@ai-matrx/associations 0.9.33 → 0.10.0

package/dist/{CommentThread-CaUsmcYj.d.cts → CommentThread-B0aryGyN.d.cts}

@@ -276,6 +276,22 @@ interface DemandedRpcSignatures {
             title: string;
         }[];
     };
+    entity_row_create: {
+        Args: {
+            p_organization_id: string;
+            p_title: string;
+            p_token: string;
+        };
+        Returns: unknown;
+    };
+    entity_row_rename: {
+        Args: {
+            p_id: string;
+            p_title: string;
+            p_token: string;
+        };
+        Returns: unknown;
+    };
     cmt_list: {
         Args: {
             p_entity_id: string;
@@ -364,27 +380,6 @@ interface PgError {
     hint?: string | null;
 }
 
-/**
- * The minimal table surface entity-row create/rename needs (a structural
- * subset of supabase-js's query builder). Registry-convention writes go
- * DIRECT to the backing table (they are RLS-gated feature rows, not
- * association edges — there is no RPC for them by design).
- */
-interface AssociationsTableQuery {
-    insert(row: Record<string, unknown>): {
-        select(columns: string): {
-            single(): PromiseLike<{
-                data: unknown;
-                error: PgError | null;
-            }>;
-        };
-    };
-    update(patch: Record<string, unknown>): {
-        eq(column: string, value: string): PromiseLike<{
-            error: PgError | null;
-        }>;
-    };
-}
 /**
  * The data seam — a structural subset of `SupabaseClient<Database>`: any
  * client that can answer the demanded RPC families (README § The demanded
@@ -392,22 +387,21 @@ interface AssociationsTableQuery {
  * one. `PromiseLike` because supabase-js returns a thenable builder, not a
  * `Promise`.
  *
- * `from`/`schema` are OPTIONAL (W2, additive): only the entity-row
- * create/rename service uses them (generic registry-convention row writes).
- * A dataSource without them still satisfies every RPC operation; calling
- * entity-row create/rename against it returns a screamed `{ok:false}`
- * result naming the missing capability — never a silent no-op. A real
- * supabase-js client satisfies both structurally.
+ * 🚨 RPC AND NOTHING ELSE (DOORS-ONLY-4, 2026-09-21). This port used to carry
+ * OPTIONAL `from`/`schema` table surfaces, used by exactly one service —
+ * entity-row create/rename, which wrote the registered entity's backing table
+ * directly. The doors-only ruling (`platform` and `iam` are not client-writable;
+ * every write goes through a named SECURITY DEFINER door) made that path answer
+ * `42501` on every closed table, so it now calls `entity_row_create` /
+ * `entity_row_rename` like every other operation. With its one reader gone the
+ * two optional members were a port nobody reads — removed rather than left as a
+ * seam a future write could quietly reach for.
  */
 interface AssociationsDataSource {
     rpc(fn: DemandedRpcName, args: Record<string, unknown>): PromiseLike<{
         data: unknown;
         error: PgError | null;
     }>;
-    from?(table: string): AssociationsTableQuery;
-    schema?(name: string): {
-        from(table: string): AssociationsTableQuery;
-    };
 }
 /**
  * The identity seam — today a store-singleton read (`requireUserId`) plus the
@@ -1100,9 +1094,19 @@ type EntityRowResult = {
 interface CreateEntityRowArgs {
     /** The new row's human name — written to the registry `titleColumn`. */
     title: string;
-    /** Org to stamp (skipped when the token has no org column). */
+    /**
+     * The organization the new row belongs to. REQUIRED by
+     * `public.entity_row_create`: every creatable token's table carries
+     * `organization_id`, and the door refuses a row with nobody owning it.
+     */
     orgId?: string | null;
-    /** Required NOT NULL columns the registry conventions can't know about. */
+    /**
+     * 🚨 NO LONGER WRITABLE THROUGH THIS SERVICE (DOORS-ONLY-4). The door writes the
+     * name, the owner and the organization and nothing else, so a non-empty value here
+     * is REFUSED with the columns named rather than dropped on the floor. A token whose
+     * table needs more than a name is created by its own feature's create service; this
+     * generic path then only renames it.
+     */
     extraColumns?: Record<string, unknown>;
 }
 interface EntityRowsServiceApi {

package/dist/{CommentThread-CaUsmcYj.d.ts → CommentThread-B0aryGyN.d.ts}

@@ -276,6 +276,22 @@ interface DemandedRpcSignatures {
             title: string;
         }[];
     };
+    entity_row_create: {
+        Args: {
+            p_organization_id: string;
+            p_title: string;
+            p_token: string;
+        };
+        Returns: unknown;
+    };
+    entity_row_rename: {
+        Args: {
+            p_id: string;
+            p_title: string;
+            p_token: string;
+        };
+        Returns: unknown;
+    };
     cmt_list: {
         Args: {
             p_entity_id: string;
@@ -364,27 +380,6 @@ interface PgError {
     hint?: string | null;
 }
 
-/**
- * The minimal table surface entity-row create/rename needs (a structural
- * subset of supabase-js's query builder). Registry-convention writes go
- * DIRECT to the backing table (they are RLS-gated feature rows, not
- * association edges — there is no RPC for them by design).
- */
-interface AssociationsTableQuery {
-    insert(row: Record<string, unknown>): {
-        select(columns: string): {
-            single(): PromiseLike<{
-                data: unknown;
-                error: PgError | null;
-            }>;
-        };
-    };
-    update(patch: Record<string, unknown>): {
-        eq(column: string, value: string): PromiseLike<{
-            error: PgError | null;
-        }>;
-    };
-}
 /**
  * The data seam — a structural subset of `SupabaseClient<Database>`: any
  * client that can answer the demanded RPC families (README § The demanded
@@ -392,22 +387,21 @@ interface AssociationsTableQuery {
  * one. `PromiseLike` because supabase-js returns a thenable builder, not a
  * `Promise`.
  *
- * `from`/`schema` are OPTIONAL (W2, additive): only the entity-row
- * create/rename service uses them (generic registry-convention row writes).
- * A dataSource without them still satisfies every RPC operation; calling
- * entity-row create/rename against it returns a screamed `{ok:false}`
- * result naming the missing capability — never a silent no-op. A real
- * supabase-js client satisfies both structurally.
+ * 🚨 RPC AND NOTHING ELSE (DOORS-ONLY-4, 2026-09-21). This port used to carry
+ * OPTIONAL `from`/`schema` table surfaces, used by exactly one service —
+ * entity-row create/rename, which wrote the registered entity's backing table
+ * directly. The doors-only ruling (`platform` and `iam` are not client-writable;
+ * every write goes through a named SECURITY DEFINER door) made that path answer
+ * `42501` on every closed table, so it now calls `entity_row_create` /
+ * `entity_row_rename` like every other operation. With its one reader gone the
+ * two optional members were a port nobody reads — removed rather than left as a
+ * seam a future write could quietly reach for.
  */
 interface AssociationsDataSource {
     rpc(fn: DemandedRpcName, args: Record<string, unknown>): PromiseLike<{
         data: unknown;
         error: PgError | null;
     }>;
-    from?(table: string): AssociationsTableQuery;
-    schema?(name: string): {
-        from(table: string): AssociationsTableQuery;
-    };
 }
 /**
  * The identity seam — today a store-singleton read (`requireUserId`) plus the
@@ -1100,9 +1094,19 @@ type EntityRowResult = {
 interface CreateEntityRowArgs {
     /** The new row's human name — written to the registry `titleColumn`. */
     title: string;
-    /** Org to stamp (skipped when the token has no org column). */
+    /**
+     * The organization the new row belongs to. REQUIRED by
+     * `public.entity_row_create`: every creatable token's table carries
+     * `organization_id`, and the door refuses a row with nobody owning it.
+     */
     orgId?: string | null;
-    /** Required NOT NULL columns the registry conventions can't know about. */
+    /**
+     * 🚨 NO LONGER WRITABLE THROUGH THIS SERVICE (DOORS-ONLY-4). The door writes the
+     * name, the owner and the organization and nothing else, so a non-empty value here
+     * is REFUSED with the columns named rather than dropped on the floor. A token whose
+     * table needs more than a name is created by its own feature's create service; this
+     * generic path then only renames it.
+     */
     extraColumns?: Record<string, unknown>;
 }
 interface EntityRowsServiceApi {

package/dist/core/index.cjs

@@ -3195,31 +3195,7 @@ function createTitlesService(deps, candidates) {
 
 // src/core/entityRows.ts
 function createEntityRowsService(deps, titles) {
-  const { dataSource, identity, registry, errorSink } = deps;
-  function tableFor(token, schema, table) {
-    if (schema && schema !== "public") {
-      if (!dataSource.schema) {
-        const error = `dataSource has no schema() capability \u2014 entity-row writes for "${token}" (${schema}.${table}) need a table-capable dataSource (a real supabase-js client)`;
-        errorSink({
-          code: "datasource_missing_table_capability",
-          message: `[entityRows] ${error}`,
-          context: { token, schema, table }
-        });
-        return { ok: false, error };
-      }
-      return { ok: true, query: dataSource.schema(schema).from(table) };
-    }
-    if (!dataSource.from) {
-      const error = `dataSource has no from() capability \u2014 entity-row writes for "${token}" need a table-capable dataSource (a real supabase-js client)`;
-      errorSink({
-        code: "datasource_missing_table_capability",
-        message: `[entityRows] ${error}`,
-        context: { token, schema, table }
-      });
-      return { ok: false, error };
-    }
-    return { ok: true, query: dataSource.from(table) };
-  }
+  const { dataSource, registry, errorSink } = deps;
   function requireTitleColumn(token, op) {
     const info = registry.getEntityInfo(token);
     if (!info.titleColumn) {
@@ -3231,43 +3207,68 @@ function createEntityRowsService(deps, titles) {
       });
       return { ok: false, error };
     }
-    return { ok: true, titleColumn: info.titleColumn };
+    return { ok: true };
   }
   return {
     /**
-     * Insert one row of `token`'s backing table named `title`, owned by the
-     * current user (when the table has an owner column). Returns the new
-     * row's id + title. The caller wires associations afterwards — this
-     * layer never writes edges.
+     * Create one row of `token`'s backing table named `title`, through
+     * `public.entity_row_create`. The door stamps `created_by` from `auth.uid()`,
+     * checks the caller can act in the organization, and refuses machinery tokens and
+     * tables with no organization by name. Returns the new row's id + title. The
+     * caller wires associations afterwards — this layer never writes edges.
      */
     async createEntityRow(token, args) {
       const gate = requireTitleColumn(token, "creating rows");
       if (!gate.ok) return gate;
-      const info = registry.getEntityInfo(token);
       const title = args.title.trim();
       if (!title) return { ok: false, error: "Name is required" };
+      const extras = Object.keys(args.extraColumns ?? {});
+      if (extras.length > 0) {
+        const error = `A new ${registry.getEntityInfo(token).label} cannot be created here with ${extras.join(", ")}: the shared create door writes the name, the owner and the organization and nothing else. Create it with this feature's own create service, then attach it.`;
+        errorSink({
+          code: "entity_row_extra_columns_unsupported",
+          message: `[createEntityRow] extraColumns are not writable through entity_row_create for "${token}": ${extras.join(", ")}`,
+          context: { token, extras }
+        });
+        return { ok: false, error };
+      }
+      if (!args.orgId) {
+        const error = `Name the organization this ${registry.getEntityInfo(token).label} belongs to.`;
+        errorSink({
+          code: "entity_row_missing_organization",
+          message: `[createEntityRow] no organization supplied for "${token}"; entity_row_create requires one`,
+          context: { token }
+        });
+        return { ok: false, error };
+      }
       try {
-        const userId = identity.requireUserId();
-        const table = tableFor(token, info.schema, info.table);
-        if (!table.ok) return table;
-        const row = {
-          [gate.titleColumn]: title,
-          ...info.ownerColumn ? { [info.ownerColumn]: userId } : {},
-          ...info.orgColumn && args.orgId ? { [info.orgColumn]: args.orgId } : {},
-          ...args.extraColumns ?? {}
-        };
-        const { data, error } = await table.query.insert(row).select("id").single();
+        const { data, error } = await dataSource.rpc("entity_row_create", {
+          p_token: token,
+          p_title: title,
+          p_organization_id: args.orgId
+        });
         if (error) {
           errorSink({
             code: "entity_row_insert_failed",
-            message: `[createEntityRow] insert failed for "${token}": ${error.message}`,
+            message: `[createEntityRow] entity_row_create failed for "${token}": ${error.message}`,
             context: { token, detail: error }
           });
           return { ok: false, error: error.message };
         }
-        const id = String(data.id);
-        titles.prime(token, id, title);
-        return { ok: true, data: { id, title } };
+        const row = data;
+        if (!row || typeof row.id !== "string" || !row.id) {
+          const msg = "The create door returned no record.";
+          errorSink({
+            code: "entity_row_insert_failed",
+            message: `[createEntityRow] entity_row_create returned no id for "${token}"`,
+            context: { token, detail: data }
+          });
+          return { ok: false, error: msg };
+        }
+        const id = row.id;
+        const named = typeof row.title === "string" && row.title ? row.title : title;
+        titles.prime(token, id, named);
+        return { ok: true, data: { id, title: named } };
       } catch (e) {
         const msg = e instanceof Error ? e.message : "Failed to create";
         errorSink({
@@ -3278,21 +3279,27 @@ function createEntityRowsService(deps, titles) {
         return { ok: false, error: msg };
       }
     },
-    /** Update the registry `titleColumn` of one row of `token`'s table. */
+    /**
+     * Rename one row of `token`'s table through `public.entity_row_rename`. The door
+     * decides on the one ladder — the row's author, `editor` on the row, or a platform
+     * admin — and answers "there is no such thing here" rather than telling a caller
+     * that somebody else's row exists.
+     */
     async renameEntityRow(token, id, title) {
       const gate = requireTitleColumn(token, "renaming rows");
       if (!gate.ok) return gate;
-      const info = registry.getEntityInfo(token);
       const trimmed = title.trim();
       if (!trimmed) return { ok: false, error: "Name is required" };
       try {
-        const table = tableFor(token, info.schema, info.table);
-        if (!table.ok) return table;
-        const { error } = await table.query.update({ [gate.titleColumn]: trimmed }).eq("id", id);
+        const { error } = await dataSource.rpc("entity_row_rename", {
+          p_token: token,
+          p_id: id,
+          p_title: trimmed
+        });
         if (error) {
           errorSink({
             code: "entity_row_update_failed",
-            message: `[renameEntityRow] update failed for "${token}": ${error.message}`,
+            message: `[renameEntityRow] entity_row_rename failed for "${token}": ${error.message}`,
             context: { token, id, detail: error }
           });
           return { ok: false, error: error.message };