deepspace 0.27.0 → 0.27.1

package/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/schemas/registry.ts","../src/server/schemas/ai-chat.ts","../src/server/schemas/messaging.ts"],"sourcesContent":["/**\n * Collection Schema Definitions & Validation\n *\n * All collections use typed SQL columns. No document-mode / fields-based storage.\n */\n\nimport type {\n  CollectionSchema,\n  ColumnDefinition,\n  ColumnInterpretation,\n  PermissionLevel,\n  RolePermissions,\n} from '../../shared/types'\n\nexport type {\n  CollectionSchema,\n  ColumnDefinition,\n  ColumnInterpretation,\n  PermissionLevel,\n  RolePermissions,\n} from '../../shared/types'\n\n// ============================================================================\n// Column Definitions\n// ============================================================================\n\nexport interface ResolvedColumn {\n  id: string\n  name: string\n  storage: 'number' | 'text'\n  interpretation: ColumnInterpretation\n  expression?: string\n  readonly: boolean\n  userBound?: boolean\n  immutable?: boolean\n  required?: boolean\n  default?: unknown\n  timestampTrigger?: { field: string; value?: unknown }\n}\n\n// ============================================================================\n// Column Helpers\n// ============================================================================\n\nexport function collectionTableName(name: string): string {\n  return `c_${name.replace(/[^a-zA-Z0-9_]/g, '_')}`\n}\n\nexport function columnId(name: string): string {\n  return `col_${name.toLowerCase().replace(/[^a-z0-9]/g, '_')}`\n}\n\nexport function resolveColumn(col: ColumnDefinition): ResolvedColumn {\n  const interp: ColumnInterpretation =\n    typeof col.interpretation === 'string'\n      ? ({ kind: col.interpretation } as ColumnInterpretation)\n      : col.interpretation\n  return {\n    id: col.id ?? columnId(col.name),\n    name: col.name,\n    storage: col.storage,\n    interpretation: interp,\n    expression: col.expression,\n    readonly: !!col.expression,\n    userBound: col.userBound,\n    immutable: col.immutable,\n    required: col.required,\n    default: col.default,\n    timestampTrigger: col.timestampTrigger,\n  }\n}\n\nexport function rowToData(\n  row: Record<string, unknown>,\n  columns: ResolvedColumn[],\n): Record<string, unknown> {\n  const data: Record<string, unknown> = {}\n  for (const col of columns) {\n    if (row[col.id] !== undefined && row[col.id] !== null) {\n      let val = row[col.id]\n      if (col.interpretation.kind === 'json' && typeof val === 'string') {\n        try {\n          val = JSON.parse(val as string)\n        } catch {\n          /* keep as string */\n        }\n      }\n      data[col.name] = val\n    }\n  }\n  return data\n}\n\nexport function dataToColumnValues(\n  data: Record<string, unknown>,\n  columns: ResolvedColumn[],\n): Record<string, unknown> {\n  const values: Record<string, unknown> = {}\n  for (const col of columns) {\n    if (col.expression || col.readonly) continue\n    // Record mutations use public schema names only. Accepting physical column\n    // ids here lets a second key bypass name-based RBAC/userBound checks.\n    const val = data[col.name]\n    if (val !== undefined) {\n      values[col.id] = coerceValue(val, col.storage, col.interpretation)\n    }\n  }\n  return values\n}\n\nexport function coerceValue(\n  value: unknown,\n  storage: 'number' | 'text',\n  interpretation: ColumnInterpretation,\n): unknown {\n  if (value === null || value === undefined) return null\n  // An empty string is a value on a text column, not an absence. Folding it\n  // into NULL destroyed it on the way in — `rowToData` then dropped the key on\n  // the way out — so a field written as `''` read back `undefined` and a\n  // `column.default = ''` never materialized at all (it is applied at create\n  // and was coerced away one line later). A `number` column has nothing to\n  // store for `''`, so there it stays NULL.\n  if (value === '') return storage === 'text' ? '' : null\n\n  if (storage === 'text') {\n    if (interpretation.kind === 'json') {\n      if (typeof value === 'string') return value\n      try {\n        return JSON.stringify(value)\n      } catch {\n        return null\n      }\n    }\n    return typeof value === 'string' ? value : String(value)\n  }\n\n  if (typeof value === 'number') return isFinite(value) ? value : null\n  if (typeof value === 'boolean') return value ? 1 : 0\n  if (typeof value !== 'string') return String(value)\n\n  const s = value.trim()\n\n  if (interpretation.kind === 'boolean') {\n    const lower = s.toLowerCase()\n    if (lower === 'true' || lower === '1' || lower === 'yes') return 1\n    if (lower === 'false' || lower === '0' || lower === 'no') return 0\n    return s\n  }\n\n  if (interpretation.kind === 'percent') {\n    const m = s.match(/^(-?\\d+(?:\\.\\d+)?)\\s*%$/)\n    if (m) return parseFloat(m[1]) / 100\n  }\n\n  if (interpretation.kind === 'currency') {\n    const cleaned = s.replace(/[^0-9.-]/g, '')\n    const n = parseFloat(cleaned)\n    if (!isNaN(n)) return n\n    return s\n  }\n\n  if (interpretation.kind === 'date' || interpretation.kind === 'datetime') {\n    const d = new Date(s)\n    if (!isNaN(d.getTime())) return epochSeconds(d)\n    return s\n  }\n\n  const cleaned = s.replace(/[$€£¥,\\s]/g, '')\n  const n = parseFloat(cleaned)\n  if (!isNaN(n) && isFinite(n)) return n\n\n  return s\n}\n\n/** Canonical numeric representation for date/datetime storage and triggers. */\nexport function epochSeconds(date: Date = new Date()): number {\n  return Math.floor(date.getTime() / 1000)\n}\n\nexport function buildTableSelect(collectionName: string, columns: ResolvedColumn[]): string {\n  const tbl = collectionTableName(collectionName)\n  const parts: string[] = ['_row_id', '_created_by', '_created_at', '_updated_at']\n  for (const col of columns) {\n    if (col.expression) {\n      parts.push(`(${col.expression}) AS \"${col.id}\"`)\n    } else {\n      parts.push(`\"${col.id}\"`)\n    }\n  }\n  return `SELECT ${parts.join(', ')} FROM \"${tbl}\"`\n}\n\nexport interface User {\n  id: string\n  email: string\n  name: string\n  imageUrl?: string\n  role: string\n  createdAt: string\n  lastSeenAt: string\n}\n\nexport interface StoredRecord {\n  collection: string\n  recordId: string\n  data: Record<string, unknown>\n  createdBy: string\n  createdAt: string\n  updatedAt: string\n}\n\n// ============================================================================\n// Permission Checking\n// ============================================================================\n\nexport interface PermissionContext {\n  isTeamMember: (teamId: string, userId: string) => boolean\n}\n\nexport const noopPermissionContext: PermissionContext = {\n  isTeamMember: () => false,\n}\n\nexport function getRolePermissions(schema: CollectionSchema, role: string): RolePermissions {\n  if (schema.permissions[role]) return schema.permissions[role]\n  if (schema.permissions['*']) return schema.permissions['*']\n  return { read: false, create: false, update: false, delete: false }\n}\n\nexport function isOwner(\n  schema: CollectionSchema,\n  record: { data: Record<string, unknown>; createdBy: string },\n  userId: string,\n): boolean {\n  if (schema.ownerField) return record.data[schema.ownerField] === userId\n  return record.createdBy === userId\n}\n\nfunction isCollaborator(\n  schema: CollectionSchema,\n  record: { data: Record<string, unknown> },\n  userId: string,\n): boolean {\n  if (!schema.collaboratorsField) return false\n  const collab = record.data[schema.collaboratorsField]\n  if (typeof collab === 'string') {\n    try {\n      return (JSON.parse(collab) as string[]).includes(userId)\n    } catch {\n      return false\n    }\n  }\n  if (Array.isArray(collab)) return collab.includes(userId)\n  return false\n}\n\nfunction passesVisibilityCheck(\n  schema: CollectionSchema,\n  record: { data: Record<string, unknown> },\n): boolean {\n  if (!schema.visibilityField) return false\n  if (typeof schema.visibilityField === 'string') {\n    return record.data[schema.visibilityField] === 'public'\n  }\n  return record.data[schema.visibilityField.field] === schema.visibilityField.value\n}\n\nfunction checkPermissionLevel(\n  level: PermissionLevel,\n  schema: CollectionSchema,\n  record: { data: Record<string, unknown>; createdBy: string; recordId?: string },\n  userId: string,\n  ctx: PermissionContext = noopPermissionContext,\n): boolean {\n  if (level === true) return true\n  if (level === false) return false\n  if (level === 'own') return isOwner(schema, record, userId)\n  if (level === 'unclaimed-or-own') {\n    if (schema.ownerField) {\n      const ownerVal = record.data[schema.ownerField]\n      if (!ownerVal || ownerVal === '') return true\n    }\n    return isOwner(schema, record, userId)\n  }\n  if (level === 'collaborator') {\n    return isOwner(schema, record, userId) || isCollaborator(schema, record, userId)\n  }\n  if (level === 'team' || level === 'access') {\n    if (isOwner(schema, record, userId)) return true\n    if (isCollaborator(schema, record, userId)) return true\n    if (schema.teamField) {\n      const teamId = record.data[schema.teamField]\n      if (typeof teamId === 'string' && ctx.isTeamMember(teamId, userId)) return true\n    }\n    return false\n  }\n  if (level === 'published') {\n    return isOwner(schema, record, userId) || passesVisibilityCheck(schema, record)\n  }\n  if (level === 'shared') {\n    return (\n      isOwner(schema, record, userId) ||\n      isCollaborator(schema, record, userId) ||\n      passesVisibilityCheck(schema, record)\n    )\n  }\n  return false\n}\n\nexport function canRead(\n  schema: CollectionSchema,\n  role: string,\n  record: { data: Record<string, unknown>; createdBy: string; recordId?: string },\n  userId: string,\n  ctx: PermissionContext = noopPermissionContext,\n): boolean {\n  return checkPermissionLevel(getRolePermissions(schema, role).read, schema, record, userId, ctx)\n}\n\nexport function canCreate(schema: CollectionSchema, role: string): boolean {\n  return getRolePermissions(schema, role).create === true\n}\n\nexport function canUpdate(\n  schema: CollectionSchema,\n  role: string,\n  record: { data: Record<string, unknown>; createdBy: string; recordId?: string },\n  userId: string,\n  ctx: PermissionContext = noopPermissionContext,\n): boolean {\n  return checkPermissionLevel(getRolePermissions(schema, role).update, schema, record, userId, ctx)\n}\n\nexport function canDelete(\n  schema: CollectionSchema,\n  role: string,\n  record: { data: Record<string, unknown>; createdBy: string; recordId?: string },\n  userId: string,\n  ctx: PermissionContext = noopPermissionContext,\n): boolean {\n  return checkPermissionLevel(getRolePermissions(schema, role).delete, schema, record, userId, ctx)\n}\n\n/** Check if a caller-supplied field write violates writableFields restrictions. */\nexport function checkFieldPermissions(\n  schema: CollectionSchema,\n  role: string,\n  newData: Record<string, unknown>,\n  existingData?: Record<string, unknown>,\n): string | null {\n  const perms = getRolePermissions(schema, role)\n  if (!perms.writableFields) return null // no restrictions\n\n  const allowedFields = new Set(perms.writableFields)\n  for (const key of Object.keys(newData)) {\n    if (existingData && newData[key] === existingData[key]) continue\n    if (!allowedFields.has(key)) {\n      return `Role '${role}' cannot modify field '${key}'`\n    }\n  }\n  return null\n}\n\n/**\n * `unclaimed-or-own` lets a client claim an empty owner field, but never lets\n * them choose another user's id. Check the post-write record so the invariant\n * covers both creation and updates while still allowing an owner to unclaim.\n */\nexport function checkUnclaimedOwnerTransition(\n  schema: CollectionSchema,\n  role: string,\n  nextData: Record<string, unknown>,\n  userId: string,\n): string | null {\n  const permissions = getRolePermissions(schema, role)\n  if (permissions.update !== 'unclaimed-or-own' || !schema.ownerField) return null\n\n  const nextOwner = nextData[schema.ownerField]\n  if (nextOwner === undefined || nextOwner === null || nextOwner === '' || nextOwner === userId) {\n    return null\n  }\n\n  return `Role '${role}' can set '${schema.ownerField}' only to their own user id or leave it unclaimed`\n}\n\n// ============================================================================\n// System-Managed Columns (users collection)\n// ============================================================================\n\n/**\n * Columns the system *assigns* — from the identity provider at registration,\n * or from an admin action. A caller who sends one of these has chosen a value\n * and means it, so a record write that would change one is refused loudly\n * rather than silently dropped.\n */\nexport const SYSTEM_ASSIGNED_COLUMNS = new Set(['email', 'name', 'imageUrl', 'role'])\n\n/**\n * Columns the system *maintains* on its own schedule, without telling anyone.\n * `registerUser` bumps `lastSeenAt` on every WS connect and `handleUserUpdate`\n * rewrites it on every 60s presence heartbeat; neither broadcasts, so every\n * client's copy goes stale silently and there is no heal path short of a\n * refetch. Read-modify-write echo (`put(id, { ...rec.data, field })`) is the\n * SDK's own house style, so refusing these would refuse writes over a value the\n * caller never chose and cannot keep current. They are preserved silently.\n */\nexport const SYSTEM_MAINTAINED_COLUMNS = new Set(['createdAt', 'lastSeenAt'])\n\n/** Every `users` column owned by the system rather than by record writes. */\nexport const SYSTEM_MANAGED_COLUMNS = new Set([\n  ...SYSTEM_ASSIGNED_COLUMNS,\n  ...SYSTEM_MAINTAINED_COLUMNS,\n])\n\n/** Standard user columns. Apps spread these into their users schema. */\nexport const USERS_COLUMNS: ColumnDefinition[] = [\n  { name: 'email', storage: 'text', interpretation: 'plain' },\n  { name: 'name', storage: 'text', interpretation: 'plain' },\n  { name: 'imageUrl', storage: 'text', interpretation: 'plain' },\n  { name: 'role', storage: 'text', interpretation: 'plain' },\n  { name: 'createdAt', storage: 'text', interpretation: { kind: 'datetime' } },\n  { name: 'lastSeenAt', storage: 'text', interpretation: { kind: 'datetime' } },\n]\n\nexport const BASE_USERS_SCHEMA: CollectionSchema = {\n  name: 'users',\n  columns: [...USERS_COLUMNS],\n  permissions: {\n    '*': { read: 'own', create: false, update: false, delete: false },\n    admin: { read: true, create: false, update: true, delete: true },\n  },\n}\n\n// ============================================================================\n// Schema Registry\n// ============================================================================\n\n/**\n * Lint a CollectionSchema for declarations that look like they should\n * enforce something but don't, due to interactions between top-level\n * fields (visibilityField, ownerField) and per-role permission levels.\n *\n * The SDK has historically silently accepted schemas that imply more\n * enforcement than they actually deliver — e.g., `visibilityField` set\n * but every role's `read: true` means \"anyone can read everything\"\n * regardless of `visibility`. Warn loudly at registration so app\n * authors notice before shipping a privacy bug.\n *\n * Returns an array of warning messages. Empty = clean.\n */\nexport function lintSchema(schema: CollectionSchema): string[] {\n  const warnings: string[] = []\n  const VISIBILITY_AWARE: ReadonlyArray<PermissionLevel> = ['published', 'shared']\n\n  // Roles that grant unconditional read despite visibilityField being declared.\n  if (schema.visibilityField) {\n    const offendingRoles = Object.entries(schema.permissions)\n      .filter(([, perms]) => perms.read === true)\n      .map(([role]) => role)\n    if (offendingRoles.length > 0) {\n      const usesAware = Object.values(schema.permissions).some(\n        (p) => typeof p.read === 'string' && VISIBILITY_AWARE.includes(p.read as PermissionLevel),\n      )\n      if (!usesAware) {\n        warnings.push(\n          `[${schema.name}] visibilityField is declared but no role uses read: 'published' or 'shared'. ` +\n            `Roles with read: true (${offendingRoles.join(', ')}) will see every row regardless of visibility. ` +\n            `Change those to read: 'published' (owner OR public) or 'shared' (owner OR collaborator OR public) ` +\n            `to actually enforce the filter, or remove visibilityField if you don't intend to gate reads by it.`,\n        )\n      }\n    }\n  }\n\n  // An ordinary client role that can create rows must not be able to claim\n  // someone else's ownership. Server-written collections legitimately carry\n  // a recipient/subject id instead: their non-privileged roles all have\n  // create:false, while owner/admin writes are already fully trusted.\n  if (schema.ownerField) {\n    const col = schema.columns.find((c) => c.name === schema.ownerField)\n    const spoofableRoles = Object.entries(schema.permissions)\n      .filter(\n        ([role, permissions]) =>\n          role !== 'owner' &&\n          role !== 'admin' &&\n          permissions.create === true &&\n          permissions.update !== 'unclaimed-or-own',\n      )\n      .map(([role]) => role)\n    if (col && !col.userBound && spoofableRoles.length > 0) {\n      warnings.push(\n        `[${schema.name}] ownerField is '${schema.ownerField}' but that column is not marked userBound: true. ` +\n          `Client role(s) ${spoofableRoles.join(', ')} can create a row with someone else's id in this field, bypassing 'own' permission checks. ` +\n          `Add userBound: true (and ideally immutable: true) to the column.`,\n      )\n    }\n  }\n\n  // userBound columns that aren't text storage — userBound sets the\n  // field to the caller's userId (a string), so non-text storage is a\n  // schema mistake that will surface as a coercion error at write time.\n  for (const col of schema.columns) {\n    if (col.userBound && col.storage !== 'text') {\n      warnings.push(\n        `[${schema.name}] column '${col.name}' is userBound but storage is '${col.storage}'. ` +\n          `userBound stamps the user id (a string); use storage: 'text'.`,\n      )\n    }\n  }\n\n  return warnings\n}\n\n/**\n * Lint a whole schema set: every per-schema warning, plus the rules that\n * need to see the set. The `'team'` permission level resolves membership from\n * a `team_members` collection (`teamId`, `userId`, `status`); without one it\n * denies everything, silently — a mistake that presents as a sync bug, not\n * as a schema error, so name it here.\n */\nexport function lintSchemas(schemas: CollectionSchema[]): string[] {\n  return [...schemas.flatMap((schema) => lintSchema(schema)), ...lintSchemaSet(schemas)]\n}\n\n/** The rules that need to see the whole schema set (per-schema rules live in\n *  `lintSchema`; `lintSchemas` composes both). */\nexport function lintSchemaSet(schemas: CollectionSchema[]): string[] {\n  const warnings: string[] = []\n  if (!schemas.some((schema) => schema.name === 'team_members')) {\n    for (const schema of schemas) {\n      const teamRoles = Object.entries(schema.permissions)\n        .filter(([, p]) => [p.read, p.update, p.delete].includes('team'))\n        .map(([role]) => role)\n      if (teamRoles.length > 0) {\n        warnings.push(\n          `[${schema.name}] role(s) ${teamRoles.join(', ')} use the 'team' permission level, but no ` +\n            `'team_members' collection is registered. 'team' resolves membership from team_members ` +\n            `(teamId, userId, status), so without it those roles are denied everything — silently. ` +\n            `Register a team_members schema or use another level.`,\n        )\n      }\n    }\n  }\n  return warnings\n}\n\nexport class SchemaRegistry {\n  private trusted: Map<string, CollectionSchema> = new Map()\n\n  constructor(schemas: CollectionSchema[] = []) {\n    // registerTrusted runs the per-schema lint; only the set-level rules are\n    // this loop's to add.\n    for (const w of lintSchemaSet(schemas)) console.warn(`[schema-lint] ${w}`)\n    for (const schema of schemas) this.registerTrusted(schema)\n  }\n\n  registerTrusted(schema: CollectionSchema): void {\n    for (const w of lintSchema(schema)) {\n      console.warn(`[schema-lint] ${w}`)\n    }\n    this.trusted.set(schema.name, schema)\n  }\n\n  get(name: string): CollectionSchema | undefined {\n    return this.trusted.get(name)\n  }\n\n  has(name: string): boolean {\n    return this.trusted.has(name)\n  }\n\n  all(): CollectionSchema[] {\n    return Array.from(this.trusted.values())\n  }\n\n  names(): string[] {\n    return Array.from(this.trusted.keys())\n  }\n}\n\n// ============================================================================\n// Permission Analysis\n// ============================================================================\n\nexport type PermissionSource = 'explicit' | 'wildcard' | 'default-deny'\n\nexport interface ResolvedPermission {\n  level: PermissionLevel | boolean\n  source: PermissionSource\n}\n\nexport interface CollectionPermissionSummary {\n  collection: string\n  ownerField?: string\n  collaboratorsField?: string\n  teamField?: string\n  columns: ColumnDefinition[]\n  permissions: Record<\n    string,\n    {\n      read: ResolvedPermission\n      create: ResolvedPermission\n      update: ResolvedPermission\n      delete: ResolvedPermission\n      writableFields?: string[]\n    }\n  >\n}\n\nexport interface PermissionAnalysis {\n  roles: string[]\n  collections: CollectionPermissionSummary[]\n}\n\nexport function analyzePermissions(schemas: CollectionSchema[]): PermissionAnalysis {\n  const roleSet = new Set<string>()\n  for (const schema of schemas) {\n    for (const role of Object.keys(schema.permissions)) roleSet.add(role)\n  }\n  roleSet.delete('*')\n  const roles = Array.from(roleSet)\n\n  const collections: CollectionPermissionSummary[] = schemas.map((schema) => {\n    const permissions: CollectionPermissionSummary['permissions'] = {}\n    for (const role of roles) {\n      let source: PermissionSource\n      let perms: RolePermissions\n      if (schema.permissions[role]) {\n        source = 'explicit'\n        perms = schema.permissions[role]\n      } else if (schema.permissions['*']) {\n        source = 'wildcard'\n        perms = schema.permissions['*']\n      } else {\n        source = 'default-deny'\n        perms = { read: false, create: false, update: false, delete: false }\n      }\n      permissions[role] = {\n        read: { level: perms.read, source },\n        create: { level: perms.create, source },\n        update: { level: perms.update, source },\n        delete: { level: perms.delete, source },\n        writableFields: perms.writableFields,\n      }\n    }\n    return {\n      collection: schema.name,\n      ownerField: schema.ownerField,\n      collaboratorsField: schema.collaboratorsField,\n      teamField: schema.teamField,\n      columns: schema.columns,\n      permissions,\n    }\n  })\n\n  return { roles, collections }\n}\n","/**\n * AI Chat Schemas\n *\n * Pre-built collection schemas for DO-backed AI chat history.\n * The worker is the only writer; the client reads via `useQuery`.\n */\n\nimport type { CollectionSchema } from './registry'\n\n// member.create is false on both collections: writes flow exclusively through\n// the worker's /api/ai/* routes, which use X-App-Action to bypass RBAC.\n// Allowing direct WS creates would let a user PUT fake `role: 'assistant'`\n// rows into their own chats and have the next turn's loadMessages feed them\n// to the LLM as if they were real assistant outputs.\nexport const AI_CHATS_SCHEMA: CollectionSchema = {\n  name: 'ai-chats',\n  columns: [\n    { name: 'userId', storage: 'text', interpretation: 'plain', userBound: true, immutable: true, required: true },\n    { name: 'title', storage: 'text', interpretation: 'plain' },\n    { name: 'model', storage: 'text', interpretation: 'plain' },\n    { name: 'compactedSummary', storage: 'text', interpretation: 'plain' },\n    { name: 'compactedThroughId', storage: 'text', interpretation: 'plain' },\n  ],\n  ownerField: 'userId',\n  permissions: {\n    admin: { read: true, create: true, update: true, delete: true },\n    member: { read: 'own', create: false, update: 'own', delete: 'own' },\n    viewer: { read: 'own', create: false, update: false, delete: false },\n  },\n}\n\nexport const AI_MESSAGES_SCHEMA: CollectionSchema = {\n  name: 'ai-messages',\n  columns: [\n    { name: 'chatId', storage: 'text', interpretation: 'plain', immutable: true, required: true },\n    { name: 'userId', storage: 'text', interpretation: 'plain', userBound: true, immutable: true, required: true },\n    { name: 'role', storage: 'text', interpretation: 'plain', required: true },\n    { name: 'content', storage: 'text', interpretation: 'plain' },\n    { name: 'parts', storage: 'text', interpretation: { kind: 'json' } },\n  ],\n  ownerField: 'userId',\n  permissions: {\n    admin: { read: true, create: true, update: true, delete: true },\n    member: { read: 'own', create: false, update: 'own', delete: 'own' },\n    viewer: { read: 'own', create: false, update: false, delete: false },\n  },\n}\n","/**\n * Messaging Schemas\n *\n * Pre-built collection schemas for messaging functionality.\n * These schemas intentionally model public channels only. RecordRoom row\n * permissions cannot make a channel private by themselves; advertising DMs\n * or private groups here would expose their records to every room member.\n *\n * @example\n * ```typescript\n * import { CHANNELS_SCHEMA, MESSAGES_SCHEMA, REACTIONS_SCHEMA } from 'deepspace/worker'\n * export const schemas = [usersSchema, CHANNELS_SCHEMA, MESSAGES_SCHEMA, REACTIONS_SCHEMA]\n * ```\n */\n\nimport type { CollectionSchema } from './registry'\n\nexport const CHANNELS_SCHEMA: CollectionSchema = {\n  name: 'channels',\n  columns: [\n    { name: 'name', storage: 'text', interpretation: 'plain' },\n    { name: 'description', storage: 'text', interpretation: 'plain' },\n    {\n      name: 'type',\n      storage: 'text',\n      interpretation: { kind: 'select', options: ['public'] },\n    },\n    {\n      name: 'createdBy',\n      storage: 'text',\n      interpretation: 'plain',\n      userBound: true,\n      immutable: true,\n    },\n    { name: 'archived', storage: 'number', interpretation: { kind: 'boolean' } },\n  ],\n  ownerField: 'createdBy',\n  permissions: {\n    admin: { read: true, create: true, update: true, delete: true },\n    member: { read: true, create: true, update: 'own', delete: false },\n    viewer: { read: true, create: false, update: false, delete: false },\n  },\n}\n\nexport const MESSAGES_SCHEMA: CollectionSchema = {\n  name: 'messages',\n  columns: [\n    { name: 'channelId', storage: 'text', interpretation: 'plain' },\n    { name: 'content', storage: 'text', interpretation: 'plain' },\n    {\n      name: 'authorId',\n      storage: 'text',\n      interpretation: 'plain',\n      userBound: true,\n      immutable: true,\n    },\n    { name: 'parentMessageId', storage: 'text', interpretation: 'plain' },\n    { name: 'edited', storage: 'number', interpretation: { kind: 'boolean' } },\n    { name: 'editedAt', storage: 'text', interpretation: { kind: 'datetime' } },\n    // Soft-delete flag. Slack-style messaging keeps the row + parent IDs\n    // intact (so threads remain coherent) and renders a tombstone instead.\n    // Hard-delete via remove() still works if an app wants it.\n    { name: 'deleted', storage: 'number', interpretation: { kind: 'boolean' } },\n  ],\n  ownerField: 'authorId',\n  permissions: {\n    admin: { read: true, create: true, update: true, delete: true },\n    member: { read: true, create: true, update: 'own', delete: 'own' },\n    viewer: { read: true, create: false, update: false, delete: false },\n  },\n}\n\nexport const REACTIONS_SCHEMA: CollectionSchema = {\n  name: 'reactions',\n  columns: [\n    { name: 'messageId', storage: 'text', interpretation: 'plain' },\n    { name: 'channelId', storage: 'text', interpretation: 'plain' },\n    { name: 'emoji', storage: 'text', interpretation: 'plain' },\n    { name: 'userId', storage: 'text', interpretation: 'plain', userBound: true, immutable: true },\n  ],\n  ownerField: 'userId',\n  uniqueOn: ['messageId', 'emoji', 'userId'],\n  permissions: {\n    admin: { read: true, create: true, update: false, delete: true },\n    member: { read: true, create: true, update: false, delete: 'own' },\n    viewer: { read: true, create: false, update: false, delete: false },\n  },\n}\n\nexport const CHANNEL_MEMBERS_SCHEMA: CollectionSchema = {\n  name: 'channel-members',\n  columns: [\n    { name: 'channelId', storage: 'text', interpretation: 'plain' },\n    { name: 'userId', storage: 'text', interpretation: 'plain', userBound: true, immutable: true },\n    { name: 'joinedAt', storage: 'text', interpretation: { kind: 'datetime' } },\n  ],\n  ownerField: 'userId',\n  uniqueOn: ['channelId', 'userId'],\n  permissions: {\n    admin: { read: true, create: true, update: false, delete: true },\n    member: { read: true, create: true, update: false, delete: 'own' },\n    viewer: { read: true, create: false, update: false, delete: false },\n  },\n}\n\nexport const READ_RECEIPTS_SCHEMA: CollectionSchema = {\n  name: 'read-receipts',\n  columns: [\n    { name: 'channelId', storage: 'text', interpretation: 'plain' },\n    { name: 'userId', storage: 'text', interpretation: 'plain', userBound: true, immutable: true },\n    { name: 'lastReadAt', storage: 'text', interpretation: { kind: 'datetime' } },\n  ],\n  ownerField: 'userId',\n  uniqueOn: ['channelId', 'userId'],\n  permissions: {\n    admin: { read: true, create: true, update: true, delete: true },\n    member: { read: true, create: true, update: 'own', delete: 'own' },\n    viewer: { read: false, create: false, update: false, delete: false },\n  },\n}\n"],"mappings":";AA2YO,IAAM,0BAA0B,oBAAI,IAAI,CAAC,SAAS,QAAQ,YAAY,MAAM,CAAC;AAW7E,IAAM,4BAA4B,oBAAI,IAAI,CAAC,aAAa,YAAY,CAAC;AAGrE,IAAM,yBAAyB,oBAAI,IAAI;AAAA,EAC5C,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAGM,IAAM,gBAAoC;AAAA,EAC/C,EAAE,MAAM,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,EAC1D,EAAE,MAAM,QAAQ,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,EACzD,EAAE,MAAM,YAAY,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,EAC7D,EAAE,MAAM,QAAQ,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,EACzD,EAAE,MAAM,aAAa,SAAS,QAAQ,gBAAgB,EAAE,MAAM,WAAW,EAAE;AAAA,EAC3E,EAAE,MAAM,cAAc,SAAS,QAAQ,gBAAgB,EAAE,MAAM,WAAW,EAAE;AAC9E;AAEO,IAAM,oBAAsC;AAAA,EACjD,MAAM;AAAA,EACN,SAAS,CAAC,GAAG,aAAa;AAAA,EAC1B,aAAa;AAAA,IACX,KAAK,EAAE,MAAM,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,IAChE,OAAO,EAAE,MAAM,MAAM,QAAQ,OAAO,QAAQ,MAAM,QAAQ,KAAK;AAAA,EACjE;AACF;;;ACjaO,IAAM,kBAAoC;AAAA,EAC/C,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,UAAU,SAAS,QAAQ,gBAAgB,SAAS,WAAW,MAAM,WAAW,MAAM,UAAU,KAAK;AAAA,IAC7G,EAAE,MAAM,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC1D,EAAE,MAAM,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC1D,EAAE,MAAM,oBAAoB,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IACrE,EAAE,MAAM,sBAAsB,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,EACzE;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAC9D,QAAQ,EAAE,MAAM,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACnE,QAAQ,EAAE,MAAM,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACrE;AACF;AAEO,IAAM,qBAAuC;AAAA,EAClD,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,UAAU,SAAS,QAAQ,gBAAgB,SAAS,WAAW,MAAM,UAAU,KAAK;AAAA,IAC5F,EAAE,MAAM,UAAU,SAAS,QAAQ,gBAAgB,SAAS,WAAW,MAAM,WAAW,MAAM,UAAU,KAAK;AAAA,IAC7G,EAAE,MAAM,QAAQ,SAAS,QAAQ,gBAAgB,SAAS,UAAU,KAAK;AAAA,IACzE,EAAE,MAAM,WAAW,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC5D,EAAE,MAAM,SAAS,SAAS,QAAQ,gBAAgB,EAAE,MAAM,OAAO,EAAE;AAAA,EACrE;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAC9D,QAAQ,EAAE,MAAM,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACnE,QAAQ,EAAE,MAAM,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACrE;AACF;;;AC7BO,IAAM,kBAAoC;AAAA,EAC/C,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,QAAQ,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IACzD,EAAE,MAAM,eAAe,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAChE;AAAA,MACE,MAAM;AAAA,MACN,SAAS;AAAA,MACT,gBAAgB,EAAE,MAAM,UAAU,SAAS,CAAC,QAAQ,EAAE;AAAA,IACxD;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,SAAS;AAAA,MACT,gBAAgB;AAAA,MAChB,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAAA,IACA,EAAE,MAAM,YAAY,SAAS,UAAU,gBAAgB,EAAE,MAAM,UAAU,EAAE;AAAA,EAC7E;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAC9D,QAAQ,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACjE,QAAQ,EAAE,MAAM,MAAM,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACpE;AACF;AAEO,IAAM,kBAAoC;AAAA,EAC/C,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,aAAa,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC9D,EAAE,MAAM,WAAW,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC5D;AAAA,MACE,MAAM;AAAA,MACN,SAAS;AAAA,MACT,gBAAgB;AAAA,MAChB,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAAA,IACA,EAAE,MAAM,mBAAmB,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IACpE,EAAE,MAAM,UAAU,SAAS,UAAU,gBAAgB,EAAE,MAAM,UAAU,EAAE;AAAA,IACzE,EAAE,MAAM,YAAY,SAAS,QAAQ,gBAAgB,EAAE,MAAM,WAAW,EAAE;AAAA;AAAA;AAAA;AAAA,IAI1E,EAAE,MAAM,WAAW,SAAS,UAAU,gBAAgB,EAAE,MAAM,UAAU,EAAE;AAAA,EAC5E;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAC9D,QAAQ,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACjE,QAAQ,EAAE,MAAM,MAAM,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACpE;AACF;AAEO,IAAM,mBAAqC;AAAA,EAChD,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,aAAa,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC9D,EAAE,MAAM,aAAa,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC9D,EAAE,MAAM,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC1D,EAAE,MAAM,UAAU,SAAS,QAAQ,gBAAgB,SAAS,WAAW,MAAM,WAAW,KAAK;AAAA,EAC/F;AAAA,EACA,YAAY;AAAA,EACZ,UAAU,CAAC,aAAa,SAAS,QAAQ;AAAA,EACzC,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,KAAK;AAAA,IAC/D,QAAQ,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACjE,QAAQ,EAAE,MAAM,MAAM,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACpE;AACF;AAEO,IAAM,yBAA2C;AAAA,EACtD,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,aAAa,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC9D,EAAE,MAAM,UAAU,SAAS,QAAQ,gBAAgB,SAAS,WAAW,MAAM,WAAW,KAAK;AAAA,IAC7F,EAAE,MAAM,YAAY,SAAS,QAAQ,gBAAgB,EAAE,MAAM,WAAW,EAAE;AAAA,EAC5E;AAAA,EACA,YAAY;AAAA,EACZ,UAAU,CAAC,aAAa,QAAQ;AAAA,EAChC,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,KAAK;AAAA,IAC/D,QAAQ,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACjE,QAAQ,EAAE,MAAM,MAAM,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACpE;AACF;AAEO,IAAM,uBAAyC;AAAA,EACpD,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,aAAa,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC9D,EAAE,MAAM,UAAU,SAAS,QAAQ,gBAAgB,SAAS,WAAW,MAAM,WAAW,KAAK;AAAA,IAC7F,EAAE,MAAM,cAAc,SAAS,QAAQ,gBAAgB,EAAE,MAAM,WAAW,EAAE;AAAA,EAC9E;AAAA,EACA,YAAY;AAAA,EACZ,UAAU,CAAC,aAAa,QAAQ;AAAA,EAChC,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAC9D,QAAQ,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACjE,QAAQ,EAAE,MAAM,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACrE;AACF;","names":[]}
+{"version":3,"sources":["../src/server/schemas/registry.ts","../src/server/schemas/ai-chat.ts","../src/server/schemas/messaging.ts"],"sourcesContent":["/**\n * Collection Schema Definitions & Validation\n *\n * All collections use typed SQL columns. No document-mode / fields-based storage.\n */\n\nimport type {\n  CollectionSchema,\n  ColumnDefinition,\n  ColumnInterpretation,\n  PermissionLevel,\n  RolePermissions,\n} from '../../shared/types'\n\nexport type {\n  CollectionSchema,\n  ColumnDefinition,\n  ColumnInterpretation,\n  PermissionLevel,\n  RolePermissions,\n} from '../../shared/types'\n\n// ============================================================================\n// Column Definitions\n// ============================================================================\n\nexport interface ResolvedColumn {\n  id: string\n  name: string\n  storage: 'number' | 'text'\n  interpretation: ColumnInterpretation\n  expression?: string\n  readonly: boolean\n  userBound?: boolean\n  immutable?: boolean\n  required?: boolean\n  default?: unknown\n  timestampTrigger?: { field: string; value?: unknown }\n}\n\n// ============================================================================\n// Column Helpers\n// ============================================================================\n\nexport function collectionTableName(name: string): string {\n  return `c_${name.replace(/[^a-zA-Z0-9_]/g, '_')}`\n}\n\nexport function columnId(name: string): string {\n  return `col_${name.toLowerCase().replace(/[^a-z0-9]/g, '_')}`\n}\n\nexport function resolveColumn(col: ColumnDefinition): ResolvedColumn {\n  const interp: ColumnInterpretation =\n    typeof col.interpretation === 'string'\n      ? ({ kind: col.interpretation } as ColumnInterpretation)\n      : col.interpretation\n  return {\n    id: col.id ?? columnId(col.name),\n    name: col.name,\n    storage: col.storage,\n    interpretation: interp,\n    expression: col.expression,\n    readonly: !!col.expression,\n    userBound: col.userBound,\n    immutable: col.immutable,\n    required: col.required,\n    default: col.default,\n    timestampTrigger: col.timestampTrigger,\n  }\n}\n\nexport function rowToData(\n  row: Record<string, unknown>,\n  columns: ResolvedColumn[],\n): Record<string, unknown> {\n  const data: Record<string, unknown> = {}\n  for (const col of columns) {\n    if (row[col.id] !== undefined && row[col.id] !== null) {\n      let val = row[col.id]\n      if (col.interpretation.kind === 'json' && typeof val === 'string') {\n        try {\n          val = JSON.parse(val as string)\n        } catch {\n          /* keep as string */\n        }\n      }\n      data[col.name] = val\n    }\n  }\n  return data\n}\n\nexport function dataToColumnValues(\n  data: Record<string, unknown>,\n  columns: ResolvedColumn[],\n): Record<string, unknown> {\n  const values: Record<string, unknown> = {}\n  for (const col of columns) {\n    if (col.expression || col.readonly) continue\n    // Record mutations use public schema names only. Accepting physical column\n    // ids here lets a second key bypass name-based RBAC/userBound checks.\n    const val = data[col.name]\n    if (val !== undefined) {\n      values[col.id] = coerceValue(val, col.storage, col.interpretation)\n    }\n  }\n  return values\n}\n\nexport function coerceValue(\n  value: unknown,\n  storage: 'number' | 'text',\n  interpretation: ColumnInterpretation,\n): unknown {\n  if (value === null || value === undefined) return null\n  // An empty string is a value on a text column, not an absence. Folding it\n  // into NULL destroyed it on the way in — `rowToData` then dropped the key on\n  // the way out — so a field written as `''` read back `undefined` and a\n  // `column.default = ''` never materialized at all (it is applied at create\n  // and was coerced away one line later). A `number` column has nothing to\n  // store for `''`, so there it stays NULL.\n  if (value === '') return storage === 'text' ? '' : null\n\n  if (storage === 'text') {\n    if (interpretation.kind === 'json') {\n      if (typeof value === 'string') return value\n      try {\n        return JSON.stringify(value)\n      } catch {\n        return null\n      }\n    }\n    return typeof value === 'string' ? value : String(value)\n  }\n\n  if (typeof value === 'number') return isFinite(value) ? value : null\n  if (typeof value === 'boolean') return value ? 1 : 0\n  if (typeof value !== 'string') return String(value)\n\n  const s = value.trim()\n\n  if (interpretation.kind === 'boolean') {\n    const lower = s.toLowerCase()\n    if (lower === 'true' || lower === '1' || lower === 'yes') return 1\n    if (lower === 'false' || lower === '0' || lower === 'no') return 0\n    return s\n  }\n\n  if (interpretation.kind === 'percent') {\n    const m = s.match(/^(-?\\d+(?:\\.\\d+)?)\\s*%$/)\n    if (m) return parseFloat(m[1]) / 100\n  }\n\n  if (interpretation.kind === 'currency') {\n    const cleaned = s.replace(/[^0-9.-]/g, '')\n    const n = parseFloat(cleaned)\n    if (!isNaN(n)) return n\n    return s\n  }\n\n  if (interpretation.kind === 'date' || interpretation.kind === 'datetime') {\n    const d = new Date(s)\n    if (!isNaN(d.getTime())) return epochSeconds(d)\n    return s\n  }\n\n  const cleaned = s.replace(/[$€£¥,\\s]/g, '')\n  const n = parseFloat(cleaned)\n  if (!isNaN(n) && isFinite(n)) return n\n\n  return s\n}\n\n/** Canonical numeric representation for date/datetime storage and triggers. */\nexport function epochSeconds(date: Date = new Date()): number {\n  return Math.floor(date.getTime() / 1000)\n}\n\nexport function buildTableSelect(collectionName: string, columns: ResolvedColumn[]): string {\n  const tbl = collectionTableName(collectionName)\n  const parts: string[] = ['_row_id', '_created_by', '_created_at', '_updated_at']\n  for (const col of columns) {\n    if (col.expression) {\n      parts.push(`(${col.expression}) AS \"${col.id}\"`)\n    } else {\n      parts.push(`\"${col.id}\"`)\n    }\n  }\n  return `SELECT ${parts.join(', ')} FROM \"${tbl}\"`\n}\n\nexport interface User {\n  id: string\n  email: string\n  name: string\n  imageUrl?: string\n  role: string\n  createdAt: string\n  lastSeenAt: string\n}\n\nexport interface StoredRecord {\n  collection: string\n  recordId: string\n  data: Record<string, unknown>\n  createdBy: string\n  createdAt: string\n  updatedAt: string\n}\n\n// ============================================================================\n// Permission Checking\n// ============================================================================\n\nexport interface PermissionContext {\n  isTeamMember: (teamId: string, userId: string) => boolean\n}\n\nexport const noopPermissionContext: PermissionContext = {\n  isTeamMember: () => false,\n}\n\nexport function getRolePermissions(schema: CollectionSchema, role: string): RolePermissions {\n  if (schema.permissions[role]) return schema.permissions[role]\n  if (schema.permissions['*']) return schema.permissions['*']\n  return { read: false, create: false, update: false, delete: false }\n}\n\nexport function isOwner(\n  schema: CollectionSchema,\n  record: { data: Record<string, unknown>; createdBy: string },\n  userId: string,\n): boolean {\n  if (schema.ownerField) return record.data[schema.ownerField] === userId\n  return record.createdBy === userId\n}\n\nfunction isCollaborator(\n  schema: CollectionSchema,\n  record: { data: Record<string, unknown> },\n  userId: string,\n): boolean {\n  if (!schema.collaboratorsField) return false\n  const collab = record.data[schema.collaboratorsField]\n  if (typeof collab === 'string') {\n    try {\n      return (JSON.parse(collab) as string[]).includes(userId)\n    } catch {\n      return false\n    }\n  }\n  if (Array.isArray(collab)) return collab.includes(userId)\n  return false\n}\n\nfunction passesVisibilityCheck(\n  schema: CollectionSchema,\n  record: { data: Record<string, unknown> },\n): boolean {\n  if (!schema.visibilityField) return false\n  if (typeof schema.visibilityField === 'string') {\n    return record.data[schema.visibilityField] === 'public'\n  }\n  return record.data[schema.visibilityField.field] === schema.visibilityField.value\n}\n\nfunction checkPermissionLevel(\n  level: PermissionLevel,\n  schema: CollectionSchema,\n  record: { data: Record<string, unknown>; createdBy: string; recordId?: string },\n  userId: string,\n  ctx: PermissionContext = noopPermissionContext,\n): boolean {\n  if (level === true) return true\n  if (level === false) return false\n  if (level === 'own') return isOwner(schema, record, userId)\n  if (level === 'unclaimed-or-own') {\n    if (schema.ownerField) {\n      const ownerVal = record.data[schema.ownerField]\n      if (!ownerVal || ownerVal === '') return true\n    }\n    return isOwner(schema, record, userId)\n  }\n  if (level === 'collaborator') {\n    return isOwner(schema, record, userId) || isCollaborator(schema, record, userId)\n  }\n  if (level === 'team' || level === 'access') {\n    if (isOwner(schema, record, userId)) return true\n    if (isCollaborator(schema, record, userId)) return true\n    if (schema.teamField) {\n      const teamId = record.data[schema.teamField]\n      if (typeof teamId === 'string' && ctx.isTeamMember(teamId, userId)) return true\n    }\n    return false\n  }\n  if (level === 'published') {\n    return isOwner(schema, record, userId) || passesVisibilityCheck(schema, record)\n  }\n  if (level === 'shared') {\n    return (\n      isOwner(schema, record, userId) ||\n      isCollaborator(schema, record, userId) ||\n      passesVisibilityCheck(schema, record)\n    )\n  }\n  return false\n}\n\nexport function canRead(\n  schema: CollectionSchema,\n  role: string,\n  record: { data: Record<string, unknown>; createdBy: string; recordId?: string },\n  userId: string,\n  ctx: PermissionContext = noopPermissionContext,\n): boolean {\n  return checkPermissionLevel(getRolePermissions(schema, role).read, schema, record, userId, ctx)\n}\n\nexport function canCreate(schema: CollectionSchema, role: string): boolean {\n  return getRolePermissions(schema, role).create === true\n}\n\nexport function canUpdate(\n  schema: CollectionSchema,\n  role: string,\n  record: { data: Record<string, unknown>; createdBy: string; recordId?: string },\n  userId: string,\n  ctx: PermissionContext = noopPermissionContext,\n): boolean {\n  return checkPermissionLevel(getRolePermissions(schema, role).update, schema, record, userId, ctx)\n}\n\nexport function canDelete(\n  schema: CollectionSchema,\n  role: string,\n  record: { data: Record<string, unknown>; createdBy: string; recordId?: string },\n  userId: string,\n  ctx: PermissionContext = noopPermissionContext,\n): boolean {\n  return checkPermissionLevel(getRolePermissions(schema, role).delete, schema, record, userId, ctx)\n}\n\n/** Check if a caller-supplied field write violates writableFields restrictions. */\nexport function checkFieldPermissions(\n  schema: CollectionSchema,\n  role: string,\n  newData: Record<string, unknown>,\n  existingData?: Record<string, unknown>,\n): string | null {\n  const perms = getRolePermissions(schema, role)\n  if (!perms.writableFields) return null // no restrictions\n\n  const allowedFields = new Set(perms.writableFields)\n  for (const key of Object.keys(newData)) {\n    if (existingData && newData[key] === existingData[key]) continue\n    if (!allowedFields.has(key)) {\n      return `Role '${role}' cannot modify field '${key}'`\n    }\n  }\n  return null\n}\n\n/**\n * `unclaimed-or-own` lets a client claim an empty owner field, but never lets\n * them choose another user's id. Check the post-write record so the invariant\n * covers both creation and updates while still allowing an owner to unclaim.\n */\nexport function checkUnclaimedOwnerTransition(\n  schema: CollectionSchema,\n  role: string,\n  nextData: Record<string, unknown>,\n  userId: string,\n): string | null {\n  const permissions = getRolePermissions(schema, role)\n  if (permissions.update !== 'unclaimed-or-own' || !schema.ownerField) return null\n\n  const nextOwner = nextData[schema.ownerField]\n  if (nextOwner === undefined || nextOwner === null || nextOwner === '' || nextOwner === userId) {\n    return null\n  }\n\n  return `Role '${role}' can set '${schema.ownerField}' only to their own user id or leave it unclaimed`\n}\n\n// ============================================================================\n// System-Managed Columns (users collection)\n// ============================================================================\n\n/**\n * Columns the system *assigns* — from the identity provider at registration,\n * or from an admin action. A caller who sends one of these has chosen a value\n * and means it, so a record write that would change one is refused loudly\n * rather than silently dropped.\n */\nexport const SYSTEM_ASSIGNED_COLUMNS = new Set(['email', 'name', 'imageUrl', 'role'])\n\n/**\n * Columns the system *maintains* on its own schedule, without telling anyone.\n * `registerUser` bumps `lastSeenAt` on every WS connect and `handleUserUpdate`\n * rewrites it on every 60s presence heartbeat; neither broadcasts, so every\n * client's copy goes stale silently and there is no heal path short of a\n * refetch. Read-modify-write echo (`put(id, { ...rec.data, field })`) is the\n * SDK's own house style, so refusing these would refuse writes over a value the\n * caller never chose and cannot keep current. They are preserved silently.\n */\nexport const SYSTEM_MAINTAINED_COLUMNS = new Set(['createdAt', 'lastSeenAt'])\n\n/** Every `users` column owned by the system rather than by record writes. */\nexport const SYSTEM_MANAGED_COLUMNS = new Set([\n  ...SYSTEM_ASSIGNED_COLUMNS,\n  ...SYSTEM_MAINTAINED_COLUMNS,\n])\n\n/** Standard user columns. Apps spread these into their users schema. */\nexport const USERS_COLUMNS: ColumnDefinition[] = [\n  { name: 'email', storage: 'text', interpretation: 'plain' },\n  { name: 'name', storage: 'text', interpretation: 'plain' },\n  { name: 'imageUrl', storage: 'text', interpretation: 'plain' },\n  { name: 'role', storage: 'text', interpretation: 'plain' },\n  { name: 'createdAt', storage: 'text', interpretation: { kind: 'datetime' } },\n  { name: 'lastSeenAt', storage: 'text', interpretation: { kind: 'datetime' } },\n]\n\nexport const BASE_USERS_SCHEMA: CollectionSchema = {\n  name: 'users',\n  columns: [...USERS_COLUMNS],\n  permissions: {\n    '*': { read: 'own', create: false, update: false, delete: false },\n    admin: { read: true, create: false, update: true, delete: true },\n  },\n}\n\n// ============================================================================\n// Schema Registry\n// ============================================================================\n\n/**\n * Lint a CollectionSchema for declarations that look like they should\n * enforce something but don't, due to interactions between top-level\n * fields (visibilityField, ownerField) and per-role permission levels.\n *\n * The SDK has historically silently accepted schemas that imply more\n * enforcement than they actually deliver — e.g., `visibilityField` set\n * but every role's `read: true` means \"anyone can read everything\"\n * regardless of `visibility`. Warn loudly at registration so app\n * authors notice before shipping a privacy bug.\n *\n * Returns an array of warning messages. Empty = clean.\n */\nexport function lintSchema(schema: CollectionSchema): string[] {\n  const warnings: string[] = []\n  const VISIBILITY_AWARE: ReadonlyArray<PermissionLevel> = ['published', 'shared']\n\n  // Roles that grant unconditional read despite visibilityField being declared.\n  if (schema.visibilityField) {\n    const offendingRoles = Object.entries(schema.permissions)\n      .filter(([, perms]) => perms.read === true)\n      .map(([role]) => role)\n    if (offendingRoles.length > 0) {\n      const usesAware = Object.values(schema.permissions).some(\n        (p) => typeof p.read === 'string' && VISIBILITY_AWARE.includes(p.read as PermissionLevel),\n      )\n      if (!usesAware) {\n        warnings.push(\n          `[${schema.name}] visibilityField is declared but no role uses read: 'published' or 'shared'. ` +\n            `Roles with read: true (${offendingRoles.join(', ')}) will see every row regardless of visibility. ` +\n            `Change those to read: 'published' (owner OR public) or 'shared' (owner OR collaborator OR public) ` +\n            `to actually enforce the filter, or remove visibilityField if you don't intend to gate reads by it.`,\n        )\n      }\n    }\n  }\n\n  // An ordinary client role that can create rows must not be able to claim\n  // someone else's ownership. Server-written collections legitimately carry\n  // a recipient/subject id instead: their non-privileged roles all have\n  // create:false, while owner/admin writes are already fully trusted.\n  if (schema.ownerField) {\n    const col = schema.columns.find((c) => c.name === schema.ownerField)\n    const spoofableRoles = Object.entries(schema.permissions)\n      .filter(\n        ([role, permissions]) =>\n          role !== 'owner' &&\n          role !== 'admin' &&\n          permissions.create === true &&\n          permissions.update !== 'unclaimed-or-own',\n      )\n      .map(([role]) => role)\n    if (col && !col.userBound && spoofableRoles.length > 0) {\n      warnings.push(\n        `[${schema.name}] ownerField is '${schema.ownerField}' but that column is not marked userBound: true. ` +\n          `Client role(s) ${spoofableRoles.join(', ')} can create a row with someone else's id in this field, bypassing 'own' permission checks. ` +\n          `Add userBound: true (and ideally immutable: true) to the column.`,\n      )\n    }\n  }\n\n  // userBound columns that aren't text storage — userBound sets the\n  // field to the caller's userId (a string), so non-text storage is a\n  // schema mistake that will surface as a coercion error at write time.\n  for (const col of schema.columns) {\n    if (col.userBound && col.storage !== 'text') {\n      warnings.push(\n        `[${schema.name}] column '${col.name}' is userBound but storage is '${col.storage}'. ` +\n          `userBound stamps the user id (a string); use storage: 'text'.`,\n      )\n    }\n  }\n\n  return warnings\n}\n\n/**\n * Lint a whole schema set: every per-schema warning, plus the rules that\n * need to see the set. The `'team'` permission level resolves membership from\n * a `team_members` collection (`teamId`, `userId`, `status`); without one it\n * denies everything, silently — a mistake that presents as a sync bug, not\n * as a schema error, so name it here.\n */\nexport function lintSchemas(schemas: CollectionSchema[]): string[] {\n  return [...schemas.flatMap((schema) => lintSchema(schema)), ...lintSchemaSet(schemas)]\n}\n\n/** The rules that need to see the whole schema set (per-schema rules live in\n *  `lintSchema`; `lintSchemas` composes both). */\nexport function lintSchemaSet(schemas: CollectionSchema[]): string[] {\n  const warnings: string[] = []\n  if (!schemas.some((schema) => schema.name === 'team_members')) {\n    for (const schema of schemas) {\n      const teamRoles = Object.entries(schema.permissions)\n        .filter(([, p]) => [p.read, p.update, p.delete].includes('team'))\n        .map(([role]) => role)\n      if (teamRoles.length > 0) {\n        warnings.push(\n          `[${schema.name}] role(s) ${teamRoles.join(', ')} use the 'team' permission level, but no ` +\n            `'team_members' collection is registered. 'team' resolves membership from team_members ` +\n            `(teamId, userId, status), so without it those roles are denied everything — silently. ` +\n            `Register a team_members schema or use another level.`,\n        )\n      }\n    }\n  }\n  return warnings\n}\n\nexport class SchemaRegistry {\n  private trusted: Map<string, CollectionSchema> = new Map()\n\n  constructor(schemas: CollectionSchema[] = []) {\n    // registerTrusted runs the per-schema lint; only the set-level rules are\n    // this loop's to add.\n    for (const w of lintSchemaSet(schemas)) console.warn(`[schema-lint] ${w}`)\n    for (const schema of schemas) this.registerTrusted(schema)\n  }\n\n  registerTrusted(schema: CollectionSchema): void {\n    for (const w of lintSchema(schema)) {\n      console.warn(`[schema-lint] ${w}`)\n    }\n    this.trusted.set(schema.name, schema)\n  }\n\n  get(name: string): CollectionSchema | undefined {\n    return this.trusted.get(name)\n  }\n\n  has(name: string): boolean {\n    return this.trusted.has(name)\n  }\n\n  all(): CollectionSchema[] {\n    return Array.from(this.trusted.values())\n  }\n\n  names(): string[] {\n    return Array.from(this.trusted.keys())\n  }\n}\n","/**\n * AI Chat Schemas\n *\n * Pre-built collection schemas for DO-backed AI chat history.\n * The worker is the only writer; the client reads via `useQuery`.\n */\n\nimport type { CollectionSchema } from './registry'\n\n// member.create is false on both collections: writes flow exclusively through\n// the worker's /api/ai/* routes, which use X-App-Action to bypass RBAC.\n// Allowing direct WS creates would let a user PUT fake `role: 'assistant'`\n// rows into their own chats and have the next turn's loadMessages feed them\n// to the LLM as if they were real assistant outputs.\nexport const AI_CHATS_SCHEMA: CollectionSchema = {\n  name: 'ai-chats',\n  columns: [\n    { name: 'userId', storage: 'text', interpretation: 'plain', userBound: true, immutable: true, required: true },\n    { name: 'title', storage: 'text', interpretation: 'plain' },\n    { name: 'model', storage: 'text', interpretation: 'plain' },\n    { name: 'compactedSummary', storage: 'text', interpretation: 'plain' },\n    { name: 'compactedThroughId', storage: 'text', interpretation: 'plain' },\n  ],\n  ownerField: 'userId',\n  permissions: {\n    admin: { read: true, create: true, update: true, delete: true },\n    member: { read: 'own', create: false, update: 'own', delete: 'own' },\n    viewer: { read: 'own', create: false, update: false, delete: false },\n  },\n}\n\nexport const AI_MESSAGES_SCHEMA: CollectionSchema = {\n  name: 'ai-messages',\n  columns: [\n    { name: 'chatId', storage: 'text', interpretation: 'plain', immutable: true, required: true },\n    { name: 'userId', storage: 'text', interpretation: 'plain', userBound: true, immutable: true, required: true },\n    { name: 'role', storage: 'text', interpretation: 'plain', required: true },\n    { name: 'content', storage: 'text', interpretation: 'plain' },\n    { name: 'parts', storage: 'text', interpretation: { kind: 'json' } },\n  ],\n  ownerField: 'userId',\n  permissions: {\n    admin: { read: true, create: true, update: true, delete: true },\n    member: { read: 'own', create: false, update: 'own', delete: 'own' },\n    viewer: { read: 'own', create: false, update: false, delete: false },\n  },\n}\n","/**\n * Messaging Schemas\n *\n * Pre-built collection schemas for messaging functionality.\n * These schemas intentionally model public channels only. RecordRoom row\n * permissions cannot make a channel private by themselves; advertising DMs\n * or private groups here would expose their records to every room member.\n *\n * @example\n * ```typescript\n * import { CHANNELS_SCHEMA, MESSAGES_SCHEMA, REACTIONS_SCHEMA } from 'deepspace/worker'\n * export const schemas = [usersSchema, CHANNELS_SCHEMA, MESSAGES_SCHEMA, REACTIONS_SCHEMA]\n * ```\n */\n\nimport type { CollectionSchema } from './registry'\n\nexport const CHANNELS_SCHEMA: CollectionSchema = {\n  name: 'channels',\n  columns: [\n    { name: 'name', storage: 'text', interpretation: 'plain' },\n    { name: 'description', storage: 'text', interpretation: 'plain' },\n    {\n      name: 'type',\n      storage: 'text',\n      interpretation: { kind: 'select', options: ['public'] },\n    },\n    {\n      name: 'createdBy',\n      storage: 'text',\n      interpretation: 'plain',\n      userBound: true,\n      immutable: true,\n    },\n    { name: 'archived', storage: 'number', interpretation: { kind: 'boolean' } },\n  ],\n  ownerField: 'createdBy',\n  permissions: {\n    admin: { read: true, create: true, update: true, delete: true },\n    member: { read: true, create: true, update: 'own', delete: false },\n    viewer: { read: true, create: false, update: false, delete: false },\n  },\n}\n\nexport const MESSAGES_SCHEMA: CollectionSchema = {\n  name: 'messages',\n  columns: [\n    { name: 'channelId', storage: 'text', interpretation: 'plain' },\n    { name: 'content', storage: 'text', interpretation: 'plain' },\n    {\n      name: 'authorId',\n      storage: 'text',\n      interpretation: 'plain',\n      userBound: true,\n      immutable: true,\n    },\n    { name: 'parentMessageId', storage: 'text', interpretation: 'plain' },\n    { name: 'edited', storage: 'number', interpretation: { kind: 'boolean' } },\n    { name: 'editedAt', storage: 'text', interpretation: { kind: 'datetime' } },\n    // Soft-delete flag. Slack-style messaging keeps the row + parent IDs\n    // intact (so threads remain coherent) and renders a tombstone instead.\n    // Hard-delete via remove() still works if an app wants it.\n    { name: 'deleted', storage: 'number', interpretation: { kind: 'boolean' } },\n  ],\n  ownerField: 'authorId',\n  permissions: {\n    admin: { read: true, create: true, update: true, delete: true },\n    member: { read: true, create: true, update: 'own', delete: 'own' },\n    viewer: { read: true, create: false, update: false, delete: false },\n  },\n}\n\nexport const REACTIONS_SCHEMA: CollectionSchema = {\n  name: 'reactions',\n  columns: [\n    { name: 'messageId', storage: 'text', interpretation: 'plain' },\n    { name: 'channelId', storage: 'text', interpretation: 'plain' },\n    { name: 'emoji', storage: 'text', interpretation: 'plain' },\n    { name: 'userId', storage: 'text', interpretation: 'plain', userBound: true, immutable: true },\n  ],\n  ownerField: 'userId',\n  uniqueOn: ['messageId', 'emoji', 'userId'],\n  permissions: {\n    admin: { read: true, create: true, update: false, delete: true },\n    member: { read: true, create: true, update: false, delete: 'own' },\n    viewer: { read: true, create: false, update: false, delete: false },\n  },\n}\n\nexport const CHANNEL_MEMBERS_SCHEMA: CollectionSchema = {\n  name: 'channel-members',\n  columns: [\n    { name: 'channelId', storage: 'text', interpretation: 'plain' },\n    { name: 'userId', storage: 'text', interpretation: 'plain', userBound: true, immutable: true },\n    { name: 'joinedAt', storage: 'text', interpretation: { kind: 'datetime' } },\n  ],\n  ownerField: 'userId',\n  uniqueOn: ['channelId', 'userId'],\n  permissions: {\n    admin: { read: true, create: true, update: false, delete: true },\n    member: { read: true, create: true, update: false, delete: 'own' },\n    viewer: { read: true, create: false, update: false, delete: false },\n  },\n}\n\nexport const READ_RECEIPTS_SCHEMA: CollectionSchema = {\n  name: 'read-receipts',\n  columns: [\n    { name: 'channelId', storage: 'text', interpretation: 'plain' },\n    { name: 'userId', storage: 'text', interpretation: 'plain', userBound: true, immutable: true },\n    { name: 'lastReadAt', storage: 'text', interpretation: { kind: 'datetime' } },\n  ],\n  ownerField: 'userId',\n  uniqueOn: ['channelId', 'userId'],\n  permissions: {\n    admin: { read: true, create: true, update: true, delete: true },\n    member: { read: true, create: true, update: 'own', delete: 'own' },\n    viewer: { read: false, create: false, update: false, delete: false },\n  },\n}\n"],"mappings":";AA2YO,IAAM,0BAA0B,oBAAI,IAAI,CAAC,SAAS,QAAQ,YAAY,MAAM,CAAC;AAW7E,IAAM,4BAA4B,oBAAI,IAAI,CAAC,aAAa,YAAY,CAAC;AAGrE,IAAM,yBAAyB,oBAAI,IAAI;AAAA,EAC5C,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAGM,IAAM,gBAAoC;AAAA,EAC/C,EAAE,MAAM,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,EAC1D,EAAE,MAAM,QAAQ,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,EACzD,EAAE,MAAM,YAAY,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,EAC7D,EAAE,MAAM,QAAQ,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,EACzD,EAAE,MAAM,aAAa,SAAS,QAAQ,gBAAgB,EAAE,MAAM,WAAW,EAAE;AAAA,EAC3E,EAAE,MAAM,cAAc,SAAS,QAAQ,gBAAgB,EAAE,MAAM,WAAW,EAAE;AAC9E;AAEO,IAAM,oBAAsC;AAAA,EACjD,MAAM;AAAA,EACN,SAAS,CAAC,GAAG,aAAa;AAAA,EAC1B,aAAa;AAAA,IACX,KAAK,EAAE,MAAM,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,IAChE,OAAO,EAAE,MAAM,MAAM,QAAQ,OAAO,QAAQ,MAAM,QAAQ,KAAK;AAAA,EACjE;AACF;;;ACjaO,IAAM,kBAAoC;AAAA,EAC/C,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,UAAU,SAAS,QAAQ,gBAAgB,SAAS,WAAW,MAAM,WAAW,MAAM,UAAU,KAAK;AAAA,IAC7G,EAAE,MAAM,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC1D,EAAE,MAAM,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC1D,EAAE,MAAM,oBAAoB,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IACrE,EAAE,MAAM,sBAAsB,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,EACzE;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAC9D,QAAQ,EAAE,MAAM,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACnE,QAAQ,EAAE,MAAM,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACrE;AACF;AAEO,IAAM,qBAAuC;AAAA,EAClD,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,UAAU,SAAS,QAAQ,gBAAgB,SAAS,WAAW,MAAM,UAAU,KAAK;AAAA,IAC5F,EAAE,MAAM,UAAU,SAAS,QAAQ,gBAAgB,SAAS,WAAW,MAAM,WAAW,MAAM,UAAU,KAAK;AAAA,IAC7G,EAAE,MAAM,QAAQ,SAAS,QAAQ,gBAAgB,SAAS,UAAU,KAAK;AAAA,IACzE,EAAE,MAAM,WAAW,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC5D,EAAE,MAAM,SAAS,SAAS,QAAQ,gBAAgB,EAAE,MAAM,OAAO,EAAE;AAAA,EACrE;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAC9D,QAAQ,EAAE,MAAM,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACnE,QAAQ,EAAE,MAAM,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACrE;AACF;;;AC7BO,IAAM,kBAAoC;AAAA,EAC/C,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,QAAQ,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IACzD,EAAE,MAAM,eAAe,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAChE;AAAA,MACE,MAAM;AAAA,MACN,SAAS;AAAA,MACT,gBAAgB,EAAE,MAAM,UAAU,SAAS,CAAC,QAAQ,EAAE;AAAA,IACxD;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,SAAS;AAAA,MACT,gBAAgB;AAAA,MAChB,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAAA,IACA,EAAE,MAAM,YAAY,SAAS,UAAU,gBAAgB,EAAE,MAAM,UAAU,EAAE;AAAA,EAC7E;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAC9D,QAAQ,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACjE,QAAQ,EAAE,MAAM,MAAM,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACpE;AACF;AAEO,IAAM,kBAAoC;AAAA,EAC/C,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,aAAa,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC9D,EAAE,MAAM,WAAW,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC5D;AAAA,MACE,MAAM;AAAA,MACN,SAAS;AAAA,MACT,gBAAgB;AAAA,MAChB,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAAA,IACA,EAAE,MAAM,mBAAmB,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IACpE,EAAE,MAAM,UAAU,SAAS,UAAU,gBAAgB,EAAE,MAAM,UAAU,EAAE;AAAA,IACzE,EAAE,MAAM,YAAY,SAAS,QAAQ,gBAAgB,EAAE,MAAM,WAAW,EAAE;AAAA;AAAA;AAAA;AAAA,IAI1E,EAAE,MAAM,WAAW,SAAS,UAAU,gBAAgB,EAAE,MAAM,UAAU,EAAE;AAAA,EAC5E;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAC9D,QAAQ,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACjE,QAAQ,EAAE,MAAM,MAAM,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACpE;AACF;AAEO,IAAM,mBAAqC;AAAA,EAChD,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,aAAa,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC9D,EAAE,MAAM,aAAa,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC9D,EAAE,MAAM,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC1D,EAAE,MAAM,UAAU,SAAS,QAAQ,gBAAgB,SAAS,WAAW,MAAM,WAAW,KAAK;AAAA,EAC/F;AAAA,EACA,YAAY;AAAA,EACZ,UAAU,CAAC,aAAa,SAAS,QAAQ;AAAA,EACzC,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,KAAK;AAAA,IAC/D,QAAQ,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACjE,QAAQ,EAAE,MAAM,MAAM,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACpE;AACF;AAEO,IAAM,yBAA2C;AAAA,EACtD,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,aAAa,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC9D,EAAE,MAAM,UAAU,SAAS,QAAQ,gBAAgB,SAAS,WAAW,MAAM,WAAW,KAAK;AAAA,IAC7F,EAAE,MAAM,YAAY,SAAS,QAAQ,gBAAgB,EAAE,MAAM,WAAW,EAAE;AAAA,EAC5E;AAAA,EACA,YAAY;AAAA,EACZ,UAAU,CAAC,aAAa,QAAQ;AAAA,EAChC,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,KAAK;AAAA,IAC/D,QAAQ,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACjE,QAAQ,EAAE,MAAM,MAAM,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACpE;AACF;AAEO,IAAM,uBAAyC;AAAA,EACpD,MAAM;AAAA,EACN,SAAS;AAAA,IACP,EAAE,MAAM,aAAa,SAAS,QAAQ,gBAAgB,QAAQ;AAAA,IAC9D,EAAE,MAAM,UAAU,SAAS,QAAQ,gBAAgB,SAAS,WAAW,MAAM,WAAW,KAAK;AAAA,IAC7F,EAAE,MAAM,cAAc,SAAS,QAAQ,gBAAgB,EAAE,MAAM,WAAW,EAAE;AAAA,EAC9E;AAAA,EACA,YAAY;AAAA,EACZ,UAAU,CAAC,aAAa,QAAQ;AAAA,EAChC,aAAa;AAAA,IACX,OAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAC9D,QAAQ,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACjE,QAAQ,EAAE,MAAM,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACrE;AACF;","names":[]}

package/dist/server.d.ts

@@ -1653,11 +1653,6 @@ declare const MSG: {
     readonly PRESENCE_JOIN: "presence.join";
     readonly PRESENCE_LEAVE: "presence.leave";
     readonly PRESENCE_UPDATE: "presence.update";
-    readonly GW_SCOPE_CONNECT: "gateway.scope_connect";
-    readonly GW_SCOPE_DISCONNECT: "gateway.scope_disconnect";
-    readonly GW_SCOPE_ERROR: "gateway.scope_error";
-    readonly GW_TOKEN_REFRESH: "gateway.token_refresh";
-    readonly GW_USER_UPDATE: "gateway.user_update";
 };
 
 /**
@@ -1673,7 +1668,7 @@ declare const MSG: {
  * runtime. This module pairs every constant with its payload type, so
  * that:
  *
- *   1. Building a message with `clientBuild.gameInput(...)` is payload-
+ *   1. Building a message with `clientBuild.canvasAdd(...)` is payload-
  *      checked at the call site — the compiler refuses to ship a wrong
  *      shape.
  *
@@ -1722,7 +1717,7 @@ declare const MSG: {
  *
  * Where payload shapes are stable + narrow (ids, flags), we type them
  * precisely. Where they're opaque or escape the protocol layer (record
- * data blobs, Yjs binary frames, game-engine state), we use `unknown` and
+ * data blobs, Yjs binary frames, canvas shapes), we use `unknown` and
  * defer narrowing to the caller. This is intentional: over-typing opaque
  * payloads would require the protocol layer to import application types
  * and defeat the "thin wire contract" goal.
@@ -1730,7 +1725,7 @@ declare const MSG: {
 
 /**
  * The outer shape of every wire message. `T` is the string discriminator
- * (e.g. `"game.input"`) — keeping it as a generic literal type lets the
+ * (e.g. `"canvas.add"`) — keeping it as a generic literal type lets the
  * discriminated-union narrowing in `dispatch()` pick the right payload.
  *
  * Callers extending the protocol should pass a string-literal type for
@@ -1837,11 +1832,7 @@ type ServerMessage = BaseMessage<typeof MSG.QUERY_RESULT, {
 }> | BaseMessage<typeof MSG.PRESENCE_UPDATE, {
     userId: string;
     state: Record<string, unknown>;
-}> | BaseMessage<typeof MSG.GW_SCOPE_ERROR, {
-    scopeType: string;
-    scopeId: string;
-    error: string;
-}> | BaseMessage<typeof MSG.GW_USER_UPDATE, unknown>;
+}>;
 
 /**
  * BaseRoom — Abstract base class for all DeepSpace Durable Objects.
@@ -2146,30 +2137,6 @@ declare class SchemaRegistry {
     all(): CollectionSchema[];
     names(): string[];
 }
-type PermissionSource = 'explicit' | 'wildcard' | 'default-deny';
-interface ResolvedPermission {
-    level: PermissionLevel | boolean;
-    source: PermissionSource;
-}
-interface CollectionPermissionSummary {
-    collection: string;
-    ownerField?: string;
-    collaboratorsField?: string;
-    teamField?: string;
-    columns: ColumnDefinition[];
-    permissions: Record<string, {
-        read: ResolvedPermission;
-        create: ResolvedPermission;
-        update: ResolvedPermission;
-        delete: ResolvedPermission;
-        writableFields?: string[];
-    }>;
-}
-interface PermissionAnalysis {
-    roles: string[];
-    collections: CollectionPermissionSummary[];
-}
-declare function analyzePermissions(schemas: CollectionSchema[]): PermissionAnalysis;
 
 /**
  * RecordRoom Durable Object
@@ -4665,4 +4632,4 @@ declare class RefundError extends Error {
     constructor(message: string, status: number);
 }
 
-export { ACCOUNT_STORAGE_LIMIT_BYTES, AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_ID_RE, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, BaseRoom, type BindingJsonValue, CHANNELS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, COST_RATES, CancelSubscriptionError, type CancelSubscriptionOpts, type CancelSubscriptionResult, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DELETE_WHERE_LIMIT, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, type DOBindings, type DOManifest, type DOManifestEntry, type DebugApiContext, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, DeepSpaceAgentProfileError, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, type GetActionData, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, type KnowledgeAddOptions, type KnowledgeAddResult, type KnowledgeClient, type KnowledgeEnv, KnowledgeError, type KnowledgeItem, type KnowledgeListOptions, type KnowledgeListResult, type KnowledgeSearchChunk, type KnowledgeSearchOptions, type KnowledgeSearchResult, type KnowledgeStatus, MAX_APP_FILE_BYTES, MAX_DELETE_WHERE_LIMIT, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_ENV_VAR_BYTES, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlanInfo, type PlatformWorkerEnv, type PrefixResult, type PresencePeer, PresenceRoom, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, REGISTRY_INSTANCE, RESERVED_BINDING_NAMES, RESOURCE_ID_RE, type RecordContext, RecordRoom, type RecordRoomConfig, RefundError, type RefundOpts, type RefundResult, RegistryClientError, type ResolvedColumn, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, STRICT_APP_ID_RE, SYSTEM_ASSIGNED_COLUMNS, SYSTEM_COLLECTION_SCHEMAS, SYSTEM_MAINTAINED_COLUMNS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedKnowledgeClient, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type StorageAdmission, type StoredRecord, SubscriptionAuthError, type SubscriptionContext, type SubscriptionRead, SubscriptionRequiredError, type SubscriptionStatus, type Summarizer, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, type ToolsApiContext, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, type UserContext, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, type YjsContext, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, armCronRoom, authWorkerFetch, bindingManifestFromOutputConfig, broadcastChange, broadcastUserList, broadcastYjsUpdate, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, cancelSubscription, capToolResultSize, captureScreenshot, checkFieldPermissions, checkUnclaimedOwnerTransition, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDeepSpaceAI, createDeepSpaceAuth, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, deleteRecord, enqueueJob, epochSeconds, executeQuery, folderFilter, formatBytes, getAllUsers, getChat, getOrCreateYjsDoc, getRecord, getRolePermissions, getSubscription, getUser, getYjsDocKey, handleApiRequest, handleDelete, handlePut, handleSetRole, handleSubscribe, handleToolsRequest, handleUnsubscribe, handleUserList, handleUserUpdate, handleYjsBinaryMessage, handleYjsJoin, handleYjsLeave, isAutoProvision, isFilesVerbPath, isOwner, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, knowledge, lintSchema, lintSchemaSet, lintSchemas, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, mintAppId, mintUlid, noopPermissionContext, normalizeKnowledgeFolder, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, putRecord, readRecord, recordMatchesSubscription, refundInvoice, registerUser, registryErrorJson, registryStub, requireSubscription, resolveAppName, resolveAppRole, resolveColumn, rowToData, runMigrations, saveYjsDoc, storageLimitForTier, storageQuotaMessage, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt };
+export { ACCOUNT_STORAGE_LIMIT_BYTES, AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_ID_RE, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, BaseRoom, type BindingJsonValue, CHANNELS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, COST_RATES, CancelSubscriptionError, type CancelSubscriptionOpts, type CancelSubscriptionResult, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DELETE_WHERE_LIMIT, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, type DOBindings, type DOManifest, type DOManifestEntry, type DebugApiContext, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, DeepSpaceAgentProfileError, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, type GetActionData, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, type KnowledgeAddOptions, type KnowledgeAddResult, type KnowledgeClient, type KnowledgeEnv, KnowledgeError, type KnowledgeItem, type KnowledgeListOptions, type KnowledgeListResult, type KnowledgeSearchChunk, type KnowledgeSearchOptions, type KnowledgeSearchResult, type KnowledgeStatus, MAX_APP_FILE_BYTES, MAX_DELETE_WHERE_LIMIT, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_ENV_VAR_BYTES, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, type MutateActionData, type PermissionContext, type PermissionLevel, type PlanInfo, type PlatformWorkerEnv, type PrefixResult, type PresencePeer, PresenceRoom, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, REGISTRY_INSTANCE, RESERVED_BINDING_NAMES, RESOURCE_ID_RE, type RecordContext, RecordRoom, type RecordRoomConfig, RefundError, type RefundOpts, type RefundResult, RegistryClientError, type ResolvedColumn, type RolePermissions, type RunMigrationsResult, STRICT_APP_ID_RE, SYSTEM_ASSIGNED_COLUMNS, SYSTEM_COLLECTION_SCHEMAS, SYSTEM_MAINTAINED_COLUMNS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedKnowledgeClient, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type StorageAdmission, type StoredRecord, SubscriptionAuthError, type SubscriptionContext, type SubscriptionRead, SubscriptionRequiredError, type SubscriptionStatus, type Summarizer, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, type ToolsApiContext, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, type UserContext, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, type YjsContext, YjsRoom, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, armCronRoom, authWorkerFetch, bindingManifestFromOutputConfig, broadcastChange, broadcastUserList, broadcastYjsUpdate, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, cancelSubscription, capToolResultSize, captureScreenshot, checkFieldPermissions, checkUnclaimedOwnerTransition, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDeepSpaceAI, createDeepSpaceAuth, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, deleteRecord, enqueueJob, epochSeconds, executeQuery, folderFilter, formatBytes, getAllUsers, getChat, getOrCreateYjsDoc, getRecord, getRolePermissions, getSubscription, getUser, getYjsDocKey, handleApiRequest, handleDelete, handlePut, handleSetRole, handleSubscribe, handleToolsRequest, handleUnsubscribe, handleUserList, handleUserUpdate, handleYjsBinaryMessage, handleYjsJoin, handleYjsLeave, isAutoProvision, isFilesVerbPath, isOwner, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, knowledge, lintSchema, lintSchemaSet, lintSchemas, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, mintAppId, mintUlid, noopPermissionContext, normalizeKnowledgeFolder, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, putRecord, readRecord, recordMatchesSubscription, refundInvoice, registerUser, registryErrorJson, registryStub, requireSubscription, resolveAppName, resolveAppRole, resolveColumn, rowToData, runMigrations, saveYjsDoc, storageLimitForTier, storageQuotaMessage, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt };

package/dist/server.js

@@ -2506,7 +2506,7 @@ var MSG = {
   USER_UPDATE: "user.update",
   // ---- Auth signal -----------------------------------------------------
   // Server → client one-shot on connect from rooms that enforce role-based
-  // writes (Canvas, Game, Cron). Tells the client whether this connection
+  // writes (Canvas, Cron). Tells the client whether this connection
   // can write so its hook can disable local write APIs and the UI can
   // render controls accordingly. Without this, a viewer's click would
   // round-trip to the server and silently come back as ERROR.
@@ -2550,13 +2550,7 @@ var MSG = {
   PRESENCE_SYNC: "presence.sync",
   PRESENCE_JOIN: "presence.join",
   PRESENCE_LEAVE: "presence.leave",
-  PRESENCE_UPDATE: "presence.update",
-  // ---- Gateway multiplexing --------------------------------------------
-  GW_SCOPE_CONNECT: "gateway.scope_connect",
-  GW_SCOPE_DISCONNECT: "gateway.scope_disconnect",
-  GW_SCOPE_ERROR: "gateway.scope_error",
-  GW_TOKEN_REFRESH: "gateway.token_refresh",
-  GW_USER_UPDATE: "gateway.user_update"
+  PRESENCE_UPDATE: "presence.update"
 };
 var MSG_YJS_SYNC = 22;
 var MSG_YJS_AWARENESS = 23;
@@ -3626,47 +3620,6 @@ var SchemaRegistry = class {
     return Array.from(this.trusted.keys());
   }
 };
-function analyzePermissions(schemas) {
-  const roleSet = /* @__PURE__ */ new Set();
-  for (const schema of schemas) {
-    for (const role of Object.keys(schema.permissions)) roleSet.add(role);
-  }
-  roleSet.delete("*");
-  const roles = Array.from(roleSet);
-  const collections = schemas.map((schema) => {
-    const permissions = {};
-    for (const role of roles) {
-      let source;
-      let perms;
-      if (schema.permissions[role]) {
-        source = "explicit";
-        perms = schema.permissions[role];
-      } else if (schema.permissions["*"]) {
-        source = "wildcard";
-        perms = schema.permissions["*"];
-      } else {
-        source = "default-deny";
-        perms = { read: false, create: false, update: false, delete: false };
-      }
-      permissions[role] = {
-        read: { level: perms.read, source },
-        create: { level: perms.create, source },
-        update: { level: perms.update, source },
-        delete: { level: perms.delete, source },
-        writableFields: perms.writableFields
-      };
-    }
-    return {
-      collection: schema.name,
-      ownerField: schema.ownerField,
-      collaboratorsField: schema.collaboratorsField,
-      teamField: schema.teamField,
-      columns: schema.columns,
-      permissions
-    };
-  });
-  return { roles, collections };
-}
 
 // src/server/rooms/collection-table-migration.ts
 var NOOP_LOGGER = { warn: () => {
@@ -3839,13 +3792,7 @@ var serverBuild = {
   presenceSync: (peers) => ({ type: MSG.PRESENCE_SYNC, payload: { peers } }),
   presenceJoin: (peer) => ({ type: MSG.PRESENCE_JOIN, payload: { peer } }),
   presenceLeave: (userId) => ({ type: MSG.PRESENCE_LEAVE, payload: { userId } }),
-  presenceUpdate: (userId, state) => ({ type: MSG.PRESENCE_UPDATE, payload: { userId, state } }),
-  // Gateway
-  gwScopeError: (scopeType, scopeId, error) => ({
-    type: MSG.GW_SCOPE_ERROR,
-    payload: { scopeType, scopeId, error }
-  }),
-  gwUserUpdate: (user) => ({ type: MSG.GW_USER_UPDATE, payload: user })
+  presenceUpdate: (userId, state) => ({ type: MSG.PRESENCE_UPDATE, payload: { userId, state } })
 };
 
 // src/server/handlers/records.ts
@@ -8747,7 +8694,6 @@ export {
   UPLOAD_PART_BYTES,
   USERS_COLUMNS,
   YjsRoom,
-  analyzePermissions,
   apiWorkerFetch,
   appendMessage,
   applyAiToolDefaults,