@ai-matrx/records 0.16.0 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog — @ai-matrx/records
 
+## 0.17.0
+
+**A list is a door, never a grant on the thing behind it.**
+
+`docTemplates`, `docRenders` and `docSignatures` read `custom.doc_template` (a
+view), `custom.doc_render` and `custom.doc_signature` (tables) with a direct
+PostgREST `.from()`. **None of those three holds a client SELECT**, and none ever
+should — so every plural act of document generation returned 403, and the
+try-everything page photographed *"permission denied for view doc_template"* on
+2026-09-20. A person could save a template they could never list and render a
+document they could never find again.
+
+All three now call doors that narrow inside the definer, after the ladder has
+spoken: `custom.doc_templates` and `custom.doc_renders` / `custom.doc_signatures`
+(viewer on the Table, viewer on the record). Two acts that had no door at all
+arrive with them:
+
+- **`docTemplateDelete({ template_id })`** — retire one template. Editor on the
+  Table it renders, because a template is that Table's wording. Soft only:
+  documents already rendered keep their frozen bytes and their seals, so
+  retiring a template can never invalidate a signature (VAL-10).
+- **`subscriptionCadences()`** — the cadences a subscription may be written
+  with, through the door a PERSON may call. `aggSubscriptionCadences` is the
+  notifier's own and holds no client grant, so every screen that asked for it
+  was refused and fell back to a word typed into the screen; this one delegates
+  to the same array, so a picker can never offer a cadence the digest runner
+  does not honour.
+
+`DocTemplateRow` drops `organization_id`, which the door does not answer and no
+caller read — the client already holds the organization. The door names its key
+`template_id` / `render_id` / `signature_id`; the package keeps `id`, mapped once
+here rather than renamed in four screens.
+
+`store.generated.ts` regenerated from the live store: **387 → 401 doors**.
+
+**Consumer action:** none for `docTemplates` / `docRenders` / `docSignatures` —
+same names, same row shapes, they simply stop being refused. The five doors they
+need are live on the main database (`doorstwo_the_document_and_cadence_doors.sql`
++ its grant file, applied 2026-09-20 13:43Z), so this version requires no
+migration of its own.
+
 ## 0.16.0
 
 **A column is declared, and a client type can finally say so.**

package/dist/core/index.cjs

@@ -374,6 +374,9 @@ var STORE_DOORS = [
   { name: "choice_synonyms_in", args: "p_map jsonb, p_token text", returns: "text[]", security: "invoker" },
   { name: "choice_words", args: "p_field jsonb", returns: "text", security: "invoker" },
   { name: "client_write_grants", args: "", returns: "TABLE(role_name text, object_name text, privilege text)", security: "invoker" },
+  { name: "comment_mention_deliver", args: "p_organization_id uuid, p_record_id uuid, p_table_id uuid, p_comment_id uuid, p_recipient uuid, p_author_name text, p_record_title text, p_body text", returns: "uuid", security: "definer" },
+  { name: "comment_thread", args: "p_organization_id uuid, p_record_id uuid, p_include_resolved boolean DEFAULT false", returns: "jsonb", security: "definer" },
+  { name: "comment_write", args: "p_organization_id uuid, p_record_id uuid, p_body text, p_anchor jsonb DEFAULT '{}'::jsonb, p_parent_comment_id uuid DEFAULT NULL::uuid, p_mentions uuid[] DEFAULT NULL::uuid[]", returns: "jsonb", security: "definer" },
   { name: "computed_provenance", args: "p_organization_id uuid, p_record_id uuid", returns: "TABLE(field_key text, field_id uuid, value jsonb, rule_id uuid, rule_version integer, computed_at timestamp with time zone)", security: "invoker" },
   { name: "containment_chain", args: "p_organization_id uuid, p_record_id uuid", returns: "TABLE(ancestor_id uuid, depth integer)", security: "invoker" },
   { name: "containment_depth_ceiling", args: "p_organization_id uuid DEFAULT NULL::uuid", returns: "integer", security: "invoker" },
@@ -406,13 +409,17 @@ var STORE_DOORS = [
   { name: "doc_render_document", args: "p_organization_id uuid, p_template_id uuid, p_record_id uuid", returns: "uuid", security: "definer" },
   { name: "doc_render_read", args: "p_organization_id uuid, p_render_id uuid", returns: "jsonb", security: "definer" },
   { name: "doc_render_write", args: "p_organization_id uuid, p_template_id uuid, p_record_id uuid, p_table_id uuid, p_template_version integer, p_body text, p_content_hash text", returns: "uuid", security: "definer" },
+  { name: "doc_renders", args: "p_organization_id uuid, p_record_id uuid", returns: "TABLE(render_id uuid, template_id uuid, record_id uuid, table_id uuid, template_version integer, body text, content_hash text, rendered_at timestamp with time zone)", security: "definer" },
   { name: "doc_sign", args: "p_organization_id uuid, p_render_id uuid, p_field_key text, p_signer_name text, p_signer_user_id uuid DEFAULT NULL::uuid", returns: "uuid", security: "definer" },
   { name: "doc_signature_field_ok", args: "p_field_data jsonb", returns: "boolean", security: "invoker" },
   { name: "doc_signature_intact", args: "p_organization_id uuid, p_signature_id uuid", returns: "jsonb", security: "invoker" },
   { name: "doc_signature_read", args: "p_organization_id uuid, p_signature_id uuid", returns: "jsonb", security: "definer" },
   { name: "doc_signature_write", args: "p_organization_id uuid, p_render_id uuid, p_record_id uuid, p_field_key text, p_signer_name text, p_signer_user_id uuid, p_document_hash text, p_document_version integer", returns: "uuid", security: "definer" },
+  { name: "doc_signatures", args: "p_organization_id uuid, p_record_id uuid", returns: "TABLE(signature_id uuid, render_id uuid, record_id uuid, field_key text, signer_name text, signer_user_id uuid, signed_at timestamp with time zone, document_hash text, document_version integer)", security: "definer" },
+  { name: "doc_template_delete", args: "p_organization_id uuid, p_template_id uuid", returns: "boolean", security: "definer" },
   { name: "doc_template_read", args: "p_organization_id uuid, p_template_id uuid", returns: "jsonb", security: "definer" },
   { name: "doc_template_save", args: "p_organization_id uuid, p_table_id uuid, p_name text, p_body text, p_template_id uuid DEFAULT NULL::uuid", returns: "uuid", security: "definer" },
+  { name: "doc_templates", args: "p_organization_id uuid, p_table_id uuid", returns: "TABLE(template_id uuid, renders_table_id uuid, name text, body text, template_version integer, token_count bigint, updated_at timestamp with time zone)", security: "definer" },
   { name: "doc_token_pattern", args: "", returns: "text", security: "invoker" },
   { name: "doc_tokens", args: "p_body text", returns: "TABLE(ordinal integer, raw text, field_id uuid)", security: "invoker" },
   { name: "doc_unresolved_tokens", args: "p_organization_id uuid, p_table_id uuid, p_body text", returns: "TABLE(raw text, field_id uuid, why text)", security: "invoker" },
@@ -441,6 +448,7 @@ var STORE_DOORS = [
   { name: "field_behaviour", args: "p_field_data jsonb", returns: "text", security: "invoker" },
   { name: "field_declare", args: "p_organization_id uuid, p_table_id uuid, p_spec jsonb", returns: "uuid", security: "definer" },
   { name: "field_dependants", args: "p_organization_id uuid, p_field_id uuid", returns: "TABLE(kind text, dependant_id uuid, label text, how text)", security: "definer" },
+  { name: "field_history", args: "p_organization_id uuid, p_table_id uuid, p_field_key text, p_limit integer DEFAULT 100, p_offset integer DEFAULT 0, p_record_id uuid DEFAULT NULL::uuid", returns: "TABLE(record_id uuid, record_title text, version integer, occurred_at timestamp with time zone, operation_label text, actor jsonb, before jsonb, after jsonb)", security: "definer" },
   { name: "field_kernel_id", args: "", returns: "uuid", security: "invoker" },
   { name: "field_options", args: "p_organization_id uuid, p_field_id uuid", returns: "SETOF custom.record", security: "definer" },
   { name: "field_retire", args: "p_organization_id uuid, p_field_id uuid", returns: "boolean", security: "definer" },
@@ -459,7 +467,11 @@ var STORE_DOORS = [
   { name: "has_visibility", args: "p_user_id uuid, p_type text, p_id uuid, p_required permission_level DEFAULT 'viewer'::permission_level", returns: "boolean", security: "definer" },
   { name: "has_visibility_at", args: "p_user_id uuid, p_type text, p_id uuid, p_required permission_level DEFAULT 'viewer'::permission_level, p_organization_id uuid DEFAULT NULL::uuid, p_min_version bigint DEFAULT NULL::bigint", returns: "boolean", security: "definer" },
   { name: "hidden_field_notice", args: "p_field custom.record, p_action text DEFAULT 'read'::text", returns: "jsonb", security: "invoker" },
+  { name: "history_actor", args: "p_tier text, p_document jsonb, p_actor_id uuid, p_people jsonb", returns: "jsonb", security: "invoker" },
+  { name: "history_changes", args: "p_organization_id uuid, p_table_id uuid, p_old jsonb, p_new jsonb", returns: "jsonb", security: "invoker" },
+  { name: "history_people", args: "p_organization_id uuid, p_ids uuid[]", returns: "jsonb", security: "definer" },
   { name: "history_prune", args: "p_organization_id uuid, p_scope text DEFAULT 'values'::text, p_table_id uuid DEFAULT NULL::uuid, p_dry_run boolean DEFAULT true", returns: "jsonb", security: "definer" },
+  { name: "history_restore_body", args: "p_current jsonb, p_target jsonb, p_field_key text DEFAULT NULL::text", returns: "jsonb", security: "invoker" },
   { name: "history_retention", args: "p_organization_id uuid, p_table_id uuid DEFAULT NULL::uuid", returns: "jsonb", security: "definer" },
   { name: "history_retention_floor_raise", args: "p_organization_id uuid, p_days integer", returns: "integer", security: "definer" },
   { name: "history_retention_set", args: "p_organization_id uuid, p_table_id uuid, p_days integer", returns: "integer", security: "definer" },
@@ -580,10 +592,13 @@ var STORE_DOORS = [
   { name: "record_card", args: "p_viewer uuid, p_organization_id uuid, p_record_id uuid", returns: "jsonb", security: "definer" },
   { name: "record_carrying_edges", args: "p_id uuid, p_data_class text, p_data jsonb, p_deleted_at timestamp with time zone", returns: "TABLE(container_id uuid, item_id uuid, edge_role text)", security: "invoker" },
   { name: "record_delete", args: "p_organization_id uuid, p_record_id uuid", returns: "timestamp with time zone", security: "definer" },
+  { name: "record_history", args: "p_organization_id uuid, p_record_id uuid, p_limit integer DEFAULT 200, p_offset integer DEFAULT 0", returns: "TABLE(version integer, occurred_at timestamp with time zone, operation text, operation_label text, actor jsonb, changes jsonb, migration_id uuid, undoable boolean)", security: "definer" },
   { name: "record_relation_edges", args: "p_organization_id uuid, p_id uuid, p_table_id uuid, p_data_class text, p_data jsonb, p_deleted_at timestamp with time zone", returns: "TABLE(target_id uuid, edge_role text, field_id uuid, ord integer)", security: "invoker" },
   { name: "record_reparent", args: "p_organization_id uuid, p_record_id uuid, p_parent_id uuid", returns: "void", security: "definer" },
   { name: "record_resolve", args: "p_organization_id uuid, p_id uuid", returns: "jsonb", security: "definer" },
   { name: "record_restore", args: "p_organization_id uuid, p_record_id uuid", returns: "void", security: "definer" },
+  { name: "record_restore_preview", args: "p_organization_id uuid, p_record_id uuid, p_version integer, p_field_key text DEFAULT NULL::text", returns: "jsonb", security: "definer" },
+  { name: "record_restore_version", args: "p_organization_id uuid, p_record_id uuid, p_version integer", returns: "jsonb", security: "definer" },
   { name: "record_state_as_of", args: "p_record_id uuid, p_at timestamp with time zone", returns: "TABLE(state jsonb, replayed boolean)", security: "definer" },
   { name: "record_table", args: "p_organization_id uuid, p_record_id uuid", returns: "uuid", security: "definer" },
   { name: "record_update", args: "p_organization_id uuid, p_record_id uuid, p_patch jsonb, p_expected_version integer DEFAULT NULL::integer", returns: "integer", security: "definer" },
@@ -636,6 +651,7 @@ var STORE_DOORS = [
   { name: "stamp_value_envelopes", args: "p_data jsonb, p_actor text, p_on_behalf_of text, p_at timestamp with time zone", returns: "jsonb", security: "invoker" },
   { name: "storage_modes", args: "", returns: "text[]", security: "invoker" },
   { name: "store_is_open", args: "p_organization_id uuid DEFAULT NULL::uuid", returns: "boolean", security: "invoker" },
+  { name: "subscription_cadences", args: "p_organization_id uuid", returns: "text[]", security: "definer" },
   { name: "subscription_mute", args: "p_organization_id uuid, p_rule_id uuid, p_muted boolean DEFAULT true", returns: "boolean", security: "definer" },
   { name: "subscriptions", args: "p_organization_id uuid, p_table_id uuid DEFAULT NULL::uuid", returns: "TABLE(rule_id uuid, name text, table_id uuid, saved_view_id uuid, cadence text, schedule text, channel text, recipient_user_id uuid, event_key text, muted boolean, mine boolean, i_may_mute boolean)", security: "definer" },
   { name: "table_capacity", args: "p_organization_id uuid, p_table_id uuid", returns: "jsonb", security: "definer" },
@@ -661,6 +677,7 @@ var STORE_DOORS = [
   { name: "value_envelope_ok", args: "p_data jsonb", returns: "boolean", security: "invoker" },
   { name: "value_envelope_refusal", args: "p_data jsonb", returns: "text", security: "invoker" },
   { name: "value_read", args: "p_organization_id uuid, p_record_id uuid, p_key text", returns: "TABLE(field_key text, field_id uuid, value jsonb, value_version integer, source jsonb, absent_reason text, actor text, on_behalf_of text, written_at timestamp with time zone, alternates jsonb)", security: "definer" },
+  { name: "value_restore", args: "p_organization_id uuid, p_record_id uuid, p_field_key text, p_version integer", returns: "jsonb", security: "definer" },
   { name: "value_versions", args: "p_old jsonb, p_new jsonb", returns: "jsonb", security: "invoker" },
   { name: "visibility_ancestors", args: "p_item_type text, p_item_id uuid", returns: "TABLE(container_type text, container_id uuid, depth integer, max_level permission_level)", security: "definer" },
   { name: "visibility_as_of", args: "p_organization_id uuid, p_record_id uuid, p_at timestamp with time zone", returns: "TABLE(principal_kind text, principal_id uuid, level permission_level, through_kind text, through_id uuid, reason text, replayed boolean, held_from timestamp with time zone, held_to timestamp with time zone)", security: "definer" },
@@ -711,6 +728,7 @@ var STORE_KNOBS = [
   { key: "code_paths_enabled", value: "false", type: "boolean" },
   { key: "consumer_chat_seeding_enabled", value: "false", type: "boolean" },
   { key: "consumer_checkout_enabled", value: "false", type: "boolean" },
+  { key: "consumer_context_enabled", value: "false", type: "boolean" },
   { key: "consumer_education_enabled", value: "false", type: "boolean" },
   { key: "consumer_extension_enabled", value: "false", type: "boolean" },
   { key: "consumer_grid_enabled", value: "false", type: "boolean" },
@@ -742,17 +760,17 @@ var STORE_KNOBS = [
   { key: "world_publish_enabled", value: "false", type: "boolean" }
 ];
 var STORE_REFUSAL_CODES = [
-  { code: "02000", raised_by: "dashboard_delete,dashboard_run,doc_render_body,doc_render_document,doc_render_read,doc_sign,doc_signature_intact,doc_signature_read,doc_template_read,doc_template_save,entity_field_retire,entity_field_update,entity_record_read,entity_value_write,external_history_event,external_rows,external_stub_upsert,external_writes_set,migrate_delete,migrate_extract_parent,migrate_merge,migrate_reclass,migrate_rename,migrate_reparent,migrate_retype,migrate_split,migrate_undo,organization_clear,portal_card,portal_declare,portal_invite,portal_preview,portal_principal_bind,portal_revoke,read_record,record_delete,record_restore,record_table,record_update,relation_uncarry,share_access,share_grant,share_lane_set,share_people,share_revoke,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_assign,work_record_states,work_set_state" },
+  { code: "02000", raised_by: "dashboard_delete,dashboard_run,doc_render_body,doc_render_document,doc_render_read,doc_sign,doc_signature_intact,doc_signature_read,doc_template_delete,doc_template_read,doc_template_save,entity_field_retire,entity_field_update,entity_record_read,entity_value_write,external_history_event,external_rows,external_stub_upsert,external_writes_set,io_restore,migrate_delete,migrate_extract_parent,migrate_merge,migrate_reclass,migrate_rename,migrate_reparent,migrate_retype,migrate_split,migrate_undo,organization_clear,portal_card,portal_declare,portal_invite,portal_preview,portal_principal_bind,portal_revoke,read_record,record_delete,record_restore,record_restore_preview,record_table,record_update,relation_uncarry,share_access,share_grant,share_lane_set,share_people,share_revoke,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_assign,work_record_states,work_set_state" },
   { code: "0A000", raised_by: "external_rows,external_source_declare,external_write_through,promote_field,promoted_index_expr,promoted_query_sql,promoted_read,rule_eval,work_assign" },
-  { code: "22004", raised_by: "_entity_custom_fields_guard,_value_envelope,actor_word,agg_assert_key,agg_sql,anon_capture,anon_token_issue,anon_write,assert_client_may_reach,dashboard_block_normalize,dashboard_declare,dashboard_window_sql,doc_render_write,doc_sign,doc_signature_write,doc_template_save,external_history_event,external_rows,external_source_declare,external_stub_upsert,external_write_through,external_writes_set,form_declare,form_submit,home_add,io_comment_write,io_import_open,io_outbox_drain,io_restore,migrate_choice_keys,migrate_purge,migrate_reclass,migrate_split,migrate_undo,organization_clear,organization_contents,portal_declare,portal_invite,portal_principal_bind,query_across_homes,query_by_coordinates,query_rollup,record_delete,record_reparent,record_resolve,record_restore,record_update,record_write,relation_carry,relation_own,rule_declare,share_grant,table_declare,work_approval_decide,work_approval_request,work_template_declare" },
+  { code: "22004", raised_by: "_entity_custom_fields_guard,_value_envelope,actor_word,agg_assert_key,agg_sql,anon_capture,anon_token_issue,anon_write,assert_client_may_reach,dashboard_block_normalize,dashboard_declare,dashboard_window_sql,doc_render_write,doc_sign,doc_signature_write,doc_template_save,external_history_event,external_rows,external_source_declare,external_stub_upsert,external_write_through,external_writes_set,field_history,form_declare,form_submit,home_add,io_comment_write,io_import_open,io_outbox_drain,io_restore,migrate_choice_keys,migrate_purge,migrate_reclass,migrate_split,migrate_undo,organization_clear,organization_contents,portal_declare,portal_invite,portal_principal_bind,query_across_homes,query_by_coordinates,query_rollup,record_delete,record_reparent,record_resolve,record_restore,record_update,record_write,relation_carry,relation_own,rule_declare,share_grant,table_declare,value_restore,work_approval_decide,work_approval_request,work_template_declare" },
   { code: "22007", raised_by: "dashboard_window_sql" },
   { code: "22012", raised_by: "rule_eval" },
-  { code: "22023", raised_by: "_entity_custom_fields_guard,_value_envelope,_work_shape_guard,actor_word,agg_assert_key,agg_sql,anon_token_issue,containment_parent,dashboard_block_normalize,dashboard_window_sql,doc_render_body,doc_render_write,doc_signature_write,entity_value_write,external_history_event,external_source_declare,external_stub_upsert,external_write_through,io_import_open,io_proposal_accept,migrate_merge,migrate_reclass,my_levels,organization_clear,portal_declare,query_by_coordinates,query_rollup,record_update,relation_carry,rule_eval,rule_members,share_grant,share_lane_set,table_rules,visibility_as_of,work_approval_request,work_list,work_slot_hold" },
-  { code: "23503", raised_by: "_containment_guard,_field_document_for,_record_rule_uses,anon_publish,anon_rate_take,anon_token_issue,anon_write,assert_organization_wall,dashboard_declare,delete_rule,doc_sign,doc_template_save,form_declare,form_submit,home_add,io_comment_write,io_import_rows,io_proposal_accept,migrate_demote,migrate_promote,promote_field,promote_table,record_applicability,record_reparent,relation_carry,relation_own,resolve_first_match,rule_applies,rule_declare,rule_eval,rule_members,rule_run,subscription_mute,work_set_state,work_take_assignment,work_template_instantiate" },
+  { code: "22023", raised_by: "_entity_custom_fields_guard,_value_envelope,_work_shape_guard,actor_word,agg_assert_key,agg_sql,anon_token_issue,containment_parent,dashboard_block_normalize,dashboard_window_sql,doc_render_body,doc_render_write,doc_signature_write,entity_value_write,external_history_event,external_source_declare,external_stub_upsert,external_write_through,field_history,io_import_open,io_proposal_accept,migrate_merge,migrate_reclass,my_levels,organization_clear,portal_declare,query_by_coordinates,query_rollup,record_update,relation_carry,rule_eval,rule_members,share_grant,share_lane_set,table_rules,visibility_as_of,work_approval_request,work_list,work_slot_hold" },
+  { code: "23503", raised_by: "_containment_guard,_field_document_for,_record_rule_uses,anon_publish,anon_rate_take,anon_token_issue,anon_write,assert_organization_wall,comment_write,dashboard_declare,delete_rule,doc_sign,doc_template_save,form_declare,form_submit,home_add,io_comment_write,io_import_rows,io_proposal_accept,migrate_demote,migrate_promote,promote_field,promote_table,record_applicability,record_reparent,relation_carry,relation_own,resolve_first_match,rule_applies,rule_declare,rule_eval,rule_members,rule_run,subscription_mute,work_set_state,work_take_assignment,work_template_instantiate" },
   { code: "23505", raised_by: "_unique_rule_holds,doc_sign,doc_signature_write,entity_field_declare,field_declare,home_add,io_proposal_accept,relation_carry,relation_own,share_grant,work_approval_decide,work_slot_hold" },
   { code: "23514", raised_by: "_containment_guard,_dated_values_guard,_derived_fields,_entity_custom_fields_guard,_field_class_guard,_field_document_for,_field_shape_guard,_field_type_parity_guard,_merge_field_shape_guard,_merge_field_temporal_guard,_promoted_field_cap_guard,_record_rule_uses,_resolve_choice_words,_rule_shape_guard,_rule_topology_guard,_store_relation_edge_names_its_field,_table_shape_guard,_value_envelope,_work_shape_guard,_workdoors_approval_guard,assert_entity_is_organization_scoped,doc_sign,doc_signature_write,doc_template_save,entity_field_declare,entity_field_retire,entity_field_update,entity_records_find,entity_table,field_declare,field_retire,field_update,home_add,migrate_merge,relation_carry,relation_own,validate_value_envelope,validate_values,work_set_state,work_slots_declare,work_take_assignment,work_template_instantiate" },
   { code: "40001", raised_by: "has_visibility_at" },
-  { code: "42501", raised_by: "_doc_render_immutable,_doc_signature_immutable,_field_definition_write,_field_write_door,_rule_definition_write,_store_door,anon_capture,anon_inbound_land,anon_publish,anon_token_issue,anon_token_verify,anon_write,assert_client_may_change,assert_client_may_open,assert_client_may_reach,assert_may_know_table,assert_organization_admin,assert_store_door,entity_field_declare,entity_field_retire,entity_field_update,entity_value_write,external_write_through,form_declare,form_submit,io_comment_resolve,io_comment_write,io_restore,migrate_purge,migrate_reclass,my_levels,organization_clear,portal_declare,portal_invitation,portal_invite,portal_principal_bind,promote_table,query_visibility_parity,read_record,read_records,share_grant,subscription_mute,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_person" },
+  { code: "42501", raised_by: "_doc_render_immutable,_doc_signature_immutable,_field_definition_write,_field_write_door,_rule_definition_write,_store_door,anon_capture,anon_inbound_land,anon_publish,anon_token_issue,anon_token_verify,anon_write,assert_client_may_change,assert_client_may_open,assert_client_may_reach,assert_may_know_table,assert_organization_admin,assert_store_door,comment_write,entity_field_declare,entity_field_retire,entity_field_update,entity_value_write,external_write_through,form_declare,form_submit,io_comment_resolve,io_comment_write,io_restore,migrate_purge,migrate_reclass,my_levels,organization_clear,portal_declare,portal_invitation,portal_invite,portal_principal_bind,promote_table,query_visibility_parity,read_record,read_records,record_table,share_grant,subscription_mute,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_person" },
   { code: "42703", raised_by: "entity_table,portal_declare" },
   { code: "53400", raised_by: "anon_rate_take,delete_cascade_closure,promote_field" },
   { code: "54001", raised_by: "record_delete" },
@@ -1971,6 +1989,10 @@ var DOORS = {
   // these rows, so "tell me when a patient arrives" can also be un-told.
   subscriptions: "subscriptions",
   subscriptionMute: "subscription_mute",
+  // The cadence CATALOGUE a person's screen may ask for. `agg_subscription_cadences`
+  // above is the notifier's own and holds no client grant; this door delegates to
+  // it, so a picker and the digest runner can never offer different words.
+  subscriptionCadences: "subscription_cadences",
   // The doc doors: a template is saved, a render is written once and frozen,
   // and a signature is checked against the exact bytes that were signed.
   docTemplateSave: "doc_template_save",
@@ -1980,6 +2002,15 @@ var DOORS = {
   docUnresolvedTokens: "doc_unresolved_tokens",
   docSign: "doc_sign",
   docSignatureIntact: "doc_signature_intact",
+  // THE PLURAL ACTS. Until 2026-09-20 this package read `custom.doc_template`,
+  // `custom.doc_render` and `custom.doc_signature` with a direct PostgREST
+  // `.from()`, and all three hold NO client SELECT — so every list in product #5
+  // opened on "permission denied for view doc_template". A list is a DOOR, never
+  // a grant on the thing behind it (DOORS-TWO).
+  docTemplates: "doc_templates",
+  docTemplateDelete: "doc_template_delete",
+  docRenders: "doc_renders",
+  docSignatures: "doc_signatures",
   // THE ANONYMOUS LANE (W4-ANON). It landed, and it landed as SEVEN doors
   // rather than the one this package had guessed at: a token is issued and
   // verified separately from the write it authorises, a form is published
@@ -2797,6 +2828,13 @@ function createRecordsClient(config) {
     async aggSubscriptionCadences() {
       return callDoor(DOORS.aggSubscriptionCadences, {}, "aggSubscriptionCadences");
     },
+    async subscriptionCadences() {
+      return callDoor(
+        DOORS.subscriptionCadences,
+        { p_organization_id: org },
+        "subscriptionCadences"
+      );
+    },
     async subscriptions(args) {
       return callDoor(
         DOORS.subscriptions,
@@ -2861,32 +2899,52 @@ function createRecordsClient(config) {
         "docSign"
       );
     },
+    // A LIST IS A DOOR, NEVER A GRANT ON THE THING BEHIND IT. These three used to
+    // read `custom.doc_template`, `custom.doc_render` and `custom.doc_signature`
+    // with a direct PostgREST `.from()`, and none of the three holds a client
+    // SELECT — so a person could save a template they could never list and
+    // render a document they could never find again, and every document screen
+    // opened on "permission denied for view doc_template". The doors below
+    // narrow inside the definer, after the ladder has spoken (DOORS-TWO).
     async docTemplates({ table_id }) {
-      const response = await config.dataSource.schema(schema).from("doc_template").select("*").eq("organization_id", org).eq("renders_table_id", table_id).order("name");
-      if (response.error) {
-        const refusal = mapPgError(response.error, "docTemplates");
-        scream({ code: refusal.code, message: refusal.message, ...refusal.hint ? { hint: refusal.hint } : {}, where: "docTemplates" });
-        return err(refusal);
-      }
-      return ok(response.data ?? []);
+      const answered = await callDoor(
+        DOORS.docTemplates,
+        { p_organization_id: org, p_table_id: table_id },
+        "docTemplates"
+      );
+      if (!answered.ok) return answered;
+      return ok(
+        answered.data.map((row) => ({ ...row, id: row["template_id"] }))
+      );
+    },
+    async docTemplateDelete({ template_id }) {
+      return callDoor(
+        DOORS.docTemplateDelete,
+        { p_organization_id: org, p_template_id: template_id },
+        "docTemplateDelete"
+      );
     },
     async docRenders({ record_id }) {
-      const response = await config.dataSource.schema(schema).from("doc_render").select("*").eq("organization_id", org).eq("record_id", record_id).is("deleted_at", null).order("rendered_at", { ascending: false });
-      if (response.error) {
-        const refusal = mapPgError(response.error, "docRenders");
-        scream({ code: refusal.code, message: refusal.message, ...refusal.hint ? { hint: refusal.hint } : {}, where: "docRenders" });
-        return err(refusal);
-      }
-      return ok(response.data ?? []);
+      const answered = await callDoor(
+        DOORS.docRenders,
+        { p_organization_id: org, p_record_id: record_id },
+        "docRenders"
+      );
+      if (!answered.ok) return answered;
+      return ok(
+        answered.data.map((row) => ({ ...row, id: row["render_id"] }))
+      );
     },
     async docSignatures({ record_id }) {
-      const response = await config.dataSource.schema(schema).from("doc_signature").select("*").eq("organization_id", org).eq("record_id", record_id).is("deleted_at", null).order("signed_at", { ascending: false });
-      if (response.error) {
-        const refusal = mapPgError(response.error, "docSignatures");
-        scream({ code: refusal.code, message: refusal.message, ...refusal.hint ? { hint: refusal.hint } : {}, where: "docSignatures" });
-        return err(refusal);
-      }
-      return ok(response.data ?? []);
+      const answered = await callDoor(
+        DOORS.docSignatures,
+        { p_organization_id: org, p_record_id: record_id },
+        "docSignatures"
+      );
+      if (!answered.ok) return answered;
+      return ok(
+        answered.data.map((row) => ({ ...row, id: row["signature_id"] }))
+      );
     },
     async recordValuesVersioned({ record_id }) {
       return readValues(record_id);