@ai-matrx/records 0.57.3 → 0.58.0

package/dist/react/index.d.cts

@@ -3147,6 +3147,11 @@ declare const STORE_DOORS: readonly [{
     readonly args: "";
     readonly returns: "TABLE(function_name text, identity_args text, why text)";
     readonly security: "invoker";
+}, {
+    readonly name: "tables_i_can_open";
+    readonly args: "";
+    readonly returns: "TABLE(table_id uuid, table_name text, organization_id uuid, organization_name text, member boolean, visibility text, updated_at timestamp with time zone)";
+    readonly security: "definer";
 }, {
     readonly name: "tables_shared_with_me";
     readonly args: "";
@@ -3267,6 +3272,11 @@ declare const STORE_DOORS: readonly [{
     readonly args: "p_user uuid, p_organization_id uuid, p_table_id uuid, p_required permission_level DEFAULT 'viewer'::permission_level, OUT o_all_visible boolean, OUT o_true_visibility platform.visibility[], OUT o_granted_all uuid[], OUT o_granted_visible uuid[], OUT o_carried_visible uuid[], OUT o_ladder_calls integer, OUT o_fallback boolean, OUT o_note text";
     readonly returns: "record";
     readonly security: "definer";
+}, {
+    readonly name: "where_id_opens";
+    readonly args: "p_id uuid";
+    readonly returns: "jsonb";
+    readonly security: "definer";
 }, {
     readonly name: "widget_kernel_id";
     readonly args: "";
@@ -3710,7 +3720,7 @@ declare const STORE_REFUSAL_CODES: readonly [{
     readonly raised_by: "has_visibility_at";
 }, {
     readonly code: "42501";
-    readonly raised_by: "_doc_render_immutable,_doc_signature_immutable,_field_definition_write,_field_write_door,_rule_definition_write,_store_door,agent_table_claim,anon_capture,anon_inbound_land,anon_publish,anon_token_issue,anon_token_verify,anon_write,assert_client_may_change,assert_client_may_open,assert_client_may_reach,assert_may_know_table,assert_organization_admin,assert_store_door,booking_confirm,booking_declare,booking_hold,capture_submit,checklist_run,comment_write,conversation_scope_bind,conversation_scope_unbind,doc_sign,enrich_declare,enrich_due,enrich_land,enrich_normalize,entity_field_declare,entity_field_retire,entity_field_update,entity_value_write,external_write_through,form_declare,form_submit,inbound_mail_land,io_comment_resolve,io_comment_write,io_import_begin,io_import_finish,io_restore,migrate_purge,migrate_purge_hard,migrate_purge_hard_request,migrate_reclass,my_levels,organization_clear,portal_declare,portal_invitation,portal_invite,portal_invite_accept,portal_principal_bind,promote_table,query_visibility_parity,read_record,read_records,read_records_archived,read_records_by_ids,read_records_matching,record_table,record_write_graph,relation_halves_disagreements,relation_halves_repair,share_grant,subscription_mute,subscription_preview,table_share_outside_accept,table_share_outside_invite,table_share_outside_resend,table_webhook_declare,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_person";
+    readonly raised_by: "_doc_render_immutable,_doc_signature_immutable,_field_definition_write,_field_write_door,_rule_definition_write,_store_door,agent_table_claim,anon_capture,anon_inbound_land,anon_publish,anon_token_issue,anon_token_verify,anon_write,assert_client_may_change,assert_client_may_open,assert_client_may_reach,assert_may_know_table,assert_organization_admin,assert_store_door,booking_confirm,booking_declare,booking_hold,capture_submit,checklist_run,comment_write,conversation_scope_bind,conversation_scope_unbind,doc_sign,enrich_declare,enrich_due,enrich_land,enrich_normalize,entity_field_declare,entity_field_retire,entity_field_update,entity_value_write,external_write_through,form_declare,form_submit,inbound_mail_land,io_comment_resolve,io_comment_write,io_import_begin,io_import_finish,io_restore,migrate_purge,migrate_purge_hard,migrate_purge_hard_request,migrate_reclass,my_levels,organization_clear,organization_contents,portal_declare,portal_invitation,portal_invite,portal_invite_accept,portal_principal_bind,promote_table,query_visibility_parity,read_record,read_records,read_records_archived,read_records_by_ids,read_records_matching,record_table,record_write_graph,relation_halves_disagreements,relation_halves_repair,share_grant,subscription_mute,subscription_preview,table_share_outside_accept,table_share_outside_invite,table_share_outside_resend,table_webhook_declare,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_person";
 }, {
     readonly code: "42703";
     readonly raised_by: "entity_table,portal_declare";
@@ -4666,6 +4676,17 @@ interface NewFieldDeclaration {
     of?: string;
     /** A formula: the expression, in the same shape a Rule uses (REC-15). */
     expr?: Record<string, unknown>;
+    /**
+     * A formula IN THE LANGUAGE A PERSON TYPES — `{Visit fee} - {Deposit taken}` (GRID-PRIMITIVES
+     * G3). The store parses it (`custom.formula_parse`), keeps the text in `config.formula_text`
+     * and the expression it parses to in `config.expr`; send this OR `expr`, never both.
+     */
+    formula_text?: string;
+    /**
+     * LANE SC-R — an `entity_reference` column's kinds: the platform entity tokens it may point at
+     * (`note`, `site`, `agent` …), kept by the store in `config.allowed_types`.
+     */
+    allowed_types?: string[];
     compute_on?: ComputeOn;
     relation_max?: number;
     /**
@@ -4708,7 +4729,7 @@ interface NewFieldDeclaration {
  * `checkbox` landed, which is how the store's own refusals came to name a list
  * that no longer matched it.
  */
-type FieldTypeWord = DeclarableFieldKind | FieldBehavior | "number" | "integer" | "decimal" | "float" | "long_text" | "string";
+type FieldTypeWord = DeclarableFieldKind | FieldBehavior | "number" | "integer" | "decimal" | "float" | "long_text" | "string" | "autonumber" | "created_time" | "modified_time" | "entity_reference";
 /**
  * What `custom.field_update` accepts.
  *
@@ -4810,6 +4831,13 @@ interface FieldPatch {
      * Field document under the guards rather than through them.
      */
     expr?: Record<string, unknown>;
+    /**
+     * RE-AIMING A FORMULA IN THE LANGUAGE A PERSON TYPES (GRID-PRIMITIVES G3). Same arm as
+     * `expr` — send it with `type: "formula"`; the store parses it and keeps both the text and
+     * the expression. Measured on the dev clone 2026-09-23: `{"type":"formula","formula_text":
+     * "{Visit fee} * 2"}` re-aims the column and keeps its other settings.
+     */
+    formula_text?: string;
 }
 /**
  * Whether a choice column takes values that are not one of its choices
@@ -4900,7 +4928,7 @@ interface CoercibleField {
  * `plain_text`, `long_text`, `number` and `boolean` are behaviours that carry
  * no parity type of their own; every other word here is a parity type.
  */
-declare const FIELD_KINDS: readonly ["attachment", "checkbox", "currency", "datetime", "email", "formula", "json", "long_text", "lookup", "member", "multi_select", "number", "percent", "phone", "relation", "rollup", "select", "text", "url"];
+declare const FIELD_KINDS: readonly ["attachment", "checkbox", "currency", "datetime", "email", "entity_reference", "formula", "json", "long_text", "lookup", "member", "multi_select", "number", "percent", "phone", "relation", "rollup", "select", "text", "url"];
 /**
  * 🚨 THE UNION IS DERIVED FROM THE LIST ABOVE, and the list is what the
  * coverage test walks. Add a kind here and the test drives it; give it no arm
@@ -4954,6 +4982,13 @@ interface CoerceOptions {
      */
     label?: string | undefined;
 }
+/**
+ * SC-R / P12. Whether a relation's config makes it an ENTITY REFERENCE: target
+ * mode `any` (REL-8) restricted by a non-empty `allowed_types`.
+ */
+declare function isEntityReferenceConfig(config: Record<string, unknown> | null | undefined): boolean;
+/** The platform kinds an entity-reference Field may name, lower-cased, in its own order. */
+declare function entityReferenceKindsOf(field: Pick<CoercibleField, "config">): string[];
 /** The Field's name in plain words — never its key on a screen. */
 declare function coercionLabel(field: CoercibleField): string;
 /**
@@ -5367,6 +5402,48 @@ interface PipelineMoveResult {
     }[];
     what_happens?: string;
 }
+/** One card of a batch move (`custom.pipeline_move_many`). The version is REQUIRED: it is the
+ * version the board loaded, and a card that changed since answers `changed_since_loaded`. */
+interface PipelineMoveManyItem {
+    record_id: Uuid;
+    stage: string;
+    expected_version: number;
+    /** Columns the stage asks for, filled in on the way in. */
+    also?: Record<string, unknown>;
+}
+/** What one card of a batch move came to. The sentence is always the store's own. */
+type PipelineMoveVerdict = "moved" | "needs_approval" | "needs_fields" | "changed_since_loaded" | "no_right" | "refused";
+interface PipelineMoveManyResult {
+    index: number;
+    record_id: Uuid;
+    stage: string;
+    verdict: PipelineMoveVerdict;
+    sentence: string;
+    /** Set on `needs_fields`: the empty columns the stage asks for. */
+    needs?: PipelineMissingField[];
+    /** Set on `moved` / `needs_approval`: the card's version now. */
+    version?: number;
+    /** Set on `changed_since_loaded`: the version that won. */
+    current_version?: number;
+    expected_version?: number;
+    approval_id?: Uuid;
+    approvers?: {
+        user_id: Uuid;
+        name: string | null;
+        why: string;
+    }[];
+    warnings?: StageRuleWarning[];
+    rule?: string;
+    code?: string;
+}
+/** What `custom.pipeline_move_many` answers: the counts, then one verdict per card in order. */
+interface PipelineMoveMany {
+    asked: number;
+    moved: number;
+    needs_approval: number;
+    not_moved: number;
+    results: PipelineMoveManyResult[];
+}
 /**
  * ONE GATE ON A STAGE, as the condition builder on the stage settings screen writes it.
  * `requires`, `who` and `limits` are sugar over this shape; this is the general form, and
@@ -5914,6 +5991,124 @@ interface PortalCard {
      * decides whether they can sign in at all.
      */
     external_lane_open: boolean;
+    /** S6 — the look and forms exactly as the owner stored them (`{}` when none). */
+    config: PortalConfig;
+    /** S6 — the look as a client sees it: the portal's own values over the organization's brand. */
+    style: PortalStyle;
+    /** S6 — every form on the portal, in its order, with its title, Table and state. */
+    forms: PortalFormRef[];
+    /** S6 — the accent names a portal may carry (the design system's `STYLE_COLORS`). */
+    accents: PortalAccent[];
+    /**
+     * S6 — the pictures that could be this portal's logo: the organization's own PUBLIC pictures in
+     * Files, newest first. A private file is never offered, because the store would refuse it.
+     */
+    logo_candidates: Array<{
+        file_id: Uuid;
+        name: string;
+        url: string | null;
+    }>;
+}
+/** The design system's colour names (`STYLE_COLORS`), which is all an accent may be. */
+declare const PORTAL_ACCENTS: readonly ["slate", "green", "amber", "red", "blue", "violet", "teal"];
+type PortalAccent = (typeof PORTAL_ACCENTS)[number];
+declare function isPortalAccent(word: unknown): word is PortalAccent;
+/** One link in a portal's footer. The store takes only `https://`, `mailto:` and `tel:`. */
+interface PortalFooterLink {
+    label: string;
+    url: string;
+}
+/** A portal's look as the owner sets it. Every key is optional; absent means "the organization's". */
+interface PortalStyleInput {
+    display_name?: string | null;
+    welcome?: string | null;
+    logo_file_id?: Uuid | null;
+    accent?: PortalAccent | null;
+    footer_links?: PortalFooterLink[] | null;
+}
+/** One form on a portal, as the owner sets it. `order` is the position; `label` overrides the title. */
+interface PortalFormInput {
+    form_id: Uuid;
+    label?: string | null;
+    order?: number | null;
+}
+/**
+ * What `portalDeclare({ config })` sends. A key given REPLACES that key; a key not given is KEPT;
+ * `style: null` puts the organization's brand back and `forms: []` takes every form off.
+ */
+interface PortalConfigInput {
+    style?: PortalStyleInput | null;
+    forms?: PortalFormInput[] | null;
+}
+/** The look and forms as the store holds them (normalized by the store). */
+interface PortalConfig {
+    style?: PortalStyleInput;
+    forms?: Array<{
+        form_id: Uuid;
+        label?: string;
+        order: number;
+    }>;
+}
+/** The look a client is shown — resolved by the store, never computed by a screen. */
+interface PortalStyle {
+    display_name: string;
+    welcome: string | null;
+    logo_file_id: Uuid | null;
+    /** The logo's PUBLIC address, or null. Readable by anybody the portal is shown to. */
+    logo_url: string | null;
+    /** Null means the app's own colour. */
+    accent: PortalAccent | null;
+    footer_links: PortalFooterLink[];
+    /** Which of the values above came from the organization rather than the portal. */
+    from_organization: Array<"display_name" | "logo">;
+}
+/** One form on a portal, with what the owner needs to see about it. */
+interface PortalFormRef {
+    form_id: Uuid;
+    /** What the portal calls it (the owner's label, else the form's title). */
+    label: string;
+    order: number;
+    title: string;
+    table_id: Uuid | null;
+    table: string;
+    /** `gone` is a form that was removed; the outsider's list only ever carries `open`. */
+    state: "open" | "closed" | "full" | "gone";
+}
+/** A Table's stages as a portal client may be told them (`custom.portal_me` → tables[].stage). */
+interface PortalStage {
+    /** The stage Field's key on the record. */
+    field: string;
+    label: string;
+    /** In the order they were declared. A record stores the stage's `key`. */
+    stages: Array<{
+        key: string;
+        label: string;
+        retired: boolean;
+    }>;
+}
+/** What `custom.portal_form` answers: one form on the caller's own portal. */
+interface PortalFormSpec {
+    form_id: Uuid;
+    portal_id: Uuid;
+    table_id: Uuid;
+    title: string;
+    label: string;
+    presentation: Record<string, unknown>;
+    /** The form's exposed Fields as the store holds them — never the one naming the client. */
+    fields: Array<Record<string, unknown> & {
+        id: Uuid;
+        key: string;
+    }>;
+    required: string[];
+    state: "open" | "closed" | "full";
+    message: string | null;
+}
+/** What `custom.portal_form_submit` answers. `held` waits for the office; `message` says so. */
+interface PortalFormAnswer {
+    submission_id: Uuid | null;
+    record_id: Uuid | null;
+    state: "accepted" | "held" | "rejected" | "closed" | "full" | "too_many";
+    message: string | null;
 }
 /** What `custom.portal_invite` answers. `say` is the door's own sentence. */
 interface PortalInvitation {
@@ -6040,6 +6235,22 @@ type AggregateFilter = string | number | boolean | null | AggregateWindow;
  * lands somewhere else, which is the only way a drill-through can lie.
  */
 type RecordFilter = Record<string, AggregateFilter>;
+/**
+ * S2-PRIME FILTER-GROUPS — A READ DOOR'S QUESTION, IN EITHER OF ITS TWO SHAPES.
+ *
+ * The flat `RecordFilter` above (field key → scalar / `null` / window, AND only) is what
+ * dashboards, drill-throughs and the notifier carry. A `RuleExpression` — `{op, args}`, ALL / ANY /
+ * NOT groups nested to any depth, fields by id — is what the condition builder, a view's own
+ * filter and every membership Rule speak. `custom.record_filter_sql(org, table, filter)` turns
+ * EITHER into the one WHERE clause the grid (`list`), the aggregate and the board all use, so the
+ * three can never disagree about which records a view holds.
+ */
+type StoreFilter = RecordFilter | RuleExpression;
+/**
+ * Is this filter a Rule expression? The store's own test (`custom.filter_is_rule`): an object
+ * whose `op` is a word and which carries `args`.
+ */
+declare function isRuleFilter(filter: unknown): filter is RuleExpression;
 /** One measure. `count` counts rows and needs no Field; the rest read one. */
 interface AggregateMeasure {
     op: AggregateOperation;
@@ -6055,6 +6266,90 @@ interface AggregateRow {
     groups: Record<string, string | null>;
     measures: Record<string, number | null>;
     row_count: number;
+    /**
+     * S3 — present only when the question carried a comparison. The same group
+     * in the PRIOR window: a bucket is matched by its position in its own window
+     * (week 1 of September beside week 1 of August), so `prior_groups` names the
+     * prior bucket's own date. `null` when the prior window had no such group.
+     */
+    prior_groups?: Record<string, string | null> | null;
+    /** The prior window's measures, keyed exactly like `measures`. */
+    prior_measures?: Record<string, number | null> | null;
+    prior_row_count?: number | null;
+    /** Every measure now and before, the change, and the change as a percent of before. */
+    delta?: Record<string, AggregateDelta> | null;
+    /** The two windows this row was worked out over, and the calendar that cut them. */
+    compare?: AggregateCompareWindows | null;
+    /**
+     * S3 — a compared, bucketed row's POSITION in its window (0 = the first
+     * bucket). A row the current window has not reached yet has a position and
+     * no current bucket, so a chart names it "Week 6" rather than inventing a date.
+     */
+    position?: number | null;
+}
+/**
+ * S3 — WHAT A PERIOD IS COMPARED AGAINST (`custom.agg_compare_kinds()`).
+ * `previous_period` is the period before, of the same length (August before
+ * September; an explicit window shifted back by its own length);
+ * `same_period_last_year`; `range` is a fixed `baseline`.
+ */
+type AggregateCompareKind = "previous_period" | "same_period_last_year" | "range";
+/**
+ * S3 — ONE COMPARISON, as `custom.record_aggregate(p_compare)` and a
+ * dashboard block's `compare` both take it. The current window is either the
+ * calendar `period` holding `at` (default: now, in the organization's time
+ * zone) or an explicit `from`/`to`. A date alone ("2026-09-01") is that local
+ * day in the organization's time zone.
+ */
+interface AggregateCompare {
+    against?: AggregateCompareKind;
+    /** The date Field the period runs along. Defaults to the bucket's key. */
+    key?: string;
+    period?: AggregateBucket;
+    at?: string;
+    from?: string;
+    to?: string;
+    /** Compare the part of the period that has happened ("month to date"). */
+    to_date?: boolean;
+    /** The fixed period `range` compares against. Half-open: `to` is excluded. */
+    baseline?: {
+        from: string;
+        to: string;
+    };
+}
+/** One measure now and before. `change_pct` is null when before was nothing or zero. */
+interface AggregateDelta {
+    current: number | null;
+    prior: number | null;
+    change: number | null;
+    change_pct: number | null;
+}
+/**
+ * S3 — THE TWO WINDOWS the store actually ran, as local ISO moments with the
+ * organization's offset ("2026-09-01T00:00:00-07:00"), and the calendar that
+ * cut them. A screen labels the comparison from THIS, never from its own clock.
+ */
+interface AggregateCompareWindows {
+    key: string;
+    against: AggregateCompareKind;
+    period: AggregateBucket | null;
+    to_date: boolean;
+    time_zone: string;
+    week_start: string;
+    /** The bucket grain the windows were counted in, when the question had a bucket. */
+    grain: AggregateBucket | null;
+    /** How many buckets the current window holds — what a target's pace is shared over. */
+    bucket_count: number | null;
+    window: {
+        from: string;
+        to: string;
+    };
+    prior_window: {
+        from: string;
+        to: string;
+    };
+    /** On a row from `recordAggregate`: that row's bucket position (see `AggregateRow.position`). */
+    position?: number | null;
 }
 /** The measure key the store answers with, so a chart can find its own series. */
 declare function measureKey(measure: AggregateMeasure): string;
@@ -6070,7 +6365,7 @@ declare function measureKey(measure: AggregateMeasure): string;
  * one question. `undefined` and an empty filter are both `"{}"` — the caller
  * asked nothing, and there is only one way to ask nothing.
  */
-declare function stableFilterKey(filter: RecordFilter | null | undefined): string;
+declare function stableFilterKey(filter: StoreFilter | null | undefined): string;
 
 /**
  * Who the data belongs to. A test organization is created under this name — the
@@ -6628,6 +6923,187 @@ declare function recordChangeTrigger(tableId: Uuid, options?: {
     actions?: RecordChangeAction[];
     changed_fields?: string[];
 };
+/**
+ * One entry of `custom.table_list_everywhere` — `public.get_user_tables`' own shape plus
+ * `store`, so a picker swaps one call and keeps its code. `store` says which home opens it.
+ */
+interface TableListEntry {
+    id: Uuid;
+    table_name: string;
+    description: string | null;
+    version: number | null;
+    user_id: Uuid | null;
+    is_public: boolean | null;
+    visibility: string | null;
+    organization_id: Uuid;
+    created_at: string;
+    updated_at: string | null;
+    last_activity_at: string | null;
+    row_count: number;
+    field_count: number;
+    store: "older" | "records";
+}
+/** Where a synced table comes from. `external_id` is the source's own id (a spreadsheet id). */
+interface TableSyncSource {
+    provider: string;
+    external_id: string;
+    tab_id?: string | null;
+    synced_at?: string | null;
+}
+/** What `custom.table_sync` takes: the source, its columns, and every row it has NOW. */
+interface TableSyncSpec {
+    source: TableSyncSource;
+    table_name: string;
+    columns: string[];
+    rows: {
+        ref: string;
+        values: Record<string, string | number | boolean | null>;
+    }[];
+}
+interface TableSyncResult {
+    table_id: Uuid;
+    created: boolean;
+    fields_added: number;
+    rows_inserted: number;
+    rows_updated: number;
+    rows_archived: number;
+    source_system: string;
+}
+/**
+ * A sheet tab's cells (header row first) → the spec `custom.table_sync` takes. Every row is
+ * named by its sheet row number (`row-2` is the first row under the header) unless
+ * `refColumn` names a column holding a stable id; a blank or repeated ref is refused here, so
+ * the store never sees two rows claiming to be the same source row. Wholly blank rows are
+ * skipped. Pure.
+ */
+declare function sheetSyncSpec(args: {
+    source: TableSyncSource;
+    tableName: string;
+    cells: readonly (readonly (string | number | boolean | null | undefined)[])[];
+    refColumn?: string;
+}): TableSyncSpec;
+/** One row of `custom.table_row_counts`: the rows of that Table this reader may see. */
+interface TableRowCount {
+    table_id: Uuid;
+    visible_rows: number;
+}
+/**
+ * One row of `custom.record_headers`: the row's own columns the document door does not answer.
+ * `created_by` is the caller's own id on rows the caller made and null on every other; `mine`
+ * says which.
+ */
+interface RecordHeader {
+    id: Uuid;
+    table_id: Uuid;
+    created_at: string;
+    updated_at: string;
+    version: number;
+    deleted_at: string | null;
+    mine: boolean;
+    created_by: Uuid | null;
+}
+/**
+ * Fold `table_row_counts` onto a table list: `row_count` set on every Table the counts name.
+ * A Table the counts do not name keeps what it had — the store answers no row for a Table this
+ * reader may not know, and that is never turned into a zero. Pure.
+ */
+declare function withRowCounts<T extends {
+    id: Uuid;
+    row_count?: number | null;
+}>(tables: readonly T[], counts: readonly TableRowCount[] | null | undefined): T[];
+/** What `custom.view_record_order_set` answers. */
+interface ViewOrderSet {
+    view_id: Uuid;
+    table_id: Uuid;
+    order: "manual";
+    named: number;
+    positioned: number;
+}
+/**
+ * The order to send after a drag: `order` with `moved` taken out and put at `toIndex` (clamped).
+ * The store keeps every row the call does not name in its old place after the named ones, so a
+ * screen may send only the rows it shows. Pure.
+ */
+declare function moveInOrder(order: readonly Uuid[], moved: Uuid, toIndex: number): Uuid[];
+/**
+ * What `custom.table_share_outside_grant` answers. `person` says which path ran:
+ * `outside_account` (granted at once and notified — never made a member), `member` (a plain
+ * share), `no_account` (the invitation door's own answer, with its link and delivery).
+ */
+interface OutsideShareAnswer {
+    granted: boolean;
+    invited: boolean;
+    joined: boolean;
+    person: "outside_account" | "member" | "no_account";
+    email: string;
+    table: string;
+    level: string;
+    level_label: string;
+    say: string;
+    user_id?: Uuid;
+    permission_id?: Uuid;
+    invitation_id?: Uuid | null;
+    accept_path?: string | null;
+    delivery_say?: string | null;
+}
+
+/** The three placement facts, as the Table document or `custom.table` carries them. */
+interface TablePlacement {
+    kept_by_the_app?: boolean | null;
+    kept_for?: string | null;
+    offered_as_context?: boolean | null;
+}
+/**
+ * One row of `custom.table_facts` since SC-1 — the two lane facts it always answered
+ * (`visibility`, `mine`) and the placement, with the sentence a person reads and where the
+ * table is used. A store without the SC-1 door answers the first three columns only; every
+ * placement column is then `undefined`, and the readers below treat the table as the
+ * organization's own — exactly what that store's older screens did.
+ */
+interface TablePlacementFact extends TablePlacement {
+    table_id: Uuid;
+    visibility: string;
+    mine: boolean;
+    /** The heading a kept table is listed under: "The context system", "The choices behind your columns", … */
+    keeper_group?: string | null;
+    /** One plain sentence: who keeps it and where it opens from. Null for the organization's own. */
+    keeper_says?: string | null;
+    /** Where the table is used: `table` (another Table, or itself) or `scope` (a context scope). */
+    used_in_kind?: "table" | "scope" | null;
+    used_in_id?: Uuid | null;
+    /** The Table that page belongs to, when `used_in_kind` is `table`. */
+    used_in_table_id?: Uuid | null;
+}
+/** Whether a person's list of tables keeps this one out of sight until "Show everything". */
+declare function keptOutOfSight(placement: TablePlacement | null | undefined): boolean;
+/** Whether the context picker may offer this Table. Absent is no. */
+declare function offeredAsContext(placement: TablePlacement | null | undefined): boolean;
+/**
+ * The placement facts folded onto a table list, by id. Pure — returns new objects and leaves
+ * the list it was given alone. A table the facts do not name is returned unchanged.
+ */
+declare function withTablePlacement<T extends {
+    id: Uuid;
+}>(tables: readonly T[], facts: readonly TablePlacementFact[] | null | undefined): Array<T & Partial<TablePlacementFact>>;
+/**
+ * THE KEPT TABLES, GROUPED UNDER THEIR KEEPER, in the order each group first appears. A kept
+ * table the store gave no heading goes under "Kept by the app" — never dropped.
+ */
+declare function keptGroups<T extends TablePlacement & Partial<TablePlacementFact>>(tables: readonly T[]): Array<{
+    group: string;
+    tables: T[];
+}>;
+/**
+ * WHERE A KEPT TABLE OPENS FROM (THE DOOR LAW): the host's own addresses for a table and for a
+ * context scope, chosen by what the store said the table is used in. With nothing said, the
+ * table's own page — a kept table is never a row with nowhere to go.
+ */
+declare function keptTableHref(fact: {
+    table_id: Uuid;
+} & Partial<TablePlacementFact>, hrefs: {
+    table: (tableId: Uuid) => string;
+    scope: (scopeId: Uuid) => string;
+}): string;
 
 /** The seven shapes a block can take, exactly as `custom.dashboard_kinds()` answers. */
 type DashboardBlockKind = "number" | "bar" | "column" | "line" | "donut" | "table" | "stuck";
@@ -6660,6 +7136,43 @@ interface DashboardBlock {
     state_key?: string;
     /** `stuck` only: how long a record may sit on the same value. Defaults to 14. */
     days?: number;
+    /**
+     * S3 — the comparison this block makes (this month against last month).
+     * The door fills `key` from the bucket when it is left out, and refuses a
+     * comparison along a Field the Table does not have, by name.
+     */
+    compare?: AggregateCompare | null;
+    /** S3 — the number this block is aiming for. */
+    target?: DashboardTarget | null;
+}
+/**
+ * S3 — A BLOCK'S TARGET. `measure` is one of the block's own measure keys
+ * (default: the first). `per: "period"` is a target for the whole window (a
+ * monthly target — a bucketed chart draws its even share per bucket as the
+ * pace); `per: "bucket"` is a target for every bar or point.
+ *
+ * A target is a FIXED NUMBER (`value`) or A GOAL COLUMN (`field`, a Field key of
+ * the block's Table): the store adds that column up (`op`, default `sum`) over
+ * exactly the records the block's own number read — same filter, same window,
+ * same reader — so "invoiced against quoted" is about the same jobs. Exactly
+ * one of the two; a goal column is always `per: "period"`.
+ */
+type DashboardTarget = DashboardTargetBase & ({
+    value: number;
+    field?: never;
+    op?: never;
+} | {
+    field: string;
+    op?: DashboardTargetOp;
+    value?: never;
+});
+/** How a goal column is added up across the block's records. */
+type DashboardTargetOp = "sum" | "avg" | "min" | "max";
+/** What every target carries, whichever kind it is. */
+interface DashboardTargetBase {
+    label?: string;
+    measure?: string;
+    per?: "period" | "bucket";
 }
 /** One dashboard as `custom.dashboards` reports it to its organization. */
 interface DashboardSummary {
@@ -6718,6 +7231,56 @@ interface DashboardBlockResult {
     refused?: string;
     /** The SQLSTATE that refusal carried. */
     sqlstate?: string;
+    /**
+     * S3 — the windows this block was actually compared over; `null` when it was
+     * not compared. (The comparison it was ASKED to make is the saved block's.)
+     */
+    compare?: AggregateCompareWindows | null;
+    /** S3 — why a canvas comparison was not applied to this block (it has no date). */
+    compare_refused?: string;
+    /**
+     * S3 — the block's first (or target) measure added up across its rows, now
+     * and before, when the measure adds up (count, sum, filled, empty) or the
+     * block has one row. Worked out by the store from the rows it answered, so
+     * a tile, a chart and a ring cannot disagree.
+     */
+    totals?: DashboardTotals;
+    /** S3 — the target, with how far the current total has come and its pace per bucket. */
+    target?: DashboardTargetResult;
+}
+/** S3 — one block's total, now and before. */
+interface DashboardTotals {
+    measure: string;
+    current: number | null;
+    prior: number | null;
+    change: number | null;
+    change_pct: number | null;
+}
+/** S3 — a target as the run answers it. */
+interface DashboardTargetResult {
+    /**
+     * The number aimed at: the fixed value, or the goal column added up over this
+     * block's records. `null` when a goal column had nothing to add up, or was refused.
+     */
+    value: number | null;
+    /** A goal column's key, when the target is read from one. */
+    field?: string;
+    /** How that column was added up. */
+    op?: DashboardTargetOp;
+    /**
+     * The store's own sentence when THIS reader may not read the goal column — the
+     * block still answers its number; only the target is withheld.
+     */
+    refused?: string;
+    label: string;
+    measure: string;
+    per: "period" | "bucket";
+    /** The current total the target is measured against. */
+    current: number | null;
+    /** current ÷ value, 4 decimals. */
+    progress: number | null;
+    /** The line a bucketed chart draws: the target's even share of one bucket, or the target itself per bucket. */
+    pace: number | null;
 }
 /** What `custom.dashboard_run` answers: the canvas, and every block's own result. */
 interface DashboardRunResult {
@@ -6727,6 +7290,15 @@ interface DashboardRunResult {
     presentation: Record<string, unknown>;
     /** The one filter bar this run was asked with. */
     filter: Record<string, AggregateFilter>;
+    /** S3 — the date grain the canvas re-cut every bucketed block to, or null. */
+    grain?: AggregateBucket | null;
+    /** S3 — the canvas comparison this run was asked with, or null. */
+    compare?: AggregateCompare | null;
+    /** S3 — the organization's calendar every date on this canvas was cut with. */
+    calendar?: {
+        time_zone: string;
+        week_start: string;
+    };
     blocks: DashboardBlockResult[];
 }
 
@@ -7458,11 +8030,22 @@ interface SavedViewRow {
     name: string;
     table_id: Uuid | null;
     filters: RecordFilter;
+    /**
+     * THE WHOLE VIEW (S0 ONE-SAVED-VIEW, 2026-09-23): `platform.saved_view` is the ONE saved-view
+     * store, so this is what the view bar, the board, the calendar and the gallery draw from —
+     * `layout` (the kind), `group_field`, `measure`, `date_field`, `image_field`, `sorts`, `rule_id`,
+     * `is_default`, `presentation`, G7's `grid`, G13's `order`, the mover's `moved_from`.
+     */
+    definition: Record<string, unknown>;
     created_at: string;
 }
-/** What `custom.view_declare` is asked for. `view_id` re-states rather than doubling. */
+/**
+ * What `custom.view_declare` is asked for. With `view_id` the door MERGES: `name` changes only
+ * when sent, `filters` only when the key is sent, each `definition` key replaces that one key and
+ * a key sent as `null` is removed — so a screen sends only what it changed.
+ */
 interface SavedViewSpecIn {
-    name: string;
+    name?: string;
     filters?: RecordFilter | null;
     definition?: Record<string, unknown> | null;
     view_id?: Uuid | null;
@@ -7493,43 +8076,204 @@ interface SubscriptionBlock {
 }
 
 /**
- * REL-6. Whether Visibility flows along this relation and the MAXIMUM access
- * level it carries. Default off on `referenced`, on for `owned`.
+ * The data seam: a structural subset of `SupabaseClient`. The package never
+ * opens a database connection of its own and never holds a key — the HOST
+ * supplies a client that already carries the operating person's session, which
+ * is what makes DOOR-5 and AGT-N-4 true (the store sees the person, not us).
  */
-interface RelationCarries {
-    carries: boolean;
-    /** The ceiling — a relation never carries more access than this. */
-    max_access: string | null;
+interface RecordsDataSource {
+    /**
+     * Call a door. The name is always a door the live catalogue has; `/core`
+     * refuses `door_absent` before it ever reaches here for one that does not.
+     */
+    rpc(fn: string, args: Record<string, unknown>, 
+    /**
+     * THE SCHEMA THE DOOR LIVES IN, always supplied: `custom` for the store's
+     * own doors, `iam` for the trust doors (the external principal and the
+     * publish binding, which are the PLATFORM's). A host binding supabase-js
+     * routes this to `client.schema(options.schema).rpc(fn, args)`; a host that
+     * ignores it calls its own default PostgREST profile — `public` — and is
+     * refused by name, which is the failure we want rather than a silent answer
+     * from the wrong system. (Before 2026-09-18 this was described as "only ever
+     * `iam`" and the store's doors went unqualified; the extension's first real
+     * turn proved that asks `public.store_is_open` and finds nothing.)
+     */
+    options?: {
+        schema?: string;
+    }): PromiseLike<{
+        data: unknown;
+        error: PgError | null;
+    }>;
+    /** Reads of `custom.*` go through the schema-qualified builder, never a bare `from`. */
+    schema(name: string): {
+        from(table: string): RecordsTableQuery;
+    };
 }
-/** The seven properties, each its own question. */
-interface RelationProperties {
-    /** REL-1. Stored once on the contained table, read from the field's side. */
-    flavor: RelationFlavor;
-    /** REL-2. Separate from flavour. */
-    on_delete: OnDelete;
-    /** REL-3. A snapshot is a frozen copy in the relation's payload — never a pointer into History. */
-    binding: RelationBinding;
-    /** REL-4. */
-    ordered: boolean;
-    /** REL-5. */
-    loops: "allowed" | "refused";
-    /** REL-6. */
-    carries: RelationCarries;
-    /** REL-7. */
-    cardinality: RelationCardinality;
+/** The read surface the list and query paths use. A real supabase-js client satisfies it. */
+interface RecordsTableQuery {
+    select(columns: string, options?: {
+        count?: "exact" | "planned" | "estimated";
+        head?: boolean;
+    }): RecordsFilter;
 }
-/**
- * REL-8 / REL-N-1. A target is a REFERENCE, written that way from the first
- * line of code, because it may name a row outside our database. One Table,
- * several, or any — polymorphic without restriction. External targets are
- * read-only in v1.
- */
-type RelationTarget = {
-    kind: "ours";
-    entity_token: string;
-    row_id: Uuid;
-} | {
-    kind: "external";
+interface RecordsFilter extends PromiseLike<RecordsResponse> {
+    eq(column: string, value: unknown): RecordsFilter;
+    neq(column: string, value: unknown): RecordsFilter;
+    in(column: string, values: readonly unknown[]): RecordsFilter;
+    is(column: string, value: null | boolean): RecordsFilter;
+    gte(column: string, value: unknown): RecordsFilter;
+    lte(column: string, value: unknown): RecordsFilter;
+    order(column: string, options?: {
+        ascending?: boolean;
+    }): RecordsFilter;
+    range(from: number, to: number): RecordsFilter;
+    limit(count: number): RecordsFilter;
+}
+interface RecordsResponse {
+    data: unknown;
+    error: PgError | null;
+    count?: number | null;
+}
+/**
+ * WHO IS ACTING. AGT-N-4: an agent carries the exact authority of the person
+ * operating it — there is no agent identity and there are no service roles. So
+ * the actor word and the person are two separate facts, and `on_behalf_of` is
+ * meaningful only when the actor is `agent`.
+ */
+interface RecordsActor {
+    actor: Actor;
+    /** The signed-in person. The store reads this from the session, not from us; this is for the client's own mirror. */
+    user_id?: Uuid;
+    /** Only an agent acts on behalf of a person (the store refuses it otherwise). */
+    on_behalf_of?: Uuid;
+}
+/**
+ * OPTIONAL. A live-updates seam. The default degradation is stated rather than
+ * silent: with no port bound, `useRecords` reports `live: false` and the screen
+ * can say "not live" instead of quietly going stale.
+ *
+ * A host binds this with `@ai-matrx/data/react`'s channel hygiene — the package
+ * deliberately does NOT depend on it, so the headless core stays free of a
+ * realtime client and a host that has one keeps using the one it already has.
+ */
+interface RecordsRealtimePort {
+    /**
+     * Watch one organization's records of one table. Returns an unsubscribe.
+     *
+     * THE HOST NUDGES THROUGH THIS SINK AND REACHES AROUND NOTHING. Until 0.43.0 the callback
+     * was `(recordId: Uuid) => void` and a host that also wanted to say "the SHAPE moved"
+     * imported `tableShapeChanged` from `@ai-matrx/records/react` and called it directly —
+     * which worked, and which meant the port contract did not describe half of what a port
+     * actually does. A column appearing is not a row changing, and the package owns the
+     * difference.
+     *
+     * NOTHING THAT ARRIVES HERE IS DATA. A nudge has not passed the read door, so the hook
+     * re-reads — by id set when the nudge names ids, whole-page when it cannot.
+     */
+    subscribeRecords(args: {
+        organization_id: Uuid;
+        table_id: Uuid;
+    }, sink: RecordsChangeSink): () => void;
+}
+/** What a realtime port may tell the package. Two calls, because a column is not a row. */
+interface RecordsChangeSink {
+    /**
+     * THESE RECORDS MOVED. `null` means "I cannot tell you which" — a reconnect, a tab wake, or
+     * a change above the store's own id cap — and is the one case that costs a whole-page read.
+     * An EMPTY array is not the same thing and is not a nudge at all.
+     */
+    records(ids: readonly Uuid[] | null): void;
+    /**
+     * THIS TABLE'S SHAPE MOVED — a column added, retired or changed. Re-reading the rows would
+     * redraw the same table without the new column in it, which is a screen that is out of date
+     * while looking healthy.
+     */
+    shape(): void;
+}
+/**
+ * OPTIONAL. Where a refusal that nobody asked about goes — the loud funnel.
+ * Default degradation: `console.error` with the store's own words, never
+ * silence.
+ */
+type RecordsErrorSink = (error: {
+    code: string;
+    message: string;
+    hint?: string;
+    where: string;
+}) => void;
+/**
+ * OPTIONAL. The merge-field resolver's server half (`W5-MERGE-B`). While it is
+ * not bound, `useMergeField` answers `pending` WITH THE REASON — never a blank,
+ * never a literal placeholder left in the text (DYN-14).
+ */
+interface RecordsResolverPort {
+    resolve(args: {
+        organization_id: Uuid;
+        merge_field_keys: string[];
+        /** The live selection the `state` source reads (DYNAMIC-VALUES §C). */
+        state?: Record<string, unknown>;
+    }): Promise<unknown>;
+}
+/** The one config a host binds. */
+interface RecordsConfig {
+    /** REQUIRED. */
+    dataSource: RecordsDataSource;
+    /** REQUIRED. */
+    actor: RecordsActor;
+    /**
+     * REQUIRED. REC-29: organizations are hard walls, and the store is keyed
+     * `(organization_id, id)`. There is no "current organization" this package
+     * discovers for itself — the host says which one, every time.
+     */
+    organizationId: Uuid;
+    realtime?: RecordsRealtimePort;
+    onError?: RecordsErrorSink;
+    resolver?: RecordsResolverPort;
+    /**
+     * The schema the record store lives in. Exists so a rehearsal branch and
+     * production can differ without a fork; it is `custom` everywhere today.
+     */
+    schema?: string;
+}
+
+/**
+ * REL-6. Whether Visibility flows along this relation and the MAXIMUM access
+ * level it carries. Default off on `referenced`, on for `owned`.
+ */
+interface RelationCarries {
+    carries: boolean;
+    /** The ceiling — a relation never carries more access than this. */
+    max_access: string | null;
+}
+/** The seven properties, each its own question. */
+interface RelationProperties {
+    /** REL-1. Stored once on the contained table, read from the field's side. */
+    flavor: RelationFlavor;
+    /** REL-2. Separate from flavour. */
+    on_delete: OnDelete;
+    /** REL-3. A snapshot is a frozen copy in the relation's payload — never a pointer into History. */
+    binding: RelationBinding;
+    /** REL-4. */
+    ordered: boolean;
+    /** REL-5. */
+    loops: "allowed" | "refused";
+    /** REL-6. */
+    carries: RelationCarries;
+    /** REL-7. */
+    cardinality: RelationCardinality;
+}
+/**
+ * REL-8 / REL-N-1. A target is a REFERENCE, written that way from the first
+ * line of code, because it may name a row outside our database. One Table,
+ * several, or any — polymorphic without restriction. External targets are
+ * read-only in v1.
+ */
+type RelationTarget = {
+    kind: "ours";
+    entity_token: string;
+    row_id: Uuid;
+} | {
+    kind: "external";
     connection_token: string;
     external_table: string;
     external_key: string;
@@ -7599,6 +8343,53 @@ type RelationWordsManyArgs = {
     display?: RelationDisplaySpec | null;
     record_ids: Uuid[];
 };
+/** One reference as the store keeps it. */
+interface EntityRef {
+    /** The `platform.entity_types` token: `note`, `web_site`, `agent` … */
+    token: string;
+    id: Uuid;
+}
+/** One reference as a read door answers it. */
+interface EntityRefWithWords extends EntityRef {
+    /**
+     * The thing's own title — or the store's withheld sentence when the reader
+     * may not open it; `null` when the kind names no title.
+     */
+    label: string | null;
+}
+/** One kind of platform thing a record may point at (`custom.entity_reference_kinds`). */
+interface EntityReferenceKind {
+    token: string;
+    /** What a person reads: "Note", "Site", "Agent". */
+    label: string;
+    /** The picker's grouping: the admin-assigned reference category, else the schema. */
+    category: string;
+}
+/**
+ * The references a cell holds, whichever shape it arrived in — one object, a
+ * list, or what a read door rendered (with labels). Anything that is not a
+ * reference is left out, never guessed at.
+ */
+declare function entityRefsOf(value: unknown): EntityRefWithWords[];
+/**
+ * What to WRITE for an entity-reference cell: `{token, id}` only, each thing
+ * once, first mention first — the label a read door added is dropped, because
+ * the store reads it and never keeps it (REL-14). A single-valued column gets
+ * the one object (or `null`), a multi-valued one the list.
+ */
+declare function entityRefsToWrite(value: unknown, multi: boolean): EntityRef | EntityRef[] | null;
+/**
+ * The kinds of platform thing a record may point at — what the field editor's
+ * kind picker lists. `custom.entity_reference_kinds()`.
+ */
+declare function entityReferenceKinds(source: RecordsDataSource): Promise<RecordsResult<EntityReferenceKind[]>>;
+/**
+ * THE WORDS HELPER. The words of each `{token, id}` for a picker or a chip
+ * before anything is saved — each label read by the store for THIS person and
+ * withheld when they may not open the thing. `custom.entity_reference_words`.
+ * A saved cell needs no call: every read door already answers its labels.
+ */
+declare function entityReferenceWords(source: RecordsDataSource, organizationId: Uuid, refs: readonly EntityRef[]): Promise<RecordsResult<EntityRefWithWords[]>>;
 
 /**
  * DYN-14 / DYN-15. An ordered list of merge fields ENDING IN A LITERAL, or the
@@ -7906,6 +8697,34 @@ interface WorkApprovalDecision {
     version: number | null;
     message: string;
 }
+/** One inbox decision of a batch (`custom.work_decide_many`). */
+interface WorkDecideManyItem {
+    /** The inbox item — a `work_approval` record's id (`WorkInboxItem.item_id`). */
+    item: Uuid;
+    decision: "approve" | "decline";
+    note?: string | null;
+}
+type WorkDecideVerdict = "approved" | "declined" | "already_decided" | "no_right" | "refused";
+interface WorkDecideManyResult {
+    index: number;
+    item: Uuid;
+    decision: "approve" | "decline";
+    verdict: WorkDecideVerdict;
+    /** The store's own sentence: what was applied, or why it was not. */
+    sentence: string;
+    subject_id?: Uuid;
+    version?: number | null;
+    record_ids?: Uuid[];
+    code?: string;
+}
+/** What `custom.work_decide_many` answers: the counts, then one verdict per item in order. */
+interface WorkDecideMany {
+    asked: number;
+    approved: number;
+    declined: number;
+    not_decided: number;
+    results: WorkDecideManyResult[];
+}
 /** What `custom.work_assign` answers: the value, the access, and who holds it now. */
 interface WorkAssignment {
     record_id: Uuid;
@@ -8154,167 +8973,6 @@ interface ResolvedPublishBinding {
     notice: string;
 }
 
-/**
- * The data seam: a structural subset of `SupabaseClient`. The package never
- * opens a database connection of its own and never holds a key — the HOST
- * supplies a client that already carries the operating person's session, which
- * is what makes DOOR-5 and AGT-N-4 true (the store sees the person, not us).
- */
-interface RecordsDataSource {
-    /**
-     * Call a door. The name is always a door the live catalogue has; `/core`
-     * refuses `door_absent` before it ever reaches here for one that does not.
-     */
-    rpc(fn: string, args: Record<string, unknown>, 
-    /**
-     * THE SCHEMA THE DOOR LIVES IN, always supplied: `custom` for the store's
-     * own doors, `iam` for the trust doors (the external principal and the
-     * publish binding, which are the PLATFORM's). A host binding supabase-js
-     * routes this to `client.schema(options.schema).rpc(fn, args)`; a host that
-     * ignores it calls its own default PostgREST profile — `public` — and is
-     * refused by name, which is the failure we want rather than a silent answer
-     * from the wrong system. (Before 2026-09-18 this was described as "only ever
-     * `iam`" and the store's doors went unqualified; the extension's first real
-     * turn proved that asks `public.store_is_open` and finds nothing.)
-     */
-    options?: {
-        schema?: string;
-    }): PromiseLike<{
-        data: unknown;
-        error: PgError | null;
-    }>;
-    /** Reads of `custom.*` go through the schema-qualified builder, never a bare `from`. */
-    schema(name: string): {
-        from(table: string): RecordsTableQuery;
-    };
-}
-/** The read surface the list and query paths use. A real supabase-js client satisfies it. */
-interface RecordsTableQuery {
-    select(columns: string, options?: {
-        count?: "exact" | "planned" | "estimated";
-        head?: boolean;
-    }): RecordsFilter;
-}
-interface RecordsFilter extends PromiseLike<RecordsResponse> {
-    eq(column: string, value: unknown): RecordsFilter;
-    neq(column: string, value: unknown): RecordsFilter;
-    in(column: string, values: readonly unknown[]): RecordsFilter;
-    is(column: string, value: null | boolean): RecordsFilter;
-    gte(column: string, value: unknown): RecordsFilter;
-    lte(column: string, value: unknown): RecordsFilter;
-    order(column: string, options?: {
-        ascending?: boolean;
-    }): RecordsFilter;
-    range(from: number, to: number): RecordsFilter;
-    limit(count: number): RecordsFilter;
-}
-interface RecordsResponse {
-    data: unknown;
-    error: PgError | null;
-    count?: number | null;
-}
-/**
- * WHO IS ACTING. AGT-N-4: an agent carries the exact authority of the person
- * operating it — there is no agent identity and there are no service roles. So
- * the actor word and the person are two separate facts, and `on_behalf_of` is
- * meaningful only when the actor is `agent`.
- */
-interface RecordsActor {
-    actor: Actor;
-    /** The signed-in person. The store reads this from the session, not from us; this is for the client's own mirror. */
-    user_id?: Uuid;
-    /** Only an agent acts on behalf of a person (the store refuses it otherwise). */
-    on_behalf_of?: Uuid;
-}
-/**
- * OPTIONAL. A live-updates seam. The default degradation is stated rather than
- * silent: with no port bound, `useRecords` reports `live: false` and the screen
- * can say "not live" instead of quietly going stale.
- *
- * A host binds this with `@ai-matrx/data/react`'s channel hygiene — the package
- * deliberately does NOT depend on it, so the headless core stays free of a
- * realtime client and a host that has one keeps using the one it already has.
- */
-interface RecordsRealtimePort {
-    /**
-     * Watch one organization's records of one table. Returns an unsubscribe.
-     *
-     * THE HOST NUDGES THROUGH THIS SINK AND REACHES AROUND NOTHING. Until 0.43.0 the callback
-     * was `(recordId: Uuid) => void` and a host that also wanted to say "the SHAPE moved"
-     * imported `tableShapeChanged` from `@ai-matrx/records/react` and called it directly —
-     * which worked, and which meant the port contract did not describe half of what a port
-     * actually does. A column appearing is not a row changing, and the package owns the
-     * difference.
-     *
-     * NOTHING THAT ARRIVES HERE IS DATA. A nudge has not passed the read door, so the hook
-     * re-reads — by id set when the nudge names ids, whole-page when it cannot.
-     */
-    subscribeRecords(args: {
-        organization_id: Uuid;
-        table_id: Uuid;
-    }, sink: RecordsChangeSink): () => void;
-}
-/** What a realtime port may tell the package. Two calls, because a column is not a row. */
-interface RecordsChangeSink {
-    /**
-     * THESE RECORDS MOVED. `null` means "I cannot tell you which" — a reconnect, a tab wake, or
-     * a change above the store's own id cap — and is the one case that costs a whole-page read.
-     * An EMPTY array is not the same thing and is not a nudge at all.
-     */
-    records(ids: readonly Uuid[] | null): void;
-    /**
-     * THIS TABLE'S SHAPE MOVED — a column added, retired or changed. Re-reading the rows would
-     * redraw the same table without the new column in it, which is a screen that is out of date
-     * while looking healthy.
-     */
-    shape(): void;
-}
-/**
- * OPTIONAL. Where a refusal that nobody asked about goes — the loud funnel.
- * Default degradation: `console.error` with the store's own words, never
- * silence.
- */
-type RecordsErrorSink = (error: {
-    code: string;
-    message: string;
-    hint?: string;
-    where: string;
-}) => void;
-/**
- * OPTIONAL. The merge-field resolver's server half (`W5-MERGE-B`). While it is
- * not bound, `useMergeField` answers `pending` WITH THE REASON — never a blank,
- * never a literal placeholder left in the text (DYN-14).
- */
-interface RecordsResolverPort {
-    resolve(args: {
-        organization_id: Uuid;
-        merge_field_keys: string[];
-        /** The live selection the `state` source reads (DYNAMIC-VALUES §C). */
-        state?: Record<string, unknown>;
-    }): Promise<unknown>;
-}
-/** The one config a host binds. */
-interface RecordsConfig {
-    /** REQUIRED. */
-    dataSource: RecordsDataSource;
-    /** REQUIRED. */
-    actor: RecordsActor;
-    /**
-     * REQUIRED. REC-29: organizations are hard walls, and the store is keyed
-     * `(organization_id, id)`. There is no "current organization" this package
-     * discovers for itself — the host says which one, every time.
-     */
-    organizationId: Uuid;
-    realtime?: RecordsRealtimePort;
-    onError?: RecordsErrorSink;
-    resolver?: RecordsResolverPort;
-    /**
-     * The schema the record store lives in. Exists so a rehearsal branch and
-     * production can differ without a fork; it is `custom` everywhere today.
-     */
-    schema?: string;
-}
-
 /** One value the agent was given, with the triple that makes it citable. */
 interface RecordScopeField {
     key: string;
@@ -8601,7 +9259,7 @@ interface RecordsClient {
          * `recordAggregate` counts with, so the rows a drill-through opens are the
          * rows the number on the dashboard counted.
          */
-        filter?: RecordFilter;
+        filter?: StoreFilter;
         limit?: number;
         offset?: number;
     }): Promise<RecordsResult<{
@@ -8809,6 +9467,12 @@ interface RecordsClient {
     pipelineBoard(args: {
         table_id: Uuid;
         measure?: string | null;
+        /**
+         * S2-PRIME — the view's question, either shape (`StoreFilter`). Given, the headings count and
+         * total exactly the cards the same filter puts on the board (`custom.pipeline_board`'s
+         * four-argument door); left out, the whole table this person may see, as before.
+         */
+        filter?: StoreFilter | null;
     }): Promise<RecordsResult<PipelineColumn[]>>;
     /** Whether this card may go to that column — asked BEFORE the finger lets go. */
     pipelineTransitionRefusal(args: {
@@ -8829,6 +9493,16 @@ interface RecordsClient {
         also?: Record<string, unknown>;
         expected_version?: number | null;
     }): Promise<RecordsResult<PipelineMoveResult>>;
+    /**
+     * MOVE MANY CARDS IN ONE CALL (lane S4, `custom.pipeline_move_many`). Each card is judged by
+     * `pipeline_move` exactly as one is, in its own savepoint: a refused card writes nothing and the
+     * others still land. `expected_version` is required per card — a card that changed since the
+     * board loaded answers `changed_since_loaded` and is never overwritten. A refusal of the WHOLE
+     * call (a stranger, an empty batch, more than the `custom/batch_items_max` knob) is the error.
+     */
+    pipelineMoveMany(args: {
+        moves: PipelineMoveManyItem[];
+    }): Promise<RecordsResult<PipelineMoveMany>>;
     /** Declare (or re-state) a pipeline: the stage column and its transition Rules. */
     pipelineDeclare(args: {
         table_id: Uuid;
@@ -8871,9 +9545,25 @@ interface RecordsClient {
         stage: string;
         gate: PipelineGate | Record<string, unknown>;
     }): Promise<RecordsResult<PipelineGatePreview>>;
+    /**
+     * SERVER LANE ONLY. `custom.rule_members` walks the whole scope table through the evaluator and
+     * returns STORED rows — no visibility ladder, no masking — so no browser role holds EXECUTE on it
+     * and it answers 42501 from a signed-in seat. A screen reads a Rule's members through
+     * `ruleMembersVisible`.
+     */
     ruleMembers(args: {
         rule_id: Uuid;
     }): Promise<RecordsResult<StoredRecord[]>>;
+    /**
+     * S2-PRIME — THE MEMBERS OF A MEMBERSHIP RULE THIS PERSON MAY SEE, a page at a time
+     * (`custom.rule_members_visible`): the list door asked the Rule's own test, so the rows are the
+     * read door's — the same ladder, masked documents, the same page ceiling.
+     */
+    ruleMembersVisible(args: {
+        rule_id: Uuid;
+        limit?: number;
+        offset?: number;
+    }): Promise<RecordsResult<ReadRow[]>>;
     /** Is this one record a member, and WHY — the store's own answer. */
     ruleMembership(args: {
         rule_id: Uuid;
@@ -8951,6 +9641,22 @@ interface RecordsClient {
         form_id?: Uuid | null;
         slug?: string | null;
     }): Promise<RecordsResult<Uuid>>;
+    /**
+     * WHICH OF A FORM'S QUESTIONS ARE ASKED, given the answers so far — for the OWNER's preview of
+     * a draft (`custom.form_preview_asks`). One row per question in order; `asked` is false only
+     * when the store's own Rule said so. Undecided and unworkable conditions are asked, the second
+     * with the store's sentence in `said`.
+     */
+    formPreviewAsks(args: {
+        table_id: Uuid;
+        questions: unknown[];
+        values: Record<string, unknown>;
+    }): Promise<RecordsResult<Array<{
+        field_key: string;
+        asked: boolean;
+        decided: boolean;
+        said: string | null;
+    }>>>;
     /**
      * What the store makes of a file's columns, before anything is written.
      * `columns` is `[{header, samples}]` — the first page of the file is plenty.
@@ -9114,7 +9820,35 @@ interface RecordsClient {
         portal_id?: Uuid | null;
         slug?: string | null;
         sign_in_method?: string | null;
+        /**
+         * S6 — the portal's own look and its forms. A key given REPLACES that key; a key not given
+         * is KEPT (leave `config` out and both stay exactly as they are). The store judges it and
+         * refuses by name: a logo that is not a public picture of this organization's Files, an
+         * accent that is not a design-system colour name, a form whose Table the portal does not show.
+         */
+        config?: PortalConfigInput | null;
     }): Promise<RecordsResult<Uuid>>;
+    /**
+     * S6 — THE CLIENT'S SIDE: one form of HER portal (`custom.portal_form`). Refused unless the
+     * caller is a live principal of that live portal and the form is on its list; the Field that
+     * names the client is never one of the questions — the portal fills it.
+     */
+    portalForm(args: {
+        portal_id: Uuid;
+        form_id: Uuid;
+    }): Promise<RecordsResult<PortalFormSpec>>;
+    /**
+     * S6 — send one form of her portal (`custom.portal_form_submit`). The store fills the Field
+     * that names the client with her own record, and the answer reaches her own list at once
+     * (`accepted`) or waits for the office (`held`, with the store's sentence). `client_key`
+     * makes a retry the same submission.
+     */
+    portalFormSubmit(args: {
+        portal_id: Uuid;
+        form_id: Uuid;
+        answers: Record<string, unknown>;
+        client_key?: string | null;
+    }): Promise<RecordsResult<PortalFormAnswer>>;
     /**
      * Invite one person, as one record of the portal's client Table.
      *
@@ -9170,6 +9904,14 @@ interface RecordsClient {
     dashboardRun(args: {
         dashboard_id: Uuid;
         filter?: RecordFilter;
+        /**
+         * S3 — compare every block that does not carry its own comparison (the
+         * block's own wins, as its own filter does). A block with no date to
+         * compare along answers alone and says so in `compare_refused`.
+         */
+        compare?: AggregateCompare | null;
+        /** S3 — re-cut every bucketed block to one date grain (the canvas's picker). */
+        grain?: AggregateBucket | null;
     }): Promise<RecordsResult<DashboardRunResult>>;
     /** The seventh block kind on its own: records that have sat on the same value too long. */
     dashboardStuck(args: {
@@ -9295,8 +10037,15 @@ interface RecordsClient {
          * A scalar is an equality and an object is a half-open moment window, and
          * either way it lands in the SAME WHERE as visibility.
          */
-        filter?: RecordFilter;
+        filter?: StoreFilter;
         limit?: number;
+        /**
+         * S3 — answer the same question over a prior window too (previous period,
+         * same period last year, or a fixed baseline). Each row then carries
+         * `prior_measures`, `delta` and the two `compare` windows. Buckets are cut
+         * in the organization's calendar (knobs `custom/time_zone`, `custom/week_start`).
+         */
+        compare?: AggregateCompare | null;
     }): Promise<RecordsResult<AggregateRow[]>>;
     /** The measures the store itself offers. Asked, never hardcoded in a picker. */
     aggOperations(): Promise<RecordsResult<string[]>>;
@@ -9832,6 +10581,15 @@ interface RecordsClient {
         approve: boolean;
         note?: string | null;
     }): Promise<RecordsResult<WorkApprovalDecision>>;
+    /**
+     * DECIDE MANY INBOX ITEMS IN ONE CALL (lane S4, `custom.work_decide_many`). Each is judged by
+     * `work_approval_decide` exactly as one is, in its own savepoint: a refused decision leaves that
+     * item waiting and the others still stand. Verdicts: approved, declined, already_decided,
+     * no_right, refused — each with the store's own sentence.
+     */
+    workDecideMany(args: {
+        decisions: WorkDecideManyItem[];
+    }): Promise<RecordsResult<WorkDecideMany>>;
     /** One waiting change in full, for the person deciding it or the one who asked. */
     workApprovalRead(args: {
         approval_id: Uuid;
@@ -9987,6 +10745,61 @@ interface RecordsClient {
         limit?: number;
     }): Promise<RecordsResult<IoExportPage>>;
     /** G5. That page as an .xlsx; a withheld column is named on its own sheet. */
+    /** G9. Every table a picker may offer here, from BOTH stores, each saying which store opens it. */
+    tableListEverywhere(): Promise<RecordsResult<{
+        success: boolean;
+        tables: TableListEntry[];
+    }>>;
+    /**
+     * G10. Refresh a synced source (a sheet tab) into ONE Table under `home_id`: new rows added,
+     * changed rows updated, rows the source dropped archived — never destroyed; columns the
+     * person added in Matrx survive. Build the spec with `sheetSyncSpec`.
+     */
+    tableSync(args: {
+        home_id: Uuid;
+        spec: TableSyncSpec;
+    }): Promise<RecordsResult<TableSyncResult>>;
+    /**
+     * G11. The record-store Table a context scope's template-bound item provisions — one per item
+     * and scope. A scope provisioned before the move answers with its moved Table (same id); the
+     * Home defaults to the organization's own.
+     */
+    scopeTableProvision(args: {
+        item_id: Uuid;
+        scope_id: Uuid;
+        home_id?: Uuid | null;
+    }): Promise<RecordsResult<Uuid>>;
+    /** G12. The rows of each Table this reader may see, in one call (fold with `withRowCounts`). A Table she may not know gets no row. */
+    tableRowCounts(args: {
+        table_ids: Uuid[];
+    }): Promise<RecordsResult<TableRowCount[]>>;
+    /** G12. Each live record's own header (created, updated, version) that the read door does not answer. */
+    recordHeaders(args: {
+        ids: Uuid[];
+    }): Promise<RecordsResult<RecordHeader[]>>;
+    /**
+     * G14. Share a Table with a person by email or account id: an existing account outside the
+     * organization is granted at once and notified (never made a member); an address with no
+     * account is invited. The organization's outside-sharing setting decides first.
+     */
+    tableShareOutsideGrant(args: {
+        table_id: Uuid;
+        person: string;
+        level?: "viewer" | "commenter" | "editor" | "admin";
+    }): Promise<RecordsResult<OutsideShareAnswer>>;
+    /** G13. Keep a hand-set order on a saved view: the named rows first, in this order (build it with `moveInOrder`). */
+    viewRecordOrderSet(args: {
+        view_id: Uuid;
+        record_ids: Uuid[];
+    }): Promise<RecordsResult<ViewOrderSet>>;
+    /** G13. A page of a hand-ordered view: placed rows by position, then the rest by created time. */
+    readInViewOrder(args: {
+        view_id: Uuid;
+        limit?: number;
+        offset?: number;
+    }): Promise<RecordsResult<Array<ReadRow & {
+        position: number | null;
+    }>>>;
     exportXlsx(args: {
         table_id: Uuid;
         columns?: string[] | null;
@@ -10142,7 +10955,7 @@ interface UseRecordsOptions {
      * This is what makes a dashboard number walkable: the same object that
      * counted it opens it.
      */
-    filter?: RecordFilter;
+    filter?: StoreFilter;
 }
 interface UseRecordsState extends Async<{
     rows: ReadRow[];
@@ -10346,4 +11159,15 @@ declare function useFieldMutation(): UseFieldMutation;
  */
 declare function useMergeField(key: string | null, state?: Record<string, unknown>): MergeFieldResolution | null;
 
-export { ABSENCE_REASONS, ACTOR_VOCABULARY, ARCHIVE_LANES, ARCHIVE_LANE_LABEL, ARCHIVE_LANE_MEANS, type AbsenceReason, type ActionRefusal, type ActionRunResult, type Actor, type AggregateBucket, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type ArchiveLane, type ArchivedDoorRow, type ArchivedRow, type BookingAvailability, type BookingDeclared, type BookingSummary, type BookingWindow, COMPUTE_ON, CONTEXT_POLICIES, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type ChoiceOptions, type CoerceOptions, type Coerced, type CoercedAnswers, type CoercibleField, type CommentThreadRead, type CommentWritten, type ComputeOn, type ContextPolicy, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, DECLARABLE_FIELD_KINDS, DEFAULT_ARCHIVE_LANE, DEFAULT_PORTAL_ARCHIVE_FILTER, DELIVERIES, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, type DeclarableFieldKind, type DecorationColor, type DecorationPath, type DecorationRule, type DecorationRuleOp, type DecorationTarget, type Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, ENTITY_TOKENS, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityTableFacts, type EntityToken, type ExampleBuilt, type ExampleSpec, type ExternalPrincipalCard, FIELD_KINDS, FIELD_SENSITIVITIES, FIELD_SOURCES, FRESHNESS, type Field, type FieldBehavior, type FieldHistoryEntry, type FieldKind, type FieldPatch, type FieldProposal, type FieldRule, type FieldSensitivity, type FieldSource, type FieldTypeWord, type ForbiddenEnvelopeWord, type FormSummary, type FormulaParse, type Freshness, type GridLayout, type GridLayoutMode, type GridRowHeight, type HiddenFieldNotice, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportColumnsDeclared, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, type IoExportPage, KERNEL_TABLES, type KernelTableName, type KernelTargets, MERGE_FIELD_MODIFIERS, MERGE_FIELD_SEMANTIC_TYPES, MERGE_FIELD_SOURCES, type MergeField, type MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, type MergeFieldSemanticType, type MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, type NewFieldDeclaration, ON_DELETE, OVERRIDE_POLICIES, type OnDelete, type OverridePolicy, PARITY_FIELD_TYPES, PERMISSION_LEVELS, PER_VALUE_ACCESS_WORDS, PIPELINE_RULE_KINDS, PORTAL_ARCHIVE_FILTERS, type ParityFieldType, type ParityFieldTypeDescriptor, type PerValueAccessWord, type PermissionLevel, type PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineGate, type PipelineGatePreview, type PipelineMissingField, type PipelineMoveResult, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalArchiveAnswer, type PortalArchiveFilter, type PortalCard, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalSummary, type PortalTableExposure, type PortalTableRef, type PredictedRefusal, type ProvenancePointer, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, RELATION_BINDINGS, RELATION_CARDINALITIES, RELATION_FLAVORS, RETIRED_ACTOR_WORDS, RULE_NODE_KINDS, RULE_USES, type ReadRow, type ReadValue, type RecordChangeAction, type RecordComment, type RecordDocument, type RecordEvent, type RecordFilter, type RecordGraphWritten, type RecordHistoryEntry, type RecordRead, type RecordRevision, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsChangeSink, type RecordsConfig, type RecordsDataSource, type RecordsError, type RecordsErrorCode, type RecordsErrorSink, type RecordsFilter, RecordsProvider, type RecordsProviderProps, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsResult, type RecordsTableQuery, type RegisteredTable, type Relation, type RelationBinding, type RelationCardinality, type RelationCarries, type RelationCoordinate, type RelationDisplay, type RelationDisplaySpec, type RelationFlavor, type RelationProperties, type RelationStore, type RelationTarget, type RelationWordsManyArgs, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type RetiredActorWord, type RowAction, type RowActionStep, type Rule, type RuleAnswer, type RuleExpression, type RuleNodeKind, type RuleUse, STAGE_RULE_ENFORCEMENT, STAGE_RULE_ON_FAIL, STORAGE_MODES, STORE_DOORS, STORE_KNOBS, STORE_REFUSAL_CODES, type SavedViewRow, type SavedViewSpecIn, type StagePending, type StagePendingOnBoard, type StageRuleEnforcement, type StageRuleOnFail, type StageRuleWarning, type StaleWriteDetail, type StorageMode, type StoreDoorName, type StoreRefusalCode, type StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, TABLE_DISPLAYS, TABLE_ORIGINS, TABLE_TYPES, type Table, type TableArchiveProgress, type TableCapacity, type TableDecorations, type TableDisplay, type TableOrigin, type TableProposal, type TableType, type TableWebhook, type TableWebhookDeclared, type Timestamp, type UseEntityFieldMutation, type UseFieldMutation, type UseRecordMutation, type UseRecordsOptions, type UseRecordsState, type UseTableArchive, type Uuid, VALUE_ALTERNATE_KEYS, VALUE_ENVELOPE_KEYS, type ValueAlternate, type ValueAlternateKey, type ValueEnvelope, type ValueEnvelopeKey, type ValueSource, type ViewLayout, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, type WriteConflict, actionRefusals, allowsOtherValues, archivedByLine, archivedWhen, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, coerceTypedAnswer, coerceTypedAnswers, coercionLabel, emptyArchiveLine, emptyPortalArchiveLine, err, exampleSpec, exportPageXlsx, fieldKindFor, forgetAllOps, highestLevel, holdsARetiredChoice, indexedDbStore, isArchiveLane, isDecided, isOwnOp, isPortalArchiveFilter, isRecordsErr, isTheChosen, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, mintOpId, ok, openCaptureQueue, optionKey, optionLabel, portalArchiveConsequence, portalConfirmLine, portalPath, portalTitleTypedBack, publicFormPath, recordChangeTrigger, rememberedOpCount, sameDocument, scopeChip, stableFilterKey, tableShapeChanged, useEntityFieldMutation, useEntityFieldRights, useEntityFields, useEntityRecord, useEntityTable, useFieldMutation, useFields, useMergeField, useMyLevel, useMyLevels, useOptionalRecordsClient, useRecord, useRecordChangeRevision, useRecordMutation, useRecords, useRecordsActor, useRecordsClient, useTable, useTableArchive, useTables };
+interface EntityReferenceRead<T> {
+    data: T | null;
+    loading: boolean;
+    /** The store's own refusal, verbatim. */
+    error: RecordsError | null;
+}
+/** The kinds of platform thing a record may point at, for the kind picker. */
+declare function useEntityReferenceKinds(): EntityReferenceRead<EntityReferenceKind[]>;
+/** The words of each reference, read for THIS person (withheld where they may not open it). */
+declare function useEntityReferenceWords(refs: readonly EntityRef[]): EntityReferenceRead<EntityRefWithWords[]>;
+
+export { ABSENCE_REASONS, ACTOR_VOCABULARY, ARCHIVE_LANES, ARCHIVE_LANE_LABEL, ARCHIVE_LANE_MEANS, type AbsenceReason, type ActionRefusal, type ActionRunResult, type Actor, type AggregateBucket, type AggregateCompare, type AggregateCompareKind, type AggregateCompareWindows, type AggregateDelta, type AggregateFilter, type AggregateMeasure, type AggregateOperation, type AggregateRow, type AggregateWindow, type AnonTokenBinding, type ArchiveLane, type ArchivedDoorRow, type ArchivedRow, type BookingAvailability, type BookingDeclared, type BookingSummary, type BookingWindow, COMPUTE_ON, CONTEXT_POLICIES, type CaptureField, type CaptureFileRef, type CaptureOutcome, type CaptureQuestion, type CaptureQueue, type CaptureQueueCounts, type CaptureQueueOptions, type CaptureQueuePorts, type CaptureQueueStore, type CaptureSheetFace, type CaptureSheetSummary, type CaptureSyncReport, type ChecklistDeclared, type ChecklistRequirement, type ChecklistRequirementKind, type ChecklistRoleSpec, type ChecklistRunStarted, type ChecklistRunStep, type ChecklistRunSummary, type ChecklistSpec, type ChecklistStepCompleted, type ChecklistStepSpec, type ChecklistTemplateShape, type ChecklistTemplateSummary, type ChecklistTrigger, type ChecklistTriggerKind, type ChoiceOption, type ChoiceOptions, type CoerceOptions, type Coerced, type CoercedAnswers, type CoercibleField, type CommentThreadRead, type CommentWritten, type ComputeOn, type ContextPolicy, type ConversationScope, type ConversationScopeContext, type CustomFieldTableType, DECLARABLE_FIELD_KINDS, DEFAULT_ARCHIVE_LANE, DEFAULT_PORTAL_ARCHIVE_FILTER, DELIVERIES, type DashboardBlock, type DashboardBlockKind, type DashboardBlockResult, type DashboardRunResult, type DashboardSummary, type DashboardTarget, type DashboardTargetBase, type DashboardTargetOp, type DashboardTargetResult, type DashboardTotals, type DeclarableFieldKind, type DecorationColor, type DecorationPath, type DecorationRule, type DecorationRuleOp, type DecorationTarget, type Delivery, type DigestPreview, type DocRenderRow, type DocSignatureCheck, type DocSignatureRow, type DocTemplateRow, type DocToken, type DocUnresolvedToken, ENTITY_TOKENS, type EnrichAlternate, type EnrichCell, type EnrichDeclared, type EnrichDueRow, type EnrichRun, type EnrichSource, type Enrichment, type EnrichmentSummary, type EntityFieldRights, type EntityFieldValue, type EntityRecordMatch, type EntityRecordRead, type EntityRecordsFound, type EntityRef, type EntityRefWithWords, type EntityReferenceKind, type EntityReferenceRead, type EntityTableFacts, type EntityToken, type ExampleBuilt, type ExampleSpec, type ExternalPrincipalCard, FIELD_KINDS, FIELD_SENSITIVITIES, FIELD_SOURCES, FRESHNESS, type Field, type FieldBehavior, type FieldHistoryEntry, type FieldKind, type FieldPatch, type FieldProposal, type FieldRule, type FieldSensitivity, type FieldSource, type FieldTypeWord, type ForbiddenEnvelopeWord, type FormSummary, type FormulaParse, type Freshness, type GridLayout, type GridLayoutMode, type GridRowHeight, type HiddenFieldNotice, type HistoryActor, type HistoryActorKind, type HistoryChange, type Home, type ImportBatchResult, type ImportColumnPlan, type ImportColumnsDeclared, type ImportFinished, type ImportOpened, type ImportOutcome, type ImportPlan, type ImportPolicy, type ImportProposal, type ImportReport, type ImportRun, type InboundAddress, type InboundDeclared, type IoExportPage, KERNEL_TABLES, type KernelTableName, type KernelTargets, MERGE_FIELD_MODIFIERS, MERGE_FIELD_SEMANTIC_TYPES, MERGE_FIELD_SOURCES, type MergeField, type MergeFieldModifier, type MergeFieldProvenance, type MergeFieldResolution, type MergeFieldSemanticType, type MergeFieldSource, type MergeFieldTransform, type MissingBehavior, type MyLevel, type MySubscription, type NewEntityFieldDeclaration, type NewFieldDeclaration, ON_DELETE, OVERRIDE_POLICIES, type OnDelete, type OutsideShareAnswer, type OverridePolicy, PARITY_FIELD_TYPES, PERMISSION_LEVELS, PER_VALUE_ACCESS_WORDS, PIPELINE_RULE_KINDS, PORTAL_ACCENTS, PORTAL_ARCHIVE_FILTERS, type ParityFieldType, type ParityFieldTypeDescriptor, type PerValueAccessWord, type PermissionLevel, type PgError, type Pipeline, type PipelineColumn, type PipelineDeclared, type PipelineGate, type PipelineGatePreview, type PipelineMissingField, type PipelineMoveMany, type PipelineMoveManyItem, type PipelineMoveManyResult, type PipelineMoveResult, type PipelineMoveVerdict, type PipelineRule, type PipelineRuleKind, type PipelineSpec, type PipelineStage, type PipelineVerdict, type PortalAccent, type PortalArchiveAnswer, type PortalArchiveFilter, type PortalCard, type PortalConfig, type PortalConfigInput, type PortalFooterLink, type PortalFormAnswer, type PortalFormInput, type PortalFormRef, type PortalFormSpec, type PortalInvitation, type PortalPreviewRow, type PortalPrincipal, type PortalRevocation, type PortalStage, type PortalStyle, type PortalStyleInput, type PortalSummary, type PortalTableExposure, type PortalTableRef, type PredictedRefusal, type ProvenancePointer, type PublishBinding, type QueuedCapture, type QueuedCaptureFile, type QueuedCaptureState, type QuietHours, REFUSALS_WORTH_REPEATING, RELATION_BINDINGS, RELATION_CARDINALITIES, RELATION_FLAVORS, RETIRED_ACTOR_WORDS, RULE_NODE_KINDS, RULE_USES, type ReadRow, type ReadValue, type RecordChangeAction, type RecordComment, type RecordDocument, type RecordEvent, type RecordFilter, type RecordGraphWritten, type RecordHeader, type RecordHistoryEntry, type RecordRead, type RecordRevision, type RecordScopeComment, type RecordScopeContext, type RecordScopeField, type RecordScopeHistoryEntry, type RecordScopeRelation, type RecordScopeWithheld, type RecordsActor, type RecordsChangeSink, type RecordsConfig, type RecordsDataSource, type RecordsError, type RecordsErrorCode, type RecordsErrorSink, type RecordsFilter, RecordsProvider, type RecordsProviderProps, type RecordsRealtimePort, type RecordsResolverPort, type RecordsResponse, type RecordsResult, type RecordsTableQuery, type RegisteredTable, type Relation, type RelationBinding, type RelationCardinality, type RelationCarries, type RelationCoordinate, type RelationDisplay, type RelationDisplaySpec, type RelationFlavor, type RelationProperties, type RelationStore, type RelationTarget, type RelationWordsManyArgs, type ResolutionTriple, type ResolvedPublishBinding, type RestorePreview, type RestoreResult, type RetiredActorWord, type RowAction, type RowActionStep, type Rule, type RuleAnswer, type RuleExpression, type RuleNodeKind, type RuleUse, STAGE_RULE_ENFORCEMENT, STAGE_RULE_ON_FAIL, STORAGE_MODES, STORE_DOORS, STORE_KNOBS, STORE_REFUSAL_CODES, type SavedViewRow, type SavedViewSpecIn, type StagePending, type StagePendingOnBoard, type StageRuleEnforcement, type StageRuleOnFail, type StageRuleWarning, type StaleWriteDetail, type StorageMode, type StoreDoorName, type StoreFilter, type StoreRefusalCode, type StoredRecord, type StuckRow, type Subscription, type SubscriptionBlock, type SubscriptionCadence, type SubscriptionSpec, TABLE_DISPLAYS, TABLE_ORIGINS, TABLE_TYPES, type Table, type TableArchiveProgress, type TableCapacity, type TableDecorations, type TableDisplay, type TableListEntry, type TableOrigin, type TablePlacement, type TablePlacementFact, type TableProposal, type TableRowCount, type TableSyncResult, type TableSyncSource, type TableSyncSpec, type TableType, type TableWebhook, type TableWebhookDeclared, type Timestamp, type UseEntityFieldMutation, type UseFieldMutation, type UseRecordMutation, type UseRecordsOptions, type UseRecordsState, type UseTableArchive, type Uuid, VALUE_ALTERNATE_KEYS, VALUE_ENVELOPE_KEYS, type ValueAlternate, type ValueAlternateKey, type ValueEnvelope, type ValueEnvelopeKey, type ValueSource, type ViewLayout, type ViewOrderSet, type WorkApprovalDecision, type WorkApprovalFiled, type WorkApprover, type WorkAssignment, type WorkAssignmentField, type WorkChange, type WorkDecideMany, type WorkDecideManyItem, type WorkDecideManyResult, type WorkDecideVerdict, type WorkDueState, type WorkGraph, type WorkInboxItem, type WorkInboxKind, type WorkInstantiation, type WorkListFlavour, type WorkListItem, type WorkOrigin, type WorkRecordState, type WorkSlotHold, type WorkState, type WorkTemplateNode, type WorkTemplateRelation, type WorkTurn, type WriteConflict, actionRefusals, allowsOtherValues, archivedByLine, archivedWhen, asPermissionLevel, atLeast, bookingPath, choiceSlug, choiceValuesOf, choicesOf, coerceTypedAnswer, coerceTypedAnswers, coercionLabel, emptyArchiveLine, emptyPortalArchiveLine, entityReferenceKinds, entityReferenceKindsOf, entityReferenceWords, entityRefsOf, entityRefsToWrite, err, exampleSpec, exportPageXlsx, fieldKindFor, forgetAllOps, highestLevel, holdsARetiredChoice, indexedDbStore, isArchiveLane, isDecided, isEntityReferenceConfig, isOwnOp, isPortalAccent, isPortalArchiveFilter, isRecordsErr, isRuleFilter, isTheChosen, keptGroups, keptOutOfSight, keptTableHref, looksLikeAnId, mayDrag, measureKey, memoryStore, mintClientKey, mintOpId, moveInOrder, offeredAsContext, ok, openCaptureQueue, optionKey, optionLabel, portalArchiveConsequence, portalConfirmLine, portalPath, portalTitleTypedBack, publicFormPath, recordChangeTrigger, rememberedOpCount, sameDocument, scopeChip, sheetSyncSpec, stableFilterKey, tableShapeChanged, useEntityFieldMutation, useEntityFieldRights, useEntityFields, useEntityRecord, useEntityReferenceKinds, useEntityReferenceWords, useEntityTable, useFieldMutation, useFields, useMergeField, useMyLevel, useMyLevels, useOptionalRecordsClient, useRecord, useRecordChangeRevision, useRecordMutation, useRecords, useRecordsActor, useRecordsClient, useTable, useTableArchive, useTables, withRowCounts, withTablePlacement };