@ai-matrx/records-ui 0.10.3 → 0.16.1

package/CHANGELOG.md

@@ -1,5 +1,198 @@
 # Changelog — @ai-matrx/records-ui
 
+## 0.16.1
+
+**`FormSubmitOutcome` is exported.** It is the return type of
+`FormRunnerProps.onSubmit`, so a host supplying its own submit could not type
+its own handler: matrx-frontend's `PublicFormRunner` failed `tsc` on 0.16.0 with
+TS2459, "declares it locally, but it is not exported". A public surface is every
+type a consumer has to name.
+
+### Consumer action
+
+None beyond importing it if you implement `onSubmit`.
+
+## 0.16.0
+
+**The grid never draws a row before it knows what the person may do.** My own
+regression from 0.12.0's refresh fix, bisected rather than guessed: treating the
+whole first load as "the rows have arrived" let the grid render while the
+table's own read was still in flight, and `useTableRights` answers `NO_RIGHTS`
+(`known: false`) then — so every cell came out as plain text with no editor and
+a click on it did nothing and said nothing. The declaration, the columns and the
+person's own level are answered ONCE per table, so they are a FIRST LOAD; only
+the page re-read is a refresh, and it still never blanks rows somebody is
+already typing in.
+
+**A publish gate that can be believed.** This package had not published since
+0.10.3 while five versions piled up, because `pnpm test` ran the whole live
+component suite against a database several lanes' harnesses share behind one
+advisory lock — each run failed a different handful of timing clauses with no
+overlap. `pnpm test` is now a DETERMINISTIC component suite (the real components
+against recorded real-door answers at this package's own `RecordsDataSource`
+seam, no network, and a call the fixture never saw throws by name) plus a SHORT
+live smoke (declare a table, take a column, write, read back, page, delete).
+Typecheck and both suites run in 27 seconds. The full live suite is
+`pnpm test:live` and runs in its own workflow on the tag and on a schedule,
+reporting red loudly and blocking nothing. Nothing was deleted or loosened.
+
+**And the two suites that could not run on a lane's own port** —
+`system-table-shape` and `walk` pinned 127.0.0.1:3005 — now read
+`RECORDS_UI_DEMO_PORT`.
+
+### Consumer action
+
+None. No API changed. `pnpm test:record` re-records the door fixture.
+
+## 0.15.0
+
+**`ActionInbox` reads the STORE's queue, and the package-owned one is gone.**
+SCR-11 shipped with its own `records_ui_action` Table: agents wrote rows into it
+and it rendered them beautifully. It was a second source of truth. An approval a
+person filed through the store, and the wait the server's own `field_propose`
+produces under `ask`, appeared nowhere in it — which is exactly the thing
+PRODUCTS.md row 6 says the product must not be ("One inbox holds human approvals
+AND the agent's field and table proposals — the same queue, the same right to
+approve").
+
+It now reads `custom.work_inbox` and decides through `custom.work_approval_decide`,
+which APPLIES the change in the same transaction as the decision, as the person
+who approved, through the store's own doors.
+
+* **Keyboard-first**, because Linear's inbox is the bar: `j`/`k` or the arrows
+  move, `a` approves, `d` declines, `o` opens, `r` refreshes. The selected row
+  scrolls into view and the header states the keys.
+* **Level-aware, absent rather than dead.** The door answers `actionable` — which
+  is `custom.work_approval_may_decide` asked per row — so a row this person may
+  not decide renders with NO buttons and says what it is waiting for, instead of
+  a greyed-out Approve that fails when clicked. The person who ASKED for a change
+  is refused the answer to their own request, by the store, and the row says so.
+* The store's own outcome sentence is shown verbatim ("Rate card is now a column
+  on this table"); this component never rewrites it.
+
+**Consumer action — BREAKING for anybody who seeded the old queue.**
+`ACTION_TABLE`, `actionDocument`, `QueuedAction`, `QueuedActionSpec` and the
+`seed` prop are removed. Nothing seeds an inbox any more: a person or an agent
+files a real request through `custom.work_approval_request`
+(`client.workApprovalRequest(...)`) and it appears. `ActionInbox` keeps
+`tableId`, `includeSettled`, `onOpenRecord` and `className`. Requires
+`@ai-matrx/records` 0.10.0.
+
+## 0.12.0
+
+**Everything 0.11.0 carried — the level-aware screens and the one refusal
+formatter below — is in this release. 0.11.0 was tagged and never published: its
+gate failed, and two of the four failures were real defects rather than stale
+copy. They are what this version fixes.**
+
+**A read the person did not ask for no longer takes the cell they are typing in
+off the screen.** `Grid` handed `MatrxDataTable` an `isLoading` that went true on
+every `reload()`, and a cell write reloads the page — while `isLoading` the data
+table renders six SKELETON rows IN PLACE OF the real ones, so committing one cell
+unmounted every cell on the page, the open editor included. In a browser that
+costs the caret and any keystroke inside the window; in the live suite one column
+of a tabbed row saved as nothing, a different one each run, which is what made it
+look like the store rather than the screen. A refresh is now `isFetching` — the
+data table's own refresh line, with the rows kept — and `isLoading` means only
+what it says: there is nothing to show yet.
+
+**Enter finishes a long-text cell, and Shift+Enter makes the newline.** It used
+to be the other way round, with Ctrl/Cmd+Enter to save, printed in 10px under the
+box: the key every grid in the world binds did nothing in the columns whose
+values are longest. Airtable is the bar. A json cell takes its newline the same
+way — it was not counted as multi-line at all, so Enter could not save it either.
+
+**One version read per record, and a version only ever goes up.** Opening a cell
+asked the store for the record's version, and tabbing on asked again before
+either answer was back; the write between them stored the store's new version,
+and whichever read landed last put the old one back. The next cell of that row
+then carried a version the store had already moved past, and a person tabbing
+through their own row was shown a conflict with themselves.
+
+**A borrowed value and a total can be built over a Person or a File again.**
+`ValueOnTheOtherSide` offers the columns the relation's target Table DECLARES —
+and a Person column points at the person kernel, which has 441 records and zero
+Field rows, so it offered nothing and said the table had no columns. The store
+reads the far side as `custom.record_values(…) -> pick`, so a pick names a key
+those records CARRY: when the target declares no Fields, the panel reads one of
+its records through the ordinary read door and offers the keys it has.
+
+### Consumer action
+
+None beyond 0.11.0's (below): no API changed. Requires `@ai-matrx/records`
+>= 0.7.0 for `custom.my_levels`.
+
+## 0.11.0 — tagged, never published
+
+**The screens never invite an action the ladder will refuse.** The 19–20
+September verdict (sixth pass), measured against Airtable, Notion and Linear:
+"None of these three products lets you start an action it already knows it will
+reject."
+
+**Every control follows the level the STORE answers.** The rights question was a
+port with two honest answers and no third — nothing offered, or
+`storeDecidesRights`: yes to everything for every non-kernel table, for
+everybody, and let the door refuse afterwards. That second one is what every
+person in the product met, and it is the defect written down. `useTableRights`
+now asks `custom.my_levels` (a table is a record), `useRecordRights` asks for one
+record, and `useRowRights` asks for a whole page in ONE call — and only when the
+table's own level does not already admit editing, because a record shared at
+Editor inside a table held at Viewer is exactly what the verdict found and the
+grid labelled that row "viewer" while the store let its holder write to it.
+
+`src/rights.ts` is the ONE place a level becomes a screen: six capabilities —
+read, comment, write, remove, share, structure — each keyed to the rung the DOOR
+itself asks for. Every `false` carries the sentence that says why, naming the
+level it would take and who can give it: *"You are Viewer here, and it takes
+Editor to change anything here. Ask somebody who is Admin on it to move you up."*
+Absent AND explained. A cell a person may not write is plain text that says so
+on hover; Tab walks PAST a row they may not write rather than opening an editor
+in it; Delete is absent on those rows; Share is absent below Admin; the field
+panel and the table settings say what changing the shape of a table takes.
+
+**One formatter, and every refusal goes through it.** `src/plainWords.ts`;
+`Refusal.tsx` renders what it returns and NOTHING else — no `error.message`, no
+`error.hint`, no SQLSTATE where a person reads. Filtering the hint was not
+enough, structurally: the store builds its access refusals with `format()` from
+THE DOOR'S OWN NAME, so the machine identity is inside the sentence written for
+the person ("You do not have access to this record, so `custom.record_update`
+may not write to it"). The formatter drops the machine clause by SHAPE, keeps
+the store's own words where they are a person's words, and ADDS A REMEDY keyed
+off the refusal code — a refusal with nothing to do about it is a dead end with
+an explanation. What it drops is kept for an engineer on the notice and in a
+screen-reader-only line. Nine screens that had captured `error.message` into
+their own state now go through it too.
+
+**A borrowed value and a total no longer ask for an internal key.** "The value
+to read" was a free-text box with the placeholder `name`; the relation already
+says which Table it points at, so both now offer that Table's columns BY NAME.
+
+**All sixteen column types open their own editor.** Four editor states that drew
+a paragraph rather than a box — a choice list loading, a choice list whose Table
+is empty, a multi-choice row, a worked-out column — carried no cell id, so the
+cell could not identify itself. Verified keyboard-only against the live store:
+sixteen open, nine typed kinds land, the date included.
+
+**Internal names, swept, by a guard that reads rendered text node by node.** Gone
+from where a person reads: the derived key under the field panel's name box; the
+machine key as a history label and raw JSON for unknown history values; the
+conflict line's key and two JSON blobs; the record panel's provenance rows as
+JSON; a truncated uuid standing in for an unnamed subject's name; JSON dumps in
+cells and in the grid's conflict line.
+
+### Consumer action
+
+**None for the three mount sites in matrx-frontend** — they already pass
+`letTheStoreDecideRights`, which now means what it says: bind no `rights` port
+and the package asks the store. `storeDecidesRights` is DEPRECATED and answers
+"not known": it is synchronous, the honest answer needs a door call, and a port
+bound there would OVERRIDE the store's answer. A host that binds `rights` of its
+own still wins, and `tableRightsAt(level)` is the one way to build that answer
+by hand — it takes the LEVEL, never six booleans, so nobody can hand a screen a
+combination the ladder cannot produce.
+
+Requires `@ai-matrx/records` >= 0.7.0 for `custom.my_levels`.
+
 ## 0.10.3
 
 Reissues the unpublished 0.10.2 candidate. Its live-store release gate exposed