@edge-base/server 0.2.7 → 0.2.9

package/admin-build/_app/immutable/nodes/{9.CLtrr0K_.js → 9.B2jgJDkH.js}

@@ -1 +1 @@
-import"../chunks/CWj6FrbW.js";import{o as U}from"../chunks/Bn2NtlTj.js";import{p as j,a as z,f as G,c as b,g as t,s as m,r as g,u as n,b as y,d as D,t as J}from"../chunks/BdTBlfLy.js";import{d as K,s as N,a as O}from"../chunks/DtZk82gG.js";import{a as Q,t as V,e as W,i as X}from"../chunks/CvczjTXx.js";import{a as F,f as I}from"../chunks/DEELgv7K.js";import{d as Y,s as Z}from"../chunks/CjcrXziO.js";import{P as tt}from"../chunks/BkZCgsc3.js";import{a as et}from"../chunks/Q2nPFxS6.js";import{M as _,T as at}from"../chunks/DaXO-sFP.js";import{D as rt,T as nt}from"../chunks/BfpUQYr3.js";var st=I("<button> </button>"),ot=I('<div class="range-selector"></div>'),lt=I('<div class="analytics-grid"><!> <!> <!> <!></div> <div class="analytics-chart"><!></div> <div class="analytics-bottom"><!> <!></div>',1);function yt(w,A){j(A,!0);let s=D(!0),o=D(null),p=D("24h");const M=[{value:"1h",label:"1H"},{value:"6h",label:"6H"},{value:"24h",label:"24H"},{value:"7d",label:"7D"},{value:"30d",label:"30D"}],T=n(()=>()=>{switch(t(p)){case"1h":return"minute";case"6h":case"24h":return"hour";default:return"day"}});async function $(){try{const e=await Q.fetch(`data/analytics?range=${t(p)}&category=function&metric=overview&groupBy=${t(T)()}`);y(o,e,!0)}catch(e){V(Y(e,"Failed to load functions analytics."))}finally{y(s,!1)}}function k(e){y(p,e,!0),y(s,!0),$()}U(()=>{$();const e=setInterval($,3e4);return()=>clearInterval(e)});const H=n(()=>()=>{var c;if(!((c=t(o))!=null&&c.summary))return 0;const{totalRequests:e,totalErrors:a}=t(o).summary;return e>0?a/e*100:0}),B=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.timeSeries)||[]).map(a=>({timestamp:a.timestamp,value:a.requests??a.value??0}))}),C=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.breakdown)||[]).map(a=>({label:a.label||"other",value:a.count}))}),E=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.topItems)||[]).map(a=>({label:a.label,count:a.count,secondary:`${Math.round(a.avgLatency)}ms · ${a.errorRate.toFixed(1)}% 5xx`}))});tt(w,{title:"Functions Analytics",description:"Serverless function execution and performance metrics",get docsHref(){return et},actions:a=>{var c=ot();W(c,21,()=>M,X,(f,d)=>{var l=st();let v;var h=b(l,!0);g(l),J(()=>{v=Z(l,1,"range-btn",null,v,{"range-btn--active":t(p)===t(d).value}),N(h,t(d).label)}),O("click",l,()=>k(t(d).value)),F(f,l)}),g(c),F(a,c)},children:(a,c)=>{var f=lt(),d=G(f),l=b(d);{let r=n(()=>{var i,u;return((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.totalRequests)??0});_(l,{label:"Invocations",get value(){return t(r)},get loading(){return t(s)}})}var v=m(l,2);{let r=n(()=>{var i,u;return((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.uniqueUsers)??0});_(v,{label:"Unique Users",get value(){return t(r)},get loading(){return t(s)}})}var h=m(v,2);{let r=n(()=>t(H)().toFixed(1));_(h,{label:"5xx Rate",get value(){return t(r)},unit:"%",get loading(){return t(s)}})}var L=m(h,2);{let r=n(()=>{var i,u;return Math.round(((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.avgLatency)??0)});_(L,{label:"Avg Duration",get value(){return t(r)},unit:"ms",get loading(){return t(s)}})}g(d);var x=m(d,2),P=b(x);{let r=n(()=>t(B)());at(P,{get data(){return t(r)},type:"bar",height:240,label:"Function invocations over time",get loading(){return t(s)},color:"#dc2626"})}g(x);var R=m(x,2),q=b(R);{let r=n(()=>t(C)());rt(q,{get items(){return t(r)},title:"Functions by invocation count",get loading(){return t(s)}})}var S=m(q,2);{let r=n(()=>t(E)());nt(S,{get items(){return t(r)},title:"Top Functions",get loading(){return t(s)}})}g(R),F(a,f)}}),z()}K(["click"]);export{yt as component};
+import"../chunks/CWj6FrbW.js";import{o as U}from"../chunks/Bn2NtlTj.js";import{p as j,a as z,f as G,c as b,g as t,s as m,r as g,u as n,b as y,d as D,t as J}from"../chunks/BdTBlfLy.js";import{d as K,s as N,a as O}from"../chunks/DtZk82gG.js";import{a as Q,t as V,e as W,i as X}from"../chunks/DncT8xH5.js";import{a as F,f as I}from"../chunks/DEELgv7K.js";import{d as Y,s as Z}from"../chunks/CjcrXziO.js";import{P as tt}from"../chunks/BkZCgsc3.js";import{a as et}from"../chunks/Q2nPFxS6.js";import{M as _,T as at}from"../chunks/YGUb3X-Q.js";import{D as rt,T as nt}from"../chunks/DBkor_jM.js";var st=I("<button> </button>"),ot=I('<div class="range-selector"></div>'),lt=I('<div class="analytics-grid"><!> <!> <!> <!></div> <div class="analytics-chart"><!></div> <div class="analytics-bottom"><!> <!></div>',1);function yt(w,A){j(A,!0);let s=D(!0),o=D(null),p=D("24h");const M=[{value:"1h",label:"1H"},{value:"6h",label:"6H"},{value:"24h",label:"24H"},{value:"7d",label:"7D"},{value:"30d",label:"30D"}],T=n(()=>()=>{switch(t(p)){case"1h":return"minute";case"6h":case"24h":return"hour";default:return"day"}});async function $(){try{const e=await Q.fetch(`data/analytics?range=${t(p)}&category=function&metric=overview&groupBy=${t(T)()}`);y(o,e,!0)}catch(e){V(Y(e,"Failed to load functions analytics."))}finally{y(s,!1)}}function k(e){y(p,e,!0),y(s,!0),$()}U(()=>{$();const e=setInterval($,3e4);return()=>clearInterval(e)});const H=n(()=>()=>{var c;if(!((c=t(o))!=null&&c.summary))return 0;const{totalRequests:e,totalErrors:a}=t(o).summary;return e>0?a/e*100:0}),B=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.timeSeries)||[]).map(a=>({timestamp:a.timestamp,value:a.requests??a.value??0}))}),C=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.breakdown)||[]).map(a=>({label:a.label||"other",value:a.count}))}),E=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.topItems)||[]).map(a=>({label:a.label,count:a.count,secondary:`${Math.round(a.avgLatency)}ms · ${a.errorRate.toFixed(1)}% 5xx`}))});tt(w,{title:"Functions Analytics",description:"Serverless function execution and performance metrics",get docsHref(){return et},actions:a=>{var c=ot();W(c,21,()=>M,X,(f,d)=>{var l=st();let v;var h=b(l,!0);g(l),J(()=>{v=Z(l,1,"range-btn",null,v,{"range-btn--active":t(p)===t(d).value}),N(h,t(d).label)}),O("click",l,()=>k(t(d).value)),F(f,l)}),g(c),F(a,c)},children:(a,c)=>{var f=lt(),d=G(f),l=b(d);{let r=n(()=>{var i,u;return((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.totalRequests)??0});_(l,{label:"Invocations",get value(){return t(r)},get loading(){return t(s)}})}var v=m(l,2);{let r=n(()=>{var i,u;return((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.uniqueUsers)??0});_(v,{label:"Unique Users",get value(){return t(r)},get loading(){return t(s)}})}var h=m(v,2);{let r=n(()=>t(H)().toFixed(1));_(h,{label:"5xx Rate",get value(){return t(r)},unit:"%",get loading(){return t(s)}})}var L=m(h,2);{let r=n(()=>{var i,u;return Math.round(((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.avgLatency)??0)});_(L,{label:"Avg Duration",get value(){return t(r)},unit:"ms",get loading(){return t(s)}})}g(d);var x=m(d,2),P=b(x);{let r=n(()=>t(B)());at(P,{get data(){return t(r)},type:"bar",height:240,label:"Function invocations over time",get loading(){return t(s)},color:"#dc2626"})}g(x);var R=m(x,2),q=b(R);{let r=n(()=>t(C)());rt(q,{get items(){return t(r)},title:"Functions by invocation count",get loading(){return t(s)}})}var S=m(q,2);{let r=n(()=>t(E)());nt(S,{get items(){return t(r)},title:"Top Functions",get loading(){return t(s)}})}g(R),F(a,f)}}),z()}K(["click"]);export{yt as component};

package/admin-build/_app/version.json

@@ -1 +1 @@
-{"version":"1774791730603"}
+{"version":"1775689125712"}

package/admin-build/index.html

@@ -5,12 +5,12 @@
         <meta name="viewport" content="width=device-width, initial-scale=1" />
         <title>EdgeBase Admin</title>
         <link rel="icon" href="/admin/favicon.svg" type="image/svg+xml" />
-        <link href="/admin/_app/immutable/entry/start.MmZh8oBH.js" rel="modulepreload">
-		<link href="/admin/_app/immutable/chunks/BaUG2TJ-.js" rel="modulepreload">
+        <link href="/admin/_app/immutable/entry/start.Bcf0SjPV.js" rel="modulepreload">
+		<link href="/admin/_app/immutable/chunks/B0zJ5_Wk.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/BdTBlfLy.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/Bn2NtlTj.js" rel="modulepreload">
-		<link href="/admin/_app/immutable/chunks/qKdzaeX3.js" rel="modulepreload">
-		<link href="/admin/_app/immutable/entry/app.DoUaxnew.js" rel="modulepreload">
+		<link href="/admin/_app/immutable/chunks/DZo4s3wn.js" rel="modulepreload">
+		<link href="/admin/_app/immutable/entry/app.BW-Ac3jY.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/B2bEC_Hm.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/Bb0e0sAP.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/DtZk82gG.js" rel="modulepreload">
@@ -26,7 +26,7 @@
         <div style="display: contents">
 			<script>
 				{
-					__sveltekit_jgts8u = {
+					__sveltekit_1iz3xys = {
 						base: "/admin",
 						assets: "/admin"
 					};
@@ -34,8 +34,8 @@
 					const element = document.currentScript.parentElement;
 
 					Promise.all([
-						import("/admin/_app/immutable/entry/start.MmZh8oBH.js"),
-						import("/admin/_app/immutable/entry/app.DoUaxnew.js")
+						import("/admin/_app/immutable/entry/start.Bcf0SjPV.js"),
+						import("/admin/_app/immutable/entry/app.BW-Ac3jY.js")
 					]).then(([kit, app]) => {
 						kit.start(app, element);
 					});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edge-base/server",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "EdgeBase runtime assets consumed by the EdgeBase CLI",
   "license": "MIT",
   "repository": {
@@ -34,8 +34,8 @@
     "jose": "^6.0.0",
     "pg": "^8.16.3",
     "zod": "^4.3.6",
-    "@edge-base/core": "0.2.7",
-    "@edge-base/shared": "0.2.7"
+    "@edge-base/core": "0.2.9",
+    "@edge-base/shared": "0.2.9"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.8.71",

package/src/__tests__/admin-assets.test.ts

@@ -8,18 +8,18 @@ import {
 
 describe('admin asset path resolution', () => {
   it('serves index for the admin root', () => {
-    expect(resolveAdminAssetPath('/admin')).toBe('/');
-    expect(resolveAdminAssetPath('/admin/')).toBe('/');
+    expect(resolveAdminAssetPath('/admin')).toBe('/admin/index.html');
+    expect(resolveAdminAssetPath('/admin/')).toBe('/admin/index.html');
   });
 
   it('strips the /admin prefix for built assets', () => {
-    expect(resolveAdminAssetPath('/admin/_app/version.json')).toBe('/_app/version.json');
-    expect(resolveAdminAssetPath('/admin/favicon.png')).toBe('/favicon.png');
+    expect(resolveAdminAssetPath('/admin/_app/version.json')).toBe('/admin/_app/version.json');
+    expect(resolveAdminAssetPath('/admin/favicon.png')).toBe('/admin/favicon.png');
   });
 
   it('falls back to index for client-side admin routes', () => {
-    expect(resolveAdminAssetPath('/admin/login')).toBe('/');
-    expect(resolveAdminAssetPath('/admin/database/tables')).toBe('/');
+    expect(resolveAdminAssetPath('/admin/login')).toBe('/admin/index.html');
+    expect(resolveAdminAssetPath('/admin/database/tables')).toBe('/admin/index.html');
   });
 
   it('rewrites requests without dropping the query string', () => {
@@ -27,7 +27,7 @@ describe('admin asset path resolution', () => {
     const rewritten = createAdminAssetRequest(request);
     const url = new URL(rewritten.url);
 
-    expect(url.pathname).toBe('/');
+    expect(url.pathname).toBe('/admin/index.html');
     expect(url.search).toBe('?next=%2Fadmin%2Fdatabase');
   });
 });

package/src/__tests__/frontend-assets.test.ts

@@ -0,0 +1,75 @@
+import { describe, expect, it } from 'vitest';
+import {
+  applyFrontendAssetHeaders,
+  createFrontendAssetRequest,
+  resolveFrontendAssetPath,
+} from '../lib/frontend-assets.js';
+
+describe('frontend asset path resolution', () => {
+  it('serves index.html for the root mount path', () => {
+    expect(resolveFrontendAssetPath('/', { mountPath: '/' })).toBe('/index.html');
+  });
+
+  it('serves index.html for custom mount roots', () => {
+    expect(resolveFrontendAssetPath('/app', { mountPath: '/app' })).toBe('/app/index.html');
+    expect(resolveFrontendAssetPath('/app/', { mountPath: '/app' })).toBe('/app/index.html');
+  });
+
+  it('keeps explicit asset paths intact', () => {
+    expect(resolveFrontendAssetPath('/assets/main.js', { mountPath: '/' })).toBe('/assets/main.js');
+    expect(resolveFrontendAssetPath('/app/assets/main.js', { mountPath: '/app' })).toBe('/app/assets/main.js');
+  });
+
+  it('falls back to index.html only for HTML navigation when enabled', () => {
+    expect(resolveFrontendAssetPath('/dashboard/settings', {
+      mountPath: '/',
+      spaFallback: true,
+      method: 'GET',
+      accept: 'text/html,application/xhtml+xml',
+    })).toBe('/index.html');
+
+    expect(resolveFrontendAssetPath('/dashboard/settings', {
+      mountPath: '/',
+      spaFallback: true,
+      method: 'GET',
+      accept: 'application/json',
+    })).toBe('/dashboard/settings');
+  });
+
+  it('returns null outside the configured mount path', () => {
+    expect(resolveFrontendAssetPath('/dashboard', { mountPath: '/app' })).toBeNull();
+  });
+
+  it('rewrites requests without dropping the query string', () => {
+    const request = new Request('http://localhost:8787/app/dashboard?tab=settings', {
+      headers: { accept: 'text/html' },
+    });
+    const rewritten = createFrontendAssetRequest(request, {
+      directory: './web/dist',
+      mountPath: '/app',
+      spaFallback: true,
+    });
+    const url = new URL(rewritten!.url);
+
+    expect(url.pathname).toBe('/app/index.html');
+    expect(url.search).toBe('?tab=settings');
+  });
+});
+
+describe('frontend cache headers', () => {
+  it('marks html and PWA entry files as no-cache', () => {
+    const response = applyFrontendAssetHeaders(new Response('ok'), '/index.html');
+    expect(response.headers.get('Cache-Control')).toBe('no-cache');
+
+    const manifest = applyFrontendAssetHeaders(new Response('ok'), '/manifest.webmanifest');
+    expect(manifest.headers.get('Cache-Control')).toBe('no-cache');
+  });
+
+  it('marks hashed assets as immutable and unhashed assets as short-lived', () => {
+    const hashed = applyFrontendAssetHeaders(new Response('ok'), '/assets/app-abc123def456.js');
+    expect(hashed.headers.get('Cache-Control')).toBe('public, max-age=31536000, immutable');
+
+    const plain = applyFrontendAssetHeaders(new Response('ok'), '/favicon.ico');
+    expect(plain.headers.get('Cache-Control')).toBe('public, max-age=300');
+  });
+});

package/src/__tests__/frontend-config.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, it } from 'vitest';
+import { normalizeFrontendMountPath } from '../lib/frontend-config.js';
+
+describe('frontend mount path normalization', () => {
+  it('defaults to the root mount path when unset', () => {
+    expect(normalizeFrontendMountPath(undefined)).toBe('/');
+  });
+
+  it('preserves the root mount path', () => {
+    expect(normalizeFrontendMountPath('/')).toBe('/');
+  });
+
+  it('trims a trailing slash from custom mount paths', () => {
+    expect(normalizeFrontendMountPath('/app/')).toBe('/app');
+  });
+});

package/src/__tests__/frontend-routing.test.ts

@@ -0,0 +1,200 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('cloudflare:workers', () => ({
+  DurableObject: class DurableObject {},
+}));
+
+afterEach(() => {
+  vi.resetModules();
+  vi.restoreAllMocks();
+});
+
+function createExecutionContext(): ExecutionContext {
+  return {
+    waitUntil(promise: Promise<unknown>) {
+      void promise.catch(() => {});
+    },
+    passThroughOnException() {},
+  } as ExecutionContext;
+}
+
+function createEnv(overrides: Record<string, unknown> = {}): Record<string, unknown> {
+  const logsBinding = {
+    idFromName: vi.fn((name: string) => ({ toString: () => name })),
+    get: vi.fn(() => ({
+      fetch: vi.fn(async () => new Response(JSON.stringify({ ok: true }), { status: 200 })),
+    })),
+  };
+
+  return {
+    DATABASE: {} as never,
+    AUTH: {} as never,
+    DATABASE_LIVE: {} as never,
+    ROOMS: {} as never,
+    LOGS: logsBinding as never,
+    STORAGE: {} as never,
+    KV: {} as never,
+    AUTH_DB: {} as never,
+    CONTROL_DB: {} as never,
+    EDGEBASE_CONFIG: {},
+    ...overrides,
+  };
+}
+
+async function loadWorker() {
+  vi.doMock('../lib/runtime-startup.js', () => ({
+    ensureServerStartup: vi.fn().mockResolvedValue(undefined),
+  }));
+
+  const mod = await import('../index.js');
+  return mod.default;
+}
+
+describe('frontend routing', () => {
+  it('serves the frontend root when a root-mounted bundle is configured', async () => {
+    const assetsFetch = vi.fn(async (request: Request) => {
+      const pathname = new URL(request.url).pathname;
+      return new Response(`asset:${pathname}`, { status: 200 });
+    });
+    const worker = await loadWorker();
+
+    const response = await worker.fetch(
+      new Request('http://localhost:8787/'),
+      createEnv({
+        EDGEBASE_CONFIG: {
+          frontend: {
+            directory: './web/dist',
+            spaFallback: true,
+          },
+        },
+        ASSETS: { fetch: assetsFetch },
+      }) as never,
+      createExecutionContext(),
+    );
+
+    expect(response.status).toBe(200);
+    expect(await response.text()).toBe('asset:/index.html');
+    expect(response.headers.get('Cache-Control')).toBe('no-cache');
+    expect(assetsFetch).toHaveBeenCalledTimes(1);
+  });
+
+  it('follows same-origin asset redirects for canonical frontend index routes', async () => {
+    const assetPaths: string[] = [];
+    const assetsFetch = vi.fn(async (request: Request) => {
+      const pathname = new URL(request.url).pathname;
+      assetPaths.push(pathname);
+
+      if (pathname === '/index.html') {
+        return new Response(null, {
+          status: 307,
+          headers: { location: '/' },
+        });
+      }
+
+      return new Response('asset:/', { status: 200 });
+    });
+    const worker = await loadWorker();
+
+    const response = await worker.fetch(
+      new Request('http://localhost:8787/'),
+      createEnv({
+        EDGEBASE_CONFIG: {
+          frontend: {
+            directory: './web/dist',
+            spaFallback: true,
+          },
+        },
+        ASSETS: { fetch: assetsFetch },
+      }) as never,
+      createExecutionContext(),
+    );
+
+    expect(response.status).toBe(200);
+    expect(await response.text()).toBe('asset:/');
+    expect(response.headers.get('Cache-Control')).toBe('no-cache');
+    expect(assetPaths).toEqual(['/index.html', '/']);
+  });
+
+  it('applies SPA fallback only to HTML navigation routes', async () => {
+    const assetPaths: string[] = [];
+    const assetsFetch = vi.fn(async (request: Request) => {
+      const pathname = new URL(request.url).pathname;
+      assetPaths.push(pathname);
+      return pathname === '/index.html'
+        ? new Response('frontend-index', { status: 200 })
+        : new Response('missing', { status: 404 });
+    });
+    const worker = await loadWorker();
+
+    const htmlNavigation = await worker.fetch(
+      new Request('http://localhost:8787/dashboard/settings', {
+        headers: { accept: 'text/html,application/xhtml+xml' },
+      }),
+      createEnv({
+        EDGEBASE_CONFIG: {
+          frontend: {
+            directory: './web/dist',
+            spaFallback: true,
+          },
+        },
+        ASSETS: { fetch: assetsFetch },
+      }) as never,
+      createExecutionContext(),
+    );
+    const missingAsset = await worker.fetch(
+      new Request('http://localhost:8787/assets/missing.js', {
+        headers: { accept: 'text/html,application/xhtml+xml' },
+      }),
+      createEnv({
+        EDGEBASE_CONFIG: {
+          frontend: {
+            directory: './web/dist',
+            spaFallback: true,
+          },
+        },
+        ASSETS: { fetch: assetsFetch },
+      }) as never,
+      createExecutionContext(),
+    );
+
+    expect(await htmlNavigation.text()).toBe('frontend-index');
+    expect(htmlNavigation.status).toBe(200);
+    expect(missingAsset.status).toBe(404);
+    expect(assetPaths).toEqual(['/index.html', '/assets/missing.js']);
+  });
+
+  it('respects custom mount paths and leaves API routes to the worker', async () => {
+    const assetsFetch = vi.fn(async (request: Request) => {
+      const pathname = new URL(request.url).pathname;
+      return new Response(`asset:${pathname}`, { status: 200 });
+    });
+    const worker = await loadWorker();
+    const env = createEnv({
+      EDGEBASE_CONFIG: {
+        frontend: {
+          directory: './web/dist',
+          mountPath: '/app',
+          spaFallback: true,
+        },
+      },
+      ASSETS: { fetch: assetsFetch },
+    }) as never;
+
+    const mounted = await worker.fetch(
+      new Request('http://localhost:8787/app/dashboard', {
+        headers: { accept: 'text/html' },
+      }),
+      env,
+      createExecutionContext(),
+    );
+    const api = await worker.fetch(
+      new Request('http://localhost:8787/api/health'),
+      env,
+      createExecutionContext(),
+    );
+
+    expect(await mounted.text()).toBe('asset:/app/index.html');
+    expect(api.status).toBe(200);
+    expect(assetsFetch).toHaveBeenCalledTimes(1);
+  });
+});

package/src/durable-objects/room-runtime-base.ts

@@ -52,6 +52,33 @@ export interface RoomWSMeta {
   lastSeenAt?: number;
 }
 
+function normalizeAnonymousRoomAuthPayload(value: unknown): SharedAuthContext | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return null;
+  }
+
+  const typed = value as Record<string, unknown>;
+  if (typed.type !== 'anonymous' || typeof typed.subject !== 'string' || typed.subject.trim().length === 0) {
+    return null;
+  }
+
+  const subject = typed.subject.trim();
+  return {
+    id: subject,
+    role: typeof typed.role === 'string' && typed.role.trim().length > 0 ? typed.role.trim() : undefined,
+    email: typeof typed.email === 'string' && typed.email.trim().length > 0 ? typed.email.trim() : undefined,
+    isAnonymous: typed.isAnonymous !== false,
+    custom:
+      typed.custom && typeof typed.custom === 'object' && !Array.isArray(typed.custom)
+        ? (typed.custom as Record<string, unknown>)
+        : undefined,
+    meta:
+      typed.meta && typeof typed.meta === 'object' && !Array.isArray(typed.meta)
+        ? (typed.meta as Record<string, unknown>)
+        : undefined,
+  };
+}
+
 interface PersistedRoomWSAttachment {
   version: 1;
   meta: RoomWSMeta;
@@ -489,7 +516,12 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
 
     // Auth must be first
     if (type === 'auth') {
-      await this.handleAuth(ws, meta, msg.token as string);
+      await this.handleAuth(
+        ws,
+        meta,
+        typeof msg.token === 'string' ? msg.token : undefined,
+        msg.authPayload,
+      );
       return;
     }
 
@@ -765,15 +797,53 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
 
   // ─── Auth Handler ───
 
-  private async handleAuth(ws: WebSocket, meta: RoomWSMeta, token: string): Promise<void> {
+  private async handleAuth(
+    ws: WebSocket,
+    meta: RoomWSMeta,
+    token?: string,
+    authPayload?: unknown,
+  ): Promise<void> {
     const isReAuth = meta.authenticated;
 
-    if (!token) {
+    const anonymousAuth = !token ? normalizeAnonymousRoomAuthPayload(authPayload) : null;
+    if (!token && !anonymousAuth) {
       this.safeSend(ws, { type: 'error', code: 'AUTH_FAILED', message: 'Token required' });
       ws.close(4002, 'Authentication failed');
       return;
     }
 
+    if (anonymousAuth) {
+      meta.authenticated = true;
+      meta.authStateLost = false;
+      meta.lastSeenAt = Date.now();
+      meta.userId = anonymousAuth.id;
+      meta.role = anonymousAuth.role;
+      meta.auth = anonymousAuth;
+      this.setWSMeta(ws, meta);
+
+      if (this.pendingAuth.delete(meta.connectionId)) {
+        this.syncEphemeralTimersToStorage();
+        this._scheduleNextAlarm();
+      }
+
+      if (!isReAuth && meta.userId) {
+        if (this.disconnectTimers.delete(meta.userId)) {
+          this.syncEphemeralTimersToStorage();
+          this._scheduleNextAlarm();
+        }
+        this.addPlayer(meta.connectionId, meta.userId);
+      }
+
+      this.safeSend(ws, {
+        type: isReAuth ? 'auth_refreshed' : 'auth_success',
+        userId: anonymousAuth.id,
+        connectionId: meta.connectionId,
+      });
+      this.syncRoomMonitoringSnapshot();
+      await this.recoverStateIfNeeded();
+      return;
+    }
+
     const secret = this.env.JWT_USER_SECRET;
     if (!secret) {
       this.safeSend(ws, { type: 'error', code: 'SERVER_ERROR', message: 'JWT secret not configured' });
@@ -782,14 +852,15 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
     }
 
     try {
+      const accessToken = token as string;
       const headers = new Headers();
       if (meta.ip) headers.set('CF-Connecting-IP', meta.ip);
       if (meta.userAgent) headers.set('User-Agent', meta.userAgent);
-      headers.set('Authorization', `Bearer ${token}`);
+      headers.set('Authorization', `Bearer ${accessToken}`);
       const { resolveAuthContextFromToken } = await import('../middleware/auth.js');
       const auth = await resolveAuthContextFromToken(
         this.env,
-        token,
+        accessToken,
         new Request('http://internal/api/room/auth', { headers }),
       );
       meta.authenticated = true;
@@ -1157,6 +1228,8 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
 
   protected buildRoomServerAPI(): RoomServerAPI {
     return {
+      namespace: this.namespace ?? '',
+      roomId: this.roomId ?? '',
       getSharedState: (): Record<string, unknown> => {
         return cloneState(this.sharedState);
       },
@@ -1343,7 +1416,8 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
       userId: meta.userId!,
       connectionId: meta.connectionId,
       role: meta.role,
-    };
+      auth: this.buildAuthFromMeta(meta),
+    } as RoomSender;
   }
 
   protected buildAuthFromMeta(meta: RoomWSMeta): SharedAuthContext {