deepspace 0.3.8 → 0.3.9

package/dist/worker.js

@@ -473,14 +473,50 @@ var BASE_USERS_SCHEMA = {
     admin: { read: true, create: false, update: true, delete: true }
   }
 };
+function lintSchema(schema) {
+  const warnings = [];
+  const VISIBILITY_AWARE = ["published", "shared"];
+  if (schema.visibilityField) {
+    const offendingRoles = Object.entries(schema.permissions).filter(([, perms]) => perms.read === true).map(([role]) => role);
+    if (offendingRoles.length > 0) {
+      const usesAware = Object.values(schema.permissions).some(
+        (p) => typeof p.read === "string" && VISIBILITY_AWARE.includes(p.read)
+      );
+      if (!usesAware) {
+        warnings.push(
+          `[${schema.name}] visibilityField is declared but no role uses read: 'published' or 'shared'. Roles with read: true (${offendingRoles.join(", ")}) will see every row regardless of visibility. Change those to read: 'published' (owner OR public) or 'shared' (owner OR collaborator OR public) to actually enforce the filter, or remove visibilityField if you don't intend to gate reads by it.`
+        );
+      }
+    }
+  }
+  if (schema.ownerField) {
+    const col = schema.columns.find((c) => c.name === schema.ownerField);
+    if (col && !col.userBound) {
+      warnings.push(
+        `[${schema.name}] ownerField is '${schema.ownerField}' but that column is not marked userBound: true. A client can create a row with someone else's id in this field, bypassing 'own' permission checks. Add userBound: true (and ideally immutable: true) to the column.`
+      );
+    }
+  }
+  for (const col of schema.columns) {
+    if (col.userBound && col.storage !== "text") {
+      warnings.push(
+        `[${schema.name}] column '${col.name}' is userBound but storage is '${col.storage}'. userBound stamps the user id (a string); use storage: 'text'.`
+      );
+    }
+  }
+  return warnings;
+}
 var SchemaRegistry = class {
   trusted = /* @__PURE__ */ new Map();
   constructor(schemas = []) {
     for (const schema of schemas) {
-      this.trusted.set(schema.name, schema);
+      this.registerTrusted(schema);
     }
   }
   registerTrusted(schema) {
+    for (const w of lintSchema(schema)) {
+      console.warn(`[schema-lint] ${w}`);
+    }
     this.trusted.set(schema.name, schema);
   }
   get(name) {
@@ -1579,6 +1615,9 @@ function executeTableQuery(ctx, query, schema, userId, userRole, isSystem, skipU
       if (col) {
         whereClauses.push(`"${col.id}" = ?`);
         params.push(value);
+      } else if (fieldName === "recordId") {
+        whereClauses.push(`_row_id = ?`);
+        params.push(value);
       } else if (fieldName === "createdBy") {
         whereClauses.push(`_created_by = ?`);
         params.push(value);
@@ -2111,11 +2150,11 @@ async function handleToolExecute(ctx, request) {
     getPermissionContext: ctx.getPermissionContext,
     send: ctx.send
   };
-  const result = executeTool(recordCtx, tool, params, userId, userRole, isAppAction);
+  const result = await executeTool(recordCtx, tool, params, userId, userRole, isAppAction);
   const status = result.success ? 200 : result.error?.includes("not found") ? 404 : 400;
   return Response.json(result, { status, headers: CORS_HEADERS });
 }
-function executeTool(ctx, toolName, params, userId, userRole, skipUserRbac) {
+async function executeTool(ctx, toolName, params, userId, userRole, skipUserRbac) {
   switch (toolName) {
     // ---- Records ----
     case "records.query": {
@@ -2162,6 +2201,33 @@ function executeTool(ctx, toolName, params, userId, userRole, skipUserRbac) {
       if (!recordId) return { success: false, error: "Missing required param: recordId" };
       return deleteRecord(ctx, collection, recordId, userId, userRole, skipUserRbac);
     }
+    // ---- Users ----
+    // Bootstrap or refresh the `users` row for a given userId. Same path
+    // the SDK uses on WS connect via registerUser, exposed for server
+    // contexts (CLI-only callers, action handlers) where there's no WS
+    // connection to trigger the natural registration. System-managed
+    // columns (email, name, imageUrl, role) are written through
+    // registerUser's privileged path, bypassing the SYSTEM_MANAGED
+    // stripping that blocks naive tools.create / tools.update.
+    case "users.register": {
+      const targetUserId = params.userId || userId;
+      if (!targetUserId) return { success: false, error: "Missing userId" };
+      const name = typeof params.name === "string" ? params.name : "";
+      const email = typeof params.email === "string" ? params.email : "";
+      const imageUrl = typeof params.imageUrl === "string" ? params.imageUrl : void 0;
+      const isAdmin = params.isAdmin === true;
+      const user = await registerUser(
+        ctx.sql,
+        targetUserId,
+        name,
+        email,
+        imageUrl,
+        isAdmin,
+        "member",
+        ctx.schemaRegistry
+      );
+      return { success: true, data: { user } };
+    }
     // ---- Schema ----
     case "schema.list": {
       const schemas = ctx.schemaRegistry.all();
@@ -2994,6 +3060,7 @@ import * as Y4 from "yjs";
 var YjsRoom = class extends BaseRoom {
   doc = null;
   initialized = false;
+  awarenessStates = /* @__PURE__ */ new Map();
   constructor(state, env) {
     super(state, env);
   }
@@ -3062,6 +3129,7 @@ var YjsRoom = class extends BaseRoom {
       ws.send(toUint8Array(step2).buffer);
     }
     ws.send(JSON.stringify({ type: "auth", canWrite }));
+    this.sendAwarenessSnapshot(ws);
     return attachment;
   }
   onMessage(ws, user, message) {
@@ -3078,18 +3146,17 @@ var YjsRoom = class extends BaseRoom {
   }
   onDisconnect(ws, user) {
     const attachment = ws.deserializeAttachment();
-    if (!attachment?.awarenessClientId) return;
+    if (attachment?.awarenessClientId == null) return;
     const clientId = attachment.awarenessClientId;
-    const stateJson = new TextEncoder().encode("null");
-    const inner = createEncoder();
-    writeVarUint(inner, clientId);
-    writeVarUint(inner, 16777215);
-    writeVarUint8Array(inner, stateJson);
-    const outer = createEncoder();
-    writeVarUint(outer, MSG_AWARENESS);
-    writeVarUint(outer, 1);
-    for (const b of inner.data) outer.data.push(b);
-    const msg = toUint8Array(outer);
+    const prevClock = this.awarenessStates.get(clientId)?.clock ?? 0;
+    this.awarenessStates.delete(clientId);
+    const msg = this.encodeAwarenessMessage([
+      {
+        clientId,
+        clock: prevClock + 1,
+        stateBytes: new TextEncoder().encode("null")
+      }
+    ]);
     for (const peer of this.state.getWebSockets()) {
       if (peer === ws) continue;
       try {
@@ -3127,20 +3194,66 @@ var YjsRoom = class extends BaseRoom {
     }
   }
   handleAwareness(ws, decoder, rawMessage) {
+    const updates = this.readAwarenessUpdates(decoder);
+    if (updates.length === 0) return;
     const attachment = ws.deserializeAttachment();
     if (attachment && attachment.awarenessClientId === null) {
-      try {
-        const savedPos = decoder.pos;
-        const _len = readVarUint(decoder);
-        const clientId = readVarUint(decoder);
-        decoder.pos = savedPos;
-        attachment.awarenessClientId = clientId;
-        ws.serializeAttachment(attachment);
-      } catch {
+      attachment.awarenessClientId = updates[0].clientId;
+      ws.serializeAttachment(attachment);
+    }
+    for (const update of updates) {
+      const existing = this.awarenessStates.get(update.clientId);
+      if (existing && existing.clock >= update.clock) continue;
+      if (new TextDecoder().decode(update.stateBytes) === "null") {
+        this.awarenessStates.delete(update.clientId);
+      } else {
+        this.awarenessStates.set(update.clientId, {
+          clock: update.clock,
+          stateBytes: update.stateBytes
+        });
       }
     }
     this.broadcastRaw(ws, rawMessage);
   }
+  readAwarenessUpdates(decoder) {
+    const update = readVarUint8Array(decoder);
+    const updateDecoder = createDecoder(update);
+    const count = readVarUint(updateDecoder);
+    const updates = [];
+    for (let i = 0; i < count; i++) {
+      const clientId = readVarUint(updateDecoder);
+      const clock = readVarUint(updateDecoder);
+      const stateBytes = readVarUint8Array(updateDecoder);
+      updates.push({ clientId, clock, stateBytes });
+    }
+    return updates;
+  }
+  encodeAwarenessMessage(updates) {
+    const inner = createEncoder();
+    writeVarUint(inner, updates.length);
+    for (const update of updates) {
+      writeVarUint(inner, update.clientId);
+      writeVarUint(inner, update.clock);
+      writeVarUint8Array(inner, update.stateBytes);
+    }
+    const outer = createEncoder();
+    writeVarUint(outer, MSG_AWARENESS);
+    writeVarUint8Array(outer, toUint8Array(inner));
+    return toUint8Array(outer);
+  }
+  sendAwarenessSnapshot(ws) {
+    if (this.awarenessStates.size === 0) return;
+    const updates = Array.from(this.awarenessStates, ([clientId, entry]) => ({
+      clientId,
+      clock: entry.clock,
+      stateBytes: entry.stateBytes
+    }));
+    const msg = this.encodeAwarenessMessage(updates);
+    try {
+      ws.send(msg.buffer);
+    } catch {
+    }
+  }
   // --------------------------------------------------------------------------
   // Broadcasting
   // --------------------------------------------------------------------------
@@ -3668,10 +3781,35 @@ var PresenceRoom = class extends BaseRoom {
   constructor(state, env) {
     super(state, env);
   }
+  /**
+   * Durable Objects can hibernate and clear heap while Cloudflare keeps
+   * WebSocket connections. Deserialize attachments from already-connected
+   * sockets so `peers` matches reality before we send PRESENCE_SYNC.
+   */
+  hydratePeersFromLiveSockets(connectingWs) {
+    for (const existing of this.state.getWebSockets()) {
+      if (existing === connectingWs) continue;
+      const att = existing.deserializeAttachment();
+      if (!att?.userId) continue;
+      if (this.peers.has(att.userId)) continue;
+      const joinedAt = typeof att.joinedAt === "string" ? att.joinedAt : (/* @__PURE__ */ new Date()).toISOString();
+      const recovered = {
+        userId: att.userId,
+        userName: att.userName,
+        userEmail: att.userEmail,
+        userImageUrl: att.userImageUrl,
+        joinedAt,
+        state: {}
+      };
+      this.peers.set(att.userId, recovered);
+      this.peerSockets.set(att.userId, existing);
+    }
+  }
   // --------------------------------------------------------------------------
   // BaseRoom Lifecycle
   // --------------------------------------------------------------------------
   onConnect(ws, user) {
+    this.hydratePeersFromLiveSockets(ws);
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const peer = {
       userId: user.userId,
@@ -3698,8 +3836,21 @@ var PresenceRoom = class extends BaseRoom {
     const { type, payload } = message;
     switch (type) {
       case MSG.PRESENCE_UPDATE: {
-        const peer = this.peers.get(user.userId);
-        if (!peer) break;
+        let peer = this.peers.get(user.userId);
+        if (!peer) {
+          const att = user;
+          const joinedAt = typeof att.joinedAt === "string" ? att.joinedAt : (/* @__PURE__ */ new Date()).toISOString();
+          peer = {
+            userId: user.userId,
+            userName: user.userName,
+            userEmail: user.userEmail,
+            userImageUrl: user.userImageUrl,
+            joinedAt,
+            state: {}
+          };
+          this.peers.set(user.userId, peer);
+          this.peerSockets.set(user.userId, ws);
+        }
         peer.state = { ...peer.state, ...payload };
         this.peers.set(user.userId, peer);
         this.broadcast(
@@ -5136,8 +5287,27 @@ async function handleUpload(request, url, bucket, prefix, userId) {
       fileName = body.name;
       mimeType = body.mimeType || "application/octet-stream";
     }
-    const fileKey = `${Date.now()}-${Math.random().toString(36).slice(2, 11)}-${fileName}`;
-    const key = `${prefix}${fileKey}`;
+    const requestedKey = url.searchParams.get("key");
+    let key;
+    if (requestedKey !== null) {
+      const safe = sanitizeSubpath(requestedKey);
+      if (safe === null) {
+        return Response.json(
+          { error: "Invalid key: traversal not allowed" },
+          { status: 400, headers: CORS_HEADERS3 }
+        );
+      }
+      if (!safe) {
+        return Response.json(
+          { error: "Invalid key: empty" },
+          { status: 400, headers: CORS_HEADERS3 }
+        );
+      }
+      key = `${prefix}${safe}`;
+    } else {
+      const fileKey = `${Date.now()}-${Math.random().toString(36).slice(2, 11)}-${fileName}`;
+      key = `${prefix}${fileKey}`;
+    }
     await bucket.put(key, fileData, {
       httpMetadata: { contentType: mimeType },
       customMetadata: {
@@ -5442,9 +5612,10 @@ function createDeepSpaceAuth(config) {
 }
 
 // src/server/utils/cron.ts
+var DEFAULT_API_BASE_URL = "https://deepspace-api.eudaimonicincorporated.workers.dev";
 function buildCronContext(env, ownerUserId, roomId = "default") {
   const hmacSecret = env.INTERNAL_STORAGE_HMAC_SECRET;
-  const apiBase = env.API_BASE_URL || "https://api.deep.space";
+  const apiBase = env.API_BASE_URL || DEFAULT_API_BASE_URL;
   const roomIdObj = env.RECORD_ROOMS.idFromName(roomId);
   const room = env.RECORD_ROOMS.get(roomIdObj);
   async function executeTool3(tool, params) {
@@ -5659,6 +5830,36 @@ function createDeepSpaceAI(env, provider, options = {}) {
   }
 }
 
+// src/server/utils/screenshot.ts
+async function captureScreenshot(env, opts) {
+  const headers = new Headers({
+    "content-type": "application/json",
+    "x-app-identity-token": env.APP_IDENTITY_TOKEN,
+    "x-app-name": env.APP_NAME
+  });
+  const res = await platformWorkerFetch(
+    env,
+    new Request("https://platform-internal/internal/screenshot", {
+      method: "POST",
+      headers,
+      body: JSON.stringify(opts)
+    })
+  );
+  if (!res.ok) {
+    let detail = "";
+    try {
+      detail = (await res.text()).slice(0, 300);
+    } catch {
+    }
+    console.warn(`[captureScreenshot] platform returned ${res.status}:`, detail);
+    return null;
+  }
+  return {
+    body: await res.arrayBuffer(),
+    contentType: res.headers.get("content-type") || "image/png"
+  };
+}
+
 // src/server/utils/chat-context.ts
 import { generateText } from "ai";
 var DEFAULT_CONTEXT_CONFIG = {
@@ -6105,8 +6306,12 @@ var VECTORIZE_QUERIED_USD_PER_M_DIMS = 0.01;
 var VECTORIZE_STORED_USD_PER_100M_DIMS = 0.05;
 var COST_RATES = {
   ai: {
-    /** USD per character (input or output). */
-    perChar: AI_EMBED_USD_PER_M_TOKENS / 1e6 / CHARS_PER_TOKEN
+    /**
+     * USD per character of *embedding input* (bge-m3 / qwen3-embedding tier).
+     * Renamed from `perChar` to make explicit that this rate does NOT
+     * apply to LLM-generation output — see `priceBindingUsageEvent`.
+     */
+    embedInputPerChar: AI_EMBED_USD_PER_M_TOKENS / 1e6 / CHARS_PER_TOKEN
   },
   vectorize: {
     /** USD per queried dimension (per query, per stored vector compared). */
@@ -6115,6 +6320,15 @@ var COST_RATES = {
     storedPerDimPerMonth: VECTORIZE_STORED_USD_PER_100M_DIMS / 1e8
   }
 };
+function priceBindingUsageEvent(kind, op, units) {
+  if (kind === "ai" && op === "input") {
+    return units * COST_RATES.ai.embedInputPerChar;
+  }
+  if (kind === "vectorize" && op === "query") {
+    return units * COST_RATES.vectorize.queriedPerDim;
+  }
+  return 0;
+}
 
 // src/server/utils/d1-migrations.ts
 var META_TABLE = "_dpc_migrations";
@@ -6210,6 +6424,7 @@ export {
   canRead,
   canUpdate,
   capToolResultSize,
+  captureScreenshot,
   checkFieldPermissions,
   clientBuild,
   coerceValue,
@@ -6242,6 +6457,7 @@ export {
   hasContent,
   isAutoProvision,
   isOwner,
+  lintSchema,
   loadMessages,
   makeDefaultSummarizer,
   meterAi,
@@ -6250,6 +6466,7 @@ export {
   noopPermissionContext,
   platformWorkerFetch,
   prepareMessagesWithCompaction,
+  priceBindingUsageEvent,
   readVarUint,
   readVarUint8Array,
   resolveAppName,