sporades 0.8.1 → 0.8.3

package/CHANGES.md

@@ -1,5 +1,17 @@
 # Changes
 
+## Unreleased - 2026-08-15
+
+Changes since v0.8.1.
+
+### 🚀 Features
+
+- Add exact pagination and join admission (63f68a0).
+
+### 🐛 Bug Fixes
+
+- Resolve npm audit vulnerabilities (a6a4b51).
+
 ## 0.8.1 - 2026-08-14
 
 Corrects the incomplete `0.8.0` package release with the merged `main` runtime,
@@ -16,3 +28,4 @@ generated artifacts, and documentation.
   explicit Team decisions in table and File ACLs. Teams are built in but do
   not select a current Team or automatically partition Capsule data; Sporades
   never sends Join-link email. See the [Built-in Teams reference](https://mgscox.github.io/sporades/reference/teams).
+

package/bin/sporades-host-helper.js

@@ -418,7 +418,7 @@ function writeEnvelope(result, failed = false) {
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.8.1";
+var CLI_VERSION = "0.8.3";
 
 // src/cli/schedule-inspection-envelope.ts
 function sanitizeScheduleInspectionEnvelope(envelope, invalid) {

package/bin/sporades.js

@@ -68,8 +68,8 @@ export const teams = {
   rename(teamId, name) {
     return connect().teamsRename(teamId, name);
   },
-  listMembers(teamId) {
-    return connect().teamsListMembers(teamId);
+  listMembers(teamId, options = {}) {
+    return connect().teamsListMembers(teamId, options);
   },
   updateApplicationRoles(teamId, userId, changes) {
     return connect().teamsUpdateApplicationRoles(teamId, userId, changes);
@@ -1117,7 +1117,7 @@ function createConnection() {
     teamsList() { return request("teams.list"); },
     teamsCreate(name) { return request("teams.create", { name }); },
     teamsRename(teamId, name) { return request("teams.rename", { teamId, name }); },
-    teamsListMembers(teamId) { return request("teams.listMembers", { teamId }); },
+    teamsListMembers(teamId, options = {}) { return request("teams.listMembers", { teamId, cursor: options.cursor, limit: options.limit }); },
     teamsUpdateApplicationRoles(teamId, userId, changes) { return request("teams.updateApplicationRoles", { teamId, userId, add: changes?.add, remove: changes?.remove }); },
     teamsCreateJoinLink(teamId, email, options = {}) { return request("teams.createJoinLink", { teamId, email, ttlSeconds: options.ttlSeconds }); },
     teamsListJoinLinks(teamId) { return request("teams.listJoinLinks", { teamId }); },
@@ -8477,6 +8477,7 @@ var INITIAL_TEAM_NAME = "My Team";
 var TEAM_NAME_MAX_BYTES = 80;
 var TEAM_MEMBER_COUNT_MAX = 99;
 var TEAM_MEMBER_LIST_MAX = 100;
+var TEAM_MEMBER_LIST_DEFAULT = TEAM_MEMBER_LIST_MAX;
 var TEAM_MEMBERSHIP_MAX = 25;
 var TEAM_BOOTSTRAP_RETRY_LIMIT = 5;
 var TEAM_JOIN_LINK_DEFAULT_TTL_SECONDS = 60 * 60 * 24;
@@ -8538,9 +8539,9 @@ function createCurrentUserTeamsApi(database, auth, contextGetter) {
       requireAuth({ auth }, { linked: true });
       return renameCurrentUserTeam(database, auth, teamId, name, contextGetter?.());
     },
-    async listMembers(teamId) {
+    async listMembers(teamId, options = {}) {
       requireAuth({ auth }, { linked: true });
-      return listTeamMembers(database, auth, teamId);
+      return listTeamMembers(database, auth, teamId, options);
     },
     async updateApplicationRoles(teamId, userId, changes) {
       requireAuth({ auth }, { linked: true });
@@ -8806,6 +8807,7 @@ async function joinCurrentUserTeam(database, auth, code, eventContext) {
         "SELECT [role] FROM [sporades_team_memberships] WHERE [teamId] = ? AND [userId] = ?"
       )).get(row.teamId, auth.userId);
       if (!membership) {
+        await enforceTeamJoinAdmission(database, tx, auth, String(row.teamId));
         await ensureMembershipCounterOnAdapter(tx, auth.userId);
         const claim = await tx.prepare(sql(
           "UPDATE [sporades_team_membership_counters] SET [membershipCount] = [membershipCount] + 1 WHERE [userId] = ? AND [membershipCount] < ?"
@@ -8829,6 +8831,23 @@ async function joinCurrentUserTeam(database, auth, code, eventContext) {
   emitTeamSecurityEvent(database, eventContext, "teams.joined", auth.userId, joined.id, "succeeded", "TEAM_JOINED");
   return { team: joined };
 }
+async function enforceTeamJoinAdmission(database, tx, auth, teamId) {
+  if (typeof database.teamJoinAdmission !== "function") return;
+  const count = await tx.prepare(tx.dialect.sql(
+    "SELECT COUNT(*) AS [count] FROM [sporades_team_memberships] WHERE [teamId] = ?"
+  )).get(teamId);
+  try {
+    const context = database.createTeamJoinAdmissionContext(tx, auth);
+    const decision = await database.teamJoinAdmission(context, {
+      teamId,
+      userId: auth.userId,
+      currentMemberCount: Number(count?.count ?? 0)
+    });
+    if (decision?.allow !== true) throw teamJoinDenied();
+  } catch {
+    throw teamJoinDenied();
+  }
+}
 function normalizeTeamJoinEmail(email) {
   const normalized = String(email ?? "").trim().toLowerCase();
   if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) {
@@ -8949,6 +8968,9 @@ function teamJoinLinkLimitError() {
 function invalidTeamJoinLink() {
   return commandError2("Join link is invalid.", "Use a current Join link for this linked account.", "INVALID_JOIN_LINK");
 }
+function teamJoinDenied() {
+  return commandError2("Could not join this Team.", "Ask a Team administrator for access.", "TEAM_JOIN_DENIED");
+}
 async function listCurrentUserTeams(database, auth) {
   requireAuth({ auth }, { linked: true });
   await ensureInitialTeam(database, auth);
@@ -9159,7 +9181,7 @@ async function deleteCurrentUserTeam(database, auth, teamId, eventContext) {
   emitTeamSecurityEvent(database, eventContext, "teams.deleted", auth.userId, teamId, "succeeded", "TEAM_DELETED");
   return { deleted: true };
 }
-async function listTeamMembers(database, auth, teamId) {
+async function listTeamMembers(database, auth, teamId, options = {}) {
   requireAuth({ auth }, { linked: true });
   if (!isOpaqueTeamId(teamId)) throw teamDenied();
   return withTeamTransaction(database, async (tx) => {
@@ -9168,20 +9190,57 @@ async function listTeamMembers(database, auth, teamId) {
       "SELECT [role] FROM [sporades_team_memberships] WHERE [teamId] = ? AND [userId] = ?"
     )).get(teamId, auth.userId);
     if (callerMembership?.role !== "admin") throw teamDenied();
+    const page = normalizeTeamMemberPage(options);
+    const total = await tx.prepare(sql(
+      "SELECT COUNT(*) AS [count] FROM [sporades_team_memberships] WHERE [teamId] = ?"
+    )).get(teamId);
+    const cursorClause = page.cursor ? "AND ([m].[createdAt] > ? OR ([m].[createdAt] = ? AND [m].[userId] > ?)) " : "";
+    const params = page.cursor ? [teamId, page.cursor.createdAt, page.cursor.createdAt, page.cursor.userId, page.limit + 1] : [teamId, page.limit + 1];
     const rows = await tx.prepare(sql(
-      "SELECT [m].[userId], [u].[displayName], [u].[picture], [m].[role] FROM [sporades_team_memberships] [m] JOIN [sporades_auth_users] [u] ON [u].[id] = [m].[userId] WHERE [m].[teamId] = ? ORDER BY [m].[createdAt] ASC, [m].[userId] ASC LIMIT ?"
-    )).all(teamId, TEAM_MEMBER_LIST_MAX);
+      "SELECT [m].[userId], [u].[displayName], [u].[picture], [m].[role] , [m].[createdAt] FROM [sporades_team_memberships] [m] JOIN [sporades_auth_users] [u] ON [u].[id] = [m].[userId] WHERE [m].[teamId] = ? " + cursorClause + "ORDER BY [m].[createdAt] ASC, [m].[userId] ASC LIMIT ?"
+    )).all(...params);
+    const hasMore = rows.length > page.limit;
+    const pageRows = hasMore ? rows.slice(0, page.limit) : rows;
+    const last = pageRows.at(-1);
     return {
-      members: await Promise.all(rows.map(async (row) => ({
+      members: await Promise.all(pageRows.map(async (row) => ({
         userId: String(row.userId),
         displayName: String(row.displayName),
         picture: typeof row.picture === "string" && row.picture.length > 0 ? row.picture : null,
         role: row.role === "admin" ? "admin" : "member",
         applicationRoles: await activeTeamApplicationRoles(tx, database.teamApplicationRoles, teamId, row.userId)
-      })))
+      }))),
+      ...hasMore && last ? { nextCursor: encodeTeamMemberCursor(String(last.createdAt), String(last.userId)) } : {},
+      totalCount: Number(total?.count ?? 0)
     };
   });
 }
+function normalizeTeamMemberPage(options) {
+  if (!options || typeof options !== "object" || Array.isArray(options)) throw invalidTeamMemberPage();
+  const limit = options.limit === void 0 ? TEAM_MEMBER_LIST_DEFAULT : options.limit;
+  if (!Number.isInteger(limit) || limit < 1 || limit > TEAM_MEMBER_LIST_MAX) throw invalidTeamMemberPage();
+  if (options.cursor === void 0) return { cursor: null, limit };
+  if (typeof options.cursor !== "string" || options.cursor.length < 1 || options.cursor.length > 512) throw invalidTeamMemberPage();
+  try {
+    if (!/^[A-Za-z0-9_-]+$/.test(options.cursor)) throw invalidTeamMemberPage();
+    const cursorBytes = Buffer.from(options.cursor, "base64url");
+    if (cursorBytes.toString("base64url") !== options.cursor) throw invalidTeamMemberPage();
+    const decoded = JSON.parse(cursorBytes.toString("utf8"));
+    if (decoded?.v !== 1 || typeof decoded.createdAt !== "string" || !Number.isFinite(Date.parse(decoded.createdAt)) || typeof decoded.userId !== "string" || decoded.userId.length < 1 || decoded.userId.length > 256) {
+      throw invalidTeamMemberPage();
+    }
+    return { cursor: { createdAt: decoded.createdAt, userId: decoded.userId }, limit };
+  } catch (error) {
+    if (error?.code === "INVALID_TEAM_MEMBER_PAGE") throw error;
+    throw invalidTeamMemberPage();
+  }
+}
+function encodeTeamMemberCursor(createdAt, userId) {
+  return Buffer.from(JSON.stringify({ v: 1, createdAt, userId }), "utf8").toString("base64url");
+}
+function invalidTeamMemberPage() {
+  return commandError2("Team member page is invalid.", `Use a limit from 1 through ${TEAM_MEMBER_LIST_MAX} and a cursor returned by listMembers().`, "INVALID_TEAM_MEMBER_PAGE");
+}
 async function ensureInitialTeam(database, auth) {
   if (database.__transactionActive) {
     return ensureInitialTeamOnAdapter(database.adapter, auth.userId);
@@ -14445,7 +14504,10 @@ function quoteIdentifier(identifier) {
 // src/server-runtime-source.ts
 async function openDevDatabase(databasePath, serverSource, serverEnv = {}, config = {}, capsuleDefinition = null, options = {}) {
   if (capsuleDefinition?.teams !== void 0 && (!capsuleDefinition.teams || typeof capsuleDefinition.teams !== "object" || Array.isArray(capsuleDefinition.teams))) {
-    throw commandError2("Invalid Capsule Teams declaration.", "Declare teams as { appRoles?: string[] }.", "INVALID_TEAM_APPLICATION_ROLES");
+    throw commandError2("Invalid Capsule Teams declaration.", "Declare teams as { appRoles?: string[], admitJoin?: function }.", "INVALID_TEAM_APPLICATION_ROLES");
+  }
+  if (capsuleDefinition?.teams?.admitJoin !== void 0 && typeof capsuleDefinition.teams.admitJoin !== "function") {
+    throw commandError2("Invalid Capsule Team admission policy.", "Declare teams.admitJoin as a server function.", "INVALID_TEAM_JOIN_ADMISSION");
   }
   const teamApplicationRoles = normalizeTeamApplicationRoles(capsuleDefinition?.teams?.appRoles);
   if (capsuleDefinition?.files !== void 0 && (!capsuleDefinition.files || typeof capsuleDefinition.files !== "object" || Array.isArray(capsuleDefinition.files))) {
@@ -14532,6 +14594,10 @@ async function openDevDatabase(databasePath, serverSource, serverEnv = {}, confi
     passwordResetConfig: resolvePasswordResetConfig(config),
     teamJoinLinkConfig: resolveTeamJoinLinkConfig(config),
     teamApplicationRoles,
+    teamJoinAdmission: capsuleDefinition?.teams?.admitJoin,
+    createTeamJoinAdmissionContext(transactionAdapter, auth) {
+      return createTeamJoinAdmissionContext(createTransactionDatabase(database, transactionAdapter), auth);
+    },
     fileAcl,
     securityPolicy: resolveRuntimeSecurityPolicy(config),
     fileStorage,
@@ -15823,6 +15889,33 @@ function createEndpointDatabaseApi(database, contextGetter = null) {
     database.schema.tables.map((table) => [table.name, createEndpointTableApi(database, table, {}, contextGetter)])
   );
 }
+function createEndpointReadOnlyDatabaseApi(database, contextGetter = null) {
+  return Object.fromEntries(
+    database.schema.tables.map((table) => [
+      table.name,
+      readOnlyEndpointTableApi(createEndpointTableApi(database, table, {}, contextGetter))
+    ])
+  );
+}
+function readOnlyEndpointTableApi(tableApi) {
+  return {
+    where(fieldName, value) {
+      return readOnlyEndpointTableApi(tableApi.where(fieldName, value));
+    },
+    orderBy(fieldName, direction = "asc") {
+      return readOnlyEndpointTableApi(tableApi.orderBy(fieldName, direction));
+    },
+    limit(count) {
+      return readOnlyEndpointTableApi(tableApi.limit(count));
+    },
+    get() {
+      return tableApi.get();
+    },
+    all() {
+      return tableApi.all();
+    }
+  };
+}
 function createEndpointTableApi(database, table, query = {}, contextGetter = null) {
   return {
     insert(values) {
@@ -16626,7 +16719,7 @@ function createWebSocketHub(getDatabase, trustedRefresh = null) {
     }
     if (message.type === "teams.listMembers") {
       try {
-        const data = await listTeamMembers(database, client.session.auth, message.teamId);
+        const data = await listTeamMembers(database, client.session.auth, message.teamId, { cursor: message.cursor, limit: message.limit });
         sendJson(client, { id: message.id ?? null, type: "teams.listMembers.result", data, error: null });
       } catch (error) {
         if (error?.sporadesAuthDenialLogData) emitAuthDeniedLog(database, { data: error.sporadesAuthDenialLogData });
@@ -17426,6 +17519,16 @@ function createMutationContext(database, auth) {
   };
   return context;
 }
+function createTeamJoinAdmissionContext(database, auth) {
+  const context = {
+    auth,
+    env: database.serverEnv,
+    log: createEndpointLogger(database)
+  };
+  const holder = createContextHolder(context);
+  context.db = createEndpointReadOnlyDatabaseApi(database, () => holder.current);
+  return context;
+}
 function createCurrentUserJobApi(database, contextGetter) {
   return {
     async enqueue(handlerName, payload, options = {}) {
@@ -23542,7 +23645,7 @@ jobs:
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.8.1";
+var CLI_VERSION = "0.8.3";
 
 // src/cli/sporades.ts
 var SUPPORTED_TEMPLATES = new Set(CLIENT_TEMPLATES);

package/dist/cli/cli-version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.8.1";
+export declare const CLI_VERSION = "0.8.3";
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli/cli-version.js

@@ -1,3 +1,3 @@
 // Generated by `npm run build` from package.json. Do not edit by hand.
-export const CLI_VERSION = "0.8.1";
+export const CLI_VERSION = "0.8.3";
 //# sourceMappingURL=cli-version.js.map

package/dist/server-runtime-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-runtime-source.d.ts","sourceRoot":"","sources":["../src/server-runtime-source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAA4C,MAAM,WAAW,CAAC;AAQ3G,OAAO,EAAY,oBAAoB,EAAuD,MAAM,SAAS,CAAC;AAE9G,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAkHhC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AAoBrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAmBlC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AA8BpC,cAAc,mBAAmB,CAAC;AAsBlC,cAAc,+BAA+B,CAAC;AAiC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AA2BnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AAuBzC,cAAc,wBAAwB,CAAC;AAqBvC,cAAc,uBAAuB,CAAC;AAiCtC,cAAc,kBAAkB,CAAC;AA8BjC,cAAc,mBAAmB,CAAC;AAElC,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACvC,KAAK,aAAa,GAAG,WAAW,CAAC;AACjC,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAqBrD,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,GAAG,EACjB,SAAS,GAAE,UAAe,EAC1B,MAAM,GAAE,aAAkB,EAC1B,iBAAiB,GAAE,GAAU,EAC7B,OAAO,GAAE,WAAgB,wBA8K1B;AA2KD,wBAAsB,0BAA0B,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,gBAUxG;AAmBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,QAAQ,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC;CAAE;;gBAU3F,GAAG;;;EA4BlB;AAyJD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE;QAAE,EAAE,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,GAAG,CAAC;QAAC,IAAI,EAAE,GAAG,CAAC;KAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;CAAE,eA2B/O;AA2GD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,SAAM,SAe5E;AAED,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,GAAG;;;;;;;;;;;;;;EAY1D;AAwJD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM;;;;;IA8BpD;AAuaD,wBAAsB,aAAa,CAAC,QAAQ,EAAE;IAAE,SAAS,EAAE,GAAG,EAAE,CAAC;CAAE,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG;IAAE,GAAG,EAAE,eAAe,CAAC;CAAE,oBAmBnK;AA2BD,wBAAsB,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE;IAAE,OAAO,CAAC,EAAE,QAAQ,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,gBAwCxI;AAsID,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,GAAE,GAAU;;EAIzF;AA6PD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,GAAG;;;SAahD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM;;;;EAU1E;AAiBD,KAAK,uBAAuB,GAAG;IAC7B,aAAa,EAAE,uBAAuB,CAAC;IACvC,YAAY,EAAE,sBAAsB,CAAC;IACrC,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtI,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,EAAE,cAAc,GAAE,uBAAuB,GAAG,IAAW;;oBAgBtF,eAAe,UAAU,MAAM;;;;;;;;;;;;;;;;;;;;4BAiF7B,GAAG,SAAS,GAAG;+BAaZ,GAAG,eAAe;QAAE,YAAY,EAAE;YAAE,KAAK,EAAE,GAAG,CAAC;SAAE,CAAC;QAAC,IAAI,EAAE,GAAG,CAAC;KAAE;;;;;EAq1B7F;AA+CD,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,WAAgB;;;;;;;;;GAyB1B;AA2GD,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAgDhG;AA+BD,wBAAsB,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,gBA6ClG;AAyBD,wBAAsB,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,GAAE,WAAgB,gBA6E3H;AA8ND,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,iBAuDlE"}
+{"version":3,"file":"server-runtime-source.d.ts","sourceRoot":"","sources":["../src/server-runtime-source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAA4C,MAAM,WAAW,CAAC;AAQ3G,OAAO,EAAY,oBAAoB,EAAuD,MAAM,SAAS,CAAC;AAE9G,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAkHhC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AAoBrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAmBlC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AA8BpC,cAAc,mBAAmB,CAAC;AAsBlC,cAAc,+BAA+B,CAAC;AAiC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AA2BnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AAuBzC,cAAc,wBAAwB,CAAC;AAqBvC,cAAc,uBAAuB,CAAC;AAiCtC,cAAc,kBAAkB,CAAC;AA8BjC,cAAc,mBAAmB,CAAC;AAElC,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACvC,KAAK,aAAa,GAAG,WAAW,CAAC;AACjC,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAqBrD,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,GAAG,EACjB,SAAS,GAAE,UAAe,EAC1B,MAAM,GAAE,aAAkB,EAC1B,iBAAiB,GAAE,GAAU,EAC7B,OAAO,GAAE,WAAgB,wBAqL1B;AA2KD,wBAAsB,0BAA0B,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,gBAUxG;AAmBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,QAAQ,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC;CAAE;;gBAU3F,GAAG;;;EA4BlB;AAyJD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE;QAAE,EAAE,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,GAAG,CAAC;QAAC,IAAI,EAAE,GAAG,CAAC;KAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;CAAE,eA2B/O;AA2GD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,SAAM,SAe5E;AAED,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,GAAG;;;;;;;;;;;;;;EAY1D;AAwJD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM;;;;;IA8BpD;AAuaD,wBAAsB,aAAa,CAAC,QAAQ,EAAE;IAAE,SAAS,EAAE,GAAG,EAAE,CAAC;CAAE,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG;IAAE,GAAG,EAAE,eAAe,CAAC;CAAE,oBAmBnK;AA2BD,wBAAsB,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE;IAAE,OAAO,CAAC,EAAE,QAAQ,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,gBAwCxI;AAsID,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,GAAE,GAAU;;EAIzF;AA0RD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,GAAG;;;SAahD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM;;;;EAU1E;AAiBD,KAAK,uBAAuB,GAAG;IAC7B,aAAa,EAAE,uBAAuB,CAAC;IACvC,YAAY,EAAE,sBAAsB,CAAC;IACrC,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtI,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,EAAE,cAAc,GAAE,uBAAuB,GAAG,IAAW;;oBAgBtF,eAAe,UAAU,MAAM;;;;;;;;;;;;;;;;;;;;4BAiF7B,GAAG,SAAS,GAAG;+BAaZ,GAAG,eAAe;QAAE,YAAY,EAAE;YAAE,KAAK,EAAE,GAAG,CAAC;SAAE,CAAC;QAAC,IAAI,EAAE,GAAG,CAAC;KAAE;;;;;EAq1B7F;AA+CD,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,WAAgB;;;;;;;;;GAyB1B;AA2GD,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAgDhG;AA+BD,wBAAsB,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,gBA6ClG;AAyBD,wBAAsB,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,GAAE,WAAgB,gBA6E3H;AAyOD,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,iBAuDlE"}

package/dist/server-runtime-source.js

@@ -337,7 +337,10 @@ export * from "./http-runtime.js";
 // imports what it calls, and esbuild follows the graph.
 export async function openDevDatabase(databasePath, serverSource, serverEnv = {}, config = {}, capsuleDefinition = null, options = {}) {
     if (capsuleDefinition?.teams !== undefined && (!capsuleDefinition.teams || typeof capsuleDefinition.teams !== "object" || Array.isArray(capsuleDefinition.teams))) {
-        throw commandError("Invalid Capsule Teams declaration.", "Declare teams as { appRoles?: string[] }.", "INVALID_TEAM_APPLICATION_ROLES");
+        throw commandError("Invalid Capsule Teams declaration.", "Declare teams as { appRoles?: string[], admitJoin?: function }.", "INVALID_TEAM_APPLICATION_ROLES");
+    }
+    if (capsuleDefinition?.teams?.admitJoin !== undefined && typeof capsuleDefinition.teams.admitJoin !== "function") {
+        throw commandError("Invalid Capsule Team admission policy.", "Declare teams.admitJoin as a server function.", "INVALID_TEAM_JOIN_ADMISSION");
     }
     const teamApplicationRoles = normalizeTeamApplicationRoles(capsuleDefinition?.teams?.appRoles);
     if (capsuleDefinition?.files !== undefined && (!capsuleDefinition.files || typeof capsuleDefinition.files !== "object" || Array.isArray(capsuleDefinition.files))) {
@@ -427,6 +430,10 @@ export async function openDevDatabase(databasePath, serverSource, serverEnv = {}
         passwordResetConfig: resolvePasswordResetConfig(config),
         teamJoinLinkConfig: resolveTeamJoinLinkConfig(config),
         teamApplicationRoles,
+        teamJoinAdmission: capsuleDefinition?.teams?.admitJoin,
+        createTeamJoinAdmissionContext(transactionAdapter, auth) {
+            return createTeamJoinAdmissionContext(createTransactionDatabase(database, transactionAdapter), auth);
+        },
         fileAcl,
         securityPolicy: resolveRuntimeSecurityPolicy(config),
         fileStorage,
@@ -1778,6 +1785,31 @@ function endpointQueryFromUrl(requestUrl) {
 export function createEndpointDatabaseApi(database, contextGetter = null) {
     return Object.fromEntries(database.schema.tables.map((table) => [table.name, createEndpointTableApi(database, table, {}, contextGetter)]));
 }
+function createEndpointReadOnlyDatabaseApi(database, contextGetter = null) {
+    return Object.fromEntries(database.schema.tables.map((table) => [
+        table.name,
+        readOnlyEndpointTableApi(createEndpointTableApi(database, table, {}, contextGetter)),
+    ]));
+}
+function readOnlyEndpointTableApi(tableApi) {
+    return {
+        where(fieldName, value) {
+            return readOnlyEndpointTableApi(tableApi.where(fieldName, value));
+        },
+        orderBy(fieldName, direction = "asc") {
+            return readOnlyEndpointTableApi(tableApi.orderBy(fieldName, direction));
+        },
+        limit(count) {
+            return readOnlyEndpointTableApi(tableApi.limit(count));
+        },
+        get() {
+            return tableApi.get();
+        },
+        all() {
+            return tableApi.all();
+        },
+    };
+}
 function createEndpointTableApi(database, table, query = {}, contextGetter = null) {
     return {
         insert(values) {
@@ -2621,7 +2653,7 @@ export function createWebSocketHub(getDatabase, trustedRefresh = null) {
         }
         if (message.type === "teams.listMembers") {
             try {
-                const data = await listTeamMembers(database, client.session.auth, message.teamId);
+                const data = await listTeamMembers(database, client.session.auth, message.teamId, { cursor: message.cursor, limit: message.limit });
                 sendJson(client, { id: message.id ?? null, type: "teams.listMembers.result", data, error: null });
             }
             catch (error) {
@@ -3462,6 +3494,16 @@ function createMutationContext(database, auth) {
     };
     return context;
 }
+function createTeamJoinAdmissionContext(database, auth) {
+    const context = {
+        auth,
+        env: database.serverEnv,
+        log: createEndpointLogger(database),
+    };
+    const holder = createContextHolder(context);
+    context.db = createEndpointReadOnlyDatabaseApi(database, () => holder.current);
+    return context;
+}
 function createCurrentUserJobApi(database, contextGetter) {
     return {
         async enqueue(handlerName, payload, options = {}) {