deepspace 0.28.0 → 0.28.1

package/dist/worker.d.ts

@@ -3202,6 +3202,20 @@ interface AppRoleEnv {
     DEEPSPACE_APP_ID: string;
     OWNER_USER_ID: string;
 }
+interface AppMembership {
+    /** True when the caller's row exists in the app's canonical users collection. */
+    member: boolean;
+    role: Role;
+}
+/**
+ * Resolve a user's membership and role from the app's canonical users
+ * collection in one read. This is the single definition of "is this user in
+ * the app" — gate new surfaces with it rather than re-deriving membership
+ * from another tool call. Returns null when the read itself failed (room
+ * unreachable, aborted): callers must treat that as "could not verify", never
+ * as "not a member".
+ */
+declare function resolveAppMembership(env: AppRoleEnv, userId: string, signal?: AbortSignal): Promise<AppMembership | null>;
 /** Resolve a user's current role from the app's canonical users collection. */
 declare function resolveAppRole(env: AppRoleEnv, userId: string): Promise<Role>;
 
@@ -4021,6 +4035,12 @@ interface VerifyOutcome {
  */
 declare function verifyJwt(config: JwtVerifierConfig, token: string | null | undefined): Promise<VerifyOutcome>;
 
+declare const AGENT_TOKEN_SCOPE = "agent";
+/** A separate issuer keeps agent credentials invalid at ordinary platform APIs. */
+declare function agentTokenIssuer(issuer: string): string;
+/** Verify an agent credential for the exact origin currently receiving it. */
+declare function verifyAgentToken(config: Omit<JwtVerifierConfig, 'audience'>, token: string | null | undefined, targetOrigin: string): Promise<VerifyOutcome>;
+
 /**
  * HMAC primitives used by the per-app identity tokens (APP_IDENTITY_TOKEN)
  * minted at deploy time and verified on every /internal/* call into the
@@ -5221,6 +5241,84 @@ interface ClientErrorReport {
     col?: number;
 }
 
+/** Wire-size limits shared by the app Worker and the stateless CLI bridge. */
+/** Maximum JSON body accepted by one tool invocation. */
+declare const AGENT_TOOL_REQUEST_BODY_CAP: number;
+/** Maximum JSON response accepted or emitted by the discovery bridge. */
+declare const AGENT_TOOL_RESPONSE_BODY_CAP: number;
+
+/**
+ * Authenticated local-assistant tool routes for generated DeepSpace apps.
+ *
+ * The generated worker owns authentication policy; this SDK registrar only
+ * consumes its verified access decision and executes the app's existing AI SDK
+ * tools as that verified user.
+ */
+
+interface AgentToolRouteEnv {
+    APP_NAME: string;
+    DEEPSPACE_APP_ID: string;
+    RECORD_ROOMS: DurableObjectNamespace;
+}
+/**
+ * The generated worker distinguishes a missing identity (401), a denied
+ * identity (403), and an access check it could not complete (503) — a
+ * transient failure must not present as a permanent permission denial.
+ */
+type AgentToolAccessResult = {
+    ok: true;
+    auth: VerifyResult;
+} | {
+    ok: false;
+    status: 401 | 403 | 503;
+};
+interface AgentToolRouteOptions<Env extends AgentToolRouteEnv> {
+    /** Preserve the generated app's existing tool definitions unchanged. */
+    buildTools: (executor: (toolName: string, params: Record<string, unknown>) => Promise<unknown>) => ToolSet;
+    /** Performs app-specific authentication and authorization before tool discovery or execution. */
+    resolveAccess: (request: Request, env: Env) => Promise<AgentToolAccessResult>;
+}
+interface UserToolExecutorEnv {
+    DEEPSPACE_APP_ID: string;
+    RECORD_ROOMS: DurableObjectNamespace;
+}
+/**
+ * Execute one app tool in the canonical app RecordRoom as the verified user.
+ * Every assistant surface (website chat, local agent) must share this path so
+ * a tool behaves identically regardless of which surface invoked it.
+ */
+declare function createUserToolExecutor(env: UserToolExecutorEnv, userId: string, signal: AbortSignal): (toolName: string, params: Record<string, unknown>) => Promise<unknown>;
+/**
+ * Register the generated app's local assistant tool API.
+ *
+ * Mount before a broad `/_deepspace/*` proxy route so these SDK-owned paths
+ * stay in the app Worker and retain the verified caller identity.
+ */
+declare function registerAgentToolRoutes<Env extends AgentToolRouteEnv>(app: Hono<{
+    Bindings: Env;
+}>, options: AgentToolRouteOptions<Env>): void;
+
+/**
+ * First-party non-app origins allowed as agent targets on the production app
+ * domain. The token minter and the CLI must agree on this policy, so both the
+ * set AND the "is production" predicate (appDomain === PRODUCTION_APP_DOMAIN)
+ * live here — callers never re-derive either.
+ */
+declare const PRODUCTION_OFFICIAL_AGENT_ORIGINS: readonly string[];
+interface AgentTargetPolicy {
+    appDomain: string;
+    allowLoopback?: boolean;
+}
+/** Normalize an agent target only when it is an exact trusted origin. */
+declare function normalizeAgentTargetOrigin(value: unknown, policy: AgentTargetPolicy): string | null;
+
+/**
+ * Better Auth session cookie name. The CLI presents it when exchanging a
+ * stored session for JWTs, and the auth worker requires it when minting —
+ * the two sides must agree on the exact name.
+ */
+declare const SESSION_COOKIE = "__Secure-better-auth.session_token";
+
 /**
  * `deepspace logs` wire DTO — the single source of truth for the whitelisted
  * shape the platform telemetry reader emits and every consumer reads.
@@ -5309,4 +5407,4 @@ interface AppLogsResponse {
 declare const APP_LOG_EVENT_KEYS: readonly ["id", "timestamp", "level", "eventType", "message", "source", "outcome", "request", "exception"];
 type AppLogEventKey = (typeof APP_LOG_EVENT_KEYS)[number];
 
-export { ACCOUNT_STORAGE_LIMIT_BYTES, ACTION_ROUTES_BEARER_GUARD_MIGRATION_ID, ACTION_TOOLS_DELETE_WHERE_MIGRATION_ID, AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, ANONYMOUS_USER_ID_PREFIX, APP_ID_RE, APP_LOG_EVENT_KEYS, APP_NAME_RULES, ASSET_NOT_FOUND_HANDLING_VALUES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppMigrationIdsValidation, type AppNameResolution, type AppNameValidation, type AssetNotFoundHandling, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BROWSER_PROXY_ROUTES, BUILD_INJECTED_APP_ID_MIGRATION_ID, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, type BindingJsonValue, CHANNELS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CLIENT_LOG_MARKER, COST_RATES, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientErrorKind, type ClientErrorReport, type ClientMessage, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConnectionAttachment, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEEPSPACE_AGENT_PROFILES, DEEPSPACE_AI_DEFAULTS, DEEPSPACE_AI_MODELS, DEEPSPACE_MODEL_CATALOG_PROVENANCE, DEFAULT_CONTEXT_CONFIG, DEFAULT_DELETE_WHERE_LIMIT, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIModel, type DeepSpaceAIModelId, type DeepSpaceAIOptions, type DeepSpaceAIProvider, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, type DeepSpaceAgentProfile, DeepSpaceAgentProfileError, type DeepSpaceAgentProfileId, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAgentSupport, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DeepSpaceDocumentationRouteEnv, type DeepSpaceDocumentationRouteOptions, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, type GetActionData, type HandlerContext, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, type KnowledgeAddOptions, type KnowledgeAddResult, type KnowledgeClient, type KnowledgeEnv, KnowledgeError, type KnowledgeItem, type KnowledgeListOptions, type KnowledgeListResult, type KnowledgeSearchChunk, type KnowledgeSearchOptions, type KnowledgeSearchResult, type KnowledgeStatus, LOG_LEVELS, type LogLevel, MAX_APP_FILE_BYTES, MAX_DELETE_WHERE_LIMIT, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_ENV_VAR_BYTES, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type MutateActionData, type PermissionContext, type PermissionLevel, type PlatformWorkerEnv, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, type ProxyRoute, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, RECORD_NOT_FOUND, REGISTRY_INSTANCE, RELEASE_STAMP_PATH, REPO_STORE_LIMIT_BYTES, REQUIRED_COMPATIBILITY_FLAGS, RESERVED_BINDING_NAMES, RESERVED_RUN_WORKER_FIRST, RESOURCE_ID_RE, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, RegistryClientError, type ResolvedColumn, type ResolvedDeepSpaceAgentModel, type RolePermissions, type RunMigrationsResult, SDK_RUN_WORKER_FIRST, SECURE_ROOM_BOUNDARIES_MIGRATION_ID, STRICT_APP_ID_RE, SYSTEM_ASSIGNED_COLUMNS, SYSTEM_COLLECTIONS, SYSTEM_MAINTAINED_COLUMNS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedKnowledgeClient, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type ServerMessage, type StorageAdmission, type StoredRecord, type Summarizer, type SyncResult, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, UNDECLARED_ASSET_NOT_FOUND_HANDLING, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKER_OWNED_NOT_FOUND_MIGRATION_ID, YjsRoom, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, armCronRoom, authWorkerFetch, authenticatedRoomRequest, bindingManifestFromOutputConfig, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, capToolResultSize, captureScreenshot, checkFieldPermissions, checkUnclaimedOwnerTransition, clientBuild, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, enqueueJob, epochSeconds, folderFilter, formatBytes, getChat, getDeepSpaceAIModel, getMessageType, getRolePermissions, handleAwarenessMessage, handleClientErrorReport, handleSyncMessage, hasContent, isAnonymousUserId, isAssetNotFoundHandling, isAutoProvision, isFilesVerbPath, isOwner, isPlatformReservedPath, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, knowledge, lintSchema, lintSchemaSet, lintSchemas, listDeepSpaceAgentModels, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, mintAppId, mintUlid, noopPermissionContext, normalizeKnowledgeFolder, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, readVarUint, readVarUint8Array, registerClientErrorRoute, registerDeepSpaceDocumentation, registryErrorJson, registryStub, resolveAppName, resolveAppRole, resolveColumn, resolveCompatibilityFlags, resolveDeepSpaceAgentModel, rowToData, runMigrations, serverBuild, storageLimitForTier, storageQuotaMessage, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, toUint8Array, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppMigrationIds, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, writeVarUint, writeVarUint8Array };
+export { ACCOUNT_STORAGE_LIMIT_BYTES, ACTION_ROUTES_BEARER_GUARD_MIGRATION_ID, ACTION_TOOLS_DELETE_WHERE_MIGRATION_ID, AGENT_TOKEN_SCOPE, AGENT_TOOL_REQUEST_BODY_CAP, AGENT_TOOL_RESPONSE_BODY_CAP, AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, ANONYMOUS_USER_ID_PREFIX, APP_ID_RE, APP_LOG_EVENT_KEYS, APP_NAME_RULES, ASSET_NOT_FOUND_HANDLING_VALUES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type AgentTargetPolicy, type AgentToolAccessResult, type AgentToolRouteEnv, type AgentToolRouteOptions, type ApiWorkerEnv, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppMembership, type AppMigrationIdsValidation, type AppNameResolution, type AppNameValidation, type AssetNotFoundHandling, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BROWSER_PROXY_ROUTES, BUILD_INJECTED_APP_ID_MIGRATION_ID, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, type BindingJsonValue, CHANNELS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CLIENT_LOG_MARKER, COST_RATES, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientErrorKind, type ClientErrorReport, type ClientMessage, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConnectionAttachment, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEEPSPACE_AGENT_PROFILES, DEEPSPACE_AI_DEFAULTS, DEEPSPACE_AI_MODELS, DEEPSPACE_MODEL_CATALOG_PROVENANCE, DEFAULT_CONTEXT_CONFIG, DEFAULT_DELETE_WHERE_LIMIT, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIModel, type DeepSpaceAIModelId, type DeepSpaceAIOptions, type DeepSpaceAIProvider, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, type DeepSpaceAgentProfile, DeepSpaceAgentProfileError, type DeepSpaceAgentProfileId, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAgentSupport, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DeepSpaceDocumentationRouteEnv, type DeepSpaceDocumentationRouteOptions, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, type GetActionData, type HandlerContext, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, type KnowledgeAddOptions, type KnowledgeAddResult, type KnowledgeClient, type KnowledgeEnv, KnowledgeError, type KnowledgeItem, type KnowledgeListOptions, type KnowledgeListResult, type KnowledgeSearchChunk, type KnowledgeSearchOptions, type KnowledgeSearchResult, type KnowledgeStatus, LOG_LEVELS, type LogLevel, MAX_APP_FILE_BYTES, MAX_DELETE_WHERE_LIMIT, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_ENV_VAR_BYTES, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type MutateActionData, PRODUCTION_OFFICIAL_AGENT_ORIGINS, type PermissionContext, type PermissionLevel, type PlatformWorkerEnv, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, type ProxyRoute, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, RECORD_NOT_FOUND, REGISTRY_INSTANCE, RELEASE_STAMP_PATH, REPO_STORE_LIMIT_BYTES, REQUIRED_COMPATIBILITY_FLAGS, RESERVED_BINDING_NAMES, RESERVED_RUN_WORKER_FIRST, RESOURCE_ID_RE, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, RegistryClientError, type ResolvedColumn, type ResolvedDeepSpaceAgentModel, type RolePermissions, type RunMigrationsResult, SDK_RUN_WORKER_FIRST, SECURE_ROOM_BOUNDARIES_MIGRATION_ID, SESSION_COOKIE, STRICT_APP_ID_RE, SYSTEM_ASSIGNED_COLUMNS, SYSTEM_COLLECTIONS, SYSTEM_MAINTAINED_COLUMNS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedKnowledgeClient, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type ServerMessage, type StorageAdmission, type StoredRecord, type Summarizer, type SyncResult, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, UNDECLARED_ASSET_NOT_FOUND_HANDLING, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, type UserToolExecutorEnv, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKER_OWNED_NOT_FOUND_MIGRATION_ID, YjsRoom, agentTokenIssuer, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, armCronRoom, authWorkerFetch, authenticatedRoomRequest, bindingManifestFromOutputConfig, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, capToolResultSize, captureScreenshot, checkFieldPermissions, checkUnclaimedOwnerTransition, clientBuild, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, createUserToolExecutor, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, enqueueJob, epochSeconds, folderFilter, formatBytes, getChat, getDeepSpaceAIModel, getMessageType, getRolePermissions, handleAwarenessMessage, handleClientErrorReport, handleSyncMessage, hasContent, isAnonymousUserId, isAssetNotFoundHandling, isAutoProvision, isFilesVerbPath, isOwner, isPlatformReservedPath, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, knowledge, lintSchema, lintSchemaSet, lintSchemas, listDeepSpaceAgentModels, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, mintAppId, mintUlid, noopPermissionContext, normalizeAgentTargetOrigin, normalizeKnowledgeFolder, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, readVarUint, readVarUint8Array, registerAgentToolRoutes, registerClientErrorRoute, registerDeepSpaceDocumentation, registryErrorJson, registryStub, resolveAppMembership, resolveAppName, resolveAppRole, resolveColumn, resolveCompatibilityFlags, resolveDeepSpaceAgentModel, rowToData, runMigrations, serverBuild, storageLimitForTier, storageQuotaMessage, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, toUint8Array, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppMigrationIds, validateAppName, validateBindingManifest, validateDoManifest, verifyAgentToken, verifyJwt, writeVarUint, writeVarUint8Array };

package/dist/worker.js

@@ -7450,8 +7450,8 @@ function buildCronContext(env, ownerUserId, roomId = "default") {
 }
 
 // src/server/utils/app-role.ts
-async function resolveAppRole(env, userId) {
-  if (userId === env.OWNER_USER_ID) return "admin";
+async function resolveAppMembership(env, userId, signal) {
+  if (userId === env.OWNER_USER_ID) return { member: true, role: "admin" };
   const stub = env.RECORD_ROOMS.get(env.RECORD_ROOMS.idFromName(`app:${env.DEEPSPACE_APP_ID}`));
   try {
     const res = await stub.fetch(
@@ -7465,16 +7465,21 @@ async function resolveAppRole(env, userId) {
         body: JSON.stringify({
           tool: "records.get",
           params: { collection: "users", recordId: userId }
-        })
+        }),
+        signal
       })
     );
     const json = await res.json();
-    const role = json.data?.record?.data?.role;
-    return json.success && isWriterRole(role) ? role : "viewer";
+    if (!json.success || !json.data?.record) return { member: false, role: "viewer" };
+    const role = json.data.record.data?.role;
+    return { member: true, role: isWriterRole(role) ? role : "viewer" };
   } catch {
-    return "viewer";
+    return null;
   }
 }
+async function resolveAppRole(env, userId) {
+  return (await resolveAppMembership(env, userId))?.role ?? "viewer";
+}
 
 // src/server/utils/ai.ts
 import { createAnthropic } from "@ai-sdk/anthropic";
@@ -7909,6 +7914,9 @@ function locateTrimmableArray(result) {
   }
   return void 0;
 }
+function utf8ByteLength(text) {
+  return new TextEncoder().encode(text).byteLength;
+}
 function capToolResultSize(result, byteCap) {
   let serialized;
   try {
@@ -7917,7 +7925,7 @@ function capToolResultSize(result, byteCap) {
     return { success: false, error: "Tool result could not be serialized." };
   }
   if (typeof serialized !== "string") return result;
-  if (serialized.length <= byteCap) return result;
+  if (utf8ByteLength(serialized) <= byteCap) return result;
   if (result && typeof result === "object") {
     const located = locateTrimmableArray(result);
     if (located) {
@@ -7926,7 +7934,7 @@ function capToolResultSize(result, byteCap) {
       const build = (k) => setPath(result, path, items.slice(0, k), { truncated: true, returned: k, total });
       const fits = (k) => {
         try {
-          return JSON.stringify(build(k)).length <= byteCap;
+          return utf8ByteLength(JSON.stringify(build(k))) <= byteCap;
         } catch {
           return false;
         }
@@ -7946,7 +7954,7 @@ function capToolResultSize(result, byteCap) {
   return {
     success: false,
     truncated: true,
-    error: `Tool result exceeded ${byteCap} bytes (was ${serialized.length}). Retry with a narrower query (e.g. add a \`where\` filter, reduce \`limit\`, or call records.get for a single record).`,
+    error: `Tool result exceeded ${byteCap} bytes (was ${utf8ByteLength(serialized)}). Retry with a narrower query (e.g. add a \`where\` filter, reduce \`limit\`, or call records.get for a single record).`,
     preview: serialized.slice(0, 2e3)
   };
 }
@@ -8098,10 +8106,15 @@ async function prepareMessagesWithCompaction(messages, config, options) {
         newSummary: { text, throughId }
       };
     } catch (err) {
-      console.error("prepareMessagesWithCompaction: summarizer failed, falling back to sliding window", err);
+      console.error(
+        "prepareMessagesWithCompaction: summarizer failed, falling back to sliding window",
+        err
+      );
     }
   } else {
-    console.warn("prepareMessagesWithCompaction: messages lack ids; cannot anchor a summary, falling back to sliding window");
+    console.warn(
+      "prepareMessagesWithCompaction: messages lack ids; cannot anchor a summary, falling back to sliding window"
+    );
   }
   return {
     messages: applySlidingWindow(working, config.contextBudget, config.minKept)
@@ -9100,38 +9113,43 @@ function documentationLimiterErrorSummary(error) {
   });
 }
 
-// src/documentation/worker/request-body.ts
-var RequestBodyTooLargeError = class extends Error {
+// src/shared/bounded-body.ts
+var BodyTooLargeError = class extends Error {
   constructor(maxBytes) {
-    super(`Request body exceeds ${maxBytes} bytes`);
+    super(`Body exceeds ${maxBytes} bytes`);
     this.maxBytes = maxBytes;
-    this.name = "RequestBodyTooLargeError";
+    this.name = "BodyTooLargeError";
   }
 };
-async function readBoundedRequestText(request2, maxBytes) {
+async function readBoundedBodyText(source, maxBytes) {
   if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
     throw new TypeError("maxBytes must be a positive safe integer");
   }
-  const declared = request2.headers.get("content-length");
+  const declared = source.headers.get("content-length");
   if (declared && /^\d+$/.test(declared.trim()) && Number(declared) > maxBytes) {
-    throw new RequestBodyTooLargeError(maxBytes);
+    await source.body?.cancel().catch(() => void 0);
+    throw new BodyTooLargeError(maxBytes);
   }
-  if (!request2.body) return "";
-  const reader = request2.body.getReader();
+  if (!source.body) return "";
+  const reader = source.body.getReader();
   const decoder = new TextDecoder();
   let bytes = 0;
   let text = "";
-  while (true) {
-    const chunk = await reader.read();
-    if (chunk.done) break;
-    bytes += chunk.value.byteLength;
-    if (bytes > maxBytes) {
-      await reader.cancel().catch(() => void 0);
-      throw new RequestBodyTooLargeError(maxBytes);
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      bytes += chunk.value.byteLength;
+      if (bytes > maxBytes) {
+        await reader.cancel().catch(() => void 0);
+        throw new BodyTooLargeError(maxBytes);
+      }
+      text += decoder.decode(chunk.value, { stream: true });
     }
-    text += decoder.decode(chunk.value, { stream: true });
+    return text + decoder.decode();
+  } finally {
+    reader.releaseLock();
   }
-  return text + decoder.decode();
 }
 
 // src/documentation/worker/assistant-routes.ts
@@ -9171,13 +9189,13 @@ function registerDocumentationAssistantRoutes(app, resolveAuth, publicBasePath =
     }
     let body = null;
     try {
-      const raw = await readBoundedRequestText(c.req.raw, MAX_REQUEST_BYTES);
+      const raw = await readBoundedBodyText(c.req.raw, MAX_REQUEST_BYTES);
       const parsed = JSON.parse(raw);
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         body = parsed;
       }
     } catch (error) {
-      if (error instanceof RequestBodyTooLargeError) {
+      if (error instanceof BodyTooLargeError) {
         return c.json({ error: `request exceeds ${MAX_REQUEST_BYTES} bytes` }, 413);
       }
       return c.json({ error: "request body must be valid JSON" }, 400);
@@ -9597,9 +9615,9 @@ function registerDocumentationMcpRoutes(app, publicBasePath = DOCUMENTATION_BASE
     }
     let raw;
     try {
-      raw = await readBoundedRequestText(c.req.raw, MAX_REQUEST_BYTES2);
+      raw = await readBoundedBodyText(c.req.raw, MAX_REQUEST_BYTES2);
     } catch (error) {
-      if (error instanceof RequestBodyTooLargeError) {
+      if (error instanceof BodyTooLargeError) {
         return mcpError(null, -32600, `Request exceeds ${MAX_REQUEST_BYTES2} bytes`, 413);
       }
       return mcpError(null, -32700, "Unable to read request body", 400);
@@ -9928,6 +9946,24 @@ async function verifyJwt(config, token) {
   }
 }
 
+// src/server/auth/agentToken.ts
+var AGENT_TOKEN_SCOPE = "agent";
+function agentTokenIssuer(issuer) {
+  return `${issuer.replace(/\/+$/, "")}/agent`;
+}
+async function verifyAgentToken(config, token, targetOrigin) {
+  const outcome = await verifyJwt(
+    {
+      ...config,
+      issuer: agentTokenIssuer(config.issuer),
+      audience: targetOrigin
+    },
+    token
+  );
+  if (!outcome.result || outcome.result.claims.scope === AGENT_TOKEN_SCOPE) return outcome;
+  return { ...outcome, result: null, error: new Error("Invalid agent token scope") };
+}
+
 // src/server/auth/internalAuth.ts
 var nodeCryptoPromise = null;
 async function loadNodeCrypto() {
@@ -10206,6 +10242,231 @@ function registerClientErrorRoute(app) {
   app.post(CLIENT_ERROR_PATH, (c) => handleClientErrorReport(c.req.raw));
 }
 
+// src/server/agent-tools.ts
+import { asSchema } from "ai";
+
+// src/shared/agent-tool-protocol.ts
+var AGENT_TOOL_REQUEST_BODY_CAP = 64 * 1024;
+var AGENT_TOOL_RESPONSE_BODY_CAP = 1024 * 1024;
+
+// src/server/agent-tools.ts
+function jsonResponse3(body, status = 200) {
+  return rawJsonResponse(JSON.stringify(body), status);
+}
+function rawJsonResponse(body, status = 200) {
+  return new Response(body, {
+    status,
+    headers: {
+      "Cache-Control": "no-store",
+      "Content-Type": "application/json; charset=utf-8"
+    }
+  });
+}
+function errorResponse(status, code) {
+  const errors = {
+    unauthenticated: "Authentication is required.",
+    forbidden: "You are not allowed to use assistant tools.",
+    access_check_unavailable: "Access could not be verified. Try again.",
+    tool_not_found: "The requested tool is not available.",
+    invalid_json: "The request body must be valid JSON.",
+    invalid_tool_input: "The tool input is invalid.",
+    payload_too_large: "The request body is too large.",
+    tool_configuration_error: "Assistant tools are not configured correctly.",
+    tool_execution_failed: "The tool could not be executed.",
+    invalid_tool_result: "The tool returned an invalid result.",
+    tool_result_too_large: "The tool returned a result that is too large."
+  };
+  return jsonResponse3({ ok: false, code, error: errors[code] }, status);
+}
+function parseToolRequestBody(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  if (!Object.hasOwn(parsed, "input")) return null;
+  return { input: parsed.input };
+}
+function isAsyncIterable(value) {
+  return value !== null && (typeof value === "object" || typeof value === "function") && Symbol.asyncIterator in value;
+}
+function jsonText(value) {
+  try {
+    const serialized = JSON.stringify(value);
+    return typeof serialized === "string" ? serialized : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function executableTool(tools, name) {
+  if (!Object.hasOwn(tools, name)) return void 0;
+  const tool3 = tools[name];
+  return typeof tool3.execute === "function" ? { ...tool3, execute: tool3.execute } : void 0;
+}
+function toolMetadata(tools) {
+  return Object.entries(tools).flatMap(([name, tool3]) => {
+    if (typeof tool3.execute !== "function") return [];
+    const inputSchema = asSchema(tool3.inputSchema);
+    const entry = {
+      name,
+      description: typeof tool3.description === "string" ? tool3.description : "",
+      inputSchema: inputSchema.jsonSchema
+    };
+    if (tool3.outputSchema) entry.outputSchema = asSchema(tool3.outputSchema).jsonSchema;
+    return [entry];
+  }).sort((left, right) => left.name.localeCompare(right.name));
+}
+function createUserToolExecutor(env, userId, signal) {
+  const roomId = env.RECORD_ROOMS.idFromName(`app:${env.DEEPSPACE_APP_ID}`);
+  const room = env.RECORD_ROOMS.get(roomId);
+  return async (toolName, params) => {
+    const response = await room.fetch(
+      new Request("https://internal/api/tools/execute", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-User-Id": userId
+        },
+        body: JSON.stringify({ tool: toolName, params }),
+        signal
+      })
+    );
+    return capToolResultSize(await response.json(), DEFAULT_CONTEXT_CONFIG.toolResultCap);
+  };
+}
+async function resolveCallerTools(options, request2, env) {
+  let access;
+  try {
+    access = await options.resolveAccess(request2, env);
+  } catch {
+    return errorResponse(500, "tool_configuration_error");
+  }
+  if (!access.ok) {
+    return errorResponse(
+      access.status,
+      access.status === 401 ? "unauthenticated" : access.status === 403 ? "forbidden" : "access_check_unavailable"
+    );
+  }
+  try {
+    return options.buildTools(createUserToolExecutor(env, access.auth.userId, request2.signal));
+  } catch {
+    return errorResponse(500, "tool_configuration_error");
+  }
+}
+function registerAgentToolRoutes(app, options) {
+  app.get("/_deepspace/agent/tools", async (c) => {
+    const tools = await resolveCallerTools(options, c.req.raw, c.env);
+    if (tools instanceof Response) return tools;
+    try {
+      const serialized = jsonText({
+        ok: true,
+        app: { id: c.env.DEEPSPACE_APP_ID, name: c.env.APP_NAME },
+        tools: toolMetadata(tools)
+      });
+      if (!serialized || utf8ByteLength(serialized) > AGENT_TOOL_RESPONSE_BODY_CAP) {
+        return errorResponse(500, "tool_configuration_error");
+      }
+      return rawJsonResponse(serialized);
+    } catch {
+      return errorResponse(500, "tool_configuration_error");
+    }
+  });
+  app.post("/_deepspace/agent/tools/:name", async (c) => {
+    const tools = await resolveCallerTools(options, c.req.raw, c.env);
+    if (tools instanceof Response) return tools;
+    let tool3;
+    try {
+      tool3 = executableTool(tools, c.req.param("name"));
+    } catch {
+      return errorResponse(500, "tool_configuration_error");
+    }
+    if (!tool3) return errorResponse(404, "tool_not_found");
+    let text;
+    try {
+      text = await readBoundedBodyText(c.req.raw, AGENT_TOOL_REQUEST_BODY_CAP);
+    } catch (error) {
+      return error instanceof BodyTooLargeError ? errorResponse(413, "payload_too_large") : errorResponse(400, "invalid_json");
+    }
+    const body = parseToolRequestBody(text);
+    if (body === void 0) return errorResponse(400, "invalid_json");
+    if (body === null) return errorResponse(400, "invalid_tool_input");
+    let input = body.input;
+    try {
+      const validation = asSchema(tool3.inputSchema).validate;
+      if (validation) {
+        const result = await validation(input);
+        if (!result.success) return errorResponse(400, "invalid_tool_input");
+        input = result.value;
+      }
+    } catch {
+      return errorResponse(400, "invalid_tool_input");
+    }
+    let output;
+    try {
+      output = await tool3.execute(input, {
+        toolCallId: crypto.randomUUID(),
+        messages: [],
+        abortSignal: c.req.raw.signal
+      });
+    } catch {
+      return errorResponse(500, "tool_execution_failed");
+    }
+    if (isAsyncIterable(output)) return errorResponse(500, "invalid_tool_result");
+    try {
+      if (tool3.outputSchema) {
+        const validation = asSchema(tool3.outputSchema).validate;
+        if (validation) {
+          const result = await validation(output);
+          if (!result.success) return errorResponse(500, "invalid_tool_result");
+          output = result.value;
+        }
+      }
+    } catch {
+      return errorResponse(500, "invalid_tool_result");
+    }
+    const serialized = jsonText(output === void 0 ? null : output);
+    if (!serialized) return errorResponse(500, "invalid_tool_result");
+    if (utf8ByteLength(serialized) > DEFAULT_CONTEXT_CONFIG.toolResultCap) {
+      return errorResponse(500, "tool_result_too_large");
+    }
+    return rawJsonResponse(`{"ok":true,"result":${serialized}}`);
+  });
+  app.all("/_deepspace/agent", () => errorResponse(404, "tool_not_found"));
+  app.all("/_deepspace/agent/*", () => errorResponse(404, "tool_not_found"));
+}
+
+// src/server/agent-target.ts
+var PRODUCTION_OFFICIAL_AGENT_ORIGINS = ["https://admin.deep.space"];
+var PRODUCTION_APP_DOMAIN = "app.space";
+function normalizeAgentTargetOrigin(value, policy) {
+  if (typeof value !== "string" || !value) return null;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (url.username || url.password || url.search || url.hash || url.pathname !== "/") return null;
+  const hostname = url.hostname.toLowerCase();
+  const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(hostname);
+  if (loopback) {
+    return policy.allowLoopback && ["http:", "https:"].includes(url.protocol) ? url.origin : null;
+  }
+  if (url.protocol !== "https:" || url.port) return null;
+  if (policy.appDomain.toLowerCase() === PRODUCTION_APP_DOMAIN && PRODUCTION_OFFICIAL_AGENT_ORIGINS.includes(url.origin)) {
+    return url.origin;
+  }
+  const suffix = `.${policy.appDomain.toLowerCase()}`;
+  if (!hostname.endsWith(suffix)) return null;
+  const label = hostname.slice(0, -suffix.length);
+  return !label.includes(".") && validateAppName(label).valid ? url.origin : null;
+}
+
+// src/shared/auth-session.ts
+var SESSION_COOKIE = "__Secure-better-auth.session_token";
+
 // src/shared/log-events.ts
 var LOG_LEVELS = ["debug", "log", "info", "warn", "error"];
 var APP_LOG_EVENT_KEYS = [
@@ -10223,6 +10484,9 @@ export {
   ACCOUNT_STORAGE_LIMIT_BYTES,
   ACTION_ROUTES_BEARER_GUARD_MIGRATION_ID,
   ACTION_TOOLS_DELETE_WHERE_MIGRATION_ID,
+  AGENT_TOKEN_SCOPE,
+  AGENT_TOOL_REQUEST_BODY_CAP,
+  AGENT_TOOL_RESPONSE_BODY_CAP,
   AI_CHATS_SCHEMA,
   AI_MESSAGES_SCHEMA,
   ALLOWED_BINDING_TYPES,
@@ -10274,6 +10538,7 @@ export {
   MSG_SYNC_UPDATE,
   MSG_YJS_AWARENESS,
   MSG_YJS_SYNC,
+  PRODUCTION_OFFICIAL_AGENT_ORIGINS,
   PresenceRoom,
   REACTIONS_SCHEMA,
   READ_RECEIPTS_SCHEMA,
@@ -10292,6 +10557,7 @@ export {
   RegistryClientError,
   SDK_RUN_WORKER_FIRST,
   SECURE_ROOM_BOUNDARIES_MIGRATION_ID,
+  SESSION_COOKIE,
   STRICT_APP_ID_RE,
   SYSTEM_ASSIGNED_COLUMNS,
   SYSTEM_COLLECTIONS,
@@ -10304,6 +10570,7 @@ export {
   USERS_COLUMNS,
   WORKER_OWNED_NOT_FOUND_MIGRATION_ID,
   YjsRoom,
+  agentTokenIssuer,
   apiWorkerFetch,
   appendMessage,
   applyAiToolDefaults,
@@ -10337,6 +10604,7 @@ export {
   createDeepSpaceAuth,
   createEncoder,
   createScopedR2Handler,
+  createUserToolExecutor,
   dataToColumnValues,
   decodeJwtPayload,
   deepSpaceAgentErrorSummary,
@@ -10382,6 +10650,7 @@ export {
   mintAppId,
   mintUlid,
   noopPermissionContext,
+  normalizeAgentTargetOrigin,
   normalizeKnowledgeFolder,
   parseQuotaLimit,
   platformCorsPatterns,
@@ -10390,10 +10659,12 @@ export {
   priceBindingUsageEvent,
   readVarUint,
   readVarUint8Array,
+  registerAgentToolRoutes,
   registerClientErrorRoute,
   registerDeepSpaceDocumentation,
   registryErrorJson,
   registryStub,
+  resolveAppMembership,
   resolveAppName,
   resolveAppRole,
   resolveColumn,
@@ -10417,6 +10688,7 @@ export {
   validateAppName,
   validateBindingManifest,
   validateDoManifest,
+  verifyAgentToken,
   verifyJwt,
   writeVarUint,
   writeVarUint8Array