deepspace 0.13.0 → 0.15.0

package/dist/worker.d.ts

@@ -2550,6 +2550,9 @@ declare function getMessageType(data: Uint8Array): number;
 
 /** First source migration required by the canonical app identity cutover. */
 declare const CANONICAL_APP_IDENTITY_MIGRATION_ID = "2026-08-canonical-app-identity-wire";
+/** Asset-layer misses became real 404s, and the worker owns the fallback. The
+ *  config and the worker's fallback path have to move together. */
+declare const WORKER_OWNED_NOT_FOUND_MIGRATION_ID = "2026-08-worker-owned-not-found";
 type AppMigrationIdsValidation = {
     valid: true;
     ids: string[];
@@ -2736,6 +2739,82 @@ interface ResolvedDeepSpaceAgentModel {
 }
 declare function resolveDeepSpaceAgentModel(modelId: unknown, profileId?: DeepSpaceAgentProfileId): ResolvedDeepSpaceAgentModel | null;
 
+/**
+ * Routing decisions the deploy worker, the CLI, and the scaffold all depend
+ * on. One home so they cannot drift — see docs/platform/app-platform-contract.md
+ * for why this boundary needs one.
+ */
+/** Where every release serves its own identity. The deploy worker injects this
+ *  asset; the CLI polls it to learn which release an edge is serving. */
+declare const RELEASE_STAMP_PATH = "/.well-known/deepspace/release.json";
+/**
+ * What the asset layer does with a path it has no file for — Cloudflare's own
+ * `not_found_handling`, restated here because both ends of a deploy have to
+ * agree on the legal values.
+ *
+ * The app declares this and the platform honors it. It is the app's to declare
+ * because it is half of a decision whose other half lives in the app's worker:
+ * `none` sends misses to the worker, which is the only place that can tell a
+ * client route from a missing file, and a worker written for one setting
+ * misbehaves under the other. Overriding it from here would silently rewrite
+ * the behavior of code the platform did not write — see
+ * docs/platform/app-platform-contract.md.
+ */
+declare const ASSET_NOT_FOUND_HANDLING_VALUES: readonly ["none", "single-page-application", "404-page"];
+type AssetNotFoundHandling = (typeof ASSET_NOT_FOUND_HANDLING_VALUES)[number];
+/**
+ * Applied when a deploy declares nothing.
+ *
+ * This is NOT Cloudflare's default (`none`) and not the value new apps ship.
+ * It is what the platform hardcoded for every app before it started honoring
+ * the declaration, and a deploy carrying no declaration is a CLI too old to
+ * send one — necessarily paired with an app written for the old behavior.
+ * Anything else here breaks every app whose CLI has not been upgraded, which
+ * is the failure Rule 1 exists to prevent.
+ */
+declare const UNDECLARED_ASSET_NOT_FOUND_HANDLING: AssetNotFoundHandling;
+declare function isAssetNotFoundHandling(value: unknown): value is AssetNotFoundHandling;
+/** Stated, not inherited from the compatibility date: from 2025-04-01 the
+ *  default sends navigations to the asset layer, which under
+ *  `not_found_handling: "none"` would 404 every client route before the
+ *  worker sees it. Required for every app, whatever it declares above. */
+declare const REQUIRED_COMPATIBILITY_FLAGS: readonly ["nodejs_compat", "assets_navigation_has_no_effect"];
+/** Required flags plus whatever the app added that does not contradict them. */
+declare function resolveCompatibilityFlags(declared: readonly string[] | undefined): string[];
+/** Routes Cloudflare hands to the worker before the asset layer answers. The
+ *  agent paths are here so an app publishing nothing there 404s instead of
+ *  returning its homepage. */
+declare const SDK_RUN_WORKER_FIRST: readonly ["/api/*", "/ws/*", "/internal/*", "/v1/*", "/_deepspace/*", "/llms.txt", "/llms-full.txt", "/.well-known/mcp", "/.well-known/mcp.json", "/.well-known/mcp/*"];
+/** Deny-list for an app's own `run_worker_first`. Strictly wider than what the
+ *  platform routes worker-first; expressing it as a superset keeps the
+ *  difference deliberate. */
+declare const RESERVED_RUN_WORKER_FIRST: readonly string[];
+/**
+ * Whether the platform owns this path — so an app's worker must answer 404
+ * rather than its shell when nothing is published there. Exported as a
+ * predicate, not a list, because the patterns carry globs and every caller
+ * matching them by hand is another copy that can drift.
+ */
+declare function isPlatformReservedPath(pathname: string): boolean;
+
+/**
+ * The platform endpoints this SDK's client hooks call through an app's proxy.
+ *
+ * The app's worker forwards these with its own identity, so the proxy is an
+ * allow-list rather than a passthrough. That list has to match what the hooks
+ * actually call — and only this package knows that, which is why it is stated
+ * here instead of copied into each scaffold. A frozen copy in a customer's
+ * repo would 404 the next hook we ship, in their browser, silently.
+ *
+ * The scaffold still registers the proxy itself, visibly and editably; it just
+ * reads the routes from here.
+ */
+interface ProxyRoute {
+    method: string;
+    path: string;
+}
+declare const BROWSER_PROXY_ROUTES: ReadonlyArray<ProxyRoute>;
+
 /**
  * Wildcard-aware CORS origin matching for the platform workers.
  *
@@ -2947,6 +3026,33 @@ declare const UPLOAD_PART_BYTES: number;
  * R2 allows 10,000 parts, so this is far inside what the API permits.
  */
 declare const MAX_UPLOAD_PARTS: number;
+/**
+ * Per-tier storage schedule, in bytes. Product semantics, not a deployment
+ * dial — the one table both storage allocations admit against:
+ *
+ *   - the repo store (Git packs + retained bundles + deploy assets), admitted
+ *     by the app's Repo DO (`platform/deploy-worker/src/vc/storage-quota.ts`)
+ *   - the app-files allocation, admitted by the shared files handler
+ *     (`server/utils/scoped-r2-files.ts`)
+ *
+ * Each allocation gets the full amount independently; they are different
+ * buckets with different writers (docs/platform/r2-storage.md). The
+ * customer-visible "storage" number is the app-files allocation — the repo
+ * store is platform bookkeeping that degrades (drops rollback retention)
+ * rather than surfacing here.
+ */
+declare const APP_STORAGE_LIMIT_BYTES: {
+    readonly test: 0;
+    readonly free: number;
+    readonly starter: number;
+    readonly premium: number;
+    readonly admin: number;
+};
+/** The storage limit for a billing tier; unknown or missing tiers get free. */
+declare function storageLimitForTier(tier: string | null | undefined): number;
+/** The one storage-quota refusal sentence. `usedBytes` is net of any object
+ *  the upload replaces, so an upsert is charged only for its growth. */
+declare function storageQuotaMessage(incomingBytes: number, usedBytes: number, limitBytes: number): string;
 /**
  * The largest single file a deploy may ship as a static asset.
  *
@@ -3019,8 +3125,26 @@ interface ScopedR2Config {
      */
     requireAuthForMutations?: boolean;
 }
+/**
+ * The storage-quota contract for one allocation, supplied per request by the
+ * mount. The handler is the enforcer; the mount only knows whose limit
+ * applies.
+ */
+interface StorageAdmission {
+    /** The WHOLE allocation the quota governs — the app prefix, not the
+     *  (possibly deeper) scope prefix a request resolved to. */
+    prefix: string;
+    /**
+     * Resolve the owner's limit in bytes. `null` means the lookup failed;
+     * writes then fail closed (503) rather than admitting unmetered storage,
+     * mirroring the repo store's `StorageBillingUnavailableError`.
+     */
+    limitBytes: () => Promise<number | null>;
+}
 interface ScopedR2Auth {
     userId: string | null;
+    /** Absent = no quota on this mount (e.g. an app's own bucket). */
+    storage?: StorageAdmission;
 }
 type ScopedR2Handler = (request: Request, url: URL, bucket: R2Bucket, auth: ScopedR2Auth) => Promise<Response>;
 declare function isFilesVerbPath(method: string, subpath: string): boolean;
@@ -5237,4 +5361,4 @@ interface AppLogsResponse {
 declare const APP_LOG_EVENT_KEYS: readonly ["id", "timestamp", "level", "eventType", "message", "source", "outcome", "request", "exception"];
 type AppLogEventKey = (typeof APP_LOG_EVENT_KEYS)[number];
 
-export { AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_ID_RE, APP_LOG_EVENT_KEYS, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppMigrationIdsValidation, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, CANONICAL_APP_IDENTITY_MIGRATION_ID, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CLIENT_LOG_MARKER, CONVERSATION_SCHEMAS, COST_RATES, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientErrorKind, type ClientErrorReport, type ClientMessage, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConnectionAttachment, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEEPSPACE_AGENT_PROFILES, DEEPSPACE_AI_DEFAULTS, DEEPSPACE_AI_MODELS, DEEPSPACE_MODEL_CATALOG_PROVENANCE, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIModel, type DeepSpaceAIModelId, type DeepSpaceAIOptions, type DeepSpaceAIProvider, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, type DeepSpaceAgentProfile, DeepSpaceAgentProfileError, type DeepSpaceAgentProfileId, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAgentSupport, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DeepSpaceDocumentationRouteEnv, type DeepSpaceDocumentationRouteOptions, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GetActionData, type GlobalDOType, type HandlerContext, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, LOG_LEVELS, type LogLevel, MAX_APP_FILE_BYTES, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, REGISTRY_INSTANCE, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, RESOURCE_ID_RE, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, RegistryClientError, type ResolvedColumn, type ResolvedDeepSpaceAgentModel, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, STRICT_APP_ID_RE, SYSTEM_COLLECTIONS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type ServerMessage, type SharedConnection, type StoredRecord, type Summarizer, type SyncResult, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKSPACE_SCHEMAS, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, capToolResultSize, captureScreenshot, checkFieldPermissions, clientBuild, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, enqueueJob, formatBytes, getChat, getDeepSpaceAIModel, getGlobalDOSchemas, getGlobalDOType, getMessageType, getRolePermissions, handleAwarenessMessage, handleClientErrorReport, handleSyncMessage, hasContent, isAutoProvision, isFilesVerbPath, isOwner, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, lintSchema, listDeepSpaceAgentModels, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, noopPermissionContext, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, readVarUint, readVarUint8Array, registerClientErrorRoute, registerDeepSpaceDocumentation, registryErrorJson, registryStub, resolveAppName, resolveColumn, resolveDeepSpaceAgentModel, rowToData, runMigrations, serverBuild, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, toUint8Array, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppMigrationIds, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema, writeVarUint, writeVarUint8Array };
+export { AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_ID_RE, APP_LOG_EVENT_KEYS, APP_NAME_RULES, APP_STORAGE_LIMIT_BYTES, ASSET_NOT_FOUND_HANDLING_VALUES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppMigrationIdsValidation, type AppNameResolution, type AppNameValidation, type AssetNotFoundHandling, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BROWSER_PROXY_ROUTES, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, CANONICAL_APP_IDENTITY_MIGRATION_ID, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CLIENT_LOG_MARKER, CONVERSATION_SCHEMAS, COST_RATES, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientErrorKind, type ClientErrorReport, type ClientMessage, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConnectionAttachment, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEEPSPACE_AGENT_PROFILES, DEEPSPACE_AI_DEFAULTS, DEEPSPACE_AI_MODELS, DEEPSPACE_MODEL_CATALOG_PROVENANCE, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIModel, type DeepSpaceAIModelId, type DeepSpaceAIOptions, type DeepSpaceAIProvider, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, type DeepSpaceAgentProfile, DeepSpaceAgentProfileError, type DeepSpaceAgentProfileId, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAgentSupport, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DeepSpaceDocumentationRouteEnv, type DeepSpaceDocumentationRouteOptions, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GetActionData, type GlobalDOType, type HandlerContext, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, LOG_LEVELS, type LogLevel, MAX_APP_FILE_BYTES, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, type ProxyRoute, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, REGISTRY_INSTANCE, RELEASE_STAMP_PATH, REQUIRED_COMPATIBILITY_FLAGS, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, RESERVED_RUN_WORKER_FIRST, RESOURCE_ID_RE, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, RegistryClientError, type ResolvedColumn, type ResolvedDeepSpaceAgentModel, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, SDK_RUN_WORKER_FIRST, STRICT_APP_ID_RE, SYSTEM_COLLECTIONS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type ServerMessage, type SharedConnection, type StorageAdmission, type StoredRecord, type Summarizer, type SyncResult, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, UNDECLARED_ASSET_NOT_FOUND_HANDLING, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKER_OWNED_NOT_FOUND_MIGRATION_ID, WORKSPACE_SCHEMAS, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, capToolResultSize, captureScreenshot, checkFieldPermissions, clientBuild, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, enqueueJob, formatBytes, getChat, getDeepSpaceAIModel, getGlobalDOSchemas, getGlobalDOType, getMessageType, getRolePermissions, handleAwarenessMessage, handleClientErrorReport, handleSyncMessage, hasContent, isAssetNotFoundHandling, isAutoProvision, isFilesVerbPath, isOwner, isPlatformReservedPath, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, lintSchema, listDeepSpaceAgentModels, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, noopPermissionContext, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, readVarUint, readVarUint8Array, registerClientErrorRoute, registerDeepSpaceDocumentation, registryErrorJson, registryStub, resolveAppName, resolveColumn, resolveCompatibilityFlags, resolveDeepSpaceAgentModel, rowToData, runMigrations, serverBuild, storageLimitForTier, storageQuotaMessage, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, toUint8Array, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppMigrationIds, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema, writeVarUint, writeVarUint8Array };

package/dist/worker.js

@@ -6019,6 +6019,7 @@ var RESERVED_COLLECTION_NAMES = new Set(
 var APP_MIGRATION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
 var MAX_APP_MIGRATION_IDS = 256;
 var CANONICAL_APP_IDENTITY_MIGRATION_ID = "2026-08-canonical-app-identity-wire";
+var WORKER_OWNED_NOT_FOUND_MIGRATION_ID = "2026-08-worker-owned-not-found";
 function validateAppMigrationIds(value) {
   if (!Array.isArray(value)) {
     return { valid: false, reason: "app migrations must be a JSON string array" };
@@ -6170,6 +6171,76 @@ function resolveDeepSpaceAgentModel(modelId, profileId = "application") {
   return { modelId: model.id, provider: model.provider, model, profile };
 }
 
+// src/shared/app-routing.ts
+var RELEASE_STAMP_PATH = "/.well-known/deepspace/release.json";
+var ASSET_NOT_FOUND_HANDLING_VALUES = [
+  "none",
+  "single-page-application",
+  "404-page"
+];
+var UNDECLARED_ASSET_NOT_FOUND_HANDLING = "single-page-application";
+function isAssetNotFoundHandling(value) {
+  return ASSET_NOT_FOUND_HANDLING_VALUES.includes(value);
+}
+var REQUIRED_COMPATIBILITY_FLAGS = [
+  "nodejs_compat",
+  "assets_navigation_has_no_effect"
+];
+var CONTRADICTORY_COMPATIBILITY_FLAGS = /* @__PURE__ */ new Set([
+  "no_nodejs_compat",
+  "assets_navigation_prefers_asset_serving"
+]);
+function resolveCompatibilityFlags(declared) {
+  const flags = new Set(REQUIRED_COMPATIBILITY_FLAGS);
+  for (const flag of declared ?? []) {
+    if (typeof flag !== "string") continue;
+    const trimmed = flag.trim();
+    if (!trimmed || CONTRADICTORY_COMPATIBILITY_FLAGS.has(trimmed)) continue;
+    flags.add(trimmed);
+  }
+  return [...flags];
+}
+var SDK_RUN_WORKER_FIRST = [
+  "/api/*",
+  "/ws/*",
+  "/internal/*",
+  "/v1/*",
+  "/_deepspace/*",
+  "/llms.txt",
+  "/llms-full.txt",
+  "/.well-known/mcp",
+  "/.well-known/mcp.json",
+  "/.well-known/mcp/*"
+];
+var DOCUMENTATION_PATHS = [
+  "/_documentation",
+  "/_documentation/*",
+  "/_documentation-root",
+  "/_documentation-root/*"
+];
+var RESERVED_RUN_WORKER_FIRST = [
+  ...SDK_RUN_WORKER_FIRST,
+  ...DOCUMENTATION_PATHS
+];
+function isPlatformReservedPath(pathname) {
+  return RESERVED_RUN_WORKER_FIRST.some((pattern) => {
+    if (!pattern.endsWith("/*")) return pathname === pattern;
+    const base = pattern.slice(0, -2);
+    return pathname === base || pathname.startsWith(`${base}/`);
+  });
+}
+
+// src/shared/platform-proxy.ts
+var BROWSER_PROXY_ROUTES = [
+  // useSubscription — read state, subscribe, manage billing.
+  { method: "GET", path: "/_deepspace/subscriptions/me" },
+  { method: "POST", path: "/_deepspace/subscriptions/checkout" },
+  { method: "POST", path: "/_deepspace/subscriptions/portal" },
+  // useCheckout (one-time charges).
+  { method: "POST", path: "/_deepspace/charges/create" },
+  { method: "GET", path: "/_deepspace/charges/me" }
+];
+
 // src/server/utils/cors.ts
 function matchOrigin(origin, patterns) {
   if (!origin) return null;
@@ -6246,6 +6317,23 @@ var MAX_UPLOAD_REQUEST_BYTES = 25 * 1024 * 1024;
 var UPLOAD_PART_BYTES = 20 * 1024 * 1024;
 var MAX_UPLOAD_PARTS = Math.ceil(MAX_APP_FILE_BYTES / UPLOAD_PART_BYTES);
 var MAX_BASE64_UPLOAD_BYTES = Math.floor(MAX_UPLOAD_REQUEST_BYTES * 3 / 4);
+var APP_STORAGE_LIMIT_BYTES = {
+  test: 0,
+  free: 128 * 1024 * 1024,
+  starter: 512 * 1024 * 1024,
+  premium: 2 * 1024 * 1024 * 1024,
+  admin: 10 * 1024 * 1024 * 1024
+};
+function storageLimitForTier(tier) {
+  if (tier && Object.hasOwn(APP_STORAGE_LIMIT_BYTES, tier)) {
+    return APP_STORAGE_LIMIT_BYTES[tier];
+  }
+  return APP_STORAGE_LIMIT_BYTES.free;
+}
+function storageQuotaMessage(incomingBytes, usedBytes, limitBytes) {
+  const free = Math.max(0, limitBytes - usedBytes);
+  return `This upload needs ${formatBytes(incomingBytes)} but the app's file storage has ${formatBytes(free)} free (${formatBytes(usedBytes)} of ${formatBytes(limitBytes)} used). Delete files with \`deepspace app files rm <key>\`, or upgrade the owner's plan.`;
+}
 var MAX_DEPLOY_ASSET_FILE_BYTES = 25 * 1024 * 1024;
 var DANGEROUS_MIME_TYPES = /* @__PURE__ */ new Set([
   "text/html",
@@ -6332,6 +6420,52 @@ function declaredLength(request, what) {
 function isKeyWithinPrefix(key, prefix) {
   return key.startsWith(prefix);
 }
+async function allocationUsage(bucket, prefix) {
+  let total = 0;
+  let cursor;
+  do {
+    const page = await bucket.list({ prefix, cursor, limit: 1e3 });
+    for (const object of page.objects) total += object.size;
+    cursor = page.truncated ? page.cursor : void 0;
+  } while (cursor !== void 0);
+  return total;
+}
+async function admitStorage(bucket, storage, incomingBytes, replacesKey) {
+  if (!storage) return null;
+  const limit = await storage.limitBytes();
+  if (limit === null) {
+    return fail(
+      503,
+      "The storage limit for this app could not be verified; nothing was uploaded. Retry shortly.",
+      "storage_limit_unavailable"
+    );
+  }
+  const stored = await allocationUsage(bucket, storage.prefix);
+  const replaced = replacesKey === null ? 0 : (await bucket.head(replacesKey))?.size ?? 0;
+  const used = stored - replaced;
+  if (used + incomingBytes <= limit) return null;
+  return fail(409, storageQuotaMessage(incomingBytes, used, limit), "storage_quota_exceeded", {
+    usedBytes: used,
+    limitBytes: limit
+  });
+}
+async function admitAssembledObject(bucket, storage, key, objectBytes) {
+  if (!storage) return null;
+  const limit = await storage.limitBytes();
+  if (limit === null) {
+    console.error("[files:quota] limit unavailable at complete; keeping", key);
+    return null;
+  }
+  const stored = await allocationUsage(bucket, storage.prefix);
+  if (stored <= limit) return null;
+  await bucket.delete(key).catch(() => void 0);
+  return fail(
+    409,
+    `${storageQuotaMessage(objectBytes, stored - objectBytes, limit)} The assembled upload was not kept.`,
+    "storage_quota_exceeded",
+    { usedBytes: stored - objectBytes, limitBytes: limit }
+  );
+}
 function anchorKey(raw, prefix) {
   const safe = sanitizeSubpath(raw);
   if (safe === null) return fail(400, "Invalid key: traversal not allowed", "invalid_key");
@@ -6421,10 +6555,10 @@ function createScopedR2Handler(config) {
         await request.body?.cancel().catch(() => void 0);
         return fail(401, "Authentication required", "unauthorized");
       }
-      return subpath === "upload" ? handleUpload(request, url, bucket, prefix, auth.userId, scope) : handleMultipart(request, url, bucket, prefix, auth.userId, scope, subpath);
+      return subpath === "upload" ? handleUpload(request, url, bucket, prefix, auth, scope) : handleMultipart(request, url, bucket, prefix, auth, scope, subpath);
     }
     if (!subpath && request.method === "GET") {
-      return handleList(bucket, prefix, url, scope);
+      return handleList(bucket, prefix, url, scope, auth);
     }
     if (subpath && request.method === "GET") {
       if (!isKeyWithinPrefix(subpath, prefix)) {
@@ -6458,7 +6592,7 @@ function createScopedR2Handler(config) {
     return Response.json({ error: "Method not allowed" }, { status: 405, headers: CORS_HEADERS3 });
   };
 }
-async function handleUpload(request, url, bucket, prefix, userId, scope) {
+async function handleUpload(request, url, bucket, prefix, auth, scope) {
   try {
     const declared = overRequestBound(Number(request.headers.get("content-length")), 8 * 1024);
     if (declared) return declared;
@@ -6489,9 +6623,12 @@ async function handleUpload(request, url, bucket, prefix, userId, scope) {
     if (mime instanceof Response) return mime;
     const located = locateUpload(url, prefix, fileName);
     if (located instanceof Response) return located;
+    const replacesKey = url.searchParams.get("key") === null ? null : located.key;
+    const overQuota = await admitStorage(bucket, auth.storage, fileData.byteLength, replacesKey);
+    if (overQuota) return overQuota;
     await bucket.put(located.key, fileData, {
       httpMetadata: { contentType: mime.mimeType },
-      customMetadata: fileMetadata(fileName, userId)
+      customMetadata: fileMetadata(fileName, auth.userId)
     });
     return storedFileJson(located.key, fileName, url, scope);
   } catch (err) {
@@ -6566,17 +6703,17 @@ async function streamPart(upload, partNumber, body, expectedBytes) {
   }
   return { ok: true, part: uploaded.value };
 }
-async function handleMultipart(request, url, bucket, prefix, userId, scope, subpath) {
+async function handleMultipart(request, url, bucket, prefix, auth, scope, subpath) {
   if (subpath === "multipart" && request.method === "POST") {
-    return multipartInit(request, url, bucket, prefix, userId);
+    return multipartInit(request, url, bucket, prefix, auth);
   }
   if (subpath === "multipart/part") return multipartPart(request, url, bucket, prefix);
   if (subpath === "multipart/complete") {
-    return multipartComplete(request, url, bucket, prefix, scope);
+    return multipartComplete(request, url, bucket, prefix, auth, scope);
   }
   return multipartAbort(url, bucket, prefix);
 }
-async function multipartInit(request, url, bucket, prefix, userId) {
+async function multipartInit(request, url, bucket, prefix, auth) {
   const body = await readControlJson(request);
   if (body instanceof Response) return body;
   const size = body.size;
@@ -6591,11 +6728,14 @@ async function multipartInit(request, url, bucket, prefix, userId) {
   if (mime instanceof Response) return mime;
   const located = locateUpload(url, prefix, name);
   if (located instanceof Response) return located;
+  const replacesKey = url.searchParams.get("key") === null ? null : located.key;
+  const overQuota = await admitStorage(bucket, auth.storage, size, replacesKey);
+  if (overQuota) return overQuota;
   let upload;
   try {
     upload = await bucket.createMultipartUpload(located.key, {
       httpMetadata: { contentType: mime.mimeType },
-      customMetadata: fileMetadata(name, userId)
+      customMetadata: fileMetadata(name, auth.userId)
     });
   } catch (error) {
     return multipartFailure(error);
@@ -6645,7 +6785,7 @@ async function multipartPart(request, url, bucket, prefix) {
     { headers: CORS_HEADERS3 }
   );
 }
-async function multipartComplete(request, url, bucket, prefix, scope) {
+async function multipartComplete(request, url, bucket, prefix, auth, scope) {
   const body = await readControlJson(request);
   if (body instanceof Response) return body;
   const session = resolveSession(url, prefix);
@@ -6679,6 +6819,8 @@ async function multipartComplete(request, url, bucket, prefix, scope) {
     await bucket.delete(session.key).catch(() => void 0);
     return tooBig;
   }
+  const overQuota = await admitAssembledObject(bucket, auth.storage, session.key, object.size);
+  if (overQuota) return overQuota;
   const name = object.customMetadata?.originalName ?? session.key.split("/").pop() ?? "file";
   return storedFileJson(session.key, name, url, scope);
 }
@@ -6693,7 +6835,7 @@ async function multipartAbort(url, bucket, prefix) {
   }
   return Response.json({ success: true, aborted: true }, { headers: CORS_HEADERS3 });
 }
-async function handleList(bucket, prefix, url, scope) {
+async function handleList(bucket, prefix, url, scope, auth) {
   const userPrefix = url.searchParams.get("prefix") || "";
   const listPrefix = `${prefix}${userPrefix}`;
   const limit = parseInt(url.searchParams.get("limit") || "100", 10);
@@ -6709,7 +6851,16 @@ async function handleList(bucket, prefix, url, scope) {
       ...obj.customMetadata
     };
   });
-  return Response.json({ files, truncated: listed.truncated }, { headers: CORS_HEADERS3 });
+  let storage;
+  if (auth.storage) {
+    storage = { usedBytes: await allocationUsage(bucket, auth.storage.prefix) };
+    const limitBytes = await auth.storage.limitBytes();
+    if (limitBytes !== null) storage.limitBytes = limitBytes;
+  }
+  return Response.json(
+    { files, truncated: listed.truncated, ...storage ? { storage } : {} },
+    { headers: CORS_HEADERS3 }
+  );
 }
 async function handleDownload(bucket, key, scope) {
   const object = await bucket.get(key);
@@ -9317,10 +9468,13 @@ export {
   APP_ID_RE,
   APP_LOG_EVENT_KEYS,
   APP_NAME_RULES,
+  APP_STORAGE_LIMIT_BYTES,
+  ASSET_NOT_FOUND_HANDLING_VALUES,
   AUTO_PROVISIONABLE_TYPES,
   AUTO_PROVISION_SENTINEL,
   Awareness,
   BASE_USERS_SCHEMA,
+  BROWSER_PROXY_ROUTES,
   BUILT_IN_TOOLS,
   BaseRoom,
   CANONICAL_APP_IDENTITY_MIGRATION_ID,
@@ -9365,22 +9519,28 @@ export {
   REACTIONS_SCHEMA,
   READ_RECEIPTS_SCHEMA,
   REGISTRY_INSTANCE,
+  RELEASE_STAMP_PATH,
+  REQUIRED_COMPATIBILITY_FLAGS,
   RESERVED_BINDING_NAMES,
   RESERVED_COLLECTION_NAMES,
+  RESERVED_RUN_WORKER_FIRST,
   RESOURCE_ID_RE,
   ROLE_ADMIN,
   ROLE_ANONYMOUS,
   ROLE_DEFAULT,
   RecordRoom,
   RegistryClientError,
+  SDK_RUN_WORKER_FIRST,
   STRICT_APP_ID_RE,
   SYSTEM_COLLECTIONS,
   SYSTEM_MANAGED_COLUMNS,
   SchemaRegistry,
   TEST_ACCOUNT_EMAIL_SUFFIX,
+  UNDECLARED_ASSET_NOT_FOUND_HANDLING,
   UPLOAD_PART_BYTES,
   USERS_COLUMNS,
   VOTING_SCHEMAS,
+  WORKER_OWNED_NOT_FOUND_MIGRATION_ID,
   WORKSPACE_SCHEMAS,
   YjsRoom,
   analyzePermissions,
@@ -9436,9 +9596,11 @@ export {
   handleClientErrorReport,
   handleSyncMessage,
   hasContent,
+  isAssetNotFoundHandling,
   isAutoProvision,
   isFilesVerbPath,
   isOwner,
+  isPlatformReservedPath,
   isTestAccountClaims,
   isTestAccountEmail,
   isTestAccountTier,
@@ -9464,10 +9626,13 @@ export {
   registryStub,
   resolveAppName,
   resolveColumn,
+  resolveCompatibilityFlags,
   resolveDeepSpaceAgentModel,
   rowToData,
   runMigrations,
   serverBuild,
+  storageLimitForTier,
+  storageQuotaMessage,
   streamDeepSpaceAgent,
   timingSafeEqualHex,
   timingSafeEqualStrings,