deepspace 0.2.3 → 0.2.5

package/dist/testing.d.ts

@@ -0,0 +1,115 @@
+import * as _playwright_test from '@playwright/test';
+import { BrowserContext, Page, Browser } from '@playwright/test';
+export { expect } from '@playwright/test';
+
+interface MultiplayerUser {
+    context: BrowserContext;
+    page: Page;
+    email: string;
+    name: string;
+    /** Test account user ID, if known from the accounts registry. */
+    userId?: string;
+}
+/**
+ * Fixture function signature. Pass either a count (`users(2)`) or an
+ * array of account names (`users(['Alice', 'Bob'])`). Returns one entry
+ * per requested user.
+ */
+type UsersFixture = (selector: number | string[], options?: {
+    label?: string;
+}) => Promise<MultiplayerUser[]>;
+interface MultiplayerFixtures {
+    users: UsersFixture;
+}
+declare const test: _playwright_test.TestType<_playwright_test.PlaywrightTestArgs & _playwright_test.PlaywrightTestOptions & MultiplayerFixtures, _playwright_test.PlaywrightWorkerArgs & _playwright_test.PlaywrightWorkerOptions>;
+
+/**
+ * Account-credential plumbing for the testing module.
+ *
+ * Reads test accounts from `~/.deepspace/test-accounts.json` (the same
+ * file `deepspace test-accounts create` writes). Each account has at
+ * minimum `{email, password}`; `name` and `label` are optional.
+ *
+ * Used by the multi-user Playwright fixture in `./fixtures.ts` and is
+ * also exported standalone in case suites want to do their own
+ * orchestration.
+ */
+interface TestAccount {
+    email: string;
+    password: string;
+    name?: string;
+    label?: string | null;
+    id?: string;
+    userId?: string;
+    createdAt?: number;
+}
+/**
+ * Load all test accounts the developer has created. Returns an empty
+ * array if the file doesn't exist yet.
+ */
+declare function loadAllTestAccounts(): TestAccount[];
+/**
+ * Pick `count` test accounts from the local registry, optionally
+ * filtered by `label`. Order-stable: sorted by `createdAt` ascending so
+ * the first test account you created is always the first one returned.
+ *
+ * Throws with a helpful message if not enough accounts exist.
+ */
+declare function pickTestAccounts(count: number, options?: {
+    label?: string;
+}): TestAccount[];
+/**
+ * Find a single account by name. Used by `users(['Alice', 'Bob'])`.
+ * Throws if not found.
+ */
+declare function findTestAccountByName(name: string): TestAccount;
+
+/**
+ * Per-account `storageState` cache for Playwright.
+ *
+ * Better Auth applies a per-IP rate limit on `/api/auth/sign-in/email`
+ * (~5 sign-ins / 60s / endpoint). A multiplayer suite that spins up
+ * 5+ users per spec would hit the limit and start failing in non-obvious
+ * ways. This module signs each account in *once*, persists the
+ * resulting browser cookies + storage to disk, and reuses the file on
+ * subsequent runs.
+ *
+ * Cache layout:
+ *   ~/.deepspace/playwright-states/<sha256(email)>.json
+ *
+ * Validity: a cached file is reused if Playwright successfully loads it
+ * AND the resulting context produces a non-anonymous session on the
+ * target app. If validation fails, we fall back to a fresh sign-in and
+ * overwrite the cache.
+ */
+
+interface EnsureStorageStateOptions {
+    /** Max age of a cached state file before we re-sign-in. Default 7 days. */
+    maxAgeMs?: number;
+    /** Force a fresh sign-in even if the cache is fresh. */
+    force?: boolean;
+}
+/**
+ * Ensure a Playwright `storageState` file exists for `account` and
+ * return its path. Signs in once if the cache is missing, stale, or
+ * `force: true`.
+ */
+declare function ensureStorageState(browser: Browser, account: {
+    email: string;
+    password: string;
+}, baseURL: string, options?: EnsureStorageStateOptions): Promise<string>;
+/**
+ * Convenience: open a fresh `BrowserContext` for `account` using the
+ * cached storage state (signing in if needed). The caller is responsible
+ * for closing the context.
+ */
+declare function newSignedInContext(browser: Browser, account: {
+    email: string;
+    password: string;
+}, baseURL: string, options?: EnsureStorageStateOptions): Promise<BrowserContext>;
+/** Read a cached storageState file (mostly for debugging). */
+declare function readCachedState(email: string): unknown | null;
+/** Where the cache for `email` lives. Useful for diagnostics. */
+declare function getStatePathForEmail(email: string): string;
+
+export { type EnsureStorageStateOptions, type MultiplayerUser, type TestAccount, type UsersFixture, ensureStorageState, findTestAccountByName, getStatePathForEmail, loadAllTestAccounts, newSignedInContext, pickTestAccounts, readCachedState, test };

package/dist/testing.js

@@ -0,0 +1,175 @@
+// src/testing/fixtures.ts
+import { test as baseTest } from "@playwright/test";
+
+// src/testing/accounts.ts
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var ACCOUNTS_PATH = join(homedir(), ".deepspace", "test-accounts.json");
+function loadAllTestAccounts() {
+  if (!existsSync(ACCOUNTS_PATH)) return [];
+  try {
+    const raw = JSON.parse(readFileSync(ACCOUNTS_PATH, "utf-8"));
+    if (!Array.isArray(raw)) return [];
+    return raw.filter(
+      (r) => r && typeof r.email === "string" && typeof r.password === "string"
+    );
+  } catch {
+    return [];
+  }
+}
+function pickTestAccounts(count, options) {
+  const all = loadAllTestAccounts();
+  const filtered = options?.label ? all.filter((a) => a.label === options.label) : all;
+  const sorted = filtered.slice().sort((a, b) => (a.createdAt ?? 0) - (b.createdAt ?? 0));
+  if (sorted.length < count) {
+    const labelHint = options?.label ? ` (label="${options.label}")` : "";
+    throw new Error(
+      `Multiplayer test needs ${count} test accounts${labelHint}, but only ${sorted.length} are present in ${ACCOUNTS_PATH}. Create more with:
+  deepspace test-accounts create --email <name>@deepspace.test --password <pw> --name "<name>"${options?.label ? ` --label ${options.label}` : ""}`
+    );
+  }
+  return sorted.slice(0, count);
+}
+function findTestAccountByName(name) {
+  const all = loadAllTestAccounts();
+  const match = all.find((a) => a.name === name);
+  if (!match) {
+    throw new Error(
+      `No test account named "${name}" in ${ACCOUNTS_PATH}. Create with:
+  deepspace test-accounts create --email ${name.toLowerCase()}@deepspace.test --password <pw> --name "${name}"`
+    );
+  }
+  return match;
+}
+
+// src/testing/storage-state.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, statSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var STATES_DIR = join2(homedir2(), ".deepspace", "playwright-states");
+var DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
+function statePathForEmail(email) {
+  const hash = createHash("sha256").update(email.trim().toLowerCase()).digest("hex").slice(0, 24);
+  return join2(STATES_DIR, `${hash}.json`);
+}
+function ensureStatesDir() {
+  if (!existsSync2(STATES_DIR)) mkdirSync(STATES_DIR, { recursive: true });
+}
+function isCacheFresh(path, maxAgeMs) {
+  if (!existsSync2(path)) return false;
+  try {
+    const age = Date.now() - statSync(path).mtimeMs;
+    return age < maxAgeMs;
+  } catch {
+    return false;
+  }
+}
+async function signInAndSaveState(browser, account, baseURL, outPath) {
+  ensureStatesDir();
+  const ctx = await browser.newContext({ baseURL });
+  try {
+    const page = await ctx.newPage();
+    await page.goto("/");
+    const ok = await page.evaluate(
+      async ({ email, password }) => {
+        const res = await fetch("/api/auth/sign-in/email", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ email, password })
+        });
+        return res.ok;
+      },
+      account
+    );
+    if (!ok) {
+      throw new Error(
+        `Sign-in failed for ${account.email}. Check the password is current; if the account was deleted on the server, re-create with \`deepspace test-accounts create\`.`
+      );
+    }
+    await ctx.storageState({ path: outPath });
+    return outPath;
+  } finally {
+    await ctx.close();
+  }
+}
+async function ensureStorageState(browser, account, baseURL, options = {}) {
+  const path = statePathForEmail(account.email);
+  const maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
+  if (!options.force && isCacheFresh(path, maxAgeMs)) {
+    return path;
+  }
+  return signInAndSaveState(browser, account, baseURL, path);
+}
+async function newSignedInContext(browser, account, baseURL, options = {}) {
+  const statePath = await ensureStorageState(browser, account, baseURL, options);
+  return browser.newContext({ storageState: statePath, baseURL });
+}
+function readCachedState(email) {
+  const path = statePathForEmail(email);
+  if (!existsSync2(path)) return null;
+  try {
+    return JSON.parse(readFileSync2(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function getStatePathForEmail(email) {
+  return statePathForEmail(email);
+}
+
+// src/testing/fixtures.ts
+import { expect } from "@playwright/test";
+async function buildUser(browser, account, baseURL) {
+  const statePath = await ensureStorageState(browser, account, baseURL);
+  const context = await browser.newContext({ storageState: statePath, baseURL });
+  const page = await context.newPage();
+  return {
+    user: {
+      context,
+      page,
+      email: account.email,
+      name: account.name ?? account.email.split("@")[0],
+      userId: account.userId
+    },
+    cleanup: async () => {
+      await context.close();
+    }
+  };
+}
+var test = baseTest.extend({
+  users: async ({ browser, baseURL }, use) => {
+    if (!baseURL) {
+      throw new Error(
+        '`users` fixture requires a baseURL. Set it on your Playwright config (e.g. `use: { baseURL: "http://localhost:5173" }`) or via the webServer.url shortcut.'
+      );
+    }
+    const cleanups = [];
+    const usersFn = async (selector, options) => {
+      const accounts = Array.isArray(selector) ? selector.map((name) => findTestAccountByName(name)) : pickTestAccounts(selector, options);
+      const built = await Promise.all(
+        accounts.map((acct) => buildUser(browser, acct, baseURL))
+      );
+      for (const b of built) cleanups.push(b.cleanup);
+      return built.map((b) => b.user);
+    };
+    await use(usersFn);
+    for (const cleanup of cleanups) {
+      await cleanup().catch(() => {
+      });
+    }
+  }
+});
+export {
+  ensureStorageState,
+  expect,
+  findTestAccountByName,
+  getStatePathForEmail,
+  loadAllTestAccounts,
+  newSignedInContext,
+  pickTestAccounts,
+  readCachedState,
+  test
+};
+//# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/testing/fixtures.ts","../src/testing/accounts.ts","../src/testing/storage-state.ts"],"sourcesContent":["/**\n * Multi-user Playwright fixture for DeepSpace apps.\n *\n * Usage:\n *\n *   import { test, expect } from 'deepspace/testing'\n *\n *   test('A sends, B sees', async ({ users }) => {\n *     const [a, b] = await users(2)\n *     await a.page.goto('/chat')\n *     await b.page.goto('/chat')\n *     await a.page.getByTestId('message-input').fill('hi')\n *     await a.page.getByTestId('send-message-btn').click()\n *     await expect(b.page.getByText('hi')).toBeVisible()\n *   })\n *\n * `users(N)` picks the first N test accounts from\n * `~/.deepspace/test-accounts.json` (created via\n * `deepspace test-accounts create`). `users(['Alice', 'Bob'])` picks\n * specific accounts by name.\n *\n * Each user gets a separate browser context with cached storageState\n * (per-account JSON in `~/.deepspace/playwright-states/`). Sign-in\n * happens once per account, not once per test, sidestepping Better\n * Auth's per-IP rate limit on `/api/auth/sign-in/email`.\n *\n * Contexts are auto-closed when the test finishes.\n */\n\nimport { test as baseTest, type Browser, type BrowserContext, type Page } from '@playwright/test'\nimport {\n  type TestAccount,\n  pickTestAccounts,\n  findTestAccountByName,\n} from './accounts'\nimport { ensureStorageState } from './storage-state'\n\nexport interface MultiplayerUser {\n  context: BrowserContext\n  page: Page\n  email: string\n  name: string\n  /** Test account user ID, if known from the accounts registry. */\n  userId?: string\n}\n\n/**\n * Fixture function signature. Pass either a count (`users(2)`) or an\n * array of account names (`users(['Alice', 'Bob'])`). Returns one entry\n * per requested user.\n */\nexport type UsersFixture = (\n  selector: number | string[],\n  options?: { label?: string },\n) => Promise<MultiplayerUser[]>\n\ninterface MultiplayerFixtures {\n  users: UsersFixture\n}\n\nasync function buildUser(\n  browser: Browser,\n  account: TestAccount,\n  baseURL: string,\n): Promise<{ user: MultiplayerUser; cleanup: () => Promise<void> }> {\n  const statePath = await ensureStorageState(browser, account, baseURL)\n  const context = await browser.newContext({ storageState: statePath, baseURL })\n  const page = await context.newPage()\n  return {\n    user: {\n      context,\n      page,\n      email: account.email,\n      name: account.name ?? account.email.split('@')[0],\n      userId: account.userId,\n    },\n    cleanup: async () => {\n      await context.close()\n    },\n  }\n}\n\nexport const test = baseTest.extend<MultiplayerFixtures>({\n  users: async ({ browser, baseURL }, use) => {\n    if (!baseURL) {\n      throw new Error(\n        '`users` fixture requires a baseURL. Set it on your Playwright config ' +\n          '(e.g. `use: { baseURL: \"http://localhost:5173\" }`) or via the ' +\n          'webServer.url shortcut.',\n      )\n    }\n\n    const cleanups: Array<() => Promise<void>> = []\n\n    const usersFn: UsersFixture = async (selector, options) => {\n      const accounts: TestAccount[] = Array.isArray(selector)\n        ? selector.map((name) => findTestAccountByName(name))\n        : pickTestAccounts(selector, options)\n\n      const built = await Promise.all(\n        accounts.map((acct) => buildUser(browser, acct, baseURL)),\n      )\n      for (const b of built) cleanups.push(b.cleanup)\n      return built.map((b) => b.user)\n    }\n\n    await use(usersFn)\n\n    // Tear down any contexts we created. Errors are swallowed — a test\n    // failure shouldn't be masked by a cleanup error.\n    for (const cleanup of cleanups) {\n      await cleanup().catch(() => {})\n    }\n  },\n})\n\nexport { expect } from '@playwright/test'\n","/**\n * Account-credential plumbing for the testing module.\n *\n * Reads test accounts from `~/.deepspace/test-accounts.json` (the same\n * file `deepspace test-accounts create` writes). Each account has at\n * minimum `{email, password}`; `name` and `label` are optional.\n *\n * Used by the multi-user Playwright fixture in `./fixtures.ts` and is\n * also exported standalone in case suites want to do their own\n * orchestration.\n */\n\nimport { existsSync, readFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\n\nexport interface TestAccount {\n  email: string\n  password: string\n  name?: string\n  label?: string | null\n  id?: string\n  userId?: string\n  createdAt?: number\n}\n\nconst ACCOUNTS_PATH = join(homedir(), '.deepspace', 'test-accounts.json')\n\n/**\n * Load all test accounts the developer has created. Returns an empty\n * array if the file doesn't exist yet.\n */\nexport function loadAllTestAccounts(): TestAccount[] {\n  if (!existsSync(ACCOUNTS_PATH)) return []\n  try {\n    const raw = JSON.parse(readFileSync(ACCOUNTS_PATH, 'utf-8'))\n    if (!Array.isArray(raw)) return []\n    // Filter out any malformed entries (missing email or password). Keep\n    // bare {email, password} rows so the file format stays forgiving.\n    return raw.filter(\n      (r) => r && typeof r.email === 'string' && typeof r.password === 'string',\n    )\n  } catch {\n    return []\n  }\n}\n\n/**\n * Pick `count` test accounts from the local registry, optionally\n * filtered by `label`. Order-stable: sorted by `createdAt` ascending so\n * the first test account you created is always the first one returned.\n *\n * Throws with a helpful message if not enough accounts exist.\n */\nexport function pickTestAccounts(\n  count: number,\n  options?: { label?: string },\n): TestAccount[] {\n  const all = loadAllTestAccounts()\n  const filtered = options?.label\n    ? all.filter((a) => a.label === options.label)\n    : all\n  const sorted = filtered.slice().sort((a, b) => (a.createdAt ?? 0) - (b.createdAt ?? 0))\n\n  if (sorted.length < count) {\n    const labelHint = options?.label ? ` (label=\"${options.label}\")` : ''\n    throw new Error(\n      `Multiplayer test needs ${count} test accounts${labelHint}, but only ${sorted.length} ` +\n        `are present in ${ACCOUNTS_PATH}. Create more with:\\n` +\n        `  deepspace test-accounts create --email <name>@deepspace.test --password <pw> --name \"<name>\"${\n          options?.label ? ` --label ${options.label}` : ''\n        }`,\n    )\n  }\n\n  return sorted.slice(0, count)\n}\n\n/**\n * Find a single account by name. Used by `users(['Alice', 'Bob'])`.\n * Throws if not found.\n */\nexport function findTestAccountByName(name: string): TestAccount {\n  const all = loadAllTestAccounts()\n  const match = all.find((a) => a.name === name)\n  if (!match) {\n    throw new Error(\n      `No test account named \"${name}\" in ${ACCOUNTS_PATH}. Create with:\\n` +\n        `  deepspace test-accounts create --email ${name.toLowerCase()}@deepspace.test --password <pw> --name \"${name}\"`,\n    )\n  }\n  return match\n}\n","/**\n * Per-account `storageState` cache for Playwright.\n *\n * Better Auth applies a per-IP rate limit on `/api/auth/sign-in/email`\n * (~5 sign-ins / 60s / endpoint). A multiplayer suite that spins up\n * 5+ users per spec would hit the limit and start failing in non-obvious\n * ways. This module signs each account in *once*, persists the\n * resulting browser cookies + storage to disk, and reuses the file on\n * subsequent runs.\n *\n * Cache layout:\n *   ~/.deepspace/playwright-states/<sha256(email)>.json\n *\n * Validity: a cached file is reused if Playwright successfully loads it\n * AND the resulting context produces a non-anonymous session on the\n * target app. If validation fails, we fall back to a fresh sign-in and\n * overwrite the cache.\n */\n\nimport { createHash } from 'node:crypto'\nimport { existsSync, mkdirSync, writeFileSync, readFileSync, statSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport type { Browser, BrowserContext } from '@playwright/test'\n\nconst STATES_DIR = join(homedir(), '.deepspace', 'playwright-states')\n\n/** Default freshness window — re-sign-in if the cache is older than this. */\nconst DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000 // 7 days\n\nfunction statePathForEmail(email: string): string {\n  const hash = createHash('sha256').update(email.trim().toLowerCase()).digest('hex').slice(0, 24)\n  return join(STATES_DIR, `${hash}.json`)\n}\n\nfunction ensureStatesDir() {\n  if (!existsSync(STATES_DIR)) mkdirSync(STATES_DIR, { recursive: true })\n}\n\n/** Returns true if a cache file exists and is younger than `maxAgeMs`. */\nfunction isCacheFresh(path: string, maxAgeMs: number): boolean {\n  if (!existsSync(path)) return false\n  try {\n    const age = Date.now() - statSync(path).mtimeMs\n    return age < maxAgeMs\n  } catch {\n    return false\n  }\n}\n\n/**\n * Sign `account` in by POSTing `/api/auth/sign-in/email` against\n * `baseURL` and capturing the resulting cookies. Returns the path to the\n * Playwright `storageState` JSON file.\n *\n * The browser-driven approach is intentional: we want the cookies set\n * on the same origin Playwright contexts will load from, otherwise the\n * Set-Cookie domain attribute won't match.\n */\nasync function signInAndSaveState(\n  browser: Browser,\n  account: { email: string; password: string },\n  baseURL: string,\n  outPath: string,\n): Promise<string> {\n  ensureStatesDir()\n  const ctx = await browser.newContext({ baseURL })\n  try {\n    const page = await ctx.newPage()\n    // Hit the app first so the origin is established (some auth plugins\n    // require a same-origin Origin header on sign-in).\n    await page.goto('/')\n    const ok = await page.evaluate(\n      async ({ email, password }: { email: string; password: string }) => {\n        const res = await fetch('/api/auth/sign-in/email', {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({ email, password }),\n        })\n        return res.ok\n      },\n      account,\n    )\n    if (!ok) {\n      throw new Error(\n        `Sign-in failed for ${account.email}. Check the password is current; ` +\n          `if the account was deleted on the server, re-create with ` +\n          `\\`deepspace test-accounts create\\`.`,\n      )\n    }\n    await ctx.storageState({ path: outPath })\n    return outPath\n  } finally {\n    await ctx.close()\n  }\n}\n\nexport interface EnsureStorageStateOptions {\n  /** Max age of a cached state file before we re-sign-in. Default 7 days. */\n  maxAgeMs?: number\n  /** Force a fresh sign-in even if the cache is fresh. */\n  force?: boolean\n}\n\n/**\n * Ensure a Playwright `storageState` file exists for `account` and\n * return its path. Signs in once if the cache is missing, stale, or\n * `force: true`.\n */\nexport async function ensureStorageState(\n  browser: Browser,\n  account: { email: string; password: string },\n  baseURL: string,\n  options: EnsureStorageStateOptions = {},\n): Promise<string> {\n  const path = statePathForEmail(account.email)\n  const maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS\n\n  if (!options.force && isCacheFresh(path, maxAgeMs)) {\n    return path\n  }\n\n  return signInAndSaveState(browser, account, baseURL, path)\n}\n\n/**\n * Convenience: open a fresh `BrowserContext` for `account` using the\n * cached storage state (signing in if needed). The caller is responsible\n * for closing the context.\n */\nexport async function newSignedInContext(\n  browser: Browser,\n  account: { email: string; password: string },\n  baseURL: string,\n  options: EnsureStorageStateOptions = {},\n): Promise<BrowserContext> {\n  const statePath = await ensureStorageState(browser, account, baseURL, options)\n  return browser.newContext({ storageState: statePath, baseURL })\n}\n\n/** Read a cached storageState file (mostly for debugging). */\nexport function readCachedState(email: string): unknown | null {\n  const path = statePathForEmail(email)\n  if (!existsSync(path)) return null\n  try {\n    return JSON.parse(readFileSync(path, 'utf-8'))\n  } catch {\n    return null\n  }\n}\n\n/** Where the cache for `email` lives. Useful for diagnostics. */\nexport function getStatePathForEmail(email: string): string {\n  return statePathForEmail(email)\n}\n"],"mappings":";AA6BA,SAAS,QAAQ,gBAA8D;;;ACjB/E,SAAS,YAAY,oBAAoB;AACzC,SAAS,eAAe;AACxB,SAAS,YAAY;AAYrB,IAAM,gBAAgB,KAAK,QAAQ,GAAG,cAAc,oBAAoB;AAMjE,SAAS,sBAAqC;AACnD,MAAI,CAAC,WAAW,aAAa,EAAG,QAAO,CAAC;AACxC,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,aAAa,eAAe,OAAO,CAAC;AAC3D,QAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AAGjC,WAAO,IAAI;AAAA,MACT,CAAC,MAAM,KAAK,OAAO,EAAE,UAAU,YAAY,OAAO,EAAE,aAAa;AAAA,IACnE;AAAA,EACF,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AASO,SAAS,iBACd,OACA,SACe;AACf,QAAM,MAAM,oBAAoB;AAChC,QAAM,WAAW,SAAS,QACtB,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,QAAQ,KAAK,IAC3C;AACJ,QAAM,SAAS,SAAS,MAAM,EAAE,KAAK,CAAC,GAAG,OAAO,EAAE,aAAa,MAAM,EAAE,aAAa,EAAE;AAEtF,MAAI,OAAO,SAAS,OAAO;AACzB,UAAM,YAAY,SAAS,QAAQ,YAAY,QAAQ,KAAK,OAAO;AACnE,UAAM,IAAI;AAAA,MACR,0BAA0B,KAAK,iBAAiB,SAAS,cAAc,OAAO,MAAM,mBAChE,aAAa;AAAA,gGAE7B,SAAS,QAAQ,YAAY,QAAQ,KAAK,KAAK,EACjD;AAAA,IACJ;AAAA,EACF;AAEA,SAAO,OAAO,MAAM,GAAG,KAAK;AAC9B;AAMO,SAAS,sBAAsB,MAA2B;AAC/D,QAAM,MAAM,oBAAoB;AAChC,QAAM,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AAC7C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,0BAA0B,IAAI,QAAQ,aAAa;AAAA,2CACL,KAAK,YAAY,CAAC,2CAA2C,IAAI;AAAA,IACjH;AAAA,EACF;AACA,SAAO;AACT;;;ACzEA,SAAS,kBAAkB;AAC3B,SAAS,cAAAA,aAAY,WAA0B,gBAAAC,eAAc,gBAAgB;AAC7E,SAAS,WAAAC,gBAAe;AACxB,SAAS,QAAAC,aAAY;AAGrB,IAAM,aAAaA,MAAKD,SAAQ,GAAG,cAAc,mBAAmB;AAGpE,IAAM,qBAAqB,IAAI,KAAK,KAAK,KAAK;AAE9C,SAAS,kBAAkB,OAAuB;AAChD,QAAM,OAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC9F,SAAOC,MAAK,YAAY,GAAG,IAAI,OAAO;AACxC;AAEA,SAAS,kBAAkB;AACzB,MAAI,CAACH,YAAW,UAAU,EAAG,WAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AACxE;AAGA,SAAS,aAAa,MAAc,UAA2B;AAC7D,MAAI,CAACA,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,EAAE;AACxC,WAAO,MAAM;AAAA,EACf,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAe,mBACb,SACA,SACA,SACA,SACiB;AACjB,kBAAgB;AAChB,QAAM,MAAM,MAAM,QAAQ,WAAW,EAAE,QAAQ,CAAC;AAChD,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,QAAQ;AAG/B,UAAM,KAAK,KAAK,GAAG;AACnB,UAAM,KAAK,MAAM,KAAK;AAAA,MACpB,OAAO,EAAE,OAAO,SAAS,MAA2C;AAClE,cAAM,MAAM,MAAM,MAAM,2BAA2B;AAAA,UACjD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,SAAS,CAAC;AAAA,QAC1C,CAAC;AACD,eAAO,IAAI;AAAA,MACb;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,IAAI;AACP,YAAM,IAAI;AAAA,QACR,sBAAsB,QAAQ,KAAK;AAAA,MAGrC;AAAA,IACF;AACA,UAAM,IAAI,aAAa,EAAE,MAAM,QAAQ,CAAC;AACxC,WAAO;AAAA,EACT,UAAE;AACA,UAAM,IAAI,MAAM;AAAA,EAClB;AACF;AAcA,eAAsB,mBACpB,SACA,SACA,SACA,UAAqC,CAAC,GACrB;AACjB,QAAM,OAAO,kBAAkB,QAAQ,KAAK;AAC5C,QAAM,WAAW,QAAQ,YAAY;AAErC,MAAI,CAAC,QAAQ,SAAS,aAAa,MAAM,QAAQ,GAAG;AAClD,WAAO;AAAA,EACT;AAEA,SAAO,mBAAmB,SAAS,SAAS,SAAS,IAAI;AAC3D;AAOA,eAAsB,mBACpB,SACA,SACA,SACA,UAAqC,CAAC,GACb;AACzB,QAAM,YAAY,MAAM,mBAAmB,SAAS,SAAS,SAAS,OAAO;AAC7E,SAAO,QAAQ,WAAW,EAAE,cAAc,WAAW,QAAQ,CAAC;AAChE;AAGO,SAAS,gBAAgB,OAA+B;AAC7D,QAAM,OAAO,kBAAkB,KAAK;AACpC,MAAI,CAACA,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,WAAO,KAAK,MAAMC,cAAa,MAAM,OAAO,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,qBAAqB,OAAuB;AAC1D,SAAO,kBAAkB,KAAK;AAChC;;;AFtCA,SAAS,cAAc;AAxDvB,eAAe,UACb,SACA,SACA,SACkE;AAClE,QAAM,YAAY,MAAM,mBAAmB,SAAS,SAAS,OAAO;AACpE,QAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,cAAc,WAAW,QAAQ,CAAC;AAC7E,QAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,SAAO;AAAA,IACL,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ,QAAQ,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAChD,QAAQ,QAAQ;AAAA,IAClB;AAAA,IACA,SAAS,YAAY;AACnB,YAAM,QAAQ,MAAM;AAAA,IACtB;AAAA,EACF;AACF;AAEO,IAAM,OAAO,SAAS,OAA4B;AAAA,EACvD,OAAO,OAAO,EAAE,SAAS,QAAQ,GAAG,QAAQ;AAC1C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AAEA,UAAM,WAAuC,CAAC;AAE9C,UAAM,UAAwB,OAAO,UAAU,YAAY;AACzD,YAAM,WAA0B,MAAM,QAAQ,QAAQ,IAClD,SAAS,IAAI,CAAC,SAAS,sBAAsB,IAAI,CAAC,IAClD,iBAAiB,UAAU,OAAO;AAEtC,YAAM,QAAQ,MAAM,QAAQ;AAAA,QAC1B,SAAS,IAAI,CAAC,SAAS,UAAU,SAAS,MAAM,OAAO,CAAC;AAAA,MAC1D;AACA,iBAAW,KAAK,MAAO,UAAS,KAAK,EAAE,OAAO;AAC9C,aAAO,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IAChC;AAEA,UAAM,IAAI,OAAO;AAIjB,eAAW,WAAW,UAAU;AAC9B,YAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAChC;AAAA,EACF;AACF,CAAC;","names":["existsSync","readFileSync","homedir","join"]}

package/dist/worker.d.ts

@@ -1,7 +1,7 @@
 import * as Y from 'yjs';
-import * as _ai_sdk_openai_compatible from '@ai-sdk/openai-compatible';
-import * as _ai_sdk_openai from '@ai-sdk/openai';
-import * as _ai_sdk_anthropic from '@ai-sdk/anthropic';
+import { AnthropicProvider } from '@ai-sdk/anthropic';
+import { OpenAIProvider } from '@ai-sdk/openai';
+import { OpenAICompatibleProvider } from '@ai-sdk/openai-compatible';
 import * as better_auth from 'better-auth';
 import * as better_auth_plugins from 'better-auth/plugins';
 
@@ -2187,7 +2187,46 @@ declare function platformWorkerFetch(env: PlatformWorkerEnv, pathOrRequest: stri
  */
 declare function authWorkerFetch(env: AuthWorkerEnv, path: string, init?: RequestInit): Promise<Response>;
 
+/**
+ * AI provider helpers — create Vercel AI SDK providers that route through
+ * the DeepSpace API worker proxy for per-user billing.
+ *
+ * Supported providers: anthropic, openai, cerebras.
+ *
+ * The API worker can be reached in two ways:
+ *   - Service binding `env.API_WORKER` (Cloudflare Fetcher) — preferred in
+ *     production if the app has declared the binding in wrangler.toml.
+ *   - HTTPS URL `env.API_WORKER_URL` — used in local dev and in production
+ *     for apps that don't declare the binding. `deepspace dev` writes this
+ *     into `.dev.vars` automatically.
+ *
+ * Auth is automatic by default:
+ *   - For server-side autonomous calls (cron, DO alarms, background agents),
+ *     the helper reads the long-lived `env.APP_OWNER_JWT` minted at deploy
+ *     time (or by `deepspace dev` in local development) and uses it for the
+ *     proxy auth header. The owner is billed automatically via the JWT sub.
+ *   - For user-initiated calls (e.g. an `/api/ai/chat` route handling a
+ *     browser request), pass `options.authToken` explicitly with the user's
+ *     own JWT so the call is billed to the user.
+ *
+ * Usage:
+ *
+ *   // Server-side autonomous — no auth config needed
+ *   import { createDeepSpaceAI } from 'deepspace/worker'
+ *   const cerebras = createDeepSpaceAI(env, 'cerebras')
+ *   const result = await generateText({ model: cerebras('llama-3.3-70b'), ... })
+ *
+ *   // User-initiated (inside a request handler)
+ *   const jwt = c.req.header('Authorization')!.slice(7)
+ *   const anthropic = createDeepSpaceAI(c.env, 'anthropic', { authToken: jwt })
+ */
+
 type Provider = 'anthropic' | 'openai' | 'cerebras';
+type ProviderReturn = {
+    anthropic: AnthropicProvider;
+    openai: OpenAIProvider;
+    cerebras: OpenAICompatibleProvider;
+};
 interface DeepSpaceAIEnv extends ApiWorkerEnv {
     /**
      * Long-lived owner-scoped JWT minted at deploy time (or by `deepspace dev`).
@@ -2215,7 +2254,7 @@ interface DeepSpaceAIOptions {
  * (explicit or `env.APP_OWNER_JWT`) automatically. Throws a clear error if
  * either is unconfigured.
  */
-declare function createDeepSpaceAI(env: DeepSpaceAIEnv, provider: Provider, options?: DeepSpaceAIOptions): _ai_sdk_anthropic.AnthropicProvider | _ai_sdk_openai.OpenAIProvider | _ai_sdk_openai_compatible.OpenAICompatibleProvider<string, string, string, string>;
+declare function createDeepSpaceAI<P extends Provider>(env: DeepSpaceAIEnv, provider: P, options?: DeepSpaceAIOptions): ProviderReturn[P];
 
 /**
  * Auth types for the DeepSpace SDK.

package/dist/worker.js

@@ -5221,6 +5221,21 @@ function authWorkerFetch(env, path, init) {
 }
 
 // src/server/utils/ai.ts
+var ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS = 4096;
+function withDefaultAnthropicMaxTokens(body) {
+  if (typeof body !== "string") return body;
+  try {
+    const parsed = JSON.parse(body);
+    const hasExplicitLimit = typeof parsed.max_tokens === "number" || typeof parsed.max_completion_tokens === "number" || typeof parsed.max_output_tokens === "number";
+    if (hasExplicitLimit) return body;
+    return JSON.stringify({
+      ...parsed,
+      max_tokens: ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS
+    });
+  } catch {
+    return body;
+  }
+}
 function createDeepSpaceAI(env, provider, options = {}) {
   const transport = resolveApiTransport(env);
   const authToken = options.authToken ?? env.APP_OWNER_JWT;
@@ -5235,12 +5250,17 @@ function createDeepSpaceAI(env, provider, options = {}) {
     headers.delete("authorization");
     headers.delete("x-api-key");
     headers.set("X-Auth-Token", authToken);
+    const body = provider === "anthropic" ? withDefaultAnthropicMaxTokens(init?.body) : init?.body;
+    if (body !== init?.body) {
+      headers.delete("content-length");
+    }
+    const nextInit = { ...init, headers, body };
     if (transport.kind === "binding") {
-      return transport.fetcher.fetch(url, { ...init, headers });
+      return transport.fetcher.fetch(url, nextInit);
     }
     const original = new URL(url);
     const rewritten = `${transport.baseUrl}${original.pathname}${original.search}`;
-    return fetch(rewritten, { ...init, headers });
+    return fetch(rewritten, nextInit);
   };
   const baseURL = `https://api-worker.internal/api/proxy/${provider}/v1`;
   switch (provider) {