@ai-matrx/records 0.3.3 → 0.5.1

package/CHANGELOG.md

@@ -1,33 +1,83 @@
 # Changelog — @ai-matrx/records
 
-## 0.3.3
+## 0.5.1
 
-Lets a legitimate competing live-store verification finish instead of treating
-five seconds of advisory-lock contention as a package failure, while retaining
-a hard statement timeout for genuinely abandoned transactions.
+Refreshes the generated store contract to the live 240-door registry caught by
+the blocking release guard after 0.5.0 was tagged.
 
 ### Consumer action
 
-None. This changes only the release-time real-store verification lane.
-
-## 0.3.2
-
-Refreshes the generated store contract to the live 238-door, 32-knob registry
-and serializes the shared record-store release lane with `records-ui`. This
-prevents either package's live verification from observing the other suite's
-temporary store state.
+None. The two new door entries are additive generated contract data.
+
+## 0.5.0
+
+**Two refusal classes the store really raises, which this package answered with
+"something this package does not recognise".** Both were found by walking the
+real product on 2026-09-19, and in both the screen showed the store's own
+sentence — honest, but the class was nameable and this package had not named it.
+
+- **`57014` — the store cancelled the statement at its own timeout.** Seen on an
+  organization whose Table kernel is large enough for `custom.read_records` to
+  run out of time. It is now `timed_out`, which is, with `stale_read`, one of
+  only two refusals in the vocabulary worth REPEATING: nothing was refused on
+  its merits and nothing was written, so a screen can offer "try again" honestly
+  instead of showing a failure a person cannot act on.
+- **`22P02` — a value that does not fit the type the store holds for it.** Seen
+  as `invalid input syntax for type uuid: "open"`, writing the text `open` into
+  an organization's copy of a package Table whose `status` Field was uuid-shaped.
+  It is `invalid_argument`, which is what it is: the CALL is wrong for the shape
+  the store holds, and the store's own message names the value and the type.
+
+Both are proved against the LIVE store in `src/__tests__/real-doors.test.ts`:
+the SQLSTATEs are raised by the real database inside the suite's own
+rolled-back transaction and read back out of psql's verbose report, and the only
+thing asserted about this package is what it makes of them. Each case is RED
+without its map entry (`expected 'internal' to be 'timed_out'`).
 
 ### Consumer action
 
-None. The new door and knob entries are additive generated contract data.
+`RecordsErrorCode` gains one member, `timed_out`. A host that switches
+exhaustively over the union must add an arm for it; every other host needs
+nothing beyond taking `latest`. A host that was special-casing `internal` to
+recognise a timeout by its message text should branch on `timed_out` instead.
 
-## 0.3.1
+## 0.4.1
 
-The real-store verification lane now takes one transaction-scoped advisory lock before it
-opens the record-store feature knob. Parallel package and UI verification waits its turn
-instead of converting unrelated knob contention into a false store refusal.
+Carries the live Supabase adapter proof through the shared npm publishing lane
+by supplying its existing main-database HTTP URL and publishable-key secrets to
+the verification step.
+
+### Consumer action
 
-**Consumer action:** none.
+None beyond taking `latest`; the 0.4.0 API is unchanged.
+
+## 0.4.0
+
+**The browser can reach the store again — `supabaseDataSource`.** Every screen
+of the record store was dead from a browser, for everybody, and the cause was a
+single silent drop. `RecordsDataSource.rpc(fn, args, { schema })` says the
+schema out loud, because every door is `custom.<name>` and every trust door is
+`iam.<name>`. supabase-js's own `rpc()` has NO schema option — its third
+argument is `{ head, get, count }` — so a host that bound its client as a bare
+structural cast handed the option to a function that dropped it, every door call
+went to PostgREST's default profile, and the store answered, correctly and
+uselessly, `PGRST202 — Could not find the function public.table_kernel_id in the
+schema cache`. Independent verdict, 2026-09-19.
+
+The fix is ONE adapter in the headless core, exported from `/core`, that every
+host inherits — never three hosts (web, desktop, extension) each remembering the
+same thing. It routes through `client.schema(name).rpc(...)`, which is the one
+way supabase-js offers, and it refuses two things by name rather than sending
+them: a call with no schema (which would reach `public`), and a client with no
+`.schema()` method (which would throw inside a render).
+
+**The test that would have caught it**, `src/__tests__/supabase-adapter.test.ts`:
+a real supabase-js client against the MAIN database, signed in as `test@test.com`,
+calling a real door. A raw `fetch` to `/rest/v1/rpc/...` would NOT have caught
+this — the bug is in supabase-js's option handling, so only a real client
+exercises it. The RED half reconstructs the bare cast that shipped and asserts
+the store's own PGRST202 naming `public`; the GREEN half is the same call
+through the adapter answering the kernel id.
 
 ## 0.3.0
 

package/dist/core/index.cjs

@@ -90,6 +90,7 @@ __export(core_exports, {
   predictValueRefusals: () => predictValueRefusals,
   predictWriteRefusals: () => predictWriteRefusals,
   staleWriteDetail: () => staleWriteDetail,
+  supabaseDataSource: () => supabaseDataSource,
   toAoa: () => toAoa
 });
 module.exports = __toCommonJS(core_exports);
@@ -281,6 +282,8 @@ var STORE_DOORS = [
   { name: "doc_unresolved_tokens", args: "p_organization_id uuid, p_table_id uuid, p_body text", returns: "TABLE(raw text, field_id uuid, why text)", security: "invoker" },
   { name: "doors_not_deciding_the_caller", args: "", returns: "TABLE(function_name text, identity_args text)", security: "invoker" },
   { name: "doors_not_deciding_the_record", args: "", returns: "TABLE(function_name text, identity_args text, why text)", security: "invoker" },
+  { name: "doors_not_on_one_ladder", args: "", returns: "TABLE(function_name text, identity_args text, why text)", security: "invoker" },
+  { name: "effective_level", args: "p_user_id uuid, p_organization_id uuid, p_id uuid, p_type text DEFAULT 'record'::text", returns: "permission_level", security: "definer" },
   { name: "export_records", args: "p_organization_id uuid, p_table_id uuid, p_limit integer DEFAULT 1000", returns: "TABLE(id uuid, document jsonb)", security: "invoker" },
   { name: "external_foreign_table_findings", args: "", returns: "SETOF text", security: "definer" },
   { name: "external_history_event", args: "p_organization_id uuid, p_link_id uuid, p_operation text", returns: "bigint", security: "definer" },
@@ -1712,6 +1715,13 @@ var BY_SQLSTATE = {
   "23514": "refused_by_rule",
   "22004": "invalid_argument",
   "22023": "invalid_argument",
+  // 22P02 — a value does not fit the type the store holds for it. The class is
+  // real and was hit live: an organization whose copy of a package table grew
+  // `status` as a uuid-valued Field was sent the text "open", and the store
+  // answered `invalid input syntax for type uuid: "open"`. It is the CALL that
+  // is wrong for the shape the store holds, which is what `invalid_argument`
+  // already means — the store's own sentence names the value and the type.
+  "22P02": "invalid_argument",
   "02000": "not_found",
   "23503": "missing_reference",
   "23505": "already_exists",
@@ -1723,6 +1733,13 @@ var BY_SQLSTATE = {
   // they just lost access to. It is retryable on a fresher connection, which is
   // a different instruction from every other refusal here.
   "40001": "stale_read",
+  // 57014 — the store cancelled the statement at its own timeout. Like
+  // `stale_read` and unlike every other refusal here, the call was never
+  // refused on its merits: the same call on a smaller page, or once the
+  // organization's kernel is not being rewritten, can succeed. It gets its own
+  // code so a screen can offer "try again" honestly instead of showing a
+  // failure sentence the caller cannot act on.
+  "57014": "timed_out",
   // PostgREST's own two: the store is not being SERVED, which is a different
   // thing from the store refusing. `custom` absent from `pgrst.db_schemas`, or
   // the grants not copied, land here.
@@ -2575,6 +2592,42 @@ function asWriteConflict(error, recordId) {
   };
 }
 
+// src/core/supabase.ts
+function refuse(code, message, hint) {
+  return { data: null, error: { code, message, hint, details: "" } };
+}
+function supabaseDataSource(client) {
+  const supabase = client;
+  const hasSchema = typeof supabase.schema === "function";
+  return {
+    rpc(fn, args, options) {
+      if (!hasSchema) {
+        return Promise.resolve(
+          refuse(
+            "data_source_unbound",
+            `The records client was given something that is not a supabase client: it has no schema() method, so the door ${fn} cannot be called in the schema it lives in.`,
+            "Pass a supabase-js v2 client (createClient(...)) to supabaseDataSource()."
+          )
+        );
+      }
+      const name = options?.schema;
+      if (!name) {
+        return Promise.resolve(
+          refuse(
+            "schema_unsaid",
+            `The door ${fn} was called without saying which schema it lives in. Every door of this store is custom.${fn} and every trust door is iam.${fn}; an unqualified call reaches PostgREST's default profile (public) and is refused there.`,
+            "This is a bug in the caller, not in your data: /core says the schema on every call."
+          )
+        );
+      }
+      return supabase.schema(name).rpc(fn, args);
+    },
+    schema(name) {
+      return supabase.schema(name);
+    }
+  };
+}
+
 // src/core/validation.ts
 var DEFAULT_VALUE_MAX_BYTES = 1e5;
 var DEFAULT_DOCUMENT_MAX_BYTES = 1048576;