@ai-matrx/sharing 0.1.0 → 0.1.2

package/dist/core.d.cts

@@ -1,7 +1,7 @@
 import * as _supabase_supabase_js from '@supabase/supabase-js';
 import { SupabaseClient } from '@supabase/supabase-js';
 import { DbPermissionLevel, PermissionLevel } from '@ai-matrx/data/access';
-export { DB_PERMISSION_LEVELS, DbPermissionLevel, PERMISSION_LEVELS, PERMISSION_LEVEL_HINTS, PERMISSION_LEVEL_LABELS, PERMISSION_LEVEL_SHORT_LABELS, PermissionLevel, isDbPermissionLevel, isPermissionLevel, toDbPermissionLevel } from '@ai-matrx/data/access';
+export { DB_PERMISSION_LEVELS, DbPermissionLevel, PERMISSION_LEVELS, PERMISSION_LEVEL_HINTS, PERMISSION_LEVEL_LABELS, PERMISSION_LEVEL_SHORT_LABELS, PermissionLevel, isDbPermissionLevel, isPermissionLevel, normalizePermissionLevel, parsePermissionLevel, toDbPermissionLevel } from '@ai-matrx/data/access';
 import { EntityTypeToken } from '@ai-matrx/associations';
 import * as _ai_matrx_api_account from '@ai-matrx/api/account';
 import { components } from '@ai-matrx/api/types';
@@ -3426,15 +3426,12 @@ declare function getResourceSharePath(resourceType: string, resourceId: string):
  * rank map, label map or ordered array omits a level.
  */
 
-/** Maps a stored/retired level onto the public ladder (a stray `edit_content` row reads as Edit). */
-declare function normalizePermissionLevel(raw: unknown): PermissionLevel | null;
 /** The levels a picker may offer: what the database stores, never the retired `edit_content`. */
 declare const OFFERED_DB_PERMISSION_LEVELS: readonly DbPermissionLevel[];
 /** Rank of every level; a stray stored `edit_content` ranks as Edit so old data never crashes. */
 declare const PERMISSION_LEVEL_RANK: Record<PermissionLevel, number> & {
     edit_content: number;
 };
-declare function parsePermissionLevel(raw: unknown, context: string): PermissionLevel | null;
 declare function permissionLevelRank(level: PermissionLevel): number;
 
 /**
@@ -3751,15 +3748,15 @@ interface CreateShareLinkOptions {
     maxUses?: number | null | undefined;
     label?: string | null | undefined;
 }
-/** Build the absolute share URL for a token. */
-declare function shareLinkUrl(token: string): string;
+/** Build the absolute share URL for a token (on `origin` when given). */
+declare function shareLinkUrl(token: string, origin?: string | undefined): string;
 /**
  * The URL to hand a person for a share link — the short alias when one exists
  * (auto-shorten-every-share-link, owner ruling 2026-08-29), the full /s/ URL
  * otherwise. The alias is a redirect only; the 64-hex share token stays the
  * one authorization either way.
  */
-declare function shareUrlForLink(link: Pick<ShareLink, "token" | "shortToken">): string;
+declare function shareUrlForLink(link: Pick<ShareLink, "token" | "shortToken">, origin?: string | undefined): string;
 /** Mint a share link for a resource (owner-only). Returns the token + URL. */
 declare function createShareLink(options: CreateShareLinkOptions): Promise<{
     success: boolean;
@@ -4065,7 +4062,7 @@ declare function resolveResourceOwnership(resourceType: ResourceType, resourceId
  * record store it could not even be ASKED, because `custom.record` carries no
  * client SELECT grant and the direct read above returns "Could not read Record".
  *
- * So this asks the database's own predicate (`public.may_manage_sharing`, lane
+ * So this asks the database's own predicate (`iam.may_manage_sharing`, lane
  * SHARE 2026-09-19), which is the same one the six sharing RPCs enforce. The
  * screen and the door cannot disagree, because there is one answer.
  *
@@ -4674,10 +4671,10 @@ declare function setSearchEngineIndexed(resourceType: string, resourceId: string
 
 type Database = any;
 
-type OrganizationMemberRow = Database["public"]["Functions"]["get_organization_members_with_users"]["Returns"][number];
+type OrganizationMemberRow = Database["iam"]["Functions"]["get_organization_members_with_users"]["Returns"][number];
 /** How long a settled roster is kept: for the tab (a change made here forgets it). */
 declare const MEMBER_ROWS_TTL_MS: number;
-type RosterClient = Pick<ReturnType<typeof createClient>, "rpc">;
+type RosterClient = Pick<ReturnType<typeof createClient>, "rpc" | "schema">;
 declare function readOrganizationMemberRows(orgId: string, { now, fresh, client, }?: {
     now?: number | undefined;
     /** An explicit refresh: skip a settled answer (an in-flight read is still joined). */
@@ -4737,4 +4734,4 @@ interface HrDepartmentOption {
 declare function listTeams(organizationId: string, includeArchived?: boolean): Promise<Team[]>;
 declare function listTeamMembers(teamId: string): Promise<TeamMember[]>;
 
-export { ACCESS_SUMMARY_ERROR_HEADLINE, type AccessContainer, type AccessDirectGrant, type AccessGranteeType, type AccessKpis, type AccessNotice, type AccessPanelView, type AccessReasonRow, type AccessSummary, type AccessSummaryView, type ApiCallResult, type AppDispatch, type ChannelReadiness, type CheckPermissionOptions, type ForkResult, GRANT_LIST_SCOPE_NOTE, type GranteeKind, type HrDepartmentOption, type LaneChoice, MEMBER_ROWS_TTL_MS, type MakePublicOptions, type MyPendingTableInvitation, NOTHING_ELSE_GRANTS, NO_GRANTS_DETAIL, NO_GRANTS_HEADLINE, NO_GRANTS_YET_HEADLINE, OFFERED_DB_PERMISSION_LEVELS, type OrCapable, type OrgAvailabilityOptions, type OrganizationMemberRow, type OutsideInviteAnswer, type OutsideShareDelivery, type OutsideShareInvitation, type OutsideShareLevel, type OutsideShareState, type OwnedResource, type OwnerCheckResult, type OwnershipResolution, PERMISSION_LEVEL_RANK, PUBLIC_LANE_COLUMNS, PUBLIC_LANE_TYPES, type Permission, type PermissionCheckResult, PermissionError, PermissionErrorCode, type PermissionWithDetails, type PublishLane, RESOURCE_TYPES, type ResolvedShareToken, type ResourceType, type ResourceVisibility, type RevokeAccessOptions, SHAREABLE_RESOURCE_REGISTRY, SHOWN_TO_ORDER, SHOWN_TO_WORDS, type SearchEngineIndexedState, type SecureDeliveryCreate, type SecureDeliveryOptions, type SecureDeliveryPage, type SecureDeliveryReceipt, SecureDeliveryRefusal, type SentSecureDelivery, type ShareActionResult, type ShareCapabilities, type ShareDbClient, type ShareLink, type ShareNoticeAnswer, type ShareServerCall, type ShareServerResult, type ShareTargetType, type ShareWithUserOptions, type ShareableResourceEntry, type SharingCopyContext, type SharingHost, type SharingState, type ShownTo, type ShownToContext, type TableSharePeek, type Team, type TeamMember, type TeamRole, type UpdatePermissionOptions, type WhoCanSee, absoluteInviteUrl, acceptOutsideShare, accessKpis, accessReasonRows, accessSummaryView, appUrl, applyShownTo, batchShareWithUsers, callApi, checkPermission, configureSharing, containerDetail, containerTitle, createClient, createSafeShareMessage, createShareLink, describeAccessSummary, describeShareLinkAccess, describeShareLinkExpiry, ensureOrgAvailability, ensureOrgId, evaluateShareLinkHandoff, fetchAccessSummary, fetchEntityTitles, fetchRecipientPhoneOnFile, fetchSecureDeliveryOptions, fetchShownToContext, forgetOrganizationMemberRows, forkSharedResource, getActiveOrgId, getClaimsUser, getPermissionLevelLabel, getPermissionLevelsAtOrAbove, getResourcePermissions, getResourceSharePath, getResourceTypeLabel, getResourceVisibility, getSearchEngineIndexedState, getShareCapabilities, getShareableResource, getSharedWithMe, grantCsvRow, grantCsvRows, grantLevelLabel, grantOrgAvailability, granteeKind, granteeLabel, granteeSecondaryLabel, hasPublicPage, humanAccessPanel, humanAccessSummary, humanGrantList, humanGrantRow, humanNotices, isForkable, isJsonObject, isKnownEntity, isPrivateSummary, isResourceOwner, listPermissions, listSentSecureDeliveries, listShareLinks, listTeamMembers, listTeams, makePrivate, makePublic, myPendingTableInvitations, normalizePermissionLevel, onlyOpenOrganizations, openSecureDelivery, organizationDisambiguators, parsePermissionLevel, passThroughDispatch, peekTableShare, permissionLevelRank, publicLaneSelect, publicResourceUrl, readOrganizationMemberRows, readOutsideShare, reasonCsvRows, recordNoun, requestSecureDeliveryCode, resendOutside, resolveEntityHref, resolveResourceOwnership, resolveResourceToken, resolveShareToken, resolveSharingAuthority, resolveTableName, revokeAccess, revokeOrgAccess, revokeOutside, revokePublicAccess, revokeSecureDelivery, revokeShareLink, revokeUserAccess, satisfiesPermissionLevel, sendSecureDelivery, sendShareNotice, setResourceShownTo, setSearchEngineIndexed, setStoreLane, shareClient, shareLinkSecurityStateMatches, shareLinkUnavailableReason, shareLinkUrl, shareUrlForLink, shareWithOutsidePerson, shareWithUser, sharingHost, sharingLocation, shownToBlendedFilter, shownToFilter, shownToMyOrgsFilter, summaryReachLabel, supabase, updatePermissionLevel, validatePermission, viewSecureDelivery };
+export { ACCESS_SUMMARY_ERROR_HEADLINE, type AccessContainer, type AccessDirectGrant, type AccessGranteeType, type AccessKpis, type AccessNotice, type AccessPanelView, type AccessReasonRow, type AccessSummary, type AccessSummaryView, type ApiCallResult, type AppDispatch, type ChannelReadiness, type CheckPermissionOptions, type ForkResult, GRANT_LIST_SCOPE_NOTE, type GranteeKind, type HrDepartmentOption, type LaneChoice, MEMBER_ROWS_TTL_MS, type MakePublicOptions, type MyPendingTableInvitation, NOTHING_ELSE_GRANTS, NO_GRANTS_DETAIL, NO_GRANTS_HEADLINE, NO_GRANTS_YET_HEADLINE, OFFERED_DB_PERMISSION_LEVELS, type OrCapable, type OrgAvailabilityOptions, type OrganizationMemberRow, type OutsideInviteAnswer, type OutsideShareDelivery, type OutsideShareInvitation, type OutsideShareLevel, type OutsideShareState, type OwnedResource, type OwnerCheckResult, type OwnershipResolution, PERMISSION_LEVEL_RANK, PUBLIC_LANE_COLUMNS, PUBLIC_LANE_TYPES, type Permission, type PermissionCheckResult, PermissionError, PermissionErrorCode, type PermissionWithDetails, type PublishLane, RESOURCE_TYPES, type ResolvedShareToken, type ResourceType, type ResourceVisibility, type RevokeAccessOptions, SHAREABLE_RESOURCE_REGISTRY, SHOWN_TO_ORDER, SHOWN_TO_WORDS, type SearchEngineIndexedState, type SecureDeliveryCreate, type SecureDeliveryOptions, type SecureDeliveryPage, type SecureDeliveryReceipt, SecureDeliveryRefusal, type SentSecureDelivery, type ShareActionResult, type ShareCapabilities, type ShareDbClient, type ShareLink, type ShareNoticeAnswer, type ShareServerCall, type ShareServerResult, type ShareTargetType, type ShareWithUserOptions, type ShareableResourceEntry, type SharingCopyContext, type SharingHost, type SharingState, type ShownTo, type ShownToContext, type TableSharePeek, type Team, type TeamMember, type TeamRole, type UpdatePermissionOptions, type WhoCanSee, absoluteInviteUrl, acceptOutsideShare, accessKpis, accessReasonRows, accessSummaryView, appUrl, applyShownTo, batchShareWithUsers, callApi, checkPermission, configureSharing, containerDetail, containerTitle, createClient, createSafeShareMessage, createShareLink, describeAccessSummary, describeShareLinkAccess, describeShareLinkExpiry, ensureOrgAvailability, ensureOrgId, evaluateShareLinkHandoff, fetchAccessSummary, fetchEntityTitles, fetchRecipientPhoneOnFile, fetchSecureDeliveryOptions, fetchShownToContext, forgetOrganizationMemberRows, forkSharedResource, getActiveOrgId, getClaimsUser, getPermissionLevelLabel, getPermissionLevelsAtOrAbove, getResourcePermissions, getResourceSharePath, getResourceTypeLabel, getResourceVisibility, getSearchEngineIndexedState, getShareCapabilities, getShareableResource, getSharedWithMe, grantCsvRow, grantCsvRows, grantLevelLabel, grantOrgAvailability, granteeKind, granteeLabel, granteeSecondaryLabel, hasPublicPage, humanAccessPanel, humanAccessSummary, humanGrantList, humanGrantRow, humanNotices, isForkable, isJsonObject, isKnownEntity, isPrivateSummary, isResourceOwner, listPermissions, listSentSecureDeliveries, listShareLinks, listTeamMembers, listTeams, makePrivate, makePublic, myPendingTableInvitations, onlyOpenOrganizations, openSecureDelivery, organizationDisambiguators, passThroughDispatch, peekTableShare, permissionLevelRank, publicLaneSelect, publicResourceUrl, readOrganizationMemberRows, readOutsideShare, reasonCsvRows, recordNoun, requestSecureDeliveryCode, resendOutside, resolveEntityHref, resolveResourceOwnership, resolveResourceToken, resolveShareToken, resolveSharingAuthority, resolveTableName, revokeAccess, revokeOrgAccess, revokeOutside, revokePublicAccess, revokeSecureDelivery, revokeShareLink, revokeUserAccess, satisfiesPermissionLevel, sendSecureDelivery, sendShareNotice, setResourceShownTo, setSearchEngineIndexed, setStoreLane, shareClient, shareLinkSecurityStateMatches, shareLinkUnavailableReason, shareLinkUrl, shareUrlForLink, shareWithOutsidePerson, shareWithUser, sharingHost, sharingLocation, shownToBlendedFilter, shownToFilter, shownToMyOrgsFilter, summaryReachLabel, supabase, updatePermissionLevel, validatePermission, viewSecureDelivery };

package/dist/core.d.ts

@@ -1,7 +1,7 @@
 import * as _supabase_supabase_js from '@supabase/supabase-js';
 import { SupabaseClient } from '@supabase/supabase-js';
 import { DbPermissionLevel, PermissionLevel } from '@ai-matrx/data/access';
-export { DB_PERMISSION_LEVELS, DbPermissionLevel, PERMISSION_LEVELS, PERMISSION_LEVEL_HINTS, PERMISSION_LEVEL_LABELS, PERMISSION_LEVEL_SHORT_LABELS, PermissionLevel, isDbPermissionLevel, isPermissionLevel, toDbPermissionLevel } from '@ai-matrx/data/access';
+export { DB_PERMISSION_LEVELS, DbPermissionLevel, PERMISSION_LEVELS, PERMISSION_LEVEL_HINTS, PERMISSION_LEVEL_LABELS, PERMISSION_LEVEL_SHORT_LABELS, PermissionLevel, isDbPermissionLevel, isPermissionLevel, normalizePermissionLevel, parsePermissionLevel, toDbPermissionLevel } from '@ai-matrx/data/access';
 import { EntityTypeToken } from '@ai-matrx/associations';
 import * as _ai_matrx_api_account from '@ai-matrx/api/account';
 import { components } from '@ai-matrx/api/types';
@@ -3426,15 +3426,12 @@ declare function getResourceSharePath(resourceType: string, resourceId: string):
  * rank map, label map or ordered array omits a level.
  */
 
-/** Maps a stored/retired level onto the public ladder (a stray `edit_content` row reads as Edit). */
-declare function normalizePermissionLevel(raw: unknown): PermissionLevel | null;
 /** The levels a picker may offer: what the database stores, never the retired `edit_content`. */
 declare const OFFERED_DB_PERMISSION_LEVELS: readonly DbPermissionLevel[];
 /** Rank of every level; a stray stored `edit_content` ranks as Edit so old data never crashes. */
 declare const PERMISSION_LEVEL_RANK: Record<PermissionLevel, number> & {
     edit_content: number;
 };
-declare function parsePermissionLevel(raw: unknown, context: string): PermissionLevel | null;
 declare function permissionLevelRank(level: PermissionLevel): number;
 
 /**
@@ -3751,15 +3748,15 @@ interface CreateShareLinkOptions {
     maxUses?: number | null | undefined;
     label?: string | null | undefined;
 }
-/** Build the absolute share URL for a token. */
-declare function shareLinkUrl(token: string): string;
+/** Build the absolute share URL for a token (on `origin` when given). */
+declare function shareLinkUrl(token: string, origin?: string | undefined): string;
 /**
  * The URL to hand a person for a share link — the short alias when one exists
  * (auto-shorten-every-share-link, owner ruling 2026-08-29), the full /s/ URL
  * otherwise. The alias is a redirect only; the 64-hex share token stays the
  * one authorization either way.
  */
-declare function shareUrlForLink(link: Pick<ShareLink, "token" | "shortToken">): string;
+declare function shareUrlForLink(link: Pick<ShareLink, "token" | "shortToken">, origin?: string | undefined): string;
 /** Mint a share link for a resource (owner-only). Returns the token + URL. */
 declare function createShareLink(options: CreateShareLinkOptions): Promise<{
     success: boolean;
@@ -4065,7 +4062,7 @@ declare function resolveResourceOwnership(resourceType: ResourceType, resourceId
  * record store it could not even be ASKED, because `custom.record` carries no
  * client SELECT grant and the direct read above returns "Could not read Record".
  *
- * So this asks the database's own predicate (`public.may_manage_sharing`, lane
+ * So this asks the database's own predicate (`iam.may_manage_sharing`, lane
  * SHARE 2026-09-19), which is the same one the six sharing RPCs enforce. The
  * screen and the door cannot disagree, because there is one answer.
  *
@@ -4674,10 +4671,10 @@ declare function setSearchEngineIndexed(resourceType: string, resourceId: string
 
 type Database = any;
 
-type OrganizationMemberRow = Database["public"]["Functions"]["get_organization_members_with_users"]["Returns"][number];
+type OrganizationMemberRow = Database["iam"]["Functions"]["get_organization_members_with_users"]["Returns"][number];
 /** How long a settled roster is kept: for the tab (a change made here forgets it). */
 declare const MEMBER_ROWS_TTL_MS: number;
-type RosterClient = Pick<ReturnType<typeof createClient>, "rpc">;
+type RosterClient = Pick<ReturnType<typeof createClient>, "rpc" | "schema">;
 declare function readOrganizationMemberRows(orgId: string, { now, fresh, client, }?: {
     now?: number | undefined;
     /** An explicit refresh: skip a settled answer (an in-flight read is still joined). */
@@ -4737,4 +4734,4 @@ interface HrDepartmentOption {
 declare function listTeams(organizationId: string, includeArchived?: boolean): Promise<Team[]>;
 declare function listTeamMembers(teamId: string): Promise<TeamMember[]>;
 
-export { ACCESS_SUMMARY_ERROR_HEADLINE, type AccessContainer, type AccessDirectGrant, type AccessGranteeType, type AccessKpis, type AccessNotice, type AccessPanelView, type AccessReasonRow, type AccessSummary, type AccessSummaryView, type ApiCallResult, type AppDispatch, type ChannelReadiness, type CheckPermissionOptions, type ForkResult, GRANT_LIST_SCOPE_NOTE, type GranteeKind, type HrDepartmentOption, type LaneChoice, MEMBER_ROWS_TTL_MS, type MakePublicOptions, type MyPendingTableInvitation, NOTHING_ELSE_GRANTS, NO_GRANTS_DETAIL, NO_GRANTS_HEADLINE, NO_GRANTS_YET_HEADLINE, OFFERED_DB_PERMISSION_LEVELS, type OrCapable, type OrgAvailabilityOptions, type OrganizationMemberRow, type OutsideInviteAnswer, type OutsideShareDelivery, type OutsideShareInvitation, type OutsideShareLevel, type OutsideShareState, type OwnedResource, type OwnerCheckResult, type OwnershipResolution, PERMISSION_LEVEL_RANK, PUBLIC_LANE_COLUMNS, PUBLIC_LANE_TYPES, type Permission, type PermissionCheckResult, PermissionError, PermissionErrorCode, type PermissionWithDetails, type PublishLane, RESOURCE_TYPES, type ResolvedShareToken, type ResourceType, type ResourceVisibility, type RevokeAccessOptions, SHAREABLE_RESOURCE_REGISTRY, SHOWN_TO_ORDER, SHOWN_TO_WORDS, type SearchEngineIndexedState, type SecureDeliveryCreate, type SecureDeliveryOptions, type SecureDeliveryPage, type SecureDeliveryReceipt, SecureDeliveryRefusal, type SentSecureDelivery, type ShareActionResult, type ShareCapabilities, type ShareDbClient, type ShareLink, type ShareNoticeAnswer, type ShareServerCall, type ShareServerResult, type ShareTargetType, type ShareWithUserOptions, type ShareableResourceEntry, type SharingCopyContext, type SharingHost, type SharingState, type ShownTo, type ShownToContext, type TableSharePeek, type Team, type TeamMember, type TeamRole, type UpdatePermissionOptions, type WhoCanSee, absoluteInviteUrl, acceptOutsideShare, accessKpis, accessReasonRows, accessSummaryView, appUrl, applyShownTo, batchShareWithUsers, callApi, checkPermission, configureSharing, containerDetail, containerTitle, createClient, createSafeShareMessage, createShareLink, describeAccessSummary, describeShareLinkAccess, describeShareLinkExpiry, ensureOrgAvailability, ensureOrgId, evaluateShareLinkHandoff, fetchAccessSummary, fetchEntityTitles, fetchRecipientPhoneOnFile, fetchSecureDeliveryOptions, fetchShownToContext, forgetOrganizationMemberRows, forkSharedResource, getActiveOrgId, getClaimsUser, getPermissionLevelLabel, getPermissionLevelsAtOrAbove, getResourcePermissions, getResourceSharePath, getResourceTypeLabel, getResourceVisibility, getSearchEngineIndexedState, getShareCapabilities, getShareableResource, getSharedWithMe, grantCsvRow, grantCsvRows, grantLevelLabel, grantOrgAvailability, granteeKind, granteeLabel, granteeSecondaryLabel, hasPublicPage, humanAccessPanel, humanAccessSummary, humanGrantList, humanGrantRow, humanNotices, isForkable, isJsonObject, isKnownEntity, isPrivateSummary, isResourceOwner, listPermissions, listSentSecureDeliveries, listShareLinks, listTeamMembers, listTeams, makePrivate, makePublic, myPendingTableInvitations, normalizePermissionLevel, onlyOpenOrganizations, openSecureDelivery, organizationDisambiguators, parsePermissionLevel, passThroughDispatch, peekTableShare, permissionLevelRank, publicLaneSelect, publicResourceUrl, readOrganizationMemberRows, readOutsideShare, reasonCsvRows, recordNoun, requestSecureDeliveryCode, resendOutside, resolveEntityHref, resolveResourceOwnership, resolveResourceToken, resolveShareToken, resolveSharingAuthority, resolveTableName, revokeAccess, revokeOrgAccess, revokeOutside, revokePublicAccess, revokeSecureDelivery, revokeShareLink, revokeUserAccess, satisfiesPermissionLevel, sendSecureDelivery, sendShareNotice, setResourceShownTo, setSearchEngineIndexed, setStoreLane, shareClient, shareLinkSecurityStateMatches, shareLinkUnavailableReason, shareLinkUrl, shareUrlForLink, shareWithOutsidePerson, shareWithUser, sharingHost, sharingLocation, shownToBlendedFilter, shownToFilter, shownToMyOrgsFilter, summaryReachLabel, supabase, updatePermissionLevel, validatePermission, viewSecureDelivery };
+export { ACCESS_SUMMARY_ERROR_HEADLINE, type AccessContainer, type AccessDirectGrant, type AccessGranteeType, type AccessKpis, type AccessNotice, type AccessPanelView, type AccessReasonRow, type AccessSummary, type AccessSummaryView, type ApiCallResult, type AppDispatch, type ChannelReadiness, type CheckPermissionOptions, type ForkResult, GRANT_LIST_SCOPE_NOTE, type GranteeKind, type HrDepartmentOption, type LaneChoice, MEMBER_ROWS_TTL_MS, type MakePublicOptions, type MyPendingTableInvitation, NOTHING_ELSE_GRANTS, NO_GRANTS_DETAIL, NO_GRANTS_HEADLINE, NO_GRANTS_YET_HEADLINE, OFFERED_DB_PERMISSION_LEVELS, type OrCapable, type OrgAvailabilityOptions, type OrganizationMemberRow, type OutsideInviteAnswer, type OutsideShareDelivery, type OutsideShareInvitation, type OutsideShareLevel, type OutsideShareState, type OwnedResource, type OwnerCheckResult, type OwnershipResolution, PERMISSION_LEVEL_RANK, PUBLIC_LANE_COLUMNS, PUBLIC_LANE_TYPES, type Permission, type PermissionCheckResult, PermissionError, PermissionErrorCode, type PermissionWithDetails, type PublishLane, RESOURCE_TYPES, type ResolvedShareToken, type ResourceType, type ResourceVisibility, type RevokeAccessOptions, SHAREABLE_RESOURCE_REGISTRY, SHOWN_TO_ORDER, SHOWN_TO_WORDS, type SearchEngineIndexedState, type SecureDeliveryCreate, type SecureDeliveryOptions, type SecureDeliveryPage, type SecureDeliveryReceipt, SecureDeliveryRefusal, type SentSecureDelivery, type ShareActionResult, type ShareCapabilities, type ShareDbClient, type ShareLink, type ShareNoticeAnswer, type ShareServerCall, type ShareServerResult, type ShareTargetType, type ShareWithUserOptions, type ShareableResourceEntry, type SharingCopyContext, type SharingHost, type SharingState, type ShownTo, type ShownToContext, type TableSharePeek, type Team, type TeamMember, type TeamRole, type UpdatePermissionOptions, type WhoCanSee, absoluteInviteUrl, acceptOutsideShare, accessKpis, accessReasonRows, accessSummaryView, appUrl, applyShownTo, batchShareWithUsers, callApi, checkPermission, configureSharing, containerDetail, containerTitle, createClient, createSafeShareMessage, createShareLink, describeAccessSummary, describeShareLinkAccess, describeShareLinkExpiry, ensureOrgAvailability, ensureOrgId, evaluateShareLinkHandoff, fetchAccessSummary, fetchEntityTitles, fetchRecipientPhoneOnFile, fetchSecureDeliveryOptions, fetchShownToContext, forgetOrganizationMemberRows, forkSharedResource, getActiveOrgId, getClaimsUser, getPermissionLevelLabel, getPermissionLevelsAtOrAbove, getResourcePermissions, getResourceSharePath, getResourceTypeLabel, getResourceVisibility, getSearchEngineIndexedState, getShareCapabilities, getShareableResource, getSharedWithMe, grantCsvRow, grantCsvRows, grantLevelLabel, grantOrgAvailability, granteeKind, granteeLabel, granteeSecondaryLabel, hasPublicPage, humanAccessPanel, humanAccessSummary, humanGrantList, humanGrantRow, humanNotices, isForkable, isJsonObject, isKnownEntity, isPrivateSummary, isResourceOwner, listPermissions, listSentSecureDeliveries, listShareLinks, listTeamMembers, listTeams, makePrivate, makePublic, myPendingTableInvitations, onlyOpenOrganizations, openSecureDelivery, organizationDisambiguators, passThroughDispatch, peekTableShare, permissionLevelRank, publicLaneSelect, publicResourceUrl, readOrganizationMemberRows, readOutsideShare, reasonCsvRows, recordNoun, requestSecureDeliveryCode, resendOutside, resolveEntityHref, resolveResourceOwnership, resolveResourceToken, resolveShareToken, resolveSharingAuthority, resolveTableName, revokeAccess, revokeOrgAccess, revokeOutside, revokePublicAccess, revokeSecureDelivery, revokeShareLink, revokeUserAccess, satisfiesPermissionLevel, sendSecureDelivery, sendShareNotice, setResourceShownTo, setSearchEngineIndexed, setStoreLane, shareClient, shareLinkSecurityStateMatches, shareLinkUnavailableReason, shareLinkUrl, shareUrlForLink, shareWithOutsidePerson, shareWithUser, sharingHost, sharingLocation, shownToBlendedFilter, shownToFilter, shownToMyOrgsFilter, summaryReachLabel, supabase, updatePermissionLevel, validatePermission, viewSecureDelivery };

package/dist/core.js

@@ -3376,10 +3376,10 @@ function getResourceSharePath(resourceType, resourceId) {
 }
 
 // src/core/levels.ts
-import { isPermissionLevel, DB_PERMISSION_LEVELS, PERMISSION_LEVEL_RANK as PACKAGE_RANK, PERMISSION_LEVELS } from "@ai-matrx/data/access";
+import { DB_PERMISSION_LEVELS, PERMISSION_LEVEL_RANK as PACKAGE_RANK } from "@ai-matrx/data/access";
 import {
-  PERMISSION_LEVELS as PERMISSION_LEVELS2,
-  isPermissionLevel as isPermissionLevel2,
+  PERMISSION_LEVELS,
+  isPermissionLevel,
   PERMISSION_LEVEL_LABELS,
   PERMISSION_LEVEL_HINTS,
   PERMISSION_LEVEL_SHORT_LABELS,
@@ -3387,28 +3387,16 @@ import {
   isDbPermissionLevel,
   toDbPermissionLevel
 } from "@ai-matrx/data/access";
-function normalizePermissionLevel(raw) {
-  if (raw === "edit_content") return "editor";
-  return isPermissionLevel(raw) ? raw : null;
-}
+import { normalizePermissionLevel, parsePermissionLevel } from "@ai-matrx/data/access";
 var OFFERED_DB_PERMISSION_LEVELS = DB_PERMISSION_LEVELS;
 var PERMISSION_LEVEL_RANK = {
   ...PACKAGE_RANK,
   edit_content: PACKAGE_RANK.editor
 };
-function parsePermissionLevel(raw, context) {
-  const level = normalizePermissionLevel(raw);
-  if (level) return level;
-  if (raw === null || raw === void 0) return null;
-  console.error(
-    `[permissions] ${context}: unrecognised permission level ${JSON.stringify(raw)}. Known levels are ${PERMISSION_LEVELS.join(", ")}. Add it to PERMISSION_LEVELS in utils/permissions/levels.ts (the package ladder is re-exported there) if the database gained a new value.`
-  );
-  return null;
-}
 function permissionLevelRank(level) {
   const rank = PERMISSION_LEVEL_RANK[level];
   if (rank === void 0) {
-    console.error(`[permissions] no rank for permission level ${JSON.stringify(level)}. Add it to PERMISSION_LEVELS in utils/permissions/levels.ts.`);
+    console.error(`[permissions] no rank for permission level ${JSON.stringify(level)}. Add it to PERMISSION_LEVELS in @ai-matrx/data/access (permissionLevels.ts).`);
     return Number.NaN;
   }
   return rank;
@@ -3419,8 +3407,8 @@ function satisfiesPermissionLevel(current, required) {
   return permissionLevelRank(current) >= permissionLevelRank(required);
 }
 function getPermissionLevelsAtOrAbove(level) {
-  const levelIndex = PERMISSION_LEVELS2.indexOf(level);
-  return [...PERMISSION_LEVELS2].slice(levelIndex);
+  const levelIndex = PERMISSION_LEVELS.indexOf(level);
+  return [...PERMISSION_LEVELS].slice(levelIndex);
 }
 function getPermissionLevelLabel(level) {
   return PERMISSION_LEVEL_LABELS[level] ?? `Unknown level (${level})`;
@@ -3536,13 +3524,16 @@ async function getShareCapabilities(resourceType) {
     rowChildColumn: typeof data.row_child_column === "string" ? data.row_child_column : null
   };
 }
-function shareLinkUrl(token) {
-  const base = process.env.NEXT_PUBLIC_APP_URL || (typeof window !== "undefined" ? window.location.origin : "");
-  return `${base}/s/${token}`;
+function shareBase(origin) {
+  const base = origin || process.env.NEXT_PUBLIC_APP_URL || (typeof window !== "undefined" ? window.location.origin : "");
+  return base.replace(/\/+$/, "");
 }
-function shareUrlForLink(link) {
-  const base = process.env.NEXT_PUBLIC_APP_URL || (typeof window !== "undefined" ? window.location.origin : "");
-  return link.shortToken ? shortLinkUrl(base, link.shortToken) : shareLinkUrl(link.token);
+function shareLinkUrl(token, origin) {
+  return `${shareBase(origin)}/s/${token}`;
+}
+function shareUrlForLink(link, origin) {
+  const base = shareBase(origin);
+  return link.shortToken ? shortLinkUrl(base, link.shortToken) : shareLinkUrl(link.token, base);
 }
 async function createShareLink(options) {
   try {
@@ -3613,7 +3604,7 @@ async function forkSharedResource(resourceType, resourceId, shareToken, organiza
   try {
     const orgId = await ensureOrgId(organizationId);
     if (resourceType === "conversation") {
-      const { data, error } = await supabase.rpc("fork_shared_conversation", {
+      const { data, error } = await supabase.schema("chat").rpc("fork_shared_conversation", {
         p_conversation_id: resourceId,
         p_organization_id: orgId,
         p_token: shareToken ?? void 0
@@ -3623,7 +3614,7 @@ async function forkSharedResource(resourceType, resourceId, shareToken, organiza
       return r?.success ? { success: true, path: `/chat/${r.conversation_id}` } : { success: false, error: r?.error };
     }
     if (resourceType === "fc_set") {
-      const { data, error } = await supabase.rpc("fork_shared_flashcard_set", {
+      const { data, error } = await supabase.schema("education").rpc("fork_shared_flashcard_set", {
         p_set_id: resourceId,
         p_organization_id: orgId,
         p_token: shareToken ?? void 0
@@ -3633,7 +3624,7 @@ async function forkSharedResource(resourceType, resourceId, shareToken, organiza
       return r?.success ? { success: true, path: `/education/flashcards/${r.set_id}` } : { success: false, error: r?.error };
     }
     if (resourceType === "quiz_session") {
-      const { data, error } = await supabase.rpc("fork_shared_quiz", {
+      const { data, error } = await supabase.schema("education").rpc("fork_shared_quiz", {
         p_quiz_id: resourceId,
         p_organization_id: orgId,
         p_token: shareToken ?? void 0
@@ -3654,7 +3645,7 @@ function isForkable(resourceType) {
   return resourceType === "conversation" || resourceType === "fc_set" || resourceType === "quiz_session";
 }
 async function resolveShareToken(token, client = supabase) {
-  const { data, error } = await client.rpc("resolve_share_token", {
+  const { data, error } = await client.schema("iam").rpc("resolve_share_token", {
     p_token: token
   });
   if (error) {
@@ -3738,7 +3729,7 @@ async function writeRowControl(resourceType, resourceId, patch) {
   return { success: true };
 }
 async function writeStoreRowControls(resourceType, resourceId, controls) {
-  const { data: lane, error: laneError } = await supabase.rpc("store_door_lane", {
+  const { data: lane, error: laneError } = await supabase.schema("workbench").rpc("store_door_lane", {
     p_resource_type: resourceType,
     p_resource_id: resourceId
   });
@@ -3772,7 +3763,7 @@ async function getResourceVisibility(resourceType, resourceId) {
     );
   }
   if (entry.schemaName === "custom") {
-    const { data: data2, error: error2 } = await supabase.rpc("store_door_lane", {
+    const { data: data2, error: error2 } = await supabase.schema("workbench").rpc("store_door_lane", {
       p_resource_type: resourceType,
       p_resource_id: resourceId
     });
@@ -3891,7 +3882,7 @@ async function shareWithUser(options) {
       permissionLevel,
       organizationId
     } = options;
-    const { data, error } = await supabase.rpc("share_resource_with_user", {
+    const { data, error } = await supabase.schema("iam").rpc("share_resource_with_user", {
       p_resource_type: resourceType,
       p_resource_id: resourceId,
       p_target_user_id: userId,
@@ -3942,7 +3933,7 @@ async function shareWithUser(options) {
 async function grantOrgAvailability(options) {
   try {
     const { resourceType, resourceId, organizationId, permissionLevel } = options;
-    const { data, error } = await supabase.rpc("grant_org_availability", {
+    const { data, error } = await supabase.schema("iam").rpc("grant_org_availability", {
       p_resource_type: resourceType,
       p_resource_id: resourceId,
       p_target_org_id: organizationId,
@@ -4004,7 +3995,7 @@ async function makePrivate(resourceType, resourceId) {
 }
 async function revokeUserAccess(resourceType, resourceId, userId) {
   try {
-    const { data, error } = await supabase.rpc("revoke_resource_access", {
+    const { data, error } = await supabase.schema("iam").rpc("revoke_resource_access", {
       p_resource_type: resourceType,
       p_resource_id: resourceId,
       p_target_user_id: userId
@@ -4027,7 +4018,7 @@ async function revokeUserAccess(resourceType, resourceId, userId) {
 }
 async function revokeOrgAccess(resourceType, resourceId, organizationId) {
   try {
-    const { data, error } = await supabase.rpc("revoke_resource_org_access", {
+    const { data, error } = await supabase.schema("iam").rpc("revoke_resource_org_access", {
       p_resource_type: resourceType,
       p_resource_id: resourceId,
       p_target_org_id: organizationId
@@ -4068,7 +4059,7 @@ async function updatePermissionLevel(options) {
     if (!userId && !organizationId) {
       return { success: false, error: "Must specify userId or organizationId" };
     }
-    const { data, error } = await supabase.rpc("update_permission_level", {
+    const { data, error } = await supabase.schema("iam").rpc("update_permission_level", {
       p_resource_type: resourceType,
       p_resource_id: resourceId,
       p_target_user_id: userId,
@@ -4096,7 +4087,7 @@ async function updatePermissionLevel(options) {
 }
 async function listPermissions(resourceType, resourceId) {
   try {
-    const { data, error } = await supabase.rpc("get_resource_permissions", {
+    const { data, error } = await supabase.schema("iam").rpc("get_resource_permissions", {
       p_resource_type: resourceType,
       p_resource_id: resourceId
     });
@@ -4175,7 +4166,7 @@ async function resolveSharingAuthority(resourceType, resourceId) {
     };
   }
   try {
-    const { data, error } = await supabase.rpc("may_manage_sharing", {
+    const { data, error } = await supabase.schema("iam").rpc("may_manage_sharing", {
       p_resource_type: resourceType,
       p_resource_id: resourceId
     });
@@ -4470,7 +4461,7 @@ async function fetchEntityTitles(entityType, ids) {
   const unique = Array.from(new Set(ids.filter(Boolean)));
   if (unique.length === 0) return out;
   const supabase2 = createClient();
-  const { data, error } = await supabase2.rpc("entity_titles", {
+  const { data, error } = await supabase2.schema("platform").rpc("entity_titles", {
     p_type: entityType,
     p_ids: unique
   });
@@ -4989,7 +4980,7 @@ async function revokeOutside(organizationId, invitationId) {
   return data;
 }
 async function peekTableShare(token) {
-  const { data, error } = await createClient().rpc("table_share_peek", { p_token: token });
+  const { data, error } = await createClient().schema("iam").rpc("table_share_peek", { p_token: token });
   if (error) throw new Error(error.message);
   return data;
 }
@@ -5145,7 +5136,7 @@ function readOrganizationMemberRows2(orgId, {
   const db = client ?? createClient();
   const entry = { at: now, settled: false, rows: Promise.resolve([]) };
   const rows = (async () => {
-    const { data, error } = await db.rpc("get_organization_members_with_users", {
+    const { data, error } = await db.schema("iam").rpc("get_organization_members_with_users", {
       p_org_id: orgId
     });
     if (error) throw pgErrorToError(error);
@@ -5192,7 +5183,7 @@ function toRole(value) {
   return value === "admin" || value === "member" ? value : null;
 }
 async function listTeams(organizationId, includeArchived = false) {
-  const { data, error } = await shareClient().rpc("team_list", { p_organization_id: organizationId, p_include_archived: includeArchived });
+  const { data, error } = await shareClient().schema("iam").rpc("team_list", { p_organization_id: organizationId, p_include_archived: includeArchived });
   if (error) throw pgErrorToError2(error);
   return (data ?? []).map((row) => ({
     id: String(row.id),
@@ -5208,7 +5199,7 @@ async function listTeams(organizationId, includeArchived = false) {
   }));
 }
 async function listTeamMembers(teamId) {
-  const { data, error } = await shareClient().rpc("team_members", { p_team_id: teamId });
+  const { data, error } = await shareClient().schema("iam").rpc("team_members", { p_team_id: teamId });
   if (error) throw pgErrorToError2(error);
   return (data ?? []).map((row) => ({
     userId: String(row.user_id),
@@ -5231,7 +5222,7 @@ export {
   NO_GRANTS_HEADLINE,
   NO_GRANTS_YET_HEADLINE,
   OFFERED_DB_PERMISSION_LEVELS,
-  PERMISSION_LEVELS2 as PERMISSION_LEVELS,
+  PERMISSION_LEVELS,
   PERMISSION_LEVEL_HINTS,
   PERMISSION_LEVEL_LABELS,
   PERMISSION_LEVEL_RANK,
@@ -5304,7 +5295,7 @@ export {
   isForkable,
   isJsonObject,
   isKnownEntity,
-  isPermissionLevel2 as isPermissionLevel,
+  isPermissionLevel,
   isPrivateSummary,
   isResourceOwner,
   listPermissions,