@ai-matrx/records 0.87.32 → 0.92.0

package/dist/search/index.js

@@ -0,0 +1,260 @@
+// src/core/supabase.ts
+function refuse(code, message, hint) {
+  return { data: null, error: { code, message, hint, details: "" } };
+}
+function supabaseDataSource(client) {
+  if (isBound(client)) return client;
+  const supabase = client;
+  const hasSchema = typeof supabase.schema === "function";
+  const bound = {
+    // PAGE-BUNDLE: the real adapter opens a table page with one `custom.table_page_bundle` call.
+    opensInOneCall: true,
+    rpc(fn, args, options) {
+      if (!hasSchema) {
+        return Promise.resolve(
+          refuse(
+            "data_source_unbound",
+            `The records client was given something that is not a supabase client: it has no schema() method, so the door ${fn} cannot be called in the schema it lives in.`,
+            "Pass a supabase-js v2 client (createClient(...)) to supabaseDataSource()."
+          )
+        );
+      }
+      const name = options?.schema;
+      if (!name) {
+        return Promise.resolve(
+          refuse(
+            "schema_unsaid",
+            `The door ${fn} was called without saying which schema it lives in. Every door of this store is custom.${fn} and every trust door is iam.${fn}; an unqualified call reaches PostgREST's default profile (public) and is refused there.`,
+            "This is a bug in the caller, not in your data: /core says the schema on every call."
+          )
+        );
+      }
+      return supabase.schema(name).rpc(fn, args);
+    },
+    schema(name) {
+      return supabase.schema(name);
+    }
+  };
+  Object.defineProperty(bound, BOUND, { value: true, enumerable: false });
+  return bound;
+}
+var BOUND = /* @__PURE__ */ Symbol.for("@ai-matrx/records/supabaseDataSource");
+function isBound(source) {
+  return source[BOUND] === true;
+}
+function asRecordsDataSource(source) {
+  if (source === null || typeof source !== "object") return supabaseDataSource({});
+  if (isBound(source)) return source;
+  const candidate = source;
+  const looksLikeSupabaseJs = typeof candidate.schema === "function" && typeof candidate.from === "function" && candidate.auth !== null && typeof candidate.auth === "object";
+  if (looksLikeSupabaseJs || typeof candidate.rpc !== "function") return supabaseDataSource(source);
+  return source;
+}
+
+// src/core/pgError.ts
+var BY_SQLSTATE = {
+  PT409: "stale_write",
+  "42501": "door",
+  "23514": "refused_by_rule",
+  "22004": "invalid_argument",
+  "22023": "invalid_argument",
+  // MX005 — a value the store cannot take as asked: since 2026-10-06 (AP-3 U3) a word that names more than one
+  // choice or linked record raises it (it used to borrow PT409 and read as somebody else's write winning).
+  MX005: "invalid_argument",
+  // MXD01 — the held-change door tried the proposed values before filing an
+  // approval request and the store refused them. Nothing is waiting for a
+  // person to decide; correct the value before asking again, which is the same
+  // caller-side condition as the other invalid-argument refusals.
+  MXD01: "invalid_argument",
+  // 22P02 — a value does not fit the type the store holds for it. The class is
+  // real and was hit live: an organization whose copy of a package table grew
+  // `status` as a uuid-valued Field was sent the text "open", and the store
+  // answered `invalid input syntax for type uuid: "open"`. It is the CALL that
+  // is wrong for the shape the store holds, which is what `invalid_argument`
+  // already means — the store's own sentence names the value and the type.
+  "22P02": "invalid_argument",
+  // 42703 — a column that is not there. The store raises it from
+  // `custom.entity_table`, which is asked for a column by NAME, so the class is
+  // exactly "the call named something the shape does not have": the same thing
+  // `invalid_argument` already means, and the store's own sentence names the
+  // column. Added 2026-09-20 (lane FORMS) because the package's live-door suite
+  // caught it raised by a door this package did not know about — which is the
+  // suite working, and is why the map is a census rather than a guess.
+  "42703": "invalid_argument",
+  // 22007 — a date or a time the store could not read as one. It is raised by
+  // `custom.dashboard_window_sql`, which is handed a window a caller wrote
+  // ("last 30 days", a literal date), so the class is again "the call named
+  // something the shape does not accept" and the store's own sentence names the
+  // text it could not read. Added 2026-09-20 (lane SCREEN-BREAK) after the
+  // live-door census caught it — the same way 42703 arrived, which is the
+  // census working rather than a guess.
+  "22007": "invalid_argument",
+  // 22003 — a number the store could not hold at the size it was handed. It is
+  // raised by `custom.context_resolve`, which is given a window or a depth a
+  // caller wrote, so the class is the same one 22P02, 42703 and 22007 already
+  // are: the CALL named a value the shape does not accept, and the store's own
+  // sentence names the number and the range. Added 2026-09-20 (lane GRID-TWO)
+  // when the live-door census caught the release gate red on it — which is the
+  // census working, and the fourth time it has been the thing that found a new
+  // refusal class rather than a person guessing one.
+  "22003": "invalid_argument",
+  // 42883 — `custom._template_call` (the template family, 2026-10-03) was handed a step that
+  // names a door the store does not have, or an argument that door does not take. The TEMPLATE
+  // named something the shape does not have — the same class 42703 is — and the store's own
+  // sentence names the door or the argument. Caught by the live-door census on records 0.68.1's
+  // tag, the eighth time the census found a class before a person did. (A bare 42883 on a door
+  // this package itself asks for is still `door_absent`, mapped before this funnel in
+  // `owedDoor`.)
+  "42883": "invalid_argument",
+  "02000": "not_found",
+  // P0002 — `custom.inbox_snooze` / `custom.inbox_clear` (lane S5-PRIME-2, 2026-09-24): "There is
+  // nothing in your inbox with that id". An invented id, another person's item and another
+  // organization's all answer it alike, so it reads exactly as 02000 does: not found.
+  "P0002": "not_found",
+  "23503": "missing_reference",
+  "23505": "already_exists",
+  "0A000": "not_supported",
+  "53400": "store_limit",
+  "22012": "store_limit",
+  // 54001 — `custom.record_delete` stops a cascade that nests past sixty-four
+  // levels of containment, because that is a loop somebody built rather than a
+  // hierarchy, and saying so beats recursing until the server runs out of
+  // stack. It is a LIMIT of the store, and the store's own sentence names what
+  // to do about it, so it reads as one.
+  "54001": "store_limit",
+  // 54000 — the grid primitives' organization ceilings (GRID-PRIMITIVES, 2026-09-23):
+  // `custom.action_run` on a selection past its knob, `custom.table_decorate` past the
+  // rule count, `custom.table_from_example` past `custom/example_rows_max`,
+  // `custom.table_webhook_declare` past `custom/table_webhooks_max`, and
+  // `custom.hub_changed_by`. Each names its knob in the hint and writes nothing, so it
+  // reads exactly like 54001: a limit of the store, in the store's own sentence.
+  "54000": "store_limit",
+  // VIS: `custom.has_visibility_at` refuses to answer from a snapshot older
+  // than a write this reader has already seen, rather than returning something
+  // they just lost access to. It is retryable on a fresher connection, which is
+  // a different instruction from every other refusal here.
+  // 55000 — `custom.table_move` (SC-1', 2026-09-24) refuses a move the table's present state
+  // does not allow: a destination that cannot take it, a table something else holds, contents
+  // that point at themselves in a circle. The store's own sentence names the reason and nothing
+  // moves, so it reads as a refusal on the merits. Caught by the live-door census on records
+  // 0.58.3's tag, the seventh time the census found a class before a person did.
+  "55000": "refused_by_rule",
+  // 42P17 — a worked-out column that would read itself round a circle (STORE-TAILS-3,
+  // 2026-09-25): `custom._field_reads_what_it_reads` refuses the declaration or edit that would
+  // close the circle, naming every column in it, and `custom.far_value` refuses a circle stored
+  // before that rule when a lookup or rollup is worked out. Refused on its merits, in the store's
+  // own sentence, nothing written — so it reads as 55000 does.
+  "42P17": "refused_by_rule",
+  // P0001 — `custom.context_scope_write` (2026-10-03) refuses a scope whose parent breaks the
+  // parent rule in the old trigger's own class and words (manager ruling H6). Refused on its
+  // merits, nothing written. Caught by the live-door census on records 0.65.0's tag.
+  P0001: "refused_by_rule",
+  "40001": "stale_read",
+  // 57014 — the store cancelled the statement at its own timeout. Like
+  // `stale_read` and unlike every other refusal here, the call was never
+  // refused on its merits: the same call on a smaller page, or once the
+  // organization's kernel is not being rewritten, can succeed. It gets its own
+  // code so a screen can offer "try again" honestly instead of showing a
+  // failure sentence the caller cannot act on.
+  "57014": "timed_out",
+  // PostgREST's own two: the store is not being SERVED, which is a different
+  // thing from the store refusing. `custom` absent from `pgrst.db_schemas`, or
+  // the grants not copied, land here.
+  PGRST202: "store_not_served",
+  PGRST205: "store_not_served",
+  PGRST301: "door",
+  // PT428 — NOT A FAILURE, and the release gate's live census is what found it
+  // missing: the store raises it and this package answered `internal`, which is
+  // the one classification that tells a screen nothing. A stage gate whose
+  // `on_fail` is `require_approval` files the request and leaves the record
+  // where it was; the transaction is rolled back to the pipeline's own block, so
+  // "nothing was written" is a fact rather than a promise. Landed by lane
+  // STAGE-RULES; mapped here by STAGE-RULES-2 the day after, when the census
+  // caught it — the sixth time that census has been the thing that found a
+  // refusal class rather than a person guessing one.
+  PT428: "needs_approval"
+};
+var MAPPED_SQLSTATES = Object.keys(BY_SQLSTATE);
+function parseDetail(details) {
+  if (!details) return void 0;
+  const trimmed = details.trim();
+  if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) return details;
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    return details;
+  }
+}
+function isNotASqlstate(code) {
+  if (!code) return true;
+  return /^[0-9]{3}$/.test(code);
+}
+function mapPgError(error, where) {
+  const raw = error.code ?? void 0;
+  const sqlstate = raw && raw !== "" ? raw : void 0;
+  const mapped = {
+    code: "internal",
+    message: error.message,
+    ...error.hint ? { hint: error.hint } : {},
+    ...sqlstate ? { sqlstate } : {}
+  };
+  if (isNotASqlstate(sqlstate)) {
+    mapped.code = "unreachable";
+  } else {
+    mapped.code = BY_SQLSTATE[sqlstate] ?? "internal";
+  }
+  const detail = parseDetail(error.details);
+  if (detail !== void 0) mapped.detail = detail;
+  if (mapped.code === "internal") {
+    mapped.unmapped = true;
+    mapped.diagnostic = `@ai-matrx/records did not recognise SQLSTATE ${sqlstate ?? "(none)"} from ${where}; the store's own message is the thing to act on.`;
+  } else if (mapped.code === "unreachable") {
+    mapped.unmapped = true;
+    mapped.diagnostic = `@ai-matrx/records never reached the store from ${where}: ${raw ? `the transport answered ${raw}` : "no response"} \u2014 ${error.message}`;
+    mapped.message = "We could not reach your data.";
+    delete mapped.hint;
+  }
+  return mapped;
+}
+
+// src/search/index.ts
+var STORE_RECORD_SEARCH_MIN_CHARS = 2;
+async function searchRecords(dataSource, request = {}) {
+  const search = request.search?.trim() ?? "";
+  if (search.length > 0 && search.length < STORE_RECORD_SEARCH_MIN_CHARS) return { ok: true, data: [] };
+  const args = { p_search: search, p_limit: request.limit ?? 25, p_offset: request.offset ?? 0 };
+  if (request.tableIds && request.tableIds.length > 0) args["p_table_ids"] = [...request.tableIds];
+  if (request.organizationIds && request.organizationIds.length > 0) args["p_organization_ids"] = [...request.organizationIds];
+  try {
+    const answer = await asRecordsDataSource(dataSource).rpc("records_search", args, { schema: "custom" });
+    if (answer.error) return { ok: false, error: mapPgError(answer.error, "custom.records_search") };
+    const rows = answer.data ?? [];
+    return {
+      ok: true,
+      data: rows.map((row) => ({
+        recordId: row.record_id,
+        tableId: row.table_id,
+        tableName: row.table_name,
+        name: row.name,
+        organizationId: row.organization_id,
+        updatedAt: row.updated_at
+      }))
+    };
+  } catch (thrown) {
+    return { ok: false, error: mapPgError({ code: "", message: thrown instanceof Error ? thrown.message : String(thrown) }, "custom.records_search") };
+  }
+}
+async function listStoreRecordCandidates(dataSource, args) {
+  const found = await searchRecords(dataSource, { ...args.search !== void 0 ? { search: args.search } : {}, limit: args.limit ?? 25 });
+  if (!found.ok) {
+    console.error("[listStoreRecordCandidates] failed", found.error);
+    return { ok: false, error: found.error.message || "Could not search records" };
+  }
+  return { ok: true, data: found.data.map((hit) => ({ id: hit.recordId, title: hit.name ? `${hit.name} \xB7 ${hit.tableName}` : hit.tableName })) };
+}
+export {
+  STORE_RECORD_SEARCH_MIN_CHARS,
+  listStoreRecordCandidates,
+  searchRecords
+};
+//# sourceMappingURL=index.js.map

package/dist/search/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/supabase.ts","../../src/core/pgError.ts","../../src/search/index.ts"],"sourcesContent":["// src/core/supabase.ts — @ai-matrx/records (HEADLESS)\n//\n// THE ONE ADAPTER FROM A SUPABASE CLIENT TO THIS PACKAGE'S DATA SEAM.\n//\n// Why it exists, and what it cost to learn (2026-09-19, the independent verdict\n// on /data): `RecordsDataSource.rpc(fn, args, { schema })` says the schema\n// out loud, because every door of this store is `custom.<name>` and every door\n// of the trust layer is `iam.<name>`. supabase-js's own\n// `rpc(fn, args, options)` HAS NO `schema` OPTION — its third argument is\n// `{ head, get, count }`, and an unknown key is dropped in silence. So a\n// supabase client handed straight to `config.dataSource` as a structural cast\n// asked its default PostgREST profile, `public`, for every door, and the store\n// answered correctly and uselessly:\n//\n//   PGRST202 — Could not find the function public.table_kernel_id(...) in the\n//   schema cache\n//\n// Every screen in the record store was dead from a browser because of it, while\n// the desktop app and the browser extension each grew their own way of asking.\n// The class fix is ONE adapter, here, in the headless core, that every host\n// inherits — never three hosts remembering the same thing.\n//\n// The schema is chosen the ONE way supabase-js offers: `client.schema(name)`\n// returns a client bound to that PostgREST profile (it sets the\n// `Accept-Profile` / `Content-Profile` headers), and `.rpc()` on THAT is the\n// call. There is no per-call option that does it.\n//\n// This file holds no key and opens no connection: the host hands in a client\n// that already carries the operating person's session, which is what makes\n// DOOR-5 and AGT-N-4 true — the store sees the person, not us.\n\nimport type { PgError } from \"../results\";\nimport type { RecordsDataSource } from \"../ports\";\n\n/**\n * The structural shape of the supabase client this adapter needs. Deliberately\n * NOT `SupabaseClient<Database>`: a generated `Database` type makes\n * `schema().from().select()` enormous, and a host app that passed its typed\n * client in got `TS2589: Type instantiation is excessively deep and possibly\n * infinite` in its own build (matrx-frontend, 2026-09-18, on all three campaign\n * routes at once). The cast lives here, once, where it is explained.\n */\nexport interface SupabaseLike {\n  schema(name: string): {\n    rpc(\n      fn: string,\n      args?: Record<string, unknown>,\n    ): PromiseLike<{ data: unknown; error: PgError | null }>;\n    from(table: string): unknown;\n  };\n}\n\n/** The refusal a caller sees rather than a silent call to the wrong schema. */\nfunction refuse(code: string, message: string, hint: string): { data: null; error: PgError } {\n  return { data: null, error: { code, message, hint, details: \"\" } as unknown as PgError };\n}\n\n/**\n * Bind a supabase-js client (or anything with the same `schema(name).rpc()`\n * shape) as this package's data seam.\n *\n * Two things never happen here, both of them loudly:\n *\n *  - A call with NO schema is never sent. It is refused by name, because\n *    sending it would reach `public` and get the store's PGRST202 several\n *    layers away from the mistake.\n *  - A client with no `.schema()` is never used. supabase-js has had it since\n *    v2.0; a host that binds something else is told exactly what is missing\n *    instead of throwing `undefined is not a function` inside a render.\n */\nexport function supabaseDataSource(client: object): RecordsDataSource {\n  if (isBound(client)) return client;\n  const supabase = client as unknown as Partial<SupabaseLike>;\n  const hasSchema = typeof supabase.schema === \"function\";\n\n  const bound: RecordsDataSource = {\n    // PAGE-BUNDLE: the real adapter opens a table page with one `custom.table_page_bundle` call.\n    opensInOneCall: true,\n    rpc(fn, args, options) {\n      if (!hasSchema) {\n        return Promise.resolve(\n          refuse(\n            \"data_source_unbound\",\n            `The records client was given something that is not a supabase client: it has no schema() ` +\n              `method, so the door ${fn} cannot be called in the schema it lives in.`,\n            \"Pass a supabase-js v2 client (createClient(...)) to supabaseDataSource().\",\n          ),\n        );\n      }\n      const name = options?.schema;\n      if (!name) {\n        return Promise.resolve(\n          refuse(\n            \"schema_unsaid\",\n            `The door ${fn} was called without saying which schema it lives in. ` +\n              `Every door of this store is custom.${fn} and every trust door is iam.${fn}; ` +\n              `an unqualified call reaches PostgREST's default profile (public) and is refused there.`,\n            \"This is a bug in the caller, not in your data: /core says the schema on every call.\",\n          ),\n        );\n      }\n      return (supabase as SupabaseLike).schema(name).rpc(fn, args) as ReturnType<\n        RecordsDataSource[\"rpc\"]\n      >;\n    },\n    schema(name) {\n      return (supabase as SupabaseLike).schema(name) as ReturnType<RecordsDataSource[\"schema\"]>;\n    },\n  };\n  Object.defineProperty(bound, BOUND, { value: true, enumerable: false });\n  return bound;\n}\n\n/** Marks a data source this adapter made, so binding it twice is a no-op, never a double wrap. */\nconst BOUND = Symbol.for(\"@ai-matrx/records/supabaseDataSource\");\n\nfunction isBound(source: object): source is RecordsDataSource {\n  return (source as Record<symbol, unknown>)[BOUND] === true;\n}\n\n/**\n * WHAT `createRecordsClient` DOES WITH WHATEVER IT IS HANDED (lane PLATFORM-APP-DATA, 2026-10-02).\n *\n * The README has always shown `dataSource: supabase` — a PLAIN supabase-js client — and that\n * exact line answered every call \"Could not find the function public.table_kernel_id\" (PGRST202),\n * because supabase-js's own `rpc()` drops the `{ schema }` option in silence (see the header).\n * Measured on the clone as admin@admin.com, 2026-10-02. The example is now true:\n *\n *  - Already bound by `supabaseDataSource` → used as it is.\n *  - A supabase-js client (it has `schema()`, `from()` and an `auth` client) → bound here, once.\n *  - Nothing callable at all (no `rpc()`) → bound here too, so every call is REFUSED by name with\n *    the remedy (`data_source_unbound`) instead of throwing `rpc is not a function` in a render.\n *  - Anything else that has its own `rpc(fn, args, { schema })` — a host's adapter, a test\n *    double — is the host's own data seam and is used as it is: it promised to honour `schema`.\n */\nexport function asRecordsDataSource(source: unknown): RecordsDataSource {\n  if (source === null || typeof source !== \"object\") return supabaseDataSource({});\n  if (isBound(source)) return source;\n  const candidate = source as Partial<SupabaseLike> & { rpc?: unknown; from?: unknown; auth?: unknown };\n  const looksLikeSupabaseJs =\n    typeof candidate.schema === \"function\" &&\n    typeof candidate.from === \"function\" &&\n    candidate.auth !== null &&\n    typeof candidate.auth === \"object\";\n  if (looksLikeSupabaseJs || typeof candidate.rpc !== \"function\") return supabaseDataSource(source);\n  return source as RecordsDataSource;\n}\n","// src/core/pgError.ts — @ai-matrx/records\n//\n// THE ONE FUNNEL from what the database said to what a caller reads. Every\n// method in this package's client goes through it, and it does exactly three\n// things: it classifies the SQLSTATE, it carries the store's message and hint\n// VERBATIM, and it parses the DETAIL when the store put json there.\n//\n// It never writes a sentence of its own about a refusal the store already\n// explained. The store's messages were written to be read by the person who hit\n// them — \"Someone else changed this record while you were working on it\" is the\n// screen's text, not a code the screen has to translate.\n\nimport type { PgError, RecordsError, RecordsErrorCode, StaleWriteDetail } from \"../results\";\n\n/**\n * SQLSTATE -> code. Every entry here answers one of the codes\n * `STORE_REFUSAL_CODES` reports the store raising; the real-door suite asserts\n * that this map covers all of them, so a new refusal class in the store shows\n * up as a red test rather than an `internal` in somebody's console.\n */\nconst BY_SQLSTATE: Record<string, RecordsErrorCode> = {\n  PT409: \"stale_write\",\n  \"42501\": \"door\",\n  \"23514\": \"refused_by_rule\",\n  \"22004\": \"invalid_argument\",\n  \"22023\": \"invalid_argument\",\n  // MX005 — a value the store cannot take as asked: since 2026-10-06 (AP-3 U3) a word that names more than one\n  // choice or linked record raises it (it used to borrow PT409 and read as somebody else's write winning).\n  MX005: \"invalid_argument\",\n  // MXD01 — the held-change door tried the proposed values before filing an\n  // approval request and the store refused them. Nothing is waiting for a\n  // person to decide; correct the value before asking again, which is the same\n  // caller-side condition as the other invalid-argument refusals.\n  MXD01: \"invalid_argument\",\n  // 22P02 — a value does not fit the type the store holds for it. The class is\n  // real and was hit live: an organization whose copy of a package table grew\n  // `status` as a uuid-valued Field was sent the text \"open\", and the store\n  // answered `invalid input syntax for type uuid: \"open\"`. It is the CALL that\n  // is wrong for the shape the store holds, which is what `invalid_argument`\n  // already means — the store's own sentence names the value and the type.\n  \"22P02\": \"invalid_argument\",\n  // 42703 — a column that is not there. The store raises it from\n  // `custom.entity_table`, which is asked for a column by NAME, so the class is\n  // exactly \"the call named something the shape does not have\": the same thing\n  // `invalid_argument` already means, and the store's own sentence names the\n  // column. Added 2026-09-20 (lane FORMS) because the package's live-door suite\n  // caught it raised by a door this package did not know about — which is the\n  // suite working, and is why the map is a census rather than a guess.\n  \"42703\": \"invalid_argument\",\n  // 22007 — a date or a time the store could not read as one. It is raised by\n  // `custom.dashboard_window_sql`, which is handed a window a caller wrote\n  // (\"last 30 days\", a literal date), so the class is again \"the call named\n  // something the shape does not accept\" and the store's own sentence names the\n  // text it could not read. Added 2026-09-20 (lane SCREEN-BREAK) after the\n  // live-door census caught it — the same way 42703 arrived, which is the\n  // census working rather than a guess.\n  \"22007\": \"invalid_argument\",\n  // 22003 — a number the store could not hold at the size it was handed. It is\n  // raised by `custom.context_resolve`, which is given a window or a depth a\n  // caller wrote, so the class is the same one 22P02, 42703 and 22007 already\n  // are: the CALL named a value the shape does not accept, and the store's own\n  // sentence names the number and the range. Added 2026-09-20 (lane GRID-TWO)\n  // when the live-door census caught the release gate red on it — which is the\n  // census working, and the fourth time it has been the thing that found a new\n  // refusal class rather than a person guessing one.\n  \"22003\": \"invalid_argument\",\n  // 42883 — `custom._template_call` (the template family, 2026-10-03) was handed a step that\n  // names a door the store does not have, or an argument that door does not take. The TEMPLATE\n  // named something the shape does not have — the same class 42703 is — and the store's own\n  // sentence names the door or the argument. Caught by the live-door census on records 0.68.1's\n  // tag, the eighth time the census found a class before a person did. (A bare 42883 on a door\n  // this package itself asks for is still `door_absent`, mapped before this funnel in\n  // `owedDoor`.)\n  \"42883\": \"invalid_argument\",\n  \"02000\": \"not_found\",\n  // P0002 — `custom.inbox_snooze` / `custom.inbox_clear` (lane S5-PRIME-2, 2026-09-24): \"There is\n  // nothing in your inbox with that id\". An invented id, another person's item and another\n  // organization's all answer it alike, so it reads exactly as 02000 does: not found.\n  \"P0002\": \"not_found\",\n  \"23503\": \"missing_reference\",\n  \"23505\": \"already_exists\",\n  \"0A000\": \"not_supported\",\n  \"53400\": \"store_limit\",\n  \"22012\": \"store_limit\",\n  // 54001 — `custom.record_delete` stops a cascade that nests past sixty-four\n  // levels of containment, because that is a loop somebody built rather than a\n  // hierarchy, and saying so beats recursing until the server runs out of\n  // stack. It is a LIMIT of the store, and the store's own sentence names what\n  // to do about it, so it reads as one.\n  \"54001\": \"store_limit\",\n  // 54000 — the grid primitives' organization ceilings (GRID-PRIMITIVES, 2026-09-23):\n  // `custom.action_run` on a selection past its knob, `custom.table_decorate` past the\n  // rule count, `custom.table_from_example` past `custom/example_rows_max`,\n  // `custom.table_webhook_declare` past `custom/table_webhooks_max`, and\n  // `custom.hub_changed_by`. Each names its knob in the hint and writes nothing, so it\n  // reads exactly like 54001: a limit of the store, in the store's own sentence.\n  \"54000\": \"store_limit\",\n  // VIS: `custom.has_visibility_at` refuses to answer from a snapshot older\n  // than a write this reader has already seen, rather than returning something\n  // they just lost access to. It is retryable on a fresher connection, which is\n  // a different instruction from every other refusal here.\n  // 55000 — `custom.table_move` (SC-1', 2026-09-24) refuses a move the table's present state\n  // does not allow: a destination that cannot take it, a table something else holds, contents\n  // that point at themselves in a circle. The store's own sentence names the reason and nothing\n  // moves, so it reads as a refusal on the merits. Caught by the live-door census on records\n  // 0.58.3's tag, the seventh time the census found a class before a person did.\n  \"55000\": \"refused_by_rule\",\n  // 42P17 — a worked-out column that would read itself round a circle (STORE-TAILS-3,\n  // 2026-09-25): `custom._field_reads_what_it_reads` refuses the declaration or edit that would\n  // close the circle, naming every column in it, and `custom.far_value` refuses a circle stored\n  // before that rule when a lookup or rollup is worked out. Refused on its merits, in the store's\n  // own sentence, nothing written — so it reads as 55000 does.\n  \"42P17\": \"refused_by_rule\",\n  // P0001 — `custom.context_scope_write` (2026-10-03) refuses a scope whose parent breaks the\n  // parent rule in the old trigger's own class and words (manager ruling H6). Refused on its\n  // merits, nothing written. Caught by the live-door census on records 0.65.0's tag.\n  P0001: \"refused_by_rule\",\n  \"40001\": \"stale_read\",\n  // 57014 — the store cancelled the statement at its own timeout. Like\n  // `stale_read` and unlike every other refusal here, the call was never\n  // refused on its merits: the same call on a smaller page, or once the\n  // organization's kernel is not being rewritten, can succeed. It gets its own\n  // code so a screen can offer \"try again\" honestly instead of showing a\n  // failure sentence the caller cannot act on.\n  \"57014\": \"timed_out\",\n  // PostgREST's own two: the store is not being SERVED, which is a different\n  // thing from the store refusing. `custom` absent from `pgrst.db_schemas`, or\n  // the grants not copied, land here.\n  PGRST202: \"store_not_served\",\n  PGRST205: \"store_not_served\",\n  PGRST301: \"door\",\n  // PT428 — NOT A FAILURE, and the release gate's live census is what found it\n  // missing: the store raises it and this package answered `internal`, which is\n  // the one classification that tells a screen nothing. A stage gate whose\n  // `on_fail` is `require_approval` files the request and leaves the record\n  // where it was; the transaction is rolled back to the pipeline's own block, so\n  // \"nothing was written\" is a fact rather than a promise. Landed by lane\n  // STAGE-RULES; mapped here by STAGE-RULES-2 the day after, when the census\n  // caught it — the sixth time that census has been the thing that found a\n  // refusal class rather than a person guessing one.\n  PT428: \"needs_approval\",\n};\n\n/** The SQLSTATEs this package claims to understand. Exported for the guard. */\nexport const MAPPED_SQLSTATES = Object.keys(BY_SQLSTATE);\n\nfunction parseDetail(details: string | null | undefined): unknown {\n  if (!details) return undefined;\n  const trimmed = details.trim();\n  if (!trimmed.startsWith(\"{\") && !trimmed.startsWith(\"[\")) return details;\n  try {\n    return JSON.parse(trimmed) as unknown;\n  } catch {\n    return details;\n  }\n}\n\n/**\n * A CODE THAT IS NOT A SQLSTATE AT ALL — so it is not read as one.\n *\n * A SQLSTATE is five characters. supabase-js puts something else in `code` in\n * exactly two situations, and BOTH of them mean the call never reached the\n * store rather than the store refusing it:\n *\n *   `\"\"`        a `FetchError` — no network, a cancelled request, CORS.\n *   `\"404\"`…    an HTTP status, when the gateway answered with no JSON body.\n *\n * Lane TAILS-6 (2026-09-22) found both landing in `internal`, which is the one\n * classification that tells a screen nothing: a person on the Checklists tab of\n * a plumbing company's jobs table was shown \"Something went wrong at our end\"\n * with nothing to do about it, over a sentence naming this package. They are\n * `unreachable`, which a screen can honestly offer \"try again\" for.\n */\nfunction isNotASqlstate(code: string | undefined): boolean {\n  if (!code) return true;\n  return /^[0-9]{3}$/.test(code);\n}\n\n/** Map a PostgREST/supabase-js failure into the package's refusal shape. */\nexport function mapPgError(error: PgError, where: string): RecordsError {\n  // `code: \"\"` is supabase-js's own value for a transport failure, and `\"\"` is\n  // not nullish — so it has to be emptied deliberately or it becomes a SQLSTATE\n  // nobody can look up.\n  const raw = error.code ?? undefined;\n  const sqlstate = raw && raw !== \"\" ? raw : undefined;\n  const mapped: RecordsError = {\n    code: \"internal\",\n    message: error.message,\n    ...(error.hint ? { hint: error.hint } : {}),\n    ...(sqlstate ? { sqlstate } : {}),\n  };\n  if (isNotASqlstate(sqlstate)) {\n    mapped.code = \"unreachable\";\n  } else {\n    mapped.code = BY_SQLSTATE[sqlstate!] ?? \"internal\";\n  }\n  const detail = parseDetail(error.details);\n  if (detail !== undefined) mapped.detail = detail;\n  if (mapped.code === \"internal\") {\n    // 🚨 THE NOTE GOES IN ITS OWN FIELD, NEVER ONTO `hint` (lane TAILS-6).\n    // `hint` is THE REMEDY — the sentence screens hand a person to act on — so\n    // a note this package writes about ITSELF being surprised belonged nowhere\n    // near it. It is still said out loud, so nobody reads the silence as\n    // \"handled\"; it is said to whoever debugs this and to nobody else.\n    mapped.unmapped = true;\n    mapped.diagnostic =\n      `@ai-matrx/records did not recognise SQLSTATE ${sqlstate ?? \"(none)\"} from ${where}; ` +\n      `the store's own message is the thing to act on.`;\n  } else if (mapped.code === \"unreachable\") {\n    mapped.unmapped = true;\n    mapped.diagnostic =\n      `@ai-matrx/records never reached the store from ${where}: ` +\n      `${raw ? `the transport answered ${raw}` : \"no response\"} — ${error.message}`;\n    // 🚨 THE ONE PLACE THIS PACKAGE WRITES A MESSAGE OF ITS OWN, and it is the\n    // one place where there is no store message to carry: the store never\n    // answered. `TypeError: Failed to fetch` is the browser talking to itself,\n    // not a sentence anybody should read, so it goes to the engineer's line\n    // above and the person gets what actually happened.\n    mapped.message = \"We could not reach your data.\";\n    // Whatever the transport said was never a remedy either.\n    delete mapped.hint;\n  }\n  return mapped;\n}\n\n/** Pull the conflict out of a `stale_write`, when the store sent one. */\nexport function staleWriteDetail(error: RecordsError): StaleWriteDetail | null {\n  if (error.code !== \"stale_write\") return null;\n  const detail = error.detail as Partial<StaleWriteDetail> | undefined;\n  if (\n    !detail ||\n    typeof detail.expected_version !== \"number\" ||\n    typeof detail.current_version !== \"number\"\n  ) {\n    return null;\n  }\n  return {\n    expected_version: detail.expected_version,\n    current_version: detail.current_version,\n    contested_fields: detail.contested_fields ?? {},\n  };\n}\n\n/**\n * HONEST-REFUSALS 1 — a member of an ARCHIVED organization is refused with the store's own sentence\n * (\"This organization is archived, …\") and DETAIL `organization_archived:<organization id>`. The sentence\n * and the restore hint ride `message` and `hint` verbatim like every refusal; this reads the organization out\n * so a screen can offer \"Restore\" (the owner's `iam.organization_restore` door) instead of a dead end.\n * Null for every other refusal, including the non-member's \"You are not a member of that organization\".\n */\nexport function archivedOrganizationId(error: RecordsError): string | null {\n  if (error.code !== \"door\" || typeof error.detail !== \"string\") return null;\n  const m = /^organization_archived:([0-9a-f-]{36})$/i.exec(error.detail.trim());\n  return m ? m[1]! : null;\n}\n","// @ai-matrx/records/search — search across every table a person can see (moved from the website's\n// `features/unified-data/storeRecordCandidates.ts`, 2026-10-08; the body is the same, the client is\n// the host's data source instead of the website's).\n//\n// The store's own search door, `custom.records_search`, answers across EVERY organization the person\n// belongs to — the active organization is never passed (access-ladder: it is not a list filter) —\n// and names each record by its table's title field. Narrowing to tables or organizations is the\n// caller's visible choice (`tableIds`, `organizationIds`).\n//\n// The door costs ~200–450 ms, so a single typed character is not sent: a picker already waits for a\n// pause, and this answers a one-character search with nothing rather than a slow broad read.\n\nimport { asRecordsDataSource } from \"../core/supabase\";\nimport { mapPgError } from \"../core/pgError\";\nimport type { Uuid } from \"../record\";\nimport type { PgError, RecordsResult } from \"../results\";\n\nexport const STORE_RECORD_SEARCH_MIN_CHARS = 2;\n\n/** One record the search door found. */\nexport interface RecordSearchHit {\n  recordId: Uuid;\n  tableId: Uuid;\n  tableName: string;\n  /** The record's title-field value; null when the record has none yet. */\n  name: string | null;\n  organizationId: Uuid;\n  updatedAt: string;\n}\n\nexport interface RecordSearchRequest {\n  search?: string;\n  limit?: number;\n  offset?: number;\n  /** Only these tables (a visible filter the person chose). */\n  tableIds?: readonly Uuid[];\n  /** Only these organizations (a visible filter the person chose; never the active one by default). */\n  organizationIds?: readonly Uuid[];\n}\n\ninterface SearchRow {\n  record_id: Uuid;\n  table_id: Uuid;\n  table_name: string;\n  name: string | null;\n  organization_id: Uuid;\n  updated_at: string;\n}\n\n/** Records across every table the person can see whose name matches `search`. */\nexport async function searchRecords(dataSource: unknown, request: RecordSearchRequest = {}): Promise<RecordsResult<RecordSearchHit[]>> {\n  const search = request.search?.trim() ?? \"\";\n  if (search.length > 0 && search.length < STORE_RECORD_SEARCH_MIN_CHARS) return { ok: true, data: [] };\n  const args: Record<string, unknown> = { p_search: search, p_limit: request.limit ?? 25, p_offset: request.offset ?? 0 };\n  if (request.tableIds && request.tableIds.length > 0) args[\"p_table_ids\"] = [...request.tableIds];\n  if (request.organizationIds && request.organizationIds.length > 0) args[\"p_organization_ids\"] = [...request.organizationIds];\n  try {\n    const answer = await asRecordsDataSource(dataSource).rpc(\"records_search\", args, { schema: \"custom\" });\n    if (answer.error) return { ok: false, error: mapPgError(answer.error as PgError, \"custom.records_search\") };\n    const rows = (answer.data ?? []) as SearchRow[];\n    return {\n      ok: true,\n      data: rows.map((row) => ({\n        recordId: row.record_id,\n        tableId: row.table_id,\n        tableName: row.table_name,\n        name: row.name,\n        organizationId: row.organization_id,\n        updatedAt: row.updated_at,\n      })),\n    };\n  } catch (thrown) {\n    return { ok: false, error: mapPgError({ code: \"\", message: thrown instanceof Error ? thrown.message : String(thrown) } as PgError, \"custom.records_search\") };\n  }\n}\n\n/**\n * Candidates for the `record` entity token in a record picker (\"Link a record…\"). Two tables often\n * hold a record of the same name (\"UnitedHealthcare\" in two choice lists), so each candidate says\n * which table it is in; the same words label the link.\n */\nexport async function listStoreRecordCandidates(\n  dataSource: unknown,\n  args: { search?: string; limit?: number },\n): Promise<{ ok: true; data: { id: string; title: string }[] } | { ok: false; error: string }> {\n  const found = await searchRecords(dataSource, { ...(args.search !== undefined ? { search: args.search } : {}), limit: args.limit ?? 25 });\n  if (!found.ok) {\n    console.error(\"[listStoreRecordCandidates] failed\", found.error);\n    return { ok: false, error: found.error.message || \"Could not search records\" };\n  }\n  return { ok: true, data: found.data.map((hit) => ({ id: hit.recordId, title: hit.name ? `${hit.name} · ${hit.tableName}` : hit.tableName })) };\n}\n"],"mappings":";AAqDA,SAAS,OAAO,MAAc,SAAiB,MAA8C;AAC3F,SAAO,EAAE,MAAM,MAAM,OAAO,EAAE,MAAM,SAAS,MAAM,SAAS,GAAG,EAAwB;AACzF;AAeO,SAAS,mBAAmB,QAAmC;AACpE,MAAI,QAAQ,MAAM,EAAG,QAAO;AAC5B,QAAM,WAAW;AACjB,QAAM,YAAY,OAAO,SAAS,WAAW;AAE7C,QAAM,QAA2B;AAAA;AAAA,IAE/B,gBAAgB;AAAA,IAChB,IAAI,IAAI,MAAM,SAAS;AACrB,UAAI,CAAC,WAAW;AACd,eAAO,QAAQ;AAAA,UACb;AAAA,YACE;AAAA,YACA,gHACyB,EAAE;AAAA,YAC3B;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,OAAO,SAAS;AACtB,UAAI,CAAC,MAAM;AACT,eAAO,QAAQ;AAAA,UACb;AAAA,YACE;AAAA,YACA,YAAY,EAAE,2FAC0B,EAAE,gCAAgC,EAAE;AAAA,YAE5E;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,aAAQ,SAA0B,OAAO,IAAI,EAAE,IAAI,IAAI,IAAI;AAAA,IAG7D;AAAA,IACA,OAAO,MAAM;AACX,aAAQ,SAA0B,OAAO,IAAI;AAAA,IAC/C;AAAA,EACF;AACA,SAAO,eAAe,OAAO,OAAO,EAAE,OAAO,MAAM,YAAY,MAAM,CAAC;AACtE,SAAO;AACT;AAGA,IAAM,QAAQ,uBAAO,IAAI,sCAAsC;AAE/D,SAAS,QAAQ,QAA6C;AAC5D,SAAQ,OAAmC,KAAK,MAAM;AACxD;AAiBO,SAAS,oBAAoB,QAAoC;AACtE,MAAI,WAAW,QAAQ,OAAO,WAAW,SAAU,QAAO,mBAAmB,CAAC,CAAC;AAC/E,MAAI,QAAQ,MAAM,EAAG,QAAO;AAC5B,QAAM,YAAY;AAClB,QAAM,sBACJ,OAAO,UAAU,WAAW,cAC5B,OAAO,UAAU,SAAS,cAC1B,UAAU,SAAS,QACnB,OAAO,UAAU,SAAS;AAC5B,MAAI,uBAAuB,OAAO,UAAU,QAAQ,WAAY,QAAO,mBAAmB,MAAM;AAChG,SAAO;AACT;;;AC9HA,IAAM,cAAgD;AAAA,EACpD,OAAO;AAAA,EACP,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AAAA;AAAA;AAAA,EAGT,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAKP,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOP,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQT,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQT,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAST,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQT,SAAS;AAAA,EACT,SAAS;AAAA;AAAA;AAAA;AAAA,EAIT,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMT,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUT,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMT,SAAS;AAAA;AAAA;AAAA;AAAA,EAIT,OAAO;AAAA,EACP,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOT,SAAS;AAAA;AAAA;AAAA;AAAA,EAIT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUV,OAAO;AACT;AAGO,IAAM,mBAAmB,OAAO,KAAK,WAAW;AAEvD,SAAS,YAAY,SAA6C;AAChE,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,QAAQ,WAAW,GAAG,KAAK,CAAC,QAAQ,WAAW,GAAG,EAAG,QAAO;AACjE,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAkBA,SAAS,eAAe,MAAmC;AACzD,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,aAAa,KAAK,IAAI;AAC/B;AAGO,SAAS,WAAW,OAAgB,OAA6B;AAItE,QAAM,MAAM,MAAM,QAAQ;AAC1B,QAAM,WAAW,OAAO,QAAQ,KAAK,MAAM;AAC3C,QAAM,SAAuB;AAAA,IAC3B,MAAM;AAAA,IACN,SAAS,MAAM;AAAA,IACf,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,IACzC,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,EACjC;AACA,MAAI,eAAe,QAAQ,GAAG;AAC5B,WAAO,OAAO;AAAA,EAChB,OAAO;AACL,WAAO,OAAO,YAAY,QAAS,KAAK;AAAA,EAC1C;AACA,QAAM,SAAS,YAAY,MAAM,OAAO;AACxC,MAAI,WAAW,OAAW,QAAO,SAAS;AAC1C,MAAI,OAAO,SAAS,YAAY;AAM9B,WAAO,WAAW;AAClB,WAAO,aACL,gDAAgD,YAAY,QAAQ,SAAS,KAAK;AAAA,EAEtF,WAAW,OAAO,SAAS,eAAe;AACxC,WAAO,WAAW;AAClB,WAAO,aACL,kDAAkD,KAAK,KACpD,MAAM,0BAA0B,GAAG,KAAK,aAAa,WAAM,MAAM,OAAO;AAM7E,WAAO,UAAU;AAEjB,WAAO,OAAO;AAAA,EAChB;AACA,SAAO;AACT;;;AC9MO,IAAM,gCAAgC;AAiC7C,eAAsB,cAAc,YAAqB,UAA+B,CAAC,GAA8C;AACrI,QAAM,SAAS,QAAQ,QAAQ,KAAK,KAAK;AACzC,MAAI,OAAO,SAAS,KAAK,OAAO,SAAS,8BAA+B,QAAO,EAAE,IAAI,MAAM,MAAM,CAAC,EAAE;AACpG,QAAM,OAAgC,EAAE,UAAU,QAAQ,SAAS,QAAQ,SAAS,IAAI,UAAU,QAAQ,UAAU,EAAE;AACtH,MAAI,QAAQ,YAAY,QAAQ,SAAS,SAAS,EAAG,MAAK,aAAa,IAAI,CAAC,GAAG,QAAQ,QAAQ;AAC/F,MAAI,QAAQ,mBAAmB,QAAQ,gBAAgB,SAAS,EAAG,MAAK,oBAAoB,IAAI,CAAC,GAAG,QAAQ,eAAe;AAC3H,MAAI;AACF,UAAM,SAAS,MAAM,oBAAoB,UAAU,EAAE,IAAI,kBAAkB,MAAM,EAAE,QAAQ,SAAS,CAAC;AACrG,QAAI,OAAO,MAAO,QAAO,EAAE,IAAI,OAAO,OAAO,WAAW,OAAO,OAAkB,uBAAuB,EAAE;AAC1G,UAAM,OAAQ,OAAO,QAAQ,CAAC;AAC9B,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM,KAAK,IAAI,CAAC,SAAS;AAAA,QACvB,UAAU,IAAI;AAAA,QACd,SAAS,IAAI;AAAA,QACb,WAAW,IAAI;AAAA,QACf,MAAM,IAAI;AAAA,QACV,gBAAgB,IAAI;AAAA,QACpB,WAAW,IAAI;AAAA,MACjB,EAAE;AAAA,IACJ;AAAA,EACF,SAAS,QAAQ;AACf,WAAO,EAAE,IAAI,OAAO,OAAO,WAAW,EAAE,MAAM,IAAI,SAAS,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM,EAAE,GAAc,uBAAuB,EAAE;AAAA,EAC9J;AACF;AAOA,eAAsB,0BACpB,YACA,MAC6F;AAC7F,QAAM,QAAQ,MAAM,cAAc,YAAY,EAAE,GAAI,KAAK,WAAW,SAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAI,OAAO,KAAK,SAAS,GAAG,CAAC;AACxI,MAAI,CAAC,MAAM,IAAI;AACb,YAAQ,MAAM,sCAAsC,MAAM,KAAK;AAC/D,WAAO,EAAE,IAAI,OAAO,OAAO,MAAM,MAAM,WAAW,2BAA2B;AAAA,EAC/E;AACA,SAAO,EAAE,IAAI,MAAM,MAAM,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,UAAU,OAAO,IAAI,OAAO,GAAG,IAAI,IAAI,SAAM,IAAI,SAAS,KAAK,IAAI,UAAU,EAAE,EAAE;AAC/I;","names":[]}