@ai-matrx/records 0.92.2 → 0.93.0

package/dist/memory/index.d.cts

@@ -1,10 +1,10 @@
-import { c as RecordsDataSource, a as RecordsConfig } from '../ports-s0D2jvqn.cjs';
-import { T as TemplateSpec } from '../types-D8qdG3Lg.cjs';
-import { P as PgError } from '../record-BwCf9wKW.cjs';
-import '../subscription-CdoI-UaB.cjs';
-import '../rule-wHI5B0Ka.cjs';
-import '../types-DAFP6XFe.cjs';
-import '../field-CCY1rG9l.cjs';
+import { d as RecordsDataSource, a as RecordsConfig } from '../ports-9BQ3zo2y.cjs';
+import { T as TemplateSpec } from '../types-DsgXrESm.cjs';
+import { P as PgError } from '../record-DmmeuUrC.cjs';
+import '../field-6rwt4ejZ.cjs';
+import '../subscription-Drbxn-9Z.cjs';
+import '../rule-CeHg1sy1.cjs';
+import '../types-CBmUdBT0.cjs';
 
 type Json$1 = Record<string, unknown>;
 /** One presented column, exactly as `platform.drill_describe(...).api.columns[]` says it. */

package/dist/memory/index.d.ts

@@ -1,10 +1,10 @@
-import { c as RecordsDataSource, a as RecordsConfig } from '../ports-BeOgjwYl.js';
-import { T as TemplateSpec } from '../types-DYzXhD7j.js';
-import { P as PgError } from '../record-BwCf9wKW.js';
-import '../subscription-BynsG1K6.js';
-import '../rule-D9yNiorf.js';
-import '../types-BvL_oKFl.js';
-import '../field-enufS5ry.js';
+import { d as RecordsDataSource, a as RecordsConfig } from '../ports-DYWE1ENo.js';
+import { T as TemplateSpec } from '../types-hrw-Eff1.js';
+import { P as PgError } from '../record-DmmeuUrC.js';
+import '../field-B-WaVZnS.js';
+import '../subscription-hdTaRrfK.js';
+import '../rule-tN2lxvJ1.js';
+import '../types-BauAeFW8.js';
 
 type Json$1 = Record<string, unknown>;
 /** One presented column, exactly as `platform.drill_describe(...).api.columns[]` says it. */

package/dist/objectOrganization-BII_K3Gm.d.ts

@@ -0,0 +1,45 @@
+import { d as RecordsDataSource } from './ports-DYWE1ENo.js';
+
+/** What kind of object the id is, as `custom.where_id_opens` names it — carried as the door's own word. */
+type ObjectKind = string;
+type ObjectOrganizationAnswer = 
+/** The store named the object's organization, and the person may open the object. */
+{
+    state: "found";
+    organizationId: string;
+    kind: ObjectKind;
+    /** The screen the store says opens it (`/data/<table>?record=…`), or null for a part with none. */
+    path: string | null;
+    /** False when it is in the trash — the person may still open it, to bring it back. */
+    live: boolean;
+    /** The id it answers as — a merged record's survivor. */
+    resolvedId: string;
+}
+/** Not given to this person — or not there at all. The store does not say which, on purpose. */
+ | {
+    state: "not-given";
+}
+/** We could not ask. NOT an answer about the person's access. */
+ | {
+    state: "unavailable";
+    why: string;
+};
+/** Which organization owns an object — the port `createRecords({ organizationOf })` accepts. */
+interface RecordOrganizationPort {
+    organizationOf(id: string): Promise<ObjectOrganizationAnswer>;
+}
+declare const WHERE_ID_OPENS_DOOR = "where_id_opens";
+/** Ask the store which organization `id` lives in — the one call an object page makes before any other door. */
+declare function resolveObjectOrganization(dataSource: Pick<RecordsDataSource, "rpc">, id: string): Promise<ObjectOrganizationAnswer>;
+/** Read one `custom.where_id_opens` answer — asked here, or asked by a server render as the same person. */
+declare function readObjectOrganizationAnswer(answered: {
+    data: unknown;
+    error: {
+        code?: string | null;
+        message?: string | null;
+    } | null;
+}, id: string): ObjectOrganizationAnswer;
+/** The default port: one `custom.where_id_opens` call per ask, nothing kept. */
+declare function whereIdOpensPort(dataSource: Pick<RecordsDataSource, "rpc">): RecordOrganizationPort;
+
+export { type ObjectOrganizationAnswer as O, type RecordOrganizationPort as R, WHERE_ID_OPENS_DOOR as W, type ObjectKind as a, resolveObjectOrganization as b, readObjectOrganizationAnswer as r, whereIdOpensPort as w };

package/dist/objectOrganization-DfjDQtDb.d.cts

@@ -0,0 +1,45 @@
+import { d as RecordsDataSource } from './ports-9BQ3zo2y.cjs';
+
+/** What kind of object the id is, as `custom.where_id_opens` names it — carried as the door's own word. */
+type ObjectKind = string;
+type ObjectOrganizationAnswer = 
+/** The store named the object's organization, and the person may open the object. */
+{
+    state: "found";
+    organizationId: string;
+    kind: ObjectKind;
+    /** The screen the store says opens it (`/data/<table>?record=…`), or null for a part with none. */
+    path: string | null;
+    /** False when it is in the trash — the person may still open it, to bring it back. */
+    live: boolean;
+    /** The id it answers as — a merged record's survivor. */
+    resolvedId: string;
+}
+/** Not given to this person — or not there at all. The store does not say which, on purpose. */
+ | {
+    state: "not-given";
+}
+/** We could not ask. NOT an answer about the person's access. */
+ | {
+    state: "unavailable";
+    why: string;
+};
+/** Which organization owns an object — the port `createRecords({ organizationOf })` accepts. */
+interface RecordOrganizationPort {
+    organizationOf(id: string): Promise<ObjectOrganizationAnswer>;
+}
+declare const WHERE_ID_OPENS_DOOR = "where_id_opens";
+/** Ask the store which organization `id` lives in — the one call an object page makes before any other door. */
+declare function resolveObjectOrganization(dataSource: Pick<RecordsDataSource, "rpc">, id: string): Promise<ObjectOrganizationAnswer>;
+/** Read one `custom.where_id_opens` answer — asked here, or asked by a server render as the same person. */
+declare function readObjectOrganizationAnswer(answered: {
+    data: unknown;
+    error: {
+        code?: string | null;
+        message?: string | null;
+    } | null;
+}, id: string): ObjectOrganizationAnswer;
+/** The default port: one `custom.where_id_opens` call per ask, nothing kept. */
+declare function whereIdOpensPort(dataSource: Pick<RecordsDataSource, "rpc">): RecordOrganizationPort;
+
+export { type ObjectOrganizationAnswer as O, type RecordOrganizationPort as R, WHERE_ID_OPENS_DOOR as W, type ObjectKind as a, resolveObjectOrganization as b, readObjectOrganizationAnswer as r, whereIdOpensPort as w };

package/dist/{port-C54ykAOv.d.ts → port--acgmxh5.d.ts}

@@ -1,5 +1,6 @@
-import { L as Lane, H as HostDataPort, V as Values } from './types-cpKY7Pjb.js';
-import { U as Uuid, R as RecordsResult } from './record-BwCf9wKW.js';
+import { L as Lane, H as HostDataPort, V as Values } from './types-HVgWcZDY.js';
+import { U as Uuid, R as RecordsResult } from './record-DmmeuUrC.js';
+import { O as OpLedger } from './ports-DYWE1ENo.js';
 import * as _ai_matrx_realtime from '@ai-matrx/realtime';
 import { RealtimeManager, ChannelSpec } from '@ai-matrx/realtime';
 
@@ -272,6 +273,8 @@ interface CreateEntityDataPortOptions {
     organization?: Uuid | null;
     /** The host's live-notice layer (`createEntityRealtime`). Left out, lists are as fresh as their last read. */
     realtime?: EntityRealtime;
+    /** This port's own-write memory (`createOpLedger()`); absent ⇒ the realm's default ledger. */
+    opLedger?: OpLedger;
 }
 /** A value as rows carry it → as the write doors take it: a link (`EntityRef[]` or one ref) becomes its id. */
 declare function toWireValue(value: unknown): unknown;

package/dist/{port-Drioh9al.d.cts → port-Cx76dq-X.d.cts}

@@ -1,5 +1,6 @@
-import { L as Lane, H as HostDataPort, V as Values } from './types-BKYEeFt4.cjs';
-import { U as Uuid, R as RecordsResult } from './record-BwCf9wKW.cjs';
+import { L as Lane, H as HostDataPort, V as Values } from './types-Dek9owBe.cjs';
+import { U as Uuid, R as RecordsResult } from './record-DmmeuUrC.cjs';
+import { O as OpLedger } from './ports-9BQ3zo2y.cjs';
 import * as _ai_matrx_realtime from '@ai-matrx/realtime';
 import { RealtimeManager, ChannelSpec } from '@ai-matrx/realtime';
 
@@ -272,6 +273,8 @@ interface CreateEntityDataPortOptions {
     organization?: Uuid | null;
     /** The host's live-notice layer (`createEntityRealtime`). Left out, lists are as fresh as their last read. */
     realtime?: EntityRealtime;
+    /** This port's own-write memory (`createOpLedger()`); absent ⇒ the realm's default ledger. */
+    opLedger?: OpLedger;
 }
 /** A value as rows carry it → as the write doors take it: a link (`EntityRef[]` or one ref) becomes its id. */
 declare function toWireValue(value: unknown): unknown;

package/dist/{portal-DRdmZ-xv.d.cts → portal-9sRr6cpG.d.cts}

@@ -1,4 +1,4 @@
-import { U as Uuid, T as Timestamp } from './record-BwCf9wKW.cjs';
+import { U as Uuid, h as Timestamp } from './record-DmmeuUrC.cjs';
 
 /** One portal as `custom.portals` reports it to its organization. */
 interface PortalSummary {

package/dist/{portal-or_f7BkT.d.ts → portal-BDAqsGkg.d.ts}

@@ -1,4 +1,4 @@
-import { U as Uuid, T as Timestamp } from './record-BwCf9wKW.js';
+import { U as Uuid, h as Timestamp } from './record-DmmeuUrC.js';
 
 /** One portal as `custom.portals` reports it to its organization. */
 interface PortalSummary {

package/dist/{ports-s0D2jvqn.d.cts → ports-9BQ3zo2y.d.cts}

@@ -1,4 +1,80 @@
-import { A as Actor, U as Uuid, P as PgError } from './record-BwCf9wKW.cjs';
+import { b as Field } from './field-6rwt4ejZ.cjs';
+import { U as Uuid, A as Actor, P as PgError, l as RecordDocument } from './record-DmmeuUrC.cjs';
+
+/** `public.permission_level`, in the store's own order. */
+/**
+ * `edit_content` (Notion's "Can edit content") sits between `commenter` and `editor`: it may change
+ * the rows and page content of a thing, never its structure (columns, views, settings) or its
+ * sharing — those stay with `editor` and `admin`.
+ */
+type PermissionLevel = "viewer" | "commenter" | "edit_content" | "editor" | "admin";
+/** The order the store writes them in, lowest first. */
+declare const PERMISSION_LEVELS: readonly PermissionLevel[];
+/** Whether `held` is the same rung as `needed` or a higher one. Nothing held is never enough. */
+declare function atLeast(held: PermissionLevel | null | undefined, needed: PermissionLevel): boolean;
+/** A level word the store sent, or null when it sent something this package does not know. */
+declare function asPermissionLevel(word: unknown): PermissionLevel | null;
+/** The higher of two levels — what a person holds when two ways in both let them through. */
+declare function highestLevel(left: PermissionLevel | null | undefined, right: PermissionLevel | null | undefined): PermissionLevel | null;
+/**
+ * What one subject's level is, as `custom.my_levels` answers it. `null` is an
+ * ANSWER — "you hold nothing on this" — and never a missing row: a screen that
+ * could not tell "no access" from "not asked yet" would draw one of them as the
+ * other.
+ */
+interface MyLevel {
+    id: string;
+    level: PermissionLevel | null;
+}
+
+/**
+ * One client's memory of its own operations. `mint()` names a write and remembers it; `isOwn(opId)`
+ * answers whether a notice is that write's echo.
+ *
+ * OWN-WRITE DETECTION IS PER CLIENT INSTANCE. Two setups in ONE process (a server holding two
+ * identities, a worker beside a UI) must hear each other: a realm-wide ledger made A's write "ours" to
+ * B as well, and B dropped it as an echo (2026-10-08, the README proof). `createRecords` gives every
+ * setup its own ledger and hands it to its client, its entity port and its live-changes port.
+ */
+interface OpLedger {
+    mint(): Uuid;
+    isOwn(opId: string | null | undefined): boolean;
+    /** Test seam: forget everything. */
+    clear(): void;
+    /** Test seam: how many operations are currently remembered. */
+    readonly size: number;
+}
+/** A ledger of one client's own: hand the SAME one to the client that writes and the port that listens. */
+declare function createOpLedger(): OpLedger;
+/**
+ * THE REALM'S DEFAULT LEDGER, IN A GLOBAL SLOT — for hosts that mount one client per realm (a browser
+ * tab) and never name a ledger. Every section of the built package (root, core, react, realtime, data,
+ * typed-table) carries its own copy of this module, and the ESM and CJS builds are two more graphs; a
+ * module-level Map split it so `records/core` minted in one and `records/realtime` checked another — own
+ * writes came back as strangers' changes (2026-10-08). Guarded on the packed tarball by
+ * scripts/check-shared-state.mjs.
+ */
+declare const defaultOpLedger: OpLedger;
+/**
+ * Mint the id for one client operation and remember it as ours (the realm's default ledger).
+ *
+ * ONE CALL IS ONE OPERATION. A fifty-row paste through `recordWriteMany` is ONE op id, because
+ * the store announces one statement once — and it REFUSES a batch carrying two different ones
+ * by name, for exactly that reason.
+ */
+declare function mintOpId(): Uuid;
+/**
+ * Is this notice the echo of a write this realm's default ledger made?
+ *
+ * `undefined`/`null` is NOT ours and never has been: a notice with no `op_id` came from a
+ * server-side write, an agent tool, another client, or a store older than this mechanism —
+ * all of which are changes this browser has not seen and must read.
+ */
+declare function isOwnOp(opId: string | null | undefined): boolean;
+/** Test seam: forget everything. Never called by product code. */
+declare function forgetAllOps(): void;
+/** Test seam: how many operations are currently remembered. */
+declare function rememberedOpCount(): number;
 
 /**
  * The data seam: a structural subset of `SupabaseClient`. The package never
@@ -173,6 +249,11 @@ interface RecordsConfig {
      */
     organizationIds?: readonly Uuid[];
     realtime?: RecordsRealtimePort;
+    /**
+     * This client's own-write memory (`createOpLedger()`). Hand the SAME ledger to the live-changes port
+     * that listens for this client. Absent ⇒ the realm's default ledger (one client per browser tab).
+     */
+    opLedger?: OpLedger;
     onError?: RecordsErrorSink;
     resolver?: RecordsResolverPort;
     /**
@@ -189,5 +270,30 @@ interface RecordsConfig {
      */
     knownDoors?: readonly string[];
 }
+/**
+ * RUN AN AGENT ON THIS ROW — a PORT (step 10, 2026-10-08). A table's agent button ("Draft follow-up") hands
+ * the row to an agent with the action's own prompt. The store ships no agent: the host binds the run (the
+ * agent run itself belongs to `@ai-matrx/agents`; the website starts it through the `data.row_action`
+ * mandate). Everything the run needs rides the target, read as THIS reader sees it — no second read.
+ */
+interface RowAgentTarget {
+    tableId: Uuid;
+    recordId: Uuid;
+    title: string;
+    action: string;
+    prompt: string;
+    /** The table's name, as the reader sees it. */
+    tableName: string;
+    /** The table's columns. */
+    fields: readonly Field[];
+    /** The row, masked for this reader. */
+    document: RecordDocument;
+    /** This reader's level on the row. */
+    level: PermissionLevel | null;
+}
+/** The host's agent runner — `createRecords({ rowAgent })`; records-ui's grid calls it for `kind: "agent"` actions. */
+interface RowAgentPort {
+    run(target: RowAgentTarget): void | Promise<void>;
+}
 
-export type { RecordsRealtimePort as R, RecordsConfig as a, RecordsErrorSink as b, RecordsDataSource as c, RecordsChangeSink as d, RecordsActor as e, RecordsFilter as f, RecordsResolverPort as g, RecordsResponse as h, RecordsTableQuery as i };
+export { type MyLevel as M, type OpLedger as O, PERMISSION_LEVELS as P, type RecordsRealtimePort as R, type RecordsConfig as a, type RowAgentPort as b, type RecordsErrorSink as c, type RecordsDataSource as d, type RecordsChangeSink as e, type RowAgentTarget as f, type PermissionLevel as g, type RecordsActor as h, type RecordsFilter as i, type RecordsResolverPort as j, type RecordsResponse as k, type RecordsTableQuery as l, asPermissionLevel as m, atLeast as n, createOpLedger as o, defaultOpLedger as p, forgetAllOps as q, highestLevel as r, isOwnOp as s, mintOpId as t, rememberedOpCount as u };

package/dist/{ports-BeOgjwYl.d.ts → ports-DYWE1ENo.d.ts}

@@ -1,4 +1,80 @@
-import { A as Actor, U as Uuid, P as PgError } from './record-BwCf9wKW.js';
+import { b as Field } from './field-B-WaVZnS.js';
+import { U as Uuid, A as Actor, P as PgError, l as RecordDocument } from './record-DmmeuUrC.js';
+
+/** `public.permission_level`, in the store's own order. */
+/**
+ * `edit_content` (Notion's "Can edit content") sits between `commenter` and `editor`: it may change
+ * the rows and page content of a thing, never its structure (columns, views, settings) or its
+ * sharing — those stay with `editor` and `admin`.
+ */
+type PermissionLevel = "viewer" | "commenter" | "edit_content" | "editor" | "admin";
+/** The order the store writes them in, lowest first. */
+declare const PERMISSION_LEVELS: readonly PermissionLevel[];
+/** Whether `held` is the same rung as `needed` or a higher one. Nothing held is never enough. */
+declare function atLeast(held: PermissionLevel | null | undefined, needed: PermissionLevel): boolean;
+/** A level word the store sent, or null when it sent something this package does not know. */
+declare function asPermissionLevel(word: unknown): PermissionLevel | null;
+/** The higher of two levels — what a person holds when two ways in both let them through. */
+declare function highestLevel(left: PermissionLevel | null | undefined, right: PermissionLevel | null | undefined): PermissionLevel | null;
+/**
+ * What one subject's level is, as `custom.my_levels` answers it. `null` is an
+ * ANSWER — "you hold nothing on this" — and never a missing row: a screen that
+ * could not tell "no access" from "not asked yet" would draw one of them as the
+ * other.
+ */
+interface MyLevel {
+    id: string;
+    level: PermissionLevel | null;
+}
+
+/**
+ * One client's memory of its own operations. `mint()` names a write and remembers it; `isOwn(opId)`
+ * answers whether a notice is that write's echo.
+ *
+ * OWN-WRITE DETECTION IS PER CLIENT INSTANCE. Two setups in ONE process (a server holding two
+ * identities, a worker beside a UI) must hear each other: a realm-wide ledger made A's write "ours" to
+ * B as well, and B dropped it as an echo (2026-10-08, the README proof). `createRecords` gives every
+ * setup its own ledger and hands it to its client, its entity port and its live-changes port.
+ */
+interface OpLedger {
+    mint(): Uuid;
+    isOwn(opId: string | null | undefined): boolean;
+    /** Test seam: forget everything. */
+    clear(): void;
+    /** Test seam: how many operations are currently remembered. */
+    readonly size: number;
+}
+/** A ledger of one client's own: hand the SAME one to the client that writes and the port that listens. */
+declare function createOpLedger(): OpLedger;
+/**
+ * THE REALM'S DEFAULT LEDGER, IN A GLOBAL SLOT — for hosts that mount one client per realm (a browser
+ * tab) and never name a ledger. Every section of the built package (root, core, react, realtime, data,
+ * typed-table) carries its own copy of this module, and the ESM and CJS builds are two more graphs; a
+ * module-level Map split it so `records/core` minted in one and `records/realtime` checked another — own
+ * writes came back as strangers' changes (2026-10-08). Guarded on the packed tarball by
+ * scripts/check-shared-state.mjs.
+ */
+declare const defaultOpLedger: OpLedger;
+/**
+ * Mint the id for one client operation and remember it as ours (the realm's default ledger).
+ *
+ * ONE CALL IS ONE OPERATION. A fifty-row paste through `recordWriteMany` is ONE op id, because
+ * the store announces one statement once — and it REFUSES a batch carrying two different ones
+ * by name, for exactly that reason.
+ */
+declare function mintOpId(): Uuid;
+/**
+ * Is this notice the echo of a write this realm's default ledger made?
+ *
+ * `undefined`/`null` is NOT ours and never has been: a notice with no `op_id` came from a
+ * server-side write, an agent tool, another client, or a store older than this mechanism —
+ * all of which are changes this browser has not seen and must read.
+ */
+declare function isOwnOp(opId: string | null | undefined): boolean;
+/** Test seam: forget everything. Never called by product code. */
+declare function forgetAllOps(): void;
+/** Test seam: how many operations are currently remembered. */
+declare function rememberedOpCount(): number;
 
 /**
  * The data seam: a structural subset of `SupabaseClient`. The package never
@@ -173,6 +249,11 @@ interface RecordsConfig {
      */
     organizationIds?: readonly Uuid[];
     realtime?: RecordsRealtimePort;
+    /**
+     * This client's own-write memory (`createOpLedger()`). Hand the SAME ledger to the live-changes port
+     * that listens for this client. Absent ⇒ the realm's default ledger (one client per browser tab).
+     */
+    opLedger?: OpLedger;
     onError?: RecordsErrorSink;
     resolver?: RecordsResolverPort;
     /**
@@ -189,5 +270,30 @@ interface RecordsConfig {
      */
     knownDoors?: readonly string[];
 }
+/**
+ * RUN AN AGENT ON THIS ROW — a PORT (step 10, 2026-10-08). A table's agent button ("Draft follow-up") hands
+ * the row to an agent with the action's own prompt. The store ships no agent: the host binds the run (the
+ * agent run itself belongs to `@ai-matrx/agents`; the website starts it through the `data.row_action`
+ * mandate). Everything the run needs rides the target, read as THIS reader sees it — no second read.
+ */
+interface RowAgentTarget {
+    tableId: Uuid;
+    recordId: Uuid;
+    title: string;
+    action: string;
+    prompt: string;
+    /** The table's name, as the reader sees it. */
+    tableName: string;
+    /** The table's columns. */
+    fields: readonly Field[];
+    /** The row, masked for this reader. */
+    document: RecordDocument;
+    /** This reader's level on the row. */
+    level: PermissionLevel | null;
+}
+/** The host's agent runner — `createRecords({ rowAgent })`; records-ui's grid calls it for `kind: "agent"` actions. */
+interface RowAgentPort {
+    run(target: RowAgentTarget): void | Promise<void>;
+}
 
-export type { RecordsRealtimePort as R, RecordsConfig as a, RecordsErrorSink as b, RecordsDataSource as c, RecordsChangeSink as d, RecordsActor as e, RecordsFilter as f, RecordsResolverPort as g, RecordsResponse as h, RecordsTableQuery as i };
+export { type MyLevel as M, type OpLedger as O, PERMISSION_LEVELS as P, type RecordsRealtimePort as R, type RecordsConfig as a, type RowAgentPort as b, type RecordsErrorSink as c, type RecordsDataSource as d, type RecordsChangeSink as e, type RowAgentTarget as f, type PermissionLevel as g, type RecordsActor as h, type RecordsFilter as i, type RecordsResolverPort as j, type RecordsResponse as k, type RecordsTableQuery as l, asPermissionLevel as m, atLeast as n, createOpLedger as o, defaultOpLedger as p, forgetAllOps as q, highestLevel as r, isOwnOp as s, mintOpId as t, rememberedOpCount as u };