deepspace 0.3.10 → 0.4.0

package/dist/worker.js

@@ -206,6 +206,13 @@ var MSG = {
   USER_LIST: "user.list",
   SET_ROLE: "user.set_role",
   USER_UPDATE: "user.update",
+  // ---- Auth signal -----------------------------------------------------
+  // Server → client one-shot on connect from rooms that enforce role-based
+  // writes (Canvas, Game, Cron). Tells the client whether this connection
+  // can write so its hook can disable local write APIs and the UI can
+  // render controls accordingly. Without this, a viewer's click would
+  // round-trip to the server and silently come back as ERROR.
+  AUTH: "auth",
   // ---- Yjs JSON control frames (binary sync lives in ./yjs.ts) ---------
   YJS_JOIN: "yjs.join",
   YJS_LEAVE: "yjs.leave",
@@ -239,6 +246,14 @@ var MSG = {
   CRON_PAUSE: "cron.pause",
   CRON_RESUME: "cron.resume",
   CRON_STATUS: "cron.status",
+  // ---- JobRoom ---------------------------------------------------------
+  // Background-job queue with durable, alarm-driven execution. See
+  // server/rooms/job-room.ts. Clients enqueue and subscribe to updates;
+  // the room broadcasts JOB_UPDATE for every status transition.
+  JOB_ENQUEUE: "job.enqueue",
+  JOB_CANCEL: "job.cancel",
+  JOB_RETRY: "job.retry",
+  JOB_UPDATE: "job.update",
   // ---- PresenceRoom ----------------------------------------------------
   PRESENCE_SYNC: "presence.sync",
   PRESENCE_JOIN: "presence.join",
@@ -934,6 +949,13 @@ var clientBuild = {
   cronTrigger: (taskName) => ({ type: MSG.CRON_TRIGGER, payload: { taskName } }),
   cronPause: (taskName) => ({ type: MSG.CRON_PAUSE, payload: { taskName } }),
   cronResume: (taskName) => ({ type: MSG.CRON_RESUME, payload: { taskName } }),
+  // Jobs
+  jobEnqueue: (requestId, type, payload, maxAttempts) => ({
+    type: MSG.JOB_ENQUEUE,
+    payload: { requestId, type, payload, maxAttempts }
+  }),
+  jobCancel: (jobId) => ({ type: MSG.JOB_CANCEL, payload: { jobId } }),
+  jobRetry: (jobId) => ({ type: MSG.JOB_RETRY, payload: { jobId } }),
   // Presence
   presenceUpdate: (state) => ({ type: MSG.PRESENCE_UPDATE, payload: state }),
   // Gateway
@@ -988,6 +1010,17 @@ var serverBuild = {
   cronTasks: (tasks) => ({ type: MSG.CRON_TASKS, payload: { tasks } }),
   cronHistory: (history) => ({ type: MSG.CRON_HISTORY, payload: { history } }),
   cronStatus: (tasks, recentHistory) => ({ type: MSG.CRON_STATUS, payload: { tasks, recentHistory } }),
+  // Jobs
+  jobSnapshot: (jobs) => ({ type: MSG.JOB_UPDATE, payload: { kind: "snapshot", jobs } }),
+  jobEnqueued: (job, requestId) => ({
+    type: MSG.JOB_UPDATE,
+    payload: { kind: "enqueued", job, requestId }
+  }),
+  jobProgress: (job) => ({ type: MSG.JOB_UPDATE, payload: { kind: "progress", job } }),
+  jobSucceeded: (job) => ({ type: MSG.JOB_UPDATE, payload: { kind: "succeeded", job } }),
+  jobFailed: (job) => ({ type: MSG.JOB_UPDATE, payload: { kind: "failed", job } }),
+  jobCanceled: (job) => ({ type: MSG.JOB_UPDATE, payload: { kind: "canceled", job } }),
+  jobRetried: (job) => ({ type: MSG.JOB_UPDATE, payload: { kind: "retried", job } }),
   // Presence
   presenceSync: (peers) => ({ type: MSG.PRESENCE_SYNC, payload: { peers } }),
   presenceJoin: (peer) => ({ type: MSG.PRESENCE_JOIN, payload: { peer } }),
@@ -3268,7 +3301,20 @@ var YjsRoom = class extends BaseRoom {
   }
 };
 
+// src/shared/roles.ts
+var ROLES = {
+  VIEWER: "viewer",
+  MEMBER: "member",
+  ADMIN: "admin"
+};
+
 // src/server/rooms/game-room.ts
+var GAME_WRITE_TYPES = /* @__PURE__ */ new Set([
+  MSG.GAME_INPUT,
+  MSG.GAME_PLAYER_READY,
+  MSG.GAME_START,
+  MSG.GAME_END
+]);
 var GameRoom = class extends BaseRoom {
   config;
   players = /* @__PURE__ */ new Map();
@@ -3324,10 +3370,26 @@ var GameRoom = class extends BaseRoom {
   // ==========================================================================
   onConnect(ws, user) {
     this.ensureInitialized();
+    const role = user.role ?? ROLES.VIEWER;
+    const canWrite = role === ROLES.MEMBER || role === ROLES.ADMIN;
     const attachment = {
       ...user,
-      joinedAt: (/* @__PURE__ */ new Date()).toISOString()
+      joinedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      canWrite
     };
+    this.sendTo(ws, { type: MSG.AUTH, payload: { canWrite } });
+    if (!canWrite) {
+      this.sendTo(ws, {
+        type: MSG.GAME_STATE,
+        payload: {
+          state: this.gameState,
+          tick: this.currentTick,
+          players: Array.from(this.players.values()),
+          running: this.running
+        }
+      });
+      return attachment;
+    }
     const player = {
       userId: user.userId,
       userName: user.userName,
@@ -3356,6 +3418,13 @@ var GameRoom = class extends BaseRoom {
   async onMessage(ws, user, message) {
     this.ensureInitialized();
     const { type, payload } = message;
+    if (GAME_WRITE_TYPES.has(type) && !user.canWrite) {
+      this.sendTo(ws, {
+        type: MSG.ERROR,
+        payload: { error: "Write access denied: spectators cannot drive the game" }
+      });
+      return;
+    }
     switch (type) {
       case MSG.GAME_INPUT: {
         this.inputBuffer.push({
@@ -3504,6 +3573,15 @@ var GameRoom = class extends BaseRoom {
 
 // src/server/rooms/canvas-room.ts
 import * as Y5 from "yjs";
+var CANVAS_WRITE_TYPES = /* @__PURE__ */ new Set([
+  MSG.CANVAS_ADD,
+  MSG.CANVAS_MOVE,
+  MSG.CANVAS_RESIZE,
+  MSG.CANVAS_DELETE,
+  MSG.CANVAS_UPDATE,
+  MSG.CANVAS_UNDO,
+  MSG.CANVAS_REDO
+]);
 var CanvasRoom = class extends BaseRoom {
   doc = null;
   initialized = false;
@@ -3563,10 +3641,14 @@ var CanvasRoom = class extends BaseRoom {
   }
   onConnect(ws, user) {
     this.ensureInitialized();
+    const role = user.role ?? ROLES.VIEWER;
+    const canWrite = role === ROLES.MEMBER || role === ROLES.ADMIN;
     const attachment = {
       ...user,
-      viewport: null
+      viewport: null,
+      canWrite
     };
+    this.sendTo(ws, { type: MSG.AUTH, payload: { canWrite } });
     const shapes = this.getAllShapes();
     this.sendTo(ws, {
       type: MSG.CANVAS_SHAPES,
@@ -3580,6 +3662,13 @@ var CanvasRoom = class extends BaseRoom {
   async onMessage(ws, user, message) {
     this.ensureInitialized();
     const { type, payload } = message;
+    if (CANVAS_WRITE_TYPES.has(type) && !user.canWrite) {
+      this.sendTo(ws, {
+        type: MSG.ERROR,
+        payload: { error: "Write access denied: viewer role cannot modify the canvas" }
+      });
+      return;
+    }
     switch (type) {
       case MSG.CANVAS_ADD: {
         const shape = payload;
@@ -3874,6 +3963,11 @@ var PresenceRoom = class extends BaseRoom {
 };
 
 // src/server/rooms/cron-room.ts
+var CRON_WRITE_TYPES = /* @__PURE__ */ new Set([
+  MSG.CRON_TRIGGER,
+  MSG.CRON_PAUSE,
+  MSG.CRON_RESUME
+]);
 var CronRoom = class extends BaseRoom {
   tasks;
   initialized = false;
@@ -3952,6 +4046,9 @@ var CronRoom = class extends BaseRoom {
   }
   onConnect(ws, user) {
     this.ensureInitialized();
+    const role = user.role ?? ROLES.VIEWER;
+    const canWrite = role === ROLES.MEMBER || role === ROLES.ADMIN;
+    this.sendTo(ws, { type: MSG.AUTH, payload: { canWrite } });
     this.sendTo(ws, {
       type: MSG.CRON_TASKS,
       payload: { tasks: this.getTaskStates() }
@@ -3960,11 +4057,18 @@ var CronRoom = class extends BaseRoom {
       type: MSG.CRON_HISTORY,
       payload: { history: this.getRecentHistory(50) }
     });
-    return user;
+    return { ...user, canWrite };
   }
   async onMessage(ws, user, message) {
     this.ensureInitialized();
     const { type, payload } = message;
+    if (CRON_WRITE_TYPES.has(type) && !user.canWrite) {
+      this.sendTo(ws, {
+        type: MSG.ERROR,
+        payload: { error: "Write access denied: viewer role cannot modify cron tasks" }
+      });
+      return;
+    }
     switch (type) {
       case MSG.CRON_TRIGGER: {
         const taskName = payload.taskName;
@@ -4275,6 +4379,543 @@ function cronMatches(parsed, timezone, date) {
   return parsed.minute.has(minute) && parsed.hour.has(hour) && parsed.dayOfMonth.has(dayOfMonth) && parsed.month.has(month) && parsed.dayOfWeek.has(dayOfWeek);
 }
 
+// src/server/rooms/job-room.ts
+var RUNNING_STALE_MS = 16 * 60 * 1e3;
+var DEFAULT_RETENTION_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_SNAPSHOT_LIMIT = 100;
+var JobRoom = class extends BaseRoom {
+  initialized = false;
+  defaultMaxAttempts;
+  retentionMs;
+  snapshotLimit;
+  retryBackoffMs;
+  /** In-flight jobs in this isolate; lets same-isolate JOB_CANCEL fire the signal. */
+  inFlight = /* @__PURE__ */ new Map();
+  /** Set by `ctx.continue` inside `executeJob`; reset before every run. */
+  continueState = null;
+  constructor(state, env, config = {}) {
+    super(state, env);
+    this.defaultMaxAttempts = Math.max(1, config.defaultMaxAttempts ?? 1);
+    this.retentionMs = Math.max(0, config.retentionMs ?? DEFAULT_RETENTION_MS);
+    this.snapshotLimit = Math.max(1, config.snapshotLimit ?? DEFAULT_SNAPSHOT_LIMIT);
+    this.retryBackoffMs = Math.max(0, config.retryBackoffMs ?? 1e3);
+  }
+  ensureInitialized() {
+    if (this.initialized) return;
+    this.initialized = true;
+    this.sql.exec(`
+      CREATE TABLE IF NOT EXISTS jobs (
+        id TEXT PRIMARY KEY,
+        type TEXT NOT NULL,
+        status TEXT NOT NULL,
+        payload TEXT,
+        result TEXT,
+        error TEXT,
+        progress REAL,
+        progress_message TEXT,
+        checkpoint TEXT,
+        attempts INTEGER NOT NULL DEFAULT 0,
+        max_attempts INTEGER NOT NULL DEFAULT 1,
+        enqueued_at TEXT NOT NULL,
+        started_at TEXT,
+        completed_at TEXT,
+        enqueued_by TEXT,
+        next_run_at TEXT
+      )
+    `);
+    this.sql.exec(
+      `CREATE INDEX IF NOT EXISTS jobs_status_next_run ON jobs (status, next_run_at)`
+    );
+    this.sql.exec(
+      `CREATE INDEX IF NOT EXISTS jobs_completed_at ON jobs (completed_at)`
+    );
+    this.recoverStuckRunning();
+    this.scheduleNextAlarm();
+  }
+  // ==========================================================================
+  // BaseRoom Lifecycle
+  // ==========================================================================
+  async fetch(request) {
+    this.ensureInitialized();
+    return super.fetch(request);
+  }
+  onConnect(ws, user) {
+    this.ensureInitialized();
+    this.sendTo(ws, serverBuild.jobSnapshot(this.getRecentJobs(this.snapshotLimit)));
+    return user;
+  }
+  async onMessage(ws, user, message) {
+    this.ensureInitialized();
+    const { type, payload } = message;
+    switch (type) {
+      case MSG.JOB_ENQUEUE: {
+        const requestId = String(payload.requestId ?? "");
+        const jobType = String(payload.type ?? "");
+        if (!jobType) {
+          this.sendTo(ws, serverBuild.error("JOB_ENQUEUE missing type"));
+          return;
+        }
+        const job = this.insertJob({
+          type: jobType,
+          payload: payload.payload,
+          maxAttempts: typeof payload.maxAttempts === "number" ? Math.max(1, Math.floor(payload.maxAttempts)) : void 0,
+          enqueuedBy: user.userId
+        });
+        this.sendTo(ws, serverBuild.jobEnqueued(job, requestId));
+        this.broadcast(serverBuild.jobEnqueued(job), ws);
+        this.scheduleNextAlarm();
+        break;
+      }
+      case MSG.JOB_CANCEL: {
+        const jobId = String(payload.jobId ?? "");
+        if (!jobId) {
+          this.sendTo(ws, serverBuild.error("JOB_CANCEL missing jobId"));
+          return;
+        }
+        this.cancelJob(jobId);
+        break;
+      }
+      case MSG.JOB_RETRY: {
+        const jobId = String(payload.jobId ?? "");
+        if (!jobId) {
+          this.sendTo(ws, serverBuild.error("JOB_RETRY missing jobId"));
+          return;
+        }
+        this.retryJob(jobId);
+        break;
+      }
+      default:
+        this.sendTo(ws, serverBuild.error(`Unknown job message type: ${type}`));
+    }
+  }
+  async onAlarm() {
+    this.ensureInitialized();
+    await this.drainDueJobs();
+    this.pruneExpired();
+    this.scheduleNextAlarm();
+  }
+  // ==========================================================================
+  // HTTP — internal enqueue path for cross-isolate callers
+  // ==========================================================================
+  /**
+   * One internal endpoint, `POST /enqueue`, used by the `enqueueJob`
+   * helper at the bottom of this file. The room is not meant to be
+   * reachable from the public internet; callers route through the app
+   * worker (or call `this.enqueue(...)` directly from a subclass).
+   *
+   * Subclasses overriding `onRequest` should call `super.onRequest(req)`
+   * for paths they don't handle.
+   */
+  async onRequest(request) {
+    this.ensureInitialized();
+    const url = new URL(request.url);
+    if (request.method !== "POST" || !url.pathname.endsWith("/enqueue")) {
+      return new Response("Not Found", { status: 404 });
+    }
+    const body = await request.json().catch(() => null);
+    if (!body || typeof body.type !== "string" || !body.type) {
+      return new Response(JSON.stringify({ error: "type required" }), {
+        status: 400,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    const job = this.insertJob({
+      type: body.type,
+      payload: body.payload,
+      maxAttempts: typeof body.maxAttempts === "number" ? Math.max(1, Math.floor(body.maxAttempts)) : void 0,
+      enqueuedBy: typeof body.enqueuedBy === "string" ? body.enqueuedBy : void 0
+    });
+    this.broadcast(serverBuild.jobEnqueued(job));
+    this.scheduleNextAlarm();
+    return new Response(JSON.stringify({ job }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  // ==========================================================================
+  // Public enqueue surface (server-side callers in the same isolate)
+  // ==========================================================================
+  /**
+   * Synchronously persist a new job and arm the alarm. Returns the new
+   * job. This is the in-isolate path — useful for a subclass `onJob`
+   * that wants to chain follow-up work without paying a fetch hop:
+   *
+   *   protected async onJob(job: Job, ctx: JobContext) {
+   *     // ... do work ...
+   *     if (needsFollowup) this.enqueue('followup', { parent: job.id })
+   *   }
+   *
+   * Workers code that lives outside the DO isolate (HTTP routes, cron
+   * tasks, server actions) cannot call this directly — they must go
+   * through the `enqueueJob` helper at the bottom of this file, which
+   * routes via the DO's `/enqueue` HTTP endpoint.
+   */
+  enqueue(type, payload, options) {
+    this.ensureInitialized();
+    const job = this.insertJob({
+      type,
+      payload,
+      maxAttempts: options?.maxAttempts,
+      enqueuedBy: options?.enqueuedBy
+    });
+    this.broadcast(serverBuild.jobEnqueued(job));
+    this.scheduleNextAlarm();
+    return job;
+  }
+  // ==========================================================================
+  // Mutation helpers
+  // ==========================================================================
+  insertJob(input) {
+    const id = crypto.randomUUID();
+    const enqueuedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const maxAttempts = Math.max(1, input.maxAttempts ?? this.defaultMaxAttempts);
+    const payloadJson = input.payload === void 0 ? null : safeStringify(input.payload);
+    this.sql.exec(
+      `INSERT INTO jobs (id, type, status, payload, attempts, max_attempts, enqueued_at, enqueued_by, next_run_at)
+       VALUES (?, ?, 'queued', ?, 0, ?, ?, ?, ?)`,
+      id,
+      input.type,
+      payloadJson,
+      maxAttempts,
+      enqueuedAt,
+      input.enqueuedBy ?? null,
+      enqueuedAt
+    );
+    return this.getJobById(id);
+  }
+  cancelJob(jobId) {
+    const row = this.sql.exec(`SELECT status FROM jobs WHERE id = ?`, jobId).toArray()[0];
+    if (!row) return;
+    if (row.status === "succeeded" || row.status === "failed" || row.status === "canceled") {
+      return;
+    }
+    const completedAt = (/* @__PURE__ */ new Date()).toISOString();
+    this.sql.exec(
+      `UPDATE jobs
+         SET status = 'canceled',
+             completed_at = ?,
+             checkpoint = NULL,
+             next_run_at = NULL
+       WHERE id = ?`,
+      completedAt,
+      jobId
+    );
+    const controller = this.inFlight.get(jobId);
+    if (controller) controller.abort();
+    const job = this.getJobById(jobId);
+    if (job) this.broadcast(serverBuild.jobCanceled(job));
+  }
+  retryJob(jobId) {
+    const row = this.sql.exec(`SELECT status, attempts, max_attempts FROM jobs WHERE id = ?`, jobId).toArray()[0];
+    if (!row) return;
+    if (row.status !== "failed" && row.status !== "canceled") return;
+    const newMax = Math.max(row.max_attempts, row.attempts + 1);
+    this.sql.exec(
+      `UPDATE jobs
+         SET status = 'queued',
+             max_attempts = ?,
+             error = NULL,
+             result = NULL,
+             completed_at = NULL,
+             next_run_at = ?
+       WHERE id = ?`,
+      newMax,
+      (/* @__PURE__ */ new Date()).toISOString(),
+      jobId
+    );
+    const job = this.getJobById(jobId);
+    if (job) this.broadcast(serverBuild.jobRetried(job));
+    this.scheduleNextAlarm();
+  }
+  // ==========================================================================
+  // Alarm / execution
+  // ==========================================================================
+  /**
+   * Drain due jobs in FIFO order. All due jobs share the alarm's
+   * 15-min wall budget (a CF property, not a per-job allocation).
+   */
+  async drainDueJobs() {
+    const cutoff = (/* @__PURE__ */ new Date()).toISOString();
+    while (true) {
+      const row = this.sql.exec(
+        `SELECT * FROM jobs
+            WHERE status = 'queued'
+              AND (next_run_at IS NULL OR next_run_at <= ?)
+            ORDER BY enqueued_at ASC
+            LIMIT 1`,
+        cutoff
+      ).toArray()[0];
+      if (!row) return;
+      await this.executeJob(row);
+    }
+  }
+  async executeJob(row) {
+    const startedAt = row.started_at ?? (/* @__PURE__ */ new Date()).toISOString();
+    const attemptsBefore = row.attempts;
+    const attempt = attemptsBefore + 1;
+    this.sql.exec(
+      `UPDATE jobs SET status = 'running', started_at = ?, attempts = ? WHERE id = ?`,
+      startedAt,
+      attempt,
+      row.id
+    );
+    const controller = new AbortController();
+    this.inFlight.set(row.id, controller);
+    this.continueState = null;
+    const job = {
+      ...rowToJobView(row),
+      status: "running",
+      attempts: attempt,
+      startedAt
+    };
+    let outcome = "succeeded";
+    let result;
+    let errorMessage;
+    try {
+      const ctx = this.makeContext(row.id, controller.signal);
+      result = await this.onJob(job, ctx);
+      if (this.continueState) outcome = "continued";
+    } catch (e) {
+      outcome = "failed";
+      errorMessage = e instanceof Error ? e.message : String(e);
+      console.error(`[JobRoom] Job "${row.type}" (${row.id}) failed:`, e);
+    } finally {
+      this.inFlight.delete(row.id);
+    }
+    const currentStatus = this.readStatus(row.id);
+    if (currentStatus === "canceled") {
+      this.continueState = null;
+      return;
+    }
+    if (outcome === "continued") {
+      const state = this.continueState;
+      this.continueState = null;
+      const nextRunAt = new Date(Date.now() + Math.max(0, state.afterMs)).toISOString();
+      this.sql.exec(
+        `UPDATE jobs
+           SET status = 'queued',
+               checkpoint = ?,
+               next_run_at = ?
+         WHERE id = ?`,
+        safeStringify(state.checkpoint),
+        nextRunAt,
+        row.id
+      );
+      const updated2 = this.getJobById(row.id);
+      if (updated2) this.broadcast(serverBuild.jobProgress(updated2));
+      return;
+    }
+    const completedAt = (/* @__PURE__ */ new Date()).toISOString();
+    if (outcome === "succeeded") {
+      this.sql.exec(
+        `UPDATE jobs
+           SET status = 'succeeded',
+               result = ?,
+               completed_at = ?,
+               error = NULL,
+               checkpoint = NULL,
+               next_run_at = NULL,
+               progress = NULL,
+               progress_message = NULL
+         WHERE id = ?`,
+        result === void 0 ? null : safeStringify(result),
+        completedAt,
+        row.id
+      );
+      const updated2 = this.getJobById(row.id);
+      if (updated2) this.broadcast(serverBuild.jobSucceeded(updated2));
+      return;
+    }
+    if (attempt < row.max_attempts) {
+      const nextRunAt = new Date(Date.now() + this.retryBackoffMs).toISOString();
+      this.sql.exec(
+        `UPDATE jobs
+           SET status = 'queued',
+               error = ?,
+               next_run_at = ?,
+               started_at = NULL,
+               progress = NULL,
+               progress_message = NULL
+         WHERE id = ?`,
+        errorMessage ?? "unknown error",
+        nextRunAt,
+        row.id
+      );
+      const updated2 = this.getJobById(row.id);
+      if (updated2) this.broadcast(serverBuild.jobRetried(updated2));
+      return;
+    }
+    this.sql.exec(
+      `UPDATE jobs
+         SET status = 'failed',
+             error = ?,
+             completed_at = ?,
+             checkpoint = NULL,
+             next_run_at = NULL,
+             progress = NULL,
+             progress_message = NULL
+       WHERE id = ?`,
+      errorMessage ?? "unknown error",
+      completedAt,
+      row.id
+    );
+    const updated = this.getJobById(row.id);
+    if (updated) this.broadcast(serverBuild.jobFailed(updated));
+  }
+  makeContext(jobId, signal) {
+    return {
+      progress: (value, message) => {
+        const clamped = Math.max(0, Math.min(1, value));
+        this.sql.exec(
+          `UPDATE jobs SET progress = ?, progress_message = ? WHERE id = ?`,
+          clamped,
+          message ?? null,
+          jobId
+        );
+        const updated = this.getJobById(jobId);
+        if (updated) this.broadcast(serverBuild.jobProgress(updated));
+      },
+      continue: (state, options) => {
+        this.continueState = {
+          checkpoint: state,
+          afterMs: Math.max(0, options?.afterMs ?? 0)
+        };
+      },
+      signal
+    };
+  }
+  readStatus(jobId) {
+    const row = this.sql.exec(`SELECT status FROM jobs WHERE id = ?`, jobId).toArray()[0];
+    return row?.status ?? null;
+  }
+  // ==========================================================================
+  // Scheduling / recovery / pruning
+  // ==========================================================================
+  scheduleNextAlarm() {
+    const row = this.sql.exec(
+      `SELECT next_run_at FROM jobs
+          WHERE status = 'queued'
+          ORDER BY (next_run_at IS NULL) ASC, next_run_at ASC
+          LIMIT 1`
+    ).toArray()[0];
+    if (!row) return;
+    const now = Date.now();
+    const target = row.next_run_at ? Math.max(now, new Date(row.next_run_at).getTime()) : now;
+    this.state.storage.setAlarm(Math.max(target, now + 50));
+  }
+  recoverStuckRunning() {
+    const cutoff = new Date(Date.now() - RUNNING_STALE_MS).toISOString();
+    const stuck = this.sql.exec(
+      `SELECT id, attempts, max_attempts FROM jobs
+          WHERE status = 'running' AND started_at < ?`,
+      cutoff
+    ).toArray();
+    for (const r of stuck) {
+      if (r.attempts >= r.max_attempts) {
+        this.sql.exec(
+          `UPDATE jobs
+             SET status = 'failed',
+                 error = 'Isolate recycled or wall time exceeded',
+                 completed_at = ?,
+                 checkpoint = NULL,
+                 next_run_at = NULL
+           WHERE id = ?`,
+          (/* @__PURE__ */ new Date()).toISOString(),
+          r.id
+        );
+      } else {
+        this.sql.exec(
+          `UPDATE jobs
+             SET status = 'queued',
+                 started_at = NULL,
+                 next_run_at = ?,
+                 error = 'Previous attempt killed mid-run; retrying',
+                 progress = NULL,
+                 progress_message = NULL
+           WHERE id = ?`,
+          (/* @__PURE__ */ new Date()).toISOString(),
+          r.id
+        );
+      }
+    }
+  }
+  pruneExpired() {
+    if (this.retentionMs === 0) return;
+    const cutoff = new Date(Date.now() - this.retentionMs).toISOString();
+    this.sql.exec(
+      `DELETE FROM jobs
+        WHERE status IN ('succeeded', 'failed', 'canceled')
+          AND completed_at IS NOT NULL
+          AND completed_at < ?`,
+      cutoff
+    );
+  }
+  // ==========================================================================
+  // Read helpers
+  // ==========================================================================
+  getRecentJobs(limit) {
+    const rows = this.sql.exec(
+      `SELECT * FROM jobs
+          ORDER BY (status IN ('queued','running')) DESC, enqueued_at DESC
+          LIMIT ?`,
+      limit
+    ).toArray();
+    return rows.map(rowToJobView);
+  }
+  getJobById(id) {
+    const row = this.sql.exec(`SELECT * FROM jobs WHERE id = ?`, id).toArray()[0];
+    return row ? rowToJobView(row) : null;
+  }
+};
+async function enqueueJob(namespace, roomId, type, payload, options) {
+  const stub = namespace.get(namespace.idFromName(roomId));
+  const res = await stub.fetch(
+    new Request("https://job-room.internal/enqueue", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        type,
+        payload,
+        maxAttempts: options?.maxAttempts,
+        enqueuedBy: options?.enqueuedBy
+      })
+    })
+  );
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`enqueueJob failed: ${res.status} ${text}`);
+  }
+  const data = await res.json();
+  if (!data.job?.id) throw new Error("enqueueJob: malformed response");
+  return data.job.id;
+}
+function rowToJobView(row) {
+  return {
+    id: row.id,
+    type: row.type,
+    status: row.status,
+    payload: row.payload == null ? void 0 : JSON.parse(row.payload),
+    result: row.result == null ? void 0 : JSON.parse(row.result),
+    error: row.error ?? void 0,
+    progress: row.progress ?? void 0,
+    progressMessage: row.progress_message ?? void 0,
+    attempts: row.attempts,
+    maxAttempts: row.max_attempts,
+    enqueuedAt: row.enqueued_at,
+    startedAt: row.started_at,
+    completedAt: row.completed_at,
+    enqueuedBy: row.enqueued_by,
+    resumeFrom: row.checkpoint == null ? void 0 : JSON.parse(row.checkpoint)
+  };
+}
+function safeStringify(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return JSON.stringify({ __unserializable__: String(value) });
+  }
+}
+
 // src/server/rooms/do-manifest.ts
 var DEFAULT_DO_MANIFEST = [
   { binding: "RECORD_ROOMS", className: "AppRecordRoom", sqlite: true },
@@ -4355,7 +4996,6 @@ var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
   "AUTH_WORKER_URL",
   "APP_IDENTITY_TOKEN",
   "APP_OWNER_JWT",
-  "INTERNAL_STORAGE_HMAC_SECRET",
   "USAGE_EVENTS"
 ]);
 function validateBindingManifest(manifest) {
@@ -5189,6 +5829,11 @@ var RESERVED_COLLECTION_NAMES = new Set(
 
 // src/server/utils/scoped-r2-files.ts
 var CORS_HEADERS3 = { "Access-Control-Allow-Origin": "*" };
+function contentDisposition(originalName) {
+  const safe = originalName.replace(/[\x00-\x1f\x7f"\\]/g, "_") || "download";
+  const encoded = encodeURIComponent(originalName);
+  return `inline; filename="${safe}"; filename*=UTF-8''${encoded}`;
+}
 function sanitizeSubpath(raw) {
   if (!raw) return "";
   const segments = raw.split("/");
@@ -5198,6 +5843,20 @@ function sanitizeSubpath(raw) {
 function isKeyWithinPrefix(key, prefix) {
   return key.startsWith(prefix);
 }
+var DANGEROUS_MIME_TYPES = /* @__PURE__ */ new Set([
+  "text/html",
+  "application/xhtml+xml",
+  "image/svg+xml",
+  "application/xml",
+  "text/xml",
+  "application/javascript",
+  "text/javascript",
+  "application/ecmascript",
+  "text/ecmascript"
+]);
+function normalizeMimeType(raw) {
+  return raw.split(";")[0].trim().toLowerCase();
+}
 function createScopedR2Handler(config) {
   const requireAuthForMutations = config.requireAuthForMutations ?? true;
   return async (request, url, bucket, auth) => {
@@ -5287,6 +5946,13 @@ async function handleUpload(request, url, bucket, prefix, userId) {
       fileName = body.name;
       mimeType = body.mimeType || "application/octet-stream";
     }
+    mimeType = normalizeMimeType(mimeType) || "application/octet-stream";
+    if (DANGEROUS_MIME_TYPES.has(mimeType)) {
+      return Response.json(
+        { error: `Unsupported media type: ${mimeType}` },
+        { status: 415, headers: CORS_HEADERS3 }
+      );
+    }
     const requestedKey = url.searchParams.get("key");
     let key;
     if (requestedKey !== null) {
@@ -5351,271 +6017,95 @@ async function handleDownload(bucket, key) {
   }
   const headers = new Headers();
   headers.set("Content-Type", object.httpMetadata?.contentType || "application/octet-stream");
+  headers.set("X-Content-Type-Options", "nosniff");
   headers.set("Cache-Control", "public, max-age=31536000, immutable");
   headers.set("Access-Control-Allow-Origin", "*");
   if (object.customMetadata?.originalName) {
-    headers.set("Content-Disposition", `inline; filename="${object.customMetadata.originalName}"`);
+    headers.set("Content-Disposition", contentDisposition(object.customMetadata.originalName));
   }
   return new Response(object.body, { headers });
 }
 
-// src/server/auth/jwtVerifier.ts
-import { importSPKI, jwtVerify } from "jose";
-
-// src/server/auth/utils.ts
-var BASE64_URL_REGEX = /^[A-Za-z0-9-_]+$/;
-function bufferToHex(bytes) {
-  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
-  let hex = "";
-  for (const byte of view) {
-    hex += byte.toString(16).padStart(2, "0");
-  }
-  return hex;
-}
-function normalizeArray(value) {
-  if (value == null) return void 0;
-  if (Array.isArray(value)) {
-    return value.length ? value : void 0;
+// src/server/utils/proxies.ts
+function resolveApiTransport(env) {
+  if (env.API_WORKER) return { kind: "binding", fetcher: env.API_WORKER };
+  if (env.API_WORKER_URL) {
+    return { kind: "url", baseUrl: env.API_WORKER_URL.replace(/\/$/, "") };
   }
-  return [value];
+  throw new Error(
+    "apiWorkerFetch: neither env.API_WORKER nor env.API_WORKER_URL is set. Add a [[services]] binding in wrangler.toml for production, or let `deepspace dev` write API_WORKER_URL into .dev.vars for local development."
+  );
 }
-function decodeJwtPayload(token) {
-  if (!token) return void 0;
-  const parts = token.split(".");
-  if (parts.length < 2) return void 0;
-  const payloadSegment = parts[1];
-  if (!payloadSegment) return void 0;
-  if (!BASE64_URL_REGEX.test(payloadSegment)) return void 0;
-  try {
-    const normalized = payloadSegment.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payloadSegment.length / 4) * 4, "=");
-    const bytes = base64ToUint8Array(normalized);
-    const json = new TextDecoder().decode(bytes);
-    const payload = JSON.parse(json);
-    return {
-      iss: payload.iss ?? null,
-      aud: payload.aud ?? null,
-      azp: payload?.azp ?? null,
-      exp: payload.exp ?? null,
-      iat: payload.iat ?? null
-    };
-  } catch {
-    return void 0;
+function resolvePlatformTransport(env) {
+  if (env.PLATFORM_WORKER) return { kind: "binding", fetcher: env.PLATFORM_WORKER };
+  if (env.PLATFORM_WORKER_URL) {
+    return { kind: "url", baseUrl: env.PLATFORM_WORKER_URL.replace(/\/$/, "") };
   }
+  throw new Error(
+    "platformWorkerFetch: neither env.PLATFORM_WORKER nor env.PLATFORM_WORKER_URL is set. Add a [[services]] binding in wrangler.toml for production, or let `deepspace dev` write PLATFORM_WORKER_URL into .dev.vars for local development."
+  );
 }
-function nowMs() {
-  return Date.now();
-}
-function base64ToUint8Array(value) {
-  if (typeof atob === "function") {
-    const binary = atob(value);
-    const out = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i += 1) {
-      out[i] = binary.charCodeAt(i);
-    }
-    return out;
+function buildTargetUrl(transport, path, internalHost) {
+  let pathAndSearch;
+  if (path.startsWith("http://") || path.startsWith("https://")) {
+    const u = new URL(path);
+    pathAndSearch = u.pathname + u.search;
+  } else if (path.startsWith("/")) {
+    pathAndSearch = path;
+  } else {
+    pathAndSearch = "/" + path;
   }
-  if (typeof Buffer !== "undefined") {
-    return Uint8Array.from(Buffer.from(value, "base64"));
+  if (transport.kind === "binding") {
+    return `https://${internalHost}${pathAndSearch}`;
   }
-  throw new Error("No base64 decoder available in current environment");
+  return `${transport.baseUrl}${pathAndSearch}`;
 }
-
-// src/server/auth/jwtVerifier.ts
-var DEFAULT_CLOCK_SKEW_MS = 5e3;
-function matchesAuthorizedParty(azp, patterns) {
-  if (!azp) return true;
-  for (const pattern of patterns) {
-    if (pattern === azp) return true;
-    if (pattern.includes("*")) {
-      const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
-      const regexPattern = escaped.replace(/\*/g, "[^/]*");
-      const regex = new RegExp(`^${regexPattern}$`);
-      if (regex.test(azp)) return true;
-      if (pattern.includes("*.")) {
-        const rootPattern = pattern.replace("*.", "");
-        if (rootPattern === azp) return true;
-      }
-    }
+function apiWorkerFetch(env, path, init) {
+  const transport = resolveApiTransport(env);
+  const url = buildTargetUrl(transport, path, "api-worker");
+  if (transport.kind === "binding") {
+    return transport.fetcher.fetch(url, init);
   }
-  return false;
-}
-var keyCache = /* @__PURE__ */ new Map();
-async function getPublicKey(pem) {
-  const cached = keyCache.get(pem);
-  if (cached) return cached;
-  const normalized = pem.replace(/\\n/g, "\n");
-  const key = await importSPKI(normalized, "ES256");
-  keyCache.set(pem, key);
-  return key;
+  return fetch(url, init);
 }
-async function verifyJwt(config, token) {
-  if (!token) {
-    return { result: null };
-  }
-  try {
-    const publicKey = await getPublicKey(config.publicKey);
-    const audience = normalizeArray(config.audience);
-    const clockTolerance = Math.floor(
-      (config.clockSkewMs ?? DEFAULT_CLOCK_SKEW_MS) / 1e3
-    );
-    const { payload } = await jwtVerify(token, publicKey, {
-      issuer: config.issuer,
-      audience: audience && audience.length === 1 ? audience[0] : audience,
-      clockTolerance
-    });
-    const claims = payload;
-    if (!claims.sub) {
-      throw new Error("JWT verification succeeded but subject claim is missing");
-    }
-    const authorizedParties = normalizeArray(config.authorizedParties);
-    if (authorizedParties) {
-      const azp = claims.azp;
-      if (!matchesAuthorizedParty(azp, authorizedParties)) {
-        throw new Error(
-          `Authorized party '${azp}' does not match any allowed pattern`
-        );
-      }
+function platformWorkerFetch(env, pathOrRequest, init) {
+  const transport = resolvePlatformTransport(env);
+  if (typeof pathOrRequest === "string") {
+    const url2 = buildTargetUrl(transport, pathOrRequest, "platform-worker");
+    if (transport.kind === "binding") {
+      return transport.fetcher.fetch(url2, init);
     }
-    return {
-      result: {
-        userId: claims.sub,
-        claims
-      }
-    };
-  } catch (error) {
-    return {
-      result: null,
-      error,
-      debug: decodeJwtPayload(token)
-    };
+    return fetch(url2, init);
   }
-}
-
-// src/server/auth/internalAuth.ts
-var DEFAULT_MAX_SKEW_MS = 5 * 6e4;
-var nodeCryptoPromise = null;
-async function loadNodeCrypto() {
-  if (!nodeCryptoPromise) {
-    nodeCryptoPromise = import("crypto").then((module) => module).catch(() => null);
+  const req = pathOrRequest;
+  const url = buildTargetUrl(transport, req.url, "platform-worker");
+  const rewritten = new Request(url, req);
+  if (transport.kind === "binding") {
+    return transport.fetcher.fetch(rewritten);
   }
-  return nodeCryptoPromise;
-}
-function hasSubtleCrypto() {
-  return typeof globalThis.crypto?.subtle?.importKey === "function";
+  return fetch(rewritten);
 }
-async function computeHmacHex(secret, payload) {
-  if (hasSubtleCrypto()) {
-    const encoder = new TextEncoder();
-    const key = await crypto.subtle.importKey(
-      "raw",
-      encoder.encode(secret),
-      { name: "HMAC", hash: "SHA-256" },
-      false,
-      ["sign"]
+function authWorkerFetch(env, path, init) {
+  if (!env.AUTH_WORKER_URL) {
+    throw new Error(
+      "authWorkerFetch: env.AUTH_WORKER_URL is not set. `deepspace dev` should write this into .dev.vars; for production, set it as a wrangler var or secret."
     );
-    const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(payload));
-    return bufferToHex(signature);
-  }
-  const nodeCrypto = await loadNodeCrypto();
-  if (!nodeCrypto) {
-    throw new Error("Crypto implementation unavailable for HMAC computation");
-  }
-  return nodeCrypto.createHmac("sha256", secret).update(payload).digest("hex");
-}
-async function timingSafeEqualHex(a, b) {
-  if (a.length !== b.length) {
-    return false;
-  }
-  const nodeCrypto = await loadNodeCrypto();
-  if (nodeCrypto?.timingSafeEqual) {
-    const aBuf = Buffer.from(a, "hex");
-    const bBuf = Buffer.from(b, "hex");
-    try {
-      return nodeCrypto.timingSafeEqual(aBuf, bBuf);
-    } catch {
-      return false;
-    }
-  }
-  let diff = 0;
-  for (let i = 0; i < a.length; i += 1) {
-    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
   }
-  return diff === 0;
-}
-async function signInternalPayload({
-  secret,
-  payload,
-  timestamp
-}) {
-  const ts = timestamp ?? nowMs().toString();
-  const signature = await computeHmacHex(secret, `${ts}.${payload}`);
-  return { timestamp: ts, signature };
-}
-async function verifyInternalSignature({
-  secret,
-  timestamp,
-  signature,
-  payload,
-  maxSkewMs = DEFAULT_MAX_SKEW_MS
-}) {
-  if (!secret || !timestamp || !signature) {
-    return false;
-  }
-  const tsNumber = Number(timestamp);
-  if (!Number.isFinite(tsNumber)) {
-    return false;
-  }
-  const skew = Math.abs(nowMs() - tsNumber);
-  if (skew > maxSkewMs) {
-    return false;
-  }
-  const expected = await computeHmacHex(secret, `${timestamp}.${payload}`);
-  return timingSafeEqualHex(signature.toLowerCase(), expected.toLowerCase());
-}
-function buildInternalPayload(body) {
-  if (body === void 0) return "{}";
-  if (typeof body === "string") return body;
-  try {
-    return JSON.stringify(body);
-  } catch {
-    return "{}";
-  }
-}
-
-// src/server/auth/betterAuth.ts
-import { betterAuth } from "better-auth";
-import { organization, twoFactor } from "better-auth/plugins";
-function createDeepSpaceAuth(config) {
-  const socialProviders = {};
-  if (config.google) {
-    socialProviders.google = config.google;
-  }
-  if (config.github) {
-    socialProviders.github = config.github;
+  const baseUrl = env.AUTH_WORKER_URL.replace(/\/$/, "");
+  let pathAndSearch;
+  if (path.startsWith("http://") || path.startsWith("https://")) {
+    const u = new URL(path);
+    pathAndSearch = u.pathname + u.search;
+  } else if (path.startsWith("/")) {
+    pathAndSearch = path;
+  } else {
+    pathAndSearch = "/" + path;
   }
-  return betterAuth({
-    database: config.database,
-    baseURL: config.baseURL,
-    secret: config.secret,
-    emailAndPassword: {
-      enabled: config.emailAndPassword ?? true
-    },
-    socialProviders,
-    trustedOrigins: config.trustedOrigins ?? [
-      "https://deep.space",
-      "https://*.deep.space",
-      "https://*.app.space",
-      "http://localhost:*"
-    ],
-    plugins: [organization(), twoFactor()]
-  });
+  return fetch(`${baseUrl}${pathAndSearch}`, init);
 }
 
 // src/server/utils/cron.ts
-var DEFAULT_API_BASE_URL = "https://api-worker.deep.space";
 function buildCronContext(env, ownerUserId, roomId = "default") {
-  const hmacSecret = env.INTERNAL_STORAGE_HMAC_SECRET;
-  const apiBase = env.API_BASE_URL || DEFAULT_API_BASE_URL;
   const roomIdObj = env.RECORD_ROOMS.idFromName(roomId);
   const room = env.RECORD_ROOMS.get(roomIdObj);
   async function executeTool3(tool, params) {
@@ -5653,30 +6143,31 @@ function buildCronContext(env, ownerUserId, roomId = "default") {
     }
   };
   const integrations = {
-    async call(endpoint, params) {
-      if (!hmacSecret) {
-        throw new Error("INTERNAL_STORAGE_HMAC_SECRET not configured \u2014 cannot call integrations");
+    async call(endpoint, params = {}) {
+      if (!env.APP_OWNER_JWT) {
+        throw new Error(
+          "integrations.call requires env.APP_OWNER_JWT. Deployed apps receive this automatically; in dev, `deepspace dev` writes it into .dev.vars."
+        );
       }
-      const payload = { userId: ownerUserId, ...params };
-      const payloadStr = buildInternalPayload(payload);
-      const { timestamp, signature } = await signInternalPayload({
-        secret: hmacSecret,
-        payload: payloadStr
-      });
-      const response = await fetch(`${apiBase}/api/internal/integrations/${endpoint}`, {
+      const response = await apiWorkerFetch(env, `/api/integrations/${endpoint}`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          "x-internal-timestamp": timestamp,
-          "x-internal-signature": signature
+          Authorization: `Bearer ${env.APP_OWNER_JWT}`
         },
-        body: payloadStr
+        body: JSON.stringify(params)
       });
-      if (!response.ok) {
-        const errText = await response.text();
-        throw new Error(`Integration call ${endpoint} failed (${response.status}): ${errText}`);
+      const text = await response.text();
+      let result = {};
+      try {
+        result = text ? JSON.parse(text) : {};
+      } catch {
+      }
+      if (!response.ok || !result.success) {
+        const detail = result.message || result.error || text || `HTTP ${response.status}`;
+        throw new Error(`Integration call ${endpoint} failed: ${detail}`);
       }
-      return response.json();
+      return result.data;
     }
   };
   return { records, integrations, ownerUserId };
@@ -5686,86 +6177,6 @@ function buildCronContext(env, ownerUserId, roomId = "default") {
 import { createAnthropic } from "@ai-sdk/anthropic";
 import { createOpenAI } from "@ai-sdk/openai";
 import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
-
-// src/server/utils/proxies.ts
-function resolveApiTransport(env) {
-  if (env.API_WORKER) return { kind: "binding", fetcher: env.API_WORKER };
-  if (env.API_WORKER_URL) {
-    return { kind: "url", baseUrl: env.API_WORKER_URL.replace(/\/$/, "") };
-  }
-  throw new Error(
-    "apiWorkerFetch: neither env.API_WORKER nor env.API_WORKER_URL is set. Add a [[services]] binding in wrangler.toml for production, or let `deepspace dev` write API_WORKER_URL into .dev.vars for local development."
-  );
-}
-function resolvePlatformTransport(env) {
-  if (env.PLATFORM_WORKER) return { kind: "binding", fetcher: env.PLATFORM_WORKER };
-  if (env.PLATFORM_WORKER_URL) {
-    return { kind: "url", baseUrl: env.PLATFORM_WORKER_URL.replace(/\/$/, "") };
-  }
-  throw new Error(
-    "platformWorkerFetch: neither env.PLATFORM_WORKER nor env.PLATFORM_WORKER_URL is set. Add a [[services]] binding in wrangler.toml for production, or let `deepspace dev` write PLATFORM_WORKER_URL into .dev.vars for local development."
-  );
-}
-function buildTargetUrl(transport, path, internalHost) {
-  let pathAndSearch;
-  if (path.startsWith("http://") || path.startsWith("https://")) {
-    const u = new URL(path);
-    pathAndSearch = u.pathname + u.search;
-  } else if (path.startsWith("/")) {
-    pathAndSearch = path;
-  } else {
-    pathAndSearch = "/" + path;
-  }
-  if (transport.kind === "binding") {
-    return `https://${internalHost}${pathAndSearch}`;
-  }
-  return `${transport.baseUrl}${pathAndSearch}`;
-}
-function apiWorkerFetch(env, path, init) {
-  const transport = resolveApiTransport(env);
-  const url = buildTargetUrl(transport, path, "api-worker");
-  if (transport.kind === "binding") {
-    return transport.fetcher.fetch(url, init);
-  }
-  return fetch(url, init);
-}
-function platformWorkerFetch(env, pathOrRequest, init) {
-  const transport = resolvePlatformTransport(env);
-  if (typeof pathOrRequest === "string") {
-    const url2 = buildTargetUrl(transport, pathOrRequest, "platform-worker");
-    if (transport.kind === "binding") {
-      return transport.fetcher.fetch(url2, init);
-    }
-    return fetch(url2, init);
-  }
-  const req = pathOrRequest;
-  const url = buildTargetUrl(transport, req.url, "platform-worker");
-  const rewritten = new Request(url, req);
-  if (transport.kind === "binding") {
-    return transport.fetcher.fetch(rewritten);
-  }
-  return fetch(rewritten);
-}
-function authWorkerFetch(env, path, init) {
-  if (!env.AUTH_WORKER_URL) {
-    throw new Error(
-      "authWorkerFetch: env.AUTH_WORKER_URL is not set. `deepspace dev` should write this into .dev.vars; for production, set it as a wrangler var or secret."
-    );
-  }
-  const baseUrl = env.AUTH_WORKER_URL.replace(/\/$/, "");
-  let pathAndSearch;
-  if (path.startsWith("http://") || path.startsWith("https://")) {
-    const u = new URL(path);
-    pathAndSearch = u.pathname + u.search;
-  } else if (path.startsWith("/")) {
-    pathAndSearch = path;
-  } else {
-    pathAndSearch = "/" + path;
-  }
-  return fetch(`${baseUrl}${pathAndSearch}`, init);
-}
-
-// src/server/utils/ai.ts
 var ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS = 4096;
 function withDefaultAnthropicMaxTokens(body) {
   if (typeof body !== "string") return body;
@@ -6359,6 +6770,215 @@ async function runMigrations(db, migrations) {
 function splitStatements(sql) {
   return sql.split(";").map((s) => s.trim()).filter((s) => s.length > 0);
 }
+
+// src/server/auth/jwtVerifier.ts
+import { importSPKI, jwtVerify } from "jose";
+
+// src/server/auth/utils.ts
+var BASE64_URL_REGEX = /^[A-Za-z0-9-_]+$/;
+function bufferToHex(bytes) {
+  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let hex = "";
+  for (const byte of view) {
+    hex += byte.toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+function normalizeArray(value) {
+  if (value == null) return void 0;
+  if (Array.isArray(value)) {
+    return value.length ? value : void 0;
+  }
+  return [value];
+}
+function decodeJwtPayload(token) {
+  if (!token) return void 0;
+  const parts = token.split(".");
+  if (parts.length < 2) return void 0;
+  const payloadSegment = parts[1];
+  if (!payloadSegment) return void 0;
+  if (!BASE64_URL_REGEX.test(payloadSegment)) return void 0;
+  try {
+    const normalized = payloadSegment.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payloadSegment.length / 4) * 4, "=");
+    const bytes = base64ToUint8Array(normalized);
+    const json = new TextDecoder().decode(bytes);
+    const payload = JSON.parse(json);
+    return {
+      iss: payload.iss ?? null,
+      aud: payload.aud ?? null,
+      azp: payload?.azp ?? null,
+      exp: payload.exp ?? null,
+      iat: payload.iat ?? null
+    };
+  } catch {
+    return void 0;
+  }
+}
+function base64ToUint8Array(value) {
+  if (typeof atob === "function") {
+    const binary = atob(value);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1) {
+      out[i] = binary.charCodeAt(i);
+    }
+    return out;
+  }
+  if (typeof Buffer !== "undefined") {
+    return Uint8Array.from(Buffer.from(value, "base64"));
+  }
+  throw new Error("No base64 decoder available in current environment");
+}
+
+// src/server/auth/jwtVerifier.ts
+var DEFAULT_CLOCK_SKEW_MS = 5e3;
+function matchesAuthorizedParty(azp, patterns) {
+  if (!azp) return true;
+  for (const pattern of patterns) {
+    if (pattern === azp) return true;
+    if (pattern.includes("*")) {
+      const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+      const regexPattern = escaped.replace(/\*/g, "[^/]*");
+      const regex = new RegExp(`^${regexPattern}$`);
+      if (regex.test(azp)) return true;
+      if (pattern.includes("*.")) {
+        const rootPattern = pattern.replace("*.", "");
+        if (rootPattern === azp) return true;
+      }
+    }
+  }
+  return false;
+}
+var keyCache = /* @__PURE__ */ new Map();
+async function getPublicKey(pem) {
+  const cached = keyCache.get(pem);
+  if (cached) return cached;
+  const normalized = pem.replace(/\\n/g, "\n");
+  const key = await importSPKI(normalized, "ES256");
+  keyCache.set(pem, key);
+  return key;
+}
+async function verifyJwt(config, token) {
+  if (!token) {
+    return { result: null };
+  }
+  try {
+    const publicKey = await getPublicKey(config.publicKey);
+    const audience = normalizeArray(config.audience);
+    const clockTolerance = Math.floor(
+      (config.clockSkewMs ?? DEFAULT_CLOCK_SKEW_MS) / 1e3
+    );
+    const { payload } = await jwtVerify(token, publicKey, {
+      issuer: config.issuer,
+      audience: audience && audience.length === 1 ? audience[0] : audience,
+      clockTolerance
+    });
+    const claims = payload;
+    if (!claims.sub) {
+      throw new Error("JWT verification succeeded but subject claim is missing");
+    }
+    const authorizedParties = normalizeArray(config.authorizedParties);
+    if (authorizedParties) {
+      const azp = claims.azp;
+      if (!matchesAuthorizedParty(azp, authorizedParties)) {
+        throw new Error(
+          `Authorized party '${azp}' does not match any allowed pattern`
+        );
+      }
+    }
+    return {
+      result: {
+        userId: claims.sub,
+        claims
+      }
+    };
+  } catch (error) {
+    return {
+      result: null,
+      error,
+      debug: decodeJwtPayload(token)
+    };
+  }
+}
+
+// src/server/auth/internalAuth.ts
+var nodeCryptoPromise = null;
+async function loadNodeCrypto() {
+  if (!nodeCryptoPromise) {
+    nodeCryptoPromise = import("crypto").then((module) => module).catch(() => null);
+  }
+  return nodeCryptoPromise;
+}
+function hasSubtleCrypto() {
+  return typeof globalThis.crypto?.subtle?.importKey === "function";
+}
+async function computeHmacHex(secret, payload) {
+  if (hasSubtleCrypto()) {
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey(
+      "raw",
+      encoder.encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(payload));
+    return bufferToHex(signature);
+  }
+  const nodeCrypto = await loadNodeCrypto();
+  if (!nodeCrypto) {
+    throw new Error("Crypto implementation unavailable for HMAC computation");
+  }
+  return nodeCrypto.createHmac("sha256", secret).update(payload).digest("hex");
+}
+async function timingSafeEqualHex(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  const nodeCrypto = await loadNodeCrypto();
+  if (nodeCrypto?.timingSafeEqual) {
+    const aBuf = Buffer.from(a, "hex");
+    const bBuf = Buffer.from(b, "hex");
+    try {
+      return nodeCrypto.timingSafeEqual(aBuf, bBuf);
+    } catch {
+      return false;
+    }
+  }
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+
+// src/server/auth/betterAuth.ts
+import { betterAuth } from "better-auth";
+import { organization, twoFactor } from "better-auth/plugins";
+function createDeepSpaceAuth(config) {
+  const socialProviders = {};
+  if (config.google) {
+    socialProviders.google = config.google;
+  }
+  if (config.github) {
+    socialProviders.github = config.github;
+  }
+  return betterAuth({
+    database: config.database,
+    baseURL: config.baseURL,
+    secret: config.secret,
+    emailAndPassword: {
+      enabled: config.emailAndPassword ?? true
+    },
+    socialProviders,
+    trustedOrigins: config.trustedOrigins ?? [
+      "https://deep.space",
+      "https://*.deep.space",
+      "https://*.app.space",
+      "http://localhost:*"
+    ],
+    plugins: [organization(), twoFactor()]
+  });
+}
 export {
   AI_CHATS_SCHEMA,
   AI_MESSAGES_SCHEMA,
@@ -6379,11 +6999,11 @@ export {
   CronRoom,
   DEFAULT_CONTEXT_CONFIG,
   DEFAULT_DO_MANIFEST,
-  DEFAULT_MAX_SKEW_MS,
   DIRECTORY_SCHEMAS,
   GLOBAL_DO_TYPES,
   GLOBAL_DO_TYPE_NAMES,
   GameRoom,
+  JobRoom,
   MESSAGES_SCHEMA,
   MSG,
   MSG_AWARENESS,
@@ -6416,7 +7036,6 @@ export {
   authWorkerFetch,
   bindingManifestFromOutputConfig,
   buildCronContext,
-  buildInternalPayload,
   buildTableSelect,
   buildUiParts,
   canCreate,
@@ -6447,6 +7066,7 @@ export {
   encodeSyncStep1,
   encodeSyncStep2,
   encodeUpdate,
+  enqueueJob,
   getChat,
   getGlobalDOSchemas,
   getGlobalDOType,
@@ -6474,7 +7094,6 @@ export {
   rowToData,
   runMigrations,
   serverBuild,
-  signInternalPayload,
   timingSafeEqualHex,
   toUint8Array,
   totalChars,
@@ -6485,7 +7104,6 @@ export {
   validateAppName,
   validateBindingManifest,
   validateDoManifest,
-  verifyInternalSignature,
   verifyJwt,
   workspaceAccountsSchema,
   workspaceContentSharesSchema,