deepspace 0.23.1 → 0.23.2

package/dist/server.js

@@ -111,7 +111,7 @@ var BUILT_IN_TOOLS = [
     description: `Query records from a collection with optional filtering, ordering, and pagination. Returns at most \`limit\` records (default ${DEFAULT_QUERY_LIMIT}). Large result sets are capped at ~30KB: an oversized page is truncated to the leading records that fit and flagged with \`{ truncated, returned, total }\`, so narrow with a \`where\` filter (or page via \`orderBy\` + \`limit\`) to see the rest.`,
     params: {
       collection: { type: "string", description: "Collection name to query", required: true },
-      where: { type: "object", description: "Filter object with field=value equality conditions", required: false },
+      where: { type: "object", description: "Filter object with field=value equality conditions; every key must be recordId, createdBy, or a schema column (an unknown key is refused, not ignored)", required: false },
       orderBy: { type: "string", description: 'Field to order by (or "createdAt"/"updatedAt")', required: false },
       orderDir: { type: "string", description: 'Order direction: "asc" or "desc" (default: "desc")', required: false },
       limit: { type: "number", description: `Maximum number of records to return (default: ${DEFAULT_QUERY_LIMIT}). Oversized pages are still capped at ~30KB and truncated with returned/total flags.`, required: false }
@@ -3836,19 +3836,7 @@ function deleteRecord(ctx, collection, recordId, userId, userRole, skipUserRbac
   notifyTeamMembershipChange(ctx, collection, record);
   return { success: true, data: { deleted: true } };
 }
-function deleteWhere(ctx, collection, where, limit, userId, userRole, skipUserRbac = false) {
-  const resolved = resolveCollection(ctx, collection);
-  if (!resolved.ok) return { success: false, error: resolved.error };
-  const schema = resolved.schema;
-  if (!schema) {
-    return {
-      success: false,
-      error: `records.deleteWhere: collection "${collection}" has no schema, so it has no filterable fields \u2014 delete its rows by recordId with records.delete`
-    };
-  }
-  if (!where || typeof where !== "object" || Array.isArray(where) || Object.keys(where).length === 0) {
-    return { success: false, error: "Missing required param: where (must match at least one field)" };
-  }
+function refuseUnknownWhere(collection, schema, where) {
   const columns = (schema.columns ?? []).map(resolveColumn);
   const filterable = ["recordId", "createdBy", ...columns.map((c) => c.name)];
   const unknown = Object.keys(where).filter(
@@ -3867,6 +3855,23 @@ function deleteWhere(ctx, collection, where, limit, userId, userRole, skipUserRb
       error: `where values must be primitives (equality only): ${nonPrimitive.map(([k]) => k).join(", ")}`
     };
   }
+  return null;
+}
+function deleteWhere(ctx, collection, where, limit, userId, userRole, skipUserRbac = false) {
+  const resolved = resolveCollection(ctx, collection);
+  if (!resolved.ok) return { success: false, error: resolved.error };
+  const schema = resolved.schema;
+  if (!schema) {
+    return {
+      success: false,
+      error: `records.deleteWhere: collection "${collection}" has no schema, so it has no filterable fields \u2014 delete its rows by recordId with records.delete`
+    };
+  }
+  if (!where || typeof where !== "object" || Array.isArray(where) || Object.keys(where).length === 0) {
+    return { success: false, error: "Missing required param: where (must match at least one field)" };
+  }
+  const whereRefusal = refuseUnknownWhere(collection, schema, where);
+  if (whereRefusal) return whereRefusal;
   if (limit !== void 0 && !(typeof limit === "number" && Number.isFinite(limit))) {
     return { success: false, error: "limit must be a finite number" };
   }
@@ -4773,9 +4778,20 @@ async function executeTool(ctx, toolName, params, userId, userRole, skipUserRbac
       if (!collection) return { success: false, error: "Missing required param: collection" };
       const resolved = resolveCollection(ctx, collection);
       if (!resolved.ok) return { success: false, error: resolved.error };
+      const where = params.where;
+      if (where && typeof where === "object" && Object.keys(where).length > 0) {
+        if (!resolved.schema) {
+          return {
+            success: false,
+            error: `records.query: collection "${collection}" has no schema, so it has no filterable fields \u2014 query it without \`where\``
+          };
+        }
+        const refusal = refuseUnknownWhere(collection, resolved.schema, where);
+        if (refusal) return refusal;
+      }
       const query = {
         collection,
-        where: params.where,
+        where,
         orderBy: params.orderBy,
         orderDir: params.orderDir,
         limit: params.limit