@ai-matrx/records 0.87.32 → 0.92.0

package/dist/portal-Db4CYyHe.d.ts

@@ -0,0 +1,331 @@
+import { U as Uuid, T as Timestamp } from './record-BQi92d4-.js';
+
+/** One portal as `custom.portals` reports it to its organization. */
+interface PortalSummary {
+    portal_id: Uuid;
+    title: string;
+    slug: string;
+    /** The Table whose records ARE the clients. A principal is one of its rows. */
+    client_table_id: Uuid;
+    /** That Table's name, so a list never has to read a second door to draw a row. */
+    client_table: string;
+    is_active: boolean;
+    /** How many Tables this portal exposes. */
+    tables: number;
+    /** Everybody invited and not revoked — NOT everybody who can see anything. */
+    invited: number;
+    /** Of those, how many have followed the link and hold an identity. */
+    signed_in: number;
+    /** `magic_link` today, and the door refuses every other word by name. */
+    sign_in_method: string;
+    opened_at: Timestamp | null;
+}
+/**
+ * ONE (portal, Table) PAIR, as `custom.portal_tables` reports it.
+ *
+ * 🚨 WHY THIS EXISTS (TAILS-3, 2026-09-21). The Portals rail sits on a Table's
+ * page beside Forms, Bookings and Dashboards — all table-scoped — while
+ * `custom.portals` takes no table at all. On Rincon Plumbing Co's **Parts**
+ * table the rail read "Portals 10" and listed ten cards titled "Your jobs and
+ * invoices", which belong to **Jobs**; the empty state never rendered, so the
+ * "Build it / Ask an agent" offer was unreachable on EVERY table of any
+ * organization that already had one portal.
+ *
+ * This is the whole of what a table-scoped rail needs: is the table I am
+ * standing on in any portal, and if not, which portals could take it.
+ */
+interface PortalTableRef {
+    portal_id: Uuid;
+    table_id: Uuid;
+    /** That Table's name, so a rail never reads a second door to draw a row. */
+    name: string;
+}
+/** One Table a portal exposes, as `custom.portal_card` reports it. */
+interface PortalTableExposure {
+    table_id: Uuid;
+    /** The Table's own name. */
+    name: string;
+    /**
+     * The key of the relation Field that says WHOSE a record is. This is the
+     * whole of "only theirs": the association that Field writes is what carries
+     * the record to the client, so a portal cannot exist without one.
+     */
+    names_via: string;
+    /** The field keys a client sees. Empty is impossible — the door fills it. */
+    visible_fields: string[];
+    /** The subset a client may change. Always a subset of `visible_fields`. */
+    editable_fields: string[];
+    comments: boolean;
+    /**
+     * The most a client is ever conveyed on this Table — `viewer`, `commenter`
+     * or `editor` — worked out by the door from the two lists above, never by a
+     * screen.
+     */
+    conveys: string;
+}
+/** One person a portal was opened to, as `custom.portal_card` reports them. */
+interface PortalPrincipal {
+    principal_id: Uuid;
+    email: string;
+    /** The record of the client Table this person IS, for the portal's purposes. */
+    client_record_id: Uuid;
+    /** That record's title — what an owner calls this client. */
+    client: string;
+    /** They followed the link and hold an identity. Until then this is false. */
+    signed_in: boolean;
+    /** Not revoked. An invitation that was never followed is still active. */
+    is_active: boolean;
+    invited_at: Timestamp;
+    revoked_at: Timestamp | null;
+    /**
+     * THE LINK THE OFFICE COPIES FOR THIS PERSON — `/invitations/portal/accept/<token>`, the
+     * path `custom.portal_invite` handed back when they were asked, read off the same
+     * `iam.invitations` row and never re-templated.
+     *
+     * 🚨 `null` IS AN ANSWER, NOT AN ABSENCE, and a screen must say which. It is null when they
+     * have already followed the link, when the office took it back (a revoke withdraws the
+     * invitation in the same statement), when it has expired, or when they were let in through
+     * the server's own magic-link route, which binds without an invitation at all. In every one
+     * of those cases there is genuinely no link to copy — so draw a sentence, never a dead
+     * control. (TAILS-5, 2026-09-21; the gap PORTAL-BIND left named.)
+     */
+    accept_path: string | null;
+}
+/** Everything about ONE portal: what it shows, and who it was opened to. */
+interface PortalCard {
+    portal_id: Uuid;
+    title: string;
+    slug: string;
+    is_active: boolean;
+    sign_in_method: string;
+    client_table_id: Uuid;
+    tables: PortalTableExposure[];
+    principals: PortalPrincipal[];
+    /**
+     * Whether this organization's outside lane is open
+     * (`custom/external_principal_enabled`). Declaring a portal opens it; while
+     * it is false every door refuses an outsider BY NAME, and a screen that drew
+     * the people as reachable anyway would be lying about the one thing that
+     * decides whether they can sign in at all.
+     */
+    external_lane_open: boolean;
+    /** S6 — the look and forms exactly as the owner stored them (`{}` when none). */
+    config: PortalConfig;
+    /** S6 — the look as a client sees it: the portal's own values over the organization's brand. */
+    style: PortalStyle;
+    /** S6 — every form on the portal, in its order, with its title, Table and state. */
+    forms: PortalFormRef[];
+    /** S6 — the accent names a portal may carry (the design system's `STYLE_COLORS`). */
+    accents: PortalAccent[];
+    /**
+     * S6 — the pictures that could be this portal's logo: the organization's own PUBLIC pictures in
+     * Files, newest first. A private file is never offered, because the store would refuse it.
+     */
+    logo_candidates: PublicPicture[];
+}
+/** The design system's colour names (`STYLE_COLORS`), which is all an accent may be. */
+declare const PORTAL_ACCENTS: readonly ["slate", "green", "amber", "red", "blue", "violet", "teal"];
+type PortalAccent = (typeof PORTAL_ACCENTS)[number];
+declare function isPortalAccent(word: unknown): word is PortalAccent;
+/** One link in a portal's footer. The store takes only `https://`, `mailto:` and `tel:`. */
+interface PortalFooterLink {
+    label: string;
+    url: string;
+}
+/** A portal's look as the owner sets it. Every key is optional; absent means "the organization's". */
+interface PortalStyleInput {
+    display_name?: string | null;
+    welcome?: string | null;
+    logo_file_id?: Uuid | null;
+    accent?: PortalAccent | null;
+    footer_links?: PortalFooterLink[] | null;
+}
+/** One form on a portal, as the owner sets it. `order` is the position; `label` overrides the title. */
+interface PortalFormInput {
+    form_id: Uuid;
+    label?: string | null;
+    order?: number | null;
+}
+/**
+ * What `portalDeclare({ config })` sends. A key given REPLACES that key; a key not given is KEPT;
+ * `style: null` puts the organization's brand back and `forms: []` takes every form off.
+ */
+interface PortalConfigInput {
+    style?: PortalStyleInput | null;
+    forms?: PortalFormInput[] | null;
+}
+/** The look and forms as the store holds them (normalized by the store). */
+interface PortalConfig {
+    style?: PortalStyleInput;
+    forms?: Array<{
+        form_id: Uuid;
+        label?: string;
+        order: number;
+    }>;
+}
+/** The look a client is shown — resolved by the store, never computed by a screen. */
+interface PortalStyle {
+    display_name: string;
+    welcome: string | null;
+    logo_file_id: Uuid | null;
+    /** The logo's PUBLIC address, or null. Readable by anybody the portal is shown to. */
+    logo_url: string | null;
+    /** Null means the app's own colour. */
+    accent: PortalAccent | null;
+    footer_links: PortalFooterLink[];
+    /** MAKE-HOME W5 — a cover picture's PUBLIC address (a form's look carries one), or null. */
+    cover_file_id?: Uuid | null;
+    cover_url?: string | null;
+    /** Which of the values above came from the organization rather than the portal. */
+    from_organization: Array<"display_name" | "logo">;
+}
+/**
+ * One of the organization's PUBLIC pictures (`custom._public_pictures`): the only pictures a
+ * portal's logo or a form's logo and cover may be, because a stranger sees them before signing in.
+ */
+interface PublicPicture {
+    file_id: Uuid;
+    name: string;
+    url: string | null;
+}
+/**
+ * What a form's look editor needs (`custom.form_look_options`, MAKE-HOME W5b): the pictures the
+ * store accepts, the colours, and the look a stranger would see for the draft presentation.
+ */
+interface FormLookOptions {
+    pictures: PublicPicture[];
+    accents: PortalAccent[];
+    look: PortalStyle;
+}
+/** One form on a portal, with what the owner needs to see about it. */
+interface PortalFormRef {
+    form_id: Uuid;
+    /** What the portal calls it (the owner's label, else the form's title). */
+    label: string;
+    order: number;
+    title: string;
+    table_id: Uuid | null;
+    table: string;
+    /** `gone` is a form that was removed; the outsider's list only ever carries `open`. */
+    state: "open" | "closed" | "full" | "gone";
+}
+/** A Table's stages as a portal client may be told them (`custom.portal_me` → tables[].stage). */
+interface PortalStage {
+    /** The stage Field's key on the record. */
+    field: string;
+    label: string;
+    /** In the order they were declared. A record stores the stage's `key`. */
+    stages: Array<{
+        key: string;
+        label: string;
+        retired: boolean;
+    }>;
+}
+/** What `custom.portal_form` answers: one form on the caller's own portal. */
+interface PortalFormSpec {
+    form_id: Uuid;
+    portal_id: Uuid;
+    table_id: Uuid;
+    title: string;
+    label: string;
+    presentation: Record<string, unknown>;
+    /** The form's exposed Fields as the store holds them — never the one naming the client. */
+    fields: Array<Record<string, unknown> & {
+        id: Uuid;
+        key: string;
+    }>;
+    required: string[];
+    state: "open" | "closed" | "full";
+    message: string | null;
+}
+/** What `custom.portal_form_submit` answers. `held` waits for the office; `message` says so. */
+interface PortalFormAnswer {
+    submission_id: Uuid | null;
+    record_id: Uuid | null;
+    state: "accepted" | "held" | "rejected" | "closed" | "full" | "too_many";
+    message: string | null;
+}
+/** What `custom.portal_invite` answers. `say` is the door's own sentence. */
+interface PortalInvitation {
+    invited: boolean;
+    principal_id: Uuid;
+    portal_id: Uuid;
+    slug: string;
+    email: string;
+    client_record_id: Uuid;
+    client: string;
+    /** They already hold an identity. From a screen this is false: the door is passed no user. */
+    bound: boolean;
+    /**
+     * The door's own words, and the ONLY correct summary of what just happened —
+     * it says outright that an invitation confers nothing until the link is
+     * followed. Show it; never paraphrase it.
+     */
+    say: string;
+}
+/** What `custom.portal_revoke` answers. `say` names the consequence, past tense. */
+interface PortalRevocation {
+    revoked: boolean;
+    principal_id: Uuid;
+    email: string;
+    /** The door's own sentence: they can no longer sign in, and their records stop reaching them. */
+    say: string;
+}
+/** One row of "what this client sees", from `custom.portal_preview`. */
+interface PortalPreviewRow {
+    record_id: Uuid;
+    title: string;
+}
+/**
+ * THE PUBLIC ADDRESS OF A PORTAL, and the one place its shape is written down.
+ *
+ * Unlike a form's link, a portal's slug is NOT the capability: the page it
+ * serves asks who you are and emails a one-time link, so the slug is a name and
+ * nothing more. That is why it is readable and why copying it is safe.
+ */
+declare function portalPath(slug: string): string;
+/**
+ * The platform archive filter's own three values, and no fourth. `custom.list_portals`
+ * refuses anything else with `22023` rather than quietly treating it as one of them.
+ */
+declare const PORTAL_ARCHIVE_FILTERS: readonly ["active", "archived", "all"];
+type PortalArchiveFilter = (typeof PORTAL_ARCHIVE_FILTERS)[number];
+/** THE LAW'S DEFAULT IS TO HIDE. A list nobody narrowed is the live things. */
+declare const DEFAULT_PORTAL_ARCHIVE_FILTER: PortalArchiveFilter;
+declare function isPortalArchiveFilter(word: unknown): word is PortalArchiveFilter;
+/** What `custom.portal_archive` and `custom.portal_restore` answer with. */
+interface PortalArchiveAnswer {
+    /** Where the portal stands NOW — true after an archive, false after a restore. */
+    archived: boolean;
+    /** False when it was already in that state; the sentence says so rather than lying about an act. */
+    changed: boolean;
+    portal_id: Uuid;
+    archived_at?: Timestamp | null;
+    /** The store's own sentence, in plain English. Show it verbatim; never a constraint name. */
+    sentence: string;
+}
+/**
+ * THE CONSEQUENCE, SAID BEFORE THE CLICK — never a generic "are you sure?".
+ *
+ * What actually changes is two things: nobody can sign in to it any more, and it
+ * leaves the organization's portal list. What does NOT change is everything
+ * else, and saying so is the difference between an archive somebody dares to
+ * press and one they avoid.
+ */
+declare function portalArchiveConsequence(title: string, signedIn: number, invited: number): string;
+/**
+ * WHY THE TITLE HAS TO BE TYPED BACK, in the store's own reasoning. Ten portals
+ * can carry one title, so the title is not what PICKS this one — the portal you
+ * opened is. Typing it back is how you say you meant this one.
+ */
+declare function portalConfirmLine(title: string): string;
+/** True when what the person typed is what the door will accept. The door decides; this only spares them a round trip. */
+declare function portalTitleTypedBack(typed: string, title: string): boolean;
+/**
+ * WHAT AN EMPTY ARCHIVE LANE SAYS. An empty list is an answer: it says nothing
+ * has been archived, so "none here" can never be read as "the archive is broken"
+ * or as "this organization has no portals at all".
+ */
+declare function emptyPortalArchiveLine(): string;
+
+export { portalArchiveConsequence as A, portalConfirmLine as B, portalPath as C, DEFAULT_PORTAL_ARCHIVE_FILTER as D, portalTitleTypedBack as E, type FormLookOptions as F, type PortalSummary as P, type PortalArchiveFilter as a, type PortalArchiveAnswer as b, type PortalTableRef as c, type PortalCard as d, type PortalConfigInput as e, type PortalFormSpec as f, type PortalFormAnswer as g, type PortalInvitation as h, type PortalRevocation as i, type PortalPreviewRow as j, type PortalAccent as k, PORTAL_ACCENTS as l, PORTAL_ARCHIVE_FILTERS as m, type PortalConfig as n, type PortalFooterLink as o, type PortalFormInput as p, type PortalFormRef as q, type PortalPrincipal as r, type PortalStage as s, type PortalStyle as t, type PortalStyleInput as u, type PortalTableExposure as v, type PublicPicture as w, emptyPortalArchiveLine as x, isPortalAccent as y, isPortalArchiveFilter as z };

package/dist/portal-DfeY2Boy.d.cts

@@ -0,0 +1,331 @@
+import { U as Uuid, T as Timestamp } from './record-BQi92d4-.cjs';
+
+/** One portal as `custom.portals` reports it to its organization. */
+interface PortalSummary {
+    portal_id: Uuid;
+    title: string;
+    slug: string;
+    /** The Table whose records ARE the clients. A principal is one of its rows. */
+    client_table_id: Uuid;
+    /** That Table's name, so a list never has to read a second door to draw a row. */
+    client_table: string;
+    is_active: boolean;
+    /** How many Tables this portal exposes. */
+    tables: number;
+    /** Everybody invited and not revoked — NOT everybody who can see anything. */
+    invited: number;
+    /** Of those, how many have followed the link and hold an identity. */
+    signed_in: number;
+    /** `magic_link` today, and the door refuses every other word by name. */
+    sign_in_method: string;
+    opened_at: Timestamp | null;
+}
+/**
+ * ONE (portal, Table) PAIR, as `custom.portal_tables` reports it.
+ *
+ * 🚨 WHY THIS EXISTS (TAILS-3, 2026-09-21). The Portals rail sits on a Table's
+ * page beside Forms, Bookings and Dashboards — all table-scoped — while
+ * `custom.portals` takes no table at all. On Rincon Plumbing Co's **Parts**
+ * table the rail read "Portals 10" and listed ten cards titled "Your jobs and
+ * invoices", which belong to **Jobs**; the empty state never rendered, so the
+ * "Build it / Ask an agent" offer was unreachable on EVERY table of any
+ * organization that already had one portal.
+ *
+ * This is the whole of what a table-scoped rail needs: is the table I am
+ * standing on in any portal, and if not, which portals could take it.
+ */
+interface PortalTableRef {
+    portal_id: Uuid;
+    table_id: Uuid;
+    /** That Table's name, so a rail never reads a second door to draw a row. */
+    name: string;
+}
+/** One Table a portal exposes, as `custom.portal_card` reports it. */
+interface PortalTableExposure {
+    table_id: Uuid;
+    /** The Table's own name. */
+    name: string;
+    /**
+     * The key of the relation Field that says WHOSE a record is. This is the
+     * whole of "only theirs": the association that Field writes is what carries
+     * the record to the client, so a portal cannot exist without one.
+     */
+    names_via: string;
+    /** The field keys a client sees. Empty is impossible — the door fills it. */
+    visible_fields: string[];
+    /** The subset a client may change. Always a subset of `visible_fields`. */
+    editable_fields: string[];
+    comments: boolean;
+    /**
+     * The most a client is ever conveyed on this Table — `viewer`, `commenter`
+     * or `editor` — worked out by the door from the two lists above, never by a
+     * screen.
+     */
+    conveys: string;
+}
+/** One person a portal was opened to, as `custom.portal_card` reports them. */
+interface PortalPrincipal {
+    principal_id: Uuid;
+    email: string;
+    /** The record of the client Table this person IS, for the portal's purposes. */
+    client_record_id: Uuid;
+    /** That record's title — what an owner calls this client. */
+    client: string;
+    /** They followed the link and hold an identity. Until then this is false. */
+    signed_in: boolean;
+    /** Not revoked. An invitation that was never followed is still active. */
+    is_active: boolean;
+    invited_at: Timestamp;
+    revoked_at: Timestamp | null;
+    /**
+     * THE LINK THE OFFICE COPIES FOR THIS PERSON — `/invitations/portal/accept/<token>`, the
+     * path `custom.portal_invite` handed back when they were asked, read off the same
+     * `iam.invitations` row and never re-templated.
+     *
+     * 🚨 `null` IS AN ANSWER, NOT AN ABSENCE, and a screen must say which. It is null when they
+     * have already followed the link, when the office took it back (a revoke withdraws the
+     * invitation in the same statement), when it has expired, or when they were let in through
+     * the server's own magic-link route, which binds without an invitation at all. In every one
+     * of those cases there is genuinely no link to copy — so draw a sentence, never a dead
+     * control. (TAILS-5, 2026-09-21; the gap PORTAL-BIND left named.)
+     */
+    accept_path: string | null;
+}
+/** Everything about ONE portal: what it shows, and who it was opened to. */
+interface PortalCard {
+    portal_id: Uuid;
+    title: string;
+    slug: string;
+    is_active: boolean;
+    sign_in_method: string;
+    client_table_id: Uuid;
+    tables: PortalTableExposure[];
+    principals: PortalPrincipal[];
+    /**
+     * Whether this organization's outside lane is open
+     * (`custom/external_principal_enabled`). Declaring a portal opens it; while
+     * it is false every door refuses an outsider BY NAME, and a screen that drew
+     * the people as reachable anyway would be lying about the one thing that
+     * decides whether they can sign in at all.
+     */
+    external_lane_open: boolean;
+    /** S6 — the look and forms exactly as the owner stored them (`{}` when none). */
+    config: PortalConfig;
+    /** S6 — the look as a client sees it: the portal's own values over the organization's brand. */
+    style: PortalStyle;
+    /** S6 — every form on the portal, in its order, with its title, Table and state. */
+    forms: PortalFormRef[];
+    /** S6 — the accent names a portal may carry (the design system's `STYLE_COLORS`). */
+    accents: PortalAccent[];
+    /**
+     * S6 — the pictures that could be this portal's logo: the organization's own PUBLIC pictures in
+     * Files, newest first. A private file is never offered, because the store would refuse it.
+     */
+    logo_candidates: PublicPicture[];
+}
+/** The design system's colour names (`STYLE_COLORS`), which is all an accent may be. */
+declare const PORTAL_ACCENTS: readonly ["slate", "green", "amber", "red", "blue", "violet", "teal"];
+type PortalAccent = (typeof PORTAL_ACCENTS)[number];
+declare function isPortalAccent(word: unknown): word is PortalAccent;
+/** One link in a portal's footer. The store takes only `https://`, `mailto:` and `tel:`. */
+interface PortalFooterLink {
+    label: string;
+    url: string;
+}
+/** A portal's look as the owner sets it. Every key is optional; absent means "the organization's". */
+interface PortalStyleInput {
+    display_name?: string | null;
+    welcome?: string | null;
+    logo_file_id?: Uuid | null;
+    accent?: PortalAccent | null;
+    footer_links?: PortalFooterLink[] | null;
+}
+/** One form on a portal, as the owner sets it. `order` is the position; `label` overrides the title. */
+interface PortalFormInput {
+    form_id: Uuid;
+    label?: string | null;
+    order?: number | null;
+}
+/**
+ * What `portalDeclare({ config })` sends. A key given REPLACES that key; a key not given is KEPT;
+ * `style: null` puts the organization's brand back and `forms: []` takes every form off.
+ */
+interface PortalConfigInput {
+    style?: PortalStyleInput | null;
+    forms?: PortalFormInput[] | null;
+}
+/** The look and forms as the store holds them (normalized by the store). */
+interface PortalConfig {
+    style?: PortalStyleInput;
+    forms?: Array<{
+        form_id: Uuid;
+        label?: string;
+        order: number;
+    }>;
+}
+/** The look a client is shown — resolved by the store, never computed by a screen. */
+interface PortalStyle {
+    display_name: string;
+    welcome: string | null;
+    logo_file_id: Uuid | null;
+    /** The logo's PUBLIC address, or null. Readable by anybody the portal is shown to. */
+    logo_url: string | null;
+    /** Null means the app's own colour. */
+    accent: PortalAccent | null;
+    footer_links: PortalFooterLink[];
+    /** MAKE-HOME W5 — a cover picture's PUBLIC address (a form's look carries one), or null. */
+    cover_file_id?: Uuid | null;
+    cover_url?: string | null;
+    /** Which of the values above came from the organization rather than the portal. */
+    from_organization: Array<"display_name" | "logo">;
+}
+/**
+ * One of the organization's PUBLIC pictures (`custom._public_pictures`): the only pictures a
+ * portal's logo or a form's logo and cover may be, because a stranger sees them before signing in.
+ */
+interface PublicPicture {
+    file_id: Uuid;
+    name: string;
+    url: string | null;
+}
+/**
+ * What a form's look editor needs (`custom.form_look_options`, MAKE-HOME W5b): the pictures the
+ * store accepts, the colours, and the look a stranger would see for the draft presentation.
+ */
+interface FormLookOptions {
+    pictures: PublicPicture[];
+    accents: PortalAccent[];
+    look: PortalStyle;
+}
+/** One form on a portal, with what the owner needs to see about it. */
+interface PortalFormRef {
+    form_id: Uuid;
+    /** What the portal calls it (the owner's label, else the form's title). */
+    label: string;
+    order: number;
+    title: string;
+    table_id: Uuid | null;
+    table: string;
+    /** `gone` is a form that was removed; the outsider's list only ever carries `open`. */
+    state: "open" | "closed" | "full" | "gone";
+}
+/** A Table's stages as a portal client may be told them (`custom.portal_me` → tables[].stage). */
+interface PortalStage {
+    /** The stage Field's key on the record. */
+    field: string;
+    label: string;
+    /** In the order they were declared. A record stores the stage's `key`. */
+    stages: Array<{
+        key: string;
+        label: string;
+        retired: boolean;
+    }>;
+}
+/** What `custom.portal_form` answers: one form on the caller's own portal. */
+interface PortalFormSpec {
+    form_id: Uuid;
+    portal_id: Uuid;
+    table_id: Uuid;
+    title: string;
+    label: string;
+    presentation: Record<string, unknown>;
+    /** The form's exposed Fields as the store holds them — never the one naming the client. */
+    fields: Array<Record<string, unknown> & {
+        id: Uuid;
+        key: string;
+    }>;
+    required: string[];
+    state: "open" | "closed" | "full";
+    message: string | null;
+}
+/** What `custom.portal_form_submit` answers. `held` waits for the office; `message` says so. */
+interface PortalFormAnswer {
+    submission_id: Uuid | null;
+    record_id: Uuid | null;
+    state: "accepted" | "held" | "rejected" | "closed" | "full" | "too_many";
+    message: string | null;
+}
+/** What `custom.portal_invite` answers. `say` is the door's own sentence. */
+interface PortalInvitation {
+    invited: boolean;
+    principal_id: Uuid;
+    portal_id: Uuid;
+    slug: string;
+    email: string;
+    client_record_id: Uuid;
+    client: string;
+    /** They already hold an identity. From a screen this is false: the door is passed no user. */
+    bound: boolean;
+    /**
+     * The door's own words, and the ONLY correct summary of what just happened —
+     * it says outright that an invitation confers nothing until the link is
+     * followed. Show it; never paraphrase it.
+     */
+    say: string;
+}
+/** What `custom.portal_revoke` answers. `say` names the consequence, past tense. */
+interface PortalRevocation {
+    revoked: boolean;
+    principal_id: Uuid;
+    email: string;
+    /** The door's own sentence: they can no longer sign in, and their records stop reaching them. */
+    say: string;
+}
+/** One row of "what this client sees", from `custom.portal_preview`. */
+interface PortalPreviewRow {
+    record_id: Uuid;
+    title: string;
+}
+/**
+ * THE PUBLIC ADDRESS OF A PORTAL, and the one place its shape is written down.
+ *
+ * Unlike a form's link, a portal's slug is NOT the capability: the page it
+ * serves asks who you are and emails a one-time link, so the slug is a name and
+ * nothing more. That is why it is readable and why copying it is safe.
+ */
+declare function portalPath(slug: string): string;
+/**
+ * The platform archive filter's own three values, and no fourth. `custom.list_portals`
+ * refuses anything else with `22023` rather than quietly treating it as one of them.
+ */
+declare const PORTAL_ARCHIVE_FILTERS: readonly ["active", "archived", "all"];
+type PortalArchiveFilter = (typeof PORTAL_ARCHIVE_FILTERS)[number];
+/** THE LAW'S DEFAULT IS TO HIDE. A list nobody narrowed is the live things. */
+declare const DEFAULT_PORTAL_ARCHIVE_FILTER: PortalArchiveFilter;
+declare function isPortalArchiveFilter(word: unknown): word is PortalArchiveFilter;
+/** What `custom.portal_archive` and `custom.portal_restore` answer with. */
+interface PortalArchiveAnswer {
+    /** Where the portal stands NOW — true after an archive, false after a restore. */
+    archived: boolean;
+    /** False when it was already in that state; the sentence says so rather than lying about an act. */
+    changed: boolean;
+    portal_id: Uuid;
+    archived_at?: Timestamp | null;
+    /** The store's own sentence, in plain English. Show it verbatim; never a constraint name. */
+    sentence: string;
+}
+/**
+ * THE CONSEQUENCE, SAID BEFORE THE CLICK — never a generic "are you sure?".
+ *
+ * What actually changes is two things: nobody can sign in to it any more, and it
+ * leaves the organization's portal list. What does NOT change is everything
+ * else, and saying so is the difference between an archive somebody dares to
+ * press and one they avoid.
+ */
+declare function portalArchiveConsequence(title: string, signedIn: number, invited: number): string;
+/**
+ * WHY THE TITLE HAS TO BE TYPED BACK, in the store's own reasoning. Ten portals
+ * can carry one title, so the title is not what PICKS this one — the portal you
+ * opened is. Typing it back is how you say you meant this one.
+ */
+declare function portalConfirmLine(title: string): string;
+/** True when what the person typed is what the door will accept. The door decides; this only spares them a round trip. */
+declare function portalTitleTypedBack(typed: string, title: string): boolean;
+/**
+ * WHAT AN EMPTY ARCHIVE LANE SAYS. An empty list is an answer: it says nothing
+ * has been archived, so "none here" can never be read as "the archive is broken"
+ * or as "this organization has no portals at all".
+ */
+declare function emptyPortalArchiveLine(): string;
+
+export { portalArchiveConsequence as A, portalConfirmLine as B, portalPath as C, DEFAULT_PORTAL_ARCHIVE_FILTER as D, portalTitleTypedBack as E, type FormLookOptions as F, type PortalSummary as P, type PortalArchiveFilter as a, type PortalArchiveAnswer as b, type PortalTableRef as c, type PortalCard as d, type PortalConfigInput as e, type PortalFormSpec as f, type PortalFormAnswer as g, type PortalInvitation as h, type PortalRevocation as i, type PortalPreviewRow as j, type PortalAccent as k, PORTAL_ACCENTS as l, PORTAL_ARCHIVE_FILTERS as m, type PortalConfig as n, type PortalFooterLink as o, type PortalFormInput as p, type PortalFormRef as q, type PortalPrincipal as r, type PortalStage as s, type PortalStyle as t, type PortalStyleInput as u, type PortalTableExposure as v, type PublicPicture as w, emptyPortalArchiveLine as x, isPortalAccent as y, isPortalArchiveFilter as z };

package/dist/{ports-TMWX-t9l.d.ts → ports-BWtxAnXh.d.ts}

@@ -1,4 +1,4 @@
-import { A as Actor, U as Uuid, P as PgError } from './record-DpB2QgAZ.js';
+import { A as Actor, U as Uuid, P as PgError } from './record-BQi92d4-.js';
 
 /**
  * The data seam: a structural subset of `SupabaseClient`. The package never
@@ -190,4 +190,4 @@ interface RecordsConfig {
     knownDoors?: readonly string[];
 }
 
-export type { RecordsRealtimePort as R, RecordsConfig as a, RecordsDataSource as b, RecordsActor as c, RecordsChangeSink as d, RecordsErrorSink as e, RecordsFilter as f, RecordsResolverPort as g, RecordsResponse as h, RecordsTableQuery as i };
+export type { RecordsRealtimePort as R, RecordsConfig as a, RecordsErrorSink as b, RecordsDataSource as c, RecordsChangeSink as d, RecordsActor as e, RecordsFilter as f, RecordsResolverPort as g, RecordsResponse as h, RecordsTableQuery as i };

package/dist/{ports-D8-iuY1P.d.cts → ports-DSU2RsR6.d.cts}

@@ -1,4 +1,4 @@
-import { A as Actor, U as Uuid, P as PgError } from './record-DpB2QgAZ.cjs';
+import { A as Actor, U as Uuid, P as PgError } from './record-BQi92d4-.cjs';
 
 /**
  * The data seam: a structural subset of `SupabaseClient`. The package never
@@ -190,4 +190,4 @@ interface RecordsConfig {
     knownDoors?: readonly string[];
 }
 
-export type { RecordsRealtimePort as R, RecordsConfig as a, RecordsDataSource as b, RecordsActor as c, RecordsChangeSink as d, RecordsErrorSink as e, RecordsFilter as f, RecordsResolverPort as g, RecordsResponse as h, RecordsTableQuery as i };
+export type { RecordsRealtimePort as R, RecordsConfig as a, RecordsErrorSink as b, RecordsDataSource as c, RecordsChangeSink as d, RecordsActor as e, RecordsFilter as f, RecordsResolverPort as g, RecordsResponse as h, RecordsTableQuery as i };