@ai-matrx/records 0.47.0 → 0.49.0

package/dist/react/index.d.cts

@@ -2103,6 +2103,11 @@ declare const STORE_DOORS: readonly [{
     readonly args: "p_organization_id uuid, p_table_id uuid, p_record_ids uuid[], p_by_id boolean DEFAULT false";
     readonly returns: "TABLE(id uuid, document jsonb, level permission_level)";
     readonly security: "definer";
+}, {
+    readonly name: "read_records_matching";
+    readonly args: "p_organization_id uuid, p_table_id uuid, p_filter jsonb DEFAULT '{}'::jsonb, p_by_id boolean DEFAULT false, p_limit integer DEFAULT 200, p_offset integer DEFAULT 0";
+    readonly returns: "TABLE(id uuid, document jsonb, level permission_level)";
+    readonly security: "definer";
 }, {
     readonly name: "realtime_topic_admits";
     readonly args: "p_topic text";
@@ -5142,6 +5147,19 @@ interface PortalPrincipal {
     is_active: boolean;
     invited_at: Timestamp;
     revoked_at: Timestamp | null;
+    /**
+     * THE LINK THE OFFICE COPIES FOR THIS PERSON — `/invitations/portal/accept/<token>`, the
+     * path `custom.portal_invite` handed back when they were asked, read off the same
+     * `iam.invitations` row and never re-templated.
+     *
+     * 🚨 `null` IS AN ANSWER, NOT AN ABSENCE, and a screen must say which. It is null when they
+     * have already followed the link, when the office took it back (a revoke withdraws the
+     * invitation in the same statement), when it has expired, or when they were let in through
+     * the server's own magic-link route, which binds without an invitation at all. In every one
+     * of those cases there is genuinely no link to copy — so draw a sentence, never a dead
+     * control. (TAILS-5, 2026-09-21; the gap PORTAL-BIND left named.)
+     */
+    accept_path: string | null;
 }
 /** Everything about ONE portal: what it shows, and who it was opened to. */
 interface PortalCard {
@@ -5223,6 +5241,25 @@ interface AggregateWindow {
  * caller should get from the compiler, not from the database.
  */
 type AggregateFilter = string | number | boolean | null | AggregateWindow;
+/**
+ * 🚨 THE STORE'S ONE FILTER SHAPE, AND THE ONLY NAME FOR IT.
+ *
+ * An object of Field key -> value. A scalar is an equality, `null` is UNSET
+ * (the third state of a tick box), an object is a half-open time window.
+ *
+ * It is not the aggregate's private shape and never was. `platform.saved_view`
+ * has carried exactly this as `definition -> 'filters'` across five live
+ * surface keys since DOOR-18; `custom.view_declare` writes it;
+ * `custom.agg_view_admits` reads it to decide whether a change belongs to a
+ * saved view; `custom.record_aggregate` takes it as `p_filter` to COMPUTE a
+ * dashboard number; and `custom.read_records_matching` takes it to OPEN the
+ * rows behind that number. One `custom.record_filter_sql` in the database turns
+ * it into SQL for the last two, so the number and the rows cannot disagree.
+ *
+ * Invent a second one and a chart can compute a total whose drill-through
+ * lands somewhere else, which is the only way a drill-through can lie.
+ */
+type RecordFilter = Record<string, AggregateFilter>;
 /** One measure. `count` counts rows and needs no Field; the rest read one. */
 interface AggregateMeasure {
     op: AggregateOperation;
@@ -5241,6 +5278,19 @@ interface AggregateRow {
 }
 /** The measure key the store answers with, so a chart can find its own series. */
 declare function measureKey(measure: AggregateMeasure): string;
+/**
+ * THE QUESTION, AS A STABLE STRING — key-sorted JSON of a `RecordFilter`.
+ *
+ * A React parent that rebuilds `{ status: "Cancelled" }` on every render hands
+ * a NEW object every time, and a hook that depends on the object re-reads the
+ * whole page on every render forever. Depending on this instead means the page
+ * is re-read exactly when the QUESTION changed, which is what a person means.
+ *
+ * Nested window objects are sorted too, so `{from, to}` and `{to, from}` are
+ * one question. `undefined` and an empty filter are both `"{}"` — the caller
+ * asked nothing, and there is only one way to ask nothing.
+ */
+declare function stableFilterKey(filter: RecordFilter | null | undefined): string;
 
 /** The seven shapes a block can take, exactly as `custom.dashboard_kinds()` answers. */
 type DashboardBlockKind = "number" | "bar" | "column" | "line" | "donut" | "table" | "stuck";
@@ -6070,13 +6120,13 @@ interface SavedViewRow {
     view_id: Uuid;
     name: string;
     table_id: Uuid | null;
-    filters: Record<string, unknown>;
+    filters: RecordFilter;
     created_at: string;
 }
 /** What `custom.view_declare` is asked for. `view_id` re-states rather than doubling. */
 interface SavedViewSpecIn {
     name: string;
-    filters?: Record<string, unknown> | null;
+    filters?: RecordFilter | null;
     definition?: Record<string, unknown> | null;
     view_id?: Uuid | null;
 }
@@ -7085,6 +7135,17 @@ interface RecordsClient {
      */
     list(args: {
         table_id: Uuid;
+        /**
+         * THE STORE'S ONE FILTER SHAPE (`RecordFilter`). Left out, this is the
+         * whole page. Supplied, the store narrows INSIDE its own query — never the
+         * browser, which can only ever filter the rows it was already allowed to
+         * see and would silently drop the rest of the answer.
+         *
+         * It is the same object a saved view stores as `filters` and the same one
+         * `recordAggregate` counts with, so the rows a drill-through opens are the
+         * rows the number on the dashboard counted.
+         */
+        filter?: RecordFilter;
         limit?: number;
         offset?: number;
     }): Promise<RecordsResult<{
@@ -7562,14 +7623,14 @@ interface RecordsClient {
      */
     dashboardRun(args: {
         dashboard_id: Uuid;
-        filter?: Record<string, AggregateFilter>;
+        filter?: RecordFilter;
     }): Promise<RecordsResult<DashboardRunResult>>;
     /** The seventh block kind on its own: records that have sat on the same value too long. */
     dashboardStuck(args: {
         table_id: Uuid;
         state_key: string;
         days?: number;
-        filter?: Record<string, AggregateFilter>;
+        filter?: RecordFilter;
         limit?: number;
     }): Promise<RecordsResult<StuckRow[]>>;
     /**
@@ -7688,7 +7749,7 @@ interface RecordsClient {
          * A scalar is an equality and an object is a half-open moment window, and
          * either way it lands in the SAME WHERE as visibility.
          */
-        filter?: Record<string, AggregateFilter>;
+        filter?: RecordFilter;
         limit?: number;
     }): Promise<RecordsResult<AggregateRow[]>>;
     /** The measures the store itself offers. Asked, never hardcoded in a picker. */
@@ -8430,6 +8491,16 @@ declare function useFields(tableId: Uuid | null, recordType?: string): Async<Fie
 interface UseRecordsOptions {
     pageSize?: number;
     page?: number;
+    /**
+     * THE STORE'S ONE FILTER SHAPE. Left out, this is the whole page. Supplied,
+     * the store narrows in its own query and the hook re-reads when the question
+     * changes — it is never filtered in the browser, which could only ever filter
+     * the rows it had already been handed and would silently drop the rest.
+     *
+     * This is what makes a dashboard number walkable: the same object that
+     * counted it opens it.
+     */
+    filter?: RecordFilter;
 }
 interface UseRecordsState extends Async<{
     rows: ReadRow[];
@@ -8564,4 +8635,4 @@ declare function useFieldMutation(): UseFieldMutation;
  */
 declare function useMergeField(key: string | null, state?: Record<string, unknown>): MergeFieldResolution | null;
 
-export { ABSENCE_REASONS, ACTOR_VOCABULARY, type AbsenceReason, type Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type BookingAvailability, type BookingDeclared, type BookingSummary, type BookingWindow, COMPUTE_ON, CONTEXT_POLICIES, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type ChoiceOptions, type CoerceOptions, type Coerced, type CoercedAnswers, type CoercibleField, type CommentThreadRead, type CommentWritten, type ComputeOn, type ContextPolicy, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, DELIVERIES, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, type Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, ENTITY_TOKENS, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type EntityToken, type ExternalPrincipalCard, FIELD_KINDS, FIELD_SENSITIVITIES, FIELD_SOURCES, FRESHNESS, type Field, type FieldBehavior, type FieldHistoryEntry, type FieldKind, type FieldPatch, type FieldProposal, type FieldRule, type FieldSensitivity, type FieldSource, type FieldTypeWord, type ForbiddenEnvelopeWord, type FormSummary, type Freshness, type HiddenFieldNotice, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, KERNEL_TABLES, type KernelTableName, type KernelTargets, MERGE_FIELD_MODIFIERS, MERGE_FIELD_SEMANTIC_TYPES, MERGE_FIELD_SOURCES, type MergeField, type MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, type MergeFieldSemanticType, type MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, type NewFieldDeclaration, ON_DELETE, OVERRIDE_POLICIES, type OnDelete, type OverridePolicy, PARITY_FIELD_TYPES, PERMISSION_LEVELS, PER_VALUE_ACCESS_WORDS, PIPELINE_RULE_KINDS, type ParityFieldType, type ParityFieldTypeDescriptor, type PerValueAccessWord, type PermissionLevel, type PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineGate, type PipelineGatePreview, type PipelineMissingField, type PipelineMoveResult, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PortalTableRef, type PredictedRefusal, type ProvenancePointer, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, RELATION_BINDINGS, RELATION_CARDINALITIES, RELATION_FLAVORS, RETIRED_ACTOR_WORDS, RULE_NODE_KINDS, RULE_USES, type ReadRow, type ReadValue, type RecordComment, type RecordDocument, type RecordHistoryEntry, type RecordRead, type RecordRevision, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsChangeSink, type RecordsConfig, type RecordsDataSource, type RecordsError, type RecordsErrorCode, type RecordsErrorSink, type RecordsFilter, RecordsProvider, type RecordsProviderProps, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsResult, type RecordsTableQuery, type RegisteredTable, type Relation, type RelationBinding, type RelationCardinality, type RelationCarries, type RelationCoordinate, type RelationDisplay, type RelationFlavor, type RelationProperties, type RelationTarget, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type RetiredActorWord, type Rule, type RuleAnswer, type RuleExpression, type RuleNodeKind, type RuleUse, STAGE_RULE_ENFORCEMENT, STAGE_RULE_ON_FAIL, STORAGE_MODES, STORE_DOORS, STORE_KNOBS, STORE_REFUSAL_CODES, type SavedViewRow, type SavedViewSpecIn, type StagePending, type StagePendingOnBoard, type StageRuleEnforcement, type StageRuleOnFail, type StageRuleWarning, type StaleWriteDetail, type StorageMode, type StoreDoorName, type StoreRefusalCode, type StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, TABLE_DISPLAYS, TABLE_ORIGINS, TABLE_TYPES, type Table, type TableCapacity, type TableDisplay, type TableOrigin, type TableProposal, type TableType, type Timestamp, type UseEntityFieldMutation, type UseFieldMutation, type UseRecordMutation, type UseRecordsOptions, type UseRecordsState, type Uuid, VALUE_ALTERNATE_KEYS, VALUE_ENVELOPE_KEYS, type ValueAlternate, type ValueAlternateKey, type ValueEnvelope, type ValueEnvelopeKey, type ValueSource, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, type WriteConflict, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, coerceTypedAnswer, coerceTypedAnswers, coercionLabel, err, fieldKindFor, forgetAllOps, highestLevel, holdsARetiredChoice, indexedDbStore, isDecided, isOwnOp, isRecordsErr, isTheChosen, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, mintOpId, ok, openCaptureQueue, optionKey, optionLabel, portalPath, publicFormPath, rememberedOpCount, scopeChip, tableShapeChanged, useEntityFieldMutation, useEntityFieldRights, useEntityFields, useEntityRecord, useEntityTable, useFieldMutation, useFields, useMergeField, useMyLevel, useMyLevels, useOptionalRecordsClient, useRecord, useRecordMutation, useRecords, useRecordsActor, useRecordsClient, useTable, useTables };
+export { ABSENCE_REASONS, ACTOR_VOCABULARY, type AbsenceReason, type Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type BookingAvailability, type BookingDeclared, type BookingSummary, type BookingWindow, COMPUTE_ON, CONTEXT_POLICIES, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type ChoiceOptions, type CoerceOptions, type Coerced, type CoercedAnswers, type CoercibleField, type CommentThreadRead, type CommentWritten, type ComputeOn, type ContextPolicy, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, DELIVERIES, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, type Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, ENTITY_TOKENS, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type EntityToken, type ExternalPrincipalCard, FIELD_KINDS, FIELD_SENSITIVITIES, FIELD_SOURCES, FRESHNESS, type Field, type FieldBehavior, type FieldHistoryEntry, type FieldKind, type FieldPatch, type FieldProposal, type FieldRule, type FieldSensitivity, type FieldSource, type FieldTypeWord, type ForbiddenEnvelopeWord, type FormSummary, type Freshness, type HiddenFieldNotice, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, KERNEL_TABLES, type KernelTableName, type KernelTargets, MERGE_FIELD_MODIFIERS, MERGE_FIELD_SEMANTIC_TYPES, MERGE_FIELD_SOURCES, type MergeField, type MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, type MergeFieldSemanticType, type MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, type NewFieldDeclaration, ON_DELETE, OVERRIDE_POLICIES, type OnDelete, type OverridePolicy, PARITY_FIELD_TYPES, PERMISSION_LEVELS, PER_VALUE_ACCESS_WORDS, PIPELINE_RULE_KINDS, type ParityFieldType, type ParityFieldTypeDescriptor, type PerValueAccessWord, type PermissionLevel, type PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineGate, type PipelineGatePreview, type PipelineMissingField, type PipelineMoveResult, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PortalTableRef, type PredictedRefusal, type ProvenancePointer, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, RELATION_BINDINGS, RELATION_CARDINALITIES, RELATION_FLAVORS, RETIRED_ACTOR_WORDS, RULE_NODE_KINDS, RULE_USES, type ReadRow, type ReadValue, type RecordComment, type RecordDocument, type RecordFilter, type RecordHistoryEntry, type RecordRead, type RecordRevision, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsChangeSink, type RecordsConfig, type RecordsDataSource, type RecordsError, type RecordsErrorCode, type RecordsErrorSink, type RecordsFilter, RecordsProvider, type RecordsProviderProps, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsResult, type RecordsTableQuery, type RegisteredTable, type Relation, type RelationBinding, type RelationCardinality, type RelationCarries, type RelationCoordinate, type RelationDisplay, type RelationFlavor, type RelationProperties, type RelationTarget, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type RetiredActorWord, type Rule, type RuleAnswer, type RuleExpression, type RuleNodeKind, type RuleUse, STAGE_RULE_ENFORCEMENT, STAGE_RULE_ON_FAIL, STORAGE_MODES, STORE_DOORS, STORE_KNOBS, STORE_REFUSAL_CODES, type SavedViewRow, type SavedViewSpecIn, type StagePending, type StagePendingOnBoard, type StageRuleEnforcement, type StageRuleOnFail, type StageRuleWarning, type StaleWriteDetail, type StorageMode, type StoreDoorName, type StoreRefusalCode, type StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, TABLE_DISPLAYS, TABLE_ORIGINS, TABLE_TYPES, type Table, type TableCapacity, type TableDisplay, type TableOrigin, type TableProposal, type TableType, type Timestamp, type UseEntityFieldMutation, type UseFieldMutation, type UseRecordMutation, type UseRecordsOptions, type UseRecordsState, type Uuid, VALUE_ALTERNATE_KEYS, VALUE_ENVELOPE_KEYS, type ValueAlternate, type ValueAlternateKey, type ValueEnvelope, type ValueEnvelopeKey, type ValueSource, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, type WriteConflict, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, coerceTypedAnswer, coerceTypedAnswers, coercionLabel, err, fieldKindFor, forgetAllOps, highestLevel, holdsARetiredChoice, indexedDbStore, isDecided, isOwnOp, isRecordsErr, isTheChosen, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, mintOpId, ok, openCaptureQueue, optionKey, optionLabel, portalPath, publicFormPath, rememberedOpCount, scopeChip, stableFilterKey, tableShapeChanged, useEntityFieldMutation, useEntityFieldRights, useEntityFields, useEntityRecord, useEntityTable, useFieldMutation, useFields, useMergeField, useMyLevel, useMyLevels, useOptionalRecordsClient, useRecord, useRecordMutation, useRecords, useRecordsActor, useRecordsClient, useTable, useTables };

package/dist/react/index.d.ts

@@ -2103,6 +2103,11 @@ declare const STORE_DOORS: readonly [{
     readonly args: "p_organization_id uuid, p_table_id uuid, p_record_ids uuid[], p_by_id boolean DEFAULT false";
     readonly returns: "TABLE(id uuid, document jsonb, level permission_level)";
     readonly security: "definer";
+}, {
+    readonly name: "read_records_matching";
+    readonly args: "p_organization_id uuid, p_table_id uuid, p_filter jsonb DEFAULT '{}'::jsonb, p_by_id boolean DEFAULT false, p_limit integer DEFAULT 200, p_offset integer DEFAULT 0";
+    readonly returns: "TABLE(id uuid, document jsonb, level permission_level)";
+    readonly security: "definer";
 }, {
     readonly name: "realtime_topic_admits";
     readonly args: "p_topic text";
@@ -5142,6 +5147,19 @@ interface PortalPrincipal {
     is_active: boolean;
     invited_at: Timestamp;
     revoked_at: Timestamp | null;
+    /**
+     * THE LINK THE OFFICE COPIES FOR THIS PERSON — `/invitations/portal/accept/<token>`, the
+     * path `custom.portal_invite` handed back when they were asked, read off the same
+     * `iam.invitations` row and never re-templated.
+     *
+     * 🚨 `null` IS AN ANSWER, NOT AN ABSENCE, and a screen must say which. It is null when they
+     * have already followed the link, when the office took it back (a revoke withdraws the
+     * invitation in the same statement), when it has expired, or when they were let in through
+     * the server's own magic-link route, which binds without an invitation at all. In every one
+     * of those cases there is genuinely no link to copy — so draw a sentence, never a dead
+     * control. (TAILS-5, 2026-09-21; the gap PORTAL-BIND left named.)
+     */
+    accept_path: string | null;
 }
 /** Everything about ONE portal: what it shows, and who it was opened to. */
 interface PortalCard {
@@ -5223,6 +5241,25 @@ interface AggregateWindow {
  * caller should get from the compiler, not from the database.
  */
 type AggregateFilter = string | number | boolean | null | AggregateWindow;
+/**
+ * 🚨 THE STORE'S ONE FILTER SHAPE, AND THE ONLY NAME FOR IT.
+ *
+ * An object of Field key -> value. A scalar is an equality, `null` is UNSET
+ * (the third state of a tick box), an object is a half-open time window.
+ *
+ * It is not the aggregate's private shape and never was. `platform.saved_view`
+ * has carried exactly this as `definition -> 'filters'` across five live
+ * surface keys since DOOR-18; `custom.view_declare` writes it;
+ * `custom.agg_view_admits` reads it to decide whether a change belongs to a
+ * saved view; `custom.record_aggregate` takes it as `p_filter` to COMPUTE a
+ * dashboard number; and `custom.read_records_matching` takes it to OPEN the
+ * rows behind that number. One `custom.record_filter_sql` in the database turns
+ * it into SQL for the last two, so the number and the rows cannot disagree.
+ *
+ * Invent a second one and a chart can compute a total whose drill-through
+ * lands somewhere else, which is the only way a drill-through can lie.
+ */
+type RecordFilter = Record<string, AggregateFilter>;
 /** One measure. `count` counts rows and needs no Field; the rest read one. */
 interface AggregateMeasure {
     op: AggregateOperation;
@@ -5241,6 +5278,19 @@ interface AggregateRow {
 }
 /** The measure key the store answers with, so a chart can find its own series. */
 declare function measureKey(measure: AggregateMeasure): string;
+/**
+ * THE QUESTION, AS A STABLE STRING — key-sorted JSON of a `RecordFilter`.
+ *
+ * A React parent that rebuilds `{ status: "Cancelled" }` on every render hands
+ * a NEW object every time, and a hook that depends on the object re-reads the
+ * whole page on every render forever. Depending on this instead means the page
+ * is re-read exactly when the QUESTION changed, which is what a person means.
+ *
+ * Nested window objects are sorted too, so `{from, to}` and `{to, from}` are
+ * one question. `undefined` and an empty filter are both `"{}"` — the caller
+ * asked nothing, and there is only one way to ask nothing.
+ */
+declare function stableFilterKey(filter: RecordFilter | null | undefined): string;
 
 /** The seven shapes a block can take, exactly as `custom.dashboard_kinds()` answers. */
 type DashboardBlockKind = "number" | "bar" | "column" | "line" | "donut" | "table" | "stuck";
@@ -6070,13 +6120,13 @@ interface SavedViewRow {
     view_id: Uuid;
     name: string;
     table_id: Uuid | null;
-    filters: Record<string, unknown>;
+    filters: RecordFilter;
     created_at: string;
 }
 /** What `custom.view_declare` is asked for. `view_id` re-states rather than doubling. */
 interface SavedViewSpecIn {
     name: string;
-    filters?: Record<string, unknown> | null;
+    filters?: RecordFilter | null;
     definition?: Record<string, unknown> | null;
     view_id?: Uuid | null;
 }
@@ -7085,6 +7135,17 @@ interface RecordsClient {
      */
     list(args: {
         table_id: Uuid;
+        /**
+         * THE STORE'S ONE FILTER SHAPE (`RecordFilter`). Left out, this is the
+         * whole page. Supplied, the store narrows INSIDE its own query — never the
+         * browser, which can only ever filter the rows it was already allowed to
+         * see and would silently drop the rest of the answer.
+         *
+         * It is the same object a saved view stores as `filters` and the same one
+         * `recordAggregate` counts with, so the rows a drill-through opens are the
+         * rows the number on the dashboard counted.
+         */
+        filter?: RecordFilter;
         limit?: number;
         offset?: number;
     }): Promise<RecordsResult<{
@@ -7562,14 +7623,14 @@ interface RecordsClient {
      */
     dashboardRun(args: {
         dashboard_id: Uuid;
-        filter?: Record<string, AggregateFilter>;
+        filter?: RecordFilter;
     }): Promise<RecordsResult<DashboardRunResult>>;
     /** The seventh block kind on its own: records that have sat on the same value too long. */
     dashboardStuck(args: {
         table_id: Uuid;
         state_key: string;
         days?: number;
-        filter?: Record<string, AggregateFilter>;
+        filter?: RecordFilter;
         limit?: number;
     }): Promise<RecordsResult<StuckRow[]>>;
     /**
@@ -7688,7 +7749,7 @@ interface RecordsClient {
          * A scalar is an equality and an object is a half-open moment window, and
          * either way it lands in the SAME WHERE as visibility.
          */
-        filter?: Record<string, AggregateFilter>;
+        filter?: RecordFilter;
         limit?: number;
     }): Promise<RecordsResult<AggregateRow[]>>;
     /** The measures the store itself offers. Asked, never hardcoded in a picker. */
@@ -8430,6 +8491,16 @@ declare function useFields(tableId: Uuid | null, recordType?: string): Async<Fie
 interface UseRecordsOptions {
     pageSize?: number;
     page?: number;
+    /**
+     * THE STORE'S ONE FILTER SHAPE. Left out, this is the whole page. Supplied,
+     * the store narrows in its own query and the hook re-reads when the question
+     * changes — it is never filtered in the browser, which could only ever filter
+     * the rows it had already been handed and would silently drop the rest.
+     *
+     * This is what makes a dashboard number walkable: the same object that
+     * counted it opens it.
+     */
+    filter?: RecordFilter;
 }
 interface UseRecordsState extends Async<{
     rows: ReadRow[];
@@ -8564,4 +8635,4 @@ declare function useFieldMutation(): UseFieldMutation;
  */
 declare function useMergeField(key: string | null, state?: Record<string, unknown>): MergeFieldResolution | null;
 
-export { ABSENCE_REASONS, ACTOR_VOCABULARY, type AbsenceReason, type Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type BookingAvailability, type BookingDeclared, type BookingSummary, type BookingWindow, COMPUTE_ON, CONTEXT_POLICIES, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type ChoiceOptions, type CoerceOptions, type Coerced, type CoercedAnswers, type CoercibleField, type CommentThreadRead, type CommentWritten, type ComputeOn, type ContextPolicy, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, DELIVERIES, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, type Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, ENTITY_TOKENS, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type EntityToken, type ExternalPrincipalCard, FIELD_KINDS, FIELD_SENSITIVITIES, FIELD_SOURCES, FRESHNESS, type Field, type FieldBehavior, type FieldHistoryEntry, type FieldKind, type FieldPatch, type FieldProposal, type FieldRule, type FieldSensitivity, type FieldSource, type FieldTypeWord, type ForbiddenEnvelopeWord, type FormSummary, type Freshness, type HiddenFieldNotice, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, KERNEL_TABLES, type KernelTableName, type KernelTargets, MERGE_FIELD_MODIFIERS, MERGE_FIELD_SEMANTIC_TYPES, MERGE_FIELD_SOURCES, type MergeField, type MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, type MergeFieldSemanticType, type MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, type NewFieldDeclaration, ON_DELETE, OVERRIDE_POLICIES, type OnDelete, type OverridePolicy, PARITY_FIELD_TYPES, PERMISSION_LEVELS, PER_VALUE_ACCESS_WORDS, PIPELINE_RULE_KINDS, type ParityFieldType, type ParityFieldTypeDescriptor, type PerValueAccessWord, type PermissionLevel, type PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineGate, type PipelineGatePreview, type PipelineMissingField, type PipelineMoveResult, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PortalTableRef, type PredictedRefusal, type ProvenancePointer, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, RELATION_BINDINGS, RELATION_CARDINALITIES, RELATION_FLAVORS, RETIRED_ACTOR_WORDS, RULE_NODE_KINDS, RULE_USES, type ReadRow, type ReadValue, type RecordComment, type RecordDocument, type RecordHistoryEntry, type RecordRead, type RecordRevision, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsChangeSink, type RecordsConfig, type RecordsDataSource, type RecordsError, type RecordsErrorCode, type RecordsErrorSink, type RecordsFilter, RecordsProvider, type RecordsProviderProps, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsResult, type RecordsTableQuery, type RegisteredTable, type Relation, type RelationBinding, type RelationCardinality, type RelationCarries, type RelationCoordinate, type RelationDisplay, type RelationFlavor, type RelationProperties, type RelationTarget, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type RetiredActorWord, type Rule, type RuleAnswer, type RuleExpression, type RuleNodeKind, type RuleUse, STAGE_RULE_ENFORCEMENT, STAGE_RULE_ON_FAIL, STORAGE_MODES, STORE_DOORS, STORE_KNOBS, STORE_REFUSAL_CODES, type SavedViewRow, type SavedViewSpecIn, type StagePending, type StagePendingOnBoard, type StageRuleEnforcement, type StageRuleOnFail, type StageRuleWarning, type StaleWriteDetail, type StorageMode, type StoreDoorName, type StoreRefusalCode, type StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, TABLE_DISPLAYS, TABLE_ORIGINS, TABLE_TYPES, type Table, type TableCapacity, type TableDisplay, type TableOrigin, type TableProposal, type TableType, type Timestamp, type UseEntityFieldMutation, type UseFieldMutation, type UseRecordMutation, type UseRecordsOptions, type UseRecordsState, type Uuid, VALUE_ALTERNATE_KEYS, VALUE_ENVELOPE_KEYS, type ValueAlternate, type ValueAlternateKey, type ValueEnvelope, type ValueEnvelopeKey, type ValueSource, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, type WriteConflict, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, coerceTypedAnswer, coerceTypedAnswers, coercionLabel, err, fieldKindFor, forgetAllOps, highestLevel, holdsARetiredChoice, indexedDbStore, isDecided, isOwnOp, isRecordsErr, isTheChosen, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, mintOpId, ok, openCaptureQueue, optionKey, optionLabel, portalPath, publicFormPath, rememberedOpCount, scopeChip, tableShapeChanged, useEntityFieldMutation, useEntityFieldRights, useEntityFields, useEntityRecord, useEntityTable, useFieldMutation, useFields, useMergeField, useMyLevel, useMyLevels, useOptionalRecordsClient, useRecord, useRecordMutation, useRecords, useRecordsActor, useRecordsClient, useTable, useTables };
+export { ABSENCE_REASONS, ACTOR_VOCABULARY, type AbsenceReason, type Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type BookingAvailability, type BookingDeclared, type BookingSummary, type BookingWindow, COMPUTE_ON, CONTEXT_POLICIES, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type ChoiceOptions, type CoerceOptions, type Coerced, type CoercedAnswers, type CoercibleField, type CommentThreadRead, type CommentWritten, type ComputeOn, type ContextPolicy, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, DELIVERIES, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, type Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, ENTITY_TOKENS, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type EntityToken, type ExternalPrincipalCard, FIELD_KINDS, FIELD_SENSITIVITIES, FIELD_SOURCES, FRESHNESS, type Field, type FieldBehavior, type FieldHistoryEntry, type FieldKind, type FieldPatch, type FieldProposal, type FieldRule, type FieldSensitivity, type FieldSource, type FieldTypeWord, type ForbiddenEnvelopeWord, type FormSummary, type Freshness, type HiddenFieldNotice, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, KERNEL_TABLES, type KernelTableName, type KernelTargets, MERGE_FIELD_MODIFIERS, MERGE_FIELD_SEMANTIC_TYPES, MERGE_FIELD_SOURCES, type MergeField, type MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, type MergeFieldSemanticType, type MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, type NewFieldDeclaration, ON_DELETE, OVERRIDE_POLICIES, type OnDelete, type OverridePolicy, PARITY_FIELD_TYPES, PERMISSION_LEVELS, PER_VALUE_ACCESS_WORDS, PIPELINE_RULE_KINDS, type ParityFieldType, type ParityFieldTypeDescriptor, type PerValueAccessWord, type PermissionLevel, type PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineGate, type PipelineGatePreview, type PipelineMissingField, type PipelineMoveResult, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PortalTableRef, type PredictedRefusal, type ProvenancePointer, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, RELATION_BINDINGS, RELATION_CARDINALITIES, RELATION_FLAVORS, RETIRED_ACTOR_WORDS, RULE_NODE_KINDS, RULE_USES, type ReadRow, type ReadValue, type RecordComment, type RecordDocument, type RecordFilter, type RecordHistoryEntry, type RecordRead, type RecordRevision, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsChangeSink, type RecordsConfig, type RecordsDataSource, type RecordsError, type RecordsErrorCode, type RecordsErrorSink, type RecordsFilter, RecordsProvider, type RecordsProviderProps, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsResult, type RecordsTableQuery, type RegisteredTable, type Relation, type RelationBinding, type RelationCardinality, type RelationCarries, type RelationCoordinate, type RelationDisplay, type RelationFlavor, type RelationProperties, type RelationTarget, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type RetiredActorWord, type Rule, type RuleAnswer, type RuleExpression, type RuleNodeKind, type RuleUse, STAGE_RULE_ENFORCEMENT, STAGE_RULE_ON_FAIL, STORAGE_MODES, STORE_DOORS, STORE_KNOBS, STORE_REFUSAL_CODES, type SavedViewRow, type SavedViewSpecIn, type StagePending, type StagePendingOnBoard, type StageRuleEnforcement, type StageRuleOnFail, type StageRuleWarning, type StaleWriteDetail, type StorageMode, type StoreDoorName, type StoreRefusalCode, type StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, TABLE_DISPLAYS, TABLE_ORIGINS, TABLE_TYPES, type Table, type TableCapacity, type TableDisplay, type TableOrigin, type TableProposal, type TableType, type Timestamp, type UseEntityFieldMutation, type UseFieldMutation, type UseRecordMutation, type UseRecordsOptions, type UseRecordsState, type Uuid, VALUE_ALTERNATE_KEYS, VALUE_ENVELOPE_KEYS, type ValueAlternate, type ValueAlternateKey, type ValueEnvelope, type ValueEnvelopeKey, type ValueSource, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, type WriteConflict, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, coerceTypedAnswer, coerceTypedAnswers, coercionLabel, err, fieldKindFor, forgetAllOps, highestLevel, holdsARetiredChoice, indexedDbStore, isDecided, isOwnOp, isRecordsErr, isTheChosen, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, mintOpId, ok, openCaptureQueue, optionKey, optionLabel, portalPath, publicFormPath, rememberedOpCount, scopeChip, stableFilterKey, tableShapeChanged, useEntityFieldMutation, useEntityFieldRights, useEntityFields, useEntityRecord, useEntityTable, useFieldMutation, useFields, useMergeField, useMyLevel, useMyLevels, useOptionalRecordsClient, useRecord, useRecordMutation, useRecords, useRecordsActor, useRecordsClient, useTable, useTables };

package/dist/react/index.js

@@ -530,6 +530,7 @@ var STORE_DOORS = [
   { name: "read_record", args: "p_organization_id uuid, p_record_id uuid, p_by_id boolean DEFAULT false", returns: "jsonb", security: "definer" },
   { name: "read_records", args: "p_organization_id uuid, p_table_id uuid, p_by_id boolean DEFAULT false, p_limit integer DEFAULT 200, p_offset integer DEFAULT 0", returns: "TABLE(id uuid, document jsonb, level permission_level)", security: "definer" },
   { name: "read_records_by_ids", args: "p_organization_id uuid, p_table_id uuid, p_record_ids uuid[], p_by_id boolean DEFAULT false", returns: "TABLE(id uuid, document jsonb, level permission_level)", security: "definer" },
+  { name: "read_records_matching", args: "p_organization_id uuid, p_table_id uuid, p_filter jsonb DEFAULT '{}'::jsonb, p_by_id boolean DEFAULT false, p_limit integer DEFAULT 200, p_offset integer DEFAULT 0", returns: "TABLE(id uuid, document jsonb, level permission_level)", security: "definer" },
   { name: "realtime_topic_admits", args: "p_topic text", returns: "boolean", security: "definer" },
   { name: "record_aggregate", args: "p_organization_id uuid, p_table_id uuid, p_group_by jsonb DEFAULT '[]'::jsonb, p_measures jsonb DEFAULT '[]'::jsonb, p_bucket jsonb DEFAULT NULL::jsonb, p_filter jsonb DEFAULT '{}'::jsonb, p_limit integer DEFAULT 200, p_required text DEFAULT 'viewer'::text", returns: "TABLE(groups jsonb, measures jsonb, row_count bigint)", security: "definer" },
   { name: "record_applicability", args: "p_organization_id uuid, p_record_id uuid", returns: "TABLE(rule_id uuid, rule_name text, rule_version integer, applies boolean, answer jsonb)", security: "invoker" },
@@ -1859,6 +1860,15 @@ var DOORS = {
   // live Postgres function makes every existing call ambiguous — `is not unique`. Same
   // ladder, same level, same masking, same page ceiling.
   readRecordsByIds: "read_records_by_ids",
+  // THE SAME READ DOOR, ADDRESSED BY A QUESTION. `custom.read_records_matching`
+  // takes the store's one filter shape (`RecordFilter` — the object
+  // `platform.saved_view` carries as `filters` and `custom.record_aggregate`
+  // takes as `p_filter`) and narrows the page INSIDE its own query, in the same
+  // WHERE as Visibility. A separate NAME for the same reason as above. It is
+  // what makes a number on a dashboard walkable: the filter is evaluated by
+  // `custom.record_filter_sql`, the one body `custom.agg_sql` also calls, so the
+  // rows it opens are the rows the number counted.
+  readRecordsMatching: "read_records_matching",
   // DOOR-8, the two clocks. `p_recorded_at` is what the store SAID then;
   // `p_world_on` is what was TRUE of the world on that date, read out of dated
   // values. A client that answered either one itself would be guessing.
@@ -2550,12 +2560,13 @@ function createRecordsClient(config) {
         })
       );
     },
-    async list({ table_id, limit = 50, offset = 0 }) {
+    async list({ table_id, filter, limit = 50, offset = 0 }) {
       const door = await callDoor(
-        DOORS.readRecords,
+        DOORS.readRecordsMatching,
         {
           p_organization_id: org,
           p_table_id: table_id,
+          p_filter: filter ?? {},
           p_limit: limit,
           p_offset: offset
         },
@@ -4264,6 +4275,27 @@ function useRecordsActor() {
 
 // src/react/hooks.ts
 import { useCallback, useEffect, useMemo as useMemo2, useRef, useState, useSyncExternalStore } from "react";
+
+// src/aggregate.ts
+function measureKey(measure) {
+  return measure.op === "count" ? "count" : `${measure.op}_${measure.key ?? ""}`;
+}
+function stableFilterKey(filter) {
+  if (!filter) return "{}";
+  const keys = Object.keys(filter).sort();
+  if (keys.length === 0) return "{}";
+  const parts = keys.map((key) => {
+    const value = filter[key];
+    if (value !== null && typeof value === "object") {
+      const window2 = value;
+      return `${JSON.stringify(key)}:{"from":${JSON.stringify(window2.from ?? null)},"to":${JSON.stringify(window2.to ?? null)}}`;
+    }
+    return `${JSON.stringify(key)}:${JSON.stringify(value ?? null)}`;
+  });
+  return `{${parts.join(",")}}`;
+}
+
+// src/react/hooks.ts
 function useAsync(run, deps) {
   const client = useRecordsClient();
   const [state, setState] = useState(
@@ -4372,16 +4404,21 @@ function useRecords(tableId, options = {}) {
   const client = useRecordsClient();
   const pageSize = options.pageSize ?? 50;
   const page = options.page ?? 0;
+  const filterKey = stableFilterKey(options.filter);
   const base = useAsync(
     async (c) => {
       if (!tableId) return { ok: true, data: { rows: [], total: null } };
       return c.list({
         table_id: tableId,
+        ...filterKey === "{}" ? {} : { filter: options.filter },
         limit: pageSize,
         offset: page * pageSize
       });
     },
-    [tableId, pageSize, page]
+    // The QUESTION, not the object: a parent that rebuilds `{status: "Cancelled"}`
+    // on every render must not re-read the page on every render, and a parent
+    // that changes the question must re-read on the first one.
+    [tableId, pageSize, page, filterKey]
   );
   const realtime = client.config.realtime;
   const { reload, setData } = base;
@@ -4971,11 +5008,6 @@ function portalPath(slug) {
   return `/portal/c/${slug}`;
 }
 
-// src/aggregate.ts
-function measureKey(measure) {
-  return measure.op === "count" ? "count" : `${measure.op}_${measure.key ?? ""}`;
-}
-
 // src/capture-queue.ts
 var DB_NAME = "matrx-capture";
 var DB_VERSION = 1;
@@ -5332,6 +5364,7 @@ export {
   publicFormPath,
   rememberedOpCount,
   scopeChip,
+  stableFilterKey,
   tableShapeChanged,
   useEntityFieldMutation,
   useEntityFieldRights,