deepspace 0.23.0 → 0.23.1

package/dist/server.js

@@ -96,6 +96,8 @@ function registryErrorJson(c, err) {
 
 // src/server/utils/tools.ts
 var DEFAULT_QUERY_LIMIT = 50;
+var DEFAULT_DELETE_WHERE_LIMIT = 100;
+var MAX_DELETE_WHERE_LIMIT = 500;
 function applyAiToolDefaults(toolName, params) {
   if (toolName === "records.query" && params.limit === void 0) {
     return { ...params, limit: DEFAULT_QUERY_LIMIT };
@@ -149,6 +151,15 @@ var BUILT_IN_TOOLS = [
       recordId: { type: "string", description: "Record ID to delete", required: true }
     }
   },
+  {
+    name: "records.deleteWhere",
+    description: `Delete every record matching a filter, in one bounded batch. Deletes at most \`limit\` records (default ${DEFAULT_DELETE_WHERE_LIMIT}, max ${MAX_DELETE_WHERE_LIMIT}) and returns \`{ deleted }\`; repeat the same call until \`deleted\` is less than the limit to drain a larger set. A non-empty \`where\` whose every key names a real field (\`recordId\`, \`createdBy\`, or a schema column) is required \u2014 an unknown key is refused rather than ignored, so this tool never deletes a whole collection. Every matched record goes through the same delete permission check as \`records.delete\`; if any of them is denied, nothing in the batch is deleted.`,
+    params: {
+      collection: { type: "string", description: "Collection name (must have a schema)", required: true },
+      where: { type: "object", description: "Filter object with field=value equality conditions; every key must be recordId, createdBy, or a schema column", required: true },
+      limit: { type: "number", description: `Maximum number of records to delete in this call (default: ${DEFAULT_DELETE_WHERE_LIMIT}, max: ${MAX_DELETE_WHERE_LIMIT})`, required: false }
+    }
+  },
   // Schema tools
   {
     name: "schema.list",
@@ -2540,6 +2551,10 @@ var MSG = {
 var MSG_YJS_SYNC = 22;
 var MSG_YJS_AWARENESS = 23;
 var ROLE_ANONYMOUS = "viewer";
+var ANONYMOUS_USER_ID_PREFIX = "anon-";
+function isAnonymousUserId(userId) {
+  return userId.startsWith(ANONYMOUS_USER_ID_PREFIX);
+}
 var RECORD_NOT_FOUND = "Record not found";
 
 // src/server/utils/chat-history.ts
@@ -2607,43 +2622,35 @@ async function createChat(stub, userId, opts = {}) {
   return toChatRow(result.record);
 }
 async function updateChat(stub, chatId, userId, patch) {
+  if (!await getChat(stub, chatId, userId)) return false;
   await executeToolAsApp(stub, userId, "records.update", {
     collection: "ai-chats",
     recordId: chatId,
     data: patch
   });
+  return true;
 }
+var MESSAGE_DELETE_PAGE = 200;
 async function deleteChatCascade(stub, chatId, userId) {
-  const list = await executeToolAsApp(stub, userId, "records.query", {
-    collection: "ai-messages",
-    where: { chatId }
-  });
-  const errors = [];
-  for (const env of list.records) {
-    try {
-      await executeToolAsApp(stub, userId, "records.delete", {
+  let messagesError = null;
+  try {
+    let deleted = MESSAGE_DELETE_PAGE;
+    while (deleted === MESSAGE_DELETE_PAGE) {
+      const page = await executeToolAsApp(stub, userId, "records.deleteWhere", {
         collection: "ai-messages",
-        recordId: env.recordId
+        where: { chatId },
+        limit: MESSAGE_DELETE_PAGE
       });
-    } catch (err) {
-      errors.push(err);
+      deleted = page.deleted;
     }
-  }
-  try {
-    await executeToolAsApp(stub, userId, "records.delete", {
-      collection: "ai-chats",
-      recordId: chatId
-    });
   } catch (err) {
-    errors.push(err);
-  }
-  if (errors.length > 0) {
-    const first = errors[0];
-    throw new Error(
-      `deleteChatCascade: ${errors.length} delete(s) failed; first: ${first instanceof Error ? first.message : String(first)}`,
-      { cause: errors }
-    );
+    messagesError = err;
   }
+  await executeToolAsApp(stub, userId, "records.delete", {
+    collection: "ai-chats",
+    recordId: chatId
+  });
+  if (messagesError) throw messagesError;
 }
 async function loadMessages(stub, chatId, userId) {
   const result = await executeToolAsApp(stub, userId, "records.query", {
@@ -2655,6 +2662,7 @@ async function loadMessages(stub, chatId, userId) {
   return result.records.map(toMessageRow);
 }
 async function appendMessage(stub, msg) {
+  if (!await getChat(stub, msg.chatId, msg.userId)) return false;
   const data = {
     chatId: msg.chatId,
     userId: msg.userId,
@@ -2667,6 +2675,7 @@ async function appendMessage(stub, msg) {
     recordId: msg.id,
     data
   });
+  return true;
 }
 
 // src/server/utils/metering.ts
@@ -2789,7 +2798,7 @@ function decodeRoomIdentityHeader(value) {
 // src/server/rooms/base-room.ts
 function connectionAttachmentFromRequest(request) {
   return {
-    userId: decodeRoomIdentityHeader(request.headers.get("x-user-id")) || `anon-${crypto.randomUUID()}`,
+    userId: decodeRoomIdentityHeader(request.headers.get("x-user-id")) || `${ANONYMOUS_USER_ID_PREFIX}${crypto.randomUUID()}`,
     userName: decodeRoomIdentityHeader(request.headers.get("x-user-name")) || "Anonymous",
     userEmail: decodeRoomIdentityHeader(request.headers.get("x-user-email")) || "",
     userImageUrl: decodeRoomIdentityHeader(request.headers.get("x-user-image-url")),
@@ -3302,12 +3311,28 @@ function lintSchema(schema) {
   }
   return warnings;
 }
+function lintSchemas(schemas) {
+  return [...schemas.flatMap((schema) => lintSchema(schema)), ...lintSchemaSet(schemas)];
+}
+function lintSchemaSet(schemas) {
+  const warnings = [];
+  if (!schemas.some((schema) => schema.name === "team_members")) {
+    for (const schema of schemas) {
+      const teamRoles = Object.entries(schema.permissions).filter(([, p]) => [p.read, p.update, p.delete].includes("team")).map(([role]) => role);
+      if (teamRoles.length > 0) {
+        warnings.push(
+          `[${schema.name}] role(s) ${teamRoles.join(", ")} use the 'team' permission level, but no 'team_members' collection is registered. 'team' resolves membership from team_members (teamId, userId, status), so without it those roles are denied everything \u2014 silently. Register a team_members schema or use another level.`
+        );
+      }
+    }
+  }
+  return warnings;
+}
 var SchemaRegistry = class {
   trusted = /* @__PURE__ */ new Map();
   constructor(schemas = []) {
-    for (const schema of schemas) {
-      this.registerTrusted(schema);
-    }
+    for (const w of lintSchemaSet(schemas)) console.warn(`[schema-lint] ${w}`);
+    for (const schema of schemas) this.registerTrusted(schema);
   }
   registerTrusted(schema) {
     for (const w of lintSchema(schema)) {
@@ -3811,6 +3836,81 @@ function deleteRecord(ctx, collection, recordId, userId, userRole, skipUserRbac
   notifyTeamMembershipChange(ctx, collection, record);
   return { success: true, data: { deleted: true } };
 }
+function deleteWhere(ctx, collection, where, limit, userId, userRole, skipUserRbac = false) {
+  const resolved = resolveCollection(ctx, collection);
+  if (!resolved.ok) return { success: false, error: resolved.error };
+  const schema = resolved.schema;
+  if (!schema) {
+    return {
+      success: false,
+      error: `records.deleteWhere: collection "${collection}" has no schema, so it has no filterable fields \u2014 delete its rows by recordId with records.delete`
+    };
+  }
+  if (!where || typeof where !== "object" || Array.isArray(where) || Object.keys(where).length === 0) {
+    return { success: false, error: "Missing required param: where (must match at least one field)" };
+  }
+  const columns = (schema.columns ?? []).map(resolveColumn);
+  const filterable = ["recordId", "createdBy", ...columns.map((c) => c.name)];
+  const unknown = Object.keys(where).filter(
+    (key) => key !== "recordId" && key !== "createdBy" && !columns.some((c) => c.id === columnId(key) || c.name === key)
+  );
+  if (unknown.length > 0) {
+    return {
+      success: false,
+      error: `Unknown field(s) in where for "${collection}": ${unknown.join(", ")} \u2014 filterable fields: ${filterable.join(", ")}`
+    };
+  }
+  const nonPrimitive = Object.entries(where).filter(([, v]) => v !== null && typeof v === "object");
+  if (nonPrimitive.length > 0) {
+    return {
+      success: false,
+      error: `where values must be primitives (equality only): ${nonPrimitive.map(([k]) => k).join(", ")}`
+    };
+  }
+  if (limit !== void 0 && !(typeof limit === "number" && Number.isFinite(limit))) {
+    return { success: false, error: "limit must be a finite number" };
+  }
+  const page = Math.min(
+    Math.max(1, Math.floor(limit ?? DEFAULT_DELETE_WHERE_LIMIT)),
+    MAX_DELETE_WHERE_LIMIT
+  );
+  const scan = { capped: false };
+  const matched = executeQuery(
+    ctx,
+    { collection, where, limit: page },
+    userId,
+    userRole,
+    skipUserRbac,
+    scan
+  );
+  if (scan.capped && matched.length < page) {
+    return {
+      success: false,
+      error: `records.deleteWhere scanned ${MAX_FILTERED_SCAN_ROWS} rows without filling a page of readable matches in "${collection}" \u2014 narrow \`where\` (or delete by recordId) and retry`
+    };
+  }
+  if (!skipUserRbac && schema) {
+    const permCtx = ctx.getPermissionContext();
+    for (const record of matched) {
+      if (!canDelete(schema, userRole, record, userId, permCtx)) {
+        return { success: false, error: `DELETE DENIED: role=${userRole}, collection=${collection}` };
+      }
+    }
+  }
+  let deleted = 0;
+  for (const record of matched) {
+    if (deleteRecord(ctx, collection, record.recordId, userId, userRole, skipUserRbac).success) {
+      deleted++;
+    }
+  }
+  if (deleted < matched.length) {
+    return {
+      success: false,
+      error: `Deleted ${deleted} of ${matched.length} matched record(s) in "${collection}"; the rest failed \u2014 retry`
+    };
+  }
+  return { success: true, data: { deleted } };
+}
 function readRecord(ctx, collection, recordId, userId, userRole, skipUserRbac = false) {
   const resolved = resolveCollection(ctx, collection);
   if (!resolved.ok) return { success: false, error: resolved.error };
@@ -4146,7 +4246,8 @@ function handleSubscribe(ctx, ws, attachment, payload) {
 }
 function handleUnsubscribe(_ctx, _ws, _attachment, _payload) {
 }
-function executeQuery(ctx, query, userId, userRole, skipUserRbac = false) {
+var MAX_FILTERED_SCAN_ROWS = 5e3;
+function executeQuery(ctx, query, userId, userRole, skipUserRbac = false, scanState) {
   const resolved = resolveCollection(ctx, query.collection);
   if (!resolved.ok) return [];
   if (!resolved.schema) {
@@ -4159,7 +4260,8 @@ function executeQuery(ctx, query, userId, userRole, skipUserRbac = false) {
     userId,
     userRole,
     resolved.isSystem,
-    skipUserRbac
+    skipUserRbac,
+    scanState
   );
 }
 function executeSystemQuery(ctx, query) {
@@ -4196,7 +4298,7 @@ function preloadUserTeamIds(ctx, userId) {
   );
   return cursor.toArray().map((r) => r.col_teamid);
 }
-function executeTableQuery(ctx, query, schema, userId, userRole, isSystem, skipUserRbac = false) {
+function executeTableQuery(ctx, query, schema, userId, userRole, isSystem, skipUserRbac = false, scanState) {
   const columns = (schema.columns ?? []).map(resolveColumn);
   const perms = getRolePermissions(schema, userRole);
   let sql = buildTableSelect(query.collection, columns);
@@ -4204,16 +4306,27 @@ function executeTableQuery(ctx, query, schema, userId, userRole, isSystem, skipU
   const whereClauses = [];
   let skipPerRecordCheck = skipUserRbac;
   if (!skipUserRbac && schema.teamField && perms.read === "team") {
-    const filterCol = schema.teamField === "_rowId" ? "_row_id" : columns.find((c) => c.name === schema.teamField)?.id ?? columnId(schema.teamField);
-    const teamIds = preloadUserTeamIds(ctx, userId);
-    if (teamIds && teamIds.length > 0) {
-      const placeholders = teamIds.map(() => "?").join(", ");
-      whereClauses.push(`("${filterCol}" IN (${placeholders}) OR _created_by = ?)`);
-      params.push(...teamIds, userId);
-    } else {
-      whereClauses.push(`_created_by = ?`);
+    const filterCol = schema.teamField === "_rowId" ? "_row_id" : columns.find((c) => c.name === schema.teamField)?.id;
+    const teamIds = filterCol ? preloadUserTeamIds(ctx, userId) : null;
+    if (filterCol) {
+      if (teamIds && teamIds.length > 0) {
+        const placeholders = teamIds.map(() => "?").join(", ");
+        whereClauses.push(`("${filterCol}" IN (${placeholders}) OR _created_by = ?)`);
+        params.push(...teamIds, userId);
+      } else {
+        whereClauses.push(`_created_by = ?`);
+        params.push(userId);
+      }
+      skipPerRecordCheck = true;
+    }
+  } else if (!skipUserRbac && perms.read === "own") {
+    const ownerCol = schema.ownerField ? columns.find((c) => c.name === schema.ownerField)?.id : "_created_by";
+    if (ownerCol) {
+      whereClauses.push(`"${ownerCol}" = ?`);
       params.push(userId);
+      skipPerRecordCheck = true;
     }
+  } else if (!skipUserRbac && perms.read === true) {
     skipPerRecordCheck = true;
   }
   if (query.where) {
@@ -4251,27 +4364,44 @@ function executeTableQuery(ctx, query, schema, userId, userRole, isSystem, skipU
   } else {
     sql += ` ORDER BY _created_at DESC`;
   }
-  if (query.limit) {
-    sql += ` LIMIT ?`;
-    params.push(query.limit);
-  }
-  const cursor = ctx.sql.exec(sql, ...params);
+  const readPage = (limitClause, limitParams) => {
+    const cursor = ctx.sql.exec(sql + limitClause, ...params, ...limitParams);
+    const rows = cursor.toArray();
+    const records = [];
+    for (const row of rows) {
+      const r = row;
+      const record = {
+        recordId: r._row_id,
+        data: rowToData(r, columns),
+        createdBy: r._created_by,
+        createdAt: r._created_at,
+        updatedAt: r._updated_at
+      };
+      if (isSystem || skipPerRecordCheck || canRead(schema, userRole, { data: record.data, createdBy: record.createdBy, recordId: record.recordId }, userId, ctx.getPermissionContext())) {
+        records.push(record);
+      }
+    }
+    return { records, scanned: rows.length };
+  };
+  if (!query.limit) return readPage("", []).records;
+  const rowFiltered = !isSystem && !skipPerRecordCheck;
+  if (!rowFiltered) return readPage(" LIMIT ?", [query.limit]).records;
   const results = [];
-  for (const row of cursor.toArray()) {
-    const r = row;
-    const data = rowToData(r, columns);
-    const record = {
-      recordId: r._row_id,
-      data,
-      createdBy: r._created_by,
-      createdAt: r._created_at,
-      updatedAt: r._updated_at
-    };
-    if (isSystem || skipPerRecordCheck || canRead(schema, userRole, { data: record.data, createdBy: record.createdBy, recordId: record.recordId }, userId, ctx.getPermissionContext())) {
+  const batch = Math.max(query.limit, 200);
+  for (let offset = 0; ; offset += batch) {
+    const { records, scanned } = readPage(" LIMIT ? OFFSET ?", [batch, offset]);
+    for (const record of records) {
       results.push(record);
+      if (results.length >= query.limit) return results;
+    }
+    if (scanned < batch) return results;
+    if (offset + batch >= MAX_FILTERED_SCAN_ROWS) {
+      if (scanState && readPage(" LIMIT ? OFFSET ?", [1, offset + batch]).scanned > 0) {
+        scanState.capped = true;
+      }
+      return results;
     }
   }
-  return results;
 }
 function recordMatchesSubscription(record, collection, query, userId, userRole, schema, ctx) {
   if (query.collection !== collection) return false;
@@ -4468,30 +4598,56 @@ async function registerUser(sql, userId, name, email, imageUrl, isAdmin, default
   );
   return { id: userId, email, name, imageUrl, role, createdAt: now, lastSeenAt: now };
 }
+function rosterFor(ctx, schema, records, publicRoster, attachment) {
+  if (isAnonymousUserId(attachment.userId)) return [];
+  if (attachment.role === "admin") {
+    const permissionContext = ctx.getPermissionContext();
+    return records.filter((record) => canRead(schema, "admin", record, attachment.userId, permissionContext)).map((record) => ({ id: record.recordId, ...record.data }));
+  }
+  if (!getRolePermissions(schema, attachment.role).read) return [];
+  if (schema.roster === "read-policy") {
+    const permissionContext = ctx.getPermissionContext();
+    const readable = new Set(
+      records.filter((record) => canRead(schema, attachment.role, record, attachment.userId, permissionContext)).map((record) => record.recordId)
+    );
+    return publicRoster.filter((user) => readable.has(user.id));
+  }
+  return publicRoster;
+}
+function publicIdentities(records) {
+  return records.map(({ recordId, data }) => ({
+    id: recordId,
+    name: data.name,
+    ...data.imageUrl ? { imageUrl: data.imageUrl } : {},
+    role: data.role
+  }));
+}
 function handleUserList(ctx, ws, attachment) {
   const schema = ctx.schemaRegistry.get("users");
-  const permissionContext = ctx.getPermissionContext();
-  const visibleRecords = attachment.userId.startsWith("anon-") || !schema ? [] : getAllUserRecords(ctx.sql, ctx.schemaRegistry).filter(
-    (record) => canRead(
-      schema,
-      attachment.role,
-      record,
-      attachment.userId,
-      permissionContext
-    )
-  );
-  const users = visibleRecords.map((record) => {
-    if (attachment.role === "admin") return { id: record.recordId, ...record.data };
-    const { name, imageUrl, role } = record.data;
-    return {
-      id: record.recordId,
-      name,
-      ...imageUrl ? { imageUrl } : {},
-      role
-    };
-  });
+  if (!schema) {
+    ctx.send(ws, { type: MSG.USER_LIST, payload: { users: [] } });
+    return;
+  }
+  const records = getAllUserRecords(ctx.sql, ctx.schemaRegistry);
+  const users = rosterFor(ctx, schema, records, publicIdentities(records), attachment);
   ctx.send(ws, { type: MSG.USER_LIST, payload: { users } });
 }
+function broadcastUserList(ctx, except) {
+  const schema = ctx.schemaRegistry.get("users");
+  if (!schema) return;
+  const skip = except instanceof Set ? except : new Set(except ? [except] : []);
+  const records = getAllUserRecords(ctx.sql, ctx.schemaRegistry);
+  const publicRoster = publicIdentities(records);
+  for (const other of ctx.state.getWebSockets()) {
+    if (skip.has(other)) continue;
+    const attachment = other.deserializeAttachment();
+    if (!attachment) continue;
+    ctx.send(other, {
+      type: MSG.USER_LIST,
+      payload: { users: rosterFor(ctx, schema, records, publicRoster, attachment) }
+    });
+  }
+}
 function handleUserUpdate(ctx, _ws, attachment, payload) {
   const existing = getUserRecord(ctx.sql, attachment.userId, ctx.schemaRegistry);
   if (!existing) return;
@@ -4500,6 +4656,8 @@ function handleUserUpdate(ctx, _ws, attachment, payload) {
   if (payload.email) data.email = payload.email;
   if (payload.imageUrl !== void 0) data.imageUrl = payload.imageUrl || void 0;
   putRecord(ctx, "users", attachment.userId, data, attachment.userId, "admin", true, true);
+  const rosterChanged = data.name !== void 0 && data.name !== existing.data.name || data.imageUrl !== void 0 && data.imageUrl !== existing.data.imageUrl;
+  if (rosterChanged) broadcastUserList(ctx);
 }
 async function handleSetRole(ctx, ws, attachment, payload) {
   if (attachment.role !== "admin") {
@@ -4518,20 +4676,17 @@ async function handleSetRole(ctx, ws, attachment, payload) {
     now,
     payload.userId
   );
+  const closing = /* @__PURE__ */ new Set();
   for (const otherWs of ctx.state.getWebSockets()) {
     const otherAttachment = otherWs.deserializeAttachment();
-    if (!otherAttachment) continue;
-    if (otherAttachment.userId === payload.userId) {
-      try {
-        otherWs.close(1008, "role-changed");
-      } catch {
-      }
-      continue;
-    }
-    if (otherAttachment.role === "admin") {
-      handleUserList(ctx, otherWs, otherAttachment);
+    if (otherAttachment?.userId !== payload.userId) continue;
+    closing.add(otherWs);
+    try {
+      otherWs.close(1008, "role-changed");
+    } catch {
     }
   }
+  broadcastUserList(ctx, closing);
 }
 
 // src/server/handlers/tools-api.ts
@@ -4659,6 +4814,15 @@ async function executeTool(ctx, toolName, params, userId, userRole, skipUserRbac
       if (!recordId) return { success: false, error: "Missing required param: recordId" };
       return deleteRecord(ctx, collection, recordId, userId, userRole, skipUserRbac);
     }
+    // Bounded batch delete — one subrequest per page instead of one per row.
+    // Same authorization posture as `records.delete`; `deleteWhere` itself
+    // validates `where` (every key must name a real field) and `limit`, so no
+    // dispatch path can reach a collection-wide truncation.
+    case "records.deleteWhere": {
+      const collection = params.collection;
+      if (!collection) return { success: false, error: "Missing required param: collection" };
+      return deleteWhere(ctx, collection, params.where, params.limit, userId, userRole, skipUserRbac);
+    }
     // ---- Users ----
     // Bootstrap or refresh the `users` row for a given userId. Same path
     // the SDK uses on WS connect via registerUser, exposed for server
@@ -5206,12 +5370,13 @@ var RecordRoom = class extends BaseRoom {
     const userName = user.userName;
     const userEmail = user.userEmail;
     const userImageUrl = user.userImageUrl;
-    const isAuthenticated = !userId.startsWith("anon-");
+    const isAuthenticated = !isAnonymousUserId(userId);
     let attachment;
     if (isAuthenticated) {
       const isOwner2 = this.ownerUserId != null && userId === this.ownerUserId;
       const regStart = Date.now();
       const defaultRole = this.schemaRegistry.get("users")?.defaultRole ?? "member";
+      const before = getUser(this.sql, userId, this.schemaRegistry);
       const registeredUser = await registerUser(
         this.sql,
         userId,
@@ -5223,6 +5388,9 @@ var RecordRoom = class extends BaseRoom {
         this.schemaRegistry
       );
       const regMs = Date.now() - regStart;
+      if (!before || before.name !== registeredUser.name || before.imageUrl !== registeredUser.imageUrl || before.role !== registeredUser.role) {
+        broadcastUserList(this.createUserContext(), ws);
+      }
       attachment = {
         userId: registeredUser.id,
         userName,
@@ -8617,6 +8785,7 @@ export {
   CanvasRoom,
   CronRoom,
   DEFAULT_CONTEXT_CONFIG,
+  DEFAULT_DELETE_WHERE_LIMIT,
   DEFAULT_DO_MANIFEST,
   DEFAULT_QUERY_LIMIT,
   DEPLOYED_APPS_DEFAULTS,
@@ -8627,6 +8796,7 @@ export {
   GLOBAL_DO_TYPE_NAMES,
   JobRoom,
   MAX_APP_FILE_BYTES,
+  MAX_DELETE_WHERE_LIMIT,
   MAX_DEPLOY_ASSET_FILE_BYTES,
   MAX_UPLOAD_PARTS,
   MAX_UPLOAD_REQUEST_BYTES,
@@ -8663,6 +8833,7 @@ export {
   authWorkerFetch,
   bindingManifestFromOutputConfig,
   broadcastChange,
+  broadcastUserList,
   broadcastYjsUpdate,
   buildCronContext,
   buildTableSelect,
@@ -8724,6 +8895,8 @@ export {
   isTestAccountEmail,
   isTestAccountTier,
   lintSchema,
+  lintSchemaSet,
+  lintSchemas,
   loadMessages,
   makeDefaultSummarizer,
   matchOrigin,