deepspace 0.3.10 → 0.4.0

package/dist/server.js

@@ -165,6 +165,11 @@ var BUILT_IN_TOOLS = [
 
 // src/server/utils/scoped-r2-files.ts
 var CORS_HEADERS = { "Access-Control-Allow-Origin": "*" };
+function contentDisposition(originalName) {
+  const safe = originalName.replace(/[\x00-\x1f\x7f"\\]/g, "_") || "download";
+  const encoded = encodeURIComponent(originalName);
+  return `inline; filename="${safe}"; filename*=UTF-8''${encoded}`;
+}
 function sanitizeSubpath(raw) {
   if (!raw) return "";
   const segments = raw.split("/");
@@ -174,6 +179,20 @@ function sanitizeSubpath(raw) {
 function isKeyWithinPrefix(key, prefix) {
   return key.startsWith(prefix);
 }
+var DANGEROUS_MIME_TYPES = /* @__PURE__ */ new Set([
+  "text/html",
+  "application/xhtml+xml",
+  "image/svg+xml",
+  "application/xml",
+  "text/xml",
+  "application/javascript",
+  "text/javascript",
+  "application/ecmascript",
+  "text/ecmascript"
+]);
+function normalizeMimeType(raw) {
+  return raw.split(";")[0].trim().toLowerCase();
+}
 function createScopedR2Handler(config) {
   const requireAuthForMutations = config.requireAuthForMutations ?? true;
   return async (request, url, bucket, auth) => {
@@ -263,6 +282,13 @@ async function handleUpload(request, url, bucket, prefix, userId) {
       fileName = body.name;
       mimeType = body.mimeType || "application/octet-stream";
     }
+    mimeType = normalizeMimeType(mimeType) || "application/octet-stream";
+    if (DANGEROUS_MIME_TYPES.has(mimeType)) {
+      return Response.json(
+        { error: `Unsupported media type: ${mimeType}` },
+        { status: 415, headers: CORS_HEADERS }
+      );
+    }
     const requestedKey = url.searchParams.get("key");
     let key;
     if (requestedKey !== null) {
@@ -327,342 +353,15 @@ async function handleDownload(bucket, key) {
   }
   const headers = new Headers();
   headers.set("Content-Type", object.httpMetadata?.contentType || "application/octet-stream");
+  headers.set("X-Content-Type-Options", "nosniff");
   headers.set("Cache-Control", "public, max-age=31536000, immutable");
   headers.set("Access-Control-Allow-Origin", "*");
   if (object.customMetadata?.originalName) {
-    headers.set("Content-Disposition", `inline; filename="${object.customMetadata.originalName}"`);
+    headers.set("Content-Disposition", contentDisposition(object.customMetadata.originalName));
   }
   return new Response(object.body, { headers });
 }
 
-// src/server/auth/jwtVerifier.ts
-import { importSPKI, jwtVerify } from "jose";
-
-// src/server/auth/utils.ts
-var BASE64_URL_REGEX = /^[A-Za-z0-9-_]+$/;
-function bufferToHex(bytes) {
-  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
-  let hex = "";
-  for (const byte of view) {
-    hex += byte.toString(16).padStart(2, "0");
-  }
-  return hex;
-}
-function normalizeArray(value) {
-  if (value == null) return void 0;
-  if (Array.isArray(value)) {
-    return value.length ? value : void 0;
-  }
-  return [value];
-}
-function decodeJwtPayload(token) {
-  if (!token) return void 0;
-  const parts = token.split(".");
-  if (parts.length < 2) return void 0;
-  const payloadSegment = parts[1];
-  if (!payloadSegment) return void 0;
-  if (!BASE64_URL_REGEX.test(payloadSegment)) return void 0;
-  try {
-    const normalized = payloadSegment.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payloadSegment.length / 4) * 4, "=");
-    const bytes = base64ToUint8Array(normalized);
-    const json = new TextDecoder().decode(bytes);
-    const payload = JSON.parse(json);
-    return {
-      iss: payload.iss ?? null,
-      aud: payload.aud ?? null,
-      azp: payload?.azp ?? null,
-      exp: payload.exp ?? null,
-      iat: payload.iat ?? null
-    };
-  } catch {
-    return void 0;
-  }
-}
-function nowMs() {
-  return Date.now();
-}
-function base64ToUint8Array(value) {
-  if (typeof atob === "function") {
-    const binary = atob(value);
-    const out = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i += 1) {
-      out[i] = binary.charCodeAt(i);
-    }
-    return out;
-  }
-  if (typeof Buffer !== "undefined") {
-    return Uint8Array.from(Buffer.from(value, "base64"));
-  }
-  throw new Error("No base64 decoder available in current environment");
-}
-
-// src/server/auth/jwtVerifier.ts
-var DEFAULT_CLOCK_SKEW_MS = 5e3;
-function matchesAuthorizedParty(azp, patterns) {
-  if (!azp) return true;
-  for (const pattern of patterns) {
-    if (pattern === azp) return true;
-    if (pattern.includes("*")) {
-      const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
-      const regexPattern = escaped.replace(/\*/g, "[^/]*");
-      const regex = new RegExp(`^${regexPattern}$`);
-      if (regex.test(azp)) return true;
-      if (pattern.includes("*.")) {
-        const rootPattern = pattern.replace("*.", "");
-        if (rootPattern === azp) return true;
-      }
-    }
-  }
-  return false;
-}
-var keyCache = /* @__PURE__ */ new Map();
-async function getPublicKey(pem) {
-  const cached = keyCache.get(pem);
-  if (cached) return cached;
-  const normalized = pem.replace(/\\n/g, "\n");
-  const key = await importSPKI(normalized, "ES256");
-  keyCache.set(pem, key);
-  return key;
-}
-async function verifyJwt(config, token) {
-  if (!token) {
-    return { result: null };
-  }
-  try {
-    const publicKey = await getPublicKey(config.publicKey);
-    const audience = normalizeArray(config.audience);
-    const clockTolerance = Math.floor(
-      (config.clockSkewMs ?? DEFAULT_CLOCK_SKEW_MS) / 1e3
-    );
-    const { payload } = await jwtVerify(token, publicKey, {
-      issuer: config.issuer,
-      audience: audience && audience.length === 1 ? audience[0] : audience,
-      clockTolerance
-    });
-    const claims = payload;
-    if (!claims.sub) {
-      throw new Error("JWT verification succeeded but subject claim is missing");
-    }
-    const authorizedParties = normalizeArray(config.authorizedParties);
-    if (authorizedParties) {
-      const azp = claims.azp;
-      if (!matchesAuthorizedParty(azp, authorizedParties)) {
-        throw new Error(
-          `Authorized party '${azp}' does not match any allowed pattern`
-        );
-      }
-    }
-    return {
-      result: {
-        userId: claims.sub,
-        claims
-      }
-    };
-  } catch (error) {
-    return {
-      result: null,
-      error,
-      debug: decodeJwtPayload(token)
-    };
-  }
-}
-
-// src/server/auth/internalAuth.ts
-var DEFAULT_MAX_SKEW_MS = 5 * 6e4;
-var nodeCryptoPromise = null;
-async function loadNodeCrypto() {
-  if (!nodeCryptoPromise) {
-    nodeCryptoPromise = import("crypto").then((module) => module).catch(() => null);
-  }
-  return nodeCryptoPromise;
-}
-function hasSubtleCrypto() {
-  return typeof globalThis.crypto?.subtle?.importKey === "function";
-}
-async function computeHmacHex(secret, payload) {
-  if (hasSubtleCrypto()) {
-    const encoder = new TextEncoder();
-    const key = await crypto.subtle.importKey(
-      "raw",
-      encoder.encode(secret),
-      { name: "HMAC", hash: "SHA-256" },
-      false,
-      ["sign"]
-    );
-    const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(payload));
-    return bufferToHex(signature);
-  }
-  const nodeCrypto = await loadNodeCrypto();
-  if (!nodeCrypto) {
-    throw new Error("Crypto implementation unavailable for HMAC computation");
-  }
-  return nodeCrypto.createHmac("sha256", secret).update(payload).digest("hex");
-}
-async function timingSafeEqualHex(a, b) {
-  if (a.length !== b.length) {
-    return false;
-  }
-  const nodeCrypto = await loadNodeCrypto();
-  if (nodeCrypto?.timingSafeEqual) {
-    const aBuf = Buffer.from(a, "hex");
-    const bBuf = Buffer.from(b, "hex");
-    try {
-      return nodeCrypto.timingSafeEqual(aBuf, bBuf);
-    } catch {
-      return false;
-    }
-  }
-  let diff = 0;
-  for (let i = 0; i < a.length; i += 1) {
-    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return diff === 0;
-}
-async function signInternalPayload({
-  secret,
-  payload,
-  timestamp
-}) {
-  const ts = timestamp ?? nowMs().toString();
-  const signature = await computeHmacHex(secret, `${ts}.${payload}`);
-  return { timestamp: ts, signature };
-}
-async function verifyInternalSignature({
-  secret,
-  timestamp,
-  signature,
-  payload,
-  maxSkewMs = DEFAULT_MAX_SKEW_MS
-}) {
-  if (!secret || !timestamp || !signature) {
-    return false;
-  }
-  const tsNumber = Number(timestamp);
-  if (!Number.isFinite(tsNumber)) {
-    return false;
-  }
-  const skew = Math.abs(nowMs() - tsNumber);
-  if (skew > maxSkewMs) {
-    return false;
-  }
-  const expected = await computeHmacHex(secret, `${timestamp}.${payload}`);
-  return timingSafeEqualHex(signature.toLowerCase(), expected.toLowerCase());
-}
-function buildInternalPayload(body) {
-  if (body === void 0) return "{}";
-  if (typeof body === "string") return body;
-  try {
-    return JSON.stringify(body);
-  } catch {
-    return "{}";
-  }
-}
-
-// src/server/auth/betterAuth.ts
-import { betterAuth } from "better-auth";
-import { organization, twoFactor } from "better-auth/plugins";
-function createDeepSpaceAuth(config) {
-  const socialProviders = {};
-  if (config.google) {
-    socialProviders.google = config.google;
-  }
-  if (config.github) {
-    socialProviders.github = config.github;
-  }
-  return betterAuth({
-    database: config.database,
-    baseURL: config.baseURL,
-    secret: config.secret,
-    emailAndPassword: {
-      enabled: config.emailAndPassword ?? true
-    },
-    socialProviders,
-    trustedOrigins: config.trustedOrigins ?? [
-      "https://deep.space",
-      "https://*.deep.space",
-      "https://*.app.space",
-      "http://localhost:*"
-    ],
-    plugins: [organization(), twoFactor()]
-  });
-}
-
-// src/server/utils/cron.ts
-var DEFAULT_API_BASE_URL = "https://api-worker.deep.space";
-function buildCronContext(env, ownerUserId, roomId = "default") {
-  const hmacSecret = env.INTERNAL_STORAGE_HMAC_SECRET;
-  const apiBase = env.API_BASE_URL || DEFAULT_API_BASE_URL;
-  const roomIdObj = env.RECORD_ROOMS.idFromName(roomId);
-  const room = env.RECORD_ROOMS.get(roomIdObj);
-  async function executeTool3(tool, params) {
-    const response = await room.fetch(new Request("https://internal/api/tools/execute", {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "X-User-Id": ownerUserId,
-        "X-App-Action": "true"
-      },
-      body: JSON.stringify({ tool, params })
-    }));
-    const result = await response.json();
-    if (!result.success) {
-      throw new Error(`RecordRoom tool ${tool} failed: ${result.error || "Unknown error"}`);
-    }
-    return result.data;
-  }
-  const records = {
-    async query(collection, opts) {
-      const params = { collection };
-      if (opts?.where) params.where = opts.where;
-      if (opts?.limit) params.limit = opts.limit;
-      const data = await executeTool3("records.query", params);
-      return data.records || [];
-    },
-    async create(collection, data) {
-      return executeTool3("records.create", { collection, data });
-    },
-    async update(collection, recordId, data) {
-      return executeTool3("records.update", { collection, recordId, data });
-    },
-    async delete(collection, recordId) {
-      return executeTool3("records.delete", { collection, recordId });
-    }
-  };
-  const integrations = {
-    async call(endpoint, params) {
-      if (!hmacSecret) {
-        throw new Error("INTERNAL_STORAGE_HMAC_SECRET not configured \u2014 cannot call integrations");
-      }
-      const payload = { userId: ownerUserId, ...params };
-      const payloadStr = buildInternalPayload(payload);
-      const { timestamp, signature } = await signInternalPayload({
-        secret: hmacSecret,
-        payload: payloadStr
-      });
-      const response = await fetch(`${apiBase}/api/internal/integrations/${endpoint}`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "x-internal-timestamp": timestamp,
-          "x-internal-signature": signature
-        },
-        body: payloadStr
-      });
-      if (!response.ok) {
-        const errText = await response.text();
-        throw new Error(`Integration call ${endpoint} failed (${response.status}): ${errText}`);
-      }
-      return response.json();
-    }
-  };
-  return { records, integrations, ownerUserId };
-}
-
-// src/server/utils/ai.ts
-import { createAnthropic } from "@ai-sdk/anthropic";
-import { createOpenAI } from "@ai-sdk/openai";
-import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
-
 // src/server/utils/proxies.ts
 function resolveApiTransport(env) {
   if (env.API_WORKER) return { kind: "binding", fetcher: env.API_WORKER };
@@ -738,10 +437,82 @@ function authWorkerFetch(env, path, init) {
   } else {
     pathAndSearch = "/" + path;
   }
-  return fetch(`${baseUrl}${pathAndSearch}`, init);
+  return fetch(`${baseUrl}${pathAndSearch}`, init);
+}
+
+// src/server/utils/cron.ts
+function buildCronContext(env, ownerUserId, roomId = "default") {
+  const roomIdObj = env.RECORD_ROOMS.idFromName(roomId);
+  const room = env.RECORD_ROOMS.get(roomIdObj);
+  async function executeTool3(tool, params) {
+    const response = await room.fetch(new Request("https://internal/api/tools/execute", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-User-Id": ownerUserId,
+        "X-App-Action": "true"
+      },
+      body: JSON.stringify({ tool, params })
+    }));
+    const result = await response.json();
+    if (!result.success) {
+      throw new Error(`RecordRoom tool ${tool} failed: ${result.error || "Unknown error"}`);
+    }
+    return result.data;
+  }
+  const records = {
+    async query(collection, opts) {
+      const params = { collection };
+      if (opts?.where) params.where = opts.where;
+      if (opts?.limit) params.limit = opts.limit;
+      const data = await executeTool3("records.query", params);
+      return data.records || [];
+    },
+    async create(collection, data) {
+      return executeTool3("records.create", { collection, data });
+    },
+    async update(collection, recordId, data) {
+      return executeTool3("records.update", { collection, recordId, data });
+    },
+    async delete(collection, recordId) {
+      return executeTool3("records.delete", { collection, recordId });
+    }
+  };
+  const integrations = {
+    async call(endpoint, params = {}) {
+      if (!env.APP_OWNER_JWT) {
+        throw new Error(
+          "integrations.call requires env.APP_OWNER_JWT. Deployed apps receive this automatically; in dev, `deepspace dev` writes it into .dev.vars."
+        );
+      }
+      const response = await apiWorkerFetch(env, `/api/integrations/${endpoint}`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${env.APP_OWNER_JWT}`
+        },
+        body: JSON.stringify(params)
+      });
+      const text = await response.text();
+      let result = {};
+      try {
+        result = text ? JSON.parse(text) : {};
+      } catch {
+      }
+      if (!response.ok || !result.success) {
+        const detail = result.message || result.error || text || `HTTP ${response.status}`;
+        throw new Error(`Integration call ${endpoint} failed: ${detail}`);
+      }
+      return result.data;
+    }
+  };
+  return { records, integrations, ownerUserId };
 }
 
 // src/server/utils/ai.ts
+import { createAnthropic } from "@ai-sdk/anthropic";
+import { createOpenAI } from "@ai-sdk/openai";
+import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
 var ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS = 4096;
 function withDefaultAnthropicMaxTokens(body) {
   if (typeof body !== "string") return body;
@@ -1544,6 +1315,13 @@ var MSG = {
   USER_LIST: "user.list",
   SET_ROLE: "user.set_role",
   USER_UPDATE: "user.update",
+  // ---- Auth signal -----------------------------------------------------
+  // Server → client one-shot on connect from rooms that enforce role-based
+  // writes (Canvas, Game, Cron). Tells the client whether this connection
+  // can write so its hook can disable local write APIs and the UI can
+  // render controls accordingly. Without this, a viewer's click would
+  // round-trip to the server and silently come back as ERROR.
+  AUTH: "auth",
   // ---- Yjs JSON control frames (binary sync lives in ./yjs.ts) ---------
   YJS_JOIN: "yjs.join",
   YJS_LEAVE: "yjs.leave",
@@ -1577,6 +1355,14 @@ var MSG = {
   CRON_PAUSE: "cron.pause",
   CRON_RESUME: "cron.resume",
   CRON_STATUS: "cron.status",
+  // ---- JobRoom ---------------------------------------------------------
+  // Background-job queue with durable, alarm-driven execution. See
+  // server/rooms/job-room.ts. Clients enqueue and subscribe to updates;
+  // the room broadcasts JOB_UPDATE for every status transition.
+  JOB_ENQUEUE: "job.enqueue",
+  JOB_CANCEL: "job.cancel",
+  JOB_RETRY: "job.retry",
+  JOB_UPDATE: "job.update",
   // ---- PresenceRoom ----------------------------------------------------
   PRESENCE_SYNC: "presence.sync",
   PRESENCE_JOIN: "presence.join",
@@ -2069,6 +1855,17 @@ var serverBuild = {
   cronTasks: (tasks) => ({ type: MSG.CRON_TASKS, payload: { tasks } }),
   cronHistory: (history) => ({ type: MSG.CRON_HISTORY, payload: { history } }),
   cronStatus: (tasks, recentHistory) => ({ type: MSG.CRON_STATUS, payload: { tasks, recentHistory } }),
+  // Jobs
+  jobSnapshot: (jobs) => ({ type: MSG.JOB_UPDATE, payload: { kind: "snapshot", jobs } }),
+  jobEnqueued: (job, requestId) => ({
+    type: MSG.JOB_UPDATE,
+    payload: { kind: "enqueued", job, requestId }
+  }),
+  jobProgress: (job) => ({ type: MSG.JOB_UPDATE, payload: { kind: "progress", job } }),
+  jobSucceeded: (job) => ({ type: MSG.JOB_UPDATE, payload: { kind: "succeeded", job } }),
+  jobFailed: (job) => ({ type: MSG.JOB_UPDATE, payload: { kind: "failed", job } }),
+  jobCanceled: (job) => ({ type: MSG.JOB_UPDATE, payload: { kind: "canceled", job } }),
+  jobRetried: (job) => ({ type: MSG.JOB_UPDATE, payload: { kind: "retried", job } }),
   // Presence
   presenceSync: (peers) => ({ type: MSG.PRESENCE_SYNC, payload: { peers } }),
   presenceJoin: (peer) => ({ type: MSG.PRESENCE_JOIN, payload: { peer } }),
@@ -4160,7 +3957,20 @@ var YjsRoom = class extends BaseRoom {
   }
 };
 
+// src/shared/roles.ts
+var ROLES = {
+  VIEWER: "viewer",
+  MEMBER: "member",
+  ADMIN: "admin"
+};
+
 // src/server/rooms/game-room.ts
+var GAME_WRITE_TYPES = /* @__PURE__ */ new Set([
+  MSG.GAME_INPUT,
+  MSG.GAME_PLAYER_READY,
+  MSG.GAME_START,
+  MSG.GAME_END
+]);
 var GameRoom = class extends BaseRoom {
   config;
   players = /* @__PURE__ */ new Map();
@@ -4216,10 +4026,26 @@ var GameRoom = class extends BaseRoom {
   // ==========================================================================
   onConnect(ws, user) {
     this.ensureInitialized();
+    const role = user.role ?? ROLES.VIEWER;
+    const canWrite = role === ROLES.MEMBER || role === ROLES.ADMIN;
     const attachment = {
       ...user,
-      joinedAt: (/* @__PURE__ */ new Date()).toISOString()
+      joinedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      canWrite
     };
+    this.sendTo(ws, { type: MSG.AUTH, payload: { canWrite } });
+    if (!canWrite) {
+      this.sendTo(ws, {
+        type: MSG.GAME_STATE,
+        payload: {
+          state: this.gameState,
+          tick: this.currentTick,
+          players: Array.from(this.players.values()),
+          running: this.running
+        }
+      });
+      return attachment;
+    }
     const player = {
       userId: user.userId,
       userName: user.userName,
@@ -4248,6 +4074,13 @@ var GameRoom = class extends BaseRoom {
   async onMessage(ws, user, message) {
     this.ensureInitialized();
     const { type, payload } = message;
+    if (GAME_WRITE_TYPES.has(type) && !user.canWrite) {
+      this.sendTo(ws, {
+        type: MSG.ERROR,
+        payload: { error: "Write access denied: spectators cannot drive the game" }
+      });
+      return;
+    }
     switch (type) {
       case MSG.GAME_INPUT: {
         this.inputBuffer.push({
@@ -4396,6 +4229,15 @@ var GameRoom = class extends BaseRoom {
 
 // src/server/rooms/canvas-room.ts
 import * as Y5 from "yjs";
+var CANVAS_WRITE_TYPES = /* @__PURE__ */ new Set([
+  MSG.CANVAS_ADD,
+  MSG.CANVAS_MOVE,
+  MSG.CANVAS_RESIZE,
+  MSG.CANVAS_DELETE,
+  MSG.CANVAS_UPDATE,
+  MSG.CANVAS_UNDO,
+  MSG.CANVAS_REDO
+]);
 var CanvasRoom = class extends BaseRoom {
   doc = null;
   initialized = false;
@@ -4455,10 +4297,14 @@ var CanvasRoom = class extends BaseRoom {
   }
   onConnect(ws, user) {
     this.ensureInitialized();
+    const role = user.role ?? ROLES.VIEWER;
+    const canWrite = role === ROLES.MEMBER || role === ROLES.ADMIN;
     const attachment = {
       ...user,
-      viewport: null
+      viewport: null,
+      canWrite
     };
+    this.sendTo(ws, { type: MSG.AUTH, payload: { canWrite } });
     const shapes = this.getAllShapes();
     this.sendTo(ws, {
       type: MSG.CANVAS_SHAPES,
@@ -4472,6 +4318,13 @@ var CanvasRoom = class extends BaseRoom {
   async onMessage(ws, user, message) {
     this.ensureInitialized();
     const { type, payload } = message;
+    if (CANVAS_WRITE_TYPES.has(type) && !user.canWrite) {
+      this.sendTo(ws, {
+        type: MSG.ERROR,
+        payload: { error: "Write access denied: viewer role cannot modify the canvas" }
+      });
+      return;
+    }
     switch (type) {
       case MSG.CANVAS_ADD: {
         const shape = payload;
@@ -4766,6 +4619,11 @@ var PresenceRoom = class extends BaseRoom {
 };
 
 // src/server/rooms/cron-room.ts
+var CRON_WRITE_TYPES = /* @__PURE__ */ new Set([
+  MSG.CRON_TRIGGER,
+  MSG.CRON_PAUSE,
+  MSG.CRON_RESUME
+]);
 var CronRoom = class extends BaseRoom {
   tasks;
   initialized = false;
@@ -4844,6 +4702,9 @@ var CronRoom = class extends BaseRoom {
   }
   onConnect(ws, user) {
     this.ensureInitialized();
+    const role = user.role ?? ROLES.VIEWER;
+    const canWrite = role === ROLES.MEMBER || role === ROLES.ADMIN;
+    this.sendTo(ws, { type: MSG.AUTH, payload: { canWrite } });
     this.sendTo(ws, {
       type: MSG.CRON_TASKS,
       payload: { tasks: this.getTaskStates() }
@@ -4852,11 +4713,18 @@ var CronRoom = class extends BaseRoom {
       type: MSG.CRON_HISTORY,
       payload: { history: this.getRecentHistory(50) }
     });
-    return user;
+    return { ...user, canWrite };
   }
   async onMessage(ws, user, message) {
     this.ensureInitialized();
     const { type, payload } = message;
+    if (CRON_WRITE_TYPES.has(type) && !user.canWrite) {
+      this.sendTo(ws, {
+        type: MSG.ERROR,
+        payload: { error: "Write access denied: viewer role cannot modify cron tasks" }
+      });
+      return;
+    }
     switch (type) {
       case MSG.CRON_TRIGGER: {
         const taskName = payload.taskName;
@@ -5126,45 +4994,582 @@ function computeNextRunAt(task, from) {
   if (task.interval_minutes) {
     return new Date(from.getTime() + task.interval_minutes * 60 * 1e3).toISOString();
   }
-  if (task.schedule && task.timezone) {
-    const next = nextCronFire(task.schedule, task.timezone, from);
-    return next ? next.toISOString() : null;
+  if (task.schedule && task.timezone) {
+    const next = nextCronFire(task.schedule, task.timezone, from);
+    return next ? next.toISOString() : null;
+  }
+  return null;
+}
+function nextCronFire(expression, timezone, from) {
+  const parsed = parseCronExpression(expression);
+  const start = new Date(Math.floor(from.getTime() / 6e4) * 6e4 + 6e4);
+  const limit = new Date(start.getTime() + 366 * 24 * 60 * 6e4);
+  for (let t = start.getTime(); t < limit.getTime(); t += 6e4) {
+    const candidate = new Date(t);
+    if (cronMatches(parsed, timezone, candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function cronMatches(parsed, timezone, date) {
+  const formatter = new Intl.DateTimeFormat("en-US", {
+    timeZone: timezone,
+    year: "numeric",
+    month: "numeric",
+    day: "numeric",
+    hour: "numeric",
+    minute: "numeric",
+    weekday: "short",
+    hour12: false
+  });
+  const parts = Object.fromEntries(
+    formatter.formatToParts(date).map((p) => [p.type, p.value])
+  );
+  const minute = parseInt(parts.minute, 10);
+  const hour = parseInt(parts.hour, 10) % 24;
+  const dayOfMonth = parseInt(parts.day, 10);
+  const month = parseInt(parts.month, 10);
+  const weekdayMap = { Sun: 0, Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6 };
+  const dayOfWeek = weekdayMap[parts.weekday] ?? 0;
+  return parsed.minute.has(minute) && parsed.hour.has(hour) && parsed.dayOfMonth.has(dayOfMonth) && parsed.month.has(month) && parsed.dayOfWeek.has(dayOfWeek);
+}
+
+// src/server/rooms/job-room.ts
+var RUNNING_STALE_MS = 16 * 60 * 1e3;
+var DEFAULT_RETENTION_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_SNAPSHOT_LIMIT = 100;
+var JobRoom = class extends BaseRoom {
+  initialized = false;
+  defaultMaxAttempts;
+  retentionMs;
+  snapshotLimit;
+  retryBackoffMs;
+  /** In-flight jobs in this isolate; lets same-isolate JOB_CANCEL fire the signal. */
+  inFlight = /* @__PURE__ */ new Map();
+  /** Set by `ctx.continue` inside `executeJob`; reset before every run. */
+  continueState = null;
+  constructor(state, env, config = {}) {
+    super(state, env);
+    this.defaultMaxAttempts = Math.max(1, config.defaultMaxAttempts ?? 1);
+    this.retentionMs = Math.max(0, config.retentionMs ?? DEFAULT_RETENTION_MS);
+    this.snapshotLimit = Math.max(1, config.snapshotLimit ?? DEFAULT_SNAPSHOT_LIMIT);
+    this.retryBackoffMs = Math.max(0, config.retryBackoffMs ?? 1e3);
+  }
+  ensureInitialized() {
+    if (this.initialized) return;
+    this.initialized = true;
+    this.sql.exec(`
+      CREATE TABLE IF NOT EXISTS jobs (
+        id TEXT PRIMARY KEY,
+        type TEXT NOT NULL,
+        status TEXT NOT NULL,
+        payload TEXT,
+        result TEXT,
+        error TEXT,
+        progress REAL,
+        progress_message TEXT,
+        checkpoint TEXT,
+        attempts INTEGER NOT NULL DEFAULT 0,
+        max_attempts INTEGER NOT NULL DEFAULT 1,
+        enqueued_at TEXT NOT NULL,
+        started_at TEXT,
+        completed_at TEXT,
+        enqueued_by TEXT,
+        next_run_at TEXT
+      )
+    `);
+    this.sql.exec(
+      `CREATE INDEX IF NOT EXISTS jobs_status_next_run ON jobs (status, next_run_at)`
+    );
+    this.sql.exec(
+      `CREATE INDEX IF NOT EXISTS jobs_completed_at ON jobs (completed_at)`
+    );
+    this.recoverStuckRunning();
+    this.scheduleNextAlarm();
+  }
+  // ==========================================================================
+  // BaseRoom Lifecycle
+  // ==========================================================================
+  async fetch(request) {
+    this.ensureInitialized();
+    return super.fetch(request);
+  }
+  onConnect(ws, user) {
+    this.ensureInitialized();
+    this.sendTo(ws, serverBuild.jobSnapshot(this.getRecentJobs(this.snapshotLimit)));
+    return user;
+  }
+  async onMessage(ws, user, message) {
+    this.ensureInitialized();
+    const { type, payload } = message;
+    switch (type) {
+      case MSG.JOB_ENQUEUE: {
+        const requestId = String(payload.requestId ?? "");
+        const jobType = String(payload.type ?? "");
+        if (!jobType) {
+          this.sendTo(ws, serverBuild.error("JOB_ENQUEUE missing type"));
+          return;
+        }
+        const job = this.insertJob({
+          type: jobType,
+          payload: payload.payload,
+          maxAttempts: typeof payload.maxAttempts === "number" ? Math.max(1, Math.floor(payload.maxAttempts)) : void 0,
+          enqueuedBy: user.userId
+        });
+        this.sendTo(ws, serverBuild.jobEnqueued(job, requestId));
+        this.broadcast(serverBuild.jobEnqueued(job), ws);
+        this.scheduleNextAlarm();
+        break;
+      }
+      case MSG.JOB_CANCEL: {
+        const jobId = String(payload.jobId ?? "");
+        if (!jobId) {
+          this.sendTo(ws, serverBuild.error("JOB_CANCEL missing jobId"));
+          return;
+        }
+        this.cancelJob(jobId);
+        break;
+      }
+      case MSG.JOB_RETRY: {
+        const jobId = String(payload.jobId ?? "");
+        if (!jobId) {
+          this.sendTo(ws, serverBuild.error("JOB_RETRY missing jobId"));
+          return;
+        }
+        this.retryJob(jobId);
+        break;
+      }
+      default:
+        this.sendTo(ws, serverBuild.error(`Unknown job message type: ${type}`));
+    }
+  }
+  async onAlarm() {
+    this.ensureInitialized();
+    await this.drainDueJobs();
+    this.pruneExpired();
+    this.scheduleNextAlarm();
+  }
+  // ==========================================================================
+  // HTTP — internal enqueue path for cross-isolate callers
+  // ==========================================================================
+  /**
+   * One internal endpoint, `POST /enqueue`, used by the `enqueueJob`
+   * helper at the bottom of this file. The room is not meant to be
+   * reachable from the public internet; callers route through the app
+   * worker (or call `this.enqueue(...)` directly from a subclass).
+   *
+   * Subclasses overriding `onRequest` should call `super.onRequest(req)`
+   * for paths they don't handle.
+   */
+  async onRequest(request) {
+    this.ensureInitialized();
+    const url = new URL(request.url);
+    if (request.method !== "POST" || !url.pathname.endsWith("/enqueue")) {
+      return new Response("Not Found", { status: 404 });
+    }
+    const body = await request.json().catch(() => null);
+    if (!body || typeof body.type !== "string" || !body.type) {
+      return new Response(JSON.stringify({ error: "type required" }), {
+        status: 400,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    const job = this.insertJob({
+      type: body.type,
+      payload: body.payload,
+      maxAttempts: typeof body.maxAttempts === "number" ? Math.max(1, Math.floor(body.maxAttempts)) : void 0,
+      enqueuedBy: typeof body.enqueuedBy === "string" ? body.enqueuedBy : void 0
+    });
+    this.broadcast(serverBuild.jobEnqueued(job));
+    this.scheduleNextAlarm();
+    return new Response(JSON.stringify({ job }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  // ==========================================================================
+  // Public enqueue surface (server-side callers in the same isolate)
+  // ==========================================================================
+  /**
+   * Synchronously persist a new job and arm the alarm. Returns the new
+   * job. This is the in-isolate path — useful for a subclass `onJob`
+   * that wants to chain follow-up work without paying a fetch hop:
+   *
+   *   protected async onJob(job: Job, ctx: JobContext) {
+   *     // ... do work ...
+   *     if (needsFollowup) this.enqueue('followup', { parent: job.id })
+   *   }
+   *
+   * Workers code that lives outside the DO isolate (HTTP routes, cron
+   * tasks, server actions) cannot call this directly — they must go
+   * through the `enqueueJob` helper at the bottom of this file, which
+   * routes via the DO's `/enqueue` HTTP endpoint.
+   */
+  enqueue(type, payload, options) {
+    this.ensureInitialized();
+    const job = this.insertJob({
+      type,
+      payload,
+      maxAttempts: options?.maxAttempts,
+      enqueuedBy: options?.enqueuedBy
+    });
+    this.broadcast(serverBuild.jobEnqueued(job));
+    this.scheduleNextAlarm();
+    return job;
+  }
+  // ==========================================================================
+  // Mutation helpers
+  // ==========================================================================
+  insertJob(input) {
+    const id = crypto.randomUUID();
+    const enqueuedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const maxAttempts = Math.max(1, input.maxAttempts ?? this.defaultMaxAttempts);
+    const payloadJson = input.payload === void 0 ? null : safeStringify(input.payload);
+    this.sql.exec(
+      `INSERT INTO jobs (id, type, status, payload, attempts, max_attempts, enqueued_at, enqueued_by, next_run_at)
+       VALUES (?, ?, 'queued', ?, 0, ?, ?, ?, ?)`,
+      id,
+      input.type,
+      payloadJson,
+      maxAttempts,
+      enqueuedAt,
+      input.enqueuedBy ?? null,
+      enqueuedAt
+    );
+    return this.getJobById(id);
+  }
+  cancelJob(jobId) {
+    const row = this.sql.exec(`SELECT status FROM jobs WHERE id = ?`, jobId).toArray()[0];
+    if (!row) return;
+    if (row.status === "succeeded" || row.status === "failed" || row.status === "canceled") {
+      return;
+    }
+    const completedAt = (/* @__PURE__ */ new Date()).toISOString();
+    this.sql.exec(
+      `UPDATE jobs
+         SET status = 'canceled',
+             completed_at = ?,
+             checkpoint = NULL,
+             next_run_at = NULL
+       WHERE id = ?`,
+      completedAt,
+      jobId
+    );
+    const controller = this.inFlight.get(jobId);
+    if (controller) controller.abort();
+    const job = this.getJobById(jobId);
+    if (job) this.broadcast(serverBuild.jobCanceled(job));
+  }
+  retryJob(jobId) {
+    const row = this.sql.exec(`SELECT status, attempts, max_attempts FROM jobs WHERE id = ?`, jobId).toArray()[0];
+    if (!row) return;
+    if (row.status !== "failed" && row.status !== "canceled") return;
+    const newMax = Math.max(row.max_attempts, row.attempts + 1);
+    this.sql.exec(
+      `UPDATE jobs
+         SET status = 'queued',
+             max_attempts = ?,
+             error = NULL,
+             result = NULL,
+             completed_at = NULL,
+             next_run_at = ?
+       WHERE id = ?`,
+      newMax,
+      (/* @__PURE__ */ new Date()).toISOString(),
+      jobId
+    );
+    const job = this.getJobById(jobId);
+    if (job) this.broadcast(serverBuild.jobRetried(job));
+    this.scheduleNextAlarm();
+  }
+  // ==========================================================================
+  // Alarm / execution
+  // ==========================================================================
+  /**
+   * Drain due jobs in FIFO order. All due jobs share the alarm's
+   * 15-min wall budget (a CF property, not a per-job allocation).
+   */
+  async drainDueJobs() {
+    const cutoff = (/* @__PURE__ */ new Date()).toISOString();
+    while (true) {
+      const row = this.sql.exec(
+        `SELECT * FROM jobs
+            WHERE status = 'queued'
+              AND (next_run_at IS NULL OR next_run_at <= ?)
+            ORDER BY enqueued_at ASC
+            LIMIT 1`,
+        cutoff
+      ).toArray()[0];
+      if (!row) return;
+      await this.executeJob(row);
+    }
+  }
+  async executeJob(row) {
+    const startedAt = row.started_at ?? (/* @__PURE__ */ new Date()).toISOString();
+    const attemptsBefore = row.attempts;
+    const attempt = attemptsBefore + 1;
+    this.sql.exec(
+      `UPDATE jobs SET status = 'running', started_at = ?, attempts = ? WHERE id = ?`,
+      startedAt,
+      attempt,
+      row.id
+    );
+    const controller = new AbortController();
+    this.inFlight.set(row.id, controller);
+    this.continueState = null;
+    const job = {
+      ...rowToJobView(row),
+      status: "running",
+      attempts: attempt,
+      startedAt
+    };
+    let outcome = "succeeded";
+    let result;
+    let errorMessage;
+    try {
+      const ctx = this.makeContext(row.id, controller.signal);
+      result = await this.onJob(job, ctx);
+      if (this.continueState) outcome = "continued";
+    } catch (e) {
+      outcome = "failed";
+      errorMessage = e instanceof Error ? e.message : String(e);
+      console.error(`[JobRoom] Job "${row.type}" (${row.id}) failed:`, e);
+    } finally {
+      this.inFlight.delete(row.id);
+    }
+    const currentStatus = this.readStatus(row.id);
+    if (currentStatus === "canceled") {
+      this.continueState = null;
+      return;
+    }
+    if (outcome === "continued") {
+      const state = this.continueState;
+      this.continueState = null;
+      const nextRunAt = new Date(Date.now() + Math.max(0, state.afterMs)).toISOString();
+      this.sql.exec(
+        `UPDATE jobs
+           SET status = 'queued',
+               checkpoint = ?,
+               next_run_at = ?
+         WHERE id = ?`,
+        safeStringify(state.checkpoint),
+        nextRunAt,
+        row.id
+      );
+      const updated2 = this.getJobById(row.id);
+      if (updated2) this.broadcast(serverBuild.jobProgress(updated2));
+      return;
+    }
+    const completedAt = (/* @__PURE__ */ new Date()).toISOString();
+    if (outcome === "succeeded") {
+      this.sql.exec(
+        `UPDATE jobs
+           SET status = 'succeeded',
+               result = ?,
+               completed_at = ?,
+               error = NULL,
+               checkpoint = NULL,
+               next_run_at = NULL,
+               progress = NULL,
+               progress_message = NULL
+         WHERE id = ?`,
+        result === void 0 ? null : safeStringify(result),
+        completedAt,
+        row.id
+      );
+      const updated2 = this.getJobById(row.id);
+      if (updated2) this.broadcast(serverBuild.jobSucceeded(updated2));
+      return;
+    }
+    if (attempt < row.max_attempts) {
+      const nextRunAt = new Date(Date.now() + this.retryBackoffMs).toISOString();
+      this.sql.exec(
+        `UPDATE jobs
+           SET status = 'queued',
+               error = ?,
+               next_run_at = ?,
+               started_at = NULL,
+               progress = NULL,
+               progress_message = NULL
+         WHERE id = ?`,
+        errorMessage ?? "unknown error",
+        nextRunAt,
+        row.id
+      );
+      const updated2 = this.getJobById(row.id);
+      if (updated2) this.broadcast(serverBuild.jobRetried(updated2));
+      return;
+    }
+    this.sql.exec(
+      `UPDATE jobs
+         SET status = 'failed',
+             error = ?,
+             completed_at = ?,
+             checkpoint = NULL,
+             next_run_at = NULL,
+             progress = NULL,
+             progress_message = NULL
+       WHERE id = ?`,
+      errorMessage ?? "unknown error",
+      completedAt,
+      row.id
+    );
+    const updated = this.getJobById(row.id);
+    if (updated) this.broadcast(serverBuild.jobFailed(updated));
+  }
+  makeContext(jobId, signal) {
+    return {
+      progress: (value, message) => {
+        const clamped = Math.max(0, Math.min(1, value));
+        this.sql.exec(
+          `UPDATE jobs SET progress = ?, progress_message = ? WHERE id = ?`,
+          clamped,
+          message ?? null,
+          jobId
+        );
+        const updated = this.getJobById(jobId);
+        if (updated) this.broadcast(serverBuild.jobProgress(updated));
+      },
+      continue: (state, options) => {
+        this.continueState = {
+          checkpoint: state,
+          afterMs: Math.max(0, options?.afterMs ?? 0)
+        };
+      },
+      signal
+    };
+  }
+  readStatus(jobId) {
+    const row = this.sql.exec(`SELECT status FROM jobs WHERE id = ?`, jobId).toArray()[0];
+    return row?.status ?? null;
+  }
+  // ==========================================================================
+  // Scheduling / recovery / pruning
+  // ==========================================================================
+  scheduleNextAlarm() {
+    const row = this.sql.exec(
+      `SELECT next_run_at FROM jobs
+          WHERE status = 'queued'
+          ORDER BY (next_run_at IS NULL) ASC, next_run_at ASC
+          LIMIT 1`
+    ).toArray()[0];
+    if (!row) return;
+    const now = Date.now();
+    const target = row.next_run_at ? Math.max(now, new Date(row.next_run_at).getTime()) : now;
+    this.state.storage.setAlarm(Math.max(target, now + 50));
+  }
+  recoverStuckRunning() {
+    const cutoff = new Date(Date.now() - RUNNING_STALE_MS).toISOString();
+    const stuck = this.sql.exec(
+      `SELECT id, attempts, max_attempts FROM jobs
+          WHERE status = 'running' AND started_at < ?`,
+      cutoff
+    ).toArray();
+    for (const r of stuck) {
+      if (r.attempts >= r.max_attempts) {
+        this.sql.exec(
+          `UPDATE jobs
+             SET status = 'failed',
+                 error = 'Isolate recycled or wall time exceeded',
+                 completed_at = ?,
+                 checkpoint = NULL,
+                 next_run_at = NULL
+           WHERE id = ?`,
+          (/* @__PURE__ */ new Date()).toISOString(),
+          r.id
+        );
+      } else {
+        this.sql.exec(
+          `UPDATE jobs
+             SET status = 'queued',
+                 started_at = NULL,
+                 next_run_at = ?,
+                 error = 'Previous attempt killed mid-run; retrying',
+                 progress = NULL,
+                 progress_message = NULL
+           WHERE id = ?`,
+          (/* @__PURE__ */ new Date()).toISOString(),
+          r.id
+        );
+      }
+    }
+  }
+  pruneExpired() {
+    if (this.retentionMs === 0) return;
+    const cutoff = new Date(Date.now() - this.retentionMs).toISOString();
+    this.sql.exec(
+      `DELETE FROM jobs
+        WHERE status IN ('succeeded', 'failed', 'canceled')
+          AND completed_at IS NOT NULL
+          AND completed_at < ?`,
+      cutoff
+    );
+  }
+  // ==========================================================================
+  // Read helpers
+  // ==========================================================================
+  getRecentJobs(limit) {
+    const rows = this.sql.exec(
+      `SELECT * FROM jobs
+          ORDER BY (status IN ('queued','running')) DESC, enqueued_at DESC
+          LIMIT ?`,
+      limit
+    ).toArray();
+    return rows.map(rowToJobView);
+  }
+  getJobById(id) {
+    const row = this.sql.exec(`SELECT * FROM jobs WHERE id = ?`, id).toArray()[0];
+    return row ? rowToJobView(row) : null;
   }
-  return null;
-}
-function nextCronFire(expression, timezone, from) {
-  const parsed = parseCronExpression(expression);
-  const start = new Date(Math.floor(from.getTime() / 6e4) * 6e4 + 6e4);
-  const limit = new Date(start.getTime() + 366 * 24 * 60 * 6e4);
-  for (let t = start.getTime(); t < limit.getTime(); t += 6e4) {
-    const candidate = new Date(t);
-    if (cronMatches(parsed, timezone, candidate)) {
-      return candidate;
-    }
+};
+async function enqueueJob(namespace, roomId, type, payload, options) {
+  const stub = namespace.get(namespace.idFromName(roomId));
+  const res = await stub.fetch(
+    new Request("https://job-room.internal/enqueue", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        type,
+        payload,
+        maxAttempts: options?.maxAttempts,
+        enqueuedBy: options?.enqueuedBy
+      })
+    })
+  );
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`enqueueJob failed: ${res.status} ${text}`);
   }
-  return null;
+  const data = await res.json();
+  if (!data.job?.id) throw new Error("enqueueJob: malformed response");
+  return data.job.id;
 }
-function cronMatches(parsed, timezone, date) {
-  const formatter = new Intl.DateTimeFormat("en-US", {
-    timeZone: timezone,
-    year: "numeric",
-    month: "numeric",
-    day: "numeric",
-    hour: "numeric",
-    minute: "numeric",
-    weekday: "short",
-    hour12: false
-  });
-  const parts = Object.fromEntries(
-    formatter.formatToParts(date).map((p) => [p.type, p.value])
-  );
-  const minute = parseInt(parts.minute, 10);
-  const hour = parseInt(parts.hour, 10) % 24;
-  const dayOfMonth = parseInt(parts.day, 10);
-  const month = parseInt(parts.month, 10);
-  const weekdayMap = { Sun: 0, Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6 };
-  const dayOfWeek = weekdayMap[parts.weekday] ?? 0;
-  return parsed.minute.has(minute) && parsed.hour.has(hour) && parsed.dayOfMonth.has(dayOfMonth) && parsed.month.has(month) && parsed.dayOfWeek.has(dayOfWeek);
+function rowToJobView(row) {
+  return {
+    id: row.id,
+    type: row.type,
+    status: row.status,
+    payload: row.payload == null ? void 0 : JSON.parse(row.payload),
+    result: row.result == null ? void 0 : JSON.parse(row.result),
+    error: row.error ?? void 0,
+    progress: row.progress ?? void 0,
+    progressMessage: row.progress_message ?? void 0,
+    attempts: row.attempts,
+    maxAttempts: row.max_attempts,
+    enqueuedAt: row.enqueued_at,
+    startedAt: row.started_at,
+    completedAt: row.completed_at,
+    enqueuedBy: row.enqueued_by,
+    resumeFrom: row.checkpoint == null ? void 0 : JSON.parse(row.checkpoint)
+  };
+}
+function safeStringify(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return JSON.stringify({ __unserializable__: String(value) });
+  }
 }
 
 // src/server/rooms/do-manifest.ts
@@ -5247,7 +5652,6 @@ var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
   "AUTH_WORKER_URL",
   "APP_IDENTITY_TOKEN",
   "APP_OWNER_JWT",
-  "INTERNAL_STORAGE_HMAC_SECRET",
   "USAGE_EVENTS"
 ]);
 function validateBindingManifest(manifest) {
@@ -6079,6 +6483,215 @@ var RESERVED_COLLECTION_NAMES = new Set(
   GLOBAL_DO_TYPES.flatMap((t) => t.schemas.map((s) => s.name))
 );
 
+// src/server/auth/jwtVerifier.ts
+import { importSPKI, jwtVerify } from "jose";
+
+// src/server/auth/utils.ts
+var BASE64_URL_REGEX = /^[A-Za-z0-9-_]+$/;
+function bufferToHex(bytes) {
+  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let hex = "";
+  for (const byte of view) {
+    hex += byte.toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+function normalizeArray(value) {
+  if (value == null) return void 0;
+  if (Array.isArray(value)) {
+    return value.length ? value : void 0;
+  }
+  return [value];
+}
+function decodeJwtPayload(token) {
+  if (!token) return void 0;
+  const parts = token.split(".");
+  if (parts.length < 2) return void 0;
+  const payloadSegment = parts[1];
+  if (!payloadSegment) return void 0;
+  if (!BASE64_URL_REGEX.test(payloadSegment)) return void 0;
+  try {
+    const normalized = payloadSegment.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payloadSegment.length / 4) * 4, "=");
+    const bytes = base64ToUint8Array(normalized);
+    const json = new TextDecoder().decode(bytes);
+    const payload = JSON.parse(json);
+    return {
+      iss: payload.iss ?? null,
+      aud: payload.aud ?? null,
+      azp: payload?.azp ?? null,
+      exp: payload.exp ?? null,
+      iat: payload.iat ?? null
+    };
+  } catch {
+    return void 0;
+  }
+}
+function base64ToUint8Array(value) {
+  if (typeof atob === "function") {
+    const binary = atob(value);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1) {
+      out[i] = binary.charCodeAt(i);
+    }
+    return out;
+  }
+  if (typeof Buffer !== "undefined") {
+    return Uint8Array.from(Buffer.from(value, "base64"));
+  }
+  throw new Error("No base64 decoder available in current environment");
+}
+
+// src/server/auth/jwtVerifier.ts
+var DEFAULT_CLOCK_SKEW_MS = 5e3;
+function matchesAuthorizedParty(azp, patterns) {
+  if (!azp) return true;
+  for (const pattern of patterns) {
+    if (pattern === azp) return true;
+    if (pattern.includes("*")) {
+      const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+      const regexPattern = escaped.replace(/\*/g, "[^/]*");
+      const regex = new RegExp(`^${regexPattern}$`);
+      if (regex.test(azp)) return true;
+      if (pattern.includes("*.")) {
+        const rootPattern = pattern.replace("*.", "");
+        if (rootPattern === azp) return true;
+      }
+    }
+  }
+  return false;
+}
+var keyCache = /* @__PURE__ */ new Map();
+async function getPublicKey(pem) {
+  const cached = keyCache.get(pem);
+  if (cached) return cached;
+  const normalized = pem.replace(/\\n/g, "\n");
+  const key = await importSPKI(normalized, "ES256");
+  keyCache.set(pem, key);
+  return key;
+}
+async function verifyJwt(config, token) {
+  if (!token) {
+    return { result: null };
+  }
+  try {
+    const publicKey = await getPublicKey(config.publicKey);
+    const audience = normalizeArray(config.audience);
+    const clockTolerance = Math.floor(
+      (config.clockSkewMs ?? DEFAULT_CLOCK_SKEW_MS) / 1e3
+    );
+    const { payload } = await jwtVerify(token, publicKey, {
+      issuer: config.issuer,
+      audience: audience && audience.length === 1 ? audience[0] : audience,
+      clockTolerance
+    });
+    const claims = payload;
+    if (!claims.sub) {
+      throw new Error("JWT verification succeeded but subject claim is missing");
+    }
+    const authorizedParties = normalizeArray(config.authorizedParties);
+    if (authorizedParties) {
+      const azp = claims.azp;
+      if (!matchesAuthorizedParty(azp, authorizedParties)) {
+        throw new Error(
+          `Authorized party '${azp}' does not match any allowed pattern`
+        );
+      }
+    }
+    return {
+      result: {
+        userId: claims.sub,
+        claims
+      }
+    };
+  } catch (error) {
+    return {
+      result: null,
+      error,
+      debug: decodeJwtPayload(token)
+    };
+  }
+}
+
+// src/server/auth/internalAuth.ts
+var nodeCryptoPromise = null;
+async function loadNodeCrypto() {
+  if (!nodeCryptoPromise) {
+    nodeCryptoPromise = import("crypto").then((module) => module).catch(() => null);
+  }
+  return nodeCryptoPromise;
+}
+function hasSubtleCrypto() {
+  return typeof globalThis.crypto?.subtle?.importKey === "function";
+}
+async function computeHmacHex(secret, payload) {
+  if (hasSubtleCrypto()) {
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey(
+      "raw",
+      encoder.encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(payload));
+    return bufferToHex(signature);
+  }
+  const nodeCrypto = await loadNodeCrypto();
+  if (!nodeCrypto) {
+    throw new Error("Crypto implementation unavailable for HMAC computation");
+  }
+  return nodeCrypto.createHmac("sha256", secret).update(payload).digest("hex");
+}
+async function timingSafeEqualHex(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  const nodeCrypto = await loadNodeCrypto();
+  if (nodeCrypto?.timingSafeEqual) {
+    const aBuf = Buffer.from(a, "hex");
+    const bBuf = Buffer.from(b, "hex");
+    try {
+      return nodeCrypto.timingSafeEqual(aBuf, bBuf);
+    } catch {
+      return false;
+    }
+  }
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+
+// src/server/auth/betterAuth.ts
+import { betterAuth } from "better-auth";
+import { organization, twoFactor } from "better-auth/plugins";
+function createDeepSpaceAuth(config) {
+  const socialProviders = {};
+  if (config.google) {
+    socialProviders.google = config.google;
+  }
+  if (config.github) {
+    socialProviders.github = config.github;
+  }
+  return betterAuth({
+    database: config.database,
+    baseURL: config.baseURL,
+    secret: config.secret,
+    emailAndPassword: {
+      enabled: config.emailAndPassword ?? true
+    },
+    socialProviders,
+    trustedOrigins: config.trustedOrigins ?? [
+      "https://deep.space",
+      "https://*.deep.space",
+      "https://*.app.space",
+      "http://localhost:*"
+    ],
+    plugins: [organization(), twoFactor()]
+  });
+}
+
 // src/shared/subscription.ts
 var ENTITLED_STATUSES = /* @__PURE__ */ new Set([
   "active",
@@ -6243,11 +6856,11 @@ export {
   CronRoom,
   DEFAULT_CONTEXT_CONFIG,
   DEFAULT_DO_MANIFEST,
-  DEFAULT_MAX_SKEW_MS,
   DIRECTORY_SCHEMAS,
   GLOBAL_DO_TYPES,
   GLOBAL_DO_TYPE_NAMES,
   GameRoom,
+  JobRoom,
   MESSAGES_SCHEMA,
   PresenceRoom,
   REACTIONS_SCHEMA,
@@ -6274,7 +6887,6 @@ export {
   broadcastChange,
   broadcastYjsUpdate,
   buildCronContext,
-  buildInternalPayload,
   buildTableSelect,
   buildUiParts,
   canCreate,
@@ -6298,6 +6910,7 @@ export {
   decodeJwtPayload,
   deleteChatCascade,
   deleteRecord,
+  enqueueJob,
   executeQuery,
   getAllUsers,
   getChat,
@@ -6344,7 +6957,6 @@ export {
   rowToData,
   runMigrations,
   saveYjsDoc,
-  signInternalPayload,
   timingSafeEqualHex,
   totalChars,
   truncateOldToolResults,
@@ -6354,7 +6966,6 @@ export {
   validateAppName,
   validateBindingManifest,
   validateDoManifest,
-  verifyInternalSignature,
   verifyJwt,
   workspaceAccountsSchema,
   workspaceContentSharesSchema,