@ai-matrx/records 0.98.8 → 0.98.9

package/dist/client-C1B-MNzb.d.ts

@@ -1,2704 +0,0 @@
-import { C as ChoiceNudge, T as TableArchiveProgress, a as TableRestoreProgress, b as TableDuplicateProgress, c as TableDuplicated, d as TableCopyInProgress, A as ArchiveLane, e as ArchivedRow, f as Table, g as TableHome, h as TableMoved, i as ChoiceUsage, j as ChoiceRehome, k as ChoiceCellBack, l as ChoicesRehomed, m as TableCapacity, F as FieldDrift, n as FieldRetyped, R as RecordsMerged, M as MigrationUndone, o as TableKindFacts, p as TableLevelFacts, q as TableReaderRule, r as TableLevelSet, E as EntityTableFacts, s as EntityFieldsAcross, N as NewEntityFieldDeclaration, t as EntityFieldRights, u as EntityRecordRead, v as EntityBackLinks, w as EntityRowWritten, x as EntityRecordsFound, P as Pipeline, y as PipelineColumn, z as PipelineVerdict, B as PipelineMoveResult, D as PipelineMoveManyItem, G as PipelineMoveMany, H as PipelineSpec, I as PipelineDeclared, S as StageRuleOnFail, J as StageRuleEnforcement, K as StagePending, L as StagePendingOnBoard, O as PipelineGate, Q as PipelineGatePreview, U as ImportPlan, V as ImportPolicy, W as ImportOpened, X as ImportColumnsDeclared, Y as ImportBatchResult, Z as ImportFinished, _ as ImportReport, $ as ImportRun, a0 as InboundDeclared, a1 as InboundAddress, a2 as FormArchiveAnswer, a3 as ArchivedForm, a4 as ArchivedChecklistTemplate, a5 as TableRowDefaults, a6 as TableRowDefaultsPatch, a7 as RowDefaultsApplied, a8 as RecordRowControls, a9 as CaptureSheetSummary, aa as CaptureSheetFace, ab as CaptureFileRef, ac as CaptureOutcome, ad as EnrichmentSummary, ae as EnrichDeclared, af as EnrichDueRow, ag as EnrichCell, ah as EnrichRun, ai as DrillSource, aj as DrillDefinition, ak as DrillQuestion, al as DrillAnswer, am as DrillRowsPage, an as DocToken, ao as DocUnresolvedToken, ap as DocTemplateRow, aq as DocRenderRow, ar as DocSignatureRow, as as RecordHistoryEntry, at as RecordScopeContext, au as ConversationScope, av as ConversationScopeContext, aw as FieldHistoryEntry, ax as RestorePreview, ay as RestoreResult, az as CommentThreadRead, aA as CommentWritten, aB as AnonTokenBinding, aC as ChecklistSpec, aD as ChecklistDeclared, aE as ChecklistTemplateSummary, aF as ChecklistTemplateShape, aG as ChecklistRunStarted, aH as ChecklistRunStep, aI as ChecklistRunSummary, aJ as ChecklistStepCompleted, aK as WorkState, aL as WorkGraph, aM as WorkInstantiation, aN as WorkTurn, aO as WorkAssignmentField, aP as WorkSlotHold, aQ as WorkInboxView, aR as WorkInboxItem, aS as InboxStateChange, aT as InboxCounts, aU as WorkListFlavour, aV as WorkListItem, aW as WorkAssignment, aX as WorkRecordState, aY as WorkApprover, aZ as WorkChange, a_ as WorkApprovalFiled, a$ as WorkApprovalDecision, b0 as WorkDecideManyItem, b1 as WorkDecideMany, b2 as ExternalPrincipalCard, b3 as PublishBinding, b4 as ResolvedPublishBinding, b5 as ResolvedPublishBindingKind, b6 as DecorationPath, b7 as TableDecorations, b8 as GridLayout, b9 as FormulaParse, ba as FormulaPreview, bb as RowAction, bc as ActionRunResult, bd as AutomationSpec, be as AutomationDeclared, bf as AutomationList, bg as AutomationFlipped, bh as AutomationRuns, bi as RecordEvent, bj as TableWebhookDeclared, bk as TableWebhook, bl as IoExportPage, bm as TableListEntry, bn as DataHomeTable, bo as AdminTable, bp as TableSyncSpec, bq as TableSyncResult, br as TableRowCount, bs as RecordHeader, bt as OutsideShareAnswer, bu as ViewOrderSet } from './table-kind-B4sdlvHf.js';
-import { d as StoreFilter, e as DashboardSummary, f as DashboardBlock, R as RecordFilter, g as AggregateCompare, A as AggregateBucket, h as DashboardRunResult, i as StuckRow, c as AggregateMeasure, j as AggregateRow, k as Subscription, M as MySubscription, l as SubscriptionSpec, m as DigestPreview, n as SavedViewRow, o as SavedViewSpecIn, p as RowTemplateRow } from './subscription-DQzPVKBR.js';
-import { R as RelationCoordinate, a as RelationWordsManyArgs, b as RelationIcons, c as ReverseColumn, d as ReverseLinksManyArgs, e as ReverseLinks, f as ReverseLinksFieldsArgs, S as SourceArchived } from './relation-Dh-lCkkh.js';
-import { F as Field, c as FieldPatch, N as NewFieldDeclaration, R as RelationNamesAnswer, d as FieldDuplicated, e as FieldProposal, T as TableProposal, B as ButtonPressed } from './field-CJtssH3q.js';
-import { s as ScopeDoors } from './doors-BTifsjNv.js';
-import { F as FormSummary, B as BookingSummary, a as BookingAvailability, b as BookingDeclared, c as FormRoute, d as FormResults } from './rule-xNwJF6Qo.js';
-import { F as FormLookOptions, P as PortalSummary, a as PortalArchiveFilter, b as PortalArchiveAnswer, c as PortalTableRef, d as PortalCard, e as PortalConfigInput, f as PortalFormSpec, g as PortalFormAnswer, h as PortalInvitation, i as PortalRevocation, j as PortalPreviewRow } from './portal-DW5NGBT0.js';
-import { a as RecordsConfig, M as MyLevel } from './ports-WwHHNwge.js';
-import { h as Timestamp, U as Uuid, k as RecordsErrorCode, l as RecordDocument, R as RecordsResult, m as RecordChange, n as RecordChangeResult, o as RecordGraphWritten, p as RecordRead, q as ReadRow, r as RecordPageSort, s as RecordPage, t as RecordKeysetPage, u as StoredRecord, v as RecordRevision, w as ReadValue, a as RecordsError, W as WriteConflict } from './record-CxGK1OEK.js';
-
-/**
- * DOOR-8. As-of on EITHER clock, and they are different questions:
- *   · `record` — the record clock: what this record looked like at version time.
- *   · `world` — the world clock: which values were true of the world then
- *     (the Field's `dated` modifier).
- */
-interface AsOf {
-    clock: "record" | "world";
-    at: Timestamp;
-}
-/** A predicate over a PROMOTED field (REC-5: promotion light -> heavy). */
-interface PromotedPredicate {
-    field_key: string;
-    /** The value as text, exactly as `custom.promoted_read` takes it. */
-    equals: string;
-}
-interface RecordQuery {
-    table_id: Uuid;
-    /** DOOR-6. Any combination, any subset. An empty list means "no relation constraint". */
-    relations?: RelationCoordinate[];
-    /** Predicates the store can answer from an index. */
-    promoted?: PromotedPredicate[];
-    /** DOOR-8. */
-    asOf?: AsOf;
-    /** DOOR-9. Ask across EVERY Home of this Table in one answer. */
-    acrossHomes?: boolean;
-    /** REC-23. Soft-deleted rows are out unless you say otherwise. */
-    includeDeleted?: boolean;
-    /** FLD-10. */
-    recordType?: string;
-    orderBy?: {
-        column: "created_at" | "updated_at";
-        ascending?: boolean;
-    };
-    limit?: number;
-    offset?: number;
-}
-/**
- * What a query decomposes into: a set of door calls whose answers INTERSECT,
- * then one filtered read. Kept as data rather than hidden inside the client so
- * the suite can assert the plan as well as the answer — a query that quietly
- * stopped applying one of its coordinates is otherwise invisible.
- */
-interface QueryPlan {
-    /** One `relation_targets` call per coordinate; the id sets are intersected. */
-    relationCalls: Array<{
-        door: "relation_targets";
-        record_id: Uuid;
-        via_key: string | null;
-    }>;
-    /** One `promoted_read` call per predicate; intersected with the above. */
-    promotedCalls: Array<{
-        door: "promoted_read";
-        field_key: string;
-        value: string;
-    }>;
-    /** The filtered read over `custom.record`, which the store's policies gate. */
-    read: {
-        table_id: Uuid;
-        includeDeleted: boolean;
-        recordType: string | null;
-        asOf: AsOf | null;
-        acrossHomes: boolean;
-        orderBy: {
-            column: string;
-            ascending: boolean;
-        };
-        limit: number;
-        offset: number;
-    };
-    /**
-     * Stated so nobody has to guess: when this is true the answer is the
-     * intersection of the id sets above, and when it is false the read stands
-     * alone.
-     */
-    intersects: boolean;
-}
-declare const DEFAULT_PAGE_SIZE = 50;
-declare function planQuery(query: RecordQuery): QueryPlan;
-/** The intersection of the id sets a plan's calls produced. Order is preserved from the first set. */
-declare function intersectIds(sets: Uuid[][]): Uuid[];
-
-/**
- * 🚨 A REFUSAL IS NOT AN APP ERROR (lane RECORDS-UI-FIX, guide re-walk 2026-09-23).
- *
- * A person typing `-3` into a column that takes "at least 0" is the store WORKING: the
- * rule said no, the screen said so in the one notice, and the person fixed it. The default
- * sink printed every one of those through `console.error`, and the app's error capture
- * (matrx-frontend `lib/diagnostics/globalErrorCapture.ts`) counts every `console.error` —
- * so one refused value lit a red "2 errors" pill in the corner, telling an admin the
- * product had failed when a person had simply been told no.
- *
- * These are the codes a PERSON causes by what they typed or when they typed it; each one
- * is already drawn on the screen that asked. They are still said (`console.info`), never
- * silenced. Everything else — a door, the store switched off, a timeout, a class this
- * package did not recognise — is a failure of the system and stays `console.error`.
- */
-declare const A_PERSONS_REFUSAL: ReadonlySet<RecordsErrorCode>;
-declare function isAPersonsRefusal(code: RecordsErrorCode | string): boolean;
-/** One organization the client could not use, with the sentence that says why. */
-interface OrganizationUnavailable {
-    organization_id: Uuid;
-    reason: string;
-}
-/** `organizationsOpen`: the organizations whose store answers, and those that do not (with why). */
-interface OrganizationsOpenAnswer {
-    open: Uuid[];
-    unavailable: OrganizationUnavailable[];
-}
-/** `metadataSearch`: every match, each carrying the organization it came from. */
-interface MetadataSearchAnswer {
-    matches: Array<Record<string, unknown> & {
-        organization_id: Uuid | null;
-    }>;
-    /** Organizations asked in order (the ones that answered). */
-    organizations_covered: Uuid[];
-    unavailable: OrganizationUnavailable[];
-}
-interface RecordsClient {
-    /** The config this client was built with, so a screen can show who it is acting as. */
-    readonly config: RecordsConfig;
-    /**
-     * THE SCOPE DOORS (`custom.context_*`): scope types are Tables kept for context, scopes Records,
-     * context fields Fields, values cells. Built from this client's own door path. `@ai-matrx/records/scopes`.
-     */
-    readonly scopes: ScopeDoors;
-    recordWrite(args: {
-        table_id: Uuid;
-        data: RecordDocument;
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * WRITE THE RECORD THIS KEY NAMES, OR UPDATE IT WHEN IT IS ALREADY THERE — one call, race-safe
-     * (`custom.record_upsert`). `key` is the column key (or keys) that say which record this is,
-     * and every one must carry a `unique` rule: the store refuses any other column by its name.
-     * Two concurrent calls with the same key leave ONE record. An update goes through
-     * `record_update` (with `expectedVersion`, its stale-write refusal); a new record through
-     * `record_write`. Answers the record's id either way.
-     */
-    recordUpsert(args: {
-        table_id: Uuid;
-        key: string | string[];
-        data: RecordDocument;
-        expectedVersion?: number;
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * Write MANY new records of one Table in one call.
-     *
-     * `custom.record_write_many` asks the switch, the organization and the Table
-     * ONCE for the whole batch and inserts the rows in one statement — which is
-     * why a paste of 120 lines is one round trip per chunk instead of 120. It
-     * CREATES only: there is no bulk update door, because an update carries a
-     * per-row optimistic version and a batch would have to either drop that or
-     * fail the whole batch for one stale row.
-     *
-     * It returns the new ids IN THE ORDER THE ROWS WERE HANDED IN, so a caller
-     * can tie each id back to the line of the spreadsheet it came from. Hand in
-     * `ids` to choose them yourself; hand in none and the door mints them.
-     */
-    recordWriteMany(args: {
-        table_id: Uuid;
-        rows: RecordDocument[];
-        ids?: Uuid[];
-    }): Promise<RecordsResult<Uuid[]>>;
-    /**
-     * DOOR-SPEED. MANY CHANGES TO ONE TABLE IN ONE TRANSACTION, through
-     * `custom.record_change_many`: inserts, updates (each with an optional `expected_version`)
-     * and archives. Every update lands in ONE statement, so the store's change notice, history and
-     * activity fire once for the batch while every row trigger still judges every row. ONE REFUSED
-     * CHANGE REFUSES THE BATCH and nothing is saved; the store's own sentence comes back with the
-     * change's position in the hint. The answer is one result per change, in order.
-     */
-    recordChangeMany(args: {
-        table_id: Uuid;
-        changes: readonly RecordChange[];
-    }): Promise<RecordsResult<RecordChangeResult[]>>;
-    /**
-     * A PARENT, THE EDGES IT STANDS ON AND THE ROWS THAT BELONG TO IT — ALL OR NOTHING.
-     *
-     * `recordWrite` and `recordWriteMany` are each ONE statement. A screen or a
-     * server path whose unit of work is a GRAPH — an AI artifact and the lines
-     * it produced, an order and its items, a research note and its citations —
-     * could therefore not save it as one thing: a loop is N transactions, and a
-     * failure on row nineteen leaves a parent standing without the lines it
-     * promised.
-     *
-     * `custom.record_write_graph` is one statement, so it is one transaction. It
-     * is NOT a second write path: it calls `custom.record_write_many` for the
-     * rows, `public.assoc_add` for an edge that points OUT of the store (the
-     * message a record was produced by), and `platform.relation_set` for the
-     * parent's own declared relation to its children. Same store switch, same
-     * editor rung on the Table, same value envelope, same undeclared-key guard,
-     * same history rows, same realtime notice.
-     *
-     * ONE REFUSAL REFUSES THE WHOLE GRAPH, BY NAME — the answer says which member
-     * failed and carries the store's own sentence about it, and nothing is
-     * written.
-     *
-     * Every child MUST name a `role`: it is the key of a declared RELATION field
-     * on the parent's Table, and an edge out of a record that names no field is
-     * refused by the store (REL-10 / T7) because without it nothing can read the
-     * relation's delete rule, its cardinality or its organization wall. The order
-     * children are handed in IS the order of the relation.
-     */
-    recordWriteGraph(args: {
-        table_id: Uuid;
-        parent: RecordDocument;
-        /** Each child: its document, the parent FIELD it fills, and optionally its own Table. */
-        children?: Array<{
-            data: RecordDocument;
-            role: string;
-            table_id?: Uuid;
-            position?: number;
-        }>;
-        /** Edges to things OUTSIDE the store. `direction` defaults to `"in"` — that thing produced this record. */
-        edges?: Array<{
-            entity: string;
-            id: Uuid;
-            direction?: "in" | "out";
-            label?: string;
-            role?: string;
-            position?: number;
-            metadata?: Record<string, unknown>;
-        }>;
-    }): Promise<RecordsResult<RecordGraphWritten>>;
-    recordUpdate(args: {
-        record_id: Uuid;
-        patch: Record<string, unknown>;
-        /** Leave it out and the last writer wins; supply it and a loser is TOLD. */
-        expectedVersion?: number;
-    }): Promise<RecordsResult<number>>;
-    /**
-     * A CELL THAT TAKES WORDS WHICH ARE NOT YET A CHOICE — the words become a choice of that
-     * column everywhere and the cell takes it, in ONE transaction (lane CHOICE-COLUMN-EDIT,
-     * `custom.record_update_adding_choices`). `add` is `{ "<column key>": ["words", ...] }`; the
-     * cell's value in `patch` is the words, and the store turns them into the new choice's key.
-     * Adding a choice changes the table's columns, so it needs that right; a refusal names it.
-     * Answers the new version, like `recordUpdate`, and announces the record changed.
-     */
-    recordUpdateAddingChoices(args: {
-        record_id: Uuid;
-        patch: Record<string, unknown>;
-        add: Record<string, string[]>;
-        expectedVersion?: number;
-    }): Promise<RecordsResult<number>>;
-    /**
-     * The Feature Knob `custom/choice_nudge` for the signed-in person in this client's
-     * organization: what a choice cell does with typed words that are not a choice
-     * (`decideTypedChoice` in `choice.ts` is the one place that acts on it).
-     */
-    choiceNudge(): Promise<RecordsResult<ChoiceNudge>>;
-    /**
-     * REC-23. Soft, and reversible within `retention`.
-     *
-     * 🚨 NOT FOR A TABLE. A Table is a record, so this door accepts one — and
-     * then recurses through every record the Table contains inside a single
-     * transaction, which is unbounded by construction and dies on `57014` at a
-     * size the product's own import reaches in half a minute. Use
-     * `tableArchive` below, which does the same work in resumable passes.
-     */
-    recordDelete(args: {
-        record_id: Uuid;
-    }): Promise<RecordsResult<Timestamp>>;
-    recordRestore(args: {
-        record_id: Uuid;
-    }): Promise<RecordsResult<void>>;
-    /**
-     * ARCHIVING A WHOLE TABLE — ONE PASS OF IT (VERIFIER-11 F3).
-     *
-     * One call archives at most `chunk` of the table's live records through
-     * `custom.record_delete` (so every guard, history capture and outbox row
-     * still happens; nothing is hard-deleted) and comes back with the numbers a
-     * screen draws progress from. The CALLER LOOPS until `done` — that loop is
-     * the fix, because the one thing a single statement cannot be made to do is
-     * finish.
-     *
-     * `chunk: 0` changes nothing and only reports, so a screen can say "1,430
-     * records will be archived" BEFORE a person commits to it. `includeTable:
-     * false` empties the table and leaves it standing.
-     *
-     * RESUMABLE, WITHOUT A JOB ROW: what remains is read off the records
-     * themselves every call. A pass that fails, a closed tab or a deploy mid-run
-     * leaves a half-archived table and a next call that continues from exactly
-     * there. A caller must therefore never report "nothing happened" after a
-     * failed pass — `archived_total` says what really landed.
-     */
-    tableArchive(args: {
-        table_id: Uuid;
-        /**
-         * How many records this pass takes on. The door clamps it; it answers with what it
-         * took. Default 50 — measured: ~35ms a record against an 8s statement timeout, so
-         * 200 dies on `57014` and is the original defect one level up.
-         */
-        chunk?: number;
-        /** Archive the Table record itself once nothing live is left in it. Default true. */
-        includeTable?: boolean;
-    }): Promise<RecordsResult<TableArchiveProgress>>;
-    /**
-     * ONE PASS OF ARCHIVING, ON PURPOSE, A TABLE THE APP'S CODE DEPENDS ON
-     * (`custom.table_archive_deliberately`, lane 12 P5). Such a table (`code_depends: true`) refuses
-     * `tableArchive`, `recordDelete`, a slug / kept_for rename, `tableMove` and removal of the mark.
-     * This door takes the table's slug TYPED by the person and a reason, refuses an agent, and then
-     * archives through `custom.table_archive` (same progress answer; the caller loops until `done`).
-     * Use `archiveTypedTableDeliberately` (`@ai-matrx/records/typed-table`), which loops.
-     */
-    tableArchiveDeliberately(args: {
-        table_id: Uuid;
-        typed_slug: string;
-        reason: string;
-    }): Promise<RecordsResult<TableArchiveProgress>>;
-    /**
-     * BRINGING A WHOLE TABLE BACK — ONE PASS OF IT (`custom.table_restore`, lane TABLE-ACTIONS).
-     *
-     * 🚨 NOT `recordRestore` FOR A TABLE: that door brings the Table, its structure, every record
-     * and everything built on it back in one statement and dies on `57014` (the clone's "Referral
-     * Intake Queue 2026-Q4 (copy 7)"). This pass brings back the Table and its structure first, then
-     * at most `chunk` records, then what was built on it — all from the one archive event — and
-     * answers `done` when nothing the archive took is still waiting. Use {@link tableRestoreWhole}.
-     */
-    tableRestore(args: {
-        table_id: Uuid;
-        chunk?: number;
-    }): Promise<RecordsResult<TableRestoreProgress>>;
-    /**
-     * THE WHOLE RESTORE OF A TABLE — the loop every caller needs: `tableRestore` until `done`,
-     * halving the pass on a statement timeout (a pass that timed out changed nothing). `onPass`
-     * hears every pass's numbers. Answers the last pass, or the refusal that stopped it (what the
-     * passes before it brought back stays back; the next call carries on from there).
-     */
-    tableRestoreWhole(args: {
-        table_id: Uuid;
-        onPass?: (progress: TableRestoreProgress) => void;
-    }): Promise<RecordsResult<TableRestoreProgress>>;
-    /**
-     * DUPLICATE A TABLE — `custom.table_duplicate` (lane TABLE-ACTIONS).
-     *
-     * Makes a NEW Table from one the caller may open: its settings and look, every live column (new
-     * ids), every choice list as a new list (same words, colours, keys and order), every saved view
-     * (filters, sorts, layouts, every id inside them pointing at the copy), and with `withRecords`
-     * every live record (a link to another row of the same table follows to the copy's row; a link
-     * to another table stays). `name` defaults to "<name> (copy)", "(copy 2)", …;
-     * `organizationId` defaults to the source's organization and must be one the caller belongs to.
-     * The source is never written. The copy is made in passes of a few seconds (any size; the
-     * store answers "copying" until "done"), and this call loops them. Refused before anything is
-     * made, the refusal carries the store's one sentence (not given / archived / not a member there
-     * / a column linking across organizations).
-     */
-    tableDuplicate(args: {
-        tableId: Uuid;
-        withRecords?: boolean;
-        name?: string | null;
-        organizationId?: Uuid | null;
-        /** Called after every pass with what is copied so far (a progress bar is made of it). */
-        onProgress?: (progress: TableDuplicateProgress) => void;
-    }): Promise<RecordsResult<TableDuplicated>>;
-    /**
-     * CARRY ON A COPY — `custom.table_duplicate_continue` (lane TABLE-ACTIONS). The copy is made in
-     * passes of a few seconds each; `tableDuplicate` loops them, and this resumes one that a closed
-     * tab or a lost connection left unfinished (the copy is kept out of every table list until it
-     * is done). Only the person who started it; it answers the finished copy, or refuses.
-     */
-    tableDuplicateContinue(args: {
-        copyId: Uuid;
-        onProgress?: (progress: TableDuplicateProgress) => void;
-    }): Promise<RecordsResult<TableDuplicated>>;
-    /**
-     * THE CALLER'S UNFINISHED COPIES — `custom.table_copies_in_progress` (lane TABLE-ACTIONS). Each
-     * is still being made (carry it on with `tableDuplicateContinue`) or stopped because its source
-     * was archived meanwhile (discard it: `tableArchive` on the copy). Nobody else can see them.
-     */
-    tableCopiesInProgress(): Promise<RecordsResult<TableCopyInProgress[]>>;
-    recordRead(args: {
-        record_id: Uuid;
-        withComputed?: boolean;
-        /** Also answer `version` (read in the same round, so the read takes as long as the slower of the two). */
-        withVersion?: boolean;
-        organization_id?: Uuid | null;
-    }): Promise<RecordsResult<RecordRead>>;
-    /**
-     * DOOR-1. A page of one Table's records THROUGH `custom.read_records`: the
-     * store decides which rows this reader may see and which fields of them, and
-     * a field it masked comes back present-and-null with its reason in `hidden`.
-     * `total` is null because the door counts nothing it has not read — a count
-     * of rows a person may not see is a leak with a number on it.
-     */
-    list(args: {
-        table_id: Uuid;
-        /**
-         * THE STORE'S ONE FILTER SHAPE (`RecordFilter`). Left out, this is the
-         * whole page. Supplied, the store narrows INSIDE its own query — never the
-         * browser, which can only ever filter the rows it was already allowed to
-         * see and would silently drop the rest of the answer.
-         *
-         * It is the same object a saved view stores as `filters` and the same one
-         * `recordAggregate` counts with, so the rows a drill-through opens are the
-         * rows the number on the dashboard counted.
-         */
-        filter?: StoreFilter;
-        limit?: number;
-        offset?: number;
-    }): Promise<RecordsResult<{
-        rows: ReadRow[];
-        total: number | null;
-        locked?: number;
-    }>>;
-    /**
-     * DOOR-SPEED. ONE PAGE THE STORE SORTED, SEARCHED, FILTERED AND COUNTED, through
-     * `custom.read_records_page` — the same wall, ladder, field mask and filter as `list`, with the
-     * order (`sort`, or a hand-ordered view's positions via `view_id`), a text `search` over the
-     * columns this reader may see (and the words of choice options), and the `total` of the
-     * matching visible set. It is what a grid pages with: nothing reads the whole table to draw one
-     * page. A sort on a column this reader cannot see (gone, or masked) is SKIPPED and named in
-     * `sort_ignored` — the page still loads; one worked out on every read is refused by name.
-     */
-    listPage(args: {
-        table_id: Uuid;
-        filter?: StoreFilter;
-        search?: string | null;
-        sort?: readonly RecordPageSort[];
-        view_id?: Uuid | null;
-        limit?: number;
-        offset?: number;
-    }): Promise<RecordsResult<RecordPage>>;
-    /**
-     * AP3-KEYSET-DOOR. THE SAME PAGE AS `listPage`, PAGED BY A CURSOR, through
-     * `custom.read_records_keyset`: the same wall, ladder, field mask, filter, search and sort (no
-     * hand-ordered view), the same rows in the same order — but the next page starts after the last
-     * row's sort values and id, so a write landing mid-read never skips or repeats a row. Pass back
-     * `cursor` as `after` (it is opaque; `null` on the last page). A cursor handed to a different
-     * sort, filter or search is refused by name ("start from the first page"), never reinterpreted.
-     *
-     * Every row carries the `version` and `organization_id` it was read at, in the same statement as
-     * its values. With `ids`, it re-reads exactly those rows among the ones the reader may see (in the
-     * page's order; `after` ignored, `cursor` and `total` null) — get-by-id, the re-read after a write,
-     * and the changed ids of a realtime notice.
-     */
-    listKeyset(args: {
-        table_id: Uuid;
-        filter?: StoreFilter;
-        search?: string | null;
-        sort?: readonly RecordPageSort[];
-        after?: string | null;
-        ids?: readonly Uuid[];
-        limit?: number;
-    }): Promise<RecordsResult<RecordKeysetPage>>;
-    /**
-     * DOOR-1 FOR AN ID SET. Exactly these records of this Table, through
-     * `custom.read_records_by_ids` — the same ladder, the same level, the same
-     * field masking and the same page ceiling as `list`, addressed by id instead
-     * of by page. An id the reader may not see simply does not come back, which
-     * is the same answer `list` gives by omission.
-     *
-     * It exists because a realtime notice has always named the exact ids that
-     * moved and no door could take them: three cells changing re-read a fifty-row
-     * page in every watching browser.
-     */
-    listByIds(args: {
-        table_id: Uuid;
-        ids: readonly Uuid[];
-    }): Promise<RecordsResult<ReadRow[]>>;
-    /**
-     * DOOR-1 FOR THE ROWS THAT LEFT: a page of one Table's ARCHIVED records,
-     * through `custom.read_records_archived` — the same ladder, the same level,
-     * the same field masking and the same page ceiling as `list`, with the sign
-     * of the `deleted_at` test flipped, plus who archived each one and when.
-     *
-     * 🚨 IT EXISTS BECAUSE ARCHIVING WAS A ONE-WAY DOOR (VERIFIER-10 F4). The
-     * store has always had `record_restore`, and it has always done exactly the
-     * right thing; what it did not have was any door that could LIST the records
-     * it would act on, because every read door answers live rows only. So an
-     * archived record was unreachable from every screen in the platform.
-     *
-     * `lane` is the archived-items law's two lanes — "mine" (what I archived) and
-     * "org" (what anybody in this organization archived), which is the default.
-     */
-    listArchived(args: {
-        table_id: Uuid;
-        lane?: ArchiveLane;
-        limit?: number;
-        offset?: number;
-    }): Promise<RecordsResult<{
-        rows: ArchivedRow[];
-        total: number | null;
-    }>>;
-    query(query: RecordQuery): Promise<RecordsResult<{
-        rows: ReadRow[];
-        total: number | null;
-    }>>;
-    /**
-     * Every Table the person can see across ALL their organizations
-     * (`config.organizationIds`); `organization_id` is the page's optional filter
-     * (absent = all). Each Table carries its own `organization_id`.
-     */
-    tableList(args?: {
-        organization_id?: Uuid | null;
-    }): Promise<RecordsResult<Table[]>>;
-    /**
-     * ONE Table's declaration by id — `null` when this reader may not see it or it is not a Table.
-     * The same kernel record `tableList` lists, read through `read_records_by_ids` for exactly
-     * that id, so a screen that opens one table never lists every table to find it (a list capped
-     * at 500 answered "no table" past the 500th).
-     */
-    tableRead(args: {
-        table_id: Uuid;
-        organization_id?: Uuid | null;
-    }): Promise<RecordsResult<Table | null>>;
-    /**
-     * ONE Table of THIS organization found by its slug — or, with no slug, by its name — in ONE
-     * request (`custom.table_find`). `null` when there is none or this reader may not see it: the
-     * store reads the candidates through the same read door `tableRead` uses, so a table she may
-     * not see answers exactly like one nobody made. Where several share a slug, the oldest she may
-     * see answers, every time (the same pick `ensureTable` makes). Never list every table to find one.
-     *
-     * `keptFor` (an app's table): the slug AND what the table is kept for must match — a person's own
-     * table of the same slug is a different table and never answers. With `keptFor` and no live
-     * match, an ARCHIVED match is answered as `{ id, organization_id, archived_at }` (no document), so
-     * a caller says "archived — restore it", never "missing".
-     */
-    tableFind(args: ({
-        slug: string;
-        name?: never;
-    } | {
-        name: string;
-        slug?: never;
-    }) & {
-        keptFor?: string;
-    }): Promise<RecordsResult<Table | null>>;
-    /**
-     * IS THIS TABLE IN THE ARCHIVE? (lane HUB-FIX, 2026-09-23.) The archived row for one
-     * Table of this organization, or `null` when the archive does not hold it — which
-     * is an ANSWER, never "it may have been deleted". A table page that cannot find a
-     * Table asks this before saying anything: an archived Table's own address used to
-     * read "…or it may have been deleted" when it was archived and one click from back.
-     */
-    tableArchived(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<ArchivedRow | null>>;
-    /**
-     * WHO CAN SEE EACH TABLE, AND WHETHER THE CALLER MADE IT — `custom.table_facts`
-     * (lane HUB-FIX). `visibility` and `created_by` are record COLUMNS the Table document
-     * never carried, so a screen that sorts Tables into lanes asks this and folds the
-     * answer onto `tableList()`'s Tables with `withTableFacts`.
-     *
-     * 🚨 IT IS ITS OWN CALL, NOT PART OF `tableList()` (0.57.3). 0.57.2 folded it into
-     * every table list, so every screen that merely LISTS tables (the field editor's
-     * relation target, the import wizard, settings) paid a second round trip it never
-     * used — and every test double that answers a table list had to answer it too
-     * (records-ui 0.84.5's gate: 47 tests in 15 files red). Only the lane-sorting
-     * screens ask.
-     *
-     * The door-presence pattern: when the store's catalogue does not carry the door the
-     * answer is `null` — nothing asked, nothing invented.
-     */
-    tableFacts(args?: {
-        organization_id?: Uuid | null;
-    }): Promise<RecordsResult<TableFact[] | null>>;
-    /**
-     * WHICH STORE CURRENTLY WRITES each table — `custom.where_tables_live`.
-     *
-     * This is a batch cutover decision, not a Table's home address: during COPY
-     * mode an older table and its record-store copy share an id, and only this
-     * door knows which one the organization is still using. It is intentionally
-     * unbound from this client's organization because the door derives the answer
-     * from each supplied table and the caller's authority.
-     */
-    tablesLiveWhere(args: {
-        table_ids: Uuid[];
-    }): Promise<RecordsResult<TableLiveLocation[]>>;
-    /**
-     * WHICH ORGANIZATION A TABLE LIVES IN, BY NAME, AND WHERE IT MAY GO — `custom.table_home`
-     * (SC-1' / SC-1-TAILS). Read FROM THE TABLE, never from the organization the client is bound
-     * to, so it answers for a table shared from outside too. `null` = not given to this person,
-     * or not there (the store says the same for both, on purpose). A store without the door
-     * refuses `door_absent` — never a guessed organization.
-     */
-    tableHome(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<TableHome | null>>;
-    /**
-     * MOVE A TABLE into another organization the caller belongs to — `custom.table_move`. It
-     * carries every Table inside it or its rows and writes the change events; refused, NOTHING
-     * moved and the refusal carries the store's one sentence. `expected_version` is the Table's
-     * version the caller decided on (a concurrent change refuses with "look again").
-     */
-    tableMove(args: {
-        table_id: Uuid;
-        to_organization_id: Uuid;
-        expected_version?: number | null;
-    }): Promise<RecordsResult<TableMoved>>;
-    /**
-     * The Fields that apply. NOTION-PROPS: a two-way link's reverse Field (`isReverseField`) is left out
-     * unless `withReverse` — every screen draws it as the table's reverse column (`reverseColumns`, with
-     * `read_only: false`), which reads and writes its links; listed as a Field too it would draw twice.
-     */
-    fields(args: {
-        table_id: Uuid;
-        recordType?: string;
-        withReverse?: boolean;
-    }): Promise<RecordsResult<Field[]>>;
-    /**
-     * FLD-5 / FLD-6: a list field stores the id of an option RECORD, because
-     * every pick-list is already a Table. These are that Table's records — the
-     * store resolves which Table from the Field's own config, so no caller has to
-     * know it.
-     */
-    fieldOptions(args: {
-        field_id: Uuid;
-    }): Promise<RecordsResult<StoredRecord[]>>;
-    /**
-     * How many records hold each choice of one choice column, keyed by the option's id
-     * (`custom.field_choice_usage`; counts only records the caller may see). What a column editor
-     * says before a choice that records still hold is removed: "3 records use “X-ray”."
-     */
-    fieldChoiceUsage(args: {
-        field_id: Uuid;
-    }): Promise<RecordsResult<Record<string, ChoiceUsage>>>;
-    /**
-     * A column's choices saved AND the records of each removed choice moved to another choice,
-     * kept as other values, or cleared — ONE transaction (`custom.field_update_rehoming_choices`).
-     * `rehome` is keyed by the removed option's id. The answer carries `undo`; sending
-     * `{ patch: { options: undo.options }, cells_back: undo.cells_back }` back through this same
-     * call puts the list and every cell back, again in one transaction.
-     */
-    fieldUpdateRehomingChoices(args: {
-        field_id: Uuid;
-        patch: FieldPatch;
-        rehome?: Record<string, ChoiceRehome> | undefined;
-        cells_back?: readonly ChoiceCellBack[] | undefined;
-    }): Promise<RecordsResult<ChoicesRehomed>>;
-    tableCapacity(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<TableCapacity>>;
-    /**
-     * REC-1: a Table has to live somewhere, so a Home comes first — and a Home is
-     * an ordinary record in the person kernel. `homeId` is therefore required and
-     * `personKernelId()` is how a caller gets a Table to write one into.
-     */
-    tableDeclare(args: {
-        spec: Record<string, unknown>;
-        homeId: Uuid;
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * FIND THIS TABLE BY ITS SLUG, OR MAKE IT — ONE call, ONE transaction (`custom.table_ensure`).
-     * The store holds a lock on (organization, slug) across the find and the make, so two tabs
-     * saving their first record at once get the SAME table; a second call adds any column the spec
-     * names that the table lacks and never retypes or drops one. `spec.fields` are full
-     * `custom.field_declare` specs. Prefer `ensureTable(client, NewTableSpec)`, which builds them.
-     *
-     * `drift` names every column the table already has whose stored shape differs from the spec
-     * (type, format, label, multi, required, unique) — reported, never applied. `[]` when nothing
-     * differs; `null` only from a store too old to compare (see `FieldDrift`).
-     */
-    tableEnsure(args: {
-        spec: Record<string, unknown>;
-    }): Promise<RecordsResult<{
-        table_id: Uuid;
-        home_id: Uuid | null;
-        created: boolean;
-        drift: FieldDrift[] | null;
-    }>>;
-    /**
-     * ADD A FIELD TO A TABLE. One call, and the store does the three things no
-     * client can do for itself: it turns a parity type into the behaviour,
-     * modifiers, format, unit, relation target and Rules its own guards demand;
-     * it tells the TABLE about the field (REC-1 / FLD-8 — a definition for a
-     * field the table never declared is refused, which is the sentence every
-     * "Add field" used to end on); and it stores the definition as a FIELD
-     * rather than as a plain record, so the delete rules and the
-     * formula-dependency check can see it.
-     *
-     * A choice list carries its `options` as words. The store keeps them the only
-     * way FLD-5 / FLD-6 allows — as the records of a Table it declares for them —
-     * so nobody is made to build a table before they can have a dropdown.
-     */
-    fieldDeclare(args: {
-        table_id: Uuid;
-        spec: NewFieldDeclaration;
-    }): Promise<RecordsResult<Uuid>>;
-    /** One field's own settings. What it HOLDS is a conversion and is refused here by name. */
-    fieldUpdate(args: {
-        field_id: Uuid;
-        patch: FieldPatch;
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * CHANGE WHAT A COLUMN HOLDS, through `custom.migrate_retype` (FLD-4 / T12). `to` is the store's
-     * behaviour word — `text`, `range` (numbers and dates), `boolean`, `list`, `relation`. Every value
-     * that converts is converted; every value that does not is kept in that record's `_retired`
-     * with the reason, never coerced and never deleted. The answer counts both.
-     */
-    migrateRetype(args: {
-        field_id: Uuid;
-        to: string;
-        note?: string;
-    }): Promise<RecordsResult<FieldRetyped>>;
-    /**
-     * MERGE ONE RECORD INTO ANOTHER, through `custom.migrate_merge` (T5 / REC-21). The loser's values
-     * the winner did not hold move across, the ones that differ are kept as ranked alternates, every
-     * link to the loser now points at the winner, and the loser is archived with its id resolving to
-     * the winner. Editor on BOTH records is decided first. The answer's `migration_id` is what
-     * `migrateUndo` takes.
-     */
-    migrateMerge(args: {
-        winner_id: Uuid;
-        loser_id: Uuid;
-        note?: string | null;
-    }): Promise<RecordsResult<RecordsMerged>>;
-    /** Put a recorded Migration back (`custom.migrate_undo`): a retype or a merge, by its id. */
-    migrateUndo(args: {
-        migration_id: Uuid;
-    }): Promise<RecordsResult<MigrationUndone>>;
-    /**
-     * REL-DISP. THE WORDS ONE RELATION CELL SHOWS, resolved by the store through
-     * that column's own display spec — one column or several, joined by its
-     * separator. Never resolve a relation label any other way: the store's
-     * `custom._words_for` is the one body that decides what a record is called, it
-     * asks the read-access ladder BEFORE it reads the name, and a record this reader
-     * may not open comes back as the withheld sentence rather than its name or id.
-     * A value that is not an id is handed straight back — it is already words.
-     */
-    relationWords(args: {
-        field_id: Uuid;
-        value: string;
-    }): Promise<RecordsResult<string | null>>;
-    /**
-     * The same answer for a WHOLE PAGE of cells in one round trip. Prefer this
-     * wherever a grid, board, list or picker resolves more than one chip: the
-     * per-id lane is what made a page of relation cells a page of requests.
-     */
-    relationWordsMany(args: RelationWordsManyArgs): Promise<RecordsResult<Record<string, string>> & {
-        archived?: readonly string[];
-        icons?: Record<string, RelationIcons>;
-    }>;
-    /**
-     * VISION-REACH G1. Which records of `table_id` each name names — its name column, case and
-     * spacing ignored, only records this reader may see. Hand the answer to `relationNameIndexOf`
-     * and pass that to the coercion as `relationNames`. Up to 5,000 names a call; more are sent in
-     * groups by this method.
-     */
-    relationNamesMatch(args: {
-        table_id: Uuid;
-        names: string[];
-    }): Promise<RecordsResult<RelationNamesAnswer>>;
-    /**
-     * VIEWS-AND-FIELDS BL (REL-9). The REVERSE COLUMNS of a Table: one per relation column of another
-     * table (or this one) that links here, read-only, virtual — never a Field of this Table, so
-     * `applicableFields` does not list them. A linking table this reader may not know is left out.
-     */
-    reverseColumns(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<ReverseColumn[]>>;
-    /**
-     * A page of records' links through ONE reverse column, in one round trip per 200 records:
-     * `{ [record id]: { total, links: [{ id, words }] } }`, only linking records this reader may see.
-     * `limit` (1–50) and `offset` page one record's links — a record with thousands of links costs
-     * one count and one page. A record with no links answers `{ total: 0, links: [] }`.
-     */
-    reverseLinksMany(args: ReverseLinksManyArgs): Promise<RecordsResult<Record<string, ReverseLinks>>>;
-    /**
-     * The same, through SEVERAL reverse columns in ONE call (`custom.reverse_links_many_fields`):
-     * `{ [source field id]: { [record id]: { total, links } } }`. A store without the door answers
-     * `door_absent` — ask `reverseLinksMany` per column then.
-     */
-    reverseLinksFields(args: ReverseLinksFieldsArgs): Promise<RecordsResult<Record<string, Record<string, ReverseLinks>>>>;
-    /**
-     * NOTION-PROPS. A TWO-WAY LINK: makes (or returns) the reverse Field of relation `field_id` on its
-     * target table (`custom.relation_reverse_field`), so the link is a column there that edits the same
-     * links. Its key is the reverse column's key; `label` defaults to the linking table's name.
-     */
-    relationReverseField(args: {
-        field_id: Uuid;
-        label?: string;
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * NOTION-PROPS. Adds and removes links from the reverse side of a two-way link
-     * (`custom.relation_reverse_set`): each id becomes a write of THAT record's forward Field.
-     * Answers how many records changed.
-     */
-    relationReverseSet(args: {
-        record_id: Uuid;
-        field_id: Uuid;
-        add?: readonly Uuid[];
-        remove?: readonly Uuid[];
-    }): Promise<RecordsResult<number>>;
-    /** Take a field off a table. Refuses the title field, the last field, and one another field reads through. */
-    fieldRetire(args: {
-        field_id: Uuid;
-    }): Promise<RecordsResult<boolean>>;
-    /**
-     * Bring a removed column back (`custom.field_restore`): the set that was retired with it, the
-     * Table's declaration of those columns, and the links they made. The values never left.
-     */
-    fieldRestore(args: {
-        field_id: Uuid;
-    }): Promise<RecordsResult<boolean>>;
-    /**
-     * DUPLICATE PROPERTY (Notion N5) — `custom.field_duplicate`: a new column right after this one, named
-     * "<name> (1)", the same kind (choices with their colours, unit, link, formula, rules, sensitivity), and
-     * every record's value copied into it in one statement. A link column copies its definition only (its
-     * values are links); a formula, lookup or roll-up works its answer out itself. Needs the table's
-     * add-a-column rung, the same as `fieldDeclare`.
-     */
-    fieldDuplicate(args: {
-        field_id: Uuid;
-    }): Promise<RecordsResult<FieldDuplicated>>;
-    /**
-     * CHAIR-ROLLUP-HONEST. Is a column this lookup or roll-up reads archived — the link it reads
-     * through, a back-link's linking column, or the far column it totals (`custom.field_source_archived`)?
-     * `null` while every source is live. Bring it back with `fieldRestore({ field_id })`.
-     */
-    fieldSourceArchived(args: {
-        field_id: Uuid;
-    }): Promise<RecordsResult<SourceArchived | null>>;
-    /**
-     * A TABLE AS A KIND (KINDS-GLUE wave 3, N1): `custom.table_kind_facts` verbatim — the Table's
-     * live Fields, choices and stamp, as the asking person. The door finds the Table's organization
-     * itself, so this works for a Table in any organization the person may open; anything else is
-     * refused (`42501`, the store's sentence).
-     */
-    tableKindFacts(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<TableKindFacts>>;
-    /**
-     * A TABLE'S ACCESS LEVEL (CONFIDENTIAL-BY-ORG-ADMIN): `custom.table_level_facts` verbatim - its level,
-     * readers, who approves a change (`set_by`) and whether THIS person may (`can_set`). Draw the control only
-     * when `can_set` is true; anyone who may know the table may ask.
-     */
-    tableLevelFacts(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<TableLevelFacts>>;
-    /**
-     * MAKE A CUSTOM TABLE CONFIDENTIAL, or change whom it names (`custom.set_table_confidential`). Succeeds
-     * only for an owner/admin of the table's own organization on an ordinary custom table; the approver, seat,
-     * reason and date are recorded. `readers` is the list of `{field, level}` rules (a person field of the
-     * table); `reason` is required.
-     */
-    setTableConfidential(args: {
-        table_id: Uuid;
-        readers: TableReaderRule[];
-        reason: string;
-    }): Promise<RecordsResult<TableLevelSet>>;
-    /** THE WAY BACK: the same caller rule, the table is Organization again (`custom.set_table_organization`). */
-    setTableOrganization(args: {
-        table_id: Uuid;
-        reason: string;
-    }): Promise<RecordsResult<TableLevelSet>>;
-    /**
-     * THE COLUMNS THIS TABLE HAD AND NO LONGER HAS (grids review 3): its retired Field records,
-     * newest first, through the same archived door the Table archive uses — addressed at the Field
-     * kernel (every Field is a record in it) and paged until the door answers short.
-     */
-    fieldsRetired(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<ArchivedRow[]>>;
-    /** What the registry says about a token, and whether it can hold a value at all. */
-    entityTable(args: {
-        token: string;
-    }): Promise<RecordsResult<EntityTableFacts>>;
-    /** The fields THIS organization added to that standard table. */
-    entityFields(args: {
-        token: string;
-    }): Promise<RecordsResult<Field[]>>;
-    /** The fields EVERY named organization added to that standard table, with their choices, in one read. */
-    entityFieldsAcross(args: {
-        token: string;
-        organization_ids: Uuid[];
-    }): Promise<RecordsResult<EntityFieldsAcross>>;
-    /** Add a column to a standard table. An organization admin's right - it changes the table for everybody. */
-    entityFieldDeclare(args: {
-        token: string;
-        spec: NewEntityFieldDeclaration;
-    }): Promise<RecordsResult<Uuid>>;
-    /** One field's own settings. A TYPE change is refused here by name, as it is on a custom table. */
-    entityFieldUpdate(args: {
-        field_id: Uuid;
-        patch: Record<string, unknown>;
-    }): Promise<RecordsResult<Uuid>>;
-    /** Take a custom field off a standard table. The values already written stay in each row. */
-    entityFieldRetire(args: {
-        field_id: Uuid;
-    }): Promise<RecordsResult<Uuid>>;
-    /** May this person add a column here - and if not, the store's own sentence saying why. */
-    entityFieldRights(args: {
-        token: string;
-    }): Promise<RecordsResult<EntityFieldRights>>;
-    /** REC-53 in one answer: the row's real columns AND its custom values AND the definitions. */
-    entityRecordRead(args: {
-        token: string;
-        record_id: Uuid;
-    }): Promise<RecordsResult<EntityRecordRead>>;
-    /**
-     * AP-4: the custom rows that link to one platform record, by which field and in which table.
-     * Keyed by the ROW's organization (`organization_id`), never the client's active one. Paged:
-     * pass the previous answer's `next_cursor` as `cursor`.
-     */
-    entityBackLinks(args: {
-        token: string;
-        record_id: Uuid;
-        organization_id: Uuid;
-        limit?: number;
-        cursor?: string | null;
-    }): Promise<RecordsResult<EntityBackLinks>>;
-    /**
-     * THE one write door for a standard row (`custom.entity_row_write`, as the person): custom values
-     * as a patch (a key left out is left alone, a key set to null is cleared with its envelope),
-     * archive / restore, and real columns only where the store lists them. The row's own organization
-     * governs; `expected_version` refuses a stale write; a change that changes nothing writes nothing.
-     */
-    entityRowWrite(args: {
-        token: string;
-        /**
-         * null ADDS a row (chairblk3_a): only for a token whose API facts say `create_via: "insert"`
-         * (`drill_describe(...).api.create_via` — task and project), as one insert AS THE PERSON in
-         * `organization_id` (default: this client's organization); the answer carries `created: true`
-         * and the new `id`. Every other token refuses in its own words.
-         */
-        record_id: Uuid | null;
-        /** A change by id: only to say which organization the row must belong to. A new row: where it goes. */
-        organization_id?: Uuid | null;
-        custom?: Record<string, unknown>;
-        columns?: Record<string, unknown>;
-        expected_version?: number | null;
-        archive?: boolean | null;
-    }): Promise<RecordsResult<EntityRowWritten>>;
-    /** Rows of that standard table with this custom value. Refuses a field nobody declared. */
-    entityRecordsFind(args: {
-        token: string;
-        key: string;
-        value?: unknown;
-        limit?: number;
-        offset?: number;
-    }): Promise<RecordsResult<EntityRecordsFound>>;
-    /** The kernel Tables a caller writes a Home, a Field or a Rule into. */
-    personKernelId(): Promise<RecordsResult<Uuid>>;
-    fieldKernelId(): Promise<RecordsResult<Uuid>>;
-    ruleKernelId(): Promise<RecordsResult<Uuid>>;
-    /** Every record the Rule says is a member. A saved view's list is this, not a filter a screen ran. */
-    /** PRODUCTS row 7 — the whole board: its stage column, its stages in the declared
-     *  order, and every Rule WITH the sentence it says when it refuses. */
-    pipelineRead(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<Pipeline>>;
-    /** The store's own count and total per column, over what this person may see. */
-    pipelineBoard(args: {
-        table_id: Uuid;
-        measure?: string | null;
-        /**
-         * S2-PRIME — the view's question, either shape (`StoreFilter`). Given, the headings count and
-         * total exactly the cards the same filter puts on the board (`custom.pipeline_board`'s
-         * four-argument door); left out, the whole table this person may see, as before.
-         */
-        filter?: StoreFilter | null;
-    }): Promise<RecordsResult<PipelineColumn[]>>;
-    /** Whether this card may go to that column — asked BEFORE the finger lets go. */
-    pipelineTransitionRefusal(args: {
-        record_id: Uuid;
-        to: string;
-    }): Promise<RecordsResult<PipelineVerdict>>;
-    /**
-     * Move a record to a stage. An ORDINARY record write, judged by the same Rules.
-     *
-     * It answers an OBJECT on every path. A gate whose `on_fail` is `require_approval`
-     * comes back `applied: false` with the wait it filed — the record has NOT moved, and a
-     * screen that treated the call's success as the move's success would show the card in
-     * the wrong column while somebody is still deciding.
-     */
-    pipelineMove(args: {
-        record_id: Uuid;
-        to: string;
-        also?: Record<string, unknown>;
-        expected_version?: number | null;
-    }): Promise<RecordsResult<PipelineMoveResult>>;
-    /**
-     * MOVE MANY CARDS IN ONE CALL (lane S4, `custom.pipeline_move_many`). Each card is judged by
-     * `pipeline_move` exactly as one is, in its own savepoint: a refused card writes nothing and the
-     * others still land. `expected_version` is required per card — a card that changed since the
-     * board loaded answers `changed_since_loaded` and is never overwritten. A refusal of the WHOLE
-     * call (a stranger, an empty batch, more than the `custom/batch_items_max` knob) is the error.
-     */
-    pipelineMoveMany(args: {
-        moves: PipelineMoveManyItem[];
-    }): Promise<RecordsResult<PipelineMoveMany>>;
-    /** Declare (or re-state) a pipeline: the stage column and its transition Rules. */
-    pipelineDeclare(args: {
-        table_id: Uuid;
-        spec: PipelineSpec;
-    }): Promise<RecordsResult<PipelineDeclared>>;
-    /** Which column of this table holds its stage, or null when it is not a board. */
-    tableStageField(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<string | null>>;
-    /** The closed list of what a gate does when it says no — the store is the authority. */
-    stageRuleOnFailKinds(): Promise<RecordsResult<{
-        behaviour: StageRuleOnFail;
-        note: string;
-    }[]>>;
-    /** Whether this organization's gates refuse or warn. One opinion, asked once. */
-    stageRuleEnforcement(): Promise<RecordsResult<StageRuleEnforcement>>;
-    /** What is waiting on this card: approvals filed against its own stage column. */
-    recordStagePending(args: {
-        record_id: Uuid;
-    }): Promise<RecordsResult<StagePending[]>>;
-    /** The same question for a whole board, in ONE call — what a Kanban badges cards from. */
-    pipelinePending(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<StagePendingOnBoard[]>>;
-    /**
-     * WHAT THIS GATE WOULD DO TO THIS BOARD TODAY — for a gate that has not been saved.
-     *
-     * The settings screen calls it on every edit of the condition, which is why it takes
-     * the gate rather than a rule id: no saved-rule door can answer about a rule that does
-     * not exist yet. The store compiles it with the same compiler `pipelineDeclare` uses,
-     * so the number here and the refusal at the door are the same rule — a preview with its
-     * own compiler would be wrong exactly at the edge of the condition, which is the only
-     * place anybody looks.
-     *
-     * A gate that does not say what it demands is REFUSED, not answered zero: "no cards
-     * would be stopped" beside a half-written rule is the sentence that gets it saved.
-     */
-    pipelineGatePreview(args: {
-        table_id: Uuid;
-        stage: string;
-        gate: PipelineGate | Record<string, unknown>;
-    }): Promise<RecordsResult<PipelineGatePreview>>;
-    /**
-     * SERVER LANE ONLY. `custom.rule_members` walks the whole scope table through the evaluator and
-     * returns STORED rows — no read-access ladder, no masking — so no browser role holds EXECUTE on it
-     * and it answers 42501 from a signed-in seat. A screen reads a Rule's members through
-     * `ruleMembersVisible`.
-     */
-    ruleMembers(args: {
-        rule_id: Uuid;
-    }): Promise<RecordsResult<StoredRecord[]>>;
-    /**
-     * S2-PRIME — THE MEMBERS OF A MEMBERSHIP RULE THIS PERSON MAY SEE, a page at a time
-     * (`custom.rule_members_visible`): the list door asked the Rule's own test, so the rows are the
-     * read door's — the same ladder, masked documents, the same page ceiling.
-     */
-    ruleMembersVisible(args: {
-        rule_id: Uuid;
-        limit?: number;
-        offset?: number;
-    }): Promise<RecordsResult<ReadRow[]>>;
-    /** Is this one record a member, and WHY — the store's own answer. */
-    ruleMembership(args: {
-        rule_id: Uuid;
-        record_id: Uuid;
-    }): Promise<RecordsResult<unknown>>;
-    /** Run a stored Rule against a document. */
-    ruleRun(args: {
-        rule_id: Uuid;
-        values: Record<string, unknown>;
-        context?: Record<string, unknown>;
-    }): Promise<RecordsResult<unknown>>;
-    /** Evaluate a Rule expression that has not been stored — the conditional logic a form runner asks about. */
-    ruleEval(args: {
-        expr: unknown;
-        values: Record<string, unknown>;
-        context?: Record<string, unknown>;
-    }): Promise<RecordsResult<unknown>>;
-    /**
-     * Write ONE Rule as a real Rule. `recordWrite` into the Rule kernel makes a
-     * valid Rule document that carries `data_class = 'record'`, and every reader
-     * that looks for a Rule looks for the class — `custom.agg_subscriptions`
-     * selects `where data_class = 'rule'` — so a subscription written that way
-     * fires at nobody. This is the door that closes it.
-     */
-    /** This organization's forms, with how many answers arrived and how many are in the table. */
-    forms(args?: {
-        table_id?: Uuid | null;
-    }): Promise<RecordsResult<FormSummary[]>>;
-    /**
-     * THIS ORGANIZATION'S BOOKING PAGES (PRODUCTS row 14), with the numbers that make
-     * the list worth opening: how many are booked, cancelled, still ahead, and how many
-     * slots somebody is holding right now. A booking page is an `anon_form`, so it is
-     * opened and closed with `anonPublish` exactly as a form is.
-     */
-    bookings(args?: {
-        table_id?: Uuid | null;
-    }): Promise<RecordsResult<BookingSummary[]>>;
-    /**
-     * CREATE OR RE-STATE ONE BOOKING PAGE over one Table. `admin` on the Table,
-     * because a booking page decides what a stranger may write into it and which
-     * hours of the organization's week are on offer.
-     *
-     * `slot`, `status` and `booked_with` are the store's to fill in: a question
-     * naming any of the three is refused BY NAME, so a page cannot be built that
-     * lets a visitor choose their own status. It does NOT publish — `anonPublish`
-     * is the one act that opens a public surface, for a booking page exactly as
-     * for a form.
-     *
-     * Until 2026-09-21 this door had no client method, so the ONLY way to a
-     * booking page was to ask an agent for one. The agent path is the faster one,
-     * never the only one.
-     */
-    bookingDeclare(args: {
-        table_id: Uuid;
-        title: string;
-        questions: unknown[];
-        availability?: Partial<BookingAvailability> | null;
-        presentation?: Record<string, unknown> | null;
-        submission_cap?: number | null;
-        quarantine_rule_id?: Uuid | null;
-        notify_rule_id?: Uuid | null;
-        form_id?: Uuid | null;
-        slug?: string | null;
-        home_id?: Uuid | null;
-    }): Promise<RecordsResult<BookingDeclared>>;
-    /** Create or re-state one form. A question naming no Field of that Table is refused BY NAME. */
-    formDeclare(args: {
-        table_id: Uuid;
-        title: string;
-        questions: unknown[];
-        presentation?: Record<string, unknown> | null;
-        submission_cap?: number | null;
-        quarantine_rule_id?: Uuid | null;
-        notify_rule_id?: Uuid | null;
-        form_id?: Uuid | null;
-        slug?: string | null;
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * WHICH OF A FORM'S QUESTIONS ARE ASKED, given the answers so far — for the OWNER's preview of
-     * a draft (`custom.form_preview_asks`). One row per question in order; `asked` is false only
-     * when the store's own Rule said so. Undecided and unworkable conditions are asked, the second
-     * with the store's sentence in `said`.
-     */
-    formPreviewAsks(args: {
-        table_id: Uuid;
-        questions: unknown[];
-        values: Record<string, unknown>;
-    }): Promise<RecordsResult<Array<{
-        field_key: string;
-        asked: boolean;
-        decided: boolean;
-        said: string | null;
-    }>>>;
-    /**
-     * WHAT A FORM'S LOOK MAY BE, AND WHAT IT WOULD LOOK LIKE (`custom.form_look_options`): the
-     * organization's public pictures (the same list a portal's look offers), the colours, and the
-     * look a stranger would see for the draft `presentation` — the builder's preview draws that.
-     */
-    formLookOptions(args?: {
-        presentation?: Record<string, unknown> | null;
-    }): Promise<RecordsResult<FormLookOptions>>;
-    /**
-     * THE ROUTE THROUGH A DRAFT FORM (`custom.form_preview_route`, lane TYPEFORM-DUP): which questions
-     * are asked given the answers so far (showIf AND logic jumps), the ending reached and the score —
-     * the store's walk, the one the stranger's page and `custom.form_submit` read too.
-     */
-    formPreviewRoute(args: {
-        table_id: Uuid;
-        questions: unknown[];
-        endings?: unknown[] | null;
-        values: Record<string, unknown>;
-    }): Promise<RecordsResult<FormRoute>>;
-    /** A form's results (`custom.form_results`): views, starts, completions, drop-off, answers. */
-    formResults(args: {
-        form_id: Uuid;
-    }): Promise<RecordsResult<FormResults>>;
-    /** TYPEFORM-2: the organization's form knobs (`custom.form_knobs`): owner header, choice auto-advance. */
-    formKnobs(): Promise<RecordsResult<{
-        show_owner_header: boolean;
-        choice_auto_advance: boolean;
-    }>>;
-    /**
-     * What the store makes of a file's columns, before anything is written.
-     * `columns` is `[{header, samples}]` — the first page of the file is plenty.
-     */
-    importPlan(args: {
-        table_id: Uuid;
-        columns: Array<{
-            header: string;
-            samples: unknown[];
-        }>;
-    }): Promise<RecordsResult<ImportPlan>>;
-    /**
-     * Open a run. `file_hash` is the run's IDENTITY: the same bytes into the same
-     * table a second time answer the FIRST run with `already: true` and write
-     * nothing, so a re-import doubles nothing. `force` re-opens deliberately.
-     */
-    importBegin(args: {
-        table_id: Uuid;
-        format?: "csv" | "xlsx";
-        source_name?: string | null;
-        source_columns?: unknown[];
-        file_hash?: string | null;
-        policy?: ImportPolicy;
-        /** A Field key. A row whose value for it is already here is a duplicate. */
-        dedupe_key?: string | null;
-        file_bytes?: number | null;
-        force?: boolean;
-    }): Promise<RecordsResult<ImportOpened>>;
-    /**
-     * IMPORT-2. ADD THE COLUMNS THIS FILE HAS AND THIS TABLE HAS NOT — a step of
-     * its own, BEFORE the run is opened, so the screen can show "8 columns added"
-     * and the person can then name one of them as the file's duplicate key
-     * (`importBegin` refuses a key naming a column that does not exist yet).
-     * Answers the mapping the file should be sent with. Admin on the Table.
-     */
-    importDeclareColumns(args: {
-        table_id: Uuid;
-        rows: Array<Record<string, unknown>>;
-        /** Header -> Field key the person already mapped by hand; never declared. */
-        mapping?: Record<string, string>;
-    }): Promise<RecordsResult<ImportColumnsDeclared>>;
-    /**
-     * One BATCH of rows. The batch is PLANNED and then written as ONE statement
-     * through the batched write door, so 250 round trips became one; a batch a
-     * guard refuses falls back to one write a row, and the answer says which it
-     * was. Send `ImportOpened.rows_per_call` the first time and
-     * `ImportBatchResult.rows_per_call` — measured — every time after that.
-     */
-    importRows(args: {
-        import_id: Uuid;
-        rows: Array<Record<string, unknown>>;
-        /** Header -> Field key. A header that already spells a key needs no entry. */
-        mapping?: Record<string, string>;
-    }): Promise<RecordsResult<ImportBatchResult>>;
-    /**
-     * Close the run and decide the columns the file had and the table did not:
-     * `propose` (the ONE approvals inbox, and the only choice a non-admin has),
-     * `create` (an admin adds them outright) or `ignore`.
-     */
-    importFinish(args: {
-        import_id: Uuid;
-        unmapped?: "propose" | "create" | "ignore";
-    }): Promise<RecordsResult<ImportFinished>>;
-    /** The refused rows, or the ones already here, WITH the source row on each. */
-    importReport(args: {
-        import_id: Uuid;
-        state?: "refused" | "duplicate";
-        limit?: number;
-        offset?: number;
-    }): Promise<RecordsResult<ImportReport>>;
-    /** This organization's import runs, newest first. How you find yesterday's. */
-    imports(args?: {
-        table_id?: Uuid | null;
-        limit?: number;
-    }): Promise<RecordsResult<ImportRun[]>>;
-    /**
-     * Forget the RECEIPT for a file so the same bytes can be imported again
-     * deliberately. Never touches the records that import wrote.
-     */
-    importForget(args: {
-        import_id: Uuid;
-    }): Promise<RecordsResult<boolean>>;
-    /**
-     * Give a table its own address. The answer carries `mail_route`: the one
-     * sentence saying what has to exist in DNS before anything arrives. Show it
-     * wherever the address is shown — an address that silently swallows mail is
-     * the failure this whole door is against.
-     */
-    inboundDeclare(args: {
-        table_id: Uuid;
-        label?: string | null;
-    }): Promise<RecordsResult<InboundDeclared>>;
-    inboundAddresses(args?: {
-        table_id?: Uuid | null;
-    }): Promise<RecordsResult<InboundAddress[]>>;
-    inboundSet(args: {
-        inbound_id: Uuid;
-        enabled: boolean;
-    }): Promise<RecordsResult<{
-        inbound_id: Uuid;
-        address: string;
-        enabled: boolean;
-        message: string;
-    }>>;
-    /** Every portal over this organization the caller may know about, with its numbers. */
-    portals(): Promise<RecordsResult<PortalSummary[]>>;
-    /**
-     * The SAME list, archive-aware. `custom.portals` keeps its signature and hides
-     * archived portals, because the archived-items law's default is to hide;
-     * this is the one door that also answers the other lane, so a rail gets the
-     * law's one-click reveal without inventing a second control or a second door.
-     * A fourth word is refused `22023` — there is no fourth answer on any surface.
-     */
-    listPortals(args?: {
-        archived?: PortalArchiveFilter;
-    }): Promise<RecordsResult<PortalSummary[]>>;
-    /**
-     * PUT ONE PORTAL AWAY. Nothing is deleted and there is no purge: every Table
-     * it exposes and every person invited to it is kept exactly as it is, and
-     * `portalRestore` hands it all back. `confirm_title` is the portal's own title
-     * typed back — ten portals can carry one title, so the title is not what picks
-     * this one and the door refuses `23514` when it does not match.
-     */
-    portalArchive(args: {
-        portal_id: Uuid;
-        confirm_title: string;
-        reason?: string | null;
-    }): Promise<RecordsResult<PortalArchiveAnswer>>;
-    /** The way back. Everyone invited signs in exactly as before, and it shows the same Tables. */
-    portalRestore(args: {
-        portal_id: Uuid;
-        confirm_title: string;
-    }): Promise<RecordsResult<PortalArchiveAnswer>>;
-    /**
-     * PUT ONE FORM OR BOOKING PAGE AWAY (`custom.form_archive`, admin on its table). Its address stops
-     * answering; everything it collected is kept. `formRestore` brings it back.
-     */
-    formArchive(args: {
-        form_id: Uuid;
-    }): Promise<RecordsResult<FormArchiveAnswer>>;
-    formRestore(args: {
-        form_id: Uuid;
-    }): Promise<RecordsResult<FormArchiveAnswer>>;
-    /** The archived forms and booking pages, newest first; `table_id` narrows to one table. */
-    formsArchived(args?: {
-        table_id?: Uuid | null;
-        limit?: number;
-    }): Promise<RecordsResult<ArchivedForm[]>>;
-    /**
-     * The archived checklist templates. A template is a record: `recordDelete` archives it and
-     * `recordRestore` brings it back.
-     */
-    checklistTemplatesArchived(args?: {
-        about_table_id?: Uuid | null;
-        limit?: number;
-    }): Promise<RecordsResult<ArchivedChecklistTemplate[]>>;
-    /** What a table's NEW rows start with (Shown to, and the web half once it lands). */
-    tableRowDefaults(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<TableRowDefaults>>;
-    /** Set them (the table's maker or an admin of it). A key left out is left alone; null = the default. */
-    tableRowDefaultsSet(args: {
-        table_id: Uuid;
-        defaults: TableRowDefaultsPatch;
-    }): Promise<RecordsResult<TableRowDefaults>>;
-    /**
-     * ONE PASS of "apply to existing rows": rows nobody set by hand follow the table's defaults.
-     * `done: false` → call again with `after: next_after`. `rowDefaultsApplyAll` walks every pass.
-     */
-    tableRowDefaultsApply(args: {
-        table_id: Uuid;
-        after?: Uuid | null;
-    }): Promise<RecordsResult<RowDefaultsApplied>>;
-    /** Every pass of `tableRowDefaultsApply`, summed; the last pass's sentence when it took one pass. */
-    rowDefaultsApplyAll(args: {
-        table_id: Uuid;
-        maxPasses?: number;
-    }): Promise<RecordsResult<RowDefaultsApplied>>;
-    /** One row's Shown to (and web half), with who may change it. */
-    recordRowControls(args: {
-        record_id: Uuid;
-    }): Promise<RecordsResult<RecordRowControls>>;
-    recordRowControlsSet(args: {
-        record_id: Uuid;
-        controls: {
-            shown_to?: string | null;
-            published_to_web?: boolean;
-            indexed?: boolean | null;
-        };
-    }): Promise<RecordsResult<RecordRowControls>>;
-    /**
-     * Which Tables each portal of this organization exposes.
-     *
-     * The one question a TABLE-scoped Portals rail has to ask: "is the table I
-     * am standing on in any portal?" Same wall and same read-access gate as
-     * `portals`, so a pair here is always a portal `portals` also returned.
-     */
-    portalTables(): Promise<RecordsResult<PortalTableRef[]>>;
-    /** ONE portal in full: what it shows, and who it was opened to. */
-    portalCard(args: {
-        portal_id: Uuid;
-    }): Promise<RecordsResult<PortalCard>>;
-    /**
-     * Create or RE-STATE one portal. Re-stating REPLACES what it exposes — a
-     * Table left out of `tables` stops being exposed in the same act — and leaves
-     * the people alone: who is invited is not part of what the portal shows.
-     */
-    portalDeclare(args: {
-        title: string;
-        client_table_id: Uuid;
-        tables: Array<{
-            table_id: Uuid;
-            names_via: string;
-            visible_fields?: string[];
-            editable_fields?: string[];
-            comments?: boolean;
-        }>;
-        portal_id?: Uuid | null;
-        slug?: string | null;
-        sign_in_method?: string | null;
-        /**
-         * S6 — the portal's own look and its forms. A key given REPLACES that key; a key not given
-         * is KEPT (leave `config` out and both stay exactly as they are). The store judges it and
-         * refuses by name: a logo that is not a public picture of this organization's Files, an
-         * accent that is not a design-system colour name, a form whose Table the portal does not show.
-         */
-        config?: PortalConfigInput | null;
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * S6 — THE CLIENT'S SIDE: one form of HER portal (`custom.portal_form`). Refused unless the
-     * caller is a live principal of that live portal and the form is on its list; the Field that
-     * names the client is never one of the questions — the portal fills it.
-     */
-    portalForm(args: {
-        portal_id: Uuid;
-        form_id: Uuid;
-    }): Promise<RecordsResult<PortalFormSpec>>;
-    /**
-     * S6 — send one form of her portal (`custom.portal_form_submit`). The store fills the Field
-     * that names the client with her own record, and the answer reaches her own list at once
-     * (`accepted`) or waits for the office (`held`, with the store's sentence). `client_key`
-     * makes a retry the same submission.
-     */
-    portalFormSubmit(args: {
-        portal_id: Uuid;
-        form_id: Uuid;
-        answers: Record<string, unknown>;
-        client_key?: string | null;
-    }): Promise<RecordsResult<PortalFormAnswer>>;
-    /**
-     * Invite one person, as one record of the portal's client Table.
-     *
-     * `user_id` is deliberately NOT a parameter here. From a screen it is always
-     * null: an invitation confers NOTHING until the person follows their sign-in
-     * link and the platform gives them an identity, and the door's own `say`
-     * sentence states exactly that. A screen that passed an id would be granting
-     * access on somebody else's behalf.
-     */
-    portalInvite(args: {
-        portal_id: Uuid;
-        client_record_id: Uuid;
-        email: string;
-    }): Promise<RecordsResult<PortalInvitation>>;
-    /** Take one person's way in away. The answer's `say` names the consequence. */
-    portalRevoke(args: {
-        portal_id: Uuid;
-        principal_id: Uuid;
-    }): Promise<RecordsResult<PortalRevocation>>;
-    /**
-     * VIEW AS THIS CLIENT. The door asks `custom.visible_set` for HER user id —
-     * the same call `custom.read_records` makes when she opens the page — so this
-     * cannot disagree with what she sees. It REFUSES with `02000` and a sentence
-     * when she has not signed in yet; show the sentence, never an empty list.
-     */
-    portalPreview(args: {
-        portal_id: Uuid;
-        principal_id: Uuid;
-        table_id: Uuid;
-    }): Promise<RecordsResult<PortalPreviewRow[]>>;
-    /** This organization's dashboards, optionally only those whose subject is one Table. */
-    dashboards(args?: {
-        table_id?: Uuid | null;
-    }): Promise<RecordsResult<DashboardSummary[]>>;
-    /**
-     * Create or re-state one dashboard. Every block is judged on the way IN —
-     * a block naming a field this Table does not have is refused BY NAME, with
-     * the table's own field list in the hint — so a canvas cannot be saved broken.
-     */
-    dashboardDeclare(args: {
-        table_id: Uuid;
-        name: string;
-        blocks?: DashboardBlock[];
-        presentation?: Record<string, unknown> | null;
-        dashboard_id?: Uuid | null;
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * Run every block and answer the numbers. `filter` is the ONE filter bar
-     * across the canvas: it is merged UNDER each block's own filter, so a block
-     * deliberately scoped to one stage stays scoped while the bar moves the rest.
-     * A block that refuses carries the store's sentence and the others still answer.
-     */
-    dashboardRun(args: {
-        dashboard_id: Uuid;
-        filter?: RecordFilter;
-        /**
-         * S3 — compare every block that does not carry its own comparison (the
-         * block's own wins, as its own filter does). A block with no date to
-         * compare along answers alone and says so in `compare_refused`.
-         */
-        compare?: AggregateCompare | null;
-        /** S3 — re-cut every bucketed block to one date grain (the canvas's picker). */
-        grain?: AggregateBucket | null;
-    }): Promise<RecordsResult<DashboardRunResult>>;
-    /** The seventh block kind on its own: records that have sat on the same value too long. */
-    dashboardStuck(args: {
-        table_id: Uuid;
-        state_key: string;
-        days?: number;
-        filter?: RecordFilter;
-        limit?: number;
-    }): Promise<RecordsResult<StuckRow[]>>;
-    /**
-     * Declare or re-state a crew capture sheet over a Table. Admin on the Table.
-     * Closed to the crew until `capturePublish`, like every publishing act here.
-     */
-    captureSheetDeclare(args: {
-        table_id: Uuid;
-        title: string;
-        questions: Array<Record<string, unknown>>;
-        presentation?: Record<string, unknown> | null;
-        sheet_id?: Uuid | null;
-        notify_rule_id?: Uuid | null;
-    }): Promise<RecordsResult<Uuid>>;
-    /** Open the sheet to the crew, or close it. Admin on the Table. */
-    capturePublish(args: {
-        sheet_id: Uuid;
-        open?: boolean;
-    }): Promise<RecordsResult<string | null>>;
-    /** The crew sheets of this organization, with what has come in through each. */
-    captureSheets(args?: {
-        table_id?: Uuid | null;
-    }): Promise<RecordsResult<CaptureSheetSummary[]>>;
-    /**
-     * Everything a phone needs to run one sheet OFFLINE — the questions, the Fields
-     * with their ids and parity types, and an honest `may_capture` with a sentence.
-     * Load it once on a signal; it is the last network call before the walk.
-     */
-    captureOpen(args: {
-        sheet_id: Uuid;
-    }): Promise<RecordsResult<CaptureSheetFace | null>>;
-    /**
-     * One capture: the answers, the file references, the device, the moment the phone
-     * took it and the place. Idempotent on `client_key`, which the PHONE mints when
-     * the capture is taken, offline, before its first attempt — send the same key on
-     * every retry and the answer comes back `replay: true` with the first record's id.
-     */
-    captureSubmit(args: {
-        sheet_id: Uuid;
-        client_key: string;
-        answers: Record<string, unknown>;
-        files?: CaptureFileRef[];
-        device?: string | null;
-        captured_at?: string | null;
-        location?: Record<string, unknown> | null;
-    }): Promise<RecordsResult<CaptureOutcome | null>>;
-    /** Every agent-owned column, with how many cells are filled, stale or pinned, and what it has cost. */
-    enrichments(args?: {
-        table_id?: Uuid | null;
-    }): Promise<RecordsResult<EnrichmentSummary[]>>;
-    /**
-     * Define, change or TURN ON an Enrichment on one Field. Admin on the Table.
-     * `{enabled: true}` on its own turns an existing one on without resetting it —
-     * and turning it on is what authorises every value it writes afterwards.
-     */
-    enrichDeclare(args: {
-        field_id: Uuid;
-        spec: Record<string, unknown>;
-    }): Promise<RecordsResult<EnrichDeclared>>;
-    /**
-     * The rows that need this column filled in, each with what the instruction may
-     * read. A cell somebody pinned is never returned. This is what a PREVIEW shows
-     * before anybody enables anything.
-     */
-    enrichDue(args: {
-        field_id: Uuid;
-        limit?: number;
-        include_fresh?: boolean;
-    }): Promise<RecordsResult<EnrichDueRow[]>>;
-    /**
-     * THE BADGE DATA FOR A WHOLE PAGE, in one call. Who wrote each value, when, out
-     * of what source, its candidates, whether a person pinned it and whether it is
-     * past its freshness date. Asked per cell this would be one round trip per badge.
-     */
-    enrichCells(args: {
-        table_id: Uuid;
-        field_keys?: string[] | null;
-        record_ids?: Uuid[] | null;
-    }): Promise<RecordsResult<EnrichCell[]>>;
-    /** Hold one cell against the model that fills its column, or hand it back. */
-    enrichPin(args: {
-        record_id: Uuid;
-        field_key: string;
-        pinned?: boolean;
-    }): Promise<RecordsResult<{
-        pinned: boolean;
-        says: string;
-    }>>;
-    /** What this column has cost, run by run. */
-    enrichRuns(args?: {
-        field_id?: Uuid | null;
-        limit?: number;
-    }): Promise<RecordsResult<EnrichRun[]>>;
-    /** Take a dashboard away. The records it counted are untouched — a canvas owns nothing. */
-    dashboardDelete(args: {
-        dashboard_id: Uuid;
-    }): Promise<RecordsResult<boolean>>;
-    /**
-     * Group, bucket, filter and measure INSIDE `custom.record_aggregate`. The
-     * aggregate node sits above the read-access join, so what a chart draws is
-     * exactly what this person may see — the rest is never fetched, let alone
-     * summed and then hidden.
-     */
-    recordAggregate(args: {
-        table_id: Uuid;
-        /**
-         * OPTIONAL FILTER (active-org law): with `config.organizationIds` set, the table is looked
-         * up across all the person's organizations and the aggregate runs in the one that OWNS it
-         * (each row then carries that `organization_id`); this narrows the lookup to one. Absent and
-         * no `organizationIds` ⇒ this client's own organization, exactly as before.
-         */
-        organization_id?: Uuid | null;
-        /** Field keys whose values become the groups. */
-        groupBy?: string[];
-        /** `count` needs no key; every other operation reads one Field. */
-        measures?: AggregateMeasure[];
-        /** A date Field truncated to a period — a group whose expression is a date_trunc. */
-        bucket?: {
-            key: string;
-            by: AggregateBucket;
-        } | null;
-        /**
-         * A scalar is an equality and an object is a half-open moment window, and
-         * either way it lands in the SAME WHERE as read access.
-         */
-        filter?: StoreFilter;
-        limit?: number;
-        /**
-         * S3 — answer the same question over a prior window too (previous period,
-         * same period last year, or a fixed baseline). Each row then carries
-         * `prior_measures`, `delta` and the two `compare` windows. Buckets are cut
-         * in the organization's calendar (knobs `custom/time_zone`, `custom/week_start`).
-         */
-        compare?: AggregateCompare | null;
-        /**
-         * The grid's search, narrowing the answer to the rows `listPage`'s search would show (the
-         * same predicate, `custom.record_search_sql`). Blank or absent: nothing changes.
-         */
-        search?: string | null;
-        /** The reader's time zone for the search's date matches (absent = the organization's calendar). */
-        time_zone?: string | null;
-    }): Promise<RecordsResult<AggregateRow[]>>;
-    /** Historical aggregate computed by the store at its recorded-time read door. */
-    recordAggregateAsOf(args: {
-        table_id: Uuid;
-        recorded_at: string;
-        measure?: string;
-        field_key?: string | null;
-        group_by?: string | null;
-        match?: Record<string, unknown>;
-    }): Promise<RecordsResult<Array<{
-        bucket: string | null;
-        result: number | null;
-        row_count: number;
-        not_numbers: number;
-        a_non_number: string | null;
-    }>>>;
-    /** The measures the store itself offers. Asked, never hardcoded in a picker. */
-    aggOperations(): Promise<RecordsResult<string[]>>;
-    /** The periods the store itself buckets by. */
-    aggBuckets(): Promise<RecordsResult<string[]>>;
-    /**
-     * The organization's calendar (knobs `custom/time_zone`, `custom/week_start`), cut by the SAME door the
-     * relative date filters and the chart buckets use. A calendar or timeline reads its first day of the week
-     * from here, never from a constant of its own (lane NOTION-SMALL-4).
-     */
-    aggCalendar(): Promise<RecordsResult<{
-        time_zone: string;
-        week_start: string;
-    }>>;
-    /**
-     * A source's drill definition — its Dimensions, Measures, drill paths and first screen.
-     * `{kind: "table", id}` is a custom Table; `{kind: "entity", token}` a standard table by its
-     * registry token or a declared definition by its key.
-     */
-    drillDescribe(args: {
-        source: DrillSource;
-    }): Promise<RecordsResult<DrillDefinition>>;
-    /**
-     * Ask a source a question: grouped, bucketed (day…year in the organization's calendar),
-     * compared, pivoted. A standard table is counted AS THE PERSON (its own row security decides
-     * every row); groups past the cap fold into one Other row and the total row says so.
-     */
-    drillAsk(args: {
-        source: DrillSource;
-        question?: DrillQuestion;
-    }): Promise<RecordsResult<DrillAnswer>>;
-    /** The records behind a number, through the same filter, read as the person. */
-    drillRows(args: {
-        source: DrillSource;
-        where?: DrillQuestion["where"];
-        window?: DrillQuestion["window"];
-        sort?: DrillQuestion["sort"];
-        lane?: DrillQuestion["lane"];
-        columns?: string[];
-        limit?: number;
-        offset?: number;
-        /** The viewer's search term, asked of the door (`platform._drill_compile` reads `question.search`). */
-        search?: string;
-    }): Promise<RecordsResult<DrillRowsPage>>;
-    /**
-     * Every subscription in this organization, optionally narrowed to one saved
-     * view or one cadence. There is no subscription table: each one is a Rule
-     * record carrying a `subscription` block, so a subscription is readable,
-     * historied and agent-writable like anything else.
-     */
-    aggSubscriptions(args?: {
-        saved_view_id?: Uuid | null;
-        cadence?: string | null;
-    }): Promise<RecordsResult<Subscription[]>>;
-    /** The cadences the store itself offers. Asked, never hardcoded in a picker. */
-    aggSubscriptionCadences(): Promise<RecordsResult<string[]>>;
-    /**
-     * The same cadences, through the door a PERSON may call.
-     * `aggSubscriptionCadences` is the notifier's own and holds no client grant,
-     * so a screen that asked for it was refused and fell back to a list typed
-     * into the picker — which drifts from what the digest runner honours. This
-     * one delegates to the same array, so there is exactly one list.
-     */
-    subscriptionCadences(): Promise<RecordsResult<string[]>>;
-    /**
-     * WHAT THIS PERSON IS BEING TOLD ABOUT, and what they may switch off.
-     *
-     * Mine, plus anyone's over a Table I hold admin on — narrowed to Tables I can
-     * already open, so the list never reveals one. `aggSubscriptions` above is the
-     * NOTIFIER's reader and no client can call it; this is the owner's.
-     */
-    subscriptions(args?: {
-        table_id?: Uuid | null;
-    }): Promise<RecordsResult<MySubscription[]>>;
-    /**
-     * Switch one on or off. Muting is honoured in ONE place — the reader every
-     * consumer goes through — so a screen can never say a subscription is off
-     * while it keeps firing.
-     */
-    subscriptionMute(args: {
-        rule_id: Uuid;
-        muted: boolean;
-    }): Promise<RecordsResult<boolean>>;
-    /**
-     * WRITE ONE. The store refuses a cadence no runner acts on, a channel this
-     * platform does not send on and quiet hours nobody can parse — by name — then
-     * declares the Rule through `rule_declare`, because a Rule written as a record
-     * carries `data_class = 'record'` and every reader that goes looking for a Rule
-     * steps straight past it (REC-72).
-     */
-    subscriptionDeclare(args: {
-        table_id: Uuid;
-        spec: SubscriptionSpec;
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * SHOW ME ONE NOW. The summary this subscription would send at this moment, with
-     * what entered, left and changed NAMED. It assembles only: nothing is delivered,
-     * nothing is recorded and the watermark does not move.
-     */
-    subscriptionPreview(args: {
-        rule_id: Uuid;
-    }): Promise<RecordsResult<DigestPreview>>;
-    /**
-     * THE SAVED VIEWS OF A TABLE — what a subscription may be written over. Narrowed
-     * in SQL as the definer to Tables this caller can already open, so the list can
-     * never reveal a Table.
-     */
-    views(args?: {
-        table_id?: Uuid | null;
-    }): Promise<RecordsResult<SavedViewRow[]>>;
-    /**
-     * SAVE ONE VIEW. VIEWER on the Table, not editor: writing down a question about a
-     * Table is not changing it, and requiring editor would mean the people who read a
-     * Table could not subscribe to anything in it.
-     */
-    viewDeclare(args: {
-        table_id: Uuid;
-        spec: SavedViewSpecIn;
-    }): Promise<RecordsResult<Uuid>>;
-    /** A Table's row templates ("New from template"). VIEWER on the Table. */
-    rowTemplates(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<RowTemplateRow[]>>;
-    /**
-     * SAVE ONE ROW TEMPLATE — `{name, values}` by Field key; the same name again changes it, and
-     * `{template_id, archived: true}` archives it. EDITOR on the Table: it is how everyone's new rows start.
-     */
-    rowTemplateDeclare(args: {
-        table_id: Uuid;
-        spec: {
-            name?: string;
-            values?: Record<string, unknown>;
-            template_id?: Uuid;
-            archived?: boolean;
-        };
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * DESIGNATE HOW A TABLE OPENS — "Make this the default". EDITOR on the Table: the named view
-     * becomes the table's only default and, when `layout` is given, that is the layout everyone opens
-     * it in. A layout press never designates (`viewDeclare` refuses the default view's layout and
-     * is_default by name — VIEW-SWITCH-NOT-DESIGNATION, VERIFIER-21).
-     */
-    viewDesignate(args: {
-        table_id: Uuid;
-        view_id: Uuid;
-        layout?: string | null;
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * ARCHIVE ONE SAVED VIEW (lane TABLE-ACTIONS, T3.5). The soft delete of the `platform.saved_view`
-     * row behind it — `public.saved_view_archive('custom/records', id)`, which asks its own ladder
-     * (the view's creator, or admin on the view) and clears a default it held. The records are
-     * untouched. `null` when the view was already gone. `viewRestore` (or Trash) brings it back.
-     */
-    viewArchive(args: {
-        view_id: Uuid;
-    }): Promise<RecordsResult<Record<string, unknown> | null>>;
-    /** PUT AN ARCHIVED VIEW BACK — the platform's one restore door, `public.entity_undelete('platform_saved_view', id)`. */
-    viewRestore(args: {
-        view_id: Uuid;
-    }): Promise<RecordsResult<boolean>>;
-    /**
-     * THE CALLER'S OWN LOOK AT EACH SAVED VIEW OF A TABLE — `{ "<view id>": { look, updated_at } }`.
-     * A look is the view settings one person chose while looking (a board's grouping, a calendar's
-     * date field, a sort, a filter, hidden columns, widths, the layout), kept for her alone until an
-     * editor saves it onto the view with `viewDeclare` ("Save to view"). Viewer on the Table.
-     */
-    viewLookRead(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<Record<string, {
-        look: Record<string, unknown>;
-        updated_at: string;
-    }>>>;
-    /**
-     * KEEP THE CALLER'S OWN LOOK AT ONE VIEW — the whole look, as definition keys (`group_field`,
-     * `date_field`, `sorts`, `where`, `presentation`, `layout`, …; a key set to null hides the view's
-     * own). `look: null` is "Reset to view". The shared view row is never written. Answers the look
-     * as kept (null after a reset).
-     */
-    viewLookSet(args: {
-        table_id: Uuid;
-        view_id: Uuid;
-        look: Record<string, unknown> | null;
-    }): Promise<RecordsResult<Record<string, unknown> | null>>;
-    docTemplateSave(args: {
-        table_id: Uuid;
-        name: string;
-        body: string;
-        template_id?: Uuid | null;
-    }): Promise<RecordsResult<Uuid>>;
-    /** The body with every token resolved against one record. Read-only, no render row. */
-    docRenderBody(args: {
-        template_id: Uuid;
-        record_id: Uuid;
-    }): Promise<RecordsResult<string>>;
-    /** Write the render — frozen bytes a signature can be checked against. */
-    docRenderDocument(args: {
-        template_id: Uuid;
-        record_id: Uuid;
-    }): Promise<RecordsResult<Uuid>>;
-    /** Every token in a body, in order, with the Field id each one points at. */
-    docTokens(args: {
-        body: string;
-    }): Promise<RecordsResult<DocToken[]>>;
-    /** The tokens this Table cannot answer, each with the store's own reason. */
-    docUnresolvedTokens(args: {
-        table_id: Uuid;
-        body: string;
-    }): Promise<RecordsResult<DocUnresolvedToken[]>>;
-    docSign(args: {
-        render_id: Uuid;
-        field_key: string;
-        signer_name: string;
-        signer_user_id?: Uuid | null;
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * One signature: the seal AND whether what was signed is still what is there.
-     * The store answers both, in one call, never the screen. Viewer on the record.
-     */
-    docSignatureRead(args: {
-        signature_id: Uuid;
-    }): Promise<RecordsResult<unknown>>;
-    /** Every template that renders one Table. Viewer on the Table. */
-    docTemplates(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<DocTemplateRow[]>>;
-    /**
-     * Retire one template. EDITOR on the Table it renders, because a template is
-     * that Table's wording. Documents already rendered keep their frozen bytes
-     * and their seals, so this can never invalidate a signature.
-     */
-    docTemplateDelete(args: {
-        template_id: Uuid;
-    }): Promise<RecordsResult<boolean>>;
-    /** Every frozen render of one record, newest first. Viewer on the record. */
-    docRenders(args: {
-        record_id: Uuid;
-    }): Promise<RecordsResult<DocRenderRow[]>>;
-    /** Every signature on one record. Viewer on the record. */
-    docSignatures(args: {
-        record_id: Uuid;
-    }): Promise<RecordsResult<DocSignatureRow[]>>;
-    /**
-     * DOOR-11. One record's revisions, newest first. The read door answers
-     * documents and deliberately not versions, so a screen that wants to save
-     * optimistically reads the version of the record it LOADED from here — for
-     * the one record being edited, never for a list.
-     */
-    revisions(args: {
-        record_id: Uuid;
-    }): Promise<RecordsResult<RecordRevision[]>>;
-    /**
-     * PRODUCTS row 4. One record's version list, newest first: who (a person, or
-     * an agent AND the person it acted for), when, the operation in the word
-     * somebody used, and every field that moved with its before, its after, the
-     * Rule version that produced a derived value and its source pointer. Viewer
-     * on the record — reading how something got to be the way it is is reading.
-     */
-    recordHistory(args: {
-        record_id: Uuid;
-        limit?: number;
-        offset?: number;
-    }): Promise<RecordsResult<RecordHistoryEntry[]>>;
-    /**
-     * AGT-N-9 — EVERYTHING A CHAT OPENED ON THIS RECORD MAY KNOW, IN ONE ROUND TRIP.
-     *
-     * The Fields with their `(record, field, value version)` triples, the relations one hop
-     * out, the history, the comments and the Table's other records — assembled INSIDE the
-     * database, every piece through the read door, under this person's own field-level
-     * security. A Field the store masks comes back in `withheld` with the store's own
-     * sentence and no value; a Field the organization keeps out of conversations comes back
-     * there too, saying which of the two it is.
-     */
-    recordScopeContext(args: {
-        record_id: Uuid;
-        relations?: number;
-        history?: number;
-        siblings?: number;
-    }): Promise<RecordsResult<RecordScopeContext>>;
-    /** What is this conversation about? */
-    conversationScope(args: {
-        conversation_id: Uuid;
-    }): Promise<RecordsResult<ConversationScope>>;
-    /** Point a conversation at one record. Refused unless this person may open it. */
-    conversationScopeBind(args: {
-        conversation_id: Uuid;
-        record_id: Uuid;
-    }): Promise<RecordsResult<ConversationScope>>;
-    /** This conversation is no longer about a particular record. */
-    conversationScopeUnbind(args: {
-        conversation_id: Uuid;
-    }): Promise<RecordsResult<ConversationScope>>;
-    /** The binding AND the context of a bound conversation, in one round trip. */
-    conversationScopeContext(args: {
-        conversation_id: Uuid;
-        relations?: number;
-        history?: number;
-        siblings?: number;
-    }): Promise<RecordsResult<ConversationScopeContext>>;
-    /**
-     * "Who changed the price on ANY record?" One column's history across a whole
-     * Table, narrowed to the records this person may see by a predicate in the
-     * same statement. A column that names no Field is refused BY NAME, never
-     * answered empty.
-     */
-    fieldHistory(args: {
-        table_id: Uuid;
-        field_key: string;
-        limit?: number;
-        offset?: number;
-        record_id?: Uuid;
-    }): Promise<RecordsResult<FieldHistoryEntry[]>>;
-    /**
-     * WHAT A RESTORE WOULD CHANGE, BEFORE IT DOES. Editor on the record: this is
-     * the first half of an act, and somebody who may not perform it is not shown
-     * its preview. Pass `field_key` for one column.
-     */
-    restorePreview(args: {
-        record_id: Uuid;
-        version: number;
-        field_key?: string;
-    }): Promise<RecordsResult<RestorePreview>>;
-    /** Put the whole record back to a version, as a NEW version. Editor. */
-    restoreVersion(args: {
-        record_id: Uuid;
-        version: number;
-    }): Promise<RecordsResult<RestoreResult>>;
-    /** Put ONE column back to what it said at a version, as a NEW version (HIS-N-2). Editor. */
-    valueRestore(args: {
-        record_id: Uuid;
-        field_key: string;
-        version: number;
-    }): Promise<RecordsResult<RestoreResult>>;
-    /**
-     * SCR-18. The record's comment thread with everybody named, plus what THIS
-     * person may do in it — decided by the store, in the same call, so a screen
-     * never draws a composer the write door will refuse.
-     */
-    commentThread(args: {
-        record_id: Uuid;
-        include_resolved?: boolean;
-    }): Promise<RecordsResult<CommentThreadRead>>;
-    /**
-     * Write a comment at the `commenter` rung, optionally naming people. A
-     * mention is a reference and not a regex over the body: the ids come from the
-     * picker and the store refuses one who is not in the organization, or who
-     * cannot open the record — because that notification would be a dead end.
-     */
-    commentWrite(args: {
-        record_id: Uuid;
-        body: string;
-        field_key?: string;
-        parent_comment_id?: Uuid;
-        mentions?: Uuid[];
-    }): Promise<RecordsResult<CommentWritten>>;
-    /** Resolve (or re-open) a thread. `commenter` — resolution is not a delete. */
-    commentResolve(args: {
-        comment_id: Uuid;
-        resolved?: boolean;
-    }): Promise<RecordsResult<boolean>>;
-    /**
-     * Every value of one record WITH its envelope — its own version, who wrote
-     * it, who they were acting for and when. The timeline IS the record (REC-19);
-     * there is no second history table.
-     */
-    recordValuesVersioned(args: {
-        record_id: Uuid;
-        organization_id?: Uuid | null;
-    }): Promise<RecordsResult<ReadValue[]>>;
-    /**
-     * Metadata search across EVERY organization the person belongs to (`config.organizationIds`;
-     * `organization_id` narrows to one): the Tables and Fields whose name, key, label or description
-     * holds `text` (case-insensitive; structure, never rows). Each match is `{id, kind: "table" |
-     * "field", name, description, organization_id}` (a Field adds `key`, `table_id`, `field_type`).
-     * An organization whose read door refuses is listed in `unavailable` WITH its reason and
-     * never hides the rest. Only when NO organization answers is the whole search a failure (the
-     * first refusal).
-     */
-    metadataSearch(args: {
-        text: string;
-        organization_id?: Uuid | null;
-    }): Promise<RecordsResult<MetadataSearchAnswer>>;
-    /**
-     * WHICH of the person's organizations can this client use right now? Asks every organization
-     * in scope (`organization_id` narrows to one) whether its record store is open, so a host can
-     * say "organization X is unavailable: <reason>" instead of silently dropping it. Organization
-     * order is the person's own, never completion order.
-     */
-    organizationsOpen(args?: {
-        organization_id?: Uuid | null;
-    }): Promise<RecordsResult<OrganizationsOpenAnswer>>;
-    /**
-     * The organization that OWNS a table or record — the one a write to it must run in. A
-     * `table_id` is looked up across all the person's organizations; a `record_id` is opened in its
-     * own. `null` = found in none of them. Never a permission: the store's doors still decide.
-     */
-    ownerOrganization(args: {
-        table_id?: Uuid | null;
-        record_id?: Uuid | null;
-        organization_id?: Uuid | null;
-    }): Promise<RecordsResult<Uuid | null>>;
-    /**
-     * Mint an embed token. `mode` is `read` OR `write` and never both — the store
-     * refuses a token carrying two decisions. The secret comes back ONCE, because
-     * only its digest is stored: a database read cannot produce a working token.
-     * `allowedOrigins` is required and matched EXACTLY, so `example.com.evil.test`
-     * fails a check that a suffix match would pass.
-     */
-    anonTokenIssue(args: {
-        mode: "read" | "write";
-        allowedOrigins: string[];
-        formId?: Uuid | null;
-        savedViewId?: Uuid | null;
-        recordId?: Uuid | null;
-        expiresAt?: Timestamp | null;
-    }): Promise<RecordsResult<{
-        token_id: Uuid;
-        secret: string;
-    }>>;
-    /** What a secret is good for, from an origin. The store's sentence when it is not. */
-    anonTokenVerify(args: {
-        secret: string;
-        origin: string;
-        requiredMode?: "read" | "write" | null;
-    }): Promise<RecordsResult<AnonTokenBinding>>;
-    anonTokenRevoke(args: {
-        token_id: Uuid;
-    }): Promise<RecordsResult<boolean>>;
-    /**
-     * A STRANGER'S WRITE. The token supplies the organization, so this call names
-     * none — and what it produces is a QUARANTINED SUBMISSION, not a record:
-     * `custom.record` is never touched here. `clientKey` makes a replay free and
-     * idempotent, which is what lets a flaky phone retry safely.
-     */
-    anonWrite(args: {
-        secret: string;
-        origin: string;
-        payload: Record<string, unknown>;
-        clientKey?: string | null;
-        rawPayload?: Record<string, unknown>;
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * SCR-30, and it is the SIGNED-IN offline path, not the stranger's. The client
-     * mints `clientKey` BEFORE the first attempt, offline, and the store's own
-     * replay ledger dedupes on it — so a reconnect that fires the same capture
-     * thirty times writes one record and returns the same id every time.
-     */
-    anonCapture(args: {
-        table_id: Uuid;
-        clientKey: string;
-        payload: Record<string, unknown>;
-        device?: string | null;
-        capturedAt?: Timestamp | null;
-    }): Promise<RecordsResult<Uuid>>;
-    /** Open or close a form to strangers. An admin act on the Table, never an editor one. */
-    anonPublish(args: {
-        form_id: Uuid;
-        published?: boolean;
-    }): Promise<RecordsResult<Timestamp | null>>;
-    /**
-     * What is wrong with a checklist somebody is writing, in the words they would
-     * use. `null` means it is fine. Pure — it reads no row and writes nothing —
-     * so an editor may ask it on every keystroke and the refusal arrives BEFORE
-     * the save rather than after it.
-     */
-    checklistRefusal(args: {
-        spec: ChecklistSpec;
-    }): Promise<RecordsResult<string | null>>;
-    /**
-     * Store a checklist, whole: ordered steps, who each belongs to by role, how
-     * many days in each is due, what each waits for, what each asks for, and what
-     * starts a run. Pass `template_id` to change the checklist that already
-     * exists rather than making a second one.
-     */
-    checklistDeclare(args: {
-        spec: ChecklistSpec;
-        template_id?: Uuid | null;
-    }): Promise<RecordsResult<ChecklistDeclared>>;
-    checklistTemplates(args?: {
-        about_table_id?: Uuid | null;
-        limit?: number;
-    }): Promise<RecordsResult<ChecklistTemplateSummary[]>>;
-    checklistTemplateShape(args: {
-        template_id: Uuid;
-    }): Promise<RecordsResult<ChecklistTemplateShape>>;
-    /**
-     * Run a checklist for one record: one work item per step in the ONE work
-     * layer, assigned by role to real people, dated from the offsets,
-     * dependencies carried across. `roles` names who stands in each role for THIS
-     * run, over whatever the checklist says by default.
-     */
-    checklistStart(args: {
-        template_id: Uuid;
-        about_record_id?: Uuid | null;
-        roles?: Record<string, Uuid>;
-        startingAt?: Timestamp | null;
-    }): Promise<RecordsResult<ChecklistRunStarted>>;
-    checklistRun(args: {
-        run_id: Uuid;
-    }): Promise<RecordsResult<ChecklistRunStep[]>>;
-    checklistRuns(args?: {
-        about_table_id?: Uuid | null;
-        about_record_id?: Uuid | null;
-        includeClosed?: boolean;
-        limit?: number;
-    }): Promise<RecordsResult<ChecklistRunSummary[]>>;
-    /**
-     * Tick a step off with whatever it asked for. Refused by name while a step it
-     * waits for is open, or while what it asks for is missing — and the same
-     * refusal meets `workSetState`, because the rule lives in the store and not
-     * in this door.
-     */
-    checklistStepComplete(args: {
-        step_id: Uuid;
-        evidence?: Record<string, unknown>;
-    }): Promise<RecordsResult<ChecklistStepCompleted>>;
-    /** Why this step cannot be finished right now. `null` means it can. */
-    checklistStepRefusal(args: {
-        step_id: Uuid;
-    }): Promise<RecordsResult<string | null>>;
-    /** The five states and what each one may become. Asked, never hardcoded in a picker. */
-    workStates(): Promise<RecordsResult<WorkState[]>>;
-    /** Why this graph would be refused — asked BEFORE it is written. `null` means it is fine. */
-    workTemplateRefusal(args: {
-        graph: WorkGraph;
-    }): Promise<RecordsResult<string | null>>;
-    workTemplateDeclare(args: {
-        name: string;
-        graph: WorkGraph;
-    }): Promise<RecordsResult<Uuid>>;
-    /**
-     * REC-70: the WHOLE graph is created in one act, judged before any of it is
-     * written, so a half-made checklist is not a state this store can be in.
-     */
-    workTemplateInstantiate(args: {
-        template_id: Uuid;
-        overrides?: Record<string, Record<string, unknown>>;
-    }): Promise<RecordsResult<WorkInstantiation>>;
-    workTemplateShape(args: {
-        template_id: Uuid;
-    }): Promise<RecordsResult<unknown>>;
-    workInstantiationShape(args: {
-        instantiation_id: Uuid;
-    }): Promise<RecordsResult<unknown>>;
-    /** Whose turn each record is, with its state and whether that state is terminal. */
-    workWhoseTurn(args: {
-        table_id: Uuid;
-        includeFinished?: boolean;
-    }): Promise<RecordsResult<WorkTurn[]>>;
-    /** Does this Table carry assignment at all? A screen asks before it offers one. */
-    workHasAssignment(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<boolean>>;
-    /** The Fields assignment is made of, so nothing here invents a column name. */
-    workAssignmentFields(args?: {
-        options_table_id?: Uuid | null;
-    }): Promise<RecordsResult<WorkAssignmentField[]>>;
-    /** Add assignment to a Table. */
-    workTakeAssignment(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<unknown>>;
-    /** Why this move would be refused. `null` means it is allowed. */
-    workTransitionRefusal(args: {
-        from_state_id: Uuid;
-        to_state_id: Uuid;
-    }): Promise<RecordsResult<string | null>>;
-    /** Declare the Table slots are held in. Idempotent — a second call finds the first. */
-    workSlotsDeclare(args: {
-        name: string;
-        slug: string;
-        homeId?: Uuid | null;
-    }): Promise<RecordsResult<unknown>>;
-    /**
-     * SCR-29. Take a slot for a while. THE STORE decides, under a unique index —
-     * two people racing for the same slot do not both get it, whatever either
-     * screen believed a moment earlier.
-     */
-    workSlotHold(args: {
-        table_id: Uuid;
-        slotKey: string;
-        holder: string;
-        ttl?: string;
-    }): Promise<RecordsResult<unknown>>;
-    workSlotRelease(args: {
-        hold_id: Uuid;
-    }): Promise<RecordsResult<boolean>>;
-    /** Every hold on this Table, with whether it has already lapsed. */
-    workSlotHolds(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<WorkSlotHold[]>>;
-    workSlotExpire(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<number>>;
-    /**
-     * THE ONE INBOX. Assignments, approvals and the agent's proposals, in one
-     * ordered list with ONE row shape — PRODUCTS.md row 6. A second queue for the
-     * agent's suggestions is the thing this replaces.
-     */
-    workInbox(args?: {
-        limit?: number;
-        offset?: number;
-        includeDecided?: boolean;
-        /** Lane S5-PRIME-2: "inbox" (default), "snoozed" or "done" — this person's own views. */
-        view?: WorkInboxView;
-    }): Promise<RecordsResult<WorkInboxItem[]>>;
-    /**
-     * SNOOZE ONE ITEM OF MY INBOX UNTIL A TIME (lane S5-PRIME-2, `custom.inbox_snooze`). Only my
-     * inbox changes; the approval or record is never written. A time already past, a snooze past a
-     * year, and a decided item are refused by name.
-     */
-    inboxSnooze(args: {
-        item_id: Uuid;
-        until: Timestamp;
-    }): Promise<RecordsResult<InboxStateChange>>;
-    /** Take my snooze off: it is back in my inbox now. */
-    inboxUnsnooze(args: {
-        item_id: Uuid;
-    }): Promise<RecordsResult<InboxStateChange>>;
-    /**
-     * CLEAR (mark done) ONE ITEM OF MY INBOX. A decision still owed is refused ("This one needs a
-     * decision"). It comes back if somebody else changes it.
-     */
-    inboxClear(args: {
-        item_id: Uuid;
-    }): Promise<RecordsResult<InboxStateChange>>;
-    /** Put a cleared item back in my inbox. */
-    inboxUnclear(args: {
-        item_id: Uuid;
-    }): Promise<RecordsResult<InboxStateChange>>;
-    /**
-     * WHAT WAITS ON ME, COUNTED (`custom.inbox_counts`) — the same predicate the inbox lists with.
-     * `everyOrganization` counts every organization I belong to (the shell badge: what waits on a
-     * person is theirs, not the selected organization's).
-     */
-    inboxCounts(args?: {
-        everyOrganization?: boolean;
-    }): Promise<RecordsResult<InboxCounts[]>>;
-    /** "My work", "work I assigned", "waiting on somebody being chosen". */
-    workList(args?: {
-        flavour?: WorkListFlavour;
-        includeFinished?: boolean;
-        limit?: number;
-        offset?: number;
-    }): Promise<RecordsResult<WorkListItem[]>>;
-    /**
-     * Give one record to one person: the Assignee value AND editor access, in one
-     * transaction. Passing no `user_id` un-assigns and says plainly that nobody's
-     * access was taken away.
-     */
-    workAssign(args: {
-        record_id: Uuid;
-        user_id?: Uuid | null;
-        dueDate?: string | null;
-        clearDue?: boolean;
-    }): Promise<RecordsResult<WorkAssignment>>;
-    /** The states this record may be moved to, and the sentence for each it may not. */
-    workRecordStates(args: {
-        record_id: Uuid;
-    }): Promise<RecordsResult<WorkRecordState[]>>;
-    /** Move it. The store refuses a move the model forbids, in its own words. */
-    workSetState(args: {
-        record_id: Uuid;
-        state_id: Uuid | null;
-    }): Promise<RecordsResult<unknown>>;
-    /** The person-kernel record standing for a signed-in person here. */
-    workPerson(args: {
-        user_id: Uuid;
-        create?: boolean;
-    }): Promise<RecordsResult<Uuid | null>>;
-    /** The templates this person may run, so a picker has ids to offer. */
-    workTemplates(args?: {
-        limit?: number;
-    }): Promise<RecordsResult<Array<{
-        template_id: Uuid;
-        name: string;
-        nodes: number;
-        relations: number;
-        created_at: string;
-    }>>>;
-    /** Who may decide a change about this subject, and why each of them may. */
-    workApprovalApprovers(args: {
-        subject_id: Uuid | null;
-        approver_id?: Uuid | null;
-    }): Promise<RecordsResult<WorkApprover[]>>;
-    /** Ask for a change instead of making it. Viewer on the subject is enough to ASK. */
-    workApprovalRequest(args: {
-        subject_id: Uuid;
-        change: WorkChange;
-        note?: string | null;
-        approver_id?: Uuid | null;
-        origin?: "person" | "agent";
-        conversation_id?: Uuid | null;
-    }): Promise<RecordsResult<WorkApprovalFiled>>;
-    /** Whether THIS person may decide THIS one — so a screen never draws a dead button. */
-    workApprovalMayDecide(args: {
-        approval_id: Uuid;
-    }): Promise<RecordsResult<boolean>>;
-    /** Approve or decline. Approving APPLIES the change, as the person approving. */
-    workApprovalDecide(args: {
-        approval_id: Uuid;
-        approve: boolean;
-        note?: string | null;
-    }): Promise<RecordsResult<WorkApprovalDecision>>;
-    /**
-     * DECIDE MANY INBOX ITEMS IN ONE CALL (lane S4, `custom.work_decide_many`). Each is judged by
-     * `work_approval_decide` exactly as one is, in its own savepoint: a refused decision leaves that
-     * item waiting and the others still stand. Verdicts: approved, declined, already_decided,
-     * no_right, refused — each with the store's own sentence.
-     */
-    workDecideMany(args: {
-        decisions: WorkDecideManyItem[];
-    }): Promise<RecordsResult<WorkDecideMany>>;
-    /** One waiting change in full, for the person deciding it or the one who asked. */
-    workApprovalRead(args: {
-        approval_id: Uuid;
-    }): Promise<RecordsResult<Record<string, unknown>>>;
-    /** VIS-31. Is this account a signed-in outsider — no NON-personal organization? */
-    isExternalPrincipal(args?: {
-        user_id?: Uuid | null;
-    }): Promise<RecordsResult<boolean>>;
-    /** The same answer WITH the plain-English reason a screen shows. */
-    externalPrincipalCard(args?: {
-        user_id?: Uuid | null;
-    }): Promise<RecordsResult<ExternalPrincipalCard>>;
-    /** Exactly the resource ids Visibility gave that outsider. Never an organization's list. */
-    externalPrincipalReach(args: {
-        resourceType: string;
-        user_id?: Uuid | null;
-    }): Promise<RecordsResult<Array<{
-        resource_id: Uuid;
-    }>>>;
-    /** VIS-32. Bind a record or a view to a public address with a declared render mode. */
-    publishBindingCreate(args: {
-        slug: string;
-        resourceType: string;
-        resource_id: Uuid;
-        renderMode?: string;
-    }): Promise<RecordsResult<PublishBinding>>;
-    publishBindingRevoke(args: {
-        slug: string;
-    }): Promise<RecordsResult<unknown>>;
-    /** What a SIGNED-OUT visitor resolves. Empty for an invented, revoked or unpublished address. */
-    resolvePublishBinding(args: {
-        slug: string;
-    }): Promise<RecordsResult<ResolvedPublishBinding[]>>;
-    /** The same resolution plus what the address holds (table | record | dashboard | page | view). */
-    resolvePublishBindingKind(args: {
-        slug: string;
-    }): Promise<RecordsResult<ResolvedPublishBindingKind[]>>;
-    /** D-15. The ONE sentence admitting nothing was scanned, so four surfaces cannot drift. */
-    worldPublishGapNotice(): Promise<RecordsResult<string>>;
-    /** Put a resource in the world lane. Refuses by name while the lane is closed. */
-    publishToWorld(args: {
-        resourceType: string;
-        resource_id: Uuid;
-        discoverable?: boolean;
-    }): Promise<RecordsResult<unknown>>;
-    /**
-     * Declare a Rule. It is NOT `recordWrite` into the rule kernel, and that is
-     * the whole point: `custom.record_write` inserts `data_class = 'record'`, so a
-     * document written that way is not a Rule and the store's own rule doors
-     * (`custom.rule_members`, `custom.agg_subscriptions`) never see it. Writing
-     * one through the record door and calling it a Rule would be a silent
-     * failure — a screen that looked like it had subscribed you to something.
-     */
-    ruleDeclare(args: {
-        spec: Record<string, unknown>;
-        rule_id?: Uuid | null;
-    }): Promise<RecordsResult<Uuid>>;
-    fieldPropose(proposal: FieldProposal): Promise<RecordsResult<never>>;
-    tablePropose(proposal: TableProposal): Promise<RecordsResult<never>>;
-    promoteTable(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<unknown>>;
-    promoteField(args: {
-        table_id: Uuid;
-        field_id: Uuid;
-    }): Promise<RecordsResult<unknown>>;
-    /**
-     * @deprecated The record store is never off (owner ruling, 2026-10-03: everything is on by
-     * default). This answers `true` whenever the door answers; a refusal means the store could not
-     * be reached, never that it is off. Do not gate a screen on it.
-     */
-    storeIsOpen(): Promise<RecordsResult<boolean>>;
-    /**
-     * WHAT THIS PERSON MAY DO TO THESE THINGS — asked once, for a whole page.
-     *
-     * There is no principal argument, on purpose: the door resolves the caller
-     * from the session, so a person can ask about their OWN access and about
-     * nobody else's. A subject they hold nothing on answers `level: null`, which
-     * is an answer; the row is never omitted, because a screen that could not
-     * tell "no access" from "not asked yet" would draw one of them as the other.
-     */
-    myLevels(args: {
-        ids: Uuid[];
-        subject?: "record";
-    }): Promise<RecordsResult<MyLevel[]>>;
-    /** G1. Write ONE leaf of a Table's colors, or clear it with `null`. Editor on the Table. */
-    tableDecorate(args: {
-        table_id: Uuid;
-        path: DecorationPath;
-        value: unknown;
-    }): Promise<RecordsResult<TableDecorations>>;
-    /** G1. A Table's colors as a screen paints them, with what went stale named. */
-    tableDecorations(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<TableDecorations>>;
-    /** G1. The layout a grid opens with: platform → organization knob → the view's own. */
-    gridLayout(args: {
-        table_id: Uuid;
-        view_id?: Uuid | null;
-    }): Promise<RecordsResult<GridLayout>>;
-    /** G3. The older grid's formula text → the store's expression. Never refuses a typo: answers ok:false. */
-    formulaParse(args: {
-        table_id: Uuid;
-        text: string;
-    }): Promise<RecordsResult<FormulaParse>>;
-    /**
-     * NOTION-PROPS. The formula being typed, parsed AND worked out for one record of the table
-     * (`custom.formula_preview`): the parse, plus `value` — what a saved formula column would show on
-     * that record — or `error` when it parses and cannot be worked out there. Writes nothing.
-     */
-    formulaPreview(args: {
-        table_id: Uuid;
-        record_id: Uuid | null;
-        text: string;
-    }): Promise<RecordsResult<FormulaPreview>>;
-    /** G2. Declare a Table's row actions — the whole list. Editor on the Table. */
-    actionDeclare(args: {
-        table_id: Uuid;
-        actions: RowAction[];
-    }): Promise<RecordsResult<RowAction[]>>;
-    /** G2. A Table's row actions, each saying whether it can run here. */
-    rowActions(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<{
-        actions: RowAction[];
-        stale: unknown[];
-    }>>;
-    /**
-     * G2. Run one action on a selection, in ONE transaction. A refusal changed NOTHING; read
-     * every record and field that refused with `actionRefusals(result.error)`.
-     */
-    actionRun(args: {
-        action_id: Uuid;
-        record_ids: Uuid[];
-    }): Promise<RecordsResult<ActionRunResult>>;
-    /**
-     * AUTOMATION-DOOR. Declare (or, with `automation_id`, replace) one automation on a Table — editor on the Table.
-     * A spec the store refuses comes back as `data.ok === false` with `_errors`, one sentence per path.
-     */
-    automationDeclare(args: {
-        table_id: Uuid;
-        spec: AutomationSpec;
-        automation_id?: Uuid | null;
-    }): Promise<RecordsResult<AutomationDeclared>>;
-    /** AUTOMATION-DOOR. A Table's automations with their last run; archived ones only when asked. */
-    automations(args: {
-        table_id: Uuid;
-        include_archived?: boolean;
-    }): Promise<RecordsResult<AutomationList>>;
-    /** AUTOMATION-DOOR. Archive one (it switches off and keeps its history). Editor on the Table. */
-    automationArchive(args: {
-        automation_id: Uuid;
-    }): Promise<RecordsResult<AutomationFlipped>>;
-    /** AUTOMATION-DOOR. Bring an archived one back (it stays off until `automationSetEnabled`). */
-    automationRestore(args: {
-        automation_id: Uuid;
-    }): Promise<RecordsResult<AutomationFlipped>>;
-    /** AUTOMATION-DOOR. Switch one on or off. */
-    automationSetEnabled(args: {
-        automation_id: Uuid;
-        enabled: boolean;
-    }): Promise<RecordsResult<AutomationFlipped>>;
-    /** AUTOMATION-DOOR. Run history, newest first: status, the store's own sentence, every step. */
-    automationRuns(args: {
-        automation_id: Uuid;
-        limit?: number;
-        cursor?: string | null;
-    }): Promise<RecordsResult<AutomationRuns>>;
-    /** G4. Send every change to this Table's records to an https webhook. Admin. The secret is shown once. */
-    tableWebhookDeclare(args: {
-        table_id: Uuid;
-        target_url: string;
-        events?: RecordEvent[] | null;
-        description?: string | null;
-    }): Promise<RecordsResult<TableWebhookDeclared>>;
-    /** G4. The webhooks a Table sends to, with their delivery health — never the secret. */
-    tableWebhooks(args: {
-        table_id: Uuid;
-    }): Promise<RecordsResult<TableWebhook[]>>;
-    /** G4. Switch one off. It is never deleted. */
-    tableWebhookArchive(args: {
-        webhook_id: Uuid;
-    }): Promise<RecordsResult<boolean>>;
-    /** G5. Number the records an autonumber column found already there, in creation order. */
-    autonumberBackfill(args: {
-        field_id: Uuid;
-    }): Promise<RecordsResult<{
-        numbered: number;
-        highest: number | null;
-        says: string;
-    }>>;
-    /**
-     * NOTION-PROPS-3. PRESS A BUTTON COLUMN ON ONE ROW (`custom.button_press`): a link comes back filled from
-     * the row for the screen to open; a row action or an automation runs in the store and its result comes
-     * back. A button with nothing set up is refused by name (22023).
-     */
-    buttonPress(args: {
-        record_id: Uuid;
-        field_id: Uuid;
-    }): Promise<RecordsResult<ButtonPressed>>;
-    /**
-     * NOTION-PROPS-3. The knob `data/timeline_dependency_shift` for the signed-in person in this organization:
-     * whether moving a record on a timeline moves the records waiting on it (default true).
-     */
-    timelineDependencyShift(): Promise<RecordsResult<boolean>>;
-    /** G5. One page of the export door — exactly the rows and columns the read door serves this person. */
-    ioExport(args: {
-        table_id: Uuid;
-        columns?: string[] | null;
-        limit?: number;
-    }): Promise<RecordsResult<IoExportPage>>;
-    /** G5. That page as an .xlsx; a withheld column is named on its own sheet. */
-    /**
-     * G9. Every table a picker may offer here, from BOTH stores, each saying which store opens it.
-     * A table the app keeps out of default lists (`custom.table_kept_out_of_lists`: an agent's
-     * outputs) is left out unless `include_platform_tables` is true — the "Show platform tables" switch.
-     */
-    tableListEverywhere(args?: {
-        include_platform_tables?: boolean;
-    }): Promise<RecordsResult<{
-        success: boolean;
-        tables: TableListEntry[];
-    }>>;
-    /**
-     * Every table the person reaches (`custom.data_home_tables`), as the data home lists them.
-     * `organization_id` names one organization; `null` asks for every organization the person
-     * reaches — never the client's bound organization by default. A table the app keeps out of
-     * default lists (an agent's outputs) is answered only with `include_platform_tables: true`.
-     */
-    dataHomeTables(args: {
-        organization_id: Uuid | null;
-        include_platform_tables?: boolean;
-    }): Promise<RecordsResult<DataHomeTable[]>>;
-    /**
-     * Every table of EVERY organization (`custom.admin_all_tables`) — the admin section's list. The
-     * store's walls admit a platform admin to system organizations only, so this is a separate door that
-     * answers only on the admin lane for a platform admin; anyone else gets a refusal, not an empty list.
-     */
-    adminAllTables(): Promise<RecordsResult<AdminTable[]>>;
-    /**
-     * G10. Refresh a synced source (a sheet tab) into ONE Table under `home_id`: new rows added,
-     * changed rows updated, rows the source dropped archived — never destroyed; columns the
-     * person added in Matrx survive. Build the spec with `sheetSyncSpec`.
-     */
-    tableSync(args: {
-        home_id: Uuid;
-        spec: TableSyncSpec;
-    }): Promise<RecordsResult<TableSyncResult>>;
-    /**
-     * G11. The record-store Table a context scope's template-bound item provisions — one per item
-     * and scope. A scope provisioned before the move answers with its moved Table (same id); the
-     * Home defaults to the organization's own.
-     */
-    scopeTableProvision(args: {
-        item_id: Uuid;
-        scope_id: Uuid;
-        home_id?: Uuid | null;
-    }): Promise<RecordsResult<Uuid>>;
-    /** G12. The rows of each Table this reader may see, in one call (fold with `withRowCounts`). A Table she may not know gets no row. */
-    tableRowCounts(args: {
-        table_ids: Uuid[];
-    }): Promise<RecordsResult<TableRowCount[]>>;
-    /** G12. Each live record's own header (created, updated, version) that the read door does not answer. */
-    recordHeaders(args: {
-        ids: Uuid[];
-    }): Promise<RecordsResult<RecordHeader[]>>;
-    /**
-     * G14. Share a Table with a person by email or account id: an existing account outside the
-     * organization is granted at once and notified (never made a member); an address with no
-     * account is invited. The organization's outside-sharing setting decides first.
-     */
-    tableShareOutsideGrant(args: {
-        table_id: Uuid;
-        person: string;
-        level?: "viewer" | "commenter" | "editor" | "admin";
-    }): Promise<RecordsResult<OutsideShareAnswer>>;
-    /** G13. Keep a hand-set order on a saved view: the named rows first, in this order (build it with `moveInOrder`). */
-    viewRecordOrderSet(args: {
-        view_id: Uuid;
-        record_ids: Uuid[];
-    }): Promise<RecordsResult<ViewOrderSet>>;
-    /**
-     * G13 + ORDER-FILTER. A page of a hand-ordered view: placed rows by position, then the rest by
-     * created time. `filter` is the list door's question (`StoreFilter`: a flat map or a nested
-     * Rule — the view's own `where`, or a number clicked on a dashboard); given, the store reads
-     * exactly the rows that match, in their places, and `limit`/`offset` page THAT order. Each row
-     * answers the position stored for it; rows the filter hides keep theirs.
-     */
-    readInViewOrder(args: {
-        view_id: Uuid;
-        filter?: StoreFilter | null | undefined;
-        limit?: number;
-        offset?: number;
-    }): Promise<RecordsResult<Array<ReadRow & {
-        position: number | null;
-    }>>>;
-    exportXlsx(args: {
-        table_id: Uuid;
-        columns?: string[] | null;
-        limit?: number;
-        labels?: Record<string, string>;
-        sheetLabel?: string;
-    }): Promise<RecordsResult<Uint8Array>>;
-}
-/** One Table's two lane facts, as `custom.table_facts` answers them. */
-interface TableFact {
-    table_id: Uuid;
-    /**
-     * The old lane word (personal · internal · public), now worked out by the store from `shown_to`
-     * and `published_to_web` (access ladder). Read those two; this stays for older stores.
-     */
-    visibility: string;
-    /** Whether the person signed in MADE this Table. Never who did. */
-    mine: boolean;
-    /** Access ladder "Shown to": only_me · my_team · everyone · everyone_on_ai_matrx; null = the default. */
-    shown_to?: string | null;
-    /** Access ladder "Published to the web": the only way anyone outside the organization opens it. */
-    published_to_web?: boolean;
-}
-/**
- * WHERE A TABLE IS CURRENTLY READ AND WRITTEN during the older-table cutover.
- * `tableHome` is an address read from one Table record; this applies the
- * organization's migration switch to a batch of ids, including same-id copies.
- */
-interface TableLiveLocation {
-    table_id: Uuid;
-    lives_in: "record" | "older";
-    why: string | null;
-}
-/**
- * The facts folded onto a table list: `visibility` on every Table the facts name,
- * `created_by` ONLY as the caller's own id and only on the Tables the caller made.
- * Pure — returns new objects and leaves the list it was given alone.
- */
-declare function withTableFacts<T extends {
-    id: Uuid;
-}>(tables: readonly T[], facts: readonly TableFact[] | null | undefined, me: Uuid | null | undefined): T[];
-declare function createRecordsClient(given: RecordsConfig): RecordsClient;
-/**
- * Turn a refusal into the conflict a screen can SHOW: which version you wrote
- * against, which one won, and every field you touched as it stands now. Returns
- * null when the refusal was not a stale write.
- */
-declare function asWriteConflict(error: RecordsError, recordId: Uuid): WriteConflict | null;
-
-export { A_PERSONS_REFUSAL as A, DEFAULT_PAGE_SIZE as D, type PromotedPredicate as P, type QueryPlan as Q, type RecordsClient as R, type TableFact as T, type AsOf as a, type RecordQuery as b, type TableLiveLocation as c, asWriteConflict as d, createRecordsClient as e, isAPersonsRefusal as f, intersectIds as i, planQuery as p, withTableFacts as w };