@ai-matrx/records 0.57.2 → 0.58.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { p as Uuid, T as Timestamp, u as ReadRow, q as RecordDocument, aT as TableType, aR as TableDisplay, aL as StorageMode, aS as TableOrigin, S as StoredRecord, v as Field, aq as ParityFieldType, aG as RuleUse, aF as RuleNodeKind, D as RecordsError, U as UseCase, aD as RelationFlavor, am as OnDelete, aA as RelationBinding, aB as RelationCardinality, aj as MergeFieldSource, ai as MergeFieldSemanticType, ah as MergeFieldModifier, an as OverridePolicy, _ as Delivery, aa as Freshness, L as Actor, E as PgError } from './types-BpBSMhYq.cjs';
-export { I as ABSENCE_REASONS, J as ACTOR_VOCABULARY, K as AbsenceReason, M as COMPUTE_ON, O as CONTEXT_POLICIES, Q as ComputeOn, V as ContextPolicy, X as DECLARABLE_FIELD_KINDS, Y as DELIVERIES, Z as DeclarableFieldKind, $ as ENTITY_TOKENS, a0 as EntityToken, a1 as FIELD_SENSITIVITIES, a2 as FIELD_SOURCES, a3 as FRESHNESS, a4 as FieldBehavior, x as FieldPatch, A as FieldProposal, a5 as FieldRule, a6 as FieldSensitivity, a7 as FieldSource, a8 as FieldTypeWord, a9 as ForbiddenEnvelopeWord, ab as HiddenFieldNotice, ac as KERNEL_TABLES, ad as KernelTableName, ae as MERGE_FIELD_MODIFIERS, af as MERGE_FIELD_SEMANTIC_TYPES, ag as MERGE_FIELD_SOURCES, w as NewFieldDeclaration, ak as ON_DELETE, al as OVERRIDE_POLICIES, ao as PARITY_FIELD_TYPES, ap as PER_VALUE_ACCESS_WORDS, ar as ParityFieldTypeDescriptor, as as PerValueAccessWord, H as PredictedRefusal, at as ProvenancePointer, au as RELATION_BINDINGS, av as RELATION_CARDINALITIES, aw as RELATION_FLAVORS, ax as RETIRED_ACTOR_WORDS, ay as RULE_NODE_KINDS, az as RULE_USES, z as ReadValue, s as RecordGraphWritten, t as RecordRead, y as RecordRevision, R as RecordsErrorCode, r as RecordsResult, aC as RelationDisplay, aE as RetiredActorWord, aH as STORAGE_MODES, aI as STORE_DOORS, aJ as STORE_KNOBS, aK as STORE_REFUSAL_CODES, G as StaleWriteDetail, aM as StoreDoorName, aN as StoreRefusalCode, aO as TABLE_DISPLAYS, aP as TABLE_ORIGINS, aQ as TABLE_TYPES, C as TableProposal, aU as VALUE_ALTERNATE_KEYS, aV as VALUE_ENVELOPE_KEYS, aW as ValueAlternate, aX as ValueAlternateKey, aY as ValueEnvelope, aZ as ValueEnvelopeKey, a_ as ValueSource, W as WriteConflict, a$ as allowsOtherValues, b0 as err, b1 as isRecordsErr, b2 as ok } from './types-BpBSMhYq.cjs';
+import { p as Uuid, T as Timestamp, u as ReadRow, q as RecordDocument, aT as TableType, aR as TableDisplay, aL as StorageMode, aS as TableOrigin, S as StoredRecord, v as Field, aq as ParityFieldType, aF as RuleNodeKind, aG as RuleUse, D as RecordsError, U as UseCase, M as Actor, G as PgError, aD as RelationFlavor, am as OnDelete, aA as RelationBinding, aB as RelationCardinality, r as RecordsResult, aj as MergeFieldSource, ai as MergeFieldSemanticType, ah as MergeFieldModifier, an as OverridePolicy, $ as Delivery, aa as Freshness } from './types-NKSc_jZq.cjs';
+export { J as ABSENCE_REASONS, K as ACTOR_VOCABULARY, L as AbsenceReason, O as COMPUTE_ON, Q as CONTEXT_POLICIES, V as ComputeOn, X as ContextPolicy, Y as DECLARABLE_FIELD_KINDS, Z as DELIVERIES, _ as DeclarableFieldKind, a0 as ENTITY_TOKENS, a1 as EntityToken, a2 as FIELD_SENSITIVITIES, a3 as FIELD_SOURCES, a4 as FRESHNESS, a5 as FieldBehavior, x as FieldPatch, A as FieldProposal, a6 as FieldRule, a7 as FieldSensitivity, a8 as FieldSource, E as FieldTypeWord, a9 as ForbiddenEnvelopeWord, ab as HiddenFieldNotice, ac as KERNEL_TABLES, ad as KernelTableName, ae as MERGE_FIELD_MODIFIERS, af as MERGE_FIELD_SEMANTIC_TYPES, ag as MERGE_FIELD_SOURCES, w as NewFieldDeclaration, ak as ON_DELETE, al as OVERRIDE_POLICIES, ao as PARITY_FIELD_TYPES, ap as PER_VALUE_ACCESS_WORDS, ar as ParityFieldTypeDescriptor, as as PerValueAccessWord, I as PredictedRefusal, at as ProvenancePointer, au as RELATION_BINDINGS, av as RELATION_CARDINALITIES, aw as RELATION_FLAVORS, ax as RETIRED_ACTOR_WORDS, ay as RULE_NODE_KINDS, az as RULE_USES, z as ReadValue, s as RecordGraphWritten, t as RecordRead, y as RecordRevision, R as RecordsErrorCode, aC as RelationDisplay, aE as RetiredActorWord, aH as STORAGE_MODES, aI as STORE_DOORS, aJ as STORE_KNOBS, aK as STORE_REFUSAL_CODES, H as StaleWriteDetail, aM as StoreDoorName, aN as StoreRefusalCode, aO as TABLE_DISPLAYS, aP as TABLE_ORIGINS, aQ as TABLE_TYPES, C as TableProposal, aU as VALUE_ALTERNATE_KEYS, aV as VALUE_ENVELOPE_KEYS, aW as ValueAlternate, aX as ValueAlternateKey, aY as ValueEnvelope, aZ as ValueEnvelopeKey, a_ as ValueSource, W as WriteConflict, a$ as allowsOtherValues, b0 as err, b1 as isRecordsErr, b2 as ok } from './types-NKSc_jZq.cjs';
 
 /**
  * THE TWO LANES THE ARCHIVED-ITEMS LAW NAMES (Arman, 2026-09-09) — the same
@@ -298,7 +298,7 @@ interface CoercibleField {
  * `plain_text`, `long_text`, `number` and `boolean` are behaviours that carry
  * no parity type of their own; every other word here is a parity type.
  */
-declare const FIELD_KINDS: readonly ["attachment", "checkbox", "currency", "datetime", "email", "formula", "json", "long_text", "lookup", "member", "multi_select", "number", "percent", "phone", "relation", "rollup", "select", "text", "url"];
+declare const FIELD_KINDS: readonly ["attachment", "checkbox", "currency", "datetime", "email", "entity_reference", "formula", "json", "long_text", "lookup", "member", "multi_select", "number", "percent", "phone", "relation", "rollup", "select", "text", "url"];
 /**
  * 🚨 THE UNION IS DERIVED FROM THE LIST ABOVE, and the list is what the
  * coverage test walks. Add a kind here and the test drives it; give it no arm
@@ -352,6 +352,13 @@ interface CoerceOptions {
      */
     label?: string | undefined;
 }
+/**
+ * SC-R / P12. Whether a relation's config makes it an ENTITY REFERENCE: target
+ * mode `any` (REL-8) restricted by a non-empty `allowed_types`.
+ */
+declare function isEntityReferenceConfig(config: Record<string, unknown> | null | undefined): boolean;
+/** The platform kinds an entity-reference Field may name, lower-cased, in its own order. */
+declare function entityReferenceKindsOf(field: Pick<CoercibleField, "config">): string[];
 /** The Field's name in plain words — never its key on a screen. */
 declare function coercionLabel(field: CoercibleField): string;
 /**
@@ -765,6 +772,48 @@ interface PipelineMoveResult {
     }[];
     what_happens?: string;
 }
+/** One card of a batch move (`custom.pipeline_move_many`). The version is REQUIRED: it is the
+ * version the board loaded, and a card that changed since answers `changed_since_loaded`. */
+interface PipelineMoveManyItem {
+    record_id: Uuid;
+    stage: string;
+    expected_version: number;
+    /** Columns the stage asks for, filled in on the way in. */
+    also?: Record<string, unknown>;
+}
+/** What one card of a batch move came to. The sentence is always the store's own. */
+type PipelineMoveVerdict = "moved" | "needs_approval" | "needs_fields" | "changed_since_loaded" | "no_right" | "refused";
+interface PipelineMoveManyResult {
+    index: number;
+    record_id: Uuid;
+    stage: string;
+    verdict: PipelineMoveVerdict;
+    sentence: string;
+    /** Set on `needs_fields`: the empty columns the stage asks for. */
+    needs?: PipelineMissingField[];
+    /** Set on `moved` / `needs_approval`: the card's version now. */
+    version?: number;
+    /** Set on `changed_since_loaded`: the version that won. */
+    current_version?: number;
+    expected_version?: number;
+    approval_id?: Uuid;
+    approvers?: {
+        user_id: Uuid;
+        name: string | null;
+        why: string;
+    }[];
+    warnings?: StageRuleWarning[];
+    rule?: string;
+    code?: string;
+}
+/** What `custom.pipeline_move_many` answers: the counts, then one verdict per card in order. */
+interface PipelineMoveMany {
+    asked: number;
+    moved: number;
+    needs_approval: number;
+    not_moved: number;
+    results: PipelineMoveManyResult[];
+}
 /**
  * ONE GATE ON A STAGE, as the condition builder on the stage settings screen writes it.
  * `requires`, `who` and `limits` are sugar over this shape; this is the general form, and
@@ -1312,6 +1361,124 @@ interface PortalCard {
      * decides whether they can sign in at all.
      */
     external_lane_open: boolean;
+    /** S6 — the look and forms exactly as the owner stored them (`{}` when none). */
+    config: PortalConfig;
+    /** S6 — the look as a client sees it: the portal's own values over the organization's brand. */
+    style: PortalStyle;
+    /** S6 — every form on the portal, in its order, with its title, Table and state. */
+    forms: PortalFormRef[];
+    /** S6 — the accent names a portal may carry (the design system's `STYLE_COLORS`). */
+    accents: PortalAccent[];
+    /**
+     * S6 — the pictures that could be this portal's logo: the organization's own PUBLIC pictures in
+     * Files, newest first. A private file is never offered, because the store would refuse it.
+     */
+    logo_candidates: Array<{
+        file_id: Uuid;
+        name: string;
+        url: string | null;
+    }>;
+}
+/** The design system's colour names (`STYLE_COLORS`), which is all an accent may be. */
+declare const PORTAL_ACCENTS: readonly ["slate", "green", "amber", "red", "blue", "violet", "teal"];
+type PortalAccent = (typeof PORTAL_ACCENTS)[number];
+declare function isPortalAccent(word: unknown): word is PortalAccent;
+/** One link in a portal's footer. The store takes only `https://`, `mailto:` and `tel:`. */
+interface PortalFooterLink {
+    label: string;
+    url: string;
+}
+/** A portal's look as the owner sets it. Every key is optional; absent means "the organization's". */
+interface PortalStyleInput {
+    display_name?: string | null;
+    welcome?: string | null;
+    logo_file_id?: Uuid | null;
+    accent?: PortalAccent | null;
+    footer_links?: PortalFooterLink[] | null;
+}
+/** One form on a portal, as the owner sets it. `order` is the position; `label` overrides the title. */
+interface PortalFormInput {
+    form_id: Uuid;
+    label?: string | null;
+    order?: number | null;
+}
+/**
+ * What `portalDeclare({ config })` sends. A key given REPLACES that key; a key not given is KEPT;
+ * `style: null` puts the organization's brand back and `forms: []` takes every form off.
+ */
+interface PortalConfigInput {
+    style?: PortalStyleInput | null;
+    forms?: PortalFormInput[] | null;
+}
+/** The look and forms as the store holds them (normalized by the store). */
+interface PortalConfig {
+    style?: PortalStyleInput;
+    forms?: Array<{
+        form_id: Uuid;
+        label?: string;
+        order: number;
+    }>;
+}
+/** The look a client is shown — resolved by the store, never computed by a screen. */
+interface PortalStyle {
+    display_name: string;
+    welcome: string | null;
+    logo_file_id: Uuid | null;
+    /** The logo's PUBLIC address, or null. Readable by anybody the portal is shown to. */
+    logo_url: string | null;
+    /** Null means the app's own colour. */
+    accent: PortalAccent | null;
+    footer_links: PortalFooterLink[];
+    /** Which of the values above came from the organization rather than the portal. */
+    from_organization: Array<"display_name" | "logo">;
+}
+/** One form on a portal, with what the owner needs to see about it. */
+interface PortalFormRef {
+    form_id: Uuid;
+    /** What the portal calls it (the owner's label, else the form's title). */
+    label: string;
+    order: number;
+    title: string;
+    table_id: Uuid | null;
+    table: string;
+    /** `gone` is a form that was removed; the outsider's list only ever carries `open`. */
+    state: "open" | "closed" | "full" | "gone";
+}
+/** A Table's stages as a portal client may be told them (`custom.portal_me` → tables[].stage). */
+interface PortalStage {
+    /** The stage Field's key on the record. */
+    field: string;
+    label: string;
+    /** In the order they were declared. A record stores the stage's `key`. */
+    stages: Array<{
+        key: string;
+        label: string;
+        retired: boolean;
+    }>;
+}
+/** What `custom.portal_form` answers: one form on the caller's own portal. */
+interface PortalFormSpec {
+    form_id: Uuid;
+    portal_id: Uuid;
+    table_id: Uuid;
+    title: string;
+    label: string;
+    presentation: Record<string, unknown>;
+    /** The form's exposed Fields as the store holds them — never the one naming the client. */
+    fields: Array<Record<string, unknown> & {
+        id: Uuid;
+        key: string;
+    }>;
+    required: string[];
+    state: "open" | "closed" | "full";
+    message: string | null;
+}
+/** What `custom.portal_form_submit` answers. `held` waits for the office; `message` says so. */
+interface PortalFormAnswer {
+    submission_id: Uuid | null;
+    record_id: Uuid | null;
+    state: "accepted" | "held" | "rejected" | "closed" | "full" | "too_many";
+    message: string | null;
 }
 /** What `custom.portal_invite` answers. `say` is the door's own sentence. */
 interface PortalInvitation {
@@ -1438,6 +1605,22 @@ type AggregateFilter = string | number | boolean | null | AggregateWindow;
  * lands somewhere else, which is the only way a drill-through can lie.
  */
 type RecordFilter = Record<string, AggregateFilter>;
+/**
+ * S2-PRIME FILTER-GROUPS — A READ DOOR'S QUESTION, IN EITHER OF ITS TWO SHAPES.
+ *
+ * The flat `RecordFilter` above (field key → scalar / `null` / window, AND only) is what
+ * dashboards, drill-throughs and the notifier carry. A `RuleExpression` — `{op, args}`, ALL / ANY /
+ * NOT groups nested to any depth, fields by id — is what the condition builder, a view's own
+ * filter and every membership Rule speak. `custom.record_filter_sql(org, table, filter)` turns
+ * EITHER into the one WHERE clause the grid (`list`), the aggregate and the board all use, so the
+ * three can never disagree about which records a view holds.
+ */
+type StoreFilter = RecordFilter | RuleExpression;
+/**
+ * Is this filter a Rule expression? The store's own test (`custom.filter_is_rule`): an object
+ * whose `op` is a word and which carries `args`.
+ */
+declare function isRuleFilter(filter: unknown): filter is RuleExpression;
 /** One measure. `count` counts rows and needs no Field; the rest read one. */
 interface AggregateMeasure {
     op: AggregateOperation;
@@ -1453,6 +1636,90 @@ interface AggregateRow {
     groups: Record<string, string | null>;
     measures: Record<string, number | null>;
     row_count: number;
+    /**
+     * S3 — present only when the question carried a comparison. The same group
+     * in the PRIOR window: a bucket is matched by its position in its own window
+     * (week 1 of September beside week 1 of August), so `prior_groups` names the
+     * prior bucket's own date. `null` when the prior window had no such group.
+     */
+    prior_groups?: Record<string, string | null> | null;
+    /** The prior window's measures, keyed exactly like `measures`. */
+    prior_measures?: Record<string, number | null> | null;
+    prior_row_count?: number | null;
+    /** Every measure now and before, the change, and the change as a percent of before. */
+    delta?: Record<string, AggregateDelta> | null;
+    /** The two windows this row was worked out over, and the calendar that cut them. */
+    compare?: AggregateCompareWindows | null;
+    /**
+     * S3 — a compared, bucketed row's POSITION in its window (0 = the first
+     * bucket). A row the current window has not reached yet has a position and
+     * no current bucket, so a chart names it "Week 6" rather than inventing a date.
+     */
+    position?: number | null;
+}
+/**
+ * S3 — WHAT A PERIOD IS COMPARED AGAINST (`custom.agg_compare_kinds()`).
+ * `previous_period` is the period before, of the same length (August before
+ * September; an explicit window shifted back by its own length);
+ * `same_period_last_year`; `range` is a fixed `baseline`.
+ */
+type AggregateCompareKind = "previous_period" | "same_period_last_year" | "range";
+/**
+ * S3 — ONE COMPARISON, as `custom.record_aggregate(p_compare)` and a
+ * dashboard block's `compare` both take it. The current window is either the
+ * calendar `period` holding `at` (default: now, in the organization's time
+ * zone) or an explicit `from`/`to`. A date alone ("2026-09-01") is that local
+ * day in the organization's time zone.
+ */
+interface AggregateCompare {
+    against?: AggregateCompareKind;
+    /** The date Field the period runs along. Defaults to the bucket's key. */
+    key?: string;
+    period?: AggregateBucket;
+    at?: string;
+    from?: string;
+    to?: string;
+    /** Compare the part of the period that has happened ("month to date"). */
+    to_date?: boolean;
+    /** The fixed period `range` compares against. Half-open: `to` is excluded. */
+    baseline?: {
+        from: string;
+        to: string;
+    };
+}
+/** One measure now and before. `change_pct` is null when before was nothing or zero. */
+interface AggregateDelta {
+    current: number | null;
+    prior: number | null;
+    change: number | null;
+    change_pct: number | null;
+}
+/**
+ * S3 — THE TWO WINDOWS the store actually ran, as local ISO moments with the
+ * organization's offset ("2026-09-01T00:00:00-07:00"), and the calendar that
+ * cut them. A screen labels the comparison from THIS, never from its own clock.
+ */
+interface AggregateCompareWindows {
+    key: string;
+    against: AggregateCompareKind;
+    period: AggregateBucket | null;
+    to_date: boolean;
+    time_zone: string;
+    week_start: string;
+    /** The bucket grain the windows were counted in, when the question had a bucket. */
+    grain: AggregateBucket | null;
+    /** How many buckets the current window holds — what a target's pace is shared over. */
+    bucket_count: number | null;
+    window: {
+        from: string;
+        to: string;
+    };
+    prior_window: {
+        from: string;
+        to: string;
+    };
+    /** On a row from `recordAggregate`: that row's bucket position (see `AggregateRow.position`). */
+    position?: number | null;
 }
 /** The measure key the store answers with, so a chart can find its own series. */
 declare function measureKey(measure: AggregateMeasure): string;
@@ -1468,7 +1735,7 @@ declare function measureKey(measure: AggregateMeasure): string;
  * one question. `undefined` and an empty filter are both `"{}"` — the caller
  * asked nothing, and there is only one way to ask nothing.
  */
-declare function stableFilterKey(filter: RecordFilter | null | undefined): string;
+declare function stableFilterKey(filter: StoreFilter | null | undefined): string;
 
 /** `custom.decoration_colors()` — the palette, in the order an uncolored choice takes. */
 type DecorationColor = "slate" | "green" | "amber" | "red" | "blue" | "violet" | "teal";
@@ -1702,6 +1969,187 @@ declare function recordChangeTrigger(tableId: Uuid, options?: {
     actions?: RecordChangeAction[];
     changed_fields?: string[];
 };
+/**
+ * One entry of `custom.table_list_everywhere` — `public.get_user_tables`' own shape plus
+ * `store`, so a picker swaps one call and keeps its code. `store` says which home opens it.
+ */
+interface TableListEntry {
+    id: Uuid;
+    table_name: string;
+    description: string | null;
+    version: number | null;
+    user_id: Uuid | null;
+    is_public: boolean | null;
+    visibility: string | null;
+    organization_id: Uuid;
+    created_at: string;
+    updated_at: string | null;
+    last_activity_at: string | null;
+    row_count: number;
+    field_count: number;
+    store: "older" | "records";
+}
+/** Where a synced table comes from. `external_id` is the source's own id (a spreadsheet id). */
+interface TableSyncSource {
+    provider: string;
+    external_id: string;
+    tab_id?: string | null;
+    synced_at?: string | null;
+}
+/** What `custom.table_sync` takes: the source, its columns, and every row it has NOW. */
+interface TableSyncSpec {
+    source: TableSyncSource;
+    table_name: string;
+    columns: string[];
+    rows: {
+        ref: string;
+        values: Record<string, string | number | boolean | null>;
+    }[];
+}
+interface TableSyncResult {
+    table_id: Uuid;
+    created: boolean;
+    fields_added: number;
+    rows_inserted: number;
+    rows_updated: number;
+    rows_archived: number;
+    source_system: string;
+}
+/**
+ * A sheet tab's cells (header row first) → the spec `custom.table_sync` takes. Every row is
+ * named by its sheet row number (`row-2` is the first row under the header) unless
+ * `refColumn` names a column holding a stable id; a blank or repeated ref is refused here, so
+ * the store never sees two rows claiming to be the same source row. Wholly blank rows are
+ * skipped. Pure.
+ */
+declare function sheetSyncSpec(args: {
+    source: TableSyncSource;
+    tableName: string;
+    cells: readonly (readonly (string | number | boolean | null | undefined)[])[];
+    refColumn?: string;
+}): TableSyncSpec;
+/** One row of `custom.table_row_counts`: the rows of that Table this reader may see. */
+interface TableRowCount {
+    table_id: Uuid;
+    visible_rows: number;
+}
+/**
+ * One row of `custom.record_headers`: the row's own columns the document door does not answer.
+ * `created_by` is the caller's own id on rows the caller made and null on every other; `mine`
+ * says which.
+ */
+interface RecordHeader {
+    id: Uuid;
+    table_id: Uuid;
+    created_at: string;
+    updated_at: string;
+    version: number;
+    deleted_at: string | null;
+    mine: boolean;
+    created_by: Uuid | null;
+}
+/**
+ * Fold `table_row_counts` onto a table list: `row_count` set on every Table the counts name.
+ * A Table the counts do not name keeps what it had — the store answers no row for a Table this
+ * reader may not know, and that is never turned into a zero. Pure.
+ */
+declare function withRowCounts<T extends {
+    id: Uuid;
+    row_count?: number | null;
+}>(tables: readonly T[], counts: readonly TableRowCount[] | null | undefined): T[];
+/** What `custom.view_record_order_set` answers. */
+interface ViewOrderSet {
+    view_id: Uuid;
+    table_id: Uuid;
+    order: "manual";
+    named: number;
+    positioned: number;
+}
+/**
+ * The order to send after a drag: `order` with `moved` taken out and put at `toIndex` (clamped).
+ * The store keeps every row the call does not name in its old place after the named ones, so a
+ * screen may send only the rows it shows. Pure.
+ */
+declare function moveInOrder(order: readonly Uuid[], moved: Uuid, toIndex: number): Uuid[];
+/**
+ * What `custom.table_share_outside_grant` answers. `person` says which path ran:
+ * `outside_account` (granted at once and notified — never made a member), `member` (a plain
+ * share), `no_account` (the invitation door's own answer, with its link and delivery).
+ */
+interface OutsideShareAnswer {
+    granted: boolean;
+    invited: boolean;
+    joined: boolean;
+    person: "outside_account" | "member" | "no_account";
+    email: string;
+    table: string;
+    level: string;
+    level_label: string;
+    say: string;
+    user_id?: Uuid;
+    permission_id?: Uuid;
+    invitation_id?: Uuid | null;
+    accept_path?: string | null;
+    delivery_say?: string | null;
+}
+
+/** The three placement facts, as the Table document or `custom.table` carries them. */
+interface TablePlacement {
+    kept_by_the_app?: boolean | null;
+    kept_for?: string | null;
+    offered_as_context?: boolean | null;
+}
+/**
+ * One row of `custom.table_facts` since SC-1 — the two lane facts it always answered
+ * (`visibility`, `mine`) and the placement, with the sentence a person reads and where the
+ * table is used. A store without the SC-1 door answers the first three columns only; every
+ * placement column is then `undefined`, and the readers below treat the table as the
+ * organization's own — exactly what that store's older screens did.
+ */
+interface TablePlacementFact extends TablePlacement {
+    table_id: Uuid;
+    visibility: string;
+    mine: boolean;
+    /** The heading a kept table is listed under: "The context system", "The choices behind your columns", … */
+    keeper_group?: string | null;
+    /** One plain sentence: who keeps it and where it opens from. Null for the organization's own. */
+    keeper_says?: string | null;
+    /** Where the table is used: `table` (another Table, or itself) or `scope` (a context scope). */
+    used_in_kind?: "table" | "scope" | null;
+    used_in_id?: Uuid | null;
+    /** The Table that page belongs to, when `used_in_kind` is `table`. */
+    used_in_table_id?: Uuid | null;
+}
+/** Whether a person's list of tables keeps this one out of sight until "Show everything". */
+declare function keptOutOfSight(placement: TablePlacement | null | undefined): boolean;
+/** Whether the context picker may offer this Table. Absent is no. */
+declare function offeredAsContext(placement: TablePlacement | null | undefined): boolean;
+/**
+ * The placement facts folded onto a table list, by id. Pure — returns new objects and leaves
+ * the list it was given alone. A table the facts do not name is returned unchanged.
+ */
+declare function withTablePlacement<T extends {
+    id: Uuid;
+}>(tables: readonly T[], facts: readonly TablePlacementFact[] | null | undefined): Array<T & Partial<TablePlacementFact>>;
+/**
+ * THE KEPT TABLES, GROUPED UNDER THEIR KEEPER, in the order each group first appears. A kept
+ * table the store gave no heading goes under "Kept by the app" — never dropped.
+ */
+declare function keptGroups<T extends TablePlacement & Partial<TablePlacementFact>>(tables: readonly T[]): Array<{
+    group: string;
+    tables: T[];
+}>;
+/**
+ * WHERE A KEPT TABLE OPENS FROM (THE DOOR LAW): the host's own addresses for a table and for a
+ * context scope, chosen by what the store said the table is used in. With nothing said, the
+ * table's own page — a kept table is never a row with nowhere to go.
+ */
+declare function keptTableHref(fact: {
+    table_id: Uuid;
+} & Partial<TablePlacementFact>, hrefs: {
+    table: (tableId: Uuid) => string;
+    scope: (scopeId: Uuid) => string;
+}): string;
 
 /** The seven shapes a block can take, exactly as `custom.dashboard_kinds()` answers. */
 type DashboardBlockKind = "number" | "bar" | "column" | "line" | "donut" | "table" | "stuck";
@@ -1734,6 +2182,43 @@ interface DashboardBlock {
     state_key?: string;
     /** `stuck` only: how long a record may sit on the same value. Defaults to 14. */
     days?: number;
+    /**
+     * S3 — the comparison this block makes (this month against last month).
+     * The door fills `key` from the bucket when it is left out, and refuses a
+     * comparison along a Field the Table does not have, by name.
+     */
+    compare?: AggregateCompare | null;
+    /** S3 — the number this block is aiming for. */
+    target?: DashboardTarget | null;
+}
+/**
+ * S3 — A BLOCK'S TARGET. `measure` is one of the block's own measure keys
+ * (default: the first). `per: "period"` is a target for the whole window (a
+ * monthly target — a bucketed chart draws its even share per bucket as the
+ * pace); `per: "bucket"` is a target for every bar or point.
+ *
+ * A target is a FIXED NUMBER (`value`) or A GOAL COLUMN (`field`, a Field key of
+ * the block's Table): the store adds that column up (`op`, default `sum`) over
+ * exactly the records the block's own number read — same filter, same window,
+ * same reader — so "invoiced against quoted" is about the same jobs. Exactly
+ * one of the two; a goal column is always `per: "period"`.
+ */
+type DashboardTarget = DashboardTargetBase & ({
+    value: number;
+    field?: never;
+    op?: never;
+} | {
+    field: string;
+    op?: DashboardTargetOp;
+    value?: never;
+});
+/** How a goal column is added up across the block's records. */
+type DashboardTargetOp = "sum" | "avg" | "min" | "max";
+/** What every target carries, whichever kind it is. */
+interface DashboardTargetBase {
+    label?: string;
+    measure?: string;
+    per?: "period" | "bucket";
 }
 /** One dashboard as `custom.dashboards` reports it to its organization. */
 interface DashboardSummary {
@@ -1792,6 +2277,56 @@ interface DashboardBlockResult {
     refused?: string;
     /** The SQLSTATE that refusal carried. */
     sqlstate?: string;
+    /**
+     * S3 — the windows this block was actually compared over; `null` when it was
+     * not compared. (The comparison it was ASKED to make is the saved block's.)
+     */
+    compare?: AggregateCompareWindows | null;
+    /** S3 — why a canvas comparison was not applied to this block (it has no date). */
+    compare_refused?: string;
+    /**
+     * S3 — the block's first (or target) measure added up across its rows, now
+     * and before, when the measure adds up (count, sum, filled, empty) or the
+     * block has one row. Worked out by the store from the rows it answered, so
+     * a tile, a chart and a ring cannot disagree.
+     */
+    totals?: DashboardTotals;
+    /** S3 — the target, with how far the current total has come and its pace per bucket. */
+    target?: DashboardTargetResult;
+}
+/** S3 — one block's total, now and before. */
+interface DashboardTotals {
+    measure: string;
+    current: number | null;
+    prior: number | null;
+    change: number | null;
+    change_pct: number | null;
+}
+/** S3 — a target as the run answers it. */
+interface DashboardTargetResult {
+    /**
+     * The number aimed at: the fixed value, or the goal column added up over this
+     * block's records. `null` when a goal column had nothing to add up, or was refused.
+     */
+    value: number | null;
+    /** A goal column's key, when the target is read from one. */
+    field?: string;
+    /** How that column was added up. */
+    op?: DashboardTargetOp;
+    /**
+     * The store's own sentence when THIS reader may not read the goal column — the
+     * block still answers its number; only the target is withheld.
+     */
+    refused?: string;
+    label: string;
+    measure: string;
+    per: "period" | "bucket";
+    /** The current total the target is measured against. */
+    current: number | null;
+    /** current ÷ value, 4 decimals. */
+    progress: number | null;
+    /** The line a bucketed chart draws: the target's even share of one bucket, or the target itself per bucket. */
+    pace: number | null;
 }
 /** What `custom.dashboard_run` answers: the canvas, and every block's own result. */
 interface DashboardRunResult {
@@ -1801,6 +2336,15 @@ interface DashboardRunResult {
     presentation: Record<string, unknown>;
     /** The one filter bar this run was asked with. */
     filter: Record<string, AggregateFilter>;
+    /** S3 — the date grain the canvas re-cut every bucketed block to, or null. */
+    grain?: AggregateBucket | null;
+    /** S3 — the canvas comparison this run was asked with, or null. */
+    compare?: AggregateCompare | null;
+    /** S3 — the organization's calendar every date on this canvas was cut with. */
+    calendar?: {
+        time_zone: string;
+        week_start: string;
+    };
     blocks: DashboardBlockResult[];
 }
 
@@ -2532,11 +3076,22 @@ interface SavedViewRow {
     name: string;
     table_id: Uuid | null;
     filters: RecordFilter;
+    /**
+     * THE WHOLE VIEW (S0 ONE-SAVED-VIEW, 2026-09-23): `platform.saved_view` is the ONE saved-view
+     * store, so this is what the view bar, the board, the calendar and the gallery draw from —
+     * `layout` (the kind), `group_field`, `measure`, `date_field`, `image_field`, `sorts`, `rule_id`,
+     * `is_default`, `presentation`, G7's `grid`, G13's `order`, the mover's `moved_from`.
+     */
+    definition: Record<string, unknown>;
     created_at: string;
 }
-/** What `custom.view_declare` is asked for. `view_id` re-states rather than doubling. */
+/**
+ * What `custom.view_declare` is asked for. With `view_id` the door MERGES: `name` changes only
+ * when sent, `filters` only when the key is sent, each `definition` key replaces that one key and
+ * a key sent as `null` is removed — so a screen sends only what it changed.
+ */
 interface SavedViewSpecIn {
-    name: string;
+    name?: string;
     filters?: RecordFilter | null;
     definition?: Record<string, unknown> | null;
     view_id?: Uuid | null;
@@ -2567,38 +3122,199 @@ interface SubscriptionBlock {
 }
 
 /**
- * REL-6. Whether Visibility flows along this relation and the MAXIMUM access
- * level it carries. Default off on `referenced`, on for `owned`.
+ * The data seam: a structural subset of `SupabaseClient`. The package never
+ * opens a database connection of its own and never holds a key — the HOST
+ * supplies a client that already carries the operating person's session, which
+ * is what makes DOOR-5 and AGT-N-4 true (the store sees the person, not us).
  */
-interface RelationCarries {
-    carries: boolean;
-    /** The ceiling — a relation never carries more access than this. */
-    max_access: string | null;
+interface RecordsDataSource {
+    /**
+     * Call a door. The name is always a door the live catalogue has; `/core`
+     * refuses `door_absent` before it ever reaches here for one that does not.
+     */
+    rpc(fn: string, args: Record<string, unknown>, 
+    /**
+     * THE SCHEMA THE DOOR LIVES IN, always supplied: `custom` for the store's
+     * own doors, `iam` for the trust doors (the external principal and the
+     * publish binding, which are the PLATFORM's). A host binding supabase-js
+     * routes this to `client.schema(options.schema).rpc(fn, args)`; a host that
+     * ignores it calls its own default PostgREST profile — `public` — and is
+     * refused by name, which is the failure we want rather than a silent answer
+     * from the wrong system. (Before 2026-09-18 this was described as "only ever
+     * `iam`" and the store's doors went unqualified; the extension's first real
+     * turn proved that asks `public.store_is_open` and finds nothing.)
+     */
+    options?: {
+        schema?: string;
+    }): PromiseLike<{
+        data: unknown;
+        error: PgError | null;
+    }>;
+    /** Reads of `custom.*` go through the schema-qualified builder, never a bare `from`. */
+    schema(name: string): {
+        from(table: string): RecordsTableQuery;
+    };
 }
-/** The seven properties, each its own question. */
-interface RelationProperties {
-    /** REL-1. Stored once on the contained table, read from the field's side. */
-    flavor: RelationFlavor;
-    /** REL-2. Separate from flavour. */
-    on_delete: OnDelete;
-    /** REL-3. A snapshot is a frozen copy in the relation's payload — never a pointer into History. */
-    binding: RelationBinding;
-    /** REL-4. */
-    ordered: boolean;
-    /** REL-5. */
-    loops: "allowed" | "refused";
-    /** REL-6. */
-    carries: RelationCarries;
-    /** REL-7. */
-    cardinality: RelationCardinality;
+/** The read surface the list and query paths use. A real supabase-js client satisfies it. */
+interface RecordsTableQuery {
+    select(columns: string, options?: {
+        count?: "exact" | "planned" | "estimated";
+        head?: boolean;
+    }): RecordsFilter;
+}
+interface RecordsFilter extends PromiseLike<RecordsResponse> {
+    eq(column: string, value: unknown): RecordsFilter;
+    neq(column: string, value: unknown): RecordsFilter;
+    in(column: string, values: readonly unknown[]): RecordsFilter;
+    is(column: string, value: null | boolean): RecordsFilter;
+    gte(column: string, value: unknown): RecordsFilter;
+    lte(column: string, value: unknown): RecordsFilter;
+    order(column: string, options?: {
+        ascending?: boolean;
+    }): RecordsFilter;
+    range(from: number, to: number): RecordsFilter;
+    limit(count: number): RecordsFilter;
+}
+interface RecordsResponse {
+    data: unknown;
+    error: PgError | null;
+    count?: number | null;
 }
 /**
- * REL-8 / REL-N-1. A target is a REFERENCE, written that way from the first
- * line of code, because it may name a row outside our database. One Table,
- * several, or any — polymorphic without restriction. External targets are
- * read-only in v1.
+ * WHO IS ACTING. AGT-N-4: an agent carries the exact authority of the person
+ * operating it — there is no agent identity and there are no service roles. So
+ * the actor word and the person are two separate facts, and `on_behalf_of` is
+ * meaningful only when the actor is `agent`.
  */
-type RelationTarget = {
+interface RecordsActor {
+    actor: Actor;
+    /** The signed-in person. The store reads this from the session, not from us; this is for the client's own mirror. */
+    user_id?: Uuid;
+    /** Only an agent acts on behalf of a person (the store refuses it otherwise). */
+    on_behalf_of?: Uuid;
+}
+/**
+ * OPTIONAL. A live-updates seam. The default degradation is stated rather than
+ * silent: with no port bound, `useRecords` reports `live: false` and the screen
+ * can say "not live" instead of quietly going stale.
+ *
+ * A host binds this with `@ai-matrx/data/react`'s channel hygiene — the package
+ * deliberately does NOT depend on it, so the headless core stays free of a
+ * realtime client and a host that has one keeps using the one it already has.
+ */
+interface RecordsRealtimePort {
+    /**
+     * Watch one organization's records of one table. Returns an unsubscribe.
+     *
+     * THE HOST NUDGES THROUGH THIS SINK AND REACHES AROUND NOTHING. Until 0.43.0 the callback
+     * was `(recordId: Uuid) => void` and a host that also wanted to say "the SHAPE moved"
+     * imported `tableShapeChanged` from `@ai-matrx/records/react` and called it directly —
+     * which worked, and which meant the port contract did not describe half of what a port
+     * actually does. A column appearing is not a row changing, and the package owns the
+     * difference.
+     *
+     * NOTHING THAT ARRIVES HERE IS DATA. A nudge has not passed the read door, so the hook
+     * re-reads — by id set when the nudge names ids, whole-page when it cannot.
+     */
+    subscribeRecords(args: {
+        organization_id: Uuid;
+        table_id: Uuid;
+    }, sink: RecordsChangeSink): () => void;
+}
+/** What a realtime port may tell the package. Two calls, because a column is not a row. */
+interface RecordsChangeSink {
+    /**
+     * THESE RECORDS MOVED. `null` means "I cannot tell you which" — a reconnect, a tab wake, or
+     * a change above the store's own id cap — and is the one case that costs a whole-page read.
+     * An EMPTY array is not the same thing and is not a nudge at all.
+     */
+    records(ids: readonly Uuid[] | null): void;
+    /**
+     * THIS TABLE'S SHAPE MOVED — a column added, retired or changed. Re-reading the rows would
+     * redraw the same table without the new column in it, which is a screen that is out of date
+     * while looking healthy.
+     */
+    shape(): void;
+}
+/**
+ * OPTIONAL. Where a refusal that nobody asked about goes — the loud funnel.
+ * Default degradation: `console.error` with the store's own words, never
+ * silence.
+ */
+type RecordsErrorSink = (error: {
+    code: string;
+    message: string;
+    hint?: string;
+    where: string;
+}) => void;
+/**
+ * OPTIONAL. The merge-field resolver's server half (`W5-MERGE-B`). While it is
+ * not bound, `useMergeField` answers `pending` WITH THE REASON — never a blank,
+ * never a literal placeholder left in the text (DYN-14).
+ */
+interface RecordsResolverPort {
+    resolve(args: {
+        organization_id: Uuid;
+        merge_field_keys: string[];
+        /** The live selection the `state` source reads (DYNAMIC-VALUES §C). */
+        state?: Record<string, unknown>;
+    }): Promise<unknown>;
+}
+/** The one config a host binds. */
+interface RecordsConfig {
+    /** REQUIRED. */
+    dataSource: RecordsDataSource;
+    /** REQUIRED. */
+    actor: RecordsActor;
+    /**
+     * REQUIRED. REC-29: organizations are hard walls, and the store is keyed
+     * `(organization_id, id)`. There is no "current organization" this package
+     * discovers for itself — the host says which one, every time.
+     */
+    organizationId: Uuid;
+    realtime?: RecordsRealtimePort;
+    onError?: RecordsErrorSink;
+    resolver?: RecordsResolverPort;
+    /**
+     * The schema the record store lives in. Exists so a rehearsal branch and
+     * production can differ without a fork; it is `custom` everywhere today.
+     */
+    schema?: string;
+}
+
+/**
+ * REL-6. Whether Visibility flows along this relation and the MAXIMUM access
+ * level it carries. Default off on `referenced`, on for `owned`.
+ */
+interface RelationCarries {
+    carries: boolean;
+    /** The ceiling — a relation never carries more access than this. */
+    max_access: string | null;
+}
+/** The seven properties, each its own question. */
+interface RelationProperties {
+    /** REL-1. Stored once on the contained table, read from the field's side. */
+    flavor: RelationFlavor;
+    /** REL-2. Separate from flavour. */
+    on_delete: OnDelete;
+    /** REL-3. A snapshot is a frozen copy in the relation's payload — never a pointer into History. */
+    binding: RelationBinding;
+    /** REL-4. */
+    ordered: boolean;
+    /** REL-5. */
+    loops: "allowed" | "refused";
+    /** REL-6. */
+    carries: RelationCarries;
+    /** REL-7. */
+    cardinality: RelationCardinality;
+}
+/**
+ * REL-8 / REL-N-1. A target is a REFERENCE, written that way from the first
+ * line of code, because it may name a row outside our database. One Table,
+ * several, or any — polymorphic without restriction. External targets are
+ * read-only in v1.
+ */
+type RelationTarget = {
     kind: "ours";
     entity_token: string;
     row_id: Uuid;
@@ -2673,6 +3389,53 @@ type RelationWordsManyArgs = {
     display?: RelationDisplaySpec | null;
     record_ids: Uuid[];
 };
+/** One reference as the store keeps it. */
+interface EntityRef {
+    /** The `platform.entity_types` token: `note`, `web_site`, `agent` … */
+    token: string;
+    id: Uuid;
+}
+/** One reference as a read door answers it. */
+interface EntityRefWithWords extends EntityRef {
+    /**
+     * The thing's own title — or the store's withheld sentence when the reader
+     * may not open it; `null` when the kind names no title.
+     */
+    label: string | null;
+}
+/** One kind of platform thing a record may point at (`custom.entity_reference_kinds`). */
+interface EntityReferenceKind {
+    token: string;
+    /** What a person reads: "Note", "Site", "Agent". */
+    label: string;
+    /** The picker's grouping: the admin-assigned reference category, else the schema. */
+    category: string;
+}
+/**
+ * The references a cell holds, whichever shape it arrived in — one object, a
+ * list, or what a read door rendered (with labels). Anything that is not a
+ * reference is left out, never guessed at.
+ */
+declare function entityRefsOf(value: unknown): EntityRefWithWords[];
+/**
+ * What to WRITE for an entity-reference cell: `{token, id}` only, each thing
+ * once, first mention first — the label a read door added is dropped, because
+ * the store reads it and never keeps it (REL-14). A single-valued column gets
+ * the one object (or `null`), a multi-valued one the list.
+ */
+declare function entityRefsToWrite(value: unknown, multi: boolean): EntityRef | EntityRef[] | null;
+/**
+ * The kinds of platform thing a record may point at — what the field editor's
+ * kind picker lists. `custom.entity_reference_kinds()`.
+ */
+declare function entityReferenceKinds(source: RecordsDataSource): Promise<RecordsResult<EntityReferenceKind[]>>;
+/**
+ * THE WORDS HELPER. The words of each `{token, id}` for a picker or a chip
+ * before anything is saved — each label read by the store for THIS person and
+ * withheld when they may not open the thing. `custom.entity_reference_words`.
+ * A saved cell needs no call: every read door already answers its labels.
+ */
+declare function entityReferenceWords(source: RecordsDataSource, organizationId: Uuid, refs: readonly EntityRef[]): Promise<RecordsResult<EntityRefWithWords[]>>;
 
 /**
  * DYN-14 / DYN-15. An ordered list of merge fields ENDING IN A LITERAL, or the
@@ -2980,6 +3743,34 @@ interface WorkApprovalDecision {
     version: number | null;
     message: string;
 }
+/** One inbox decision of a batch (`custom.work_decide_many`). */
+interface WorkDecideManyItem {
+    /** The inbox item — a `work_approval` record's id (`WorkInboxItem.item_id`). */
+    item: Uuid;
+    decision: "approve" | "decline";
+    note?: string | null;
+}
+type WorkDecideVerdict = "approved" | "declined" | "already_decided" | "no_right" | "refused";
+interface WorkDecideManyResult {
+    index: number;
+    item: Uuid;
+    decision: "approve" | "decline";
+    verdict: WorkDecideVerdict;
+    /** The store's own sentence: what was applied, or why it was not. */
+    sentence: string;
+    subject_id?: Uuid;
+    version?: number | null;
+    record_ids?: Uuid[];
+    code?: string;
+}
+/** What `custom.work_decide_many` answers: the counts, then one verdict per item in order. */
+interface WorkDecideMany {
+    asked: number;
+    approved: number;
+    declined: number;
+    not_decided: number;
+    results: WorkDecideManyResult[];
+}
 /** What `custom.work_assign` answers: the value, the access, and who holds it now. */
 interface WorkAssignment {
     record_id: Uuid;
@@ -3228,167 +4019,6 @@ interface ResolvedPublishBinding {
     notice: string;
 }
 
-/**
- * The data seam: a structural subset of `SupabaseClient`. The package never
- * opens a database connection of its own and never holds a key — the HOST
- * supplies a client that already carries the operating person's session, which
- * is what makes DOOR-5 and AGT-N-4 true (the store sees the person, not us).
- */
-interface RecordsDataSource {
-    /**
-     * Call a door. The name is always a door the live catalogue has; `/core`
-     * refuses `door_absent` before it ever reaches here for one that does not.
-     */
-    rpc(fn: string, args: Record<string, unknown>, 
-    /**
-     * THE SCHEMA THE DOOR LIVES IN, always supplied: `custom` for the store's
-     * own doors, `iam` for the trust doors (the external principal and the
-     * publish binding, which are the PLATFORM's). A host binding supabase-js
-     * routes this to `client.schema(options.schema).rpc(fn, args)`; a host that
-     * ignores it calls its own default PostgREST profile — `public` — and is
-     * refused by name, which is the failure we want rather than a silent answer
-     * from the wrong system. (Before 2026-09-18 this was described as "only ever
-     * `iam`" and the store's doors went unqualified; the extension's first real
-     * turn proved that asks `public.store_is_open` and finds nothing.)
-     */
-    options?: {
-        schema?: string;
-    }): PromiseLike<{
-        data: unknown;
-        error: PgError | null;
-    }>;
-    /** Reads of `custom.*` go through the schema-qualified builder, never a bare `from`. */
-    schema(name: string): {
-        from(table: string): RecordsTableQuery;
-    };
-}
-/** The read surface the list and query paths use. A real supabase-js client satisfies it. */
-interface RecordsTableQuery {
-    select(columns: string, options?: {
-        count?: "exact" | "planned" | "estimated";
-        head?: boolean;
-    }): RecordsFilter;
-}
-interface RecordsFilter extends PromiseLike<RecordsResponse> {
-    eq(column: string, value: unknown): RecordsFilter;
-    neq(column: string, value: unknown): RecordsFilter;
-    in(column: string, values: readonly unknown[]): RecordsFilter;
-    is(column: string, value: null | boolean): RecordsFilter;
-    gte(column: string, value: unknown): RecordsFilter;
-    lte(column: string, value: unknown): RecordsFilter;
-    order(column: string, options?: {
-        ascending?: boolean;
-    }): RecordsFilter;
-    range(from: number, to: number): RecordsFilter;
-    limit(count: number): RecordsFilter;
-}
-interface RecordsResponse {
-    data: unknown;
-    error: PgError | null;
-    count?: number | null;
-}
-/**
- * WHO IS ACTING. AGT-N-4: an agent carries the exact authority of the person
- * operating it — there is no agent identity and there are no service roles. So
- * the actor word and the person are two separate facts, and `on_behalf_of` is
- * meaningful only when the actor is `agent`.
- */
-interface RecordsActor {
-    actor: Actor;
-    /** The signed-in person. The store reads this from the session, not from us; this is for the client's own mirror. */
-    user_id?: Uuid;
-    /** Only an agent acts on behalf of a person (the store refuses it otherwise). */
-    on_behalf_of?: Uuid;
-}
-/**
- * OPTIONAL. A live-updates seam. The default degradation is stated rather than
- * silent: with no port bound, `useRecords` reports `live: false` and the screen
- * can say "not live" instead of quietly going stale.
- *
- * A host binds this with `@ai-matrx/data/react`'s channel hygiene — the package
- * deliberately does NOT depend on it, so the headless core stays free of a
- * realtime client and a host that has one keeps using the one it already has.
- */
-interface RecordsRealtimePort {
-    /**
-     * Watch one organization's records of one table. Returns an unsubscribe.
-     *
-     * THE HOST NUDGES THROUGH THIS SINK AND REACHES AROUND NOTHING. Until 0.43.0 the callback
-     * was `(recordId: Uuid) => void` and a host that also wanted to say "the SHAPE moved"
-     * imported `tableShapeChanged` from `@ai-matrx/records/react` and called it directly —
-     * which worked, and which meant the port contract did not describe half of what a port
-     * actually does. A column appearing is not a row changing, and the package owns the
-     * difference.
-     *
-     * NOTHING THAT ARRIVES HERE IS DATA. A nudge has not passed the read door, so the hook
-     * re-reads — by id set when the nudge names ids, whole-page when it cannot.
-     */
-    subscribeRecords(args: {
-        organization_id: Uuid;
-        table_id: Uuid;
-    }, sink: RecordsChangeSink): () => void;
-}
-/** What a realtime port may tell the package. Two calls, because a column is not a row. */
-interface RecordsChangeSink {
-    /**
-     * THESE RECORDS MOVED. `null` means "I cannot tell you which" — a reconnect, a tab wake, or
-     * a change above the store's own id cap — and is the one case that costs a whole-page read.
-     * An EMPTY array is not the same thing and is not a nudge at all.
-     */
-    records(ids: readonly Uuid[] | null): void;
-    /**
-     * THIS TABLE'S SHAPE MOVED — a column added, retired or changed. Re-reading the rows would
-     * redraw the same table without the new column in it, which is a screen that is out of date
-     * while looking healthy.
-     */
-    shape(): void;
-}
-/**
- * OPTIONAL. Where a refusal that nobody asked about goes — the loud funnel.
- * Default degradation: `console.error` with the store's own words, never
- * silence.
- */
-type RecordsErrorSink = (error: {
-    code: string;
-    message: string;
-    hint?: string;
-    where: string;
-}) => void;
-/**
- * OPTIONAL. The merge-field resolver's server half (`W5-MERGE-B`). While it is
- * not bound, `useMergeField` answers `pending` WITH THE REASON — never a blank,
- * never a literal placeholder left in the text (DYN-14).
- */
-interface RecordsResolverPort {
-    resolve(args: {
-        organization_id: Uuid;
-        merge_field_keys: string[];
-        /** The live selection the `state` source reads (DYNAMIC-VALUES §C). */
-        state?: Record<string, unknown>;
-    }): Promise<unknown>;
-}
-/** The one config a host binds. */
-interface RecordsConfig {
-    /** REQUIRED. */
-    dataSource: RecordsDataSource;
-    /** REQUIRED. */
-    actor: RecordsActor;
-    /**
-     * REQUIRED. REC-29: organizations are hard walls, and the store is keyed
-     * `(organization_id, id)`. There is no "current organization" this package
-     * discovers for itself — the host says which one, every time.
-     */
-    organizationId: Uuid;
-    realtime?: RecordsRealtimePort;
-    onError?: RecordsErrorSink;
-    resolver?: RecordsResolverPort;
-    /**
-     * The schema the record store lives in. Exists so a rehearsal branch and
-     * production can differ without a fork; it is `custom` everywhere today.
-     */
-    schema?: string;
-}
-
 /**
  * THE CLIENT OPERATION LEDGER — how a browser recognises the echo of its own write.
  *
@@ -3542,4 +4172,4 @@ interface ConversationScopeContext {
 /** `About: Acme Industrial` — the chip a bound chat wears. */
 declare function scopeChip(scope: ConversationScope): string;
 
-export { ARCHIVE_LANES, ARCHIVE_LANE_LABEL, ARCHIVE_LANE_MEANS, type ActionRefusal, type ActionRunResult, Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type ArchiveLane, type ArchivedDoorRow, type ArchivedRow, type BookingAvailability, type BookingDeclared, type BookingSummary, type BookingWindow, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type ChoiceOptions, type CoerceOptions, type Coerced, type CoercedAnswers, type CoercibleField, type CommentThreadRead, type CommentWritten, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, DEFAULT_ARCHIVE_LANE, DEFAULT_PORTAL_ARCHIVE_FILTER, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, type DecorationColor, type DecorationPath, type DecorationRule, type DecorationRuleOp, type DecorationTarget, Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type ExampleBuilt, type ExampleSpec, type ExternalPrincipalCard, FIELD_KINDS, Field, type FieldHistoryEntry, type FieldKind, type FormSummary, type FormulaParse, Freshness, type GridLayout, type GridLayoutMode, type GridRowHeight, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportColumnsDeclared, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, type IoExportPage, type KernelTargets, type MergeField, MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, MergeFieldSemanticType, MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, OnDelete, OverridePolicy, PERMISSION_LEVELS, PIPELINE_RULE_KINDS, PORTAL_ARCHIVE_FILTERS, ParityFieldType, type PermissionLevel, PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineGate, type PipelineGatePreview, type PipelineMissingField, type PipelineMoveResult, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalArchiveAnswer, type PortalArchiveFilter, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PortalTableRef, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, ReadRow, type RecordChangeAction, type RecordComment, RecordDocument, type RecordEvent, type RecordFilter, type RecordHistoryEntry, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsChangeSink, type RecordsConfig, type RecordsDataSource, RecordsError, type RecordsErrorSink, type RecordsFilter, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsTableQuery, type RegisteredTable, type Relation, RelationBinding, RelationCardinality, type RelationCarries, type RelationCoordinate, type RelationDisplaySpec, RelationFlavor, type RelationProperties, type RelationStore, type RelationTarget, type RelationWordsManyArgs, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type RowAction, type RowActionStep, type Rule, type RuleAnswer, type RuleExpression, RuleNodeKind, RuleUse, STAGE_RULE_ENFORCEMENT, STAGE_RULE_ON_FAIL, type SavedViewRow, type SavedViewSpecIn, type StagePending, type StagePendingOnBoard, type StageRuleEnforcement, type StageRuleOnFail, type StageRuleWarning, StorageMode, StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, type Table, type TableArchiveProgress, type TableCapacity, type TableDecorations, TableDisplay, TableOrigin, TableType, type TableWebhook, type TableWebhookDeclared, Timestamp, Uuid, type ViewLayout, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, actionRefusals, archivedByLine, archivedWhen, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, coerceTypedAnswer, coerceTypedAnswers, coercionLabel, emptyArchiveLine, emptyPortalArchiveLine, exampleSpec, exportPageXlsx, fieldKindFor, forgetAllOps, highestLevel, holdsARetiredChoice, indexedDbStore, isArchiveLane, isDecided, isOwnOp, isPortalArchiveFilter, isTheChosen, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, mintOpId, openCaptureQueue, optionKey, optionLabel, portalArchiveConsequence, portalConfirmLine, portalPath, portalTitleTypedBack, publicFormPath, recordChangeTrigger, rememberedOpCount, sameDocument, scopeChip, stableFilterKey };
+export { ARCHIVE_LANES, ARCHIVE_LANE_LABEL, ARCHIVE_LANE_MEANS, type ActionRefusal, type ActionRunResult, Actor, type AggregateBucket, type AggregateCompare, type AggregateCompareKind, type AggregateCompareWindows, type AggregateDelta, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type ArchiveLane, type ArchivedDoorRow, type ArchivedRow, type BookingAvailability, type BookingDeclared, type BookingSummary, type BookingWindow, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type ChoiceOptions, type CoerceOptions, type Coerced, type CoercedAnswers, type CoercibleField, type CommentThreadRead, type CommentWritten, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, DEFAULT_ARCHIVE_LANE, DEFAULT_PORTAL_ARCHIVE_FILTER, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, type DashboardTarget, type DashboardTargetBase, type DashboardTargetOp, type DashboardTargetResult, type DashboardTotals, type DecorationColor, type DecorationPath, type DecorationRule, type DecorationRuleOp, type DecorationTarget, Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityRef, type EntityRefWithWords, type EntityReferenceKind, type EntityTableFacts, type ExampleBuilt, type ExampleSpec, type ExternalPrincipalCard, FIELD_KINDS, Field, type FieldHistoryEntry, type FieldKind, type FormSummary, type FormulaParse, Freshness, type GridLayout, type GridLayoutMode, type GridRowHeight, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportColumnsDeclared, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, type IoExportPage, type KernelTargets, type MergeField, MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, MergeFieldSemanticType, MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, OnDelete, type OutsideShareAnswer, OverridePolicy, PERMISSION_LEVELS, PIPELINE_RULE_KINDS, PORTAL_ACCENTS, PORTAL_ARCHIVE_FILTERS, ParityFieldType, type PermissionLevel, PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineGate, type PipelineGatePreview, type PipelineMissingField, type PipelineMoveMany, type PipelineMoveManyItem, type PipelineMoveManyResult, type PipelineMoveResult, type PipelineMoveVerdict, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalAccent, type PortalArchiveAnswer, type PortalArchiveFilter, type PortalCard, type PortalConfig, type PortalConfigInput, type PortalFooterLink, type PortalFormAnswer, type PortalFormInput, type PortalFormRef, type PortalFormSpec, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalStage, type PortalStyle, type PortalStyleInput, type PortalSummary, type PortalTableExposure, type PortalTableRef, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, ReadRow, type RecordChangeAction, type RecordComment, RecordDocument, type RecordEvent, type RecordFilter, type RecordHeader, type RecordHistoryEntry, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsChangeSink, type RecordsConfig, type RecordsDataSource, RecordsError, type RecordsErrorSink, type RecordsFilter, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, RecordsResult, type RecordsTableQuery, type RegisteredTable, type Relation, RelationBinding, RelationCardinality, type RelationCarries, type RelationCoordinate, type RelationDisplaySpec, RelationFlavor, type RelationProperties, type RelationStore, type RelationTarget, type RelationWordsManyArgs, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type RowAction, type RowActionStep, type Rule, type RuleAnswer, type RuleExpression, RuleNodeKind, RuleUse, STAGE_RULE_ENFORCEMENT, STAGE_RULE_ON_FAIL, type SavedViewRow, type SavedViewSpecIn, type StagePending, type StagePendingOnBoard, type StageRuleEnforcement, type StageRuleOnFail, type StageRuleWarning, StorageMode, type StoreFilter, StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, type Table, type TableArchiveProgress, type TableCapacity, type TableDecorations, TableDisplay, type TableListEntry, TableOrigin, type TablePlacement, type TablePlacementFact, type TableRowCount, type TableSyncResult, type TableSyncSource, type TableSyncSpec, TableType, type TableWebhook, type TableWebhookDeclared, Timestamp, Uuid, type ViewLayout, type ViewOrderSet, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDecideMany, type WorkDecideManyItem, type WorkDecideManyResult, type WorkDecideVerdict, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, actionRefusals, archivedByLine, archivedWhen, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, coerceTypedAnswer, coerceTypedAnswers, coercionLabel, emptyArchiveLine, emptyPortalArchiveLine, entityReferenceKinds, entityReferenceKindsOf, entityReferenceWords, entityRefsOf, entityRefsToWrite, exampleSpec, exportPageXlsx, fieldKindFor, forgetAllOps, highestLevel, holdsARetiredChoice, indexedDbStore, isArchiveLane, isDecided, isEntityReferenceConfig, isOwnOp, isPortalAccent, isPortalArchiveFilter, isRuleFilter, isTheChosen, keptGroups, keptOutOfSight, keptTableHref, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, mintOpId, moveInOrder, offeredAsContext, openCaptureQueue, optionKey, optionLabel, portalArchiveConsequence, portalConfirmLine, portalPath, portalTitleTypedBack, publicFormPath, recordChangeTrigger, rememberedOpCount, sameDocument, scopeChip, sheetSyncSpec, stableFilterKey, withRowCounts, withTablePlacement };