@ai-matrx/records 0.99.32 → 0.99.33

package/dist/door-call/index.cjs

@@ -0,0 +1,1287 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/door-call/index.ts
+var door_call_exports = {};
+__export(door_call_exports, {
+  A_PERSONS_REFUSAL: () => A_PERSONS_REFUSAL,
+  DEFAULT_DOOR_SCHEMA: () => DEFAULT_DOOR_SCHEMA,
+  PICK_LIST_DOORS: () => PICK_LIST_DOORS,
+  STORE_SCHEMA: () => STORE_SCHEMA,
+  asRecordsDataSource: () => asRecordsDataSource,
+  canonicalArgs: () => canonicalArgs,
+  createDoorCall: () => createDoorCall,
+  createPickListDoors: () => createPickListDoors,
+  createScopeDoors: () => createScopeDoors,
+  describeBulkFailures: () => describeBulkFailures,
+  doorAbsentRefusal: () => doorAbsentRefusal,
+  isAPersonsRefusal: () => isAPersonsRefusal,
+  isBulkOpError: () => isBulkOpError,
+  isServiceFailure: () => isServiceFailure,
+  lightDoorCall: () => lightDoorCall,
+  lightPickListDoors: () => lightPickListDoors,
+  lightScopeDoors: () => lightScopeDoors,
+  primedDoorAnswer: () => primedDoorAnswer,
+  readObjectOrganizationAnswer: () => readObjectOrganizationAnswer,
+  recordsErrorSink: () => recordsErrorSink,
+  resolveObjectOrganization: () => resolveObjectOrganization,
+  storeDoors: () => storeDoors,
+  supabaseDataSource: () => supabaseDataSource
+});
+module.exports = __toCommonJS(door_call_exports);
+
+// src/core/supabase.ts
+function refuse(code, message, hint) {
+  return { data: null, error: { code, message, hint, details: "" } };
+}
+function supabaseDataSource(client) {
+  if (isBound(client)) return client;
+  const supabase = client;
+  const hasSchema = typeof supabase.schema === "function";
+  const bound = {
+    // PAGE-BUNDLE: the real adapter opens a table page with one `custom.table_page_bundle` call.
+    opensInOneCall: true,
+    rpc(fn, args, options) {
+      if (!hasSchema) {
+        return Promise.resolve(
+          refuse(
+            "data_source_unbound",
+            `The records client was given something that is not a supabase client: it has no schema() method, so the door ${fn} cannot be called in the schema it lives in.`,
+            "Pass a supabase-js v2 client (createClient(...)) to supabaseDataSource()."
+          )
+        );
+      }
+      const name = options?.schema;
+      if (!name) {
+        return Promise.resolve(
+          refuse(
+            "schema_unsaid",
+            `The door ${fn} was called without saying which schema it lives in. Every door of this store is custom.${fn} and every trust door is iam.${fn}; an unqualified call reaches PostgREST's default profile (public) and is refused there.`,
+            "This is a bug in the caller, not in your data: /core says the schema on every call."
+          )
+        );
+      }
+      return supabase.schema(name).rpc(fn, args);
+    },
+    schema(name) {
+      return supabase.schema(name);
+    }
+  };
+  Object.defineProperty(bound, BOUND, { value: true, enumerable: false });
+  return bound;
+}
+var BOUND = /* @__PURE__ */ Symbol.for("@ai-matrx/records/supabaseDataSource");
+function isBound(source) {
+  return source[BOUND] === true;
+}
+function asRecordsDataSource(source) {
+  if (source === null || typeof source !== "object") return supabaseDataSource({});
+  if (isBound(source)) return source;
+  const candidate = source;
+  const looksLikeSupabaseJs = typeof candidate.schema === "function" && typeof candidate.from === "function" && candidate.auth !== null && typeof candidate.auth === "object";
+  if (looksLikeSupabaseJs || typeof candidate.rpc !== "function") return supabaseDataSource(source);
+  return source;
+}
+
+// src/results.ts
+var ok = (data) => ({ ok: true, data });
+var err = (error) => ({ ok: false, error });
+
+// src/core/pgError.ts
+var BY_SQLSTATE = {
+  PT409: "stale_write",
+  "42501": "door",
+  "23514": "refused_by_rule",
+  "22004": "invalid_argument",
+  "22023": "invalid_argument",
+  // MX005 — a value the store cannot take as asked: since 2026-10-06 (AP-3 U3) a word that names more than one
+  // choice or linked record raises it (it used to borrow PT409 and read as somebody else's write winning).
+  MX005: "invalid_argument",
+  // MXD01 — the held-change door tried the proposed values before filing an
+  // approval request and the store refused them. Nothing is waiting for a
+  // person to decide; correct the value before asking again, which is the same
+  // caller-side condition as the other invalid-argument refusals.
+  MXD01: "invalid_argument",
+  // 22P02 — a value does not fit the type the store holds for it. The class is
+  // real and was hit live: an organization whose copy of a package table grew
+  // `status` as a uuid-valued Field was sent the text "open", and the store
+  // answered `invalid input syntax for type uuid: "open"`. It is the CALL that
+  // is wrong for the shape the store holds, which is what `invalid_argument`
+  // already means — the store's own sentence names the value and the type.
+  "22P02": "invalid_argument",
+  // 42703 — a column that is not there. The store raises it from
+  // `custom.entity_table`, which is asked for a column by NAME, so the class is
+  // exactly "the call named something the shape does not have": the same thing
+  // `invalid_argument` already means, and the store's own sentence names the
+  // column. Added 2026-09-20 (lane FORMS) because the package's live-door suite
+  // caught it raised by a door this package did not know about — which is the
+  // suite working, and is why the map is a census rather than a guess.
+  "42703": "invalid_argument",
+  // 22007 — a date or a time the store could not read as one. It is raised by
+  // `custom.dashboard_window_sql`, which is handed a window a caller wrote
+  // ("last 30 days", a literal date), so the class is again "the call named
+  // something the shape does not accept" and the store's own sentence names the
+  // text it could not read. Added 2026-09-20 (lane SCREEN-BREAK) after the
+  // live-door census caught it — the same way 42703 arrived, which is the
+  // census working rather than a guess.
+  "22007": "invalid_argument",
+  // 22003 — a number the store could not hold at the size it was handed. It is
+  // raised by `custom.context_resolve`, which is given a window or a depth a
+  // caller wrote, so the class is the same one 22P02, 42703 and 22007 already
+  // are: the CALL named a value the shape does not accept, and the store's own
+  // sentence names the number and the range. Added 2026-09-20 (lane GRID-TWO)
+  // when the live-door census caught the release gate red on it — which is the
+  // census working, and the fourth time it has been the thing that found a new
+  // refusal class rather than a person guessing one.
+  "22003": "invalid_argument",
+  // 42883 — `custom._template_call` (the template family, 2026-10-03) was handed a step that
+  // names a door the store does not have, or an argument that door does not take. The TEMPLATE
+  // named something the shape does not have — the same class 42703 is — and the store's own
+  // sentence names the door or the argument. Caught by the live-door census on records 0.68.1's
+  // tag, the eighth time the census found a class before a person did. (A bare 42883 on a door
+  // this package itself asks for is still `door_absent`, mapped before this funnel in
+  // `owedDoor`.)
+  "42883": "invalid_argument",
+  "02000": "not_found",
+  // P0002 — `custom.inbox_snooze` / `custom.inbox_clear` (lane S5-PRIME-2, 2026-09-24): "There is
+  // nothing in your inbox with that id". An invented id, another person's item and another
+  // organization's all answer it alike, so it reads exactly as 02000 does: not found.
+  "P0002": "not_found",
+  "23503": "missing_reference",
+  "23505": "already_exists",
+  "0A000": "not_supported",
+  "53400": "store_limit",
+  "22012": "store_limit",
+  // 54001 — `custom.record_delete` stops a cascade that nests past sixty-four
+  // levels of containment, because that is a loop somebody built rather than a
+  // hierarchy, and saying so beats recursing until the server runs out of
+  // stack. It is a LIMIT of the store, and the store's own sentence names what
+  // to do about it, so it reads as one.
+  "54001": "store_limit",
+  // 54000 — the grid primitives' organization ceilings (GRID-PRIMITIVES, 2026-09-23):
+  // `custom.action_run` on a selection past its knob, `custom.table_decorate` past the
+  // rule count, `custom.table_from_example` past `custom/example_rows_max`,
+  // `custom.table_webhook_declare` past `custom/table_webhooks_max`, and
+  // `custom.hub_changed_by`. Each names its knob in the hint and writes nothing, so it
+  // reads exactly like 54001: a limit of the store, in the store's own sentence.
+  "54000": "store_limit",
+  // VIS: `custom.has_visibility_at` refuses to answer from a snapshot older
+  // than a write this reader has already seen, rather than returning something
+  // they just lost access to. It is retryable on a fresher connection, which is
+  // a different instruction from every other refusal here.
+  // 55000 — `custom.table_move` (SC-1', 2026-09-24) refuses a move the table's present state
+  // does not allow: a destination that cannot take it, a table something else holds, contents
+  // that point at themselves in a circle. The store's own sentence names the reason and nothing
+  // moves, so it reads as a refusal on the merits. Caught by the live-door census on records
+  // 0.58.3's tag, the seventh time the census found a class before a person did.
+  "55000": "refused_by_rule",
+  // 42P17 — a worked-out column that would read itself round a circle (STORE-TAILS-3,
+  // 2026-09-25): `custom._field_reads_what_it_reads` refuses the declaration or edit that would
+  // close the circle, naming every column in it, and `custom.far_value` refuses a circle stored
+  // before that rule when a lookup or rollup is worked out. Refused on its merits, in the store's
+  // own sentence, nothing written — so it reads as 55000 does.
+  "42P17": "refused_by_rule",
+  // P0001 — `custom.context_scope_write` (2026-10-03) refuses a scope whose parent breaks the
+  // parent rule in the old trigger's own class and words (manager ruling H6). Refused on its
+  // merits, nothing written. Caught by the live-door census on records 0.65.0's tag.
+  P0001: "refused_by_rule",
+  "40001": "stale_read",
+  // 57014 — the store cancelled the statement at its own timeout. Like
+  // `stale_read` and unlike every other refusal here, the call was never
+  // refused on its merits: the same call on a smaller page, or once the
+  // organization's kernel is not being rewritten, can succeed. It gets its own
+  // code so a screen can offer "try again" honestly instead of showing a
+  // failure sentence the caller cannot act on.
+  "57014": "timed_out",
+  // PostgREST's own two: the store is not being SERVED, which is a different
+  // thing from the store refusing. `custom` absent from `pgrst.db_schemas`, or
+  // the grants not copied, land here.
+  PGRST202: "store_not_served",
+  PGRST205: "store_not_served",
+  PGRST301: "door",
+  // PT428 — NOT A FAILURE, and the release gate's live census is what found it
+  // missing: the store raises it and this package answered `internal`, which is
+  // the one classification that tells a screen nothing. A stage gate whose
+  // `on_fail` is `require_approval` files the request and leaves the record
+  // where it was; the transaction is rolled back to the pipeline's own block, so
+  // "nothing was written" is a fact rather than a promise. Landed by lane
+  // STAGE-RULES; mapped here by STAGE-RULES-2 the day after, when the census
+  // caught it — the sixth time that census has been the thing that found a
+  // refusal class rather than a person guessing one.
+  PT428: "needs_approval"
+};
+var MAPPED_SQLSTATES = Object.keys(BY_SQLSTATE);
+function parseDetail(details) {
+  if (!details) return void 0;
+  const trimmed = details.trim();
+  if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) return details;
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    return details;
+  }
+}
+function isNotASqlstate(code) {
+  if (!code) return true;
+  return /^[0-9]{3}$/.test(code);
+}
+function mapPgError(error, where) {
+  const raw = error.code ?? void 0;
+  const sqlstate = raw && raw !== "" ? raw : void 0;
+  const mapped = {
+    code: "internal",
+    message: error.message,
+    ...error.hint ? { hint: error.hint } : {},
+    ...sqlstate ? { sqlstate } : {}
+  };
+  if (isNotASqlstate(sqlstate)) {
+    mapped.code = "unreachable";
+  } else {
+    mapped.code = BY_SQLSTATE[sqlstate] ?? "internal";
+  }
+  const detail = parseDetail(error.details);
+  if (detail !== void 0) mapped.detail = detail;
+  if (mapped.code === "internal") {
+    mapped.unmapped = true;
+    mapped.diagnostic = `@ai-matrx/records did not recognise SQLSTATE ${sqlstate ?? "(none)"} from ${where}; the store's own message is the thing to act on.`;
+  } else if (mapped.code === "unreachable") {
+    mapped.unmapped = true;
+    mapped.diagnostic = `@ai-matrx/records never reached the store from ${where}: ${raw ? `the transport answered ${raw}` : "no response"} \u2014 ${error.message}`;
+    mapped.message = "We could not reach your data.";
+    delete mapped.hint;
+  }
+  return mapped;
+}
+
+// src/core/primedBundle.ts
+var REGISTRY = /* @__PURE__ */ Symbol.for("@ai-matrx/records/primed-table-page-bundles");
+function registry() {
+  const g = globalThis;
+  return g[REGISTRY] ??= /* @__PURE__ */ new Map();
+}
+function forgetPrimedTablePageBundlesOf(tableId) {
+  const primed = registry();
+  for (const key of [...primed.keys()]) if (tableId === null || key.split("|")[1] === tableId) primed.delete(key);
+}
+var DOOR_REGISTRY = /* @__PURE__ */ Symbol.for("@ai-matrx/records/primed-door-answers");
+function doorRegistry() {
+  const g = globalThis;
+  return g[DOOR_REGISTRY] ??= /* @__PURE__ */ new Map();
+}
+var PRIMED_DOOR_TTL_MS = 1e4;
+function takePrimedDoorAnswer(key) {
+  const registry2 = doorRegistry();
+  const held = registry2.get(key);
+  if (!held) return null;
+  if (Date.now() - held.at < PRIMED_DOOR_TTL_MS) return { data: held.data };
+  registry2.delete(key);
+  return null;
+}
+function dropPrimedDoorAnswers(doors) {
+  const registry2 = doorRegistry();
+  if (!doors) {
+    registry2.clear();
+    return;
+  }
+  for (const key of [...registry2.keys()]) if (doors.some((door) => key.startsWith(`${door}|`))) registry2.delete(key);
+}
+var LOOK_WRITES = {
+  view_declare: ["views", "view_look_read", "grid_layout", "table_page_bundle"],
+  view_designate: ["views", "view_look_read", "grid_layout", "table_page_bundle"],
+  view_look_set: ["views", "view_look_read", "grid_layout", "table_page_bundle"],
+  view_record_order_set: ["views", "view_look_read", "grid_layout", "table_page_bundle"]
+};
+function isWritingDoor(door) {
+  return /(_declare|_set(_|$)|_update|_write|_delete|_restore|_archive|_upsert|_reparent|_change|_duplicate|_move|_decide|_run$|_submit|_publish|_import_|_start$|_complete|_sign$|_add$|_retire|_propose|_promote|_land$|_pin$|_mute|_snooze|_unsnooze|_clear|_unclear|_revoke|_issue|_bind|_unbind|_apply|_backfill|_sync$|_decorate|_designate|_ensure|^migrate_|^set_table_|^home_add|^capture_|^claim_|^record_stage|^anon_|^io_import_|^io_comment_resolve|^enrich_(declare|land|pin)|^field_(declare|duplicate|propose|restore|retire|update)|^table_(declare|ensure|from_example|move|sync)|^value_restore|^relation_own)/.test(door);
+}
+
+// src/core/doorCall.ts
+var DEFAULT_DOOR_SCHEMA = "custom";
+function canonicalArgs(value) {
+  return JSON.stringify(
+    value,
+    (_key, held) => held && typeof held === "object" && !Array.isArray(held) ? Object.fromEntries(Object.keys(held).sort().map((k) => [k, held[k]])) : held
+  );
+}
+var A_PERSONS_REFUSAL = /* @__PURE__ */ new Set([
+  "refused_by_rule",
+  "stale_write",
+  "invalid_argument",
+  "already_exists",
+  "missing_reference"
+]);
+function isAPersonsRefusal(code) {
+  return A_PERSONS_REFUSAL.has(code);
+}
+function recordsErrorSink(onError) {
+  return onError ?? ((e) => {
+    const line = `[@ai-matrx/records] ${e.where}: ${e.code} \u2014 ${e.message}${e.hint ? ` (${e.hint})` : ""}`;
+    if (isAPersonsRefusal(e.code)) console.info(line);
+    else console.error(line);
+  });
+}
+function doorAbsentRefusal(name, owedBy) {
+  return {
+    code: "door_absent",
+    message: `The record store has no door \`custom.${name}\` yet, so this call was not made. Nothing was read and nothing was written.`,
+    hint: owedBy ? `That door is ${owedBy}. Until it lands, this call refuses rather than guessing: an empty answer here would read like "there is nothing", which is a different sentence.` : `No lane in the build book claims this door. Either the name is wrong, or the door was removed from the store and this package has not been regenerated \u2014 run \`pnpm records:generate\`.`
+  };
+}
+function primedDoorAnswer(door, args) {
+  const look = LOOK_WRITES[door];
+  if (look) {
+    dropPrimedDoorAnswers(look);
+    return null;
+  }
+  if (isWritingDoor(door)) {
+    dropPrimedDoorAnswers();
+    return null;
+  }
+  return takePrimedDoorAnswer(`${door}|${canonicalArgs(args)}`);
+}
+function createDoorCall(options) {
+  const { dataSource, doorReady, held, wrote } = options;
+  const schema = options.schema ?? DEFAULT_DOOR_SCHEMA;
+  const scream = recordsErrorSink(options.onError);
+  const absent = options.absent ?? ((door) => doorAbsentRefusal(door));
+  const readsInFlight = /* @__PURE__ */ new Map();
+  const say = (refusal, where) => scream({ code: refusal.code, message: refusal.message, ...refusal.hint ? { hint: refusal.hint } : {}, where });
+  return async function callDoor(door, args, where, opts) {
+    const primed = primedDoorAnswer(door, args);
+    if (primed) return ok(primed.data);
+    if (held) {
+      const bundled = await held(door, args);
+      if (bundled) return ok(bundled.data);
+    }
+    if (doorReady && !doorReady(door)) {
+      const refusal = absent(door);
+      say(refusal, where);
+      return err(refusal);
+    }
+    const flightKey = isWritingDoor(door) ? null : `${door}|${canonicalArgs(args)}`;
+    const flying = flightKey ? readsInFlight.get(flightKey) : void 0;
+    const response = await (flying ?? (() => {
+      const call = Promise.resolve(dataSource.rpc(`${door}`, args, { schema }));
+      if (flightKey) {
+        readsInFlight.set(flightKey, call);
+        const forget = () => {
+          if (readsInFlight.get(flightKey) === call) readsInFlight.delete(flightKey);
+        };
+        call.then(forget, forget);
+      }
+      return call;
+    })());
+    if (response.error) {
+      const code = response.error.code;
+      const refusal = !doorReady && (code === "PGRST202" || code === "42883") ? absent(door) : mapPgError(response.error, where);
+      if (opts?.quiet) console.info(`[@ai-matrx/records] ${where}: ${refusal.code} - ${refusal.message}`);
+      else say(refusal, where);
+      return err(refusal);
+    }
+    if (isWritingDoor(door) || LOOK_WRITES[door]) {
+      const tableId = args["p_table_id"];
+      wrote?.(door, args);
+      forgetPrimedTablePageBundlesOf(typeof tableId === "string" ? tableId : null);
+      dropPrimedDoorAnswers(LOOK_WRITES[door]);
+    }
+    return ok(response.data);
+  };
+}
+
+// src/core/pickListDoors.ts
+var PICK_LIST_DOORS = {
+  pickListGet: "pick_list_get",
+  pickListForSelection: "pick_list_for_selection",
+  pickListUpdate: "pick_list_update"
+};
+function createPickListDoors(callDoor) {
+  return {
+    async pickListGet({ list_id }) {
+      return callDoor(PICK_LIST_DOORS.pickListGet, { p_list_id: list_id }, "pickListGet");
+    },
+    async pickListForSelection({ list_id }) {
+      return callDoor(
+        PICK_LIST_DOORS.pickListForSelection,
+        { p_list_id: list_id },
+        "pickListForSelection"
+      );
+    },
+    async pickListUpdate({ list_id, list_name, description, items }) {
+      return callDoor(
+        PICK_LIST_DOORS.pickListUpdate,
+        {
+          p_list_id: list_id,
+          p_list_name: list_name ?? null,
+          p_description: description ?? null,
+          p_items: items ? [...items] : null
+        },
+        "pickListUpdate"
+      );
+    }
+  };
+}
+
+// src/scopes/types.ts
+var SYSTEM_CONTEXT_TYPE_ID = "__system__";
+
+// src/scopes/codec.ts
+var import_uuid = require("@ai-matrx/kit/uuid");
+var str = (v, fallback = "") => typeof v === "string" ? v : fallback;
+var strOrNull = (v) => typeof v === "string" ? v : null;
+var num = (v, fallback = 0) => {
+  const n = typeof v === "number" ? v : typeof v === "string" ? Number(v) : NaN;
+  return Number.isFinite(n) ? n : fallback;
+};
+function scopeTypeFromStore(row) {
+  const singular = row.label_singular ?? row.name ?? "";
+  return {
+    id: row.id,
+    organization_id: row.organization_id,
+    label_singular: singular,
+    label_plural: row.label_plural ?? singular,
+    icon: row.icon ?? "folder",
+    color: row.color ?? "",
+    slug: row.slug ?? null,
+    description: row.description ?? "",
+    sort_order: num(row.sort_order),
+    max_assignments_per_entity: row.max_assignments_per_entity ?? null,
+    default_variable_keys: Array.isArray(row.default_variable_keys) ? row.default_variable_keys : [],
+    created_by: row.created_by ?? null,
+    created_at: row.created_at ?? "",
+    updated_at: row.updated_at ?? ""
+  };
+}
+function scopeTypeLabelFromStore(t) {
+  const singular = t.label_singular ?? t.name ?? "";
+  return { id: t.id, slug: t.slug ?? null, label_singular: singular, label_plural: t.label_plural ?? singular, icon: t.icon ?? null, color: t.color ?? null };
+}
+function settingFromStore(value) {
+  if (!Array.isArray(value)) return value;
+  return value.map((el) => {
+    if (typeof el !== "string") return el;
+    const t = el.trim();
+    if (!(t.startsWith("{") && t.endsWith("}")) && !(t.startsWith("[") && t.endsWith("]"))) return el;
+    try {
+      return JSON.parse(t);
+    } catch {
+      return el;
+    }
+  });
+}
+function scopeFromStore(row) {
+  const settings = {};
+  for (const [k, v] of Object.entries(row.settings ?? {})) settings[k] = settingFromStore(v);
+  return {
+    id: row.id,
+    scope_type_id: row.scope_type_id,
+    organization_id: row.organization_id,
+    name: row.name ?? "",
+    description: row.description ?? "",
+    slug: row.slug ?? null,
+    sort_order: num(row.sort_order),
+    parent_scope_id: row.parent_scope_id ?? null,
+    settings,
+    created_by: row.created_by ?? null,
+    created_at: row.created_at ?? "",
+    updated_at: row.updated_at ?? ""
+  };
+}
+function scopeWithTypeFromStore(row) {
+  return { ...scopeFromStore(row), scope_type: row.scope_type ? scopeTypeLabelFromStore(row.scope_type) : null };
+}
+function archivedScopeTypeFromStore(row) {
+  const singular = row.label_singular ?? "";
+  return {
+    id: row.id,
+    organization_id: row.organization_id,
+    label_singular: singular,
+    label_plural: row.label_plural ?? singular,
+    icon: row.icon ?? "folder",
+    color: row.color ?? "",
+    archived_at: row.deleted_at ?? "",
+    created_by: row.created_by ?? null,
+    archived_scope_count: row.archived_scope_count ?? 0
+  };
+}
+var FILE_KERNEL_ID = "11111111-0000-4000-8000-000000000006";
+var KINDS = /* @__PURE__ */ new Set([
+  "string",
+  "markdown",
+  "email",
+  "url",
+  "phone",
+  "color",
+  "number",
+  "percent",
+  "currency",
+  "boolean",
+  "date",
+  "datetime",
+  "time",
+  "object",
+  "array",
+  "reference",
+  "document"
+]);
+function contextFieldKind(doc, carried) {
+  if (carried?.as_text && carried.value_type && KINDS.has(carried.value_type)) return carried.value_type;
+  const behavior = String(doc.type ?? "text");
+  const fmt = doc.format ? String(doc.format) : "";
+  const shown = doc.display_format && typeof doc.display_format === "object" ? String(doc.display_format.id ?? "") : "";
+  const kind = String(doc.config?.kind ?? "");
+  const multi = Boolean(doc.multi);
+  if (behavior === "boolean") return "boolean";
+  if (behavior === "relation") return doc.relation_target === FILE_KERNEL_ID && !multi ? "document" : "reference";
+  if (behavior === "range") {
+    if (kind === "date") return "date";
+    if (kind === "datetime") return "datetime";
+    if (fmt === "percent" || fmt === "currency") return fmt;
+    return "number";
+  }
+  if (behavior === "text") {
+    if (multi) return "array";
+    if (fmt === "json") return "object";
+    for (const word of [fmt, shown]) {
+      if (word === "time" || word === "email" || word === "url" || word === "phone" || word === "color" || word === "markdown") return word;
+    }
+  }
+  return "string";
+}
+var POLICIES = /* @__PURE__ */ new Set(["include", "on_request", "exclude"]);
+var SENSITIVITIES = /* @__PURE__ */ new Set(["public", "internal", "confidential", "restricted"]);
+function contextFieldFromStore(row) {
+  const d = row.data ?? {};
+  const key = str(d.key);
+  const policy = str(d.context_policy, "include");
+  const sensitivity = str(d.sensitivity, "internal");
+  return {
+    id: row.id,
+    scope_type_id: row.scope_type_id,
+    organization_id: row.organization_id,
+    key,
+    label: str(d.label, key),
+    description: str(d.description),
+    kind: contextFieldKind(d, row.carried),
+    type: str(d.type, "text"),
+    multi: Boolean(d.multi),
+    format: strOrNull(d.format),
+    config: d.config ?? {},
+    relation_target: strOrNull(d.relation_target),
+    // The store's sort counts the scope's own two columns first (custom._ctx_store_item: + 2).
+    sort: Math.max(0, num(d.sort) - 2),
+    context_policy: POLICIES.has(policy) ? policy : "include",
+    sensitivity: SENSITIVITIES.has(sensitivity) ? sensitivity : "internal",
+    source: str(d.source, "manual"),
+    status: str(d.status, "active"),
+    status_note: strOrNull(d.status_note),
+    category: strOrNull(d.category),
+    tags: Array.isArray(d.tags) ? d.tags : [],
+    max_items: typeof d.max_items === "number" ? d.max_items : 1,
+    custom_component: d.custom_component ?? null,
+    reference_source: d.reference_source ?? null,
+    allowed_scope_type_ids: Array.isArray(d.allowed_scope_type_ids) ? d.allowed_scope_type_ids : null,
+    allowed_reference_types: Array.isArray(d.allowed_reference_types) ? d.allowed_reference_types : null,
+    review_interval_days: typeof d.review_interval_days === "number" ? d.review_interval_days : null,
+    depends_on: Array.isArray(d.depends_on) ? d.depends_on : [],
+    version: num(row.version, 1),
+    created_by: row.created_by ?? null,
+    created_at: row.created_at ?? "",
+    updated_at: row.updated_at ?? ""
+  };
+}
+var POLICY_TO_DOOR = { include: "always", on_request: "on_demand", exclude: "never" };
+var SENSITIVITY_TO_DOOR = {
+  public: "public",
+  internal: "internal",
+  confidential: "restricted",
+  restricted: "privileged"
+};
+var SENSITIVITY_FROM_DOOR = {
+  public: "public",
+  internal: "internal",
+  restricted: "confidential",
+  privileged: "restricted"
+};
+function systemContextFieldFromStore(row, index) {
+  const key = str(row.key);
+  const kind = str(row.value_type, "string");
+  return {
+    id: str(row.id),
+    scope_type_id: SYSTEM_CONTEXT_TYPE_ID,
+    organization_id: "",
+    key,
+    label: str(row.display_name, key),
+    description: str(row.description),
+    kind: KINDS.has(kind) ? kind : "string",
+    type: "system",
+    multi: kind === "array",
+    format: null,
+    config: {},
+    relation_target: null,
+    sort: typeof row.sort_order === "number" ? row.sort_order : index,
+    context_policy: "include",
+    // The system table keeps the old sensitivity words (`restricted`/`privileged`), like the write doors.
+    sensitivity: SENSITIVITY_FROM_DOOR[str(row.sensitivity)] ?? "public",
+    source: "system",
+    status: "active",
+    status_note: null,
+    category: null,
+    tags: [],
+    max_items: 0,
+    custom_component: null,
+    reference_source: null,
+    allowed_scope_type_ids: null,
+    allowed_reference_types: null,
+    review_interval_days: null,
+    depends_on: [],
+    version: 0,
+    created_by: null,
+    created_at: "",
+    updated_at: "",
+    item_class: strOrNull(row.item_class)
+  };
+}
+function referencesOf(row) {
+  const v = row.value;
+  const list = Array.isArray(v) ? v : v == null ? [] : [v];
+  const labels = row.labels ?? {};
+  const files = row.files ?? {};
+  const toFile = row.field?.relation_target === FILE_KERNEL_ID;
+  const out = [];
+  for (const el of list) {
+    let ref = null;
+    if (typeof el === "string" && (0, import_uuid.isUuidShape)(el)) ref = { id: el, type: toFile ? "file" : "scope" };
+    else if (el && typeof el === "object" && typeof el.id === "string") {
+      const token = String(el.token ?? "");
+      const own = el.label;
+      ref = { id: el.id, type: token === "dataset" ? "table" : token || (toFile ? "file" : "scope") };
+      if (typeof own === "string" && own) ref.label = own;
+    }
+    if (!ref) continue;
+    const label = labels[ref.id];
+    if (label) ref.label = label;
+    const fileId = files[ref.id];
+    if (fileId) ref.file_id = fileId;
+    out.push(ref);
+  }
+  return out;
+}
+function contextValueFromStore(row) {
+  const kind = contextFieldKind(row.field ?? {}, row.field?.carried);
+  const carriedText = Boolean(row.field?.carried?.as_text);
+  const isRef = !carriedText && (kind === "reference" || kind === "document");
+  return {
+    scope_id: row.scope_id,
+    field_id: row.context_item_id,
+    key: row.key,
+    kind,
+    value: row.value ?? null,
+    references: isRef ? referencesOf(row) : [],
+    version: num(row.version, 1),
+    set_at: row.set_at ?? null,
+    source_type: row.source_type ?? null,
+    authored_by: row.authored_by ?? null,
+    whole_value: row.whole_value ?? null,
+    incomplete: null
+  };
+}
+async function sha256Hex(text) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) return null;
+  const digest = await subtle.digest("SHA-256", new TextEncoder().encode(text));
+  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function completeWholeValues(values, read) {
+  const texts = /* @__PURE__ */ new Map();
+  await Promise.all(
+    values.map(async (cell) => {
+      const w = cell.whole_value;
+      if (!w || w.in_value || typeof cell.value !== "string") return;
+      const head = cell.value;
+      const chars = typeof w.chars === "number" ? w.chars : null;
+      const incomplete = (fileId, why) => {
+        cell.incomplete = { head, chars, file_id: fileId, why };
+      };
+      if (!w.file_id) return incomplete(null, "The rest of this text is still being saved.");
+      if (!read) return incomplete(w.file_id, "This place cannot open the file that holds the whole text.");
+      if (!texts.has(w.file_id)) texts.set(w.file_id, read(w.file_id));
+      try {
+        const text = await texts.get(w.file_id);
+        if (chars !== null && [...text].length !== chars) {
+          return incomplete(w.file_id, `The file holds ${[...text].length} characters, not ${chars}.`);
+        }
+        if (w.sha256) {
+          const sha = await sha256Hex(text);
+          if (sha === null) return incomplete(w.file_id, "This browser cannot check the file.");
+          if (sha !== w.sha256) return incomplete(w.file_id, "The file's content is not the text the cell points at.");
+        }
+        cell.value = text;
+      } catch (thrown) {
+        incomplete(w.file_id, thrown instanceof Error ? thrown.message : String(thrown));
+      }
+    })
+  );
+}
+function definedOnly(fields) {
+  const out = {};
+  for (const [k, v] of Object.entries(fields)) if (v !== void 0) out[k] = v;
+  return out;
+}
+function fieldSpecForDoor(spec) {
+  return definedOnly({
+    key: spec.key,
+    display_name: spec.label,
+    value_type: spec.kind,
+    description: spec.description,
+    category: spec.category,
+    fetch_hint: spec.context_policy ? POLICY_TO_DOOR[spec.context_policy] : void 0,
+    sensitivity: spec.sensitivity ? SENSITIVITY_TO_DOOR[spec.sensitivity] : void 0,
+    tags: spec.tags,
+    sort_order: spec.sort,
+    status: spec.status,
+    status_note: spec.status_note,
+    custom_component: spec.custom_component,
+    review_interval_days: spec.review_interval_days,
+    allowed_reference_types: spec.allowed_reference_types,
+    max_items: spec.max_items,
+    allowed_scope_type_ids: spec.allowed_scope_type_ids,
+    reference_source: spec.reference_source
+  });
+}
+function referenceFence(references) {
+  const kinds = [...new Set(references.map((r) => r.type))];
+  const type = kinds.length === 1 ? kinds[0] : "mixed";
+  const items = references.map((r) => {
+    if (r.type === "file" && r.file_id) return r.label ? { file_id: r.file_id, label: r.label } : { file_id: r.file_id };
+    const item = { id: r.id };
+    if (r.label) item.label = r.label;
+    if (kinds.length > 1) item.type = r.type;
+    return item;
+  });
+  return "```matrx\n" + JSON.stringify({ matrx_version: 1, kind: "reference", type, items }, null, 2) + "\n```";
+}
+function valuePayloadForDoor(write) {
+  const base = definedOnly({
+    scope_id: write.scope_id,
+    context_item_id: write.field_id,
+    source_type: write.source_type,
+    change_summary: write.change_summary
+  });
+  const v = write.value;
+  if (write.kind === "reference" || write.kind === "document") {
+    if (write.references) return { ...base, value_text: write.references.length ? referenceFence(write.references) : null };
+    if (write.kind === "document" && typeof v === "string") return { ...base, value_document_url: v || null };
+    return { ...base, value_text: typeof v === "string" ? v || null : null };
+  }
+  if (v === null || v === void 0 || v === "") {
+    return { ...base, value_text: null };
+  }
+  switch (write.kind) {
+    case "number":
+    case "percent":
+      return typeof v === "number" ? { ...base, value_number: v } : { ...base, value_text: String(v) };
+    case "currency":
+      return typeof v === "object" ? { ...base, value_json: v } : typeof v === "number" ? { ...base, value_number: v } : { ...base, value_text: String(v) };
+    case "boolean":
+      return typeof v === "boolean" ? { ...base, value_boolean: v } : { ...base, value_text: String(v) };
+    case "date":
+      return { ...base, value_date: String(v) };
+    case "datetime":
+      return { ...base, value_timestamp: String(v) };
+    case "time":
+      return { ...base, value_time: String(v) };
+    case "object":
+    case "array":
+      return typeof v === "object" ? { ...base, value_json: v } : { ...base, value_text: String(v) };
+    default:
+      return typeof v === "object" ? { ...base, value_json: v } : { ...base, value_text: String(v) };
+  }
+}
+
+// src/scopes/rules.ts
+function toSlug(name) {
+  return name.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function isValidSlug(s) {
+  return /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/.test(s);
+}
+var RESERVED_SCOPE_SLUGS = /* @__PURE__ */ new Set(["context-items", "scopes", "edit", "manage", "new", "settings"]);
+function isReservedSlug(s) {
+  return RESERVED_SCOPE_SLUGS.has(s.toLowerCase().replace(/_/g, "-"));
+}
+function resolveSlug(supplied, fallbackName) {
+  const slug = supplied?.trim() || toSlug(fallbackName);
+  if (!slug || !isValidSlug(slug)) {
+    return {
+      ok: false,
+      error: { code: "invalid_argument", message: "Use letters, numbers and single hyphens for the short name." }
+    };
+  }
+  if (isReservedSlug(slug)) {
+    return { ok: false, error: { code: "invalid_argument", message: `"${slug}" is a page name here. Pick another short name.` } };
+  }
+  return { ok: true, data: slug };
+}
+
+// src/scopes/doors.ts
+var FIELD_KERNEL_ID = "11111111-0000-4000-8000-000000000002";
+var SCOPES_PER_CALL = 500;
+var SCOPE_TYPES_PER_FIELDS_CALL = 100;
+var SCOPES_PER_VALUES_CALL = 200;
+var TYPE_SCOPES_PAGE = 200;
+var ARCHIVED_SCOPES_PAGE = 200;
+var uniq = (ids) => [...new Set(ids.filter(Boolean))];
+async function inBatches(ids, size, call) {
+  const unique = uniq(ids);
+  const batches = [];
+  for (let i = 0; i < unique.length; i += size) batches.push(unique.slice(i, i + size));
+  const answers = await Promise.all(batches.map(call));
+  const out = [];
+  for (const a of answers) {
+    if (!a.ok) return a;
+    out.push(...a.data ?? []);
+  }
+  return { ok: true, data: out };
+}
+function noRow(door) {
+  return { ok: false, error: { code: "internal", message: `${door} answered without the row it wrote.`, diagnostic: `@ai-matrx/records/scopes: ${door}` } };
+}
+var VALUE_DOOR_CODES = {
+  unauthorized: "door",
+  forbidden: "door",
+  forbidden_org: "door",
+  not_found: "not_found",
+  invalid_argument: "invalid_argument",
+  conflict: "stale_write",
+  unavailable: "not_supported"
+};
+function createScopeDoors(call) {
+  async function write(door, args) {
+    const res = await call(door, args, `scopes.${door}`);
+    if (!res.ok) return res;
+    const row = res.data?.row;
+    if (!row || typeof row !== "object") return noRow(door);
+    return { ok: true, data: row };
+  }
+  async function archiveOrRestore(door, args, id) {
+    const res = await call(door, args, `scopes.${door}`);
+    return res.ok ? { ok: true, data: { id } } : res;
+  }
+  async function fieldById(scopeTypeId, fieldId, door) {
+    const fields = await doors.fields([scopeTypeId]);
+    if (!fields.ok) return fields;
+    const field = fields.data.find((f) => f.id === fieldId);
+    return field ? { ok: true, data: field } : noRow(door);
+  }
+  const doors = {
+    async tree(organizationIds) {
+      const ids = uniq(organizationIds);
+      if (ids.length === 0) return { ok: true, data: [] };
+      const res = await call("context_tree", { p_organization_ids: ids }, "scopes.tree");
+      if (!res.ok) return res;
+      const byType = /* @__PURE__ */ new Map();
+      for (const s of res.data?.scopes ?? []) {
+        const scope = scopeFromStore(s);
+        const list = byType.get(scope.scope_type_id) ?? [];
+        list.push(scope);
+        byType.set(scope.scope_type_id, list);
+      }
+      return { ok: true, data: (res.data?.types ?? []).map((t) => ({ ...scopeTypeFromStore(t), scopes: byType.get(t.id) ?? [] })) };
+    },
+    async types(organizationIds, options) {
+      const withCounts = options?.withCounts ?? true;
+      const ids = uniq(organizationIds);
+      if (ids.length === 0) return { ok: true, data: { types: [], counts: withCounts ? {} : null } };
+      const res = await call("context_tree_types", { p_organization_ids: ids, p_with_counts: withCounts }, "scopes.types");
+      if (!res.ok) return res;
+      const rows = res.data?.types ?? [];
+      const counts = withCounts ? {} : null;
+      if (counts) for (const r of rows) counts[r.id] = Number(r.scope_count ?? 0);
+      return { ok: true, data: { types: rows.map(scopeTypeFromStore), counts } };
+    },
+    async typeScopesPage(scopeTypeId, offset = 0, limit = TYPE_SCOPES_PAGE) {
+      const res = await call(
+        "context_tree_type_scopes",
+        { p_scope_type_id: scopeTypeId, p_offset: offset, p_limit: limit },
+        "scopes.typeScopesPage"
+      );
+      if (!res.ok) return res;
+      return {
+        ok: true,
+        data: { scopes: (res.data?.scopes ?? []).map(scopeFromStore), total: Number(res.data?.total ?? 0), next_offset: res.data?.next_offset ?? null }
+      };
+    },
+    async search(organizationIds, query, limit = 100) {
+      const ids = uniq(organizationIds);
+      const q = query.trim();
+      if (ids.length === 0 || q === "") return { ok: true, data: { scopes: [], total: 0 } };
+      const res = await call(
+        "context_tree_search",
+        { p_organization_ids: ids, p_query: q, p_limit: limit },
+        "scopes.search"
+      );
+      if (!res.ok) return res;
+      return { ok: true, data: { scopes: (res.data?.scopes ?? []).map(scopeFromStore), total: Number(res.data?.total ?? 0) } };
+    },
+    async scopes(ids) {
+      const res = await inBatches(ids, SCOPES_PER_CALL, (batch) => call("context_scopes", { p_scope_ids: batch }, "scopes.scopes"));
+      return res.ok ? { ok: true, data: res.data.map(scopeWithTypeFromStore) } : res;
+    },
+    async fields(scopeTypeIds) {
+      const res = await inBatches(
+        scopeTypeIds,
+        SCOPE_TYPES_PER_FIELDS_CALL,
+        (batch) => call("context_items", { p_scope_type_ids: batch }, "scopes.fields")
+      );
+      return res.ok ? { ok: true, data: res.data.map(contextFieldFromStore) } : res;
+    },
+    async field(fieldId, organizationIds) {
+      const orgs = uniq(organizationIds);
+      const answers = await Promise.all(
+        orgs.map(
+          (org) => call(
+            "read_records_by_ids",
+            { p_organization_id: org, p_table_id: FIELD_KERNEL_ID, p_record_ids: [fieldId], p_by_id: false },
+            "scopes.field"
+          )
+        )
+      );
+      let refusal = null;
+      for (const answer of answers) {
+        if (!answer.ok) {
+          refusal ??= answer;
+          continue;
+        }
+        const typeId = answer.data?.find((r) => r.id === fieldId)?.document?.entity_definition_id;
+        if (typeof typeId !== "string") continue;
+        const fields = await doors.fields([typeId]);
+        if (!fields.ok) return fields;
+        const field = fields.data.find((f) => f.id === fieldId);
+        if (field) return { ok: true, data: field };
+      }
+      return refusal ?? {
+        ok: false,
+        error: { code: "not_found", message: "This context field could not be found.", diagnostic: `@ai-matrx/records/scopes: field ${fieldId}` }
+      };
+    },
+    async values(scopeIds, options) {
+      const res = await inBatches(
+        scopeIds,
+        SCOPES_PER_VALUES_CALL,
+        (batch) => call("context_values", { p_scope_ids: batch }, "scopes.values")
+      );
+      if (!res.ok) return res;
+      const cells = res.data.map(contextValueFromStore);
+      await completeWholeValues(cells, options?.readFileText ?? null);
+      return { ok: true, data: cells };
+    },
+    async archivedTypes(organizationId) {
+      const res = await call("context_archived_types", { p_organization_id: organizationId }, "scopes.archivedTypes");
+      return res.ok ? { ok: true, data: (res.data ?? []).map(archivedScopeTypeFromStore) } : res;
+    },
+    async archivedScopesOfType(organizationId, scopeTypeId, wanted) {
+      const out = [];
+      for (let offset = 0; out.length < wanted.size; offset += ARCHIVED_SCOPES_PAGE) {
+        const res = await call(
+          "read_records_archived",
+          { p_organization_id: organizationId, p_table_id: scopeTypeId, p_lane: "org", p_by_id: false, p_limit: ARCHIVED_SCOPES_PAGE, p_offset: offset },
+          "scopes.archivedScopesOfType"
+        );
+        if (!res.ok) return res;
+        const rows = res.data ?? [];
+        for (const r of rows) {
+          if (!wanted.has(r.id)) continue;
+          out.push({
+            id: r.id,
+            name: typeof r.document?.name === "string" ? r.document.name : null,
+            slug: typeof r.document?.slug === "string" ? r.document.slug : null,
+            archived_at: r.archived_at ?? null
+          });
+        }
+        if (rows.length < ARCHIVED_SCOPES_PAGE) break;
+      }
+      return { ok: true, data: out };
+    },
+    async systemItems() {
+      const res = await call("context_system_items", {}, "scopes.systemItems");
+      return res.ok ? { ok: true, data: (res.data ?? []).map(systemContextFieldFromStore) } : res;
+    },
+    async tableTemplates(organizationId) {
+      const res = await call("table_templates", { p_org_id: organizationId }, "scopes.tableTemplates");
+      return res.ok ? { ok: true, data: Array.isArray(res.data) ? res.data : [] } : res;
+    },
+    async templates() {
+      const res = await call("context_templates", {}, "scopes.templates");
+      return res.ok ? { ok: true, data: res.data ?? [] } : res;
+    },
+    async createType(organizationId, spec) {
+      const slug = resolveSlug(spec.slug, spec.label_plural || spec.label_singular || "");
+      if (!slug.ok) return slug;
+      const res = await write("context_type_write", {
+        p_organization_id: organizationId,
+        p_type_id: null,
+        p_spec: definedOnly({
+          label_singular: spec.label_singular,
+          label_plural: spec.label_plural,
+          icon: spec.icon ?? "folder",
+          description: spec.description ?? "",
+          sort_order: spec.sort_order ?? 0,
+          max_assignments: spec.max_assignments_per_entity ?? void 0,
+          default_variable_keys: spec.default_variable_keys ?? [],
+          color: spec.color,
+          slug: slug.data
+        })
+      });
+      return res.ok ? { ok: true, data: scopeTypeFromStore(res.data) } : res;
+    },
+    async updateType(typeId, spec) {
+      let slug;
+      if (spec.slug !== void 0) {
+        const resolved = resolveSlug(spec.slug, spec.label_plural ?? spec.label_singular ?? "");
+        if (!resolved.ok) return resolved;
+        slug = resolved.data;
+      }
+      const res = await write("context_type_write", {
+        p_organization_id: null,
+        p_type_id: typeId,
+        p_spec: definedOnly({
+          label_singular: spec.label_singular,
+          label_plural: spec.label_plural,
+          icon: spec.icon,
+          description: spec.description,
+          sort_order: spec.sort_order,
+          max_assignments: spec.max_assignments_per_entity,
+          color: spec.color,
+          slug
+        })
+      });
+      return res.ok ? { ok: true, data: scopeTypeFromStore(res.data) } : res;
+    },
+    archiveType: (typeId) => archiveOrRestore("context_type_archive", { p_type_id: typeId }, typeId),
+    restoreType: (typeId) => archiveOrRestore("context_type_restore", { p_type_id: typeId }, typeId),
+    async createScope(organizationId, typeId, spec) {
+      const slug = resolveSlug(spec.slug, spec.name ?? "");
+      if (!slug.ok) return slug;
+      const res = await write("context_scope_write", {
+        p_organization_id: organizationId,
+        p_scope_id: null,
+        p_type_id: typeId,
+        p_spec: definedOnly({
+          name: spec.name,
+          parent_scope_id: spec.parent_scope_id,
+          description: spec.description ?? "",
+          settings: spec.settings ?? {},
+          slug: slug.data,
+          sort_order: spec.sort_order
+        })
+      });
+      return res.ok ? { ok: true, data: scopeFromStore(res.data) } : res;
+    },
+    async updateScope(scopeId, spec) {
+      let slug;
+      if (spec.slug !== void 0) {
+        const resolved = resolveSlug(spec.slug, spec.name ?? "");
+        if (!resolved.ok) return resolved;
+        slug = resolved.data;
+      }
+      const res = await write("context_scope_write", {
+        p_organization_id: null,
+        p_scope_id: scopeId,
+        p_type_id: null,
+        p_spec: definedOnly({ name: spec.name, description: spec.description, settings: spec.settings, slug, sort_order: spec.sort_order })
+      });
+      return res.ok ? { ok: true, data: scopeFromStore(res.data) } : res;
+    },
+    archiveScope: (scopeId) => archiveOrRestore("context_scope_archive", { p_scope_id: scopeId }, scopeId),
+    restoreScope: (scopeId) => archiveOrRestore("context_scope_restore", { p_scope_id: scopeId }, scopeId),
+    async createField(scopeTypeId, spec) {
+      const res = await write("context_item_write", {
+        p_item_id: null,
+        p_scope_type_id: scopeTypeId,
+        p_spec: fieldSpecForDoor({ kind: "string", description: "", context_policy: "on_request", sensitivity: "internal", tags: [], ...spec })
+      });
+      if (!res.ok) return res;
+      return fieldById(scopeTypeId, String(res.data.id), "context_item_write");
+    },
+    async updateField(fieldId, scopeTypeId, spec) {
+      const res = await write("context_item_write", { p_item_id: fieldId, p_scope_type_id: null, p_spec: fieldSpecForDoor(spec) });
+      if (!res.ok) return res;
+      return fieldById(scopeTypeId, fieldId, "context_item_write");
+    },
+    archiveField: (fieldId) => archiveOrRestore("context_item_archive", { p_item_id: fieldId }, fieldId),
+    restoreField: (fieldId) => archiveOrRestore("context_item_restore", { p_item_id: fieldId }, fieldId),
+    async writeValue(cell) {
+      const res = await call(
+        "context_value_write",
+        { p_payload: { source_type: "ai_enriched", ...valuePayloadForDoor(cell) } },
+        "scopes.writeValue"
+      );
+      if (!res.ok) return res;
+      const envelope = res.data ?? {};
+      if (!envelope.ok) {
+        const code = VALUE_DOOR_CODES[envelope.error?.code ?? ""] ?? "internal";
+        return { ok: false, error: { code, message: envelope.error?.message ?? "The value was not saved." } };
+      }
+      return {
+        ok: true,
+        data: {
+          scope_id: cell.scope_id,
+          field_id: cell.field_id,
+          version: Number(envelope.data?.version ?? 1),
+          source_type: String(envelope.data?.source_type ?? cell.source_type ?? "ai_enriched")
+        }
+      };
+    },
+    tableProvision({ organization_id, item_id, scope_id, home_id }) {
+      return call(
+        "scope_table_provision",
+        { p_organization_id: organization_id, p_item_id: item_id, p_scope_id: scope_id, p_home_id: home_id ?? null },
+        "scopeTableProvision"
+      );
+    }
+  };
+  return doors;
+}
+
+// src/core/storeDoors.ts
+var STORE_SCHEMA = "custom";
+function storeDoors(client) {
+  const source = supabaseDataSource(client ?? {});
+  const call = (fn, args = {}) => source.rpc(fn, args, { schema: STORE_SCHEMA });
+  const typed = (fn, args) => call(fn, args);
+  return {
+    rpc: call,
+    async whereIdOpens(id) {
+      const raw = await call("where_id_opens", { p_id: id });
+      const e = raw.error;
+      return {
+        data: raw.data ?? null,
+        error: e ? { code: typeof e.code === "string" ? e.code : null, message: typeof e.message === "string" ? e.message : "The record store refused." } : null
+      };
+    },
+    tableKernelId: () => typed("table_kernel_id", {}),
+    readRecordsByIds: (organizationId, tableId, ids) => typed("read_records_by_ids", { p_organization_id: organizationId, p_table_id: tableId, p_record_ids: ids }),
+    readRecordsPage: (args) => typed("read_records_page", args),
+    recordTable: (organizationId, recordId) => typed("record_table", { p_organization_id: organizationId, p_record_id: recordId }),
+    applicableFields: (organizationId, tableId) => typed("applicable_fields", { p_organization_id: organizationId, p_table_id: tableId }),
+    fieldDeclare: (organizationId, tableId, spec) => typed("field_declare", { p_organization_id: organizationId, p_table_id: tableId, p_spec: spec }),
+    recordUpdate: (organizationId, recordId, patch) => typed("record_update", { p_organization_id: organizationId, p_record_id: recordId, p_patch: patch }),
+    entityReferenceWords: (organizationId, refs) => typed("entity_reference_words", { p_organization_id: organizationId, p_refs: refs.map((r) => ({ token: r.token, id: r.id })) }),
+    templates: (filter) => typed("templates", { p_filter: filter }),
+    templateFromTables: ({ organizationId, tableIds, includeRows, rowsPerTable }) => typed("template_from_tables", {
+      p_organization_id: organizationId,
+      p_table_ids: tableIds,
+      p_include_rows: includeRows,
+      p_rows_per_table: rowsPerTable
+    }),
+    templateDeclare: (scope, spec) => typed("template_declare", { p_scope: scope, p_spec: spec }),
+    templateKeep: (templateId) => typed("template_keep", { p_template_id: templateId }),
+    templateArchive: (templateId, restore) => typed("template_archive", restore === void 0 ? { p_template_id: templateId } : { p_template_id: templateId, p_restore: restore }),
+    templateInstallClaim: ({ organizationId, installId, kind, label, sourceId, leaseSeconds }) => typed("template_install_claim", {
+      p_organization_id: organizationId,
+      p_install_id: installId,
+      p_kind: kind,
+      p_label: label,
+      ...sourceId ? { p_source_id: sourceId } : {},
+      p_lease_seconds: leaseSeconds
+    }),
+    templateInstallNote: ({ organizationId, installId, kind, id, label }) => typed("template_install_note", {
+      p_organization_id: organizationId,
+      p_install_id: installId,
+      p_kind: kind,
+      p_id: id,
+      p_label: label
+    })
+  };
+}
+
+// src/core/table-logic.ts
+function isBulkOpError(r) {
+  return typeof r === "object" && r !== null && "error" in r;
+}
+function describeBulkFailures(failed) {
+  const inTrash = failed.filter((f) => f.error === "row_in_trash").length;
+  const missing = failed.length - inTrash;
+  const parts = [];
+  if (inTrash > 0) {
+    parts.push(
+      `${inTrash} row${inTrash === 1 ? " is" : "s are"} in Trash \u2014 restore ${inTrash === 1 ? "it" : "them"} from Trash to edit`
+    );
+  }
+  if (missing > 0) {
+    parts.push(
+      `${missing} row${missing === 1 ? "" : "s"} could not be found \u2014 ${missing === 1 ? "it" : "they"} may have been removed by someone else`
+    );
+  }
+  return `${parts.join("; ")}.`;
+}
+function isServiceFailure(r) {
+  return r.success === false;
+}
+
+// src/objectOrganization.ts
+var WHERE_ID_OPENS_DOOR = "where_id_opens";
+function doorIsAbsent(error) {
+  if (error.code === "PGRST202" || error.code === "42883") return true;
+  return /could not find the function/i.test(error.message ?? "");
+}
+var DOOR_ABSENT_WHY = "custom.where_id_opens is missing from this database, so this page cannot tell which organization the record lives in and holds instead of guessing. Remedy: the chair applies migrations/campaign/openbyid_one_address_opens_any_id.sql and openbyid_the_resolver_can_be_reached.sql.";
+async function resolveObjectOrganization(dataSource, id) {
+  let answered;
+  try {
+    answered = await dataSource.rpc(WHERE_ID_OPENS_DOOR, { p_id: id }, { schema: "custom" });
+  } catch (thrown) {
+    return { state: "unavailable", why: thrown instanceof Error ? thrown.message : "The record store did not answer." };
+  }
+  return readObjectOrganizationAnswer(answered, id);
+}
+function readObjectOrganizationAnswer(answered, id) {
+  if (answered.error) {
+    if (doorIsAbsent(answered.error)) {
+      console.warn(`[@ai-matrx/records] ${DOOR_ABSENT_WHY}`);
+      return { state: "unavailable", why: DOOR_ABSENT_WHY };
+    }
+    return { state: "unavailable", why: answered.error.message ?? "The record store refused to say where this is." };
+  }
+  const row = answered.data;
+  if (row === null || row === void 0) return { state: "not-given" };
+  if (typeof row !== "object" || typeof row.organization_id !== "string" || typeof row.kind !== "string") {
+    return { state: "unavailable", why: "The record store answered something this page cannot read." };
+  }
+  return {
+    state: "found",
+    organizationId: row.organization_id,
+    kind: row.kind,
+    path: typeof row.path === "string" ? row.path : null,
+    live: row.live !== false,
+    resolvedId: typeof row.resolved_id === "string" ? row.resolved_id : id
+  };
+}
+
+// src/door-call/index.ts
+function lightDoorCall(client, options = {}) {
+  return createDoorCall({ ...options, dataSource: asRecordsDataSource(client) });
+}
+function lightScopeDoors(client, options = {}) {
+  return createScopeDoors(lightDoorCall(client, options));
+}
+function lightPickListDoors(client, options = {}) {
+  return createPickListDoors(lightDoorCall(client, options));
+}
+//# sourceMappingURL=index.cjs.map