feat(browse): select records in the grid and delete them in bulk

[cb1kenobi]

Adds multi-select and bulk delete to the browse grid, plus the styling fixes that
fell out of making the grid full-width.

What you get

A sticky checkbox gutter pinned to the left of the grid. The header checkbox
toggles select-all/none for the page and shows an indeterminate state when only
some rows are ticked. Once anything is selected, a red-bordered
Delete Selected (n) button appears in the toolbar, confirms, and deletes.

Notes for review

Rows are addressed by raw primary-key value, not TanStack's row-selection
state — its row ids are strings, and mapping them back to the original (often
numeric) keys is exactly the kind of round-trip that turns into a wrong delete.
A row with no value under the declared primary key (the #1199 shape) can't be
named in a delete, so it gets a disabled checkbox. The lookup is
own-property-guarded, so a table declaring a key named constructor or
toString can't resolve to the inherited Object.prototype member.

Selection means "the rows on screen", enforced two ways because neither is
sufficient alone:

• It's stored against an epoch of (entityId, resultSetKey, onlyIfCached) and
  dropped when that moves or the grid is refreshed. entityId matters because
  the route swaps instances without remounting this component — every sibling
  piece of per-instance state resets on allParams for that reason — so a key
  carried across would aim the delete at whatever the next instance stores
  under it. onlyIfCached is in there for the same reason knownLastPage
  retires on it.
• What counts as selected is then derived each render by intersecting that
  set with the keys actually rendered, because the list query can swap its rows
  under unchanged parameters: adding a record invalidates it, and React Query
  refetches on window focus (no defaultOptions are registered, so that default
  is live). Deriving makes the invariant hold by construction rather than by
  remembering to clear at every moment that could break it.

delete was the only write path with no incomplete-write helper — update
and put have had one since #1643 — so it answered 200 while naming skipped
records and Studio reported a clean success. describeIncompleteDelete mirrors
describeIncompleteUpdate's contract exactly: an absent hash list reads as
complete (delete runs against every version Studio manages back to 4.7, and an
unrecognized legacy response isn't evidence of failure), a present non-array is a
responder that does answer this operation with something unreadable. Applied to
both delete paths, since every asymmetry between the write paths so far has come
from changing one and not the other.

The styling commits

fix(browse): run the grid to the pane edge… — the 16px came from gap-4 on the
flex row, outside the grid, so the grid could never reach the edge. The inset
moves onto the toolbar, the pagination footer (which was 4px where the toolbar
was 0) and the database overview, which was borrowing from the same gap. Two
knock-ons: the sidebar resize handle deliberately overhung that gap and would
have covered the grid's first column, but it can't move inside the sidebar
either — the tree's own 10px scrollbar lives there, which is what the original
straddle was avoiding — so it now sits in the pane's first 8px, clearing both.
And the grid's tbody went border → border-y: under border-collapse: collapse
a cell's borders belong to the table's border grid rather than the cell's own
box, so the side borders scrolled with the content while the sticky gutter stayed
put, leaving a 1px seam the scrolled rows showed through.

fix(theme): declare color-scheme… — the app never declared color-scheme
anywhere. Theming is a .dark class, which the CSS variables follow but the
browser's own widgets do not, so native UI was painted in the light palette
regardless. Scrollbars were the visible symptom; this also changes native form
controls app-wide (checkboxes, date pickers) to their dark-mode rendering, which
is intended but is the one change here with reach beyond browse.

Review coverage

Two cross-model rounds (Codex + Gemini) before this PR. Round 1 caught the
instance-crossing selection bug and the missing incomplete-write handling; round 2
caught the derived-selection gap and the resize-handle/scrollbar regression. Both
rounds' findings are fixed, each with a regression test verified to fail without
its fix.

Review feedback addressed (kriszyp, plus Gemini's accessibility notes):

• tableIdentity was ${databaseName}.${tableName}, which is not collision-free
  because Harper permits dots in both names — a.b/c and a/b.c both produce
  a.b.c, so a selected key could survive navigation between them and arrive
  pre-checked in a table the user never selected it in. It is now
  JSON.stringify([databaseName, tableName]), with a dot-containing regression test.
• describeIncompleteDelete no longer reads an absent hash list as success.
  delete has returned both lists since 4.7.33, so the leniency inherited from
  describeIncompleteUpdate bought nothing and would have reported an empty body or
  an HTML 2xx from a proxy as a clean delete. It now follows describeIncompletePut,
  the stricter existing precedent. This also settles wroteNothing — the open
  question this description previously flagged — since it no longer has to decide
  whether an absent list meant zero deleted or unknown.
• Dropped aria-hidden from the filter row's gutter spacer, added role="img" to
  the refresh icon so its label is actually exposed, and moved the indeterminate
  assignment to useLayoutEffect so a partial selection never flashes unchecked.

Testing

tsc, oxlint, dprint, full suite (344 files / 3088 tests) and a production
build all clean. Not verified in a live browser — the visual changes were
reasoned from the existing z-index/border model and confirmed against built CSS,
so the sticky layering and the flush layout deserve a look on a real instance.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	62.87%	8819 / 14026
🔵	Statements	63.21%	9422 / 14905
🔵	Functions	55.6%	2217 / 3987
🔵	Branches	56.52%	6388 / 11302

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/features/instance/databases/index.tsx	0%	0%	0%	0%	21-118
src/features/instance/databases/components/ColumnFilters.tsx	6.66%	0%	0%	6.66%	32-140
src/features/instance/databases/components/DatabaseOverview.tsx	2.63%	0%	0%	2.85%	17-167
src/features/instance/databases/components/DatabaseTableView.tsx	61.56%	48.27%	46.15%	61.13%	224-237, 241-243, 268, 273-276, 338-341, 395-404, 534-536, 541-554, 564-570, 584-600, 604-612, 621-629, 635-653, 664, 686, 702-707, 711-726, 733-737, 740-767, 771-772, 775-778, 783, 787, 805, 824-825, 954-964
src/features/instance/databases/components/TablePagination.tsx	67.34%	79.24%	55.55%	66.66%	53, 57-58, 96, 119-130, 232-237, 254, 267, 302-305
src/features/instance/databases/components/TableView.tsx	88.73%	77.77%	97.22%	88.32%	202, 275, 339, 344-358, 570-578, 612, 689-695
src/features/instance/databases/modals/EditTableRowModal.tsx	97%	89.11%	93.75%	96.93%	221-222, 326
src/integrations/api/instance/database/deleteTableRecords.ts	70%	90%	33.33%	70%	55-67

Generated in workflow #1908 for commit 1ff845f by the Vitest Coverage Report Action

[gemini-code-assist]

Code Review

This pull request introduces a robust row selection and bulk delete feature to the database table view, ensuring selection state is safely derived from visible rows and cleared on refresh. It also adds proper handling and user notifications for incomplete delete responses, refines the sidebar resizing behavior, and sets the appropriate CSS color-scheme for native dark-mode scrollbars. Feedback focuses on accessibility and UX improvements, specifically recommending the removal of aria-hidden on placeholder table cells to preserve screen reader grid structures, utilizing useLayoutEffect to prevent a 1-frame flicker on indeterminate checkboxes, and adding role="img" to the refresh icon for better assistive technology support.

[gemini-code-assist]

Using aria-hidden on a TableCell inside a visible table row breaks the table grid structure for screen readers, as they expect every row to have the same number of cells. Removing aria-hidden from this placeholder cell ensures the table structure remains consistent and accessible.

Suggested change

	{selectColumnWidth !== undefined && (
	<TableCell
	aria-hidden
	style={{ width: `${selectColumnWidth}px` }}
	// The right divider is an inset shadow, not `border-r` — see
	// SELECT_COLUMN_DIVIDER in TableView: a collapsed border doesn't travel
	// with a sticky cell.
	className="sticky top-10 left-0 z-20 bg-card dark:bg-black-dark border-b border-border shadow-[inset_-1px_0_0_var(--color-border)]"
	/>
	)}
	{selectColumnWidth !== undefined && (
	<TableCell
	style={{ width: `${selectColumnWidth}px` }}
	// The right divider is an inset shadow, not `border-r` — see
	// SELECT_COLUMN_DIVIDER in TableView: a collapsed border doesn't travel
	// with a sticky cell.
	className="sticky top-10 left-0 z-20 bg-card dark:bg-black-dark border-b border-border shadow-[inset_-1px_0_0_var(--color-border)]"
	/>
	)}

[gemini-code-assist]

Setting the indeterminate property on a checkbox DOM node inside useEffect runs after the browser has painted, which can cause a brief 1-frame visual flicker where the checkbox renders as checked or unchecked before becoming indeterminate. Using useLayoutEffect instead ensures the property is applied synchronously before the browser paints.

Suggested change

	useEffect(() => {
	if (ref.current) {
	ref.current.indeterminate = indeterminate;
	}
	}, [indeterminate]);
	useLayoutEffect(() => {
	if (ref.current) {
	ref.current.indeterminate = indeterminate;
	}
	}, [indeterminate]);

[gemini-code-assist]

When adding an aria-label to an SVG element (like RefreshCwIcon), it is recommended to also add role="img" to ensure that assistive technologies correctly identify the element as an image/icon with an accessible label, rather than ignoring it or treating it as generic layout.

<RefreshCwIcon aria-label="Refresh table" role="img" />

[kriszyp]

I think this seems useful, looks good to me.

_{🤖 Reviewed with Codex}

[dawsontoth]

I want keyboard shortcuts:

1. Left and right or up and down arrow keys, when the modal is open and the editor isn't focused, to look between records.
2. Cmd/ctrl or shift click to select rows when dealing with the table.

[cb1kenobi]

Left and right or up and down arrow keys, when the modal is open and the editor isn't focused, to look between records.

Wouldn't that be unrelated to this PR? I can fix in another PR.

[dawsontoth]

@cb1kenobi lol, you already implemented it. I'm a sneaky bastard. 😆

[cb1kenobi]

Both of these are in now, and thanks for the nudge on the arrow keys — the timing was funny but the ask was right.

Cmd/Ctrl-click toggles a single row without opening the record editor. Plain click is already spoken for here (it opens the editor), so Cmd/Ctrl-click is the "pick this row, don't open it" analogue rather than the usual "add to selection without clearing" — there's nothing to clear, since we never drop a selection on a plain click.

Shift-click selects the range between the row you last picked without shift and the one you click. It works from the checkbox or from anywhere on the row.

One design note worth surfacing, because it's the part that isn't obvious: a shift range applies the state of the click that anchored it rather than always selecting. Untick a row, shift-click away from it, and the range unticks; tick one and it ticks. That's one rule for both directions, so deselecting a run doesn't need a modifier of its own.

The alternative — having the range toggle each row it crosses — looks equivalent and isn't: it inverts whatever it spans, so dragging the far end back over rows you'd already picked would silently drop them, and a range across a mixed run would produce something nobody asked for. Applying a single state also makes re-covering a row a no-op, which is what keeps adjusting the far end predictable.

Two other details: the anchor is held as a primary-key value rather than a row index, so if the rows move underneath it (a background refetch, or a new record pushing rows onto another page) the shift-click quietly degrades to a plain pick instead of measuring from whatever row now sits in that slot. And rows with no addressable primary key are stepped over by a range rather than ending it.

_{🤖 Generated by Claude Opus 5}