@ai-matrx/records 0.98.7 → 0.98.9

package/dist/{table-kind-CboiMJuE.d.cts → client-9fzhCPD5.d.cts}

@@ -1,6 +1,11 @@
-import { U as Uuid, h as Timestamp, q as ReadRow, l as RecordDocument, T as TableType, b as TableDisplay, S as StorageMode, aw as TableOrigin, u as StoredRecord, y as ParityFieldType, a as RecordsError } from './record-CxGK1OEK.cjs';
-import { F as Field } from './field-DoVl2I9K.cjs';
-import { g as PermissionLevel } from './ports-YIh9jrCZ.cjs';
+import { U as Uuid, h as Timestamp, l as ReadRow, n as RecordDocument, T as TableType, b as TableDisplay, S as StorageMode, av as TableOrigin, ar as StoredRecord, p as ParityFieldType, a as RecordsError, m as RecordsErrorCode, R as RecordsResult, ad as RecordChange, ae as RecordChangeResult, af as RecordGraphWritten, ai as RecordRead, k as RecordPageSort, ah as RecordPage, ag as RecordKeysetPage, aj as RecordRevision, s as ReadValue, aD as WriteConflict } from './record-BrJNCmH1.cjs';
+import { B as StoreFilter, o as DashboardSummary, l as DashboardBlock, R as RecordFilter, e as AggregateCompare, A as AggregateBucket, n as DashboardRunResult, C as StuckRow, c as AggregateMeasure, j as AggregateRow, E as Subscription, M as MySubscription, G as SubscriptionSpec, u as DigestPreview, d as SavedViewRow, z as SavedViewSpecIn, v as RowTemplateRow } from './subscription-BEM4B4dR.cjs';
+import { f as RelationCoordinate, j as RelationWordsManyArgs, g as RelationIcons, k as ReverseColumn, o as ReverseLinksManyArgs, m as ReverseLinks, n as ReverseLinksFieldsArgs, S as SourceArchived } from './relation-R10qQyQU.cjs';
+import { F as Field, r as FieldPatch, N as NewFieldDeclaration, z as RelationNamesAnswer, o as FieldDuplicated, s as FieldProposal, T as TableProposal, h as ButtonPressed } from './field-BLy8drjM.cjs';
+import { s as ScopeDoors } from './doors-Dm5q9H8Y.cjs';
+import { F as FormSummary, b as BookingSummary, B as BookingAvailability, a as BookingDeclared, e as FormRoute, d as FormResults } from './rule-BGtYd6Pf.cjs';
+import { g as PermissionLevel, a as RecordsConfig, M as MyLevel } from './ports-BIdYUS-C.cjs';
+import { F as FormLookOptions, t as PortalSummary, d as PortalArchiveFilter, c as PortalArchiveAnswer, v as PortalTableRef, e as PortalCard, g as PortalConfigInput, l as PortalFormSpec, i as PortalFormAnswer, m as PortalInvitation, p as PortalRevocation, n as PortalPreviewRow } from './portal-C_LgvDeh.cjs';
 
 /**
  * THE TWO LANES THE ARCHIVED-ITEMS LAW NAMES (Arman, 2026-09-09) — the same
@@ -540,6 +545,36 @@ interface RecordsMerged {
     resolves_to?: string | null;
     at?: string;
 }
+/** `custom.migrate_split`'s answer. The original keeps its id; the moved values live on `new_record`. */
+interface RecordSplit {
+    verb: "split";
+    kept_the_id: string;
+    new_record: string;
+    migration_id: string;
+    moved: string[];
+    old_id_resolves_to?: string | null;
+    at?: string;
+}
+/** `custom.migrate_extract_parent`'s answer. The named values were COPIED up into `parent`, and the record now sits under it. */
+interface ParentExtracted {
+    verb: "extract_parent";
+    record_id: string;
+    parent: string;
+    was_under: string | null;
+    migration_id: string;
+    at?: string;
+}
+/** One row of `custom.migrations`: a recorded Migration on one target, and whether it was put back. */
+interface MigrationEntry {
+    id: string;
+    verb: string;
+    target_kind: string;
+    target_id: string;
+    note: string | null;
+    applied_at: string;
+    applied_by: string | null;
+    undone_at: string | null;
+}
 /** `custom.migrate_undo`'s answer: the Migration it put back. */
 interface MigrationUndone {
     undone: string;
@@ -549,6 +584,8 @@ interface MigrationUndone {
     version_after?: number | null;
     also_restored?: number;
     ids_unaliased?: number;
+    /** A split or an extracted parent: the record the Migration made, archived by the undo. */
+    removed?: string | null;
     at?: string;
 }
 /**
@@ -3844,4 +3881,2734 @@ declare function tableJsonSchema(facts: TableKindFacts, mode: TableSchemaMode):
  */
 declare function tableRenderSchema(facts: TableKindFacts): TableRenderSchema;
 
-export { type ImportRun as $, type ArchiveLane as A, type PipelineMoveResult as B, type ChoiceNudge as C, type PipelineMoveManyItem as D, type EntityTableFacts as E, type FieldDrift as F, type PipelineMoveMany as G, type PipelineSpec as H, type PipelineDeclared as I, type StageRuleEnforcement as J, type StagePending as K, type StagePendingOnBoard as L, type MigrationUndone as M, type NewEntityFieldDeclaration as N, type PipelineGate as O, type Pipeline as P, type PipelineGatePreview as Q, type RecordsMerged as R, type StageRuleOnFail as S, type TableArchiveProgress as T, type ImportPlan as U, type ImportPolicy as V, type ImportOpened as W, type ImportColumnsDeclared as X, type ImportBatchResult as Y, type ImportFinished as Z, type ImportReport as _, type TableRestoreProgress as a, type WorkApprovalDecision as a$, type InboundDeclared as a0, type InboundAddress as a1, type FormArchiveAnswer as a2, type ArchivedForm as a3, type ArchivedChecklistTemplate as a4, type TableRowDefaults as a5, type TableRowDefaultsPatch as a6, type RowDefaultsApplied as a7, type RecordRowControls as a8, type CaptureSheetSummary as a9, type CommentWritten as aA, type AnonTokenBinding as aB, type ChecklistSpec as aC, type ChecklistDeclared as aD, type ChecklistTemplateSummary as aE, type ChecklistTemplateShape as aF, type ChecklistRunStarted as aG, type ChecklistRunStep as aH, type ChecklistRunSummary as aI, type ChecklistStepCompleted as aJ, type WorkState as aK, type WorkGraph as aL, type WorkInstantiation as aM, type WorkTurn as aN, type WorkAssignmentField as aO, type WorkSlotHold as aP, type WorkInboxView as aQ, type WorkInboxItem as aR, type InboxStateChange as aS, type InboxCounts as aT, type WorkListFlavour as aU, type WorkListItem as aV, type WorkAssignment as aW, type WorkRecordState as aX, type WorkApprover as aY, type WorkChange as aZ, type WorkApprovalFiled as a_, type CaptureSheetFace as aa, type CaptureFileRef as ab, type CaptureOutcome as ac, type EnrichmentSummary as ad, type EnrichDeclared as ae, type EnrichDueRow as af, type EnrichCell as ag, type EnrichRun as ah, type DrillSource as ai, type DrillDefinition as aj, type DrillQuestion as ak, type DrillAnswer as al, type DrillRowsPage as am, type DocToken as an, type DocUnresolvedToken as ao, type DocTemplateRow as ap, type DocRenderRow as aq, type DocSignatureRow as ar, type RecordHistoryEntry as as, type RecordScopeContext as at, type ConversationScope as au, type ConversationScopeContext as av, type FieldHistoryEntry as aw, type RestorePreview as ax, type RestoreResult as ay, type CommentThreadRead as az, type TableDuplicateProgress as b, DRILL_DOORS as b$, type WorkDecideManyItem as b0, type WorkDecideMany as b1, type ExternalPrincipalCard as b2, type PublishBinding as b3, type ResolvedPublishBinding as b4, type ResolvedPublishBindingKind as b5, type DecorationPath as b6, type TableDecorations as b7, type GridLayout as b8, type FormulaParse as b9, type AutomationAction as bA, type AutomationFilter as bB, type AutomationItem as bC, type AutomationLastRun as bD, type AutomationRun as bE, type AutomationRunStatus as bF, type AutomationStep as bG, type AutomationTrigger as bH, type AutomationValue as bI, type AutomationValues as bJ, type AutomationWeekday as bK, BUILT_KIND_WORD as bL, CHOICE_NUDGES as bM, type CaptureField as bN, type CaptureQuestion as bO, type ChecklistRequirement as bP, type ChecklistRequirementKind as bQ, type ChecklistRoleSpec as bR, type ChecklistStepSpec as bS, type ChecklistTrigger as bT, type ChecklistTriggerKind as bU, type ChoiceLike as bV, type ChoiceOption as bW, type CustomFieldTableType as bX, DEFAULT_ARCHIVE_LANE as bY, DRILL_CHART_TOKENS as bZ, DRILL_DESCRIPTION_MAX as b_, type FormulaPreview as ba, type RowAction as bb, type ActionRunResult as bc, type AutomationSpec as bd, type AutomationDeclared as be, type AutomationList as bf, type AutomationFlipped as bg, type AutomationRuns as bh, type RecordEvent as bi, type TableWebhookDeclared as bj, type TableWebhook as bk, type IoExportPage as bl, type TableListEntry as bm, type DataHomeTable as bn, type AdminTable as bo, type TableSyncSpec as bp, type TableSyncResult as bq, type TableRowCount as br, type RecordHeader as bs, type OutsideShareAnswer as bt, type ViewOrderSet as bu, ARCHIVE_LANES as bv, ARCHIVE_LANE_LABEL as bw, ARCHIVE_LANE_MEANS as bx, type ActionRefusal as by, type ArchivedDoorRow as bz, type TableDuplicated as c, type ShownTo as c$, DRILL_SCHEMA as c0, type DecorationColor as c1, type DecorationRule as c2, type DecorationRuleOp as c3, type DecorationTarget as c4, type DocSignatureCheck as c5, type DrillAdHocOp as c6, type DrillAnswerRow as c7, type DrillChartToken as c8, type DrillDeclaration as c9, type ImportOutcome as cA, type ImportProposal as cB, PIPELINE_RULE_KINDS as cC, type PipelineMissingField as cD, type PipelineMoveManyResult as cE, type PipelineMoveVerdict as cF, type PipelineRule as cG, type PipelineRuleKind as cH, type PipelineStage as cI, type PublishBindingKind as cJ, ROW_WEB_NOT_READY as cK, type RecordChangeAction as cL, type RecordComment as cM, type RecordScopeComment as cN, type RecordScopeField as cO, type RecordScopeHistoryEntry as cP, type RecordScopeRelation as cQ, type RecordScopeWithheld as cR, type RegisteredTable as cS, type RetypeBehaviour as cT, type RetypePreview as cU, type RowActionStep as cV, SHOWN_TO_LABEL as cW, SHOWN_TO_VALUES as cX, SHOWN_TO_WHO_MAY_CHANGE as cY, STAGE_RULE_ENFORCEMENT as cZ, STAGE_RULE_ON_FAIL as c_, type DrillDimension as ca, type DrillFinding as cb, type DrillGrain as cc, type DrillHaving as cd, type DrillLane as ce, type DrillLevel as cf, type DrillMeasure as cg, type DrillMeasureOp as ch, type DrillMeasureWhereValue as ci, type DrillPath as cj, type DrillRecords as ck, type DrillView as cl, type EnrichAlternate as cm, type EnrichSource as cn, type Enrichment as co, type EntityBackLinkItem as cp, type EntityFieldValue as cq, type EntityRecordMatch as cr, type FieldDriftAspect as cs, type GridLayoutMode as ct, type GridRowHeight as cu, type HistoryActor as cv, type HistoryActorKind as cw, type HistoryChange as cx, type Home as cy, type ImportColumnPlan as cz, type TableCopyInProgress as d, recordsUseSentence as d$, type StageRuleWarning as d0, TABLE_KIND_PREFIX as d1, type TableHomeDestination as d2, type TableLevel as d3, type TableLevelApproval as d4, type TablePlacement as d5, type TablePlacementFact as d6, type TableRenderSchema as d7, type TableSchemaMode as d8, type TableSyncSource as d9, isArchiveLane as dA, isFoundation as dB, isShownTo as dC, isTableKind as dD, isTheChosen as dE, keptGroups as dF, keptOutOfSight as dG, keptTableHref as dH, levelHasShownTo as dI, looksLikeAnId as dJ, mayDrag as dK, moveConsequence as dL, moveInOrder as dM, offeredAsContext as dN, optionKey as dO, optionLabel as dP, parseFieldDrift as dQ, parseTableCopiesInProgress as dR, parseTableDuplicateProgress as dS, parseTableDuplicated as dT, parseTableHome as dU, parseTableMoved as dV, previewRetype as dW, previewRuleChange as dX, recordChangeTrigger as dY, recordSourceKey as dZ, recordSourceTable as d_, type TypedChoiceDecision as da, type ViewLayout as db, type WorkApprovalState as dc, type WorkDecideManyResult as dd, type WorkDecideVerdict as de, type WorkDueState as df, type WorkInboxKind as dg, type WorkOrigin as dh, type WorkTemplateNode as di, type WorkTemplateRelation as dj, actionRefusals as dk, archivedByLine as dl, archivedWhen as dm, asChoiceNudge as dn, choiceSlug as dp, choiceValuesOf as dq, choicesOf as dr, decideTypedChoice as ds, declareDrillDefinition as dt, drillAnswerOf as du, drillFindingKnob as dv, emptyArchiveLine as dw, exportPageXlsx as dx, fieldKindOf as dy, holdsARetiredChoice as dz, type ArchivedRow as e, rehomeSentence as e0, removedChoicesInUse as e1, ruleThatRefuses as e2, rulesWithTopStar as e3, sameDocument as e4, scopeChip as e5, sheetSyncSpec as e6, tableIdOf as e7, tableJsonSchema as e8, tableKindMapping as e9, tableKindSlug as ea, tableRenderSchema as eb, valueConverts as ec, withRowCounts as ed, withTablePlacement as ee, type Table as f, type TableHome as g, type TableMoved as h, type ChoiceUsage as i, type ChoiceRehome as j, type ChoiceCellBack as k, type ChoicesRehomed as l, type TableCapacity as m, type FieldRetyped as n, type TableKindFacts as o, type TableLevelFacts as p, type TableReaderRule as q, type TableLevelSet as r, type EntityFieldsAcross as s, type EntityFieldRights as t, type EntityRecordRead as u, type EntityBackLinks as v, type EntityRowWritten as w, type EntityRecordsFound as x, type PipelineColumn as y, type PipelineVerdict as z };
+/**
+ * DOOR-8. As-of on EITHER clock, and they are different questions:
+ *   · `record` — the record clock: what this record looked like at version time.
+ *   · `world` — the world clock: which values were true of the world then
+ *     (the Field's `dated` modifier).
+ */
+interface AsOf {
+    clock: "record" | "world";
+    at: Timestamp;
+}
+/** A predicate over a PROMOTED field (REC-5: promotion light -> heavy). */
+interface PromotedPredicate {
+    field_key: string;
+    /** The value as text, exactly as `custom.promoted_read` takes it. */
+    equals: string;
+}
+interface RecordQuery {
+    table_id: Uuid;
+    /** DOOR-6. Any combination, any subset. An empty list means "no relation constraint". */
+    relations?: RelationCoordinate[];
+    /** Predicates the store can answer from an index. */
+    promoted?: PromotedPredicate[];
+    /** DOOR-8. */
+    asOf?: AsOf;
+    /** DOOR-9. Ask across EVERY Home of this Table in one answer. */
+    acrossHomes?: boolean;
+    /** REC-23. Soft-deleted rows are out unless you say otherwise. */
+    includeDeleted?: boolean;
+    /** FLD-10. */
+    recordType?: string;
+    orderBy?: {
+        column: "created_at" | "updated_at";
+        ascending?: boolean;
+    };
+    limit?: number;
+    offset?: number;
+}
+/**
+ * What a query decomposes into: a set of door calls whose answers INTERSECT,
+ * then one filtered read. Kept as data rather than hidden inside the client so
+ * the suite can assert the plan as well as the answer — a query that quietly
+ * stopped applying one of its coordinates is otherwise invisible.
+ */
+interface QueryPlan {
+    /** One `relation_targets` call per coordinate; the id sets are intersected. */
+    relationCalls: Array<{
+        door: "relation_targets";
+        record_id: Uuid;
+        via_key: string | null;
+    }>;
+    /** One `promoted_read` call per predicate; intersected with the above. */
+    promotedCalls: Array<{
+        door: "promoted_read";
+        field_key: string;
+        value: string;
+    }>;
+    /** The filtered read over `custom.record`, which the store's policies gate. */
+    read: {
+        table_id: Uuid;
+        includeDeleted: boolean;
+        recordType: string | null;
+        asOf: AsOf | null;
+        acrossHomes: boolean;
+        orderBy: {
+            column: string;
+            ascending: boolean;
+        };
+        limit: number;
+        offset: number;
+    };
+    /**
+     * Stated so nobody has to guess: when this is true the answer is the
+     * intersection of the id sets above, and when it is false the read stands
+     * alone.
+     */
+    intersects: boolean;
+}
+declare const DEFAULT_PAGE_SIZE = 50;
+declare function planQuery(query: RecordQuery): QueryPlan;
+/** The intersection of the id sets a plan's calls produced. Order is preserved from the first set. */
+declare function intersectIds(sets: Uuid[][]): Uuid[];
+
+/**
+ * 🚨 A REFUSAL IS NOT AN APP ERROR (lane RECORDS-UI-FIX, guide re-walk 2026-09-23).
+ *
+ * A person typing `-3` into a column that takes "at least 0" is the store WORKING: the
+ * rule said no, the screen said so in the one notice, and the person fixed it. The default
+ * sink printed every one of those through `console.error`, and the app's error capture
+ * (matrx-frontend `lib/diagnostics/globalErrorCapture.ts`) counts every `console.error` —
+ * so one refused value lit a red "2 errors" pill in the corner, telling an admin the
+ * product had failed when a person had simply been told no.
+ *
+ * These are the codes a PERSON causes by what they typed or when they typed it; each one
+ * is already drawn on the screen that asked. They are still said (`console.info`), never
+ * silenced. Everything else — a door, the store switched off, a timeout, a class this
+ * package did not recognise — is a failure of the system and stays `console.error`.
+ */
+declare const A_PERSONS_REFUSAL: ReadonlySet<RecordsErrorCode>;
+declare function isAPersonsRefusal(code: RecordsErrorCode | string): boolean;
+/** One organization the client could not use, with the sentence that says why. */
+interface OrganizationUnavailable {
+    organization_id: Uuid;
+    reason: string;
+}
+/** `organizationsOpen`: the organizations whose store answers, and those that do not (with why). */
+interface OrganizationsOpenAnswer {
+    open: Uuid[];
+    unavailable: OrganizationUnavailable[];
+}
+/** `metadataSearch`: every match, each carrying the organization it came from. */
+interface MetadataSearchAnswer {
+    matches: Array<Record<string, unknown> & {
+        organization_id: Uuid | null;
+    }>;
+    /** Organizations asked in order (the ones that answered). */
+    organizations_covered: Uuid[];
+    unavailable: OrganizationUnavailable[];
+}
+interface RecordsClient {
+    /** The config this client was built with, so a screen can show who it is acting as. */
+    readonly config: RecordsConfig;
+    /**
+     * THE SCOPE DOORS (`custom.context_*`): scope types are Tables kept for context, scopes Records,
+     * context fields Fields, values cells. Built from this client's own door path. `@ai-matrx/records/scopes`.
+     */
+    readonly scopes: ScopeDoors;
+    recordWrite(args: {
+        table_id: Uuid;
+        data: RecordDocument;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * WRITE THE RECORD THIS KEY NAMES, OR UPDATE IT WHEN IT IS ALREADY THERE — one call, race-safe
+     * (`custom.record_upsert`). `key` is the column key (or keys) that say which record this is,
+     * and every one must carry a `unique` rule: the store refuses any other column by its name.
+     * Two concurrent calls with the same key leave ONE record. An update goes through
+     * `record_update` (with `expectedVersion`, its stale-write refusal); a new record through
+     * `record_write`. Answers the record's id either way.
+     */
+    recordUpsert(args: {
+        table_id: Uuid;
+        key: string | string[];
+        data: RecordDocument;
+        expectedVersion?: number;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * Write MANY new records of one Table in one call.
+     *
+     * `custom.record_write_many` asks the switch, the organization and the Table
+     * ONCE for the whole batch and inserts the rows in one statement — which is
+     * why a paste of 120 lines is one round trip per chunk instead of 120. It
+     * CREATES only: there is no bulk update door, because an update carries a
+     * per-row optimistic version and a batch would have to either drop that or
+     * fail the whole batch for one stale row.
+     *
+     * It returns the new ids IN THE ORDER THE ROWS WERE HANDED IN, so a caller
+     * can tie each id back to the line of the spreadsheet it came from. Hand in
+     * `ids` to choose them yourself; hand in none and the door mints them.
+     */
+    recordWriteMany(args: {
+        table_id: Uuid;
+        rows: RecordDocument[];
+        ids?: Uuid[];
+    }): Promise<RecordsResult<Uuid[]>>;
+    /**
+     * DOOR-SPEED. MANY CHANGES TO ONE TABLE IN ONE TRANSACTION, through
+     * `custom.record_change_many`: inserts, updates (each with an optional `expected_version`)
+     * and archives. Every update lands in ONE statement, so the store's change notice, history and
+     * activity fire once for the batch while every row trigger still judges every row. ONE REFUSED
+     * CHANGE REFUSES THE BATCH and nothing is saved; the store's own sentence comes back with the
+     * change's position in the hint. The answer is one result per change, in order.
+     */
+    recordChangeMany(args: {
+        table_id: Uuid;
+        changes: readonly RecordChange[];
+    }): Promise<RecordsResult<RecordChangeResult[]>>;
+    /**
+     * A PARENT, THE EDGES IT STANDS ON AND THE ROWS THAT BELONG TO IT — ALL OR NOTHING.
+     *
+     * `recordWrite` and `recordWriteMany` are each ONE statement. A screen or a
+     * server path whose unit of work is a GRAPH — an AI artifact and the lines
+     * it produced, an order and its items, a research note and its citations —
+     * could therefore not save it as one thing: a loop is N transactions, and a
+     * failure on row nineteen leaves a parent standing without the lines it
+     * promised.
+     *
+     * `custom.record_write_graph` is one statement, so it is one transaction. It
+     * is NOT a second write path: it calls `custom.record_write_many` for the
+     * rows, `public.assoc_add` for an edge that points OUT of the store (the
+     * message a record was produced by), and `platform.relation_set` for the
+     * parent's own declared relation to its children. Same store switch, same
+     * editor rung on the Table, same value envelope, same undeclared-key guard,
+     * same history rows, same realtime notice.
+     *
+     * ONE REFUSAL REFUSES THE WHOLE GRAPH, BY NAME — the answer says which member
+     * failed and carries the store's own sentence about it, and nothing is
+     * written.
+     *
+     * Every child MUST name a `role`: it is the key of a declared RELATION field
+     * on the parent's Table, and an edge out of a record that names no field is
+     * refused by the store (REL-10 / T7) because without it nothing can read the
+     * relation's delete rule, its cardinality or its organization wall. The order
+     * children are handed in IS the order of the relation.
+     */
+    recordWriteGraph(args: {
+        table_id: Uuid;
+        parent: RecordDocument;
+        /** Each child: its document, the parent FIELD it fills, and optionally its own Table. */
+        children?: Array<{
+            data: RecordDocument;
+            role: string;
+            table_id?: Uuid;
+            position?: number;
+        }>;
+        /** Edges to things OUTSIDE the store. `direction` defaults to `"in"` — that thing produced this record. */
+        edges?: Array<{
+            entity: string;
+            id: Uuid;
+            direction?: "in" | "out";
+            label?: string;
+            role?: string;
+            position?: number;
+            metadata?: Record<string, unknown>;
+        }>;
+    }): Promise<RecordsResult<RecordGraphWritten>>;
+    recordUpdate(args: {
+        record_id: Uuid;
+        patch: Record<string, unknown>;
+        /** Leave it out and the last writer wins; supply it and a loser is TOLD. */
+        expectedVersion?: number;
+    }): Promise<RecordsResult<number>>;
+    /**
+     * A CELL THAT TAKES WORDS WHICH ARE NOT YET A CHOICE — the words become a choice of that
+     * column everywhere and the cell takes it, in ONE transaction (lane CHOICE-COLUMN-EDIT,
+     * `custom.record_update_adding_choices`). `add` is `{ "<column key>": ["words", ...] }`; the
+     * cell's value in `patch` is the words, and the store turns them into the new choice's key.
+     * Adding a choice changes the table's columns, so it needs that right; a refusal names it.
+     * Answers the new version, like `recordUpdate`, and announces the record changed.
+     */
+    recordUpdateAddingChoices(args: {
+        record_id: Uuid;
+        patch: Record<string, unknown>;
+        add: Record<string, string[]>;
+        expectedVersion?: number;
+    }): Promise<RecordsResult<number>>;
+    /**
+     * The Feature Knob `custom/choice_nudge` for the signed-in person in this client's
+     * organization: what a choice cell does with typed words that are not a choice
+     * (`decideTypedChoice` in `choice.ts` is the one place that acts on it).
+     */
+    choiceNudge(): Promise<RecordsResult<ChoiceNudge>>;
+    /**
+     * REC-23. Soft, and reversible within `retention`.
+     *
+     * 🚨 NOT FOR A TABLE. A Table is a record, so this door accepts one — and
+     * then recurses through every record the Table contains inside a single
+     * transaction, which is unbounded by construction and dies on `57014` at a
+     * size the product's own import reaches in half a minute. Use
+     * `tableArchive` below, which does the same work in resumable passes.
+     */
+    recordDelete(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<Timestamp>>;
+    recordRestore(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<void>>;
+    /**
+     * ARCHIVING A WHOLE TABLE — ONE PASS OF IT (VERIFIER-11 F3).
+     *
+     * One call archives at most `chunk` of the table's live records through
+     * `custom.record_delete` (so every guard, history capture and outbox row
+     * still happens; nothing is hard-deleted) and comes back with the numbers a
+     * screen draws progress from. The CALLER LOOPS until `done` — that loop is
+     * the fix, because the one thing a single statement cannot be made to do is
+     * finish.
+     *
+     * `chunk: 0` changes nothing and only reports, so a screen can say "1,430
+     * records will be archived" BEFORE a person commits to it. `includeTable:
+     * false` empties the table and leaves it standing.
+     *
+     * RESUMABLE, WITHOUT A JOB ROW: what remains is read off the records
+     * themselves every call. A pass that fails, a closed tab or a deploy mid-run
+     * leaves a half-archived table and a next call that continues from exactly
+     * there. A caller must therefore never report "nothing happened" after a
+     * failed pass — `archived_total` says what really landed.
+     */
+    tableArchive(args: {
+        table_id: Uuid;
+        /**
+         * How many records this pass takes on. The door clamps it; it answers with what it
+         * took. Default 50 — measured: ~35ms a record against an 8s statement timeout, so
+         * 200 dies on `57014` and is the original defect one level up.
+         */
+        chunk?: number;
+        /** Archive the Table record itself once nothing live is left in it. Default true. */
+        includeTable?: boolean;
+    }): Promise<RecordsResult<TableArchiveProgress>>;
+    /**
+     * ONE PASS OF ARCHIVING, ON PURPOSE, A TABLE THE APP'S CODE DEPENDS ON
+     * (`custom.table_archive_deliberately`, lane 12 P5). Such a table (`code_depends: true`) refuses
+     * `tableArchive`, `recordDelete`, a slug / kept_for rename, `tableMove` and removal of the mark.
+     * This door takes the table's slug TYPED by the person and a reason, refuses an agent, and then
+     * archives through `custom.table_archive` (same progress answer; the caller loops until `done`).
+     * Use `archiveTypedTableDeliberately` (`@ai-matrx/records/typed-table`), which loops.
+     */
+    tableArchiveDeliberately(args: {
+        table_id: Uuid;
+        typed_slug: string;
+        reason: string;
+    }): Promise<RecordsResult<TableArchiveProgress>>;
+    /**
+     * BRINGING A WHOLE TABLE BACK — ONE PASS OF IT (`custom.table_restore`, lane TABLE-ACTIONS).
+     *
+     * 🚨 NOT `recordRestore` FOR A TABLE: that door brings the Table, its structure, every record
+     * and everything built on it back in one statement and dies on `57014` (the clone's "Referral
+     * Intake Queue 2026-Q4 (copy 7)"). This pass brings back the Table and its structure first, then
+     * at most `chunk` records, then what was built on it — all from the one archive event — and
+     * answers `done` when nothing the archive took is still waiting. Use {@link tableRestoreWhole}.
+     */
+    tableRestore(args: {
+        table_id: Uuid;
+        chunk?: number;
+    }): Promise<RecordsResult<TableRestoreProgress>>;
+    /**
+     * THE WHOLE RESTORE OF A TABLE — the loop every caller needs: `tableRestore` until `done`,
+     * halving the pass on a statement timeout (a pass that timed out changed nothing). `onPass`
+     * hears every pass's numbers. Answers the last pass, or the refusal that stopped it (what the
+     * passes before it brought back stays back; the next call carries on from there).
+     */
+    tableRestoreWhole(args: {
+        table_id: Uuid;
+        onPass?: (progress: TableRestoreProgress) => void;
+    }): Promise<RecordsResult<TableRestoreProgress>>;
+    /**
+     * DUPLICATE A TABLE — `custom.table_duplicate` (lane TABLE-ACTIONS).
+     *
+     * Makes a NEW Table from one the caller may open: its settings and look, every live column (new
+     * ids), every choice list as a new list (same words, colours, keys and order), every saved view
+     * (filters, sorts, layouts, every id inside them pointing at the copy), and with `withRecords`
+     * every live record (a link to another row of the same table follows to the copy's row; a link
+     * to another table stays). `name` defaults to "<name> (copy)", "(copy 2)", …;
+     * `organizationId` defaults to the source's organization and must be one the caller belongs to.
+     * The source is never written. The copy is made in passes of a few seconds (any size; the
+     * store answers "copying" until "done"), and this call loops them. Refused before anything is
+     * made, the refusal carries the store's one sentence (not given / archived / not a member there
+     * / a column linking across organizations).
+     */
+    tableDuplicate(args: {
+        tableId: Uuid;
+        withRecords?: boolean;
+        name?: string | null;
+        organizationId?: Uuid | null;
+        /** Called after every pass with what is copied so far (a progress bar is made of it). */
+        onProgress?: (progress: TableDuplicateProgress) => void;
+    }): Promise<RecordsResult<TableDuplicated>>;
+    /**
+     * CARRY ON A COPY — `custom.table_duplicate_continue` (lane TABLE-ACTIONS). The copy is made in
+     * passes of a few seconds each; `tableDuplicate` loops them, and this resumes one that a closed
+     * tab or a lost connection left unfinished (the copy is kept out of every table list until it
+     * is done). Only the person who started it; it answers the finished copy, or refuses.
+     */
+    tableDuplicateContinue(args: {
+        copyId: Uuid;
+        onProgress?: (progress: TableDuplicateProgress) => void;
+    }): Promise<RecordsResult<TableDuplicated>>;
+    /**
+     * THE CALLER'S UNFINISHED COPIES — `custom.table_copies_in_progress` (lane TABLE-ACTIONS). Each
+     * is still being made (carry it on with `tableDuplicateContinue`) or stopped because its source
+     * was archived meanwhile (discard it: `tableArchive` on the copy). Nobody else can see them.
+     */
+    tableCopiesInProgress(): Promise<RecordsResult<TableCopyInProgress[]>>;
+    recordRead(args: {
+        record_id: Uuid;
+        withComputed?: boolean;
+        /** Also answer `version` (read in the same round, so the read takes as long as the slower of the two). */
+        withVersion?: boolean;
+        organization_id?: Uuid | null;
+    }): Promise<RecordsResult<RecordRead>>;
+    /**
+     * DOOR-1. A page of one Table's records THROUGH `custom.read_records`: the
+     * store decides which rows this reader may see and which fields of them, and
+     * a field it masked comes back present-and-null with its reason in `hidden`.
+     * `total` is null because the door counts nothing it has not read — a count
+     * of rows a person may not see is a leak with a number on it.
+     */
+    list(args: {
+        table_id: Uuid;
+        /**
+         * THE STORE'S ONE FILTER SHAPE (`RecordFilter`). Left out, this is the
+         * whole page. Supplied, the store narrows INSIDE its own query — never the
+         * browser, which can only ever filter the rows it was already allowed to
+         * see and would silently drop the rest of the answer.
+         *
+         * It is the same object a saved view stores as `filters` and the same one
+         * `recordAggregate` counts with, so the rows a drill-through opens are the
+         * rows the number on the dashboard counted.
+         */
+        filter?: StoreFilter;
+        limit?: number;
+        offset?: number;
+    }): Promise<RecordsResult<{
+        rows: ReadRow[];
+        total: number | null;
+        locked?: number;
+    }>>;
+    /**
+     * DOOR-SPEED. ONE PAGE THE STORE SORTED, SEARCHED, FILTERED AND COUNTED, through
+     * `custom.read_records_page` — the same wall, ladder, field mask and filter as `list`, with the
+     * order (`sort`, or a hand-ordered view's positions via `view_id`), a text `search` over the
+     * columns this reader may see (and the words of choice options), and the `total` of the
+     * matching visible set. It is what a grid pages with: nothing reads the whole table to draw one
+     * page. A sort on a column this reader cannot see (gone, or masked) is SKIPPED and named in
+     * `sort_ignored` — the page still loads; one worked out on every read is refused by name.
+     */
+    listPage(args: {
+        table_id: Uuid;
+        filter?: StoreFilter;
+        search?: string | null;
+        sort?: readonly RecordPageSort[];
+        view_id?: Uuid | null;
+        limit?: number;
+        offset?: number;
+    }): Promise<RecordsResult<RecordPage>>;
+    /**
+     * AP3-KEYSET-DOOR. THE SAME PAGE AS `listPage`, PAGED BY A CURSOR, through
+     * `custom.read_records_keyset`: the same wall, ladder, field mask, filter, search and sort (no
+     * hand-ordered view), the same rows in the same order — but the next page starts after the last
+     * row's sort values and id, so a write landing mid-read never skips or repeats a row. Pass back
+     * `cursor` as `after` (it is opaque; `null` on the last page). A cursor handed to a different
+     * sort, filter or search is refused by name ("start from the first page"), never reinterpreted.
+     *
+     * Every row carries the `version` and `organization_id` it was read at, in the same statement as
+     * its values. With `ids`, it re-reads exactly those rows among the ones the reader may see (in the
+     * page's order; `after` ignored, `cursor` and `total` null) — get-by-id, the re-read after a write,
+     * and the changed ids of a realtime notice.
+     */
+    listKeyset(args: {
+        table_id: Uuid;
+        filter?: StoreFilter;
+        search?: string | null;
+        sort?: readonly RecordPageSort[];
+        after?: string | null;
+        ids?: readonly Uuid[];
+        limit?: number;
+    }): Promise<RecordsResult<RecordKeysetPage>>;
+    /**
+     * DOOR-1 FOR AN ID SET. Exactly these records of this Table, through
+     * `custom.read_records_by_ids` — the same ladder, the same level, the same
+     * field masking and the same page ceiling as `list`, addressed by id instead
+     * of by page. An id the reader may not see simply does not come back, which
+     * is the same answer `list` gives by omission.
+     *
+     * It exists because a realtime notice has always named the exact ids that
+     * moved and no door could take them: three cells changing re-read a fifty-row
+     * page in every watching browser.
+     */
+    listByIds(args: {
+        table_id: Uuid;
+        ids: readonly Uuid[];
+    }): Promise<RecordsResult<ReadRow[]>>;
+    /**
+     * DOOR-1 FOR THE ROWS THAT LEFT: a page of one Table's ARCHIVED records,
+     * through `custom.read_records_archived` — the same ladder, the same level,
+     * the same field masking and the same page ceiling as `list`, with the sign
+     * of the `deleted_at` test flipped, plus who archived each one and when.
+     *
+     * 🚨 IT EXISTS BECAUSE ARCHIVING WAS A ONE-WAY DOOR (VERIFIER-10 F4). The
+     * store has always had `record_restore`, and it has always done exactly the
+     * right thing; what it did not have was any door that could LIST the records
+     * it would act on, because every read door answers live rows only. So an
+     * archived record was unreachable from every screen in the platform.
+     *
+     * `lane` is the archived-items law's two lanes — "mine" (what I archived) and
+     * "org" (what anybody in this organization archived), which is the default.
+     */
+    listArchived(args: {
+        table_id: Uuid;
+        lane?: ArchiveLane;
+        limit?: number;
+        offset?: number;
+    }): Promise<RecordsResult<{
+        rows: ArchivedRow[];
+        total: number | null;
+    }>>;
+    query(query: RecordQuery): Promise<RecordsResult<{
+        rows: ReadRow[];
+        total: number | null;
+    }>>;
+    /**
+     * Every Table the person can see across ALL their organizations
+     * (`config.organizationIds`); `organization_id` is the page's optional filter
+     * (absent = all). Each Table carries its own `organization_id`.
+     */
+    tableList(args?: {
+        organization_id?: Uuid | null;
+    }): Promise<RecordsResult<Table[]>>;
+    /**
+     * ONE Table's declaration by id — `null` when this reader may not see it or it is not a Table.
+     * The same kernel record `tableList` lists, read through `read_records_by_ids` for exactly
+     * that id, so a screen that opens one table never lists every table to find it (a list capped
+     * at 500 answered "no table" past the 500th).
+     */
+    tableRead(args: {
+        table_id: Uuid;
+        organization_id?: Uuid | null;
+    }): Promise<RecordsResult<Table | null>>;
+    /**
+     * ONE Table of THIS organization found by its slug — or, with no slug, by its name — in ONE
+     * request (`custom.table_find`). `null` when there is none or this reader may not see it: the
+     * store reads the candidates through the same read door `tableRead` uses, so a table she may
+     * not see answers exactly like one nobody made. Where several share a slug, the oldest she may
+     * see answers, every time (the same pick `ensureTable` makes). Never list every table to find one.
+     *
+     * `keptFor` (an app's table): the slug AND what the table is kept for must match — a person's own
+     * table of the same slug is a different table and never answers. With `keptFor` and no live
+     * match, an ARCHIVED match is answered as `{ id, organization_id, archived_at }` (no document), so
+     * a caller says "archived — restore it", never "missing".
+     */
+    tableFind(args: ({
+        slug: string;
+        name?: never;
+    } | {
+        name: string;
+        slug?: never;
+    }) & {
+        keptFor?: string;
+    }): Promise<RecordsResult<Table | null>>;
+    /**
+     * IS THIS TABLE IN THE ARCHIVE? (lane HUB-FIX, 2026-09-23.) The archived row for one
+     * Table of this organization, or `null` when the archive does not hold it — which
+     * is an ANSWER, never "it may have been deleted". A table page that cannot find a
+     * Table asks this before saying anything: an archived Table's own address used to
+     * read "…or it may have been deleted" when it was archived and one click from back.
+     */
+    tableArchived(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<ArchivedRow | null>>;
+    /**
+     * WHO CAN SEE EACH TABLE, AND WHETHER THE CALLER MADE IT — `custom.table_facts`
+     * (lane HUB-FIX). `visibility` and `created_by` are record COLUMNS the Table document
+     * never carried, so a screen that sorts Tables into lanes asks this and folds the
+     * answer onto `tableList()`'s Tables with `withTableFacts`.
+     *
+     * 🚨 IT IS ITS OWN CALL, NOT PART OF `tableList()` (0.57.3). 0.57.2 folded it into
+     * every table list, so every screen that merely LISTS tables (the field editor's
+     * relation target, the import wizard, settings) paid a second round trip it never
+     * used — and every test double that answers a table list had to answer it too
+     * (records-ui 0.84.5's gate: 47 tests in 15 files red). Only the lane-sorting
+     * screens ask.
+     *
+     * The door-presence pattern: when the store's catalogue does not carry the door the
+     * answer is `null` — nothing asked, nothing invented.
+     */
+    tableFacts(args?: {
+        organization_id?: Uuid | null;
+    }): Promise<RecordsResult<TableFact[] | null>>;
+    /**
+     * WHICH STORE CURRENTLY WRITES each table — `custom.where_tables_live`.
+     *
+     * This is a batch cutover decision, not a Table's home address: during COPY
+     * mode an older table and its record-store copy share an id, and only this
+     * door knows which one the organization is still using. It is intentionally
+     * unbound from this client's organization because the door derives the answer
+     * from each supplied table and the caller's authority.
+     */
+    tablesLiveWhere(args: {
+        table_ids: Uuid[];
+    }): Promise<RecordsResult<TableLiveLocation[]>>;
+    /**
+     * WHICH ORGANIZATION A TABLE LIVES IN, BY NAME, AND WHERE IT MAY GO — `custom.table_home`
+     * (SC-1' / SC-1-TAILS). Read FROM THE TABLE, never from the organization the client is bound
+     * to, so it answers for a table shared from outside too. `null` = not given to this person,
+     * or not there (the store says the same for both, on purpose). A store without the door
+     * refuses `door_absent` — never a guessed organization.
+     */
+    tableHome(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<TableHome | null>>;
+    /**
+     * MOVE A TABLE into another organization the caller belongs to — `custom.table_move`. It
+     * carries every Table inside it or its rows and writes the change events; refused, NOTHING
+     * moved and the refusal carries the store's one sentence. `expected_version` is the Table's
+     * version the caller decided on (a concurrent change refuses with "look again").
+     */
+    tableMove(args: {
+        table_id: Uuid;
+        to_organization_id: Uuid;
+        expected_version?: number | null;
+    }): Promise<RecordsResult<TableMoved>>;
+    /**
+     * The Fields that apply. NOTION-PROPS: a two-way link's reverse Field (`isReverseField`) is left out
+     * unless `withReverse` — every screen draws it as the table's reverse column (`reverseColumns`, with
+     * `read_only: false`), which reads and writes its links; listed as a Field too it would draw twice.
+     */
+    fields(args: {
+        table_id: Uuid;
+        recordType?: string;
+        withReverse?: boolean;
+    }): Promise<RecordsResult<Field[]>>;
+    /**
+     * FLD-5 / FLD-6: a list field stores the id of an option RECORD, because
+     * every pick-list is already a Table. These are that Table's records — the
+     * store resolves which Table from the Field's own config, so no caller has to
+     * know it.
+     */
+    fieldOptions(args: {
+        field_id: Uuid;
+    }): Promise<RecordsResult<StoredRecord[]>>;
+    /**
+     * How many records hold each choice of one choice column, keyed by the option's id
+     * (`custom.field_choice_usage`; counts only records the caller may see). What a column editor
+     * says before a choice that records still hold is removed: "3 records use “X-ray”."
+     */
+    fieldChoiceUsage(args: {
+        field_id: Uuid;
+    }): Promise<RecordsResult<Record<string, ChoiceUsage>>>;
+    /**
+     * A column's choices saved AND the records of each removed choice moved to another choice,
+     * kept as other values, or cleared — ONE transaction (`custom.field_update_rehoming_choices`).
+     * `rehome` is keyed by the removed option's id. The answer carries `undo`; sending
+     * `{ patch: { options: undo.options }, cells_back: undo.cells_back }` back through this same
+     * call puts the list and every cell back, again in one transaction.
+     */
+    fieldUpdateRehomingChoices(args: {
+        field_id: Uuid;
+        patch: FieldPatch;
+        rehome?: Record<string, ChoiceRehome> | undefined;
+        cells_back?: readonly ChoiceCellBack[] | undefined;
+    }): Promise<RecordsResult<ChoicesRehomed>>;
+    tableCapacity(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<TableCapacity>>;
+    /**
+     * REC-1: a Table has to live somewhere, so a Home comes first — and a Home is
+     * an ordinary record in the person kernel. `homeId` is therefore required and
+     * `personKernelId()` is how a caller gets a Table to write one into.
+     */
+    tableDeclare(args: {
+        spec: Record<string, unknown>;
+        homeId: Uuid;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * FIND THIS TABLE BY ITS SLUG, OR MAKE IT — ONE call, ONE transaction (`custom.table_ensure`).
+     * The store holds a lock on (organization, slug) across the find and the make, so two tabs
+     * saving their first record at once get the SAME table; a second call adds any column the spec
+     * names that the table lacks and never retypes or drops one. `spec.fields` are full
+     * `custom.field_declare` specs. Prefer `ensureTable(client, NewTableSpec)`, which builds them.
+     *
+     * `drift` names every column the table already has whose stored shape differs from the spec
+     * (type, format, label, multi, required, unique) — reported, never applied. `[]` when nothing
+     * differs; `null` only from a store too old to compare (see `FieldDrift`).
+     */
+    tableEnsure(args: {
+        spec: Record<string, unknown>;
+    }): Promise<RecordsResult<{
+        table_id: Uuid;
+        home_id: Uuid | null;
+        created: boolean;
+        drift: FieldDrift[] | null;
+    }>>;
+    /**
+     * ADD A FIELD TO A TABLE. One call, and the store does the three things no
+     * client can do for itself: it turns a parity type into the behaviour,
+     * modifiers, format, unit, relation target and Rules its own guards demand;
+     * it tells the TABLE about the field (REC-1 / FLD-8 — a definition for a
+     * field the table never declared is refused, which is the sentence every
+     * "Add field" used to end on); and it stores the definition as a FIELD
+     * rather than as a plain record, so the delete rules and the
+     * formula-dependency check can see it.
+     *
+     * A choice list carries its `options` as words. The store keeps them the only
+     * way FLD-5 / FLD-6 allows — as the records of a Table it declares for them —
+     * so nobody is made to build a table before they can have a dropdown.
+     */
+    fieldDeclare(args: {
+        table_id: Uuid;
+        spec: NewFieldDeclaration;
+    }): Promise<RecordsResult<Uuid>>;
+    /** One field's own settings. What it HOLDS is a conversion and is refused here by name. */
+    fieldUpdate(args: {
+        field_id: Uuid;
+        patch: FieldPatch;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * CHANGE WHAT A COLUMN HOLDS, through `custom.migrate_retype` (FLD-4 / T12). `to` is the store's
+     * behaviour word — `text`, `range` (numbers and dates), `boolean`, `list`, `relation`. Every value
+     * that converts is converted; every value that does not is kept in that record's `_retired`
+     * with the reason, never coerced and never deleted. The answer counts both.
+     */
+    migrateRetype(args: {
+        field_id: Uuid;
+        to: string;
+        note?: string;
+    }): Promise<RecordsResult<FieldRetyped>>;
+    /**
+     * MERGE ONE RECORD INTO ANOTHER, through `custom.migrate_merge` (T5 / REC-21). The loser's values
+     * the winner did not hold move across, the ones that differ are kept as ranked alternates, every
+     * link to the loser now points at the winner, and the loser is archived with its id resolving to
+     * the winner. Editor on BOTH records is decided first. The answer's `migration_id` is what
+     * `migrateUndo` takes.
+     */
+    migrateMerge(args: {
+        winner_id: Uuid;
+        loser_id: Uuid;
+        note?: string | null;
+    }): Promise<RecordsResult<RecordsMerged>>;
+    /** Put a recorded Migration back (`custom.migrate_undo`): a retype or a merge, by its id. */
+    migrateUndo(args: {
+        migration_id: Uuid;
+    }): Promise<RecordsResult<MigrationUndone>>;
+    /**
+     * SPLIT ONE RECORD IN TWO, through `custom.migrate_split` (Rule 11 / REC-22). The named values
+     * MOVE to a new record of the same Table; the original keeps its id, so every link to it still
+     * resolves. Editor on the record is decided first. `migrateUndo(migration_id)` puts it back.
+     */
+    migrateSplit(args: {
+        record_id: Uuid;
+        moved_keys: string[];
+        note?: string | null;
+    }): Promise<RecordsResult<RecordSplit>>;
+    /**
+     * EXTRACT A PARENT, through `custom.migrate_extract_parent` (Rule 11 / test 5). The named values
+     * are COPIED up into a new record of `parent_table_id`, and this record is put under it. Its old
+     * parent, if any, becomes the new parent's parent. `migrateUndo(migration_id)` puts it back.
+     */
+    migrateExtractParent(args: {
+        record_id: Uuid;
+        parent_table_id: Uuid;
+        moved_keys: string[];
+        note?: string | null;
+    }): Promise<RecordsResult<ParentExtracted>>;
+    /** The Migration log for one record or Table (`custom.migrations`), newest first. */
+    migrations(args: {
+        target_id?: Uuid | null;
+        limit?: number;
+    }): Promise<RecordsResult<MigrationEntry[]>>;
+    /**
+     * ONE RECORD ON EITHER CLOCK, through `custom.query_record_as_of` (Rule 10 / test 6).
+     * `recorded_at` answers what the store SAID at that moment; `world_on` answers what was TRUE of
+     * the world on that date, read from `dated` values. Both may be given. `null` data means the
+     * record is not visible to this person (or did not exist then) — an absence, not an empty record.
+     */
+    recordAsOf(args: {
+        record_id: Uuid;
+        recorded_at?: string | null;
+        world_on?: string | null;
+    }): Promise<RecordsResult<Record<string, unknown> | null>>;
+    /**
+     * REL-DISP. THE WORDS ONE RELATION CELL SHOWS, resolved by the store through
+     * that column's own display spec — one column or several, joined by its
+     * separator. Never resolve a relation label any other way: the store's
+     * `custom._words_for` is the one body that decides what a record is called, it
+     * asks the read-access ladder BEFORE it reads the name, and a record this reader
+     * may not open comes back as the withheld sentence rather than its name or id.
+     * A value that is not an id is handed straight back — it is already words.
+     */
+    relationWords(args: {
+        field_id: Uuid;
+        value: string;
+    }): Promise<RecordsResult<string | null>>;
+    /**
+     * The same answer for a WHOLE PAGE of cells in one round trip. Prefer this
+     * wherever a grid, board, list or picker resolves more than one chip: the
+     * per-id lane is what made a page of relation cells a page of requests.
+     */
+    relationWordsMany(args: RelationWordsManyArgs): Promise<RecordsResult<Record<string, string>> & {
+        archived?: readonly string[];
+        icons?: Record<string, RelationIcons>;
+    }>;
+    /**
+     * VISION-REACH G1. Which records of `table_id` each name names — its name column, case and
+     * spacing ignored, only records this reader may see. Hand the answer to `relationNameIndexOf`
+     * and pass that to the coercion as `relationNames`. Up to 5,000 names a call; more are sent in
+     * groups by this method.
+     */
+    relationNamesMatch(args: {
+        table_id: Uuid;
+        names: string[];
+    }): Promise<RecordsResult<RelationNamesAnswer>>;
+    /**
+     * VIEWS-AND-FIELDS BL (REL-9). The REVERSE COLUMNS of a Table: one per relation column of another
+     * table (or this one) that links here, read-only, virtual — never a Field of this Table, so
+     * `applicableFields` does not list them. A linking table this reader may not know is left out.
+     */
+    reverseColumns(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<ReverseColumn[]>>;
+    /**
+     * A page of records' links through ONE reverse column, in one round trip per 200 records:
+     * `{ [record id]: { total, links: [{ id, words }] } }`, only linking records this reader may see.
+     * `limit` (1–50) and `offset` page one record's links — a record with thousands of links costs
+     * one count and one page. A record with no links answers `{ total: 0, links: [] }`.
+     */
+    reverseLinksMany(args: ReverseLinksManyArgs): Promise<RecordsResult<Record<string, ReverseLinks>>>;
+    /**
+     * The same, through SEVERAL reverse columns in ONE call (`custom.reverse_links_many_fields`):
+     * `{ [source field id]: { [record id]: { total, links } } }`. A store without the door answers
+     * `door_absent` — ask `reverseLinksMany` per column then.
+     */
+    reverseLinksFields(args: ReverseLinksFieldsArgs): Promise<RecordsResult<Record<string, Record<string, ReverseLinks>>>>;
+    /**
+     * NOTION-PROPS. A TWO-WAY LINK: makes (or returns) the reverse Field of relation `field_id` on its
+     * target table (`custom.relation_reverse_field`), so the link is a column there that edits the same
+     * links. Its key is the reverse column's key; `label` defaults to the linking table's name.
+     */
+    relationReverseField(args: {
+        field_id: Uuid;
+        label?: string;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * NOTION-PROPS. Adds and removes links from the reverse side of a two-way link
+     * (`custom.relation_reverse_set`): each id becomes a write of THAT record's forward Field.
+     * Answers how many records changed.
+     */
+    relationReverseSet(args: {
+        record_id: Uuid;
+        field_id: Uuid;
+        add?: readonly Uuid[];
+        remove?: readonly Uuid[];
+    }): Promise<RecordsResult<number>>;
+    /** Take a field off a table. Refuses the title field, the last field, and one another field reads through. */
+    fieldRetire(args: {
+        field_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /**
+     * Bring a removed column back (`custom.field_restore`): the set that was retired with it, the
+     * Table's declaration of those columns, and the links they made. The values never left.
+     */
+    fieldRestore(args: {
+        field_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /**
+     * DUPLICATE PROPERTY (Notion N5) — `custom.field_duplicate`: a new column right after this one, named
+     * "<name> (1)", the same kind (choices with their colours, unit, link, formula, rules, sensitivity), and
+     * every record's value copied into it in one statement. A link column copies its definition only (its
+     * values are links); a formula, lookup or roll-up works its answer out itself. Needs the table's
+     * add-a-column rung, the same as `fieldDeclare`.
+     */
+    fieldDuplicate(args: {
+        field_id: Uuid;
+    }): Promise<RecordsResult<FieldDuplicated>>;
+    /**
+     * CHAIR-ROLLUP-HONEST. Is a column this lookup or roll-up reads archived — the link it reads
+     * through, a back-link's linking column, or the far column it totals (`custom.field_source_archived`)?
+     * `null` while every source is live. Bring it back with `fieldRestore({ field_id })`.
+     */
+    fieldSourceArchived(args: {
+        field_id: Uuid;
+    }): Promise<RecordsResult<SourceArchived | null>>;
+    /**
+     * A TABLE AS A KIND (KINDS-GLUE wave 3, N1): `custom.table_kind_facts` verbatim — the Table's
+     * live Fields, choices and stamp, as the asking person. The door finds the Table's organization
+     * itself, so this works for a Table in any organization the person may open; anything else is
+     * refused (`42501`, the store's sentence).
+     */
+    tableKindFacts(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<TableKindFacts>>;
+    /**
+     * A TABLE'S ACCESS LEVEL (CONFIDENTIAL-BY-ORG-ADMIN): `custom.table_level_facts` verbatim - its level,
+     * readers, who approves a change (`set_by`) and whether THIS person may (`can_set`). Draw the control only
+     * when `can_set` is true; anyone who may know the table may ask.
+     */
+    tableLevelFacts(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<TableLevelFacts>>;
+    /**
+     * MAKE A CUSTOM TABLE CONFIDENTIAL, or change whom it names (`custom.set_table_confidential`). Succeeds
+     * only for an owner/admin of the table's own organization on an ordinary custom table; the approver, seat,
+     * reason and date are recorded. `readers` is the list of `{field, level}` rules (a person field of the
+     * table); `reason` is required.
+     */
+    setTableConfidential(args: {
+        table_id: Uuid;
+        readers: TableReaderRule[];
+        reason: string;
+    }): Promise<RecordsResult<TableLevelSet>>;
+    /** THE WAY BACK: the same caller rule, the table is Organization again (`custom.set_table_organization`). */
+    setTableOrganization(args: {
+        table_id: Uuid;
+        reason: string;
+    }): Promise<RecordsResult<TableLevelSet>>;
+    /**
+     * THE COLUMNS THIS TABLE HAD AND NO LONGER HAS (grids review 3): its retired Field records,
+     * newest first, through the same archived door the Table archive uses — addressed at the Field
+     * kernel (every Field is a record in it) and paged until the door answers short.
+     */
+    fieldsRetired(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<ArchivedRow[]>>;
+    /** What the registry says about a token, and whether it can hold a value at all. */
+    entityTable(args: {
+        token: string;
+    }): Promise<RecordsResult<EntityTableFacts>>;
+    /** The fields THIS organization added to that standard table. */
+    entityFields(args: {
+        token: string;
+    }): Promise<RecordsResult<Field[]>>;
+    /** The fields EVERY named organization added to that standard table, with their choices, in one read. */
+    entityFieldsAcross(args: {
+        token: string;
+        organization_ids: Uuid[];
+    }): Promise<RecordsResult<EntityFieldsAcross>>;
+    /** Add a column to a standard table. An organization admin's right - it changes the table for everybody. */
+    entityFieldDeclare(args: {
+        token: string;
+        spec: NewEntityFieldDeclaration;
+    }): Promise<RecordsResult<Uuid>>;
+    /** One field's own settings. A TYPE change is refused here by name, as it is on a custom table. */
+    entityFieldUpdate(args: {
+        field_id: Uuid;
+        patch: Record<string, unknown>;
+    }): Promise<RecordsResult<Uuid>>;
+    /** Take a custom field off a standard table. The values already written stay in each row. */
+    entityFieldRetire(args: {
+        field_id: Uuid;
+    }): Promise<RecordsResult<Uuid>>;
+    /** May this person add a column here - and if not, the store's own sentence saying why. */
+    entityFieldRights(args: {
+        token: string;
+    }): Promise<RecordsResult<EntityFieldRights>>;
+    /** REC-53 in one answer: the row's real columns AND its custom values AND the definitions. */
+    entityRecordRead(args: {
+        token: string;
+        record_id: Uuid;
+    }): Promise<RecordsResult<EntityRecordRead>>;
+    /**
+     * AP-4: the custom rows that link to one platform record, by which field and in which table.
+     * Keyed by the ROW's organization (`organization_id`), never the client's active one. Paged:
+     * pass the previous answer's `next_cursor` as `cursor`.
+     */
+    entityBackLinks(args: {
+        token: string;
+        record_id: Uuid;
+        organization_id: Uuid;
+        limit?: number;
+        cursor?: string | null;
+    }): Promise<RecordsResult<EntityBackLinks>>;
+    /**
+     * THE one write door for a standard row (`custom.entity_row_write`, as the person): custom values
+     * as a patch (a key left out is left alone, a key set to null is cleared with its envelope),
+     * archive / restore, and real columns only where the store lists them. The row's own organization
+     * governs; `expected_version` refuses a stale write; a change that changes nothing writes nothing.
+     */
+    entityRowWrite(args: {
+        token: string;
+        /**
+         * null ADDS a row (chairblk3_a): only for a token whose API facts say `create_via: "insert"`
+         * (`drill_describe(...).api.create_via` — task and project), as one insert AS THE PERSON in
+         * `organization_id` (default: this client's organization); the answer carries `created: true`
+         * and the new `id`. Every other token refuses in its own words.
+         */
+        record_id: Uuid | null;
+        /** A change by id: only to say which organization the row must belong to. A new row: where it goes. */
+        organization_id?: Uuid | null;
+        custom?: Record<string, unknown>;
+        columns?: Record<string, unknown>;
+        expected_version?: number | null;
+        archive?: boolean | null;
+    }): Promise<RecordsResult<EntityRowWritten>>;
+    /** Rows of that standard table with this custom value. Refuses a field nobody declared. */
+    entityRecordsFind(args: {
+        token: string;
+        key: string;
+        value?: unknown;
+        limit?: number;
+        offset?: number;
+    }): Promise<RecordsResult<EntityRecordsFound>>;
+    /** The kernel Tables a caller writes a Home, a Field or a Rule into. */
+    personKernelId(): Promise<RecordsResult<Uuid>>;
+    fieldKernelId(): Promise<RecordsResult<Uuid>>;
+    ruleKernelId(): Promise<RecordsResult<Uuid>>;
+    /** Every record the Rule says is a member. A saved view's list is this, not a filter a screen ran. */
+    /** PRODUCTS row 7 — the whole board: its stage column, its stages in the declared
+     *  order, and every Rule WITH the sentence it says when it refuses. */
+    pipelineRead(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<Pipeline>>;
+    /** The store's own count and total per column, over what this person may see. */
+    pipelineBoard(args: {
+        table_id: Uuid;
+        measure?: string | null;
+        /**
+         * S2-PRIME — the view's question, either shape (`StoreFilter`). Given, the headings count and
+         * total exactly the cards the same filter puts on the board (`custom.pipeline_board`'s
+         * four-argument door); left out, the whole table this person may see, as before.
+         */
+        filter?: StoreFilter | null;
+    }): Promise<RecordsResult<PipelineColumn[]>>;
+    /** Whether this card may go to that column — asked BEFORE the finger lets go. */
+    pipelineTransitionRefusal(args: {
+        record_id: Uuid;
+        to: string;
+    }): Promise<RecordsResult<PipelineVerdict>>;
+    /**
+     * Move a record to a stage. An ORDINARY record write, judged by the same Rules.
+     *
+     * It answers an OBJECT on every path. A gate whose `on_fail` is `require_approval`
+     * comes back `applied: false` with the wait it filed — the record has NOT moved, and a
+     * screen that treated the call's success as the move's success would show the card in
+     * the wrong column while somebody is still deciding.
+     */
+    pipelineMove(args: {
+        record_id: Uuid;
+        to: string;
+        also?: Record<string, unknown>;
+        expected_version?: number | null;
+    }): Promise<RecordsResult<PipelineMoveResult>>;
+    /**
+     * MOVE MANY CARDS IN ONE CALL (lane S4, `custom.pipeline_move_many`). Each card is judged by
+     * `pipeline_move` exactly as one is, in its own savepoint: a refused card writes nothing and the
+     * others still land. `expected_version` is required per card — a card that changed since the
+     * board loaded answers `changed_since_loaded` and is never overwritten. A refusal of the WHOLE
+     * call (a stranger, an empty batch, more than the `custom/batch_items_max` knob) is the error.
+     */
+    pipelineMoveMany(args: {
+        moves: PipelineMoveManyItem[];
+    }): Promise<RecordsResult<PipelineMoveMany>>;
+    /** Declare (or re-state) a pipeline: the stage column and its transition Rules. */
+    pipelineDeclare(args: {
+        table_id: Uuid;
+        spec: PipelineSpec;
+    }): Promise<RecordsResult<PipelineDeclared>>;
+    /** Which column of this table holds its stage, or null when it is not a board. */
+    tableStageField(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<string | null>>;
+    /** The closed list of what a gate does when it says no — the store is the authority. */
+    stageRuleOnFailKinds(): Promise<RecordsResult<{
+        behaviour: StageRuleOnFail;
+        note: string;
+    }[]>>;
+    /** Whether this organization's gates refuse or warn. One opinion, asked once. */
+    stageRuleEnforcement(): Promise<RecordsResult<StageRuleEnforcement>>;
+    /** What is waiting on this card: approvals filed against its own stage column. */
+    recordStagePending(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<StagePending[]>>;
+    /** The same question for a whole board, in ONE call — what a Kanban badges cards from. */
+    pipelinePending(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<StagePendingOnBoard[]>>;
+    /**
+     * WHAT THIS GATE WOULD DO TO THIS BOARD TODAY — for a gate that has not been saved.
+     *
+     * The settings screen calls it on every edit of the condition, which is why it takes
+     * the gate rather than a rule id: no saved-rule door can answer about a rule that does
+     * not exist yet. The store compiles it with the same compiler `pipelineDeclare` uses,
+     * so the number here and the refusal at the door are the same rule — a preview with its
+     * own compiler would be wrong exactly at the edge of the condition, which is the only
+     * place anybody looks.
+     *
+     * A gate that does not say what it demands is REFUSED, not answered zero: "no cards
+     * would be stopped" beside a half-written rule is the sentence that gets it saved.
+     */
+    pipelineGatePreview(args: {
+        table_id: Uuid;
+        stage: string;
+        gate: PipelineGate | Record<string, unknown>;
+    }): Promise<RecordsResult<PipelineGatePreview>>;
+    /**
+     * SERVER LANE ONLY. `custom.rule_members` walks the whole scope table through the evaluator and
+     * returns STORED rows — no read-access ladder, no masking — so no browser role holds EXECUTE on it
+     * and it answers 42501 from a signed-in seat. A screen reads a Rule's members through
+     * `ruleMembersVisible`.
+     */
+    ruleMembers(args: {
+        rule_id: Uuid;
+    }): Promise<RecordsResult<StoredRecord[]>>;
+    /**
+     * S2-PRIME — THE MEMBERS OF A MEMBERSHIP RULE THIS PERSON MAY SEE, a page at a time
+     * (`custom.rule_members_visible`): the list door asked the Rule's own test, so the rows are the
+     * read door's — the same ladder, masked documents, the same page ceiling.
+     */
+    ruleMembersVisible(args: {
+        rule_id: Uuid;
+        limit?: number;
+        offset?: number;
+    }): Promise<RecordsResult<ReadRow[]>>;
+    /** Is this one record a member, and WHY — the store's own answer. */
+    ruleMembership(args: {
+        rule_id: Uuid;
+        record_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    /** Run a stored Rule against a document. */
+    ruleRun(args: {
+        rule_id: Uuid;
+        values: Record<string, unknown>;
+        context?: Record<string, unknown>;
+    }): Promise<RecordsResult<unknown>>;
+    /** Evaluate a Rule expression that has not been stored — the conditional logic a form runner asks about. */
+    ruleEval(args: {
+        expr: unknown;
+        values: Record<string, unknown>;
+        context?: Record<string, unknown>;
+    }): Promise<RecordsResult<unknown>>;
+    /**
+     * Write ONE Rule as a real Rule. `recordWrite` into the Rule kernel makes a
+     * valid Rule document that carries `data_class = 'record'`, and every reader
+     * that looks for a Rule looks for the class — `custom.agg_subscriptions`
+     * selects `where data_class = 'rule'` — so a subscription written that way
+     * fires at nobody. This is the door that closes it.
+     */
+    /** This organization's forms, with how many answers arrived and how many are in the table. */
+    forms(args?: {
+        table_id?: Uuid | null;
+    }): Promise<RecordsResult<FormSummary[]>>;
+    /**
+     * THIS ORGANIZATION'S BOOKING PAGES (PRODUCTS row 14), with the numbers that make
+     * the list worth opening: how many are booked, cancelled, still ahead, and how many
+     * slots somebody is holding right now. A booking page is an `anon_form`, so it is
+     * opened and closed with `anonPublish` exactly as a form is.
+     */
+    bookings(args?: {
+        table_id?: Uuid | null;
+    }): Promise<RecordsResult<BookingSummary[]>>;
+    /**
+     * CREATE OR RE-STATE ONE BOOKING PAGE over one Table. `admin` on the Table,
+     * because a booking page decides what a stranger may write into it and which
+     * hours of the organization's week are on offer.
+     *
+     * `slot`, `status` and `booked_with` are the store's to fill in: a question
+     * naming any of the three is refused BY NAME, so a page cannot be built that
+     * lets a visitor choose their own status. It does NOT publish — `anonPublish`
+     * is the one act that opens a public surface, for a booking page exactly as
+     * for a form.
+     *
+     * Until 2026-09-21 this door had no client method, so the ONLY way to a
+     * booking page was to ask an agent for one. The agent path is the faster one,
+     * never the only one.
+     */
+    bookingDeclare(args: {
+        table_id: Uuid;
+        title: string;
+        questions: unknown[];
+        availability?: Partial<BookingAvailability> | null;
+        presentation?: Record<string, unknown> | null;
+        submission_cap?: number | null;
+        quarantine_rule_id?: Uuid | null;
+        notify_rule_id?: Uuid | null;
+        form_id?: Uuid | null;
+        slug?: string | null;
+        home_id?: Uuid | null;
+    }): Promise<RecordsResult<BookingDeclared>>;
+    /** Create or re-state one form. A question naming no Field of that Table is refused BY NAME. */
+    formDeclare(args: {
+        table_id: Uuid;
+        title: string;
+        questions: unknown[];
+        presentation?: Record<string, unknown> | null;
+        submission_cap?: number | null;
+        quarantine_rule_id?: Uuid | null;
+        notify_rule_id?: Uuid | null;
+        form_id?: Uuid | null;
+        slug?: string | null;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * WHICH OF A FORM'S QUESTIONS ARE ASKED, given the answers so far — for the OWNER's preview of
+     * a draft (`custom.form_preview_asks`). One row per question in order; `asked` is false only
+     * when the store's own Rule said so. Undecided and unworkable conditions are asked, the second
+     * with the store's sentence in `said`.
+     */
+    formPreviewAsks(args: {
+        table_id: Uuid;
+        questions: unknown[];
+        values: Record<string, unknown>;
+    }): Promise<RecordsResult<Array<{
+        field_key: string;
+        asked: boolean;
+        decided: boolean;
+        said: string | null;
+    }>>>;
+    /**
+     * WHAT A FORM'S LOOK MAY BE, AND WHAT IT WOULD LOOK LIKE (`custom.form_look_options`): the
+     * organization's public pictures (the same list a portal's look offers), the colours, and the
+     * look a stranger would see for the draft `presentation` — the builder's preview draws that.
+     */
+    formLookOptions(args?: {
+        presentation?: Record<string, unknown> | null;
+    }): Promise<RecordsResult<FormLookOptions>>;
+    /**
+     * THE ROUTE THROUGH A DRAFT FORM (`custom.form_preview_route`, lane TYPEFORM-DUP): which questions
+     * are asked given the answers so far (showIf AND logic jumps), the ending reached and the score —
+     * the store's walk, the one the stranger's page and `custom.form_submit` read too.
+     */
+    formPreviewRoute(args: {
+        table_id: Uuid;
+        questions: unknown[];
+        endings?: unknown[] | null;
+        values: Record<string, unknown>;
+    }): Promise<RecordsResult<FormRoute>>;
+    /** A form's results (`custom.form_results`): views, starts, completions, drop-off, answers. */
+    formResults(args: {
+        form_id: Uuid;
+    }): Promise<RecordsResult<FormResults>>;
+    /** TYPEFORM-2: the organization's form knobs (`custom.form_knobs`): owner header, choice auto-advance. */
+    formKnobs(): Promise<RecordsResult<{
+        show_owner_header: boolean;
+        choice_auto_advance: boolean;
+    }>>;
+    /**
+     * What the store makes of a file's columns, before anything is written.
+     * `columns` is `[{header, samples}]` — the first page of the file is plenty.
+     */
+    importPlan(args: {
+        table_id: Uuid;
+        columns: Array<{
+            header: string;
+            samples: unknown[];
+        }>;
+    }): Promise<RecordsResult<ImportPlan>>;
+    /**
+     * Open a run. `file_hash` is the run's IDENTITY: the same bytes into the same
+     * table a second time answer the FIRST run with `already: true` and write
+     * nothing, so a re-import doubles nothing. `force` re-opens deliberately.
+     */
+    importBegin(args: {
+        table_id: Uuid;
+        format?: "csv" | "xlsx";
+        source_name?: string | null;
+        source_columns?: unknown[];
+        file_hash?: string | null;
+        policy?: ImportPolicy;
+        /** A Field key. A row whose value for it is already here is a duplicate. */
+        dedupe_key?: string | null;
+        file_bytes?: number | null;
+        force?: boolean;
+    }): Promise<RecordsResult<ImportOpened>>;
+    /**
+     * IMPORT-2. ADD THE COLUMNS THIS FILE HAS AND THIS TABLE HAS NOT — a step of
+     * its own, BEFORE the run is opened, so the screen can show "8 columns added"
+     * and the person can then name one of them as the file's duplicate key
+     * (`importBegin` refuses a key naming a column that does not exist yet).
+     * Answers the mapping the file should be sent with. Admin on the Table.
+     */
+    importDeclareColumns(args: {
+        table_id: Uuid;
+        rows: Array<Record<string, unknown>>;
+        /** Header -> Field key the person already mapped by hand; never declared. */
+        mapping?: Record<string, string>;
+    }): Promise<RecordsResult<ImportColumnsDeclared>>;
+    /**
+     * One BATCH of rows. The batch is PLANNED and then written as ONE statement
+     * through the batched write door, so 250 round trips became one; a batch a
+     * guard refuses falls back to one write a row, and the answer says which it
+     * was. Send `ImportOpened.rows_per_call` the first time and
+     * `ImportBatchResult.rows_per_call` — measured — every time after that.
+     */
+    importRows(args: {
+        import_id: Uuid;
+        rows: Array<Record<string, unknown>>;
+        /** Header -> Field key. A header that already spells a key needs no entry. */
+        mapping?: Record<string, string>;
+    }): Promise<RecordsResult<ImportBatchResult>>;
+    /**
+     * Close the run and decide the columns the file had and the table did not:
+     * `propose` (the ONE approvals inbox, and the only choice a non-admin has),
+     * `create` (an admin adds them outright) or `ignore`.
+     */
+    importFinish(args: {
+        import_id: Uuid;
+        unmapped?: "propose" | "create" | "ignore";
+    }): Promise<RecordsResult<ImportFinished>>;
+    /** The refused rows, or the ones already here, WITH the source row on each. */
+    importReport(args: {
+        import_id: Uuid;
+        state?: "refused" | "duplicate";
+        limit?: number;
+        offset?: number;
+    }): Promise<RecordsResult<ImportReport>>;
+    /** This organization's import runs, newest first. How you find yesterday's. */
+    imports(args?: {
+        table_id?: Uuid | null;
+        limit?: number;
+    }): Promise<RecordsResult<ImportRun[]>>;
+    /**
+     * Forget the RECEIPT for a file so the same bytes can be imported again
+     * deliberately. Never touches the records that import wrote.
+     */
+    importForget(args: {
+        import_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /**
+     * Give a table its own address. The answer carries `mail_route`: the one
+     * sentence saying what has to exist in DNS before anything arrives. Show it
+     * wherever the address is shown — an address that silently swallows mail is
+     * the failure this whole door is against.
+     */
+    inboundDeclare(args: {
+        table_id: Uuid;
+        label?: string | null;
+    }): Promise<RecordsResult<InboundDeclared>>;
+    inboundAddresses(args?: {
+        table_id?: Uuid | null;
+    }): Promise<RecordsResult<InboundAddress[]>>;
+    inboundSet(args: {
+        inbound_id: Uuid;
+        enabled: boolean;
+    }): Promise<RecordsResult<{
+        inbound_id: Uuid;
+        address: string;
+        enabled: boolean;
+        message: string;
+    }>>;
+    /** Every portal over this organization the caller may know about, with its numbers. */
+    portals(): Promise<RecordsResult<PortalSummary[]>>;
+    /**
+     * The SAME list, archive-aware. `custom.portals` keeps its signature and hides
+     * archived portals, because the archived-items law's default is to hide;
+     * this is the one door that also answers the other lane, so a rail gets the
+     * law's one-click reveal without inventing a second control or a second door.
+     * A fourth word is refused `22023` — there is no fourth answer on any surface.
+     */
+    listPortals(args?: {
+        archived?: PortalArchiveFilter;
+    }): Promise<RecordsResult<PortalSummary[]>>;
+    /**
+     * PUT ONE PORTAL AWAY. Nothing is deleted and there is no purge: every Table
+     * it exposes and every person invited to it is kept exactly as it is, and
+     * `portalRestore` hands it all back. `confirm_title` is the portal's own title
+     * typed back — ten portals can carry one title, so the title is not what picks
+     * this one and the door refuses `23514` when it does not match.
+     */
+    portalArchive(args: {
+        portal_id: Uuid;
+        confirm_title: string;
+        reason?: string | null;
+    }): Promise<RecordsResult<PortalArchiveAnswer>>;
+    /** The way back. Everyone invited signs in exactly as before, and it shows the same Tables. */
+    portalRestore(args: {
+        portal_id: Uuid;
+        confirm_title: string;
+    }): Promise<RecordsResult<PortalArchiveAnswer>>;
+    /**
+     * PUT ONE FORM OR BOOKING PAGE AWAY (`custom.form_archive`, admin on its table). Its address stops
+     * answering; everything it collected is kept. `formRestore` brings it back.
+     */
+    formArchive(args: {
+        form_id: Uuid;
+    }): Promise<RecordsResult<FormArchiveAnswer>>;
+    formRestore(args: {
+        form_id: Uuid;
+    }): Promise<RecordsResult<FormArchiveAnswer>>;
+    /** The archived forms and booking pages, newest first; `table_id` narrows to one table. */
+    formsArchived(args?: {
+        table_id?: Uuid | null;
+        limit?: number;
+    }): Promise<RecordsResult<ArchivedForm[]>>;
+    /**
+     * The archived checklist templates. A template is a record: `recordDelete` archives it and
+     * `recordRestore` brings it back.
+     */
+    checklistTemplatesArchived(args?: {
+        about_table_id?: Uuid | null;
+        limit?: number;
+    }): Promise<RecordsResult<ArchivedChecklistTemplate[]>>;
+    /** What a table's NEW rows start with (Shown to, and the web half once it lands). */
+    tableRowDefaults(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<TableRowDefaults>>;
+    /** Set them (the table's maker or an admin of it). A key left out is left alone; null = the default. */
+    tableRowDefaultsSet(args: {
+        table_id: Uuid;
+        defaults: TableRowDefaultsPatch;
+    }): Promise<RecordsResult<TableRowDefaults>>;
+    /**
+     * ONE PASS of "apply to existing rows": rows nobody set by hand follow the table's defaults.
+     * `done: false` → call again with `after: next_after`. `rowDefaultsApplyAll` walks every pass.
+     */
+    tableRowDefaultsApply(args: {
+        table_id: Uuid;
+        after?: Uuid | null;
+    }): Promise<RecordsResult<RowDefaultsApplied>>;
+    /** Every pass of `tableRowDefaultsApply`, summed; the last pass's sentence when it took one pass. */
+    rowDefaultsApplyAll(args: {
+        table_id: Uuid;
+        maxPasses?: number;
+    }): Promise<RecordsResult<RowDefaultsApplied>>;
+    /** One row's Shown to (and web half), with who may change it. */
+    recordRowControls(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<RecordRowControls>>;
+    recordRowControlsSet(args: {
+        record_id: Uuid;
+        controls: {
+            shown_to?: string | null;
+            published_to_web?: boolean;
+            indexed?: boolean | null;
+        };
+    }): Promise<RecordsResult<RecordRowControls>>;
+    /**
+     * Which Tables each portal of this organization exposes.
+     *
+     * The one question a TABLE-scoped Portals rail has to ask: "is the table I
+     * am standing on in any portal?" Same wall and same read-access gate as
+     * `portals`, so a pair here is always a portal `portals` also returned.
+     */
+    portalTables(): Promise<RecordsResult<PortalTableRef[]>>;
+    /** ONE portal in full: what it shows, and who it was opened to. */
+    portalCard(args: {
+        portal_id: Uuid;
+    }): Promise<RecordsResult<PortalCard>>;
+    /**
+     * Create or RE-STATE one portal. Re-stating REPLACES what it exposes — a
+     * Table left out of `tables` stops being exposed in the same act — and leaves
+     * the people alone: who is invited is not part of what the portal shows.
+     */
+    portalDeclare(args: {
+        title: string;
+        client_table_id: Uuid;
+        tables: Array<{
+            table_id: Uuid;
+            names_via: string;
+            visible_fields?: string[];
+            editable_fields?: string[];
+            comments?: boolean;
+        }>;
+        portal_id?: Uuid | null;
+        slug?: string | null;
+        sign_in_method?: string | null;
+        /**
+         * S6 — the portal's own look and its forms. A key given REPLACES that key; a key not given
+         * is KEPT (leave `config` out and both stay exactly as they are). The store judges it and
+         * refuses by name: a logo that is not a public picture of this organization's Files, an
+         * accent that is not a design-system colour name, a form whose Table the portal does not show.
+         */
+        config?: PortalConfigInput | null;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * S6 — THE CLIENT'S SIDE: one form of HER portal (`custom.portal_form`). Refused unless the
+     * caller is a live principal of that live portal and the form is on its list; the Field that
+     * names the client is never one of the questions — the portal fills it.
+     */
+    portalForm(args: {
+        portal_id: Uuid;
+        form_id: Uuid;
+    }): Promise<RecordsResult<PortalFormSpec>>;
+    /**
+     * S6 — send one form of her portal (`custom.portal_form_submit`). The store fills the Field
+     * that names the client with her own record, and the answer reaches her own list at once
+     * (`accepted`) or waits for the office (`held`, with the store's sentence). `client_key`
+     * makes a retry the same submission.
+     */
+    portalFormSubmit(args: {
+        portal_id: Uuid;
+        form_id: Uuid;
+        answers: Record<string, unknown>;
+        client_key?: string | null;
+    }): Promise<RecordsResult<PortalFormAnswer>>;
+    /**
+     * Invite one person, as one record of the portal's client Table.
+     *
+     * `user_id` is deliberately NOT a parameter here. From a screen it is always
+     * null: an invitation confers NOTHING until the person follows their sign-in
+     * link and the platform gives them an identity, and the door's own `say`
+     * sentence states exactly that. A screen that passed an id would be granting
+     * access on somebody else's behalf.
+     */
+    portalInvite(args: {
+        portal_id: Uuid;
+        client_record_id: Uuid;
+        email: string;
+    }): Promise<RecordsResult<PortalInvitation>>;
+    /** Take one person's way in away. The answer's `say` names the consequence. */
+    portalRevoke(args: {
+        portal_id: Uuid;
+        principal_id: Uuid;
+    }): Promise<RecordsResult<PortalRevocation>>;
+    /**
+     * VIEW AS THIS CLIENT. The door asks `custom.visible_set` for HER user id —
+     * the same call `custom.read_records` makes when she opens the page — so this
+     * cannot disagree with what she sees. It REFUSES with `02000` and a sentence
+     * when she has not signed in yet; show the sentence, never an empty list.
+     */
+    portalPreview(args: {
+        portal_id: Uuid;
+        principal_id: Uuid;
+        table_id: Uuid;
+    }): Promise<RecordsResult<PortalPreviewRow[]>>;
+    /** This organization's dashboards, optionally only those whose subject is one Table. */
+    dashboards(args?: {
+        table_id?: Uuid | null;
+    }): Promise<RecordsResult<DashboardSummary[]>>;
+    /**
+     * Create or re-state one dashboard. Every block is judged on the way IN —
+     * a block naming a field this Table does not have is refused BY NAME, with
+     * the table's own field list in the hint — so a canvas cannot be saved broken.
+     */
+    dashboardDeclare(args: {
+        table_id: Uuid;
+        name: string;
+        blocks?: DashboardBlock[];
+        presentation?: Record<string, unknown> | null;
+        dashboard_id?: Uuid | null;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * Run every block and answer the numbers. `filter` is the ONE filter bar
+     * across the canvas: it is merged UNDER each block's own filter, so a block
+     * deliberately scoped to one stage stays scoped while the bar moves the rest.
+     * A block that refuses carries the store's sentence and the others still answer.
+     */
+    dashboardRun(args: {
+        dashboard_id: Uuid;
+        filter?: RecordFilter;
+        /**
+         * S3 — compare every block that does not carry its own comparison (the
+         * block's own wins, as its own filter does). A block with no date to
+         * compare along answers alone and says so in `compare_refused`.
+         */
+        compare?: AggregateCompare | null;
+        /** S3 — re-cut every bucketed block to one date grain (the canvas's picker). */
+        grain?: AggregateBucket | null;
+    }): Promise<RecordsResult<DashboardRunResult>>;
+    /** The seventh block kind on its own: records that have sat on the same value too long. */
+    dashboardStuck(args: {
+        table_id: Uuid;
+        state_key: string;
+        days?: number;
+        filter?: RecordFilter;
+        limit?: number;
+    }): Promise<RecordsResult<StuckRow[]>>;
+    /**
+     * Declare or re-state a crew capture sheet over a Table. Admin on the Table.
+     * Closed to the crew until `capturePublish`, like every publishing act here.
+     */
+    captureSheetDeclare(args: {
+        table_id: Uuid;
+        title: string;
+        questions: Array<Record<string, unknown>>;
+        presentation?: Record<string, unknown> | null;
+        sheet_id?: Uuid | null;
+        notify_rule_id?: Uuid | null;
+    }): Promise<RecordsResult<Uuid>>;
+    /** Open the sheet to the crew, or close it. Admin on the Table. */
+    capturePublish(args: {
+        sheet_id: Uuid;
+        open?: boolean;
+    }): Promise<RecordsResult<string | null>>;
+    /** The crew sheets of this organization, with what has come in through each. */
+    captureSheets(args?: {
+        table_id?: Uuid | null;
+    }): Promise<RecordsResult<CaptureSheetSummary[]>>;
+    /**
+     * Everything a phone needs to run one sheet OFFLINE — the questions, the Fields
+     * with their ids and parity types, and an honest `may_capture` with a sentence.
+     * Load it once on a signal; it is the last network call before the walk.
+     */
+    captureOpen(args: {
+        sheet_id: Uuid;
+    }): Promise<RecordsResult<CaptureSheetFace | null>>;
+    /**
+     * One capture: the answers, the file references, the device, the moment the phone
+     * took it and the place. Idempotent on `client_key`, which the PHONE mints when
+     * the capture is taken, offline, before its first attempt — send the same key on
+     * every retry and the answer comes back `replay: true` with the first record's id.
+     */
+    captureSubmit(args: {
+        sheet_id: Uuid;
+        client_key: string;
+        answers: Record<string, unknown>;
+        files?: CaptureFileRef[];
+        device?: string | null;
+        captured_at?: string | null;
+        location?: Record<string, unknown> | null;
+    }): Promise<RecordsResult<CaptureOutcome | null>>;
+    /** Every agent-owned column, with how many cells are filled, stale or pinned, and what it has cost. */
+    enrichments(args?: {
+        table_id?: Uuid | null;
+    }): Promise<RecordsResult<EnrichmentSummary[]>>;
+    /**
+     * Define, change or TURN ON an Enrichment on one Field. Admin on the Table.
+     * `{enabled: true}` on its own turns an existing one on without resetting it —
+     * and turning it on is what authorises every value it writes afterwards.
+     */
+    enrichDeclare(args: {
+        field_id: Uuid;
+        spec: Record<string, unknown>;
+    }): Promise<RecordsResult<EnrichDeclared>>;
+    /**
+     * The rows that need this column filled in, each with what the instruction may
+     * read. A cell somebody pinned is never returned. This is what a PREVIEW shows
+     * before anybody enables anything.
+     */
+    enrichDue(args: {
+        field_id: Uuid;
+        limit?: number;
+        include_fresh?: boolean;
+    }): Promise<RecordsResult<EnrichDueRow[]>>;
+    /**
+     * THE BADGE DATA FOR A WHOLE PAGE, in one call. Who wrote each value, when, out
+     * of what source, its candidates, whether a person pinned it and whether it is
+     * past its freshness date. Asked per cell this would be one round trip per badge.
+     */
+    enrichCells(args: {
+        table_id: Uuid;
+        field_keys?: string[] | null;
+        record_ids?: Uuid[] | null;
+    }): Promise<RecordsResult<EnrichCell[]>>;
+    /** Hold one cell against the model that fills its column, or hand it back. */
+    enrichPin(args: {
+        record_id: Uuid;
+        field_key: string;
+        pinned?: boolean;
+    }): Promise<RecordsResult<{
+        pinned: boolean;
+        says: string;
+    }>>;
+    /** What this column has cost, run by run. */
+    enrichRuns(args?: {
+        field_id?: Uuid | null;
+        limit?: number;
+    }): Promise<RecordsResult<EnrichRun[]>>;
+    /** Take a dashboard away. The records it counted are untouched — a canvas owns nothing. */
+    dashboardDelete(args: {
+        dashboard_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /**
+     * Group, bucket, filter and measure INSIDE `custom.record_aggregate`. The
+     * aggregate node sits above the read-access join, so what a chart draws is
+     * exactly what this person may see — the rest is never fetched, let alone
+     * summed and then hidden.
+     */
+    recordAggregate(args: {
+        table_id: Uuid;
+        /**
+         * OPTIONAL FILTER (active-org law): with `config.organizationIds` set, the table is looked
+         * up across all the person's organizations and the aggregate runs in the one that OWNS it
+         * (each row then carries that `organization_id`); this narrows the lookup to one. Absent and
+         * no `organizationIds` ⇒ this client's own organization, exactly as before.
+         */
+        organization_id?: Uuid | null;
+        /** Field keys whose values become the groups. */
+        groupBy?: string[];
+        /** `count` needs no key; every other operation reads one Field. */
+        measures?: AggregateMeasure[];
+        /** A date Field truncated to a period — a group whose expression is a date_trunc. */
+        bucket?: {
+            key: string;
+            by: AggregateBucket;
+        } | null;
+        /**
+         * A scalar is an equality and an object is a half-open moment window, and
+         * either way it lands in the SAME WHERE as read access.
+         */
+        filter?: StoreFilter;
+        limit?: number;
+        /**
+         * S3 — answer the same question over a prior window too (previous period,
+         * same period last year, or a fixed baseline). Each row then carries
+         * `prior_measures`, `delta` and the two `compare` windows. Buckets are cut
+         * in the organization's calendar (knobs `custom/time_zone`, `custom/week_start`).
+         */
+        compare?: AggregateCompare | null;
+        /**
+         * The grid's search, narrowing the answer to the rows `listPage`'s search would show (the
+         * same predicate, `custom.record_search_sql`). Blank or absent: nothing changes.
+         */
+        search?: string | null;
+        /** The reader's time zone for the search's date matches (absent = the organization's calendar). */
+        time_zone?: string | null;
+    }): Promise<RecordsResult<AggregateRow[]>>;
+    /** Historical aggregate computed by the store at its recorded-time read door. */
+    recordAggregateAsOf(args: {
+        table_id: Uuid;
+        recorded_at: string;
+        measure?: string;
+        field_key?: string | null;
+        group_by?: string | null;
+        match?: Record<string, unknown>;
+    }): Promise<RecordsResult<Array<{
+        bucket: string | null;
+        result: number | null;
+        row_count: number;
+        not_numbers: number;
+        a_non_number: string | null;
+    }>>>;
+    /** The measures the store itself offers. Asked, never hardcoded in a picker. */
+    aggOperations(): Promise<RecordsResult<string[]>>;
+    /** The periods the store itself buckets by. */
+    aggBuckets(): Promise<RecordsResult<string[]>>;
+    /**
+     * The organization's calendar (knobs `custom/time_zone`, `custom/week_start`), cut by the SAME door the
+     * relative date filters and the chart buckets use. A calendar or timeline reads its first day of the week
+     * from here, never from a constant of its own (lane NOTION-SMALL-4).
+     */
+    aggCalendar(): Promise<RecordsResult<{
+        time_zone: string;
+        week_start: string;
+    }>>;
+    /**
+     * A source's drill definition — its Dimensions, Measures, drill paths and first screen.
+     * `{kind: "table", id}` is a custom Table; `{kind: "entity", token}` a standard table by its
+     * registry token or a declared definition by its key.
+     */
+    drillDescribe(args: {
+        source: DrillSource;
+    }): Promise<RecordsResult<DrillDefinition>>;
+    /**
+     * Ask a source a question: grouped, bucketed (day…year in the organization's calendar),
+     * compared, pivoted. A standard table is counted AS THE PERSON (its own row security decides
+     * every row); groups past the cap fold into one Other row and the total row says so.
+     */
+    drillAsk(args: {
+        source: DrillSource;
+        question?: DrillQuestion;
+    }): Promise<RecordsResult<DrillAnswer>>;
+    /** The records behind a number, through the same filter, read as the person. */
+    drillRows(args: {
+        source: DrillSource;
+        where?: DrillQuestion["where"];
+        window?: DrillQuestion["window"];
+        sort?: DrillQuestion["sort"];
+        lane?: DrillQuestion["lane"];
+        columns?: string[];
+        limit?: number;
+        offset?: number;
+        /** The viewer's search term, asked of the door (`platform._drill_compile` reads `question.search`). */
+        search?: string;
+    }): Promise<RecordsResult<DrillRowsPage>>;
+    /**
+     * Every subscription in this organization, optionally narrowed to one saved
+     * view or one cadence. There is no subscription table: each one is a Rule
+     * record carrying a `subscription` block, so a subscription is readable,
+     * historied and agent-writable like anything else.
+     */
+    aggSubscriptions(args?: {
+        saved_view_id?: Uuid | null;
+        cadence?: string | null;
+    }): Promise<RecordsResult<Subscription[]>>;
+    /** The cadences the store itself offers. Asked, never hardcoded in a picker. */
+    aggSubscriptionCadences(): Promise<RecordsResult<string[]>>;
+    /**
+     * The same cadences, through the door a PERSON may call.
+     * `aggSubscriptionCadences` is the notifier's own and holds no client grant,
+     * so a screen that asked for it was refused and fell back to a list typed
+     * into the picker — which drifts from what the digest runner honours. This
+     * one delegates to the same array, so there is exactly one list.
+     */
+    subscriptionCadences(): Promise<RecordsResult<string[]>>;
+    /**
+     * WHAT THIS PERSON IS BEING TOLD ABOUT, and what they may switch off.
+     *
+     * Mine, plus anyone's over a Table I hold admin on — narrowed to Tables I can
+     * already open, so the list never reveals one. `aggSubscriptions` above is the
+     * NOTIFIER's reader and no client can call it; this is the owner's.
+     */
+    subscriptions(args?: {
+        table_id?: Uuid | null;
+    }): Promise<RecordsResult<MySubscription[]>>;
+    /**
+     * Switch one on or off. Muting is honoured in ONE place — the reader every
+     * consumer goes through — so a screen can never say a subscription is off
+     * while it keeps firing.
+     */
+    subscriptionMute(args: {
+        rule_id: Uuid;
+        muted: boolean;
+    }): Promise<RecordsResult<boolean>>;
+    /**
+     * WRITE ONE. The store refuses a cadence no runner acts on, a channel this
+     * platform does not send on and quiet hours nobody can parse — by name — then
+     * declares the Rule through `rule_declare`, because a Rule written as a record
+     * carries `data_class = 'record'` and every reader that goes looking for a Rule
+     * steps straight past it (REC-72).
+     */
+    subscriptionDeclare(args: {
+        table_id: Uuid;
+        spec: SubscriptionSpec;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * SHOW ME ONE NOW. The summary this subscription would send at this moment, with
+     * what entered, left and changed NAMED. It assembles only: nothing is delivered,
+     * nothing is recorded and the watermark does not move.
+     */
+    subscriptionPreview(args: {
+        rule_id: Uuid;
+    }): Promise<RecordsResult<DigestPreview>>;
+    /**
+     * THE SAVED VIEWS OF A TABLE — what a subscription may be written over. Narrowed
+     * in SQL as the definer to Tables this caller can already open, so the list can
+     * never reveal a Table.
+     */
+    views(args?: {
+        table_id?: Uuid | null;
+    }): Promise<RecordsResult<SavedViewRow[]>>;
+    /**
+     * SAVE ONE VIEW. VIEWER on the Table, not editor: writing down a question about a
+     * Table is not changing it, and requiring editor would mean the people who read a
+     * Table could not subscribe to anything in it.
+     */
+    viewDeclare(args: {
+        table_id: Uuid;
+        spec: SavedViewSpecIn;
+    }): Promise<RecordsResult<Uuid>>;
+    /** A Table's row templates ("New from template"). VIEWER on the Table. */
+    rowTemplates(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<RowTemplateRow[]>>;
+    /**
+     * SAVE ONE ROW TEMPLATE — `{name, values}` by Field key; the same name again changes it, and
+     * `{template_id, archived: true}` archives it. EDITOR on the Table: it is how everyone's new rows start.
+     */
+    rowTemplateDeclare(args: {
+        table_id: Uuid;
+        spec: {
+            name?: string;
+            values?: Record<string, unknown>;
+            template_id?: Uuid;
+            archived?: boolean;
+        };
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * DESIGNATE HOW A TABLE OPENS — "Make this the default". EDITOR on the Table: the named view
+     * becomes the table's only default and, when `layout` is given, that is the layout everyone opens
+     * it in. A layout press never designates (`viewDeclare` refuses the default view's layout and
+     * is_default by name — VIEW-SWITCH-NOT-DESIGNATION, VERIFIER-21).
+     */
+    viewDesignate(args: {
+        table_id: Uuid;
+        view_id: Uuid;
+        layout?: string | null;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * ARCHIVE ONE SAVED VIEW (lane TABLE-ACTIONS, T3.5). The soft delete of the `platform.saved_view`
+     * row behind it — `public.saved_view_archive('custom/records', id)`, which asks its own ladder
+     * (the view's creator, or admin on the view) and clears a default it held. The records are
+     * untouched. `null` when the view was already gone. `viewRestore` (or Trash) brings it back.
+     */
+    viewArchive(args: {
+        view_id: Uuid;
+    }): Promise<RecordsResult<Record<string, unknown> | null>>;
+    /** PUT AN ARCHIVED VIEW BACK — the platform's one restore door, `public.entity_undelete('platform_saved_view', id)`. */
+    viewRestore(args: {
+        view_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /**
+     * THE CALLER'S OWN LOOK AT EACH SAVED VIEW OF A TABLE — `{ "<view id>": { look, updated_at } }`.
+     * A look is the view settings one person chose while looking (a board's grouping, a calendar's
+     * date field, a sort, a filter, hidden columns, widths, the layout), kept for her alone until an
+     * editor saves it onto the view with `viewDeclare` ("Save to view"). Viewer on the Table.
+     */
+    viewLookRead(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<Record<string, {
+        look: Record<string, unknown>;
+        updated_at: string;
+    }>>>;
+    /**
+     * KEEP THE CALLER'S OWN LOOK AT ONE VIEW — the whole look, as definition keys (`group_field`,
+     * `date_field`, `sorts`, `where`, `presentation`, `layout`, …; a key set to null hides the view's
+     * own). `look: null` is "Reset to view". The shared view row is never written. Answers the look
+     * as kept (null after a reset).
+     */
+    viewLookSet(args: {
+        table_id: Uuid;
+        view_id: Uuid;
+        look: Record<string, unknown> | null;
+    }): Promise<RecordsResult<Record<string, unknown> | null>>;
+    docTemplateSave(args: {
+        table_id: Uuid;
+        name: string;
+        body: string;
+        template_id?: Uuid | null;
+    }): Promise<RecordsResult<Uuid>>;
+    /** The body with every token resolved against one record. Read-only, no render row. */
+    docRenderBody(args: {
+        template_id: Uuid;
+        record_id: Uuid;
+    }): Promise<RecordsResult<string>>;
+    /** Write the render — frozen bytes a signature can be checked against. */
+    docRenderDocument(args: {
+        template_id: Uuid;
+        record_id: Uuid;
+    }): Promise<RecordsResult<Uuid>>;
+    /** Every token in a body, in order, with the Field id each one points at. */
+    docTokens(args: {
+        body: string;
+    }): Promise<RecordsResult<DocToken[]>>;
+    /** The tokens this Table cannot answer, each with the store's own reason. */
+    docUnresolvedTokens(args: {
+        table_id: Uuid;
+        body: string;
+    }): Promise<RecordsResult<DocUnresolvedToken[]>>;
+    docSign(args: {
+        render_id: Uuid;
+        field_key: string;
+        signer_name: string;
+        signer_user_id?: Uuid | null;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * One signature: the seal AND whether what was signed is still what is there.
+     * The store answers both, in one call, never the screen. Viewer on the record.
+     */
+    docSignatureRead(args: {
+        signature_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    /** Every template that renders one Table. Viewer on the Table. */
+    docTemplates(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<DocTemplateRow[]>>;
+    /**
+     * Retire one template. EDITOR on the Table it renders, because a template is
+     * that Table's wording. Documents already rendered keep their frozen bytes
+     * and their seals, so this can never invalidate a signature.
+     */
+    docTemplateDelete(args: {
+        template_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /** Every frozen render of one record, newest first. Viewer on the record. */
+    docRenders(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<DocRenderRow[]>>;
+    /** Every signature on one record. Viewer on the record. */
+    docSignatures(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<DocSignatureRow[]>>;
+    /**
+     * DOOR-11. One record's revisions, newest first. The read door answers
+     * documents and deliberately not versions, so a screen that wants to save
+     * optimistically reads the version of the record it LOADED from here — for
+     * the one record being edited, never for a list.
+     */
+    revisions(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<RecordRevision[]>>;
+    /**
+     * PRODUCTS row 4. One record's version list, newest first: who (a person, or
+     * an agent AND the person it acted for), when, the operation in the word
+     * somebody used, and every field that moved with its before, its after, the
+     * Rule version that produced a derived value and its source pointer. Viewer
+     * on the record — reading how something got to be the way it is is reading.
+     */
+    recordHistory(args: {
+        record_id: Uuid;
+        limit?: number;
+        offset?: number;
+    }): Promise<RecordsResult<RecordHistoryEntry[]>>;
+    /**
+     * AGT-N-9 — EVERYTHING A CHAT OPENED ON THIS RECORD MAY KNOW, IN ONE ROUND TRIP.
+     *
+     * The Fields with their `(record, field, value version)` triples, the relations one hop
+     * out, the history, the comments and the Table's other records — assembled INSIDE the
+     * database, every piece through the read door, under this person's own field-level
+     * security. A Field the store masks comes back in `withheld` with the store's own
+     * sentence and no value; a Field the organization keeps out of conversations comes back
+     * there too, saying which of the two it is.
+     */
+    recordScopeContext(args: {
+        record_id: Uuid;
+        relations?: number;
+        history?: number;
+        siblings?: number;
+    }): Promise<RecordsResult<RecordScopeContext>>;
+    /** What is this conversation about? */
+    conversationScope(args: {
+        conversation_id: Uuid;
+    }): Promise<RecordsResult<ConversationScope>>;
+    /** Point a conversation at one record. Refused unless this person may open it. */
+    conversationScopeBind(args: {
+        conversation_id: Uuid;
+        record_id: Uuid;
+    }): Promise<RecordsResult<ConversationScope>>;
+    /** This conversation is no longer about a particular record. */
+    conversationScopeUnbind(args: {
+        conversation_id: Uuid;
+    }): Promise<RecordsResult<ConversationScope>>;
+    /** The binding AND the context of a bound conversation, in one round trip. */
+    conversationScopeContext(args: {
+        conversation_id: Uuid;
+        relations?: number;
+        history?: number;
+        siblings?: number;
+    }): Promise<RecordsResult<ConversationScopeContext>>;
+    /**
+     * "Who changed the price on ANY record?" One column's history across a whole
+     * Table, narrowed to the records this person may see by a predicate in the
+     * same statement. A column that names no Field is refused BY NAME, never
+     * answered empty.
+     */
+    fieldHistory(args: {
+        table_id: Uuid;
+        field_key: string;
+        limit?: number;
+        offset?: number;
+        record_id?: Uuid;
+    }): Promise<RecordsResult<FieldHistoryEntry[]>>;
+    /**
+     * WHAT A RESTORE WOULD CHANGE, BEFORE IT DOES. Editor on the record: this is
+     * the first half of an act, and somebody who may not perform it is not shown
+     * its preview. Pass `field_key` for one column.
+     */
+    restorePreview(args: {
+        record_id: Uuid;
+        version: number;
+        field_key?: string;
+    }): Promise<RecordsResult<RestorePreview>>;
+    /** Put the whole record back to a version, as a NEW version. Editor. */
+    restoreVersion(args: {
+        record_id: Uuid;
+        version: number;
+    }): Promise<RecordsResult<RestoreResult>>;
+    /** Put ONE column back to what it said at a version, as a NEW version (HIS-N-2). Editor. */
+    valueRestore(args: {
+        record_id: Uuid;
+        field_key: string;
+        version: number;
+    }): Promise<RecordsResult<RestoreResult>>;
+    /**
+     * SCR-18. The record's comment thread with everybody named, plus what THIS
+     * person may do in it — decided by the store, in the same call, so a screen
+     * never draws a composer the write door will refuse.
+     */
+    commentThread(args: {
+        record_id: Uuid;
+        include_resolved?: boolean;
+    }): Promise<RecordsResult<CommentThreadRead>>;
+    /**
+     * Write a comment at the `commenter` rung, optionally naming people. A
+     * mention is a reference and not a regex over the body: the ids come from the
+     * picker and the store refuses one who is not in the organization, or who
+     * cannot open the record — because that notification would be a dead end.
+     */
+    commentWrite(args: {
+        record_id: Uuid;
+        body: string;
+        field_key?: string;
+        parent_comment_id?: Uuid;
+        mentions?: Uuid[];
+    }): Promise<RecordsResult<CommentWritten>>;
+    /** Resolve (or re-open) a thread. `commenter` — resolution is not a delete. */
+    commentResolve(args: {
+        comment_id: Uuid;
+        resolved?: boolean;
+    }): Promise<RecordsResult<boolean>>;
+    /**
+     * Every value of one record WITH its envelope — its own version, who wrote
+     * it, who they were acting for and when. The timeline IS the record (REC-19);
+     * there is no second history table.
+     */
+    recordValuesVersioned(args: {
+        record_id: Uuid;
+        organization_id?: Uuid | null;
+    }): Promise<RecordsResult<ReadValue[]>>;
+    /**
+     * Metadata search across EVERY organization the person belongs to (`config.organizationIds`;
+     * `organization_id` narrows to one): the Tables and Fields whose name, key, label or description
+     * holds `text` (case-insensitive; structure, never rows). Each match is `{id, kind: "table" |
+     * "field", name, description, organization_id}` (a Field adds `key`, `table_id`, `field_type`).
+     * An organization whose read door refuses is listed in `unavailable` WITH its reason and
+     * never hides the rest. Only when NO organization answers is the whole search a failure (the
+     * first refusal).
+     */
+    metadataSearch(args: {
+        text: string;
+        organization_id?: Uuid | null;
+    }): Promise<RecordsResult<MetadataSearchAnswer>>;
+    /**
+     * WHICH of the person's organizations can this client use right now? Asks every organization
+     * in scope (`organization_id` narrows to one) whether its record store is open, so a host can
+     * say "organization X is unavailable: <reason>" instead of silently dropping it. Organization
+     * order is the person's own, never completion order.
+     */
+    organizationsOpen(args?: {
+        organization_id?: Uuid | null;
+    }): Promise<RecordsResult<OrganizationsOpenAnswer>>;
+    /**
+     * The organization that OWNS a table or record — the one a write to it must run in. A
+     * `table_id` is looked up across all the person's organizations; a `record_id` is opened in its
+     * own. `null` = found in none of them. Never a permission: the store's doors still decide.
+     */
+    ownerOrganization(args: {
+        table_id?: Uuid | null;
+        record_id?: Uuid | null;
+        organization_id?: Uuid | null;
+    }): Promise<RecordsResult<Uuid | null>>;
+    /**
+     * Mint an embed token. `mode` is `read` OR `write` and never both — the store
+     * refuses a token carrying two decisions. The secret comes back ONCE, because
+     * only its digest is stored: a database read cannot produce a working token.
+     * `allowedOrigins` is required and matched EXACTLY, so `example.com.evil.test`
+     * fails a check that a suffix match would pass.
+     */
+    anonTokenIssue(args: {
+        mode: "read" | "write";
+        allowedOrigins: string[];
+        formId?: Uuid | null;
+        savedViewId?: Uuid | null;
+        recordId?: Uuid | null;
+        expiresAt?: Timestamp | null;
+    }): Promise<RecordsResult<{
+        token_id: Uuid;
+        secret: string;
+    }>>;
+    /** What a secret is good for, from an origin. The store's sentence when it is not. */
+    anonTokenVerify(args: {
+        secret: string;
+        origin: string;
+        requiredMode?: "read" | "write" | null;
+    }): Promise<RecordsResult<AnonTokenBinding>>;
+    anonTokenRevoke(args: {
+        token_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /**
+     * A STRANGER'S WRITE. The token supplies the organization, so this call names
+     * none — and what it produces is a QUARANTINED SUBMISSION, not a record:
+     * `custom.record` is never touched here. `clientKey` makes a replay free and
+     * idempotent, which is what lets a flaky phone retry safely.
+     */
+    anonWrite(args: {
+        secret: string;
+        origin: string;
+        payload: Record<string, unknown>;
+        clientKey?: string | null;
+        rawPayload?: Record<string, unknown>;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * SCR-30, and it is the SIGNED-IN offline path, not the stranger's. The client
+     * mints `clientKey` BEFORE the first attempt, offline, and the store's own
+     * replay ledger dedupes on it — so a reconnect that fires the same capture
+     * thirty times writes one record and returns the same id every time.
+     */
+    anonCapture(args: {
+        table_id: Uuid;
+        clientKey: string;
+        payload: Record<string, unknown>;
+        device?: string | null;
+        capturedAt?: Timestamp | null;
+    }): Promise<RecordsResult<Uuid>>;
+    /** Open or close a form to strangers. An admin act on the Table, never an editor one. */
+    anonPublish(args: {
+        form_id: Uuid;
+        published?: boolean;
+    }): Promise<RecordsResult<Timestamp | null>>;
+    /**
+     * What is wrong with a checklist somebody is writing, in the words they would
+     * use. `null` means it is fine. Pure — it reads no row and writes nothing —
+     * so an editor may ask it on every keystroke and the refusal arrives BEFORE
+     * the save rather than after it.
+     */
+    checklistRefusal(args: {
+        spec: ChecklistSpec;
+    }): Promise<RecordsResult<string | null>>;
+    /**
+     * Store a checklist, whole: ordered steps, who each belongs to by role, how
+     * many days in each is due, what each waits for, what each asks for, and what
+     * starts a run. Pass `template_id` to change the checklist that already
+     * exists rather than making a second one.
+     */
+    checklistDeclare(args: {
+        spec: ChecklistSpec;
+        template_id?: Uuid | null;
+    }): Promise<RecordsResult<ChecklistDeclared>>;
+    checklistTemplates(args?: {
+        about_table_id?: Uuid | null;
+        limit?: number;
+    }): Promise<RecordsResult<ChecklistTemplateSummary[]>>;
+    checklistTemplateShape(args: {
+        template_id: Uuid;
+    }): Promise<RecordsResult<ChecklistTemplateShape>>;
+    /**
+     * Run a checklist for one record: one work item per step in the ONE work
+     * layer, assigned by role to real people, dated from the offsets,
+     * dependencies carried across. `roles` names who stands in each role for THIS
+     * run, over whatever the checklist says by default.
+     */
+    checklistStart(args: {
+        template_id: Uuid;
+        about_record_id?: Uuid | null;
+        roles?: Record<string, Uuid>;
+        startingAt?: Timestamp | null;
+    }): Promise<RecordsResult<ChecklistRunStarted>>;
+    checklistRun(args: {
+        run_id: Uuid;
+    }): Promise<RecordsResult<ChecklistRunStep[]>>;
+    checklistRuns(args?: {
+        about_table_id?: Uuid | null;
+        about_record_id?: Uuid | null;
+        includeClosed?: boolean;
+        limit?: number;
+    }): Promise<RecordsResult<ChecklistRunSummary[]>>;
+    /**
+     * Tick a step off with whatever it asked for. Refused by name while a step it
+     * waits for is open, or while what it asks for is missing — and the same
+     * refusal meets `workSetState`, because the rule lives in the store and not
+     * in this door.
+     */
+    checklistStepComplete(args: {
+        step_id: Uuid;
+        evidence?: Record<string, unknown>;
+    }): Promise<RecordsResult<ChecklistStepCompleted>>;
+    /** Why this step cannot be finished right now. `null` means it can. */
+    checklistStepRefusal(args: {
+        step_id: Uuid;
+    }): Promise<RecordsResult<string | null>>;
+    /** The five states and what each one may become. Asked, never hardcoded in a picker. */
+    workStates(): Promise<RecordsResult<WorkState[]>>;
+    /** Why this graph would be refused — asked BEFORE it is written. `null` means it is fine. */
+    workTemplateRefusal(args: {
+        graph: WorkGraph;
+    }): Promise<RecordsResult<string | null>>;
+    workTemplateDeclare(args: {
+        name: string;
+        graph: WorkGraph;
+    }): Promise<RecordsResult<Uuid>>;
+    /**
+     * REC-70: the WHOLE graph is created in one act, judged before any of it is
+     * written, so a half-made checklist is not a state this store can be in.
+     */
+    workTemplateInstantiate(args: {
+        template_id: Uuid;
+        overrides?: Record<string, Record<string, unknown>>;
+    }): Promise<RecordsResult<WorkInstantiation>>;
+    workTemplateShape(args: {
+        template_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    workInstantiationShape(args: {
+        instantiation_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    /** Whose turn each record is, with its state and whether that state is terminal. */
+    workWhoseTurn(args: {
+        table_id: Uuid;
+        includeFinished?: boolean;
+    }): Promise<RecordsResult<WorkTurn[]>>;
+    /** Does this Table carry assignment at all? A screen asks before it offers one. */
+    workHasAssignment(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /** The Fields assignment is made of, so nothing here invents a column name. */
+    workAssignmentFields(args?: {
+        options_table_id?: Uuid | null;
+    }): Promise<RecordsResult<WorkAssignmentField[]>>;
+    /** Add assignment to a Table. */
+    workTakeAssignment(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    /** Why this move would be refused. `null` means it is allowed. */
+    workTransitionRefusal(args: {
+        from_state_id: Uuid;
+        to_state_id: Uuid;
+    }): Promise<RecordsResult<string | null>>;
+    /** Declare the Table slots are held in. Idempotent — a second call finds the first. */
+    workSlotsDeclare(args: {
+        name: string;
+        slug: string;
+        homeId?: Uuid | null;
+    }): Promise<RecordsResult<unknown>>;
+    /**
+     * SCR-29. Take a slot for a while. THE STORE decides, under a unique index —
+     * two people racing for the same slot do not both get it, whatever either
+     * screen believed a moment earlier.
+     */
+    workSlotHold(args: {
+        table_id: Uuid;
+        slotKey: string;
+        holder: string;
+        ttl?: string;
+    }): Promise<RecordsResult<unknown>>;
+    workSlotRelease(args: {
+        hold_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /** Every hold on this Table, with whether it has already lapsed. */
+    workSlotHolds(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<WorkSlotHold[]>>;
+    workSlotExpire(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<number>>;
+    /**
+     * THE ONE INBOX. Assignments, approvals and the agent's proposals, in one
+     * ordered list with ONE row shape — PRODUCTS.md row 6. A second queue for the
+     * agent's suggestions is the thing this replaces.
+     */
+    workInbox(args?: {
+        limit?: number;
+        offset?: number;
+        includeDecided?: boolean;
+        /** Lane S5-PRIME-2: "inbox" (default), "snoozed" or "done" — this person's own views. */
+        view?: WorkInboxView;
+    }): Promise<RecordsResult<WorkInboxItem[]>>;
+    /**
+     * SNOOZE ONE ITEM OF MY INBOX UNTIL A TIME (lane S5-PRIME-2, `custom.inbox_snooze`). Only my
+     * inbox changes; the approval or record is never written. A time already past, a snooze past a
+     * year, and a decided item are refused by name.
+     */
+    inboxSnooze(args: {
+        item_id: Uuid;
+        until: Timestamp;
+    }): Promise<RecordsResult<InboxStateChange>>;
+    /** Take my snooze off: it is back in my inbox now. */
+    inboxUnsnooze(args: {
+        item_id: Uuid;
+    }): Promise<RecordsResult<InboxStateChange>>;
+    /**
+     * CLEAR (mark done) ONE ITEM OF MY INBOX. A decision still owed is refused ("This one needs a
+     * decision"). It comes back if somebody else changes it.
+     */
+    inboxClear(args: {
+        item_id: Uuid;
+    }): Promise<RecordsResult<InboxStateChange>>;
+    /** Put a cleared item back in my inbox. */
+    inboxUnclear(args: {
+        item_id: Uuid;
+    }): Promise<RecordsResult<InboxStateChange>>;
+    /**
+     * WHAT WAITS ON ME, COUNTED (`custom.inbox_counts`) — the same predicate the inbox lists with.
+     * `everyOrganization` counts every organization I belong to (the shell badge: what waits on a
+     * person is theirs, not the selected organization's).
+     */
+    inboxCounts(args?: {
+        everyOrganization?: boolean;
+    }): Promise<RecordsResult<InboxCounts[]>>;
+    /** "My work", "work I assigned", "waiting on somebody being chosen". */
+    workList(args?: {
+        flavour?: WorkListFlavour;
+        includeFinished?: boolean;
+        limit?: number;
+        offset?: number;
+    }): Promise<RecordsResult<WorkListItem[]>>;
+    /**
+     * Give one record to one person: the Assignee value AND editor access, in one
+     * transaction. Passing no `user_id` un-assigns and says plainly that nobody's
+     * access was taken away.
+     */
+    workAssign(args: {
+        record_id: Uuid;
+        user_id?: Uuid | null;
+        dueDate?: string | null;
+        clearDue?: boolean;
+    }): Promise<RecordsResult<WorkAssignment>>;
+    /** The states this record may be moved to, and the sentence for each it may not. */
+    workRecordStates(args: {
+        record_id: Uuid;
+    }): Promise<RecordsResult<WorkRecordState[]>>;
+    /** Move it. The store refuses a move the model forbids, in its own words. */
+    workSetState(args: {
+        record_id: Uuid;
+        state_id: Uuid | null;
+    }): Promise<RecordsResult<unknown>>;
+    /** The person-kernel record standing for a signed-in person here. */
+    workPerson(args: {
+        user_id: Uuid;
+        create?: boolean;
+    }): Promise<RecordsResult<Uuid | null>>;
+    /** The templates this person may run, so a picker has ids to offer. */
+    workTemplates(args?: {
+        limit?: number;
+    }): Promise<RecordsResult<Array<{
+        template_id: Uuid;
+        name: string;
+        nodes: number;
+        relations: number;
+        created_at: string;
+    }>>>;
+    /** Who may decide a change about this subject, and why each of them may. */
+    workApprovalApprovers(args: {
+        subject_id: Uuid | null;
+        approver_id?: Uuid | null;
+    }): Promise<RecordsResult<WorkApprover[]>>;
+    /** Ask for a change instead of making it. Viewer on the subject is enough to ASK. */
+    workApprovalRequest(args: {
+        subject_id: Uuid;
+        change: WorkChange;
+        note?: string | null;
+        approver_id?: Uuid | null;
+        origin?: "person" | "agent";
+        conversation_id?: Uuid | null;
+    }): Promise<RecordsResult<WorkApprovalFiled>>;
+    /** Whether THIS person may decide THIS one — so a screen never draws a dead button. */
+    workApprovalMayDecide(args: {
+        approval_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /** Approve or decline. Approving APPLIES the change, as the person approving. */
+    workApprovalDecide(args: {
+        approval_id: Uuid;
+        approve: boolean;
+        note?: string | null;
+    }): Promise<RecordsResult<WorkApprovalDecision>>;
+    /**
+     * DECIDE MANY INBOX ITEMS IN ONE CALL (lane S4, `custom.work_decide_many`). Each is judged by
+     * `work_approval_decide` exactly as one is, in its own savepoint: a refused decision leaves that
+     * item waiting and the others still stand. Verdicts: approved, declined, already_decided,
+     * no_right, refused — each with the store's own sentence.
+     */
+    workDecideMany(args: {
+        decisions: WorkDecideManyItem[];
+    }): Promise<RecordsResult<WorkDecideMany>>;
+    /** One waiting change in full, for the person deciding it or the one who asked. */
+    workApprovalRead(args: {
+        approval_id: Uuid;
+    }): Promise<RecordsResult<Record<string, unknown>>>;
+    /** VIS-31. Is this account a signed-in outsider — no NON-personal organization? */
+    isExternalPrincipal(args?: {
+        user_id?: Uuid | null;
+    }): Promise<RecordsResult<boolean>>;
+    /** The same answer WITH the plain-English reason a screen shows. */
+    externalPrincipalCard(args?: {
+        user_id?: Uuid | null;
+    }): Promise<RecordsResult<ExternalPrincipalCard>>;
+    /** Exactly the resource ids Visibility gave that outsider. Never an organization's list. */
+    externalPrincipalReach(args: {
+        resourceType: string;
+        user_id?: Uuid | null;
+    }): Promise<RecordsResult<Array<{
+        resource_id: Uuid;
+    }>>>;
+    /** VIS-32. Bind a record or a view to a public address with a declared render mode. */
+    publishBindingCreate(args: {
+        slug: string;
+        resourceType: string;
+        resource_id: Uuid;
+        renderMode?: string;
+    }): Promise<RecordsResult<PublishBinding>>;
+    publishBindingRevoke(args: {
+        slug: string;
+    }): Promise<RecordsResult<unknown>>;
+    /** What a SIGNED-OUT visitor resolves. Empty for an invented, revoked or unpublished address. */
+    resolvePublishBinding(args: {
+        slug: string;
+    }): Promise<RecordsResult<ResolvedPublishBinding[]>>;
+    /** The same resolution plus what the address holds (table | record | dashboard | page | view). */
+    resolvePublishBindingKind(args: {
+        slug: string;
+    }): Promise<RecordsResult<ResolvedPublishBindingKind[]>>;
+    /** D-15. The ONE sentence admitting nothing was scanned, so four surfaces cannot drift. */
+    worldPublishGapNotice(): Promise<RecordsResult<string>>;
+    /** Put a resource in the world lane. Refuses by name while the lane is closed. */
+    publishToWorld(args: {
+        resourceType: string;
+        resource_id: Uuid;
+        discoverable?: boolean;
+    }): Promise<RecordsResult<unknown>>;
+    /**
+     * Declare a Rule. It is NOT `recordWrite` into the rule kernel, and that is
+     * the whole point: `custom.record_write` inserts `data_class = 'record'`, so a
+     * document written that way is not a Rule and the store's own rule doors
+     * (`custom.rule_members`, `custom.agg_subscriptions`) never see it. Writing
+     * one through the record door and calling it a Rule would be a silent
+     * failure — a screen that looked like it had subscribed you to something.
+     */
+    ruleDeclare(args: {
+        spec: Record<string, unknown>;
+        rule_id?: Uuid | null;
+    }): Promise<RecordsResult<Uuid>>;
+    fieldPropose(proposal: FieldProposal): Promise<RecordsResult<never>>;
+    tablePropose(proposal: TableProposal): Promise<RecordsResult<never>>;
+    promoteTable(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    promoteField(args: {
+        table_id: Uuid;
+        field_id: Uuid;
+    }): Promise<RecordsResult<unknown>>;
+    /**
+     * @deprecated The record store is never off (owner ruling, 2026-10-03: everything is on by
+     * default). This answers `true` whenever the door answers; a refusal means the store could not
+     * be reached, never that it is off. Do not gate a screen on it.
+     */
+    storeIsOpen(): Promise<RecordsResult<boolean>>;
+    /**
+     * WHAT THIS PERSON MAY DO TO THESE THINGS — asked once, for a whole page.
+     *
+     * There is no principal argument, on purpose: the door resolves the caller
+     * from the session, so a person can ask about their OWN access and about
+     * nobody else's. A subject they hold nothing on answers `level: null`, which
+     * is an answer; the row is never omitted, because a screen that could not
+     * tell "no access" from "not asked yet" would draw one of them as the other.
+     */
+    myLevels(args: {
+        ids: Uuid[];
+        subject?: "record";
+    }): Promise<RecordsResult<MyLevel[]>>;
+    /** G1. Write ONE leaf of a Table's colors, or clear it with `null`. Editor on the Table. */
+    tableDecorate(args: {
+        table_id: Uuid;
+        path: DecorationPath;
+        value: unknown;
+    }): Promise<RecordsResult<TableDecorations>>;
+    /** G1. A Table's colors as a screen paints them, with what went stale named. */
+    tableDecorations(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<TableDecorations>>;
+    /** G1. The layout a grid opens with: platform → organization knob → the view's own. */
+    gridLayout(args: {
+        table_id: Uuid;
+        view_id?: Uuid | null;
+    }): Promise<RecordsResult<GridLayout>>;
+    /** G3. The older grid's formula text → the store's expression. Never refuses a typo: answers ok:false. */
+    formulaParse(args: {
+        table_id: Uuid;
+        text: string;
+    }): Promise<RecordsResult<FormulaParse>>;
+    /**
+     * NOTION-PROPS. The formula being typed, parsed AND worked out for one record of the table
+     * (`custom.formula_preview`): the parse, plus `value` — what a saved formula column would show on
+     * that record — or `error` when it parses and cannot be worked out there. Writes nothing.
+     */
+    formulaPreview(args: {
+        table_id: Uuid;
+        record_id: Uuid | null;
+        text: string;
+    }): Promise<RecordsResult<FormulaPreview>>;
+    /** G2. Declare a Table's row actions — the whole list. Editor on the Table. */
+    actionDeclare(args: {
+        table_id: Uuid;
+        actions: RowAction[];
+    }): Promise<RecordsResult<RowAction[]>>;
+    /** G2. A Table's row actions, each saying whether it can run here. */
+    rowActions(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<{
+        actions: RowAction[];
+        stale: unknown[];
+    }>>;
+    /**
+     * G2. Run one action on a selection, in ONE transaction. A refusal changed NOTHING; read
+     * every record and field that refused with `actionRefusals(result.error)`.
+     */
+    actionRun(args: {
+        action_id: Uuid;
+        record_ids: Uuid[];
+    }): Promise<RecordsResult<ActionRunResult>>;
+    /**
+     * AUTOMATION-DOOR. Declare (or, with `automation_id`, replace) one automation on a Table — editor on the Table.
+     * A spec the store refuses comes back as `data.ok === false` with `_errors`, one sentence per path.
+     */
+    automationDeclare(args: {
+        table_id: Uuid;
+        spec: AutomationSpec;
+        automation_id?: Uuid | null;
+    }): Promise<RecordsResult<AutomationDeclared>>;
+    /** AUTOMATION-DOOR. A Table's automations with their last run; archived ones only when asked. */
+    automations(args: {
+        table_id: Uuid;
+        include_archived?: boolean;
+    }): Promise<RecordsResult<AutomationList>>;
+    /** AUTOMATION-DOOR. Archive one (it switches off and keeps its history). Editor on the Table. */
+    automationArchive(args: {
+        automation_id: Uuid;
+    }): Promise<RecordsResult<AutomationFlipped>>;
+    /** AUTOMATION-DOOR. Bring an archived one back (it stays off until `automationSetEnabled`). */
+    automationRestore(args: {
+        automation_id: Uuid;
+    }): Promise<RecordsResult<AutomationFlipped>>;
+    /** AUTOMATION-DOOR. Switch one on or off. */
+    automationSetEnabled(args: {
+        automation_id: Uuid;
+        enabled: boolean;
+    }): Promise<RecordsResult<AutomationFlipped>>;
+    /** AUTOMATION-DOOR. Run history, newest first: status, the store's own sentence, every step. */
+    automationRuns(args: {
+        automation_id: Uuid;
+        limit?: number;
+        cursor?: string | null;
+    }): Promise<RecordsResult<AutomationRuns>>;
+    /** G4. Send every change to this Table's records to an https webhook. Admin. The secret is shown once. */
+    tableWebhookDeclare(args: {
+        table_id: Uuid;
+        target_url: string;
+        events?: RecordEvent[] | null;
+        description?: string | null;
+    }): Promise<RecordsResult<TableWebhookDeclared>>;
+    /** G4. The webhooks a Table sends to, with their delivery health — never the secret. */
+    tableWebhooks(args: {
+        table_id: Uuid;
+    }): Promise<RecordsResult<TableWebhook[]>>;
+    /** G4. Switch one off. It is never deleted. */
+    tableWebhookArchive(args: {
+        webhook_id: Uuid;
+    }): Promise<RecordsResult<boolean>>;
+    /** G5. Number the records an autonumber column found already there, in creation order. */
+    autonumberBackfill(args: {
+        field_id: Uuid;
+    }): Promise<RecordsResult<{
+        numbered: number;
+        highest: number | null;
+        says: string;
+    }>>;
+    /**
+     * NOTION-PROPS-3. PRESS A BUTTON COLUMN ON ONE ROW (`custom.button_press`): a link comes back filled from
+     * the row for the screen to open; a row action or an automation runs in the store and its result comes
+     * back. A button with nothing set up is refused by name (22023).
+     */
+    buttonPress(args: {
+        record_id: Uuid;
+        field_id: Uuid;
+    }): Promise<RecordsResult<ButtonPressed>>;
+    /**
+     * NOTION-PROPS-3. The knob `data/timeline_dependency_shift` for the signed-in person in this organization:
+     * whether moving a record on a timeline moves the records waiting on it (default true).
+     */
+    timelineDependencyShift(): Promise<RecordsResult<boolean>>;
+    /** G5. One page of the export door — exactly the rows and columns the read door serves this person. */
+    ioExport(args: {
+        table_id: Uuid;
+        columns?: string[] | null;
+        limit?: number;
+    }): Promise<RecordsResult<IoExportPage>>;
+    /** G5. That page as an .xlsx; a withheld column is named on its own sheet. */
+    /**
+     * G9. Every table a picker may offer here, from BOTH stores, each saying which store opens it.
+     * A table the app keeps out of default lists (`custom.table_kept_out_of_lists`: an agent's
+     * outputs) is left out unless `include_platform_tables` is true — the "Show platform tables" switch.
+     */
+    tableListEverywhere(args?: {
+        include_platform_tables?: boolean;
+    }): Promise<RecordsResult<{
+        success: boolean;
+        tables: TableListEntry[];
+    }>>;
+    /**
+     * Every table the person reaches (`custom.data_home_tables`), as the data home lists them.
+     * `organization_id` names one organization; `null` asks for every organization the person
+     * reaches — never the client's bound organization by default. A table the app keeps out of
+     * default lists (an agent's outputs) is answered only with `include_platform_tables: true`.
+     */
+    dataHomeTables(args: {
+        organization_id: Uuid | null;
+        include_platform_tables?: boolean;
+    }): Promise<RecordsResult<DataHomeTable[]>>;
+    /**
+     * Every table of EVERY organization (`custom.admin_all_tables`) — the admin section's list. The
+     * store's walls admit a platform admin to system organizations only, so this is a separate door that
+     * answers only on the admin lane for a platform admin; anyone else gets a refusal, not an empty list.
+     */
+    adminAllTables(): Promise<RecordsResult<AdminTable[]>>;
+    /**
+     * G10. Refresh a synced source (a sheet tab) into ONE Table under `home_id`: new rows added,
+     * changed rows updated, rows the source dropped archived — never destroyed; columns the
+     * person added in Matrx survive. Build the spec with `sheetSyncSpec`.
+     */
+    tableSync(args: {
+        home_id: Uuid;
+        spec: TableSyncSpec;
+    }): Promise<RecordsResult<TableSyncResult>>;
+    /**
+     * G11. The record-store Table a context scope's template-bound item provisions — one per item
+     * and scope. A scope provisioned before the move answers with its moved Table (same id); the
+     * Home defaults to the organization's own.
+     */
+    scopeTableProvision(args: {
+        item_id: Uuid;
+        scope_id: Uuid;
+        home_id?: Uuid | null;
+    }): Promise<RecordsResult<Uuid>>;
+    /** G12. The rows of each Table this reader may see, in one call (fold with `withRowCounts`). A Table she may not know gets no row. */
+    tableRowCounts(args: {
+        table_ids: Uuid[];
+    }): Promise<RecordsResult<TableRowCount[]>>;
+    /** G12. Each live record's own header (created, updated, version) that the read door does not answer. */
+    recordHeaders(args: {
+        ids: Uuid[];
+    }): Promise<RecordsResult<RecordHeader[]>>;
+    /**
+     * G14. Share a Table with a person by email or account id: an existing account outside the
+     * organization is granted at once and notified (never made a member); an address with no
+     * account is invited. The organization's outside-sharing setting decides first.
+     */
+    tableShareOutsideGrant(args: {
+        table_id: Uuid;
+        person: string;
+        level?: "viewer" | "commenter" | "editor" | "admin";
+    }): Promise<RecordsResult<OutsideShareAnswer>>;
+    /** G13. Keep a hand-set order on a saved view: the named rows first, in this order (build it with `moveInOrder`). */
+    viewRecordOrderSet(args: {
+        view_id: Uuid;
+        record_ids: Uuid[];
+    }): Promise<RecordsResult<ViewOrderSet>>;
+    /**
+     * G13 + ORDER-FILTER. A page of a hand-ordered view: placed rows by position, then the rest by
+     * created time. `filter` is the list door's question (`StoreFilter`: a flat map or a nested
+     * Rule — the view's own `where`, or a number clicked on a dashboard); given, the store reads
+     * exactly the rows that match, in their places, and `limit`/`offset` page THAT order. Each row
+     * answers the position stored for it; rows the filter hides keep theirs.
+     */
+    readInViewOrder(args: {
+        view_id: Uuid;
+        filter?: StoreFilter | null | undefined;
+        limit?: number;
+        offset?: number;
+    }): Promise<RecordsResult<Array<ReadRow & {
+        position: number | null;
+    }>>>;
+    exportXlsx(args: {
+        table_id: Uuid;
+        columns?: string[] | null;
+        limit?: number;
+        labels?: Record<string, string>;
+        sheetLabel?: string;
+    }): Promise<RecordsResult<Uint8Array>>;
+}
+/** One Table's two lane facts, as `custom.table_facts` answers them. */
+interface TableFact {
+    table_id: Uuid;
+    /**
+     * The old lane word (personal · internal · public), now worked out by the store from `shown_to`
+     * and `published_to_web` (access ladder). Read those two; this stays for older stores.
+     */
+    visibility: string;
+    /** Whether the person signed in MADE this Table. Never who did. */
+    mine: boolean;
+    /** Access ladder "Shown to": only_me · my_team · everyone · everyone_on_ai_matrx; null = the default. */
+    shown_to?: string | null;
+    /** Access ladder "Published to the web": the only way anyone outside the organization opens it. */
+    published_to_web?: boolean;
+}
+/**
+ * WHERE A TABLE IS CURRENTLY READ AND WRITTEN during the older-table cutover.
+ * `tableHome` is an address read from one Table record; this applies the
+ * organization's migration switch to a batch of ids, including same-id copies.
+ */
+interface TableLiveLocation {
+    table_id: Uuid;
+    lives_in: "record" | "older";
+    why: string | null;
+}
+/**
+ * The facts folded onto a table list: `visibility` on every Table the facts name,
+ * `created_by` ONLY as the caller's own id and only on the Tables the caller made.
+ * Pure — returns new objects and leaves the list it was given alone.
+ */
+declare function withTableFacts<T extends {
+    id: Uuid;
+}>(tables: readonly T[], facts: readonly TableFact[] | null | undefined, me: Uuid | null | undefined): T[];
+declare function createRecordsClient(given: RecordsConfig): RecordsClient;
+/**
+ * Turn a refusal into the conflict a screen can SHOW: which version you wrote
+ * against, which one won, and every field you touched as it stands now. Returns
+ * null when the refusal was not a stale write.
+ */
+declare function asWriteConflict(error: RecordsError, recordId: Uuid): WriteConflict | null;
+
+export { type ChecklistTemplateSummary as $, ARCHIVE_LANES as A, type AutomationTrigger as B, type AutomationValue as C, type AutomationValues as D, type AutomationWeekday as E, type FieldDrift as F, BUILT_KIND_WORD as G, CHOICE_NUDGES as H, type CaptureField as I, type CaptureFileRef as J, type CaptureOutcome as K, type CaptureQuestion as L, type CaptureSheetFace as M, type CaptureSheetSummary as N, type ChecklistDeclared as O, type ChecklistRequirement as P, type ChecklistRequirementKind as Q, type RecordsClient as R, type ChecklistRoleSpec as S, type TableArchiveProgress as T, type ChecklistRunStarted as U, type ChecklistRunStep as V, type ChecklistRunSummary as W, type ChecklistSpec as X, type ChecklistStepCompleted as Y, type ChecklistStepSpec as Z, type ChecklistTemplateShape as _, type TableKindFacts as a, type EntityFieldRights as a$, type ChecklistTrigger as a0, type ChecklistTriggerKind as a1, type ChoiceCellBack as a2, type ChoiceLike as a3, type ChoiceNudge as a4, type ChoiceOption as a5, type ChoiceRehome as a6, type ChoiceUsage as a7, type ChoicesRehomed as a8, type CommentThreadRead as a9, type DrillDeclaration as aA, type DrillDefinition as aB, type DrillDimension as aC, type DrillFinding as aD, type DrillGrain as aE, type DrillHaving as aF, type DrillLane as aG, type DrillLevel as aH, type DrillMeasure as aI, type DrillMeasureOp as aJ, type DrillMeasureWhereValue as aK, type DrillPath as aL, type DrillQuestion as aM, type DrillRecords as aN, type DrillRowsPage as aO, type DrillSource as aP, type DrillView as aQ, type EnrichAlternate as aR, type EnrichCell as aS, type EnrichDeclared as aT, type EnrichDueRow as aU, type EnrichRun as aV, type EnrichSource as aW, type Enrichment as aX, type EnrichmentSummary as aY, type EntityBackLinkItem as aZ, type EntityBackLinks as a_, type CommentWritten as aa, type ConversationScope as ab, type ConversationScopeContext as ac, type CustomFieldTableType as ad, DEFAULT_ARCHIVE_LANE as ae, DEFAULT_PAGE_SIZE as af, DRILL_CHART_TOKENS as ag, DRILL_DESCRIPTION_MAX as ah, DRILL_DOORS as ai, DRILL_SCHEMA as aj, type DataHomeTable as ak, type DecorationColor as al, type DecorationPath as am, type DecorationRule as an, type DecorationRuleOp as ao, type DecorationTarget as ap, type DocRenderRow as aq, type DocSignatureCheck as ar, type DocSignatureRow as as, type DocTemplateRow as at, type DocToken as au, type DocUnresolvedToken as av, type DrillAdHocOp as aw, type DrillAnswer as ax, type DrillAnswerRow as ay, type DrillChartToken as az, ARCHIVE_LANE_LABEL as b, ROW_WEB_NOT_READY as b$, type EntityFieldValue as b0, type EntityFieldsAcross as b1, type EntityRecordMatch as b2, type EntityRecordRead as b3, type EntityRecordsFound as b4, type EntityRowWritten as b5, type EntityTableFacts as b6, type ExternalPrincipalCard as b7, type FieldDriftAspect as b8, type FieldHistoryEntry as b9, type IoExportPage as bA, type MigrationEntry as bB, type MigrationUndone as bC, type NewEntityFieldDeclaration as bD, type OutsideShareAnswer as bE, PIPELINE_RULE_KINDS as bF, type ParentExtracted as bG, type Pipeline as bH, type PipelineColumn as bI, type PipelineDeclared as bJ, type PipelineGate as bK, type PipelineGatePreview as bL, type PipelineMissingField as bM, type PipelineMoveMany as bN, type PipelineMoveManyItem as bO, type PipelineMoveManyResult as bP, type PipelineMoveResult as bQ, type PipelineMoveVerdict as bR, type PipelineRule as bS, type PipelineRuleKind as bT, type PipelineSpec as bU, type PipelineStage as bV, type PipelineVerdict as bW, type PromotedPredicate as bX, type PublishBinding as bY, type PublishBindingKind as bZ, type QueryPlan as b_, type FieldRetyped as ba, type FormArchiveAnswer as bb, type FormulaParse as bc, type FormulaPreview as bd, type GridLayout as be, type GridLayoutMode as bf, type GridRowHeight as bg, type HistoryActor as bh, type HistoryActorKind as bi, type HistoryChange as bj, type Home as bk, type ImportBatchResult as bl, type ImportColumnPlan as bm, type ImportColumnsDeclared as bn, type ImportFinished as bo, type ImportOpened as bp, type ImportOutcome as bq, type ImportPlan as br, type ImportPolicy as bs, type ImportProposal as bt, type ImportReport as bu, type ImportRun as bv, type InboundAddress as bw, type InboundDeclared as bx, type InboxCounts as by, type InboxStateChange as bz, ARCHIVE_LANE_MEANS as c, type TableSyncSource as c$, type RecordChangeAction as c0, type RecordComment as c1, type RecordEvent as c2, type RecordHeader as c3, type RecordHistoryEntry as c4, type RecordQuery as c5, type RecordRowControls as c6, type RecordScopeComment as c7, type RecordScopeContext as c8, type RecordScopeField as c9, TABLE_KIND_PREFIX as cA, type Table as cB, type TableCapacity as cC, type TableCopyInProgress as cD, type TableDecorations as cE, type TableDuplicateProgress as cF, type TableDuplicated as cG, type TableFact as cH, type TableHome as cI, type TableHomeDestination as cJ, type TableLevel as cK, type TableLevelApproval as cL, type TableLevelFacts as cM, type TableLevelSet as cN, type TableListEntry as cO, type TableLiveLocation as cP, type TableMoved as cQ, type TablePlacement as cR, type TablePlacementFact as cS, type TableReaderRule as cT, type TableRenderSchema as cU, type TableRestoreProgress as cV, type TableRowCount as cW, type TableRowDefaults as cX, type TableRowDefaultsPatch as cY, type TableSchemaMode as cZ, type TableSyncResult as c_, type RecordScopeHistoryEntry as ca, type RecordScopeRelation as cb, type RecordScopeWithheld as cc, type RecordSplit as cd, type RecordsMerged as ce, type RegisteredTable as cf, type ResolvedPublishBinding as cg, type ResolvedPublishBindingKind as ch, type RestorePreview as ci, type RestoreResult as cj, type RetypeBehaviour as ck, type RetypePreview as cl, type RowAction as cm, type RowActionStep as cn, type RowDefaultsApplied as co, SHOWN_TO_LABEL as cp, SHOWN_TO_VALUES as cq, SHOWN_TO_WHO_MAY_CHANGE as cr, STAGE_RULE_ENFORCEMENT as cs, STAGE_RULE_ON_FAIL as ct, type ShownTo as cu, type StagePending as cv, type StagePendingOnBoard as cw, type StageRuleEnforcement as cx, type StageRuleOnFail as cy, type StageRuleWarning as cz, A_PERSONS_REFUSAL as d, moveConsequence as d$, type TableSyncSpec as d0, type TableWebhook as d1, type TableWebhookDeclared as d2, type TypedChoiceDecision as d3, type ViewLayout as d4, type ViewOrderSet as d5, type WorkApprovalDecision as d6, type WorkApprovalFiled as d7, type WorkApprovalState as d8, type WorkApprover as d9, asChoiceNudge as dA, asWriteConflict as dB, choiceSlug as dC, choiceValuesOf as dD, choicesOf as dE, createRecordsClient as dF, decideTypedChoice as dG, declareDrillDefinition as dH, drillAnswerOf as dI, drillFindingKnob as dJ, emptyArchiveLine as dK, exportPageXlsx as dL, fieldKindOf as dM, holdsARetiredChoice as dN, intersectIds as dO, isAPersonsRefusal as dP, isArchiveLane as dQ, isFoundation as dR, isShownTo as dS, isTableKind as dT, isTheChosen as dU, keptGroups as dV, keptOutOfSight as dW, keptTableHref as dX, levelHasShownTo as dY, looksLikeAnId as dZ, mayDrag as d_, type WorkAssignment as da, type WorkAssignmentField as db, type WorkChange as dc, type WorkDecideMany as dd, type WorkDecideManyItem as de, type WorkDecideManyResult as df, type WorkDecideVerdict as dg, type WorkDueState as dh, type WorkGraph as di, type WorkInboxItem as dj, type WorkInboxKind as dk, type WorkInboxView as dl, type WorkInstantiation as dm, type WorkListFlavour as dn, type WorkListItem as dp, type WorkOrigin as dq, type WorkRecordState as dr, type WorkSlotHold as ds, type WorkState as dt, type WorkTemplateNode as du, type WorkTemplateRelation as dv, type WorkTurn as dw, actionRefusals as dx, archivedByLine as dy, archivedWhen as dz, type ActionRefusal as e, moveInOrder as e0, offeredAsContext as e1, optionKey as e2, optionLabel as e3, parseFieldDrift as e4, parseTableCopiesInProgress as e5, parseTableDuplicateProgress as e6, parseTableDuplicated as e7, parseTableHome as e8, parseTableMoved as e9, planQuery as ea, previewRetype as eb, previewRuleChange as ec, recordChangeTrigger as ed, recordSourceKey as ee, recordSourceTable as ef, recordsUseSentence as eg, rehomeSentence as eh, removedChoicesInUse as ei, ruleThatRefuses as ej, rulesWithTopStar as ek, sameDocument as el, scopeChip as em, sheetSyncSpec as en, tableIdOf as eo, tableJsonSchema as ep, tableKindMapping as eq, tableKindSlug as er, tableRenderSchema as es, valueConverts as et, withRowCounts as eu, withTableFacts as ev, withTablePlacement as ew, type ActionRunResult as f, type AdminTable as g, type AnonTokenBinding as h, type ArchiveLane as i, type ArchivedChecklistTemplate as j, type ArchivedDoorRow as k, type ArchivedForm as l, type ArchivedRow as m, type AsOf as n, type AutomationAction as o, type AutomationDeclared as p, type AutomationFilter as q, type AutomationFlipped as r, type AutomationItem as s, type AutomationLastRun as t, type AutomationList as u, type AutomationRun as v, type AutomationRunStatus as w, type AutomationRuns as x, type AutomationSpec as y, type AutomationStep as z };