@ai-matrx/records 0.3.0

package/dist/core/index.d.ts

@@ -0,0 +1,652 @@
+import { Timestamp, Uuid, RelationCoordinate, RecordsConfig, RecordDocument, RecordsResult, RecordRead, ReadRow, Table, Field, StoredRecord, TableCapacity, AggregateMeasure, AggregateBucket, AggregateRow, Subscription, DocToken, DocUnresolvedToken, DocTemplateRow, DocRenderRow, DocSignatureRow, RecordRevision, ReadValue, AnonTokenBinding, WorkState, WorkGraph, WorkInstantiation, WorkTurn, WorkAssignmentField, WorkSlotHold, ExternalPrincipalCard, PublishBinding, ResolvedPublishBinding, FieldProposal, TableProposal, RecordsError, WriteConflict, PgError, StaleWriteDetail, PredictedRefusal } from '../index.js';
+export { ABSENCE_REASONS, ACTOR_VOCABULARY, AbsenceReason, Actor, AggregateOperation, COMPUTE_ON, CONTEXT_POLICIES, ComputeOn, ContextPolicy, DELIVERIES, Delivery, DocSignatureCheck, ENTITY_TOKENS, EntityToken, FIELD_SENSITIVITIES, FIELD_SOURCES, FRESHNESS, FieldBehavior, FieldRule, FieldSensitivity, FieldSource, ForbiddenEnvelopeWord, Freshness, HiddenFieldNotice, Home, KERNEL_TABLES, KernelTableName, MERGE_FIELD_MODIFIERS, MERGE_FIELD_SEMANTIC_TYPES, MERGE_FIELD_SOURCES, MergeField, MergeFieldModifier, MergeFieldProvenance, MergeFieldResolution, MergeFieldSemanticType, MergeFieldSource, MergeFieldTransform, MissingBehavior, ON_DELETE, OVERRIDE_POLICIES, OnDelete, OverridePolicy, PARITY_FIELD_TYPES, PER_VALUE_ACCESS_WORDS, ParityFieldType, ParityFieldTypeDescriptor, PerValueAccessWord, ProvenancePointer, RELATION_BINDINGS, RELATION_CARDINALITIES, RELATION_FLAVORS, RETIRED_ACTOR_WORDS, RULE_NODE_KINDS, RULE_USES, RecordsActor, RecordsDataSource, RecordsErrorCode, RecordsErrorSink, RecordsFilter, RecordsRealtimePort, RecordsResolverPort, RecordsResponse, RecordsTableQuery, RegisteredTable, Relation, RelationBinding, RelationCardinality, RelationCarries, RelationFlavor, RelationProperties, RelationTarget, ResolutionTriple, RetiredActorWord, Rule, RuleAnswer, RuleExpression, RuleNodeKind, RuleUse, STORAGE_MODES, STORE_DOORS, STORE_KNOBS, STORE_REFUSAL_CODES, StorageMode, StoreDoorName, StoreRefusalCode, SubscriptionBlock, SubscriptionCadence, TABLE_DISPLAYS, TABLE_ORIGINS, TABLE_TYPES, TableDisplay, TableOrigin, TableType, VALUE_ALTERNATE_KEYS, VALUE_ENVELOPE_KEYS, ValueAlternate, ValueAlternateKey, ValueEnvelope, ValueEnvelopeKey, ValueSource, WorkTemplateNode, WorkTemplateRelation, err, isRecordsErr, measureKey, ok } from '../index.js';
+
+/**
+ * DOOR-8. As-of on EITHER clock, and they are different questions:
+ *   · `record` — the record clock: what this record looked like at version time.
+ *   · `world` — the world clock: which values were true of the world then
+ *     (the Field's `dated` modifier).
+ */
+interface AsOf {
+    clock: "record" | "world";
+    at: Timestamp;
+}
+/** A predicate over a PROMOTED field (REC-5: promotion light -> heavy). */
+interface PromotedPredicate {
+    field_key: string;
+    /** The value as text, exactly as `custom.promoted_read` takes it. */
+    equals: string;
+}
+interface RecordQuery {
+    table_id: Uuid;
+    /** DOOR-6. Any combination, any subset. An empty list means "no relation constraint". */
+    relations?: RelationCoordinate[];
+    /** Predicates the store can answer from an index. */
+    promoted?: PromotedPredicate[];
+    /** DOOR-8. */
+    asOf?: AsOf;
+    /** DOOR-9. Ask across EVERY Home of this Table in one answer. */
+    acrossHomes?: boolean;
+    /** REC-23. Soft-deleted rows are out unless you say otherwise. */
+    includeDeleted?: boolean;
+    /** FLD-10. */
+    recordType?: string;
+    orderBy?: {
+        column: "created_at" | "updated_at";
+        ascending?: boolean;
+    };
+    limit?: number;
+    offset?: number;
+}
+/**
+ * What a query decomposes into: a set of door calls whose answers INTERSECT,
+ * then one filtered read. Kept as data rather than hidden inside the client so
+ * the suite can assert the plan as well as the answer — a query that quietly
+ * stopped applying one of its coordinates is otherwise invisible.
+ */
+interface QueryPlan {
+    /** One `relation_targets` call per coordinate; the id sets are intersected. */
+    relationCalls: Array<{
+        door: "relation_targets";
+        record_id: Uuid;
+        via_key: string | null;
+    }>;
+    /** One `promoted_read` call per predicate; intersected with the above. */
+    promotedCalls: Array<{
+        door: "promoted_read";
+        field_key: string;
+        value: string;
+    }>;
+    /** The filtered read over `custom.record`, which the store's policies gate. */
+    read: {
+        table_id: Uuid;
+        includeDeleted: boolean;
+        recordType: string | null;
+        asOf: AsOf | null;
+        acrossHomes: boolean;
+        orderBy: {
+            column: string;
+            ascending: boolean;
+        };
+        limit: number;
+        offset: number;
+    };
+    /**
+     * Stated so nobody has to guess: when this is true the answer is the
+     * intersection of the id sets above, and when it is false the read stands
+     * alone.
+     */
+    intersects: boolean;
+}
+declare const DEFAULT_PAGE_SIZE = 50;
+declare function planQuery(query: RecordQuery): QueryPlan;
+/** The intersection of the id sets a plan's calls produced. Order is preserved from the first set. */
+declare function intersectIds(sets: Uuid[][]): Uuid[];
+
+interface RecordsClient {
+    /** The config this client was built with, so a screen can show who it is acting as. */
+    readonly config: RecordsConfig;
+    recordWrite(args: {
+        table_id: Uuid;
+        data: RecordDocument;
+    }): Promise<RecordsResult<Uuid>>;
+    recordUpdate(args: {
+        record_id: Uuid;
+        patch: Record<string, unknown>;
+        /** Leave it out and the last writer wins; supply it and a loser is TOLD. */
+        expectedVersion?: number;
+    }): Promise<RecordsResult<number>>;
+    /** REC-23. Soft, and reversible within `retention`. */
+    recordDelete(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<Timestamp>>;
+    recordRestore(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<void>>;
+    recordRead(args: {
+        record_id: Uuid;
+        withComputed?: boolean;
+    }): Promise<RecordsResult<RecordRead>>;
+    /**
+     * DOOR-1. A page of one Table's records THROUGH `custom.read_records`: the
+     * store decides which rows this reader may see and which fields of them, and
+     * a field it masked comes back present-and-null with its reason in `hidden`.
+     * `total` is null because the door counts nothing it has not read — a count
+     * of rows a person may not see is a leak with a number on it.
+     */
+    list(args: {
+        table_id: Uuid;
+        limit?: number;
+        offset?: number;
+    }): Promise<RecordsResult<{
+        rows: ReadRow[];
+        total: number | null;
+    }>>;
+    query(query: RecordQuery): Promise<RecordsResult<{
+        rows: ReadRow[];
+        total: number | null;
+    }>>;
+    tableList(): Promise<RecordsResult<Table[]>>;
+    fields(args: {
+        table_id: Uuid;
+        recordType?: string;
+    }): Promise<RecordsResult<Field[]>>;
+    /**
+     * FLD-5 / FLD-6: a list field stores the id of an option RECORD, because
+     * every pick-list is already a Table. These are that Table's records — the
+     * store resolves which Table from the Field's own config, so no caller has to
+     * know it.
+     */
+    fieldOptions(args: {
+        field_id: Uuid;
+    }): Promise<RecordsResult<StoredRecord[]>>;
+    tableCapacity(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<TableCapacity>>;
+    /**
+     * REC-1: a Table has to live somewhere, so a Home comes first — and a Home is
+     * an ordinary record in the person kernel. `homeId` is therefore required and
+     * `personKernelId()` is how a caller gets a Table to write one into.
+     */
+    tableDeclare(args: {
+        spec: Record<string, unknown>;
+        homeId: Uuid;
+    }): Promise<RecordsResult<Uuid>>;
+    /** The kernel Tables a caller writes a Home, a Field or a Rule into. */
+    personKernelId(): Promise<RecordsResult<Uuid>>;
+    fieldKernelId(): Promise<RecordsResult<Uuid>>;
+    ruleKernelId(): Promise<RecordsResult<Uuid>>;
+    /** Every record the Rule says is a member. A saved view's list is this, not a filter a screen ran. */
+    ruleMembers(args: {
+        rule_id: Uuid;
+    }): Promise<RecordsResult<StoredRecord[]>>;
+    /** Is this one record a member, and WHY — the store's own answer. */
+    ruleMembership(args: {
+        rule_id: Uuid;
+        record_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    /** Run a stored Rule against a document. */
+    ruleRun(args: {
+        rule_id: Uuid;
+        values: Record<string, unknown>;
+        context?: Record<string, unknown>;
+    }): Promise<RecordsResult<unknown>>;
+    /** Evaluate a Rule expression that has not been stored — the conditional logic a form runner asks about. */
+    ruleEval(args: {
+        expr: unknown;
+        values: Record<string, unknown>;
+        context?: Record<string, unknown>;
+    }): Promise<RecordsResult<unknown>>;
+    /**
+     * Group, bucket, filter and measure INSIDE `custom.record_aggregate`. The
+     * aggregate node sits above the visibility join, so what a chart draws is
+     * exactly what this person may see — the rest is never fetched, let alone
+     * summed and then hidden.
+     */
+    recordAggregate(args: {
+        table_id: Uuid;
+        /** Field keys whose values become the groups. */
+        groupBy?: string[];
+        /** `count` needs no key; every other operation reads one Field. */
+        measures?: AggregateMeasure[];
+        /** A date Field truncated to a period — a group whose expression is a date_trunc. */
+        bucket?: {
+            key: string;
+            by: AggregateBucket;
+        } | null;
+        /** Equality only, and it lands in the SAME WHERE as visibility. */
+        filter?: Record<string, string>;
+        limit?: number;
+    }): Promise<RecordsResult<AggregateRow[]>>;
+    /** The measures the store itself offers. Asked, never hardcoded in a picker. */
+    aggOperations(): Promise<RecordsResult<string[]>>;
+    /** The periods the store itself buckets by. */
+    aggBuckets(): Promise<RecordsResult<string[]>>;
+    /**
+     * Every subscription in this organization, optionally narrowed to one saved
+     * view or one cadence. There is no subscription table: each one is a Rule
+     * record carrying a `subscription` block, so a subscription is readable,
+     * historied and agent-writable like anything else.
+     */
+    aggSubscriptions(args?: {
+        saved_view_id?: Uuid | null;
+        cadence?: string | null;
+    }): Promise<RecordsResult<Subscription[]>>;
+    /** The cadences the store itself offers. Asked, never hardcoded in a picker. */
+    aggSubscriptionCadences(): Promise<RecordsResult<string[]>>;
+    docTemplateSave(args: {
+        table_id: Uuid;
+        name: string;
+        body: string;
+        template_id?: Uuid | null;
+    }): Promise<RecordsResult<Uuid>>;
+    /** The body with every token resolved against one record. Read-only, no render row. */
+    docRenderBody(args: {
+        template_id: Uuid;
+        record_id: Uuid;
+    }): Promise<RecordsResult<string>>;
+    /** Write the render — frozen bytes a signature can be checked against. */
+    docRenderDocument(args: {
+        template_id: Uuid;
+        record_id: Uuid;
+    }): Promise<RecordsResult<Uuid>>;
+    /** Every token in a body, in order, with the Field id each one points at. */
+    docTokens(args: {
+        body: string;
+    }): Promise<RecordsResult<DocToken[]>>;
+    /** The tokens this Table cannot answer, each with the store's own reason. */
+    docUnresolvedTokens(args: {
+        table_id: Uuid;
+        body: string;
+    }): Promise<RecordsResult<DocUnresolvedToken[]>>;
+    docSign(args: {
+        render_id: Uuid;
+        field_key: string;
+        signer_name: string;
+        signer_user_id?: Uuid | null;
+    }): Promise<RecordsResult<Uuid>>;
+    /** Is what was signed still what is there? The store answers, never the screen. */
+    docSignatureIntact(args: {
+        signature_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    /** Every template that renders one Table. */
+    docTemplates(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<DocTemplateRow[]>>;
+    /** Every frozen render of one record, newest first. */
+    docRenders(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<DocRenderRow[]>>;
+    /** Every signature on one record. */
+    docSignatures(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<DocSignatureRow[]>>;
+    /**
+     * DOOR-11. One record's revisions, newest first. The read door answers
+     * documents and deliberately not versions, so a screen that wants to save
+     * optimistically reads the version of the record it LOADED from here — for
+     * the one record being edited, never for a list.
+     */
+    revisions(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<RecordRevision[]>>;
+    /**
+     * Every value of one record WITH its envelope — its own version, who wrote
+     * it, who they were acting for and when. The timeline IS the record (REC-19);
+     * there is no second history table.
+     */
+    recordValuesVersioned(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<ReadValue[]>>;
+    metadataSearch(args: {
+        text: string;
+    }): Promise<RecordsResult<never>>;
+    /**
+     * Mint an embed token. `mode` is `read` OR `write` and never both — the store
+     * refuses a token carrying two decisions. The secret comes back ONCE, because
+     * only its digest is stored: a database read cannot produce a working token.
+     * `allowedOrigins` is required and matched EXACTLY, so `example.com.evil.test`
+     * fails a check that a suffix match would pass.
+     */
+    anonTokenIssue(args: {
+        mode: "read" | "write";
+        allowedOrigins: string[];
+        formId?: Uuid | null;
+        savedViewId?: Uuid | null;
+        recordId?: Uuid | null;
+        expiresAt?: Timestamp | null;
+    }): Promise<RecordsResult<{
+        token_id: Uuid;
+        secret: string;
+    }>>;
+    /** What a secret is good for, from an origin. The store's sentence when it is not. */
+    anonTokenVerify(args: {
+        secret: string;
+        origin: string;
+        requiredMode?: "read" | "write" | null;
+    }): Promise<RecordsResult<AnonTokenBinding>>;
+    anonTokenRevoke(args: {
+        token_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /**
+     * A STRANGER'S WRITE. The token supplies the organization, so this call names
+     * none — and what it produces is a QUARANTINED SUBMISSION, not a record:
+     * `custom.record` is never touched here. `clientKey` makes a replay free and
+     * idempotent, which is what lets a flaky phone retry safely.
+     */
+    anonWrite(args: {
+        secret: string;
+        origin: string;
+        payload: Record<string, unknown>;
+        clientKey?: string | null;
+        rawPayload?: Record<string, unknown>;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * SCR-30, and it is the SIGNED-IN offline path, not the stranger's. The client
+     * mints `clientKey` BEFORE the first attempt, offline, and the store's own
+     * replay ledger dedupes on it — so a reconnect that fires the same capture
+     * thirty times writes one record and returns the same id every time.
+     */
+    anonCapture(args: {
+        table_id: Uuid;
+        clientKey: string;
+        payload: Record<string, unknown>;
+        device?: string | null;
+        capturedAt?: Timestamp | null;
+    }): Promise<RecordsResult<Uuid>>;
+    /** Open or close a form to strangers. An admin act on the Table, never an editor one. */
+    anonPublish(args: {
+        form_id: Uuid;
+        published?: boolean;
+    }): Promise<RecordsResult<Timestamp | null>>;
+    /** The five states and what each one may become. Asked, never hardcoded in a picker. */
+    workStates(): Promise<RecordsResult<WorkState[]>>;
+    /** Why this graph would be refused — asked BEFORE it is written. `null` means it is fine. */
+    workTemplateRefusal(args: {
+        graph: WorkGraph;
+    }): Promise<RecordsResult<string | null>>;
+    workTemplateDeclare(args: {
+        name: string;
+        graph: WorkGraph;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * REC-70: the WHOLE graph is created in one act, judged before any of it is
+     * written, so a half-made checklist is not a state this store can be in.
+     */
+    workTemplateInstantiate(args: {
+        template_id: Uuid;
+        overrides?: Record<string, Record<string, unknown>>;
+    }): Promise<RecordsResult<WorkInstantiation>>;
+    workTemplateShape(args: {
+        template_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    workInstantiationShape(args: {
+        instantiation_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    /** Whose turn each record is, with its state and whether that state is terminal. */
+    workWhoseTurn(args: {
+        table_id: Uuid;
+        includeFinished?: boolean;
+    }): Promise<RecordsResult<WorkTurn[]>>;
+    /** Does this Table carry assignment at all? A screen asks before it offers one. */
+    workHasAssignment(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /** The Fields assignment is made of, so nothing here invents a column name. */
+    workAssignmentFields(args?: {
+        options_table_id?: Uuid | null;
+    }): Promise<RecordsResult<WorkAssignmentField[]>>;
+    /** Add assignment to a Table. */
+    workTakeAssignment(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    /** Why this move would be refused. `null` means it is allowed. */
+    workTransitionRefusal(args: {
+        from_state_id: Uuid;
+        to_state_id: Uuid;
+    }): Promise<RecordsResult<string | null>>;
+    /** Declare the Table slots are held in. Idempotent — a second call finds the first. */
+    workSlotsDeclare(args: {
+        name: string;
+        slug: string;
+        homeId?: Uuid | null;
+    }): Promise<RecordsResult<unknown>>;
+    /**
+     * SCR-29. Take a slot for a while. THE STORE decides, under a unique index —
+     * two people racing for the same slot do not both get it, whatever either
+     * screen believed a moment earlier.
+     */
+    workSlotHold(args: {
+        table_id: Uuid;
+        slotKey: string;
+        holder: string;
+        ttl?: string;
+    }): Promise<RecordsResult<unknown>>;
+    workSlotRelease(args: {
+        hold_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /** Every hold on this Table, with whether it has already lapsed. */
+    workSlotHolds(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<WorkSlotHold[]>>;
+    workSlotExpire(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<number>>;
+    /** VIS-31. Is this account a signed-in outsider — no NON-personal organization? */
+    isExternalPrincipal(args?: {
+        user_id?: Uuid | null;
+    }): Promise<RecordsResult<boolean>>;
+    /** The same answer WITH the plain-English reason a screen shows. */
+    externalPrincipalCard(args?: {
+        user_id?: Uuid | null;
+    }): Promise<RecordsResult<ExternalPrincipalCard>>;
+    /** Exactly the resource ids Visibility gave that outsider. Never an organization's list. */
+    externalPrincipalReach(args: {
+        resourceType: string;
+        user_id?: Uuid | null;
+    }): Promise<RecordsResult<Array<{
+        resource_id: Uuid;
+    }>>>;
+    /** VIS-32. Bind a record or a view to a public address with a declared render mode. */
+    publishBindingCreate(args: {
+        slug: string;
+        resourceType: string;
+        resource_id: Uuid;
+        renderMode?: string;
+    }): Promise<RecordsResult<PublishBinding>>;
+    publishBindingRevoke(args: {
+        slug: string;
+    }): Promise<RecordsResult<unknown>>;
+    /** What a SIGNED-OUT visitor resolves. Empty for an invented, revoked or unpublished address. */
+    resolvePublishBinding(args: {
+        slug: string;
+    }): Promise<RecordsResult<ResolvedPublishBinding[]>>;
+    /** D-15. The ONE sentence admitting nothing was scanned, so four surfaces cannot drift. */
+    worldPublishGapNotice(): Promise<RecordsResult<string>>;
+    /** Put a resource in the world lane. Refuses by name while the lane is closed. */
+    publishToWorld(args: {
+        resourceType: string;
+        resource_id: Uuid;
+        discoverable?: boolean;
+    }): Promise<RecordsResult<unknown>>;
+    /**
+     * Declare a Rule. It is NOT `recordWrite` into the rule kernel, and that is
+     * the whole point: `custom.record_write` inserts `data_class = 'record'`, so a
+     * document written that way is not a Rule and the store's own rule doors
+     * (`custom.rule_members`, `custom.agg_subscriptions`) never see it. Writing
+     * one through the record door and calling it a Rule would be a silent
+     * failure — a screen that looked like it had subscribed you to something.
+     */
+    ruleDeclare(args: {
+        spec: Record<string, unknown>;
+    }): Promise<RecordsResult<never>>;
+    fieldPropose(proposal: FieldProposal): Promise<RecordsResult<never>>;
+    tablePropose(proposal: TableProposal): Promise<RecordsResult<never>>;
+    promoteTable(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    promoteField(args: {
+        table_id: Uuid;
+        field_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    /** Is the store switched on for this organization? A product switch, never the boundary. */
+    storeIsOpen(): Promise<RecordsResult<boolean>>;
+}
+declare function createRecordsClient(config: RecordsConfig): RecordsClient;
+/**
+ * Turn a refusal into the conflict a screen can SHOW: which version you wrote
+ * against, which one won, and every field you touched as it stands now. Returns
+ * null when the refusal was not a stale write.
+ */
+declare function asWriteConflict(error: RecordsError, recordId: Uuid): WriteConflict | null;
+
+declare function doorExists(name: string): boolean;
+/** The refusal a missing door gets. It always says who owes it. */
+declare function doorAbsent(name: string): RecordsError;
+/** The doors this package calls, one place, so the suite can walk them. */
+declare const DOORS: {
+    readonly readRecord: "read_record";
+    readonly readRecords: "read_records";
+    readonly queryRecordAsOf: "query_record_as_of";
+    readonly queryTableAsOf: "query_table_as_of";
+    readonly recordWrite: "record_write";
+    readonly recordUpdate: "record_update";
+    readonly recordDelete: "record_delete";
+    readonly recordRestore: "record_restore";
+    readonly recordValues: "record_values";
+    readonly recordValuesVersioned: "record_values_versioned";
+    readonly valueRead: "value_read";
+    readonly computedProvenance: "computed_provenance";
+    readonly recordApplicability: "record_applicability";
+    readonly applicableFields: "applicable_fields";
+    readonly fieldOptions: "field_options";
+    readonly parityValues: "parity_values";
+    readonly tableDeclare: "table_declare";
+    readonly tableCapacity: "table_capacity";
+    readonly tableStorage: "table_storage";
+    readonly promoteTable: "promote_table";
+    readonly promoteField: "promote_field";
+    readonly promotedFields: "promoted_fields";
+    readonly promotedRead: "promoted_read";
+    readonly relationTargets: "relation_targets";
+    readonly relationOwn: "relation_own";
+    readonly homeAdd: "home_add";
+    readonly recordReparent: "record_reparent";
+    readonly containmentChain: "containment_chain";
+    readonly storeIsOpen: "store_is_open";
+    readonly ioRevisions: "io_revisions";
+    readonly resolveFirstMatch: "resolve_first_match";
+    readonly personKernelId: "person_kernel_id";
+    readonly fieldKernelId: "field_kernel_id";
+    readonly ruleKernelId: "rule_kernel_id";
+    readonly tableKernelId: "table_kernel_id";
+    readonly ruleMembers: "rule_members";
+    readonly ruleMembership: "rule_membership";
+    readonly ruleRun: "rule_run";
+    readonly ruleEval: "rule_eval";
+    readonly recordAggregate: "record_aggregate";
+    readonly aggOperations: "agg_operations";
+    readonly aggBuckets: "agg_buckets";
+    readonly aggSubscriptions: "agg_subscriptions";
+    readonly aggSubscriptionCadences: "agg_subscription_cadences";
+    readonly docTemplateSave: "doc_template_save";
+    readonly docRenderBody: "doc_render_body";
+    readonly docRenderDocument: "doc_render_document";
+    readonly docTokens: "doc_tokens";
+    readonly docUnresolvedTokens: "doc_unresolved_tokens";
+    readonly docSign: "doc_sign";
+    readonly docSignatureIntact: "doc_signature_intact";
+    readonly anonTokenIssue: "anon_token_issue";
+    readonly anonTokenVerify: "anon_token_verify";
+    readonly anonTokenRevoke: "anon_token_revoke";
+    /** The stranger's write. The TOKEN names the organization; a caller never does. */
+    readonly anonWrite: "anon_write";
+    /** SCR-30. The signed-in OFFLINE path: the client mints the key, the store dedupes on it. */
+    readonly anonCapture: "anon_capture";
+    readonly anonPublish: "anon_publish";
+    readonly workStates: "work_states";
+    readonly workTemplateDeclare: "work_template_declare";
+    readonly workTemplateInstantiate: "work_template_instantiate";
+    readonly workTemplateShape: "work_template_shape";
+    /** Why a graph would be refused — asked BEFORE it is written, never after. */
+    readonly workTemplateRefusal: "work_template_refusal";
+    readonly workWhoseTurn: "work_whose_turn";
+    readonly workTakeAssignment: "work_take_assignment";
+    readonly workHasAssignment: "work_has_assignment";
+    readonly workAssignmentFields: "work_assignment_fields";
+    readonly workTransitionRefusal: "work_transition_refusal";
+    readonly workInstantiationShape: "work_instantiation_shape";
+    readonly workSlotsDeclare: "work_slots_declare";
+    readonly workSlotHold: "work_slot_hold";
+    readonly workSlotRelease: "work_slot_release";
+    readonly workSlotHolds: "work_slot_holds";
+    readonly workSlotExpire: "work_slot_expire";
+    readonly metadataSearch: "metadata_search";
+    readonly ruleDeclare: "rule_declare";
+    readonly fieldPropose: "field_propose";
+    readonly tablePropose: "table_propose";
+    readonly mergeFieldResolve: "merge_field_resolve";
+};
+type DoorKey = keyof typeof DOORS;
+/** Which of this package's doors the live store actually has, and which it does not. */
+declare function doorCensus(): {
+    present: string[];
+    absent: string[];
+};
+
+/** The SQLSTATEs this package claims to understand. Exported for the guard. */
+declare const MAPPED_SQLSTATES: string[];
+/** Map a PostgREST/supabase-js failure into the package's refusal shape. */
+declare function mapPgError(error: PgError, where: string): RecordsError;
+/** Pull the conflict out of a `stale_write`, when the store sent one. */
+declare function staleWriteDetail(error: RecordsError): StaleWriteDetail | null;
+
+/** The published defaults, which are also what the store falls back to when it cannot read a knob. */
+declare const DEFAULT_VALUE_MAX_BYTES = 100000;
+declare const DEFAULT_DOCUMENT_MAX_BYTES = 1048576;
+interface MirrorLimits {
+    value_max_bytes?: number;
+    document_max_bytes?: number;
+}
+/**
+ * Predict `custom.validate_values`. Everything it checks WITHOUT a query is
+ * mirrored; option membership and relation targets are deliberately left to the
+ * door, and the mirror says nothing about them.
+ */
+declare function predictValueRefusals(fields: Field[], values: Record<string, unknown>, recordType?: string): PredictedRefusal[];
+/** Predict `custom.size_refusal`, with the same two ceilings and the same sentences. */
+declare function predictSizeRefusal(document: RecordDocument, limits?: MirrorLimits): PredictedRefusal | null;
+/**
+ * Predict `custom.value_envelope_refusal`. The store returns the FIRST problem
+ * it finds and stops; so does this, key order included, so the two agree on
+ * which sentence a person sees.
+ */
+declare function predictEnvelopeRefusal(document: RecordDocument): PredictedRefusal | null;
+/** Everything the mirror can see about one write, in the order the store sees it. */
+declare function predictWriteRefusals(args: {
+    fields: Field[];
+    document: RecordDocument;
+    recordType?: string;
+    limits?: MirrorLimits;
+}): PredictedRefusal[];
+
+/** One exportable row: the values of one record, keyed by field key. */
+type ExportRow = Record<string, ReadValue | undefined>;
+/**
+ * The same stringification: a string stays itself, everything else becomes its
+ * JSON, and an absent value becomes the store's own absence WORD rather than an
+ * empty cell. A blank cell would be the silent failure VAL-2 exists to prevent —
+ * "we never asked" and "they refused" are different facts and the export says
+ * which.
+ */
+declare function cellText(value: ReadValue | undefined): string;
+declare function exportCsv(fields: Field[], rows: ExportRow[]): string;
+/** The header row plus every cell, as the sheet writer takes it. */
+declare function toAoa(fields: Field[], rows: ExportRow[]): string[][];
+/**
+ * The XLSX bytes. The `xlsx` import is dynamic so a consumer that only ever
+ * exports CSV never pays for the library — the design-system module is loaded
+ * the same way, and for the same reason.
+ */
+declare function exportXlsx(fields: Field[], rows: ExportRow[], sheetLabel?: string): Promise<Uint8Array>;
+/** A parsed import: the header row mapped onto field keys, and the rows. */
+interface ParsedImport {
+    /** Header text -> the Field it matched, or null when nothing matched. */
+    columns: Array<{
+        header: string;
+        field: Field | null;
+    }>;
+    rows: Array<Record<string, string>>;
+    /**
+     * DOOR-14 / AGT-N-7. Headers that matched no Field. They are NEVER dropped
+     * quietly: an unmapped key becomes a field proposal a person approves, and the
+     * import surface shows this list.
+     */
+    unmapped: string[];
+}
+/** RFC-4180 enough for what the canonical table writes, quotes and embedded newlines included. */
+declare function parseCsv(text: string): string[][];
+declare function importCsv(fields: Field[], text: string): ParsedImport;
+declare function importXlsx(fields: Field[], bytes: ArrayBuffer | Uint8Array): Promise<ParsedImport>;
+
+export { AggregateBucket, AggregateMeasure, AggregateRow, AnonTokenBinding, type AsOf, DEFAULT_DOCUMENT_MAX_BYTES, DEFAULT_PAGE_SIZE, DEFAULT_VALUE_MAX_BYTES, DOORS, DocRenderRow, DocSignatureRow, DocTemplateRow, DocToken, DocUnresolvedToken, type DoorKey, type ExportRow, ExternalPrincipalCard, Field, FieldProposal, MAPPED_SQLSTATES, type MirrorLimits, type ParsedImport, PgError, PredictedRefusal, type PromotedPredicate, PublishBinding, type QueryPlan, ReadRow, ReadValue, RecordDocument, type RecordQuery, RecordRead, RecordRevision, type RecordsClient, RecordsConfig, RecordsError, RecordsResult, RelationCoordinate, ResolvedPublishBinding, StaleWriteDetail, StoredRecord, Subscription, Table, TableCapacity, TableProposal, Timestamp, Uuid, WorkAssignmentField, WorkGraph, WorkInstantiation, WorkSlotHold, WorkState, WorkTurn, WriteConflict, asWriteConflict, cellText, createRecordsClient, doorAbsent, doorCensus, doorExists, exportCsv, exportXlsx, importCsv, importXlsx, intersectIds, mapPgError, parseCsv, planQuery, predictEnvelopeRefusal, predictSizeRefusal, predictValueRefusals, predictWriteRefusals, staleWriteDetail, toAoa };