deepspace 0.3.11 → 0.4.0

package/dist/worker.js

@@ -206,6 +206,13 @@ var MSG = {
   USER_LIST: "user.list",
   SET_ROLE: "user.set_role",
   USER_UPDATE: "user.update",
+  // ---- Auth signal -----------------------------------------------------
+  // Server → client one-shot on connect from rooms that enforce role-based
+  // writes (Canvas, Game, Cron). Tells the client whether this connection
+  // can write so its hook can disable local write APIs and the UI can
+  // render controls accordingly. Without this, a viewer's click would
+  // round-trip to the server and silently come back as ERROR.
+  AUTH: "auth",
   // ---- Yjs JSON control frames (binary sync lives in ./yjs.ts) ---------
   YJS_JOIN: "yjs.join",
   YJS_LEAVE: "yjs.leave",
@@ -3294,7 +3301,20 @@ var YjsRoom = class extends BaseRoom {
   }
 };
 
+// src/shared/roles.ts
+var ROLES = {
+  VIEWER: "viewer",
+  MEMBER: "member",
+  ADMIN: "admin"
+};
+
 // src/server/rooms/game-room.ts
+var GAME_WRITE_TYPES = /* @__PURE__ */ new Set([
+  MSG.GAME_INPUT,
+  MSG.GAME_PLAYER_READY,
+  MSG.GAME_START,
+  MSG.GAME_END
+]);
 var GameRoom = class extends BaseRoom {
   config;
   players = /* @__PURE__ */ new Map();
@@ -3350,10 +3370,26 @@ var GameRoom = class extends BaseRoom {
   // ==========================================================================
   onConnect(ws, user) {
     this.ensureInitialized();
+    const role = user.role ?? ROLES.VIEWER;
+    const canWrite = role === ROLES.MEMBER || role === ROLES.ADMIN;
     const attachment = {
       ...user,
-      joinedAt: (/* @__PURE__ */ new Date()).toISOString()
+      joinedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      canWrite
     };
+    this.sendTo(ws, { type: MSG.AUTH, payload: { canWrite } });
+    if (!canWrite) {
+      this.sendTo(ws, {
+        type: MSG.GAME_STATE,
+        payload: {
+          state: this.gameState,
+          tick: this.currentTick,
+          players: Array.from(this.players.values()),
+          running: this.running
+        }
+      });
+      return attachment;
+    }
     const player = {
       userId: user.userId,
       userName: user.userName,
@@ -3382,6 +3418,13 @@ var GameRoom = class extends BaseRoom {
   async onMessage(ws, user, message) {
     this.ensureInitialized();
     const { type, payload } = message;
+    if (GAME_WRITE_TYPES.has(type) && !user.canWrite) {
+      this.sendTo(ws, {
+        type: MSG.ERROR,
+        payload: { error: "Write access denied: spectators cannot drive the game" }
+      });
+      return;
+    }
     switch (type) {
       case MSG.GAME_INPUT: {
         this.inputBuffer.push({
@@ -3530,6 +3573,15 @@ var GameRoom = class extends BaseRoom {
 
 // src/server/rooms/canvas-room.ts
 import * as Y5 from "yjs";
+var CANVAS_WRITE_TYPES = /* @__PURE__ */ new Set([
+  MSG.CANVAS_ADD,
+  MSG.CANVAS_MOVE,
+  MSG.CANVAS_RESIZE,
+  MSG.CANVAS_DELETE,
+  MSG.CANVAS_UPDATE,
+  MSG.CANVAS_UNDO,
+  MSG.CANVAS_REDO
+]);
 var CanvasRoom = class extends BaseRoom {
   doc = null;
   initialized = false;
@@ -3589,10 +3641,14 @@ var CanvasRoom = class extends BaseRoom {
   }
   onConnect(ws, user) {
     this.ensureInitialized();
+    const role = user.role ?? ROLES.VIEWER;
+    const canWrite = role === ROLES.MEMBER || role === ROLES.ADMIN;
     const attachment = {
       ...user,
-      viewport: null
+      viewport: null,
+      canWrite
     };
+    this.sendTo(ws, { type: MSG.AUTH, payload: { canWrite } });
     const shapes = this.getAllShapes();
     this.sendTo(ws, {
       type: MSG.CANVAS_SHAPES,
@@ -3606,6 +3662,13 @@ var CanvasRoom = class extends BaseRoom {
   async onMessage(ws, user, message) {
     this.ensureInitialized();
     const { type, payload } = message;
+    if (CANVAS_WRITE_TYPES.has(type) && !user.canWrite) {
+      this.sendTo(ws, {
+        type: MSG.ERROR,
+        payload: { error: "Write access denied: viewer role cannot modify the canvas" }
+      });
+      return;
+    }
     switch (type) {
       case MSG.CANVAS_ADD: {
         const shape = payload;
@@ -3900,6 +3963,11 @@ var PresenceRoom = class extends BaseRoom {
 };
 
 // src/server/rooms/cron-room.ts
+var CRON_WRITE_TYPES = /* @__PURE__ */ new Set([
+  MSG.CRON_TRIGGER,
+  MSG.CRON_PAUSE,
+  MSG.CRON_RESUME
+]);
 var CronRoom = class extends BaseRoom {
   tasks;
   initialized = false;
@@ -3978,6 +4046,9 @@ var CronRoom = class extends BaseRoom {
   }
   onConnect(ws, user) {
     this.ensureInitialized();
+    const role = user.role ?? ROLES.VIEWER;
+    const canWrite = role === ROLES.MEMBER || role === ROLES.ADMIN;
+    this.sendTo(ws, { type: MSG.AUTH, payload: { canWrite } });
     this.sendTo(ws, {
       type: MSG.CRON_TASKS,
       payload: { tasks: this.getTaskStates() }
@@ -3986,11 +4057,18 @@ var CronRoom = class extends BaseRoom {
       type: MSG.CRON_HISTORY,
       payload: { history: this.getRecentHistory(50) }
     });
-    return user;
+    return { ...user, canWrite };
   }
   async onMessage(ws, user, message) {
     this.ensureInitialized();
     const { type, payload } = message;
+    if (CRON_WRITE_TYPES.has(type) && !user.canWrite) {
+      this.sendTo(ws, {
+        type: MSG.ERROR,
+        payload: { error: "Write access denied: viewer role cannot modify cron tasks" }
+      });
+      return;
+    }
     switch (type) {
       case MSG.CRON_TRIGGER: {
         const taskName = payload.taskName;
@@ -4918,7 +4996,6 @@ var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
   "AUTH_WORKER_URL",
   "APP_IDENTITY_TOKEN",
   "APP_OWNER_JWT",
-  "INTERNAL_STORAGE_HMAC_SECRET",
   "USAGE_EVENTS"
 ]);
 function validateBindingManifest(manifest) {
@@ -5752,6 +5829,11 @@ var RESERVED_COLLECTION_NAMES = new Set(
 
 // src/server/utils/scoped-r2-files.ts
 var CORS_HEADERS3 = { "Access-Control-Allow-Origin": "*" };
+function contentDisposition(originalName) {
+  const safe = originalName.replace(/[\x00-\x1f\x7f"\\]/g, "_") || "download";
+  const encoded = encodeURIComponent(originalName);
+  return `inline; filename="${safe}"; filename*=UTF-8''${encoded}`;
+}
 function sanitizeSubpath(raw) {
   if (!raw) return "";
   const segments = raw.split("/");
@@ -5939,418 +6021,162 @@ async function handleDownload(bucket, key) {
   headers.set("Cache-Control", "public, max-age=31536000, immutable");
   headers.set("Access-Control-Allow-Origin", "*");
   if (object.customMetadata?.originalName) {
-    headers.set("Content-Disposition", `inline; filename="${object.customMetadata.originalName}"`);
+    headers.set("Content-Disposition", contentDisposition(object.customMetadata.originalName));
   }
   return new Response(object.body, { headers });
 }
 
-// src/server/auth/jwtVerifier.ts
-import { importSPKI, jwtVerify } from "jose";
-
-// src/server/auth/utils.ts
-var BASE64_URL_REGEX = /^[A-Za-z0-9-_]+$/;
-function bufferToHex(bytes) {
-  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
-  let hex = "";
-  for (const byte of view) {
-    hex += byte.toString(16).padStart(2, "0");
+// src/server/utils/proxies.ts
+function resolveApiTransport(env) {
+  if (env.API_WORKER) return { kind: "binding", fetcher: env.API_WORKER };
+  if (env.API_WORKER_URL) {
+    return { kind: "url", baseUrl: env.API_WORKER_URL.replace(/\/$/, "") };
   }
-  return hex;
+  throw new Error(
+    "apiWorkerFetch: neither env.API_WORKER nor env.API_WORKER_URL is set. Add a [[services]] binding in wrangler.toml for production, or let `deepspace dev` write API_WORKER_URL into .dev.vars for local development."
+  );
 }
-function normalizeArray(value) {
-  if (value == null) return void 0;
-  if (Array.isArray(value)) {
-    return value.length ? value : void 0;
+function resolvePlatformTransport(env) {
+  if (env.PLATFORM_WORKER) return { kind: "binding", fetcher: env.PLATFORM_WORKER };
+  if (env.PLATFORM_WORKER_URL) {
+    return { kind: "url", baseUrl: env.PLATFORM_WORKER_URL.replace(/\/$/, "") };
   }
-  return [value];
+  throw new Error(
+    "platformWorkerFetch: neither env.PLATFORM_WORKER nor env.PLATFORM_WORKER_URL is set. Add a [[services]] binding in wrangler.toml for production, or let `deepspace dev` write PLATFORM_WORKER_URL into .dev.vars for local development."
+  );
 }
-function decodeJwtPayload(token) {
-  if (!token) return void 0;
-  const parts = token.split(".");
-  if (parts.length < 2) return void 0;
-  const payloadSegment = parts[1];
-  if (!payloadSegment) return void 0;
-  if (!BASE64_URL_REGEX.test(payloadSegment)) return void 0;
-  try {
-    const normalized = payloadSegment.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payloadSegment.length / 4) * 4, "=");
-    const bytes = base64ToUint8Array(normalized);
-    const json = new TextDecoder().decode(bytes);
-    const payload = JSON.parse(json);
-    return {
-      iss: payload.iss ?? null,
-      aud: payload.aud ?? null,
-      azp: payload?.azp ?? null,
-      exp: payload.exp ?? null,
-      iat: payload.iat ?? null
-    };
-  } catch {
-    return void 0;
+function buildTargetUrl(transport, path, internalHost) {
+  let pathAndSearch;
+  if (path.startsWith("http://") || path.startsWith("https://")) {
+    const u = new URL(path);
+    pathAndSearch = u.pathname + u.search;
+  } else if (path.startsWith("/")) {
+    pathAndSearch = path;
+  } else {
+    pathAndSearch = "/" + path;
+  }
+  if (transport.kind === "binding") {
+    return `https://${internalHost}${pathAndSearch}`;
   }
+  return `${transport.baseUrl}${pathAndSearch}`;
 }
-function nowMs() {
-  return Date.now();
+function apiWorkerFetch(env, path, init) {
+  const transport = resolveApiTransport(env);
+  const url = buildTargetUrl(transport, path, "api-worker");
+  if (transport.kind === "binding") {
+    return transport.fetcher.fetch(url, init);
+  }
+  return fetch(url, init);
 }
-function base64ToUint8Array(value) {
-  if (typeof atob === "function") {
-    const binary = atob(value);
-    const out = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i += 1) {
-      out[i] = binary.charCodeAt(i);
+function platformWorkerFetch(env, pathOrRequest, init) {
+  const transport = resolvePlatformTransport(env);
+  if (typeof pathOrRequest === "string") {
+    const url2 = buildTargetUrl(transport, pathOrRequest, "platform-worker");
+    if (transport.kind === "binding") {
+      return transport.fetcher.fetch(url2, init);
     }
-    return out;
+    return fetch(url2, init);
   }
-  if (typeof Buffer !== "undefined") {
-    return Uint8Array.from(Buffer.from(value, "base64"));
+  const req = pathOrRequest;
+  const url = buildTargetUrl(transport, req.url, "platform-worker");
+  const rewritten = new Request(url, req);
+  if (transport.kind === "binding") {
+    return transport.fetcher.fetch(rewritten);
   }
-  throw new Error("No base64 decoder available in current environment");
+  return fetch(rewritten);
 }
-
-// src/server/auth/jwtVerifier.ts
-var DEFAULT_CLOCK_SKEW_MS = 5e3;
-function matchesAuthorizedParty(azp, patterns) {
-  if (!azp) return true;
-  for (const pattern of patterns) {
-    if (pattern === azp) return true;
-    if (pattern.includes("*")) {
-      const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
-      const regexPattern = escaped.replace(/\*/g, "[^/]*");
-      const regex = new RegExp(`^${regexPattern}$`);
-      if (regex.test(azp)) return true;
-      if (pattern.includes("*.")) {
-        const rootPattern = pattern.replace("*.", "");
-        if (rootPattern === azp) return true;
-      }
-    }
+function authWorkerFetch(env, path, init) {
+  if (!env.AUTH_WORKER_URL) {
+    throw new Error(
+      "authWorkerFetch: env.AUTH_WORKER_URL is not set. `deepspace dev` should write this into .dev.vars; for production, set it as a wrangler var or secret."
+    );
   }
-  return false;
-}
-var keyCache = /* @__PURE__ */ new Map();
-async function getPublicKey(pem) {
-  const cached = keyCache.get(pem);
-  if (cached) return cached;
-  const normalized = pem.replace(/\\n/g, "\n");
-  const key = await importSPKI(normalized, "ES256");
-  keyCache.set(pem, key);
-  return key;
+  const baseUrl = env.AUTH_WORKER_URL.replace(/\/$/, "");
+  let pathAndSearch;
+  if (path.startsWith("http://") || path.startsWith("https://")) {
+    const u = new URL(path);
+    pathAndSearch = u.pathname + u.search;
+  } else if (path.startsWith("/")) {
+    pathAndSearch = path;
+  } else {
+    pathAndSearch = "/" + path;
+  }
+  return fetch(`${baseUrl}${pathAndSearch}`, init);
 }
-async function verifyJwt(config, token) {
-  if (!token) {
-    return { result: null };
+
+// src/server/utils/cron.ts
+function buildCronContext(env, ownerUserId, roomId = "default") {
+  const roomIdObj = env.RECORD_ROOMS.idFromName(roomId);
+  const room = env.RECORD_ROOMS.get(roomIdObj);
+  async function executeTool3(tool, params) {
+    const response = await room.fetch(new Request("https://internal/api/tools/execute", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-User-Id": ownerUserId,
+        "X-App-Action": "true"
+      },
+      body: JSON.stringify({ tool, params })
+    }));
+    const result = await response.json();
+    if (!result.success) {
+      throw new Error(`RecordRoom tool ${tool} failed: ${result.error || "Unknown error"}`);
+    }
+    return result.data;
   }
-  try {
-    const publicKey = await getPublicKey(config.publicKey);
-    const audience = normalizeArray(config.audience);
-    const clockTolerance = Math.floor(
-      (config.clockSkewMs ?? DEFAULT_CLOCK_SKEW_MS) / 1e3
-    );
-    const { payload } = await jwtVerify(token, publicKey, {
-      issuer: config.issuer,
-      audience: audience && audience.length === 1 ? audience[0] : audience,
-      clockTolerance
-    });
-    const claims = payload;
-    if (!claims.sub) {
-      throw new Error("JWT verification succeeded but subject claim is missing");
+  const records = {
+    async query(collection, opts) {
+      const params = { collection };
+      if (opts?.where) params.where = opts.where;
+      if (opts?.limit) params.limit = opts.limit;
+      const data = await executeTool3("records.query", params);
+      return data.records || [];
+    },
+    async create(collection, data) {
+      return executeTool3("records.create", { collection, data });
+    },
+    async update(collection, recordId, data) {
+      return executeTool3("records.update", { collection, recordId, data });
+    },
+    async delete(collection, recordId) {
+      return executeTool3("records.delete", { collection, recordId });
     }
-    const authorizedParties = normalizeArray(config.authorizedParties);
-    if (authorizedParties) {
-      const azp = claims.azp;
-      if (!matchesAuthorizedParty(azp, authorizedParties)) {
+  };
+  const integrations = {
+    async call(endpoint, params = {}) {
+      if (!env.APP_OWNER_JWT) {
         throw new Error(
-          `Authorized party '${azp}' does not match any allowed pattern`
+          "integrations.call requires env.APP_OWNER_JWT. Deployed apps receive this automatically; in dev, `deepspace dev` writes it into .dev.vars."
         );
       }
-    }
-    return {
-      result: {
-        userId: claims.sub,
-        claims
+      const response = await apiWorkerFetch(env, `/api/integrations/${endpoint}`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${env.APP_OWNER_JWT}`
+        },
+        body: JSON.stringify(params)
+      });
+      const text = await response.text();
+      let result = {};
+      try {
+        result = text ? JSON.parse(text) : {};
+      } catch {
       }
-    };
-  } catch (error) {
-    return {
-      result: null,
-      error,
-      debug: decodeJwtPayload(token)
-    };
-  }
-}
-
-// src/server/auth/internalAuth.ts
-var DEFAULT_MAX_SKEW_MS = 5 * 6e4;
-var nodeCryptoPromise = null;
-async function loadNodeCrypto() {
-  if (!nodeCryptoPromise) {
-    nodeCryptoPromise = import("crypto").then((module) => module).catch(() => null);
-  }
-  return nodeCryptoPromise;
-}
-function hasSubtleCrypto() {
-  return typeof globalThis.crypto?.subtle?.importKey === "function";
-}
-async function computeHmacHex(secret, payload) {
-  if (hasSubtleCrypto()) {
-    const encoder = new TextEncoder();
-    const key = await crypto.subtle.importKey(
-      "raw",
-      encoder.encode(secret),
-      { name: "HMAC", hash: "SHA-256" },
-      false,
-      ["sign"]
-    );
-    const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(payload));
-    return bufferToHex(signature);
-  }
-  const nodeCrypto = await loadNodeCrypto();
-  if (!nodeCrypto) {
-    throw new Error("Crypto implementation unavailable for HMAC computation");
-  }
-  return nodeCrypto.createHmac("sha256", secret).update(payload).digest("hex");
-}
-async function timingSafeEqualHex(a, b) {
-  if (a.length !== b.length) {
-    return false;
-  }
-  const nodeCrypto = await loadNodeCrypto();
-  if (nodeCrypto?.timingSafeEqual) {
-    const aBuf = Buffer.from(a, "hex");
-    const bBuf = Buffer.from(b, "hex");
-    try {
-      return nodeCrypto.timingSafeEqual(aBuf, bBuf);
-    } catch {
-      return false;
-    }
-  }
-  let diff = 0;
-  for (let i = 0; i < a.length; i += 1) {
-    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return diff === 0;
-}
-async function signInternalPayload({
-  secret,
-  payload,
-  timestamp
-}) {
-  const ts = timestamp ?? nowMs().toString();
-  const signature = await computeHmacHex(secret, `${ts}.${payload}`);
-  return { timestamp: ts, signature };
-}
-async function verifyInternalSignature({
-  secret,
-  timestamp,
-  signature,
-  payload,
-  maxSkewMs = DEFAULT_MAX_SKEW_MS
-}) {
-  if (!secret || !timestamp || !signature) {
-    return false;
-  }
-  const tsNumber = Number(timestamp);
-  if (!Number.isFinite(tsNumber)) {
-    return false;
-  }
-  const skew = Math.abs(nowMs() - tsNumber);
-  if (skew > maxSkewMs) {
-    return false;
-  }
-  const expected = await computeHmacHex(secret, `${timestamp}.${payload}`);
-  return timingSafeEqualHex(signature.toLowerCase(), expected.toLowerCase());
-}
-function buildInternalPayload(body) {
-  if (body === void 0) return "{}";
-  if (typeof body === "string") return body;
-  try {
-    return JSON.stringify(body);
-  } catch {
-    return "{}";
-  }
-}
-
-// src/server/auth/betterAuth.ts
-import { betterAuth } from "better-auth";
-import { organization, twoFactor } from "better-auth/plugins";
-function createDeepSpaceAuth(config) {
-  const socialProviders = {};
-  if (config.google) {
-    socialProviders.google = config.google;
-  }
-  if (config.github) {
-    socialProviders.github = config.github;
-  }
-  return betterAuth({
-    database: config.database,
-    baseURL: config.baseURL,
-    secret: config.secret,
-    emailAndPassword: {
-      enabled: config.emailAndPassword ?? true
-    },
-    socialProviders,
-    trustedOrigins: config.trustedOrigins ?? [
-      "https://deep.space",
-      "https://*.deep.space",
-      "https://*.app.space",
-      "http://localhost:*"
-    ],
-    plugins: [organization(), twoFactor()]
-  });
-}
-
-// src/server/utils/cron.ts
-var DEFAULT_API_BASE_URL = "https://api-worker.deep.space";
-function buildCronContext(env, ownerUserId, roomId = "default") {
-  const hmacSecret = env.INTERNAL_STORAGE_HMAC_SECRET;
-  const apiBase = env.API_BASE_URL || DEFAULT_API_BASE_URL;
-  const roomIdObj = env.RECORD_ROOMS.idFromName(roomId);
-  const room = env.RECORD_ROOMS.get(roomIdObj);
-  async function executeTool3(tool, params) {
-    const response = await room.fetch(new Request("https://internal/api/tools/execute", {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "X-User-Id": ownerUserId,
-        "X-App-Action": "true"
-      },
-      body: JSON.stringify({ tool, params })
-    }));
-    const result = await response.json();
-    if (!result.success) {
-      throw new Error(`RecordRoom tool ${tool} failed: ${result.error || "Unknown error"}`);
-    }
-    return result.data;
-  }
-  const records = {
-    async query(collection, opts) {
-      const params = { collection };
-      if (opts?.where) params.where = opts.where;
-      if (opts?.limit) params.limit = opts.limit;
-      const data = await executeTool3("records.query", params);
-      return data.records || [];
-    },
-    async create(collection, data) {
-      return executeTool3("records.create", { collection, data });
-    },
-    async update(collection, recordId, data) {
-      return executeTool3("records.update", { collection, recordId, data });
-    },
-    async delete(collection, recordId) {
-      return executeTool3("records.delete", { collection, recordId });
-    }
-  };
-  const integrations = {
-    async call(endpoint, params) {
-      if (!hmacSecret) {
-        throw new Error("INTERNAL_STORAGE_HMAC_SECRET not configured \u2014 cannot call integrations");
-      }
-      const payload = { userId: ownerUserId, ...params };
-      const payloadStr = buildInternalPayload(payload);
-      const { timestamp, signature } = await signInternalPayload({
-        secret: hmacSecret,
-        payload: payloadStr
-      });
-      const response = await fetch(`${apiBase}/api/internal/integrations/${endpoint}`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "x-internal-timestamp": timestamp,
-          "x-internal-signature": signature
-        },
-        body: payloadStr
-      });
-      if (!response.ok) {
-        const errText = await response.text();
-        throw new Error(`Integration call ${endpoint} failed (${response.status}): ${errText}`);
-      }
-      return response.json();
-    }
-  };
-  return { records, integrations, ownerUserId };
+      if (!response.ok || !result.success) {
+        const detail = result.message || result.error || text || `HTTP ${response.status}`;
+        throw new Error(`Integration call ${endpoint} failed: ${detail}`);
+      }
+      return result.data;
+    }
+  };
+  return { records, integrations, ownerUserId };
 }
 
 // src/server/utils/ai.ts
 import { createAnthropic } from "@ai-sdk/anthropic";
 import { createOpenAI } from "@ai-sdk/openai";
 import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
-
-// src/server/utils/proxies.ts
-function resolveApiTransport(env) {
-  if (env.API_WORKER) return { kind: "binding", fetcher: env.API_WORKER };
-  if (env.API_WORKER_URL) {
-    return { kind: "url", baseUrl: env.API_WORKER_URL.replace(/\/$/, "") };
-  }
-  throw new Error(
-    "apiWorkerFetch: neither env.API_WORKER nor env.API_WORKER_URL is set. Add a [[services]] binding in wrangler.toml for production, or let `deepspace dev` write API_WORKER_URL into .dev.vars for local development."
-  );
-}
-function resolvePlatformTransport(env) {
-  if (env.PLATFORM_WORKER) return { kind: "binding", fetcher: env.PLATFORM_WORKER };
-  if (env.PLATFORM_WORKER_URL) {
-    return { kind: "url", baseUrl: env.PLATFORM_WORKER_URL.replace(/\/$/, "") };
-  }
-  throw new Error(
-    "platformWorkerFetch: neither env.PLATFORM_WORKER nor env.PLATFORM_WORKER_URL is set. Add a [[services]] binding in wrangler.toml for production, or let `deepspace dev` write PLATFORM_WORKER_URL into .dev.vars for local development."
-  );
-}
-function buildTargetUrl(transport, path, internalHost) {
-  let pathAndSearch;
-  if (path.startsWith("http://") || path.startsWith("https://")) {
-    const u = new URL(path);
-    pathAndSearch = u.pathname + u.search;
-  } else if (path.startsWith("/")) {
-    pathAndSearch = path;
-  } else {
-    pathAndSearch = "/" + path;
-  }
-  if (transport.kind === "binding") {
-    return `https://${internalHost}${pathAndSearch}`;
-  }
-  return `${transport.baseUrl}${pathAndSearch}`;
-}
-function apiWorkerFetch(env, path, init) {
-  const transport = resolveApiTransport(env);
-  const url = buildTargetUrl(transport, path, "api-worker");
-  if (transport.kind === "binding") {
-    return transport.fetcher.fetch(url, init);
-  }
-  return fetch(url, init);
-}
-function platformWorkerFetch(env, pathOrRequest, init) {
-  const transport = resolvePlatformTransport(env);
-  if (typeof pathOrRequest === "string") {
-    const url2 = buildTargetUrl(transport, pathOrRequest, "platform-worker");
-    if (transport.kind === "binding") {
-      return transport.fetcher.fetch(url2, init);
-    }
-    return fetch(url2, init);
-  }
-  const req = pathOrRequest;
-  const url = buildTargetUrl(transport, req.url, "platform-worker");
-  const rewritten = new Request(url, req);
-  if (transport.kind === "binding") {
-    return transport.fetcher.fetch(rewritten);
-  }
-  return fetch(rewritten);
-}
-function authWorkerFetch(env, path, init) {
-  if (!env.AUTH_WORKER_URL) {
-    throw new Error(
-      "authWorkerFetch: env.AUTH_WORKER_URL is not set. `deepspace dev` should write this into .dev.vars; for production, set it as a wrangler var or secret."
-    );
-  }
-  const baseUrl = env.AUTH_WORKER_URL.replace(/\/$/, "");
-  let pathAndSearch;
-  if (path.startsWith("http://") || path.startsWith("https://")) {
-    const u = new URL(path);
-    pathAndSearch = u.pathname + u.search;
-  } else if (path.startsWith("/")) {
-    pathAndSearch = path;
-  } else {
-    pathAndSearch = "/" + path;
-  }
-  return fetch(`${baseUrl}${pathAndSearch}`, init);
-}
-
-// src/server/utils/ai.ts
 var ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS = 4096;
 function withDefaultAnthropicMaxTokens(body) {
   if (typeof body !== "string") return body;
@@ -6944,6 +6770,215 @@ async function runMigrations(db, migrations) {
 function splitStatements(sql) {
   return sql.split(";").map((s) => s.trim()).filter((s) => s.length > 0);
 }
+
+// src/server/auth/jwtVerifier.ts
+import { importSPKI, jwtVerify } from "jose";
+
+// src/server/auth/utils.ts
+var BASE64_URL_REGEX = /^[A-Za-z0-9-_]+$/;
+function bufferToHex(bytes) {
+  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let hex = "";
+  for (const byte of view) {
+    hex += byte.toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+function normalizeArray(value) {
+  if (value == null) return void 0;
+  if (Array.isArray(value)) {
+    return value.length ? value : void 0;
+  }
+  return [value];
+}
+function decodeJwtPayload(token) {
+  if (!token) return void 0;
+  const parts = token.split(".");
+  if (parts.length < 2) return void 0;
+  const payloadSegment = parts[1];
+  if (!payloadSegment) return void 0;
+  if (!BASE64_URL_REGEX.test(payloadSegment)) return void 0;
+  try {
+    const normalized = payloadSegment.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payloadSegment.length / 4) * 4, "=");
+    const bytes = base64ToUint8Array(normalized);
+    const json = new TextDecoder().decode(bytes);
+    const payload = JSON.parse(json);
+    return {
+      iss: payload.iss ?? null,
+      aud: payload.aud ?? null,
+      azp: payload?.azp ?? null,
+      exp: payload.exp ?? null,
+      iat: payload.iat ?? null
+    };
+  } catch {
+    return void 0;
+  }
+}
+function base64ToUint8Array(value) {
+  if (typeof atob === "function") {
+    const binary = atob(value);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1) {
+      out[i] = binary.charCodeAt(i);
+    }
+    return out;
+  }
+  if (typeof Buffer !== "undefined") {
+    return Uint8Array.from(Buffer.from(value, "base64"));
+  }
+  throw new Error("No base64 decoder available in current environment");
+}
+
+// src/server/auth/jwtVerifier.ts
+var DEFAULT_CLOCK_SKEW_MS = 5e3;
+function matchesAuthorizedParty(azp, patterns) {
+  if (!azp) return true;
+  for (const pattern of patterns) {
+    if (pattern === azp) return true;
+    if (pattern.includes("*")) {
+      const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+      const regexPattern = escaped.replace(/\*/g, "[^/]*");
+      const regex = new RegExp(`^${regexPattern}$`);
+      if (regex.test(azp)) return true;
+      if (pattern.includes("*.")) {
+        const rootPattern = pattern.replace("*.", "");
+        if (rootPattern === azp) return true;
+      }
+    }
+  }
+  return false;
+}
+var keyCache = /* @__PURE__ */ new Map();
+async function getPublicKey(pem) {
+  const cached = keyCache.get(pem);
+  if (cached) return cached;
+  const normalized = pem.replace(/\\n/g, "\n");
+  const key = await importSPKI(normalized, "ES256");
+  keyCache.set(pem, key);
+  return key;
+}
+async function verifyJwt(config, token) {
+  if (!token) {
+    return { result: null };
+  }
+  try {
+    const publicKey = await getPublicKey(config.publicKey);
+    const audience = normalizeArray(config.audience);
+    const clockTolerance = Math.floor(
+      (config.clockSkewMs ?? DEFAULT_CLOCK_SKEW_MS) / 1e3
+    );
+    const { payload } = await jwtVerify(token, publicKey, {
+      issuer: config.issuer,
+      audience: audience && audience.length === 1 ? audience[0] : audience,
+      clockTolerance
+    });
+    const claims = payload;
+    if (!claims.sub) {
+      throw new Error("JWT verification succeeded but subject claim is missing");
+    }
+    const authorizedParties = normalizeArray(config.authorizedParties);
+    if (authorizedParties) {
+      const azp = claims.azp;
+      if (!matchesAuthorizedParty(azp, authorizedParties)) {
+        throw new Error(
+          `Authorized party '${azp}' does not match any allowed pattern`
+        );
+      }
+    }
+    return {
+      result: {
+        userId: claims.sub,
+        claims
+      }
+    };
+  } catch (error) {
+    return {
+      result: null,
+      error,
+      debug: decodeJwtPayload(token)
+    };
+  }
+}
+
+// src/server/auth/internalAuth.ts
+var nodeCryptoPromise = null;
+async function loadNodeCrypto() {
+  if (!nodeCryptoPromise) {
+    nodeCryptoPromise = import("crypto").then((module) => module).catch(() => null);
+  }
+  return nodeCryptoPromise;
+}
+function hasSubtleCrypto() {
+  return typeof globalThis.crypto?.subtle?.importKey === "function";
+}
+async function computeHmacHex(secret, payload) {
+  if (hasSubtleCrypto()) {
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey(
+      "raw",
+      encoder.encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(payload));
+    return bufferToHex(signature);
+  }
+  const nodeCrypto = await loadNodeCrypto();
+  if (!nodeCrypto) {
+    throw new Error("Crypto implementation unavailable for HMAC computation");
+  }
+  return nodeCrypto.createHmac("sha256", secret).update(payload).digest("hex");
+}
+async function timingSafeEqualHex(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  const nodeCrypto = await loadNodeCrypto();
+  if (nodeCrypto?.timingSafeEqual) {
+    const aBuf = Buffer.from(a, "hex");
+    const bBuf = Buffer.from(b, "hex");
+    try {
+      return nodeCrypto.timingSafeEqual(aBuf, bBuf);
+    } catch {
+      return false;
+    }
+  }
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+
+// src/server/auth/betterAuth.ts
+import { betterAuth } from "better-auth";
+import { organization, twoFactor } from "better-auth/plugins";
+function createDeepSpaceAuth(config) {
+  const socialProviders = {};
+  if (config.google) {
+    socialProviders.google = config.google;
+  }
+  if (config.github) {
+    socialProviders.github = config.github;
+  }
+  return betterAuth({
+    database: config.database,
+    baseURL: config.baseURL,
+    secret: config.secret,
+    emailAndPassword: {
+      enabled: config.emailAndPassword ?? true
+    },
+    socialProviders,
+    trustedOrigins: config.trustedOrigins ?? [
+      "https://deep.space",
+      "https://*.deep.space",
+      "https://*.app.space",
+      "http://localhost:*"
+    ],
+    plugins: [organization(), twoFactor()]
+  });
+}
 export {
   AI_CHATS_SCHEMA,
   AI_MESSAGES_SCHEMA,
@@ -6964,7 +6999,6 @@ export {
   CronRoom,
   DEFAULT_CONTEXT_CONFIG,
   DEFAULT_DO_MANIFEST,
-  DEFAULT_MAX_SKEW_MS,
   DIRECTORY_SCHEMAS,
   GLOBAL_DO_TYPES,
   GLOBAL_DO_TYPE_NAMES,
@@ -7002,7 +7036,6 @@ export {
   authWorkerFetch,
   bindingManifestFromOutputConfig,
   buildCronContext,
-  buildInternalPayload,
   buildTableSelect,
   buildUiParts,
   canCreate,
@@ -7061,7 +7094,6 @@ export {
   rowToData,
   runMigrations,
   serverBuild,
-  signInternalPayload,
   timingSafeEqualHex,
   toUint8Array,
   totalChars,
@@ -7072,7 +7104,6 @@ export {
   validateAppName,
   validateBindingManifest,
   validateDoManifest,
-  verifyInternalSignature,
   verifyJwt,
   workspaceAccountsSchema,
   workspaceContentSharesSchema,