@elevasis/core 0.28.0 → 0.30.0

package/src/reference/glossary.md

@@ -7,7 +7,9 @@ description: Terminology disambiguation for Organization OS concepts used in the
 
 ## Terms
 
-**AdminGuard** -- route-level admin wrapper from `@elevasis/ui/features/auth`. Must nest inside `ProtectedRoute`.
+**AccessGuard** -- route-level and section-level access wrapper from `@elevasis/ui/auth`. It consumes the unified Access Model and gates on an `accessKey`.
+
+**AccessKeys** -- exported access-key constants from `@elevasis/core/auth` / `@repo/core/auth` for platform-admin, diagnostic, and permission-backed gates.
 
 **Contract** -- the publishable boundary a consumer depends on: Zod schemas, TypeScript types, provider props, resource definitions, or workflow I/O schemas.
 
@@ -15,7 +17,7 @@ description: Terminology disambiguation for Organization OS concepts used in the
 
 **Feature** -- legacy or UI-package wording for a platform capability area. In the current Organization Model, use **System** for semantic ownership and **navigation surface** for shell placement. Keep "feature" only when referring to existing UI package folders, exported manifest names, or legacy compatibility recipes.
 
-**SystemGuard** -- route-level System gate from `@elevasis/ui/features/auth`.
+**SystemGuard** -- retired route-level System gate. Use **AccessGuard** with a System path or `AccessKeys` constant.
 
 **SystemModule** -- manifest contract a shell module provides to `ElevasisSystemsProvider`. Key fields are `key`, optional `systemId`, optional `routePrefixes`, optional `capabilityIds`, optional `icon`, optional `sidebar`, and optional `sidebarWidth`. Graph bridge metadata is compatibility-only; new semantic bindings belong in the Organization Model System, ontology, navigation, and Resource descriptors.
 
@@ -29,13 +31,13 @@ description: Terminology disambiguation for Organization OS concepts used in the
 
 **Manifest** -- a runtime declaration for a feature or resource collection.
 
-**MembershipFeatureConfig** -- legacy per-member feature override config. Current System visibility should be authored through Organization Model System lifecycle/access metadata and resolved through provider compatibility layers for older consumers.
+**MembershipFeatureConfig** -- retired per-member feature override config. The migration is complete: access is resolved through the unified Access Model using Organization Model System lifecycle, role permissions, diagnostic allowlists, membership scope, and platform-admin bypass.
 
 **OrganizationModel** -- top-level semantic contract for an organization. Current primary fields include `version`, `domainMetadata`, `branding`, `navigation`, `ontology`, `systems`, `resources`, `topology`, `identity`, `customers`, `offerings`, `roles`, `goals`, `policies`, `statuses`, and `knowledge`. Legacy domain keys such as `sales`, `prospecting`, `projects`, `actions`, and `entities` remain compatibility inputs while projects migrate to System-owned ontology/config/resource contracts.
 
 **OrganizationModelSystemEntry** -- System node in `OrganizationModel.systems`. Primary authoring fields include `id`, `label`, `description`, `parentSystemId`, `systems`, `lifecycle`, `ui`, `requiresAdmin`, `devOnly`, `responsibleRoleId`, `governedByKnowledge`, `drivesGoals`, `actions`, `policies`, `ontology`, `config`, and `order`. `subsystems` and `content` are retained compatibility inputs for older projects and should not be used for new recursive Systems, schemas, catalogs, or config.
 
-**Provider / ElevasisSystemsProvider** -- runtime that registers System modules, resolves System access against the org model, projects sidebar navigation, and exposes shell helpers through `useElevasisSystems()`.
+**Provider / ElevasisSystemsProvider** -- runtime that registers System modules, resolves System lifecycle against the org model, projects sidebar navigation, and exposes shell helpers through `useElevasisSystems()`.
 
 **Resource** -- governance-only descriptor in `OrganizationModel.resources` for a workflow, agent, integration, or script. Runtime code derives `resourceId` and kind from the descriptor, then attaches executable behavior in operations.
 
@@ -62,13 +64,13 @@ description: Terminology disambiguation for Organization OS concepts used in the
 - `OrganizationModel`, `OrganizationModelSystemEntry`
 - `SystemEntry`, `ResourceEntry`
 - `resolveOrganizationModel`, `defineOrganizationModel`, `DEFAULT_ORGANIZATION_MODEL`
-- `MembershipFeatureConfig`
+- `AccessKeys`, `checkAccess`, `createAccessModel`
 - `DeploymentSpec`, `ResourceLink`, `ResourceCategory`
 
 **`@elevasis/ui`**
 
 - `SystemModule`
-- `SystemGuard`, `AdminGuard`, `ProtectedRoute`
+- `AccessGuard`, `ProtectedRoute`
 - `ElevasisSystemsProvider`, `ElevasisCoreProvider`, `useElevasisSystems`
 
 **External project source**

package/src/supabase/database.types.ts

@@ -2787,6 +2787,7 @@ export type Database = {
           title: string | null
           updated_at: string
           user_id: string
+          visibility: string
         }
         Insert: {
           content: string
@@ -2801,6 +2802,7 @@ export type Database = {
           title?: string | null
           updated_at?: string
           user_id: string
+          visibility?: string
         }
         Update: {
           content?: string
@@ -2815,6 +2817,7 @@ export type Database = {
           title?: string | null
           updated_at?: string
           user_id?: string
+          visibility?: string
         }
         Relationships: [
           {
@@ -2962,6 +2965,10 @@ export type Database = {
         Returns: boolean
       }
       current_user_is_platform_admin: { Args: never; Returns: boolean }
+      current_user_shares_org_with: {
+        Args: { other_user_id: string }
+        Returns: boolean
+      }
       current_user_supabase_id: { Args: never; Returns: string }
       detect_stalled_executions: { Args: never; Returns: undefined }
       execute_session_turn: {
@@ -2982,6 +2989,12 @@ export type Database = {
       get_platform_credential_kek: { Args: never; Returns: string }
       get_storage_org_id: { Args: { file_path: string }; Returns: string }
       get_workos_user_id: { Args: never; Returns: string }
+      has_org_access:
+        | {
+            Args: { action?: string; org_id: string; system_path: string }
+            Returns: boolean
+          }
+        | { Args: { action?: string; system_path: string }; Returns: boolean }
       has_org_permission: {
         Args: { org_id: string; perm_key: string }
         Returns: boolean