@ai-matrx/records 0.8.0 → 0.16.0

package/dist/core/index.cjs

@@ -72,6 +72,9 @@ __export(core_exports, {
   asWriteConflict: () => asWriteConflict,
   atLeast: () => atLeast,
   cellText: () => cellText,
+  choiceSlug: () => choiceSlug,
+  choiceValuesOf: () => choiceValuesOf,
+  choicesOf: () => choicesOf,
   createRecordsClient: () => createRecordsClient,
   doorAbsent: () => doorAbsent,
   doorCensus: () => doorCensus,
@@ -80,15 +83,21 @@ __export(core_exports, {
   exportCsv: () => exportCsv,
   exportXlsx: () => exportXlsx,
   highestLevel: () => highestLevel,
+  holdsARetiredChoice: () => holdsARetiredChoice,
   importCsv: () => importCsv,
   importXlsx: () => importXlsx,
   intersectIds: () => intersectIds,
   isRecordsErr: () => isRecordsErr,
+  isTheChosen: () => isTheChosen,
+  looksLikeAnId: () => looksLikeAnId,
   mapPgError: () => mapPgError,
   measureKey: () => measureKey,
   ok: () => ok,
+  optionKey: () => optionKey,
+  optionLabel: () => optionLabel,
   parseCsv: () => parseCsv,
   planQuery: () => planQuery,
+  portalPath: () => portalPath,
   predictEnvelopeRefusal: () => predictEnvelopeRefusal,
   predictSizeRefusal: () => predictSizeRefusal,
   predictValueRefusals: () => predictValueRefusals,
@@ -183,11 +192,59 @@ function highestLevel(left, right) {
   return ORDINAL[left] >= ORDINAL[right] ? left : right;
 }
 
+// src/choice.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function optionKey(option) {
+  const stored = option.metadata?.["option_key"];
+  if (typeof stored === "string" && stored.trim() !== "") return stored;
+  return choiceSlug(optionLabel(option));
+}
+function optionLabel(option) {
+  const doc = option.data;
+  const title = doc?.["title"] ?? doc?.["name"];
+  if (typeof title === "string" && title.trim() !== "") return title;
+  return "Unnamed choice";
+}
+function choiceSlug(word) {
+  const slug = word.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 55);
+  return slug === "" ? "choice" : slug;
+}
+function isTheChosen(option, value) {
+  if (typeof value !== "string") return false;
+  const asked = value.trim().toLowerCase();
+  if (asked === "") return false;
+  return asked === optionKey(option).toLowerCase() || asked === optionLabel(option).toLowerCase() || asked === option.id.toLowerCase();
+}
+function choiceValuesOf(value) {
+  if (Array.isArray(value)) return value.filter((v) => typeof v === "string");
+  if (typeof value === "string" && value !== "") return [value];
+  return [];
+}
+function choicesOf(document, fieldKeyOrId) {
+  const block = document?.["_choices"];
+  if (!block || typeof block !== "object") return [];
+  const entry = block[fieldKeyOrId];
+  if (!entry) return [];
+  const list = Array.isArray(entry) ? entry : [entry];
+  return list.filter((x) => !!x && typeof x === "object" && typeof x.key === "string");
+}
+function holdsARetiredChoice(document, fieldKeyOrId) {
+  return choicesOf(document, fieldKeyOrId).some((c) => c.retired === true);
+}
+function looksLikeAnId(value) {
+  return typeof value === "string" && UUID.test(value);
+}
+
 // src/rule.ts
 function publicFormPath(formId) {
   return `/f/${formId}`;
 }
 
+// src/portal.ts
+function portalPath(slug) {
+  return `/portal/c/${slug}`;
+}
+
 // src/aggregate.ts
 function measureKey(measure) {
   return measure.op === "count" ? "count" : `${measure.op}_${measure.key ?? ""}`;
@@ -302,6 +359,20 @@ var STORE_DOORS = [
   { name: "caller_role", args: "", returns: "name", security: "invoker" },
   { name: "carrying_edges_in", args: "p_organization_id uuid", returns: "TABLE(container_type text, container_id uuid, item_type text, item_id uuid, conveys_max permission_level)", security: "definer" },
   { name: "carrying_edges_of", args: "p_item_type text, p_item_id uuid", returns: "TABLE(container_type text, container_id uuid, conveys_max permission_level)", security: "definer" },
+  { name: "choice_census", args: "p_organization_id uuid, p_table_id uuid DEFAULT NULL::uuid", returns: "jsonb", security: "definer" },
+  { name: "choice_field_map", args: "p_organization_id uuid, p_table_id uuid", returns: "jsonb", security: "invoker" },
+  { name: "choice_filter_normalize", args: "p_map jsonb, p_filter jsonb", returns: "jsonb", security: "invoker" },
+  { name: "choice_key_for", args: "p_organization_id uuid, p_options_table_id uuid, p_title text, p_exclude uuid DEFAULT NULL::uuid", returns: "text", security: "invoker" },
+  { name: "choice_key_of", args: "p_field jsonb, p_token text", returns: "text", security: "invoker" },
+  { name: "choice_options", args: "p_organization_id uuid, p_options_table_id uuid", returns: "jsonb", security: "invoker" },
+  { name: "choice_render", args: "p_organization_id uuid, p_table_id uuid, p_doc jsonb", returns: "jsonb", security: "invoker" },
+  { name: "choice_render_groups", args: "p_map jsonb, p_groups jsonb", returns: "jsonb", security: "invoker" },
+  { name: "choice_render_note", args: "p_field jsonb, p_value jsonb", returns: "jsonb", security: "invoker" },
+  { name: "choice_render_value", args: "p_field jsonb, p_value jsonb", returns: "jsonb", security: "invoker" },
+  { name: "choice_slug", args: "p_word text", returns: "text", security: "invoker" },
+  { name: "choice_synonyms", args: "p_organization_id uuid, p_table_id uuid, p_token text", returns: "text[]", security: "invoker" },
+  { name: "choice_synonyms_in", args: "p_map jsonb, p_token text", returns: "text[]", security: "invoker" },
+  { name: "choice_words", args: "p_field jsonb", returns: "text", security: "invoker" },
   { name: "client_write_grants", args: "", returns: "TABLE(role_name text, object_name text, privilege text)", security: "invoker" },
   { name: "computed_provenance", args: "p_organization_id uuid, p_record_id uuid", returns: "TABLE(field_key text, field_id uuid, value jsonb, rule_id uuid, rule_version integer, computed_at timestamp with time zone)", security: "invoker" },
   { name: "containment_chain", args: "p_organization_id uuid, p_record_id uuid", returns: "TABLE(ancestor_id uuid, depth integer)", security: "invoker" },
@@ -310,6 +381,17 @@ var STORE_DOORS = [
   { name: "containment_parent", args: "p_data jsonb", returns: "uuid", security: "invoker" },
   { name: "cross_organization_links_open", args: "p_source_organization_id uuid, p_target_organization_id uuid", returns: "boolean", security: "invoker" },
   { name: "custom_fields_tables", args: "", returns: "TABLE(token text, schema_name text, table_name text)", security: "invoker" },
+  { name: "dashboard_block_normalize", args: "p_organization_id uuid, p_subject_table_id uuid, p_block jsonb", returns: "jsonb", security: "definer" },
+  { name: "dashboard_class", args: "", returns: "text", security: "invoker" },
+  { name: "dashboard_declare", args: "p_organization_id uuid, p_table_id uuid, p_name text, p_blocks jsonb DEFAULT '[]'::jsonb, p_presentation jsonb DEFAULT '{}'::jsonb, p_dashboard_id uuid DEFAULT NULL::uuid", returns: "uuid", security: "definer" },
+  { name: "dashboard_delete", args: "p_organization_id uuid, p_dashboard_id uuid", returns: "boolean", security: "definer" },
+  { name: "dashboard_field_keys", args: "p_organization_id uuid, p_table_id uuid", returns: "text[]", security: "definer" },
+  { name: "dashboard_kinds", args: "", returns: "text[]", security: "invoker" },
+  { name: "dashboard_moment_sql", args: "p_key text", returns: "text", security: "invoker" },
+  { name: "dashboard_run", args: "p_organization_id uuid, p_dashboard_id uuid, p_filter jsonb DEFAULT '{}'::jsonb", returns: "jsonb", security: "definer" },
+  { name: "dashboard_stuck", args: "p_organization_id uuid, p_table_id uuid, p_state_key text, p_days integer DEFAULT 14, p_filter jsonb DEFAULT '{}'::jsonb, p_limit integer DEFAULT 50, p_required text DEFAULT 'viewer'::text", returns: "TABLE(record_id uuid, title text, state text, last_changed_at timestamp with time zone, days_unchanged numeric, measured_from text)", security: "definer" },
+  { name: "dashboard_window_sql", args: "p_key text, p_window jsonb", returns: "text", security: "invoker" },
+  { name: "dashboards", args: "p_organization_id uuid, p_table_id uuid DEFAULT NULL::uuid", returns: "TABLE(dashboard_id uuid, table_id uuid, name text, blocks jsonb, presentation jsonb, block_count integer, version integer, created_at timestamp with time zone, updated_at timestamp with time zone)", security: "definer" },
   { name: "delete_cascade_closure", args: "p_organization_id uuid, p_record_id uuid", returns: "uuid[]", security: "invoker" },
   { name: "delete_preview", args: "p_organization_id uuid, p_record_id uuid", returns: "jsonb", security: "definer" },
   { name: "delete_rule", args: "p_organization_id uuid, p_record_id uuid, p_apply boolean DEFAULT true", returns: "jsonb", security: "definer" },
@@ -406,16 +488,20 @@ var STORE_DOORS = [
   { name: "io_restore", args: "p_organization_id uuid, p_record_id uuid, p_version integer", returns: "integer", security: "definer" },
   { name: "io_revisions", args: "p_organization_id uuid, p_record_id uuid", returns: "TABLE(version integer, changed_at timestamp with time zone, changed_by uuid, summary text, operation text, changed_fields jsonb)", security: "definer" },
   { name: "is_a_retirement", args: "p_old_deleted timestamp with time zone, p_new_deleted timestamp with time zone, p_old_data jsonb, p_new_data jsonb, p_old_table uuid, p_new_table uuid, p_old_org uuid, p_new_org uuid, p_old_class text, p_new_class text", returns: "boolean", security: "invoker" },
+  { name: "list_door_disagreements", args: "p_pretend text DEFAULT NULL::text, p_only_organization uuid DEFAULT NULL::uuid, p_sample integer DEFAULT 200", returns: "TABLE(organization_id uuid, organization_name text, member_id uuid, table_id uuid, record_id uuid, door text, why text)", security: "invoker" },
+  { name: "list_door_disagreements", args: "p_pretend text, p_only_organization uuid, p_sample integer, p_exhaustive boolean", returns: "TABLE(organization_id uuid, organization_name text, member_id uuid, table_id uuid, record_id uuid, door text, why text)", security: "invoker" },
   { name: "lookup_value", args: "p_organization_id uuid, p_record_id uuid, p_field_data jsonb", returns: "jsonb", security: "invoker" },
   { name: "mask_document", args: "p_document jsonb, p_visible_keys text[], p_notices jsonb, p_by_id boolean DEFAULT false, p_key_ids jsonb DEFAULT '{}'::jsonb", returns: "jsonb", security: "invoker" },
   { name: "mask_document", args: "p_document jsonb, p_visible_keys text[], p_notices jsonb, p_by_id boolean DEFAULT false, p_key_ids jsonb DEFAULT '{}'::jsonb, p_declared_keys text[] DEFAULT NULL::text[]", returns: "jsonb", security: "invoker" },
   { name: "merge_field_kernel_id", args: "", returns: "uuid", security: "invoker" },
+  { name: "migrate_choice_keys", args: "p_organization_id uuid, p_table_id uuid, p_dry_run boolean DEFAULT false", returns: "jsonb", security: "definer" },
   { name: "migrate_delete", args: "p_organization_id uuid, p_record_id uuid, p_note text DEFAULT NULL::text", returns: "jsonb", security: "definer" },
   { name: "migrate_demote", args: "p_organization_id uuid, p_table_id uuid, p_note text DEFAULT NULL::text", returns: "jsonb", security: "definer" },
   { name: "migrate_extract_parent", args: "p_organization_id uuid, p_id uuid, p_parent_table_id uuid, p_moved_keys text[], p_note text DEFAULT NULL::text", returns: "jsonb", security: "definer" },
   { name: "migrate_merge", args: "p_organization_id uuid, p_winner_id uuid, p_loser_id uuid, p_note text DEFAULT NULL::text", returns: "jsonb", security: "definer" },
   { name: "migrate_promote", args: "p_organization_id uuid, p_table_id uuid, p_note text DEFAULT NULL::text", returns: "jsonb", security: "definer" },
   { name: "migrate_purge", args: "p_organization_id uuid, p_table_id uuid DEFAULT NULL::uuid, p_dry_run boolean DEFAULT true", returns: "jsonb", security: "definer" },
+  { name: "migrate_reclass", args: "p_organization_id uuid, p_id uuid, p_to text DEFAULT 'field'::text, p_note text DEFAULT NULL::text", returns: "jsonb", security: "definer" },
   { name: "migrate_rename", args: "p_organization_id uuid, p_id uuid, p_to text, p_note text DEFAULT NULL::text", returns: "jsonb", security: "definer" },
   { name: "migrate_reparent", args: "p_organization_id uuid, p_id uuid, p_parent_id uuid, p_note text DEFAULT NULL::text", returns: "jsonb", security: "definer" },
   { name: "migrate_retype", args: "p_organization_id uuid, p_id uuid, p_to text, p_note text DEFAULT NULL::text", returns: "jsonb", security: "definer" },
@@ -435,6 +521,20 @@ var STORE_DOORS = [
   { name: "parity_values", args: "p_organization_id uuid, p_record_id uuid", returns: "TABLE(field_key text, field_id uuid, parity_type text, behavior text, unit text, format text, value jsonb, value_version integer, actor text, written_at timestamp with time zone)", security: "invoker" },
   { name: "per_value_access_words", args: "", returns: "text[]", security: "invoker" },
   { name: "person_kernel_id", args: "", returns: "uuid", security: "invoker" },
+  { name: "portal_admits", args: "p_organization_id uuid, p_user_id uuid DEFAULT NULL::uuid", returns: "boolean", security: "definer" },
+  { name: "portal_card", args: "p_organization_id uuid, p_portal_id uuid", returns: "jsonb", security: "definer" },
+  { name: "portal_declare", args: "p_organization_id uuid, p_title text, p_client_table_id uuid, p_tables jsonb, p_portal_id uuid DEFAULT NULL::uuid, p_slug text DEFAULT NULL::text, p_sign_in_method text DEFAULT 'magic_link'::text", returns: "uuid", security: "definer" },
+  { name: "portal_field_map", args: "p_organization_id uuid, p_table_id uuid", returns: "TABLE(field_id uuid, field_key text, field_type text, points_at uuid)", security: "definer" },
+  { name: "portal_invitation", args: "p_slug text, p_email text", returns: "jsonb", security: "definer" },
+  { name: "portal_invite", args: "p_organization_id uuid, p_portal_id uuid, p_client_record_id uuid, p_email text, p_user_id uuid DEFAULT NULL::uuid", returns: "jsonb", security: "definer" },
+  { name: "portal_me", args: "", returns: "jsonb", security: "definer" },
+  { name: "portal_preview", args: "p_organization_id uuid, p_portal_id uuid, p_principal_id uuid, p_table_id uuid", returns: "TABLE(record_id uuid, title text)", security: "definer" },
+  { name: "portal_principal_bind", args: "p_organization_id uuid, p_principal_id uuid, p_user_id uuid", returns: "jsonb", security: "definer" },
+  { name: "portal_public", args: "p_slug text", returns: "jsonb", security: "definer" },
+  { name: "portal_record_title", args: "p_organization_id uuid, p_record_id uuid", returns: "text", security: "definer" },
+  { name: "portal_revoke", args: "p_organization_id uuid, p_portal_id uuid, p_principal_id uuid", returns: "jsonb", security: "definer" },
+  { name: "portal_slug", args: "p_organization_id uuid, p_title text, p_portal_id uuid DEFAULT NULL::uuid", returns: "text", security: "definer" },
+  { name: "portals", args: "p_organization_id uuid", returns: "TABLE(portal_id uuid, title text, slug text, client_table_id uuid, client_table text, is_active boolean, tables integer, invited integer, signed_in integer, sign_in_method text, opened_at timestamp with time zone)", security: "definer" },
   { name: "presentation_kernel_id", args: "", returns: "uuid", security: "invoker" },
   { name: "promote_field", args: "p_organization_id uuid, p_table_id uuid, p_field_id uuid", returns: "jsonb", security: "invoker" },
   { name: "promote_table", args: "p_organization_id uuid, p_table_id uuid", returns: "jsonb", security: "definer" },
@@ -485,10 +585,12 @@ var STORE_DOORS = [
   { name: "record_resolve", args: "p_organization_id uuid, p_id uuid", returns: "jsonb", security: "definer" },
   { name: "record_restore", args: "p_organization_id uuid, p_record_id uuid", returns: "void", security: "definer" },
   { name: "record_state_as_of", args: "p_record_id uuid, p_at timestamp with time zone", returns: "TABLE(state jsonb, replayed boolean)", security: "definer" },
+  { name: "record_table", args: "p_organization_id uuid, p_record_id uuid", returns: "uuid", security: "definer" },
   { name: "record_update", args: "p_organization_id uuid, p_record_id uuid, p_patch jsonb, p_expected_version integer DEFAULT NULL::integer", returns: "integer", security: "definer" },
   { name: "record_values", args: "p_organization_id uuid, p_record_id uuid", returns: "jsonb", security: "invoker" },
   { name: "record_values_versioned", args: "p_organization_id uuid, p_record_id uuid", returns: "TABLE(field_key text, field_id uuid, value jsonb, value_version integer, source jsonb, absent_reason text, actor text, on_behalf_of text, written_at timestamp with time zone, alternates jsonb)", security: "definer" },
   { name: "record_write", args: "p_organization_id uuid, p_table_id uuid, p_data jsonb", returns: "uuid", security: "definer" },
+  { name: "refusals_claiming_a_level_never_asked", args: "", returns: "TABLE(function_name text, identity_args text, why text)", security: "invoker" },
   { name: "relation_carry", args: "p_organization_id uuid, p_container_id uuid, p_item_id uuid", returns: "uuid", security: "definer" },
   { name: "relation_edges_withdraw", args: "p_organization_id uuid, p_field_ids uuid[], p_why text", returns: "integer", security: "definer" },
   { name: "relation_own", args: "p_organization_id uuid, p_owner_id uuid, p_target_id uuid", returns: "uuid", security: "definer" },
@@ -534,7 +636,10 @@ var STORE_DOORS = [
   { name: "stamp_value_envelopes", args: "p_data jsonb, p_actor text, p_on_behalf_of text, p_at timestamp with time zone", returns: "jsonb", security: "invoker" },
   { name: "storage_modes", args: "", returns: "text[]", security: "invoker" },
   { name: "store_is_open", args: "p_organization_id uuid DEFAULT NULL::uuid", returns: "boolean", security: "invoker" },
+  { name: "subscription_mute", args: "p_organization_id uuid, p_rule_id uuid, p_muted boolean DEFAULT true", returns: "boolean", security: "definer" },
+  { name: "subscriptions", args: "p_organization_id uuid, p_table_id uuid DEFAULT NULL::uuid", returns: "TABLE(rule_id uuid, name text, table_id uuid, saved_view_id uuid, cadence text, schedule text, channel text, recipient_user_id uuid, event_key text, muted boolean, mine boolean, i_may_mute boolean)", security: "definer" },
   { name: "table_capacity", args: "p_organization_id uuid, p_table_id uuid", returns: "jsonb", security: "definer" },
+  { name: "table_carries_its_rows", args: "p_user_id uuid, p_table_id uuid, p_required permission_level DEFAULT 'viewer'::permission_level", returns: "boolean", security: "definer" },
   { name: "table_contents", args: "p_organization_id uuid, p_table_id uuid", returns: "TABLE(record_id uuid, kind text, goes_at integer)", security: "invoker" },
   { name: "table_declare", args: "p_organization_id uuid, p_spec jsonb", returns: "uuid", security: "definer" },
   { name: "table_has_a_visible_record", args: "p_user uuid, p_organization_id uuid, p_table_id uuid", returns: "boolean", security: "definer" },
@@ -568,6 +673,7 @@ var STORE_DOORS = [
   { name: "widget_kernel_id", args: "", returns: "uuid", security: "invoker" },
   { name: "work_approval_approvers", args: "p_organization_id uuid, p_subject_id uuid, p_approver_id uuid DEFAULT NULL::uuid", returns: "TABLE(user_id uuid, name text, why text)", security: "definer" },
   { name: "work_approval_decide", args: "p_organization_id uuid, p_approval_id uuid, p_approve boolean, p_note text DEFAULT NULL::text", returns: "jsonb", security: "definer" },
+  { name: "work_approval_kinds", args: "", returns: "text[]", security: "invoker" },
   { name: "work_approval_may_decide", args: "p_organization_id uuid, p_approval_id uuid", returns: "boolean", security: "definer" },
   { name: "work_approval_read", args: "p_organization_id uuid, p_approval_id uuid", returns: "jsonb", security: "definer" },
   { name: "work_approval_request", args: "p_organization_id uuid, p_subject_id uuid, p_change jsonb, p_note text DEFAULT NULL::text, p_approver_id uuid DEFAULT NULL::uuid, p_origin text DEFAULT 'person'::text, p_conversation_id uuid DEFAULT NULL::uuid", returns: "jsonb", security: "definer" },
@@ -587,6 +693,7 @@ var STORE_DOORS = [
   { name: "work_slot_index_name", args: "p_table_id uuid", returns: "text", security: "invoker" },
   { name: "work_slot_release", args: "p_organization_id uuid, p_hold_id uuid", returns: "boolean", security: "definer" },
   { name: "work_slots_declare", args: "p_organization_id uuid, p_name text, p_slug text, p_home_id uuid DEFAULT NULL::uuid", returns: "jsonb", security: "definer" },
+  { name: "work_state_id", args: "p_organization_id uuid, p_table_id uuid, p_value text", returns: "uuid", security: "invoker" },
   { name: "work_states", args: "", returns: "TABLE(sort integer, name text, terminal boolean, next text[])", security: "invoker" },
   { name: "work_take_assignment", args: "p_organization_id uuid, p_table_id uuid", returns: "jsonb", security: "definer" },
   { name: "work_template_declare", args: "p_organization_id uuid, p_name text, p_graph jsonb", returns: "uuid", security: "definer" },
@@ -635,17 +742,18 @@ var STORE_KNOBS = [
   { key: "world_publish_enabled", value: "false", type: "boolean" }
 ];
 var STORE_REFUSAL_CODES = [
-  { code: "02000", raised_by: "doc_render_body,doc_render_document,doc_render_read,doc_sign,doc_signature_intact,doc_signature_read,doc_template_read,doc_template_save,entity_field_retire,entity_field_update,entity_record_read,entity_value_write,external_history_event,external_rows,external_stub_upsert,external_writes_set,migrate_delete,migrate_extract_parent,migrate_merge,migrate_rename,migrate_reparent,migrate_retype,migrate_split,migrate_undo,organization_clear,read_record,record_delete,record_restore,record_update,relation_uncarry,share_access,share_grant,share_lane_set,share_people,share_revoke,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_assign,work_record_states,work_set_state" },
-  { code: "0A000", raised_by: "external_rows,external_source_declare,external_write_through,promote_field,promoted_index_expr,promoted_query_sql,promoted_read,rule_eval,work_assign,work_slots_declare" },
-  { code: "22004", raised_by: "_entity_custom_fields_guard,_value_envelope,actor_word,agg_assert_key,agg_sql,anon_capture,anon_token_issue,anon_write,assert_client_may_reach,doc_render_write,doc_sign,doc_signature_write,doc_template_save,external_history_event,external_rows,external_source_declare,external_stub_upsert,external_write_through,external_writes_set,form_declare,form_submit,home_add,io_comment_write,io_import_open,io_outbox_drain,io_restore,migrate_purge,migrate_split,migrate_undo,organization_clear,organization_contents,query_across_homes,query_by_coordinates,query_rollup,record_delete,record_reparent,record_resolve,record_restore,record_update,record_write,relation_carry,relation_own,rule_declare,share_grant,table_declare,work_approval_decide,work_approval_request,work_template_declare" },
+  { code: "02000", raised_by: "dashboard_delete,dashboard_run,doc_render_body,doc_render_document,doc_render_read,doc_sign,doc_signature_intact,doc_signature_read,doc_template_read,doc_template_save,entity_field_retire,entity_field_update,entity_record_read,entity_value_write,external_history_event,external_rows,external_stub_upsert,external_writes_set,migrate_delete,migrate_extract_parent,migrate_merge,migrate_reclass,migrate_rename,migrate_reparent,migrate_retype,migrate_split,migrate_undo,organization_clear,portal_card,portal_declare,portal_invite,portal_preview,portal_principal_bind,portal_revoke,read_record,record_delete,record_restore,record_table,record_update,relation_uncarry,share_access,share_grant,share_lane_set,share_people,share_revoke,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_assign,work_record_states,work_set_state" },
+  { code: "0A000", raised_by: "external_rows,external_source_declare,external_write_through,promote_field,promoted_index_expr,promoted_query_sql,promoted_read,rule_eval,work_assign" },
+  { code: "22004", raised_by: "_entity_custom_fields_guard,_value_envelope,actor_word,agg_assert_key,agg_sql,anon_capture,anon_token_issue,anon_write,assert_client_may_reach,dashboard_block_normalize,dashboard_declare,dashboard_window_sql,doc_render_write,doc_sign,doc_signature_write,doc_template_save,external_history_event,external_rows,external_source_declare,external_stub_upsert,external_write_through,external_writes_set,form_declare,form_submit,home_add,io_comment_write,io_import_open,io_outbox_drain,io_restore,migrate_choice_keys,migrate_purge,migrate_reclass,migrate_split,migrate_undo,organization_clear,organization_contents,portal_declare,portal_invite,portal_principal_bind,query_across_homes,query_by_coordinates,query_rollup,record_delete,record_reparent,record_resolve,record_restore,record_update,record_write,relation_carry,relation_own,rule_declare,share_grant,table_declare,work_approval_decide,work_approval_request,work_template_declare" },
+  { code: "22007", raised_by: "dashboard_window_sql" },
   { code: "22012", raised_by: "rule_eval" },
-  { code: "22023", raised_by: "_entity_custom_fields_guard,_value_envelope,_work_shape_guard,actor_word,agg_assert_key,agg_sql,anon_token_issue,containment_parent,doc_render_body,doc_render_write,doc_signature_write,entity_value_write,external_history_event,external_source_declare,external_stub_upsert,external_write_through,io_import_open,io_proposal_accept,migrate_merge,my_levels,organization_clear,query_by_coordinates,query_rollup,record_update,relation_carry,rule_eval,rule_members,share_grant,share_lane_set,table_rules,visibility_as_of,work_approval_request,work_list,work_slot_hold" },
-  { code: "23503", raised_by: "_containment_guard,_field_document_for,_record_rule_uses,anon_publish,anon_rate_take,anon_token_issue,anon_write,assert_organization_wall,delete_rule,doc_sign,doc_template_save,form_declare,form_submit,home_add,io_comment_write,io_import_rows,io_proposal_accept,migrate_demote,migrate_promote,promote_field,promote_table,record_applicability,record_reparent,relation_carry,relation_own,resolve_first_match,rule_applies,rule_declare,rule_eval,rule_members,rule_run,work_set_state,work_take_assignment,work_template_instantiate" },
+  { code: "22023", raised_by: "_entity_custom_fields_guard,_value_envelope,_work_shape_guard,actor_word,agg_assert_key,agg_sql,anon_token_issue,containment_parent,dashboard_block_normalize,dashboard_window_sql,doc_render_body,doc_render_write,doc_signature_write,entity_value_write,external_history_event,external_source_declare,external_stub_upsert,external_write_through,io_import_open,io_proposal_accept,migrate_merge,migrate_reclass,my_levels,organization_clear,portal_declare,query_by_coordinates,query_rollup,record_update,relation_carry,rule_eval,rule_members,share_grant,share_lane_set,table_rules,visibility_as_of,work_approval_request,work_list,work_slot_hold" },
+  { code: "23503", raised_by: "_containment_guard,_field_document_for,_record_rule_uses,anon_publish,anon_rate_take,anon_token_issue,anon_write,assert_organization_wall,dashboard_declare,delete_rule,doc_sign,doc_template_save,form_declare,form_submit,home_add,io_comment_write,io_import_rows,io_proposal_accept,migrate_demote,migrate_promote,promote_field,promote_table,record_applicability,record_reparent,relation_carry,relation_own,resolve_first_match,rule_applies,rule_declare,rule_eval,rule_members,rule_run,subscription_mute,work_set_state,work_take_assignment,work_template_instantiate" },
   { code: "23505", raised_by: "_unique_rule_holds,doc_sign,doc_signature_write,entity_field_declare,field_declare,home_add,io_proposal_accept,relation_carry,relation_own,share_grant,work_approval_decide,work_slot_hold" },
-  { code: "23514", raised_by: "_containment_guard,_dated_values_guard,_derived_fields,_entity_custom_fields_guard,_field_document_for,_field_shape_guard,_field_type_parity_guard,_merge_field_shape_guard,_merge_field_temporal_guard,_promoted_field_cap_guard,_record_rule_uses,_resolve_choice_words,_rule_shape_guard,_rule_topology_guard,_store_relation_edge_names_its_field,_table_shape_guard,_value_envelope,_work_shape_guard,_workdoors_approval_guard,assert_entity_is_organization_scoped,doc_sign,doc_signature_write,doc_template_save,entity_field_declare,entity_field_retire,entity_field_update,entity_records_find,entity_table,field_declare,field_retire,field_update,home_add,migrate_merge,relation_carry,relation_own,validate_value_envelope,validate_values,work_set_state,work_slots_declare,work_take_assignment,work_template_instantiate" },
+  { code: "23514", raised_by: "_containment_guard,_dated_values_guard,_derived_fields,_entity_custom_fields_guard,_field_class_guard,_field_document_for,_field_shape_guard,_field_type_parity_guard,_merge_field_shape_guard,_merge_field_temporal_guard,_promoted_field_cap_guard,_record_rule_uses,_resolve_choice_words,_rule_shape_guard,_rule_topology_guard,_store_relation_edge_names_its_field,_table_shape_guard,_value_envelope,_work_shape_guard,_workdoors_approval_guard,assert_entity_is_organization_scoped,doc_sign,doc_signature_write,doc_template_save,entity_field_declare,entity_field_retire,entity_field_update,entity_records_find,entity_table,field_declare,field_retire,field_update,home_add,migrate_merge,relation_carry,relation_own,validate_value_envelope,validate_values,work_set_state,work_slots_declare,work_take_assignment,work_template_instantiate" },
   { code: "40001", raised_by: "has_visibility_at" },
-  { code: "42501", raised_by: "_doc_render_immutable,_doc_signature_immutable,_field_definition_write,_field_write_door,_rule_definition_write,_store_door,anon_capture,anon_inbound_land,anon_publish,anon_token_issue,anon_token_verify,anon_write,assert_client_may_change,assert_client_may_open,assert_client_may_reach,assert_may_know_table,assert_organization_admin,assert_store_door,entity_field_declare,entity_field_retire,entity_field_update,entity_value_write,external_write_through,form_declare,form_submit,io_comment_resolve,io_comment_write,io_restore,migrate_purge,my_levels,organization_clear,promote_table,query_visibility_parity,read_record,read_records,share_grant,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_person" },
-  { code: "42703", raised_by: "entity_table" },
+  { code: "42501", raised_by: "_doc_render_immutable,_doc_signature_immutable,_field_definition_write,_field_write_door,_rule_definition_write,_store_door,anon_capture,anon_inbound_land,anon_publish,anon_token_issue,anon_token_verify,anon_write,assert_client_may_change,assert_client_may_open,assert_client_may_reach,assert_may_know_table,assert_organization_admin,assert_store_door,entity_field_declare,entity_field_retire,entity_field_update,entity_value_write,external_write_through,form_declare,form_submit,io_comment_resolve,io_comment_write,io_restore,migrate_purge,migrate_reclass,my_levels,organization_clear,portal_declare,portal_invitation,portal_invite,portal_principal_bind,promote_table,query_visibility_parity,read_record,read_records,share_grant,subscription_mute,visibility_as_of,work_approval_decide,work_approval_read,work_approval_request,work_person" },
+  { code: "42703", raised_by: "entity_table,portal_declare" },
   { code: "53400", raised_by: "anon_rate_take,delete_cascade_closure,promote_field" },
   { code: "54001", raised_by: "record_delete" },
   { code: "PT409", raised_by: "record_update" }
@@ -1755,6 +1863,24 @@ var DOORS = {
   fieldDeclare: "field_declare",
   fieldUpdate: "field_update",
   fieldRetire: "field_retire",
+  // CUSTOM FIELDS ON A STANDARD BUSINESS TABLE. Every door above is keyed by a
+  // custom Table's uuid, and a standard table has no Table record - so until
+  // 2026-09-20 `custom.applicable_fields(org, 'party', null)` answered `22P02
+  // invalid input syntax for uuid` and there was no other way in. These are
+  // keyed by the REGISTRY TOKEN instead, and they are one set for all 643
+  // tables the registry types Entity or Detail. The three value doors are
+  // SECURITY INVOKER in the database on purpose: the standard table's own
+  // row-level security is what decides who may read and write its rows, and a
+  // definer wrapper would replace it with a second access system.
+  entityTable: "entity_table",
+  entityFields: "entity_fields",
+  entityFieldDeclare: "entity_field_declare",
+  entityFieldUpdate: "entity_field_update",
+  entityFieldRetire: "entity_field_retire",
+  entityFieldRights: "entity_field_rights",
+  entityRecordRead: "entity_record_read",
+  entityValueWrite: "entity_value_write",
+  entityRecordsFind: "entity_records_find",
   tableCapacity: "table_capacity",
   tableStorage: "table_storage",
   promoteTable: "promote_table",
@@ -1803,6 +1929,32 @@ var DOORS = {
   // are server-lane doors and a browser never calls them.
   forms: "forms",
   formDeclare: "form_declare",
+  // THE CLIENT PORTAL, OWNER'S SIDE (VIS-31 / PORTAL). A portal is how somebody
+  // with NO membership is let in to see the records that name them. `portals`
+  // lists them, `portalCard` opens one, `portalDeclare` states what it exposes,
+  // `portalInvite` and `portalRevoke` are the two acts on a person, and
+  // `portalPreview` is "view as this client" — it asks `custom.visible_set` for
+  // HER user id, the same call `custom.read_records` makes when she opens the
+  // page, so the preview cannot disagree with what she sees. The CLIENT-side
+  // pair (`custom.portal_public`, `custom.portal_invitation`, `custom.portal_me`)
+  // is deliberately absent here: those belong to the outsider's own shell.
+  portals: "portals",
+  portalCard: "portal_card",
+  portalDeclare: "portal_declare",
+  portalInvite: "portal_invite",
+  portalRevoke: "portal_revoke",
+  portalPreview: "portal_preview",
+  // SCR-16 — the canvas. A dashboard is a record in the presentation kernel
+  // whose blocks are saved SPECS for the eighth verb; `dashboardRun` walks them
+  // under the CALLER'S principal, so nothing here is precomputed and nothing is
+  // summed in a browser. `dashboardStuck` is the seventh block kind on its own,
+  // because "what has not moved in fourteen days" is a question a screen asks
+  // outside a canvas too.
+  dashboards: "dashboards",
+  dashboardDeclare: "dashboard_declare",
+  dashboardRun: "dashboard_run",
+  dashboardStuck: "dashboard_stuck",
+  dashboardDelete: "dashboard_delete",
   // The eighth verb (AGT-N-8): a grouped, bucketed, filtered count/sum/avg/
   // min/max computed INSIDE the read door's own query, so a chart shows exactly
   // the rows this person may see and never fetches the ones they may not.
@@ -1813,6 +1965,12 @@ var DOORS = {
   // over a saved view. There is no subscription TABLE and no second notifier.
   aggSubscriptions: "agg_subscriptions",
   aggSubscriptionCadences: "agg_subscription_cadences",
+  // The OWNER's side of DOOR-18. `agg_subscriptions` is the notifier's reader
+  // and is not client-callable; these two are what a person reaches: what am I
+  // being told about, and switch this one off. A form's notify Rule is one of
+  // these rows, so "tell me when a patient arrives" can also be un-told.
+  subscriptions: "subscriptions",
+  subscriptionMute: "subscription_mute",
   // The doc doors: a template is saved, a render is written once and frozen,
   // and a signature is checked against the exact bytes that were signed.
   docTemplateSave: "doc_template_save",
@@ -1861,6 +2019,23 @@ var DOORS = {
   workSlotRelease: "work_slot_release",
   workSlotHolds: "work_slot_holds",
   workSlotExpire: "work_slot_expire",
+  // THE WORK LAYER'S OWN DOORS (lane WORK-DOORS, 2026-09-20). Until this lane
+  // all nineteen `custom.work_*` functions were SECURITY INVOKER with no client
+  // grant: REC-69, REC-70 and REC-71 were live in the store and unreachable
+  // from a browser. These are the verbs a person actually uses.
+  workPerson: "work_person",
+  workAssign: "work_assign",
+  workRecordStates: "work_record_states",
+  workSetState: "work_set_state",
+  workList: "work_list",
+  workTemplates: "work_templates",
+  /** THE ONE QUEUE: assignments, approvals and the agent's proposals together. */
+  workInbox: "work_inbox",
+  workApprovalApprovers: "work_approval_approvers",
+  workApprovalRequest: "work_approval_request",
+  workApprovalMayDecide: "work_approval_may_decide",
+  workApprovalDecide: "work_approval_decide",
+  workApprovalRead: "work_approval_read",
   // Declared here BECAUSE they do not exist yet: naming them is what makes the
   // absence visible to `pnpm check:store-registry` and to the suite.
   metadataSearch: "metadata_search",
@@ -1900,6 +2075,14 @@ var BY_SQLSTATE = {
   // caught it raised by a door this package did not know about — which is the
   // suite working, and is why the map is a census rather than a guess.
   "42703": "invalid_argument",
+  // 22007 — a date or a time the store could not read as one. It is raised by
+  // `custom.dashboard_window_sql`, which is handed a window a caller wrote
+  // ("last 30 days", a literal date), so the class is again "the call named
+  // something the shape does not accept" and the store's own sentence names the
+  // text it could not read. Added 2026-09-20 (lane SCREEN-BREAK) after the
+  // live-door census caught it — the same way 42703 arrived, which is the
+  // census working rather than a guess.
+  "22007": "invalid_argument",
   "02000": "not_found",
   "23503": "missing_reference",
   "23505": "already_exists",
@@ -2269,9 +2452,11 @@ function createRecordsClient(config) {
       );
       if (!applicable.ok) return err(applicable.error);
       const rows = applicable.data ?? [];
-      return ok(
-        rows.map((row) => ({ id: row.id, ...row.data }))
+      const fields = rows.map((row) => ({ id: row.id, ...row.data }));
+      fields.sort(
+        (a, b) => (a.sort ?? 0) - (b.sort ?? 0) || (a.label ?? "").localeCompare(b.label ?? "")
       );
+      return ok(fields);
     },
     async fieldOptions({ field_id }) {
       return callDoor(
@@ -2294,6 +2479,88 @@ function createRecordsClient(config) {
         "fieldDeclare"
       );
     },
+    async entityTable({ token }) {
+      const answer = await callDoor(
+        DOORS.entityTable,
+        { p_token: token },
+        "entityTable"
+      );
+      if (!answer.ok) return err(answer.error);
+      const row = Array.isArray(answer.data) ? answer.data[0] : answer.data;
+      if (!row) {
+        return err({
+          code: "not_found",
+          message: `The registry answered nothing for the table "${token}".`,
+          hint: "REC-33: a standard table is named by its registry token. Nothing was read."
+        });
+      }
+      return ok(row);
+    },
+    async entityFields({ token }) {
+      const rows = await callDoor(
+        DOORS.entityFields,
+        { p_organization_id: org, p_token: token },
+        "entityFields"
+      );
+      if (!rows.ok) return err(rows.error);
+      return ok((rows.data ?? []).map((row) => ({ id: row.id, ...row.data })));
+    },
+    async entityFieldDeclare({ token, spec }) {
+      return callDoor(
+        DOORS.entityFieldDeclare,
+        { p_organization_id: org, p_token: token, p_spec: spec },
+        "entityFieldDeclare"
+      );
+    },
+    async entityFieldUpdate({ field_id, patch }) {
+      return callDoor(
+        DOORS.entityFieldUpdate,
+        { p_organization_id: org, p_field_id: field_id, p_patch: patch },
+        "entityFieldUpdate"
+      );
+    },
+    async entityFieldRetire({ field_id }) {
+      return callDoor(
+        DOORS.entityFieldRetire,
+        { p_organization_id: org, p_field_id: field_id },
+        "entityFieldRetire"
+      );
+    },
+    async entityFieldRights({ token }) {
+      return callDoor(
+        DOORS.entityFieldRights,
+        { p_organization_id: org, p_token: token },
+        "entityFieldRights"
+      );
+    },
+    async entityRecordRead({ token, record_id }) {
+      return callDoor(
+        DOORS.entityRecordRead,
+        { p_organization_id: org, p_token: token, p_record_id: record_id },
+        "entityRecordRead"
+      );
+    },
+    async entityValueWrite({ token, record_id, patch }) {
+      return callDoor(
+        DOORS.entityValueWrite,
+        { p_organization_id: org, p_token: token, p_record_id: record_id, p_patch: patch },
+        "entityValueWrite"
+      );
+    },
+    async entityRecordsFind({ token, key, value, limit, offset }) {
+      return callDoor(
+        DOORS.entityRecordsFind,
+        {
+          p_organization_id: org,
+          p_token: token,
+          p_key: key,
+          p_value: value === void 0 ? null : value,
+          ...limit === void 0 ? {} : { p_limit: limit },
+          ...offset === void 0 ? {} : { p_offset: offset }
+        },
+        "entityRecordsFind"
+      );
+    },
     async fieldUpdate({ field_id, patch }) {
       return callDoor(
         DOORS.fieldUpdate,
@@ -2363,6 +2630,65 @@ function createRecordsClient(config) {
         "formDeclare"
       );
     },
+    async portals() {
+      return callDoor(DOORS.portals, { p_organization_id: org }, "portals");
+    },
+    async portalCard({ portal_id }) {
+      return callDoor(
+        DOORS.portalCard,
+        { p_organization_id: org, p_portal_id: portal_id },
+        "portalCard"
+      );
+    },
+    async portalDeclare(args) {
+      return callDoor(
+        DOORS.portalDeclare,
+        {
+          p_organization_id: org,
+          p_title: args.title,
+          p_client_table_id: args.client_table_id,
+          p_tables: args.tables,
+          p_portal_id: args.portal_id ?? null,
+          p_slug: args.slug ?? null,
+          p_sign_in_method: args.sign_in_method ?? "magic_link"
+        },
+        "portalDeclare"
+      );
+    },
+    async portalInvite(args) {
+      return callDoor(
+        DOORS.portalInvite,
+        {
+          p_organization_id: org,
+          p_portal_id: args.portal_id,
+          p_client_record_id: args.client_record_id,
+          p_email: args.email,
+          // ALWAYS null from a client. See the interface comment: an invitation
+          // confers nothing until the person follows their own sign-in link.
+          p_user_id: null
+        },
+        "portalInvite"
+      );
+    },
+    async portalRevoke({ portal_id, principal_id }) {
+      return callDoor(
+        DOORS.portalRevoke,
+        { p_organization_id: org, p_portal_id: portal_id, p_principal_id: principal_id },
+        "portalRevoke"
+      );
+    },
+    async portalPreview({ portal_id, principal_id, table_id }) {
+      return callDoor(
+        DOORS.portalPreview,
+        {
+          p_organization_id: org,
+          p_portal_id: portal_id,
+          p_principal_id: principal_id,
+          p_table_id: table_id
+        },
+        "portalPreview"
+      );
+    },
     async ruleRun({ rule_id, values, context }) {
       return callDoor(
         DOORS.ruleRun,
@@ -2387,6 +2713,55 @@ function createRecordsClient(config) {
         "ruleEval"
       );
     },
+    async dashboards(args) {
+      return callDoor(
+        DOORS.dashboards,
+        { p_organization_id: org, p_table_id: args?.table_id ?? null },
+        "dashboards"
+      );
+    },
+    async dashboardDeclare(args) {
+      return callDoor(
+        DOORS.dashboardDeclare,
+        {
+          p_organization_id: org,
+          p_table_id: args.table_id,
+          p_name: args.name,
+          p_blocks: args.blocks ?? [],
+          p_presentation: args.presentation ?? {},
+          p_dashboard_id: args.dashboard_id ?? null
+        },
+        "dashboardDeclare"
+      );
+    },
+    async dashboardRun({ dashboard_id, filter }) {
+      return callDoor(
+        DOORS.dashboardRun,
+        { p_organization_id: org, p_dashboard_id: dashboard_id, p_filter: filter ?? {} },
+        "dashboardRun"
+      );
+    },
+    async dashboardStuck({ table_id, state_key, days, filter, limit }) {
+      return callDoor(
+        DOORS.dashboardStuck,
+        {
+          p_organization_id: org,
+          p_table_id: table_id,
+          p_state_key: state_key,
+          p_days: days ?? 14,
+          p_filter: filter ?? {},
+          p_limit: limit ?? 50
+        },
+        "dashboardStuck"
+      );
+    },
+    async dashboardDelete({ dashboard_id }) {
+      return callDoor(
+        DOORS.dashboardDelete,
+        { p_organization_id: org, p_dashboard_id: dashboard_id },
+        "dashboardDelete"
+      );
+    },
     async recordAggregate({ table_id, groupBy, measures, bucket, filter, limit }) {
       return callDoor(
         DOORS.recordAggregate,
@@ -2422,6 +2797,20 @@ function createRecordsClient(config) {
     async aggSubscriptionCadences() {
       return callDoor(DOORS.aggSubscriptionCadences, {}, "aggSubscriptionCadences");
     },
+    async subscriptions(args) {
+      return callDoor(
+        DOORS.subscriptions,
+        { p_organization_id: org, p_table_id: args?.table_id ?? null },
+        "subscriptions"
+      );
+    },
+    async subscriptionMute({ rule_id, muted }) {
+      return callDoor(
+        DOORS.subscriptionMute,
+        { p_organization_id: org, p_rule_id: rule_id, p_muted: muted },
+        "subscriptionMute"
+      );
+    },
     async docTemplateSave({ table_id, name, body, template_id }) {
       return callDoor(
         DOORS.docTemplateSave,
@@ -2711,6 +3100,128 @@ function createRecordsClient(config) {
         "workSlotExpire"
       );
     },
+    // ── the work layer a person actually uses ────────────────────────────
+    async workInbox(args) {
+      return callDoor(
+        DOORS.workInbox,
+        {
+          p_organization_id: org,
+          p_limit: args?.limit ?? 50,
+          p_offset: args?.offset ?? 0,
+          p_include_decided: args?.includeDecided ?? false
+        },
+        "workInbox"
+      );
+    },
+    async workList(args) {
+      return callDoor(
+        DOORS.workList,
+        {
+          p_organization_id: org,
+          p_flavour: args?.flavour ?? "mine",
+          p_include_finished: args?.includeFinished ?? false,
+          p_limit: args?.limit ?? 100,
+          p_offset: args?.offset ?? 0
+        },
+        "workList"
+      );
+    },
+    async workAssign({ record_id, user_id = null, dueDate = null, clearDue = false }) {
+      return callDoor(
+        DOORS.workAssign,
+        {
+          p_organization_id: org,
+          p_record_id: record_id,
+          p_assignee_user_id: user_id,
+          p_due_date: dueDate,
+          p_clear_due: clearDue
+        },
+        "workAssign"
+      );
+    },
+    async workRecordStates({ record_id }) {
+      return callDoor(
+        DOORS.workRecordStates,
+        { p_organization_id: org, p_record_id: record_id },
+        "workRecordStates"
+      );
+    },
+    async workSetState({ record_id, state_id }) {
+      return callDoor(
+        DOORS.workSetState,
+        { p_organization_id: org, p_record_id: record_id, p_state_id: state_id },
+        "workSetState"
+      );
+    },
+    async workPerson({ user_id, create = true }) {
+      return callDoor(
+        DOORS.workPerson,
+        { p_organization_id: org, p_user_id: user_id, p_create: create },
+        "workPerson"
+      );
+    },
+    async workTemplates(args) {
+      return callDoor(
+        DOORS.workTemplates,
+        { p_organization_id: org, p_limit: args?.limit ?? 100 },
+        "workTemplates"
+      );
+    },
+    async workApprovalApprovers({ subject_id, approver_id = null }) {
+      return callDoor(
+        DOORS.workApprovalApprovers,
+        { p_organization_id: org, p_subject_id: subject_id, p_approver_id: approver_id },
+        "workApprovalApprovers"
+      );
+    },
+    async workApprovalRequest({
+      subject_id,
+      change,
+      note = null,
+      approver_id = null,
+      origin = "person",
+      conversation_id = null
+    }) {
+      return callDoor(
+        DOORS.workApprovalRequest,
+        {
+          p_organization_id: org,
+          p_subject_id: subject_id,
+          p_change: change,
+          p_note: note,
+          p_approver_id: approver_id,
+          p_origin: origin,
+          p_conversation_id: conversation_id
+        },
+        "workApprovalRequest"
+      );
+    },
+    async workApprovalMayDecide({ approval_id }) {
+      return callDoor(
+        DOORS.workApprovalMayDecide,
+        { p_organization_id: org, p_approval_id: approval_id },
+        "workApprovalMayDecide"
+      );
+    },
+    async workApprovalDecide({ approval_id, approve, note = null }) {
+      return callDoor(
+        DOORS.workApprovalDecide,
+        {
+          p_organization_id: org,
+          p_approval_id: approval_id,
+          p_approve: approve,
+          p_note: note
+        },
+        "workApprovalDecide"
+      );
+    },
+    async workApprovalRead({ approval_id }) {
+      return callDoor(
+        DOORS.workApprovalRead,
+        { p_organization_id: org, p_approval_id: approval_id },
+        "workApprovalRead"
+      );
+    },
     // ── the trust doors ──────────────────────────────────────────────────
     async isExternalPrincipal(args) {
       return trustDoor(
@@ -2903,7 +3414,7 @@ function pgJsonbText(value) {
   return JSON.stringify(value);
 }
 var jsonBytes = (value) => new TextEncoder().encode(pgJsonbText(value)).length;
-var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function labelOf(field) {
   return field.label && field.label.length > 0 ? field.label : field.key;
 }
@@ -3013,7 +3524,7 @@ function predictValueRefusals(fields, values, recordType) {
             message: `${label} takes one of its choices, and it was given a ${jsonType(item)}`,
             hint: "FLD-5 / FLD-6: a list field stores the id of the option RECORD, because every pick-list is already a Table."
           });
-        } else if (!UUID.test(item)) {
+        } else if (!UUID2.test(item)) {
           found.push({
             ...base,
             message: `${label} was given a choice that is not one of its choices`,
@@ -3023,7 +3534,7 @@ function predictValueRefusals(fields, values, recordType) {
       } else if (field.type === "relation") {
         if (typeof item !== "string") {
           found.push({ ...base, message: `${label} points at a record, and it was given a ${jsonType(item)}`, hint: "FLD-1: relation." });
-        } else if (!UUID.test(item)) {
+        } else if (!UUID2.test(item)) {
           found.push({
             ...base,
             message: `${label} points at something that is not there`,