@ai-matrx/records 0.26.0 → 0.28.0

package/dist/index.d.cts

@@ -3617,9 +3617,21 @@ interface FieldPatch {
     /** …or the one word every other caller reaches for (see `NewFieldDeclaration`). */
     type?: FieldTypeWord;
     /**
-     * FLD-2. The shape of the value. The door reads it ONLY inside its behaviour
-     * arm, so a patch that moves `multi` alone changes nothing — send the
-     * behaviour word with it.
+     * FLD-2. The shape of the value — one, or several.
+     *
+     * This comment used to say that a patch moving `multi` ALONE changed nothing
+     * and that the behaviour word had to be sent with it. That was true, and it
+     * was a description of a silent failure rather than a contract: the door
+     * answered "saved" and the column still held one. `custom.field_update` has
+     * had a real settings arm for it since 2026-09-20 (matrx-frontend
+     * `migrations/campaign/fix7b_field_multi_arm.sql`), which also moves a
+     * relation's `relation_max` beside it — `custom.validate_values` counts links
+     * against that number, so moving `multi` without it would tick a box and
+     * still refuse the second record.
+     *
+     * A CHOICE LIST IS THE ONE EXCEPTION, and it is refused by name rather than
+     * ignored: for `select` / `multi_select`, "one answer or several" IS the
+     * parity type, so send the type instead.
      */
     multi?: boolean;
     /** REL / FLD-11: re-point the column. The old edges are withdrawn by the door. */
@@ -3793,6 +3805,139 @@ interface EntityFieldRights {
     may_fill_in: boolean;
 }
 
+/** One stage of a board: the KEY the store keeps, and the LABEL a person reads. */
+interface PipelineStage {
+    /** The option's stable key — what a cell holds, and what a move is written with. */
+    key: string;
+    /** What the column heading says. Renaming a stage rewrites no record. */
+    label: string;
+    /** A retired choice can still be READ on a record that holds it; it cannot be picked anew. */
+    retired: boolean;
+}
+/** What each Rule of a pipeline is about. Closed, and the store is the authority. */
+declare const PIPELINE_RULE_KINDS: readonly ["moves", "requires", "who", "limit", "entry"];
+type PipelineRuleKind = (typeof PIPELINE_RULE_KINDS)[number];
+/**
+ * One transition Rule, as `custom.pipeline_read` hands it back — WITH the sentence it says
+ * when it refuses, because a screen that knows a rule exists but not what it refuses in
+ * cannot warn anybody before they drag.
+ */
+interface PipelineRule {
+    id: Uuid;
+    name: string;
+    /** The exact words a person is shown when this Rule stops a move. */
+    message: string;
+    kind: PipelineRuleKind | null;
+    /** The stage this Rule is about; `null` on the one Rule about the moves themselves. */
+    stage: string | null;
+    uses: string[];
+    /** What happens when a card ARRIVES in this stage — assign, notify, start a checklist. */
+    on_entry: Record<string, unknown> | null;
+    version: number;
+}
+/** The whole board's definition, from `custom.pipeline_read`. */
+interface Pipeline {
+    is_pipeline: boolean;
+    /** Present, and it says what would make a board exist, when `is_pipeline` is false. */
+    why?: string;
+    table_id?: Uuid;
+    /** The Field KEY that holds the stage — the twin of a Table's `type_field`. */
+    stage_field?: string;
+    field_id?: Uuid;
+    /** What that column is called, e.g. "Stage". */
+    stage_label?: string;
+    /** In the order they were declared, which is the order the board draws them. */
+    stages?: PipelineStage[];
+    rules?: PipelineRule[];
+}
+/** One column of the board, with the store's own numbers over what this person may see. */
+interface PipelineColumn {
+    stage_key: string;
+    stage_label: string;
+    /** 1-based, the declared order. */
+    stage_position: number;
+    cards: number;
+    /** The total of the chosen measure, or null when no measure was asked for. */
+    total: number | null;
+    /** How many cards this column takes at once, or null when it takes any number. */
+    wip_limit: number | null;
+    /** True when the column already holds MORE than its limit — a state a board must show. */
+    over_limit: boolean;
+}
+/** One column this stage demands before a card may land in it. */
+interface PipelineMissingField {
+    field_id: Uuid;
+    key: string;
+    /** What the column is called, so a screen can ASK for it rather than only refuse. */
+    label: string;
+}
+/**
+ * Whether a card may go to a column, answered BEFORE the finger lets go — by the same
+ * Rules, through the same evaluator, on the document the move WOULD produce.
+ *
+ * A board greys a column, and snaps a card back, from this. It never decides for itself.
+ */
+interface PipelineVerdict {
+    allowed: boolean;
+    is_pipeline: boolean;
+    /** The stage key the move was asked about. */
+    to?: string;
+    /** The store's own sentence — shown verbatim, never paraphrased by a screen. */
+    why: string;
+    rule?: string;
+    rule_id?: Uuid;
+    rule_version?: number;
+    kind?: PipelineRuleKind;
+    /**
+     * When a stage demands columns that are empty, exactly which ones — so the screen can
+     * prompt for them on entry instead of sending the person away to find them.
+     */
+    missing?: PipelineMissingField[];
+}
+/** What `custom.pipeline_declare` says it made or changed. */
+interface PipelineDeclared {
+    table_id: Uuid;
+    stage_field: string;
+    field_id: Uuid;
+    stages: string[];
+    rules: Record<string, Uuid>;
+    /** Plain sentences naming each thing this declaration wrote. */
+    said: string[];
+}
+/** The declaration a person (or an agent) writes. Everything is optional but the stages. */
+interface PipelineSpec {
+    stage_field: {
+        key: string;
+        label?: string;
+        options?: string[];
+        sort?: number;
+    };
+    transitions?: {
+        from: string;
+        to: string;
+    }[];
+    /** Stage name → the column keys that must be filled in to land there. */
+    requires?: Record<string, string[]>;
+    /** Stage name → the rung somebody needs on the record to move a card INTO it. */
+    who?: Record<string, "viewer" | "commenter" | "editor" | "admin">;
+    /** Stage name → how many cards may sit there at once. The mover is not counted. */
+    limits?: Record<string, number>;
+    /** Stage name → what happens when a card arrives: assign, notify, start a checklist. */
+    on_entry?: Record<string, Record<string, unknown>>;
+    moves_message?: string;
+    requires_messages?: Record<string, string>;
+}
+/**
+ * THE ONE PLACE A SCREEN DECIDES WHETHER A CARD LOOKS DRAGGABLE — and it decides on the
+ * PERSON, not on the rules. Whether a particular move is allowed is
+ * `pipelineTransitionRefusal`, which is the store's answer; whether this person may move
+ * anything at all is their level on the record, which the read door already told us.
+ *
+ * Absent rather than dead: a viewer's card carries no drag handle at all, instead of one
+ * that looks live and snaps back every time.
+ */
+declare function mayDrag(level: string | null | undefined): boolean;
+
 /**
  * A rule expression as `custom.rule_eval` ACTUALLY evaluates it — read off the
  * door's own body, not invented here. A leaf is the node's name carrying its
@@ -3883,6 +4028,46 @@ interface FormSummary {
     notify_rule_id: string | null;
     presentation: Record<string, unknown>;
 }
+/**
+ * ONE BOOKING PAGE, AS ITS OWNER SEES IT — `custom.bookings` (PRODUCTS row 14).
+ *
+ * A booking page is an `anon_form` whose `presentation -> 'booking'` carries the
+ * availability and the id of a slots Table, so it is the SAME object a form is and
+ * this is the same list `forms()` is, asked for the booking half. The numbers are
+ * the store's own: a screen that counted appointments in the browser would drift
+ * from the index that actually protects a slot.
+ */
+interface BookingSummary {
+    form_id: string;
+    /** The Table the appointments land in — a booking is an ordinary record in it. */
+    table_id: string;
+    title: string | null;
+    slug: string;
+    published_at: string | null;
+    closed_at: string | null;
+    /** How long one appointment is. The offer is the store's, never the browser's. */
+    slot_minutes: number;
+    /** The organization's own zone, which is what the visitor's times are drawn in. */
+    timezone: string;
+    /** The ONE slots Table `custom.booking_declare` finds-or-makes for this page. */
+    slot_table_id: string;
+    booked: number;
+    cancelled: number;
+    /** Booked and still ahead of now — the number that answers "what is coming". */
+    upcoming: number;
+    /** Slots a visitor is holding right now, before they have given their details. */
+    held: number;
+    /** The next appointment, or null when there is none. */
+    next_at: string | null;
+    /** draft · open · closed — the store's own word, never derived on a screen. */
+    state: string;
+}
+/**
+ * THE VISITOR'S OWN LINK to a booking page. The page id IS the capability, exactly
+ * as it is for a form; `custom.anon_submission.booking_ref` is the separate secret
+ * that lets ONE visitor manage the appointment they made.
+ */
+declare function bookingPath(formId: string): string;
 /**
  * THE PUBLIC LINK, and the one place its shape is written down.
  *
@@ -6077,4 +6262,4 @@ interface ConversationScopeContext {
 /** `About: Acme Industrial` — the chip a bound chat wears. */
 declare function scopeChip(scope: ConversationScope): string;
 
-export { ABSENCE_REASONS, ACTOR_VOCABULARY, type AbsenceReason, type Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, COMPUTE_ON, CONTEXT_POLICIES, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type CommentThreadRead, type CommentWritten, type ComputeOn, type ContextPolicy, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, DELIVERIES, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, type Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, ENTITY_TOKENS, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type EntityToken, type ExternalPrincipalCard, FIELD_SENSITIVITIES, FIELD_SOURCES, FRESHNESS, type Field, type FieldBehavior, type FieldHistoryEntry, type FieldPatch, type FieldProposal, type FieldRule, type FieldSensitivity, type FieldSource, type FieldTypeWord, type ForbiddenEnvelopeWord, type FormSummary, type Freshness, type HiddenFieldNotice, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, KERNEL_TABLES, type KernelTableName, MERGE_FIELD_MODIFIERS, MERGE_FIELD_SEMANTIC_TYPES, MERGE_FIELD_SOURCES, type MergeField, type MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, type MergeFieldSemanticType, type MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, type NewFieldDeclaration, ON_DELETE, OVERRIDE_POLICIES, type OnDelete, type OverridePolicy, PARITY_FIELD_TYPES, PERMISSION_LEVELS, PER_VALUE_ACCESS_WORDS, type ParityFieldType, type ParityFieldTypeDescriptor, type PerValueAccessWord, type PermissionLevel, type PgError, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PredictedRefusal, type ProvenancePointer, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, RELATION_BINDINGS, RELATION_CARDINALITIES, RELATION_FLAVORS, RETIRED_ACTOR_WORDS, RULE_NODE_KINDS, RULE_USES, type ReadRow, type ReadValue, type RecordComment, type RecordDocument, type RecordHistoryEntry, type RecordRead, type RecordRevision, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsConfig, type RecordsDataSource, type RecordsError, type RecordsErrorCode, type RecordsErrorSink, type RecordsFilter, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsResult, type RecordsTableQuery, type RegisteredTable, type Relation, type RelationBinding, type RelationCardinality, type RelationCarries, type RelationCoordinate, type RelationFlavor, type RelationProperties, type RelationTarget, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type RetiredActorWord, type Rule, type RuleAnswer, type RuleExpression, type RuleNodeKind, type RuleUse, STORAGE_MODES, STORE_DOORS, STORE_KNOBS, STORE_REFUSAL_CODES, type StaleWriteDetail, type StorageMode, type StoreDoorName, type StoreRefusalCode, type StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, TABLE_DISPLAYS, TABLE_ORIGINS, TABLE_TYPES, type Table, type TableCapacity, type TableDisplay, type TableOrigin, type TableProposal, type TableType, type Timestamp, type Uuid, VALUE_ALTERNATE_KEYS, VALUE_ENVELOPE_KEYS, type ValueAlternate, type ValueAlternateKey, type ValueEnvelope, type ValueEnvelopeKey, type ValueSource, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, type WriteConflict, asPermissionLevel, atLeast, choiceSlug, choiceValuesOf, choicesOf, err, highestLevel, holdsARetiredChoice, indexedDbStore, isDecided, isRecordsErr, isTheChosen, looksLikeAnId, measureKey, memoryStore, mintClientKey, ok, openCaptureQueue, optionKey, optionLabel, portalPath, publicFormPath, scopeChip };
+export { ABSENCE_REASONS, ACTOR_VOCABULARY, type AbsenceReason, type Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type BookingSummary, COMPUTE_ON, CONTEXT_POLICIES, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type CommentThreadRead, type CommentWritten, type ComputeOn, type ContextPolicy, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, DELIVERIES, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, type Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, ENTITY_TOKENS, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type EntityToken, type ExternalPrincipalCard, FIELD_SENSITIVITIES, FIELD_SOURCES, FRESHNESS, type Field, type FieldBehavior, type FieldHistoryEntry, type FieldPatch, type FieldProposal, type FieldRule, type FieldSensitivity, type FieldSource, type FieldTypeWord, type ForbiddenEnvelopeWord, type FormSummary, type Freshness, type HiddenFieldNotice, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, KERNEL_TABLES, type KernelTableName, MERGE_FIELD_MODIFIERS, MERGE_FIELD_SEMANTIC_TYPES, MERGE_FIELD_SOURCES, type MergeField, type MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, type MergeFieldSemanticType, type MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, type NewFieldDeclaration, ON_DELETE, OVERRIDE_POLICIES, type OnDelete, type OverridePolicy, PARITY_FIELD_TYPES, PERMISSION_LEVELS, PER_VALUE_ACCESS_WORDS, PIPELINE_RULE_KINDS, type ParityFieldType, type ParityFieldTypeDescriptor, type PerValueAccessWord, type PermissionLevel, type PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineMissingField, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PredictedRefusal, type ProvenancePointer, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, RELATION_BINDINGS, RELATION_CARDINALITIES, RELATION_FLAVORS, RETIRED_ACTOR_WORDS, RULE_NODE_KINDS, RULE_USES, type ReadRow, type ReadValue, type RecordComment, type RecordDocument, type RecordHistoryEntry, type RecordRead, type RecordRevision, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsConfig, type RecordsDataSource, type RecordsError, type RecordsErrorCode, type RecordsErrorSink, type RecordsFilter, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsResult, type RecordsTableQuery, type RegisteredTable, type Relation, type RelationBinding, type RelationCardinality, type RelationCarries, type RelationCoordinate, type RelationFlavor, type RelationProperties, type RelationTarget, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type RetiredActorWord, type Rule, type RuleAnswer, type RuleExpression, type RuleNodeKind, type RuleUse, STORAGE_MODES, STORE_DOORS, STORE_KNOBS, STORE_REFUSAL_CODES, type StaleWriteDetail, type StorageMode, type StoreDoorName, type StoreRefusalCode, type StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, TABLE_DISPLAYS, TABLE_ORIGINS, TABLE_TYPES, type Table, type TableCapacity, type TableDisplay, type TableOrigin, type TableProposal, type TableType, type Timestamp, type Uuid, VALUE_ALTERNATE_KEYS, VALUE_ENVELOPE_KEYS, type ValueAlternate, type ValueAlternateKey, type ValueEnvelope, type ValueEnvelopeKey, type ValueSource, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, type WriteConflict, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, err, highestLevel, holdsARetiredChoice, indexedDbStore, isDecided, isRecordsErr, isTheChosen, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, ok, openCaptureQueue, optionKey, optionLabel, portalPath, publicFormPath, scopeChip };

package/dist/index.d.ts

@@ -3617,9 +3617,21 @@ interface FieldPatch {
     /** …or the one word every other caller reaches for (see `NewFieldDeclaration`). */
     type?: FieldTypeWord;
     /**
-     * FLD-2. The shape of the value. The door reads it ONLY inside its behaviour
-     * arm, so a patch that moves `multi` alone changes nothing — send the
-     * behaviour word with it.
+     * FLD-2. The shape of the value — one, or several.
+     *
+     * This comment used to say that a patch moving `multi` ALONE changed nothing
+     * and that the behaviour word had to be sent with it. That was true, and it
+     * was a description of a silent failure rather than a contract: the door
+     * answered "saved" and the column still held one. `custom.field_update` has
+     * had a real settings arm for it since 2026-09-20 (matrx-frontend
+     * `migrations/campaign/fix7b_field_multi_arm.sql`), which also moves a
+     * relation's `relation_max` beside it — `custom.validate_values` counts links
+     * against that number, so moving `multi` without it would tick a box and
+     * still refuse the second record.
+     *
+     * A CHOICE LIST IS THE ONE EXCEPTION, and it is refused by name rather than
+     * ignored: for `select` / `multi_select`, "one answer or several" IS the
+     * parity type, so send the type instead.
      */
     multi?: boolean;
     /** REL / FLD-11: re-point the column. The old edges are withdrawn by the door. */
@@ -3793,6 +3805,139 @@ interface EntityFieldRights {
     may_fill_in: boolean;
 }
 
+/** One stage of a board: the KEY the store keeps, and the LABEL a person reads. */
+interface PipelineStage {
+    /** The option's stable key — what a cell holds, and what a move is written with. */
+    key: string;
+    /** What the column heading says. Renaming a stage rewrites no record. */
+    label: string;
+    /** A retired choice can still be READ on a record that holds it; it cannot be picked anew. */
+    retired: boolean;
+}
+/** What each Rule of a pipeline is about. Closed, and the store is the authority. */
+declare const PIPELINE_RULE_KINDS: readonly ["moves", "requires", "who", "limit", "entry"];
+type PipelineRuleKind = (typeof PIPELINE_RULE_KINDS)[number];
+/**
+ * One transition Rule, as `custom.pipeline_read` hands it back — WITH the sentence it says
+ * when it refuses, because a screen that knows a rule exists but not what it refuses in
+ * cannot warn anybody before they drag.
+ */
+interface PipelineRule {
+    id: Uuid;
+    name: string;
+    /** The exact words a person is shown when this Rule stops a move. */
+    message: string;
+    kind: PipelineRuleKind | null;
+    /** The stage this Rule is about; `null` on the one Rule about the moves themselves. */
+    stage: string | null;
+    uses: string[];
+    /** What happens when a card ARRIVES in this stage — assign, notify, start a checklist. */
+    on_entry: Record<string, unknown> | null;
+    version: number;
+}
+/** The whole board's definition, from `custom.pipeline_read`. */
+interface Pipeline {
+    is_pipeline: boolean;
+    /** Present, and it says what would make a board exist, when `is_pipeline` is false. */
+    why?: string;
+    table_id?: Uuid;
+    /** The Field KEY that holds the stage — the twin of a Table's `type_field`. */
+    stage_field?: string;
+    field_id?: Uuid;
+    /** What that column is called, e.g. "Stage". */
+    stage_label?: string;
+    /** In the order they were declared, which is the order the board draws them. */
+    stages?: PipelineStage[];
+    rules?: PipelineRule[];
+}
+/** One column of the board, with the store's own numbers over what this person may see. */
+interface PipelineColumn {
+    stage_key: string;
+    stage_label: string;
+    /** 1-based, the declared order. */
+    stage_position: number;
+    cards: number;
+    /** The total of the chosen measure, or null when no measure was asked for. */
+    total: number | null;
+    /** How many cards this column takes at once, or null when it takes any number. */
+    wip_limit: number | null;
+    /** True when the column already holds MORE than its limit — a state a board must show. */
+    over_limit: boolean;
+}
+/** One column this stage demands before a card may land in it. */
+interface PipelineMissingField {
+    field_id: Uuid;
+    key: string;
+    /** What the column is called, so a screen can ASK for it rather than only refuse. */
+    label: string;
+}
+/**
+ * Whether a card may go to a column, answered BEFORE the finger lets go — by the same
+ * Rules, through the same evaluator, on the document the move WOULD produce.
+ *
+ * A board greys a column, and snaps a card back, from this. It never decides for itself.
+ */
+interface PipelineVerdict {
+    allowed: boolean;
+    is_pipeline: boolean;
+    /** The stage key the move was asked about. */
+    to?: string;
+    /** The store's own sentence — shown verbatim, never paraphrased by a screen. */
+    why: string;
+    rule?: string;
+    rule_id?: Uuid;
+    rule_version?: number;
+    kind?: PipelineRuleKind;
+    /**
+     * When a stage demands columns that are empty, exactly which ones — so the screen can
+     * prompt for them on entry instead of sending the person away to find them.
+     */
+    missing?: PipelineMissingField[];
+}
+/** What `custom.pipeline_declare` says it made or changed. */
+interface PipelineDeclared {
+    table_id: Uuid;
+    stage_field: string;
+    field_id: Uuid;
+    stages: string[];
+    rules: Record<string, Uuid>;
+    /** Plain sentences naming each thing this declaration wrote. */
+    said: string[];
+}
+/** The declaration a person (or an agent) writes. Everything is optional but the stages. */
+interface PipelineSpec {
+    stage_field: {
+        key: string;
+        label?: string;
+        options?: string[];
+        sort?: number;
+    };
+    transitions?: {
+        from: string;
+        to: string;
+    }[];
+    /** Stage name → the column keys that must be filled in to land there. */
+    requires?: Record<string, string[]>;
+    /** Stage name → the rung somebody needs on the record to move a card INTO it. */
+    who?: Record<string, "viewer" | "commenter" | "editor" | "admin">;
+    /** Stage name → how many cards may sit there at once. The mover is not counted. */
+    limits?: Record<string, number>;
+    /** Stage name → what happens when a card arrives: assign, notify, start a checklist. */
+    on_entry?: Record<string, Record<string, unknown>>;
+    moves_message?: string;
+    requires_messages?: Record<string, string>;
+}
+/**
+ * THE ONE PLACE A SCREEN DECIDES WHETHER A CARD LOOKS DRAGGABLE — and it decides on the
+ * PERSON, not on the rules. Whether a particular move is allowed is
+ * `pipelineTransitionRefusal`, which is the store's answer; whether this person may move
+ * anything at all is their level on the record, which the read door already told us.
+ *
+ * Absent rather than dead: a viewer's card carries no drag handle at all, instead of one
+ * that looks live and snaps back every time.
+ */
+declare function mayDrag(level: string | null | undefined): boolean;
+
 /**
  * A rule expression as `custom.rule_eval` ACTUALLY evaluates it — read off the
  * door's own body, not invented here. A leaf is the node's name carrying its
@@ -3883,6 +4028,46 @@ interface FormSummary {
     notify_rule_id: string | null;
     presentation: Record<string, unknown>;
 }
+/**
+ * ONE BOOKING PAGE, AS ITS OWNER SEES IT — `custom.bookings` (PRODUCTS row 14).
+ *
+ * A booking page is an `anon_form` whose `presentation -> 'booking'` carries the
+ * availability and the id of a slots Table, so it is the SAME object a form is and
+ * this is the same list `forms()` is, asked for the booking half. The numbers are
+ * the store's own: a screen that counted appointments in the browser would drift
+ * from the index that actually protects a slot.
+ */
+interface BookingSummary {
+    form_id: string;
+    /** The Table the appointments land in — a booking is an ordinary record in it. */
+    table_id: string;
+    title: string | null;
+    slug: string;
+    published_at: string | null;
+    closed_at: string | null;
+    /** How long one appointment is. The offer is the store's, never the browser's. */
+    slot_minutes: number;
+    /** The organization's own zone, which is what the visitor's times are drawn in. */
+    timezone: string;
+    /** The ONE slots Table `custom.booking_declare` finds-or-makes for this page. */
+    slot_table_id: string;
+    booked: number;
+    cancelled: number;
+    /** Booked and still ahead of now — the number that answers "what is coming". */
+    upcoming: number;
+    /** Slots a visitor is holding right now, before they have given their details. */
+    held: number;
+    /** The next appointment, or null when there is none. */
+    next_at: string | null;
+    /** draft · open · closed — the store's own word, never derived on a screen. */
+    state: string;
+}
+/**
+ * THE VISITOR'S OWN LINK to a booking page. The page id IS the capability, exactly
+ * as it is for a form; `custom.anon_submission.booking_ref` is the separate secret
+ * that lets ONE visitor manage the appointment they made.
+ */
+declare function bookingPath(formId: string): string;
 /**
  * THE PUBLIC LINK, and the one place its shape is written down.
  *
@@ -6077,4 +6262,4 @@ interface ConversationScopeContext {
 /** `About: Acme Industrial` — the chip a bound chat wears. */
 declare function scopeChip(scope: ConversationScope): string;
 
-export { ABSENCE_REASONS, ACTOR_VOCABULARY, type AbsenceReason, type Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, COMPUTE_ON, CONTEXT_POLICIES, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type CommentThreadRead, type CommentWritten, type ComputeOn, type ContextPolicy, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, DELIVERIES, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, type Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, ENTITY_TOKENS, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type EntityToken, type ExternalPrincipalCard, FIELD_SENSITIVITIES, FIELD_SOURCES, FRESHNESS, type Field, type FieldBehavior, type FieldHistoryEntry, type FieldPatch, type FieldProposal, type FieldRule, type FieldSensitivity, type FieldSource, type FieldTypeWord, type ForbiddenEnvelopeWord, type FormSummary, type Freshness, type HiddenFieldNotice, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, KERNEL_TABLES, type KernelTableName, MERGE_FIELD_MODIFIERS, MERGE_FIELD_SEMANTIC_TYPES, MERGE_FIELD_SOURCES, type MergeField, type MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, type MergeFieldSemanticType, type MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, type NewFieldDeclaration, ON_DELETE, OVERRIDE_POLICIES, type OnDelete, type OverridePolicy, PARITY_FIELD_TYPES, PERMISSION_LEVELS, PER_VALUE_ACCESS_WORDS, type ParityFieldType, type ParityFieldTypeDescriptor, type PerValueAccessWord, type PermissionLevel, type PgError, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PredictedRefusal, type ProvenancePointer, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, RELATION_BINDINGS, RELATION_CARDINALITIES, RELATION_FLAVORS, RETIRED_ACTOR_WORDS, RULE_NODE_KINDS, RULE_USES, type ReadRow, type ReadValue, type RecordComment, type RecordDocument, type RecordHistoryEntry, type RecordRead, type RecordRevision, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsConfig, type RecordsDataSource, type RecordsError, type RecordsErrorCode, type RecordsErrorSink, type RecordsFilter, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsResult, type RecordsTableQuery, type RegisteredTable, type Relation, type RelationBinding, type RelationCardinality, type RelationCarries, type RelationCoordinate, type RelationFlavor, type RelationProperties, type RelationTarget, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type RetiredActorWord, type Rule, type RuleAnswer, type RuleExpression, type RuleNodeKind, type RuleUse, STORAGE_MODES, STORE_DOORS, STORE_KNOBS, STORE_REFUSAL_CODES, type StaleWriteDetail, type StorageMode, type StoreDoorName, type StoreRefusalCode, type StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, TABLE_DISPLAYS, TABLE_ORIGINS, TABLE_TYPES, type Table, type TableCapacity, type TableDisplay, type TableOrigin, type TableProposal, type TableType, type Timestamp, type Uuid, VALUE_ALTERNATE_KEYS, VALUE_ENVELOPE_KEYS, type ValueAlternate, type ValueAlternateKey, type ValueEnvelope, type ValueEnvelopeKey, type ValueSource, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, type WriteConflict, asPermissionLevel, atLeast, choiceSlug, choiceValuesOf, choicesOf, err, highestLevel, holdsARetiredChoice, indexedDbStore, isDecided, isRecordsErr, isTheChosen, looksLikeAnId, measureKey, memoryStore, mintClientKey, ok, openCaptureQueue, optionKey, optionLabel, portalPath, publicFormPath, scopeChip };
+export { ABSENCE_REASONS, ACTOR_VOCABULARY, type AbsenceReason, type Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type BookingSummary, COMPUTE_ON, CONTEXT_POLICIES, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type CommentThreadRead, type CommentWritten, type ComputeOn, type ContextPolicy, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, DELIVERIES, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, type Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, ENTITY_TOKENS, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type EntityToken, type ExternalPrincipalCard, FIELD_SENSITIVITIES, FIELD_SOURCES, FRESHNESS, type Field, type FieldBehavior, type FieldHistoryEntry, type FieldPatch, type FieldProposal, type FieldRule, type FieldSensitivity, type FieldSource, type FieldTypeWord, type ForbiddenEnvelopeWord, type FormSummary, type Freshness, type HiddenFieldNotice, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, KERNEL_TABLES, type KernelTableName, MERGE_FIELD_MODIFIERS, MERGE_FIELD_SEMANTIC_TYPES, MERGE_FIELD_SOURCES, type MergeField, type MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, type MergeFieldSemanticType, type MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, type NewFieldDeclaration, ON_DELETE, OVERRIDE_POLICIES, type OnDelete, type OverridePolicy, PARITY_FIELD_TYPES, PERMISSION_LEVELS, PER_VALUE_ACCESS_WORDS, PIPELINE_RULE_KINDS, type ParityFieldType, type ParityFieldTypeDescriptor, type PerValueAccessWord, type PermissionLevel, type PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineMissingField, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PredictedRefusal, type ProvenancePointer, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, RELATION_BINDINGS, RELATION_CARDINALITIES, RELATION_FLAVORS, RETIRED_ACTOR_WORDS, RULE_NODE_KINDS, RULE_USES, type ReadRow, type ReadValue, type RecordComment, type RecordDocument, type RecordHistoryEntry, type RecordRead, type RecordRevision, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsConfig, type RecordsDataSource, type RecordsError, type RecordsErrorCode, type RecordsErrorSink, type RecordsFilter, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsResult, type RecordsTableQuery, type RegisteredTable, type Relation, type RelationBinding, type RelationCardinality, type RelationCarries, type RelationCoordinate, type RelationFlavor, type RelationProperties, type RelationTarget, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type RetiredActorWord, type Rule, type RuleAnswer, type RuleExpression, type RuleNodeKind, type RuleUse, STORAGE_MODES, STORE_DOORS, STORE_KNOBS, STORE_REFUSAL_CODES, type StaleWriteDetail, type StorageMode, type StoreDoorName, type StoreRefusalCode, type StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, TABLE_DISPLAYS, TABLE_ORIGINS, TABLE_TYPES, type Table, type TableCapacity, type TableDisplay, type TableOrigin, type TableProposal, type TableType, type Timestamp, type Uuid, VALUE_ALTERNATE_KEYS, VALUE_ENVELOPE_KEYS, type ValueAlternate, type ValueAlternateKey, type ValueEnvelope, type ValueEnvelopeKey, type ValueSource, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, type WriteConflict, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, err, highestLevel, holdsARetiredChoice, indexedDbStore, isDecided, isRecordsErr, isTheChosen, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, ok, openCaptureQueue, optionKey, optionLabel, portalPath, publicFormPath, scopeChip };

package/dist/index.js

@@ -124,7 +124,16 @@ function looksLikeAnId(value) {
   return typeof value === "string" && UUID.test(value);
 }
 
+// src/pipeline.ts
+var PIPELINE_RULE_KINDS = ["moves", "requires", "who", "limit", "entry"];
+function mayDrag(level) {
+  return level === "editor" || level === "admin" || level === "owner";
+}
+
 // src/rule.ts
+function bookingPath(formId) {
+  return `/b/${formId}`;
+}
 function publicFormPath(formId) {
   return `/f/${formId}`;
 }
@@ -2121,6 +2130,7 @@ export {
   PARITY_FIELD_TYPES,
   PERMISSION_LEVELS,
   PER_VALUE_ACCESS_WORDS,
+  PIPELINE_RULE_KINDS,
   REFUSALS_WORTH_REPEATING,
   RELATION_BINDINGS,
   RELATION_CARDINALITIES,
@@ -2139,6 +2149,7 @@ export {
   VALUE_ENVELOPE_KEYS,
   asPermissionLevel,
   atLeast,
+  bookingPath,
   choiceSlug,
   choiceValuesOf,
   choicesOf,
@@ -2150,6 +2161,7 @@ export {
   isRecordsErr,
   isTheChosen,
   looksLikeAnId,
+  mayDrag,
   measureKey,
   memoryStore,
   mintClientKey,