAAY;AACnD,SAAO,SAAS,KAAK,KAAK,IAAI,QAAQ;AACxC;AAQO,SAAS,cAAc,OAAuB;AACnD,QAAM,aAAa,wBAAwB,KAAK;AAChD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR,kBAAkB,KAAK,UAAU,KAAK,CAAC,+BACjC,uBAAuB,cAAc,yBAAyB;AAAA,IACtE;AAAA,EACF;AACA,SAAO,GAAG,sBAAsB,GAAG,UAAU;AAC/C;AAMO,SAAS,aAAa,QAAgB,OAAuB;AAClE,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC,GAAG,cAAc,KAAK,CAAC;AAC7D;AAqCA,SAAS,cAAc,QAAgC;AACrD,MAAI,OAAQ,QAAO;AACnB,MAAI,OAAO,WAAW,eAAe,OAAO,UAAU,QAAQ;AAC5D,WAAO,OAAO,SAAS;AAAA,EACzB;AACA,SAAO;AACT;AAGA,eAAsB,cACpB,QACA,SAC8B;AAC9B,MAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,QAAQ,KAAK,WAAW,IAAI,GAAG;AAClE,WAAO,EAAE,IAAI,OAAO,OAAO,qEAAqE;AAAA,EAClG;AACA,QAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,IAAI,OAAO,OAAO,mDAAmD;AAAA,EAChF;AACA,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,mBAAmB;AAAA,IAC1D,QAAQ,QAAQ;AAAA,IAChB,mBAAmB,QAAQ;AAAA,IAC3B,GAAI,QAAQ,YAAY,EAAE,cAAc,QAAQ,UAAU,IAAI,CAAC;AAAA,EACjE,CAAC;AACD,MAAI,MAAO,QAAO,EAAE,IAAI,OAAO,OAAO,MAAM,QAAQ;AACpD,QAAM,SAAS;AACf,QAAM,QAAQ,QAAQ,KAAK,wBAAwB,OAAO,KAAK,IAAI;AACnE,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,SAAS,kCAAkC;AAAA,EAChF;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,MAAM,cAAc,KAAK,GAAG,KAAK,aAAa,QAAQ,KAAK,EAAE;AACzF;;;ADdI;AAxGJ,eAAe,eAAe,MAAgC;AAC5D,MAAI;AACF,UAAM,UAAU,UAAU,UAAU,IAAI;AACxC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYO,SAAS,aACd,QACA,SACoB;AACpB,QAAM,CAAC,KAAK,MAAM,IAAI,SAAwB,IAAI;AAClD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,SAAS,OAAmC,IAAI;AAEtD,QAAM,OAAO,YAAY,YAA0C;AACjE,QAAI,OAAO,SAAS,GAAI,QAAO,OAAO;AACtC,eAAW,IAAI;AACf,aAAS,IAAI;AACb,QAAI;AACF,YAAM,SAAS,MAAM,cAAc,QAAQ,OAAO;AAClD,aAAO,UAAU;AACjB,UAAI,OAAO,IAAI;AACb,eAAO,OAAO,GAAG;AAAA,MACnB,OAAO;AACL,iBAAS,OAAO,KAAK;AAAA,MACvB;AACA,aAAO;AAAA,IACT,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,QAAQ,QAAQ,MAAM,QAAQ,gBAAgB,QAAQ,WAAW,QAAQ,MAAM,CAAC;AAEpF,SAAO,EAAE,MAAM,KAAK,SAAS,MAAM;AACrC;AAkBO,SAAS,oBAAoB;AAAA,EAClC;AAAA,EACA,QAAQ;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,GAA6B;AAC3B,QAAM,EAAE,MAAM,QAAQ,IAAI,aAAa,QAAQ,OAAO;AACtD,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAsC,MAAM;AACtE,QAAM,aAAa,OAA6C,IAAI;AAEpE,QAAM,QAAQ,YAAY,CAAC,SAA6B;AACtD,aAAS,IAAI;AACb,QAAI,WAAW,QAAS,cAAa,WAAW,OAAO;AACvD,eAAW,UAAU,WAAW,MAAM,SAAS,MAAM,GAAG,GAAI;AAAA,EAC9D,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,YAAY,YAAY;AACtC,UAAM,SAAS,MAAM,KAAK;AAC1B,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,OAAO;AACb,gBAAU,OAAO,KAAK;AACtB;AAAA,IACF;AACA,UAAM,SAAS,MAAM,eAAe,OAAO,GAAG;AAC9C,QAAI,QAAQ;AACV,YAAM,QAAQ;AACd,iBAAW,OAAO,GAAG;AAAA,IACvB,OAAO;AACL,YAAM,OAAO;AACb,gBAAU,kCAAkC;AAAA,IAC9C;AAAA,EACF,GAAG,CAAC,MAAM,OAAO,UAAU,OAAO,CAAC;AAEnC,QAAM,OACJ,UAAU,WAAW,WAAW,UAAU,UAAU,gBAAgB,UAAU,mBAAc;AAE9F,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL;AAAA,MACA,UAAU;AAAA,MACV,aAAU;AAAA,MACV,WACE,oKAEC,UAAU,UAAU,sBAAsB,OAC1C,aAAa;AAAA,MAGf;AAAA;AAAA,EACH;AAEJ;","names":[]}
+{"version":3,"sources":["../src/short-link-react.tsx","../src/short-link.ts"],"sourcesContent":["/**\n * @ai-matrx/kit/short-link-react — the drop-in short-link UI, headless included.\n *\n * The five-minute story: import the button, hand it your Supabase client, done.\n * The mint call (the org-gated `shorten_app_url` door), the URL shape, the\n * clipboard write, and the state feedback all live HERE — a consuming app\n * writes zero shortener logic.\n *\n *   <CopyShortLinkButton client={supabase} path={`/notes/${id}`} organizationId={orgId} />\n *   <CopyPageShortLinkButton client={supabase} organizationId={orgId} />  // THIS page, query string and all\n *\n * Custom chrome (a menu row, a context-menu item, an icon button)? Use the\n * headless hook and keep only the markup:\n *\n *   const { copy, phase } = useCopyShortLink(supabase, { organizationId });\n *   <button onClick={copy}>{phase === \"copied\" ? \"Copied\" : \"Copy short link\"}</button>\n *\n * Omitting `path` means \"the current page at the moment of the click\" —\n * pathname + query + hash, so a sorted/filtered/column-configured view\n * shortens to exactly that view.\n *\n * Runtime deps of this subpath: none beyond React.\n * Styling is the Matrx Tailwind semantic-token vocabulary; override via\n * `className` (the class string is appended).\n */\n\nimport { useCallback, useRef, useState } from \"react\";\n\nimport {\n  currentAppPath,\n  mintShortLink,\n  type MintShortLinkOptions,\n  type MintShortLinkResult,\n  type ShortLinkClient,\n} from \"./short-link\";\n\nasync function writeClipboard(text: string): Promise<boolean> {\n  try {\n    await navigator.clipboard.writeText(text);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport interface UseShortLinkResult {\n  /** Mint (once) and return the short URL; re-calls return the cached mint. */\n  mint: () => Promise<MintShortLinkResult>;\n  /** The minted URL, once `mint` has succeeded. */\n  url: string | null;\n  minting: boolean;\n  error: string | null;\n}\n\n/** Mint-on-demand with caching — a fixed path known at render time. */\nexport function useShortLink(\n  client: ShortLinkClient,\n  options: MintShortLinkOptions,\n): UseShortLinkResult {\n  const [url, setUrl] = useState<string | null>(null);\n  const [minting, setMinting] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const cached = useRef<MintShortLinkResult | null>(null);\n\n  const mint = useCallback(async (): Promise<MintShortLinkResult> => {\n    if (cached.current?.ok) return cached.current;\n    setMinting(true);\n    setError(null);\n    try {\n      const result = await mintShortLink(client, options);\n      cached.current = result;\n      if (result.ok) {\n        setUrl(result.url);\n      } else {\n        setError(result.error);\n      }\n      return result;\n    } finally {\n      setMinting(false);\n    }\n  }, [client, options.path, options.organizationId, options.expiresAt, options.origin]);\n\n  return { mint, url, minting, error };\n}\n\nexport type CopyShortLinkPhase = \"idle\" | \"minting\" | \"copied\" | \"error\";\n\nexport interface UseCopyShortLinkOptions\n  extends Omit<MintShortLinkOptions, \"path\"> {\n  /**\n   * Path to shorten. Omit for \"the current page at click time\" (pathname +\n   * query + hash — the exact configured view).\n   */\n  path?: string;\n  /** Called with the short URL after it lands on the clipboard. */\n  onCopied?: (url: string) => void;\n  onError?: (error: string) => void;\n}\n\nexport interface UseCopyShortLinkResult {\n  /** Mint (cached per path) + copy to the clipboard. The whole flow. */\n  copy: () => Promise<{ ok: boolean; url?: string; error?: string }>;\n  phase: CopyShortLinkPhase;\n  /** The last successfully copied URL. */\n  lastUrl: string | null;\n}\n\n/**\n * The headless whole-flow hook: mint (cached per path), clipboard write, and a\n * self-resetting phase for feedback. Every piece of chrome — the buttons below,\n * a menu row, a context-menu item — sits on this.\n */\nexport function useCopyShortLink(\n  client: ShortLinkClient,\n  options: UseCopyShortLinkOptions,\n): UseCopyShortLinkResult {\n  const [phase, setPhase] = useState<CopyShortLinkPhase>(\"idle\");\n  const [lastUrl, setLastUrl] = useState<string | null>(null);\n  const cache = useRef<Map<string, MintShortLinkResult>>(new Map());\n  const resetTimer = useRef<ReturnType<typeof setTimeout> | null>(null);\n  const { path, onCopied, onError, ...mintOptions } = options;\n\n  const flash = useCallback((next: \"copied\" | \"error\") => {\n    setPhase(next);\n    if (resetTimer.current) clearTimeout(resetTimer.current);\n    resetTimer.current = setTimeout(() => setPhase(\"idle\"), 2000);\n  }, []);\n\n  const copy = useCallback(async () => {\n    const targetPath = path ?? currentAppPath();\n    if (!targetPath) {\n      flash(\"error\");\n      onError?.(\"No path to shorten\");\n      return { ok: false, error: \"No path to shorten\" };\n    }\n    let result = cache.current.get(targetPath);\n    if (!result?.ok) {\n      setPhase(\"minting\");\n      result = await mintShortLink(client, { ...mintOptions, path: targetPath });\n      cache.current.set(targetPath, result);\n    }\n    if (!result.ok) {\n      flash(\"error\");\n      onError?.(result.error);\n      return { ok: false, error: result.error };\n    }\n    const copied = await writeClipboard(result.url);\n    if (!copied) {\n      flash(\"error\");\n      onError?.(\"Could not write to the clipboard\");\n      return { ok: false, error: \"Could not write to the clipboard\" };\n    }\n    setLastUrl(result.url);\n    flash(\"copied\");\n    onCopied?.(result.url);\n    return { ok: true, url: result.url };\n  }, [\n    client,\n    path,\n    mintOptions.organizationId,\n    mintOptions.expiresAt,\n    mintOptions.origin,\n    flash,\n    onCopied,\n    onError,\n  ]);\n\n  return { copy, phase, lastUrl };\n}\n\nexport interface CopyShortLinkButtonProps extends UseCopyShortLinkOptions {\n  /** Your Supabase client (anything with a compatible `.rpc`). */\n  client: ShortLinkClient;\n  /** Button label; default \"Copy short link\". */\n  label?: string;\n  className?: string;\n}\n\n/**\n * One click: mint (first time only), copy the short URL, confirm inline.\n * The mint is lazy — no short-link row exists until someone actually asks\n * for the link. With no `path`, shortens the current page at click time.\n */\nexport function CopyShortLinkButton({\n  client,\n  label = \"Copy short link\",\n  className,\n  ...options\n}: CopyShortLinkButtonProps) {\n  const { copy, phase } = useCopyShortLink(client, options);\n\n  const text =\n    phase === \"copied\"\n      ? \"Copied\"\n      : phase === \"error\"\n        ? \"Copy failed\"\n        : phase === \"minting\"\n          ? \"Creating…\"\n          : label;\n\n  return (\n    <button\n      type=\"button\"\n      onClick={copy}\n      disabled={phase === \"minting\"}\n      aria-live=\"polite\"\n      className={\n        \"inline-flex items-center gap-1.5 rounded-md border border-border bg-card px-2.5 py-1.5 \" +\n        \"text-sm font-medium text-foreground hover:bg-muted disabled:opacity-60 \" +\n        (phase === \"error\" ? \"text-destructive \" : \"\") +\n        (className ?? \"\")\n      }\n    >\n      {text}\n    </button>\n  );\n}\n\nexport type CopyPageShortLinkButtonProps = Omit<CopyShortLinkButtonProps, \"path\">;\n\n/**\n * \"Copy a short link to THIS page\" — the zero-thought affordance. The path is\n * read at click time (pathname + query + hash), so whatever the person has\n * configured — sorts, filters, hidden columns, a hash target — is exactly what\n * the recipient opens.\n */\nexport function CopyPageShortLinkButton(props: CopyPageShortLinkButtonProps) {\n  return <CopyShortLinkButton {...props} />;\n}\n","/**\n * @ai-matrx/kit/short-link — the platform short-link CONTRACT, in one place.\n *\n * The primitive itself lives in the database (migration `0557_platform_short_links`):\n * `platform.short_links` holds `token → same-app path`, org-scoped and expiring;\n * `platform.create_short_link` mints (server-side only); `public.resolve_short_link`\n * resolves (anon-callable; answers with a PATH, never content — the target route's\n * own auth gates everything). The frontend redirect route is `/r/[token]`\n * (matrx-frontend `app/(public)/r/[token]`), and the notification spine mints per\n * SMS leg (aidream `services/notifications/short_links.py`).\n *\n * This module is the shared vocabulary every client needs to speak about those\n * tokens — alphabet, length, validation, and the URL shape — so no consumer ever\n * re-declares it. 🚨 `SHORT_LINK_TOKEN_ALPHABET` and `SHORT_LINK_TOKEN_LENGTH`\n * mirror `platform.create_short_link` EXACTLY; change one and you change both.\n *\n * 🚨 A short link is a URL, not a permission. The primitive that grants\n * anonymous access to content is `platform.share_links` (`/s/[token]`, 64-hex\n * tokens) — a different system, deliberately. Never shorten by minting a share\n * link, and never share by minting a short link.\n *\n * Pure logic — no DOM, no React, no network; safe in Server Components, route\n * handlers, workers, and Node scripts.\n */\n\n/**\n * 32 characters: digits 2–9 plus a–z minus `l` and `o`. 256 % 32 = 0, so the\n * mint maps random bytes without modulo bias; lowercase-only survives channels\n * that case-mangle (the resolver lowercases before lookup); the ambiguous\n * glyphs (`0/o`, `1/l`) never appear.\n */\nexport const SHORT_LINK_TOKEN_ALPHABET = \"23456789abcdefghijkmnpqrstuvwxyz\";\n\n/** 10 characters × 5 bits = 50 bits — unguessable at any realistic probe rate. */\nexport const SHORT_LINK_TOKEN_LENGTH = 10;\n\n/** The resolve route on the app origin (matrx-frontend `app/(public)/r/[token]`). */\nexport const SHORT_LINK_PATH_PREFIX = \"/r/\";\n\nconst TOKEN_RE = new RegExp(`^[${SHORT_LINK_TOKEN_ALPHABET}]{${SHORT_LINK_TOKEN_LENGTH}}$`);\n\n/**\n * Trim, lowercase, and shape-check a candidate token. Returns the normalized\n * token, or `null` for anything outside the contract — the resolver would\n * refuse it anyway, so callers can skip the round trip.\n */\nexport function normalizeShortLinkToken(candidate: string | null | undefined): string | null {\n  const token = (candidate ?? \"\").trim().toLowerCase();\n  return TOKEN_RE.test(token) ? token : null;\n}\n\n/** Whether a string is a well-formed short-link token (after normalization). */\nexport function isShortLinkToken(candidate: string | null | undefined): boolean {\n  return normalizeShortLinkToken(candidate) !== null;\n}\n\n/** The app-relative path a token resolves at: `/r/<token>`. */\nexport function shortLinkPath(token: string): string {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) {\n    throw new Error(\n      `shortLinkPath: ${JSON.stringify(token)} is not a short-link token ` +\n        `(${SHORT_LINK_TOKEN_LENGTH} chars of \"${SHORT_LINK_TOKEN_ALPHABET}\")`,\n    );\n  }\n  return `${SHORT_LINK_PATH_PREFIX}${normalized}`;\n}\n\n/**\n * The absolute short URL for a token on a given origin, e.g.\n * `shortLinkUrl(\"https://app.aimatrx.com\", token)` → `https://app.aimatrx.com/r/<token>`.\n */\nexport function shortLinkUrl(origin: string, token: string): string {\n  return `${origin.replace(/\\/+$/, \"\")}${shortLinkPath(token)}`;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The client half — the WHOLE mint/resolve logic, so a consumer adds nothing.\n//\n// Pass your Supabase client (or anything with a compatible `.rpc`) and you are\n// done: `mintShortLink(supabase, { path, organizationId })` calls the platform's\n// authenticated mint door (`public.shorten_app_url`, org-membership-gated) and\n// hands back the finished short URL; `resolveShortLinkPath(supabase, token)`\n// calls the anon resolver (`public.resolve_short_link`). No app writes its own\n// shortener logic, ever — the only thing outside this module is the shared\n// database that stores the tokens, which is exactly where shared state lives.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Anything with a Supabase-shaped `.rpc` — pass the Supabase client itself. */\nexport interface ShortLinkClient {\n  rpc(\n    fn: string,\n    args?: Record<string, unknown>,\n  ): PromiseLike<{ data: unknown; error: { message: string } | null }>;\n}\n\nexport interface MintShortLinkOptions {\n  /** Same-app path to shorten (must start with a single `/`). */\n  path: string;\n  /** The organization the link belongs to — the caller must be a member. */\n  organizationId: string;\n  /** ISO timestamp; the platform default (365 days) applies when omitted. */\n  expiresAt?: string;\n  /** Origin for the returned URL; defaults to `window.location.origin`. */\n  origin?: string;\n}\n\nexport type MintShortLinkResult =\n  | { ok: true; token: string; path: string; url: string }\n  | { ok: false; error: string };\n\nfunction resolveOrigin(origin?: string): string | null {\n  if (origin) return origin;\n  if (typeof window !== \"undefined\" && window.location?.origin) {\n    return window.location.origin;\n  }\n  return null;\n}\n\n/** Mint a short link through the platform's authenticated mint door. */\nexport async function mintShortLink(\n  client: ShortLinkClient,\n  options: MintShortLinkOptions,\n): Promise<MintShortLinkResult> {\n  if (!options.path.startsWith(\"/\") || options.path.startsWith(\"//\")) {\n    return { ok: false, error: \"Only a same-app path (starting with a single '/') can be shortened\" };\n  }\n  const origin = resolveOrigin(options.origin);\n  if (!origin) {\n    return { ok: false, error: \"No origin: pass options.origin outside a browser\" };\n  }\n  const { data, error } = await client.rpc(\"shorten_app_url\", {\n    p_path: options.path,\n    p_organization_id: options.organizationId,\n    ...(options.expiresAt ? { p_expires_at: options.expiresAt } : {}),\n  });\n  if (error) return { ok: false, error: error.message };\n  const result = data as { ok?: boolean; token?: string; error?: string } | null;\n  const token = result?.ok ? normalizeShortLinkToken(result.token) : null;\n  if (!token) {\n    return { ok: false, error: result?.error ?? \"The mint door returned no token\" };\n  }\n  return { ok: true, token, path: shortLinkPath(token), url: shortLinkUrl(origin, token) };\n}\n\nexport type ResolveShortLinkResult =\n  | { ok: true; targetPath: string }\n  | { ok: false };\n\n/**\n * Resolve a short token to its target path through the anon resolver.\n * `{ok:false}` covers invalid, unknown, and expired identically — the platform\n * deliberately does not distinguish them.\n */\nexport async function resolveShortLinkPath(\n  client: ShortLinkClient,\n  token: string,\n): Promise<ResolveShortLinkResult> {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) return { ok: false };\n  const { data, error } = await client.rpc(\"resolve_short_link\", { p_token: normalized });\n  if (error) return { ok: false };\n  const result = data as { ok?: boolean; target_path?: string } | null;\n  const targetPath = result?.ok ? result.target_path : undefined;\n  if (!targetPath || !targetPath.startsWith(\"/\") || targetPath.startsWith(\"//\")) {\n    return { ok: false };\n  }\n  return { ok: true, targetPath };\n}\n\n/**\n * The current page as a shortenable same-app path — pathname + query + hash,\n * exactly the \"this view, as I have it configured\" URL (sorts, filters, hidden\n * columns riding in the query string all survive). `null` outside a browser.\n */\nexport function currentAppPath(): string | null {\n  if (typeof window === \"undefined\" || !window.location) return null;\n  const { pathname, search, hash } = window.location;\n  if (!pathname.startsWith(\"/\") || pathname.startsWith(\"//\")) return null;\n  return `${pathname}${search}${hash}`;\n}\n"],"mappings":";;;AA0BA,SAAS,aAAa,QAAQ,gBAAgB;;;ACKvC,IAAM,4BAA4B;AAGlC,IAAM,0BAA0B;AAGhC,IAAM,yBAAyB;AAEtC,IAAM,WAAW,IAAI,OAAO,KAAK,yBAAyB,KAAK,uBAAuB,IAAI;AAOnF,SAAS,wBAAwB,WAAqD;AAC3F,QAAM,SAAS,aAAa,IAAI,KAAK,EAAE,YAAY;AACnD,SAAO,SAAS,KAAK,KAAK,IAAI,QAAQ;AACxC;AAQO,SAAS,cAAc,OAAuB;AACnD,QAAM,aAAa,wBAAwB,KAAK;AAChD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR,kBAAkB,KAAK,UAAU,KAAK,CAAC,+BACjC,uBAAuB,cAAc,yBAAyB;AAAA,IACtE;AAAA,EACF;AACA,SAAO,GAAG,sBAAsB,GAAG,UAAU;AAC/C;AAMO,SAAS,aAAa,QAAgB,OAAuB;AAClE,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC,GAAG,cAAc,KAAK,CAAC;AAC7D;AAqCA,SAAS,cAAc,QAAgC;AACrD,MAAI,OAAQ,QAAO;AACnB,MAAI,OAAO,WAAW,eAAe,OAAO,UAAU,QAAQ;AAC5D,WAAO,OAAO,SAAS;AAAA,EACzB;AACA,SAAO;AACT;AAGA,eAAsB,cACpB,QACA,SAC8B;AAC9B,MAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,QAAQ,KAAK,WAAW,IAAI,GAAG;AAClE,WAAO,EAAE,IAAI,OAAO,OAAO,qEAAqE;AAAA,EAClG;AACA,QAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,IAAI,OAAO,OAAO,mDAAmD;AAAA,EAChF;AACA,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,mBAAmB;AAAA,IAC1D,QAAQ,QAAQ;AAAA,IAChB,mBAAmB,QAAQ;AAAA,IAC3B,GAAI,QAAQ,YAAY,EAAE,cAAc,QAAQ,UAAU,IAAI,CAAC;AAAA,EACjE,CAAC;AACD,MAAI,MAAO,QAAO,EAAE,IAAI,OAAO,OAAO,MAAM,QAAQ;AACpD,QAAM,SAAS;AACf,QAAM,QAAQ,QAAQ,KAAK,wBAAwB,OAAO,KAAK,IAAI;AACnE,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,SAAS,kCAAkC;AAAA,EAChF;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,MAAM,cAAc,KAAK,GAAG,KAAK,aAAa,QAAQ,KAAK,EAAE;AACzF;AAgCO,SAAS,iBAAgC;AAC9C,MAAI,OAAO,WAAW,eAAe,CAAC,OAAO,SAAU,QAAO;AAC9D,QAAM,EAAE,UAAU,QAAQ,KAAK,IAAI,OAAO;AAC1C,MAAI,CAAC,SAAS,WAAW,GAAG,KAAK,SAAS,WAAW,IAAI,EAAG,QAAO;AACnE,SAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI;AACpC;;;ADqBI;AArKJ,eAAe,eAAe,MAAgC;AAC5D,MAAI;AACF,UAAM,UAAU,UAAU,UAAU,IAAI;AACxC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYO,SAAS,aACd,QACA,SACoB;AACpB,QAAM,CAAC,KAAK,MAAM,IAAI,SAAwB,IAAI;AAClD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,SAAS,OAAmC,IAAI;AAEtD,QAAM,OAAO,YAAY,YAA0C;AACjE,QAAI,OAAO,SAAS,GAAI,QAAO,OAAO;AACtC,eAAW,IAAI;AACf,aAAS,IAAI;AACb,QAAI;AACF,YAAM,SAAS,MAAM,cAAc,QAAQ,OAAO;AAClD,aAAO,UAAU;AACjB,UAAI,OAAO,IAAI;AACb,eAAO,OAAO,GAAG;AAAA,MACnB,OAAO;AACL,iBAAS,OAAO,KAAK;AAAA,MACvB;AACA,aAAO;AAAA,IACT,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,QAAQ,QAAQ,MAAM,QAAQ,gBAAgB,QAAQ,WAAW,QAAQ,MAAM,CAAC;AAEpF,SAAO,EAAE,MAAM,KAAK,SAAS,MAAM;AACrC;AA6BO,SAAS,iBACd,QACA,SACwB;AACxB,QAAM,CAAC,OAAO,QAAQ,IAAI,SAA6B,MAAM;AAC7D,QAAM,CAAC,SAAS,UAAU,IAAI,SAAwB,IAAI;AAC1D,QAAM,QAAQ,OAAyC,oBAAI,IAAI,CAAC;AAChE,QAAM,aAAa,OAA6C,IAAI;AACpE,QAAM,EAAE,MAAM,UAAU,SAAS,GAAG,YAAY,IAAI;AAEpD,QAAM,QAAQ,YAAY,CAAC,SAA6B;AACtD,aAAS,IAAI;AACb,QAAI,WAAW,QAAS,cAAa,WAAW,OAAO;AACvD,eAAW,UAAU,WAAW,MAAM,SAAS,MAAM,GAAG,GAAI;AAAA,EAC9D,GAAG,CAAC,CAAC;AAEL,QAAM,OAAO,YAAY,YAAY;AACnC,UAAM,aAAa,QAAQ,eAAe;AAC1C,QAAI,CAAC,YAAY;AACf,YAAM,OAAO;AACb,gBAAU,oBAAoB;AAC9B,aAAO,EAAE,IAAI,OAAO,OAAO,qBAAqB;AAAA,IAClD;AACA,QAAI,SAAS,MAAM,QAAQ,IAAI,UAAU;AACzC,QAAI,CAAC,QAAQ,IAAI;AACf,eAAS,SAAS;AAClB,eAAS,MAAM,cAAc,QAAQ,EAAE,GAAG,aAAa,MAAM,WAAW,CAAC;AACzE,YAAM,QAAQ,IAAI,YAAY,MAAM;AAAA,IACtC;AACA,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,OAAO;AACb,gBAAU,OAAO,KAAK;AACtB,aAAO,EAAE,IAAI,OAAO,OAAO,OAAO,MAAM;AAAA,IAC1C;AACA,UAAM,SAAS,MAAM,eAAe,OAAO,GAAG;AAC9C,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO;AACb,gBAAU,kCAAkC;AAC5C,aAAO,EAAE,IAAI,OAAO,OAAO,mCAAmC;AAAA,IAChE;AACA,eAAW,OAAO,GAAG;AACrB,UAAM,QAAQ;AACd,eAAW,OAAO,GAAG;AACrB,WAAO,EAAE,IAAI,MAAM,KAAK,OAAO,IAAI;AAAA,EACrC,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO,EAAE,MAAM,OAAO,QAAQ;AAChC;AAeO,SAAS,oBAAoB;AAAA,EAClC;AAAA,EACA,QAAQ;AAAA,EACR;AAAA,EACA,GAAG;AACL,GAA6B;AAC3B,QAAM,EAAE,MAAM,MAAM,IAAI,iBAAiB,QAAQ,OAAO;AAExD,QAAM,OACJ,UAAU,WACN,WACA,UAAU,UACR,gBACA,UAAU,YACR,mBACA;AAEV,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,SAAS;AAAA,MACT,UAAU,UAAU;AAAA,MACpB,aAAU;AAAA,MACV,WACE,oKAEC,UAAU,UAAU,sBAAsB,OAC1C,aAAa;AAAA,MAGf;AAAA;AAAA,EACH;AAEJ;AAUO,SAAS,wBAAwB,OAAqC;AAC3E,SAAO,oBAAC,uBAAqB,GAAG,OAAO;AACzC;","names":[]}

package/dist/short-link.cjs

@@ -23,6 +23,7 @@ __export(short_link_exports, {
   SHORT_LINK_PATH_PREFIX: () => SHORT_LINK_PATH_PREFIX,
   SHORT_LINK_TOKEN_ALPHABET: () => SHORT_LINK_TOKEN_ALPHABET,
   SHORT_LINK_TOKEN_LENGTH: () => SHORT_LINK_TOKEN_LENGTH,
+  currentAppPath: () => currentAppPath,
   isShortLinkToken: () => isShortLinkToken,
   mintShortLink: () => mintShortLink,
   normalizeShortLinkToken: () => normalizeShortLinkToken,
@@ -94,4 +95,10 @@ async function resolveShortLinkPath(client, token) {
   }
   return { ok: true, targetPath };
 }
+function currentAppPath() {
+  if (typeof window === "undefined" || !window.location) return null;
+  const { pathname, search, hash } = window.location;
+  if (!pathname.startsWith("/") || pathname.startsWith("//")) return null;
+  return `${pathname}${search}${hash}`;
+}
 //# sourceMappingURL=short-link.cjs.map

package/dist/short-link.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/short-link.ts"],"sourcesContent":["/**\n * @ai-matrx/kit/short-link — the platform short-link CONTRACT, in one place.\n *\n * The primitive itself lives in the database (migration `0557_platform_short_links`):\n * `platform.short_links` holds `token → same-app path`, org-scoped and expiring;\n * `platform.create_short_link` mints (server-side only); `public.resolve_short_link`\n * resolves (anon-callable; answers with a PATH, never content — the target route's\n * own auth gates everything). The frontend redirect route is `/r/[token]`\n * (matrx-frontend `app/(public)/r/[token]`), and the notification spine mints per\n * SMS leg (aidream `services/notifications/short_links.py`).\n *\n * This module is the shared vocabulary every client needs to speak about those\n * tokens — alphabet, length, validation, and the URL shape — so no consumer ever\n * re-declares it. 🚨 `SHORT_LINK_TOKEN_ALPHABET` and `SHORT_LINK_TOKEN_LENGTH`\n * mirror `platform.create_short_link` EXACTLY; change one and you change both.\n *\n * 🚨 A short link is a URL, not a permission. The primitive that grants\n * anonymous access to content is `platform.share_links` (`/s/[token]`, 64-hex\n * tokens) — a different system, deliberately. Never shorten by minting a share\n * link, and never share by minting a short link.\n *\n * Pure logic — no DOM, no React, no network; safe in Server Components, route\n * handlers, workers, and Node scripts.\n */\n\n/**\n * 32 characters: digits 2–9 plus a–z minus `l` and `o`. 256 % 32 = 0, so the\n * mint maps random bytes without modulo bias; lowercase-only survives channels\n * that case-mangle (the resolver lowercases before lookup); the ambiguous\n * glyphs (`0/o`, `1/l`) never appear.\n */\nexport const SHORT_LINK_TOKEN_ALPHABET = \"23456789abcdefghijkmnpqrstuvwxyz\";\n\n/** 10 characters × 5 bits = 50 bits — unguessable at any realistic probe rate. */\nexport const SHORT_LINK_TOKEN_LENGTH = 10;\n\n/** The resolve route on the app origin (matrx-frontend `app/(public)/r/[token]`). */\nexport const SHORT_LINK_PATH_PREFIX = \"/r/\";\n\nconst TOKEN_RE = new RegExp(`^[${SHORT_LINK_TOKEN_ALPHABET}]{${SHORT_LINK_TOKEN_LENGTH}}$`);\n\n/**\n * Trim, lowercase, and shape-check a candidate token. Returns the normalized\n * token, or `null` for anything outside the contract — the resolver would\n * refuse it anyway, so callers can skip the round trip.\n */\nexport function normalizeShortLinkToken(candidate: string | null | undefined): string | null {\n  const token = (candidate ?? \"\").trim().toLowerCase();\n  return TOKEN_RE.test(token) ? token : null;\n}\n\n/** Whether a string is a well-formed short-link token (after normalization). */\nexport function isShortLinkToken(candidate: string | null | undefined): boolean {\n  return normalizeShortLinkToken(candidate) !== null;\n}\n\n/** The app-relative path a token resolves at: `/r/<token>`. */\nexport function shortLinkPath(token: string): string {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) {\n    throw new Error(\n      `shortLinkPath: ${JSON.stringify(token)} is not a short-link token ` +\n        `(${SHORT_LINK_TOKEN_LENGTH} chars of \"${SHORT_LINK_TOKEN_ALPHABET}\")`,\n    );\n  }\n  return `${SHORT_LINK_PATH_PREFIX}${normalized}`;\n}\n\n/**\n * The absolute short URL for a token on a given origin, e.g.\n * `shortLinkUrl(\"https://app.aimatrx.com\", token)` → `https://app.aimatrx.com/r/<token>`.\n */\nexport function shortLinkUrl(origin: string, token: string): string {\n  return `${origin.replace(/\\/+$/, \"\")}${shortLinkPath(token)}`;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The client half — the WHOLE mint/resolve logic, so a consumer adds nothing.\n//\n// Pass your Supabase client (or anything with a compatible `.rpc`) and you are\n// done: `mintShortLink(supabase, { path, organizationId })` calls the platform's\n// authenticated mint door (`public.shorten_app_url`, org-membership-gated) and\n// hands back the finished short URL; `resolveShortLinkPath(supabase, token)`\n// calls the anon resolver (`public.resolve_short_link`). No app writes its own\n// shortener logic, ever — the only thing outside this module is the shared\n// database that stores the tokens, which is exactly where shared state lives.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Anything with a Supabase-shaped `.rpc` — pass the Supabase client itself. */\nexport interface ShortLinkClient {\n  rpc(\n    fn: string,\n    args?: Record<string, unknown>,\n  ): PromiseLike<{ data: unknown; error: { message: string } | null }>;\n}\n\nexport interface MintShortLinkOptions {\n  /** Same-app path to shorten (must start with a single `/`). */\n  path: string;\n  /** The organization the link belongs to — the caller must be a member. */\n  organizationId: string;\n  /** ISO timestamp; the platform default (365 days) applies when omitted. */\n  expiresAt?: string;\n  /** Origin for the returned URL; defaults to `window.location.origin`. */\n  origin?: string;\n}\n\nexport type MintShortLinkResult =\n  | { ok: true; token: string; path: string; url: string }\n  | { ok: false; error: string };\n\nfunction resolveOrigin(origin?: string): string | null {\n  if (origin) return origin;\n  if (typeof window !== \"undefined\" && window.location?.origin) {\n    return window.location.origin;\n  }\n  return null;\n}\n\n/** Mint a short link through the platform's authenticated mint door. */\nexport async function mintShortLink(\n  client: ShortLinkClient,\n  options: MintShortLinkOptions,\n): Promise<MintShortLinkResult> {\n  if (!options.path.startsWith(\"/\") || options.path.startsWith(\"//\")) {\n    return { ok: false, error: \"Only a same-app path (starting with a single '/') can be shortened\" };\n  }\n  const origin = resolveOrigin(options.origin);\n  if (!origin) {\n    return { ok: false, error: \"No origin: pass options.origin outside a browser\" };\n  }\n  const { data, error } = await client.rpc(\"shorten_app_url\", {\n    p_path: options.path,\n    p_organization_id: options.organizationId,\n    ...(options.expiresAt ? { p_expires_at: options.expiresAt } : {}),\n  });\n  if (error) return { ok: false, error: error.message };\n  const result = data as { ok?: boolean; token?: string; error?: string } | null;\n  const token = result?.ok ? normalizeShortLinkToken(result.token) : null;\n  if (!token) {\n    return { ok: false, error: result?.error ?? \"The mint door returned no token\" };\n  }\n  return { ok: true, token, path: shortLinkPath(token), url: shortLinkUrl(origin, token) };\n}\n\nexport type ResolveShortLinkResult =\n  | { ok: true; targetPath: string }\n  | { ok: false };\n\n/**\n * Resolve a short token to its target path through the anon resolver.\n * `{ok:false}` covers invalid, unknown, and expired identically — the platform\n * deliberately does not distinguish them.\n */\nexport async function resolveShortLinkPath(\n  client: ShortLinkClient,\n  token: string,\n): Promise<ResolveShortLinkResult> {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) return { ok: false };\n  const { data, error } = await client.rpc(\"resolve_short_link\", { p_token: normalized });\n  if (error) return { ok: false };\n  const result = data as { ok?: boolean; target_path?: string } | null;\n  const targetPath = result?.ok ? result.target_path : undefined;\n  if (!targetPath || !targetPath.startsWith(\"/\") || targetPath.startsWith(\"//\")) {\n    return { ok: false };\n  }\n  return { ok: true, targetPath };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+BO,IAAM,4BAA4B;AAGlC,IAAM,0BAA0B;AAGhC,IAAM,yBAAyB;AAEtC,IAAM,WAAW,IAAI,OAAO,KAAK,yBAAyB,KAAK,uBAAuB,IAAI;AAOnF,SAAS,wBAAwB,WAAqD;AAC3F,QAAM,SAAS,aAAa,IAAI,KAAK,EAAE,YAAY;AACnD,SAAO,SAAS,KAAK,KAAK,IAAI,QAAQ;AACxC;AAGO,SAAS,iBAAiB,WAA+C;AAC9E,SAAO,wBAAwB,SAAS,MAAM;AAChD;AAGO,SAAS,cAAc,OAAuB;AACnD,QAAM,aAAa,wBAAwB,KAAK;AAChD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR,kBAAkB,KAAK,UAAU,KAAK,CAAC,+BACjC,uBAAuB,cAAc,yBAAyB;AAAA,IACtE;AAAA,EACF;AACA,SAAO,GAAG,sBAAsB,GAAG,UAAU;AAC/C;AAMO,SAAS,aAAa,QAAgB,OAAuB;AAClE,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC,GAAG,cAAc,KAAK,CAAC;AAC7D;AAqCA,SAAS,cAAc,QAAgC;AACrD,MAAI,OAAQ,QAAO;AACnB,MAAI,OAAO,WAAW,eAAe,OAAO,UAAU,QAAQ;AAC5D,WAAO,OAAO,SAAS;AAAA,EACzB;AACA,SAAO;AACT;AAGA,eAAsB,cACpB,QACA,SAC8B;AAC9B,MAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,QAAQ,KAAK,WAAW,IAAI,GAAG;AAClE,WAAO,EAAE,IAAI,OAAO,OAAO,qEAAqE;AAAA,EAClG;AACA,QAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,IAAI,OAAO,OAAO,mDAAmD;AAAA,EAChF;AACA,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,mBAAmB;AAAA,IAC1D,QAAQ,QAAQ;AAAA,IAChB,mBAAmB,QAAQ;AAAA,IAC3B,GAAI,QAAQ,YAAY,EAAE,cAAc,QAAQ,UAAU,IAAI,CAAC;AAAA,EACjE,CAAC;AACD,MAAI,MAAO,QAAO,EAAE,IAAI,OAAO,OAAO,MAAM,QAAQ;AACpD,QAAM,SAAS;AACf,QAAM,QAAQ,QAAQ,KAAK,wBAAwB,OAAO,KAAK,IAAI;AACnE,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,SAAS,kCAAkC;AAAA,EAChF;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,MAAM,cAAc,KAAK,GAAG,KAAK,aAAa,QAAQ,KAAK,EAAE;AACzF;AAWA,eAAsB,qBACpB,QACA,OACiC;AACjC,QAAM,aAAa,wBAAwB,KAAK;AAChD,MAAI,CAAC,WAAY,QAAO,EAAE,IAAI,MAAM;AACpC,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,sBAAsB,EAAE,SAAS,WAAW,CAAC;AACtF,MAAI,MAAO,QAAO,EAAE,IAAI,MAAM;AAC9B,QAAM,SAAS;AACf,QAAM,aAAa,QAAQ,KAAK,OAAO,cAAc;AACrD,MAAI,CAAC,cAAc,CAAC,WAAW,WAAW,GAAG,KAAK,WAAW,WAAW,IAAI,GAAG;AAC7E,WAAO,EAAE,IAAI,MAAM;AAAA,EACrB;AACA,SAAO,EAAE,IAAI,MAAM,WAAW;AAChC;","names":[]}
+{"version":3,"sources":["../src/short-link.ts"],"sourcesContent":["/**\n * @ai-matrx/kit/short-link — the platform short-link CONTRACT, in one place.\n *\n * The primitive itself lives in the database (migration `0557_platform_short_links`):\n * `platform.short_links` holds `token → same-app path`, org-scoped and expiring;\n * `platform.create_short_link` mints (server-side only); `public.resolve_short_link`\n * resolves (anon-callable; answers with a PATH, never content — the target route's\n * own auth gates everything). The frontend redirect route is `/r/[token]`\n * (matrx-frontend `app/(public)/r/[token]`), and the notification spine mints per\n * SMS leg (aidream `services/notifications/short_links.py`).\n *\n * This module is the shared vocabulary every client needs to speak about those\n * tokens — alphabet, length, validation, and the URL shape — so no consumer ever\n * re-declares it. 🚨 `SHORT_LINK_TOKEN_ALPHABET` and `SHORT_LINK_TOKEN_LENGTH`\n * mirror `platform.create_short_link` EXACTLY; change one and you change both.\n *\n * 🚨 A short link is a URL, not a permission. The primitive that grants\n * anonymous access to content is `platform.share_links` (`/s/[token]`, 64-hex\n * tokens) — a different system, deliberately. Never shorten by minting a share\n * link, and never share by minting a short link.\n *\n * Pure logic — no DOM, no React, no network; safe in Server Components, route\n * handlers, workers, and Node scripts.\n */\n\n/**\n * 32 characters: digits 2–9 plus a–z minus `l` and `o`. 256 % 32 = 0, so the\n * mint maps random bytes without modulo bias; lowercase-only survives channels\n * that case-mangle (the resolver lowercases before lookup); the ambiguous\n * glyphs (`0/o`, `1/l`) never appear.\n */\nexport const SHORT_LINK_TOKEN_ALPHABET = \"23456789abcdefghijkmnpqrstuvwxyz\";\n\n/** 10 characters × 5 bits = 50 bits — unguessable at any realistic probe rate. */\nexport const SHORT_LINK_TOKEN_LENGTH = 10;\n\n/** The resolve route on the app origin (matrx-frontend `app/(public)/r/[token]`). */\nexport const SHORT_LINK_PATH_PREFIX = \"/r/\";\n\nconst TOKEN_RE = new RegExp(`^[${SHORT_LINK_TOKEN_ALPHABET}]{${SHORT_LINK_TOKEN_LENGTH}}$`);\n\n/**\n * Trim, lowercase, and shape-check a candidate token. Returns the normalized\n * token, or `null` for anything outside the contract — the resolver would\n * refuse it anyway, so callers can skip the round trip.\n */\nexport function normalizeShortLinkToken(candidate: string | null | undefined): string | null {\n  const token = (candidate ?? \"\").trim().toLowerCase();\n  return TOKEN_RE.test(token) ? token : null;\n}\n\n/** Whether a string is a well-formed short-link token (after normalization). */\nexport function isShortLinkToken(candidate: string | null | undefined): boolean {\n  return normalizeShortLinkToken(candidate) !== null;\n}\n\n/** The app-relative path a token resolves at: `/r/<token>`. */\nexport function shortLinkPath(token: string): string {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) {\n    throw new Error(\n      `shortLinkPath: ${JSON.stringify(token)} is not a short-link token ` +\n        `(${SHORT_LINK_TOKEN_LENGTH} chars of \"${SHORT_LINK_TOKEN_ALPHABET}\")`,\n    );\n  }\n  return `${SHORT_LINK_PATH_PREFIX}${normalized}`;\n}\n\n/**\n * The absolute short URL for a token on a given origin, e.g.\n * `shortLinkUrl(\"https://app.aimatrx.com\", token)` → `https://app.aimatrx.com/r/<token>`.\n */\nexport function shortLinkUrl(origin: string, token: string): string {\n  return `${origin.replace(/\\/+$/, \"\")}${shortLinkPath(token)}`;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The client half — the WHOLE mint/resolve logic, so a consumer adds nothing.\n//\n// Pass your Supabase client (or anything with a compatible `.rpc`) and you are\n// done: `mintShortLink(supabase, { path, organizationId })` calls the platform's\n// authenticated mint door (`public.shorten_app_url`, org-membership-gated) and\n// hands back the finished short URL; `resolveShortLinkPath(supabase, token)`\n// calls the anon resolver (`public.resolve_short_link`). No app writes its own\n// shortener logic, ever — the only thing outside this module is the shared\n// database that stores the tokens, which is exactly where shared state lives.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Anything with a Supabase-shaped `.rpc` — pass the Supabase client itself. */\nexport interface ShortLinkClient {\n  rpc(\n    fn: string,\n    args?: Record<string, unknown>,\n  ): PromiseLike<{ data: unknown; error: { message: string } | null }>;\n}\n\nexport interface MintShortLinkOptions {\n  /** Same-app path to shorten (must start with a single `/`). */\n  path: string;\n  /** The organization the link belongs to — the caller must be a member. */\n  organizationId: string;\n  /** ISO timestamp; the platform default (365 days) applies when omitted. */\n  expiresAt?: string;\n  /** Origin for the returned URL; defaults to `window.location.origin`. */\n  origin?: string;\n}\n\nexport type MintShortLinkResult =\n  | { ok: true; token: string; path: string; url: string }\n  | { ok: false; error: string };\n\nfunction resolveOrigin(origin?: string): string | null {\n  if (origin) return origin;\n  if (typeof window !== \"undefined\" && window.location?.origin) {\n    return window.location.origin;\n  }\n  return null;\n}\n\n/** Mint a short link through the platform's authenticated mint door. */\nexport async function mintShortLink(\n  client: ShortLinkClient,\n  options: MintShortLinkOptions,\n): Promise<MintShortLinkResult> {\n  if (!options.path.startsWith(\"/\") || options.path.startsWith(\"//\")) {\n    return { ok: false, error: \"Only a same-app path (starting with a single '/') can be shortened\" };\n  }\n  const origin = resolveOrigin(options.origin);\n  if (!origin) {\n    return { ok: false, error: \"No origin: pass options.origin outside a browser\" };\n  }\n  const { data, error } = await client.rpc(\"shorten_app_url\", {\n    p_path: options.path,\n    p_organization_id: options.organizationId,\n    ...(options.expiresAt ? { p_expires_at: options.expiresAt } : {}),\n  });\n  if (error) return { ok: false, error: error.message };\n  const result = data as { ok?: boolean; token?: string; error?: string } | null;\n  const token = result?.ok ? normalizeShortLinkToken(result.token) : null;\n  if (!token) {\n    return { ok: false, error: result?.error ?? \"The mint door returned no token\" };\n  }\n  return { ok: true, token, path: shortLinkPath(token), url: shortLinkUrl(origin, token) };\n}\n\nexport type ResolveShortLinkResult =\n  | { ok: true; targetPath: string }\n  | { ok: false };\n\n/**\n * Resolve a short token to its target path through the anon resolver.\n * `{ok:false}` covers invalid, unknown, and expired identically — the platform\n * deliberately does not distinguish them.\n */\nexport async function resolveShortLinkPath(\n  client: ShortLinkClient,\n  token: string,\n): Promise<ResolveShortLinkResult> {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) return { ok: false };\n  const { data, error } = await client.rpc(\"resolve_short_link\", { p_token: normalized });\n  if (error) return { ok: false };\n  const result = data as { ok?: boolean; target_path?: string } | null;\n  const targetPath = result?.ok ? result.target_path : undefined;\n  if (!targetPath || !targetPath.startsWith(\"/\") || targetPath.startsWith(\"//\")) {\n    return { ok: false };\n  }\n  return { ok: true, targetPath };\n}\n\n/**\n * The current page as a shortenable same-app path — pathname + query + hash,\n * exactly the \"this view, as I have it configured\" URL (sorts, filters, hidden\n * columns riding in the query string all survive). `null` outside a browser.\n */\nexport function currentAppPath(): string | null {\n  if (typeof window === \"undefined\" || !window.location) return null;\n  const { pathname, search, hash } = window.location;\n  if (!pathname.startsWith(\"/\") || pathname.startsWith(\"//\")) return null;\n  return `${pathname}${search}${hash}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+BO,IAAM,4BAA4B;AAGlC,IAAM,0BAA0B;AAGhC,IAAM,yBAAyB;AAEtC,IAAM,WAAW,IAAI,OAAO,KAAK,yBAAyB,KAAK,uBAAuB,IAAI;AAOnF,SAAS,wBAAwB,WAAqD;AAC3F,QAAM,SAAS,aAAa,IAAI,KAAK,EAAE,YAAY;AACnD,SAAO,SAAS,KAAK,KAAK,IAAI,QAAQ;AACxC;AAGO,SAAS,iBAAiB,WAA+C;AAC9E,SAAO,wBAAwB,SAAS,MAAM;AAChD;AAGO,SAAS,cAAc,OAAuB;AACnD,QAAM,aAAa,wBAAwB,KAAK;AAChD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR,kBAAkB,KAAK,UAAU,KAAK,CAAC,+BACjC,uBAAuB,cAAc,yBAAyB;AAAA,IACtE;AAAA,EACF;AACA,SAAO,GAAG,sBAAsB,GAAG,UAAU;AAC/C;AAMO,SAAS,aAAa,QAAgB,OAAuB;AAClE,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC,GAAG,cAAc,KAAK,CAAC;AAC7D;AAqCA,SAAS,cAAc,QAAgC;AACrD,MAAI,OAAQ,QAAO;AACnB,MAAI,OAAO,WAAW,eAAe,OAAO,UAAU,QAAQ;AAC5D,WAAO,OAAO,SAAS;AAAA,EACzB;AACA,SAAO;AACT;AAGA,eAAsB,cACpB,QACA,SAC8B;AAC9B,MAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,QAAQ,KAAK,WAAW,IAAI,GAAG;AAClE,WAAO,EAAE,IAAI,OAAO,OAAO,qEAAqE;AAAA,EAClG;AACA,QAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,IAAI,OAAO,OAAO,mDAAmD;AAAA,EAChF;AACA,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,mBAAmB;AAAA,IAC1D,QAAQ,QAAQ;AAAA,IAChB,mBAAmB,QAAQ;AAAA,IAC3B,GAAI,QAAQ,YAAY,EAAE,cAAc,QAAQ,UAAU,IAAI,CAAC;AAAA,EACjE,CAAC;AACD,MAAI,MAAO,QAAO,EAAE,IAAI,OAAO,OAAO,MAAM,QAAQ;AACpD,QAAM,SAAS;AACf,QAAM,QAAQ,QAAQ,KAAK,wBAAwB,OAAO,KAAK,IAAI;AACnE,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,SAAS,kCAAkC;AAAA,EAChF;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,MAAM,cAAc,KAAK,GAAG,KAAK,aAAa,QAAQ,KAAK,EAAE;AACzF;AAWA,eAAsB,qBACpB,QACA,OACiC;AACjC,QAAM,aAAa,wBAAwB,KAAK;AAChD,MAAI,CAAC,WAAY,QAAO,EAAE,IAAI,MAAM;AACpC,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,sBAAsB,EAAE,SAAS,WAAW,CAAC;AACtF,MAAI,MAAO,QAAO,EAAE,IAAI,MAAM;AAC9B,QAAM,SAAS;AACf,QAAM,aAAa,QAAQ,KAAK,OAAO,cAAc;AACrD,MAAI,CAAC,cAAc,CAAC,WAAW,WAAW,GAAG,KAAK,WAAW,WAAW,IAAI,GAAG;AAC7E,WAAO,EAAE,IAAI,MAAM;AAAA,EACrB;AACA,SAAO,EAAE,IAAI,MAAM,WAAW;AAChC;AAOO,SAAS,iBAAgC;AAC9C,MAAI,OAAO,WAAW,eAAe,CAAC,OAAO,SAAU,QAAO;AAC9D,QAAM,EAAE,UAAU,QAAQ,KAAK,IAAI,OAAO;AAC1C,MAAI,CAAC,SAAS,WAAW,GAAG,KAAK,SAAS,WAAW,IAAI,EAAG,QAAO;AACnE,SAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI;AACpC;","names":[]}

package/dist/short-link.d.cts

@@ -90,5 +90,11 @@ type ResolveShortLinkResult = {
  * deliberately does not distinguish them.
  */
 declare function resolveShortLinkPath(client: ShortLinkClient, token: string): Promise<ResolveShortLinkResult>;
+/**
+ * The current page as a shortenable same-app path — pathname + query + hash,
+ * exactly the "this view, as I have it configured" URL (sorts, filters, hidden
+ * columns riding in the query string all survive). `null` outside a browser.
+ */
+declare function currentAppPath(): string | null;
 
-export { type MintShortLinkOptions, type MintShortLinkResult, type ResolveShortLinkResult, SHORT_LINK_PATH_PREFIX, SHORT_LINK_TOKEN_ALPHABET, SHORT_LINK_TOKEN_LENGTH, type ShortLinkClient, isShortLinkToken, mintShortLink, normalizeShortLinkToken, resolveShortLinkPath, shortLinkPath, shortLinkUrl };
+export { type MintShortLinkOptions, type MintShortLinkResult, type ResolveShortLinkResult, SHORT_LINK_PATH_PREFIX, SHORT_LINK_TOKEN_ALPHABET, SHORT_LINK_TOKEN_LENGTH, type ShortLinkClient, currentAppPath, isShortLinkToken, mintShortLink, normalizeShortLinkToken, resolveShortLinkPath, shortLinkPath, shortLinkUrl };

package/dist/short-link.d.ts

@@ -90,5 +90,11 @@ type ResolveShortLinkResult = {
  * deliberately does not distinguish them.
  */
 declare function resolveShortLinkPath(client: ShortLinkClient, token: string): Promise<ResolveShortLinkResult>;
+/**
+ * The current page as a shortenable same-app path — pathname + query + hash,
+ * exactly the "this view, as I have it configured" URL (sorts, filters, hidden
+ * columns riding in the query string all survive). `null` outside a browser.
+ */
+declare function currentAppPath(): string | null;
 
-export { type MintShortLinkOptions, type MintShortLinkResult, type ResolveShortLinkResult, SHORT_LINK_PATH_PREFIX, SHORT_LINK_TOKEN_ALPHABET, SHORT_LINK_TOKEN_LENGTH, type ShortLinkClient, isShortLinkToken, mintShortLink, normalizeShortLinkToken, resolveShortLinkPath, shortLinkPath, shortLinkUrl };
+export { type MintShortLinkOptions, type MintShortLinkResult, type ResolveShortLinkResult, SHORT_LINK_PATH_PREFIX, SHORT_LINK_TOKEN_ALPHABET, SHORT_LINK_TOKEN_LENGTH, type ShortLinkClient, currentAppPath, isShortLinkToken, mintShortLink, normalizeShortLinkToken, resolveShortLinkPath, shortLinkPath, shortLinkUrl };

package/dist/short-link.js

@@ -62,10 +62,17 @@ async function resolveShortLinkPath(client, token) {
   }
   return { ok: true, targetPath };
 }
+function currentAppPath() {
+  if (typeof window === "undefined" || !window.location) return null;
+  const { pathname, search, hash } = window.location;
+  if (!pathname.startsWith("/") || pathname.startsWith("//")) return null;
+  return `${pathname}${search}${hash}`;
+}
 export {
   SHORT_LINK_PATH_PREFIX,
   SHORT_LINK_TOKEN_ALPHABET,
   SHORT_LINK_TOKEN_LENGTH,
+  currentAppPath,
   isShortLinkToken,
   mintShortLink,
   normalizeShortLinkToken,

package/dist/short-link.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/short-link.ts"],"sourcesContent":["/**\n * @ai-matrx/kit/short-link — the platform short-link CONTRACT, in one place.\n *\n * The primitive itself lives in the database (migration `0557_platform_short_links`):\n * `platform.short_links` holds `token → same-app path`, org-scoped and expiring;\n * `platform.create_short_link` mints (server-side only); `public.resolve_short_link`\n * resolves (anon-callable; answers with a PATH, never content — the target route's\n * own auth gates everything). The frontend redirect route is `/r/[token]`\n * (matrx-frontend `app/(public)/r/[token]`), and the notification spine mints per\n * SMS leg (aidream `services/notifications/short_links.py`).\n *\n * This module is the shared vocabulary every client needs to speak about those\n * tokens — alphabet, length, validation, and the URL shape — so no consumer ever\n * re-declares it. 🚨 `SHORT_LINK_TOKEN_ALPHABET` and `SHORT_LINK_TOKEN_LENGTH`\n * mirror `platform.create_short_link` EXACTLY; change one and you change both.\n *\n * 🚨 A short link is a URL, not a permission. The primitive that grants\n * anonymous access to content is `platform.share_links` (`/s/[token]`, 64-hex\n * tokens) — a different system, deliberately. Never shorten by minting a share\n * link, and never share by minting a short link.\n *\n * Pure logic — no DOM, no React, no network; safe in Server Components, route\n * handlers, workers, and Node scripts.\n */\n\n/**\n * 32 characters: digits 2–9 plus a–z minus `l` and `o`. 256 % 32 = 0, so the\n * mint maps random bytes without modulo bias; lowercase-only survives channels\n * that case-mangle (the resolver lowercases before lookup); the ambiguous\n * glyphs (`0/o`, `1/l`) never appear.\n */\nexport const SHORT_LINK_TOKEN_ALPHABET = \"23456789abcdefghijkmnpqrstuvwxyz\";\n\n/** 10 characters × 5 bits = 50 bits — unguessable at any realistic probe rate. */\nexport const SHORT_LINK_TOKEN_LENGTH = 10;\n\n/** The resolve route on the app origin (matrx-frontend `app/(public)/r/[token]`). */\nexport const SHORT_LINK_PATH_PREFIX = \"/r/\";\n\nconst TOKEN_RE = new RegExp(`^[${SHORT_LINK_TOKEN_ALPHABET}]{${SHORT_LINK_TOKEN_LENGTH}}$`);\n\n/**\n * Trim, lowercase, and shape-check a candidate token. Returns the normalized\n * token, or `null` for anything outside the contract — the resolver would\n * refuse it anyway, so callers can skip the round trip.\n */\nexport function normalizeShortLinkToken(candidate: string | null | undefined): string | null {\n  const token = (candidate ?? \"\").trim().toLowerCase();\n  return TOKEN_RE.test(token) ? token : null;\n}\n\n/** Whether a string is a well-formed short-link token (after normalization). */\nexport function isShortLinkToken(candidate: string | null | undefined): boolean {\n  return normalizeShortLinkToken(candidate) !== null;\n}\n\n/** The app-relative path a token resolves at: `/r/<token>`. */\nexport function shortLinkPath(token: string): string {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) {\n    throw new Error(\n      `shortLinkPath: ${JSON.stringify(token)} is not a short-link token ` +\n        `(${SHORT_LINK_TOKEN_LENGTH} chars of \"${SHORT_LINK_TOKEN_ALPHABET}\")`,\n    );\n  }\n  return `${SHORT_LINK_PATH_PREFIX}${normalized}`;\n}\n\n/**\n * The absolute short URL for a token on a given origin, e.g.\n * `shortLinkUrl(\"https://app.aimatrx.com\", token)` → `https://app.aimatrx.com/r/<token>`.\n */\nexport function shortLinkUrl(origin: string, token: string): string {\n  return `${origin.replace(/\\/+$/, \"\")}${shortLinkPath(token)}`;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The client half — the WHOLE mint/resolve logic, so a consumer adds nothing.\n//\n// Pass your Supabase client (or anything with a compatible `.rpc`) and you are\n// done: `mintShortLink(supabase, { path, organizationId })` calls the platform's\n// authenticated mint door (`public.shorten_app_url`, org-membership-gated) and\n// hands back the finished short URL; `resolveShortLinkPath(supabase, token)`\n// calls the anon resolver (`public.resolve_short_link`). No app writes its own\n// shortener logic, ever — the only thing outside this module is the shared\n// database that stores the tokens, which is exactly where shared state lives.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Anything with a Supabase-shaped `.rpc` — pass the Supabase client itself. */\nexport interface ShortLinkClient {\n  rpc(\n    fn: string,\n    args?: Record<string, unknown>,\n  ): PromiseLike<{ data: unknown; error: { message: string } | null }>;\n}\n\nexport interface MintShortLinkOptions {\n  /** Same-app path to shorten (must start with a single `/`). */\n  path: string;\n  /** The organization the link belongs to — the caller must be a member. */\n  organizationId: string;\n  /** ISO timestamp; the platform default (365 days) applies when omitted. */\n  expiresAt?: string;\n  /** Origin for the returned URL; defaults to `window.location.origin`. */\n  origin?: string;\n}\n\nexport type MintShortLinkResult =\n  | { ok: true; token: string; path: string; url: string }\n  | { ok: false; error: string };\n\nfunction resolveOrigin(origin?: string): string | null {\n  if (origin) return origin;\n  if (typeof window !== \"undefined\" && window.location?.origin) {\n    return window.location.origin;\n  }\n  return null;\n}\n\n/** Mint a short link through the platform's authenticated mint door. */\nexport async function mintShortLink(\n  client: ShortLinkClient,\n  options: MintShortLinkOptions,\n): Promise<MintShortLinkResult> {\n  if (!options.path.startsWith(\"/\") || options.path.startsWith(\"//\")) {\n    return { ok: false, error: \"Only a same-app path (starting with a single '/') can be shortened\" };\n  }\n  const origin = resolveOrigin(options.origin);\n  if (!origin) {\n    return { ok: false, error: \"No origin: pass options.origin outside a browser\" };\n  }\n  const { data, error } = await client.rpc(\"shorten_app_url\", {\n    p_path: options.path,\n    p_organization_id: options.organizationId,\n    ...(options.expiresAt ? { p_expires_at: options.expiresAt } : {}),\n  });\n  if (error) return { ok: false, error: error.message };\n  const result = data as { ok?: boolean; token?: string; error?: string } | null;\n  const token = result?.ok ? normalizeShortLinkToken(result.token) : null;\n  if (!token) {\n    return { ok: false, error: result?.error ?? \"The mint door returned no token\" };\n  }\n  return { ok: true, token, path: shortLinkPath(token), url: shortLinkUrl(origin, token) };\n}\n\nexport type ResolveShortLinkResult =\n  | { ok: true; targetPath: string }\n  | { ok: false };\n\n/**\n * Resolve a short token to its target path through the anon resolver.\n * `{ok:false}` covers invalid, unknown, and expired identically — the platform\n * deliberately does not distinguish them.\n */\nexport async function resolveShortLinkPath(\n  client: ShortLinkClient,\n  token: string,\n): Promise<ResolveShortLinkResult> {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) return { ok: false };\n  const { data, error } = await client.rpc(\"resolve_short_link\", { p_token: normalized });\n  if (error) return { ok: false };\n  const result = data as { ok?: boolean; target_path?: string } | null;\n  const targetPath = result?.ok ? result.target_path : undefined;\n  if (!targetPath || !targetPath.startsWith(\"/\") || targetPath.startsWith(\"//\")) {\n    return { ok: false };\n  }\n  return { ok: true, targetPath };\n}\n"],"mappings":";AA+BO,IAAM,4BAA4B;AAGlC,IAAM,0BAA0B;AAGhC,IAAM,yBAAyB;AAEtC,IAAM,WAAW,IAAI,OAAO,KAAK,yBAAyB,KAAK,uBAAuB,IAAI;AAOnF,SAAS,wBAAwB,WAAqD;AAC3F,QAAM,SAAS,aAAa,IAAI,KAAK,EAAE,YAAY;AACnD,SAAO,SAAS,KAAK,KAAK,IAAI,QAAQ;AACxC;AAGO,SAAS,iBAAiB,WAA+C;AAC9E,SAAO,wBAAwB,SAAS,MAAM;AAChD;AAGO,SAAS,cAAc,OAAuB;AACnD,QAAM,aAAa,wBAAwB,KAAK;AAChD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR,kBAAkB,KAAK,UAAU,KAAK,CAAC,+BACjC,uBAAuB,cAAc,yBAAyB;AAAA,IACtE;AAAA,EACF;AACA,SAAO,GAAG,sBAAsB,GAAG,UAAU;AAC/C;AAMO,SAAS,aAAa,QAAgB,OAAuB;AAClE,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC,GAAG,cAAc,KAAK,CAAC;AAC7D;AAqCA,SAAS,cAAc,QAAgC;AACrD,MAAI,OAAQ,QAAO;AACnB,MAAI,OAAO,WAAW,eAAe,OAAO,UAAU,QAAQ;AAC5D,WAAO,OAAO,SAAS;AAAA,EACzB;AACA,SAAO;AACT;AAGA,eAAsB,cACpB,QACA,SAC8B;AAC9B,MAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,QAAQ,KAAK,WAAW,IAAI,GAAG;AAClE,WAAO,EAAE,IAAI,OAAO,OAAO,qEAAqE;AAAA,EAClG;AACA,QAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,IAAI,OAAO,OAAO,mDAAmD;AAAA,EAChF;AACA,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,mBAAmB;AAAA,IAC1D,QAAQ,QAAQ;AAAA,IAChB,mBAAmB,QAAQ;AAAA,IAC3B,GAAI,QAAQ,YAAY,EAAE,cAAc,QAAQ,UAAU,IAAI,CAAC;AAAA,EACjE,CAAC;AACD,MAAI,MAAO,QAAO,EAAE,IAAI,OAAO,OAAO,MAAM,QAAQ;AACpD,QAAM,SAAS;AACf,QAAM,QAAQ,QAAQ,KAAK,wBAAwB,OAAO,KAAK,IAAI;AACnE,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,SAAS,kCAAkC;AAAA,EAChF;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,MAAM,cAAc,KAAK,GAAG,KAAK,aAAa,QAAQ,KAAK,EAAE;AACzF;AAWA,eAAsB,qBACpB,QACA,OACiC;AACjC,QAAM,aAAa,wBAAwB,KAAK;AAChD,MAAI,CAAC,WAAY,QAAO,EAAE,IAAI,MAAM;AACpC,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,sBAAsB,EAAE,SAAS,WAAW,CAAC;AACtF,MAAI,MAAO,QAAO,EAAE,IAAI,MAAM;AAC9B,QAAM,SAAS;AACf,QAAM,aAAa,QAAQ,KAAK,OAAO,cAAc;AACrD,MAAI,CAAC,cAAc,CAAC,WAAW,WAAW,GAAG,KAAK,WAAW,WAAW,IAAI,GAAG;AAC7E,WAAO,EAAE,IAAI,MAAM;AAAA,EACrB;AACA,SAAO,EAAE,IAAI,MAAM,WAAW;AAChC;","names":[]}
+{"version":3,"sources":["../src/short-link.ts"],"sourcesContent":["/**\n * @ai-matrx/kit/short-link — the platform short-link CONTRACT, in one place.\n *\n * The primitive itself lives in the database (migration `0557_platform_short_links`):\n * `platform.short_links` holds `token → same-app path`, org-scoped and expiring;\n * `platform.create_short_link` mints (server-side only); `public.resolve_short_link`\n * resolves (anon-callable; answers with a PATH, never content — the target route's\n * own auth gates everything). The frontend redirect route is `/r/[token]`\n * (matrx-frontend `app/(public)/r/[token]`), and the notification spine mints per\n * SMS leg (aidream `services/notifications/short_links.py`).\n *\n * This module is the shared vocabulary every client needs to speak about those\n * tokens — alphabet, length, validation, and the URL shape — so no consumer ever\n * re-declares it. 🚨 `SHORT_LINK_TOKEN_ALPHABET` and `SHORT_LINK_TOKEN_LENGTH`\n * mirror `platform.create_short_link` EXACTLY; change one and you change both.\n *\n * 🚨 A short link is a URL, not a permission. The primitive that grants\n * anonymous access to content is `platform.share_links` (`/s/[token]`, 64-hex\n * tokens) — a different system, deliberately. Never shorten by minting a share\n * link, and never share by minting a short link.\n *\n * Pure logic — no DOM, no React, no network; safe in Server Components, route\n * handlers, workers, and Node scripts.\n */\n\n/**\n * 32 characters: digits 2–9 plus a–z minus `l` and `o`. 256 % 32 = 0, so the\n * mint maps random bytes without modulo bias; lowercase-only survives channels\n * that case-mangle (the resolver lowercases before lookup); the ambiguous\n * glyphs (`0/o`, `1/l`) never appear.\n */\nexport const SHORT_LINK_TOKEN_ALPHABET = \"23456789abcdefghijkmnpqrstuvwxyz\";\n\n/** 10 characters × 5 bits = 50 bits — unguessable at any realistic probe rate. */\nexport const SHORT_LINK_TOKEN_LENGTH = 10;\n\n/** The resolve route on the app origin (matrx-frontend `app/(public)/r/[token]`). */\nexport const SHORT_LINK_PATH_PREFIX = \"/r/\";\n\nconst TOKEN_RE = new RegExp(`^[${SHORT_LINK_TOKEN_ALPHABET}]{${SHORT_LINK_TOKEN_LENGTH}}$`);\n\n/**\n * Trim, lowercase, and shape-check a candidate token. Returns the normalized\n * token, or `null` for anything outside the contract — the resolver would\n * refuse it anyway, so callers can skip the round trip.\n */\nexport function normalizeShortLinkToken(candidate: string | null | undefined): string | null {\n  const token = (candidate ?? \"\").trim().toLowerCase();\n  return TOKEN_RE.test(token) ? token : null;\n}\n\n/** Whether a string is a well-formed short-link token (after normalization). */\nexport function isShortLinkToken(candidate: string | null | undefined): boolean {\n  return normalizeShortLinkToken(candidate) !== null;\n}\n\n/** The app-relative path a token resolves at: `/r/<token>`. */\nexport function shortLinkPath(token: string): string {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) {\n    throw new Error(\n      `shortLinkPath: ${JSON.stringify(token)} is not a short-link token ` +\n        `(${SHORT_LINK_TOKEN_LENGTH} chars of \"${SHORT_LINK_TOKEN_ALPHABET}\")`,\n    );\n  }\n  return `${SHORT_LINK_PATH_PREFIX}${normalized}`;\n}\n\n/**\n * The absolute short URL for a token on a given origin, e.g.\n * `shortLinkUrl(\"https://app.aimatrx.com\", token)` → `https://app.aimatrx.com/r/<token>`.\n */\nexport function shortLinkUrl(origin: string, token: string): string {\n  return `${origin.replace(/\\/+$/, \"\")}${shortLinkPath(token)}`;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The client half — the WHOLE mint/resolve logic, so a consumer adds nothing.\n//\n// Pass your Supabase client (or anything with a compatible `.rpc`) and you are\n// done: `mintShortLink(supabase, { path, organizationId })` calls the platform's\n// authenticated mint door (`public.shorten_app_url`, org-membership-gated) and\n// hands back the finished short URL; `resolveShortLinkPath(supabase, token)`\n// calls the anon resolver (`public.resolve_short_link`). No app writes its own\n// shortener logic, ever — the only thing outside this module is the shared\n// database that stores the tokens, which is exactly where shared state lives.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Anything with a Supabase-shaped `.rpc` — pass the Supabase client itself. */\nexport interface ShortLinkClient {\n  rpc(\n    fn: string,\n    args?: Record<string, unknown>,\n  ): PromiseLike<{ data: unknown; error: { message: string } | null }>;\n}\n\nexport interface MintShortLinkOptions {\n  /** Same-app path to shorten (must start with a single `/`). */\n  path: string;\n  /** The organization the link belongs to — the caller must be a member. */\n  organizationId: string;\n  /** ISO timestamp; the platform default (365 days) applies when omitted. */\n  expiresAt?: string;\n  /** Origin for the returned URL; defaults to `window.location.origin`. */\n  origin?: string;\n}\n\nexport type MintShortLinkResult =\n  | { ok: true; token: string; path: string; url: string }\n  | { ok: false; error: string };\n\nfunction resolveOrigin(origin?: string): string | null {\n  if (origin) return origin;\n  if (typeof window !== \"undefined\" && window.location?.origin) {\n    return window.location.origin;\n  }\n  return null;\n}\n\n/** Mint a short link through the platform's authenticated mint door. */\nexport async function mintShortLink(\n  client: ShortLinkClient,\n  options: MintShortLinkOptions,\n): Promise<MintShortLinkResult> {\n  if (!options.path.startsWith(\"/\") || options.path.startsWith(\"//\")) {\n    return { ok: false, error: \"Only a same-app path (starting with a single '/') can be shortened\" };\n  }\n  const origin = resolveOrigin(options.origin);\n  if (!origin) {\n    return { ok: false, error: \"No origin: pass options.origin outside a browser\" };\n  }\n  const { data, error } = await client.rpc(\"shorten_app_url\", {\n    p_path: options.path,\n    p_organization_id: options.organizationId,\n    ...(options.expiresAt ? { p_expires_at: options.expiresAt } : {}),\n  });\n  if (error) return { ok: false, error: error.message };\n  const result = data as { ok?: boolean; token?: string; error?: string } | null;\n  const token = result?.ok ? normalizeShortLinkToken(result.token) : null;\n  if (!token) {\n    return { ok: false, error: result?.error ?? \"The mint door returned no token\" };\n  }\n  return { ok: true, token, path: shortLinkPath(token), url: shortLinkUrl(origin, token) };\n}\n\nexport type ResolveShortLinkResult =\n  | { ok: true; targetPath: string }\n  | { ok: false };\n\n/**\n * Resolve a short token to its target path through the anon resolver.\n * `{ok:false}` covers invalid, unknown, and expired identically — the platform\n * deliberately does not distinguish them.\n */\nexport async function resolveShortLinkPath(\n  client: ShortLinkClient,\n  token: string,\n): Promise<ResolveShortLinkResult> {\n  const normalized = normalizeShortLinkToken(token);\n  if (!normalized) return { ok: false };\n  const { data, error } = await client.rpc(\"resolve_short_link\", { p_token: normalized });\n  if (error) return { ok: false };\n  const result = data as { ok?: boolean; target_path?: string } | null;\n  const targetPath = result?.ok ? result.target_path : undefined;\n  if (!targetPath || !targetPath.startsWith(\"/\") || targetPath.startsWith(\"//\")) {\n    return { ok: false };\n  }\n  return { ok: true, targetPath };\n}\n\n/**\n * The current page as a shortenable same-app path — pathname + query + hash,\n * exactly the \"this view, as I have it configured\" URL (sorts, filters, hidden\n * columns riding in the query string all survive). `null` outside a browser.\n */\nexport function currentAppPath(): string | null {\n  if (typeof window === \"undefined\" || !window.location) return null;\n  const { pathname, search, hash } = window.location;\n  if (!pathname.startsWith(\"/\") || pathname.startsWith(\"//\")) return null;\n  return `${pathname}${search}${hash}`;\n}\n"],"mappings":";AA+BO,IAAM,4BAA4B;AAGlC,IAAM,0BAA0B;AAGhC,IAAM,yBAAyB;AAEtC,IAAM,WAAW,IAAI,OAAO,KAAK,yBAAyB,KAAK,uBAAuB,IAAI;AAOnF,SAAS,wBAAwB,WAAqD;AAC3F,QAAM,SAAS,aAAa,IAAI,KAAK,EAAE,YAAY;AACnD,SAAO,SAAS,KAAK,KAAK,IAAI,QAAQ;AACxC;AAGO,SAAS,iBAAiB,WAA+C;AAC9E,SAAO,wBAAwB,SAAS,MAAM;AAChD;AAGO,SAAS,cAAc,OAAuB;AACnD,QAAM,aAAa,wBAAwB,KAAK;AAChD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR,kBAAkB,KAAK,UAAU,KAAK,CAAC,+BACjC,uBAAuB,cAAc,yBAAyB;AAAA,IACtE;AAAA,EACF;AACA,SAAO,GAAG,sBAAsB,GAAG,UAAU;AAC/C;AAMO,SAAS,aAAa,QAAgB,OAAuB;AAClE,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC,GAAG,cAAc,KAAK,CAAC;AAC7D;AAqCA,SAAS,cAAc,QAAgC;AACrD,MAAI,OAAQ,QAAO;AACnB,MAAI,OAAO,WAAW,eAAe,OAAO,UAAU,QAAQ;AAC5D,WAAO,OAAO,SAAS;AAAA,EACzB;AACA,SAAO;AACT;AAGA,eAAsB,cACpB,QACA,SAC8B;AAC9B,MAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,QAAQ,KAAK,WAAW,IAAI,GAAG;AAClE,WAAO,EAAE,IAAI,OAAO,OAAO,qEAAqE;AAAA,EAClG;AACA,QAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,IAAI,OAAO,OAAO,mDAAmD;AAAA,EAChF;AACA,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,mBAAmB;AAAA,IAC1D,QAAQ,QAAQ;AAAA,IAChB,mBAAmB,QAAQ;AAAA,IAC3B,GAAI,QAAQ,YAAY,EAAE,cAAc,QAAQ,UAAU,IAAI,CAAC;AAAA,EACjE,CAAC;AACD,MAAI,MAAO,QAAO,EAAE,IAAI,OAAO,OAAO,MAAM,QAAQ;AACpD,QAAM,SAAS;AACf,QAAM,QAAQ,QAAQ,KAAK,wBAAwB,OAAO,KAAK,IAAI;AACnE,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,SAAS,kCAAkC;AAAA,EAChF;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,MAAM,cAAc,KAAK,GAAG,KAAK,aAAa,QAAQ,KAAK,EAAE;AACzF;AAWA,eAAsB,qBACpB,QACA,OACiC;AACjC,QAAM,aAAa,wBAAwB,KAAK;AAChD,MAAI,CAAC,WAAY,QAAO,EAAE,IAAI,MAAM;AACpC,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,sBAAsB,EAAE,SAAS,WAAW,CAAC;AACtF,MAAI,MAAO,QAAO,EAAE,IAAI,MAAM;AAC9B,QAAM,SAAS;AACf,QAAM,aAAa,QAAQ,KAAK,OAAO,cAAc;AACrD,MAAI,CAAC,cAAc,CAAC,WAAW,WAAW,GAAG,KAAK,WAAW,WAAW,IAAI,GAAG;AAC7E,WAAO,EAAE,IAAI,MAAM;AAAA,EACrB;AACA,SAAO,EAAE,IAAI,MAAM,WAAW;AAChC;AAOO,SAAS,iBAAgC;AAC9C,MAAI,OAAO,WAAW,eAAe,CAAC,OAAO,SAAU,QAAO;AAC9D,QAAM,EAAE,UAAU,QAAQ,KAAK,IAAI,OAAO;AAC1C,MAAI,CAAC,SAAS,WAAW,GAAG,KAAK,SAAS,WAAW,IAAI,EAAG,QAAO;AACnE,SAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI;AACpC;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-matrx/kit",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "The always-include AI Matrx kit: the little primitives every Matrx app speaks — autosave that never loses a keystroke, stale-response guards, clipboard with graceful fallbacks — one per subpath, tree-shaken to what you use.",
   "type": "module",
   "main": "./dist/index.cjs",