perf(prefetch): finish removing self-HTTP prefetches and delete the legacy helper

Converts the last four server-render prefetches that called our own API over
HTTP, and deletes prefetch-internal-fetch.ts now that nothing imports it.

- knowledge bases: runs the route's own listInternalKnowledgeBases use case
  with a principal from the same internalSessionAuth policy the route declares,
  then projects through the same presenter and contract. Not a bypass of the
  application boundary — the same path, called in-process.
- tables: extracts the route's list projection into lib/table/wire.ts as
  toTableListItem, which the route and the prefetch now both call. This matters
  because listTablesContract's response schema is a passthrough z.custom, so a
  client fetch caches the route's JSON verbatim. Seeding listTables() directly
  would have put Date objects and the server-only metadata field under a key the
  hook never sees them on.
- pinned items: extracts the route's inline query into lib/pinned-items/queries.ts
  as listPinnedItemsForUser, which the route now calls too.
- workspace members: getWorkspaceMemberProfiles already existed; the prefetch
  calls it directly.

normalizeColumn moves from app/api/table/utils.ts to lib/table/wire.ts with ten
importers repointed. That also removes a pre-existing lib/* -> app/api/* boundary
violation in lib/table/import-runner.ts. No response shape changes: the v1/v2
edits are import-path moves only.

Every converted read proves the viewer first and caches nothing when that fails,
so an unauthorized viewer's client fetch still reaches the route for the real
403. Authorization equivalence was checked by unfolding both paths to
checkWorkspaceAccess rather than assumed.

Author: waleedlatif1

apps/sim/app/api/pinned-items/route.ts

@@ -2,40 +2,21 @@ import { db, pinnedItem } from '@sim/db'
 import { createLogger } from '@sim/logger'
 import { getPostgresErrorCode } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
-import { and, eq, ne } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import {
   createPinnedItemContract,
   listPinnedItemsContract,
   type PinnedItemApi,
-  pinnedResourceTypeSchema,
 } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { filterToActiveResources, pinnableResourceExists } from '@/lib/pinned-items/resources'
+import { listPinnedItemsForUser } from '@/lib/pinned-items/queries'
+import { pinnableResourceExists } from '@/lib/pinned-items/resources'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('PinnedItemsAPI')
 
-/**
- * Narrows a stored row to the wire shape, dropping any row whose `resourceType` this build does
- * not recognise.
- *
- * `pinned_item.resource_type` is plain `text` — deliberately, so the set of pinnable kinds can
- * grow — while the contract is a closed enum. During a rolling deploy an older pod can therefore
- * read a pin a newer one wrote. Returning it would fail response validation and take the WHOLE
- * list down rather than the single row, so the unknown kind is skipped instead.
- *
- * `filterToActiveResources` already drops these as a side effect of not having a table to look
- * them up in; this makes the guarantee explicit and compiler-checked at the wire boundary.
- */
-function toPinnedItemApi(row: typeof pinnedItem.$inferSelect): PinnedItemApi | null {
-  const resourceType = pinnedResourceTypeSchema.safeParse(row.resourceType)
-  if (!resourceType.success) return null
-  return { ...row, resourceType: resourceType.data, pinnedAt: row.pinnedAt.toISOString() }
-}
-
 /** Lists the session user's pinned items in a workspace, optionally filtered to one `resourceType`. */
 export const GET = withRouteHandler(async (request: NextRequest) => {
   const session = await getSession()
@@ -52,30 +33,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     return NextResponse.json({ error: 'Access denied to this workspace' }, { status: 403 })
   }
 
-  const rows = await db
-    .select()
-    .from(pinnedItem)
-    .where(
-      and(
-        eq(pinnedItem.userId, session.user.id),
-        eq(pinnedItem.workspaceId, workspaceId),
-        /**
-         * A `workspace` pin stores `workspaceId === resourceId`, so it would otherwise
-         * appear in this workspace's unscoped listing as a resource *inside* itself.
-         * It is read from the workspace-list payload instead, so it is excluded here
-         * rather than left for a future unscoped caller to mistake for a real resource.
-         */
-        resourceType
-          ? eq(pinnedItem.resourceType, resourceType)
-          : ne(pinnedItem.resourceType, 'workspace')
-      )
-    )
-
-  const activeRows = await filterToActiveResources(rows, workspaceId)
-
-  const pinnedItems = activeRows
-    .map(toPinnedItemApi)
-    .filter((item): item is PinnedItemApi => item !== null)
+  const pinnedItems = await listPinnedItemsForUser(session.user.id, workspaceId, resourceType)
 
   return NextResponse.json({ pinnedItems })
 })

apps/sim/app/api/table/[tableId]/columns/route.test.ts

@@ -49,10 +49,12 @@ vi.mock('@/lib/table/columns/service', () => ({
   updateColumnOptions: mockUpdateColumnOptions,
   updateColumnType: mockUpdateColumnType,
 }))
+vi.mock('@/lib/table/wire', () => ({
+  normalizeColumn: (c: unknown) => c,
+}))
 vi.mock('@/app/api/table/utils', () => ({
   accessError: () => new Response('denied', { status: 403 }),
   checkAccess: mockCheckAccess,
-  normalizeColumn: (c: unknown) => c,
   orchestrationOutcomeErrorResponse: (
     outcome: { error?: string; errorCode?: OrchestrationErrorCode },
     fallback: string

apps/sim/app/api/table/[tableId]/columns/route.ts

@@ -13,10 +13,10 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { addTableColumn, deleteColumn } from '@/lib/table'
 import { signalTableSchemaChanged } from '@/lib/table/events'
 import { performUpdateTableColumn } from '@/lib/table/orchestration'
+import { normalizeColumn } from '@/lib/table/wire'
 import {
   accessError,
   checkAccess,
-  normalizeColumn,
   orchestrationOutcomeErrorResponse,
   rootErrorMessage,
   tableLockErrorResponse,

apps/sim/app/api/table/[tableId]/groups/route.test.ts

@@ -54,7 +54,7 @@ vi.mock('@/lib/table/application/groups', () => ({
   updateTableGroupUseCase: mocks.useCases.update,
 }))
 
-vi.mock('@/app/api/table/utils', () => ({
+vi.mock('@/lib/table/wire', () => ({
   normalizeColumn: vi.fn(),
 }))
 

apps/sim/app/api/table/[tableId]/groups/route.ts

@@ -12,7 +12,7 @@ import {
 } from '@/lib/table/application/groups'
 import { tableOperations } from '@/lib/table/application/operations'
 import type { TableDefinition } from '@/lib/table/types'
-import { normalizeColumn } from '@/app/api/table/utils'
+import { normalizeColumn } from '@/lib/table/wire'
 
 const rateLimit = internalRateLimits.none({
   reason: 'Existing authenticated table group mutations have no request-rate policy',

apps/sim/app/api/table/[tableId]/route.test.ts

@@ -51,9 +51,11 @@ vi.mock('@/lib/workspaces/permissions/utils', () => ({
 vi.mock('@/app/api/table/utils', () => ({
   accessError: () => new Response('denied', { status: 403 }),
   checkAccess: mockCheckAccess,
-  normalizeColumn: (column: unknown) => column,
   tableLockErrorResponse: () => null,
 }))
+vi.mock('@/lib/table/wire', () => ({
+  normalizeColumn: (column: unknown) => column,
+}))
 
 import { GET, PATCH } from '@/app/api/table/[tableId]/route'
 

apps/sim/app/api/table/[tableId]/route.ts

@@ -18,11 +18,11 @@ import {
   performUpdateTableLocks,
 } from '@/lib/table/orchestration'
 import { TABLE_LOCK_FLAGS, TABLE_LOCK_KINDS } from '@/lib/table/types'
+import { normalizeColumn } from '@/lib/table/wire'
 import { getWorkspaceWithOwner } from '@/lib/workspaces/permissions/utils'
 import {
   accessError,
   checkAccess,
-  normalizeColumn,
   orchestrationOutcomeErrorResponse,
   tableLockErrorResponse,
 } from '@/app/api/table/utils'

apps/sim/app/api/table/import-csv/route.test.ts

@@ -34,7 +34,6 @@ vi.mock('@/app/api/table/utils', async () => {
   const { asOrchestrationError, messageForOrchestrationError, statusForOrchestrationError } =
     await import('@/lib/core/orchestration/types')
   return {
-    normalizeColumn: (column: unknown) => column,
     csvProxyBodyCapResponse: () => null,
     multipartErrorResponse: (error: { code: string; message: string }) =>
       NextResponse.json(

apps/sim/app/api/table/route.ts

@@ -15,8 +15,9 @@ import {
   type TableSchema,
   type TableScope,
 } from '@/lib/table'
+import { normalizeColumn, toTableListItem } from '@/lib/table/wire'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
-import { normalizeColumn, orchestrationErrorResponse } from '@/app/api/table/utils'
+import { orchestrationErrorResponse } from '@/app/api/table/utils'
 
 const logger = createLogger('TableAPI')
 
@@ -198,41 +199,10 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
 
     logger.info(`[${requestId}] Listed ${tables.length} tables in workspace ${params.workspaceId}`)
 
-    const responseTables = tables.map((t) => {
-      const schemaData = t.schema as TableSchema
-      return {
-        id: t.id,
-        name: t.name,
-        description: t.description,
-        schema: {
-          columns: schemaData.columns.map(normalizeColumn),
-        },
-        rowCount: t.rowCount,
-        maxRows: t.maxRows,
-        locks: t.locks,
-        workspaceId: t.workspaceId,
-        folderId: t.folderId ?? null,
-        createdBy: t.createdBy,
-        createdAt: t.createdAt instanceof Date ? t.createdAt.toISOString() : String(t.createdAt),
-        updatedAt: t.updatedAt instanceof Date ? t.updatedAt.toISOString() : String(t.updatedAt),
-        archivedAt:
-          t.archivedAt instanceof Date
-            ? t.archivedAt.toISOString()
-            : t.archivedAt
-              ? String(t.archivedAt)
-              : null,
-        jobStatus: t.jobStatus ?? null,
-        jobId: t.jobId ?? null,
-        jobType: t.jobType ?? null,
-        jobError: t.jobError ?? null,
-        jobRowsProcessed: t.jobRowsProcessed ?? 0,
-      }
-    })
-
     return NextResponse.json({
       success: true,
       data: {
-        tables: responseTables,
+        tables: tables.map(toTableListItem),
         totalCount: tables.length,
       },
     })

apps/sim/app/api/table/utils.ts

@@ -17,7 +17,6 @@ import {
 import type { MultipartError } from '@/lib/core/utils/multipart'
 import type { ColumnDefinition, Filter, TableDefinition, TablePredicate } from '@/lib/table'
 import { buildFilterClause, getTableById, TableQueryValidationError } from '@/lib/table'
-import { typeMetadataOf } from '@/lib/table/column-types'
 import { USER_TABLE_ROWS_SQL_NAME } from '@/lib/table/constants'
 import { TableLockedError } from '@/lib/table/mutation-locks'
 import { isTablePredicate } from '@/lib/table/query-builder/converters'
@@ -358,21 +357,3 @@ export function serverErrorResponse(message = 'Internal server error') {
 export const CreateColumnSchema = createTableColumnBodySchema
 export const UpdateColumnSchema = updateTableColumnBodySchema
 export const DeleteColumnSchema = deleteTableColumnBodySchema
-
-export function normalizeColumn(
-  col: ColumnDefinition
-): ColumnDefinition & { required: boolean; unique: boolean } {
-  return {
-    // Preserve the stable column id — it's the row-data storage key, so dropping
-    // it makes clients fall back to `name` and miss id-keyed cell values.
-    ...(col.id ? { id: col.id } : {}),
-    name: col.name,
-    type: col.type,
-    required: col.required ?? false,
-    unique: col.unique ?? false,
-    ...(col.workflowGroupId ? { workflowGroupId: col.workflowGroupId } : {}),
-    // Type-specific metadata is forwarded generically: naming keys here meant a
-    // new type's metadata was stored server-side but silently never returned.
-    ...typeMetadataOf(col),
-  }
-}