@managemint-solutions/sdk 0.53.0 → 0.55.0

package/dist/emulation-handshakes/index.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EmulationHandshakesResource = void 0;
+const errors_1 = require("../errors");
+/**
+ * `emulation_handshakes`, service client only: proof that a user's next sign-in is the admin
+ * api's own mint, which the custom access token hook spends to mark that token emulated.
+ */
+class EmulationHandshakesResource {
+    supabase;
+    constructor(supabase) {
+        this.supabase = supabase;
+    }
+    /**
+     * Opens a handshake for `userId`'s next sign-in, good for thirty seconds. Returns its id. The
+     * credential is the one a public mint presented; a staff member's own mint has none.
+     */
+    async open(userId, credentialId) {
+        const { data, error } = await this.supabase
+            .from('emulation_handshakes')
+            .insert({
+            user_id: userId,
+            credential_id: credentialId,
+            expires_at: new Date(Date.now() + 30_000).toISOString(),
+        })
+            .select('id')
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data.id;
+    }
+    /** Deletes the handshake, spent or not, once the mint is over. */
+    async close(id) {
+        const { error } = await this.supabase.from('emulation_handshakes').delete().eq('id', id);
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+    }
+}
+exports.EmulationHandshakesResource = EmulationHandshakesResource;

package/dist/errors.js

@@ -90,7 +90,7 @@ exports.mapPostgrestError = mapPostgrestError;
  * network/unknown failures have none, hence the 500 fallback.
  */
 const mapStorageError = (error, message = error.message) => new SupabaseClientError({
-    status: error.status ?? 500,
+    status: error.status || 500,
     error: 'Storage Error',
     message,
 }, { cause: error });
@@ -101,7 +101,7 @@ exports.mapStorageError = mapStorageError;
  * status GoTrue answered with; network/unknown failures carry none, hence the 500 fallback.
  */
 const mapAuthError = (error) => new SupabaseClientError({
-    status: error.status ?? 500,
+    status: error.status || 500,
     error: 'Authentication Error',
     message: error.message,
 }, { cause: error });

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { SupabaseClient, createSupabaseClient } from './client';
 export type { SupabaseClientConfig, TypedSupabaseClient } from './client';
-export type { AuthContext, VerifiedAuth, VerifiedOrganization, VerifyAccessTokenConfig, } from './auth';
+export { SupabaseStaffClient, createSupabaseStaffClient } from './staff-client';
+export type { AuthContext, StaffContext, VerifiedAuth, VerifiedOrganization, VerifiedStaff, VerifyAccessTokenConfig, } from './auth';
 export { SupabaseAuthClient, createSupabaseAuthClient } from './auth-client';
 export type { SupabaseAuthClientConfig } from './auth-client';
 export { ExchangeRefreshTokenDto, ExchangeTokenHashDto, ResetPasswordDto, SendPasswordResetEmailDto, SignInDto, } from './auth-client';
@@ -9,7 +10,7 @@ export type { SupabaseOrganizationScope, SupabaseServiceClientConfig } from './s
 export { SupabaseClientError } from './errors';
 export type { SupabaseClientErrorInit } from './errors';
 export { EmptyToNull, IsNullable } from './validators';
-export type { AuditActor, AuditChanges, AuditEntry, AuditErrorHandler, AuditGuard, AuditNameTable, AuditRow, AuditedTable, AuditedTableOptions, EntityAuditTrail, } from './audit';
+export type { AuditActor, AuditChanges, AuditEntry, AuditErrorHandler, AuditGuard, AuditNameTable, AuditRow, AuditedTable, AuditedTableOptions, EntityAuditTrail, OrganizationTableFactory, } from './audit';
 export { GetAuditTrailDto, withAuditBatch } from './audit';
 export { CancelSubscriptionDto, GetPaymentsQueryDto, InitialPaymentDto, PaymentIdDto, PurchaseModuleDto, ReinstateSubscriptionDto, } from './billing';
 export { GetInvoicesQueryDto, InvoiceIdDto } from './billing/invoices';
@@ -21,23 +22,26 @@ export { AddStatusDto, GetStatusesDto, ReorderStatusesDto, StatusIdDto, UpdateSt
 export { AddLabelDto, GetLabelsDto, LabelIdDto, UpdateLabelDto } from './labels';
 export { AddAdditionalDetailsDto, AdditionalDetailsIdDto, GetAdditionalDetailsDto, IsAdditionalDetailsValueByType, UpdateAdditionalDetailsDto, } from './additional-details';
 export { AddNoteDto, GetNotesDto, NoteIdDto } from './notes';
-export type { CreateNotificationInput, CreatedNotification, NotificationContentRow, OrganizationTableFactory, QueuedNotification, } from './notifications';
+export type { CreateNotificationInput, CreatedNotification, NotificationContentRow, QueuedNotification, } from './notifications';
 export { GetNotificationsDto, NotificationIdDto } from './notifications';
 export type { OrganizationInvite } from './organization-invites';
 export type { OrganizationPaymentMethod, PaymentMethodLookupColumn, } from './organization-payment-methods';
 export type { CreateOrganizationRow, OrganizationRow } from './organizations';
-export { CreateOrganizationDto, UpdateOrganizationDto } from './organizations';
+export { CreateOrganizationDto, GetOrganizationsDto, OrganizationIdDto, UpdateOrganizationDto, } from './organizations';
 export { PermissionsResource } from './permissions';
 export type { PermissionFlags } from './permissions';
 export { UpdatePermissionsDto } from './permissions';
+export { CreateStaffDto, StaffIdDto, UpdateStaffPermissionsDto } from './staff';
+export type { CreateUserApiCredentialRow, UserApiCredentialRow } from './user-api-credentials';
+export { CreateUserApiCredentialDto, MintEmulationTokenDto, UserApiCredentialIdDto, } from './user-api-credentials';
 export type { UserEmploymentRow, UserRow } from './users';
-export { AddUserDto, GetUsersQueryDto, UpdateMyProfileDto, UpdateUserDto, UserIdDto, } from './users';
+export { AddUserDto, GetUsersQueryDto, StaffGetUsersDto, UpdateMyProfileDto, UpdateUserDto, UserIdDto, } from './users';
 export type { ClaimOutcome, WebhookEventRow, WebhookEventsTable } from './webhook-events';
 export { GetSupportingFilesDto, SupportingFileIdDto, SupportingFileNamesDto } from './supporting-files';
-export { ClientIdDto, CreateClientDto, GetClientsDto, UpdateClientDto } from './clients';
-export { ConvertLeadDto, CreateLeadDto, GetLeadsDto, LeadIdDto, UpdateLeadDto } from './leads';
-export { CreateProjectDto, GetProjectsDto, ProjectIdDto, UpdateProjectDto } from './projects';
-export { AddTaskLinkDto, CreateTaskDto, GetTasksDto, TaskIdDto, TaskLinkIdDto, UpdateTaskDto } from './tasks';
+export { ClientIdDto, CreateClientDto, GetClientsDto, StaffGetClientsDto, UpdateClientDto } from './clients';
+export { ConvertLeadDto, CreateLeadDto, GetLeadsDto, LeadIdDto, StaffGetLeadsDto, UpdateLeadDto } from './leads';
+export { CreateProjectDto, GetProjectsDto, ProjectIdDto, StaffGetProjectsDto, UpdateProjectDto } from './projects';
+export { AddTaskLinkDto, CreateTaskDto, GetTasksDto, StaffGetTasksDto, TaskIdDto, TaskLinkIdDto, UpdateTaskDto, } from './tasks';
 export type { CreateLeaveEntitlementInput, CreateLeaveRequestRow, ReviewLeaveRequestRow, UpdateLeaveRequestRow, } from './leave';
 export type { BalanceEntitlement, BalanceRequest, LeaveCycle } from './leave';
 export { BulkCreateLeaveEntitlementsDto, CreateLeaveAdjustmentDto, CreateLeaveEntitlementDto, CreateLeaveRequestDto, CreateLeaveTypeDto, GetLeaveCalendarDto, GetLeaveEntitlementsDto, GetLeaveRequestsDto, GetLeaveTypesDto, LeaveEntitlementIdDto, LeaveRequestIdDto, LeaveTypeIdDto, ReviewLeaveRequestDto, UpdateLeaveEntitlementDto, UpdateLeaveRequestDto, UpdateLeaveTypeDto, } from './leave';

package/dist/index.js

@@ -3,16 +3,19 @@
 // the audit diff, the row helpers, the select-string fragments, the error mappers - and stays
 // reachable only from inside. The `./nest` entrypoint is listed separately, in src/nest/index.ts.
 //
-// Resources are reached through the three clients (`supabase.tasks`, `scope.invoices`, ...), so
+// Resources are reached through the clients (`supabase.tasks`, `scope.invoices`, ...), so
 // their classes are not exported: a consumer never constructs one, and every export is a contract
 // to keep. The row and input types they produce and accept are exported for annotations.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PermissionsResource = exports.UpdateOrganizationDto = exports.CreateOrganizationDto = exports.NotificationIdDto = exports.GetNotificationsDto = exports.NoteIdDto = exports.GetNotesDto = exports.AddNoteDto = exports.UpdateAdditionalDetailsDto = exports.IsAdditionalDetailsValueByType = exports.GetAdditionalDetailsDto = exports.AdditionalDetailsIdDto = exports.AddAdditionalDetailsDto = exports.UpdateLabelDto = exports.LabelIdDto = exports.GetLabelsDto = exports.AddLabelDto = exports.UpdateStatusDto = exports.StatusIdDto = exports.ReorderStatusesDto = exports.GetStatusesDto = exports.AddStatusDto = exports.CreateSupportRequestDto = exports.UpdateConfigDto = exports.CreateConfigDto = exports.CreateFeatureRequestDto = exports.InvoiceIdDto = exports.GetInvoicesQueryDto = exports.ReinstateSubscriptionDto = exports.PurchaseModuleDto = exports.PaymentIdDto = exports.InitialPaymentDto = exports.GetPaymentsQueryDto = exports.CancelSubscriptionDto = exports.withAuditBatch = exports.GetAuditTrailDto = exports.IsNullable = exports.EmptyToNull = exports.SupabaseClientError = exports.createSupabaseServiceClient = exports.SupabaseServiceClient = exports.SignInDto = exports.SendPasswordResetEmailDto = exports.ResetPasswordDto = exports.ExchangeTokenHashDto = exports.ExchangeRefreshTokenDto = exports.createSupabaseAuthClient = exports.SupabaseAuthClient = exports.createSupabaseClient = exports.SupabaseClient = void 0;
-exports.initialUntil = exports.cyclePeriodFor = exports.countWorkingDays = exports.completedMonths = exports.addMonths = exports.GetPublicHolidaysDto = exports.UpdateLeaveTypeDto = exports.UpdateLeaveRequestDto = exports.UpdateLeaveEntitlementDto = exports.ReviewLeaveRequestDto = exports.LeaveTypeIdDto = exports.LeaveRequestIdDto = exports.LeaveEntitlementIdDto = exports.GetLeaveTypesDto = exports.GetLeaveRequestsDto = exports.GetLeaveEntitlementsDto = exports.GetLeaveCalendarDto = exports.CreateLeaveTypeDto = exports.CreateLeaveRequestDto = exports.CreateLeaveEntitlementDto = exports.CreateLeaveAdjustmentDto = exports.BulkCreateLeaveEntitlementsDto = exports.UpdateTaskDto = exports.TaskLinkIdDto = exports.TaskIdDto = exports.GetTasksDto = exports.CreateTaskDto = exports.AddTaskLinkDto = exports.UpdateProjectDto = exports.ProjectIdDto = exports.GetProjectsDto = exports.CreateProjectDto = exports.UpdateLeadDto = exports.LeadIdDto = exports.GetLeadsDto = exports.CreateLeadDto = exports.ConvertLeadDto = exports.UpdateClientDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.SupportingFileNamesDto = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.GetUsersQueryDto = exports.AddUserDto = exports.UpdatePermissionsDto = void 0;
-exports.monthlyTotalMinor = exports.weekStartOf = exports.minutesBetween = exports.UpdateTimesheetEntryDto = exports.TimesheetIdDto = exports.TimesheetEntryIdDto = exports.ReviewTimesheetDto = exports.GetTimesheetsDto = exports.GetTimesheetReportDto = exports.CreateTimesheetEntryDto = exports.todayInJohannesburg = exports.shiftDays = exports.proRataDays = exports.isWithinPeriod = void 0;
+exports.CreateOrganizationDto = exports.NotificationIdDto = exports.GetNotificationsDto = exports.NoteIdDto = exports.GetNotesDto = exports.AddNoteDto = exports.UpdateAdditionalDetailsDto = exports.IsAdditionalDetailsValueByType = exports.GetAdditionalDetailsDto = exports.AdditionalDetailsIdDto = exports.AddAdditionalDetailsDto = exports.UpdateLabelDto = exports.LabelIdDto = exports.GetLabelsDto = exports.AddLabelDto = exports.UpdateStatusDto = exports.StatusIdDto = exports.ReorderStatusesDto = exports.GetStatusesDto = exports.AddStatusDto = exports.CreateSupportRequestDto = exports.UpdateConfigDto = exports.CreateConfigDto = exports.CreateFeatureRequestDto = exports.InvoiceIdDto = exports.GetInvoicesQueryDto = exports.ReinstateSubscriptionDto = exports.PurchaseModuleDto = exports.PaymentIdDto = exports.InitialPaymentDto = exports.GetPaymentsQueryDto = exports.CancelSubscriptionDto = exports.withAuditBatch = exports.GetAuditTrailDto = exports.IsNullable = exports.EmptyToNull = exports.SupabaseClientError = exports.createSupabaseServiceClient = exports.SupabaseServiceClient = exports.SignInDto = exports.SendPasswordResetEmailDto = exports.ResetPasswordDto = exports.ExchangeTokenHashDto = exports.ExchangeRefreshTokenDto = exports.createSupabaseAuthClient = exports.SupabaseAuthClient = exports.createSupabaseStaffClient = exports.SupabaseStaffClient = exports.createSupabaseClient = exports.SupabaseClient = void 0;
+exports.GetLeaveEntitlementsDto = exports.GetLeaveCalendarDto = exports.CreateLeaveTypeDto = exports.CreateLeaveRequestDto = exports.CreateLeaveEntitlementDto = exports.CreateLeaveAdjustmentDto = exports.BulkCreateLeaveEntitlementsDto = exports.UpdateTaskDto = exports.TaskLinkIdDto = exports.TaskIdDto = exports.StaffGetTasksDto = exports.GetTasksDto = exports.CreateTaskDto = exports.AddTaskLinkDto = exports.UpdateProjectDto = exports.StaffGetProjectsDto = exports.ProjectIdDto = exports.GetProjectsDto = exports.CreateProjectDto = exports.UpdateLeadDto = exports.StaffGetLeadsDto = exports.LeadIdDto = exports.GetLeadsDto = exports.CreateLeadDto = exports.ConvertLeadDto = exports.UpdateClientDto = exports.StaffGetClientsDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.SupportingFileNamesDto = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.StaffGetUsersDto = exports.GetUsersQueryDto = exports.AddUserDto = exports.UserApiCredentialIdDto = exports.MintEmulationTokenDto = exports.CreateUserApiCredentialDto = exports.UpdateStaffPermissionsDto = exports.StaffIdDto = exports.CreateStaffDto = exports.UpdatePermissionsDto = exports.PermissionsResource = exports.UpdateOrganizationDto = exports.OrganizationIdDto = exports.GetOrganizationsDto = void 0;
+exports.monthlyTotalMinor = exports.weekStartOf = exports.minutesBetween = exports.UpdateTimesheetEntryDto = exports.TimesheetIdDto = exports.TimesheetEntryIdDto = exports.ReviewTimesheetDto = exports.GetTimesheetsDto = exports.GetTimesheetReportDto = exports.CreateTimesheetEntryDto = exports.todayInJohannesburg = exports.shiftDays = exports.proRataDays = exports.isWithinPeriod = exports.initialUntil = exports.cyclePeriodFor = exports.countWorkingDays = exports.completedMonths = exports.addMonths = exports.GetPublicHolidaysDto = exports.UpdateLeaveTypeDto = exports.UpdateLeaveRequestDto = exports.UpdateLeaveEntitlementDto = exports.ReviewLeaveRequestDto = exports.LeaveTypeIdDto = exports.LeaveRequestIdDto = exports.LeaveEntitlementIdDto = exports.GetLeaveTypesDto = exports.GetLeaveRequestsDto = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "SupabaseClient", { enumerable: true, get: function () { return client_1.SupabaseClient; } });
 Object.defineProperty(exports, "createSupabaseClient", { enumerable: true, get: function () { return client_1.createSupabaseClient; } });
+var staff_client_1 = require("./staff-client");
+Object.defineProperty(exports, "SupabaseStaffClient", { enumerable: true, get: function () { return staff_client_1.SupabaseStaffClient; } });
+Object.defineProperty(exports, "createSupabaseStaffClient", { enumerable: true, get: function () { return staff_client_1.createSupabaseStaffClient; } });
 var auth_client_1 = require("./auth-client");
 Object.defineProperty(exports, "SupabaseAuthClient", { enumerable: true, get: function () { return auth_client_1.SupabaseAuthClient; } });
 Object.defineProperty(exports, "createSupabaseAuthClient", { enumerable: true, get: function () { return auth_client_1.createSupabaseAuthClient; } });
@@ -76,6 +79,8 @@ Object.defineProperty(exports, "GetNotificationsDto", { enumerable: true, get: f
 Object.defineProperty(exports, "NotificationIdDto", { enumerable: true, get: function () { return notifications_1.NotificationIdDto; } });
 var organizations_1 = require("./organizations");
 Object.defineProperty(exports, "CreateOrganizationDto", { enumerable: true, get: function () { return organizations_1.CreateOrganizationDto; } });
+Object.defineProperty(exports, "GetOrganizationsDto", { enumerable: true, get: function () { return organizations_1.GetOrganizationsDto; } });
+Object.defineProperty(exports, "OrganizationIdDto", { enumerable: true, get: function () { return organizations_1.OrganizationIdDto; } });
 Object.defineProperty(exports, "UpdateOrganizationDto", { enumerable: true, get: function () { return organizations_1.UpdateOrganizationDto; } });
 // The one resource class still exported: the api's permissions guard spec drives a real
 // PermissionsResource over a stubbed client.
@@ -83,9 +88,18 @@ var permissions_1 = require("./permissions");
 Object.defineProperty(exports, "PermissionsResource", { enumerable: true, get: function () { return permissions_1.PermissionsResource; } });
 var permissions_2 = require("./permissions");
 Object.defineProperty(exports, "UpdatePermissionsDto", { enumerable: true, get: function () { return permissions_2.UpdatePermissionsDto; } });
+var staff_1 = require("./staff");
+Object.defineProperty(exports, "CreateStaffDto", { enumerable: true, get: function () { return staff_1.CreateStaffDto; } });
+Object.defineProperty(exports, "StaffIdDto", { enumerable: true, get: function () { return staff_1.StaffIdDto; } });
+Object.defineProperty(exports, "UpdateStaffPermissionsDto", { enumerable: true, get: function () { return staff_1.UpdateStaffPermissionsDto; } });
+var user_api_credentials_1 = require("./user-api-credentials");
+Object.defineProperty(exports, "CreateUserApiCredentialDto", { enumerable: true, get: function () { return user_api_credentials_1.CreateUserApiCredentialDto; } });
+Object.defineProperty(exports, "MintEmulationTokenDto", { enumerable: true, get: function () { return user_api_credentials_1.MintEmulationTokenDto; } });
+Object.defineProperty(exports, "UserApiCredentialIdDto", { enumerable: true, get: function () { return user_api_credentials_1.UserApiCredentialIdDto; } });
 var users_1 = require("./users");
 Object.defineProperty(exports, "AddUserDto", { enumerable: true, get: function () { return users_1.AddUserDto; } });
 Object.defineProperty(exports, "GetUsersQueryDto", { enumerable: true, get: function () { return users_1.GetUsersQueryDto; } });
+Object.defineProperty(exports, "StaffGetUsersDto", { enumerable: true, get: function () { return users_1.StaffGetUsersDto; } });
 Object.defineProperty(exports, "UpdateMyProfileDto", { enumerable: true, get: function () { return users_1.UpdateMyProfileDto; } });
 Object.defineProperty(exports, "UpdateUserDto", { enumerable: true, get: function () { return users_1.UpdateUserDto; } });
 Object.defineProperty(exports, "UserIdDto", { enumerable: true, get: function () { return users_1.UserIdDto; } });
@@ -97,22 +111,26 @@ var clients_1 = require("./clients");
 Object.defineProperty(exports, "ClientIdDto", { enumerable: true, get: function () { return clients_1.ClientIdDto; } });
 Object.defineProperty(exports, "CreateClientDto", { enumerable: true, get: function () { return clients_1.CreateClientDto; } });
 Object.defineProperty(exports, "GetClientsDto", { enumerable: true, get: function () { return clients_1.GetClientsDto; } });
+Object.defineProperty(exports, "StaffGetClientsDto", { enumerable: true, get: function () { return clients_1.StaffGetClientsDto; } });
 Object.defineProperty(exports, "UpdateClientDto", { enumerable: true, get: function () { return clients_1.UpdateClientDto; } });
 var leads_1 = require("./leads");
 Object.defineProperty(exports, "ConvertLeadDto", { enumerable: true, get: function () { return leads_1.ConvertLeadDto; } });
 Object.defineProperty(exports, "CreateLeadDto", { enumerable: true, get: function () { return leads_1.CreateLeadDto; } });
 Object.defineProperty(exports, "GetLeadsDto", { enumerable: true, get: function () { return leads_1.GetLeadsDto; } });
 Object.defineProperty(exports, "LeadIdDto", { enumerable: true, get: function () { return leads_1.LeadIdDto; } });
+Object.defineProperty(exports, "StaffGetLeadsDto", { enumerable: true, get: function () { return leads_1.StaffGetLeadsDto; } });
 Object.defineProperty(exports, "UpdateLeadDto", { enumerable: true, get: function () { return leads_1.UpdateLeadDto; } });
 var projects_1 = require("./projects");
 Object.defineProperty(exports, "CreateProjectDto", { enumerable: true, get: function () { return projects_1.CreateProjectDto; } });
 Object.defineProperty(exports, "GetProjectsDto", { enumerable: true, get: function () { return projects_1.GetProjectsDto; } });
 Object.defineProperty(exports, "ProjectIdDto", { enumerable: true, get: function () { return projects_1.ProjectIdDto; } });
+Object.defineProperty(exports, "StaffGetProjectsDto", { enumerable: true, get: function () { return projects_1.StaffGetProjectsDto; } });
 Object.defineProperty(exports, "UpdateProjectDto", { enumerable: true, get: function () { return projects_1.UpdateProjectDto; } });
 var tasks_1 = require("./tasks");
 Object.defineProperty(exports, "AddTaskLinkDto", { enumerable: true, get: function () { return tasks_1.AddTaskLinkDto; } });
 Object.defineProperty(exports, "CreateTaskDto", { enumerable: true, get: function () { return tasks_1.CreateTaskDto; } });
 Object.defineProperty(exports, "GetTasksDto", { enumerable: true, get: function () { return tasks_1.GetTasksDto; } });
+Object.defineProperty(exports, "StaffGetTasksDto", { enumerable: true, get: function () { return tasks_1.StaffGetTasksDto; } });
 Object.defineProperty(exports, "TaskIdDto", { enumerable: true, get: function () { return tasks_1.TaskIdDto; } });
 Object.defineProperty(exports, "TaskLinkIdDto", { enumerable: true, get: function () { return tasks_1.TaskLinkIdDto; } });
 Object.defineProperty(exports, "UpdateTaskDto", { enumerable: true, get: function () { return tasks_1.UpdateTaskDto; } });

package/dist/leads/dto.d.ts

@@ -1,5 +1,5 @@
 import type { UUID } from 'crypto';
-import type { ConvertLeadDto as ConvertLeadDtoType, CreateLeadDto as CreateLeadDtoType, GetLeadsDto as GetLeadsDtoType, LeadIdDto as LeadIdDtoType, UpdateLeadDto as UpdateLeadDtoType } from '@managemint-solutions/entities/leads/dto';
+import type { ConvertLeadDto as ConvertLeadDtoType, CreateLeadDto as CreateLeadDtoType, GetLeadsDto as GetLeadsDtoType, StaffGetLeadsDto as StaffGetLeadsDtoType, LeadIdDto as LeadIdDtoType, UpdateLeadDto as UpdateLeadDtoType } from '@managemint-solutions/entities/leads/dto';
 import { LeadSource } from '@managemint-solutions/entities/leads/enum';
 export declare class GetLeadsDto implements Omit<GetLeadsDtoType, 'status_id_in'> {
     readonly search?: string | null;
@@ -13,6 +13,10 @@ export declare class GetLeadsDto implements Omit<GetLeadsDtoType, 'status_id_in'
     readonly completed?: boolean | null;
     readonly archive: boolean;
 }
+/** A staff read across organizations, optionally narrowed to one of them. */
+export declare class StaffGetLeadsDto extends GetLeadsDto implements Omit<StaffGetLeadsDtoType, 'status_id_in'> {
+    readonly organization_id?: string | null;
+}
 export declare class LeadIdDto implements LeadIdDtoType {
     readonly leadId: string;
 }

package/dist/leads/dto.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConvertLeadDto = exports.UpdateLeadDto = exports.CreateLeadDto = exports.LeadIdDto = exports.GetLeadsDto = void 0;
+exports.ConvertLeadDto = exports.UpdateLeadDto = exports.CreateLeadDto = exports.LeadIdDto = exports.StaffGetLeadsDto = exports.GetLeadsDto = void 0;
 const class_validator_1 = require("class-validator");
 const class_transformer_1 = require("class-transformer");
 const enum_1 = require("@managemint-solutions/entities/leads/enum");
@@ -107,6 +107,17 @@ __decorate([
     (0, class_validator_1.IsBoolean)({ message: 'Include archived must be a boolean' }),
     __metadata("design:type", Boolean)
 ], GetLeadsDto.prototype, "archive", void 0);
+/** A staff read across organizations, optionally narrowed to one of them. */
+class StaffGetLeadsDto extends GetLeadsDto {
+    organization_id;
+}
+exports.StaffGetLeadsDto = StaffGetLeadsDto;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUUID)('7', { message: 'Invalid organization ID format' }),
+    __metadata("design:type", Object)
+], StaffGetLeadsDto.prototype, "organization_id", void 0);
 class LeadIdDto {
     leadId;
 }

package/dist/leads/index.d.ts

@@ -1,7 +1,7 @@
 import type { ClientEntity } from '@managemint-solutions/entities/clients';
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { LeadEntity, LeadSummary } from '@managemint-solutions/entities/leads';
-import type { AuthContext } from '../auth';
+import type { ClientContext } from '../auth';
 import type { AdditionalDetailsResource } from '../additional-details';
 import { EntityAuditTrail, type AuditResource } from '../audit';
 import type { ClientsResource } from '../clients';
@@ -15,8 +15,10 @@ export declare class LeadsResource {
     private readonly table;
     /** This record's history - its own rows and the rows that hang off it. */
     readonly audit: EntityAuditTrail;
-    constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource, additionalDetails: AdditionalDetailsResource);
-    list(query: GetLeadsDto): Promise<MmsList<LeadSummary>>;
+    constructor(supabase: TypedSupabaseClient, auth: ClientContext, audit: AuditResource, additionalDetails: AdditionalDetailsResource);
+    list(query: GetLeadsDto & {
+        organization_id?: string | null;
+    }): Promise<MmsList<LeadSummary>>;
     getById(leadId: string): Promise<LeadEntity>;
     create(input: CreateLeadDto): Promise<LeadEntity>;
     update(leadId: string, input: UpdateLeadDto): Promise<LeadEntity>;

package/dist/leads/index.js

@@ -24,6 +24,7 @@ const enum_6 = require("@managemint-solutions/entities/audit-trail/enum");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
 const paths_1 = require("../supporting-files/paths");
+const tenancy_1 = require("../tenancy");
 const transforms_1 = require("../transforms");
 const won_1 = require("./won");
 __exportStar(require("./dto"), exports);
@@ -127,14 +128,16 @@ class LeadsResource {
         const trimmedSearch = query.search?.trim();
         // `order`/`range` return `this`, so the builder stays a filter builder and the conditional
         // filters below can be reassigned onto it without a cast.
-        let leadsQuery = this.supabase
+        let leadsQuery = (0, tenancy_1.scopeToOrganization)(this.supabase
             .from('leads')
-            .select(LEAD_LIST_SELECT, { count: 'estimated' })
-            .eq('organization_id', this.auth.organization_id)
+            .select((0, tenancy_1.withOrganization)(LEAD_LIST_SELECT, this.auth), { count: 'estimated' }), this.auth)
             .eq('archived', query.archive)
             .eq('deleted', false)
             .order('created_at', { ascending: false })
             .range(offset, offset + pageSize - 1);
+        if (query.organization_id) {
+            leadsQuery = leadsQuery.eq('organization_id', query.organization_id);
+        }
         if (trimmedSearch) {
             leadsQuery = leadsQuery.or((0, transforms_1.orIlike)(['name', 'contact_person', 'email'], trimmedSearch));
         }
@@ -162,19 +165,18 @@ class LeadsResource {
         return (0, transforms_1.toMmsList)(data, page, pageSize, count);
     }
     async getById(leadId) {
-        const { data, error } = await this.supabase
-            .from('leads')
-            .select(LEAD_DETAIL_SELECT)
-            .eq('organization_id', this.auth.organization_id)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('leads').select((0, tenancy_1.withOrganization)(LEAD_DETAIL_SELECT, this.auth)), this.auth)
             .eq('mms_id', leadId)
             .single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
+        // The select carries the staff embed, so its row type is not inferred from the string.
+        const row = data;
         // A soft-deleted lead keeps its audit trail but gives up its details. The client it became
         // stays, so a converted lead can still point at it.
-        if (data.deleted) {
+        if (row.deleted) {
             return {
-                ...data,
+                ...row,
                 name: '',
                 contact_person: null,
                 email: '',
@@ -196,7 +198,7 @@ class LeadsResource {
             // Omitted means the creator owns the lead; an explicit null leaves it unassigned.
             assigned_to_id: input.assigned_to_id === undefined ? this.auth.mms_id : input.assigned_to_id,
             lost_reason: lostReason,
-            organization_id: this.auth.organization_id,
+            organization_id: (0, tenancy_1.requireOrganization)(this.auth),
             created_by: this.auth.mms_id,
             created_at: new Date().toISOString(),
         });
@@ -208,7 +210,7 @@ class LeadsResource {
         const { data, error } = await this.supabase
             .from('leads')
             .select('status_id, converted_client_id')
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', (0, tenancy_1.requireOrganization)(this.auth))
             .eq('mms_id', leadId)
             .single();
         if (error)
@@ -228,12 +230,12 @@ class LeadsResource {
         return this.getById(leadId);
     }
     async archive(leadId) {
-        await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, leadId);
+        await (0, won_1.refuseWonLead)(this.supabase, (0, tenancy_1.requireOrganization)(this.auth), leadId);
         await this.table.transition(leadId, enum_6.AuditTrailAction.ARCHIVE, (0, transforms_1.archivedPatch)(this.auth.mms_id));
         return this.getById(leadId);
     }
     async unarchive(leadId) {
-        await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, leadId);
+        await (0, won_1.refuseWonLead)(this.supabase, (0, tenancy_1.requireOrganization)(this.auth), leadId);
         await this.table.transition(leadId, enum_6.AuditTrailAction.UNARCHIVE, (0, transforms_1.unarchivedPatch)(this.auth.mms_id));
         return this.getById(leadId);
     }
@@ -243,7 +245,7 @@ class LeadsResource {
     }
     /** Soft delete - the row stays, flagged `deleted`, and `restore()` brings it back. A Won lead cannot be deleted. */
     async remove(leadId) {
-        await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, leadId);
+        await (0, won_1.refuseWonLead)(this.supabase, (0, tenancy_1.requireOrganization)(this.auth), leadId);
         await this.table.transition(leadId, enum_6.AuditTrailAction.DELETE, (0, transforms_1.deletedPatch)(this.auth.mms_id));
     }
     /**
@@ -266,11 +268,12 @@ class LeadsResource {
      * client is created, and read back, without the caller holding any clients permission.
      */
     async convert(leadId, input, clients) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         // (a) The lead, in this organization, not deleted and not converted already.
         const { data, error } = await this.supabase
             .from('leads')
             .select(LEAD_CONVERT_SELECT)
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', organizationId)
             .eq('mms_id', leadId)
             .maybeSingle();
         if (error)
@@ -324,7 +327,7 @@ class LeadsResource {
             const { error: moveError } = await this.supabase
                 .from(table)
                 .update({ entity_type: toType, entity_id: clientId })
-                .eq('organization_id', this.auth.organization_id)
+                .eq('organization_id', organizationId)
                 .eq('entity_type', fromType)
                 .eq('entity_id', leadId);
             if (moveError)
@@ -336,7 +339,7 @@ class LeadsResource {
         const { data: files, error: filesError } = await this.supabase
             .from('supporting_files')
             .select('mms_id, name, extension')
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', organizationId)
             .eq('entity_type', enum_5.SupportingFilesEntityTypes.LEAD)
             .eq('entity_id', leadId);
         if (filesError)
@@ -344,7 +347,7 @@ class LeadsResource {
         for (const file of files) {
             const { error: storageError } = await this.supabase.storage
                 .from(SUPPORTING_FILES_BUCKET)
-                .move((0, paths_1.storagePath)(this.auth.organization_id, enum_5.SupportingFilesEntityTypes.LEAD, leadId, file.name, file.extension), (0, paths_1.storagePath)(this.auth.organization_id, enum_5.SupportingFilesEntityTypes.CLIENT, clientId, file.name, file.extension));
+                .move((0, paths_1.storagePath)(organizationId, enum_5.SupportingFilesEntityTypes.LEAD, leadId, file.name, file.extension), (0, paths_1.storagePath)(organizationId, enum_5.SupportingFilesEntityTypes.CLIENT, clientId, file.name, file.extension));
             if (storageError) {
                 if (storageError.status === 404 || storageError.statusCode === '404')
                     continue;
@@ -353,7 +356,7 @@ class LeadsResource {
             const { error: rowError } = await this.supabase
                 .from('supporting_files')
                 .update({ entity_type: enum_5.SupportingFilesEntityTypes.CLIENT, entity_id: clientId })
-                .eq('organization_id', this.auth.organization_id)
+                .eq('organization_id', organizationId)
                 .eq('mms_id', file.mms_id);
             if (rowError)
                 throw (0, errors_1.mapPostgrestError)(rowError);
@@ -363,7 +366,7 @@ class LeadsResource {
         const { data: won, error: wonError } = await this.supabase
             .from('statuses')
             .select('mms_id')
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', organizationId)
             .eq('is_won', true)
             .maybeSingle();
         if (wonError)
@@ -390,7 +393,7 @@ class LeadsResource {
         const { data, error } = await this.supabase
             .from('statuses')
             .select('is_fail, is_won')
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', (0, tenancy_1.requireOrganization)(this.auth))
             .eq('entity_type', enum_4.StatusEntityTypes.LEAD)
             .eq('mms_id', statusId)
             .maybeSingle();

package/dist/nest/index.d.ts

@@ -1,9 +1,10 @@
 import { HttpException } from '@nestjs/common';
 import type { Request } from 'express';
 import type { AuditErrorHandler } from '../audit';
-import { type VerifiedAuth } from '../auth';
+import { type VerifiedAuth, type VerifiedStaff } from '../auth';
 import { type SupabaseClient } from '../client';
 import { SupabaseClientError } from '../errors';
+import { type SupabaseStaffClient as StaffClient } from '../staff-client';
 import { type SupabaseServiceClient } from '../service-client';
 /**
  * The HttpException Nest should send for an SDK error: same status, and the body is
@@ -42,6 +43,30 @@ export declare const attachSupabaseRequestContext: (request: Request) => Promise
 export declare const getSupabaseRequestContext: (request: Request) => SupabaseRequestContext;
 /** The caller's data client, from the context the auth guard attached. */
 export declare const SupabaseUserClient: (...dataOrPipes: unknown[]) => ParameterDecorator;
+/** What the admin api's staff guard leaves on the request for the decorator to pick up. */
+export type SupabaseStaffRequestContext = {
+    client: StaffClient;
+    staff: VerifiedStaff;
+};
+/**
+ * Where on the request the staff context is stored - `request[SUPABASE_STAFF_REQUEST_KEY]`. A key
+ * of its own, so a staff context is never found where a tenant one is expected.
+ */
+export declare const SUPABASE_STAFF_REQUEST_KEY = "supabaseStaff";
+/**
+ * `attachSupabaseRequestContext` for a staff session: verifies the token as a staff one and builds
+ * the staff member's `SupabaseStaffClient`.
+ *
+ * Idempotent: a second call hands back the context the first one attached.
+ */
+export declare const attachSupabaseStaffRequestContext: (request: Request) => Promise<SupabaseStaffRequestContext>;
+/**
+ * The context the staff guard attached. Throws when it is absent, which only happens when the
+ * route is missing the guard.
+ */
+export declare const getSupabaseStaffRequestContext: (request: Request) => SupabaseStaffRequestContext;
+/** The staff member's data client, from the context the staff guard attached. */
+export declare const SupabaseStaffClient: (...dataOrPipes: unknown[]) => ParameterDecorator;
 /**
  * A `SupabaseServiceClient` from the ambient env - the SDK-side replacement for the api's
  * `createSupabaseAdminClient()`.

package/dist/nest/index.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SupabasePublicClient = exports.createSupabaseServiceClientFromEnv = exports.SupabaseUserClient = exports.getSupabaseRequestContext = exports.attachSupabaseRequestContext = exports.SUPABASE_REQUEST_KEY = exports.configureSupabaseUserClient = exports.toHttpException = void 0;
+exports.SupabasePublicClient = exports.createSupabaseServiceClientFromEnv = exports.SupabaseStaffClient = exports.getSupabaseStaffRequestContext = exports.attachSupabaseStaffRequestContext = exports.SUPABASE_STAFF_REQUEST_KEY = exports.SupabaseUserClient = exports.getSupabaseRequestContext = exports.attachSupabaseRequestContext = exports.SUPABASE_REQUEST_KEY = exports.configureSupabaseUserClient = exports.toHttpException = void 0;
 const common_1 = require("@nestjs/common");
 const auth_1 = require("../auth");
 const auth_client_1 = require("../auth-client");
 const client_1 = require("../client");
 const errors_1 = require("../errors");
+// Aliased: the param decorator below takes the class's name.
+const staff_client_1 = require("../staff-client");
 const service_client_1 = require("../service-client");
 /**
  * The HttpException Nest should send for an SDK error: same status, and the body is
@@ -96,6 +98,61 @@ const getSupabaseRequestContext = (request) => {
 exports.getSupabaseRequestContext = getSupabaseRequestContext;
 /** The caller's data client, from the context the auth guard attached. */
 exports.SupabaseUserClient = (0, common_1.createParamDecorator)((_, ctx) => (0, exports.getSupabaseRequestContext)(ctx.switchToHttp().getRequest()).client);
+/**
+ * Where on the request the staff context is stored - `request[SUPABASE_STAFF_REQUEST_KEY]`. A key
+ * of its own, so a staff context is never found where a tenant one is expected.
+ */
+exports.SUPABASE_STAFF_REQUEST_KEY = 'supabaseStaff';
+/**
+ * `attachSupabaseRequestContext` for a staff session: verifies the token as a staff one and builds
+ * the staff member's `SupabaseStaffClient`.
+ *
+ * Idempotent: a second call hands back the context the first one attached.
+ */
+const attachSupabaseStaffRequestContext = async (request) => {
+    const existing = request[exports.SUPABASE_STAFF_REQUEST_KEY];
+    if (existing)
+        return existing;
+    const accessToken = getBearerToken(request);
+    const url = getEnvOrThrow('SUPABASE_URL');
+    const key = getEnvOrThrow('SUPABASE_PUBLISHABLE_KEY');
+    const client = (0, auth_1.createRawClient)(url, key, accessToken);
+    try {
+        const staff = await (0, auth_1.verifyStaffAccessToken)({ url, key, accessToken, client });
+        const context = {
+            staff,
+            client: (0, staff_client_1.createSupabaseStaffClient)({
+                url,
+                key,
+                accessToken,
+                client,
+                auth: { mms_id: staff.mms_id, organization_id: null },
+            }),
+        };
+        request[exports.SUPABASE_STAFF_REQUEST_KEY] = context;
+        return context;
+    }
+    catch (error) {
+        // Converted here for the same reason as the tenant attach: guards run outside the filters.
+        if (error instanceof errors_1.SupabaseClientError)
+            throw (0, exports.toHttpException)(error);
+        throw error;
+    }
+};
+exports.attachSupabaseStaffRequestContext = attachSupabaseStaffRequestContext;
+/**
+ * The context the staff guard attached. Throws when it is absent, which only happens when the
+ * route is missing the guard.
+ */
+const getSupabaseStaffRequestContext = (request) => {
+    const context = request[exports.SUPABASE_STAFF_REQUEST_KEY];
+    if (!context)
+        throw new common_1.UnauthorizedException('Request is not authenticated');
+    return context;
+};
+exports.getSupabaseStaffRequestContext = getSupabaseStaffRequestContext;
+/** The staff member's data client, from the context the staff guard attached. */
+exports.SupabaseStaffClient = (0, common_1.createParamDecorator)((_, ctx) => (0, exports.getSupabaseStaffRequestContext)(ctx.switchToHttp().getRequest()).client);
 /**
  * A `SupabaseServiceClient` from the ambient env - the SDK-side replacement for the api's
  * `createSupabaseAdminClient()`.

package/dist/notifications/index.d.ts

@@ -2,7 +2,7 @@ import type { NotificationContent, NotificationEntity, NotificationSummary, Noti
 import { NotificationChannel, NotificationStatus, type NotificationType } from '@managemint-solutions/entities/notifications/enum';
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { AuthContext } from '../auth';
-import { type AuditedTable, type AuditResource } from '../audit';
+import { type AuditResource, type OrganizationTableFactory } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { GetNotificationsDto } from './dto';
 export * from './dto';
@@ -75,8 +75,6 @@ export declare class NotificationsResource {
     /** Soft delete - the outbox row stays, flagged `deleted`, so the send record survives. */
     remove(notificationId: string): Promise<void>;
 }
-/** How the outbox reaches an audited table once it knows which organization a row belongs to. */
-export type OrganizationTableFactory = (organizationId: string) => AuditedTable;
 /**
  * The outbox and the queue worker's side of the table, on the service client: RLS reserves
  * `notifications` INSERT and DELETE to the service role, and `authenticated` has no grant on

package/dist/organizations/dto.d.ts

@@ -1,4 +1,4 @@
-import type { CreateOrganizationDto as CreateOrganizationDtoType, UpdateOrganizationDto as UpdateOrganizationDtoType } from '@managemint-solutions/entities/organization/dto';
+import type { CreateOrganizationDto as CreateOrganizationDtoType, GetOrganizationsDto as GetOrganizationsDtoType, OrganizationIdDto as OrganizationIdDtoType, UpdateOrganizationDto as UpdateOrganizationDtoType } from '@managemint-solutions/entities/organization/dto';
 import { OrganizationTypes } from '@managemint-solutions/entities/organization/enum';
 export declare class CreateOrganizationDto implements CreateOrganizationDtoType {
     readonly org_type: OrganizationTypes;
@@ -61,3 +61,11 @@ export declare class UpdateOrganizationDto implements UpdateOrganizationDtoType
     readonly currency?: string;
     readonly leave_calendar_start_month?: number;
 }
+export declare class OrganizationIdDto implements OrganizationIdDtoType {
+    readonly organizationId: string;
+}
+export declare class GetOrganizationsDto implements GetOrganizationsDtoType {
+    readonly search?: string | null;
+    readonly page: number;
+    readonly page_size: number;
+}