deepspace 0.9.1 → 0.9.3

package/dist/worker.d.ts

@@ -2540,6 +2540,18 @@ declare function handleAwarenessMessage(awareness: Awareness, data: Uint8Array):
  */
 declare function getMessageType(data: Uint8Array): number;
 
+/** First source migration required by the canonical app identity cutover. */
+declare const CANONICAL_APP_IDENTITY_MIGRATION_ID = "2026-08-canonical-app-identity-wire";
+type AppMigrationIdsValidation = {
+    valid: true;
+    ids: string[];
+} | {
+    valid: false;
+    reason: string;
+};
+/** Validate the small, provider-neutral migration manifest shipped with an app bundle. */
+declare function validateAppMigrationIds(value: unknown): AppMigrationIdsValidation;
+
 /**
  * Wildcard-aware CORS origin matching for the platform workers.
  *
@@ -4882,4 +4894,4 @@ interface AppLogsResponse {
 declare const APP_LOG_EVENT_KEYS: readonly ["id", "timestamp", "level", "eventType", "message", "source", "outcome", "request", "exception"];
 type AppLogEventKey = (typeof APP_LOG_EVENT_KEYS)[number];
 
-export { AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_ID_RE, APP_LOG_EVENT_KEYS, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CLIENT_LOG_MARKER, CONVERSATION_SCHEMAS, COST_RATES, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientErrorKind, type ClientErrorReport, type ClientMessage, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConnectionAttachment, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GetActionData, type GlobalDOType, type HandlerContext, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, LOG_LEVELS, type LogLevel, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, REGISTRY_INSTANCE, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, RESOURCE_ID_RE, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, RegistryClientError, type ResolvedColumn, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, STRICT_APP_ID_RE, SYSTEM_COLLECTIONS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type ServerMessage, type SharedConnection, type StoredRecord, type Summarizer, type SyncResult, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, USERS_COLUMNS, type User, type UserAttachment, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKSPACE_SCHEMAS, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, capToolResultSize, captureScreenshot, checkFieldPermissions, clientBuild, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, enqueueJob, getChat, getGlobalDOSchemas, getGlobalDOType, getMessageType, getRolePermissions, handleAwarenessMessage, handleClientErrorReport, handleSyncMessage, hasContent, isAutoProvision, isOwner, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, lintSchema, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, noopPermissionContext, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, readVarUint, readVarUint8Array, registerClientErrorRoute, registryErrorJson, registryStub, resolveAppName, resolveColumn, rowToData, runMigrations, serverBuild, timingSafeEqualHex, timingSafeEqualStrings, toUint8Array, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema, writeVarUint, writeVarUint8Array };
+export { AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_ID_RE, APP_LOG_EVENT_KEYS, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppMigrationIdsValidation, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, CANONICAL_APP_IDENTITY_MIGRATION_ID, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CLIENT_LOG_MARKER, CONVERSATION_SCHEMAS, COST_RATES, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientErrorKind, type ClientErrorReport, type ClientMessage, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConnectionAttachment, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GetActionData, type GlobalDOType, type HandlerContext, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, LOG_LEVELS, type LogLevel, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, REGISTRY_INSTANCE, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, RESOURCE_ID_RE, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, RegistryClientError, type ResolvedColumn, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, STRICT_APP_ID_RE, SYSTEM_COLLECTIONS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type ServerMessage, type SharedConnection, type StoredRecord, type Summarizer, type SyncResult, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, USERS_COLUMNS, type User, type UserAttachment, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKSPACE_SCHEMAS, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, capToolResultSize, captureScreenshot, checkFieldPermissions, clientBuild, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, enqueueJob, getChat, getGlobalDOSchemas, getGlobalDOType, getMessageType, getRolePermissions, handleAwarenessMessage, handleClientErrorReport, handleSyncMessage, hasContent, isAutoProvision, isOwner, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, lintSchema, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, noopPermissionContext, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, readVarUint, readVarUint8Array, registerClientErrorRoute, registryErrorJson, registryStub, resolveAppName, resolveColumn, rowToData, runMigrations, serverBuild, timingSafeEqualHex, timingSafeEqualStrings, toUint8Array, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppMigrationIds, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema, writeVarUint, writeVarUint8Array };

package/dist/worker.js

@@ -574,9 +574,12 @@ function lintSchema(schema) {
   }
   if (schema.ownerField) {
     const col = schema.columns.find((c) => c.name === schema.ownerField);
-    if (col && !col.userBound) {
+    const spoofableRoles = Object.entries(schema.permissions).filter(
+      ([role, permissions]) => role !== "owner" && role !== "admin" && permissions.create === true
+    ).map(([role]) => role);
+    if (col && !col.userBound && spoofableRoles.length > 0) {
       warnings.push(
-        `[${schema.name}] ownerField is '${schema.ownerField}' but that column is not marked userBound: true. A client can create a row with someone else's id in this field, bypassing 'own' permission checks. Add userBound: true (and ideally immutable: true) to the column.`
+        `[${schema.name}] ownerField is '${schema.ownerField}' but that column is not marked userBound: true. Client role(s) ${spoofableRoles.join(", ")} can create a row with someone else's id in this field, bypassing 'own' permission checks. Add userBound: true (and ideally immutable: true) to the column.`
       );
     }
   }
@@ -5425,8 +5428,18 @@ var CHANNELS_SCHEMA = {
   columns: [
     { name: "name", storage: "text", interpretation: "plain" },
     { name: "description", storage: "text", interpretation: "plain" },
-    { name: "type", storage: "text", interpretation: { kind: "select", options: ["public", "private", "dm"] } },
-    { name: "createdBy", storage: "text", interpretation: "plain" },
+    {
+      name: "type",
+      storage: "text",
+      interpretation: { kind: "select", options: ["public", "private", "dm"] }
+    },
+    {
+      name: "createdBy",
+      storage: "text",
+      interpretation: "plain",
+      userBound: true,
+      immutable: true
+    },
     { name: "archived", storage: "number", interpretation: { kind: "boolean" } }
   ],
   ownerField: "createdBy",
@@ -5441,7 +5454,13 @@ var MESSAGES_SCHEMA = {
   columns: [
     { name: "channelId", storage: "text", interpretation: "plain" },
     { name: "content", storage: "text", interpretation: "plain" },
-    { name: "authorId", storage: "text", interpretation: "plain" },
+    {
+      name: "authorId",
+      storage: "text",
+      interpretation: "plain",
+      userBound: true,
+      immutable: true
+    },
     { name: "parentMessageId", storage: "text", interpretation: "plain" },
     { name: "edited", storage: "number", interpretation: { kind: "boolean" } },
     { name: "editedAt", storage: "text", interpretation: { kind: "datetime" } },
@@ -5463,7 +5482,7 @@ var REACTIONS_SCHEMA = {
     { name: "messageId", storage: "text", interpretation: "plain" },
     { name: "channelId", storage: "text", interpretation: "plain" },
     { name: "emoji", storage: "text", interpretation: "plain" },
-    { name: "userId", storage: "text", interpretation: "plain" }
+    { name: "userId", storage: "text", interpretation: "plain", userBound: true, immutable: true }
   ],
   ownerField: "userId",
   uniqueOn: ["messageId", "emoji", "userId"],
@@ -5477,7 +5496,7 @@ var CHANNEL_MEMBERS_SCHEMA = {
   name: "channel-members",
   columns: [
     { name: "channelId", storage: "text", interpretation: "plain" },
-    { name: "userId", storage: "text", interpretation: "plain" },
+    { name: "userId", storage: "text", interpretation: "plain", userBound: true, immutable: true },
     { name: "joinedAt", storage: "text", interpretation: { kind: "datetime" } }
   ],
   ownerField: "userId",
@@ -5491,10 +5510,33 @@ var CHANNEL_MEMBERS_SCHEMA = {
 var CHANNEL_INVITATIONS_SCHEMA = {
   name: "channel-invitations",
   columns: [
-    { name: "channelId", storage: "text", interpretation: "plain", required: true, immutable: true },
-    { name: "invitedUserId", storage: "text", interpretation: "plain", required: true, immutable: true },
-    { name: "invitedBy", storage: "text", interpretation: "plain", userBound: true, immutable: true },
-    { name: "status", storage: "text", interpretation: { kind: "select", options: ["pending", "accepted", "declined"] }, required: true }
+    {
+      name: "channelId",
+      storage: "text",
+      interpretation: "plain",
+      required: true,
+      immutable: true
+    },
+    {
+      name: "invitedUserId",
+      storage: "text",
+      interpretation: "plain",
+      required: true,
+      immutable: true
+    },
+    {
+      name: "invitedBy",
+      storage: "text",
+      interpretation: "plain",
+      userBound: true,
+      immutable: true
+    },
+    {
+      name: "status",
+      storage: "text",
+      interpretation: { kind: "select", options: ["pending", "accepted", "declined"] },
+      required: true
+    }
   ],
   uniqueOn: ["channelId", "invitedUserId"],
   permissions: {
@@ -5507,7 +5549,7 @@ var READ_RECEIPTS_SCHEMA = {
   name: "read-receipts",
   columns: [
     { name: "channelId", storage: "text", interpretation: "plain" },
-    { name: "userId", storage: "text", interpretation: "plain" },
+    { name: "userId", storage: "text", interpretation: "plain", userBound: true, immutable: true },
     { name: "lastReadAt", storage: "text", interpretation: { kind: "datetime" } }
   ],
   ownerField: "userId",
@@ -5951,6 +5993,35 @@ var RESERVED_COLLECTION_NAMES = new Set(
   GLOBAL_DO_TYPES.flatMap((t) => t.schemas.map((s) => s.name))
 );
 
+// src/shared/protocol/app-migrations.ts
+var APP_MIGRATION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+var MAX_APP_MIGRATION_IDS = 256;
+var CANONICAL_APP_IDENTITY_MIGRATION_ID = "2026-08-canonical-app-identity-wire";
+function validateAppMigrationIds(value) {
+  if (!Array.isArray(value)) {
+    return { valid: false, reason: "app migrations must be a JSON string array" };
+  }
+  if (value.length > MAX_APP_MIGRATION_IDS) {
+    return {
+      valid: false,
+      reason: `app migrations cannot contain more than ${MAX_APP_MIGRATION_IDS} entries`
+    };
+  }
+  const ids = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const valueId of value) {
+    if (typeof valueId !== "string" || !APP_MIGRATION_ID_RE.test(valueId)) {
+      return { valid: false, reason: `invalid app migration id: ${String(valueId)}` };
+    }
+    if (seen.has(valueId)) {
+      return { valid: false, reason: `duplicate app migration id: ${valueId}` };
+    }
+    seen.add(valueId);
+    ids.push(valueId);
+  }
+  return { valid: true, ids };
+}
+
 // src/server/utils/cors.ts
 function matchOrigin(origin, patterns) {
   if (!origin) return null;
@@ -7569,6 +7640,7 @@ export {
   BASE_USERS_SCHEMA,
   BUILT_IN_TOOLS,
   BaseRoom,
+  CANONICAL_APP_IDENTITY_MIGRATION_ID,
   CHANNELS_SCHEMA,
   CHANNEL_INVITATIONS_SCHEMA,
   CHANNEL_MEMBERS_SCHEMA,
@@ -7703,6 +7775,7 @@ export {
   turnsToCoreMessages,
   unwrapToolOutput,
   updateChat,
+  validateAppMigrationIds,
   validateAppName,
   validateBindingManifest,
   validateDoManifest,