latticesql 3.3.1 → 3.3.3

package/dist/cli.js

@@ -7417,6 +7417,10 @@ function isJunctionTable(table) {
   const fkCols = new Set(belongsTo.map((r6) => r6.foreignKey));
   return table.columns.every((c6) => fkCols.has(c6) || JUNCTION_ALLOWED_NONFK.has(c6));
 }
+function isJunctionByColumns(columns) {
+  const payload = columns.filter((c6) => !JUNCTION_ALLOWED_NONFK.has(c6));
+  return payload.length === 2 && payload.every((c6) => c6.endsWith("_id"));
+}
 function fileJunctions(configPath, outputDir) {
   const out = [];
   for (const t8 of getGuiEntities(configPath, outputDir).tables) {
@@ -12224,6 +12228,16 @@ var init_ingest_url = __esm({
 });
 
 // src/gui/ai/dispatch.ts
+function visibilityDenialReason(opts) {
+  if (opts.kind === "table") {
+    return opts.canManageTableDefault ? null : "Only the workspace owner can change a table's default sharing.";
+  }
+  if (!opts.rowAccess) return "That record was not found, or is not visible to you.";
+  if (!opts.rowAccess.ownedByMe) {
+    return "You do not own this record, so you cannot change its sharing \u2014 only its owner can.";
+  }
+  return null;
+}
 async function secretColumnsFor(db, table) {
   try {
     const rows = await db.query("_lattice_gui_column_meta", {
@@ -12449,6 +12463,14 @@ async function executeFunction(ctx, name, args) {
           };
         }
         const id = typeof args.id === "string" && args.id ? args.id : void 0;
+        const denial = id ? visibilityDenialReason({
+          kind: "row",
+          rowAccess: (await rowAccessSummaries(ctx.db, table, [id])).get(id)
+        }) : visibilityDenialReason({
+          kind: "table",
+          canManageTableDefault: await canManageRoles(ctx.db)
+        });
+        if (denial) return { ok: false, error: denial };
         try {
           if (id) {
             await setRowVisibility(ctx.db, table, id, visibility);
@@ -12612,6 +12634,7 @@ var init_dispatch = __esm({
     init_column_descriptions();
     init_members();
     init_table_policy();
+    init_cloud_connect();
     init_dedup_service();
     DISPATCHABLE = /* @__PURE__ */ new Set([
       "list_entities",
@@ -52440,6 +52463,7 @@ async function checkForUpdate(pkgName, currentVersion) {
 // src/gui/server.ts
 import { createServer } from "http";
 import { spawn as spawn2 } from "child_process";
+import { WebSocketServer, WebSocket } from "ws";
 import {
   existsSync as existsSync23,
   mkdirSync as mkdirSync11,
@@ -54314,6 +54338,31 @@ var appJs = `
         // Boot analytics with the resolved consent (no network contact when off),
         // then record the session open. advanced_mode is a boolean \u2014 safe to send.
         if (window.LatticeGA) window.LatticeGA.init(state.analyticsEffective);
+        // Deduplicate unique users in GA: set the GA user_id to a SHA-256 hash of
+        // the operator's email. Anonymized \u2014 the plaintext is hashed in-browser and
+        // never sent (analytics.ts only accepts a hex digest). Without a user_id,
+        // GA counts each session/device as a new user (active-users \u2248 events).
+        // Best-effort + only when analytics consent is on.
+        if (window.LatticeGA && state.analyticsEffective && window.crypto && window.crypto.subtle) {
+          fetchJson('/api/userconfig/identity')
+            .then(function (id) {
+              var email = id && id.email ? String(id.email).trim().toLowerCase() : '';
+              if (!email) return undefined;
+              return window.crypto.subtle
+                .digest('SHA-256', new TextEncoder().encode(email))
+                .then(function (buf) {
+                  var hex = Array.prototype.map
+                    .call(new Uint8Array(buf), function (b) {
+                      return ('0' + b.toString(16)).slice(-2);
+                    })
+                    .join('');
+                  window.LatticeGA.setUser(hex);
+                });
+            })
+            .catch(function () {
+              /* best-effort \u2014 GA still functions without a user_id */
+            });
+        }
         gaTrack('app_open', { advanced_mode: advancedMode() });
         document.body.classList.toggle('advanced-mode', advancedMode());
         wireSettingsDrawer();
@@ -54325,15 +54374,13 @@ var appJs = `
         wireHistoryControls();
         refreshHistoryState();
         renderRoute();
-        startRealtime();
-        startRenderProgress();
+        startEventStream();
         initSearch();
         initLastEdited();
         initOffline();
         initRailResize();
         initRailDrawer();
         initRailDragDrop();
-        startFeed();
         renderComposer();
         initThreadControls();
         checkNativeSetup();
@@ -54349,12 +54396,14 @@ var appJs = `
     }
 
     // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-    // Realtime \u2014 Server-Sent Events from /api/realtime/stream.
-    // One EventSource per session; on 'change' events we mark the
-    // current view dirty and refetch via afterMutation() (debounced
-    // to coalesce bursts). On 'state' events we drive the topbar pill.
+    // Realtime / feed / render-progress all arrive over ONE multiplexed
+    // WebSocket (/api/stream) \u2014 see startEventStream() below. A single
+    // connection per tab (instead of three SSE streams) keeps the browser's
+    // tiny per-host HTTP connection budget free for data requests, so clicking
+    // objects and switching workspaces stay responsive no matter how many tabs
+    // are open. 'change' events mark the current view dirty and refetch via
+    // afterMutation() (debounced); 'state' events drive the topbar pill.
     // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-    var realtimeSource = null;
     var realtimePending = null;
     // Team-cloud collaboration state. usersById resolves "last edited by"
     // names; lastEditedByPk maps "<table>|<pk>" \u2192 { userId, at } from realtime
@@ -54692,42 +54741,87 @@ var appJs = `
         afterMutation().catch(function () { /* swallow */ });
       }, 200);
     }
-    function startRealtime() {
-      if (realtimeSource) {
-        try { realtimeSource.close(); } catch (_) { /* ignore */ }
-        realtimeSource = null;
-      }
-      if (typeof EventSource === 'undefined') return;
-      realtimeSource = new EventSource('/api/realtime/stream');
-      realtimeSource.addEventListener('state', function (ev) {
-        try {
-          var data = JSON.parse(ev.data);
-          setStatusPill(data.mode || 'local', data.state || 'local');
-        } catch (_) { /* ignore malformed */ }
-      });
-      realtimeSource.addEventListener('change', function (ev) {
-        var p = null;
-        try { p = JSON.parse(ev.data); } catch (_) { /* ignore malformed */ }
-        if (p) onRealtimeChange(p);
+    // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    // Multiplexed event stream \u2014 ONE WebSocket carries realtime state/change,
+    // the activity feed, and background-render progress (previously three
+    // separate SSE streams). Holding one connection per tab instead of three
+    // keeps the browser's per-host HTTP budget free for data requests, so the
+    // GUI never freezes when several tabs are open. Each server message is
+    // { type, data }; we demux to the same handlers the SSE listeners used.
+    // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    var eventStream = null; // the active WebSocket (or null)
+    var eventStreamReconnect = null; // pending reconnect timer
+    var eventStreamBackoff = 1000; // reconnect delay, grows to a cap
+    var eventStreamClosed = false; // true \u21D2 closed on purpose (switch/teardown), don't reconnect
+    function dispatchStreamMessage(type, data) {
+      if (type === 'realtime-state') {
+        setStatusPill((data && data.mode) || 'local', (data && data.state) || 'local');
+      } else if (type === 'realtime-change') {
+        if (data) onRealtimeChange(data);
         scheduleRealtimeRefresh();
-      });
-      realtimeSource.onerror = function () {
-        // EventSource auto-reconnects; surface the disconnect on the pill
-        // until the server's 'state' event reports recovery.
+      } else if (type === 'feed') {
+        try { renderFeedItem(data); } catch (_) { /* render best-effort */ }
+        if (data && (data.table || data.op === 'schema')) scheduleRealtimeRefresh();
+      } else if (type === 'render-snapshot') {
+        if (data) applyRenderSnapshot(data);
+      } else if (type === 'render-progress') {
+        if (data) onRenderEvent(data);
+      }
+    }
+    function scheduleEventStreamReconnect() {
+      if (eventStreamClosed || eventStreamReconnect) return;
+      var delay = eventStreamBackoff;
+      eventStreamBackoff = Math.min(eventStreamBackoff * 2, 15000);
+      eventStreamReconnect = setTimeout(function () {
+        eventStreamReconnect = null;
+        startEventStream();
+      }, delay);
+    }
+    function stopEventStream() {
+      eventStreamClosed = true;
+      if (eventStreamReconnect) { clearTimeout(eventStreamReconnect); eventStreamReconnect = null; }
+      if (eventStream) {
+        // Drop the onclose handler first so an intentional close doesn't trip the
+        // reconnect/disconnect path.
+        try { eventStream.onclose = null; eventStream.close(); } catch (_) { /* ignore */ }
+        eventStream = null;
+      }
+    }
+    function startEventStream() {
+      stopEventStream();
+      eventStreamClosed = false;
+      if (typeof WebSocket === 'undefined') return;
+      var proto = location.protocol === 'https:' ? 'wss:' : 'ws:';
+      var ws;
+      try { ws = new WebSocket(proto + '//' + location.host + '/api/stream'); }
+      catch (_) { scheduleEventStreamReconnect(); return; }
+      eventStream = ws;
+      ws.onopen = function () { eventStreamBackoff = 1000; };
+      ws.onmessage = function (ev) {
+        var msg = null;
+        try { msg = JSON.parse(ev.data); } catch (_) { return; /* ignore malformed */ }
+        if (msg && msg.type) dispatchStreamMessage(msg.type, msg.data);
+      };
+      ws.onerror = function () { /* surfaced via onclose \u2192 reconnect */ };
+      ws.onclose = function () {
+        if (eventStream === ws) eventStream = null;
+        if (eventStreamClosed) return;
+        // Unexpected drop: show the disconnect on the pill and auto-reconnect with
+        // backoff (the server replays state + render snapshot on reconnect).
         setStatusPill('cloud', 'disconnected');
+        scheduleEventStreamReconnect();
       };
     }
 
     // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-    // Background-render progress \u2014 Server-Sent Events from
-    // /api/render/progress. A workspace opens/switches instantly and renders its
-    // context tree in the background; this paints a per-table % overlay on the
-    // dashboard cards (bottom-edge bar + \u27F3 pill) and dims the row count until
-    // each table completes. Row COUNTS come only from /api/entities \u2014 the render
-    // stream drives only the transient overlay and one reconciling refetch on
-    // completion. Mirrors the realtime EventSource pattern above.
+    // Background-render progress \u2014 render events arrive over the multiplexed
+    // /api/stream WebSocket (render-snapshot + render-progress). A workspace
+    // opens/switches instantly and renders its context tree in the background;
+    // this paints a per-table % overlay on the dashboard cards (bottom-edge bar +
+    // \u27F3 pill) and dims the row count until each table completes. Row COUNTS come
+    // only from /api/entities \u2014 the render events drive only the transient overlay
+    // and one reconciling refetch on completion.
     // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-    var renderSource = null;
     // { [table]: { pct, rendered, total, done, error } } \u2014 the live render state,
     // re-applied to cards after every dashboard rebuild (drawDashboard wipes the
     // DOM overlays but not this map).
@@ -54840,37 +54934,17 @@ var appJs = `
         }
       }
     }
-    function startRenderProgress() {
-      if (renderSource) {
-        try { renderSource.close(); } catch (_) { /* ignore */ }
-        renderSource = null;
-      }
-      if (typeof EventSource === 'undefined') return;
-      // On (re)connect, fetch the single-shot snapshot so a tab that connects
-      // mid- or post-render paints correctly even before the next event. The SSE
-      // endpoint ALSO replays a 'snapshot' event on connect, so both paths agree.
-      fetchJson('/api/render/status').then(applyRenderSnapshot).catch(function () { /* ignore */ });
-      renderSource = new EventSource('/api/render/progress');
-      renderSource.addEventListener('snapshot', function (ev) {
-        var snap = null;
-        try { snap = JSON.parse(ev.data); } catch (_) { /* ignore malformed */ }
-        if (snap) applyRenderSnapshot(snap);
-      });
-      renderSource.addEventListener('progress', function (ev) {
-        var e = null;
-        try { e = JSON.parse(ev.data); } catch (_) { /* ignore malformed */ }
-        if (e) onRenderEvent(e);
-      });
-      // EventSource auto-reconnects on error; the status refetch on the next
-      // open repaints from the authoritative snapshot.
-    }
+    // Render snapshot + progress are applied from the multiplexed /api/stream
+    // WebSocket: the server replays a render-snapshot on connect (so a tab that
+    // connects mid- or post-render paints correctly) and streams render-progress
+    // events thereafter. See dispatchStreamMessage / startEventStream.
 
     // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
     // Shared activity helpers \u2014 the operation-icon map and relative-time
     // formatter, used by Version History and the dashboard activity list. The
     // standalone Activity rail was removed in 1.16.1 (redundant with Version
-    // History); multiplayer realtime convergence runs on the separate realtime
-    // channel (startRealtime), not on this.
+    // History); multiplayer realtime convergence runs on the realtime-change
+    // messages of the multiplexed event stream (startEventStream), not on this.
     // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
     var FEED_ICONS = {
       insert: '\u2795', update: '\u270F\uFE0F', delete: '\u{1F5D1}',
@@ -55108,12 +55182,11 @@ var appJs = `
         if (location.hash !== '#/') location.hash = '#/';
         else renderRoute();
         loadedTables = {};
-        startRealtime();
-        // A switch swaps the server-side render bus to the new workspace; drop the
-        // old workspace's overlay state and re-subscribe so the new render streams
-        // onto this workspace's cards.
+        // A switch swaps the server-side buses to the new workspace; drop the old
+        // workspace's render overlay state and reconnect the multiplexed event
+        // stream so realtime/feed/render all rebind to this workspace.
         renderProgress = {};
-        startRenderProgress();
+        startEventStream();
       });
     }
 
@@ -55280,7 +55353,6 @@ var appJs = `
                 // to THIS workspace, and reload its thread list (+ latest convo).
                 newChat();
                 clearActivityFeed();
-                startFeed();
                 refreshThreadList(true);
                 showToast('Switched workspace', {});
               }).catch(function (err) { menu.hidden = true; endWsSwitching(true); showToast('Switch failed: ' + err.message, {}); });
@@ -55741,7 +55813,7 @@ var appJs = `
         function rowVisMarkup(tbl, r) {
           var a = r._access;
           if (!a) return '';
-          var vis = a.visibility;
+          var vis = effectiveVisibility(a);
           var glyph = vis === 'custom' ? '\u25CE' : '\u25C9';
           if (!a.ownedByMe) {
             var seen = vis === 'custom' ? 'Shared with you' : 'Visible to everyone';
@@ -56091,7 +56163,7 @@ var appJs = `
     function detailVisLineEl(row) {
       var a = row._access;
       if (!a) return '';
-      var vis = a.visibility;
+      var vis = effectiveVisibility(a);
       var labelMap = { everyone: 'Visible to everyone', private: 'Private to you', custom: 'Shared with specific people' };
       // Clear visual indicator: a lock when private, an eye when shared (everyone
       // or specific people), with a hover tooltip. The shared helper keeps the
@@ -56102,8 +56174,7 @@ var appJs = `
         return '<div class="detail-vis muted" style="display:flex;align-items:center;gap:6px;margin:6px 0;font-size:13px">' +
           visIcon + '<span>' + escapeHtml(seen) + '</span></div>';
       }
-      var info = labelMap[vis] || '';
-      if (vis === 'custom' && a.grantees) info += ' (' + a.grantees.length + ')';
+      var info = visInfoLabel(a);
       var buttons;
       if (vis === 'custom') {
         // Leaving custom stops the grant list from applying \u2014 the toggle
@@ -56158,9 +56229,12 @@ var appJs = `
         if (!panel) return;
         if (!panel.hidden) { panel.hidden = true; return; }
         var access = row._access || {};
-        var ensure = access.visibility === 'custom'
-          ? Promise.resolve()
-          : postVisibility('custom').then(function () { access.visibility = 'custom'; });
+        // Opening the panel must NOT pre-flip the row to 'custom' \u2014 that left a
+        // row the user never actually shared stuck at "custom (0)". The first
+        // grant flips it to custom server-side (lattice_grant_row); revoking the
+        // last leaves it custom-with-0-grantees, which now reads as private. So
+        // just load the member checklist.
+        var ensure = Promise.resolve();
         withBusy(detailVisManage, function () {
           return ensure.then(function () {
             return fetchJson('/api/cloud/members');
@@ -56194,8 +56268,13 @@ var appJs = `
                   var at = list.indexOf(role);
                   if (cb.checked && at === -1) list.push(role);
                   if (!cb.checked && at !== -1) list.splice(at, 1);
+                  // The first grant flips the row to custom server-side; mirror
+                  // that locally so the indicator updates. Revoking the last leaves
+                  // visibility 'custom' but effectiveVisibility renders custom-0 as
+                  // private, so the label flips back to "Private to you".
+                  if (list.length > 0) access.visibility = 'custom';
                   var infoEl = content.querySelector('#detail-vis-info');
-                  if (infoEl) infoEl.textContent = 'Shared with specific people (' + list.length + ')';
+                  if (infoEl) infoEl.textContent = visInfoLabel(access);
                   invalidate(tableName);
                 }).catch(function (e) {
                   cb.checked = !cb.checked; // revert the failed change
@@ -56203,10 +56282,8 @@ var appJs = `
                 }).then(function () { cb.disabled = false; });
               });
             });
-            if (access.visibility === 'custom') {
-              var infoEl = content.querySelector('#detail-vis-info');
-              if (infoEl) infoEl.textContent = 'Shared with specific people (' + (access.grantees || []).length + ')';
-            }
+            var infoEl = content.querySelector('#detail-vis-info');
+            if (infoEl) infoEl.textContent = visInfoLabel(access);
           }).catch(function (e) { showToast('Could not load members: ' + e.message, {}); });
         });
       });
@@ -58317,6 +58394,29 @@ var appJs = `
     var EYE_SVG =
       '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">' +
         '<path d="M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7-10-7-10-7z"/><circle cx="12" cy="12" r="3"/></svg>';
+    // A custom row with zero grantees is effectively PRIVATE (RLS shows it only to
+    // the owner), so it must read as private, not "Shared with specific people
+    // (0)". Only collapse for the OWNER's own view, where the grantees list is
+    // authoritative \u2014 a member viewing a row shared WITH them gets custom with no
+    // grantees list and must still read as "Shared with you".
+    function effectiveVisibility(access) {
+      if (!access || !access.visibility) return 'private';
+      if (access.visibility === 'custom' && access.ownedByMe &&
+        (!access.grantees || access.grantees.length === 0)) {
+        return 'private';
+      }
+      return access.visibility;
+    }
+    // Owner-facing status label for a row's sharing, honoring effectiveVisibility
+    // (so custom-0 reads as "Private to you") and appending the grantee count only
+    // for a genuine specific-people share.
+    function visInfoLabel(access) {
+      var v = effectiveVisibility(access);
+      var map = { everyone: 'Visible to everyone', private: 'Private to you', custom: 'Shared with specific people' };
+      var s = map[v] || '';
+      if (v === 'custom' && access && access.grantees) s += ' (' + access.grantees.length + ')';
+      return s;
+    }
     // Shared per-row lock/eye indicator, reused on the entity-detail header and the
     // fs card tiles so the meaning is consistent. The access arg is the server-
     // attached row._access (visibility + ownedByMe); returns empty when absent (a
@@ -58324,7 +58424,7 @@ var appJs = `
     // A hover tooltip spells out what the lock/eye means (state + ownership aware).
     function visIndicator(access, extraClass) {
       if (!access || !access.visibility) return '';
-      var vis = access.visibility;
+      var vis = effectiveVisibility(access);
       var tip = vis === 'private'
         ? 'Private \u2014 only you can see this'
         : vis === 'custom'
@@ -60113,7 +60213,6 @@ var appJs = `
 
 
     // ============ AI assistant rail (2.0) ============
-    var feedSource = null;
     var FEED_ICONS = {
       insert: '\u2795', update: '\u270F\uFE0F', delete: '\u{1F5D1}',
       link: '\u{1F517}', unlink: '\u26D3', undo: '\u21B6', redo: '\u21B7', schema: '\u{1F6E0}',
@@ -60366,32 +60465,13 @@ var appJs = `
         else { card.timeEl.textContent = formatElapsed(Math.max(0, evMs - startMs)); }
       }
     }
-    function startFeed() {
-      if (feedSource) {
-        try { feedSource.close(); } catch (_) { /* ignore */ }
-        feedSource = null;
-      }
-      if (typeof EventSource === 'undefined') return;
-      feedSource = new EventSource('/api/feed/stream');
-      feedSource.addEventListener('feed', function (ev) {
-        var data;
-        try { data = JSON.parse(ev.data); } catch (_) { return; /* ignore malformed */ }
-        try { renderFeedItem(data); } catch (_) { /* render best-effort */ }
-        // Refresh on ANY data mutation, not just schema/new-table events. The
-        // local feed bus delivers every insert/update/delete/link even when
-        // there's no realtime broker (SQLite/local), so this is what makes the
-        // home dashboard counts AND the open entity view live-update without a
-        // manual reload (previously only schema ops or brand-new tables did).
-        // scheduleRealtimeRefresh is debounced (200ms) so a burst from one
-        // ingest still coalesces into a single refetch \u2014 and on Postgres/cloud
-        // it shares that debounce with the realtime 'change' handler (no double
-        // fetch). /api/entities batches its row counts into one query, not N.
-        if (data && (data.table || data.op === 'schema')) {
-          scheduleRealtimeRefresh();
-        }
-      });
-      // EventSource auto-reconnects on error; no extra handling needed.
-    }
+    // Feed events arrive over the multiplexed /api/stream WebSocket and are
+    // handled in dispatchStreamMessage('feed', \u2026): renderFeedItem() paints the
+    // card, then scheduleRealtimeRefresh() refetches on ANY data mutation (the
+    // local feed bus delivers every insert/update/delete/link even with no
+    // realtime broker, so this is what live-updates the dashboard counts and the
+    // open entity view without a manual reload). The 200ms debounce coalesces a
+    // burst into a single refetch and is shared with the realtime 'change' path.
 
     // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
     // Assistant rail resize \u2014 drag the left edge, clamp, persist.
@@ -61087,6 +61167,16 @@ var analyticsJs = `
         page_title: t,
       });
     },
+    // Set the GA user_id to an OPAQUE per-user hash so active users are
+    // deduplicated across sessions/devices (without it, unique users \u2248 events).
+    // Accepts ONLY a 64-char hex digest \u2014 a raw email or any other PII is
+    // rejected (never sent), preserving the privacy contract above. The caller
+    // hashes the email; this module never sees the plaintext.
+    setUser: function (idHash) {
+      if (!consent || !loaded) return;
+      if (typeof idHash !== 'string' || !/^[a-f0-9]{64}$/.test(idHash)) return;
+      gtag('config', MEASUREMENT_ID, { user_id: idHash });
+    },
   };
 })();
 `;
@@ -61676,6 +61766,44 @@ async function reconcileCloudMemberAccess(db) {
       );
     }
   }
+  const memberSystemGrants = [
+    ["_lattice_gui_meta", "SELECT, INSERT, UPDATE"],
+    ["_lattice_gui_column_meta", "SELECT, INSERT, UPDATE"],
+    ["_lattice_gui_audit", "SELECT, INSERT"],
+    ["__lattice_user_identity", "SELECT, INSERT, UPDATE"]
+  ];
+  for (const [tbl, privs] of memberSystemGrants) {
+    await runAsyncOrSync(
+      db.adapter,
+      `DO $LATTICE$ BEGIN
+         IF to_regclass('${tbl}') IS NOT NULL THEN
+           EXECUTE 'GRANT ${privs} ON "${tbl}" TO ${MEMBER_GROUP}';
+         END IF;
+       END $LATTICE$`
+    );
+  }
+  try {
+    await runAsyncOrSync(
+      db.adapter,
+      `GRANT EXECUTE ON FUNCTION json_extract(text, text), strftime(text, text) TO ${MEMBER_GROUP}`
+    );
+  } catch (err) {
+    console.warn(
+      "[reconcileCloudMemberAccess] could not grant EXECUTE on polyfills (will retry next open):",
+      err instanceof Error ? err.message : String(err)
+    );
+  }
+  for (const table of registered) {
+    if (table.startsWith("__lattice_") || table.startsWith("_lattice_")) continue;
+    const cols = db.getRegisteredColumns(table);
+    if (cols && !("deleted_at" in cols)) {
+      const q3 = `"${table.replace(/"/g, '""')}"`;
+      await runAsyncOrSync(
+        db.adapter,
+        `ALTER TABLE ${q3} ADD COLUMN IF NOT EXISTS "deleted_at" TEXT`
+      );
+    }
+  }
 }
 async function secureNewCloudTable(db, table, pk) {
   if (db.getDialect() !== "postgres") return;
@@ -61701,14 +61829,6 @@ async function secureCloud(db) {
     await secureNewCloudTable(db, table, db.getPrimaryKey(table));
   }
   await reconcileCloudMemberAccess(db);
-  await runAsyncOrSync(
-    db.adapter,
-    `DO $LATTICE$ BEGIN
-       IF to_regclass('__lattice_user_identity') IS NOT NULL THEN
-         EXECUTE 'GRANT SELECT, INSERT, UPDATE ON "__lattice_user_identity" TO ${MEMBER_GROUP}';
-       END IF;
-     END $LATTICE$`
-  );
 }
 
 // src/gui/meta-gen.ts
@@ -65194,19 +65314,36 @@ async function openConfig(configPath, outputDir, autoRender = false, realtimeWat
   }
   let memberOpen = false;
   const maskedReadViews = /* @__PURE__ */ new Map();
+  const discoveredJunctions = /* @__PURE__ */ new Set();
   if (db.getDialect() === "postgres") {
     const peek = new Lattice({ config: configPath }, { encryptionKey });
     try {
       await peek.init({ introspectOnly: true });
-      if (await cloudRlsInstalled(peek)) {
-        memberOpen = !await canManageRoles(peek);
+      const [rlsInstalled, canManage] = await Promise.all([
+        cloudRlsInstalled(peek),
+        canManageRoles(peek)
+      ]);
+      if (rlsInstalled) {
+        memberOpen = !canManage;
         if (memberOpen) {
           const declared = new Set(db.getRegisteredTableNames());
-          const discovered = await discoverCloudTables(peek);
+          const [discovered, viewsRaw] = await Promise.all([
+            discoverCloudTables(peek),
+            allAsyncOrSync(
+              peek.adapter,
+              `SELECT table_name AS name FROM information_schema.views
+                 WHERE table_schema = current_schema() AND table_name LIKE '%\\_v' ESCAPE '\\'`
+            )
+          ]);
+          const views = viewsRaw;
           const knownTables = /* @__PURE__ */ new Set([...declared, ...discovered.map((t8) => t8.name)]);
           for (const t8 of discovered) {
             if (declared.has(t8.name)) continue;
             if (t8.columns.length === 0) continue;
+            if (isJunctionByColumns(t8.columns)) {
+              discoveredJunctions.add(t8.name);
+              continue;
+            }
             db.define(t8.name, {
               columns: Object.fromEntries(t8.columns.map((c6) => [c6, "TEXT"])),
               ...t8.pk.length > 0 ? { primaryKey: t8.pk.length === 1 ? t8.pk[0] : t8.pk } : {},
@@ -65214,11 +65351,6 @@ async function openConfig(configPath, outputDir, autoRender = false, realtimeWat
               outputFile: `${t8.name}/.lattice/${t8.name}.md`
             });
           }
-          const views = await allAsyncOrSync(
-            peek.adapter,
-            `SELECT table_name AS name FROM information_schema.views
-               WHERE table_schema = current_schema() AND table_name LIKE '%\\_v' ESCAPE '\\'`
-          );
           for (const { name } of views) {
             const base = name.slice(0, -2);
             if (knownTables.has(base)) maskedReadViews.set(base, name);
@@ -65255,9 +65387,12 @@ async function openConfig(configPath, outputDir, autoRender = false, realtimeWat
     if (name.startsWith("__lattice_") || name.startsWith("_lattice_")) continue;
     validTables.add(name);
   }
-  const junctionTables = new Set(
-    getGuiEntities(configPath, outputDir).tables.filter(isJunctionTable).map((t8) => t8.name)
-  );
+  const junctionTables = /* @__PURE__ */ new Set([
+    ...getGuiEntities(configPath, outputDir).tables.filter(isJunctionTable).map((t8) => t8.name),
+    // Member-discovered junctions (classified from the physical shape above);
+    // empty for an owner/local open.
+    ...discoveredJunctions
+  ]);
   const entityContextByTable = db.entityContexts();
   const manifest = readManifest(outputDir);
   const softDeletable = /* @__PURE__ */ new Set();
@@ -65458,6 +65593,9 @@ async function changeVisibleToActiveRole(db, payload) {
 function isDeleteOp(op) {
   return op === "delete" || op === "DELETE";
 }
+function isFeedHiddenTable(t8) {
+  return t8.startsWith("_lattice") || t8.startsWith("__lattice") || isInternalNativeEntity(t8);
+}
 function readRelationFor(active, table) {
   return active.maskedReadViews.get(table) ?? table;
 }
@@ -65839,158 +65977,10 @@ async function startGuiServer(options) {
           sendJson(res, { mode, state: active.realtime?.state() ?? "local", connected });
           return;
         }
-        if (method === "GET" && pathname === "/api/realtime/stream") {
-          res.writeHead(200, {
-            "content-type": "text/event-stream; charset=utf-8",
-            "cache-control": "no-store, no-transform",
-            connection: "keep-alive",
-            "x-accel-buffering": "no"
-          });
-          const broker = active.realtime;
-          const initialMode = broker ? "cloud" : "local";
-          const writeEvent = (event, data) => {
-            try {
-              res.write(`event: ${event}
-data: ${JSON.stringify(data)}
-
-`);
-            } catch {
-            }
-          };
-          writeEvent("state", {
-            mode: initialMode,
-            state: broker?.state() ?? "local"
-          });
-          const keepalive = setInterval(() => {
-            try {
-              res.write(`: keepalive
-
-`);
-            } catch {
-            }
-          }, 25e3);
-          const offState = broker?.subscribeState((state2) => {
-            writeEvent("state", { mode: "cloud", state: state2 });
-          });
-          const offPayload = broker?.subscribePayload((payload) => {
-            if (activeRef !== active) return;
-            void changeVisibleToActiveRole(active.db, payload).then((visible) => {
-              if (!visible) return;
-              const out = isDeleteOp(payload.op) ? { ...payload, owner_role: null } : payload;
-              writeEvent("change", out);
-            });
-          });
-          const cleanup = () => {
-            clearInterval(keepalive);
-            if (offState) offState();
-            if (offPayload) offPayload();
-          };
-          req.on("close", cleanup);
-          req.on("error", cleanup);
-          return;
-        }
-        if (method === "GET" && pathname === "/api/feed/stream") {
-          res.writeHead(200, {
-            "content-type": "text/event-stream; charset=utf-8",
-            "cache-control": "no-store, no-transform",
-            connection: "keep-alive",
-            "x-accel-buffering": "no"
-          });
-          const writeFeed = (data) => {
-            try {
-              res.write(`event: feed
-data: ${JSON.stringify(data)}
-
-`);
-            } catch {
-            }
-          };
-          const keepalive = setInterval(() => {
-            try {
-              res.write(`: keepalive
-
-`);
-            } catch {
-            }
-          }, 25e3);
-          const recentSelf = /* @__PURE__ */ new Map();
-          const isFeedHiddenTable = (t8) => t8.startsWith("_lattice") || t8.startsWith("__lattice") || isInternalNativeEntity(t8);
-          const offFeed = active.feed.subscribe((e6) => {
-            if (e6.table && isFeedHiddenTable(e6.table)) return;
-            recentSelf.set(`${e6.table ?? ""}:${e6.rowId ?? ""}:${e6.op}`, Date.now());
-            writeFeed(e6);
-          });
-          const offBroker = active.realtime?.subscribePayload((p3) => {
-            const op = feedOpForChange(p3.op);
-            if (!op || !p3.table_name || isFeedHiddenTable(p3.table_name)) return;
-            const tableName = p3.table_name;
-            const key = `${tableName}:${p3.pk ?? ""}:${op}`;
-            const seen = recentSelf.get(key);
-            if (seen && Date.now() - seen < 5e3) return;
-            if (activeRef !== active) return;
-            void changeVisibleToActiveRole(active.db, p3).then((visible) => {
-              if (!visible) return;
-              writeFeed({
-                seq: p3.seq,
-                table: tableName,
-                op,
-                rowId: p3.pk,
-                source: "cli",
-                actor: isDeleteOp(p3.op) ? void 0 : p3.owner_role ?? void 0,
-                ts: p3.created_at || (/* @__PURE__ */ new Date()).toISOString(),
-                summary: `${op} on ${tableName} (another client)`
-              });
-            });
-          });
-          const cleanup = () => {
-            clearInterval(keepalive);
-            offFeed();
-            if (offBroker) offBroker();
-          };
-          req.on("close", cleanup);
-          req.on("error", cleanup);
-          return;
-        }
         if (method === "GET" && pathname === "/api/render/status") {
           sendJson(res, active.renderState);
           return;
         }
-        if (method === "GET" && pathname === "/api/render/progress") {
-          res.writeHead(200, {
-            "content-type": "text/event-stream; charset=utf-8",
-            "cache-control": "no-store, no-transform",
-            connection: "keep-alive",
-            "x-accel-buffering": "no"
-          });
-          const writeEvent = (event, data) => {
-            try {
-              res.write(`event: ${event}
-data: ${JSON.stringify(data)}
-
-`);
-            } catch {
-            }
-          };
-          writeEvent("snapshot", active.renderState);
-          const keepalive = setInterval(() => {
-            try {
-              res.write(`: keepalive
-
-`);
-            } catch {
-            }
-          }, 25e3);
-          const offProgress = active.renderProgress.subscribe((e6) => {
-            writeEvent("progress", e6);
-          });
-          const cleanup = () => {
-            clearInterval(keepalive);
-            offProgress();
-          };
-          req.on("close", cleanup);
-          req.on("error", cleanup);
-          return;
-        }
         if (method === "GET" && pathname === "/api/project") {
           sendJson(res, getGuiProject(active.configPath, active.outputDir));
           return;
@@ -67508,6 +67498,107 @@ ${e6.stack ?? ""}`
       }
     })();
   });
+  const wss = new WebSocketServer({ noServer: true });
+  const handleEventStream = (ws) => {
+    const bound = activeRef;
+    const send = (type, data) => {
+      if (ws.readyState !== WebSocket.OPEN) return;
+      try {
+        ws.send(JSON.stringify({ type, data }));
+      } catch {
+      }
+    };
+    const broker = bound?.realtime ?? null;
+    send("realtime-state", { mode: broker ? "cloud" : "local", state: broker?.state() ?? "local" });
+    if (bound) send("render-snapshot", bound.renderState);
+    const offs = [];
+    if (bound) {
+      if (broker) {
+        offs.push(
+          broker.subscribeState((state2) => {
+            send("realtime-state", { mode: "cloud", state: state2 });
+          })
+        );
+        offs.push(
+          broker.subscribePayload((payload) => {
+            if (activeRef !== bound) return;
+            void changeVisibleToActiveRole(bound.db, payload).then((visible) => {
+              if (!visible) return;
+              const out = isDeleteOp(payload.op) ? { ...payload, owner_role: null } : payload;
+              send("realtime-change", out);
+            });
+          })
+        );
+      }
+      const recentSelf = /* @__PURE__ */ new Map();
+      offs.push(
+        bound.feed.subscribe((e6) => {
+          if (e6.table && isFeedHiddenTable(e6.table)) return;
+          recentSelf.set(`${e6.table ?? ""}:${e6.rowId ?? ""}:${e6.op}`, Date.now());
+          send("feed", e6);
+        })
+      );
+      if (broker) {
+        offs.push(
+          broker.subscribePayload((p3) => {
+            const op = feedOpForChange(p3.op);
+            if (!op || !p3.table_name || isFeedHiddenTable(p3.table_name)) return;
+            const tableName = p3.table_name;
+            const key = `${tableName}:${p3.pk ?? ""}:${op}`;
+            const seen = recentSelf.get(key);
+            if (seen && Date.now() - seen < 5e3) return;
+            if (activeRef !== bound) return;
+            void changeVisibleToActiveRole(bound.db, p3).then((visible) => {
+              if (!visible) return;
+              send("feed", {
+                seq: p3.seq,
+                table: tableName,
+                op,
+                rowId: p3.pk,
+                source: "cli",
+                actor: isDeleteOp(p3.op) ? void 0 : p3.owner_role ?? void 0,
+                ts: p3.created_at || (/* @__PURE__ */ new Date()).toISOString(),
+                summary: `${op} on ${tableName} (another client)`
+              });
+            });
+          })
+        );
+      }
+      offs.push(
+        bound.renderProgress.subscribe((e6) => {
+          send("render-progress", e6);
+        })
+      );
+    }
+    const keepalive = setInterval(() => {
+      if (ws.readyState !== WebSocket.OPEN) return;
+      try {
+        ws.ping();
+      } catch {
+      }
+    }, 25e3);
+    const cleanup = () => {
+      clearInterval(keepalive);
+      for (const off of offs) {
+        try {
+          off();
+        } catch {
+        }
+      }
+    };
+    ws.on("close", cleanup);
+    ws.on("error", cleanup);
+  };
+  server.on("upgrade", (req, socket, head) => {
+    const { pathname } = new URL(req.url ?? "/", `http://${host}`);
+    if (pathname !== "/api/stream") {
+      socket.destroy();
+      return;
+    }
+    wss.handleUpgrade(req, socket, head, (ws) => {
+      handleEventStream(ws);
+    });
+  });
   const port = await listenWithPortFallback(server, startPort, host);
   if (activeRef) startBackgroundRender(activeRef);
   const displayHost = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
@@ -67518,6 +67609,13 @@ ${e6.stack ?? ""}`
     port,
     url,
     close: () => new Promise((resolveClose, reject) => {
+      for (const client of wss.clients) {
+        try {
+          client.terminate();
+        } catch {
+        }
+      }
+      wss.close();
       server.close((err) => {
         if (err) {
           reject(err);
@@ -67715,6 +67813,7 @@ function printHelp() {
   );
 }
 function getVersion() {
+  if (true) return "3.3.3";
   try {
     const pkgPath = new URL("../package.json", import.meta.url).pathname;
     const pkg = JSON.parse(readFileSync18(pkgPath, "utf-8"));