deepspace 0.22.1 → 0.23.1

package/dist/server.d.ts

@@ -143,6 +143,17 @@ type ToolResult = {
  * `actions.query`) stay unbounded.
  */
 declare const DEFAULT_QUERY_LIMIT = 50;
+/**
+ * Page size `records.deleteWhere` uses when the caller omits `limit`, and the
+ * ceiling it clamps any larger `limit` to.
+ *
+ * The tool exists so a cascade costs one subrequest per *page* instead of one
+ * per row (see `deleteChatCascade`); the ceiling keeps a single call's SQL and
+ * delete broadcasts bounded, and callers page by repeating the call until it
+ * reports fewer deletions than the page size.
+ */
+declare const DEFAULT_DELETE_WHERE_LIMIT = 100;
+declare const MAX_DELETE_WHERE_LIMIT = 500;
 /**
  * Fill in assistant-only parameter defaults for a built-in tool call.
  *
@@ -450,6 +461,16 @@ interface CollectionSchema {
     permissions: Record<string, RolePermissions>;
     /** Default role assigned on the `users` collection. */
     defaultRole?: string;
+    /**
+     * `users` collection only: what the `user.list` roster shows a non-admin
+     * whose `read` policy is row-scoped (`'own'`, `'team'`, …). Default
+     * `'public-identity'`: every registered user's id/name/imageUrl/role — the
+     * row policy keeps guarding full-row reads on the records/query path.
+     * `'read-policy'`: the roster contains only the rows the caller's read
+     * policy grants (still projected to public identity) — for apps that scope
+     * users to a tenant/team and must not show names across it.
+     */
+    roster?: 'public-identity' | 'read-policy';
 }
 interface Query {
     collection: string;
@@ -1231,16 +1252,27 @@ declare function makeDefaultSummarizer(env: DeepSpaceAIEnv, options?: {
 /**
  * Chat history helpers — wrap RecordRoom's tools API for ai-chats / ai-messages.
  *
- * Trust model: every helper sends `X-App-Action: 'true'`, which bypasses
- * RecordRoom's per-record RBAC. The worker is the trust boundary, not
- * RecordRoom. Callers MUST verify ownership before invoking write helpers
- * (`updateChat`, `appendMessage`, `deleteChatCascade`); the worker's
- * `/api/ai/chat`, `PATCH /api/ai/chats/:id`, and `DELETE /api/ai/chats/:id`
- * routes do this via a `getChat()` precheck that 404s when the row is
- * missing or owned by another user. Read helpers (`getChat`, `loadMessages`)
- * filter by `chatId` against userBound rows, so cross-user reads return
- * empty — but new consumers should still consider an explicit ownership
- * check before exposing data.
+ * Trust model: every helper here runs through `executeToolAsApp`, which sends
+ * `X-App-Action: 'true'` and therefore **bypasses RecordRoom's per-record
+ * RBAC entirely**. The `userId` argument these helpers take is the identity
+ * they act *as* — it is NOT an authorization boundary, and RecordRoom will
+ * not check it. The worker is the only trust boundary.
+ *
+ * `getChat` is that boundary for this module: it compares the stored
+ * `userId` against the caller and returns null on a mismatch, so the
+ * worker's `/api/ai/chat`, `PATCH /api/ai/chats/:id`, and
+ * `DELETE /api/ai/chats/:id` routes 404 when a row is missing *or* owned by
+ * someone else. Every write helper (`updateChat`, `appendMessage`,
+ * `deleteChatCascade`) is reachable only behind that precheck; a new caller
+ * that skips it is writing across users, so route new consumers through
+ * `getChat` first.
+ *
+ * `updateChat` and `appendMessage` re-run that precheck themselves and report
+ * `false` instead of writing when the chat is gone: `records.update` /
+ * `records.create` are upserts, so a write racing the user's delete would
+ * resurrect the chat as a ghost row or orphan messages under a chat that no
+ * longer exists. The guard lives in the helpers, not the routes, so every copy
+ * of the scaffolded chat routes gets it.
  *
  * The tools API returns records as `{ recordId, data, createdAt, updatedAt }`
  * envelopes; helpers below flatten them into ChatRow / ChatMessageRow.
@@ -1264,14 +1296,47 @@ type ChatMessageRow = {
     parts?: unknown[];
     createdAt: string;
 };
+/**
+ * Fetch a chat the caller owns, or null.
+ *
+ * This is the module's authorization boundary. `records.get` runs with
+ * `X-App-Action`, so RecordRoom applies no per-record RBAC and will happily
+ * return another user's row — the ownership comparison below is the only
+ * thing standing between a caller and someone else's chat. A miss and a
+ * cross-user hit deliberately look identical to the caller (both null, both
+ * 404 at the route) so chat ids stay unenumerable.
+ */
 declare function getChat(stub: DurableObjectStub, chatId: string, userId: string): Promise<ChatRow | null>;
 declare function createChat(stub: DurableObjectStub, userId: string, opts?: {
     title?: string;
     model?: string;
 }): Promise<ChatRow>;
-declare function updateChat(stub: DurableObjectStub, chatId: string, userId: string, patch: Partial<Pick<ChatRow, 'title' | 'model' | 'compactedSummary' | 'compactedThroughId'>>): Promise<void>;
+/**
+ * Patch a chat the caller owns. Returns true if the row was written, false if
+ * the chat no longer exists (or never belonged to the caller).
+ *
+ * The `getChat` precheck is not redundant with the route's own: `records.update`
+ * is an upsert on the DO — same code path as create — so an unguarded patch of
+ * a chat the user deleted mid-stream *recreates* it as a title-less ghost whose
+ * messages are already cascaded away. Writing only over a row that still exists
+ * is the one place that can be prevented for every caller, so the guard lives
+ * here rather than at each call site. A tiny TOCTOU window remains between the
+ * read and the write (closing it needs a compare-and-set on the DO); a delete
+ * landing inside that window is the same rare race as before, not the routine
+ * "user deleted the chat while the stream ran" case this closes.
+ */
+declare function updateChat(stub: DurableObjectStub, chatId: string, userId: string, patch: Partial<Pick<ChatRow, 'title' | 'model' | 'compactedSummary' | 'compactedThroughId'>>): Promise<boolean>;
 declare function deleteChatCascade(stub: DurableObjectStub, chatId: string, userId: string): Promise<void>;
 declare function loadMessages(stub: DurableObjectStub, chatId: string, userId: string): Promise<ChatMessageRow[]>;
+/**
+ * Append one message to a chat the caller owns. Returns true if the row was
+ * written, false if the chat is gone (or never belonged to the caller).
+ *
+ * Same write-after-delete guard as `updateChat`, for the same reason: a turn
+ * that finishes after the user deleted the chat would otherwise write messages
+ * whose parent row no longer exists — invisible in every listing and never
+ * cascaded again.
+ */
 declare function appendMessage(stub: DurableObjectStub, msg: {
     id: string;
     chatId: string;
@@ -1279,7 +1344,7 @@ declare function appendMessage(stub: DurableObjectStub, msg: {
     role: 'user' | 'assistant' | 'system';
     content: string;
     parts?: unknown[];
-}): Promise<void>;
+}): Promise<boolean>;
 
 /**
  * Per-binding usage metering — record Vectorize / Workers AI / etc. costs
@@ -1983,7 +2048,24 @@ declare function checkFieldPermissions(schema: CollectionSchema, role: string, n
  * covers both creation and updates while still allowing an owner to unclaim.
  */
 declare function checkUnclaimedOwnerTransition(schema: CollectionSchema, role: string, nextData: Record<string, unknown>, userId: string): string | null;
-/** Names of columns managed by the system (registerUser), not client mutations. */
+/**
+ * Columns the system *assigns* — from the identity provider at registration,
+ * or from an admin action. A caller who sends one of these has chosen a value
+ * and means it, so a record write that would change one is refused loudly
+ * rather than silently dropped.
+ */
+declare const SYSTEM_ASSIGNED_COLUMNS: Set<string>;
+/**
+ * Columns the system *maintains* on its own schedule, without telling anyone.
+ * `registerUser` bumps `lastSeenAt` on every WS connect and `handleUserUpdate`
+ * rewrites it on every 60s presence heartbeat; neither broadcasts, so every
+ * client's copy goes stale silently and there is no heal path short of a
+ * refetch. Read-modify-write echo (`put(id, { ...rec.data, field })`) is the
+ * SDK's own house style, so refusing these would refuse writes over a value the
+ * caller never chose and cannot keep current. They are preserved silently.
+ */
+declare const SYSTEM_MAINTAINED_COLUMNS: Set<string>;
+/** Every `users` column owned by the system rather than by record writes. */
 declare const SYSTEM_MANAGED_COLUMNS: Set<string>;
 /** Standard user columns. Apps spread these into their users schema. */
 declare const USERS_COLUMNS: ColumnDefinition[];
@@ -2002,6 +2084,17 @@ declare const BASE_USERS_SCHEMA: CollectionSchema;
  * Returns an array of warning messages. Empty = clean.
  */
 declare function lintSchema(schema: CollectionSchema): string[];
+/**
+ * Lint a whole schema set: every per-schema warning, plus the rules that
+ * need to see the set. The `'team'` permission level resolves membership from
+ * a `team_members` collection (`teamId`, `userId`, `status`); without one it
+ * denies everything, silently — a mistake that presents as a sync bug, not
+ * as a schema error, so name it here.
+ */
+declare function lintSchemas(schemas: CollectionSchema[]): string[];
+/** The rules that need to see the whole schema set (per-schema rules live in
+ *  `lintSchema`; `lintSchemas` composes both). */
+declare function lintSchemaSet(schemas: CollectionSchema[]): string[];
 declare class SchemaRegistry {
     private trusted;
     constructor(schemas?: CollectionSchema[]);
@@ -2985,6 +3078,14 @@ interface SubscriptionContext {
     sql: SqlStorage;
     schemaRegistry: SchemaRegistry;
     state: DurableObjectState;
+    /**
+     * The scope this room was addressed by — `app:{appId}`, `chat:{channelId}`,
+     * `conv:{convId}`, `workspace:default`, … Records are sharded across rooms
+     * by scope, so the scope is what names the room in an unknown-collection
+     * failure. Undefined only for rooms addressed by a unique id rather than a
+     * name (`idFromName` populates `DurableObjectId.name`).
+     */
+    scopeId?: string;
     getPermissionContext(): PermissionContext;
     /** Typed against `ServerMessage` so outbound broadcasts are
      *  compile-checked against the wire contract. */
@@ -3004,15 +3105,14 @@ declare function handleSubscribe(ctx: SubscriptionContext, ws: WebSocket, attach
  * The client handles unsubscription locally.
  */
 declare function handleUnsubscribe(_ctx: SubscriptionContext, _ws: WebSocket, _attachment: ConnectionAttachment, _payload: UnsubscribePayload): void;
-/**
- * Execute a query and return matching records.
- * All collections use table-mode (c_* tables).
- *
- * `skipUserRbac` lets a server-action caller (i.e. the app itself, via
- * `X-App-Action`) bypass the per-user read filter for parity with the other
- * `tools.*` operations (`get`, `create`, `update`, `remove`).
- */
-declare function executeQuery(ctx: SubscriptionContext, query: Query, userId: string, userRole: string, skipUserRbac?: boolean): RecordResult[];
+/** Out-param for {@link executeQuery}: `capped` is set when a limited,
+ *  row-filtered scan stopped on {@link MAX_FILTERED_SCAN_ROWS} rather than on
+ *  exhausting the rows — the one case a short result does NOT mean "no more
+ *  matches". */
+interface QueryScanState {
+    capped: boolean;
+}
+declare function executeQuery(ctx: SubscriptionContext, query: Query, userId: string, userRole: string, skipUserRbac?: boolean, scanState?: QueryScanState): RecordResult[];
 /**
  * Check if a record matches a subscription's query and permissions
  */
@@ -3124,12 +3224,21 @@ declare function getAllUsers(sql: SqlStorage, schemaRegistry?: SchemaRegistry):
 declare function registerUser(sql: SqlStorage, userId: string, name: string, email: string, imageUrl: string | undefined, isAdmin: boolean, defaultRole?: string, schemaRegistry?: SchemaRegistry): Promise<User>;
 /** Handle user list requests without bypassing the users collection's privacy boundary. */
 declare function handleUserList(ctx: UserContext, ws: WebSocket, attachment: ConnectionAttachment): void;
+/**
+ * Push the current roster to every connected socket (except `except`). The
+ * client asks for `user.list` once per connection and never again, so anything
+ * that changes what the roster shows — a user registering, a rename, a new
+ * avatar, a role change — must push, or every open tab keeps rendering the
+ * peer it has never seen as "Unknown" until it reconnects. The roster is read
+ * and projected once; each socket then gets its own view of it.
+ */
+declare function broadcastUserList(ctx: UserContext, except?: WebSocket | ReadonlySet<WebSocket>): void;
 /**
  * Handle user profile update.
  *
  * Called when the client's profile loads after the initial WS connection.
- * Updates the user's name/email/imageUrl in c_users and broadcasts the
- * updated user list to all connected clients so names refresh in real time.
+ * Updates the user's name/email/imageUrl in c_users and pushes the updated
+ * roster to every connected client so names refresh in real time.
  */
 interface UserUpdatePayload {
     name?: string;
@@ -4593,4 +4702,4 @@ declare class RefundError extends Error {
     constructor(message: string, status: number);
 }
 
-export { ACCOUNT_STORAGE_LIMIT_BYTES, AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_ID_RE, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, BaseRoom, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CONVERSATION_SCHEMAS, COST_RATES, CancelSubscriptionError, type CancelSubscriptionOpts, type CancelSubscriptionResult, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DebugApiContext, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, DeepSpaceAgentProfileError, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GetActionData, type GlobalDOType, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, MAX_APP_FILE_BYTES, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlanInfo, type PlatformWorkerEnv, type PrefixResult, type PresencePeer, PresenceRoom, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, REGISTRY_INSTANCE, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, RESOURCE_ID_RE, type RecordContext, RecordRoom, type RecordRoomConfig, RefundError, type RefundOpts, type RefundResult, RegistryClientError, type ResolvedColumn, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, STRICT_APP_ID_RE, SYSTEM_COLLECTION_SCHEMAS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type SharedConnection, type StorageAdmission, type StoredRecord, SubscriptionAuthError, type SubscriptionContext, type SubscriptionRead, SubscriptionRequiredError, type SubscriptionStatus, type Summarizer, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, type ToolsApiContext, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, type UserContext, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKSPACE_SCHEMAS, type YjsContext, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, broadcastChange, broadcastYjsUpdate, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, cancelSubscription, capToolResultSize, captureScreenshot, checkFieldPermissions, checkUnclaimedOwnerTransition, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDeepSpaceAI, createDeepSpaceAuth, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, deleteRecord, enqueueJob, executeQuery, formatBytes, getAllUsers, getChat, getGlobalDOSchemas, getGlobalDOType, getOrCreateYjsDoc, getRecord, getRolePermissions, getSubscription, getUser, getYjsDocKey, handleApiRequest, handleDelete, handlePut, handleSetRole, handleSubscribe, handleToolsRequest, handleUnsubscribe, handleUserList, handleUserUpdate, handleYjsBinaryMessage, handleYjsJoin, handleYjsLeave, isAutoProvision, isFilesVerbPath, isOwner, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, lintSchema, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, mintAppId, mintUlid, noopPermissionContext, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, putRecord, readRecord, recordMatchesSubscription, refundInvoice, registerUser, registryErrorJson, registryStub, requireSubscription, resolveAppName, resolveAppRole, resolveColumn, rowToData, runMigrations, saveYjsDoc, storageLimitForTier, storageQuotaMessage, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema };
+export { ACCOUNT_STORAGE_LIMIT_BYTES, AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_ID_RE, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, BaseRoom, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CONVERSATION_SCHEMAS, COST_RATES, CancelSubscriptionError, type CancelSubscriptionOpts, type CancelSubscriptionResult, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DELETE_WHERE_LIMIT, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DebugApiContext, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, DeepSpaceAgentProfileError, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GetActionData, type GlobalDOType, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, MAX_APP_FILE_BYTES, MAX_DELETE_WHERE_LIMIT, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlanInfo, type PlatformWorkerEnv, type PrefixResult, type PresencePeer, PresenceRoom, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, REGISTRY_INSTANCE, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, RESOURCE_ID_RE, type RecordContext, RecordRoom, type RecordRoomConfig, RefundError, type RefundOpts, type RefundResult, RegistryClientError, type ResolvedColumn, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, STRICT_APP_ID_RE, SYSTEM_ASSIGNED_COLUMNS, SYSTEM_COLLECTION_SCHEMAS, SYSTEM_MAINTAINED_COLUMNS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type SharedConnection, type StorageAdmission, type StoredRecord, SubscriptionAuthError, type SubscriptionContext, type SubscriptionRead, SubscriptionRequiredError, type SubscriptionStatus, type Summarizer, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, type ToolsApiContext, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, type UserContext, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKSPACE_SCHEMAS, type YjsContext, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, broadcastChange, broadcastUserList, broadcastYjsUpdate, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, cancelSubscription, capToolResultSize, captureScreenshot, checkFieldPermissions, checkUnclaimedOwnerTransition, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDeepSpaceAI, createDeepSpaceAuth, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, deleteRecord, enqueueJob, executeQuery, formatBytes, getAllUsers, getChat, getGlobalDOSchemas, getGlobalDOType, getOrCreateYjsDoc, getRecord, getRolePermissions, getSubscription, getUser, getYjsDocKey, handleApiRequest, handleDelete, handlePut, handleSetRole, handleSubscribe, handleToolsRequest, handleUnsubscribe, handleUserList, handleUserUpdate, handleYjsBinaryMessage, handleYjsJoin, handleYjsLeave, isAutoProvision, isFilesVerbPath, isOwner, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, lintSchema, lintSchemaSet, lintSchemas, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, mintAppId, mintUlid, noopPermissionContext, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, putRecord, readRecord, recordMatchesSubscription, refundInvoice, registerUser, registryErrorJson, registryStub, requireSubscription, resolveAppName, resolveAppRole, resolveColumn, rowToData, runMigrations, saveYjsDoc, storageLimitForTier, storageQuotaMessage, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema };