From 25713a4e5796a27590aaf6ea0cddb18046b2433a Mon Sep 17 00:00:00 2001
From: "Mericio \"Hablo\" Salazar"
 <218162243+simihablo@users.noreply.github.com>
Date: Fri, 7 Aug 2026 09:35:24 -0500
Subject: [PATCH 01/13] fix(schemas): derive every wire shape from
 @meshery/schemas, repair three drifts

Full schema-consumer audit of sistent. Every local declaration of a
meshery/schemas-owned construct is now derived from the canonical type instead
of hand-copied, and three shapes that had already drifted off the wire are
repaired.

Sistent is upstream of Meshery UI, Layer5 Cloud UI and Kanvas, so a shape
copied here propagates to all of them and an upstream rename arrives as a
silent `undefined` rather than an error.

Live defects fixed
- ShareModal posted `{grant_access, revoke_access, notify_users}` with
  `{actor_id, actor_type}` actors. meshery-cloud flipped that contract to
  `{grantAccess, revokeAccess, notifyUsers}` / `{actorId, actorType}` on
  2026-04-28 and decodes it with a strict `json.Unmarshal` into `omitempty`
  structs, then answers 200 regardless - so every share since has reported
  success and granted nothing. The payload now has its own module with a test
  pinning the literal key names.
- TeamTable's bulk-delete read `teamId` / `team_name` off a team record. Neither
  field exists: meshery-cloud aliases its Team straight to the canonical v1beta2
  construct, which identifies by `id` / `name`. Both pushed `undefined`.
- WorkspaceCard typed a workspace `id` as `number` where the canonical is a uuid
  string, and Pattern typed `createdAt` / `updatedAt` as `Date` where the wire
  carries RFC 3339 strings - the two read sites had grown `.toString()` calls to
  paper over it.

Also removes `src/types/meshery-schemas.d.ts`, three ambient `declare module`s
that shadowed the canonical subpath declarations with a mapping to a *different*
version's schema object; the package exports `./constructs/*` with types and this
repo resolves with `moduleResolution: "bundler"`, so they were redundant and
wrong. Fixes two MUI v7 prop removals (`imgProps`, `secondaryTypographyProps`)
surfaced by the dts build along the way.

Guards, each proven to fail against its own defect first:
- src/__testing__/resourceAccessPayload.test.ts pins the share payload keys.
- src/__testing__/schemaConstructAliasTypes.test.ts compiles a fixture that
  asserts every omitted or narrowed key still exists on its canonical construct
  - `Omit<T, 'gone'>` where `T` lacks `gone` is a silent no-op, so deriving from
  the canonical does not by itself survive the rename it guards against.

Kept deliberately narrower, each with a filed upstream issue linked from the
type's doc comment: meshery/schemas#1142 (catalogData declares `class` /
`snapshotURL`; every server emits `contentClass` / `imageURL`), #1143
(v1beta3 getTeamsOfWorkspace still $refs the snake_case v1beta1 TeamPage),
`avatarUrl`).

Adds `buildGrantAccessPayload`, `buildRevokeAccessPayload`,
`toResourceAccessActors` and their types to the public API so hosts stop
hand-rolling the body that caused the share bug.

Signed-off-by: Mericio "Hablo" Salazar <218162243+simihablo@users.noreply.github.com>
---
 AGENTS.md                                     |  28 +++
 .../fixtures/schemaConstructAliases.ts        | 176 ++++++++++++++++++
 .../tsconfig.schemaConstructAliases.json      |   7 +
 src/__testing__/resourceAccessPayload.test.ts |  89 +++++++++
 .../schemaConstructAliasTypes.test.ts         |  82 ++++++++
 src/custom/CatalogDetail/UserInfo.tsx         |   8 +-
 src/custom/CatalogDetail/types.ts             |  24 ++-
 src/custom/CustomCatalog/CustomCard.tsx       |  95 +++++++---
 .../WorkspaceActivityWidget.tsx               |  24 ++-
 src/custom/ShareModal/ShareModal.tsx          |  57 +++---
 src/custom/ShareModal/index.tsx               |   7 +
 .../ShareModal/resourceAccessPayload.ts       |  52 ++++++
 .../TeamTable/TeamTableConfiguration.tsx      |  19 +-
 src/custom/Workspaces/WorkspaceCard.tsx       |  42 +++--
 .../Workspaces/WorkspaceContentMoveModal.tsx  |   9 +-
 .../WorkspaceEnvironmentSelection.tsx         |   9 +-
 .../WorkspaceRecentActivityModal.tsx          |  31 ++-
 src/custom/Workspaces/types.ts                |  81 +++++---
 src/index.tsx                                 |  15 ++
 src/types/meshery-schemas.d.ts                |  17 --
 src/utils/user.ts                             |  50 +++--
 21 files changed, 736 insertions(+), 186 deletions(-)
 create mode 100644 src/__testing__/fixtures/schemaConstructAliases.ts
 create mode 100644 src/__testing__/fixtures/tsconfig.schemaConstructAliases.json
 create mode 100644 src/__testing__/resourceAccessPayload.test.ts
 create mode 100644 src/__testing__/schemaConstructAliasTypes.test.ts
 create mode 100644 src/custom/ShareModal/resourceAccessPayload.ts
 delete mode 100644 src/types/meshery-schemas.d.ts

diff --git a/AGENTS.md b/AGENTS.md
index 5f60a3ded..30cc5f208 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -146,6 +146,34 @@ sheet's human-readable category + function text, while the UUID is stable. Editi
 typo fix, a plural made singular - renames the exported constant and orphans the old one. That is how
 `1.3.35 -> 1.3.36` renamed 10 keys with every UUID unchanged, in a patch release.
 
+## Wire shapes are derived from `@meshery/schemas`, never re-declared
+
+Any type that is decoded from or encoded to a Meshery/Layer5 API is owned by `meshery/schemas`.
+Sistent is upstream of every Meshery UI, so a shape hand-copied here propagates to all of them and a
+rename upstream reaches consumers as a silent `undefined` rather than an error. Derive from the
+canonical construct instead - `import type { components } from '@meshery/schemas/constructs/<ver>/<c>/<C>'`
+- and express any divergence as an explicit `Pick`/`Omit`/`&` carrying the reason.
+
+**`Omit<T, 'gone'>` where `T` has no `gone` is a silent no-op**, so derivation alone does not survive
+the rename it was adopted to catch: the omit stops removing anything and the override quietly becomes
+an addition. [`src/__testing__/fixtures/schemaConstructAliases.ts`](src/__testing__/fixtures/schemaConstructAliases.ts)
+closes that by asserting every omitted/narrowed key still exists upstream, and is the source of truth
+for which local types are bound to which construct and why each divergence is kept. Read it before
+adding or widening one. It is compiled by a `tsc` guard, not by `jest` - see the `tsc`-over-a-fixture
+note under "Repo state that looks broken but is pre-existing".
+
+When the canonical is the wrong one, keep the narrower local shape, link a filed `meshery/schemas`
+issue from the type's doc comment, and verify the claim against the actual server struct before
+filing - open examples: [#1142](https://github.com/meshery/schemas/issues/1142) (catalog data),
+[#1143](https://github.com/meshery/schemas/issues/1143), [#1144](https://github.com/meshery/schemas/issues/1144)
+(share/revoke), [#1145](https://github.com/meshery/schemas/issues/1145).
+
+A wire mismatch here is not loud. meshery-cloud decodes request bodies with a strict `json.Unmarshal`
+into `omitempty` structs and still answers 200, so a stale outbound key name is a successful no-op -
+which is how sistent's share modal granted nothing for three months after the Phase 4 camelCase flip.
+Outbound payload shapes therefore get their own module and a test pinning the literal key names, as
+[`src/custom/ShareModal/resourceAccessPayload.ts`](src/custom/ShareModal/resourceAccessPayload.ts) does.
+
 ## `disabled` on a MUI `MenuItem` does not stop a click
 
 MUI enforces `disabled` on non-`<button>` elements (a `MenuItem` renders `<li>`) purely with
diff --git a/src/__testing__/fixtures/schemaConstructAliases.ts b/src/__testing__/fixtures/schemaConstructAliases.ts
new file mode 100644
index 000000000..a0acf5352
--- /dev/null
+++ b/src/__testing__/fixtures/schemaConstructAliases.ts
@@ -0,0 +1,176 @@
+// Type-level fixture for sistent's aliases of `@meshery/schemas` constructs.
+// It is compiled by `schemaConstructAliasTypes.test.ts` via `tsc --noEmit`,
+// never executed, and is deliberately outside jest's `*.test.*` glob so jest
+// does not collect it.
+//
+// Sistent is upstream of every Meshery UI, so a schemas-owned shape copied here
+// propagates to all of them. The local types are therefore derived from the
+// canonical constructs with `Pick` / `Omit` rather than re-declared - but that
+// derivation has a hole this fixture exists to close:
+//
+//   `Omit<T, 'gone'>` where `T` has no `gone` is not an error. It is a no-op.
+//
+// So when a construct renames a field that sistent overrides, the `Omit` stops
+// removing anything, the intersected override silently becomes an *addition* of
+// a field the wire no longer carries, and nothing anywhere fails. That is the
+// same silent-rename failure the derivation was adopted to prevent.
+//
+// `RequiresKey` closes it: every key sistent omits or narrows is asserted to
+// still exist on the canonical type it was taken from.
+import type { components as DesignComponents } from '@meshery/schemas/constructs/v1beta3/design/Design';
+import type { components as EnvironmentComponents } from '@meshery/schemas/constructs/v1beta3/environment/Environment';
+import type { components as EventComponents } from '@meshery/schemas/constructs/v1beta3/event/Event';
+import type { components as TeamComponents } from '@meshery/schemas/constructs/v1beta2/team/Team';
+import type { components as UserComponents } from '@meshery/schemas/constructs/v1beta3/user/User';
+import type { components as WorkspaceComponents } from '@meshery/schemas/constructs/v1beta3/workspace/Workspace';
+import type { UserProfile } from '../../custom/CatalogDetail/types';
+import type { Pattern } from '../../custom/CustomCatalog/CustomCard';
+import type { Environment, Team, Workspace } from '../../custom/Workspaces/types';
+import type { User } from '../../utils/user';
+
+/**
+ * Resolves to `K` only while every key in `K` exists on `T`. Used as
+ * `type _ = RequiresKey<Canonical, 'someKey'>`, which stops compiling the
+ * moment `someKey` leaves the canonical construct.
+ */
+type RequiresKey<T, K extends keyof T> = K;
+
+/**
+ * `true` only while `T` and `U` are the same type, in both directions.
+ *
+ * Paired with {@link Expect}, which is what turns a mismatch into a compiler
+ * error: a bare conditional type that resolves to `never` or `false` is a
+ * perfectly legal type alias and reports nothing.
+ */
+type IsExact<T, U> = [T] extends [U] ? ([U] extends [T] ? true : false) : false;
+
+/** Compiles only when handed `true`; anything else is a TS2344 constraint error. */
+type Expect<T extends true> = T;
+
+type CanonicalWorkspace = WorkspaceComponents['schemas']['Workspace'];
+type CanonicalEnvironment = EnvironmentComponents['schemas']['Environment'];
+type CanonicalTeam = TeamComponents['schemas']['Team'];
+type CanonicalSearchableUser = UserComponents['schemas']['SearchableUser'];
+type CanonicalPattern = DesignComponents['schemas']['MesheryPattern'];
+type CanonicalEventResult = EventComponents['schemas']['EventResult'];
+type CanonicalEventsPage = EventComponents['schemas']['EventsPage'];
+
+// --- Keys sistent omits or narrows, asserted to still exist upstream --------
+
+export type WorkspaceOverrides = RequiresKey<
+  CanonicalWorkspace,
+  'organizationId' | 'deletedAt' | 'id' | 'name' | 'description' | 'createdAt' | 'updatedAt'
+>;
+
+export type EnvironmentOverrides = RequiresKey<
+  CanonicalEnvironment,
+  'createdAt' | 'updatedAt' | 'id' | 'name'
+>;
+
+export type TeamOverrides = RequiresKey<CanonicalTeam, 'deletedAt' | 'id' | 'name'>;
+
+export type UserOverrides = RequiresKey<
+  CanonicalSearchableUser,
+  'id' | 'deletedAt' | 'userId' | 'username' | 'firstName' | 'lastName' | 'email' | 'avatarUrl'
+>;
+
+export type PatternOverrides = RequiresKey<
+  CanonicalPattern,
+  | 'id'
+  | 'userId'
+  | 'patternFile'
+  | 'name'
+  | 'visibility'
+  | 'catalogData'
+  | 'user'
+  | 'createdAt'
+  | 'updatedAt'
+>;
+
+export type EventResultOverrides = RequiresKey<
+  CanonicalEventResult,
+  'createdAt' | 'description' | 'firstName' | 'lastName'
+>;
+
+export type EventsPageOverrides = RequiresKey<CanonicalEventsPage, 'page' | 'totalCount'>;
+
+export type UserProfileOverrides = RequiresKey<
+  CanonicalSearchableUser,
+  'firstName' | 'lastName' | 'avatarUrl'
+>;
+
+// --- Fields carried through unchanged, asserted to be the canonical types ---
+//
+// A widened override that later drifts (say `createdAt` typed `Date` again, the
+// defect this audit found on `Pattern`) shows up here as a type mismatch.
+
+export type WorkspaceTimestampsAreCanonical = Expect<
+  IsExact<Workspace['createdAt'], CanonicalWorkspace['createdAt']>
+>;
+
+export type PatternCreatedAtIsCanonical = Expect<
+  IsExact<Pattern['createdAt'], CanonicalPattern['createdAt']>
+>;
+
+export type PatternUpdatedAtIsCanonical = Expect<
+  IsExact<Pattern['updatedAt'], CanonicalPattern['updatedAt']>
+>;
+
+export type PatternCountsAreCanonical = Expect<
+  IsExact<Pattern['downloadCount'], CanonicalPattern['downloadCount']>
+>;
+
+export type EnvironmentOrgIdIsCanonical = Expect<
+  IsExact<Environment['organizationId'], CanonicalEnvironment['organizationId']>
+>;
+
+export type TeamNameIsCanonical = Expect<IsExact<Team['name'], CanonicalTeam['name']>>;
+
+export type UserEmailIsCanonical = Expect<
+  IsExact<User['email'], CanonicalSearchableUser['email']>
+>;
+
+export type UserProfileAvatarIsCanonical = Expect<
+  IsExact<UserProfile['avatarUrl'], NonNullable<CanonicalSearchableUser['avatarUrl']>>
+>;
+
+// Self-check for the pair above: `Expect` is the half that reports, and a
+// mismatch it fails to catch is invisible. If `IsExact` ever stops discriminating
+// - or `Expect` stops constraining - this suppression goes unused and tsc
+// reports TS2578.
+// @ts-expect-error - a workspace id is a string, not a number
+export type ExpectRejectsAMismatch = Expect<IsExact<CanonicalWorkspace['id'], number>>;
+
+// --- Fields the canonical does NOT model, asserted to stay absent ------------
+//
+// `teamId` / `team_name` were read off a team record by the bulk-delete button
+// and never existed on the wire. If a future schemas release does introduce
+// them, this suppression goes unused and tsc reports TS2578, which is the
+// signal to consume the canonical field instead of the `id` / `name` fallback.
+// @ts-expect-error - the canonical team construct has no `teamId`
+export type TeamHasNoTeamId = RequiresKey<CanonicalTeam, 'teamId'>;
+
+// --- Subpath resolution, formerly propped up by a local ambient shim --------
+//
+// `src/types/meshery-schemas.d.ts` used to `declare module` these three
+// subpaths, asserting each resolved to the *v1beta1* schema object - so the
+// canonical `.d.ts` shipped in the package was shadowed by a hand-written
+// mapping to a different version's type. `@meshery/schemas` exports
+// `./constructs/*` with types, and this repo resolves with
+// `moduleResolution: "bundler"`, so the shim was both redundant and wrong; it
+// was deleted. These imports keep the resolution it was covering asserted.
+export type ModelSchemaResolves = typeof import(
+  '@meshery/schemas/constructs/v1beta2/model/ModelSchema'
+).default;
+export type EnvironmentSchemaResolves = typeof import(
+  '@meshery/schemas/constructs/v1beta3/environment/EnvironmentSchema'
+).default;
+export type WorkspaceSchemaResolves = typeof import(
+  '@meshery/schemas/constructs/v1beta3/workspace/WorkspaceSchema'
+).default;
+
+// Self-check: if the compiler ever stops type-checking this fixture, the
+// suppression below goes unused and tsc reports TS2578 here, failing the test
+// rather than letting it pass vacuously.
+// @ts-expect-error - `definitelyNotAField` is not a key of the workspace construct
+export type FixtureIsChecked = RequiresKey<CanonicalWorkspace, 'definitelyNotAField'>;
diff --git a/src/__testing__/fixtures/tsconfig.schemaConstructAliases.json b/src/__testing__/fixtures/tsconfig.schemaConstructAliases.json
new file mode 100644
index 000000000..72780dae2
--- /dev/null
+++ b/src/__testing__/fixtures/tsconfig.schemaConstructAliases.json
@@ -0,0 +1,7 @@
+{
+  "extends": "../../../tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true
+  },
+  "include": ["./schemaConstructAliases.ts"]
+}
diff --git a/src/__testing__/resourceAccessPayload.test.ts b/src/__testing__/resourceAccessPayload.test.ts
new file mode 100644
index 000000000..fc20633f6
--- /dev/null
+++ b/src/__testing__/resourceAccessPayload.test.ts
@@ -0,0 +1,89 @@
+import {
+  buildGrantAccessPayload,
+  buildRevokeAccessPayload,
+  toResourceAccessActors
+} from '../custom/ShareModal/resourceAccessPayload';
+
+// Wire-contract guard for the resource share / revoke payload that
+// `ShareModal` posts to `POST /api/resources/{type}/{id}/share` (via the
+// host-supplied `resourceAccessMutator`).
+//
+// The server model is meshery-cloud's `models.ResourceAccessMappingPayload`,
+// which decodes with a strict `json.Unmarshal` into a struct whose fields all
+// carry `omitempty`. Every key it does not recognise is dropped silently and
+// the handler still answers 200 - so a stale key name here is not a visible
+// error, it is a share that reports success and grants nothing.
+//
+// meshery-cloud flipped this contract to canonical camelCase in
+// `fix(wire-format): flip Credential/Organization/Team/MesheryFilter/sibling
+// JSON tags to canonical camelCase (Phase 4 tail)`, which also renamed the
+// actor fields:
+//
+//   { grantAccess: [{ actorId, actorType }], revokeAccess: [...], notifyUsers }
+//
+// These assertions are deliberately written against literal key names rather
+// than a type: the failure mode is a runtime key mismatch that no TypeScript
+// type on either side of the boundary can observe (the mutator is `any`).
+
+const jane = {
+  id: 'b6e6d123-0000-4000-8000-000000000001',
+  firstName: 'Jane',
+  lastName: 'Doe',
+  email: 'jane@example.com'
+};
+
+// A record from a provider that predates the retirement of the `users.user_id`
+// column: the canonical `id` is absent and the deprecated alias carries it.
+const legacyAliasUser = {
+  userId: 'b6e6d123-0000-4000-8000-000000000002',
+  email: 'legacy@example.com'
+};
+
+describe('resource access mapping payload', () => {
+  describe('toResourceAccessActors', () => {
+    it('emits the canonical camelCase actor keys', () => {
+      expect(toResourceAccessActors([jane])).toEqual([
+        { actorId: jane.id, actorType: 'user' }
+      ]);
+    });
+
+    it('never emits the retired snake_case actor keys', () => {
+      const [actor] = toResourceAccessActors([jane]);
+      expect(Object.keys(actor).sort()).toEqual(['actorId', 'actorType']);
+    });
+
+    it('resolves the actor id through the canonical/legacy identifier fallback', () => {
+      expect(toResourceAccessActors([legacyAliasUser])).toEqual([
+        { actorId: legacyAliasUser.userId, actorType: 'user' }
+      ]);
+    });
+  });
+
+  describe('buildGrantAccessPayload', () => {
+    it('emits exactly the three canonical payload keys', () => {
+      expect(Object.keys(buildGrantAccessPayload([jane])).sort()).toEqual([
+        'grantAccess',
+        'notifyUsers',
+        'revokeAccess'
+      ]);
+    });
+
+    it('puts the actors on grantAccess and leaves revokeAccess empty', () => {
+      expect(buildGrantAccessPayload([jane])).toEqual({
+        grantAccess: [{ actorId: jane.id, actorType: 'user' }],
+        revokeAccess: [],
+        notifyUsers: true
+      });
+    });
+  });
+
+  describe('buildRevokeAccessPayload', () => {
+    it('puts the actors on revokeAccess and leaves grantAccess empty', () => {
+      expect(buildRevokeAccessPayload([jane])).toEqual({
+        grantAccess: [],
+        revokeAccess: [{ actorId: jane.id, actorType: 'user' }],
+        notifyUsers: true
+      });
+    });
+  });
+});
diff --git a/src/__testing__/schemaConstructAliasTypes.test.ts b/src/__testing__/schemaConstructAliasTypes.test.ts
new file mode 100644
index 000000000..e683b8df8
--- /dev/null
+++ b/src/__testing__/schemaConstructAliasTypes.test.ts
@@ -0,0 +1,82 @@
+import { spawnSync } from 'child_process';
+import path from 'path';
+
+// Type-level regression guard for sistent's aliases of `@meshery/schemas`
+// constructs. See `fixtures/schemaConstructAliases.ts` for what is asserted and
+// why - in short, `Omit<T, 'gone'>` where `T` has no `gone` is a silent no-op,
+// so deriving a local type from a canonical one does not by itself survive a
+// rename upstream.
+//
+// jest transforms with @swc/jest, which strips types without checking them, so
+// a plain type-only assertion file would pass no matter what it asserts. This
+// test therefore shells out to `tsc` over the fixture, exactly as
+// `navigationItemTitleTypes.test.ts` does; the two share their mechanics, and
+// the comments there explain each guard against the check turning vacuous.
+
+const FIXTURE = 'src/__testing__/fixtures/schemaConstructAliases.ts';
+const PROJECT = 'src/__testing__/fixtures/tsconfig.schemaConstructAliases.json';
+const repoRoot = path.resolve(__dirname, '..', '..');
+
+const FILE_SCOPED_DIAGNOSTIC = /^(.+?)\(\d+,\d+\): error TS\d+/;
+const CONFIG_SCOPED_DIAGNOSTIC = /^error TS\d+/;
+
+const asPosix = (value: string): string => value.replace(/\\/g, '/');
+
+type Diagnostics = { fixture: string[]; config: string[]; compiledFixture: boolean };
+
+const TSC_TIMEOUT_MS = 150_000;
+
+const typeCheckFixture = (): Diagnostics => {
+  const tsc = spawnSync(
+    process.execPath,
+    [require.resolve('typescript/bin/tsc'), '-p', PROJECT, '--pretty', 'false', '--listFiles'],
+    {
+      cwd: repoRoot,
+      encoding: 'utf8',
+      timeout: TSC_TIMEOUT_MS,
+      maxBuffer: 32 * 1024 * 1024
+    }
+  );
+
+  if (tsc.error) throw tsc.error;
+  if (tsc.status === null) {
+    throw new Error(`tsc was killed by ${tsc.signal ?? 'an unknown signal'} before reporting`);
+  }
+
+  const lines = `${tsc.stdout}\n${tsc.stderr}`.split('\n').map((line) => line.trim());
+
+  const belongsToFixture = (line: string): boolean => {
+    const file = FILE_SCOPED_DIAGNOSTIC.exec(line)?.[1];
+    return file !== undefined && asPosix(file).endsWith(FIXTURE);
+  };
+
+  return {
+    fixture: lines.filter(belongsToFixture),
+    config: lines.filter((line) => CONFIG_SCOPED_DIAGNOSTIC.test(line)),
+    compiledFixture: lines.some(
+      (line) => !FILE_SCOPED_DIAGNOSTIC.test(line) && asPosix(line).endsWith(FIXTURE)
+    )
+  };
+};
+
+describe('schemas construct alias contract', () => {
+  let diagnostics: Diagnostics;
+
+  beforeAll(() => {
+    diagnostics = typeCheckFixture();
+  }, 180_000);
+
+  // Ordered deliberately: the assertion below is only meaningful once the
+  // fixture is known to have been compiled, so prove that first.
+  it('compiles the fixture', () => {
+    expect(diagnostics.compiledFixture).toBe(true);
+  });
+
+  it('reports no config-level failure that would skip the fixture', () => {
+    expect(diagnostics.config).toEqual([]);
+  });
+
+  it('keeps every aliased local type bound to its canonical construct', () => {
+    expect(diagnostics.fixture).toEqual([]);
+  });
+});
diff --git a/src/custom/CatalogDetail/UserInfo.tsx b/src/custom/CatalogDetail/UserInfo.tsx
index 64c8626ce..725481b5b 100644
--- a/src/custom/CatalogDetail/UserInfo.tsx
+++ b/src/custom/CatalogDetail/UserInfo.tsx
@@ -56,11 +56,15 @@ const UserInfo: React.FC<UserInfoProps> = ({
       </ContentRow>
       <ContentRow>
         <ContentDetailsPoints>CREATED AT</ContentDetailsPoints>
-        <ContentDetailsText>{getFormatDate(details?.createdAt.toString())}</ContentDetailsText>
+        <ContentDetailsText>
+          {details?.createdAt ? getFormatDate(details.createdAt) : '-'}
+        </ContentDetailsText>
       </ContentRow>
       <ContentRow>
         <ContentDetailsPoints>UPDATED AT</ContentDetailsPoints>
-        <ContentDetailsText>{getFormatDate(details?.updatedAt.toString())}</ContentDetailsText>
+        <ContentDetailsText>
+          {details?.updatedAt ? getFormatDate(details.updatedAt) : '-'}
+        </ContentDetailsText>
       </ContentRow>
       {showVersion && (
         <ContentRow>
diff --git a/src/custom/CatalogDetail/types.ts b/src/custom/CatalogDetail/types.ts
index 37caf9af9..c35fcf9ce 100644
--- a/src/custom/CatalogDetail/types.ts
+++ b/src/custom/CatalogDetail/types.ts
@@ -1,8 +1,4 @@
-export interface User {
-  id: string;
-  firstName: string;
-  lastName: string;
-}
+import type { CanonicalSearchableUser } from '../../utils/user';
 
 export interface FilteredAcademyData {
   'learning-path'?: string[];
@@ -56,8 +52,16 @@ export type ContentClassType = {
   };
 };
 
-export type UserProfile = {
-  firstName: string;
-  lastName: string;
-  avatarUrl: string;
-};
+/**
+ * The design author as the catalog detail page renders them: the three fields
+ * of the canonical v1beta3 user collaboration projection that appear in the
+ * byline. Derived from {@link CanonicalSearchableUser} so a rename upstream is
+ * a compile error here rather than a blank byline downstream.
+ *
+ * Required rather than optional (the canonical marks all three optional,
+ * because reduced projections omit them) because the byline has no fallback:
+ * these values are rendered directly.
+ */
+export type UserProfile = Required<
+  Pick<CanonicalSearchableUser, 'firstName' | 'lastName' | 'avatarUrl'>
+>;
diff --git a/src/custom/CustomCatalog/CustomCard.tsx b/src/custom/CustomCatalog/CustomCard.tsx
index d16ab63a8..3ffe0a43a 100644
--- a/src/custom/CustomCatalog/CustomCard.tsx
+++ b/src/custom/CustomCatalog/CustomCard.tsx
@@ -1,3 +1,4 @@
+import type { components as DesignComponents } from '@meshery/schemas/constructs/v1beta3/design/Design';
 import CalendarMonthIcon from '@mui/icons-material/CalendarMonth';
 import React, { useEffect, useState } from 'react';
 import { Avatar, Grid2 } from '../../base';
@@ -37,7 +38,67 @@ export const DesignCardUrl = styled('a')(() => ({
   textDecoration: 'none'
 }));
 
-export interface Pattern {
+/** The canonical v1beta3 design (pattern) construct. */
+export type CanonicalPattern = DesignComponents['schemas']['MesheryPattern'];
+
+/**
+ * `catalogData` as it actually arrives on the wire.
+ *
+ * This is the one place sistent deliberately does *not* take the canonical
+ * shape, because the canonical is wrong here. Both servers marshal this object
+ * from meshkit's `models/catalog/v1alpha1.CatalogData`, whose JSON tags are
+ * `contentClass` and `imageURL` (the latter carries an explicit comment that it
+ * was kept at the legacy key name so stored catalog rows would not need
+ * rewriting). `@meshery/schemas` instead declares `class` and `snapshotURL`,
+ * neither of which is ever emitted - and its own Go models under
+ * `models/v1beta1/catalog` disagree again, tagging `pattern_caveats` /
+ * `pattern_info` in snake_case.
+ *
+ * Filed upstream as https://github.com/meshery/schemas/issues/1142. Repoint
+ * this at `CanonicalPattern['catalogData']` once that lands; until then the
+ * fields below are the verified contract and the canonical is not.
+ */
+export interface PatternCatalogData {
+  contentClass?: string;
+  imageURL?: string[];
+  compatibility?: string[];
+  publishedVersion?: string;
+  type?: string;
+  patternInfo?: string;
+  patternCaveats?: string;
+}
+
+/**
+ * A catalog design as the cards and the catalog detail page consume it.
+ *
+ * Derived from {@link CanonicalPattern} rather than re-declared: sistent is
+ * upstream of every Meshery UI, so a field renamed in the canonical construct
+ * has to fail here rather than reach consumers as `undefined`. The properties
+ * restated below are the deliberate divergences, each of them either a
+ * narrowing sistent relies on or a field the canonical does not model:
+ *
+ *  - `id`, `userId`, `patternFile`, `name`, `visibility` are required. The
+ *    canonical marks them optional because one schema doubles as both the read
+ *    projection and the create payload - `MesheryPatternPage.patterns[]`, which
+ *    is read-only, still types `id` and `name` optional. Every catalog read
+ *    carries them, and the cards index and link on `id`.
+ *  - `user`, `firstName`, `lastName`, `avatarUrl` are the joined author fields
+ *    the card renders. The canonical `user` is the full user construct; only
+ *    the two name fields are used here.
+ *  - `userData` is a host-assembled view model (the catalog page's author
+ *    sidebar), not a wire field of the design construct.
+ *  - `catalogData` - see {@link PatternCatalogData}.
+ *
+ * `createdAt` / `updatedAt` are inherited from the canonical as `string`. They
+ * were previously declared `Date`, which is not what the wire carries: the Go
+ * `time.Time` marshals to an RFC 3339 string, and the two call sites that read
+ * them had grown `.toString()` calls to paper over the mismatch.
+ */
+export interface Pattern
+  extends Omit<
+    CanonicalPattern,
+    'id' | 'userId' | 'patternFile' | 'name' | 'visibility' | 'catalogData' | 'user'
+  > {
   id: string;
   userId: string;
   patternFile: string;
@@ -49,11 +110,6 @@ export interface Pattern {
   lastName?: string;
   avatarUrl: string;
   name: string;
-  downloadCount: number;
-  cloneCount: number;
-  viewCount: number;
-  deploymentCount: number;
-  shareCount: number;
   userData?: {
     version?: string;
     avatarUrl?: string;
@@ -61,18 +117,8 @@ export interface Pattern {
     technologies?: string[];
     updatedAt?: string;
   };
-  catalogData?: {
-    contentClass?: string;
-    imageURL?: string[];
-    compatibility?: string[];
-    publishedVersion?: string;
-    type?: string;
-    patternInfo?: string;
-    patternCaveats?: string;
-  };
+  catalogData?: PatternCatalogData;
   visibility: string;
-  updatedAt: Date;
-  createdAt: Date;
 }
 
 type CatalogCardProps = {
@@ -303,14 +349,13 @@ const CustomCatalogCard: React.FC<CatalogCardProps> = ({
                     </div>
                     <DateText>
                       {' '}
-                      {new Date(pattern.updatedAt.toString().slice(0, 10)).toLocaleDateString(
-                        'en-US',
-                        {
-                          day: 'numeric',
-                          month: 'long',
-                          year: 'numeric'
-                        }
-                      )}
+                      {pattern.updatedAt
+                        ? new Date(pattern.updatedAt.slice(0, 10)).toLocaleDateString('en-US', {
+                            day: 'numeric',
+                            month: 'long',
+                            year: 'numeric'
+                          })
+                        : '-'}
                     </DateText>
                   </Grid2>
                 </Grid2>
diff --git a/src/custom/DashboardWidgets/WorkspaceActivityWidget.tsx b/src/custom/DashboardWidgets/WorkspaceActivityWidget.tsx
index 2460327d6..114ce4df1 100644
--- a/src/custom/DashboardWidgets/WorkspaceActivityWidget.tsx
+++ b/src/custom/DashboardWidgets/WorkspaceActivityWidget.tsx
@@ -1,3 +1,4 @@
+import type { components as EventComponents } from '@meshery/schemas/constructs/v1beta3/event/Event';
 import { SelectChangeEvent } from '@mui/material';
 import { styled } from '@mui/material/styles';
 import moment from 'moment';
@@ -18,16 +19,19 @@ import { iconMedium } from '../../constants/iconsSizes';
 import { WorkspaceIcon } from '../../icons';
 import { useTheme } from '../../theme';
 import { CustomTooltip } from '../CustomTooltip';
-
-interface Activity {
-  createdAt: string;
-  description: string;
-}
-
-interface Workspace {
-  id: string;
-  name: string;
-}
+import { CanonicalWorkspace } from '../Workspaces/types';
+
+// A row of the workspace activity feed, derived from the canonical v1beta3
+// `EventResult`. Required rather than optional because the widget renders each
+// value directly with no fallback.
+type Activity = Required<
+  Pick<EventComponents['schemas']['EventResult'], 'createdAt' | 'description'>
+>;
+
+// The workspace-selector projection: only the two fields this widget renders,
+// derived from the canonical v1beta3 construct so a rename upstream fails here
+// rather than silently rendering `undefined`.
+type Workspace = Pick<CanonicalWorkspace, 'id' | 'name'>;
 
 interface WorkspaceActivityCardProps {
   selectedWorkspace: string;
diff --git a/src/custom/ShareModal/ShareModal.tsx b/src/custom/ShareModal/ShareModal.tsx
index b68db4ab6..94263ffa8 100644
--- a/src/custom/ShareModal/ShareModal.tsx
+++ b/src/custom/ShareModal/ShareModal.tsx
@@ -28,6 +28,11 @@ import {
 import { CustomTooltip } from '../CustomTooltip';
 import { Modal, ModalBody, ModalButtonSecondary, ModalFooter } from '../Modal';
 import UserShareSearch from '../UserSearchField/UserSearchField';
+import {
+  ResourceAccessMappingPayload,
+  buildGrantAccessPayload,
+  buildRevokeAccessPayload
+} from './resourceAccessPayload';
 import {
   CustomDialogContentText,
   CustomListItemText,
@@ -86,7 +91,8 @@ const AccessListActor: React.FC<AccessListActorProps> = ({
         <Avatar
           alt={getUserDisplayName(actorData)}
           src={actorData.avatarUrl}
-          imgProps={{ referrerPolicy: 'no-referrer' }}
+          // MUI v7 replaced `imgProps` with the `img` slot.
+          slotProps={{ img: { referrerPolicy: 'no-referrer' } }}
           onClick={() => {
             if (hostURL) openInNewTab(`${hostURL}/user/${getUserIdentifier(actorData)}`);
           }}
@@ -95,9 +101,12 @@ const AccessListActor: React.FC<AccessListActorProps> = ({
       <ListItemText
         primary={getUserDisplayName(actorData)}
         secondary={getUserContactLabel(actorData)}
-        secondaryTypographyProps={{
-          sx: {
-            color: theme.palette.background.neutral?.pressed
+        // MUI v7 replaced `secondaryTypographyProps` with the `secondary` slot.
+        slotProps={{
+          secondary: {
+            sx: {
+              color: theme.palette.background.neutral?.pressed
+            }
           }
         }}
       />
@@ -162,11 +171,7 @@ type SelectedResources = SelectedResource | SelectedResource[];
 export type ResourceAccessArg = {
   resourceType: string;
   resourceId: string | string[];
-  resourceAccessMappingPayload: {
-    grant_access: string[];
-    revoke_access: string[];
-    notify_users: boolean;
-  };
+  resourceAccessMappingPayload: ResourceAccessMappingPayload;
 };
 
 interface ShareModalProps {
@@ -267,8 +272,8 @@ const ShareModal: React.FC<ShareModalProps> = ({
       return { error: 'no resource selected' };
     }
 
-    // Fail fast on records without a usable identifier: an empty actor_id
-    // would produce an invalid grant_access payload and a confusing
+    // Fail fast on records without a usable identifier: an empty actorId
+    // would produce an invalid grantAccess payload and a confusing
     // partial-share result.
     if (newUsers.some((user) => !getUserIdentifier(user))) {
       notify({
@@ -278,10 +283,6 @@ const ShareModal: React.FC<ShareModalProps> = ({
       return { error: 'missing user identifier' };
     }
 
-    const grantAccessList = newUsers.map((user) => ({
-      actor_id: getUserIdentifier(user),
-      actor_type: 'user'
-    }));
     const recipients = newUsers.map(getUserLabel);
 
     if (Array.isArray(selectedResource)) {
@@ -290,11 +291,7 @@ const ShareModal: React.FC<ShareModalProps> = ({
           resourceAccessMutator({
             resourceType,
             resourceId: resource.id,
-            resourceAccessMappingPayload: {
-              grant_access: [...grantAccessList],
-              revoke_access: [],
-              notify_users: true
-            }
+            resourceAccessMappingPayload: buildGrantAccessPayload(newUsers)
           })
         )
       );
@@ -321,11 +318,7 @@ const ShareModal: React.FC<ShareModalProps> = ({
     const response = await resourceAccessMutator({
       resourceType,
       resourceId: !Array.isArray(selectedResource) ? selectedResource.id : selectedResource[0].id,
-      resourceAccessMappingPayload: {
-        grant_access: [...grantAccessList],
-        revoke_access: [],
-        notify_users: true
-      }
+      resourceAccessMappingPayload: buildGrantAccessPayload(newUsers)
     });
 
     if (!response?.error) {
@@ -356,8 +349,8 @@ const ShareModal: React.FC<ShareModalProps> = ({
       return { error: 'no resource selected' };
     }
 
-    // Same guard as sharing: never issue a revoke_access entry with an
-    // empty actor_id.
+    // Same guard as sharing: never issue a revokeAccess entry with an
+    // empty actorId.
     if (revokedUsers.some((user) => !getUserIdentifier(user))) {
       notify({
         message: `Unable to revoke access to ${dataName}: the user record is missing its identifier`,
@@ -366,20 +359,12 @@ const ShareModal: React.FC<ShareModalProps> = ({
       return { error: 'missing user identifier' };
     }
 
-    const revokeAccessList = revokedUsers.map((user) => ({
-      actor_id: getUserIdentifier(user),
-      actor_type: 'user'
-    }));
     const revokees = revokedUsers.map(getUserLabel);
 
     const response = await resourceAccessMutator({
       resourceType,
       resourceId: !Array.isArray(selectedResource) ? selectedResource.id : selectedResource[0].id,
-      resourceAccessMappingPayload: {
-        grant_access: [],
-        revoke_access: [...revokeAccessList],
-        notify_users: true
-      }
+      resourceAccessMappingPayload: buildRevokeAccessPayload(revokedUsers)
     });
 
     if (!response?.error) {
diff --git a/src/custom/ShareModal/index.tsx b/src/custom/ShareModal/index.tsx
index 47ba38288..1eb789acc 100644
--- a/src/custom/ShareModal/index.tsx
+++ b/src/custom/ShareModal/index.tsx
@@ -1,3 +1,10 @@
 import ShareModal from './ShareModal';
 
 export { ShareModal };
+export {
+  buildGrantAccessPayload,
+  buildRevokeAccessPayload,
+  toResourceAccessActors,
+  type ResourceAccessActor,
+  type ResourceAccessMappingPayload
+} from './resourceAccessPayload';
diff --git a/src/custom/ShareModal/resourceAccessPayload.ts b/src/custom/ShareModal/resourceAccessPayload.ts
new file mode 100644
index 000000000..d0135db8b
--- /dev/null
+++ b/src/custom/ShareModal/resourceAccessPayload.ts
@@ -0,0 +1,52 @@
+import { User, getUserIdentifier } from '../../utils/user';
+
+/**
+ * The wire contract for `POST /api/resources/{resourceType}/{resourceId}/share`.
+ *
+ * This shape is owned by the server (meshery-cloud `HandleResourceShare` and
+ * its `models.ResourceAccessMappingPayload` / `models.Actor`) and is *not*
+ * modelled in `@meshery/schemas` today, so it cannot be aliased from there -
+ * see https://github.com/meshery/schemas/issues/1144. It is defined here, once,
+ * rather than inline at each call site precisely because the failure mode is
+ * invisible: the handler decodes with a strict `json.Unmarshal` into a struct
+ * whose fields all carry `omitempty`, drops every key it does not recognise,
+ * and still answers 200. A stale key name therefore produces a share that
+ * reports success and grants nothing.
+ *
+ * `src/__testing__/resourceAccessPayload.test.ts` pins the literal key names.
+ * Update both together, and only against the server model.
+ */
+export type ResourceAccessActor = {
+  /** Canonical identifier of the actor; a user id for `actorType: 'user'`. */
+  actorId: string;
+  actorType: 'user';
+};
+
+export interface ResourceAccessMappingPayload {
+  grantAccess: ResourceAccessActor[];
+  revokeAccess: ResourceAccessActor[];
+  notifyUsers: boolean;
+}
+
+/**
+ * Maps user records onto share actors, resolving each identifier through the
+ * canonical-then-legacy fallback in {@link getUserIdentifier}. Callers must
+ * reject records without an identifier before building a payload: an empty
+ * `actorId` is accepted by the server as a no-op entry.
+ */
+export const toResourceAccessActors = (users: User[]): ResourceAccessActor[] =>
+  users.map((user) => ({ actorId: getUserIdentifier(user), actorType: 'user' }));
+
+/** Payload that grants `users` access and notifies them. */
+export const buildGrantAccessPayload = (users: User[]): ResourceAccessMappingPayload => ({
+  grantAccess: toResourceAccessActors(users),
+  revokeAccess: [],
+  notifyUsers: true
+});
+
+/** Payload that revokes `users`' access and notifies them. */
+export const buildRevokeAccessPayload = (users: User[]): ResourceAccessMappingPayload => ({
+  grantAccess: [],
+  revokeAccess: toResourceAccessActors(users),
+  notifyUsers: true
+});
diff --git a/src/custom/TeamTable/TeamTableConfiguration.tsx b/src/custom/TeamTable/TeamTableConfiguration.tsx
index f73223db4..8221be154 100644
--- a/src/custom/TeamTable/TeamTableConfiguration.tsx
+++ b/src/custom/TeamTable/TeamTableConfiguration.tsx
@@ -22,10 +22,17 @@ import {
 import { Team } from '../Workspaces/types';
 
 // currently team does not support bulk team delete
-// TODO(meshery-cloud#?): flip `team_ids` / `team_names` to camelCase once the
-// server's bulk-delete handler lands dual-accept (camel + legacy snake).
-// Deferred from Phase 2.K cascade to avoid a client-only flip that would break
-// the outbound POST body.
+//
+// The outbound `team_ids` / `team_names` keys are left snake_case on purpose:
+// `deleteTeamsModalHandler` is a host-supplied callback, there is no
+// bulk-delete handler in meshery-cloud to check the body against, and no
+// canonical construct in `@meshery/schemas` describes it. Flipping the keys
+// blind would trade a verified shape for an unverified one.
+//
+// The *inbound* reads below are a different matter and were wrong: they read
+// `teamId` and `team_name` off a team record. Neither field exists - the
+// canonical v1beta2 team construct, which meshery-cloud now aliases directly,
+// identifies a team by `id` and `name` - so both pushed `undefined`.
 interface DeleteTeamsBtnProps {
   selected: any;
   teams: Team[];
@@ -39,8 +46,8 @@ function DeleteTeamsBtn({ selected, teams, deleteTeamsModalHandler }: DeleteTeam
   };
   selected?.data.forEach((val: any) => {
     const idx = val.index;
-    deleteTeams['team_ids'].push(teams[idx]?.teamId);
-    deleteTeams['team_names'].push(teams[idx]?.team_name);
+    deleteTeams['team_ids'].push(teams[idx]?.id);
+    deleteTeams['team_names'].push(teams[idx]?.name);
   });
 
   return (
diff --git a/src/custom/Workspaces/WorkspaceCard.tsx b/src/custom/Workspaces/WorkspaceCard.tsx
index da8c6ce25..d29a6b062 100644
--- a/src/custom/Workspaces/WorkspaceCard.tsx
+++ b/src/custom/Workspaces/WorkspaceCard.tsx
@@ -1,8 +1,10 @@
+import type { components as EventComponents } from '@meshery/schemas/constructs/v1beta3/event/Event';
 import { useTheme } from '@mui/material';
 import { Backdrop, CircularProgress, Grid2 } from '../../base';
 
-import { DeletedAt, getRelativeTime, isSoftDeleted } from '../../utils';
+import { getRelativeTime, isSoftDeleted } from '../../utils';
 import { FlipCard } from '../FlipCard';
+import { Workspace } from './types';
 import { RecordRow, RedirectButton, TransferButton } from './WorkspaceTransferButton';
 import {
   AllocationColumnGrid,
@@ -26,25 +28,29 @@ import {
   WorkspaceCardGrid
 } from './styles';
 
-interface WorkspaceDetails {
-  id: number;
-  name: string;
-  description: string;
-  deletedAt: DeletedAt;
-  updatedAt: string;
-  createdAt: string;
-}
+// The subset of the v1beta3 workspace construct this card renders. Derived
+// from {@link Workspace} rather than re-declared: the card previously typed
+// `id` as `number` while the canonical identifier is a uuid `string`, which
+// forced every consumer through a cast and made the bulk-select comparison
+// below type-check against the wrong primitive.
+type WorkspaceDetails = Pick<
+  Workspace,
+  'id' | 'name' | 'description' | 'deletedAt' | 'createdAt' | 'updatedAt'
+>;
 
-type Activity = {
-  description: string;
-  firstName: string;
-  createdAt: string;
-};
+// A row of the workspace activity feed, derived from the canonical v1beta3
+// `EventResult`. Required rather than optional because the card renders each
+// value directly with no fallback.
+type Activity = Required<
+  Pick<EventComponents['schemas']['EventResult'], 'description' | 'firstName' | 'createdAt'>
+>;
 
 interface CardFrontProps {
   onFlip: () => void;
   name: string;
-  description: string;
+  // Optional to match the canonical construct: `description` is not required
+  // on a workspace, and the card already renders a "No description" fallback.
+  description?: string;
   environmentsCount: number;
   onAssignEnvironment: () => void;
   teamsCount: number;
@@ -67,8 +73,8 @@ interface CardBackProps {
   name: string;
   onEdit: () => void;
   onDelete: () => void;
-  selectedWorkspaces: number[];
-  workspaceId: number;
+  selectedWorkspaces: string[];
+  workspaceId: string;
   loadingEvents: boolean;
   recentActivities: Activity[];
   updatedDate: string;
@@ -83,7 +89,7 @@ interface WorkspaceCardProps {
   onDelete: () => void;
   onEdit: () => void;
   onSelect: () => void;
-  selectedWorkspaces: number[];
+  selectedWorkspaces: string[];
   onAssignTeam: () => void;
   onAssignEnvironment: () => void;
   onAssignDesign: () => void;
diff --git a/src/custom/Workspaces/WorkspaceContentMoveModal.tsx b/src/custom/Workspaces/WorkspaceContentMoveModal.tsx
index a134cc3c7..36f70468f 100644
--- a/src/custom/Workspaces/WorkspaceContentMoveModal.tsx
+++ b/src/custom/Workspaces/WorkspaceContentMoveModal.tsx
@@ -16,6 +16,7 @@ import { OpenFileIcon } from '../../icons';
 import { styled } from '../../theme';
 import { Pattern } from '../CustomCatalog/CustomCard';
 import { Modal, ModalBody, ModalFooter, PrimaryActionButtons } from '../Modal';
+import { CanonicalWorkspace } from './types';
 
 interface WorkspaceContentMoveModalProps {
   workspaceContentMoveModal: boolean;
@@ -36,10 +37,10 @@ interface WorkspaceContentMoveModalProps {
   currentOrgId: string;
 }
 
-interface Workspace {
-  id: string;
-  name: string;
-}
+// The workspace-picker projection: only the two fields this modal renders,
+// derived from the canonical v1beta3 construct so a rename upstream fails here
+// rather than silently rendering `undefined`.
+type Workspace = Pick<CanonicalWorkspace, 'id' | 'name'>;
 
 const WorkspaceItem = styled(ListItemButton)({
   borderRadius: '8px'
diff --git a/src/custom/Workspaces/WorkspaceEnvironmentSelection.tsx b/src/custom/Workspaces/WorkspaceEnvironmentSelection.tsx
index 4b430651d..5403cf7c5 100644
--- a/src/custom/Workspaces/WorkspaceEnvironmentSelection.tsx
+++ b/src/custom/Workspaces/WorkspaceEnvironmentSelection.tsx
@@ -2,11 +2,12 @@
 /* eslint-disable @typescript-eslint/ban-ts-comment */
 import { FunctionComponent } from 'react';
 import { Autocomplete, Chip, TextField } from '../../base';
+import { CanonicalEnvironment } from './types';
 
-interface Environment {
-  id: string;
-  name: string;
-}
+// The environment-picker projection: only the two fields this selector reads,
+// derived from the canonical v1beta3 construct so a rename upstream fails here
+// rather than silently rendering `undefined`.
+type Environment = Pick<CanonicalEnvironment, 'id' | 'name'>;
 
 interface EnvironmentOption {
   label: string;
diff --git a/src/custom/Workspaces/WorkspaceRecentActivityModal.tsx b/src/custom/Workspaces/WorkspaceRecentActivityModal.tsx
index b2b38dff5..0ecfc9dde 100644
--- a/src/custom/Workspaces/WorkspaceRecentActivityModal.tsx
+++ b/src/custom/Workspaces/WorkspaceRecentActivityModal.tsx
@@ -1,3 +1,4 @@
+import type { components as EventComponents } from '@meshery/schemas/constructs/v1beta3/event/Event';
 import AccessTimeFilledIcon from '@mui/icons-material/AccessTimeFilled';
 import { useCallback, useEffect, useRef, useState } from 'react';
 import {
@@ -18,19 +19,29 @@ import { getFormatDate, getFullFormattedTime } from '../../utils';
 import { CustomTooltip } from '../CustomTooltip';
 import { Modal, ModalBody, ModalFooter } from '../Modal';
 
-interface EventData {
-  createdAt: string;
-  description: string;
-  firstName: string;
-  lastName: string;
+type CanonicalEventResult = EventComponents['schemas']['EventResult'];
+type CanonicalEventsPage = EventComponents['schemas']['EventsPage'];
+
+/**
+ * A workspace activity row, derived from the canonical v1beta3 `EventResult`.
+ *
+ * The four canonical fields are required here rather than optional: the row
+ * renders each one directly and has no fallback. `avatarUrl` is added because
+ * the server emits it (meshery-cloud `models.EventResult`, `json:"avatarUrl"`)
+ * but the canonical construct does not model it - see
+ * https://github.com/meshery/schemas/issues/1145. Drop the addition once that
+ * lands.
+ */
+type EventData = Required<
+  Pick<CanonicalEventResult, 'createdAt' | 'description' | 'firstName' | 'lastName'>
+> & {
   avatarUrl: string;
-}
+};
 
-interface EventsResponse {
+/** The canonical `EventsPage`, narrowed to the fields this modal paginates on. */
+type EventsResponse = Required<Pick<CanonicalEventsPage, 'page' | 'totalCount'>> & {
   data: EventData[];
-  page: number;
-  totalCount: number;
-}
+};
 
 interface RecentActivityModalProps {
   workspaceId: string;
diff --git a/src/custom/Workspaces/types.ts b/src/custom/Workspaces/types.ts
index 9e2daabcf..dd80ed631 100644
--- a/src/custom/Workspaces/types.ts
+++ b/src/custom/Workspaces/types.ts
@@ -1,5 +1,18 @@
+import type { components as EnvironmentComponents } from '@meshery/schemas/constructs/v1beta3/environment/Environment';
+import type { components as TeamComponents } from '@meshery/schemas/constructs/v1beta2/team/Team';
+import type { components as WorkspaceComponents } from '@meshery/schemas/constructs/v1beta3/workspace/Workspace';
 import { DeletedAt } from '../../utils/nullTime';
 
+// The canonical constructs. Sistent is upstream of every Meshery UI, so a
+// shape copied here propagates to all of them: these types are derived from
+// `@meshery/schemas` rather than re-declared, so that a rename in the canonical
+// source becomes a compile error here instead of a silent `undefined` in a
+// consumer. Where sistent deliberately diverges, the divergence is spelled out
+// as an explicit `Omit`/`&` with its reason - never as a quiet re-declaration.
+export type CanonicalWorkspace = WorkspaceComponents['schemas']['Workspace'];
+export type CanonicalEnvironment = EnvironmentComponents['schemas']['Environment'];
+export type CanonicalTeam = TeamComponents['schemas']['Team'];
+
 export interface AssignmentHookResult<T> {
   data: T[];
   workspaceData: T[];
@@ -15,35 +28,51 @@ export interface AssignmentHookResult<T> {
   assignedItems: T[];
 }
 
-export interface Workspace {
-  id: string;
-  name: string;
-  description?: string;
-  organizationId?: string;
-  owner?: string;
-  metadata?: Record<string, string>;
-  createdAt: string;
-  updatedAt: string;
+/**
+ * The v1beta3 workspace construct as sistent consumes it.
+ *
+ * Two deliberate widenings over the canonical shape, both of them tolerance for
+ * wire values the canonical does not describe but that do reach the UI:
+ *
+ *  - `organizationId` is optional. The canonical requires it, but the workspace
+ *    projections a picker renders (`AvailableWorkspace`, and the `{id, name}`
+ *    rows of the move-content modal) omit it.
+ *  - `deletedAt` is {@link DeletedAt} rather than `string | undefined`, because
+ *    some provider endpoints still emit the legacy Go `sql.NullTime`
+ *    `{ Valid, Time }` object. See `src/utils/nullTime.ts` for the crash that
+ *    reading `.Valid` off a value typed to the canonical shape produced.
+ */
+export type Workspace = Omit<CanonicalWorkspace, 'organizationId' | 'deletedAt'> & {
+  organizationId?: CanonicalWorkspace['organizationId'];
   deletedAt: DeletedAt;
-}
+};
 
-export interface Environment {
-  id: string;
-  name: string;
-  description?: string;
-  organizationId: string;
+/**
+ * The v1beta3 environment construct as sistent consumes it. `createdAt` and
+ * `updatedAt` are required here because the environment table renders both
+ * unconditionally; the canonical marks them optional so that the same schema
+ * can describe a create payload.
+ */
+export type Environment = Omit<CanonicalEnvironment, 'createdAt' | 'updatedAt'> & {
   createdAt: string;
   updatedAt: string;
-}
+};
 
-export interface Team {
-  id: string;
-  name: string;
-  teamId: string;
-  description?: string;
-  // TODO(meshery-cloud#?): flip to `teamName` once server renames the SQL alias
-  // (currently aliased to `Team.name`; flipping here without the server rename
-  // would break the wire contract). Deferred from Phase 2.K cascade.
-  team_name: string;
+/**
+ * The v1beta2 team construct as sistent consumes it, widened only on
+ * `deletedAt` for the same legacy `sql.NullTime` reason as {@link Workspace}.
+ *
+ * This type previously carried two extra fields, `teamId` and `team_name`, read
+ * by the bulk-delete button in `TeamTable/TeamTableConfiguration.tsx`. Neither
+ * exists on the wire: meshery-cloud aliases its `Team` straight to the
+ * canonical `team.Team` (`server/models/model_aliases_org.go`), whose identity
+ * fields are `id` and `name`, and the Phase 4 wire-format flip removed the
+ * snake_case aliases outright. Both reads yielded `undefined`.
+ *
+ * The canonical is taken from v1beta2 rather than through the v1beta3 workspace
+ * API's `getTeamsOfWorkspace` operation, which still `$ref`s the snake_case
+ * v1beta1 `TeamPage` - see https://github.com/meshery/schemas/issues/1143.
+ */
+export type Team = Omit<CanonicalTeam, 'deletedAt'> & {
   deletedAt: DeletedAt;
-}
+};
diff --git a/src/index.tsx b/src/index.tsx
index 8aa1331b6..99ff399e1 100644
--- a/src/index.tsx
+++ b/src/index.tsx
@@ -92,3 +92,18 @@ export {
 export { BottomSheet, type BottomSheetProps } from './custom/BottomSheet';
 
 export { ActionButton, type ActionButtonProps, type Option } from './custom/ActionButton';
+
+// Same nested-barrel dts-drop quirk as FeedbackButton above. The share/revoke
+// payload builders exist so that hosts stop hand-rolling the
+// `resourceAccessMappingPayload` body they hand to `ShareModal`'s
+// `resourceAccessMutator`: the server drops unrecognised keys silently and
+// still answers 200, so a hand-rolled body fails as a successful no-op.
+// Without the declarations a host cannot type that body at all and falls back
+// to the object literal that caused the bug.
+export {
+  buildGrantAccessPayload,
+  buildRevokeAccessPayload,
+  toResourceAccessActors,
+  type ResourceAccessActor,
+  type ResourceAccessMappingPayload
+} from './custom/ShareModal';
diff --git a/src/types/meshery-schemas.d.ts b/src/types/meshery-schemas.d.ts
deleted file mode 100644
index 47f20e703..000000000
--- a/src/types/meshery-schemas.d.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-declare module '@meshery/schemas/constructs/v1beta2/model/ModelSchema' {
-  const schema: typeof import('@meshery/schemas').ModelDefinitionV1Beta1OpenApiSchema;
-
-  export default schema;
-}
-
-declare module '@meshery/schemas/constructs/v1beta3/environment/EnvironmentSchema' {
-  const schema: typeof import('@meshery/schemas').EnvironmentDefinitionV1Beta1OpenApiSchema;
-
-  export default schema;
-}
-
-declare module '@meshery/schemas/constructs/v1beta3/workspace/WorkspaceSchema' {
-  const schema: typeof import('@meshery/schemas').WorkspaceDefinitionV1Beta1OpenApiSchema;
-
-  export default schema;
-}
diff --git a/src/utils/user.ts b/src/utils/user.ts
index 51d9fd0db..ca47757a6 100644
--- a/src/utils/user.ts
+++ b/src/utils/user.ts
@@ -1,27 +1,41 @@
+import type { components as UserComponents } from '@meshery/schemas/constructs/v1beta3/user/User';
 import { DeletedAt } from './nullTime';
 
 /**
- * Collaboration-facing user record, aligned with the v1beta3 `user` construct
- * of @meshery/schemas. The canonical identifier is `id`; `userId` survives
- * only as a deprecated wire alias emitted by providers that predate the
- * users.user_id column retirement. Reduced projections (the public users
- * directory, the searchable collaboration projection) omit some or all of the
- * name/email fields, so everything except the identifiers is optional and
- * display code must go through the fallback helpers below.
+ * The canonical collaboration projection of the v1beta3 `user` construct: what
+ * the authenticated people-picker endpoints serve. Exported so consumers can
+ * name the unmodified contract.
  */
-export interface User {
-  /** Canonical unique identifier of the user (v1beta3 `id`). */
-  id?: string;
-  /** @deprecated Legacy duplicate of `id`; read via {@link getUserIdentifier}. */
-  userId?: string;
-  username?: string;
-  firstName?: string;
-  lastName?: string;
-  email?: string;
-  avatarUrl?: string;
+export type CanonicalSearchableUser = UserComponents['schemas']['SearchableUser'];
+
+/**
+ * Collaboration-facing user record, derived from the canonical
+ * {@link CanonicalSearchableUser} projection rather than re-declared, so that a
+ * rename in `@meshery/schemas` is a compile error here instead of an
+ * `undefined` in every Meshery UI downstream of sistent.
+ *
+ * The canonical identifier is `id`; `userId` survives only as a deprecated wire
+ * alias emitted by providers that predate the `users.user_id` column
+ * retirement - read both through {@link getUserIdentifier}.
+ *
+ * Three deliberate divergences from the canonical projection:
+ *
+ *  - `id` is optional. The canonical requires it, but sistent also renders
+ *    records assembled by hosts from older provider payloads that carry only
+ *    the `userId` alias; the fallback helpers below exist for exactly that.
+ *  - `deletedAt` is {@link DeletedAt} rather than `string | null`, because some
+ *    provider endpoints still emit the legacy Go `sql.NullTime`
+ *    `{ Valid, Time }` object. See `src/utils/nullTime.ts`.
+ *  - `roleNames` is added. It is not part of the `SearchableUser` projection
+ *    (which deliberately excludes roles) but is present on the org-scoped user
+ *    listings the users table renders, where it carries the same meaning as
+ *    `User.roleNames` in the canonical construct.
+ */
+export type User = Omit<CanonicalSearchableUser, 'id' | 'deletedAt'> & {
+  id?: CanonicalSearchableUser['id'];
   deletedAt?: DeletedAt;
   roleNames?: string[];
-}
+};
 
 /**
  * Resolves the canonical identifier of a user record: v1beta3 `id` first,

From 9571801a8a30bae4ff4e62598527be0053190adb Mon Sep 17 00:00:00 2001
From: "Mericio \"Hablo\" Salazar"
 <218162243+simihablo@users.noreply.github.com>
Date: Fri, 7 Aug 2026 11:35:18 -0500
Subject: [PATCH 02/13] no-mistakes(review): harden share payload builders;
 finish MUI slot migration

Signed-off-by: Mericio "Hablo" Salazar <218162243+simihablo@users.noreply.github.com>
---
 AGENTS.md                                     |  17 ++-
 .../fixtures/schemaConstructAliases.ts        |  42 ++++++++
 src/__testing__/helpers/tscFixture.ts         | 102 ++++++++++++++++++
 .../navigationItemTitleTypes.test.ts          |  90 ++--------------
 src/__testing__/resourceAccessPayload.test.ts |  49 +++++++++
 .../schemaConstructAliasTypes.test.ts         |  56 ++--------
 .../CatalogDetail/CollapsibleSection.tsx      |  24 +++--
 .../CollaboratorAvatarGroup.tsx               |  10 +-
 src/custom/ShareModal/index.tsx               |   1 +
 .../ShareModal/resourceAccessPayload.ts       |  50 +++++++--
 src/custom/Workspaces/types.ts                |   9 ++
 src/index.tsx                                 |   9 +-
 12 files changed, 305 insertions(+), 154 deletions(-)
 create mode 100644 src/__testing__/helpers/tscFixture.ts

diff --git a/AGENTS.md b/AGENTS.md
index 30cc5f208..8734397a5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -168,11 +168,20 @@ filing - open examples: [#1142](https://github.com/meshery/schemas/issues/1142)
 [#1143](https://github.com/meshery/schemas/issues/1143), [#1144](https://github.com/meshery/schemas/issues/1144)
 (share/revoke), [#1145](https://github.com/meshery/schemas/issues/1145).
 
+Such a workaround needs an expiry date, not just an issue link, or it outlives its upstream fix in
+silence. Pair it with an `// @ts-expect-error` + `RequiresKey<Canonical, 'theMissingKey'>` entry in
+the fixture: the suppression goes unused the moment the canonical gains the key, and tsc reports
+TS2578. `TeamHasNoTeamId`, `EventResultHasNoAvatarUrl` and the two `CatalogDataHasNo*` entries are
+the worked examples.
+
 A wire mismatch here is not loud. meshery-cloud decodes request bodies with a strict `json.Unmarshal`
 into `omitempty` structs and still answers 200, so a stale outbound key name is a successful no-op -
 which is how sistent's share modal granted nothing for three months after the Phase 4 camelCase flip.
 Outbound payload shapes therefore get their own module and a test pinning the literal key names, as
 [`src/custom/ShareModal/resourceAccessPayload.ts`](src/custom/ShareModal/resourceAccessPayload.ts) does.
+Those modules are root-exported so hosts stop hand-rolling the body, which makes them public API: the
+validation that keeps an unusable value off the wire belongs in the builder, not only in the caller
+that happens to render the error. A component-level guard is defence in depth on top of it.
 
 ## `disabled` on a MUI `MenuItem` does not stop a click
 
@@ -208,8 +217,12 @@ A type contract can still be gated, just not by a type-only assertion file: jest
 `@swc/jest`, which strips types without checking them, so such a file passes no matter what it
 asserts. Shell out to `tsc` over a scoped fixture, assert the fixture is in the compiled program
 (`--listFiles`) before trusting an empty diagnostic list, then filter the diagnostics to that
-fixture - [`src/__testing__/navigationItemTitleTypes.test.ts`](src/__testing__/navigationItemTitleTypes.test.ts)
-is the worked pattern, including the checks that keep the filter from turning the guard vacuous.
+fixture. [`src/__testing__/helpers/tscFixture.ts`](src/__testing__/helpers/tscFixture.ts) is that
+harness, and documents each check that keeps the filter from turning the guard vacuous - call
+`typeCheckFixture(fixture, project)` from a new guard rather than copying it, because a fix to one
+copy silently leaves the other unguarded. `navigationItemTitleTypes.test.ts` and
+`schemaConstructAliasTypes.test.ts` are the two worked callers; both assert "compiles the fixture"
+before the emptiness assertions, and the ordering is load-bearing.
 
 ## Every commit needs a sign-off matching its own author
 
diff --git a/src/__testing__/fixtures/schemaConstructAliases.ts b/src/__testing__/fixtures/schemaConstructAliases.ts
index a0acf5352..b2ab01093 100644
--- a/src/__testing__/fixtures/schemaConstructAliases.ts
+++ b/src/__testing__/fixtures/schemaConstructAliases.ts
@@ -52,6 +52,7 @@ type CanonicalEnvironment = EnvironmentComponents['schemas']['Environment'];
 type CanonicalTeam = TeamComponents['schemas']['Team'];
 type CanonicalSearchableUser = UserComponents['schemas']['SearchableUser'];
 type CanonicalPattern = DesignComponents['schemas']['MesheryPattern'];
+type CanonicalCatalogData = NonNullable<CanonicalPattern['catalogData']>;
 type CanonicalEventResult = EventComponents['schemas']['EventResult'];
 type CanonicalEventsPage = EventComponents['schemas']['EventsPage'];
 
@@ -108,6 +109,22 @@ export type WorkspaceTimestampsAreCanonical = Expect<
   IsExact<Workspace['createdAt'], CanonicalWorkspace['createdAt']>
 >;
 
+// `metadata` is the one field sistent narrows rather than widens, and it does so
+// only by carrying the canonical through: openapi-typescript emits
+// `Record<string, never>` for a free-form object, so every key reads as `never`.
+// The first assertion pins that sistent does not quietly re-declare it; the
+// second pins the claim in `Workspace`'s doc comment that the shape is a
+// generator artifact, and fails the moment `meshery/schemas` gives `metadata`
+// real properties - which is the signal that the doc comment, not the type, is
+// what needs updating.
+export type WorkspaceMetadataIsCanonical = Expect<
+  IsExact<Workspace['metadata'], CanonicalWorkspace['metadata']>
+>;
+
+export type WorkspaceMetadataIsAGeneratorArtifact = Expect<
+  IsExact<NonNullable<CanonicalWorkspace['metadata']>, Record<string, never>>
+>;
+
 export type PatternCreatedAtIsCanonical = Expect<
   IsExact<Pattern['createdAt'], CanonicalPattern['createdAt']>
 >;
@@ -150,6 +167,31 @@ export type ExpectRejectsAMismatch = Expect<IsExact<CanonicalWorkspace['id'], nu
 // @ts-expect-error - the canonical team construct has no `teamId`
 export type TeamHasNoTeamId = RequiresKey<CanonicalTeam, 'teamId'>;
 
+// The same technique used as an expiry date on the two workarounds whose doc
+// comments promise their own removal. Both are suppressed errors today; the
+// moment the upstream fix lands the suppression goes unused, tsc reports TS2578
+// here, and the local workaround has to go with it.
+//
+// Each assertion stays on one line: `@ts-expect-error` only suppresses the line
+// directly below it, and tsc reports a constraint violation on the offending
+// type *argument*, so wrapping the generic pushes the error out of the
+// directive's reach and leaves both an unsuppressed TS2344 and an unused TS2578.
+//
+// `WorkspaceRecentActivityModal`'s `EventData` adds `avatarUrl` because the
+// server emits it and the canonical does not model it -
+// https://github.com/meshery/schemas/issues/1145.
+// @ts-expect-error - the canonical event construct has no `avatarUrl`
+export type EventResultHasNoAvatarUrl = RequiresKey<CanonicalEventResult, 'avatarUrl'>;
+
+// `CustomCard`'s `PatternCatalogData` keeps a hand-written shape because the
+// canonical declares `class` / `snapshotURL` while every server emits
+// `contentClass` / `imageURL` - https://github.com/meshery/schemas/issues/1142.
+// One assertion per renamed field, so each expires on its own.
+// @ts-expect-error - the canonical catalog data declares `class`, not `contentClass`
+export type CatalogDataHasNoContentClass = RequiresKey<CanonicalCatalogData, 'contentClass'>;
+// @ts-expect-error - the canonical catalog data declares `snapshotURL`, not `imageURL`
+export type CatalogDataHasNoImageUrl = RequiresKey<CanonicalCatalogData, 'imageURL'>;
+
 // --- Subpath resolution, formerly propped up by a local ambient shim --------
 //
 // `src/types/meshery-schemas.d.ts` used to `declare module` these three
diff --git a/src/__testing__/helpers/tscFixture.ts b/src/__testing__/helpers/tscFixture.ts
new file mode 100644
index 000000000..768b85eb2
--- /dev/null
+++ b/src/__testing__/helpers/tscFixture.ts
@@ -0,0 +1,102 @@
+import { spawnSync } from 'child_process';
+import path from 'path';
+
+// Shared harness for the repo's type-level regression guards.
+//
+// jest transforms with @swc/jest, which strips types without checking them, so
+// a plain type-only assertion file passes no matter what it asserts. Those
+// guards therefore shell out to `tsc` over a scoped fixture, and every one of
+// them needs the same protections against the check quietly turning into a
+// no-op - which is why the mechanics live here once rather than being copied
+// per guard.
+
+const repoRoot = path.resolve(__dirname, '..', '..', '..');
+
+// `<file>(<line>,<col>): error TS….` The file part is what scopes a diagnostic,
+// so it is parsed rather than prefix-matched: tsc prints paths relative to its
+// cwd only while the fixture stays under it, and a bare `startsWith` would read
+// any other emission as "the fixture is clean".
+const FILE_SCOPED_DIAGNOSTIC = /^(.+?)\(\d+,\d+\): error TS\d+/;
+
+// `error TS…` with no file part is a config-level failure - TS18003 "No inputs
+// were found in config file", TS5083 "Cannot read file" - and means the fixture
+// was never compiled at all. The fixture filter drops these on the floor, and a
+// fixture's `@ts-expect-error` self-check cannot see them either, because
+// neither fires unless the compiler had the fixture in its program.
+const CONFIG_SCOPED_DIAGNOSTIC = /^error TS\d+/;
+
+// Absence of diagnostics only means "nothing was wrong with what tsc compiled" -
+// it says nothing about *what* tsc compiled. A project whose `include` resolves
+// to some other existing file emits no diagnostic at all, so both lists below
+// come back empty and the guard passes without ever having looked at the
+// fixture. `--listFiles` closes that by making the program's contents an
+// assertable fact instead of an assumption.
+const asPosix = (value: string): string => value.replace(/\\/g, '/');
+
+export type Diagnostics = {
+  /** Diagnostics tsc attributed to the fixture itself. */
+  fixture: string[];
+  /** Config-level diagnostics, which mean the fixture was never compiled. */
+  config: string[];
+  /** Whether `--listFiles` proves the fixture was in the compiled program. */
+  compiledFixture: boolean;
+};
+
+// Below the 180s `beforeAll` budget callers give this. `spawnSync` blocks the
+// jest worker outright, and jest's own timeout cannot preempt a synchronous
+// child, so a wedged tsc would otherwise hold the worker until the whole run is
+// killed. Node's timeout signals the child, which surfaces as the
+// `status === null` throw below.
+const TSC_TIMEOUT_MS = 150_000;
+
+/**
+ * Type-checks `project` with `tsc` and returns the diagnostics scoped to
+ * `fixture`, plus the proof that `fixture` was actually compiled.
+ *
+ * @param fixture repo-relative POSIX path of the fixture file.
+ * @param project repo-relative POSIX path of the tsconfig that includes it.
+ */
+export const typeCheckFixture = (fixture: string, project: string): Diagnostics => {
+  // Spawned through `process.execPath` rather than `npx`: no shell, no PATH
+  // lookup, and no `npx` vs `npx.cmd` divergence on Windows, where an ENOENT
+  // would otherwise be caught and laundered into the diagnostic output.
+  const tsc = spawnSync(
+    process.execPath,
+    [require.resolve('typescript/bin/tsc'), '-p', project, '--pretty', 'false', '--listFiles'],
+    {
+      cwd: repoRoot,
+      encoding: 'utf8',
+      timeout: TSC_TIMEOUT_MS,
+      // tsc reports on every file in the program, and `--listFiles` prints each
+      // one, so this runs to several MB. The 1 MB default would kill the child
+      // mid-stream and truncate stdout - and the fixture is a root file, so its
+      // diagnostics are emitted last and lost first.
+      maxBuffer: 32 * 1024 * 1024
+    }
+  );
+
+  // A compiler that never ran is not a compiler that found nothing.
+  if (tsc.error) throw tsc.error;
+  if (tsc.status === null) {
+    throw new Error(`tsc was killed by ${tsc.signal ?? 'an unknown signal'} before reporting`);
+  }
+
+  // tsc exits non-zero whenever any file in the program has an error, including
+  // the pre-existing ones outside the fixture, so the exit code is not the
+  // verdict here - the diagnostics are.
+  const lines = `${tsc.stdout}\n${tsc.stderr}`.split('\n').map((line) => line.trim());
+
+  const belongsToFixture = (line: string): boolean => {
+    const file = FILE_SCOPED_DIAGNOSTIC.exec(line)?.[1];
+    return file !== undefined && asPosix(file).endsWith(fixture);
+  };
+
+  return {
+    fixture: lines.filter(belongsToFixture),
+    config: lines.filter((line) => CONFIG_SCOPED_DIAGNOSTIC.test(line)),
+    // `--listFiles` prints one absolute path per program file, diagnostics aside.
+    compiledFixture: lines.some(
+      (line) => !FILE_SCOPED_DIAGNOSTIC.test(line) && asPosix(line).endsWith(fixture)
+    )
+  };
+};
diff --git a/src/__testing__/navigationItemTitleTypes.test.ts b/src/__testing__/navigationItemTitleTypes.test.ts
index 416d298b9..af7d453e1 100644
--- a/src/__testing__/navigationItemTitleTypes.test.ts
+++ b/src/__testing__/navigationItemTitleTypes.test.ts
@@ -1,5 +1,4 @@
-import { spawnSync } from 'child_process';
-import path from 'path';
+import { type Diagnostics, typeCheckFixture } from './helpers/tscFixture';
 
 // Type-level regression guard for https://github.com/layer5io/sistent/issues/1746.
 //
@@ -11,102 +10,25 @@ import path from 'path';
 // jest transforms with @swc/jest, which strips types without checking them, so a
 // plain type-only assertion file would pass no matter what `title` is declared
 // as. This test therefore shells out to `tsc` over a fixture that exercises both
-// a plain string and a composed `ReactNode` title.
+// a plain string and a composed `ReactNode` title, through the shared
+// `typeCheckFixture` harness - which is where the guards that keep the check
+// from turning vacuous (diagnostic scoping, config-level failures, `--listFiles`
+// proof that the fixture was compiled) are documented.
 //
 // Diagnostics are filtered to the fixture itself: type-checking it pulls in the
 // component's transitive dependencies, which carry pre-existing errors unrelated
 // to this contract (see CLAUDE.md, "Repo state that looks broken but is
 // pre-existing"). The fixture's own `@ts-expect-error` self-check fails loudly if
 // the compiler ever stops checking it, so filtering cannot make this vacuous.
-//
-// Everything below the filter exists so that the guard fails closed. Filtering
-// is the one place a compiler check can quietly turn into a no-op: every outcome
-// that is not "tsc ran, compiled the fixture, and reported on it" has to be made
-// to fail rather than collapse into an empty, green list of diagnostics.
 
 const FIXTURE = 'src/__testing__/fixtures/navigationItemTitle.tsx';
 const PROJECT = 'src/__testing__/fixtures/tsconfig.navigationItemTitle.json';
-const repoRoot = path.resolve(__dirname, '..', '..');
-
-// `<file>(<line>,<col>): error TS….` The file part is what scopes a diagnostic,
-// so it is parsed rather than prefix-matched: tsc prints paths relative to its
-// cwd only while the fixture stays under it, and a bare `startsWith` would read
-// any other emission as "the fixture is clean".
-const FILE_SCOPED_DIAGNOSTIC = /^(.+?)\(\d+,\d+\): error TS\d+/;
-
-// `error TS…` with no file part is a config-level failure - TS18003 "No inputs
-// were found in config file", TS5083 "Cannot read file" - and means the fixture
-// was never compiled at all. The fixture filter drops these on the floor, and
-// the fixture's `@ts-expect-error` self-check cannot see them either, because
-// neither fires unless the compiler had the fixture in its program.
-const CONFIG_SCOPED_DIAGNOSTIC = /^error TS\d+/;
-
-// Absence of diagnostics only means "nothing was wrong with what tsc compiled" -
-// it says nothing about *what* tsc compiled. A project whose `include` resolves
-// to some other existing file emits no diagnostic at all, so both lists above
-// come back empty and the guard passes without ever having looked at the
-// fixture. `--listFiles` closes that by making the program's contents an
-// assertable fact instead of an assumption.
-const asPosix = (value: string): string => value.replace(/\\/g, '/');
-
-type Diagnostics = { fixture: string[]; config: string[]; compiledFixture: boolean };
-
-// Below the 180s `beforeAll` budget. `spawnSync` blocks the jest worker outright,
-// and jest's own timeout cannot preempt a synchronous child, so a wedged tsc
-// would otherwise hold the worker until the whole run is killed. Node's timeout
-// signals the child, which surfaces as the `status === null` throw below.
-const TSC_TIMEOUT_MS = 150_000;
-
-const typeCheckFixture = (): Diagnostics => {
-  // Spawned through `process.execPath` rather than `npx`: no shell, no PATH
-  // lookup, and no `npx` vs `npx.cmd` divergence on Windows, where an ENOENT
-  // would otherwise be caught and laundered into the diagnostic output.
-  const tsc = spawnSync(
-    process.execPath,
-    [require.resolve('typescript/bin/tsc'), '-p', PROJECT, '--pretty', 'false', '--listFiles'],
-    {
-      cwd: repoRoot,
-      encoding: 'utf8',
-      timeout: TSC_TIMEOUT_MS,
-      // tsc reports on every file in the program, and `--listFiles` prints each
-      // one, so this runs to several MB. The 1 MB default would kill the child
-      // mid-stream and truncate stdout - and the fixture is a root file, so its
-      // diagnostics are emitted last and lost first.
-      maxBuffer: 32 * 1024 * 1024
-    }
-  );
-
-  // A compiler that never ran is not a compiler that found nothing.
-  if (tsc.error) throw tsc.error;
-  if (tsc.status === null) {
-    throw new Error(`tsc was killed by ${tsc.signal ?? 'an unknown signal'} before reporting`);
-  }
-
-  // tsc exits non-zero whenever any file in the program has an error, including
-  // the pre-existing ones outside the fixture, so the exit code is not the
-  // verdict here - the diagnostics are.
-  const lines = `${tsc.stdout}\n${tsc.stderr}`.split('\n').map((line) => line.trim());
-
-  const belongsToFixture = (line: string): boolean => {
-    const file = FILE_SCOPED_DIAGNOSTIC.exec(line)?.[1];
-    return file !== undefined && asPosix(file).endsWith(FIXTURE);
-  };
-
-  return {
-    fixture: lines.filter(belongsToFixture),
-    config: lines.filter((line) => CONFIG_SCOPED_DIAGNOSTIC.test(line)),
-    // `--listFiles` prints one absolute path per program file, diagnostics aside.
-    compiledFixture: lines.some(
-      (line) => !FILE_SCOPED_DIAGNOSTIC.test(line) && asPosix(line).endsWith(FIXTURE)
-    )
-  };
-};
 
 describe('NavigationItem title type contract', () => {
   let diagnostics: Diagnostics;
 
   beforeAll(() => {
-    diagnostics = typeCheckFixture();
+    diagnostics = typeCheckFixture(FIXTURE, PROJECT);
   }, 180_000);
 
   // Ordered deliberately: the two assertions below are only meaningful once the
diff --git a/src/__testing__/resourceAccessPayload.test.ts b/src/__testing__/resourceAccessPayload.test.ts
index fc20633f6..6a40cacb2 100644
--- a/src/__testing__/resourceAccessPayload.test.ts
+++ b/src/__testing__/resourceAccessPayload.test.ts
@@ -1,4 +1,5 @@
 import {
+  ResourceAccessActorError,
   buildGrantAccessPayload,
   buildRevokeAccessPayload,
   toResourceAccessActors
@@ -39,6 +40,16 @@ const legacyAliasUser = {
   email: 'legacy@example.com'
 };
 
+// A record neither identifier resolves on. `models.Actor.ActorId` is
+// `core.Uuid` (gofrs `uuid.UUID`), whose `UnmarshalText` rejects a zero-length
+// string, so emitting `actorId: ''` fails the handler's `json.Unmarshal` and
+// takes the whole request down with a 400 - the valid actors alongside it
+// included. The builders are public API, so the rejection has to live in them
+// and not only in `ShareModal`'s handlers.
+const unidentifiableUser = {
+  email: 'ghost@example.com'
+};
+
 describe('resource access mapping payload', () => {
   describe('toResourceAccessActors', () => {
     it('emits the canonical camelCase actor keys', () => {
@@ -57,6 +68,32 @@ describe('resource access mapping payload', () => {
         { actorId: legacyAliasUser.userId, actorType: 'user' }
       ]);
     });
+
+    it('rejects a record whose identifier cannot be resolved', () => {
+      expect(() => toResourceAccessActors([unidentifiableUser])).toThrow(ResourceAccessActorError);
+    });
+
+    it('rejects the whole batch when any one record is unidentifiable', () => {
+      expect(() => toResourceAccessActors([jane, unidentifiableUser])).toThrow(
+        ResourceAccessActorError
+      );
+    });
+
+    it('names the offending records on the error', () => {
+      let thrown: ResourceAccessActorError | undefined;
+      try {
+        toResourceAccessActors([jane, unidentifiableUser]);
+      } catch (error) {
+        thrown = error as ResourceAccessActorError;
+      }
+
+      expect(thrown?.actors).toEqual([unidentifiableUser]);
+      expect(thrown?.message).toContain(unidentifiableUser.email);
+    });
+
+    it('accepts an empty list', () => {
+      expect(toResourceAccessActors([])).toEqual([]);
+    });
   });
 
   describe('buildGrantAccessPayload', () => {
@@ -75,6 +112,12 @@ describe('resource access mapping payload', () => {
         notifyUsers: true
       });
     });
+
+    it('never emits an empty actorId', () => {
+      expect(() => buildGrantAccessPayload([unidentifiableUser])).toThrow(
+        ResourceAccessActorError
+      );
+    });
   });
 
   describe('buildRevokeAccessPayload', () => {
@@ -85,5 +128,11 @@ describe('resource access mapping payload', () => {
         notifyUsers: true
       });
     });
+
+    it('never emits an empty actorId', () => {
+      expect(() => buildRevokeAccessPayload([unidentifiableUser])).toThrow(
+        ResourceAccessActorError
+      );
+    });
   });
 });
diff --git a/src/__testing__/schemaConstructAliasTypes.test.ts b/src/__testing__/schemaConstructAliasTypes.test.ts
index e683b8df8..797e1c417 100644
--- a/src/__testing__/schemaConstructAliasTypes.test.ts
+++ b/src/__testing__/schemaConstructAliasTypes.test.ts
@@ -1,5 +1,4 @@
-import { spawnSync } from 'child_process';
-import path from 'path';
+import { type Diagnostics, typeCheckFixture } from './helpers/tscFixture';
 
 // Type-level regression guard for sistent's aliases of `@meshery/schemas`
 // constructs. See `fixtures/schemaConstructAliases.ts` for what is asserted and
@@ -9,64 +8,21 @@ import path from 'path';
 //
 // jest transforms with @swc/jest, which strips types without checking them, so
 // a plain type-only assertion file would pass no matter what it asserts. This
-// test therefore shells out to `tsc` over the fixture, exactly as
-// `navigationItemTitleTypes.test.ts` does; the two share their mechanics, and
-// the comments there explain each guard against the check turning vacuous.
+// test therefore shells out to `tsc` over the fixture through the shared
+// `typeCheckFixture` harness, which documents each guard that keeps the check
+// from turning vacuous.
 
 const FIXTURE = 'src/__testing__/fixtures/schemaConstructAliases.ts';
 const PROJECT = 'src/__testing__/fixtures/tsconfig.schemaConstructAliases.json';
-const repoRoot = path.resolve(__dirname, '..', '..');
-
-const FILE_SCOPED_DIAGNOSTIC = /^(.+?)\(\d+,\d+\): error TS\d+/;
-const CONFIG_SCOPED_DIAGNOSTIC = /^error TS\d+/;
-
-const asPosix = (value: string): string => value.replace(/\\/g, '/');
-
-type Diagnostics = { fixture: string[]; config: string[]; compiledFixture: boolean };
-
-const TSC_TIMEOUT_MS = 150_000;
-
-const typeCheckFixture = (): Diagnostics => {
-  const tsc = spawnSync(
-    process.execPath,
-    [require.resolve('typescript/bin/tsc'), '-p', PROJECT, '--pretty', 'false', '--listFiles'],
-    {
-      cwd: repoRoot,
-      encoding: 'utf8',
-      timeout: TSC_TIMEOUT_MS,
-      maxBuffer: 32 * 1024 * 1024
-    }
-  );
-
-  if (tsc.error) throw tsc.error;
-  if (tsc.status === null) {
-    throw new Error(`tsc was killed by ${tsc.signal ?? 'an unknown signal'} before reporting`);
-  }
-
-  const lines = `${tsc.stdout}\n${tsc.stderr}`.split('\n').map((line) => line.trim());
-
-  const belongsToFixture = (line: string): boolean => {
-    const file = FILE_SCOPED_DIAGNOSTIC.exec(line)?.[1];
-    return file !== undefined && asPosix(file).endsWith(FIXTURE);
-  };
-
-  return {
-    fixture: lines.filter(belongsToFixture),
-    config: lines.filter((line) => CONFIG_SCOPED_DIAGNOSTIC.test(line)),
-    compiledFixture: lines.some(
-      (line) => !FILE_SCOPED_DIAGNOSTIC.test(line) && asPosix(line).endsWith(FIXTURE)
-    )
-  };
-};
 
 describe('schemas construct alias contract', () => {
   let diagnostics: Diagnostics;
 
   beforeAll(() => {
-    diagnostics = typeCheckFixture();
+    diagnostics = typeCheckFixture(FIXTURE, PROJECT);
   }, 180_000);
 
-  // Ordered deliberately: the assertion below is only meaningful once the
+  // Ordered deliberately: the assertions below are only meaningful once the
   // fixture is known to have been compiled, so prove that first.
   it('compiles the fixture', () => {
     expect(diagnostics.compiledFixture).toBe(true);
diff --git a/src/custom/CatalogDetail/CollapsibleSection.tsx b/src/custom/CatalogDetail/CollapsibleSection.tsx
index a356f301a..54f48b67a 100644
--- a/src/custom/CatalogDetail/CollapsibleSection.tsx
+++ b/src/custom/CatalogDetail/CollapsibleSection.tsx
@@ -28,10 +28,16 @@ const CollapsibleSection: React.FC<CollapsibleSectionProps> = ({
     <SideContainer>
       <SideTitleButton onClick={onToggle}>
         <ListItemText
-          primaryTypographyProps={{
-            variant: 'h6',
-            fontWeight: 'bold',
-            fontFamily: 'inherit'
+          // MUI replaced `primaryTypographyProps` with the `primary` slot, and
+          // Typography no longer takes system props outside `sx`.
+          slotProps={{
+            primary: {
+              variant: 'h6',
+              sx: {
+                fontWeight: 'bold',
+                fontFamily: 'inherit'
+              }
+            }
           }}
           primary={title}
         />
@@ -55,8 +61,14 @@ const CollapsibleSection: React.FC<CollapsibleSectionProps> = ({
               opacity: 0.8,
               padding: '7px'
             }}
-            primaryTypographyProps={{
-              fontFamily: 'inherit'
+            // MUI replaced `primaryTypographyProps` with the `primary` slot, and
+            // Typography no longer takes system props outside `sx`.
+            slotProps={{
+              primary: {
+                sx: {
+                  fontFamily: 'inherit'
+                }
+              }
             }}
             primary={emptyState}
           />
diff --git a/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx b/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx
index 825266a1f..32a3a3163 100644
--- a/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx
+++ b/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx
@@ -144,7 +144,9 @@ const CollaboratorAvatarGroup = ({
           return (
             <CustomTooltip
               key={clientID}
-              componentsProps={{
+              // MUI replaced `componentsProps` with `slotProps`, which is also
+              // the only one `CustomTooltip` merges over its own defaults.
+              slotProps={{
                 tooltip: {
                   sx: {
                     background: theme.palette.background.paper,
@@ -194,7 +196,8 @@ const CollaboratorAvatarGroup = ({
                 alt={user.name}
                 src={user.avatarUrl}
                 borderColor={user.borderColor}
-                imgProps={{ referrerPolicy: 'no-referrer' }}
+                // MUI replaced `imgProps` with the `img` slot.
+                slotProps={{ img: { referrerPolicy: 'no-referrer' } }}
                 onClick={() => openInNewTab(`${providerUrl}/user/${user.userId}`)}
               />
             </CustomTooltip>
@@ -243,7 +246,8 @@ const CollaboratorAvatarGroup = ({
                     alt={user.name}
                     src={user.avatarUrl}
                     borderColor={user.borderColor}
-                    imgProps={{ referrerPolicy: 'no-referrer' }}
+                    // MUI replaced `imgProps` with the `img` slot.
+                    slotProps={{ img: { referrerPolicy: 'no-referrer' } }}
                   />
                   <UserName variant="body1">{user.name}</UserName>
                 </PopupAvatarWrapper>
diff --git a/src/custom/ShareModal/index.tsx b/src/custom/ShareModal/index.tsx
index 1eb789acc..b05dae426 100644
--- a/src/custom/ShareModal/index.tsx
+++ b/src/custom/ShareModal/index.tsx
@@ -2,6 +2,7 @@ import ShareModal from './ShareModal';
 
 export { ShareModal };
 export {
+  ResourceAccessActorError,
   buildGrantAccessPayload,
   buildRevokeAccessPayload,
   toResourceAccessActors,
diff --git a/src/custom/ShareModal/resourceAccessPayload.ts b/src/custom/ShareModal/resourceAccessPayload.ts
index d0135db8b..aee162111 100644
--- a/src/custom/ShareModal/resourceAccessPayload.ts
+++ b/src/custom/ShareModal/resourceAccessPayload.ts
@@ -1,4 +1,4 @@
-import { User, getUserIdentifier } from '../../utils/user';
+import { User, getUserIdentifier, getUserLabel } from '../../utils/user';
 
 /**
  * The wire contract for `POST /api/resources/{resourceType}/{resourceId}/share`.
@@ -28,23 +28,57 @@ export interface ResourceAccessMappingPayload {
   notifyUsers: boolean;
 }
 
+/**
+ * Thrown by {@link toResourceAccessActors} for records whose identifier cannot
+ * be resolved. {@link ResourceAccessActorError.actors} carries the offending
+ * records so a caller can name them back to the user.
+ */
+export class ResourceAccessActorError extends Error {
+  readonly actors: User[];
+
+  constructor(actors: User[]) {
+    const labels = actors.map((actor) => getUserLabel(actor) || '<unidentifiable record>');
+    super(`Cannot build a resource access payload: ${labels.join(', ')} has no identifier`);
+    this.name = 'ResourceAccessActorError';
+    this.actors = actors;
+  }
+}
+
 /**
  * Maps user records onto share actors, resolving each identifier through the
- * canonical-then-legacy fallback in {@link getUserIdentifier}. Callers must
- * reject records without an identifier before building a payload: an empty
- * `actorId` is accepted by the server as a no-op entry.
+ * canonical-then-legacy fallback in {@link getUserIdentifier}.
+ *
+ * Records that resolve to no identifier are rejected here rather than emitted
+ * as `actorId: ''`. The server's `models.Actor.ActorId` is `core.Uuid`, i.e.
+ * gofrs `uuid.UUID`, whose `UnmarshalText` rejects a zero-length string, so an
+ * empty `actorId` fails `HandleResourceShare`'s `json.Unmarshal` and takes the
+ * whole request down with a 400 - every other actor in the batch included.
+ *
+ * @throws {ResourceAccessActorError} when any record has no identifier.
  */
-export const toResourceAccessActors = (users: User[]): ResourceAccessActor[] =>
-  users.map((user) => ({ actorId: getUserIdentifier(user), actorType: 'user' }));
+export const toResourceAccessActors = (users: User[]): ResourceAccessActor[] => {
+  const unidentifiable = users.filter((user) => !getUserIdentifier(user));
+  if (unidentifiable.length > 0) throw new ResourceAccessActorError(unidentifiable);
 
-/** Payload that grants `users` access and notifies them. */
+  return users.map((user) => ({ actorId: getUserIdentifier(user), actorType: 'user' }));
+};
+
+/**
+ * Payload that grants `users` access and notifies them.
+ *
+ * @throws {ResourceAccessActorError} when any record has no identifier.
+ */
 export const buildGrantAccessPayload = (users: User[]): ResourceAccessMappingPayload => ({
   grantAccess: toResourceAccessActors(users),
   revokeAccess: [],
   notifyUsers: true
 });
 
-/** Payload that revokes `users`' access and notifies them. */
+/**
+ * Payload that revokes `users`' access and notifies them.
+ *
+ * @throws {ResourceAccessActorError} when any record has no identifier.
+ */
 export const buildRevokeAccessPayload = (users: User[]): ResourceAccessMappingPayload => ({
   grantAccess: [],
   revokeAccess: toResourceAccessActors(users),
diff --git a/src/custom/Workspaces/types.ts b/src/custom/Workspaces/types.ts
index dd80ed631..33fa26419 100644
--- a/src/custom/Workspaces/types.ts
+++ b/src/custom/Workspaces/types.ts
@@ -41,6 +41,15 @@ export interface AssignmentHookResult<T> {
  *    some provider endpoints still emit the legacy Go `sql.NullTime`
  *    `{ Valid, Time }` object. See `src/utils/nullTime.ts` for the crash that
  *    reading `.Valid` off a value typed to the canonical shape produced.
+ *
+ * And one narrowing, inherited rather than chosen: `metadata` arrives as the
+ * canonical `Record<string, never>`, which is what openapi-typescript emits for
+ * a free-form object with no declared properties - an artifact of the generator,
+ * not a statement that the map is empty. It reads as `never` for every key.
+ * Nothing in sistent reads `workspace.metadata` today, so it is carried through
+ * unchanged rather than re-widened locally: a local override would be exactly
+ * the hand-copied shape this derivation exists to eliminate. The first caller
+ * that needs it should get the canonical fixed in `meshery/schemas` instead.
  */
 export type Workspace = Omit<CanonicalWorkspace, 'organizationId' | 'deletedAt'> & {
   organizationId?: CanonicalWorkspace['organizationId'];
diff --git a/src/index.tsx b/src/index.tsx
index 99ff399e1..b349323dd 100644
--- a/src/index.tsx
+++ b/src/index.tsx
@@ -100,10 +100,17 @@ export { ActionButton, type ActionButtonProps, type Option } from './custom/Acti
 // still answers 200, so a hand-rolled body fails as a successful no-op.
 // Without the declarations a host cannot type that body at all and falls back
 // to the object literal that caused the bug.
+//
+// Taken from the leaf `resourceAccessPayload` module rather than the
+// `ShareModal` barrel, for the same reason as `TableActions` above: these are
+// three pure functions, and routing them through the barrel would make the
+// declaration bundle a root file out of `ShareModal.tsx` and gate the build on
+// that component's whole type surface.
 export {
+  ResourceAccessActorError,
   buildGrantAccessPayload,
   buildRevokeAccessPayload,
   toResourceAccessActors,
   type ResourceAccessActor,
   type ResourceAccessMappingPayload
-} from './custom/ShareModal';
+} from './custom/ShareModal/resourceAccessPayload';

From 9482f6c366059e6e3268aab51ddf5c619b66f080 Mon Sep 17 00:00:00 2001
From: "Mericio \"Hablo\" Salazar"
 <218162243+simihablo@users.noreply.github.com>
Date: Fri, 7 Aug 2026 11:35:19 -0500
Subject: [PATCH 03/13] no-mistakes(review): migrate remaining removed MUI
 props; export ShareModal types

Signed-off-by: Mericio "Hablo" Salazar <218162243+simihablo@users.noreply.github.com>
---
 AGENTS.md                                      | 18 ++++++++++++++++++
 src/custom/CatalogDetail/SocialSharePopper.tsx | 11 +++++++----
 .../CatalogFilterSection/FilterSection.tsx     |  3 ++-
 .../CustomCatalog/CatalogCardDesignLogo.tsx    | 15 +++++++++------
 src/custom/CustomImage/CustomImage.tsx         | 15 +++++++++------
 .../ResourceDetailFormatters/Component.tsx     |  3 ++-
 src/custom/ShareModal/ShareModal.tsx           |  6 +++---
 src/custom/ShareModal/index.tsx                |  1 +
 src/custom/TypingFilter/TypingFIlters.tsx      |  3 ++-
 .../TypingFilter/TypingFilterSuggestions.tsx   |  3 ++-
 src/index.tsx                                  |  9 +++++++++
 11 files changed, 64 insertions(+), 23 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 8734397a5..3f15ab699 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -206,6 +206,24 @@ a new public component or type in a `src/<domain>/` subtree, also add an explici
 of examples there, e.g. `FeedbackButton`, `NavigationItem`). Verify by building and grepping
 `dist/index.d.ts` for the symbol - a green `jest`/lint run will not catch this.
 
+The explicit block is a stopgap, not the fix. Measure the real gap before assuming a symbol is
+covered - it is large, and every uncovered symbol is one a consumer must shim locally:
+
+```bash
+npm run build
+node -e 'const f=require("fs"),rt=new Set();
+for(const b of f.readFileSync("dist/index.mjs","utf8").matchAll(/export\s*\{([^{}]*)\}\s*;?/g))
+  b[1].split(",").map(s=>s.trim()).filter(Boolean).forEach(s=>rt.add(s.split(/\s+as\s+/).pop().trim()));
+const d=f.readFileSync("dist/index.d.ts","utf8");
+console.log([...rt].filter(n=>/^[A-Za-z_$][\w$]*$/.test(n)&&!new RegExp("\\b"+n+"\\b").test(d)).sort().join("\n"))'
+```
+
+At `e41ece8f` that reports 131 of 729 runtime exports absent from the declaration bundle -
+`WorkspaceCard`, `TeamTable`, `UsersTable`, `CustomImage`, `ErrorBoundary` and most of
+`src/custom/` among them. Adding 131 lines is not the answer; the durable fix is in how the
+declaration bundle is produced. Until then, prefer extending this list over leaving a symbol
+uncovered, and do not read its absence as "that component is intentionally private".
+
 ## Repo state that looks broken but is pre-existing
 
 `prettier --check` fails on dozens of files and `tsc --noEmit` reports errors across `src/`
diff --git a/src/custom/CatalogDetail/SocialSharePopper.tsx b/src/custom/CatalogDetail/SocialSharePopper.tsx
index 23225927d..c636b4f1d 100644
--- a/src/custom/CatalogDetail/SocialSharePopper.tsx
+++ b/src/custom/CatalogDetail/SocialSharePopper.tsx
@@ -75,10 +75,13 @@ const SocialSharePopper: React.FC<SocialSharePopperProps> = ({
               open={open}
               onClose={handleClose}
               onClick={handleClose}
-              PaperProps={{
-                sx: {
-                  p: 0,
-                  width: 'auto'
+              // MUI replaced `PaperProps` with the `paper` slot.
+              slotProps={{
+                paper: {
+                  sx: {
+                    p: 0,
+                    width: 'auto'
+                  }
                 }
               }}
               sx={{
diff --git a/src/custom/CatalogFilterSection/FilterSection.tsx b/src/custom/CatalogFilterSection/FilterSection.tsx
index 172fd70b8..d8ab625b5 100644
--- a/src/custom/CatalogFilterSection/FilterSection.tsx
+++ b/src/custom/CatalogFilterSection/FilterSection.tsx
@@ -135,7 +135,8 @@ const FilterSection: React.FC<FilterSectionProps> = ({
 
                   {option.Icon && <option.Icon width="20px" height="20px" />}
 
-                  <Typography fontFamily={styleProps.fontFamily}>{option.label}</Typography>
+                  {/* MUI dropped system props from Typography; they go through `sx`. */}
+                  <Typography sx={{ fontFamily: styleProps.fontFamily }}>{option.label}</Typography>
                 </Stack>
                 <Stack direction="row" sx={optionGroupSx}>
                   {option.totalCount !== undefined && `(${option.totalCount || 0})`}
diff --git a/src/custom/CustomCatalog/CatalogCardDesignLogo.tsx b/src/custom/CustomCatalog/CatalogCardDesignLogo.tsx
index 9a9038e44..26bbe135c 100644
--- a/src/custom/CustomCatalog/CatalogCardDesignLogo.tsx
+++ b/src/custom/CustomCatalog/CatalogCardDesignLogo.tsx
@@ -79,12 +79,15 @@ const CatalogCardDesignLogo: React.FC<CatalogCardDesignLogoProps> = ({
             style={{
               backgroundColor: 'rgba(0, 0, 0, 0.8)'
             }}
-            PaperProps={{
-              style: {
-                background: 'transparent',
-                boxShadow: 'none',
-                overflow: 'hidden',
-                maxWidth: '60vw'
+            // MUI replaced `PaperProps` with the `paper` slot.
+            slotProps={{
+              paper: {
+                style: {
+                  background: 'transparent',
+                  boxShadow: 'none',
+                  overflow: 'hidden',
+                  maxWidth: '60vw'
+                }
               }
             }}
           >
diff --git a/src/custom/CustomImage/CustomImage.tsx b/src/custom/CustomImage/CustomImage.tsx
index d31009100..e1fcbcaed 100644
--- a/src/custom/CustomImage/CustomImage.tsx
+++ b/src/custom/CustomImage/CustomImage.tsx
@@ -75,12 +75,15 @@ const CustomImage: React.FC<ImageComponentProps> = ({
         style={{
           backgroundColor: 'rgba(0, 0, 0, 0.8)'
         }}
-        PaperProps={{
-          style: {
-            background: 'transparent',
-            boxShadow: 'none',
-            overflow: 'auto',
-            maxWidth: '100%'
+        // MUI replaced `PaperProps` with the `paper` slot.
+        slotProps={{
+          paper: {
+            style: {
+              background: 'transparent',
+              boxShadow: 'none',
+              overflow: 'auto',
+              maxWidth: '100%'
+            }
           }
         }}
       >
diff --git a/src/custom/ResourceDetailFormatters/Component.tsx b/src/custom/ResourceDetailFormatters/Component.tsx
index dc1984da9..d4ca79a3e 100644
--- a/src/custom/ResourceDetailFormatters/Component.tsx
+++ b/src/custom/ResourceDetailFormatters/Component.tsx
@@ -163,8 +163,9 @@ export const KeyValueInRow: React.FC<KeyValueProps> = ({ Key, Value, showFold =
     setIsFolded(!isFolded);
   };
 
+  // MUI dropped system props from Grid; they go through `sx`.
   return (
-    <KeyValueGrid container rowGap={0.5}>
+    <KeyValueGrid container sx={{ rowGap: 0.5 }}>
       <React.Fragment key={Key}>
         <KeyValueGridCell container size={{ xs: 12, sm: 3 }}>
           <KeyValueGridTitle>{Key}</KeyValueGridTitle>
diff --git a/src/custom/ShareModal/ShareModal.tsx b/src/custom/ShareModal/ShareModal.tsx
index 94263ffa8..c87de019c 100644
--- a/src/custom/ShareModal/ShareModal.tsx
+++ b/src/custom/ShareModal/ShareModal.tsx
@@ -91,7 +91,7 @@ const AccessListActor: React.FC<AccessListActorProps> = ({
         <Avatar
           alt={getUserDisplayName(actorData)}
           src={actorData.avatarUrl}
-          // MUI v7 replaced `imgProps` with the `img` slot.
+          // MUI replaced `imgProps` with the `img` slot.
           slotProps={{ img: { referrerPolicy: 'no-referrer' } }}
           onClick={() => {
             if (hostURL) openInNewTab(`${hostURL}/user/${getUserIdentifier(actorData)}`);
@@ -101,7 +101,7 @@ const AccessListActor: React.FC<AccessListActorProps> = ({
       <ListItemText
         primary={getUserDisplayName(actorData)}
         secondary={getUserContactLabel(actorData)}
-        // MUI v7 replaced `secondaryTypographyProps` with the `secondary` slot.
+        // MUI replaced `secondaryTypographyProps` with the `secondary` slot.
         slotProps={{
           secondary: {
             sx: {
@@ -174,7 +174,7 @@ export type ResourceAccessArg = {
   resourceAccessMappingPayload: ResourceAccessMappingPayload;
 };
 
-interface ShareModalProps {
+export interface ShareModalProps {
   /** Function to close the share modal */
   handleShareModalClose: () => void;
   /** The resource(s) that is selected for sharing.*/
diff --git a/src/custom/ShareModal/index.tsx b/src/custom/ShareModal/index.tsx
index b05dae426..a8f1d7e69 100644
--- a/src/custom/ShareModal/index.tsx
+++ b/src/custom/ShareModal/index.tsx
@@ -1,6 +1,7 @@
 import ShareModal from './ShareModal';
 
 export { ShareModal };
+export type { ResourceAccessArg, ShareModalProps } from './ShareModal';
 export {
   ResourceAccessActorError,
   buildGrantAccessPayload,
diff --git a/src/custom/TypingFilter/TypingFIlters.tsx b/src/custom/TypingFilter/TypingFIlters.tsx
index b19834b3f..6d9296e0a 100644
--- a/src/custom/TypingFilter/TypingFIlters.tsx
+++ b/src/custom/TypingFilter/TypingFIlters.tsx
@@ -46,7 +46,8 @@ export function TypingFilters({
             <Typography variant="body1">{filter.values}:</Typography>
             <Typography variant="body1">{filter.description}</Typography>
           </ListItem>
-          <Divider light />
+          {/* MUI removed Divider's `light` prop; the opacity is its replacement. */}
+          <Divider sx={{ opacity: 0.6 }} />
         </React.Fragment>
       ))}
     </List>
diff --git a/src/custom/TypingFilter/TypingFilterSuggestions.tsx b/src/custom/TypingFilter/TypingFilterSuggestions.tsx
index 2cfe03864..fbe806c86 100644
--- a/src/custom/TypingFilter/TypingFilterSuggestions.tsx
+++ b/src/custom/TypingFilter/TypingFilterSuggestions.tsx
@@ -47,7 +47,8 @@ export function TypingFilterValueSuggestions({
               {suggestion}
             </Typography>
           </ListItem>
-          <Divider light />
+          {/* MUI removed Divider's `light` prop; the opacity is its replacement. */}
+          <Divider sx={{ opacity: 0.6 }} />
         </React.Fragment>
       ))}
     </List>
diff --git a/src/index.tsx b/src/index.tsx
index b349323dd..18961b8f4 100644
--- a/src/index.tsx
+++ b/src/index.tsx
@@ -114,3 +114,12 @@ export {
   type ResourceAccessActor,
   type ResourceAccessMappingPayload
 } from './custom/ShareModal/resourceAccessPayload';
+// The component itself is dropped by the same quirk, which left hosts able to
+// type the share body but not the component consuming it. This is one instance
+// of a wider gap: 131 runtime exports reach `dist/index.js` without reaching
+// `dist/index.d.ts`, so a per-symbol line here is a stopgap, not the fix.
+export {
+  ShareModal,
+  type ResourceAccessArg,
+  type ShareModalProps
+} from './custom/ShareModal';

From df0ad70717323cc2770a7120154d550362d6932b Mon Sep 17 00:00:00 2001
From: "Mericio \"Hablo\" Salazar"
 <218162243+simihablo@users.noreply.github.com>
Date: Fri, 7 Aug 2026 11:35:19 -0500
Subject: [PATCH 04/13] no-mistakes(review): drop tooltip surface override;
 remove dead Stack prop

Signed-off-by: Mericio "Hablo" Salazar <218162243+simihablo@users.noreply.github.com>
---
 .../CollaboratorAvatarGroup.tsx               | 19 +++----------------
 src/custom/Stepper/index.tsx                  |  3 ++-
 2 files changed, 5 insertions(+), 17 deletions(-)

diff --git a/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx b/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx
index 32a3a3163..9bfea9317 100644
--- a/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx
+++ b/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx
@@ -144,22 +144,9 @@ const CollaboratorAvatarGroup = ({
           return (
             <CustomTooltip
               key={clientID}
-              // MUI replaced `componentsProps` with `slotProps`, which is also
-              // the only one `CustomTooltip` merges over its own defaults.
-              slotProps={{
-                tooltip: {
-                  sx: {
-                    background: theme.palette.background.paper,
-                    color: theme.palette.text.primary,
-                    boxShadow: theme.shadows[4]
-                  }
-                },
-                arrow: {
-                  sx: {
-                    color: theme.palette.background.paper
-                  }
-                }
-              }}
+              // The surface is deliberately inherited from `CustomTooltip`'s own
+              // default: no other call site overrides it, and `background.paper`
+              // is not a sistent token.
               title={
                 <div style={{ display: 'flex', justifyContent: 'center', flexDirection: 'column' }}>
                   <Typography
diff --git a/src/custom/Stepper/index.tsx b/src/custom/Stepper/index.tsx
index 586495aeb..213a2f3b4 100644
--- a/src/custom/Stepper/index.tsx
+++ b/src/custom/Stepper/index.tsx
@@ -138,7 +138,8 @@ const CustomizedStepper: React.FC<CustomizedStepperPropsI> = ({
       <Stack
         data-testid="stepper-header"
         direction="row"
-        justifyContent="center"
+        // MUI dropped system props from Stack; they go through `sx`.
+        sx={{ justifyContent: 'center' }}
         style={{ paddingBlock: '1rem', backgroundColor: theme.palette.background.blur?.heavy }}
       >
         <Stepper

From a438751e7fd348008fae852131a609c5671eae69 Mon Sep 17 00:00:00 2001
From: "Mericio \"Hablo\" Salazar"
 <218162243+simihablo@users.noreply.github.com>
Date: Fri, 7 Aug 2026 11:35:19 -0500
Subject: [PATCH 05/13] no-mistakes(review): fix tooltip content contrast; drop
 dead ClickAwayListener prop

Signed-off-by: Mericio "Hablo" Salazar <218162243+simihablo@users.noreply.github.com>
---
 .../CollaboratorAvatarGroup.tsx                  | 16 ++++++++++++++--
 src/custom/TypingFilter/index.tsx                |  2 +-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx b/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx
index 9bfea9317..6cb6d865c 100644
--- a/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx
+++ b/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx
@@ -1,4 +1,5 @@
 import { ExpandMore } from '@mui/icons-material';
+import { alpha } from '@mui/material';
 import { MouseEvent, useState } from 'react';
 import { Avatar, AvatarGroup, Button, Divider, Popover, Typography } from '../../base';
 import { iconSmall } from '../../constants/iconsSizes';
@@ -160,7 +161,17 @@ const CollaboratorAvatarGroup = ({
                   >
                     {user.name}
                   </Typography>
-                  <Divider />
+                  {/*
+                    WORKAROUND for https://github.com/layer5io/sistent/issues/1783 - delete
+                    both `borderColor` overrides once that component-level fix lands, and do
+                    not copy this into other tooltips. `CustomTooltip`'s surface is the
+                    literal `#141414` in both palette modes, but `palette.divider` and the
+                    theme's outlined-button border resolve to mode-dependent tokens, so in
+                    light mode the separator is invisible and the button outline is near
+                    black-on-black. These two are fixed to white alphas, which are stable
+                    across modes because the surface they sit on is.
+                  */}
+                  <Divider style={{ borderColor: alpha(theme.palette.common.white, 0.2) }} />
                   <Button
                     size="small"
                     variant="outlined"
@@ -169,7 +180,8 @@ const CollaboratorAvatarGroup = ({
                       fontSize: '1rem',
                       padding: '2px 8px',
                       minWidth: 'auto',
-                      marginTop: '8px'
+                      marginTop: '8px',
+                      borderColor: alpha(theme.palette.common.white, 0.4)
                     }}
                   >
                     Open Recents
diff --git a/src/custom/TypingFilter/index.tsx b/src/custom/TypingFilter/index.tsx
index b2c494953..f4293564d 100644
--- a/src/custom/TypingFilter/index.tsx
+++ b/src/custom/TypingFilter/index.tsx
@@ -158,7 +158,7 @@ export function TypingFilter({ filterSchema, handleFilter, autoFilter = false }:
         {({ TransitionProps }) => {
           return (
             <Fade {...TransitionProps} timeout={100}>
-              <ClickAwayListener onKeydown onClickAway={handleClickAway}>
+              <ClickAwayListener onClickAway={handleClickAway}>
                 <div
                   style={{
                     width: inputFieldRef.current ? inputFieldRef.current.clientWidth : 0

From e14f64d08a27721b9c6087ed93557f5f4abebe5a Mon Sep 17 00:00:00 2001
From: "Mericio \"Hablo\" Salazar"
 <218162243+simihablo@users.noreply.github.com>
Date: Fri, 7 Aug 2026 15:09:44 -0500
Subject: [PATCH 06/13] no-mistakes(review): repoint team/org pickers at
 canonical constructs; fix phantom ID keys

Signed-off-by: Mericio "Hablo" Salazar <218162243+simihablo@users.noreply.github.com>
---
 AGENTS.md                                     |  4 +-
 .../fixtures/schemaConstructAliases.ts        | 27 ++++++++++-
 .../GettingStartedWidget/InviteUserModal.tsx  | 35 ++++++++++-----
 .../GettingStartedWidget/TeamSearchField.tsx  | 43 +++++++++++-------
 src/custom/ShareModal/ShareModal.tsx          | 10 ++++-
 src/custom/Workspaces/types.ts                | 45 +++++++++++++++++--
 src/index.tsx                                 | 12 ++---
 7 files changed, 136 insertions(+), 40 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 3f15ab699..2a875c23a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -218,9 +218,9 @@ const d=f.readFileSync("dist/index.d.ts","utf8");
 console.log([...rt].filter(n=>/^[A-Za-z_$][\w$]*$/.test(n)&&!new RegExp("\\b"+n+"\\b").test(d)).sort().join("\n"))'
 ```
 
-At `e41ece8f` that reports 131 of 729 runtime exports absent from the declaration bundle -
+As of this change that reports 129 of 729 runtime exports absent from the declaration bundle -
 `WorkspaceCard`, `TeamTable`, `UsersTable`, `CustomImage`, `ErrorBoundary` and most of
-`src/custom/` among them. Adding 131 lines is not the answer; the durable fix is in how the
+`src/custom/` among them. Adding 129 lines is not the answer; the durable fix is in how the
 declaration bundle is produced. Until then, prefer extending this list over leaving a symbol
 uncovered, and do not read its absence as "that component is intentionally private".
 
diff --git a/src/__testing__/fixtures/schemaConstructAliases.ts b/src/__testing__/fixtures/schemaConstructAliases.ts
index b2ab01093..c778d1883 100644
--- a/src/__testing__/fixtures/schemaConstructAliases.ts
+++ b/src/__testing__/fixtures/schemaConstructAliases.ts
@@ -20,11 +20,13 @@
 import type { components as DesignComponents } from '@meshery/schemas/constructs/v1beta3/design/Design';
 import type { components as EnvironmentComponents } from '@meshery/schemas/constructs/v1beta3/environment/Environment';
 import type { components as EventComponents } from '@meshery/schemas/constructs/v1beta3/event/Event';
+import type { components as OrganizationComponents } from '@meshery/schemas/constructs/v1beta2/organization/Organization';
 import type { components as TeamComponents } from '@meshery/schemas/constructs/v1beta2/team/Team';
 import type { components as UserComponents } from '@meshery/schemas/constructs/v1beta3/user/User';
 import type { components as WorkspaceComponents } from '@meshery/schemas/constructs/v1beta3/workspace/Workspace';
 import type { UserProfile } from '../../custom/CatalogDetail/types';
 import type { Pattern } from '../../custom/CustomCatalog/CustomCard';
+import type { Team as PickedTeam } from '../../custom/DashboardWidgets/GettingStartedWidget/TeamSearchField';
 import type { Environment, Team, Workspace } from '../../custom/Workspaces/types';
 import type { User } from '../../utils/user';
 
@@ -50,6 +52,7 @@ type Expect<T extends true> = T;
 type CanonicalWorkspace = WorkspaceComponents['schemas']['Workspace'];
 type CanonicalEnvironment = EnvironmentComponents['schemas']['Environment'];
 type CanonicalTeam = TeamComponents['schemas']['Team'];
+type CanonicalOrganization = OrganizationComponents['schemas']['Organization'];
 type CanonicalSearchableUser = UserComponents['schemas']['SearchableUser'];
 type CanonicalPattern = DesignComponents['schemas']['MesheryPattern'];
 type CanonicalCatalogData = NonNullable<CanonicalPattern['catalogData']>;
@@ -68,7 +71,16 @@ export type EnvironmentOverrides = RequiresKey<
   'createdAt' | 'updatedAt' | 'id' | 'name'
 >;
 
-export type TeamOverrides = RequiresKey<CanonicalTeam, 'deletedAt' | 'id' | 'name'>;
+export type TeamOverrides = RequiresKey<
+  CanonicalTeam,
+  'deletedAt' | 'id' | 'name' | 'createdAt' | 'updatedAt'
+>;
+
+// The picker projections. Each names only the fields its component reads, so
+// the `Pick` is the whole contract and a rename upstream has to fail here.
+export type TeamPickerOverrides = RequiresKey<CanonicalTeam, 'id' | 'name' | 'deletedAt'>;
+
+export type OrganizationPickerOverrides = RequiresKey<CanonicalOrganization, 'id' | 'name'>;
 
 export type UserOverrides = RequiresKey<
   CanonicalSearchableUser,
@@ -143,6 +155,13 @@ export type EnvironmentOrgIdIsCanonical = Expect<
 
 export type TeamNameIsCanonical = Expect<IsExact<Team['name'], CanonicalTeam['name']>>;
 
+// The team-picker projection in `TeamSearchField`: its two identity fields are
+// carried through from the canonical unchanged, so a retype upstream (a uuid
+// becoming a number, the way `WorkspaceCard`'s id had drifted) fails here.
+export type PickedTeamIdIsCanonical = Expect<IsExact<PickedTeam['id'], CanonicalTeam['id']>>;
+
+export type PickedTeamNameIsCanonical = Expect<IsExact<PickedTeam['name'], CanonicalTeam['name']>>;
+
 export type UserEmailIsCanonical = Expect<
   IsExact<User['email'], CanonicalSearchableUser['email']>
 >;
@@ -167,6 +186,12 @@ export type ExpectRejectsAMismatch = Expect<IsExact<CanonicalWorkspace['id'], nu
 // @ts-expect-error - the canonical team construct has no `teamId`
 export type TeamHasNoTeamId = RequiresKey<CanonicalTeam, 'teamId'>;
 
+// `ID` is the same defect one file over: `TeamSearchField` keyed its option
+// rows and its selected-team chips off `team.ID`, which the canonical has never
+// carried either - the identity field is the lowercase `id` above.
+// @ts-expect-error - the canonical team construct has no `ID`
+export type TeamHasNoUppercaseId = RequiresKey<CanonicalTeam, 'ID'>;
+
 // The same technique used as an expiry date on the two workarounds whose doc
 // comments promise their own removal. Both are suppressed errors today; the
 // moment the upstream fix lands the suppression goes unused, tsc reports TS2578
diff --git a/src/custom/DashboardWidgets/GettingStartedWidget/InviteUserModal.tsx b/src/custom/DashboardWidgets/GettingStartedWidget/InviteUserModal.tsx
index 850ef65cf..cb5e147fc 100644
--- a/src/custom/DashboardWidgets/GettingStartedWidget/InviteUserModal.tsx
+++ b/src/custom/DashboardWidgets/GettingStartedWidget/InviteUserModal.tsx
@@ -2,6 +2,7 @@
 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
 // @ts-nocheck
 
+import type { components as OrganizationComponents } from '@meshery/schemas/constructs/v1beta2/organization/Organization';
 import { useEffect, useState } from 'react';
 import {
   Box,
@@ -17,7 +18,7 @@ import { InviteUserIcon } from '../../../icons';
 import { styled, useTheme } from '../../../theme';
 import { Modal, ModalBody, ModalFooter, PrimaryActionButtons } from '../../Modal';
 import { withDefaultPageArgs } from '../../PerformersSection/PerformersSection';
-import TeamSearchField from './TeamSearchField';
+import TeamSearchField, { type Team } from './TeamSearchField';
 
 const CreateUserInputField = styled(TextField)(() => ({
   width: 'auto'
@@ -39,15 +40,29 @@ const FormControlSelect = styled(FormControl)(() => ({
 const EMAIL_REGEXP =
   /^[\w!#$%&'*+\-\\/=?^_`{|}~]+(\.[\w!#$%&'*+\-\\/=?^_`{|}~]+)*@[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*(\.[a-zA-Z]{2,})$/;
 
-interface Organization {
-  id: string;
-  name: string;
-}
-
-interface Team {
-  id: string;
-  name: string;
-}
+/** The canonical v1beta2 organization construct, as `getOrgs` serves it. */
+type CanonicalOrganization = OrganizationComponents['schemas']['Organization'];
+
+/**
+ * The organization-picker projection: the two fields this modal renders and
+ * submits, derived from the canonical v1beta2 construct so that a rename
+ * upstream fails here rather than silently rendering `undefined`.
+ *
+ * No divergence from the canonical - both fields are required there too. The
+ * `{ id: 'none', name: 'None' }` sentinel this modal starts from is a local
+ * "no organization selected" placeholder, not a wire record, and satisfies the
+ * projection unchanged.
+ *
+ * The derivation is not enforced while this file carries `@ts-nocheck` above.
+ * That directive is held in place by the `Select` call sites below, not by
+ * anything here: their `onChange` handlers declare a `{ target: { value } }`
+ * shape rather than MUI's `SelectChangeEvent`, and the organization `Select`
+ * holds an object value against string-valued `MenuItem`s. Untangling that is
+ * a MUI typing change with its own behavioural risk, so it is deliberately not
+ * bundled with this schema repoint. `TeamSearchField` - the other half of this
+ * widget, and where the phantom `ID` reads lived - is checked.
+ */
+type Organization = Pick<CanonicalOrganization, 'id' | 'name'>;
 
 interface ErrorMessages {
   inviteeEmail: string;
diff --git a/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx b/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
index e69bb6e61..2804dea65 100644
--- a/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
+++ b/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
@@ -1,6 +1,4 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
-// eslint-disable-next-line @typescript-eslint/ban-ts-comment
-// @ts-nocheck
 import { Autocomplete, Box, Typography } from '@mui/material';
 import { styled } from '@mui/material/styles';
 import { debounce } from 'lodash';
@@ -9,13 +7,29 @@ import { Chip, CircularProgress, TextField, Tooltip } from '../../../base';
 import { iconSmall } from '../../../constants/iconsSizes';
 import { CloseIcon } from '../../../icons';
 import { DeletedAt, isSoftDeleted } from '../../../utils/nullTime';
+import { CanonicalTeam } from '../../Workspaces/types';
 
-interface Team {
-  id: string;
-  ID: string;
-  name: string;
+/**
+ * The team-picker projection: the three fields this field reads off a team
+ * record served by `getTeams`, derived from the canonical v1beta2 construct so
+ * that a rename upstream fails here rather than silently rendering `undefined`.
+ *
+ * One deliberate widening: `deletedAt` is {@link DeletedAt} rather than the
+ * canonical `string | undefined`, because some provider endpoints still emit
+ * the legacy Go `sql.NullTime` `{ Valid, Time }` object. See
+ * `src/utils/nullTime.ts` - this field's team search is the crash that
+ * documents.
+ *
+ * This type previously also declared `ID`, read by the option and chip `key`
+ * props. It has never existed on the wire: meshery-cloud aliases its `Team`
+ * straight to the canonical `team.Team`, whose identity field is `id`. The
+ * same phantom-identity defect the bulk-delete button carried through
+ * `teamId` / `team_name`; see {@link CanonicalTeam}'s consumer in
+ * `src/custom/Workspaces/types.ts`.
+ */
+export type Team = Pick<CanonicalTeam, 'id' | 'name'> & {
   deletedAt?: DeletedAt;
-}
+};
 
 interface TeamSearchFieldProps {
   teamsData: Team[];
@@ -60,7 +74,6 @@ const TeamSearchField: React.FC<TeamSearchFieldProps> = ({
   useNotificationHandlers
 }) => {
   const [error, setError] = useState<boolean>(false);
-  const [inputValue, setInputValue] = useState<string>('');
   const [options, setOptions] = useState<Team[]>([]);
   const [isLoading, setIsLoading] = useState<boolean>(false);
   const [showAllTeams, setShowAllTeams] = useState<boolean>(false);
@@ -91,7 +104,7 @@ const TeamSearchField: React.FC<TeamSearchFieldProps> = ({
     setTeamsData(teamsData.filter((team) => team.id !== teamId));
   };
 
-  const handleAdd = (_: string, value: Team): void => {
+  const handleAdd = (_: React.SyntheticEvent, value: Team): void => {
     setTeamsData((prevData: Team[]) => {
       const isDuplicate = prevData.some((team) => team.id === value.id);
       if (isDuplicate) {
@@ -101,10 +114,9 @@ const TeamSearchField: React.FC<TeamSearchFieldProps> = ({
       setError(false);
       return [...prevData, value];
     });
-    setInputValue('');
   };
 
-  const handleInputChange = (_: string, value: string): void => {
+  const handleInputChange = (_: React.SyntheticEvent, value: string): void => {
     if (typeof value === 'string') {
       setError(false);
       fetchSuggestions(value);
@@ -128,7 +140,6 @@ const TeamSearchField: React.FC<TeamSearchFieldProps> = ({
         sx={{ width: 'auto' }}
         disableClearable
         loading={isLoading}
-        value={inputValue}
         filterSelectedOptions
         noOptionsText={isLoading ? 'Loading...' : 'No team found'}
         onChange={handleAdd}
@@ -136,6 +147,7 @@ const TeamSearchField: React.FC<TeamSearchFieldProps> = ({
         options={options}
         filterOptions={(x) => x}
         getOptionLabel={() => ''}
+        getOptionKey={(option: Team) => option.id}
         clearOnBlur
         isOptionEqualToValue={(option, value) => option === value}
         renderInput={(params) => (
@@ -156,12 +168,13 @@ const TeamSearchField: React.FC<TeamSearchFieldProps> = ({
         )}
         renderOption={(props, option) => {
           if (!isSoftDeleted(option.deletedAt)) {
+            const { key, ...optionProps } = props;
             return (
               <Box
                 component="li"
                 sx={{ '& > img': { mr: 2, flexShrink: 0 } }}
-                key={option.ID}
-                {...props}
+                key={key}
+                {...optionProps}
               >
                 <Typography>{option.name}</Typography>
               </Box>
@@ -177,7 +190,7 @@ const TeamSearchField: React.FC<TeamSearchFieldProps> = ({
               <>
                 {teamsData.map((team) => (
                   <Chip
-                    key={team.ID}
+                    key={team.id}
                     label={team.name}
                     size="small"
                     onDelete={() => handleDelete(team.id)}
diff --git a/src/custom/ShareModal/ShareModal.tsx b/src/custom/ShareModal/ShareModal.tsx
index c87de019c..fc3bd1b55 100644
--- a/src/custom/ShareModal/ShareModal.tsx
+++ b/src/custom/ShareModal/ShareModal.tsx
@@ -285,13 +285,19 @@ const ShareModal: React.FC<ShareModalProps> = ({
 
     const recipients = newUsers.map(getUserLabel);
 
+    // Built once, above the branch: the actor list is identical for every
+    // resource in a bulk share, and this keeps the builder's throw on a single
+    // path immediately below the guard that makes it unreachable rather than
+    // one per iteration inside a `Promise.all`.
+    const grantPayload = buildGrantAccessPayload(newUsers);
+
     if (Array.isArray(selectedResource)) {
       const responses = await Promise.all(
         selectedResource.map((resource) =>
           resourceAccessMutator({
             resourceType,
             resourceId: resource.id,
-            resourceAccessMappingPayload: buildGrantAccessPayload(newUsers)
+            resourceAccessMappingPayload: grantPayload
           })
         )
       );
@@ -318,7 +324,7 @@ const ShareModal: React.FC<ShareModalProps> = ({
     const response = await resourceAccessMutator({
       resourceType,
       resourceId: !Array.isArray(selectedResource) ? selectedResource.id : selectedResource[0].id,
-      resourceAccessMappingPayload: buildGrantAccessPayload(newUsers)
+      resourceAccessMappingPayload: grantPayload
     });
 
     if (!response?.error) {
diff --git a/src/custom/Workspaces/types.ts b/src/custom/Workspaces/types.ts
index 33fa26419..16a19455e 100644
--- a/src/custom/Workspaces/types.ts
+++ b/src/custom/Workspaces/types.ts
@@ -57,10 +57,31 @@ export type Workspace = Omit<CanonicalWorkspace, 'organizationId' | 'deletedAt'>
 };
 
 /**
- * The v1beta3 environment construct as sistent consumes it. `createdAt` and
- * `updatedAt` are required here because the environment table renders both
- * unconditionally; the canonical marks them optional so that the same schema
- * can describe a create payload.
+ * The v1beta3 environment construct as sistent consumes it.
+ *
+ * One deliberate narrowing: `createdAt` and `updatedAt` are required here
+ * because the environment table renders both unconditionally; the canonical
+ * marks them optional so that the same schema can describe a create payload.
+ *
+ * The rest of the shape is the canonical one, and taking it whole tightens two
+ * fields the previous hand-declared shape did not carry:
+ *
+ *  - `schemaVersion` is required and is new - the local shape never declared
+ *    it. Every environment the provider serves carries it.
+ *  - `description` is required, where the local shape had it optional. The
+ *    canonical requires it and meshery-cloud always emits it (empty string
+ *    when unset).
+ *
+ * Neither is re-widened here: a local override would be exactly the hand-copied
+ * divergence this derivation exists to eliminate. If the canonical is wrong
+ * about either, the fix belongs in `meshery/schemas`.
+ *
+ * SEMVER - this type reaches the published surface through
+ * `useEnvironmentAssignment`'s {@link AssignmentHookResult}`<Environment>`, so
+ * the two tightenings above are consumer-visible: a host that annotates or
+ * builds an environment record from a reduced projection (a `{ id, name }`
+ * picker row, a test double) stops compiling until it supplies them. Version
+ * the release that ships this accordingly.
  */
 export type Environment = Omit<CanonicalEnvironment, 'createdAt' | 'updatedAt'> & {
   createdAt: string;
@@ -81,6 +102,22 @@ export type Environment = Omit<CanonicalEnvironment, 'createdAt' | 'updatedAt'>
  * The canonical is taken from v1beta2 rather than through the v1beta3 workspace
  * API's `getTeamsOfWorkspace` operation, which still `$ref`s the snake_case
  * v1beta1 `TeamPage` - see https://github.com/meshery/schemas/issues/1143.
+ *
+ * Taking the canonical whole also tightens two fields the previous
+ * hand-declared shape did not carry: `createdAt` and `updatedAt` are required
+ * on the canonical and were absent locally. They are not re-widened here, for
+ * the same reason as {@link Environment}.
+ *
+ * SEMVER - like {@link Environment}, this type reaches the published surface
+ * through `useTeamAssignment`'s {@link AssignmentHookResult}`<Team>`, so those
+ * two now-required fields are consumer-visible. `deletedAt` is likewise a
+ * required key here where the canonical marks it optional; that predates this
+ * derivation and is unchanged, but it binds a host constructing a team record
+ * just the same.
+ *
+ * A team-picker projection that needs only the identity fields should derive
+ * its own `Pick` of {@link CanonicalTeam} rather than widen this type - see
+ * `Team` in `src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx`.
  */
 export type Team = Omit<CanonicalTeam, 'deletedAt'> & {
   deletedAt: DeletedAt;
diff --git a/src/index.tsx b/src/index.tsx
index 18961b8f4..48936414c 100644
--- a/src/index.tsx
+++ b/src/index.tsx
@@ -101,11 +101,11 @@ export { ActionButton, type ActionButtonProps, type Option } from './custom/Acti
 // Without the declarations a host cannot type that body at all and falls back
 // to the object literal that caused the bug.
 //
-// Taken from the leaf `resourceAccessPayload` module rather than the
-// `ShareModal` barrel, for the same reason as `TableActions` above: these are
-// three pure functions, and routing them through the barrel would make the
-// declaration bundle a root file out of `ShareModal.tsx` and gate the build on
-// that component's whole type surface.
+// Taken from the leaf `resourceAccessPayload` module because that is where the
+// builders live. The block below re-exports the component from the barrel, so
+// `ShareModal.tsx` is a declaration-bundle root either way and there is nothing
+// left to keep apart: collapse the two blocks freely, the barrel already
+// re-exports all six symbols.
 export {
   ResourceAccessActorError,
   buildGrantAccessPayload,
@@ -116,7 +116,7 @@ export {
 } from './custom/ShareModal/resourceAccessPayload';
 // The component itself is dropped by the same quirk, which left hosts able to
 // type the share body but not the component consuming it. This is one instance
-// of a wider gap: 131 runtime exports reach `dist/index.js` without reaching
+// of a wider gap: 129 runtime exports reach `dist/index.js` without reaching
 // `dist/index.d.ts`, so a per-symbol line here is a stopgap, not the fix.
 export {
   ShareModal,

From a3305d809b4cb5a5c467ffd3bc673eba49ec59b1 Mon Sep 17 00:00:00 2001
From: "Mericio \"Hablo\" Salazar"
 <218162243+simihablo@users.noreply.github.com>
Date: Fri, 7 Aug 2026 15:09:44 -0500
Subject: [PATCH 07/13] no-mistakes(review): root-export TeamSearchField and
 its picker prop types

Signed-off-by: Mericio "Hablo" Salazar <218162243+simihablo@users.noreply.github.com>
---
 AGENTS.md                                      |  4 ++--
 .../GettingStartedWidget/TeamSearchField.tsx   |  2 +-
 src/index.tsx                                  | 18 +++++++++++++++++-
 3 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 2a875c23a..ddcee6d2c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -218,9 +218,9 @@ const d=f.readFileSync("dist/index.d.ts","utf8");
 console.log([...rt].filter(n=>/^[A-Za-z_$][\w$]*$/.test(n)&&!new RegExp("\\b"+n+"\\b").test(d)).sort().join("\n"))'
 ```
 
-As of this change that reports 129 of 729 runtime exports absent from the declaration bundle -
+As of this change that reports 128 of 729 runtime exports absent from the declaration bundle -
 `WorkspaceCard`, `TeamTable`, `UsersTable`, `CustomImage`, `ErrorBoundary` and most of
-`src/custom/` among them. Adding 129 lines is not the answer; the durable fix is in how the
+`src/custom/` among them. Adding 128 lines is not the answer; the durable fix is in how the
 declaration bundle is produced. Until then, prefer extending this list over leaving a symbol
 uncovered, and do not read its absence as "that component is intentionally private".
 
diff --git a/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx b/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
index 2804dea65..b5897430f 100644
--- a/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
+++ b/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
@@ -31,7 +31,7 @@ export type Team = Pick<CanonicalTeam, 'id' | 'name'> & {
   deletedAt?: DeletedAt;
 };
 
-interface TeamSearchFieldProps {
+export interface TeamSearchFieldProps {
   teamsData: Team[];
   setTeamsData: Dispatch<SetStateAction<Team[]>>;
   label?: string;
diff --git a/src/index.tsx b/src/index.tsx
index 48936414c..e14b1a95a 100644
--- a/src/index.tsx
+++ b/src/index.tsx
@@ -116,10 +116,26 @@ export {
 } from './custom/ShareModal/resourceAccessPayload';
 // The component itself is dropped by the same quirk, which left hosts able to
 // type the share body but not the component consuming it. This is one instance
-// of a wider gap: 129 runtime exports reach `dist/index.js` without reaching
+// of a wider gap: 128 runtime exports reach `dist/index.js` without reaching
 // `dist/index.d.ts`, so a per-symbol line here is a stopgap, not the fix.
 export {
   ShareModal,
   type ResourceAccessArg,
   type ShareModalProps
 } from './custom/ShareModal';
+
+// Same nested-barrel dts-drop quirk as FeedbackButton above, and the whole
+// `DashboardWidgets` barrel is subject to it - `TeamSearchField` reaches
+// `dist/index.js` but not `dist/index.d.ts`, so a host cannot name the
+// component at all. Its two prop types travel with it: `teamsData` and
+// `setTeamsData` are both keyed on the team-picker record, so a consumer that
+// cannot name it cannot hold the state the component requires and falls back
+// to `any`. Taken from the leaf module because the barrel re-exports only the
+// default. The record is aliased because sistent has a second, wider `Team` -
+// the full v1beta2 construct in `custom/Workspaces/types` - and a bare `Team`
+// at the root would make which one this is ambiguous.
+export {
+  default as TeamSearchField,
+  type Team as TeamPickerRecord,
+  type TeamSearchFieldProps
+} from './custom/DashboardWidgets/GettingStartedWidget/TeamSearchField';

From 06028fae8f9125850cb9f91dc813357238ed06cf Mon Sep 17 00:00:00 2001
From: "Mericio \"Hablo\" Salazar"
 <218162243+simihablo@users.noreply.github.com>
Date: Fri, 7 Aug 2026 15:09:44 -0500
Subject: [PATCH 08/13] no-mistakes(test): fix invisible tooltip button label
 in light mode

Signed-off-by: Mericio "Hablo" Salazar <218162243+simihablo@users.noreply.github.com>
---
 .../ShareModalWireContract.test.tsx           | 193 ++++++++++++++++++
 .../CollaboratorAvatarGroup.tsx               |  24 ++-
 2 files changed, 209 insertions(+), 8 deletions(-)
 create mode 100644 src/__testing__/ShareModalWireContract.test.tsx

diff --git a/src/__testing__/ShareModalWireContract.test.tsx b/src/__testing__/ShareModalWireContract.test.tsx
new file mode 100644
index 000000000..edd4106aa
--- /dev/null
+++ b/src/__testing__/ShareModalWireContract.test.tsx
@@ -0,0 +1,193 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import React from 'react';
+import ShareModal from '../custom/ShareModal/ShareModal';
+import { SistentThemeProvider } from '../theme';
+
+// `ShareModal` reaches `react-markdown` (via `CustomTooltip` and the modal's
+// help text), which with its `remark`/`rehype` plugins publishes ESM-only
+// sources that jest's `transformIgnorePatterns` does not pass through the
+// transformer. None of them participate in the wire contract under test, so
+// they are stubbed rather than dragged into the transform allowlist.
+jest.mock('react-markdown', () => ({
+  __esModule: true,
+  default: ({ children }: { children?: React.ReactNode }) => <>{children}</>
+}));
+jest.mock('remark-gfm', () => ({ __esModule: true, default: () => undefined }));
+jest.mock('rehype-raw', () => ({ __esModule: true, default: () => undefined }));
+
+// End-to-end guard for the body `ShareModal` actually puts on the wire.
+//
+// `src/__testing__/resourceAccessPayload.test.ts` pins the builders in
+// isolation; this pins the *component*, because the builders being right does
+// not stop `ShareModal` from hand-rolling a body of its own - which is exactly
+// how the April 2026 drift happened. The flow exercised here is the one a user
+// performs: open the modal, search for a person, press Share (and, for revoke,
+// press the remove-access button next to someone in the access list), then
+// inspect what reached the host-supplied `resourceAccessMutator`.
+//
+// The server (meshery-cloud `HandleResourceShare` ->
+// `models.ResourceAccessMappingPayload`) decodes with a strict `json.Unmarshal`
+// into a struct whose fields all carry `omitempty`: unknown keys are dropped
+// and the handler still answers 200. A stale key name is therefore a share
+// that reports success and grants nothing, which no type on either side of the
+// `any`-typed mutator can observe.
+
+const owner = {
+  id: 'b6e6d123-0000-4000-8000-0000000000aa',
+  firstName: 'Olive',
+  lastName: 'Owner',
+  email: 'olive@example.com'
+};
+
+const jane = {
+  id: 'b6e6d123-0000-4000-8000-000000000001',
+  username: 'jdoe',
+  firstName: 'Jane',
+  lastName: 'Doe',
+  email: 'jane@example.com'
+};
+
+const selectedResource = {
+  id: 'd0c5f1a2-0000-4000-8000-00000000beef',
+  name: 'My Design',
+  visibility: 'private'
+};
+
+type ShareModalProps = React.ComponentProps<typeof ShareModal>;
+
+const renderShareModal = (overrides: Partial<ShareModalProps> = {}) => {
+  const resourceAccessMutator = jest.fn().mockResolvedValue({});
+  const props = {
+    handleShareModalClose: jest.fn(),
+    selectedResource,
+    dataName: 'design',
+    ownerData: owner,
+    currentUser: owner,
+    // Only the owner has access by default: the people-picker deliberately
+    // does not resurface someone who is already on the access list, so a
+    // grant flow needs the invitee absent from it.
+    fetchAccessActors: jest.fn().mockResolvedValue([owner]),
+    handleUpdateVisibility: jest.fn().mockResolvedValue({ error: '' }),
+    handleShareWithNewUsers: jest.fn().mockResolvedValue({ error: '' }),
+    canShareWithNewUsers: true,
+    handleRevokeAccess: jest.fn().mockResolvedValue({ error: '' }),
+    canRevokeAccess: true,
+    resourceAccessMutator,
+    notify: jest.fn(),
+    useGetAllUsersQuery: (_args: unknown, options?: { skip?: boolean }) => ({
+      data: options?.skip ? undefined : { data: [jane] },
+      isLoading: false
+    }),
+    shareableLink: 'https://cloud.layer5.io/design/my-design',
+    mesheryURL: 'https://cloud.layer5.io',
+    ...overrides
+  } as unknown as ShareModalProps;
+
+  render(
+    <SistentThemeProvider>
+      <ShareModal {...props} />
+    </SistentThemeProvider>
+  );
+
+  return { props, resourceAccessMutator };
+};
+
+/** The single argument the host mutator was called with, as it would be sent. */
+const sentRequest = (mutator: jest.Mock) => mutator.mock.calls[0][0];
+
+describe('ShareModal resource-access wire contract', () => {
+  it('posts the canonical grantAccess body when a person is shared with', async () => {
+    const { resourceAccessMutator } = renderShareModal();
+
+    const input = screen.getByPlaceholderText('Add Users') as HTMLInputElement;
+    fireEvent.change(input, { target: { value: 'jane' } });
+    await waitFor(() => expect(screen.queryByText('Jane Doe')).not.toBeNull(), { timeout: 2000 });
+    fireEvent.click(screen.getByText('Jane Doe'));
+    fireEvent.click(screen.getByRole('button', { name: 'Share' }));
+
+    await waitFor(() => expect(resourceAccessMutator).toHaveBeenCalledTimes(1));
+
+    expect(sentRequest(resourceAccessMutator)).toEqual({
+      // `design` is the UI name; the resource type on the wire is `pattern`.
+      resourceType: 'pattern',
+      resourceId: selectedResource.id,
+      resourceAccessMappingPayload: {
+        grantAccess: [{ actorId: jane.id, actorType: 'user' }],
+        revokeAccess: [],
+        notifyUsers: true
+      }
+    });
+  });
+
+  it('posts the canonical revokeAccess body when access is removed', async () => {
+    const { resourceAccessMutator } = renderShareModal({
+      fetchAccessActors: jest.fn().mockResolvedValue([owner, jane])
+    } as Partial<ShareModalProps>);
+
+    // The access list is fetched on mount; the owner row has no remove button.
+    await waitFor(() => expect(screen.queryByText('jane@example.com')).not.toBeNull());
+    fireEvent.click(screen.getByRole('button', { name: 'delete' }));
+
+    await waitFor(() => expect(resourceAccessMutator).toHaveBeenCalledTimes(1));
+
+    expect(sentRequest(resourceAccessMutator)).toEqual({
+      resourceType: 'pattern',
+      resourceId: selectedResource.id,
+      resourceAccessMappingPayload: {
+        grantAccess: [],
+        revokeAccess: [{ actorId: jane.id, actorType: 'user' }],
+        notifyUsers: true
+      }
+    });
+  });
+
+  it('never emits a retired snake_case key anywhere in the body', async () => {
+    const { resourceAccessMutator } = renderShareModal();
+
+    const input = screen.getByPlaceholderText('Add Users') as HTMLInputElement;
+    fireEvent.change(input, { target: { value: 'jane' } });
+    await waitFor(() => expect(screen.queryByText('Jane Doe')).not.toBeNull(), { timeout: 2000 });
+    fireEvent.click(screen.getByText('Jane Doe'));
+    fireEvent.click(screen.getByRole('button', { name: 'Share' }));
+
+    await waitFor(() => expect(resourceAccessMutator).toHaveBeenCalledTimes(1));
+
+    const body = JSON.stringify(sentRequest(resourceAccessMutator).resourceAccessMappingPayload);
+    for (const retired of [
+      'grant_access',
+      'revoke_access',
+      'notify_users',
+      'actor_id',
+      'actor_type'
+    ]) {
+      expect(body).not.toContain(retired);
+    }
+  });
+
+  it('reports an error instead of posting when a record has no identifier', async () => {
+    // An `actorId: ''` fails the handler's `json.Unmarshal` (gofrs
+    // `uuid.UUID` rejects a zero-length string) and 400s the whole batch.
+    const ghost = { username: 'ghost', email: 'ghost@example.com' };
+    const { props, resourceAccessMutator } = renderShareModal({
+      useGetAllUsersQuery: (_args: unknown, options?: { skip?: boolean }) => ({
+        data: options?.skip ? undefined : { data: [ghost] },
+        isLoading: false
+      })
+    } as Partial<ShareModalProps>);
+
+    const input = screen.getByPlaceholderText('Add Users') as HTMLInputElement;
+    fireEvent.change(input, { target: { value: 'ghost' } });
+    await waitFor(() => expect(screen.queryByText('ghost@example.com')).not.toBeNull(), {
+      timeout: 2000
+    });
+    fireEvent.click(screen.getByText('ghost@example.com'));
+    fireEvent.click(screen.getByRole('button', { name: 'Share' }));
+
+    await waitFor(() =>
+      expect(props.notify).toHaveBeenCalledWith(
+        expect.objectContaining({ event_type: 'error' })
+      )
+    );
+    expect(resourceAccessMutator).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx b/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx
index 6cb6d865c..9c7143a48 100644
--- a/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx
+++ b/src/custom/CollaboratorAvatarGroup/CollaboratorAvatarGroup.tsx
@@ -163,13 +163,20 @@ const CollaboratorAvatarGroup = ({
                   </Typography>
                   {/*
                     WORKAROUND for https://github.com/layer5io/sistent/issues/1783 - delete
-                    both `borderColor` overrides once that component-level fix lands, and do
-                    not copy this into other tooltips. `CustomTooltip`'s surface is the
-                    literal `#141414` in both palette modes, but `palette.divider` and the
-                    theme's outlined-button border resolve to mode-dependent tokens, so in
-                    light mode the separator is invisible and the button outline is near
-                    black-on-black. These two are fixed to white alphas, which are stable
-                    across modes because the surface they sit on is.
+                    the two `borderColor` overrides and the button `color` override once that
+                    component-level fix lands, and do not copy this into other tooltips.
+                    `CustomTooltip`'s surface is the literal `#141414` in both palette modes,
+                    but `palette.divider`, the theme's outlined-button border and the button
+                    label colour all resolve to mode-dependent tokens, so in light mode the
+                    separator is invisible, the button outline is near black-on-black and the
+                    label is black-on-black outright: `MuiButton`'s root override spreads
+                    `typography.textB2SemiBold`, whose `color` is `common.black` in light mode
+                    (src/theme/typography.ts), and that wins over MUI's own
+                    `--variant-outlinedColor`. Measured on the hovered component, the label was
+                    `rgb(0, 0, 0)` on `rgb(20, 20, 20)` - 1.06:1. These three are fixed to
+                    white / white alphas, which are stable across modes because the surface
+                    they sit on is; the label now matches the tooltip's own body text at
+                    18.4:1, clearing WCAG AA.
                   */}
                   <Divider style={{ borderColor: alpha(theme.palette.common.white, 0.2) }} />
                   <Button
@@ -181,7 +188,8 @@ const CollaboratorAvatarGroup = ({
                       padding: '2px 8px',
                       minWidth: 'auto',
                       marginTop: '8px',
-                      borderColor: alpha(theme.palette.common.white, 0.4)
+                      borderColor: alpha(theme.palette.common.white, 0.4),
+                      color: theme.palette.common.white
                     }}
                   >
                     Open Recents

From 2e27077cc13a73ae93b314cbff6e6785dafd360d Mon Sep 17 00:00:00 2001
From: "Mericio \"Hablo\" Salazar"
 <218162243+simihablo@users.noreply.github.com>
Date: Fri, 7 Aug 2026 15:48:35 -0500
Subject: [PATCH 09/13] no-mistakes(review): guard team options; deprecate dead
 ShareModal props; collapse exports

Signed-off-by: Mericio "Hablo" Salazar <218162243+simihablo@users.noreply.github.com>
---
 .../GettingStartedWidget/TeamSearchField.tsx  |  2 +-
 src/custom/ShareModal/ShareModal.tsx          | 36 ++++++++++++++++---
 src/index.tsx                                 | 24 ++++++-------
 3 files changed, 43 insertions(+), 19 deletions(-)

diff --git a/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx b/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
index b5897430f..d11ec3e27 100644
--- a/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
+++ b/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
@@ -89,7 +89,7 @@ const TeamSearchField: React.FC<TeamSearchFieldProps> = ({
         getTeams({ orgId: orgID, search: searchValue }, true)
           .unwrap()
           .then((response: any) => {
-            setOptions(typeof response === 'string' ? [] : response?.teams);
+            setOptions(Array.isArray(response?.teams) ? response.teams : []);
             setIsLoading(false);
           })
           .catch((err: any) => {
diff --git a/src/custom/ShareModal/ShareModal.tsx b/src/custom/ShareModal/ShareModal.tsx
index fc3bd1b55..732dc88b4 100644
--- a/src/custom/ShareModal/ShareModal.tsx
+++ b/src/custom/ShareModal/ShareModal.tsx
@@ -188,10 +188,32 @@ export interface ShareModalProps {
   /** Optional URL of the host application. Defaults to `null` if not provided */
   hostURL?: string | null;
   handleUpdateVisibility: (value: string) => Promise<{ error: string }>;
-  handleShareWithNewUsers: (newUsers: User[]) => Promise<{ error: string }>;
-  canShareWithNewUsers: boolean;
-  handleRevokeAccess: (revokedUsser: User[]) => Promise<{ error: string }>;
-  canRevokeAccess: boolean;
+  /**
+   * @deprecated Unused - never read. The component defines its own
+   * `handleShareWithNewUsers`, which shadows this prop and shares through
+   * `resourceAccessMutator`, so a function passed here is never called. Kept
+   * optional so hosts that already pass it keep compiling.
+   */
+  handleShareWithNewUsers?: (newUsers: User[]) => Promise<{ error: string }>;
+  /**
+   * @deprecated Unused - never read, and it does not gate anything. The
+   * component computes `userCanShareWithNewUsers` itself from
+   * `selectedResource`, `currentUser` and `ownerData`; passing `false` here
+   * does not disable sharing.
+   */
+  canShareWithNewUsers?: boolean;
+  /**
+   * @deprecated Unused - never read. The component defines its own
+   * `handleRevokeAccess`, which shadows this prop and revokes through
+   * `resourceAccessMutator`, so a function passed here is never called.
+   */
+  handleRevokeAccess?: (revokedUsser: User[]) => Promise<{ error: string }>;
+  /**
+   * @deprecated Unused - never read, and it does not gate anything. Revoke is
+   * gated per actor by the owner check in `AccessList`; passing `false` here
+   * does not disable revoking.
+   */
+  canRevokeAccess?: boolean;
 
   /* eslint-disable @typescript-eslint/no-explicit-any */
   resourceAccessMutator: any;
@@ -200,7 +222,11 @@ export interface ShareModalProps {
   /* eslint-disable @typescript-eslint/no-explicit-any */
   useGetAllUsersQuery: any;
   shareableLink: string;
-  mesheryURL: string; // url to hosted meshery
+  /**
+   * @deprecated Unused - never read. The only link this modal renders is
+   * `shareableLink`, and the only host URL it dereferences is `hostURL`.
+   */
+  mesheryURL?: string;
   currentUser: User;
 }
 
diff --git a/src/index.tsx b/src/index.tsx
index e14b1a95a..ae64f91fe 100644
--- a/src/index.tsx
+++ b/src/index.tsx
@@ -101,26 +101,24 @@ export { ActionButton, type ActionButtonProps, type Option } from './custom/Acti
 // Without the declarations a host cannot type that body at all and falls back
 // to the object literal that caused the bug.
 //
-// Taken from the leaf `resourceAccessPayload` module because that is where the
-// builders live. The block below re-exports the component from the barrel, so
-// `ShareModal.tsx` is a declaration-bundle root either way and there is nothing
-// left to keep apart: collapse the two blocks freely, the barrel already
-// re-exports all six symbols.
+// The component is dropped by the same quirk, which left hosts able to type the
+// share body but not the component consuming it. This is one instance of a
+// wider gap: 128 runtime exports reach `dist/index.js` without reaching
+// `dist/index.d.ts`, so a per-symbol line here is a stopgap, not the fix.
+//
+// Taken from the `./custom/ShareModal` barrel rather than the leaf
+// `resourceAccessPayload` module: that barrel re-exports the builders as well
+// as the component, so one statement is the single source of truth for where
+// all of these come from.
 export {
+  ShareModal,
   ResourceAccessActorError,
   buildGrantAccessPayload,
   buildRevokeAccessPayload,
   toResourceAccessActors,
   type ResourceAccessActor,
-  type ResourceAccessMappingPayload
-} from './custom/ShareModal/resourceAccessPayload';
-// The component itself is dropped by the same quirk, which left hosts able to
-// type the share body but not the component consuming it. This is one instance
-// of a wider gap: 128 runtime exports reach `dist/index.js` without reaching
-// `dist/index.d.ts`, so a per-symbol line here is a stopgap, not the fix.
-export {
-  ShareModal,
   type ResourceAccessArg,
+  type ResourceAccessMappingPayload,
   type ShareModalProps
 } from './custom/ShareModal';
 

From dfac1526c7bf100945f8c003c9ed2fd0e6780a6d Mon Sep 17 00:00:00 2001
From: "Mericio \"Hablo\" Salazar"
 <218162243+simihablo@users.noreply.github.com>
Date: Fri, 7 Aug 2026 16:24:37 -0500
Subject: [PATCH 10/13] no-mistakes(document): fix stale schema-derivation
 docs; format changed files

Signed-off-by: Mericio "Hablo" Salazar <218162243+simihablo@users.noreply.github.com>
---
 AGENTS.md                                     |  5 ++--
 .../ShareModalWireContract.test.tsx           |  4 +---
 .../fixtures/schemaConstructAliases.ts        | 23 ++++++++-----------
 src/__testing__/resourceAccessPayload.test.ts |  8 ++-----
 src/custom/CustomCatalog/CustomCard.tsx       |  9 ++++----
 .../GettingStartedWidget/TeamSearchField.tsx  |  8 +++++++
 src/custom/ShareModal/ShareModal.tsx          |  4 ++--
 src/custom/ShareModal/index.tsx               |  4 ++--
 src/custom/Workspaces/WorkspaceCard.tsx       |  4 ++--
 src/custom/Workspaces/types.ts                |  2 +-
 src/index.tsx                                 |  8 ++++---
 11 files changed, 39 insertions(+), 40 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index ddcee6d2c..94c842235 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -151,8 +151,9 @@ typo fix, a plural made singular - renames the exported constant and orphans the
 Any type that is decoded from or encoded to a Meshery/Layer5 API is owned by `meshery/schemas`.
 Sistent is upstream of every Meshery UI, so a shape hand-copied here propagates to all of them and a
 rename upstream reaches consumers as a silent `undefined` rather than an error. Derive from the
-canonical construct instead - `import type { components } from '@meshery/schemas/constructs/<ver>/<c>/<C>'`
-- and express any divergence as an explicit `Pick`/`Omit`/`&` carrying the reason.
+canonical construct instead
+(`import type { components } from '@meshery/schemas/constructs/<ver>/<c>/<C>'`), and express any
+divergence as an explicit `Pick`/`Omit`/`&` carrying the reason.
 
 **`Omit<T, 'gone'>` where `T` has no `gone` is a silent no-op**, so derivation alone does not survive
 the rename it was adopted to catch: the omit stops removing anything and the override quietly becomes
diff --git a/src/__testing__/ShareModalWireContract.test.tsx b/src/__testing__/ShareModalWireContract.test.tsx
index edd4106aa..e1222954a 100644
--- a/src/__testing__/ShareModalWireContract.test.tsx
+++ b/src/__testing__/ShareModalWireContract.test.tsx
@@ -184,9 +184,7 @@ describe('ShareModal resource-access wire contract', () => {
     fireEvent.click(screen.getByRole('button', { name: 'Share' }));
 
     await waitFor(() =>
-      expect(props.notify).toHaveBeenCalledWith(
-        expect.objectContaining({ event_type: 'error' })
-      )
+      expect(props.notify).toHaveBeenCalledWith(expect.objectContaining({ event_type: 'error' }))
     );
     expect(resourceAccessMutator).not.toHaveBeenCalled();
   });
diff --git a/src/__testing__/fixtures/schemaConstructAliases.ts b/src/__testing__/fixtures/schemaConstructAliases.ts
index c778d1883..ef55d1390 100644
--- a/src/__testing__/fixtures/schemaConstructAliases.ts
+++ b/src/__testing__/fixtures/schemaConstructAliases.ts
@@ -17,11 +17,11 @@
 //
 // `RequiresKey` closes it: every key sistent omits or narrows is asserted to
 // still exist on the canonical type it was taken from.
+import type { components as OrganizationComponents } from '@meshery/schemas/constructs/v1beta2/organization/Organization';
+import type { components as TeamComponents } from '@meshery/schemas/constructs/v1beta2/team/Team';
 import type { components as DesignComponents } from '@meshery/schemas/constructs/v1beta3/design/Design';
 import type { components as EnvironmentComponents } from '@meshery/schemas/constructs/v1beta3/environment/Environment';
 import type { components as EventComponents } from '@meshery/schemas/constructs/v1beta3/event/Event';
-import type { components as OrganizationComponents } from '@meshery/schemas/constructs/v1beta2/organization/Organization';
-import type { components as TeamComponents } from '@meshery/schemas/constructs/v1beta2/team/Team';
 import type { components as UserComponents } from '@meshery/schemas/constructs/v1beta3/user/User';
 import type { components as WorkspaceComponents } from '@meshery/schemas/constructs/v1beta3/workspace/Workspace';
 import type { UserProfile } from '../../custom/CatalogDetail/types';
@@ -162,9 +162,7 @@ export type PickedTeamIdIsCanonical = Expect<IsExact<PickedTeam['id'], Canonical
 
 export type PickedTeamNameIsCanonical = Expect<IsExact<PickedTeam['name'], CanonicalTeam['name']>>;
 
-export type UserEmailIsCanonical = Expect<
-  IsExact<User['email'], CanonicalSearchableUser['email']>
->;
+export type UserEmailIsCanonical = Expect<IsExact<User['email'], CanonicalSearchableUser['email']>>;
 
 export type UserProfileAvatarIsCanonical = Expect<
   IsExact<UserProfile['avatarUrl'], NonNullable<CanonicalSearchableUser['avatarUrl']>>
@@ -226,15 +224,12 @@ export type CatalogDataHasNoImageUrl = RequiresKey<CanonicalCatalogData, 'imageU
 // `./constructs/*` with types, and this repo resolves with
 // `moduleResolution: "bundler"`, so the shim was both redundant and wrong; it
 // was deleted. These imports keep the resolution it was covering asserted.
-export type ModelSchemaResolves = typeof import(
-  '@meshery/schemas/constructs/v1beta2/model/ModelSchema'
-).default;
-export type EnvironmentSchemaResolves = typeof import(
-  '@meshery/schemas/constructs/v1beta3/environment/EnvironmentSchema'
-).default;
-export type WorkspaceSchemaResolves = typeof import(
-  '@meshery/schemas/constructs/v1beta3/workspace/WorkspaceSchema'
-).default;
+export type ModelSchemaResolves =
+  typeof import('@meshery/schemas/constructs/v1beta2/model/ModelSchema').default;
+export type EnvironmentSchemaResolves =
+  typeof import('@meshery/schemas/constructs/v1beta3/environment/EnvironmentSchema').default;
+export type WorkspaceSchemaResolves =
+  typeof import('@meshery/schemas/constructs/v1beta3/workspace/WorkspaceSchema').default;
 
 // Self-check: if the compiler ever stops type-checking this fixture, the
 // suppression below goes unused and tsc reports TS2578 here, failing the test
diff --git a/src/__testing__/resourceAccessPayload.test.ts b/src/__testing__/resourceAccessPayload.test.ts
index 6a40cacb2..47163b4cc 100644
--- a/src/__testing__/resourceAccessPayload.test.ts
+++ b/src/__testing__/resourceAccessPayload.test.ts
@@ -53,9 +53,7 @@ const unidentifiableUser = {
 describe('resource access mapping payload', () => {
   describe('toResourceAccessActors', () => {
     it('emits the canonical camelCase actor keys', () => {
-      expect(toResourceAccessActors([jane])).toEqual([
-        { actorId: jane.id, actorType: 'user' }
-      ]);
+      expect(toResourceAccessActors([jane])).toEqual([{ actorId: jane.id, actorType: 'user' }]);
     });
 
     it('never emits the retired snake_case actor keys', () => {
@@ -114,9 +112,7 @@ describe('resource access mapping payload', () => {
     });
 
     it('never emits an empty actorId', () => {
-      expect(() => buildGrantAccessPayload([unidentifiableUser])).toThrow(
-        ResourceAccessActorError
-      );
+      expect(() => buildGrantAccessPayload([unidentifiableUser])).toThrow(ResourceAccessActorError);
     });
   });
 
diff --git a/src/custom/CustomCatalog/CustomCard.tsx b/src/custom/CustomCatalog/CustomCard.tsx
index 3ffe0a43a..cf3cdc9f2 100644
--- a/src/custom/CustomCatalog/CustomCard.tsx
+++ b/src/custom/CustomCatalog/CustomCard.tsx
@@ -94,11 +94,10 @@ export interface PatternCatalogData {
  * `time.Time` marshals to an RFC 3339 string, and the two call sites that read
  * them had grown `.toString()` calls to paper over the mismatch.
  */
-export interface Pattern
-  extends Omit<
-    CanonicalPattern,
-    'id' | 'userId' | 'patternFile' | 'name' | 'visibility' | 'catalogData' | 'user'
-  > {
+export interface Pattern extends Omit<
+  CanonicalPattern,
+  'id' | 'userId' | 'patternFile' | 'name' | 'visibility' | 'catalogData' | 'user'
+> {
   id: string;
   userId: string;
   patternFile: string;
diff --git a/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx b/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
index d11ec3e27..81f69ac61 100644
--- a/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
+++ b/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
@@ -140,6 +140,14 @@ const TeamSearchField: React.FC<TeamSearchFieldProps> = ({
         sx={{ width: 'auto' }}
         disableClearable
         loading={isLoading}
+        // Live only since this field stopped binding a string to `value`, and
+        // partial: it filters against the Autocomplete's own uncontrolled
+        // value - the last option picked - not against `teamsData`, which
+        // holds the real selection. So one team is hidden, and only until the
+        // next `fetchSuggestions` replaces `options` (the comparator below is
+        // reference equality). The duplicate guard in `handleAdd` is what
+        // actually prevents a re-pick. Finishing this properly is
+        // https://github.com/layer5io/sistent/issues/1784.
         filterSelectedOptions
         noOptionsText={isLoading ? 'Loading...' : 'No team found'}
         onChange={handleAdd}
diff --git a/src/custom/ShareModal/ShareModal.tsx b/src/custom/ShareModal/ShareModal.tsx
index 732dc88b4..8045d6694 100644
--- a/src/custom/ShareModal/ShareModal.tsx
+++ b/src/custom/ShareModal/ShareModal.tsx
@@ -29,9 +29,9 @@ import { CustomTooltip } from '../CustomTooltip';
 import { Modal, ModalBody, ModalButtonSecondary, ModalFooter } from '../Modal';
 import UserShareSearch from '../UserSearchField/UserSearchField';
 import {
-  ResourceAccessMappingPayload,
   buildGrantAccessPayload,
-  buildRevokeAccessPayload
+  buildRevokeAccessPayload,
+  ResourceAccessMappingPayload
 } from './resourceAccessPayload';
 import {
   CustomDialogContentText,
diff --git a/src/custom/ShareModal/index.tsx b/src/custom/ShareModal/index.tsx
index a8f1d7e69..e809d6422 100644
--- a/src/custom/ShareModal/index.tsx
+++ b/src/custom/ShareModal/index.tsx
@@ -1,7 +1,5 @@
 import ShareModal from './ShareModal';
 
-export { ShareModal };
-export type { ResourceAccessArg, ShareModalProps } from './ShareModal';
 export {
   ResourceAccessActorError,
   buildGrantAccessPayload,
@@ -10,3 +8,5 @@ export {
   type ResourceAccessActor,
   type ResourceAccessMappingPayload
 } from './resourceAccessPayload';
+export type { ResourceAccessArg, ShareModalProps } from './ShareModal';
+export { ShareModal };
diff --git a/src/custom/Workspaces/WorkspaceCard.tsx b/src/custom/Workspaces/WorkspaceCard.tsx
index d29a6b062..faff89d7c 100644
--- a/src/custom/Workspaces/WorkspaceCard.tsx
+++ b/src/custom/Workspaces/WorkspaceCard.tsx
@@ -4,8 +4,6 @@ import { Backdrop, CircularProgress, Grid2 } from '../../base';
 
 import { getRelativeTime, isSoftDeleted } from '../../utils';
 import { FlipCard } from '../FlipCard';
-import { Workspace } from './types';
-import { RecordRow, RedirectButton, TransferButton } from './WorkspaceTransferButton';
 import {
   AllocationColumnGrid,
   AllocationWorkspace,
@@ -27,6 +25,8 @@ import {
   RecentActivityTitle,
   WorkspaceCardGrid
 } from './styles';
+import { Workspace } from './types';
+import { RecordRow, RedirectButton, TransferButton } from './WorkspaceTransferButton';
 
 // The subset of the v1beta3 workspace construct this card renders. Derived
 // from {@link Workspace} rather than re-declared: the card previously typed
diff --git a/src/custom/Workspaces/types.ts b/src/custom/Workspaces/types.ts
index 16a19455e..d90f904b6 100644
--- a/src/custom/Workspaces/types.ts
+++ b/src/custom/Workspaces/types.ts
@@ -1,5 +1,5 @@
-import type { components as EnvironmentComponents } from '@meshery/schemas/constructs/v1beta3/environment/Environment';
 import type { components as TeamComponents } from '@meshery/schemas/constructs/v1beta2/team/Team';
+import type { components as EnvironmentComponents } from '@meshery/schemas/constructs/v1beta3/environment/Environment';
 import type { components as WorkspaceComponents } from '@meshery/schemas/constructs/v1beta3/workspace/Workspace';
 import { DeletedAt } from '../../utils/nullTime';
 
diff --git a/src/index.tsx b/src/index.tsx
index ae64f91fe..fce5d8899 100644
--- a/src/index.tsx
+++ b/src/index.tsx
@@ -103,16 +103,18 @@ export { ActionButton, type ActionButtonProps, type Option } from './custom/Acti
 //
 // The component is dropped by the same quirk, which left hosts able to type the
 // share body but not the component consuming it. This is one instance of a
-// wider gap: 128 runtime exports reach `dist/index.js` without reaching
-// `dist/index.d.ts`, so a per-symbol line here is a stopgap, not the fix.
+// wider gap - most of `src/custom/` reaches `dist/index.js` without reaching
+// `dist/index.d.ts` - so a per-symbol line here is a stopgap, not the fix.
+// AGENTS.md, "New public exports need an explicit root re-export", owns the
+// measurement and the command that reproduces it.
 //
 // Taken from the `./custom/ShareModal` barrel rather than the leaf
 // `resourceAccessPayload` module: that barrel re-exports the builders as well
 // as the component, so one statement is the single source of truth for where
 // all of these come from.
 export {
-  ShareModal,
   ResourceAccessActorError,
+  ShareModal,
   buildGrantAccessPayload,
   buildRevokeAccessPayload,
   toResourceAccessActors,

From ca46684945f3b954c0504dd29b16e1de53d9439b Mon Sep 17 00:00:00 2001
From: "Mericio \"Hablo\" Salazar"
 <218162243+simihablo@users.noreply.github.com>
Date: Fri, 7 Aug 2026 16:39:36 -0500
Subject: [PATCH 11/13] no-mistakes(document): correct Node-matrix pointers,
 release-bump rule, Autocomplete filter comment

Signed-off-by: Mericio "Hablo" Salazar <218162243+simihablo@users.noreply.github.com>
---
 .agents/skills/cut-release/SKILL.md           | 25 +++++++++++++------
 .github/copilot-instructions.md               |  2 +-
 AGENTS.md                                     |  8 ++++++
 README.md                                     |  4 ++-
 .../GettingStartedWidget/TeamSearchField.tsx  | 17 +++++++------
 5 files changed, 40 insertions(+), 16 deletions(-)

diff --git a/.agents/skills/cut-release/SKILL.md b/.agents/skills/cut-release/SKILL.md
index 49ef2b0c3..8b066a9a2 100644
--- a/.agents/skills/cut-release/SKILL.md
+++ b/.agents/skills/cut-release/SKILL.md
@@ -1,12 +1,12 @@
 ---
 name: cut-release
-description: Runbook for cutting a release of @sistent/sistent to npm. Use when asked to "cut a release", "release Sistent", "publish a new version", or "ship the next @sistent/sistent". The flow is: wait for Release Drafter to fold the merged PR into the draft release, then publish that draft — Release Drafter has already set the version and notes, and release.yml handles the npm publish (OIDC provenance) and the auto-merged version-bump-back.
+description: Runbook for cutting a release of @sistent/sistent to npm. Use when asked to "cut a release", "release Sistent", "publish a new version", or "ship the next @sistent/sistent". The flow is: wait for Release Drafter to fold the merged PR into the draft release, then publish that draft - Release Drafter has already set the notes and drafted the next patch version (a minor or major needs the draft's tag corrected first), and release.yml handles the npm publish (OIDC provenance) and the auto-merged version-bump-back.
 user-invocable: true
 ---
 
 # Cut a Sistent Release
 
-Publishes a new version of the `@sistent/sistent` npm package. Releasing is **automation-driven** and requires **no manual preparation**: Release Drafter already computes the next version and writes the release notes, and the publish workflow does the rest. You do **not** run `npm publish`, bump `package.json`, write release notes, or create a git tag by hand.
+Publishes a new version of the `@sistent/sistent` npm package. Releasing is **automation-driven** and requires **no manual preparation**: Release Drafter already drafts the next version and writes the release notes, and the publish workflow does the rest. You do **not** run `npm publish`, bump `package.json`, write release notes, or create a git tag by hand. The one exception is a minor or major bump, which the drafter cannot produce - see [Cutting a minor or major](#cutting-a-minor-or-major).
 
 - **Package:** `@sistent/sistent` (public, scope `@sistent`), published with npm **provenance** via OIDC trusted publishing.
 - **Release branch:** `master` (protected — requires PR approval).
@@ -14,28 +14,39 @@ Publishes a new version of the `@sistent/sistent` npm package. Releasing is **au
 
 ## The release chain (what actually happens)
 
-1. **A PR merges to `master`** → `release-drafter.yml` runs and updates the **draft GitHub Release**: it folds that PR into the changelog and computes the next version from the PR's labels (major / minor / patch).
+1. **A PR merges to `master`** → `release-drafter.yml` runs and updates the **draft GitHub Release**: it folds that PR into the changelog and drafts the **next patch** version. Its `version-resolver` does map `major` / `minor` / `patch` PR labels, but the config's name and tag templates interpolate `$NEXT_PATCH_VERSION` rather than `$RESOLVED_VERSION`, so the resolved bump never reaches the draft - a `minor`-labelled PR still drafts a patch tag. See [Cutting a minor or major](#cutting-a-minor-or-major).
 2. **You publish the draft Release.** The tag (e.g. `v0.21.31`) becomes the version source of truth.
 3. Publishing emits `release: published` → **`release.yml`**: sets `package.json#version` from the tag, `npm ci` → `npm run build` → `npm publish --provenance --access public`, then opens the `release/version-bump/vX.Y.Z` PR and **auto-merges it** so `master`'s `package.json`/`package-lock.json` track the published version without sitting idle.
 4. `notify-dependents.yml` fires on the publish workflow's success and bumps downstream consumers (e.g. meshery, meshery-cloud) to the new version.
 
 ## Procedure
 
-The only human step is publishing the drafted release — Release Drafter has already done the versioning and notes.
+For a patch - which is every release the drafter produces on its own - the only human step is publishing the drafted release; Release Drafter has already done the versioning and notes.
 
 1. **Wait for Release Drafter to fold your merged PR into the draft.** After the PR merges to `master`, `release-drafter.yml` runs (a few seconds). Confirm the draft now reflects the merged PR and shows the intended next version:
    ```bash
    gh release list --repo layer5io/sistent          # find the draft (isDraft = true)
    gh release view <vX.Y.Z> --repo layer5io/sistent  # confirm version + notes
    ```
-   If the version bump is wrong, it's driven by the merged PR's labels — relabel and let Release Drafter re-draft; do not hand-edit the tag.
+   The draft is always the next patch. If that is the intended bump, change nothing; if the merged PR carried a breaking change, see [Cutting a minor or major](#cutting-a-minor-or-major) before publishing.
 
-2. **Publish the draft Release. That's it.** No version editing, no notes, no tagging:
+2. **Publish the draft Release. That's it.** No notes, no tagging:
    ```bash
    gh release edit <vX.Y.Z> --repo layer5io/sistent --draft=false --latest
    ```
    Publishing triggers `release.yml`, which publishes to npm and auto-merges the version-bump-back PR.
 
+### Cutting a minor or major
+
+sistent is pre-1.0, so a consumer-visible breaking change is a **minor** - `major` would assert 1.0 stability rather than describe the break. Label the PR `minor` to record the intent where `version-resolver` expects it, but do not stop there: the drafted tag comes from `$NEXT_PATCH_VERSION`, so the label does not move it. Correct the draft's tag and name before publishing:
+
+```bash
+gh release edit <drafted-vX.Y.Z> --repo layer5io/sistent \
+  --tag "v<major>.<minor+1>.0" --title "Sistent v<major>.<minor+1>.0"
+```
+
+The tag is the version source of truth for `release.yml`, so correcting it is what actually publishes the minor. No minor boundary in this repo's history came out of the drafter - `v0.21.0` and the ones below it were created by hand.
+
 ## Verify
 
 1. Watch the publish workflow to success:
@@ -52,7 +63,7 @@ The only human step is publishing the drafted release — Release Drafter has al
 ## What NOT to do
 
 - ❌ Don't `npm publish` locally or `npm version`-tag by hand — the workflow owns publishing (with provenance) and the version comes from the release tag.
-- ❌ Don't edit the draft's version or release notes — Release Drafter owns both; fix PR labels instead.
+- ❌ Don't edit the draft's release notes — Release Drafter owns them; fix PR labels instead. The drafted **version** is a different matter: it is always the next patch, so a minor or major needs the tag corrected by hand, per [Cutting a minor or major](#cutting-a-minor-or-major).
 - ❌ Don't publish expecting an unmerged PR to be included — the release ships `master`'s current state; merge first, then let Release Drafter update the draft.
 - ❌ Don't republish an already-published npm version — npm publishes are effectively permanent; cut a new patch instead.
 
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index fa8435c19..5d47dbbd3 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -20,7 +20,7 @@ npm test -- src/__testing__/routing.test.ts --runInBand
 npm test -- -t "routing utilities" --runInBand
 ```
 
-Current CI runs the main checks on Node 20 and 22. Pull requests also trigger a downstream integration workflow that packs this library and installs it into `meshery/meshery`'s `ui/` app before building and testing there.
+CI runs the main checks on the Node versions in the `node-version` matrix of `.github/workflows/node-checks.yml`; read them there rather than from a copy here that can drift. Pull requests also trigger a downstream integration workflow that packs this library and installs it into `meshery/meshery`'s `ui/` app before building and testing there.
 
 ## Known issues
 
diff --git a/AGENTS.md b/AGENTS.md
index 94c842235..3cb667ee2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -41,6 +41,14 @@ Runbook: [`.agents/skills/cut-release/SKILL.md`](.agents/skills/cut-release/SKIL
 Resolve "what is currently released" from the npm `latest` dist-tag and publish timestamps
 (`npm view @sistent/sistent dist-tags time --json`), not by eyeballing semver order.
 
+A consumer-visible breaking change - a published type that gains a required field, narrows, or
+changes shape - is a **minor** here, not a major: sistent is pre-1.0, so `major` would assert 1.0
+stability rather than describe the break. Label the PR `minor`;
+[`.github/release-drafter.yml`](.github/release-drafter.yml) owns the label-to-bump mapping and
+defaults to `patch`, so an unlabelled PR publishes a breaking change as a patch. That label is
+necessary but not sufficient - as configured the drafter cannot draft anything but a patch tag, so
+a minor needs a manual step too; the runbook's "Cutting a minor or major" section has it.
+
 Verify a published release **by content**, not by the version number moving. Two properties carry
 the three-repo chain, and losing either fails downstream with errors that point nowhere near sistent:
 
diff --git a/README.md b/README.md
index cc740d327..3aff1c667 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,9 @@ Before you begin, ensure you have the following installed on your system:
 
 ### How to get started
 
-Make sure you have `npm` on `node@16` and above. The CI workflows checks for in `node@16`, `node@18` and `node@20`
+Develop on a Node version that CI actually tests. The tested versions are the `node-version` matrix
+in [`.github/workflows/node-checks.yml`](.github/workflows/node-checks.yml) - read them there rather
+than from a copy that can drift.
 
 <div>&nbsp;</div>
 
diff --git a/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx b/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
index 81f69ac61..2663605c6 100644
--- a/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
+++ b/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
@@ -140,13 +140,16 @@ const TeamSearchField: React.FC<TeamSearchFieldProps> = ({
         sx={{ width: 'auto' }}
         disableClearable
         loading={isLoading}
-        // Live only since this field stopped binding a string to `value`, and
-        // partial: it filters against the Autocomplete's own uncontrolled
-        // value - the last option picked - not against `teamsData`, which
-        // holds the real selection. So one team is hidden, and only until the
-        // next `fetchSuggestions` replaces `options` (the comparator below is
-        // reference equality). The duplicate guard in `handleAdd` is what
-        // actually prevents a re-pick. Finishing this properly is
+        // Not "hide what is selected": MUI applies this against the
+        // Autocomplete's own uncontrolled value - the last option picked - not
+        // against `teamsData`, which holds the real selection, and through the
+        // reference-equality comparator below. So at most that one option is
+        // hidden, and only while `options` still holds that exact object -
+        // typing a search before picking makes the post-select input reset
+        // (`getOptionLabel` is `''`) fire `onInputChange` -> `fetchSuggestions`,
+        // and the replacement objects un-hide it. The duplicate guard in
+        // `handleAdd` is what actually prevents a re-pick. Hiding every
+        // selected team deterministically is
         // https://github.com/layer5io/sistent/issues/1784.
         filterSelectedOptions
         noOptionsText={isLoading ? 'Loading...' : 'No team found'}

From 988e3752c4be9858af4764c83262e5e5062b78bd Mon Sep 17 00:00:00 2001
From: "Mericio \"Hablo\" Salazar"
 <218162243+simihablo@users.noreply.github.com>
Date: Fri, 7 Aug 2026 16:50:57 -0500
Subject: [PATCH 12/13] no-mistakes(document): make release-drafter honor
 version labels; trim filter comment

Signed-off-by: Mericio "Hablo" Salazar <218162243+simihablo@users.noreply.github.com>
---
 .agents/skills/cut-release/SKILL.md           | 25 ++++++-------------
 .github/release-drafter.yml                   |  8 ++++--
 AGENTS.md                                     |  9 +++----
 .../GettingStartedWidget/TeamSearchField.tsx  | 15 ++++-------
 4 files changed, 23 insertions(+), 34 deletions(-)

diff --git a/.agents/skills/cut-release/SKILL.md b/.agents/skills/cut-release/SKILL.md
index 8b066a9a2..60dc7f1fe 100644
--- a/.agents/skills/cut-release/SKILL.md
+++ b/.agents/skills/cut-release/SKILL.md
@@ -1,12 +1,12 @@
 ---
 name: cut-release
-description: Runbook for cutting a release of @sistent/sistent to npm. Use when asked to "cut a release", "release Sistent", "publish a new version", or "ship the next @sistent/sistent". The flow is: wait for Release Drafter to fold the merged PR into the draft release, then publish that draft - Release Drafter has already set the notes and drafted the next patch version (a minor or major needs the draft's tag corrected first), and release.yml handles the npm publish (OIDC provenance) and the auto-merged version-bump-back.
+description: Runbook for cutting a release of @sistent/sistent to npm. Use when asked to "cut a release", "release Sistent", "publish a new version", or "ship the next @sistent/sistent". The flow is: wait for Release Drafter to fold the merged PR into the draft release, then publish that draft - Release Drafter has already set the version (from the merged PR's labels) and the notes, and release.yml handles the npm publish (OIDC provenance) and the auto-merged version-bump-back.
 user-invocable: true
 ---
 
 # Cut a Sistent Release
 
-Publishes a new version of the `@sistent/sistent` npm package. Releasing is **automation-driven** and requires **no manual preparation**: Release Drafter already drafts the next version and writes the release notes, and the publish workflow does the rest. You do **not** run `npm publish`, bump `package.json`, write release notes, or create a git tag by hand. The one exception is a minor or major bump, which the drafter cannot produce - see [Cutting a minor or major](#cutting-a-minor-or-major).
+Publishes a new version of the `@sistent/sistent` npm package. Releasing is **automation-driven** and requires **no manual preparation**: Release Drafter already computes the next version and writes the release notes, and the publish workflow does the rest. You do **not** run `npm publish`, bump `package.json`, write release notes, or create a git tag by hand.
 
 - **Package:** `@sistent/sistent` (public, scope `@sistent`), published with npm **provenance** via OIDC trusted publishing.
 - **Release branch:** `master` (protected — requires PR approval).
@@ -14,38 +14,29 @@ Publishes a new version of the `@sistent/sistent` npm package. Releasing is **au
 
 ## The release chain (what actually happens)
 
-1. **A PR merges to `master`** → `release-drafter.yml` runs and updates the **draft GitHub Release**: it folds that PR into the changelog and drafts the **next patch** version. Its `version-resolver` does map `major` / `minor` / `patch` PR labels, but the config's name and tag templates interpolate `$NEXT_PATCH_VERSION` rather than `$RESOLVED_VERSION`, so the resolved bump never reaches the draft - a `minor`-labelled PR still drafts a patch tag. See [Cutting a minor or major](#cutting-a-minor-or-major).
+1. **A PR merges to `master`** → `release-drafter.yml` runs and updates the **draft GitHub Release**: it folds that PR into the changelog and computes the next version from the PR's labels (`major` / `minor` / `patch`, defaulting to `patch` when unlabelled).
 2. **You publish the draft Release.** The tag (e.g. `v0.21.31`) becomes the version source of truth.
 3. Publishing emits `release: published` → **`release.yml`**: sets `package.json#version` from the tag, `npm ci` → `npm run build` → `npm publish --provenance --access public`, then opens the `release/version-bump/vX.Y.Z` PR and **auto-merges it** so `master`'s `package.json`/`package-lock.json` track the published version without sitting idle.
 4. `notify-dependents.yml` fires on the publish workflow's success and bumps downstream consumers (e.g. meshery, meshery-cloud) to the new version.
 
 ## Procedure
 
-For a patch - which is every release the drafter produces on its own - the only human step is publishing the drafted release; Release Drafter has already done the versioning and notes.
+The only human step is publishing the drafted release - Release Drafter has already done the versioning and notes.
 
 1. **Wait for Release Drafter to fold your merged PR into the draft.** After the PR merges to `master`, `release-drafter.yml` runs (a few seconds). Confirm the draft now reflects the merged PR and shows the intended next version:
    ```bash
    gh release list --repo layer5io/sistent          # find the draft (isDraft = true)
    gh release view <vX.Y.Z> --repo layer5io/sistent  # confirm version + notes
    ```
-   The draft is always the next patch. If that is the intended bump, change nothing; if the merged PR carried a breaking change, see [Cutting a minor or major](#cutting-a-minor-or-major) before publishing.
+   If the version bump is wrong, it's driven by the merged PR's labels - relabel and let Release Drafter re-draft; do not hand-edit the tag. Which label a breaking change gets is the pre-1.0 rule in [`AGENTS.md`](../../../AGENTS.md)'s Releasing section.
 
-2. **Publish the draft Release. That's it.** No notes, no tagging:
+2. **Publish the draft Release. That's it.** No version editing, no notes, no tagging:
    ```bash
    gh release edit <vX.Y.Z> --repo layer5io/sistent --draft=false --latest
    ```
    Publishing triggers `release.yml`, which publishes to npm and auto-merges the version-bump-back PR.
 
-### Cutting a minor or major
-
-sistent is pre-1.0, so a consumer-visible breaking change is a **minor** - `major` would assert 1.0 stability rather than describe the break. Label the PR `minor` to record the intent where `version-resolver` expects it, but do not stop there: the drafted tag comes from `$NEXT_PATCH_VERSION`, so the label does not move it. Correct the draft's tag and name before publishing:
-
-```bash
-gh release edit <drafted-vX.Y.Z> --repo layer5io/sistent \
-  --tag "v<major>.<minor+1>.0" --title "Sistent v<major>.<minor+1>.0"
-```
-
-The tag is the version source of truth for `release.yml`, so correcting it is what actually publishes the minor. No minor boundary in this repo's history came out of the drafter - `v0.21.0` and the ones below it were created by hand.
+> **A label-driven minor or major has never actually been drafted in this repo.** Until the config change alongside this note, the name and tag templates interpolated `$NEXT_PATCH_VERSION`, so `version-resolver` was inert and every `v0.21.*` release drafted as a patch regardless of labels (`v0.21.0` and the boundaries below it were created by hand). The first non-patch draft is worth confirming against step 1 before publishing rather than assuming.
 
 ## Verify
 
@@ -63,7 +54,7 @@ The tag is the version source of truth for `release.yml`, so correcting it is wh
 ## What NOT to do
 
 - ❌ Don't `npm publish` locally or `npm version`-tag by hand — the workflow owns publishing (with provenance) and the version comes from the release tag.
-- ❌ Don't edit the draft's release notes — Release Drafter owns them; fix PR labels instead. The drafted **version** is a different matter: it is always the next patch, so a minor or major needs the tag corrected by hand, per [Cutting a minor or major](#cutting-a-minor-or-major).
+- ❌ Don't edit the draft's version or release notes - Release Drafter owns both; fix PR labels instead.
 - ❌ Don't publish expecting an unmerged PR to be included — the release ships `master`'s current state; merge first, then let Release Drafter update the draft.
 - ❌ Don't republish an already-published npm version — npm publishes are effectively permanent; cut a new patch instead.
 
diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml
index 814780d03..61347b2af 100644
--- a/.github/release-drafter.yml
+++ b/.github/release-drafter.yml
@@ -1,5 +1,9 @@
-name-template: 'Sistent v$NEXT_PATCH_VERSION'
-tag-template: 'v$NEXT_PATCH_VERSION'
+# $RESOLVED_VERSION, not $NEXT_PATCH_VERSION: it is what routes the
+# version-resolver below into the drafted tag. With `default: patch` an
+# unlabelled PR resolves to the next patch either way, so only a
+# major/minor-labelled PR drafts differently than it used to.
+name-template: 'Sistent v$RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
 categories:
   - title: '🚀 Features'
     labels:
diff --git a/AGENTS.md b/AGENTS.md
index 3cb667ee2..d483673aa 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -43,11 +43,10 @@ Resolve "what is currently released" from the npm `latest` dist-tag and publish
 
 A consumer-visible breaking change - a published type that gains a required field, narrows, or
 changes shape - is a **minor** here, not a major: sistent is pre-1.0, so `major` would assert 1.0
-stability rather than describe the break. Label the PR `minor`;
-[`.github/release-drafter.yml`](.github/release-drafter.yml) owns the label-to-bump mapping and
-defaults to `patch`, so an unlabelled PR publishes a breaking change as a patch. That label is
-necessary but not sufficient - as configured the drafter cannot draft anything but a patch tag, so
-a minor needs a manual step too; the runbook's "Cutting a minor or major" section has it.
+stability rather than describe the break. Label the PR `minor`, and note that the label is the only
+signal that moves the version: [`.github/release-drafter.yml`](.github/release-drafter.yml) owns the
+label-to-bump mapping and defaults to `patch`, so an unlabelled PR publishes a breaking change as a
+patch.
 
 Verify a published release **by content**, not by the version number moving. Two properties carry
 the three-repo chain, and losing either fails downstream with errors that point nowhere near sistent:
diff --git a/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx b/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
index 2663605c6..22ac492e8 100644
--- a/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
+++ b/src/custom/DashboardWidgets/GettingStartedWidget/TeamSearchField.tsx
@@ -140,16 +140,11 @@ const TeamSearchField: React.FC<TeamSearchFieldProps> = ({
         sx={{ width: 'auto' }}
         disableClearable
         loading={isLoading}
-        // Not "hide what is selected": MUI applies this against the
-        // Autocomplete's own uncontrolled value - the last option picked - not
-        // against `teamsData`, which holds the real selection, and through the
-        // reference-equality comparator below. So at most that one option is
-        // hidden, and only while `options` still holds that exact object -
-        // typing a search before picking makes the post-select input reset
-        // (`getOptionLabel` is `''`) fire `onInputChange` -> `fetchSuggestions`,
-        // and the replacement objects un-hide it. The duplicate guard in
-        // `handleAdd` is what actually prevents a re-pick. Hiding every
-        // selected team deterministically is
+        // MUI applies this through `isOptionEqualToValue` below, which is
+        // reference equality here and so load-bearing: whether this filter hides
+        // anything depends on whether a refetch has replaced `options` with new
+        // objects. Do not rely on it - the duplicate guard in `handleAdd` is
+        // what actually prevents a re-pick. Analysis and the fix:
         // https://github.com/layer5io/sistent/issues/1784.
         filterSelectedOptions
         noOptionsText={isLoading ? 'Loading...' : 'No team found'}

From 838e7d2996cd2bfd7e7575fba6d01423b4c13bb5 Mon Sep 17 00:00:00 2001
From: "Mericio \"Hablo\" Salazar"
 <218162243+simihablo@users.noreply.github.com>
Date: Fri, 7 Aug 2026 17:11:28 -0500
Subject: [PATCH 13/13] fix(release): make relabel re-draft callable; parse
 real exports in dts audit

Addresses PR review feedback.

- .github/workflows/release-drafter.yml: add workflow_dispatch. The runbook
  tells you to relabel and let Release Drafter re-draft when a version bump is
  wrong, but the workflow only ran on push to master, so relabelling after the
  merge did nothing. cut-release now documents the `gh workflow run` re-draft.
- AGENTS.md: the declaration-gap audit tested whether a symbol name appeared
  anywhere in dist/index.d.ts, so an internal declaration or a doc comment
  counted as "declared". It now parses the declaration bundle's own export
  lists, which raises the measured gap from 128 to 130 of 729.
- CustomCatalog/CustomCard.tsx: `new Date(updatedAt.slice(0, 10))` parses as UTC
  midnight and then renders in local time, showing the previous day to any
  viewer at a negative UTC offset. Parse the full RFC 3339 instant instead.

Signed-off-by: Mericio "Hablo" Salazar <218162243+simihablo@users.noreply.github.com>
---
 .agents/skills/cut-release/SKILL.md     |  6 ++++++
 .github/workflows/release-drafter.yml   |  5 +++++
 AGENTS.md                               | 17 ++++++++++-------
 src/custom/CustomCatalog/CustomCard.tsx |  2 +-
 4 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/.agents/skills/cut-release/SKILL.md b/.agents/skills/cut-release/SKILL.md
index 60dc7f1fe..7e3f75d9e 100644
--- a/.agents/skills/cut-release/SKILL.md
+++ b/.agents/skills/cut-release/SKILL.md
@@ -30,6 +30,12 @@ The only human step is publishing the drafted release - Release Drafter has alre
    ```
    If the version bump is wrong, it's driven by the merged PR's labels - relabel and let Release Drafter re-draft; do not hand-edit the tag. Which label a breaking change gets is the pre-1.0 rule in [`AGENTS.md`](../../../AGENTS.md)'s Releasing section.
 
+   Relabelling alone does **not** re-draft: `release-drafter.yml` runs on push to `master`, so nothing re-runs it after the merge. Re-run it by hand once the label is right:
+   ```bash
+   gh workflow run release-drafter.yml --repo layer5io/sistent --ref master
+   ```
+   Then re-check the draft with `gh release view` before publishing.
+
 2. **Publish the draft Release. That's it.** No version editing, no notes, no tagging:
    ```bash
    gh release edit <vX.Y.Z> --repo layer5io/sistent --draft=false --latest
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index 78fe422d5..1c1dff5ad 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -5,6 +5,11 @@ on:
     # our release branch
     branches:
       - master
+  # Manual re-draft. Release Drafter recomputes the draft from the merged PRs and
+  # their labels, so this is how a mislabelled release is corrected: relabel the
+  # merged PR, then re-run this workflow. Without it the drafter only ever runs on
+  # a push to master, so relabelling after the fact has no effect.
+  workflow_dispatch:
 
 jobs:
   update_release_draft:
diff --git a/AGENTS.md b/AGENTS.md
index d483673aa..217a5f976 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -219,16 +219,19 @@ covered - it is large, and every uncovered symbol is one a consumer must shim lo
 
 ```bash
 npm run build
-node -e 'const f=require("fs"),rt=new Set();
-for(const b of f.readFileSync("dist/index.mjs","utf8").matchAll(/export\s*\{([^{}]*)\}\s*;?/g))
-  b[1].split(",").map(s=>s.trim()).filter(Boolean).forEach(s=>rt.add(s.split(/\s+as\s+/).pop().trim()));
-const d=f.readFileSync("dist/index.d.ts","utf8");
-console.log([...rt].filter(n=>/^[A-Za-z_$][\w$]*$/.test(n)&&!new RegExp("\\b"+n+"\\b").test(d)).sort().join("\n"))'
+node -e 'const f=require("fs"),names=t=>{const s=new Set();
+for(const b of t.matchAll(/export\s*\{([^{}]*)\}\s*;?/g))
+  b[1].split(",").map(x=>x.trim()).filter(Boolean)
+    .forEach(x=>s.add(x.replace(/^type\s+/,"").split(/\s+as\s+/).pop().trim()));
+return s;};
+const rt=names(f.readFileSync("dist/index.mjs","utf8"));
+const dt=names(f.readFileSync("dist/index.d.ts","utf8"));
+console.log([...rt].filter(n=>/^[A-Za-z_$][\w$]*$/.test(n)&&!dt.has(n)).sort().join("\n"))'
 ```
 
-As of this change that reports 128 of 729 runtime exports absent from the declaration bundle -
+As of this change that reports 130 of 729 runtime exports absent from the declaration bundle -
 `WorkspaceCard`, `TeamTable`, `UsersTable`, `CustomImage`, `ErrorBoundary` and most of
-`src/custom/` among them. Adding 128 lines is not the answer; the durable fix is in how the
+`src/custom/` among them. Adding 130 lines is not the answer; the durable fix is in how the
 declaration bundle is produced. Until then, prefer extending this list over leaving a symbol
 uncovered, and do not read its absence as "that component is intentionally private".
 
diff --git a/src/custom/CustomCatalog/CustomCard.tsx b/src/custom/CustomCatalog/CustomCard.tsx
index cf3cdc9f2..daf2630c0 100644
--- a/src/custom/CustomCatalog/CustomCard.tsx
+++ b/src/custom/CustomCatalog/CustomCard.tsx
@@ -349,7 +349,7 @@ const CustomCatalogCard: React.FC<CatalogCardProps> = ({
                     <DateText>
                       {' '}
                       {pattern.updatedAt
-                        ? new Date(pattern.updatedAt.slice(0, 10)).toLocaleDateString('en-US', {
+                        ? new Date(pattern.updatedAt).toLocaleDateString('en-US', {
                             day: 'numeric',
                             month: 'long',
                             year: 'numeric'