@ai-matrx/records 0.42.0 → 0.44.1

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { U as Uuid, T as TableType, a as TableDisplay, S as StorageMode, g as Timestamp, av as TableOrigin, h as RecordDocument, m as StoredRecord, l as Field, a7 as ParityFieldType, al as RuleUse, ak as RuleNodeKind, R as RelationFlavor, O as OnDelete, ai as RelationBinding, f as RelationCardinality, a1 as MergeFieldSource, a0 as MergeFieldSemanticType, $ as MergeFieldModifier, a4 as OverridePolicy, B as Delivery, M as Freshness, x as Actor, P as PgError } from './field-IOFl9Kvu.cjs';
-export { A as ABSENCE_REASONS, v as ACTOR_VOCABULARY, w as AbsenceReason, y as COMPUTE_ON, z as CONTEXT_POLICIES, C as ComputeOn, e as ContextPolicy, D as DELIVERIES, E as ENTITY_TOKENS, G as EntityToken, H as FIELD_SENSITIVITIES, I as FIELD_SOURCES, J as FRESHNESS, K as FieldBehavior, n as FieldPatch, q as FieldProposal, c as FieldRule, d as FieldSensitivity, b as FieldSource, F as FieldTypeWord, L as ForbiddenEnvelopeWord, Q as HiddenFieldNotice, V as KERNEL_TABLES, X as KernelTableName, Y as MERGE_FIELD_MODIFIERS, Z as MERGE_FIELD_SEMANTIC_TYPES, _ as MERGE_FIELD_SOURCES, N as NewFieldDeclaration, a2 as ON_DELETE, a3 as OVERRIDE_POLICIES, a5 as PARITY_FIELD_TYPES, a6 as PER_VALUE_ACCESS_WORDS, a8 as ParityFieldTypeDescriptor, a9 as PerValueAccessWord, u as PredictedRefusal, aa as ProvenancePointer, ab as RELATION_BINDINGS, ac as RELATION_CARDINALITIES, ad as RELATION_FLAVORS, ae as RETIRED_ACTOR_WORDS, af as RULE_NODE_KINDS, ag as RULE_USES, k as ReadRow, p as ReadValue, j as RecordRead, o as RecordRevision, s as RecordsError, ah as RecordsErrorCode, i as RecordsResult, aj as RetiredActorWord, am as STORAGE_MODES, an as STORE_DOORS, ao as STORE_KNOBS, ap as STORE_REFUSAL_CODES, t as StaleWriteDetail, aq as StoreDoorName, ar as StoreRefusalCode, as as TABLE_DISPLAYS, at as TABLE_ORIGINS, au as TABLE_TYPES, r as TableProposal, aw as VALUE_ALTERNATE_KEYS, ax as VALUE_ENVELOPE_KEYS, ay as ValueAlternate, az as ValueAlternateKey, aA as ValueEnvelope, aB as ValueEnvelopeKey, aC as ValueSource, W as WriteConflict, aD as err, aE as isRecordsErr, aF as ok } from './field-IOFl9Kvu.cjs';
+import { U as Uuid, T as TableType, a as TableDisplay, S as StorageMode, g as Timestamp, aw as TableOrigin, h as RecordDocument, m as StoredRecord, l as Field, a7 as ParityFieldType, am as RuleUse, al as RuleNodeKind, R as RelationFlavor, O as OnDelete, ai as RelationBinding, f as RelationCardinality, a1 as MergeFieldSource, a0 as MergeFieldSemanticType, $ as MergeFieldModifier, a4 as OverridePolicy, B as Delivery, M as Freshness, x as Actor, P as PgError } from './field-D0Rr4Cqb.cjs';
+export { A as ABSENCE_REASONS, v as ACTOR_VOCABULARY, w as AbsenceReason, y as COMPUTE_ON, z as CONTEXT_POLICIES, C as ComputeOn, e as ContextPolicy, D as DELIVERIES, E as ENTITY_TOKENS, G as EntityToken, H as FIELD_SENSITIVITIES, I as FIELD_SOURCES, J as FRESHNESS, K as FieldBehavior, n as FieldPatch, q as FieldProposal, c as FieldRule, d as FieldSensitivity, b as FieldSource, F as FieldTypeWord, L as ForbiddenEnvelopeWord, Q as HiddenFieldNotice, V as KERNEL_TABLES, X as KernelTableName, Y as MERGE_FIELD_MODIFIERS, Z as MERGE_FIELD_SEMANTIC_TYPES, _ as MERGE_FIELD_SOURCES, N as NewFieldDeclaration, a2 as ON_DELETE, a3 as OVERRIDE_POLICIES, a5 as PARITY_FIELD_TYPES, a6 as PER_VALUE_ACCESS_WORDS, a8 as ParityFieldTypeDescriptor, a9 as PerValueAccessWord, u as PredictedRefusal, aa as ProvenancePointer, ab as RELATION_BINDINGS, ac as RELATION_CARDINALITIES, ad as RELATION_FLAVORS, ae as RETIRED_ACTOR_WORDS, af as RULE_NODE_KINDS, ag as RULE_USES, k as ReadRow, p as ReadValue, j as RecordRead, o as RecordRevision, s as RecordsError, ah as RecordsErrorCode, i as RecordsResult, aj as RelationDisplay, ak as RetiredActorWord, an as STORAGE_MODES, ao as STORE_DOORS, ap as STORE_KNOBS, aq as STORE_REFUSAL_CODES, t as StaleWriteDetail, ar as StoreDoorName, as as StoreRefusalCode, at as TABLE_DISPLAYS, au as TABLE_ORIGINS, av as TABLE_TYPES, r as TableProposal, ax as VALUE_ALTERNATE_KEYS, ay as VALUE_ENVELOPE_KEYS, az as ValueAlternate, aA as ValueAlternateKey, aB as ValueEnvelope, aC as ValueEnvelopeKey, aD as ValueSource, W as WriteConflict, aE as err, aF as isRecordsErr, aG as ok } from './field-D0Rr4Cqb.cjs';
 
 /** `public.permission_level`, in the store's own order. */
 type PermissionLevel = "viewer" | "commenter" | "editor" | "admin";
@@ -2663,14 +2663,37 @@ interface RecordsActor {
  */
 interface RecordsRealtimePort {
     /**
-     * Watch one organization's records of one table. Returns an unsubscribe. The
-     * callback fires with the record id that changed; the hook re-reads through
-     * the read door, because a realtime payload has NOT passed the door.
+     * Watch one organization's records of one table. Returns an unsubscribe.
+     *
+     * THE HOST NUDGES THROUGH THIS SINK AND REACHES AROUND NOTHING. Until 0.43.0 the callback
+     * was `(recordId: Uuid) => void` and a host that also wanted to say "the SHAPE moved"
+     * imported `tableShapeChanged` from `@ai-matrx/records/react` and called it directly —
+     * which worked, and which meant the port contract did not describe half of what a port
+     * actually does. A column appearing is not a row changing, and the package owns the
+     * difference.
+     *
+     * NOTHING THAT ARRIVES HERE IS DATA. A nudge has not passed the read door, so the hook
+     * re-reads — by id set when the nudge names ids, whole-page when it cannot.
      */
     subscribeRecords(args: {
         organization_id: Uuid;
         table_id: Uuid;
-    }, onChange: (recordId: Uuid) => void): () => void;
+    }, sink: RecordsChangeSink): () => void;
+}
+/** What a realtime port may tell the package. Two calls, because a column is not a row. */
+interface RecordsChangeSink {
+    /**
+     * THESE RECORDS MOVED. `null` means "I cannot tell you which" — a reconnect, a tab wake, or
+     * a change above the store's own id cap — and is the one case that costs a whole-page read.
+     * An EMPTY array is not the same thing and is not a nudge at all.
+     */
+    records(ids: readonly Uuid[] | null): void;
+    /**
+     * THIS TABLE'S SHAPE MOVED — a column added, retired or changed. Re-reading the rows would
+     * redraw the same table without the new column in it, which is a screen that is out of date
+     * while looking healthy.
+     */
+    shape(): void;
 }
 /**
  * OPTIONAL. Where a refusal that nobody asked about goes — the loud funnel.
@@ -2718,6 +2741,61 @@ interface RecordsConfig {
     schema?: string;
 }
 
+/**
+ * THE CLIENT OPERATION LEDGER — how a browser recognises the echo of its own write.
+ *
+ * Every private-channel notice the record store broadcasts reaches EVERY browser watching that
+ * Table, including the one that caused it. Until now the writer had no way to tell its own
+ * change from a colleague's: the notice carried ids and nothing about who moved them, so
+ * `recordsRealtimePort.ts` declared `acceptEchoFromSelf: true` and the writer re-read a page it
+ * had already updated. It was named honestly rather than faked, and this is the other half.
+ *
+ * THE SHAPE. Every write through `RecordsClient` mints a uuid, sends it to the store as the
+ * platform envelope key `_op_id`, and remembers it here. The store lifts that key out before
+ * storage — it is never written onto the record — carries it on the change-feed row, and puts
+ * it in the notice as `op_id`. A notice whose `op_id` is in this ledger is this browser's own
+ * echo and is dropped.
+ *
+ * WHY A TIME WINDOW RATHER THAN A DELETE-ON-MATCH. One write can produce MORE THAN ONE notice:
+ * a record write that also moves a column produces a `record` notice and a `field` notice, and
+ * a statement touching two Tables produces one per Table. Forgetting an op the first time it
+ * came back would make the second notice look like somebody else's and cost the re-read this
+ * exists to avoid. So an op is remembered for a window and expires on its own.
+ *
+ * 🚨 THE WINDOW IS A CORRECTNESS BOUNDARY, NOT A TUNING KNOB, AND IT FAILS IN THE SAFE
+ * DIRECTION BY CONSTRUCTION. Too SHORT and a late echo is treated as a stranger's change: one
+ * extra read of a page that is already correct — invisible. Too LONG and a stranger's change
+ * that happened to reuse our uuid would be dropped — which cannot happen, because it is a v4
+ * uuid nobody else has ever seen. The only real cost of a long window is memory, so it is
+ * bounded by COUNT as well as by time.
+ *
+ * WHAT THIS IS NOT. It is not a replacement for the store's optimistic concurrency, and it
+ * never decides what is true — a dropped echo means "I already know about this", and every
+ * path that could be wrong about that (a reconnect, a tab wake, a notice with no `op_id` at
+ * all) re-reads through the door as it always did.
+ */
+
+/**
+ * Mint the id for one client operation and remember it as ours.
+ *
+ * ONE CALL IS ONE OPERATION. A fifty-row paste through `recordWriteMany` is ONE op id, because
+ * the store announces one statement once — and it REFUSES a batch carrying two different ones
+ * by name, for exactly that reason.
+ */
+declare function mintOpId(): Uuid;
+/**
+ * Is this notice the echo of a write this browser made?
+ *
+ * `undefined`/`null` is NOT ours and never has been: a notice with no `op_id` came from a
+ * server-side write, an agent tool, another client, or a store older than this mechanism —
+ * all of which are changes this browser has not seen and must read.
+ */
+declare function isOwnOp(opId: string | null | undefined): boolean;
+/** Test seam: forget everything. Never called by product code. */
+declare function forgetAllOps(): void;
+/** Test seam: how many operations are currently remembered. */
+declare function rememberedOpCount(): number;
+
 /** One value the agent was given, with the triple that makes it citable. */
 interface RecordScopeField {
     key: string;
@@ -2816,4 +2894,4 @@ interface ConversationScopeContext {
 /** `About: Acme Industrial` — the chip a bound chat wears. */
 declare function scopeChip(scope: ConversationScope): string;
 
-export { Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type BookingAvailability, type BookingDeclared, type BookingSummary, type BookingWindow, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type CommentThreadRead, type CommentWritten, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type ExternalPrincipalCard, Field, type FieldHistoryEntry, type FormSummary, Freshness, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, type MergeField, MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, MergeFieldSemanticType, MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, OnDelete, OverridePolicy, PERMISSION_LEVELS, PIPELINE_RULE_KINDS, ParityFieldType, type PermissionLevel, PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineGate, type PipelineGatePreview, type PipelineMissingField, type PipelineMoveResult, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, type RecordComment, RecordDocument, type RecordHistoryEntry, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsConfig, type RecordsDataSource, type RecordsErrorSink, type RecordsFilter, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsTableQuery, type RegisteredTable, type Relation, RelationBinding, RelationCardinality, type RelationCarries, type RelationCoordinate, RelationFlavor, type RelationProperties, type RelationTarget, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type Rule, type RuleAnswer, type RuleExpression, RuleNodeKind, RuleUse, STAGE_RULE_ENFORCEMENT, STAGE_RULE_ON_FAIL, type SavedViewRow, type SavedViewSpecIn, type StagePending, type StagePendingOnBoard, type StageRuleEnforcement, type StageRuleOnFail, type StageRuleWarning, StorageMode, StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, type Table, type TableCapacity, TableDisplay, TableOrigin, TableType, Timestamp, Uuid, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, highestLevel, holdsARetiredChoice, indexedDbStore, isDecided, isTheChosen, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, openCaptureQueue, optionKey, optionLabel, portalPath, publicFormPath, scopeChip };
+export { Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type BookingAvailability, type BookingDeclared, type BookingSummary, type BookingWindow, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type CommentThreadRead, type CommentWritten, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type ExternalPrincipalCard, Field, type FieldHistoryEntry, type FormSummary, Freshness, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, type MergeField, MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, MergeFieldSemanticType, MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, OnDelete, OverridePolicy, PERMISSION_LEVELS, PIPELINE_RULE_KINDS, ParityFieldType, type PermissionLevel, PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineGate, type PipelineGatePreview, type PipelineMissingField, type PipelineMoveResult, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, type RecordComment, RecordDocument, type RecordHistoryEntry, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsChangeSink, type RecordsConfig, type RecordsDataSource, type RecordsErrorSink, type RecordsFilter, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsTableQuery, type RegisteredTable, type Relation, RelationBinding, RelationCardinality, type RelationCarries, type RelationCoordinate, RelationFlavor, type RelationProperties, type RelationTarget, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type Rule, type RuleAnswer, type RuleExpression, RuleNodeKind, RuleUse, STAGE_RULE_ENFORCEMENT, STAGE_RULE_ON_FAIL, type SavedViewRow, type SavedViewSpecIn, type StagePending, type StagePendingOnBoard, type StageRuleEnforcement, type StageRuleOnFail, type StageRuleWarning, StorageMode, StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, type Table, type TableCapacity, TableDisplay, TableOrigin, TableType, Timestamp, Uuid, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, forgetAllOps, highestLevel, holdsARetiredChoice, indexedDbStore, isDecided, isOwnOp, isTheChosen, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, mintOpId, openCaptureQueue, optionKey, optionLabel, portalPath, publicFormPath, rememberedOpCount, scopeChip };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { U as Uuid, T as TableType, a as TableDisplay, S as StorageMode, g as Timestamp, av as TableOrigin, h as RecordDocument, m as StoredRecord, l as Field, a7 as ParityFieldType, al as RuleUse, ak as RuleNodeKind, R as RelationFlavor, O as OnDelete, ai as RelationBinding, f as RelationCardinality, a1 as MergeFieldSource, a0 as MergeFieldSemanticType, $ as MergeFieldModifier, a4 as OverridePolicy, B as Delivery, M as Freshness, x as Actor, P as PgError } from './field-IOFl9Kvu.js';
-export { A as ABSENCE_REASONS, v as ACTOR_VOCABULARY, w as AbsenceReason, y as COMPUTE_ON, z as CONTEXT_POLICIES, C as ComputeOn, e as ContextPolicy, D as DELIVERIES, E as ENTITY_TOKENS, G as EntityToken, H as FIELD_SENSITIVITIES, I as FIELD_SOURCES, J as FRESHNESS, K as FieldBehavior, n as FieldPatch, q as FieldProposal, c as FieldRule, d as FieldSensitivity, b as FieldSource, F as FieldTypeWord, L as ForbiddenEnvelopeWord, Q as HiddenFieldNotice, V as KERNEL_TABLES, X as KernelTableName, Y as MERGE_FIELD_MODIFIERS, Z as MERGE_FIELD_SEMANTIC_TYPES, _ as MERGE_FIELD_SOURCES, N as NewFieldDeclaration, a2 as ON_DELETE, a3 as OVERRIDE_POLICIES, a5 as PARITY_FIELD_TYPES, a6 as PER_VALUE_ACCESS_WORDS, a8 as ParityFieldTypeDescriptor, a9 as PerValueAccessWord, u as PredictedRefusal, aa as ProvenancePointer, ab as RELATION_BINDINGS, ac as RELATION_CARDINALITIES, ad as RELATION_FLAVORS, ae as RETIRED_ACTOR_WORDS, af as RULE_NODE_KINDS, ag as RULE_USES, k as ReadRow, p as ReadValue, j as RecordRead, o as RecordRevision, s as RecordsError, ah as RecordsErrorCode, i as RecordsResult, aj as RetiredActorWord, am as STORAGE_MODES, an as STORE_DOORS, ao as STORE_KNOBS, ap as STORE_REFUSAL_CODES, t as StaleWriteDetail, aq as StoreDoorName, ar as StoreRefusalCode, as as TABLE_DISPLAYS, at as TABLE_ORIGINS, au as TABLE_TYPES, r as TableProposal, aw as VALUE_ALTERNATE_KEYS, ax as VALUE_ENVELOPE_KEYS, ay as ValueAlternate, az as ValueAlternateKey, aA as ValueEnvelope, aB as ValueEnvelopeKey, aC as ValueSource, W as WriteConflict, aD as err, aE as isRecordsErr, aF as ok } from './field-IOFl9Kvu.js';
+import { U as Uuid, T as TableType, a as TableDisplay, S as StorageMode, g as Timestamp, aw as TableOrigin, h as RecordDocument, m as StoredRecord, l as Field, a7 as ParityFieldType, am as RuleUse, al as RuleNodeKind, R as RelationFlavor, O as OnDelete, ai as RelationBinding, f as RelationCardinality, a1 as MergeFieldSource, a0 as MergeFieldSemanticType, $ as MergeFieldModifier, a4 as OverridePolicy, B as Delivery, M as Freshness, x as Actor, P as PgError } from './field-D0Rr4Cqb.js';
+export { A as ABSENCE_REASONS, v as ACTOR_VOCABULARY, w as AbsenceReason, y as COMPUTE_ON, z as CONTEXT_POLICIES, C as ComputeOn, e as ContextPolicy, D as DELIVERIES, E as ENTITY_TOKENS, G as EntityToken, H as FIELD_SENSITIVITIES, I as FIELD_SOURCES, J as FRESHNESS, K as FieldBehavior, n as FieldPatch, q as FieldProposal, c as FieldRule, d as FieldSensitivity, b as FieldSource, F as FieldTypeWord, L as ForbiddenEnvelopeWord, Q as HiddenFieldNotice, V as KERNEL_TABLES, X as KernelTableName, Y as MERGE_FIELD_MODIFIERS, Z as MERGE_FIELD_SEMANTIC_TYPES, _ as MERGE_FIELD_SOURCES, N as NewFieldDeclaration, a2 as ON_DELETE, a3 as OVERRIDE_POLICIES, a5 as PARITY_FIELD_TYPES, a6 as PER_VALUE_ACCESS_WORDS, a8 as ParityFieldTypeDescriptor, a9 as PerValueAccessWord, u as PredictedRefusal, aa as ProvenancePointer, ab as RELATION_BINDINGS, ac as RELATION_CARDINALITIES, ad as RELATION_FLAVORS, ae as RETIRED_ACTOR_WORDS, af as RULE_NODE_KINDS, ag as RULE_USES, k as ReadRow, p as ReadValue, j as RecordRead, o as RecordRevision, s as RecordsError, ah as RecordsErrorCode, i as RecordsResult, aj as RelationDisplay, ak as RetiredActorWord, an as STORAGE_MODES, ao as STORE_DOORS, ap as STORE_KNOBS, aq as STORE_REFUSAL_CODES, t as StaleWriteDetail, ar as StoreDoorName, as as StoreRefusalCode, at as TABLE_DISPLAYS, au as TABLE_ORIGINS, av as TABLE_TYPES, r as TableProposal, ax as VALUE_ALTERNATE_KEYS, ay as VALUE_ENVELOPE_KEYS, az as ValueAlternate, aA as ValueAlternateKey, aB as ValueEnvelope, aC as ValueEnvelopeKey, aD as ValueSource, W as WriteConflict, aE as err, aF as isRecordsErr, aG as ok } from './field-D0Rr4Cqb.js';
 
 /** `public.permission_level`, in the store's own order. */
 type PermissionLevel = "viewer" | "commenter" | "editor" | "admin";
@@ -2663,14 +2663,37 @@ interface RecordsActor {
  */
 interface RecordsRealtimePort {
     /**
-     * Watch one organization's records of one table. Returns an unsubscribe. The
-     * callback fires with the record id that changed; the hook re-reads through
-     * the read door, because a realtime payload has NOT passed the door.
+     * Watch one organization's records of one table. Returns an unsubscribe.
+     *
+     * THE HOST NUDGES THROUGH THIS SINK AND REACHES AROUND NOTHING. Until 0.43.0 the callback
+     * was `(recordId: Uuid) => void` and a host that also wanted to say "the SHAPE moved"
+     * imported `tableShapeChanged` from `@ai-matrx/records/react` and called it directly —
+     * which worked, and which meant the port contract did not describe half of what a port
+     * actually does. A column appearing is not a row changing, and the package owns the
+     * difference.
+     *
+     * NOTHING THAT ARRIVES HERE IS DATA. A nudge has not passed the read door, so the hook
+     * re-reads — by id set when the nudge names ids, whole-page when it cannot.
      */
     subscribeRecords(args: {
         organization_id: Uuid;
         table_id: Uuid;
-    }, onChange: (recordId: Uuid) => void): () => void;
+    }, sink: RecordsChangeSink): () => void;
+}
+/** What a realtime port may tell the package. Two calls, because a column is not a row. */
+interface RecordsChangeSink {
+    /**
+     * THESE RECORDS MOVED. `null` means "I cannot tell you which" — a reconnect, a tab wake, or
+     * a change above the store's own id cap — and is the one case that costs a whole-page read.
+     * An EMPTY array is not the same thing and is not a nudge at all.
+     */
+    records(ids: readonly Uuid[] | null): void;
+    /**
+     * THIS TABLE'S SHAPE MOVED — a column added, retired or changed. Re-reading the rows would
+     * redraw the same table without the new column in it, which is a screen that is out of date
+     * while looking healthy.
+     */
+    shape(): void;
 }
 /**
  * OPTIONAL. Where a refusal that nobody asked about goes — the loud funnel.
@@ -2718,6 +2741,61 @@ interface RecordsConfig {
     schema?: string;
 }
 
+/**
+ * THE CLIENT OPERATION LEDGER — how a browser recognises the echo of its own write.
+ *
+ * Every private-channel notice the record store broadcasts reaches EVERY browser watching that
+ * Table, including the one that caused it. Until now the writer had no way to tell its own
+ * change from a colleague's: the notice carried ids and nothing about who moved them, so
+ * `recordsRealtimePort.ts` declared `acceptEchoFromSelf: true` and the writer re-read a page it
+ * had already updated. It was named honestly rather than faked, and this is the other half.
+ *
+ * THE SHAPE. Every write through `RecordsClient` mints a uuid, sends it to the store as the
+ * platform envelope key `_op_id`, and remembers it here. The store lifts that key out before
+ * storage — it is never written onto the record — carries it on the change-feed row, and puts
+ * it in the notice as `op_id`. A notice whose `op_id` is in this ledger is this browser's own
+ * echo and is dropped.
+ *
+ * WHY A TIME WINDOW RATHER THAN A DELETE-ON-MATCH. One write can produce MORE THAN ONE notice:
+ * a record write that also moves a column produces a `record` notice and a `field` notice, and
+ * a statement touching two Tables produces one per Table. Forgetting an op the first time it
+ * came back would make the second notice look like somebody else's and cost the re-read this
+ * exists to avoid. So an op is remembered for a window and expires on its own.
+ *
+ * 🚨 THE WINDOW IS A CORRECTNESS BOUNDARY, NOT A TUNING KNOB, AND IT FAILS IN THE SAFE
+ * DIRECTION BY CONSTRUCTION. Too SHORT and a late echo is treated as a stranger's change: one
+ * extra read of a page that is already correct — invisible. Too LONG and a stranger's change
+ * that happened to reuse our uuid would be dropped — which cannot happen, because it is a v4
+ * uuid nobody else has ever seen. The only real cost of a long window is memory, so it is
+ * bounded by COUNT as well as by time.
+ *
+ * WHAT THIS IS NOT. It is not a replacement for the store's optimistic concurrency, and it
+ * never decides what is true — a dropped echo means "I already know about this", and every
+ * path that could be wrong about that (a reconnect, a tab wake, a notice with no `op_id` at
+ * all) re-reads through the door as it always did.
+ */
+
+/**
+ * Mint the id for one client operation and remember it as ours.
+ *
+ * ONE CALL IS ONE OPERATION. A fifty-row paste through `recordWriteMany` is ONE op id, because
+ * the store announces one statement once — and it REFUSES a batch carrying two different ones
+ * by name, for exactly that reason.
+ */
+declare function mintOpId(): Uuid;
+/**
+ * Is this notice the echo of a write this browser made?
+ *
+ * `undefined`/`null` is NOT ours and never has been: a notice with no `op_id` came from a
+ * server-side write, an agent tool, another client, or a store older than this mechanism —
+ * all of which are changes this browser has not seen and must read.
+ */
+declare function isOwnOp(opId: string | null | undefined): boolean;
+/** Test seam: forget everything. Never called by product code. */
+declare function forgetAllOps(): void;
+/** Test seam: how many operations are currently remembered. */
+declare function rememberedOpCount(): number;
+
 /** One value the agent was given, with the triple that makes it citable. */
 interface RecordScopeField {
     key: string;
@@ -2816,4 +2894,4 @@ interface ConversationScopeContext {
 /** `About: Acme Industrial` — the chip a bound chat wears. */
 declare function scopeChip(scope: ConversationScope): string;
 
-export { Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type BookingAvailability, type BookingDeclared, type BookingSummary, type BookingWindow, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type CommentThreadRead, type CommentWritten, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type ExternalPrincipalCard, Field, type FieldHistoryEntry, type FormSummary, Freshness, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, type MergeField, MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, MergeFieldSemanticType, MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, OnDelete, OverridePolicy, PERMISSION_LEVELS, PIPELINE_RULE_KINDS, ParityFieldType, type PermissionLevel, PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineGate, type PipelineGatePreview, type PipelineMissingField, type PipelineMoveResult, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, type RecordComment, RecordDocument, type RecordHistoryEntry, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsConfig, type RecordsDataSource, type RecordsErrorSink, type RecordsFilter, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsTableQuery, type RegisteredTable, type Relation, RelationBinding, RelationCardinality, type RelationCarries, type RelationCoordinate, RelationFlavor, type RelationProperties, type RelationTarget, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type Rule, type RuleAnswer, type RuleExpression, RuleNodeKind, RuleUse, STAGE_RULE_ENFORCEMENT, STAGE_RULE_ON_FAIL, type SavedViewRow, type SavedViewSpecIn, type StagePending, type StagePendingOnBoard, type StageRuleEnforcement, type StageRuleOnFail, type StageRuleWarning, StorageMode, StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, type Table, type TableCapacity, TableDisplay, TableOrigin, TableType, Timestamp, Uuid, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, highestLevel, holdsARetiredChoice, indexedDbStore, isDecided, isTheChosen, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, openCaptureQueue, optionKey, optionLabel, portalPath, publicFormPath, scopeChip };
+export { Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type BookingAvailability, type BookingDeclared, type BookingSummary, type BookingWindow, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type CommentThreadRead, type CommentWritten, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type ExternalPrincipalCard, Field, type FieldHistoryEntry, type FormSummary, Freshness, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, type MergeField, MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, MergeFieldSemanticType, MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, OnDelete, OverridePolicy, PERMISSION_LEVELS, PIPELINE_RULE_KINDS, ParityFieldType, type PermissionLevel, PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineGate, type PipelineGatePreview, type PipelineMissingField, type PipelineMoveResult, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, type RecordComment, RecordDocument, type RecordHistoryEntry, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsChangeSink, type RecordsConfig, type RecordsDataSource, type RecordsErrorSink, type RecordsFilter, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsTableQuery, type RegisteredTable, type Relation, RelationBinding, RelationCardinality, type RelationCarries, type RelationCoordinate, RelationFlavor, type RelationProperties, type RelationTarget, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type Rule, type RuleAnswer, type RuleExpression, RuleNodeKind, RuleUse, STAGE_RULE_ENFORCEMENT, STAGE_RULE_ON_FAIL, type SavedViewRow, type SavedViewSpecIn, type StagePending, type StagePendingOnBoard, type StageRuleEnforcement, type StageRuleOnFail, type StageRuleWarning, StorageMode, StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, type Table, type TableCapacity, TableDisplay, TableOrigin, TableType, Timestamp, Uuid, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, forgetAllOps, highestLevel, holdsARetiredChoice, indexedDbStore, isDecided, isOwnOp, isTheChosen, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, mintOpId, openCaptureQueue, optionKey, optionLabel, portalPath, publicFormPath, rememberedOpCount, scopeChip };

package/dist/index.js

@@ -436,6 +436,45 @@ function isRecordsErr(result) {
 var ok = (data) => ({ ok: true, data });
 var err = (error) => ({ ok: false, error });
 
+// src/ops.ts
+var REMEMBER_MS = 3e4;
+var REMEMBER_MAX = 500;
+var ours = /* @__PURE__ */ new Map();
+function trim(now) {
+  for (const [id, at] of ours) {
+    if (now - at <= REMEMBER_MS) break;
+    ours.delete(id);
+  }
+  while (ours.size > REMEMBER_MAX) {
+    const oldest = ours.keys().next();
+    if (oldest.done === true) break;
+    ours.delete(oldest.value);
+  }
+}
+function mintOpId() {
+  const id = crypto.randomUUID();
+  const now = Date.now();
+  ours.set(id, now);
+  trim(now);
+  return id;
+}
+function isOwnOp(opId) {
+  if (!opId) return false;
+  const at = ours.get(opId);
+  if (at === void 0) return false;
+  if (Date.now() - at > REMEMBER_MS) {
+    ours.delete(opId);
+    return false;
+  }
+  return true;
+}
+function forgetAllOps() {
+  ours.clear();
+}
+function rememberedOpCount() {
+  return ours.size;
+}
+
 // src/store.generated.ts
 var ACTOR_VOCABULARY = ["user", "agent", "system"];
 var RETIRED_ACTOR_WORDS = { "ai": "agent", "code": "system", "human": "user" };
@@ -879,6 +918,7 @@ var STORE_DOORS = [
   { name: "read_paths_outside_the_door", args: "", returns: "TABLE(object_name text, why text)", security: "invoker" },
   { name: "read_record", args: "p_organization_id uuid, p_record_id uuid, p_by_id boolean DEFAULT false", returns: "jsonb", security: "definer" },
   { name: "read_records", args: "p_organization_id uuid, p_table_id uuid, p_by_id boolean DEFAULT false, p_limit integer DEFAULT 200, p_offset integer DEFAULT 0", returns: "TABLE(id uuid, document jsonb, level permission_level)", security: "definer" },
+  { name: "read_records_by_ids", args: "p_organization_id uuid, p_table_id uuid, p_record_ids uuid[], p_by_id boolean DEFAULT false", returns: "TABLE(id uuid, document jsonb, level permission_level)", security: "definer" },
   { name: "realtime_topic_admits", args: "p_topic text", returns: "boolean", security: "definer" },
   { name: "record_aggregate", args: "p_organization_id uuid, p_table_id uuid, p_group_by jsonb DEFAULT '[]'::jsonb, p_measures jsonb DEFAULT '[]'::jsonb, p_bucket jsonb DEFAULT NULL::jsonb, p_filter jsonb DEFAULT '{}'::jsonb, p_limit integer DEFAULT 200, p_required text DEFAULT 'viewer'::text", returns: "TABLE(groups jsonb, measures jsonb, row_count bigint)", security: "definer" },
   { name: "record_applicability", args: "p_organization_id uuid, p_record_id uuid", returns: "TABLE(rule_id uuid, rule_name text, rule_version integer, applies boolean, answer jsonb)", security: "invoker" },
@@ -903,6 +943,7 @@ var STORE_DOORS = [
   { name: "record_values", args: "p_organization_id uuid, p_record_id uuid", returns: "jsonb", security: "invoker" },
   { name: "record_values_of", args: "p_row custom.record", returns: "jsonb", security: "invoker" },
   { name: "record_values_versioned", args: "p_organization_id uuid, p_record_id uuid", returns: "TABLE(field_key text, field_id uuid, value jsonb, value_version integer, source jsonb, absent_reason text, actor text, on_behalf_of text, written_at timestamp with time zone, alternates jsonb)", security: "definer" },
+  { name: "record_words", args: "p_organization_id uuid, p_record_id uuid, p_noun text DEFAULT NULL::text", returns: "text", security: "definer" },
   { name: "record_write", args: "p_organization_id uuid, p_table_id uuid, p_data jsonb", returns: "uuid", security: "definer" },
   { name: "record_write_many", args: "p_organization_id uuid, p_table_id uuid, p_rows jsonb[], p_ids uuid[] DEFAULT NULL::uuid[]", returns: "uuid[]", security: "definer" },
   { name: "refusals_claiming_a_level_never_asked", args: "", returns: "TABLE(function_name text, identity_args text, why text)", security: "invoker" },
@@ -914,6 +955,8 @@ var STORE_DOORS = [
   { name: "relation_target_ours", args: "p_entity_token text, p_row_id uuid", returns: "jsonb", security: "definer" },
   { name: "relation_targets", args: "p_organization_id uuid, p_record_id uuid, p_via_key text", returns: "SETOF uuid", security: "definer" },
   { name: "relation_uncarry", args: "p_organization_id uuid, p_container_id uuid, p_item_id uuid", returns: "integer", security: "definer" },
+  { name: "relation_words", args: "p_organization_id uuid, p_field_id uuid, p_value text", returns: "text", security: "definer" },
+  { name: "relation_words_many", args: "p_organization_id uuid, p_field_id uuid, p_record_ids uuid[]", returns: "TABLE(record_id uuid, words text)", security: "definer" },
   { name: "reopen_declared_doors", args: "", returns: "TABLE(reopened text)", security: "definer" },
   { name: "required_epoch", args: "p_container_type text, p_container_id uuid, p_item_type text, p_item_id uuid", returns: "bigint", security: "definer" },
   { name: "resolve_first_match", args: "p_organization_id uuid, p_record_id uuid", returns: "jsonb", security: "invoker" },
@@ -1103,18 +1146,18 @@ var STORE_KNOBS = [
   { key: "world_publish_enabled", value: "false", type: "boolean" }
 ];
 var STORE_REFUSAL_CODES = [
-  { code: "02000", raised_by: "_checklist_instantiate,checklist_declare,checklist_run,checklist_step_complete,checklist_step_refusal,checklist_template_shape,conversation_scope_bind,dashboard_delete,dashboard_run,doc_letterhead,doc_render_body,doc_render_document,doc_render_read,doc_sign,doc_signature_intact,doc_signature_read,doc_template_delete,doc_template_read,doc_template_save,enrich_pin,entity_field_retire,entity_field_update,entity_record_read,entity_value_write,external_history_event,external_rows,external_stub_upsert,external_writes_set,io_restore,migrate_delete,migrate_extract_parent,migrate_merge,migrate_reclass,migrate_rename,migrate_reparent,migrate_retype,migrate_split,migrate_undo,organization_clear,portal_card,portal_declare,portal_invite,portal_preview,portal_principal_bind,portal_revoke,read_record,record_delete,record_restore,record_restore_preview,record_table,record_update,relation_uncarry,share_access,share_grant,share_lane_set,share_people,share_revoke,sign_request_cancel,sign_request_create,sign_request_remind,sign_request_unchanged,table_share_outside_accept,table_share_outside_invite,table_share_outside_resend,table_share_outside_revoke,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_assign,work_record_states,work_set_state" },
+  { code: "02000", raised_by: "_checklist_instantiate,_table_share_invite_payload,checklist_declare,checklist_run,checklist_step_complete,checklist_step_refusal,checklist_template_shape,conversation_scope_bind,dashboard_delete,dashboard_run,doc_letterhead,doc_render_body,doc_render_document,doc_render_read,doc_sign,doc_signature_intact,doc_signature_read,doc_template_delete,doc_template_read,doc_template_save,enrich_pin,entity_field_retire,entity_field_update,entity_record_read,entity_value_write,external_history_event,external_rows,external_stub_upsert,external_writes_set,io_restore,migrate_delete,migrate_extract_parent,migrate_merge,migrate_reclass,migrate_rename,migrate_reparent,migrate_retype,migrate_split,migrate_undo,organization_clear,portal_card,portal_declare,portal_invite,portal_preview,portal_principal_bind,portal_revoke,read_record,record_delete,record_restore,record_restore_preview,record_table,record_update,relation_uncarry,share_access,share_grant,share_lane_set,share_people,share_revoke,sign_request_cancel,sign_request_create,sign_request_remind,sign_request_unchanged,table_share_outside_accept,table_share_outside_invite,table_share_outside_resend,table_share_outside_revoke,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_assign,work_record_states,work_set_state" },
   { code: "0A000", raised_by: "checklist_step_complete,external_rows,external_source_declare,external_write_through,promote_field,promoted_index_expr,promoted_query_sql,promoted_read,rule_eval,work_assign" },
   { code: "22003", raised_by: "context_resolve" },
   { code: "22004", raised_by: "_entity_custom_fields_guard,_value_envelope,actor_word,agg_assert_key,agg_sql,anon_capture,anon_token_issue,anon_write,assert_client_may_reach,booking_declare,capture_submit,checklist_declare,context_resolve,dashboard_block_normalize,dashboard_declare,dashboard_window_sql,doc_render_write,doc_sign,doc_signature_write,doc_template_save,enrich_land,enrich_normalize,external_history_event,external_rows,external_source_declare,external_stub_upsert,external_write_through,external_writes_set,field_history,form_declare,form_submit,home_add,io_comment_write,io_import_begin,io_infer_column,io_outbox_drain,io_restore,migrate_choice_keys,migrate_purge,migrate_reclass,migrate_split,migrate_undo,organization_clear,organization_contents,pipeline_declare,pipeline_gate_preview,portal_declare,portal_invite,portal_principal_bind,provenance_retention_days,provenance_write,query_across_homes,query_by_coordinates,query_rollup,record_delete,record_reparent,record_resolve,record_restore,record_update,record_write,record_write_many,relation_carry,relation_own,rule_declare,share_grant,sign_request_create,sign_request_sign,subscription_declare,table_declare,table_share_outside_invite,value_restore,view_declare,work_approval_decide,work_approval_request,work_template_declare" },
   { code: "22007", raised_by: "dashboard_window_sql" },
   { code: "22012", raised_by: "rule_eval" },
-  { code: "22023", raised_by: "_booking_availability,_entity_custom_fields_guard,_value_envelope,_work_shape_guard,actor_word,agg_assert_key,agg_sql,anon_token_issue,booking_declare,containment_parent,dashboard_block_normalize,dashboard_window_sql,doc_render_body,doc_render_write,doc_signature_write,enrich_declare,enrich_land,enrich_normalize,enrich_pin,entity_value_write,external_history_event,external_source_declare,external_stub_upsert,external_write_through,field_history,io_export,io_import_begin,io_import_finish,io_import_plan,io_import_report,io_proposal_accept,migrate_merge,migrate_reclass,my_levels,organization_clear,page_size,pin_agent_cells,pipeline_move,portal_declare,provenance_write,query_by_coordinates,query_rollup,record_update,record_write_many,relation_carry,rule_eval,rule_members,share_grant,share_lane_set,sign_request_create,sign_request_sign,subscription_declare,table_rules,visibility_as_of,work_approval_request,work_list,work_slot_hold" },
-  { code: "23503", raised_by: "_booking_availability,_checklist_instantiate,_containment_guard,_field_document_for,_pipeline_stage_key,_record_rule_uses,agg_digest_assemble,anon_publish,anon_rate_take,anon_token_issue,anon_write,assert_organization_wall,booking_cancel,booking_confirm,booking_declare,booking_hold,booking_reschedule,capture_publish,checklist_declare,checklist_steps_table,comment_write,dashboard_declare,delete_rule,doc_sign,doc_template_save,enrich_declare,enrich_due,enrich_land,form_declare,form_submit,home_add,inbound_declare,inbound_mail_land,inbound_set,io_comment_write,io_import_begin,io_import_finish,io_import_report,io_import_rows,io_proposal_accept,migrate_demote,migrate_promote,pipeline_board,pipeline_declare,pipeline_move,pipeline_read,pipeline_transition_refusal,promote_field,promote_table,record_applicability,record_reparent,relation_carry,relation_own,resolve_first_match,rule_applies,rule_declare,rule_eval,rule_members,rule_run,sign_request_create,subscription_mute,subscription_preview,view_declare,work_set_state,work_take_assignment,work_template_instantiate" },
+  { code: "22023", raised_by: "_booking_availability,_entity_custom_fields_guard,_take_op_id,_value_envelope,_work_shape_guard,actor_word,agg_assert_key,agg_sql,anon_token_issue,booking_declare,containment_parent,dashboard_block_normalize,dashboard_window_sql,doc_render_body,doc_render_write,doc_signature_write,enrich_declare,enrich_land,enrich_normalize,enrich_pin,entity_value_write,external_history_event,external_source_declare,external_stub_upsert,external_write_through,field_history,io_export,io_import_begin,io_import_finish,io_import_plan,io_import_report,io_proposal_accept,migrate_merge,migrate_reclass,my_levels,organization_clear,page_size,pin_agent_cells,pipeline_move,portal_declare,provenance_write,query_by_coordinates,query_rollup,record_update,record_write_many,relation_carry,rule_eval,rule_members,share_grant,share_lane_set,sign_request_create,sign_request_sign,subscription_declare,table_rules,visibility_as_of,work_approval_request,work_list,work_slot_hold" },
+  { code: "23503", raised_by: "_booking_availability,_checklist_instantiate,_containment_guard,_display_spec_for,_field_document_for,_pipeline_stage_key,_record_rule_uses,agg_digest_assemble,anon_publish,anon_rate_take,anon_token_issue,anon_write,assert_organization_wall,booking_cancel,booking_confirm,booking_declare,booking_hold,booking_reschedule,capture_publish,checklist_declare,checklist_steps_table,comment_write,dashboard_declare,delete_rule,doc_sign,doc_template_save,enrich_declare,enrich_due,enrich_land,form_declare,form_submit,home_add,inbound_declare,inbound_mail_land,inbound_set,io_comment_write,io_import_begin,io_import_finish,io_import_report,io_import_rows,io_proposal_accept,migrate_demote,migrate_promote,pipeline_board,pipeline_declare,pipeline_move,pipeline_read,pipeline_transition_refusal,promote_field,promote_table,record_applicability,record_reparent,relation_carry,relation_own,resolve_first_match,rule_applies,rule_declare,rule_eval,rule_members,rule_run,sign_request_create,subscription_mute,subscription_preview,view_declare,work_set_state,work_take_assignment,work_template_instantiate" },
   { code: "23505", raised_by: "_unique_rule_holds,doc_sign,doc_signature_write,entity_field_declare,field_declare,home_add,inbound_declare,io_proposal_accept,relation_carry,relation_own,share_grant,sign_request_cancel,sign_request_create,table_share_outside_invite,table_share_outside_resend,work_approval_decide,work_slot_hold" },
-  { code: "23514", raised_by: "_checklist_instantiate,_checklist_step_guard,_containment_guard,_dated_values_guard,_derived_fields,_entity_custom_fields_guard,_field_class_guard,_field_document_for,_field_shape_guard,_field_type_parity_guard,_merge_field_shape_guard,_merge_field_temporal_guard,_promoted_field_cap_guard,_record_rule_uses,_resolve_choice_words,_rule_shape_guard,_rule_topology_guard,_store_relation_edge_names_its_field,_table_columns_word_guard,_table_shape_guard,_undeclared_key_guard,_value_envelope,_work_shape_guard,_workdoors_approval_guard,assert_columns_are_defined,assert_entity_is_organization_scoped,capture_publish,capture_sheet_declare,checklist_declare,checklist_step_complete,doc_sign,doc_signature_write,doc_template_save,entity_field_declare,entity_field_retire,entity_field_update,entity_records_find,entity_table,field_declare,field_retire,field_update,home_add,io_import_rows,migrate_merge,relation_carry,relation_own,sign_request_create,sign_request_sign,table_declare,validate_value_envelope,validate_values,work_set_state,work_slots_declare,work_take_assignment,work_template_instantiate" },
+  { code: "23514", raised_by: "_checklist_instantiate,_checklist_step_guard,_containment_guard,_dated_values_guard,_derived_fields,_display_spec_for,_entity_custom_fields_guard,_field_class_guard,_field_document_for,_field_shape_guard,_field_type_parity_guard,_merge_field_shape_guard,_merge_field_temporal_guard,_promoted_field_cap_guard,_record_rule_uses,_resolve_choice_words,_rule_shape_guard,_rule_topology_guard,_store_relation_edge_names_its_field,_table_columns_word_guard,_table_shape_guard,_undeclared_key_guard,_value_envelope,_with_display,_work_shape_guard,_workdoors_approval_guard,assert_columns_are_defined,assert_entity_is_organization_scoped,booking_declare,capture_publish,capture_sheet_declare,checklist_declare,checklist_step_complete,doc_sign,doc_signature_write,doc_template_save,entity_field_declare,entity_field_retire,entity_field_update,entity_records_find,entity_table,field_declare,field_retire,field_update,home_add,io_import_rows,migrate_merge,relation_carry,relation_own,sign_request_create,sign_request_sign,table_declare,validate_value_envelope,validate_values,work_set_state,work_slots_declare,work_take_assignment,work_template_instantiate" },
   { code: "40001", raised_by: "has_visibility_at" },
-  { code: "42501", raised_by: "_doc_render_immutable,_doc_signature_immutable,_field_definition_write,_field_write_door,_rule_definition_write,_store_door,anon_capture,anon_inbound_land,anon_publish,anon_token_issue,anon_token_verify,anon_write,assert_client_may_change,assert_client_may_open,assert_client_may_reach,assert_may_know_table,assert_organization_admin,assert_store_door,booking_confirm,booking_declare,booking_hold,capture_submit,checklist_run,comment_write,conversation_scope_bind,conversation_scope_unbind,enrich_declare,enrich_due,enrich_land,enrich_normalize,entity_field_declare,entity_field_retire,entity_field_update,entity_value_write,external_write_through,form_declare,form_submit,inbound_mail_land,io_comment_resolve,io_comment_write,io_import_begin,io_import_finish,io_restore,migrate_purge,migrate_reclass,my_levels,organization_clear,portal_declare,portal_invitation,portal_invite,portal_principal_bind,promote_table,query_visibility_parity,read_record,read_records,record_table,share_grant,subscription_mute,subscription_preview,table_share_outside_accept,table_share_outside_invite,table_share_outside_resend,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_person" },
+  { code: "42501", raised_by: "_doc_render_immutable,_doc_signature_immutable,_field_definition_write,_field_write_door,_rule_definition_write,_store_door,anon_capture,anon_inbound_land,anon_publish,anon_token_issue,anon_token_verify,anon_write,assert_client_may_change,assert_client_may_open,assert_client_may_reach,assert_may_know_table,assert_organization_admin,assert_store_door,booking_confirm,booking_declare,booking_hold,capture_submit,checklist_run,comment_write,conversation_scope_bind,conversation_scope_unbind,enrich_declare,enrich_due,enrich_land,enrich_normalize,entity_field_declare,entity_field_retire,entity_field_update,entity_value_write,external_write_through,form_declare,form_submit,inbound_mail_land,io_comment_resolve,io_comment_write,io_import_begin,io_import_finish,io_restore,migrate_purge,migrate_reclass,my_levels,organization_clear,portal_declare,portal_invitation,portal_invite,portal_principal_bind,promote_table,query_visibility_parity,read_record,read_records,read_records_by_ids,record_table,share_grant,subscription_mute,subscription_preview,table_share_outside_accept,table_share_outside_invite,table_share_outside_resend,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_person" },
   { code: "42703", raised_by: "entity_table,portal_declare" },
   { code: "53400", raised_by: "anon_rate_take,delete_cascade_closure,enrich_due,enrich_land,promote_field" },
   { code: "54001", raised_by: "record_delete" },
@@ -2196,10 +2239,12 @@ export {
   choiceValuesOf,
   choicesOf,
   err,
+  forgetAllOps,
   highestLevel,
   holdsARetiredChoice,
   indexedDbStore,
   isDecided,
+  isOwnOp,
   isRecordsErr,
   isTheChosen,
   looksLikeAnId,
@@ -2207,12 +2252,14 @@ export {
   measureKey,
   memoryStore,
   mintClientKey,
+  mintOpId,
   ok,
   openCaptureQueue,
   optionKey,
   optionLabel,
   portalPath,
   publicFormPath,
+  rememberedOpCount,
   scopeChip
 };
 //# sourceMappingURL=index.js.map