@elevasis/ui 2.73.0 → 2.74.0

package/dist/layout/index.js

@@ -1,18 +1,17 @@
-export { AppShellContainer, AppShellContentContainer, AppShellRightSideContainer, AppShellRightSideOuterContainer, AppTopbarAdjusterWrapper, CollapsibleSidebarGroup, CyberParticles, LinksGroup, Sidebar, SidebarContext, SidebarProvider, SubshellNavList, Topbar, TopbarActions, TopbarContainer, Vignette, subsidebarWidth, useSidebar, useSidebarCollapse } from '../chunk-CJ2232PQ.js';
-export { SubshellLoader } from '../chunk-Z4ICFQXG.js';
-export { AppShellCenteredContainer, AppShellError, AppShellLoader } from '../chunk-3TS5U5BL.js';
+export { AppShellContainer, AppShellContentContainer, AppShellRightSideContainer, AppShellRightSideOuterContainer, AppTopbarAdjusterWrapper, CollapsibleSidebarGroup, CyberParticles, LinksGroup, Sidebar, SidebarContext, SidebarProvider, SubshellNavList, Topbar, TopbarActions, TopbarContainer, Vignette, subsidebarWidth, useSidebar, useSidebarCollapse } from '../chunk-GO4XJ5D4.js';
+export { SubshellLoader } from '../chunk-BA3AZJUR.js';
+export { AppShellCenteredContainer, AppShellError, AppShellLoader } from '../chunk-E6YGA5WH.js';
 export { PageContainer } from '../chunk-BZZCNLT6.js';
-export { SubshellContainer, SubshellContentContainer, SubshellRightSideContainer, SubshellSidebar, SubshellSidebarLoader } from '../chunk-OCVSPAKM.js';
+export { SubshellContainer, SubshellContentContainer, SubshellRightSideContainer, SubshellSidebar, SubshellSidebarLoader } from '../chunk-6JN2TLV2.js';
 import '../chunk-R6NMRXNO.js';
 export { AmbientBloomGrid, AppBackground, CyberBackground, FilmGrain, FloatingMotes, FloatingOrbs, PerspectiveGrid, RadiantGlow, WaveBackground } from '../chunk-RBGVNPA6.js';
-import '../chunk-MKH2KOAO.js';
-import '../chunk-NHNTX6ZL.js';
+import '../chunk-O32UQ26A.js';
 import '../chunk-L7BZZ4SI.js';
-import '../chunk-U2H3TIHD.js';
+import '../chunk-HYQOGRWG.js';
 export { SubshellNavItem, SubshellSidebarSection, sidebarBottomSectionCollapsedHeight, sidebarBottomSectionHeight, sidebarCollapsedWidth, sidebarGroupChevronSize, sidebarHoverDelay, sidebarIconInnerSize, sidebarIconSize, sidebarIconStroke, sidebarItemGap, sidebarItemHeight, sidebarItemPadding, sidebarSectionPadding, sidebarSubLinkIndent, sidebarSubLinkPaddingX, sidebarSubLinkPaddingY, sidebarToggleIconSize, sidebarTransitionDuration, sidebarWidth, subshellNavItemIconSize, topbarHeight } from '../chunk-MISHPEJX.js';
 import '../chunk-62GVNH5U.js';
 import '../chunk-P45GQ3ZW.js';
-import '../chunk-M7WWRZ5Z.js';
+import '../chunk-2GIJBHZT.js';
 import '../chunk-3KMDHCAR.js';
 import '../chunk-2IFYDILW.js';
 import '../chunk-BLXJEIQS.js';
@@ -20,7 +19,7 @@ import '../chunk-UD657ICS.js';
 import '../chunk-DD3CCMCZ.js';
 import '../chunk-RNP5R5I3.js';
 import '../chunk-RT4KRGZT.js';
-import '../chunk-IBCEAVB2.js';
+import '../chunk-R5UGIFYU.js';
 import '../chunk-Y6I3IC45.js';
 import '../chunk-6SSQGWK7.js';
 import '../chunk-BI5VDO2K.js';

package/dist/profile/index.d.ts

@@ -1455,6 +1455,64 @@ type Database = {
                     }
                 ];
             };
+            content_distribution_metrics: {
+                Row: {
+                    captured_at: string;
+                    created_at: string;
+                    distribution_id: string;
+                    id: string;
+                    metrics: Json;
+                    organization_id: string;
+                    raw: Json;
+                    source: string;
+                    source_execution_id: string | null;
+                };
+                Insert: {
+                    captured_at?: string;
+                    created_at?: string;
+                    distribution_id: string;
+                    id?: string;
+                    metrics?: Json;
+                    organization_id: string;
+                    raw?: Json;
+                    source: string;
+                    source_execution_id?: string | null;
+                };
+                Update: {
+                    captured_at?: string;
+                    created_at?: string;
+                    distribution_id?: string;
+                    id?: string;
+                    metrics?: Json;
+                    organization_id?: string;
+                    raw?: Json;
+                    source?: string;
+                    source_execution_id?: string | null;
+                };
+                Relationships: [
+                    {
+                        foreignKeyName: "content_distribution_metrics_distribution_fkey";
+                        columns: ["distribution_id", "organization_id"];
+                        isOneToOne: false;
+                        referencedRelation: "content_distributions";
+                        referencedColumns: ["id", "organization_id"];
+                    },
+                    {
+                        foreignKeyName: "content_distribution_metrics_organization_id_fkey";
+                        columns: ["organization_id"];
+                        isOneToOne: false;
+                        referencedRelation: "organizations";
+                        referencedColumns: ["id"];
+                    },
+                    {
+                        foreignKeyName: "content_distribution_metrics_source_execution_id_fkey";
+                        columns: ["source_execution_id"];
+                        isOneToOne: false;
+                        referencedRelation: "execution_logs";
+                        referencedColumns: ["execution_id"];
+                    }
+                ];
+            };
             content_distributions: {
                 Row: {
                     adapted_body: string | null;

package/dist/provider/index.d.ts

@@ -1557,6 +1557,64 @@ type Database = {
                     }
                 ];
             };
+            content_distribution_metrics: {
+                Row: {
+                    captured_at: string;
+                    created_at: string;
+                    distribution_id: string;
+                    id: string;
+                    metrics: Json;
+                    organization_id: string;
+                    raw: Json;
+                    source: string;
+                    source_execution_id: string | null;
+                };
+                Insert: {
+                    captured_at?: string;
+                    created_at?: string;
+                    distribution_id: string;
+                    id?: string;
+                    metrics?: Json;
+                    organization_id: string;
+                    raw?: Json;
+                    source: string;
+                    source_execution_id?: string | null;
+                };
+                Update: {
+                    captured_at?: string;
+                    created_at?: string;
+                    distribution_id?: string;
+                    id?: string;
+                    metrics?: Json;
+                    organization_id?: string;
+                    raw?: Json;
+                    source?: string;
+                    source_execution_id?: string | null;
+                };
+                Relationships: [
+                    {
+                        foreignKeyName: "content_distribution_metrics_distribution_fkey";
+                        columns: ["distribution_id", "organization_id"];
+                        isOneToOne: false;
+                        referencedRelation: "content_distributions";
+                        referencedColumns: ["id", "organization_id"];
+                    },
+                    {
+                        foreignKeyName: "content_distribution_metrics_organization_id_fkey";
+                        columns: ["organization_id"];
+                        isOneToOne: false;
+                        referencedRelation: "organizations";
+                        referencedColumns: ["id"];
+                    },
+                    {
+                        foreignKeyName: "content_distribution_metrics_source_execution_id_fkey";
+                        columns: ["source_execution_id"];
+                        isOneToOne: false;
+                        referencedRelation: "execution_logs";
+                        referencedColumns: ["execution_id"];
+                    }
+                ];
+            };
             content_distributions: {
                 Row: {
                     adapted_body: string | null;
@@ -5681,6 +5739,24 @@ declare function useElevasisSystems(): ElevasisSystemsContextValue;
 declare function useOptionalElevasisSystems(): ElevasisSystemsContextValue | null;
 declare function ElevasisSystemsProvider({ systems, topbarActions, organizationModel, timeRange, operationsApiUrl, operationsSSEManager, deliveryApiUrl, deliverySSEManager, disabledSubsectionPaths, children }: ElevasisSystemsProviderProps): react_jsx_runtime.JSX.Element;
 
+/**
+ * Filters a static candidate manifest list down to the ones whose System is
+ * both **declared** in the organization model and **visible** by lifecycle
+ * (`isSystemLifecycleVisible` -- the Wave 1 shared predicate; `lifecycle:
+ * 'draft'` is not visible, and an omitted lifecycle parses as `'active'`).
+ *
+ * This is a FILTER, not a generator. Tenants keep their hand-written
+ * `SYSTEM_MANIFESTS` array (real imports, so bundling and tree-shaking stay
+ * honest) and route the result through this function before handing it to
+ * `ElevasisSystemsProvider` / `ElevasisAuthenticatedShell`.
+ *
+ * A manifest with no `systemId` is a navigation-only surface (see
+ * `SystemModule.systemId`'s own doc: "Omit for navigation-only app
+ * surfaces") -- there is nothing to check it against, so it always passes
+ * through unfiltered.
+ */
+declare function selectDeclaredSystems<T extends SystemModule>(candidates: readonly T[], organizationModel: ElevasisOrganizationModel | undefined): T[];
+
 declare function SystemShell({ children }: {
     children: ReactNode;
 }): react_jsx_runtime.JSX.Element;
@@ -5759,5 +5835,5 @@ declare function createTestSystemsProvider({ organizationModel, systems }?: Crea
     children: ReactNode;
 }) => react_jsx_runtime.JSX.Element;
 
-export { AppearanceProvider, CrmActionsProvider, ElevasisCoreProvider, ElevasisServiceProvider, ElevasisSystemsProvider, ElevasisUIProvider, ListActionsProvider, NotificationProvider, SystemShell, createTestSystemsProvider, useAppearance, useCrmActions, useElevasisServices, useElevasisSystems, useListActions, useNotificationAdapter, useOptionalElevasisSystems, useResolvedOrganizationModel };
+export { AppearanceProvider, CrmActionsProvider, ElevasisCoreProvider, ElevasisServiceProvider, ElevasisSystemsProvider, ElevasisUIProvider, ListActionsProvider, NotificationProvider, SystemShell, createTestSystemsProvider, selectDeclaredSystems, useAppearance, useCrmActions, useElevasisServices, useElevasisSystems, useListActions, useNotificationAdapter, useOptionalElevasisSystems, useResolvedOrganizationModel };
 export type { ApiKeyConfig, AppearanceConfig, AuthConfig, AuthKitConfig, CreateTestSystemsProviderOptions, ElevasisCoreProviderProps, ElevasisCoreThemeConfig, ElevasisServiceContextValue, ElevasisServiceProviderProps, ElevasisSystemsContextValue, ElevasisSystemsProviderProps, ElevasisThemeConfig, ElevasisTokenOverrides, LeadGenStageKey, ListBuilderRegistry, ListBuilderWorkflow, ListBuilderWorkflowCategory, NotificationAdapter, OrganizationGraphContextValue, OrganizationGraphSystemBridge, PresetName, ResolvedShellModel, ResolvedShellRouteMatch, ResolvedShellSystem, ResolvedSystemAccess, ResolvedSystemModule, ResolvedSystemSemantics, ShellRouteMatchStatus, ShellRuntime, ShellSidebarLinkGroup, ShellSidebarLinkItem, ShellSidebarProjectionOptions, SystemIconComponent, SystemModule, SystemSidebarComponent, WithSchemes };

package/dist/provider/index.js

@@ -1,14 +1,13 @@
-export { AppearanceProvider, CrmActionsProvider, ElevasisCoreProvider, ElevasisSystemsProvider, ElevasisUIProvider, ListActionsProvider, NotificationProvider, SystemShell, createTestSystemsProvider, useAppearance, useCrmActions, useElevasisSystems, useListActions, useNotificationAdapter, useOptionalElevasisSystems, useResolvedOrganizationModel } from '../chunk-OCVSPAKM.js';
+export { AppearanceProvider, CrmActionsProvider, ElevasisCoreProvider, ElevasisSystemsProvider, ElevasisUIProvider, ListActionsProvider, NotificationProvider, SystemShell, createTestSystemsProvider, selectDeclaredSystems, useAppearance, useCrmActions, useElevasisSystems, useListActions, useNotificationAdapter, useOptionalElevasisSystems, useResolvedOrganizationModel } from '../chunk-6JN2TLV2.js';
 import '../chunk-R6NMRXNO.js';
 import '../chunk-RBGVNPA6.js';
-import '../chunk-MKH2KOAO.js';
-import '../chunk-NHNTX6ZL.js';
+import '../chunk-O32UQ26A.js';
 import '../chunk-L7BZZ4SI.js';
-import '../chunk-U2H3TIHD.js';
+import '../chunk-HYQOGRWG.js';
 import '../chunk-MISHPEJX.js';
 import '../chunk-62GVNH5U.js';
 import '../chunk-P45GQ3ZW.js';
-import '../chunk-M7WWRZ5Z.js';
+import '../chunk-2GIJBHZT.js';
 import '../chunk-3KMDHCAR.js';
 import '../chunk-2IFYDILW.js';
 import '../chunk-BLXJEIQS.js';
@@ -16,7 +15,7 @@ import '../chunk-UD657ICS.js';
 import '../chunk-DD3CCMCZ.js';
 import '../chunk-RNP5R5I3.js';
 import '../chunk-RT4KRGZT.js';
-import '../chunk-IBCEAVB2.js';
+import '../chunk-R5UGIFYU.js';
 import '../chunk-Y6I3IC45.js';
 import '../chunk-6SSQGWK7.js';
 export { ElevasisServiceProvider, useElevasisServices } from '../chunk-BI5VDO2K.js';

package/dist/provider/published.d.ts

@@ -1556,6 +1556,64 @@ type Database = {
                     }
                 ];
             };
+            content_distribution_metrics: {
+                Row: {
+                    captured_at: string;
+                    created_at: string;
+                    distribution_id: string;
+                    id: string;
+                    metrics: Json;
+                    organization_id: string;
+                    raw: Json;
+                    source: string;
+                    source_execution_id: string | null;
+                };
+                Insert: {
+                    captured_at?: string;
+                    created_at?: string;
+                    distribution_id: string;
+                    id?: string;
+                    metrics?: Json;
+                    organization_id: string;
+                    raw?: Json;
+                    source: string;
+                    source_execution_id?: string | null;
+                };
+                Update: {
+                    captured_at?: string;
+                    created_at?: string;
+                    distribution_id?: string;
+                    id?: string;
+                    metrics?: Json;
+                    organization_id?: string;
+                    raw?: Json;
+                    source?: string;
+                    source_execution_id?: string | null;
+                };
+                Relationships: [
+                    {
+                        foreignKeyName: "content_distribution_metrics_distribution_fkey";
+                        columns: ["distribution_id", "organization_id"];
+                        isOneToOne: false;
+                        referencedRelation: "content_distributions";
+                        referencedColumns: ["id", "organization_id"];
+                    },
+                    {
+                        foreignKeyName: "content_distribution_metrics_organization_id_fkey";
+                        columns: ["organization_id"];
+                        isOneToOne: false;
+                        referencedRelation: "organizations";
+                        referencedColumns: ["id"];
+                    },
+                    {
+                        foreignKeyName: "content_distribution_metrics_source_execution_id_fkey";
+                        columns: ["source_execution_id"];
+                        isOneToOne: false;
+                        referencedRelation: "execution_logs";
+                        referencedColumns: ["execution_id"];
+                    }
+                ];
+            };
             content_distributions: {
                 Row: {
                     adapted_body: string | null;
@@ -5565,6 +5623,52 @@ declare function useElevasisSystems(): ElevasisSystemsContextValue;
 declare function useOptionalElevasisSystems(): ElevasisSystemsContextValue | null;
 declare function ElevasisSystemsProvider({ systems, topbarActions, organizationModel, timeRange, operationsApiUrl, operationsSSEManager, deliveryApiUrl, deliverySSEManager, disabledSubsectionPaths, children }: ElevasisSystemsProviderProps): react_jsx_runtime.JSX.Element;
 
+/**
+ * Filters a static candidate manifest list down to the ones whose System is
+ * both **declared** in the organization model and **visible** by lifecycle
+ * (`isSystemLifecycleVisible` -- the Wave 1 shared predicate; `lifecycle:
+ * 'draft'` is not visible, and an omitted lifecycle parses as `'active'`).
+ *
+ * This is a FILTER, not a generator. Tenants keep their hand-written
+ * `SYSTEM_MANIFESTS` array (real imports, so bundling and tree-shaking stay
+ * honest) and route the result through this function before handing it to
+ * `ElevasisSystemsProvider` / `ElevasisAuthenticatedShell`.
+ *
+ * A manifest with no `systemId` is a navigation-only surface (see
+ * `SystemModule.systemId`'s own doc: "Omit for navigation-only app
+ * surfaces") -- there is nothing to check it against, so it always passes
+ * through unfiltered.
+ */
+declare function selectDeclaredSystems<T extends SystemModule>(candidates: readonly T[], organizationModel: ElevasisOrganizationModel | undefined): T[];
+
+/**
+ * useResolvedOrganizationModel
+ *
+ * Returns the live organization model from ElevasisSystemsProvider, falling
+ * back to a canonical empty model when the provider has not yet supplied one.
+ *
+ * Fallback uses `mergeDefaults: false` intentionally: the generic
+ * DEFAULT_ORGANIZATION_MODEL has an empty `systems: {}` record (all
+ * Elevasis-specific systems live in `@repo/elevasis-core`).  With
+ * `mergeDefaults: true` Zod would inject the generic fixture defaults,
+ * producing a model that looks valid but contains none of the tenant's
+ * semantic data.  `mergeDefaults: false` yields a minimal schema-valid shell
+ * that makes the missing-provider state explicit rather than silently hiding it.
+ */
+
+/**
+ * Returns the live `OrganizationModel` from the nearest
+ * `ElevasisSystemsProvider`.  When the provider has not yet supplied a model
+ * (e.g. during initial load), returns `EMPTY_CANONICAL_MODEL` -- a minimal
+ * schema-valid shell resolved with `{ mergeDefaults: false }` so it never
+ * silently injects the generic fixture Systems/knowledge.
+ *
+ * Use this hook instead of `organizationModel ?? resolveOrganizationModel()`
+ * at call sites; it centralises the fallback decision and enforces the
+ * `mergeDefaults: false` contract in one place.
+ */
+declare function useResolvedOrganizationModel(): OrganizationModel;
+
 declare function SystemShell({ children }: {
     children: ReactNode;
 }): react_jsx_runtime.JSX.Element;
@@ -5611,5 +5715,5 @@ declare function useElevasisServices(): ElevasisServiceContextValue;
  */
 declare function ElevasisServiceProvider({ apiRequest, organizationId, workOSOrganizationId, isReady, apiUrl, children }: ElevasisServiceProviderProps): react_jsx_runtime.JSX.Element;
 
-export { AppearanceProvider, ElevasisCoreProvider, ElevasisServiceProvider, ElevasisSystemsProvider, NotificationProvider, SystemShell, useAppearance, useElevasisServices, useElevasisSystems, useNotificationAdapter, useOptionalElevasisSystems };
+export { AppearanceProvider, ElevasisCoreProvider, ElevasisServiceProvider, ElevasisSystemsProvider, NotificationProvider, SystemShell, selectDeclaredSystems, useAppearance, useElevasisServices, useElevasisSystems, useNotificationAdapter, useOptionalElevasisSystems, useResolvedOrganizationModel };
 export type { ApiKeyConfig, AppearanceConfig, AuthConfig, AuthKitConfig, ElevasisCoreProviderProps, ElevasisCoreThemeConfig, ElevasisServiceContextValue, ElevasisServiceProviderProps, ElevasisSystemsContextValue, ElevasisSystemsProviderProps, ElevasisTokenOverrides, NotificationAdapter, OrganizationGraphContextValue, OrganizationGraphSystemBridge, ResolvedShellModel, ResolvedShellRouteMatch, ResolvedShellSystem, ResolvedSystemAccess, ResolvedSystemModule, ResolvedSystemSemantics, ResolvedTopbarAction, ResolvedTopbarActionEntry, ShellRouteMatchStatus, ShellRuntime, ShellSidebarLinkGroup, ShellSidebarLinkItem, ShellSidebarProjectionOptions, SystemIconComponent, SystemModule, SystemSidebarComponent, TopbarActionModule, TopbarActionsProjectionOptions, WithSchemes };

package/dist/provider/published.js

@@ -1,14 +1,13 @@
-export { AppearanceProvider, ElevasisCoreProvider, ElevasisSystemsProvider, NotificationProvider, SystemShell, useAppearance, useElevasisSystems, useNotificationAdapter, useOptionalElevasisSystems } from '../chunk-OCVSPAKM.js';
+export { AppearanceProvider, ElevasisCoreProvider, ElevasisSystemsProvider, NotificationProvider, SystemShell, selectDeclaredSystems, useAppearance, useElevasisSystems, useNotificationAdapter, useOptionalElevasisSystems, useResolvedOrganizationModel } from '../chunk-6JN2TLV2.js';
 import '../chunk-R6NMRXNO.js';
 import '../chunk-RBGVNPA6.js';
-import '../chunk-MKH2KOAO.js';
-import '../chunk-NHNTX6ZL.js';
+import '../chunk-O32UQ26A.js';
 import '../chunk-L7BZZ4SI.js';
-import '../chunk-U2H3TIHD.js';
+import '../chunk-HYQOGRWG.js';
 import '../chunk-MISHPEJX.js';
 import '../chunk-62GVNH5U.js';
 import '../chunk-P45GQ3ZW.js';
-import '../chunk-M7WWRZ5Z.js';
+import '../chunk-2GIJBHZT.js';
 import '../chunk-3KMDHCAR.js';
 import '../chunk-2IFYDILW.js';
 import '../chunk-BLXJEIQS.js';
@@ -16,7 +15,7 @@ import '../chunk-UD657ICS.js';
 import '../chunk-DD3CCMCZ.js';
 import '../chunk-RNP5R5I3.js';
 import '../chunk-RT4KRGZT.js';
-import '../chunk-IBCEAVB2.js';
+import '../chunk-R5UGIFYU.js';
 import '../chunk-Y6I3IC45.js';
 import '../chunk-6SSQGWK7.js';
 export { ElevasisServiceProvider, useElevasisServices } from '../chunk-BI5VDO2K.js';

package/dist/test-utils/index.d.ts

@@ -176,15 +176,26 @@ interface OrgOsUiRouteContractOptions {
     mode?: OrgOsUiRouteContractMode;
     /**
      * Route paths whose route file — or an ancestor layout route — wraps the page
-     * in an `AccessGuard`. Supply this to enable the `unguarded-beta-route` check.
+     * in an `AccessGuard`. Supply this to enable the `unguarded-route` check.
      *
-     * Omitted means the beta-guard check does not run. Hiding a System from
-     * navigation (`lifecycle: 'beta'`) does not make its route unreachable, so a
-     * caller that can resolve route files should always pass this.
+     * Omitted means the guard check does not run. A System's route is reachable
+     * by direct URL regardless of its lifecycle or whether it is currently
+     * surfaced in navigation, so a caller that can resolve route files should
+     * always pass this.
      */
     guardedRoutePaths?: Iterable<string>;
+    /**
+     * Explicit, named opt-out from the `unguarded-route` check for System paths
+     * that are intentionally reachable without an `AccessGuard` (a public or
+     * unauthenticated surface, for example). Each entry must be a normalized
+     * route path already present in `routePaths`/`routeTreeSource` — this is
+     * not a way to silence a path that simply has not been checked. Keep this
+     * empty unless a route genuinely should not be guarded; do not use it to
+     * paper over a route a guard was forgotten on.
+     */
+    publiclyReachableRoutePaths?: Iterable<string>;
 }
-type OrgOsUiRouteContractIssueKind = 'missing-system' | 'missing-route' | 'unguarded-beta-route';
+type OrgOsUiRouteContractIssueKind = 'missing-system' | 'missing-route' | 'unguarded-route';
 interface OrgOsUiRouteContractIssue {
     target: OrgOsUiRouteContractTarget;
     kind: OrgOsUiRouteContractIssueKind;

package/dist/test-utils/index.js

@@ -2,10 +2,10 @@ import { server, handlers } from '../chunk-7XKCG5CT.js';
 export { handlers, server } from '../chunk-7XKCG5CT.js';
 import { mockWorkOSUser, mockUseAuth, mockUnauthenticatedUser, mockAuthenticatedUser, mockAuthLoading, createMockUseAuth } from '../chunk-N7U24M2J.js';
 export { createMockUseAuth, mockAuthLoading, mockAuthenticatedUser, mockUnauthenticatedUser, mockUseAuth, mockWorkOSUser } from '../chunk-N7U24M2J.js';
-import '../chunk-5B2ZFO44.js';
-import { ApiClientProvider } from '../chunk-NHNTX6ZL.js';
+import '../chunk-RFNJ2PTO.js';
+import { ApiClientProvider } from '../chunk-O32UQ26A.js';
 import '../chunk-DD3CCMCZ.js';
-import '../chunk-IBCEAVB2.js';
+import '../chunk-R5UGIFYU.js';
 import '../chunk-Y6I3IC45.js';
 import '../chunk-6SSQGWK7.js';
 import { ElevasisServiceProvider } from '../chunk-BI5VDO2K.js';
@@ -179,19 +179,15 @@ function getOrgOsRouteContractSystems(organizationModel) {
   const { systems } = organizationModel;
   const arraySystems = systems.systems;
   if (Array.isArray(arraySystems)) {
-    return arraySystems.map((system) => ({
-      ...system,
-      betaByAncestry: system.lifecycle === "beta"
-    }));
+    return arraySystems;
   }
   const result = [];
-  const visit = (entries, prefix = "", ancestorBeta = false) => {
+  const visit = (entries, prefix = "") => {
     for (const [key, system] of Object.entries(entries)) {
       const id = prefix ? `${prefix}.${key}` : system.id || key;
-      const betaByAncestry = ancestorBeta || system.lifecycle === "beta";
-      result.push({ ...system, id, betaByAncestry });
-      if (system.systems) visit(system.systems, id, betaByAncestry);
-      if (system.subsystems) visit(system.subsystems, id, betaByAncestry);
+      result.push({ ...system, id });
+      if (system.systems) visit(system.systems, id);
+      if (system.subsystems) visit(system.subsystems, id);
     }
   };
   visit(systems);
@@ -205,6 +201,9 @@ function collectOrgOsUiRouteContractIssues(options) {
   }
   const normalizedRoutePaths = new Set([...routePaths].map(normalizeOrgOsRoutePath));
   const normalizedGuardedPaths = options.guardedRoutePaths ? new Set([...options.guardedRoutePaths].map(normalizeOrgOsRoutePath)) : void 0;
+  const normalizedPubliclyReachablePaths = new Set(
+    [...options.publiclyReachableRoutePaths ?? []].map(normalizeOrgOsRoutePath)
+  );
   const systems = getOrgOsRouteContractSystems(organizationModel);
   const modelSystemIds = new Set(systems.map((system) => system.id));
   const issues = [];
@@ -236,10 +235,10 @@ function collectOrgOsUiRouteContractIssues(options) {
       });
       continue;
     }
-    if (normalizedGuardedPaths && system.betaByAncestry && !normalizedGuardedPaths.has(normalizedPath)) {
+    if (normalizedGuardedPaths && !normalizedGuardedPaths.has(normalizedPath) && !normalizedPubliclyReachablePaths.has(normalizedPath)) {
       issues.push({
         target,
-        kind: "unguarded-beta-route",
+        kind: "unguarded-route",
         systemId: system.id,
         ownerSystemId,
         path: normalizedPath
@@ -257,17 +256,17 @@ function formatOrgOsUiRouteContractIssue(issue) {
       `- If it should not ship, remove that SystemModule from ${issue.target.shellSource}.`
     ].join("\n");
   }
-  if (issue.kind === "unguarded-beta-route") {
+  if (issue.kind === "unguarded-route") {
     return [
-      `[unguarded-beta-route] System "${issue.systemId}" is lifecycle "beta" (directly or via an ancestor) and routes to "${issue.path}", but neither that route file nor an ancestor layout route wraps it in an AccessGuard.`,
+      `[unguarded-route] System "${issue.systemId}" routes to "${issue.path}", but neither that route file nor an ancestor layout route wraps it in an AccessGuard.`,
       `Owner SystemModule: ${issue.ownerSystemId}`,
-      "A beta System is hidden from navigation, which is not the same as unreachable \u2014 the route still answers a direct URL.",
+      "Any System route answers a direct URL regardless of its lifecycle or navigation visibility, so every routable System needs its own guard.",
       "Fix one of:",
       // Phrased in prose rather than as a guard JSX tag on purpose. The
       // access-key drift scanner in @repo/core matches that tag shape anywhere
       // in a file and would read this message as a real runtime access key.
       `- Wrap the route (or its layout route) in an AccessGuard whose access key is "${issue.systemId}".`,
-      `- Or change the System's lifecycle in ${issue.target.orgModelSource} if it is actually meant to be publicly reachable.`
+      `- Or, if this route is genuinely meant to be reachable without an AccessGuard, add its path to the contract call's publiclyReachableRoutePaths with a comment naming why.`
     ].join("\n");
   }
   return [

package/dist/types/index.d.ts

@@ -2225,6 +2225,64 @@ type Database = {
                     }
                 ];
             };
+            content_distribution_metrics: {
+                Row: {
+                    captured_at: string;
+                    created_at: string;
+                    distribution_id: string;
+                    id: string;
+                    metrics: Json;
+                    organization_id: string;
+                    raw: Json;
+                    source: string;
+                    source_execution_id: string | null;
+                };
+                Insert: {
+                    captured_at?: string;
+                    created_at?: string;
+                    distribution_id: string;
+                    id?: string;
+                    metrics?: Json;
+                    organization_id: string;
+                    raw?: Json;
+                    source: string;
+                    source_execution_id?: string | null;
+                };
+                Update: {
+                    captured_at?: string;
+                    created_at?: string;
+                    distribution_id?: string;
+                    id?: string;
+                    metrics?: Json;
+                    organization_id?: string;
+                    raw?: Json;
+                    source?: string;
+                    source_execution_id?: string | null;
+                };
+                Relationships: [
+                    {
+                        foreignKeyName: "content_distribution_metrics_distribution_fkey";
+                        columns: ["distribution_id", "organization_id"];
+                        isOneToOne: false;
+                        referencedRelation: "content_distributions";
+                        referencedColumns: ["id", "organization_id"];
+                    },
+                    {
+                        foreignKeyName: "content_distribution_metrics_organization_id_fkey";
+                        columns: ["organization_id"];
+                        isOneToOne: false;
+                        referencedRelation: "organizations";
+                        referencedColumns: ["id"];
+                    },
+                    {
+                        foreignKeyName: "content_distribution_metrics_source_execution_id_fkey";
+                        columns: ["source_execution_id"];
+                        isOneToOne: false;
+                        referencedRelation: "execution_logs";
+                        referencedColumns: ["execution_id"];
+                    }
+                ];
+            };
             content_distributions: {
                 Row: {
                     adapted_body: string | null;
@@ -5742,7 +5800,7 @@ type AIResourceDefinition = SerializedWorkflowDefinition | SerializedAgentDefini
  * Note: Concrete adapter implementations are deferred until needed.
  * This type provides compile-time safety and auto-completion for tool definitions.
  */
-type IntegrationType = 'gmail' | 'google-sheets' | 'slack' | 'github' | 'linear' | 'attio' | 'airtable' | 'salesforce' | 'hubspot' | 'stripe' | 'twilio' | 'sendgrid' | 'mailgun' | 'zapier' | 'webhook' | 'apify' | 'instantly' | 'resend' | 'signature-api' | 'dropbox' | 'anymailfinder' | 'tomba' | 'millionverifier';
+type IntegrationType = 'gmail' | 'google-sheets' | 'slack' | 'github' | 'linear' | 'attio' | 'airtable' | 'salesforce' | 'hubspot' | 'stripe' | 'twilio' | 'sendgrid' | 'mailgun' | 'zapier' | 'webhook' | 'apify' | 'instantly' | 'resend' | 'signature-api' | 'dropbox' | 'anymailfinder' | 'tomba' | 'millionverifier' | 'instagram';
 
 /**
  * Resource Registry type definitions