deepspace 0.2.8 → 0.3.3

package/dist/worker.d.ts

@@ -1650,6 +1650,268 @@ type DOBindings<T extends readonly DOManifestEntry[]> = {
 };
 /** Default manifest for apps that don't declare one */
 declare const DEFAULT_DO_MANIFEST: DOManifest;
+/**
+ * Shape-validate a DO manifest received over the wire (e.g. from the CLI's
+ * deploy form-field). Without this, malformed input gets passed straight to
+ * `deployToWfP`'s `.filter(...).map(...)` chain and crashes the route mid-deploy.
+ *
+ * Mirrors the contract of `validateBindingManifest` for non-DO bindings.
+ */
+declare function validateDoManifest(manifest: unknown): {
+    valid: true;
+    manifest: DOManifest;
+} | {
+    valid: false;
+    reason: string;
+};
+
+/**
+ * Binding Manifest — non-DO bindings declared by an app's wrangler.toml that
+ * the deploy-worker should pass through to Cloudflare's WfP upload API.
+ *
+ * Apps don't export a `__BINDING_MANIFEST__`; the CLI extracts these from the
+ * normalized vite/wrangler output config at deploy time. This file just owns
+ * the types + validation so both sides (CLI client and deploy-worker server)
+ * agree on the shape.
+ */
+/**
+ * A single non-DO binding the app declares. Mirrors CF's WfP binding API.
+ *
+ * Provisionable resources (d1, kv_namespace, vectorize, r2_bucket, queue) accept
+ * the literal string `"auto"` in their ID field to request platform-side
+ * provisioning at deploy time. When `"auto"` is used, the deploy-worker creates
+ * the resource on the platform CF account, persists the resulting CF ID in the
+ * app registry, and substitutes the real ID before forwarding to WfP. The
+ * sentinel sticks around in this type because:
+ *   1. `wrangler` parsing requires a non-empty string in the id field
+ *   2. The CLI passes the unresolved manifest through to the deploy-worker
+ *   3. The deploy-worker is the only side with CF API credentials
+ *
+ * Companion fields (`database_name`, `title`, `dimensions`, `metric`) are only
+ * used when `"auto"` is set — they tell the provisioner how to create the
+ * resource. After provisioning these fields are still present on the wire but
+ * ignored by WfP.
+ */
+type CustomBinding = {
+    type: 'vectorize';
+    name: string;
+    /** Either a pre-existing index name or the literal `"auto"`. */
+    index_name: string;
+    /** Required when `index_name === "auto"`. */
+    dimensions?: number;
+    /** Required when `index_name === "auto"`. */
+    metric?: 'cosine' | 'euclidean' | 'dot-product';
+} | {
+    type: 'ai';
+    name: string;
+} | {
+    type: 'r2_bucket';
+    name: string;
+    /** Either a pre-existing bucket name or the literal `"auto"`. */
+    bucket_name: string;
+} | {
+    type: 'kv_namespace';
+    name: string;
+    /** Either a pre-existing KV namespace ID or the literal `"auto"`. */
+    namespace_id: string;
+    /** Required when `namespace_id === "auto"`. Human-readable namespace title. */
+    title?: string;
+} | {
+    type: 'd1';
+    name: string;
+    /** Either a pre-existing D1 database UUID or the literal `"auto"`. */
+    id: string;
+    /** Required when `id === "auto"`. Human-readable database name. */
+    database_name?: string;
+} | {
+    type: 'queue';
+    name: string;
+    /** Either a pre-existing queue name or the literal `"auto"`. */
+    queue_name: string;
+} | {
+    type: 'browser_rendering';
+    name: string;
+} | {
+    type: 'analytics_engine';
+    name: string;
+    dataset?: string;
+} | {
+    type: 'hyperdrive';
+    name: string;
+    id: string;
+};
+type CustomBindingManifest = CustomBinding[];
+/** Sentinel string in an ID field that requests platform-side provisioning. */
+declare const AUTO_PROVISION_SENTINEL = "auto";
+/** Binding types whose ID field accepts the `"auto"` sentinel for provisioning. */
+declare const AUTO_PROVISIONABLE_TYPES: Set<string>;
+/**
+ * True if a binding has the `"auto"` sentinel in its primary ID field. Used by
+ * the deploy-worker to decide which entries need provisioning and by the
+ * validator to enforce companion-field requirements.
+ */
+declare function isAutoProvision(b: CustomBinding): boolean;
+/** Binding `type` values an app is allowed to declare. */
+declare const ALLOWED_BINDING_TYPES: Set<string>;
+/**
+ * Binding NAMES the SDK reserves on every app — apps may not redeclare them.
+ *
+ * Includes:
+ *   - Static-asset + service bindings the platform sets up automatically.
+ *   - SDK-managed env (auth, identity, owner JWT, HMAC secret).
+ *   - The auto-attached cost-tracking AE dataset (`USAGE_EVENTS`).
+ *
+ * DO binding names (RECORD_ROOMS, YJS_ROOMS, etc.) are NOT in this set
+ * because they live in a separate manifest (`__DO_MANIFEST__`).
+ */
+declare const RESERVED_BINDING_NAMES: Set<string>;
+/**
+ * Per-binding validation error. `binding` is undefined for top-level
+ * shape failures (e.g. manifest is not an array).
+ */
+interface ValidationError {
+    binding?: CustomBinding;
+    reason: string;
+}
+/**
+ * Validate a binding manifest. Returns errors; an empty array means valid.
+ *
+ * Used both client-side (CLI) for friendly fail-fast and server-side
+ * (deploy-worker) as a security boundary — apps can't sneak in reserved
+ * binding names by editing the wire format.
+ */
+declare function validateBindingManifest(manifest: unknown): {
+    valid: true;
+    bindings: CustomBindingManifest;
+} | {
+    valid: false;
+    errors: ValidationError[];
+};
+/**
+ * Convert vite/wrangler's normalized config (from `.wrangler/deploy/config.json`)
+ * into a CustomBindingManifest.
+ *
+ * Vite normalizes wrangler.toml into object/array structures with shapes like
+ * `{ ai: { binding: 'AI' } }`, `{ vectorize: [{ binding, index_name }] }`,
+ * etc. We extract each known shape with explicit field plucks (no broad
+ * `as` casts) and return a flat array.
+ */
+declare function bindingManifestFromOutputConfig(outputConfig: Record<string, unknown>): CustomBindingManifest;
+
+/**
+ * Pure helpers for computing Cloudflare Durable Object migrations from a
+ * declared manifest + the bindings already registered on a deployed script.
+ *
+ * Lives in the SDK (not deploy-worker) so the logic is testable with vitest
+ * and reusable from other CF deploy paths if we ever add them.
+ */
+
+/** Subset of CF's `bindings` API response we read from. */
+interface ExistingDOBinding {
+    /** Binding name in `env`, e.g. 'RECORD_ROOMS' */
+    name: string;
+    /** Always `'durable_object_namespace'` for DO bindings. */
+    type: string;
+    /** SDK class name, e.g. 'AppRecordRoom' */
+    class_name?: string;
+}
+/** What goes in the CF script-upload `migrations` block. */
+interface DoMigrationDirective {
+    tag: string;
+    new_sqlite_classes?: string[];
+    deleted_classes?: string[];
+}
+interface DoMigrationPlan {
+    /** New SQLite classes to register (present in manifest, absent in existing). */
+    newSqliteClasses: string[];
+    /** Classes to delete (present in existing, absent in manifest). */
+    deletedClasses: string[];
+    /** True when there's actual delta — only then should the migrations block be sent. */
+    needsMigration: boolean;
+    /** The full directive to splat into the CF script-upload metadata. Null if no migration is needed. */
+    directive: DoMigrationDirective | null;
+}
+interface ComputeDoMigrationOptions {
+    /**
+     * Override for the timestamp baked into the migration tag. Tests pass a
+     * fixed value to assert determinism; production omits this and gets
+     * `Date.now()`, which guarantees lifetime tag uniqueness even across
+     * cycles like `[A]→[A,B]→[A]→[A,B]`.
+     */
+    now?: number;
+}
+/**
+ * Compute the migration plan for a deploy.
+ *
+ *   manifest:   what the app declares now
+ *   existing:   what CF currently has registered for this script
+ *
+ * Behavior:
+ *   - new_sqlite_classes  ← in manifest, not in existing, sqlite=true
+ *   - deleted_classes     ← in existing, not in manifest
+ *   - needsMigration       ← either of the above is non-empty
+ *   - tag                 ← content-addressed by (add, remove) so:
+ *                            - identical re-deploy → unchanged tag → no-op (and
+ *                              `needsMigration` is false anyway)
+ *                            - any class change → unique tag → CF processes
+ *
+ * Bug history: an earlier version computed `tag = v${count}`. Removing a class
+ * dropped the count, the migration block was skipped (no NEW classes), and CF
+ * retained the orphaned class registration with its SQLite storage. The
+ * `deleted_classes` path closes that gap; the content-addressed tag prevents
+ * tag collisions when class sets are added and removed in different orders.
+ */
+declare function computeDoMigration(manifest: readonly DOManifestEntry[], existing: readonly ExistingDOBinding[], options?: ComputeDoMigrationOptions): DoMigrationPlan;
+
+/**
+ * App-name validation + sanitization helpers.
+ *
+ * Strategy: validate strictly so we have a precise definition of "valid",
+ * but DON'T reject non-conforming names — sanitize them, warn the user, and
+ * proceed. Hard rejection would break apps whose `wrangler.toml name` was
+ * something like `My_App` (previously deployed as `my-app` via silent
+ * server-side sanitization). The new behavior preserves "still deploys,"
+ * but the CLI now surfaces a warning so the user can fix the name when
+ * convenient instead of being silently surprised by their hostname.
+ *
+ * Rules track Cloudflare's WfP script-name constraints (RFC 1035 host label,
+ * no consecutive dashes) plus our 2-char minimum so subdomains read sensibly.
+ */
+declare const APP_NAME_RULES: {
+    /** ^[a-z0-9](-?[a-z0-9])+$ — RFC 1035 host label, no consecutive dashes. */
+    readonly pattern: RegExp;
+    readonly minLength: 2;
+    readonly maxLength: 63;
+};
+type AppNameValidation = {
+    valid: true;
+    name: string;
+} | {
+    valid: false;
+    reason: string;
+};
+/**
+ * Strict validation: returns valid only if the name already conforms.
+ * Useful as a precondition test or for CI lints.
+ */
+declare function validateAppName(raw: unknown): AppNameValidation;
+type AppNameResolution = {
+    ok: true;
+    name: string;
+    warning?: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Resolve an app name for deploy: prefer the input as-is if valid, otherwise
+ * sanitize and warn. Hard-fail only if even sanitization can't produce a
+ * valid name (empty, all-non-alphanumeric, too short, too long).
+ *
+ * The intent is "what previously worked still works, with a friendly warning
+ * about non-conforming names."
+ */
+declare function resolveAppName(raw: unknown): AppNameResolution;
 
 /**
  * AI Chat Schemas
@@ -2398,7 +2660,22 @@ declare function makeDefaultSummarizer(env: DeepSpaceAIEnv, options?: {
  * The tools API returns records as `{ recordId, data, createdAt, updatedAt }`
  * envelopes; helpers below flatten them into ChatRow / ChatMessageRow.
  */
+/**
+ * Canonical chat row.
+ *
+ * `recordId` is the primary identifier — same envelope shape as every
+ * other DeepSpace data type (records.* tools, useQuery results, etc.).
+ *
+ * `id` is kept as a deprecated alias so existing callers don't break,
+ * but every new caller should prefer `recordId`. Without this rename
+ * an integrator who reads `chat.recordId` (the obvious thing given the
+ * rest of the SDK) silently gets `undefined`, then ships code that
+ * sends `{"chatId": undefined}` to `/api/ai/chat` and gets back a 400
+ * with a misleading error.
+ */
 type ChatRow = {
+    recordId: string;
+    /** @deprecated Use `recordId`. Retained for backward compatibility. */
     id: string;
     userId: string;
     title: string;
@@ -2409,6 +2686,8 @@ type ChatRow = {
     updatedAt: string;
 };
 type ChatMessageRow = {
+    recordId: string;
+    /** @deprecated Use `recordId`. Retained for backward compatibility. */
     id: string;
     chatId: string;
     userId: string;
@@ -2434,6 +2713,179 @@ declare function appendMessage(stub: DurableObjectStub, msg: {
     parts?: unknown[];
 }): Promise<void>;
 
+/**
+ * Per-binding usage metering — record Vectorize / Workers AI / etc. costs
+ * to the auto-attached `USAGE_EVENTS` Analytics Engine dataset.
+ *
+ * Why: the platform's tail-worker captures per-invocation compute (CPU + wall
+ * time + script name) but it can't see which model an AI call hit, how many
+ * tokens it embedded, or how many vectors a Vectorize query scanned. Without
+ * those signals there's no way to surface per-tenant binding cost on the
+ * billing dashboard.
+ *
+ * The deploy-worker auto-attaches a `USAGE_EVENTS` AE binding to every app
+ * (dataset: `deepspace_binding_usage`). Apps don't need to declare it. They
+ * just call `meterAi(...)` / `meterVectorize(...)` / `meterUsage(...)` after
+ * each call and the dashboard rolls it up by `ownerUserId`.
+ *
+ * Schema written:
+ *   indexes: [ownerUserId]
+ *   blobs:   [appName, kind, model_or_index, op]
+ *   doubles: [units, count]
+ *
+ * Use:
+ *   await meterAi(env, '@cf/qwen/qwen3-embedding-0.6b', { inputChars: 5000 })
+ *   await meterVectorize(env, 'unison-candidates', 'query', { vectors: 1000 })
+ *   await meterUsage(env, 'custom-thing', { units: 1 })
+ */
+interface MeteringEnv {
+    USAGE_EVENTS?: AnalyticsEngineDataset;
+    OWNER_USER_ID?: string;
+    APP_NAME?: string;
+}
+/**
+ * Generic event recorder. Returns `false` if the binding isn't present
+ * (dev / not yet deployed) or if AnalyticsEngine throws — metering must
+ * never break the calling code path.
+ */
+declare function meterUsage(env: MeteringEnv, kind: string, fields?: {
+    id?: string;
+    op?: string;
+    units?: number;
+    count?: number;
+}): boolean;
+/**
+ * Record a Workers AI call.
+ *
+ * Cloudflare prices input and output tokens at different rates for LLMs
+ * (output is typically more expensive); embedding models bill input only.
+ * Emits up to two events per call so the dashboard rollup can group by
+ * `op` and apply the right per-token rate:
+ *
+ *   op='input'   units=inputChars
+ *   op='output'  units=outputChars
+ *
+ * For a pure embedding call (outputChars=0), only the input event fires.
+ * Pass `inputChars` and `outputChars` raw — the rough chars-to-token
+ * conversion happens at price time using `COST_RATES.ai.embedPerChar`.
+ */
+declare function meterAi(env: MeteringEnv, model: string, fields?: {
+    inputChars?: number;
+    outputChars?: number;
+    calls?: number;
+}): boolean;
+/**
+ * Record a Vectorize operation.
+ *
+ * Cloudflare's published model (https://developers.cloudflare.com/vectorize/platform/pricing/):
+ *
+ *   "If you have 10,000 vectors with 384-dimensions in an index, and make
+ *    100 queries against that index, your total queried vector dimensions
+ *    would sum to 3.878 million ((10000 + 100) * 384)."
+ *
+ * So query billing is *additive* — `(stored + queries) * dims` summed
+ * across the call, not per-query-multiplied-by-stored. Translating to a
+ * per-call meter:
+ *
+ *   op='query':   units = (vectors + storedCount) * dims
+ *                 Without `storedCount` we significantly undercount: a single
+ *                 query against a 100K-vector index produces ~100K queried
+ *                 dims, not just `dims`.
+ *   op='upsert':  CF doesn't bill upserts directly; the chargeable delta is
+ *                 the change to stored-vector-month. `units = vectors * dims`
+ *                 approximates the per-call storage delta.
+ *   op='delete' / 'getByIds':  recorded for observability; no direct cost.
+ *
+ * Edge case: querying an empty index gives `(1 + 0) * dims = dims`, which
+ * matches CF's formula (the `+ queries` term is always added, even at 0
+ * stored). If CF later changes that and an empty-index query bills 0,
+ * adjust here — `metering` is the single place to update the math.
+ */
+declare function meterVectorize(env: MeteringEnv, indexName: string, op: 'query' | 'upsert' | 'delete' | 'getByIds', fields?: {
+    vectors?: number;
+    dims?: number;
+    storedCount?: number;
+}): boolean;
+/**
+ * Per-`units` USD multipliers, matched to the (`kind`, `op`) the meter
+ * helpers above record. Dashboard rollup can multiply
+ *
+ *   SUM(_sample_interval * doubles[1])   -- units
+ *
+ * by these to surface $-figures without re-querying CF's billing API.
+ */
+declare const COST_RATES: {
+    readonly ai: {
+        /** USD per character (input or output). */
+        readonly perChar: number;
+    };
+    readonly vectorize: {
+        /** USD per queried dimension (per query, per stored vector compared). */
+        readonly queriedPerDim: number;
+        /** USD per stored dimension per month. */
+        readonly storedPerDimPerMonth: number;
+    };
+};
+
+/**
+ * Lightweight D1 schema bootstrapping for apps that use auto-provisioned
+ * `[[d1_databases]]` bindings.
+ *
+ * The auto-provisioner gives apps an empty D1; the app needs to create its
+ * own tables before using them. This helper runs ordered SQL fragments and
+ * tracks which have applied via a `_dpc_migrations` meta-table so re-running
+ * is a no-op:
+ *
+ * ```ts
+ * import { runMigrations } from 'deepspace/worker'
+ *
+ * await runMigrations(env.CARDS_DB, [
+ *   `CREATE TABLE cards (id INTEGER PRIMARY KEY, json TEXT NOT NULL);`,
+ *   `CREATE INDEX idx_cards_updated ON cards(updated_at);`,
+ * ])
+ * ```
+ *
+ * Each entry in the array is one migration. The runner records the index of
+ * each successfully-applied migration in `_dpc_migrations`; subsequent calls
+ * skip rows already recorded. Adding a new migration means appending to the
+ * array; never reorder or delete entries.
+ *
+ * Why a meta-table instead of `PRAGMA user_version`: D1's SQLite authorizer
+ * rejects PRAGMA writes with `SQLITE_AUTH`, even though the same statements
+ * work in raw SQLite. A real table works on any D1 database and stays a
+ * trivial bootstrap (one CREATE TABLE IF NOT EXISTS).
+ *
+ * Concurrency: D1 serializes statements per database, but two simultaneous
+ * `runMigrations` callers could race the same migration index. The duplicate
+ * INSERT collides on the primary key and the second caller sees the failure
+ * — but the migration itself uses `IF NOT EXISTS` so the schema is correct
+ * either way. Apps invoke this at startup which is single-threaded per
+ * worker isolate; the cross-isolate race is rare and self-healing.
+ *
+ * This is the simplest possible migration story (option 1 in
+ * docs/proposals/binding-auto-provisioning.md). Apps that outgrow it can
+ * adopt CF's `wrangler d1 migrations apply` directly without breaking the
+ * helper.
+ */
+interface RunMigrationsResult {
+    /** Version before this run started. Equals the count of migrations already applied. */
+    fromVersion: number;
+    /** Version after migrations applied. Equals fromVersion if nothing ran. */
+    toVersion: number;
+    /** Number of migrations applied this call. */
+    applied: number;
+}
+/**
+ * Apply ordered SQL migrations to a D1 database. Idempotent: the next call
+ * with the same array is a no-op until the array grows.
+ *
+ * Throws on any individual migration failure. The migrations meta-row is
+ * only inserted after a migration succeeds, so a partial failure leaves a
+ * recoverable state — fix the SQL, redeploy, and the failed migration runs
+ * on next startup.
+ */
+declare function runMigrations(db: D1Database, migrations: readonly string[]): Promise<RunMigrationsResult>;
+
 /**
  * Auth types for the DeepSpace SDK.
  *
@@ -3387,4 +3839,4 @@ type DeepSpaceAuth = ReturnType<typeof createDeepSpaceAuth>;
 /** Collections that bypass schema checks (permissive access) */
 declare const SYSTEM_COLLECTIONS: Set<string>;
 
-export { AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CONVERSATION_SCHEMAS, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientMessage, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ConnectionAttachment, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_MAX_SKEW_MS, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GlobalDOType, type HandlerContext, type InternalSignature, type JwtClaims, type JwtVerifierConfig, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, RESERVED_COLLECTION_NAMES, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, type ResolvedColumn, type ResolvedPermission, type RolePermissions, SYSTEM_COLLECTIONS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ServerMessage, type SharedConnection, type SignInternalPayloadInput, type StoredRecord, type Summarizer, type SyncResult, type TokenDebugInfo, type ToolResult, type ToolSchema, USERS_COLUMNS, type User, type UserAttachment, VOTING_SCHEMAS, type VerifiedAuth, type VerifyInternalSignatureInput, type VerifyOutcome, type VerifyResult, type Viewport, WORKSPACE_SCHEMAS, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applySlidingWindow, authWorkerFetch, buildCronContext, buildInternalPayload, buildTableSelect, buildUiParts, canCreate, canDelete, canRead, canUpdate, capToolResultSize, checkFieldPermissions, clientBuild, coerceValue, collectionTableName, columnId, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, getChat, getGlobalDOSchemas, getGlobalDOType, getMessageType, getRolePermissions, handleAwarenessMessage, handleSyncMessage, hasContent, isOwner, loadMessages, makeDefaultSummarizer, noopPermissionContext, platformWorkerFetch, prepareMessagesWithCompaction, readVarUint, readVarUint8Array, resolveColumn, rowToData, serverBuild, signInternalPayload, timingSafeEqualHex, toUint8Array, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, verifyInternalSignature, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema, writeVarUint, writeVarUint8Array };
+export { AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CONVERSATION_SCHEMAS, COST_RATES, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientMessage, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ConnectionAttachment, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_MAX_SKEW_MS, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GlobalDOType, type HandlerContext, type InternalSignature, type JwtClaims, type JwtVerifierConfig, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, type ResolvedColumn, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, SYSTEM_COLLECTIONS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ServerMessage, type SharedConnection, type SignInternalPayloadInput, type StoredRecord, type Summarizer, type SyncResult, type TokenDebugInfo, type ToolResult, type ToolSchema, USERS_COLUMNS, type User, type UserAttachment, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyInternalSignatureInput, type VerifyOutcome, type VerifyResult, type Viewport, WORKSPACE_SCHEMAS, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, buildCronContext, buildInternalPayload, buildTableSelect, buildUiParts, canCreate, canDelete, canRead, canUpdate, capToolResultSize, checkFieldPermissions, clientBuild, coerceValue, collectionTableName, columnId, computeDoMigration, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, getChat, getGlobalDOSchemas, getGlobalDOType, getMessageType, getRolePermissions, handleAwarenessMessage, handleSyncMessage, hasContent, isAutoProvision, isOwner, loadMessages, makeDefaultSummarizer, meterAi, meterUsage, meterVectorize, noopPermissionContext, platformWorkerFetch, prepareMessagesWithCompaction, readVarUint, readVarUint8Array, resolveAppName, resolveColumn, rowToData, runMigrations, serverBuild, signInternalPayload, timingSafeEqualHex, toUint8Array, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyInternalSignature, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema, writeVarUint, writeVarUint8Array };