sporades 0.8.1 → 0.8.5

package/CHANGES.md

@@ -1,5 +1,27 @@
 # Changes
 
+## Unreleased - 2026-08-15
+
+Changes since v0.8.1.
+
+### 🚀 Features
+
+- Add reactive query arguments (5b882f5).
+- Add exact pagination and join admission (63f68a0).
+
+### 🐛 Bug Fixes
+
+- Resolve npm audit vulnerabilities (a6a4b51).
+
+### 📝 Documentation
+
+- Describe parameterized queries (287ef63).
+- Plan reactive query arguments (4876db8).
+
+### 📦 Packaging
+
+- Release v0.8.3 (c17bb1b).
+
 ## 0.8.1 - 2026-08-14
 
 Corrects the incomplete `0.8.0` package release with the merged `main` runtime,
@@ -16,3 +38,4 @@ generated artifacts, and documentation.
   explicit Team decisions in table and File ACLs. Teams are built in but do
   not select a current Team or automatically partition Capsule data; Sporades
   never sends Join-link email. See the [Built-in Teams reference](https://mgscox.github.io/sporades/reference/teams).
+

package/bin/sporades-host-helper.js

@@ -418,7 +418,7 @@ function writeEnvelope(result, failed = false) {
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.8.1";
+var CLI_VERSION = "0.8.5";
 
 // src/cli/schedule-inspection-envelope.ts
 function sanitizeScheduleInspectionEnvelope(envelope, invalid) {

package/bin/sporades.js

@@ -38,11 +38,69 @@ export function onMessage(listener) {
 }
 
 export const queries = {
-  subscribe(name, listener) {
-    return connect().subscribeQuery(name, listener);
+  subscribe(name, listener, ...args) {
+    const normalizedArgs = args.length === 1 && args[0]?.[normalizedQueryArgumentsMarker]
+      ? args[0]
+      : normalizeQueryArguments(args);
+    return connect().subscribeNormalizedQuery(name, listener, normalizedArgs);
   },
 };
 
+const queryArgumentLimitBytes = 65536;
+const normalizedQueryArgumentsMarker = Symbol("sporades.normalizedQueryArguments");
+
+function normalizeQueryArguments(args) {
+  if (!Array.isArray(args)) throw new TypeError("Query arguments must be an array.");
+  const ancestors = new Set();
+  const snapshot = normalizeQueryArgumentValue(args, ancestors);
+  const identity = JSON.stringify(snapshot);
+  const byteLength = new TextEncoder().encode(identity).byteLength;
+  if (byteLength > queryArgumentLimitBytes) throw new RangeError("Query arguments exceed the 65536-byte limit.");
+  return Object.freeze({ snapshot, identity, byteLength, [normalizedQueryArgumentsMarker]: true });
+}
+
+function normalizeQueryArgumentValue(value, ancestors) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new TypeError("Query arguments must contain JSON values.");
+    return value;
+  }
+  if (Array.isArray(value)) {
+    if (Object.getOwnPropertySymbols(value).length > 0) throw new TypeError("Query arguments must not contain symbol keys.");
+    if (ancestors.has(value)) throw new TypeError("Query arguments must not contain cycles.");
+    if (Object.getOwnPropertyNames(value).some((key) => key !== "length" && (!/^(0|[1-9]\\d*)$/.test(key) || Number(key) >= value.length))) {
+      throw new TypeError("Query arguments must not contain non-index array properties.");
+    }
+    ancestors.add(value);
+    const snapshot = [];
+    for (let index = 0; index < value.length; index += 1) {
+      if (!Object.hasOwn(value, index)) throw new TypeError("Query arguments must not contain sparse arrays.");
+      snapshot.push(normalizeQueryArgumentValue(value[index], ancestors));
+    }
+    ancestors.delete(value);
+    return Object.freeze(snapshot);
+  }
+  if (!value || typeof value !== "object") throw new TypeError("Query arguments must contain JSON values.");
+  if (Object.getOwnPropertySymbols(value).length > 0) throw new TypeError("Query arguments must not contain symbol keys.");
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) throw new TypeError("Query arguments must contain plain JSON objects.");
+  if (ancestors.has(value)) throw new TypeError("Query arguments must not contain cycles.");
+  ancestors.add(value);
+  const snapshot = Object.create(null);
+  for (const key of Object.getOwnPropertyNames(value).sort()) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, "value")) throw new TypeError("Query arguments must contain plain JSON objects.");
+    Object.defineProperty(snapshot, key, {
+      value: normalizeQueryArgumentValue(descriptor.value, ancestors),
+      enumerable: true,
+      configurable: false,
+      writable: false,
+    });
+  }
+  ancestors.delete(value);
+  return Object.freeze(snapshot);
+}
+
 export const mutations = {
   run(name, ...args) {
     return connect().mutate(name, args);
@@ -68,8 +126,8 @@ export const teams = {
   rename(teamId, name) {
     return connect().teamsRename(teamId, name);
   },
-  listMembers(teamId) {
-    return connect().teamsListMembers(teamId);
+  listMembers(teamId, options = {}) {
+    return connect().teamsListMembers(teamId, options);
   },
   updateApplicationRoles(teamId, userId, changes) {
     return connect().teamsUpdateApplicationRoles(teamId, userId, changes);
@@ -171,13 +229,14 @@ export const files = {
 export function createHooks(primitives) {
   const { useEffect, useState } = primitives;
 
-  function useQuery(name) {
+  function useQuery(name, ...args) {
+    const normalizedArgs = normalizeQueryArguments(args);
     const [state, setState] = useState({ data: null, error: null, loading: true });
 
     useEffect(() => {
-      const subscription = queries.subscribe(name, setState);
+      const subscription = queries.subscribe(name, setState, normalizedArgs);
       return () => subscription.unsubscribe();
-    }, [name]);
+    }, [name, normalizedArgs.identity]);
 
     return state;
   }
@@ -237,9 +296,10 @@ export function createHooks(primitives) {
 export function createVueComposables(primitives) {
   const { reactive, onScopeDispose } = primitives;
 
-  function useQuery(name) {
+  function useQuery(name, ...args) {
+    const normalizedArgs = normalizeQueryArguments(args);
     const state = reactive({ data: null, error: null, loading: true });
-    const subscription = queries.subscribe(name, (nextState) => Object.assign(state, nextState));
+    const subscription = queries.subscribe(name, (nextState) => Object.assign(state, nextState), normalizedArgs);
     onScopeDispose(() => subscription.unsubscribe());
     return state;
   }
@@ -293,9 +353,10 @@ export function createVueComposables(primitives) {
 export function createSolidPrimitives(primitives) {
   const { createSignal, onCleanup } = primitives;
 
-  function createQuery(name) {
+  function createQuery(name, ...args) {
+    const normalizedArgs = normalizeQueryArguments(args);
     const [state, setState] = createSignal({ data: null, error: null, loading: true });
-    const subscription = queries.subscribe(name, setState);
+    const subscription = queries.subscribe(name, setState, normalizedArgs);
     onCleanup(() => subscription.unsubscribe());
     return state;
   }
@@ -389,8 +450,9 @@ export function createLitControllers() {
     return controller;
   }
 
-  function queryController(host, name) {
-    return observedController(host, { data: null, error: null, loading: true }, (publish) => queries.subscribe(name, publish));
+  function queryController(host, name, ...args) {
+    const normalizedArgs = normalizeQueryArguments(args);
+    return observedController(host, { data: null, error: null, loading: true }, (publish) => queries.subscribe(name, publish, normalizedArgs));
   }
 
   function mutationController(host, name) {
@@ -477,7 +539,10 @@ export function createInfernoAdapters() {
     };
     return adapter;
   }
-  const queryAdapter = (host, name) => observedAdapter(host, { data: null, error: null, loading: true }, (publish) => queries.subscribe(name, publish));
+  const queryAdapter = (host, name, ...args) => {
+    const normalizedArgs = normalizeQueryArguments(args);
+    return observedAdapter(host, { data: null, error: null, loading: true }, (publish) => queries.subscribe(name, publish, normalizedArgs));
+  };
   function mutationAdapter(host, name) {
     let pending = 0, latestInvocation = 0;
     const adapter = { state: { data: null, error: null, loading: false }, async run(...args) {
@@ -513,10 +578,11 @@ export function createInfernoAdapters() {
 }
 
 export function createSvelteStores() {
-  function queryStore(name) {
+  function queryStore(name, ...args) {
+    const normalizedArgs = normalizeQueryArguments(args);
     return createLazyStore(
       { data: null, error: null, loading: true },
-      (publish) => queries.subscribe(name, publish).unsubscribe,
+      (publish) => queries.subscribe(name, publish, normalizedArgs).unsubscribe,
       true,
     );
   }
@@ -688,6 +754,7 @@ function createConnection() {
           id: subscription.id,
           type: "query.subscribe",
           query: subscription.name,
+          args: subscription.args.snapshot,
         });
       }
     });
@@ -1073,17 +1140,19 @@ function createConnection() {
     confirmPasswordReset(code, newPassword) {
       return request("auth.confirmPasswordReset", { code, newPassword });
     },
-    subscribeQuery(name, listener) {
+    subscribeNormalizedQuery(name, listener, args) {
       if (typeof name !== "string" || !name) throw new TypeError("queries.subscribe requires a query name.");
       if (typeof listener !== "function") throw new TypeError("queries.subscribe requires a listener function.");
-      let subscription = queryChannels.get(name);
+      const channelsForName = queryChannels.get(name) ?? new Map();
+      if (!queryChannels.has(name)) queryChannels.set(name, channelsForName);
+      let subscription = channelsForName.get(args.identity);
       if (!subscription) {
         const id = nextId++;
-        subscription = { id, name, listeners: new Set(), latest: null };
-        queryChannels.set(name, subscription);
+        subscription = { id, name, args, listeners: new Set(), latest: null };
+        channelsForName.set(args.identity, subscription);
         subscriptions.set(id, subscription);
         const activeSocket = open();
-        if (activeSocket.readyState === WebSocket.OPEN) send({ id, type: "query.subscribe", query: name });
+        if (activeSocket.readyState === WebSocket.OPEN) send({ id, type: "query.subscribe", query: name, args: args.snapshot });
       }
       subscription.listeners.add(listener);
       listener(subscription.latest ?? { data: null, error: null, loading: true });
@@ -1093,7 +1162,8 @@ function createConnection() {
         active = false;
         subscription.listeners.delete(listener);
         if (subscription.listeners.size === 0) {
-          queryChannels.delete(name);
+          channelsForName.delete(args.identity);
+          if (channelsForName.size === 0) queryChannels.delete(name);
           subscriptions.delete(subscription.id);
           sendIfOpen({ id: nextId++, type: "query.unsubscribe", subscriptionId: subscription.id });
         }
@@ -1117,7 +1187,7 @@ function createConnection() {
     teamsList() { return request("teams.list"); },
     teamsCreate(name) { return request("teams.create", { name }); },
     teamsRename(teamId, name) { return request("teams.rename", { teamId, name }); },
-    teamsListMembers(teamId) { return request("teams.listMembers", { teamId }); },
+    teamsListMembers(teamId, options = {}) { return request("teams.listMembers", { teamId, cursor: options.cursor, limit: options.limit }); },
     teamsUpdateApplicationRoles(teamId, userId, changes) { return request("teams.updateApplicationRoles", { teamId, userId, add: changes?.add, remove: changes?.remove }); },
     teamsCreateJoinLink(teamId, email, options = {}) { return request("teams.createJoinLink", { teamId, email, ttlSeconds: options.ttlSeconds }); },
     teamsListJoinLinks(teamId) { return request("teams.listJoinLinks", { teamId }); },
@@ -8477,6 +8547,7 @@ var INITIAL_TEAM_NAME = "My Team";
 var TEAM_NAME_MAX_BYTES = 80;
 var TEAM_MEMBER_COUNT_MAX = 99;
 var TEAM_MEMBER_LIST_MAX = 100;
+var TEAM_MEMBER_LIST_DEFAULT = TEAM_MEMBER_LIST_MAX;
 var TEAM_MEMBERSHIP_MAX = 25;
 var TEAM_BOOTSTRAP_RETRY_LIMIT = 5;
 var TEAM_JOIN_LINK_DEFAULT_TTL_SECONDS = 60 * 60 * 24;
@@ -8538,9 +8609,9 @@ function createCurrentUserTeamsApi(database, auth, contextGetter) {
       requireAuth({ auth }, { linked: true });
       return renameCurrentUserTeam(database, auth, teamId, name, contextGetter?.());
     },
-    async listMembers(teamId) {
+    async listMembers(teamId, options = {}) {
       requireAuth({ auth }, { linked: true });
-      return listTeamMembers(database, auth, teamId);
+      return listTeamMembers(database, auth, teamId, options);
     },
     async updateApplicationRoles(teamId, userId, changes) {
       requireAuth({ auth }, { linked: true });
@@ -8806,6 +8877,7 @@ async function joinCurrentUserTeam(database, auth, code, eventContext) {
         "SELECT [role] FROM [sporades_team_memberships] WHERE [teamId] = ? AND [userId] = ?"
       )).get(row.teamId, auth.userId);
       if (!membership) {
+        await enforceTeamJoinAdmission(database, tx, auth, String(row.teamId));
         await ensureMembershipCounterOnAdapter(tx, auth.userId);
         const claim = await tx.prepare(sql(
           "UPDATE [sporades_team_membership_counters] SET [membershipCount] = [membershipCount] + 1 WHERE [userId] = ? AND [membershipCount] < ?"
@@ -8829,6 +8901,23 @@ async function joinCurrentUserTeam(database, auth, code, eventContext) {
   emitTeamSecurityEvent(database, eventContext, "teams.joined", auth.userId, joined.id, "succeeded", "TEAM_JOINED");
   return { team: joined };
 }
+async function enforceTeamJoinAdmission(database, tx, auth, teamId) {
+  if (typeof database.teamJoinAdmission !== "function") return;
+  const count = await tx.prepare(tx.dialect.sql(
+    "SELECT COUNT(*) AS [count] FROM [sporades_team_memberships] WHERE [teamId] = ?"
+  )).get(teamId);
+  try {
+    const context = database.createTeamJoinAdmissionContext(tx, auth);
+    const decision = await database.teamJoinAdmission(context, {
+      teamId,
+      userId: auth.userId,
+      currentMemberCount: Number(count?.count ?? 0)
+    });
+    if (decision?.allow !== true) throw teamJoinDenied();
+  } catch {
+    throw teamJoinDenied();
+  }
+}
 function normalizeTeamJoinEmail(email) {
   const normalized = String(email ?? "").trim().toLowerCase();
   if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) {
@@ -8949,6 +9038,9 @@ function teamJoinLinkLimitError() {
 function invalidTeamJoinLink() {
   return commandError2("Join link is invalid.", "Use a current Join link for this linked account.", "INVALID_JOIN_LINK");
 }
+function teamJoinDenied() {
+  return commandError2("Could not join this Team.", "Ask a Team administrator for access.", "TEAM_JOIN_DENIED");
+}
 async function listCurrentUserTeams(database, auth) {
   requireAuth({ auth }, { linked: true });
   await ensureInitialTeam(database, auth);
@@ -9159,7 +9251,7 @@ async function deleteCurrentUserTeam(database, auth, teamId, eventContext) {
   emitTeamSecurityEvent(database, eventContext, "teams.deleted", auth.userId, teamId, "succeeded", "TEAM_DELETED");
   return { deleted: true };
 }
-async function listTeamMembers(database, auth, teamId) {
+async function listTeamMembers(database, auth, teamId, options = {}) {
   requireAuth({ auth }, { linked: true });
   if (!isOpaqueTeamId(teamId)) throw teamDenied();
   return withTeamTransaction(database, async (tx) => {
@@ -9168,20 +9260,57 @@ async function listTeamMembers(database, auth, teamId) {
       "SELECT [role] FROM [sporades_team_memberships] WHERE [teamId] = ? AND [userId] = ?"
     )).get(teamId, auth.userId);
     if (callerMembership?.role !== "admin") throw teamDenied();
+    const page = normalizeTeamMemberPage(options);
+    const total = await tx.prepare(sql(
+      "SELECT COUNT(*) AS [count] FROM [sporades_team_memberships] WHERE [teamId] = ?"
+    )).get(teamId);
+    const cursorClause = page.cursor ? "AND ([m].[createdAt] > ? OR ([m].[createdAt] = ? AND [m].[userId] > ?)) " : "";
+    const params = page.cursor ? [teamId, page.cursor.createdAt, page.cursor.createdAt, page.cursor.userId, page.limit + 1] : [teamId, page.limit + 1];
     const rows = await tx.prepare(sql(
-      "SELECT [m].[userId], [u].[displayName], [u].[picture], [m].[role] FROM [sporades_team_memberships] [m] JOIN [sporades_auth_users] [u] ON [u].[id] = [m].[userId] WHERE [m].[teamId] = ? ORDER BY [m].[createdAt] ASC, [m].[userId] ASC LIMIT ?"
-    )).all(teamId, TEAM_MEMBER_LIST_MAX);
+      "SELECT [m].[userId], [u].[displayName], [u].[picture], [m].[role] , [m].[createdAt] FROM [sporades_team_memberships] [m] JOIN [sporades_auth_users] [u] ON [u].[id] = [m].[userId] WHERE [m].[teamId] = ? " + cursorClause + "ORDER BY [m].[createdAt] ASC, [m].[userId] ASC LIMIT ?"
+    )).all(...params);
+    const hasMore = rows.length > page.limit;
+    const pageRows = hasMore ? rows.slice(0, page.limit) : rows;
+    const last = pageRows.at(-1);
     return {
-      members: await Promise.all(rows.map(async (row) => ({
+      members: await Promise.all(pageRows.map(async (row) => ({
         userId: String(row.userId),
         displayName: String(row.displayName),
         picture: typeof row.picture === "string" && row.picture.length > 0 ? row.picture : null,
         role: row.role === "admin" ? "admin" : "member",
         applicationRoles: await activeTeamApplicationRoles(tx, database.teamApplicationRoles, teamId, row.userId)
-      })))
+      }))),
+      ...hasMore && last ? { nextCursor: encodeTeamMemberCursor(String(last.createdAt), String(last.userId)) } : {},
+      totalCount: Number(total?.count ?? 0)
     };
   });
 }
+function normalizeTeamMemberPage(options) {
+  if (!options || typeof options !== "object" || Array.isArray(options)) throw invalidTeamMemberPage();
+  const limit = options.limit === void 0 ? TEAM_MEMBER_LIST_DEFAULT : options.limit;
+  if (!Number.isInteger(limit) || limit < 1 || limit > TEAM_MEMBER_LIST_MAX) throw invalidTeamMemberPage();
+  if (options.cursor === void 0) return { cursor: null, limit };
+  if (typeof options.cursor !== "string" || options.cursor.length < 1 || options.cursor.length > 512) throw invalidTeamMemberPage();
+  try {
+    if (!/^[A-Za-z0-9_-]+$/.test(options.cursor)) throw invalidTeamMemberPage();
+    const cursorBytes = Buffer.from(options.cursor, "base64url");
+    if (cursorBytes.toString("base64url") !== options.cursor) throw invalidTeamMemberPage();
+    const decoded = JSON.parse(cursorBytes.toString("utf8"));
+    if (decoded?.v !== 1 || typeof decoded.createdAt !== "string" || !Number.isFinite(Date.parse(decoded.createdAt)) || typeof decoded.userId !== "string" || decoded.userId.length < 1 || decoded.userId.length > 256) {
+      throw invalidTeamMemberPage();
+    }
+    return { cursor: { createdAt: decoded.createdAt, userId: decoded.userId }, limit };
+  } catch (error) {
+    if (error?.code === "INVALID_TEAM_MEMBER_PAGE") throw error;
+    throw invalidTeamMemberPage();
+  }
+}
+function encodeTeamMemberCursor(createdAt, userId) {
+  return Buffer.from(JSON.stringify({ v: 1, createdAt, userId }), "utf8").toString("base64url");
+}
+function invalidTeamMemberPage() {
+  return commandError2("Team member page is invalid.", `Use a limit from 1 through ${TEAM_MEMBER_LIST_MAX} and a cursor returned by listMembers().`, "INVALID_TEAM_MEMBER_PAGE");
+}
 async function ensureInitialTeam(database, auth) {
   if (database.__transactionActive) {
     return ensureInitialTeamOnAdapter(database.adapter, auth.userId);
@@ -14445,7 +14574,10 @@ function quoteIdentifier(identifier) {
 // src/server-runtime-source.ts
 async function openDevDatabase(databasePath, serverSource, serverEnv = {}, config = {}, capsuleDefinition = null, options = {}) {
   if (capsuleDefinition?.teams !== void 0 && (!capsuleDefinition.teams || typeof capsuleDefinition.teams !== "object" || Array.isArray(capsuleDefinition.teams))) {
-    throw commandError2("Invalid Capsule Teams declaration.", "Declare teams as { appRoles?: string[] }.", "INVALID_TEAM_APPLICATION_ROLES");
+    throw commandError2("Invalid Capsule Teams declaration.", "Declare teams as { appRoles?: string[], admitJoin?: function }.", "INVALID_TEAM_APPLICATION_ROLES");
+  }
+  if (capsuleDefinition?.teams?.admitJoin !== void 0 && typeof capsuleDefinition.teams.admitJoin !== "function") {
+    throw commandError2("Invalid Capsule Team admission policy.", "Declare teams.admitJoin as a server function.", "INVALID_TEAM_JOIN_ADMISSION");
   }
   const teamApplicationRoles = normalizeTeamApplicationRoles(capsuleDefinition?.teams?.appRoles);
   if (capsuleDefinition?.files !== void 0 && (!capsuleDefinition.files || typeof capsuleDefinition.files !== "object" || Array.isArray(capsuleDefinition.files))) {
@@ -14532,6 +14664,10 @@ async function openDevDatabase(databasePath, serverSource, serverEnv = {}, confi
     passwordResetConfig: resolvePasswordResetConfig(config),
     teamJoinLinkConfig: resolveTeamJoinLinkConfig(config),
     teamApplicationRoles,
+    teamJoinAdmission: capsuleDefinition?.teams?.admitJoin,
+    createTeamJoinAdmissionContext(transactionAdapter, auth) {
+      return createTeamJoinAdmissionContext(createTransactionDatabase(database, transactionAdapter), auth);
+    },
     fileAcl,
     securityPolicy: resolveRuntimeSecurityPolicy(config),
     fileStorage,
@@ -15823,6 +15959,33 @@ function createEndpointDatabaseApi(database, contextGetter = null) {
     database.schema.tables.map((table) => [table.name, createEndpointTableApi(database, table, {}, contextGetter)])
   );
 }
+function createEndpointReadOnlyDatabaseApi(database, contextGetter = null) {
+  return Object.fromEntries(
+    database.schema.tables.map((table) => [
+      table.name,
+      readOnlyEndpointTableApi(createEndpointTableApi(database, table, {}, contextGetter))
+    ])
+  );
+}
+function readOnlyEndpointTableApi(tableApi) {
+  return {
+    where(fieldName, value) {
+      return readOnlyEndpointTableApi(tableApi.where(fieldName, value));
+    },
+    orderBy(fieldName, direction = "asc") {
+      return readOnlyEndpointTableApi(tableApi.orderBy(fieldName, direction));
+    },
+    limit(count) {
+      return readOnlyEndpointTableApi(tableApi.limit(count));
+    },
+    get() {
+      return tableApi.get();
+    },
+    all() {
+      return tableApi.all();
+    }
+  };
+}
 function createEndpointTableApi(database, table, query = {}, contextGetter = null) {
   return {
     insert(values) {
@@ -16528,7 +16691,30 @@ function createWebSocketHub(getDatabase, trustedRefresh = null) {
         });
         return;
       }
-      const subscription = { id: message.id, name: queryName, style: message.query ? "direct" : "rows", generation: 0 };
+      let args;
+      try {
+        args = normalizeQueryArguments(message.args ?? []);
+      } catch {
+        sendJson(client, {
+          id: message.id,
+          type: "query.result",
+          query: queryName,
+          data: null,
+          error: invalidQueryArgumentsError()
+        });
+        return;
+      }
+      if (!message.query && args.length > 0) {
+        sendJson(client, {
+          id: message.id,
+          type: "query.result",
+          query: queryName,
+          data: null,
+          error: invalidQueryArgumentsError()
+        });
+        return;
+      }
+      const subscription = { id: message.id, name: queryName, args, style: message.query ? "direct" : "rows", generation: 0 };
       client.subscriptions.set(message.id, subscription);
       void sendQueryResult(client, subscription, (error) => sendUnhandledMessageError(client, rawMessage, error));
       return;
@@ -16626,7 +16812,7 @@ function createWebSocketHub(getDatabase, trustedRefresh = null) {
     }
     if (message.type === "teams.listMembers") {
       try {
-        const data = await listTeamMembers(database, client.session.auth, message.teamId);
+        const data = await listTeamMembers(database, client.session.auth, message.teamId, { cursor: message.cursor, limit: message.limit });
         sendJson(client, { id: message.id ?? null, type: "teams.listMembers.result", data, error: null });
       } catch (error) {
         if (error?.sporadesAuthDenialLogData) emitAuthDeniedLog(database, { data: error.sporadesAuthDenialLogData });
@@ -16913,7 +17099,7 @@ function createWebSocketHub(getDatabase, trustedRefresh = null) {
     subscription.generation = generation;
     try {
       const database = getDatabase();
-      const result = await runQuery(database, client.session.auth, subscription.name);
+      const result = await runQuery(database, client.session.auth, subscription.name, subscription.args);
       const data = subscription.style === "direct" ? result.data ?? result.rows : { rows: result.data ?? result.rows };
       if (client.subscriptions.get(subscription.id) !== subscription || subscription.generation !== generation) return;
       sendJson(client, {
@@ -17135,7 +17321,13 @@ function sendJsonWithCompletion(client, message, timeoutMs = 250) {
     }
   });
 }
-async function runQuery(database, auth, queryName) {
+async function runQuery(database, auth, queryName, rawArgs = []) {
+  let args;
+  try {
+    args = normalizeQueryArguments(rawArgs);
+  } catch {
+    return { rows: null, data: null, error: invalidQueryArgumentsError() };
+  }
   let context;
   try {
     context = await applyContextMiddleware(database, createMutationContext(database, auth), "query");
@@ -17149,9 +17341,10 @@ async function runQuery(database, auth, queryName) {
     };
   }
   if (queryName === "ctx.env") {
+    if (args.length > 0) return { rows: null, data: null, error: invalidQueryArgumentsError() };
     return { data: context.env, error: null };
   }
-  const customResult = await runCustomQuery(database, context, queryName);
+  const customResult = await runCustomQuery(database, context, queryName, args);
   if (customResult) {
     return customResult;
   }
@@ -17165,6 +17358,7 @@ async function runQuery(database, auth, queryName) {
       }
     };
   }
+  if (args.length > 0) return { rows: null, data: null, error: invalidQueryArgumentsError() };
   const cacheKey = `${table.name}:${context.auth.userId}`;
   if (!database.rowCache.has(cacheKey)) {
     const columns = ["id", "createdAt", "updatedAt", ...table.fields.map((field) => field.name)];
@@ -17179,14 +17373,14 @@ async function runQuery(database, auth, queryName) {
   const rows = await filterRowsByReadAcl(database, table, database.rowCache.get(cacheKey), context);
   return { rows, error: null };
 }
-async function runCustomQuery(database, context, queryName) {
+async function runCustomQuery(database, context, queryName, args) {
   const handler = database.queries.find((candidate) => candidate.name === queryName);
   if (!handler) {
     return null;
   }
   try {
     const queryHandler = typeof handler.handler === "function" ? handler.handler : new Function(`return (${handler.handlerSource});`)();
-    const data = await queryHandler(context);
+    const data = await queryHandler(context, ...args);
     assertJsonCompatible(data);
     return { data, error: null };
   } catch (error) {
@@ -17203,6 +17397,64 @@ async function runCustomQuery(database, context, queryName) {
     };
   }
 }
+var QUERY_ARGUMENT_LIMIT_BYTES = 65536;
+function invalidQueryArgumentsError() {
+  return {
+    message: "Invalid query arguments.",
+    hint: "Use a JSON-compatible argument array no larger than 65536 UTF-8 bytes."
+  };
+}
+function normalizeQueryArguments(value) {
+  if (!Array.isArray(value)) throw new Error("Query arguments must be an array.");
+  const snapshot = normalizeQueryArgumentValue(value, /* @__PURE__ */ new Set());
+  const canonicalJson = JSON.stringify(snapshot);
+  if (Buffer.byteLength(canonicalJson, "utf8") > QUERY_ARGUMENT_LIMIT_BYTES) {
+    throw new Error("Query arguments are too large.");
+  }
+  return snapshot;
+}
+function normalizeQueryArgumentValue(value, ancestors) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("Query arguments must contain finite numbers.");
+    return value;
+  }
+  if (typeof value !== "object") throw new Error("Query arguments must be JSON-compatible.");
+  if (Object.getOwnPropertySymbols(value).length > 0) throw new Error("Query arguments must not contain symbol keys.");
+  if (ancestors.has(value)) throw new Error("Query arguments must not contain cycles.");
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      if (Object.getOwnPropertyNames(value).some((key) => key !== "length" && (!/^(0|[1-9]\\d*)$/.test(key) || Number(key) >= value.length))) {
+        throw new Error("Query arguments must not contain non-index array properties.");
+      }
+      const copy2 = [];
+      for (let index = 0; index < value.length; index += 1) {
+        if (!Object.hasOwn(value, index)) throw new Error("Query arguments must not contain sparse arrays.");
+        copy2.push(normalizeQueryArgumentValue(value[index], ancestors));
+      }
+      return Object.freeze(copy2);
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new Error("Query arguments must contain plain objects only.");
+    }
+    const copy = /* @__PURE__ */ Object.create(null);
+    for (const key of Object.getOwnPropertyNames(value).sort()) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (!descriptor || !descriptor.enumerable || !("value" in descriptor)) throw new Error("Query arguments must not contain accessors.");
+      Object.defineProperty(copy, key, {
+        value: normalizeQueryArgumentValue(descriptor.value, ancestors),
+        enumerable: true,
+        writable: false,
+        configurable: false
+      });
+    }
+    return Object.freeze(copy);
+  } finally {
+    ancestors.delete(value);
+  }
+}
 async function runMutation(database, auth, mutationName, args) {
   let context;
   let result;
@@ -17426,6 +17678,16 @@ function createMutationContext(database, auth) {
   };
   return context;
 }
+function createTeamJoinAdmissionContext(database, auth) {
+  const context = {
+    auth,
+    env: database.serverEnv,
+    log: createEndpointLogger(database)
+  };
+  const holder = createContextHolder(context);
+  context.db = createEndpointReadOnlyDatabaseApi(database, () => holder.current);
+  return context;
+}
 function createCurrentUserJobApi(database, contextGetter) {
   return {
     async enqueue(handlerName, payload, options = {}) {
@@ -23542,7 +23804,7 @@ jobs:
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.8.1";
+var CLI_VERSION = "0.8.5";
 
 // src/cli/sporades.ts
 var SUPPORTED_TEMPLATES = new Set(CLIENT_TEMPLATES);

package/dist/cli/cli-version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.8.1";
+export declare const CLI_VERSION = "0.8.5";
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli/cli-version.js

@@ -1,3 +1,3 @@
 // Generated by `npm run build` from package.json. Do not edit by hand.
-export const CLI_VERSION = "0.8.1";
+export const CLI_VERSION = "0.8.5";
 //# sourceMappingURL=cli-version.js.map

package/dist/server-runtime-source.d.ts

@@ -144,7 +144,7 @@ export declare function sendEmailPasswordResetLink(database: LooseRecord, sessio
     ok: boolean;
     error?: undefined;
 }>;
-export declare function runQuery(database: LooseRecord, auth: any, queryName: string): Promise<any>;
+export declare function runQuery(database: LooseRecord, auth: any, queryName: string, rawArgs?: unknown): Promise<any>;
 export declare function runMutation(database: LooseRecord, auth: any, mutationName: string, args: any): Promise<any>;
 export declare function runAppMessage(database: LooseRecord, auth: any, messageName: any, data: any, options?: LooseRecord): Promise<any>;
 export declare function runCurrentUserJobWorker(database: LooseRecord): Promise<void>;