latticesql 1.16.0 → 1.16.1

package/README.md

@@ -2300,7 +2300,15 @@ lattice teams join \
 
 The cloud rejects redemption if the caller's claimed email doesn't match the invitation's `invitee_email` (case-insensitive). Sharing an invite token in a public channel is therefore safe — only the addressee can redeem it.
 
-**Other subcommands** (`lattice teams help` for the full list): `list`, `members`, `leave`, `destroy`, `share`, `unshare`, `shared`, `sync`, `link`, `unlink`, `pull`, `push`, `status`.
+**Other subcommands** (`lattice teams help` for the full list): `list`, `members`, `leave`, `destroy`, `share`, `unshare`, `shared`, `sync`, `link`, `unlink`, `pull`, `push`, `status`, `dlq`.
+
+**Dead-letter queue (v1.15+).** A pulled change envelope that fails to apply (e.g. it arrived before the row/table it depends on), and any non-owner-overwrite divergence notice, lands in `__lattice_team_dlq`. Inspect and recover it instead of losing it behind the pull cursor:
+
+```bash
+lattice teams dlq list  --team <name>            # show entries (op, target, error)
+lattice teams dlq retry --team <name> [--id <id>] # replay; a late dependency now applies cleanly
+lattice teams dlq purge --team <name> [--id <id>] # discard without applying
+```
 
 **Per-table ownership + opt-in sharing (v1.14+).** Team members share one physical Postgres, so visibility is enforced at the app layer via a `__lattice_object_owners` table: each table records its creator, and a user sees only the tables they own plus tables explicitly shared to the team. The native `files`/`secrets` objects are owned by the database creator and private by default. Sharing is an explicit, owner-only action (not a side effect of creating a table). The filter gates API access, not just the display.
 

package/dist/cli.js

@@ -435,6 +435,15 @@ function resolveDbPath(raw, configDir2) {
   }
   return resolve(configDir2, raw);
 }
+var warnedDeprecatedRefs = /* @__PURE__ */ new Set();
+function warnDeprecatedRef(entity, field, target) {
+  const key = `${entity}.${field}`;
+  if (warnedDeprecatedRefs.has(key)) return;
+  warnedDeprecatedRefs.add(key);
+  console.warn(
+    `Lattice: one-to-many \`ref:\` on "${entity}.${field}" \u2192 "${target}" is deprecated in favor of many-to-many junction tables and will be removed in 2.0.`
+  );
+}
 function entityToTableDef(entityName, entity) {
   const rawFields = entity.fields;
   if (!rawFields || typeof rawFields !== "object" || Array.isArray(rawFields)) {
@@ -457,6 +466,7 @@ function entityToTableDef(entityName, entity) {
         table: field.ref,
         foreignKey: fieldName
       };
+      warnDeprecatedRef(entityName, fieldName, field.ref);
     }
   }
   const primaryKey = entity.primaryKey ?? pkFromField;
@@ -6238,7 +6248,6 @@ var css = `
       --danger: #ef4444;
       --danger-deep: #dc2626;
       --shadow: 0 1px 2px rgba(0, 0, 0, 0.45);
-      --sidebar-width: 380px;
       --nav-width: 220px;
     }
     * { box-sizing: border-box; }
@@ -6459,30 +6468,11 @@ var css = `
        minimum keeps the track at content-width and the whole page scrolls
        horizontally. */
     .layout {
-      display: grid; grid-template-columns: var(--nav-width) minmax(0, 1fr) var(--sidebar-width);
+      display: grid; grid-template-columns: var(--nav-width) minmax(0, 1fr);
       height: calc(100vh - 56px);
     }
-    .rail-handle { display: none; }
     @media (max-width: 720px) {
-      /* The activity rail becomes a bottom drawer: tap the handle to expand
-         the feed to ~62svh. */
-      .layout { grid-template-columns: var(--nav-width) minmax(0, 1fr); }
-      .assistant-rail {
-        position: fixed; left: 0; right: 0; bottom: 0; z-index: 50;
-        border-left: none; border-top: 1px solid var(--border);
-        max-height: 62svh; box-shadow: 0 -8px 24px rgba(0, 0, 0, 0.4);
-      }
-      .rail-resize { display: none; }
-      .rail-handle {
-        display: block; flex: 0 0 auto; height: 22px; cursor: pointer; position: relative;
-      }
-      .rail-handle::after {
-        content: ''; position: absolute; top: 9px; left: 50%; transform: translateX(-50%);
-        width: 40px; height: 4px; border-radius: 2px; background: var(--border-strong);
-      }
-      .assistant-rail:not(.expanded) { max-height: none; }
-      .assistant-rail:not(.expanded) .rail-feed { display: none; }
-      main#content { padding-bottom: 96px; }
+      main#content { padding-bottom: 24px; }
     }
     nav.sidebar {
       background: var(--surface); border-right: 1px solid var(--border);
@@ -6506,51 +6496,6 @@ var css = `
 
     main#content { padding: 24px; overflow: auto; }
 
-    /* \u2500\u2500 Assistant rail (activity feed) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */
-    .assistant-rail {
-      position: relative;
-      background: var(--surface);
-      border-left: 1px solid var(--border);
-      display: flex; flex-direction: column;
-      min-width: 0; overflow: hidden;
-    }
-    .rail-resize {
-      position: absolute; left: 0; top: 0; bottom: 0; width: 5px;
-      cursor: col-resize; background: transparent; z-index: 5;
-      transition: background-color 120ms;
-    }
-    .rail-resize:hover, .rail-resize.dragging { background: var(--accent-soft); }
-    .rail-header {
-      flex: 0 0 auto; padding: 12px 14px; border-bottom: 1px solid var(--border);
-      display: flex; align-items: center; gap: 8px;
-    }
-    .rail-title {
-      font-size: 11px; font-weight: 600; color: var(--text-muted);
-      text-transform: uppercase; letter-spacing: 0.06em; flex: 0 0 auto;
-    }
-    .rail-feed {
-      flex: 1 1 auto; overflow-y: auto; padding: 10px 12px;
-      display: flex; flex-direction: column; gap: 8px;
-    }
-    .rail-empty { color: var(--text-muted); font-size: 12.5px; text-align: center; padding: 18px 8px; }
-    .feed-item {
-      display: grid; grid-template-columns: 20px minmax(0, 1fr) auto; gap: 8px;
-      align-items: baseline; padding: 7px 9px; border-radius: 8px;
-      background: var(--surface-2); border: 1px solid var(--border);
-      animation: feedIn 0.18s ease-out;
-    }
-    @keyframes feedIn { from { opacity: 0; transform: translateY(6px); } to { opacity: 1; transform: translateY(0); } }
-    .feed-icon { text-align: center; font-size: 13px; }
-    .feed-body { min-width: 0; }
-    .feed-summary { font-size: 13px; color: var(--text); word-break: break-word; }
-    .feed-meta { margin-top: 2px; display: flex; align-items: center; gap: 6px; }
-    .feed-source {
-      font-size: 10px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.04em;
-      padding: 1px 6px; border-radius: 999px;
-      background: var(--accent-soft); color: var(--accent);
-    }
-    .feed-time { font-size: 11px; color: var(--text-muted); white-space: nowrap; }
-
     /* \u2500\u2500 File preview (files detail page) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */
     .file-preview { margin: 4px 0 16px; }
     .file-preview .file-desc {
@@ -7412,9 +7357,6 @@ var appJs = `
         refreshHistoryState();
         renderRoute();
         startRealtime();
-        initRailResize();
-        initRailDrawer();
-        startFeed();
         initSearch();
         initLastEdited();
         initOffline();
@@ -7770,11 +7712,12 @@ var appJs = `
     }
 
     // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-    // Activity feed \u2014 SSE from /api/feed/stream. Renders every audited
-    // mutation as a bubble in the assistant rail. Unlike the realtime
-    // channel (Postgres-only), this works for SQLite databases too.
+    // Shared activity helpers \u2014 the operation-icon map and relative-time
+    // formatter, used by Version History and the dashboard activity list. The
+    // standalone Activity rail was removed in 1.16.1 (redundant with Version
+    // History); multiplayer realtime convergence runs on the separate realtime
+    // channel (startRealtime), not on this.
     // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-    var feedSource = null;
     var FEED_ICONS = {
       insert: '\u2795', update: '\u270F\uFE0F', delete: '\u{1F5D1}',
       link: '\u{1F517}', unlink: '\u26D3', undo: '\u21B6', redo: '\u21B7', schema: '\u{1F6E0}',
@@ -7790,51 +7733,6 @@ var appJs = `
         return new Date(iso).toLocaleDateString();
       } catch (_) { return ''; }
     }
-    function renderFeedItem(ev) {
-      var feedEl = document.getElementById('rail-feed');
-      if (!feedEl) return;
-      var empty = document.getElementById('rail-empty');
-      if (empty) empty.remove();
-      var item = document.createElement('div');
-      item.className = 'feed-item';
-      var icon = document.createElement('div');
-      icon.className = 'feed-icon';
-      icon.textContent = FEED_ICONS[ev.op] || '\u2022';
-      var body = document.createElement('div');
-      body.className = 'feed-body';
-      var summary = document.createElement('div');
-      summary.className = 'feed-summary';
-      summary.textContent = ev.summary || (String(ev.op || '') + ' ' + String(ev.table || ''));
-      var meta = document.createElement('div');
-      meta.className = 'feed-meta';
-      var src = document.createElement('span');
-      src.className = 'feed-source';
-      src.textContent = ev.source === 'gui' ? 'you' : String(ev.source || '');
-      meta.appendChild(src);
-      body.appendChild(summary);
-      body.appendChild(meta);
-      var time = document.createElement('div');
-      time.className = 'feed-time';
-      time.textContent = relTime(ev.ts);
-      item.appendChild(icon);
-      item.appendChild(body);
-      item.appendChild(time);
-      // Most-recent on top: prepend new items and keep the view scrolled up.
-      feedEl.insertBefore(item, feedEl.firstChild);
-      feedEl.scrollTop = 0;
-    }
-    function startFeed() {
-      if (feedSource) {
-        try { feedSource.close(); } catch (_) { /* ignore */ }
-        feedSource = null;
-      }
-      if (typeof EventSource === 'undefined') return;
-      feedSource = new EventSource('/api/feed/stream');
-      feedSource.addEventListener('feed', function (ev) {
-        try { renderFeedItem(JSON.parse(ev.data)); } catch (_) { /* ignore malformed */ }
-      });
-      // EventSource auto-reconnects on error; no extra handling needed.
-    }
 
     // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
     // Full-text search \u2014 GET /api/search, grouped dropdown, click to open.
@@ -7916,52 +7814,6 @@ var appJs = `
       });
     }
 
-    // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-    // Activity rail resize \u2014 drag the left edge, clamp, persist.
-    // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-    var RAIL_MIN = 320, RAIL_MAX = 640, RAIL_KEY = 'lattice-rail-width';
-    function applyRailWidth(px) {
-      var w = Math.min(RAIL_MAX, Math.max(RAIL_MIN, Math.round(px)));
-      document.documentElement.style.setProperty('--sidebar-width', w + 'px');
-      return w;
-    }
-    function initRailResize() {
-      var saved = parseInt(window.localStorage.getItem(RAIL_KEY) || '', 10);
-      if (!isNaN(saved)) applyRailWidth(saved);
-      var handle = document.getElementById('rail-resize');
-      if (!handle) return;
-      handle.addEventListener('pointerdown', function (e) {
-        e.preventDefault();
-        var startX = e.clientX;
-        var rail = document.getElementById('assistant-rail');
-        var startW = rail ? rail.getBoundingClientRect().width : 380;
-        handle.classList.add('dragging');
-        function move(ev) {
-          // Rail sits on the right; dragging left (smaller clientX) widens it.
-          applyRailWidth(startW - (ev.clientX - startX));
-        }
-        function up() {
-          handle.classList.remove('dragging');
-          window.removeEventListener('pointermove', move);
-          window.removeEventListener('pointerup', up);
-          var cur = parseInt(
-            getComputedStyle(document.documentElement).getPropertyValue('--sidebar-width'),
-            10,
-          );
-          if (!isNaN(cur)) window.localStorage.setItem(RAIL_KEY, String(cur));
-        }
-        window.addEventListener('pointermove', move);
-        window.addEventListener('pointerup', up);
-      });
-    }
-
-    // Mobile: tapping the handle expands/collapses the bottom drawer.
-    function initRailDrawer() {
-      var handle = document.getElementById('rail-handle');
-      var rail = document.getElementById('assistant-rail');
-      if (handle && rail) handle.addEventListener('click', function () { rail.classList.toggle('expanded'); });
-    }
-
     /** Reload column meta after a secret-flag change. */
     function refreshColumnMeta() {
       return fetchJson('/api/gui-meta/columns').then(function (d) {
@@ -8112,10 +7964,10 @@ var appJs = `
         else renderRoute();
         loadedTables = {};
         startRealtime();
-        startFeed();
       });
     }
 
+    var wsOutsideClickBound = false;
     function renderWsSwitcher(data) {
       var wrap = document.getElementById('ws-switcher');
       var btn = document.getElementById('ws-button');
@@ -8173,8 +8025,13 @@ var appJs = `
             });
           });
         });
-        document.getElementById('ws-create-btn').addEventListener('click', function () {
-          showCreateWorkspaceInput(menu);
+        document.getElementById('ws-create-btn').addEventListener('click', function (e) {
+          // Stop propagation: showCreateWorkspaceInput replaces .db-create's
+          // innerHTML, detaching THIS button. Without this, the click then
+          // bubbles to the document outside-click closer, whose
+          // menu.contains(e.target) is now false (target detached) \u2192 it would
+          // close the menu, so the create input never appears.
+          e.stopPropagation(); showCreateWorkspaceInput(menu);
         });
       }
 
@@ -8183,12 +8040,20 @@ var appJs = `
         if (menu.hidden) buildMenu();
         menu.hidden = !menu.hidden;
       };
-      document.addEventListener('click', function (e) {
-        if (menu.hidden) return;
-        if (!menu.contains(e.target) && e.target !== btn && !btn.contains(e.target)) {
-          menu.hidden = true;
-        }
-      });
+      // Attach the outside-click closer ONCE \u2014 renderWsSwitcher runs on every
+      // reload, so adding it each time leaked a listener per render. Re-fetch
+      // the elements by id inside the handler so it never holds a stale closure.
+      if (!wsOutsideClickBound) {
+        wsOutsideClickBound = true;
+        document.addEventListener('click', function (e) {
+          var m = document.getElementById('ws-menu');
+          var b = document.getElementById('ws-button');
+          if (!m || m.hidden) return;
+          if (!m.contains(e.target) && e.target !== b && (!b || !b.contains(e.target))) {
+            m.hidden = true;
+          }
+        });
+      }
     }
 
     // Inline "new workspace" name entry, shown inside the Workspaces menu.
@@ -10288,7 +10153,9 @@ var appJs = `
       var linkRows = dmLinks.map(function (lk, i) {
         return '<div class="dm-link-row">' +
           '<span class="dm-link-name">' + escapeHtml(displayFor(lk.other).label) + '</span>' +
-          '<span class="dm-link-arrow">\u2194 many-to-many</span>' +
+          '<span class="dm-link-arrow' + (lk.kind === 'fk' ? ' legacy' : '') + '" ' +
+            (lk.kind === 'fk' ? 'title="Legacy one-to-many link. New links are many-to-many; this is kept for back-compat and will be migrated in 2.0."' : '') +
+            '>' + (lk.kind === 'fk' ? '\u2192 one-to-many (legacy)' : '\u2194 many-to-many') + '</span>' +
           '<button class="btn danger dm-link-destroy" data-link="' + i +
             '" title="Delete this link \u2014 removes it from both tables">Delete link</button>' +
           '</div>';
@@ -11569,11 +11436,11 @@ var appJs = `
         return (
           '<p style="margin:0 0 12px;color:var(--text-muted);font-size:13px">' +
             'SQLite DB: <code>' + escapeHtml(info.dbFile || '(unknown)') + '</code>. ' +
-            'Move forward by either pushing this data to a new cloud Postgres or connecting to an existing one.' +
+            'Push this workspace to a cloud Postgres to collaborate. ' +
+            '(To join an existing cloud, create a new workspace and choose \u201Cjoin via cloud invite\u201D.)' +
           '</p>' +
           '<div class="team-actions">' +
             '<button class="btn primary" data-act="open-migrate">Migrate to cloud \u2192</button>' +
-            '<button class="btn" data-act="open-connect-existing">Connect to existing cloud \u2192</button>' +
           '</div>'
         );
       }
@@ -11642,11 +11509,6 @@ var appJs = `
         showMigrateToCloudModal(rerender);
       });
 
-      var connectExBtn = host.querySelector('[data-act="open-connect-existing"]');
-      if (connectExBtn) connectExBtn.addEventListener('click', function () {
-        showConnectExistingModal(rerender);
-      });
-
       var upgradeBtn = host.querySelector('[data-act="open-upgrade"]');
       if (upgradeBtn) upgradeBtn.addEventListener('click', function () {
         showUpgradeToTeamModal(rerender);
@@ -12218,16 +12080,6 @@ var guiAppHtml = `<!doctype html>
       </div>
     </nav>
     <main id="content"></main>
-    <aside class="assistant-rail" id="assistant-rail">
-      <div class="rail-resize" id="rail-resize" role="separator" aria-orientation="vertical" title="Drag to resize"></div>
-      <div class="rail-handle" id="rail-handle" title="Expand / collapse"></div>
-      <div class="rail-header">
-        <span class="rail-title">Activity</span>
-      </div>
-      <div class="rail-feed" id="rail-feed">
-        <div class="rail-empty" id="rail-empty">No activity yet. Changes you make will appear here.</div>
-      </div>
-    </aside>
   </div>
 
   <div class="drawer-backdrop" id="drawer-backdrop" hidden></div>
@@ -13653,10 +13505,32 @@ async function createRow(ctx, table, values) {
   await emitTeamEnvelope(ctx, table, id, "upsert", row);
   return { id, row };
 }
+function storedValueMatches(stored, requested) {
+  if (stored === requested) return true;
+  const storedEmpty = stored === null || stored === void 0 || stored === "";
+  const reqEmpty = requested === null || requested === void 0 || requested === "";
+  if (storedEmpty && reqEmpty) return true;
+  if (typeof requested === "boolean") return Number(stored) === Number(requested);
+  if (typeof requested === "number") return Number(stored) === requested;
+  return String(stored) === String(requested);
+}
+function rowsEqual(a, b) {
+  const keys = /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)]);
+  for (const k of keys) if (a[k] !== b[k]) return false;
+  return true;
+}
 async function updateRow(ctx, table, id, values) {
   const before = await ctx.db.get(table, id);
   await ctx.db.update(table, id, values);
   const after = await ctx.db.get(table, id);
+  if (before != null && after != null) {
+    const wantedChange = Object.keys(values).some(
+      (k) => !storedValueMatches(before[k], values[k])
+    );
+    if (wantedChange && rowsEqual(before, after)) {
+      throw new Error("Row update did not persist \u2014 the data source may be read-only");
+    }
+  }
   await appendAudit(
     ctx.db,
     ctx.feed,
@@ -18194,6 +18068,14 @@ data: ${JSON.stringify(data)}
             sendJson(res, { error: `Unknown entity: ${oldName}` }, 400);
             return;
           }
+          if (isNativeEntity(oldName)) {
+            sendJson(
+              res,
+              { error: `"${oldName}" is a built-in entity and cannot be modified` },
+              400
+            );
+            return;
+          }
           if (!operatorOwnsTable(active.teamContext, oldName)) {
             sendJson(res, { error: "Only the table owner can edit this entity" }, 403);
             return;
@@ -18239,6 +18121,14 @@ data: ${JSON.stringify(data)}
             sendJson(res, { error: `Unknown entity: ${entityName}` }, 400);
             return;
           }
+          if (isNativeEntity(entityName)) {
+            sendJson(
+              res,
+              { error: `"${entityName}" is a built-in entity and cannot be modified` },
+              400
+            );
+            return;
+          }
           if (!operatorOwnsTable(active.teamContext, entityName)) {
             sendJson(res, { error: "Only the table owner can edit this entity" }, 403);
             return;
@@ -18266,12 +18156,22 @@ data: ${JSON.stringify(data)}
             sendJson(res, { error: "Use \u201CAdd link\u201D to create a relationship column" }, 400);
             return;
           }
+          const doc = loadConfigDoc(active.configPath);
+          const fieldsNode = doc.getIn(["entities", entityName, "fields"]);
+          if (!fieldsNode || typeof fieldsNode !== "object" || typeof fieldsNode.toJSON !== "function") {
+            sendJson(res, { error: `Cannot add columns to "${entityName}"` }, 400);
+            return;
+          }
+          const existingFields = fieldsNode.toJSON();
+          if (colName in existingFields) {
+            sendJson(res, { error: `Column "${colName}" already exists on ${entityName}` }, 400);
+            return;
+          }
           const sqliteType = fieldToSqliteBaseType(colType);
           await execSql(
             active.db,
             `ALTER TABLE "${entityName}" ADD COLUMN "${colName}" ${sqliteType}`
           );
-          const doc = loadConfigDoc(active.configPath);
           const fieldDef = { type: colType };
           if (body.required === true) fieldDef.required = true;
           doc.setIn(["entities", entityName, "fields", colName], fieldDef);
@@ -18298,6 +18198,14 @@ data: ${JSON.stringify(data)}
             sendJson(res, { error: `Unknown entity: ${entityName}` }, 400);
             return;
           }
+          if (isNativeEntity(entityName)) {
+            sendJson(
+              res,
+              { error: `"${entityName}" is a built-in entity and cannot be modified` },
+              400
+            );
+            return;
+          }
           if (!operatorOwnsTable(active.teamContext, entityName)) {
             sendJson(res, { error: "Only the table owner can edit this entity" }, 403);
             return;
@@ -18320,14 +18228,30 @@ data: ${JSON.stringify(data)}
             sendJson(res, { error: `"${newCol}" is a reserved system column` }, 400);
             return;
           }
+          const doc = loadConfigDoc(active.configPath);
+          const fieldsNode = doc.getIn(["entities", entityName, "fields"]);
+          if (!fieldsNode || typeof fieldsNode !== "object" || typeof fieldsNode.toJSON !== "function") {
+            sendJson(res, { error: `Cannot rename columns on "${entityName}"` }, 400);
+            return;
+          }
+          const fieldsObj = fieldsNode.toJSON();
+          if (!(colName in fieldsObj)) {
+            sendJson(res, { error: `Unknown column "${colName}" on ${entityName}` }, 400);
+            return;
+          }
+          if (newCol in fieldsObj) {
+            sendJson(res, { error: `Column "${newCol}" already exists on ${entityName}` }, 400);
+            return;
+          }
           await execSql(
             active.db,
             `ALTER TABLE "${entityName}" RENAME COLUMN "${colName}" TO "${newCol}"`
           );
-          const doc = loadConfigDoc(active.configPath);
-          const fieldDef = doc.getIn(["entities", entityName, "fields", colName]);
-          doc.deleteIn(["entities", entityName, "fields", colName]);
-          doc.setIn(["entities", entityName, "fields", newCol], fieldDef);
+          const renamedFields = {};
+          for (const k of Object.keys(fieldsObj)) {
+            renamedFields[k === colName ? newCol : k] = fieldsObj[k];
+          }
+          doc.setIn(["entities", entityName, "fields"], renamedFields);
           saveConfigDoc(active.configPath, doc);
           await disposeActive(active);
           active = await openConfig(active.configPath, active.outputDir, autoRender);
@@ -18569,10 +18493,12 @@ data: ${JSON.stringify(data)}
               (e) => e.table_name === filterTable || junctionMatchesFilter.has(e.table_name)
             );
           }
-          const allEntries = raw.map(parseAudit);
-          const liveCount = allEntries.filter((e) => e.undone === 0).length;
-          const undoneCount = allEntries.length - liveCount;
-          sendJson(res, { entries, canUndo: liveCount > 0, canRedo: undoneCount > 0 });
+          const sessionRows = await active.db.query("_lattice_gui_audit", {
+            filters: [{ col: "session_id", op: "eq", val: sessionId }]
+          });
+          const sessionLive = sessionRows.filter((r) => Number(r.undone) === 0).length;
+          const sessionUndone = sessionRows.length - sessionLive;
+          sendJson(res, { entries, canUndo: sessionLive > 0, canRedo: sessionUndone > 0 });
           return;
         }
         if (method === "POST" && pathname === "/api/history/undo") {

package/dist/index.cjs

@@ -3560,6 +3560,15 @@ function resolveDbPath(raw, configDir2) {
   }
   return (0, import_node_path11.resolve)(configDir2, raw);
 }
+var warnedDeprecatedRefs = /* @__PURE__ */ new Set();
+function warnDeprecatedRef(entity, field, target) {
+  const key = `${entity}.${field}`;
+  if (warnedDeprecatedRefs.has(key)) return;
+  warnedDeprecatedRefs.add(key);
+  console.warn(
+    `Lattice: one-to-many \`ref:\` on "${entity}.${field}" \u2192 "${target}" is deprecated in favor of many-to-many junction tables and will be removed in 2.0.`
+  );
+}
 function entityToTableDef(entityName, entity) {
   const rawFields = entity.fields;
   if (!rawFields || typeof rawFields !== "object" || Array.isArray(rawFields)) {
@@ -3582,6 +3591,7 @@ function entityToTableDef(entityName, entity) {
         table: field.ref,
         foreignKey: fieldName
       };
+      warnDeprecatedRef(entityName, fieldName, field.ref);
     }
   }
   const primaryKey = entity.primaryKey ?? pkFromField;

package/dist/index.js

@@ -3436,6 +3436,15 @@ function resolveDbPath(raw, configDir2) {
   }
   return resolve2(configDir2, raw);
 }
+var warnedDeprecatedRefs = /* @__PURE__ */ new Set();
+function warnDeprecatedRef(entity, field, target) {
+  const key = `${entity}.${field}`;
+  if (warnedDeprecatedRefs.has(key)) return;
+  warnedDeprecatedRefs.add(key);
+  console.warn(
+    `Lattice: one-to-many \`ref:\` on "${entity}.${field}" \u2192 "${target}" is deprecated in favor of many-to-many junction tables and will be removed in 2.0.`
+  );
+}
 function entityToTableDef(entityName, entity) {
   const rawFields = entity.fields;
   if (!rawFields || typeof rawFields !== "object" || Array.isArray(rawFields)) {
@@ -3458,6 +3467,7 @@ function entityToTableDef(entityName, entity) {
         table: field.ref,
         foreignKey: fieldName
       };
+      warnDeprecatedRef(entityName, fieldName, field.ref);
     }
   }
   const primaryKey = entity.primaryKey ?? pkFromField;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "latticesql",
-  "version": "1.16.0",
+  "version": "1.16.1",
   "description": "Persistent structured memory for AI agent systems — pluggable SQLite or Postgres backend, LLM context bridge",
   "type": "module",
   "main": "./dist/index.js",