@memberjunction/core-entities 5.28.0 → 5.30.0

package/dist/custom/Permissions/BaseShareEntityExtended.d.ts

@@ -0,0 +1,105 @@
+import { BaseEntity, EntityPermissionType, EntitySaveOptions, IMetadataProvider, UserInfo } from '@memberjunction/core';
+import { ShareNotificationInput } from './shareNotification.js';
+/**
+ * Shared lifecycle for the four user-grantee sharing permission entities
+ * (Dashboard, Artifact, Collection, Access Control Rule). Each of those
+ * classes delegates three repetitive behaviors to the helpers in this module:
+ *
+ *  1. **Grantor Update/Delete relaxation** — {@link checkShareManagePermission}
+ *     Lets the grantor (and, via the optional `additional` hook, resource owners
+ *     or other privileged parties) revoke or edit their own grant without needing
+ *     broader CRUD on the permission entity itself.
+ *
+ *  2. **Post-save share notification dispatch** — {@link dispatchShareNotificationAfterSave}
+ *     After a successful server-side save of a new share, asks the caller for
+ *     a notification payload and fires it off through `CreateShareNotification`.
+ *     Returning `null` from the payload builder short-circuits (used by Access
+ *     Control Rules for Role / Everyone grantees who have no single recipient).
+ *
+ *  3. **Action summary rendering** — {@link buildActionsSummary}
+ *     Turns `{ view: this.CanRead, edit: this.CanEdit, … }` into `"view, edit"`.
+ *
+ * The original class inheritance shape is preserved (each extended class still
+ * extends its generated entity base) — these are plain functions the subclasses
+ * call from their `CheckPermissions` / `Save` overrides. We use functions rather
+ * than another class in the chain because each permission entity already has a
+ * fixed generated base, and multiple inheritance isn't available in TypeScript.
+ */
+/**
+ * Determine whether `user` may Update/Delete a share row they don't own via
+ * role permissions. Returns true when the user is the grantor, or when the
+ * optional `additional(userId)` predicate says they have some domain-specific
+ * management right (e.g., dashboard owner, Owner-level grantee).
+ *
+ * Use:
+ * ```typescript
+ * override CheckPermissions(type, throwError) {
+ *     if ((type === Update || Delete) && this.ActiveUser &&
+ *         checkShareManagePermission(this.ActiveUser, this.SharedByUserID, (u) => …)) {
+ *         return true;
+ *     }
+ *     return super.CheckPermissions(type, throwError);
+ * }
+ * ```
+ */
+export declare function checkShareManagePermission(user: UserInfo, grantorUserId: string | null | undefined, additional?: (userId: string) => boolean): boolean;
+/**
+ * Post-save share-notification dispatcher for extended permission entities.
+ * Call immediately after `super.Save(options)` returns `true`:
+ *
+ * ```typescript
+ * const saved = await super.Save(options);
+ * if (saved) {
+ *     await dispatchShareNotificationAfterSave(this, isNewShare, async (provider, grantorId) => {
+ *         return { Provider: provider, ContextUser: this.ContextCurrentUser, … };
+ *     });
+ * }
+ * return saved;
+ * ```
+ *
+ * Handles the boilerplate each previous implementation repeated:
+ *  - bail on client-side saves (`ProviderType !== 'Database'`)
+ *  - bail on updates (`isNewShare === false`)
+ *  - resolve the effective grantor ID (falls back to ContextCurrentUser.ID)
+ *  - let `payloadBuilder` return `null` to skip (e.g., Role-grantee ACRs)
+ *  - fire-and-forget via `void CreateShareNotification(...)` — notification
+ *    failures never fail the save.
+ */
+export declare function dispatchShareNotificationAfterSave(entity: BaseEntity, isNewShare: boolean, grantorUserId: string | null | undefined, payloadBuilder: (provider: IMetadataProvider, grantorId: string) => Promise<ShareNotificationInput | null> | ShareNotificationInput | null): Promise<void>;
+/**
+ * Turn `{ view: this.CanRead, edit: this.CanEdit, … }` into `"view, edit"`.
+ * Truthy verbs are emitted in declaration order. Replaces the hand-rolled
+ * `actionsSummary()` method each sharing entity used to carry.
+ */
+export declare function buildActionsSummary(flags: Record<string, boolean | null | undefined>): string;
+/**
+ * Server-side gate for CREATING a new share. Blocks users who hold role-level
+ * `CanCreate` on a sharing entity but don't own the target resource and don't
+ * already hold a Share-capable grant on it.
+ *
+ * Separate from `checkShareManagePermission` (which handles Update/Delete) because
+ * Angular's default role-based check can't express "the caller owns the underlying
+ * resource" — that requires a resource-specific lookup.
+ *
+ * Usage in an extended entity's `Save()` override:
+ * ```typescript
+ * const isNewShare = !this.IsSaved;
+ * if (!assertCallerMayCreateShare(this, isNewShare, () => this.callerIsAuthorizedToShare())) {
+ *     return false; // save is short-circuited; LatestResult carries the reason
+ * }
+ * const saved = await super.Save(options);
+ * ```
+ *
+ * Returns `true` when the save should proceed, `false` to short-circuit.
+ * On `false`, sets `entity.LatestResult` with `Success=false` and a user-visible
+ * `Message`, and emits a `LogError` for server logs.
+ *
+ * Short-circuits to `true` (allows the save) when:
+ *  - `isNewShare` is false (not a create — Update/Delete handled by CheckPermissions)
+ *  - provider is not the Database provider (client-side save, already trusted)
+ *  - `entity.ContextCurrentUser` is missing (defer to downstream auth layers)
+ */
+export declare function assertCallerMayCreateShare(entity: BaseEntity, isNewShare: boolean, authorized: () => boolean | Promise<boolean>, reason?: string): Promise<boolean> | boolean;
+/** Re-export for ergonomic `import { EntityPermissionType } from '...'` in subclasses. */
+export { EntityPermissionType, EntitySaveOptions };
+//# sourceMappingURL=BaseShareEntityExtended.d.ts.map

package/dist/custom/Permissions/BaseShareEntityExtended.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseShareEntityExtended.d.ts","sourceRoot":"","sources":["../../../src/custom/Permissions/BaseShareEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGlI,OAAO,EAA2B,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CACtC,IAAI,EAAE,QAAQ,EACd,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GACzC,OAAO,CAIT;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,kCAAkC,CACpD,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,OAAO,EACnB,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,cAAc,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,GAAG,sBAAsB,GAAG,IAAI,GAC3I,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,CAM7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,0BAA0B,CACtC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,OAAO,EACnB,UAAU,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAC5C,MAAM,GAAE,MAA0F,GACnG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAY5B;AAgBD,0FAA0F;AAC1F,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/custom/Permissions/BaseShareEntityExtended.js

@@ -0,0 +1,162 @@
+import { EntityPermissionType, EntitySaveOptions, LogError } from '@memberjunction/core';
+import { UUIDsEqual } from '@memberjunction/global';
+import { CreateShareNotification } from './shareNotification.js';
+/**
+ * Shared lifecycle for the four user-grantee sharing permission entities
+ * (Dashboard, Artifact, Collection, Access Control Rule). Each of those
+ * classes delegates three repetitive behaviors to the helpers in this module:
+ *
+ *  1. **Grantor Update/Delete relaxation** — {@link checkShareManagePermission}
+ *     Lets the grantor (and, via the optional `additional` hook, resource owners
+ *     or other privileged parties) revoke or edit their own grant without needing
+ *     broader CRUD on the permission entity itself.
+ *
+ *  2. **Post-save share notification dispatch** — {@link dispatchShareNotificationAfterSave}
+ *     After a successful server-side save of a new share, asks the caller for
+ *     a notification payload and fires it off through `CreateShareNotification`.
+ *     Returning `null` from the payload builder short-circuits (used by Access
+ *     Control Rules for Role / Everyone grantees who have no single recipient).
+ *
+ *  3. **Action summary rendering** — {@link buildActionsSummary}
+ *     Turns `{ view: this.CanRead, edit: this.CanEdit, … }` into `"view, edit"`.
+ *
+ * The original class inheritance shape is preserved (each extended class still
+ * extends its generated entity base) — these are plain functions the subclasses
+ * call from their `CheckPermissions` / `Save` overrides. We use functions rather
+ * than another class in the chain because each permission entity already has a
+ * fixed generated base, and multiple inheritance isn't available in TypeScript.
+ */
+/**
+ * Determine whether `user` may Update/Delete a share row they don't own via
+ * role permissions. Returns true when the user is the grantor, or when the
+ * optional `additional(userId)` predicate says they have some domain-specific
+ * management right (e.g., dashboard owner, Owner-level grantee).
+ *
+ * Use:
+ * ```typescript
+ * override CheckPermissions(type, throwError) {
+ *     if ((type === Update || Delete) && this.ActiveUser &&
+ *         checkShareManagePermission(this.ActiveUser, this.SharedByUserID, (u) => …)) {
+ *         return true;
+ *     }
+ *     return super.CheckPermissions(type, throwError);
+ * }
+ * ```
+ */
+export function checkShareManagePermission(user, grantorUserId, additional) {
+    if (grantorUserId && UUIDsEqual(grantorUserId, user.ID))
+        return true;
+    if (additional && additional(user.ID))
+        return true;
+    return false;
+}
+/**
+ * Post-save share-notification dispatcher for extended permission entities.
+ * Call immediately after `super.Save(options)` returns `true`:
+ *
+ * ```typescript
+ * const saved = await super.Save(options);
+ * if (saved) {
+ *     await dispatchShareNotificationAfterSave(this, isNewShare, async (provider, grantorId) => {
+ *         return { Provider: provider, ContextUser: this.ContextCurrentUser, … };
+ *     });
+ * }
+ * return saved;
+ * ```
+ *
+ * Handles the boilerplate each previous implementation repeated:
+ *  - bail on client-side saves (`ProviderType !== 'Database'`)
+ *  - bail on updates (`isNewShare === false`)
+ *  - resolve the effective grantor ID (falls back to ContextCurrentUser.ID)
+ *  - let `payloadBuilder` return `null` to skip (e.g., Role-grantee ACRs)
+ *  - fire-and-forget via `void CreateShareNotification(...)` — notification
+ *    failures never fail the save.
+ */
+export async function dispatchShareNotificationAfterSave(entity, isNewShare, grantorUserId, payloadBuilder) {
+    const provider = entity.ProviderToUse;
+    const isServerSide = provider?.ProviderType === 'Database';
+    if (!isServerSide || !isNewShare)
+        return;
+    const grantorId = grantorUserId ?? entity.ContextCurrentUser?.ID ?? null;
+    if (!grantorId)
+        return;
+    try {
+        const input = await payloadBuilder(provider, grantorId);
+        if (input)
+            void CreateShareNotification(input);
+    }
+    catch {
+        // Defensive: payload builder never fails the save.
+    }
+}
+/**
+ * Turn `{ view: this.CanRead, edit: this.CanEdit, … }` into `"view, edit"`.
+ * Truthy verbs are emitted in declaration order. Replaces the hand-rolled
+ * `actionsSummary()` method each sharing entity used to carry.
+ */
+export function buildActionsSummary(flags) {
+    const parts = [];
+    for (const [label, enabled] of Object.entries(flags)) {
+        if (enabled)
+            parts.push(label);
+    }
+    return parts.join(', ');
+}
+/**
+ * Server-side gate for CREATING a new share. Blocks users who hold role-level
+ * `CanCreate` on a sharing entity but don't own the target resource and don't
+ * already hold a Share-capable grant on it.
+ *
+ * Separate from `checkShareManagePermission` (which handles Update/Delete) because
+ * Angular's default role-based check can't express "the caller owns the underlying
+ * resource" — that requires a resource-specific lookup.
+ *
+ * Usage in an extended entity's `Save()` override:
+ * ```typescript
+ * const isNewShare = !this.IsSaved;
+ * if (!assertCallerMayCreateShare(this, isNewShare, () => this.callerIsAuthorizedToShare())) {
+ *     return false; // save is short-circuited; LatestResult carries the reason
+ * }
+ * const saved = await super.Save(options);
+ * ```
+ *
+ * Returns `true` when the save should proceed, `false` to short-circuit.
+ * On `false`, sets `entity.LatestResult` with `Success=false` and a user-visible
+ * `Message`, and emits a `LogError` for server logs.
+ *
+ * Short-circuits to `true` (allows the save) when:
+ *  - `isNewShare` is false (not a create — Update/Delete handled by CheckPermissions)
+ *  - provider is not the Database provider (client-side save, already trusted)
+ *  - `entity.ContextCurrentUser` is missing (defer to downstream auth layers)
+ */
+export function assertCallerMayCreateShare(entity, isNewShare, authorized, reason = 'Only the resource owner or someone with Share permission can create this share.') {
+    if (!isNewShare)
+        return true;
+    const provider = entity.ProviderToUse;
+    if (provider?.ProviderType !== 'Database')
+        return true;
+    const user = entity.ContextCurrentUser;
+    if (!user)
+        return true;
+    const result = authorized();
+    if (result instanceof Promise) {
+        return result.then((ok) => ok || failSave(entity, user, reason));
+    }
+    return result || failSave(entity, user, reason);
+}
+/**
+ * Fail-the-save helper: marks `LatestResult` so the UI sees the reason, logs
+ * server-side. Always returns `false` so callers can `return failSave(...)`.
+ */
+function failSave(entity, user, reason) {
+    LogError(`${entity.constructor.name}: user ${user.ID} (${user.Email ?? user.Name ?? 'unknown'}) blocked from creating share — ${reason}`);
+    const latest = entity.LatestResult;
+    if (latest) {
+        latest.Success = false;
+        latest.Message = reason;
+    }
+    return false;
+}
+/** Re-export for ergonomic `import { EntityPermissionType } from '...'` in subclasses. */
+export { EntityPermissionType, EntitySaveOptions };
+//# sourceMappingURL=BaseShareEntityExtended.js.map

package/dist/custom/Permissions/BaseShareEntityExtended.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseShareEntityExtended.js","sourceRoot":"","sources":["../../../src/custom/Permissions/BaseShareEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,oBAAoB,EAAE,iBAAiB,EAAqB,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AAClI,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAE,uBAAuB,EAA0B,MAAM,qBAAqB,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CACtC,IAAc,EACd,aAAwC,EACxC,UAAwC;IAExC,IAAI,aAAa,IAAI,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACpD,MAAkB,EAClB,UAAmB,EACnB,aAAwC,EACxC,cAA0I;IAE1I,MAAM,QAAQ,GAAG,MAAM,CAAC,aAA6C,CAAC;IACtE,MAAM,YAAY,GAAG,QAAQ,EAAE,YAAY,KAAK,UAAU,CAAC;IAC3D,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU;QAAE,OAAO;IAEzC,MAAM,SAAS,GAAG,aAAa,IAAI,MAAM,CAAC,kBAAkB,EAAE,EAAE,IAAI,IAAI,CAAC;IACzE,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,IAAI,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,KAAK;YAAE,KAAK,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACL,mDAAmD;IACvD,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAiD;IACjF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,0BAA0B,CACtC,MAAkB,EAClB,UAAmB,EACnB,UAA4C,EAC5C,SAAiB,iFAAiF;IAElG,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,aAA6C,CAAC;IACtE,IAAI,QAAQ,EAAE,YAAY,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,MAAkB,EAAE,IAAc,EAAE,MAAc;IAChE,QAAQ,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,mCAAmC,MAAM,EAAE,CAAC,CAAC;IAC1I,MAAM,MAAM,GAAG,MAAM,CAAC,YAA6E,CAAC;IACpG,IAAI,MAAM,EAAE,CAAC;QACT,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,0FAA0F;AAC1F,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/custom/Permissions/MJAccessControlRuleEntityExtended.d.ts

@@ -0,0 +1,22 @@
+import { EntityPermissionType, EntitySaveOptions } from '@memberjunction/core';
+import { MJAccessControlRuleEntity } from '../../generated/entity_subclasses.js';
+/**
+ * Extended Access Control Rule entity — same dual-purpose pattern as
+ * {@link MJDashboardPermissionEntityExtended}, with two differences:
+ *
+ *  - Uses `GrantedByUserID` instead of `SharedByUserID` (ACR column naming).
+ *  - Only notifies when `GranteeType === 'User'` and `GranteeID` is populated.
+ *    Role / Everyone / Public grants don't have a single identifiable recipient,
+ *    so the payload builder returns `null` to skip.
+ *
+ * Notifications use the generic `Records` Resource Type from the catalog because
+ * ACRs target arbitrary entities — there's no single ResourceType that fits.
+ */
+export declare class MJAccessControlRuleEntityExtended extends MJAccessControlRuleEntity {
+    CheckPermissions(type: EntityPermissionType, throwError: boolean): boolean;
+    Save(options?: EntitySaveOptions): Promise<boolean>;
+    private actionsSummary;
+}
+/** Tree-shaking prevention — referenced from the custom/Permissions barrel. */
+export declare function LoadMJAccessControlRuleEntityExtended(): void;
+//# sourceMappingURL=MJAccessControlRuleEntityExtended.d.ts.map

package/dist/custom/Permissions/MJAccessControlRuleEntityExtended.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJAccessControlRuleEntityExtended.d.ts","sourceRoot":"","sources":["../../../src/custom/Permissions/MJAccessControlRuleEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,oBAAoB,EAAE,iBAAiB,EAAY,MAAM,sBAAsB,CAAC;AAGrG,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAO9E;;;;;;;;;;;GAWG;AACH,qBACa,iCAAkC,SAAQ,yBAAyB;IACnE,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO;IAQpE,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IA0BlE,OAAO,CAAC,cAAc;CASzB;AAED,+EAA+E;AAC/E,wBAAgB,qCAAqC,IAAI,IAAI,CAE5D"}

package/dist/custom/Permissions/MJAccessControlRuleEntityExtended.js

@@ -0,0 +1,75 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { BaseEntity, EntityPermissionType, Metadata } from '@memberjunction/core';
+import { RegisterClass, UUIDsEqual } from '@memberjunction/global';
+import { MJAccessControlRuleEntity } from '../../generated/entity_subclasses.js';
+import { buildActionsSummary, checkShareManagePermission, dispatchShareNotificationAfterSave, } from './BaseShareEntityExtended.js';
+/**
+ * Extended Access Control Rule entity — same dual-purpose pattern as
+ * {@link MJDashboardPermissionEntityExtended}, with two differences:
+ *
+ *  - Uses `GrantedByUserID` instead of `SharedByUserID` (ACR column naming).
+ *  - Only notifies when `GranteeType === 'User'` and `GranteeID` is populated.
+ *    Role / Everyone / Public grants don't have a single identifiable recipient,
+ *    so the payload builder returns `null` to skip.
+ *
+ * Notifications use the generic `Records` Resource Type from the catalog because
+ * ACRs target arbitrary entities — there's no single ResourceType that fits.
+ */
+let MJAccessControlRuleEntityExtended = class MJAccessControlRuleEntityExtended extends MJAccessControlRuleEntity {
+    CheckPermissions(type, throwError) {
+        if (type === EntityPermissionType.Update || type === EntityPermissionType.Delete) {
+            const user = this.ActiveUser;
+            if (user && checkShareManagePermission(user, this.GrantedByUserID))
+                return true;
+        }
+        return super.CheckPermissions(type, throwError);
+    }
+    async Save(options) {
+        const isNewShare = !this.IsSaved;
+        const saved = await super.Save(options);
+        if (saved) {
+            await dispatchShareNotificationAfterSave(this, isNewShare, this.GrantedByUserID, (provider, grantorId) => {
+                // Only user grantees get individual notifications.
+                if (this.GranteeType !== 'User' || !this.GranteeID)
+                    return null;
+                const entityInfo = new Metadata().Entities.find((e) => UUIDsEqual(e.ID, this.EntityID));
+                return {
+                    Provider: provider,
+                    ContextUser: this.ContextCurrentUser,
+                    GrantorUserID: grantorId,
+                    GranteeUserID: this.GranteeID,
+                    ResourceTypeLabel: entityInfo?.Name ?? 'Record',
+                    ResourceTypeName: 'Records',
+                    ResourceName: null,
+                    ResourceRecordID: this.RecordID,
+                    ActionsSummary: this.actionsSummary(),
+                    ExtraConfiguration: { AccessControlRuleID: this.ID, EntityID: this.EntityID },
+                };
+            });
+        }
+        return saved;
+    }
+    actionsSummary() {
+        return buildActionsSummary({
+            view: this.CanRead,
+            create: this.CanCreate,
+            edit: this.CanUpdate,
+            delete: this.CanDelete,
+            share: this.CanShare,
+        });
+    }
+};
+MJAccessControlRuleEntityExtended = __decorate([
+    RegisterClass(BaseEntity, 'MJ: Access Control Rules')
+], MJAccessControlRuleEntityExtended);
+export { MJAccessControlRuleEntityExtended };
+/** Tree-shaking prevention — referenced from the custom/Permissions barrel. */
+export function LoadMJAccessControlRuleEntityExtended() {
+    // intentionally empty
+}
+//# sourceMappingURL=MJAccessControlRuleEntityExtended.js.map

package/dist/custom/Permissions/MJAccessControlRuleEntityExtended.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJAccessControlRuleEntityExtended.js","sourceRoot":"","sources":["../../../src/custom/Permissions/MJAccessControlRuleEntityExtended.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAqB,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACH,mBAAmB,EACnB,0BAA0B,EAC1B,kCAAkC,GACrC,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;;GAWG;AAEI,IAAM,iCAAiC,GAAvC,MAAM,iCAAkC,SAAQ,yBAAyB;IACnE,gBAAgB,CAAC,IAA0B,EAAE,UAAmB;QACrE,IAAI,IAAI,KAAK,oBAAoB,CAAC,MAAM,IAAI,IAAI,KAAK,oBAAoB,CAAC,MAAM,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,IAAI,IAAI,IAAI,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpF,CAAC;QACD,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,OAA2B;QAC3C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACR,MAAM,kCAAkC,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE;gBACrG,mDAAmD;gBACnD,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS;oBAAE,OAAO,IAAI,CAAC;gBAEhE,MAAM,UAAU,GAAG,IAAI,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxF,OAAO;oBACH,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,IAAI,CAAC,kBAAkB;oBACpC,aAAa,EAAE,SAAS;oBACxB,aAAa,EAAE,IAAI,CAAC,SAAS;oBAC7B,iBAAiB,EAAE,UAAU,EAAE,IAAI,IAAI,QAAQ;oBAC/C,gBAAgB,EAAE,SAAS;oBAC3B,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,IAAI,CAAC,QAAQ;oBAC/B,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;oBACrC,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;iBAChF,CAAC;YACN,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,cAAc;QAClB,OAAO,mBAAmB,CAAC;YACvB,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,KAAK,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC,CAAC;IACP,CAAC;CACJ,CAAA;AA5CY,iCAAiC;IAD7C,aAAa,CAAC,UAAU,EAAE,0BAA0B,CAAC;GACzC,iCAAiC,CA4C7C;;AAED,+EAA+E;AAC/E,MAAM,UAAU,qCAAqC;IACjD,sBAAsB;AAC1B,CAAC"}

package/dist/custom/Permissions/MJArtifactPermissionEntityExtended.d.ts

@@ -0,0 +1,22 @@
+import { EntityPermissionType, EntitySaveOptions } from '@memberjunction/core';
+import { MJArtifactPermissionEntity } from '../../generated/entity_subclasses.js';
+/**
+ * Extended Artifact Permission entity — same dual-purpose pattern as
+ * {@link MJDashboardPermissionEntityExtended}. See that class for rationale.
+ */
+export declare class MJArtifactPermissionEntityExtended extends MJArtifactPermissionEntity {
+    CheckPermissions(type: EntityPermissionType, throwError: boolean): boolean;
+    Save(options?: EntitySaveOptions): Promise<boolean>;
+    private actionsSummary;
+    /**
+     * Authorization for CREATING a new ArtifactPermission row.
+     * Same pattern as MJDashboardPermissionEntityExtended.callerMayShareDashboard
+     * but without an in-memory engine — we fetch the artifact and the caller's
+     * existing grant row directly.
+     */
+    private callerMayShareArtifact;
+    private fetchArtifactName;
+}
+/** Tree-shaking prevention — referenced from the custom/Permissions barrel. */
+export declare function LoadMJArtifactPermissionEntityExtended(): void;
+//# sourceMappingURL=MJArtifactPermissionEntityExtended.d.ts.map

package/dist/custom/Permissions/MJArtifactPermissionEntityExtended.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJArtifactPermissionEntityExtended.d.ts","sourceRoot":"","sources":["../../../src/custom/Permissions/MJArtifactPermissionEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,oBAAoB,EAAE,iBAAiB,EAAW,MAAM,sBAAsB,CAAC;AAGpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAQ/E;;;GAGG;AACH,qBACa,kCAAmC,SAAQ,0BAA0B;IACrE,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO;IAQpE,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAgClE,OAAO,CAAC,cAAc;IAStB;;;;;OAKG;YACW,sBAAsB;YA6BtB,iBAAiB;CAWlC;AAED,+EAA+E;AAC/E,wBAAgB,sCAAsC,IAAI,IAAI,CAE7D"}

package/dist/custom/Permissions/MJArtifactPermissionEntityExtended.js

@@ -0,0 +1,114 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { BaseEntity, EntityPermissionType, RunView } from '@memberjunction/core';
+import { RegisterClass, UUIDsEqual } from '@memberjunction/global';
+import { MJArtifactPermissionEntity } from '../../generated/entity_subclasses.js';
+import { assertCallerMayCreateShare, buildActionsSummary, checkShareManagePermission, dispatchShareNotificationAfterSave, } from './BaseShareEntityExtended.js';
+/**
+ * Extended Artifact Permission entity — same dual-purpose pattern as
+ * {@link MJDashboardPermissionEntityExtended}. See that class for rationale.
+ */
+let MJArtifactPermissionEntityExtended = class MJArtifactPermissionEntityExtended extends MJArtifactPermissionEntity {
+    CheckPermissions(type, throwError) {
+        if (type === EntityPermissionType.Update || type === EntityPermissionType.Delete) {
+            const user = this.ActiveUser;
+            if (user && checkShareManagePermission(user, this.SharedByUserID))
+                return true;
+        }
+        return super.CheckPermissions(type, throwError);
+    }
+    async Save(options) {
+        const isNewShare = !this.IsSaved;
+        const allowed = await assertCallerMayCreateShare(this, isNewShare, () => this.callerMayShareArtifact(), 'Only the artifact owner or someone with Share permission on this artifact can create a new share.');
+        if (!allowed)
+            return false;
+        const saved = await super.Save(options);
+        if (saved) {
+            await dispatchShareNotificationAfterSave(this, isNewShare, this.SharedByUserID, async (provider, grantorId) => {
+                // The Artifact view doesn't denormalize Name onto the permission row — look it up.
+                const artifactName = await this.fetchArtifactName();
+                return {
+                    Provider: provider,
+                    ContextUser: this.ContextCurrentUser,
+                    GrantorUserID: grantorId,
+                    GranteeUserID: this.UserID,
+                    ResourceTypeLabel: 'Artifact',
+                    ResourceTypeName: 'Artifacts',
+                    ResourceName: artifactName,
+                    ResourceRecordID: this.ArtifactID,
+                    ActionsSummary: this.actionsSummary(),
+                    ExtraConfiguration: { PermissionID: this.ID },
+                };
+            });
+        }
+        return saved;
+    }
+    actionsSummary() {
+        return buildActionsSummary({
+            view: this.CanRead,
+            edit: this.CanEdit,
+            delete: this.CanDelete,
+            share: this.CanShare,
+        });
+    }
+    /**
+     * Authorization for CREATING a new ArtifactPermission row.
+     * Same pattern as MJDashboardPermissionEntityExtended.callerMayShareDashboard
+     * but without an in-memory engine — we fetch the artifact and the caller's
+     * existing grant row directly.
+     */
+    async callerMayShareArtifact() {
+        const user = this.ContextCurrentUser;
+        if (!user)
+            return false;
+        const rv = new RunView();
+        // One round-trip: fetch the artifact's owner AND any existing Share-capable
+        // permission row for this caller on this artifact.
+        const [ownerResult, grantResult] = await rv.RunViews([
+            {
+                EntityName: 'MJ: Artifacts',
+                ExtraFilter: `ID='${this.ArtifactID}'`,
+                Fields: ['ID', 'UserID'],
+                MaxRows: 1,
+                ResultType: 'simple',
+            },
+            {
+                EntityName: 'MJ: Artifact Permissions',
+                ExtraFilter: `ArtifactID='${this.ArtifactID}' AND UserID='${user.ID}' AND CanShare=1`,
+                Fields: ['ID'],
+                MaxRows: 1,
+                ResultType: 'simple',
+            },
+        ]);
+        const ownerId = ownerResult.Success
+            ? ownerResult.Results?.[0]?.UserID
+            : undefined;
+        if (ownerId && UUIDsEqual(ownerId, user.ID))
+            return true;
+        return grantResult.Success && (grantResult.Results?.length ?? 0) > 0;
+    }
+    async fetchArtifactName() {
+        const rv = new RunView();
+        const result = await rv.RunView({
+            EntityName: 'MJ: Artifacts',
+            ExtraFilter: `ID='${this.ArtifactID}'`,
+            Fields: ['ID', 'Name'],
+            MaxRows: 1,
+            ResultType: 'simple',
+        });
+        return result.Success ? result.Results?.[0]?.Name ?? null : null;
+    }
+};
+MJArtifactPermissionEntityExtended = __decorate([
+    RegisterClass(BaseEntity, 'MJ: Artifact Permissions')
+], MJArtifactPermissionEntityExtended);
+export { MJArtifactPermissionEntityExtended };
+/** Tree-shaking prevention — referenced from the custom/Permissions barrel. */
+export function LoadMJArtifactPermissionEntityExtended() {
+    // intentionally empty
+}
+//# sourceMappingURL=MJArtifactPermissionEntityExtended.js.map

package/dist/custom/Permissions/MJArtifactPermissionEntityExtended.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJArtifactPermissionEntityExtended.js","sourceRoot":"","sources":["../../../src/custom/Permissions/MJArtifactPermissionEntityExtended.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAqB,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EACH,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,EAC1B,kCAAkC,GACrC,MAAM,2BAA2B,CAAC;AAEnC;;;GAGG;AAEI,IAAM,kCAAkC,GAAxC,MAAM,kCAAmC,SAAQ,0BAA0B;IACrE,gBAAgB,CAAC,IAA0B,EAAE,UAAmB;QACrE,IAAI,IAAI,KAAK,oBAAoB,CAAC,MAAM,IAAI,IAAI,KAAK,oBAAoB,CAAC,MAAM,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,IAAI,IAAI,IAAI,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC;gBAAE,OAAO,IAAI,CAAC;QACnF,CAAC;QACD,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,OAA2B;QAC3C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC5C,IAAI,EACJ,UAAU,EACV,GAAG,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,EACnC,mGAAmG,CACtG,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAE3B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACR,MAAM,kCAAkC,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE;gBAC1G,mFAAmF;gBACnF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACpD,OAAO;oBACH,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,IAAI,CAAC,kBAAkB;oBACpC,aAAa,EAAE,SAAS;oBACxB,aAAa,EAAE,IAAI,CAAC,MAAM;oBAC1B,iBAAiB,EAAE,UAAU;oBAC7B,gBAAgB,EAAE,WAAW;oBAC7B,YAAY,EAAE,YAAY;oBAC1B,gBAAgB,EAAE,IAAI,CAAC,UAAU;oBACjC,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;oBACrC,kBAAkB,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE;iBAChD,CAAC;YACN,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,cAAc;QAClB,OAAO,mBAAmB,CAAC;YACvB,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,KAAK,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC,CAAC;IACP,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,sBAAsB;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,4EAA4E;QAC5E,mDAAmD;QACnD,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;YACjD;gBACI,UAAU,EAAE,eAAe;gBAC3B,WAAW,EAAE,OAAO,IAAI,CAAC,UAAU,GAAG;gBACtC,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACxB,OAAO,EAAE,CAAC;gBACV,UAAU,EAAE,QAAQ;aACvB;YACD;gBACI,UAAU,EAAE,0BAA0B;gBACtC,WAAW,EAAE,eAAe,IAAI,CAAC,UAAU,iBAAiB,IAAI,CAAC,EAAE,kBAAkB;gBACrF,MAAM,EAAE,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,CAAC;gBACV,UAAU,EAAE,QAAQ;aACvB;SACJ,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO;YAC/B,CAAC,CAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAqC,EAAE,MAAM;YACvE,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,OAAO,WAAW,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC3B,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAuC;YAClE,UAAU,EAAE,eAAe;YAC3B,WAAW,EAAE,OAAO,IAAI,CAAC,UAAU,GAAG;YACtC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;YACtB,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,QAAQ;SACvB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;CACJ,CAAA;AAhGY,kCAAkC;IAD9C,aAAa,CAAC,UAAU,EAAE,0BAA0B,CAAC;GACzC,kCAAkC,CAgG9C;;AAED,+EAA+E;AAC/E,MAAM,UAAU,sCAAsC;IAClD,sBAAsB;AAC1B,CAAC"}

package/dist/custom/Permissions/MJCollectionPermissionEntityExtended.d.ts

@@ -0,0 +1,25 @@
+import { EntityPermissionType, EntitySaveOptions } from '@memberjunction/core';
+import { MJCollectionPermissionEntity } from '../../generated/entity_subclasses.js';
+/**
+ * Extended Collection Permission entity — same dual-purpose pattern as
+ * {@link MJDashboardPermissionEntityExtended}. See that class for rationale.
+ *
+ * Note: Collections have no entry in the `MJ: Resource Type` catalog, so
+ * `ResourceTypeName` is omitted and the notification's `ResourceTypeID` is
+ * left null. The bell icon still shows the title/message; click-through
+ * deep-linking can be added later if a Collection ResourceType is seeded.
+ */
+export declare class MJCollectionPermissionEntityExtended extends MJCollectionPermissionEntity {
+    CheckPermissions(type: EntityPermissionType, throwError: boolean): boolean;
+    Save(options?: EntitySaveOptions): Promise<boolean>;
+    private actionsSummary;
+    /**
+     * Authorization for CREATING a new CollectionPermission row. Caller must
+     * be the collection owner or hold an existing Share-capable grant. Same
+     * two-query pattern as {@link MJArtifactPermissionEntityExtended.callerMayShareArtifact}.
+     */
+    private callerMayShareCollection;
+}
+/** Tree-shaking prevention — referenced from the custom/Permissions barrel. */
+export declare function LoadMJCollectionPermissionEntityExtended(): void;
+//# sourceMappingURL=MJCollectionPermissionEntityExtended.d.ts.map

package/dist/custom/Permissions/MJCollectionPermissionEntityExtended.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MJCollectionPermissionEntityExtended.d.ts","sourceRoot":"","sources":["../../../src/custom/Permissions/MJCollectionPermissionEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,oBAAoB,EAAE,iBAAiB,EAAW,MAAM,sBAAsB,CAAC;AAGpG,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAQjF;;;;;;;;GAQG;AACH,qBACa,oCAAqC,SAAQ,4BAA4B;IACzE,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO;IAQpE,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IA4BlE,OAAO,CAAC,cAAc;IAStB;;;;OAIG;YACW,wBAAwB;CA0BzC;AAED,+EAA+E;AAC/E,wBAAgB,wCAAwC,IAAI,IAAI,CAE/D"}