deepspace 0.22.1 → 0.23.0

package/dist/server.js

@@ -1586,7 +1586,7 @@ function authWorkerFetch(env, path, init) {
 function buildCronContext(env, ownerUserId, roomId = "default") {
   const roomIdObj = env.RECORD_ROOMS.idFromName(roomId);
   const room = env.RECORD_ROOMS.get(roomIdObj);
-  async function executeTool3(tool2, params) {
+  async function executeTool2(tool2, params) {
     const response = await room.fetch(
       new Request("https://internal/api/tools/execute", {
         method: "POST",
@@ -1609,18 +1609,18 @@ function buildCronContext(env, ownerUserId, roomId = "default") {
       const params = { collection };
       if (opts?.where) params.where = opts.where;
       if (opts?.limit) params.limit = opts.limit;
-      const data = await executeTool3("records.query", params);
+      const data = await executeTool2("records.query", params);
       const records2 = data?.records;
       return records2 ?? [];
     },
     async create(collection, data) {
-      return executeTool3("records.create", { collection, data });
+      return executeTool2("records.create", { collection, data });
     },
     async update(collection, recordId, data) {
-      return executeTool3("records.update", { collection, recordId, data });
+      return executeTool2("records.update", { collection, recordId, data });
     },
     async delete(collection, recordId) {
-      return executeTool3("records.delete", { collection, recordId });
+      return executeTool2("records.delete", { collection, recordId });
     }
   };
   const integrations = {
@@ -2468,8 +2468,82 @@ function makeDefaultSummarizer(env, options = {}) {
   };
 }
 
+// src/shared/protocol/constants.ts
+var MSG = {
+  // ---- Records / CRUD --------------------------------------------------
+  SUBSCRIBE: "core.subscribe",
+  UNSUBSCRIBE: "core.unsubscribe",
+  QUERY_RESULT: "core.query_result",
+  RECORD_CHANGE: "core.record_change",
+  PUT: "core.put",
+  DELETE: "core.delete",
+  ERROR: "core.error",
+  // ---- Users -----------------------------------------------------------
+  USER_INFO: "user.info",
+  USER_LIST: "user.list",
+  SET_ROLE: "user.set_role",
+  USER_UPDATE: "user.update",
+  // ---- Auth signal -----------------------------------------------------
+  // Server → client one-shot on connect from rooms that enforce role-based
+  // writes (Canvas, Game, Cron). Tells the client whether this connection
+  // can write so its hook can disable local write APIs and the UI can
+  // render controls accordingly. Without this, a viewer's click would
+  // round-trip to the server and silently come back as ERROR.
+  AUTH: "auth",
+  // ---- Yjs JSON control frames (binary sync lives in ./yjs.ts) ---------
+  YJS_JOIN: "yjs.join",
+  YJS_LEAVE: "yjs.leave",
+  // ---- Records room misc -----------------------------------------------
+  ACK: "records.ack",
+  LIST_SCHEMAS: "records.list_schemas",
+  RESUBSCRIBE: "records.resubscribe",
+  // ---- CanvasRoom ------------------------------------------------------
+  CANVAS_SHAPES: "canvas.shapes",
+  CANVAS_ADD: "canvas.add",
+  CANVAS_MOVE: "canvas.move",
+  CANVAS_RESIZE: "canvas.resize",
+  CANVAS_DELETE: "canvas.delete",
+  CANVAS_UPDATE: "canvas.update",
+  CANVAS_VIEWPORT: "canvas.viewport",
+  CANVAS_UNDO: "canvas.undo",
+  CANVAS_REDO: "canvas.redo",
+  // ---- CronRoom --------------------------------------------------------
+  CRON_TASKS: "cron.tasks",
+  CRON_HISTORY: "cron.history",
+  CRON_TRIGGER: "cron.trigger",
+  CRON_PAUSE: "cron.pause",
+  CRON_RESUME: "cron.resume",
+  CRON_STATUS: "cron.status",
+  // Per-mutation receipt, sent only to the socket whose trigger/pause/
+  // resume carried a `requestId` — frames without one stay fire-and-forget.
+  CRON_ACK: "cron.ack",
+  // ---- JobRoom ---------------------------------------------------------
+  // Background-job queue with durable, alarm-driven execution. See
+  // server/rooms/job-room.ts. Clients enqueue and subscribe to updates;
+  // the room broadcasts JOB_UPDATE for every status transition.
+  JOB_ENQUEUE: "job.enqueue",
+  JOB_CANCEL: "job.cancel",
+  JOB_RETRY: "job.retry",
+  JOB_UPDATE: "job.update",
+  // ---- PresenceRoom ----------------------------------------------------
+  PRESENCE_SYNC: "presence.sync",
+  PRESENCE_JOIN: "presence.join",
+  PRESENCE_LEAVE: "presence.leave",
+  PRESENCE_UPDATE: "presence.update",
+  // ---- Gateway multiplexing --------------------------------------------
+  GW_SCOPE_CONNECT: "gateway.scope_connect",
+  GW_SCOPE_DISCONNECT: "gateway.scope_disconnect",
+  GW_SCOPE_ERROR: "gateway.scope_error",
+  GW_TOKEN_REFRESH: "gateway.token_refresh",
+  GW_USER_UPDATE: "gateway.user_update"
+};
+var MSG_YJS_SYNC = 22;
+var MSG_YJS_AWARENESS = 23;
+var ROLE_ANONYMOUS = "viewer";
+var RECORD_NOT_FOUND = "Record not found";
+
 // src/server/utils/chat-history.ts
-async function executeTool(stub, userId, tool2, params) {
+async function executeToolAsApp(stub, userId, tool2, params) {
   const res = await stub.fetch(new Request("https://internal/api/tools/execute", {
     method: "POST",
     headers: {
@@ -2510,13 +2584,15 @@ function toMessageRow(env) {
 }
 async function getChat(stub, chatId, userId) {
   try {
-    const result = await executeTool(stub, userId, "records.get", {
+    const result = await executeToolAsApp(stub, userId, "records.get", {
       collection: "ai-chats",
       recordId: chatId
     });
-    return result.record ? toChatRow(result.record) : null;
+    if (!result.record) return null;
+    const chat = toChatRow(result.record);
+    return chat.userId === userId ? chat : null;
   } catch (err) {
-    if (err instanceof Error && err.message.includes("Record not found")) return null;
+    if (err instanceof Error && err.message.includes(RECORD_NOT_FOUND)) return null;
     throw err;
   }
 }
@@ -2524,28 +2600,28 @@ async function createChat(stub, userId, opts = {}) {
   const data = { userId };
   if (opts.title !== void 0) data.title = opts.title;
   if (opts.model !== void 0) data.model = opts.model;
-  const result = await executeTool(stub, userId, "records.create", {
+  const result = await executeToolAsApp(stub, userId, "records.create", {
     collection: "ai-chats",
     data
   });
   return toChatRow(result.record);
 }
 async function updateChat(stub, chatId, userId, patch) {
-  await executeTool(stub, userId, "records.update", {
+  await executeToolAsApp(stub, userId, "records.update", {
     collection: "ai-chats",
     recordId: chatId,
     data: patch
   });
 }
 async function deleteChatCascade(stub, chatId, userId) {
-  const list = await executeTool(stub, userId, "records.query", {
+  const list = await executeToolAsApp(stub, userId, "records.query", {
     collection: "ai-messages",
     where: { chatId }
   });
   const errors = [];
   for (const env of list.records) {
     try {
-      await executeTool(stub, userId, "records.delete", {
+      await executeToolAsApp(stub, userId, "records.delete", {
         collection: "ai-messages",
         recordId: env.recordId
       });
@@ -2554,7 +2630,7 @@ async function deleteChatCascade(stub, chatId, userId) {
     }
   }
   try {
-    await executeTool(stub, userId, "records.delete", {
+    await executeToolAsApp(stub, userId, "records.delete", {
       collection: "ai-chats",
       recordId: chatId
     });
@@ -2570,7 +2646,7 @@ async function deleteChatCascade(stub, chatId, userId) {
   }
 }
 async function loadMessages(stub, chatId, userId) {
-  const result = await executeTool(stub, userId, "records.query", {
+  const result = await executeToolAsApp(stub, userId, "records.query", {
     collection: "ai-messages",
     where: { chatId, userId },
     orderBy: "createdAt",
@@ -2586,7 +2662,7 @@ async function appendMessage(stub, msg) {
     content: msg.content
   };
   if (msg.parts !== void 0) data.parts = msg.parts;
-  await executeTool(stub, msg.userId, "records.create", {
+  await executeToolAsApp(stub, msg.userId, "records.create", {
     collection: "ai-messages",
     recordId: msg.id,
     data
@@ -2967,79 +3043,6 @@ var BaseRoom = class {
   }
 };
 
-// src/shared/protocol/constants.ts
-var MSG = {
-  // ---- Records / CRUD --------------------------------------------------
-  SUBSCRIBE: "core.subscribe",
-  UNSUBSCRIBE: "core.unsubscribe",
-  QUERY_RESULT: "core.query_result",
-  RECORD_CHANGE: "core.record_change",
-  PUT: "core.put",
-  DELETE: "core.delete",
-  ERROR: "core.error",
-  // ---- Users -----------------------------------------------------------
-  USER_INFO: "user.info",
-  USER_LIST: "user.list",
-  SET_ROLE: "user.set_role",
-  USER_UPDATE: "user.update",
-  // ---- Auth signal -----------------------------------------------------
-  // Server → client one-shot on connect from rooms that enforce role-based
-  // writes (Canvas, Game, Cron). Tells the client whether this connection
-  // can write so its hook can disable local write APIs and the UI can
-  // render controls accordingly. Without this, a viewer's click would
-  // round-trip to the server and silently come back as ERROR.
-  AUTH: "auth",
-  // ---- Yjs JSON control frames (binary sync lives in ./yjs.ts) ---------
-  YJS_JOIN: "yjs.join",
-  YJS_LEAVE: "yjs.leave",
-  // ---- Records room misc -----------------------------------------------
-  ACK: "records.ack",
-  LIST_SCHEMAS: "records.list_schemas",
-  RESUBSCRIBE: "records.resubscribe",
-  // ---- CanvasRoom ------------------------------------------------------
-  CANVAS_SHAPES: "canvas.shapes",
-  CANVAS_ADD: "canvas.add",
-  CANVAS_MOVE: "canvas.move",
-  CANVAS_RESIZE: "canvas.resize",
-  CANVAS_DELETE: "canvas.delete",
-  CANVAS_UPDATE: "canvas.update",
-  CANVAS_VIEWPORT: "canvas.viewport",
-  CANVAS_UNDO: "canvas.undo",
-  CANVAS_REDO: "canvas.redo",
-  // ---- CronRoom --------------------------------------------------------
-  CRON_TASKS: "cron.tasks",
-  CRON_HISTORY: "cron.history",
-  CRON_TRIGGER: "cron.trigger",
-  CRON_PAUSE: "cron.pause",
-  CRON_RESUME: "cron.resume",
-  CRON_STATUS: "cron.status",
-  // Per-mutation receipt, sent only to the socket whose trigger/pause/
-  // resume carried a `requestId` — frames without one stay fire-and-forget.
-  CRON_ACK: "cron.ack",
-  // ---- JobRoom ---------------------------------------------------------
-  // Background-job queue with durable, alarm-driven execution. See
-  // server/rooms/job-room.ts. Clients enqueue and subscribe to updates;
-  // the room broadcasts JOB_UPDATE for every status transition.
-  JOB_ENQUEUE: "job.enqueue",
-  JOB_CANCEL: "job.cancel",
-  JOB_RETRY: "job.retry",
-  JOB_UPDATE: "job.update",
-  // ---- PresenceRoom ----------------------------------------------------
-  PRESENCE_SYNC: "presence.sync",
-  PRESENCE_JOIN: "presence.join",
-  PRESENCE_LEAVE: "presence.leave",
-  PRESENCE_UPDATE: "presence.update",
-  // ---- Gateway multiplexing --------------------------------------------
-  GW_SCOPE_CONNECT: "gateway.scope_connect",
-  GW_SCOPE_DISCONNECT: "gateway.scope_disconnect",
-  GW_SCOPE_ERROR: "gateway.scope_error",
-  GW_TOKEN_REFRESH: "gateway.token_refresh",
-  GW_USER_UPDATE: "gateway.user_update"
-};
-var MSG_YJS_SYNC = 22;
-var MSG_YJS_AWARENESS = 23;
-var ROLE_ANONYMOUS = "viewer";
-
 // src/server/schemas/registry.ts
 function collectionTableName(name) {
   return `c_${name.replace(/[^a-zA-Z0-9_]/g, "_")}`;
@@ -3241,13 +3244,11 @@ function checkUnclaimedOwnerTransition(schema, role, nextData, userId) {
   }
   return `Role '${role}' can set '${schema.ownerField}' only to their own user id or leave it unclaimed`;
 }
+var SYSTEM_ASSIGNED_COLUMNS = /* @__PURE__ */ new Set(["email", "name", "imageUrl", "role"]);
+var SYSTEM_MAINTAINED_COLUMNS = /* @__PURE__ */ new Set(["createdAt", "lastSeenAt"]);
 var SYSTEM_MANAGED_COLUMNS = /* @__PURE__ */ new Set([
-  "email",
-  "name",
-  "imageUrl",
-  "role",
-  "createdAt",
-  "lastSeenAt"
+  ...SYSTEM_ASSIGNED_COLUMNS,
+  ...SYSTEM_MAINTAINED_COLUMNS
 ]);
 var USERS_COLUMNS = [
   { name: "email", storage: "text", interpretation: "plain" },
@@ -3553,6 +3554,11 @@ var serverBuild = {
 function getResolvedColumns(schema) {
   return (schema.columns ?? []).map(resolveColumn);
 }
+function systemManagedColumnError(column, isUpdate) {
+  const roleHint = column === "role" ? ", or the admin-gated useUsers().setRole() to change a role" : "";
+  const remedy = isUpdate ? `Re-sending the current value of '${column}' unchanged is accepted and ignored.` : `A users row is created by registration, so no value for '${column}' is accepted here \u2014 omit it.`;
+  return `FIELD ERROR: '${column}' is system-managed and cannot be set by a record write \u2014 nothing was written. Use tools.registerUser({ userId, isAdmin })${roleHint}. ${remedy}`;
+}
 function notifyTeamMembershipChange(ctx, collection, record) {
   if (collection !== "team_members") return;
   const affectedUserId = record.data.UserId;
@@ -3623,11 +3629,9 @@ function handleDelete(ctx, ws, attachment, payload) {
   }
 }
 function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRbac = false, systemUpdate = false) {
-  const isSystem = SYSTEM_COLLECTIONS.has(collection);
-  const schema = ctx.schemaRegistry.get(collection);
-  if (!schema && !isSystem) {
-    return { success: false, error: `Schema not registered for collection: ${collection}` };
-  }
+  const resolved = resolveCollection(ctx, collection);
+  if (!resolved.ok) return { success: false, error: resolved.error };
+  const schema = resolved.schema;
   if (!schema) {
     return { success: false, error: `Schema not registered for collection: ${collection}` };
   }
@@ -3682,17 +3686,7 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
       }
     }
   }
-  let finalData = mergedData;
-  if (!systemUpdate && schema.name === "users") {
-    finalData = { ...mergedData };
-    for (const key of SYSTEM_MANAGED_COLUMNS) {
-      if (existing?.data[key] !== void 0) {
-        finalData[key] = existing.data[key];
-      } else {
-        delete finalData[key];
-      }
-    }
-  }
+  const finalData = { ...mergedData };
   if (!skipUserRbac) {
     const permCtx = ctx.getPermissionContext();
     if (isUpdate) {
@@ -3724,6 +3718,17 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
       return { success: false, error: `FIELD ERROR: ${ownerError}` };
     }
   }
+  if (!systemUpdate && schema.name === "users") {
+    for (const col of columns) {
+      if (!SYSTEM_MANAGED_COLUMNS.has(col.name)) continue;
+      const current = existing?.data[col.name];
+      if (SYSTEM_ASSIGNED_COLUMNS.has(col.name) && Object.hasOwn(data, col.name) && coerceValue(data[col.name], col.storage, col.interpretation) !== coerceValue(current, col.storage, col.interpretation)) {
+        return { success: false, error: systemManagedColumnError(col.name, isUpdate) };
+      }
+      if (current !== void 0) finalData[col.name] = current;
+      else delete finalData[col.name];
+    }
+  }
   const colValues = dataToColumnValues(finalData, columns);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const tbl = collectionTableName(collection);
@@ -3783,14 +3788,12 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
   return { success: true, data: { recordId, record } };
 }
 function deleteRecord(ctx, collection, recordId, userId, userRole, skipUserRbac = false) {
-  const isSystem = SYSTEM_COLLECTIONS.has(collection);
-  const schema = ctx.schemaRegistry.get(collection);
-  if (!schema && !isSystem) {
-    return { success: false, error: `Schema not registered for collection: ${collection}` };
-  }
+  const resolved = resolveCollection(ctx, collection);
+  if (!resolved.ok) return { success: false, error: resolved.error };
+  const schema = resolved.schema;
   const existing = getRecord(ctx.sql, collection, recordId, schema);
   if (!existing) {
-    return { success: false, error: "Record not found" };
+    return { success: false, error: RECORD_NOT_FOUND };
   }
   if (!skipUserRbac && schema && !canDelete(schema, userRole, { ...existing, recordId }, userId, ctx.getPermissionContext())) {
     return { success: false, error: `DELETE DENIED: role=${userRole}, collection=${collection}` };
@@ -3809,14 +3812,12 @@ function deleteRecord(ctx, collection, recordId, userId, userRole, skipUserRbac
   return { success: true, data: { deleted: true } };
 }
 function readRecord(ctx, collection, recordId, userId, userRole, skipUserRbac = false) {
-  const isSystem = SYSTEM_COLLECTIONS.has(collection);
-  const schema = ctx.schemaRegistry.get(collection);
-  if (!schema && !isSystem) {
-    return { success: false, error: `Schema not registered for collection: ${collection}` };
-  }
+  const resolved = resolveCollection(ctx, collection);
+  if (!resolved.ok) return { success: false, error: resolved.error };
+  const schema = resolved.schema;
   const existing = getRecord(ctx.sql, collection, recordId, schema);
   if (!existing) {
-    return { success: false, error: "Record not found" };
+    return { success: false, error: RECORD_NOT_FOUND };
   }
   if (!skipUserRbac && schema && !canRead(schema, userRole, { ...existing, recordId }, userId, ctx.getPermissionContext())) {
     return { success: false, error: `READ DENIED: role=${userRole}, collection=${collection}` };
@@ -3847,9 +3848,7 @@ function hasYjsSubscription(attachment, target) {
     (subscription) => subscription.collection === target.collection && subscription.recordId === target.recordId && subscription.fieldName === target.fieldName
   );
 }
-var SYSTEM_COLLECTIONS = /* @__PURE__ */ new Set([
-  "canvas-settings"
-]);
+var SYSTEM_COLLECTIONS = /* @__PURE__ */ new Set(["canvas-settings"]);
 var SYSTEM_COLLECTION_SCHEMAS = [
   {
     name: "canvas-settings",
@@ -3866,10 +3865,7 @@ function getOrCreateYjsDoc(ctx, docKey) {
   let doc = ctx.yjsDocs.get(docKey);
   if (doc) return doc;
   doc = new Y2.Doc();
-  const row = ctx.sql.exec(
-    `SELECT state FROM yjs_docs WHERE doc_key = ?`,
-    docKey
-  ).toArray()[0];
+  const row = ctx.sql.exec(`SELECT state FROM yjs_docs WHERE doc_key = ?`, docKey).toArray()[0];
   if (row?.state) {
     try {
       Y2.applyUpdate(doc, new Uint8Array(row.state));
@@ -3934,11 +3930,17 @@ function handleYjsJoin(ctx, ws, attachment, payload) {
     }
   } else {
     if (!schema) {
-      ctx.send(ws, { type: MSG.ERROR, payload: { error: `Schema not registered for collection: ${collection}` } });
+      const resolution = resolveCollection(ctx, collection);
+      ctx.send(ws, {
+        type: MSG.ERROR,
+        payload: {
+          error: resolution.ok ? `Schema not registered for collection: ${collection}` : resolution.error
+        }
+      });
       return;
     }
     if (!record) {
-      ctx.send(ws, { type: MSG.ERROR, payload: { error: "Record not found" } });
+      ctx.send(ws, { type: MSG.ERROR, payload: { error: RECORD_NOT_FOUND } });
       return;
     }
     const permCtx = ctx.getPermissionContext();
@@ -3971,7 +3973,10 @@ function handleYjsJoin(ctx, ws, attachment, payload) {
     writeVarUint8Array(encoder2, fullState);
     ctx.sendBinary(ws, toUint8Array(encoder2));
   }
-  ctx.send(ws, { type: MSG.YJS_JOIN, payload: { collection, recordId, fieldName, canWrite: hasWriteAccess } });
+  ctx.send(ws, {
+    type: MSG.YJS_JOIN,
+    payload: { collection, recordId, fieldName, canWrite: hasWriteAccess }
+  });
 }
 function handleYjsLeave(ctx, ws, attachment, payload) {
   const { collection, recordId, fieldName } = payload;
@@ -4040,7 +4045,14 @@ function handleYjsBinaryMessage(ctx, ws, attachment, data) {
         if (!syncSchema) return;
         const record = getRecord(ctx.sql, collection, recordId, syncSchema);
         if (!record) return;
-        if (!canUpdate(syncSchema, attachment.role, { ...record, recordId }, attachment.userId, ctx.getPermissionContext())) return;
+        if (!canUpdate(
+          syncSchema,
+          attachment.role,
+          { ...record, recordId },
+          attachment.userId,
+          ctx.getPermissionContext()
+        ))
+          return;
       }
       const update = readVarUint8Array(decoder);
       Y2.applyUpdate(doc, update, "client");
@@ -4114,6 +4126,19 @@ function handleYjsDisconnect(ctx, ws, attachment) {
 }
 
 // src/server/handlers/subscriptions.ts
+function resolveCollection(ctx, collection) {
+  const isSystem = SYSTEM_COLLECTIONS.has(collection);
+  const schema = ctx.schemaRegistry.get(collection);
+  if (!schema && !isSystem) {
+    const known = ctx.schemaRegistry.names().sort().join(", ") || "(none)";
+    const room = ctx.scopeId ? `Room '${ctx.scopeId}'` : "This room";
+    return {
+      ok: false,
+      error: `Schema not registered for collection: ${collection} \u2014 ${room} serves only: ${known}. Records are sharded by scope, so address the room that owns '${collection}', or add it to the schemas this room is constructed with.`
+    };
+  }
+  return { ok: true, schema, isSystem };
+}
 function handleSubscribe(ctx, ws, attachment, payload) {
   const { subscriptionId, query } = payload;
   const records = executeQuery(ctx, query, attachment.userId, attachment.role);
@@ -4122,15 +4147,20 @@ function handleSubscribe(ctx, ws, attachment, payload) {
 function handleUnsubscribe(_ctx, _ws, _attachment, _payload) {
 }
 function executeQuery(ctx, query, userId, userRole, skipUserRbac = false) {
-  const isSystem = SYSTEM_COLLECTIONS.has(query.collection);
-  const schema = ctx.schemaRegistry.get(query.collection);
-  if (!schema && !isSystem) {
-    return [];
-  }
-  if (!schema) {
+  const resolved = resolveCollection(ctx, query.collection);
+  if (!resolved.ok) return [];
+  if (!resolved.schema) {
     return executeSystemQuery(ctx, query);
   }
-  return executeTableQuery(ctx, query, schema, userId, userRole, isSystem, skipUserRbac);
+  return executeTableQuery(
+    ctx,
+    query,
+    resolved.schema,
+    userId,
+    userRole,
+    resolved.isSystem,
+    skipUserRbac
+  );
 }
 function executeSystemQuery(ctx, query) {
   const tbl = collectionTableName(query.collection);
@@ -4523,7 +4553,10 @@ async function handleToolsRequest(ctx, request, path) {
     const toolName = path.replace("tools/describe/", "");
     const tool2 = BUILT_IN_TOOLS.find((t) => t.name === toolName);
     if (!tool2) {
-      return Response.json({ error: `Tool not found: ${toolName}` }, { status: 404, headers: CORS_HEADERS3 });
+      return Response.json(
+        { error: `Tool not found: ${toolName}` },
+        { status: 404, headers: CORS_HEADERS3 }
+      );
     }
     return Response.json({ tool: tool2 }, { headers: CORS_HEADERS3 });
   }
@@ -4568,20 +4601,23 @@ async function handleToolExecute(ctx, request) {
   const recordCtx = {
     sql: ctx.sql,
     schemaRegistry: ctx.schemaRegistry,
+    scopeId: ctx.scopeId,
     state: ctx.state,
     getPermissionContext: ctx.getPermissionContext,
     send: ctx.send
   };
-  const result = await executeTool2(recordCtx, tool2, params, userId, userRole, isAppAction);
+  const result = await executeTool(recordCtx, tool2, params, userId, userRole, isAppAction);
   const status = result.success ? 200 : result.error?.includes("not found") ? 404 : 400;
   return Response.json(result, { status, headers: CORS_HEADERS3 });
 }
-async function executeTool2(ctx, toolName, params, userId, userRole, skipUserRbac) {
+async function executeTool(ctx, toolName, params, userId, userRole, skipUserRbac) {
   switch (toolName) {
     // ---- Records ----
     case "records.query": {
       const collection = params.collection;
       if (!collection) return { success: false, error: "Missing required param: collection" };
+      const resolved = resolveCollection(ctx, collection);
+      if (!resolved.ok) return { success: false, error: resolved.error };
       const query = {
         collection,
         where: params.where,
@@ -4691,10 +4727,13 @@ async function executeTool2(ctx, toolName, params, userId, userRole, skipUserRba
 }
 function checkYjsPermission(ctx, collection, recordId, userId, userRole, action) {
   if (SYSTEM_COLLECTIONS.has(collection)) return null;
-  const schema = ctx.schemaRegistry.get(collection);
-  if (!schema) return { success: false, error: `Schema not registered for collection: ${collection}` };
+  const resolution = resolveCollection(ctx, collection);
+  if (!resolution.ok) return { success: false, error: resolution.error };
+  const schema = resolution.schema;
+  if (!schema)
+    return { success: false, error: `Schema not registered for collection: ${collection}` };
   const record = getRecord(ctx.sql, collection, recordId, schema);
-  if (!record) return { success: false, error: `Record not found: ${collection}/${recordId}` };
+  if (!record) return { success: false, error: `${RECORD_NOT_FOUND}: ${collection}/${recordId}` };
   const recordWithId = { ...record, recordId };
   const permCtx = ctx.getPermissionContext();
   if (action === "read" && !canRead(schema, userRole, recordWithId, userId, permCtx)) {
@@ -4727,9 +4766,7 @@ function withYjsDoc(ctx, docKey, operation) {
 function executeYjsTool(ctx, toolName, params, userId, userRole) {
   switch (toolName) {
     case "yjs.list": {
-      const rows = ctx.sql.exec(
-        `SELECT doc_key, updated_at FROM yjs_docs ORDER BY updated_at DESC`
-      ).toArray();
+      const rows = ctx.sql.exec(`SELECT doc_key, updated_at FROM yjs_docs ORDER BY updated_at DESC`).toArray();
       const docs = rows.map((row) => {
         const firstColon = row.doc_key.indexOf(":");
         const lastColon = row.doc_key.lastIndexOf(":");
@@ -5352,6 +5389,10 @@ var RecordRoom = class extends BaseRoom {
       sql: this.sql,
       state: this.state,
       schemaRegistry: this.schemaRegistry,
+      // Every record room stub is addressed with `idFromName(scopeId)`, so the
+      // DO's own name is the scope. Handlers use it to name the room when a
+      // caller asks it for a collection that lives in a different scope.
+      scopeId: this.state.id.name,
       getPermissionContext: () => this.getPermissionContext(),
       send: (ws, msg) => this.send(ws, msg),
       sendBinary: (ws, data) => this.sendBinaryHelper(ws, data),
@@ -8601,7 +8642,9 @@ export {
   RefundError,
   RegistryClientError,
   STRICT_APP_ID_RE,
+  SYSTEM_ASSIGNED_COLUMNS,
   SYSTEM_COLLECTION_SCHEMAS,
+  SYSTEM_MAINTAINED_COLUMNS,
   SYSTEM_MANAGED_COLUMNS,
   SchemaRegistry,
   SubscriptionAuthError,