deepspace 0.4.2 → 0.4.4

package/dist/server.js

@@ -1,15 +1,22 @@
 // src/server/utils/tools.ts
+var DEFAULT_QUERY_LIMIT = 50;
+function applyAiToolDefaults(toolName, params) {
+  if (toolName === "records.query" && params.limit === void 0) {
+    return { ...params, limit: DEFAULT_QUERY_LIMIT };
+  }
+  return params;
+}
 var BUILT_IN_TOOLS = [
   // Record tools (structured collections with RBAC)
   {
     name: "records.query",
-    description: "Query records from a collection with optional filtering, ordering, and limits",
+    description: `Query records from a collection with optional filtering, ordering, and pagination. Returns at most \`limit\` records (default ${DEFAULT_QUERY_LIMIT}). Large result sets are capped at ~30KB: an oversized page is truncated to the leading records that fit and flagged with \`{ truncated, returned, total }\`, so narrow with a \`where\` filter (or page via \`orderBy\` + \`limit\`) to see the rest.`,
     params: {
       collection: { type: "string", description: "Collection name to query", required: true },
       where: { type: "object", description: "Filter object with field=value equality conditions", required: false },
       orderBy: { type: "string", description: 'Field to order by (or "createdAt"/"updatedAt")', required: false },
       orderDir: { type: "string", description: 'Order direction: "asc" or "desc" (default: "desc")', required: false },
-      limit: { type: "number", description: "Maximum number of records to return", required: false }
+      limit: { type: "number", description: `Maximum number of records to return (default: ${DEFAULT_QUERY_LIMIT}). Oversized pages are still capped at ~30KB and truncated with returned/total flags.`, required: false }
     }
   },
   {
@@ -446,7 +453,7 @@ function authWorkerFetch(env, path, init) {
 function buildCronContext(env, ownerUserId, roomId = "default") {
   const roomIdObj = env.RECORD_ROOMS.idFromName(roomId);
   const room = env.RECORD_ROOMS.get(roomIdObj);
-  async function executeTool3(tool, params) {
+  async function executeTool3(tool2, params) {
     const response = await room.fetch(new Request("https://internal/api/tools/execute", {
       method: "POST",
       headers: {
@@ -454,11 +461,11 @@ function buildCronContext(env, ownerUserId, roomId = "default") {
         "X-User-Id": ownerUserId,
         "X-App-Action": "true"
       },
-      body: JSON.stringify({ tool, params })
+      body: JSON.stringify({ tool: tool2, params })
     }));
     const result = await response.json();
     if (!result.success) {
-      throw new Error(`RecordRoom tool ${tool} failed: ${result.error || "Unknown error"}`);
+      throw new Error(`RecordRoom tool ${tool2} failed: ${result.error || "Unknown error"}`);
     }
     return result.data;
   }
@@ -579,6 +586,87 @@ function createDeepSpaceAI(env, provider, options = {}) {
   }
 }
 
+// src/server/utils/composio-tools.ts
+import { tool, jsonSchema } from "ai";
+var EMPTY_SCHEMA = { type: "object", properties: {} };
+async function requestComposio(env, endpoint, params, authToken) {
+  const res = await apiWorkerFetch(env, `/api/integrations/composio/${endpoint}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${authToken}`
+    },
+    body: JSON.stringify(params)
+  });
+  const text = await res.text();
+  let parsed = {};
+  try {
+    parsed = text ? JSON.parse(text) : {};
+  } catch {
+  }
+  const detail = parsed.message || parsed.error || text || `HTTP ${res.status}`;
+  return { ok: res.ok, success: parsed.success === true, data: parsed.data, detail };
+}
+function toolKey(slug) {
+  const key = slug.replace(/[^a-zA-Z0-9_-]/g, "_");
+  return key.length <= 64 ? key : key.slice(0, 64);
+}
+async function composioTools(env, options) {
+  const { authToken } = options;
+  if (!authToken) {
+    throw new Error(
+      "composioTools: options.authToken is required. Pass the end user's JWT so the tools run as that user (Composio resolves their connected accounts by it) and the calls are billed to them."
+    );
+  }
+  const list = await requestComposio(
+    env,
+    "list-tools",
+    {
+      toolkit: options.toolkit,
+      toolSlugs: options.tools?.length ? options.tools.join(",") : void 0,
+      search: options.search,
+      limit: options.limit ?? 20
+    },
+    authToken
+  );
+  if (!list.ok || !list.success) {
+    throw new Error(`composioTools: failed to list Composio tools: ${list.detail}`);
+  }
+  const items = Array.isArray(list.data?.items) ? list.data.items : [];
+  const tools = {};
+  for (const item of items) {
+    if (!item?.slug) continue;
+    const slug = item.slug;
+    const schema = item.input_parameters ?? EMPTY_SCHEMA;
+    tools[toolKey(slug)] = tool({
+      description: item.description ?? item.name ?? slug,
+      inputSchema: jsonSchema(schema),
+      execute: async (args) => {
+        const r = await requestComposio(
+          env,
+          "execute-tool",
+          { slug, arguments: args ?? {} },
+          authToken
+        );
+        if (!r.ok || !r.success) {
+          return { error: true, message: `Composio tool ${slug} failed: ${r.detail}` };
+        }
+        const data = r.data;
+        if (data && typeof data === "object" && data.requiresConnection) {
+          const toolkit = data.toolkit;
+          return {
+            requiresConnection: true,
+            toolkit,
+            message: `The user has not connected ${toolkit ?? "this app"}. Ask them to connect it before using this tool.`
+          };
+        }
+        return data;
+      }
+    });
+  }
+  return tools;
+}
+
 // src/server/utils/screenshot.ts
 async function captureScreenshot(env, opts) {
   const headers = new Headers({
@@ -666,6 +754,45 @@ function applySlidingWindow(messages, charCap, minKept) {
   }
   return out;
 }
+var TRIMMABLE_ARRAY_PATHS = [
+  ["records"],
+  ["data", "records"],
+  ["items"],
+  ["data", "items"],
+  ["data"]
+];
+function getPath(root, path) {
+  let cur = root;
+  for (const key of path) {
+    if (!cur || typeof cur !== "object") return void 0;
+    cur = cur[key];
+  }
+  return cur;
+}
+function setPath(root, path, value, flags) {
+  const obj = root && typeof root === "object" ? root : {};
+  const [head, ...tail] = path;
+  if (tail.length === 0) {
+    return { ...obj, [head]: value, ...flags };
+  }
+  return { ...obj, [head]: setPath(obj[head], tail, value, flags) };
+}
+function locateTrimmableArray(result) {
+  for (const path of TRIMMABLE_ARRAY_PATHS) {
+    const arr = getPath(result, path);
+    if (Array.isArray(arr)) return { path, items: arr };
+  }
+  for (const [key, value] of Object.entries(result)) {
+    if (Array.isArray(value)) return { path: [key], items: value };
+  }
+  const data = result.data;
+  if (data && typeof data === "object") {
+    for (const [key, value] of Object.entries(data)) {
+      if (Array.isArray(value)) return { path: ["data", key], items: value };
+    }
+  }
+  return void 0;
+}
 function capToolResultSize(result, byteCap) {
   let serialized;
   try {
@@ -675,6 +802,31 @@ function capToolResultSize(result, byteCap) {
   }
   if (typeof serialized !== "string") return result;
   if (serialized.length <= byteCap) return result;
+  if (result && typeof result === "object") {
+    const located = locateTrimmableArray(result);
+    if (located) {
+      const { path, items } = located;
+      const total = items.length;
+      const build = (k) => setPath(result, path, items.slice(0, k), { truncated: true, returned: k, total });
+      const fits = (k) => {
+        try {
+          return JSON.stringify(build(k)).length <= byteCap;
+        } catch {
+          return false;
+        }
+      };
+      if (fits(0)) {
+        let lo = 0;
+        let hi = total;
+        while (lo < hi) {
+          const mid = Math.ceil((lo + hi) / 2);
+          if (fits(mid)) lo = mid;
+          else hi = mid - 1;
+        }
+        if (lo > 0) return build(lo);
+      }
+    }
+  }
   return {
     success: false,
     truncated: true,
@@ -883,7 +1035,7 @@ function makeDefaultSummarizer(env, options = {}) {
 }
 
 // src/server/utils/chat-history.ts
-async function executeTool(stub, userId, tool, params) {
+async function executeTool(stub, userId, tool2, params) {
   const res = await stub.fetch(new Request("https://internal/api/tools/execute", {
     method: "POST",
     headers: {
@@ -891,11 +1043,11 @@ async function executeTool(stub, userId, tool, params) {
       "X-User-Id": userId,
       "X-App-Action": "true"
     },
-    body: JSON.stringify({ tool, params })
+    body: JSON.stringify({ tool: tool2, params })
   }));
   const body = await res.json();
   if (!body.success) {
-    throw new Error(`chat-history ${tool} failed: ${body.error ?? "unknown error"}`);
+    throw new Error(`chat-history ${tool2} failed: ${body.error ?? "unknown error"}`);
   }
   return body.data;
 }
@@ -2790,11 +2942,11 @@ async function handleToolsRequest(ctx, request, path) {
   }
   if (path.startsWith("tools/describe/")) {
     const toolName = path.replace("tools/describe/", "");
-    const tool = BUILT_IN_TOOLS.find((t) => t.name === toolName);
-    if (!tool) {
+    const tool2 = BUILT_IN_TOOLS.find((t) => t.name === toolName);
+    if (!tool2) {
       return Response.json({ error: `Tool not found: ${toolName}` }, { status: 404, headers: CORS_HEADERS2 });
     }
-    return Response.json({ tool }, { headers: CORS_HEADERS2 });
+    return Response.json({ tool: tool2 }, { headers: CORS_HEADERS2 });
   }
   if (path.startsWith("tools/execute") && request.method === "POST") {
     return handleToolExecute(ctx, request);
@@ -2811,8 +2963,8 @@ async function handleToolExecute(ctx, request) {
       { status: 400, headers: CORS_HEADERS2 }
     );
   }
-  const { tool, params = {} } = body;
-  if (!tool) {
+  const { tool: tool2, params = {} } = body;
+  if (!tool2) {
     return Response.json(
       { success: false, error: 'Missing "tool" in request body' },
       { status: 400, headers: CORS_HEADERS2 }
@@ -2829,8 +2981,8 @@ async function handleToolExecute(ctx, request) {
       userRole = user.role;
     }
   }
-  if (tool.startsWith("yjs.")) {
-    const result2 = await executeYjsTool(ctx, tool, params, userId, userRole);
+  if (tool2.startsWith("yjs.")) {
+    const result2 = await executeYjsTool(ctx, tool2, params, userId, userRole);
     const status2 = result2.success ? 200 : result2.error?.includes("not found") ? 404 : 400;
     return Response.json(result2, { status: status2, headers: CORS_HEADERS2 });
   }
@@ -2841,7 +2993,7 @@ async function handleToolExecute(ctx, request) {
     getPermissionContext: ctx.getPermissionContext,
     send: ctx.send
   };
-  const result = await executeTool2(recordCtx, tool, params, userId, userRole, isAppAction);
+  const result = await executeTool2(recordCtx, tool2, params, userId, userRole, isAppAction);
   const status = result.success ? 200 : result.error?.includes("not found") ? 404 : 400;
   return Response.json(result, { status, headers: CORS_HEADERS2 });
 }
@@ -3826,13 +3978,13 @@ var YjsRoom = class extends BaseRoom {
   onMessage(ws, user, message) {
   }
   onBinaryMessage(ws, user, data) {
-    const bytes = new Uint8Array(data);
-    const decoder = createDecoder(bytes);
+    const bytes2 = new Uint8Array(data);
+    const decoder = createDecoder(bytes2);
     const messageType = readVarUint(decoder);
     if (messageType === MSG_SYNC) {
-      this.handleSync(ws, decoder, bytes);
+      this.handleSync(ws, decoder, bytes2);
     } else if (messageType === MSG_AWARENESS) {
-      this.handleAwareness(ws, decoder, bytes);
+      this.handleAwareness(ws, decoder, bytes2);
     }
   }
   onDisconnect(ws, user) {
@@ -5037,6 +5189,319 @@ function cronMatches(parsed, timezone, date) {
   return parsed.minute.has(minute) && parsed.hour.has(hour) && parsed.dayOfMonth.has(dayOfMonth) && parsed.month.has(month) && parsed.dayOfWeek.has(dayOfWeek);
 }
 
+// src/server/rooms/secrets-room.ts
+var INTERNAL_HEADER = "x-deepspace-internal";
+var INTERNAL_VALUE = "app-secrets";
+var VERSION = "app-secret-v1";
+var NAME_INFO = "deepspace app secret name v1";
+var VALUE_INFO = "deepspace app secret value v1";
+var HMAC_INFO = "deepspace app secret lookup v1";
+var STORE_ID = "default";
+var SecretsRoom = class extends BaseRoom {
+  initialized = false;
+  onMessage(_ws, _user, _message) {
+  }
+  async fetch(request) {
+    this.ensureInitialized();
+    return super.fetch(request);
+  }
+  async onRequest(request) {
+    if (request.headers.get(INTERNAL_HEADER) !== INTERNAL_VALUE) {
+      return json({ error: "Not found" }, 404);
+    }
+    const url = new URL(request.url);
+    try {
+      if (request.method === "GET" && url.pathname.endsWith("/list")) {
+        return json({ version: this.storeVersion(), secrets: await this.list() });
+      }
+      if (request.method === "GET" && url.pathname.endsWith("/pull")) {
+        return json({ version: this.storeVersion(), secrets: await this.pull() });
+      }
+      if (request.method === "GET" && url.pathname.endsWith("/version")) {
+        return json({ version: this.storeVersion() });
+      }
+      if (request.method === "PATCH" && url.pathname.endsWith("/patch")) {
+        const body = await request.json();
+        const result = await this.patch(body);
+        return json(result);
+      }
+      if (request.method === "PUT" && url.pathname.endsWith("/replace")) {
+        const body = await request.json();
+        const result = await this.replace(body);
+        return json(result);
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const status = message.includes("conflict") ? 409 : 500;
+      return json({ error: message }, status);
+    }
+    return json({ error: "Not found" }, 404);
+  }
+  async list() {
+    const rows = this.sql.exec(
+      `SELECT name_encrypted, version, updated_by, created_at, updated_at
+         FROM app_secrets_store ORDER BY updated_at DESC`
+    ).toArray();
+    const out = [];
+    for (const row of rows) {
+      out.push({
+        name: await decryptText(this.requireKey(), row.name_encrypted, NAME_INFO),
+        version: row.version,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        updatedBy: row.updated_by
+      });
+    }
+    return out.sort((a, b) => a.name.localeCompare(b.name));
+  }
+  async pull() {
+    const rows = this.sql.exec(
+      `SELECT name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at
+         FROM app_secrets_store`
+    ).toArray();
+    const out = {};
+    for (const row of rows) {
+      const name = await decryptText(this.requireKey(), row.name_encrypted, NAME_INFO);
+      out[name] = await decryptText(this.requireKey(), row.value_encrypted, VALUE_INFO);
+    }
+    return out;
+  }
+  async patch(body) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const actor = body.updatedBy ?? null;
+    const key = this.requireKey();
+    const setEntries = Object.entries(body.set ?? {});
+    const deleteNames = body.delete ?? [];
+    for (const name of [...setEntries.map(([name2]) => name2), ...deleteNames]) {
+      validateSecretName(name);
+    }
+    const writes = [];
+    for (const [name, value] of setEntries) {
+      const nameHash = await hashName(key, name);
+      const existing = this.sql.exec(
+        `SELECT version, created_at FROM app_secrets_store WHERE name_hash = ?`,
+        nameHash
+      ).toArray()[0];
+      writes.push({
+        nameHash,
+        nameEncrypted: await encryptText(key, name, NAME_INFO),
+        valueEncrypted: await encryptText(key, value, VALUE_INFO),
+        version: (existing?.version ?? 0) + 1,
+        createdAt: existing?.created_at ?? now
+      });
+    }
+    const deletes = [];
+    for (const name of deleteNames) {
+      deletes.push(await hashName(key, name));
+    }
+    this.transaction(() => {
+      for (const write of writes) {
+        this.sql.exec(
+          `INSERT OR REPLACE INTO app_secrets_store
+           (name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?)`,
+          write.nameHash,
+          write.nameEncrypted,
+          write.valueEncrypted,
+          write.version,
+          actor,
+          write.createdAt,
+          now
+        );
+      }
+      for (const nameHash of deletes) {
+        this.sql.exec(`DELETE FROM app_secrets_store WHERE name_hash = ?`, nameHash);
+      }
+      this.bumpStoreVersion(now);
+    });
+    return { version: this.storeVersion(), secrets: await this.list() };
+  }
+  async replace(body) {
+    const next = body.secrets ?? {};
+    for (const name of Object.keys(next)) validateSecretName(name);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const actor = body.updatedBy ?? null;
+    const key = this.requireKey();
+    const writes = [];
+    for (const [name, value] of Object.entries(next)) {
+      writes.push({
+        nameHash: await hashName(key, name),
+        nameEncrypted: await encryptText(key, name, NAME_INFO),
+        valueEncrypted: await encryptText(key, value, VALUE_INFO)
+      });
+    }
+    this.transaction(() => {
+      this.sql.exec(`DELETE FROM app_secrets_store`);
+      for (const write of writes) {
+        this.sql.exec(
+          `INSERT INTO app_secrets_store
+           (name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at)
+           VALUES (?, ?, ?, 1, ?, ?, ?)`,
+          write.nameHash,
+          write.nameEncrypted,
+          write.valueEncrypted,
+          actor,
+          now,
+          now
+        );
+      }
+      this.bumpStoreVersion(now);
+    });
+    return { version: this.storeVersion(), secrets: await this.list() };
+  }
+  transaction(run) {
+    this.state.storage.transactionSync(run);
+  }
+  migrateLegacyProductionSecrets() {
+    const legacyExists = this.sql.exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'app_secrets'`).toArray().length > 0;
+    if (!legacyExists) return;
+    const currentCount = this.sql.exec(`SELECT COUNT(*) AS count FROM app_secrets_store`).toArray()[0];
+    if ((currentCount?.count ?? 0) > 0) return;
+    this.sql.exec(`
+      INSERT OR IGNORE INTO app_secrets_store
+        (name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at)
+      SELECT name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at
+      FROM app_secrets
+      WHERE env = 'production'
+    `);
+    const legacyVersionExists = this.sql.exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'app_secret_env_versions'`).toArray().length > 0;
+    const legacyVersion = legacyVersionExists ? this.sql.exec(`SELECT version, updated_at FROM app_secret_env_versions WHERE env = 'production'`).toArray()[0] : void 0;
+    if (legacyVersion) {
+      this.sql.exec(
+        `INSERT OR REPLACE INTO app_secret_store_versions (id, version, updated_at) VALUES (?, ?, ?)`,
+        STORE_ID,
+        legacyVersion.version,
+        legacyVersion.updated_at
+      );
+    }
+    const migratedCount = this.sql.exec(`SELECT COUNT(*) AS count FROM app_secrets_store`).toArray()[0];
+    if (!legacyVersion && (migratedCount?.count ?? 0) > 0) {
+      this.sql.exec(
+        `INSERT OR REPLACE INTO app_secret_store_versions (id, version, updated_at) VALUES (?, ?, ?)`,
+        STORE_ID,
+        1,
+        (/* @__PURE__ */ new Date()).toISOString()
+      );
+    }
+  }
+  ensureInitialized() {
+    if (this.initialized) return;
+    this.initialized = true;
+    this.sql.exec(`
+      CREATE TABLE IF NOT EXISTS app_secrets_store (
+        name_hash TEXT NOT NULL,
+        name_encrypted TEXT NOT NULL,
+        value_encrypted TEXT NOT NULL,
+        version INTEGER NOT NULL,
+        updated_by TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (name_hash)
+      )
+    `);
+    this.sql.exec(`
+      CREATE TABLE IF NOT EXISTS app_secret_store_versions (
+        id TEXT PRIMARY KEY,
+        version INTEGER NOT NULL,
+        updated_at TEXT NOT NULL
+      )
+    `);
+    this.migrateLegacyProductionSecrets();
+  }
+  requireKey() {
+    if (!this.env.APP_SECRETS_KEY) {
+      throw new Error("APP_SECRETS_KEY binding is missing");
+    }
+    return this.env.APP_SECRETS_KEY;
+  }
+  storeVersion() {
+    const row = this.sql.exec(
+      `SELECT version FROM app_secret_store_versions WHERE id = ?`,
+      STORE_ID
+    ).toArray()[0];
+    return row?.version ?? 0;
+  }
+  bumpStoreVersion(now) {
+    const next = this.storeVersion() + 1;
+    this.sql.exec(
+      `INSERT OR REPLACE INTO app_secret_store_versions (id, version, updated_at) VALUES (?, ?, ?)`,
+      STORE_ID,
+      next,
+      now
+    );
+  }
+};
+function validateSecretName(name) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+    throw new Error(`Invalid secret name "${name}"`);
+  }
+}
+function json(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+async function encryptText(root, plaintext, info) {
+  const salt = crypto.getRandomValues(new Uint8Array(16));
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const key = await aesKey(root, salt, info);
+  const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(plaintext));
+  return [VERSION, b64(salt), b64(iv), b64(new Uint8Array(ciphertext))].join(":");
+}
+async function decryptText(root, encoded, info) {
+  const [version, saltB64, ivB64, bodyB64] = encoded.split(":");
+  if (version !== VERSION || !saltB64 || !ivB64 || !bodyB64) {
+    throw new Error("Corrupt app secret ciphertext");
+  }
+  const key = await aesKey(root, unb64(saltB64), info);
+  const plaintext = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: bytes(unb64(ivB64)) },
+    key,
+    bytes(unb64(bodyB64))
+  );
+  return new TextDecoder().decode(plaintext);
+}
+async function hashName(root, name) {
+  const key = await hmacKey(root, HMAC_INFO);
+  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`production:${name}`));
+  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function aesKey(root, salt, info) {
+  const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(root), "HKDF", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt: bytes(salt), info: new TextEncoder().encode(info) },
+    base,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function hmacKey(root, info) {
+  const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(root), "HKDF", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt: bytes(new Uint8Array(16)), info: new TextEncoder().encode(info) },
+    base,
+    { name: "HMAC", hash: "SHA-256", length: 256 },
+    false,
+    ["sign"]
+  );
+}
+function b64(bytes2) {
+  let s = "";
+  for (const b of bytes2) s += String.fromCharCode(b);
+  return btoa(s);
+}
+function unb64(value) {
+  const s = atob(value);
+  const out = new Uint8Array(s.length);
+  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i);
+  return out;
+}
+function bytes(input) {
+  return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
+}
+
 // src/server/rooms/job-room.ts
 var RUNNING_STALE_MS = 16 * 60 * 1e3;
 var DEFAULT_RETENTION_MS = 24 * 60 * 60 * 1e3;
@@ -5654,6 +6119,7 @@ var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
   "AUTH_WORKER_URL",
   "APP_IDENTITY_TOKEN",
   "APP_OWNER_JWT",
+  "APP_SECRETS_KEY",
   "USAGE_EVENTS"
 ]);
 function validateBindingManifest(manifest) {
@@ -6490,8 +6956,8 @@ import { importSPKI, jwtVerify } from "jose";
 
 // src/server/auth/utils.ts
 var BASE64_URL_REGEX = /^[A-Za-z0-9-_]+$/;
-function bufferToHex(bytes) {
-  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+function bufferToHex(bytes2) {
+  const view = bytes2 instanceof Uint8Array ? bytes2 : new Uint8Array(bytes2);
   let hex = "";
   for (const byte of view) {
     hex += byte.toString(16).padStart(2, "0");
@@ -6514,9 +6980,9 @@ function decodeJwtPayload(token) {
   if (!BASE64_URL_REGEX.test(payloadSegment)) return void 0;
   try {
     const normalized = payloadSegment.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payloadSegment.length / 4) * 4, "=");
-    const bytes = base64ToUint8Array(normalized);
-    const json = new TextDecoder().decode(bytes);
-    const payload = JSON.parse(json);
+    const bytes2 = base64ToUint8Array(normalized);
+    const json2 = new TextDecoder().decode(bytes2);
+    const payload = JSON.parse(json2);
     return {
       iss: payload.iss ?? null,
       aud: payload.aud ?? null,
@@ -6668,6 +7134,7 @@ async function timingSafeEqualHex(a, b) {
 // src/server/auth/betterAuth.ts
 import { betterAuth } from "better-auth";
 import { organization, twoFactor } from "better-auth/plugins";
+import { SignJWT, importPKCS8 } from "jose";
 function createDeepSpaceAuth(config) {
   const socialProviders = {};
   if (config.google) {
@@ -6676,6 +7143,20 @@ function createDeepSpaceAuth(config) {
   if (config.github) {
     socialProviders.github = config.github;
   }
+  if (config.microsoft) {
+    socialProviders.microsoft = config.microsoft;
+  }
+  if (config.apple) {
+    const apple = config.apple;
+    socialProviders.apple = async () => {
+      try {
+        return { clientId: apple.clientId, clientSecret: await generateAppleClientSecret(apple) };
+      } catch (err) {
+        console.error("[deepspace] failed to mint Apple client secret; Apple sign-in disabled", err);
+        return { clientId: apple.clientId, clientSecret: "" };
+      }
+    };
+  }
   return betterAuth({
     database: config.database,
     baseURL: config.baseURL,
@@ -6688,11 +7169,212 @@ function createDeepSpaceAuth(config) {
       "https://deep.space",
       "https://*.deep.space",
       "https://*.app.space",
-      "http://localhost:*"
+      "http://localhost:*",
+      // Apple posts its OAuth callback from this origin (form_post).
+      "https://appleid.apple.com"
     ],
+    // Apple returns its callback as a cross-site form_post, which a
+    // SameSite=Lax cookie won't ride along with — so the OAuth handshake
+    // cookie must be SameSite=None. Scoped to just that cookie; the session
+    // cookie stays Lax. Gated on Apple being configured: deployments without
+    // Apple keep Lax entirely. Note that when Apple IS configured, this also
+    // relaxes the handshake cookie for Google/GitHub/Microsoft on the same
+    // instance — which is safe, since the state is encrypted and verified
+    // independently of SameSite (plus a separate per-flow CSRF cookie).
+    ...config.apple ? {
+      advanced: {
+        cookies: {
+          state: { attributes: { sameSite: "none", secure: true } },
+          oauth_state: { attributes: { sameSite: "none", secure: true } }
+        }
+      }
+    } : {},
     plugins: [organization(), twoFactor()]
   });
 }
+var cachedAppleSecret = null;
+async function generateAppleClientSecret(apple) {
+  const now = Math.floor(Date.now() / 1e3);
+  if (cachedAppleSecret && cachedAppleSecret.keyId === apple.keyId && cachedAppleSecret.expiresAt - now > 3600) {
+    return cachedAppleSecret.token;
+  }
+  const pem = apple.privateKey.replace(/\\n/g, "\n");
+  const key = await importPKCS8(pem, "ES256");
+  const expiresAt = now + 180 * 24 * 60 * 60;
+  const token = await new SignJWT({}).setProtectedHeader({ alg: "ES256", kid: apple.keyId }).setIssuer(apple.teamId).setSubject(apple.clientId).setAudience("https://appleid.apple.com").setIssuedAt(now).setExpirationTime(expiresAt).sign(key);
+  cachedAppleSecret = { keyId: apple.keyId, token, expiresAt };
+  return token;
+}
+
+// src/server/secrets.ts
+var DEFAULT_REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+function createSecrets(env, options = {}) {
+  const refreshIntervalMs = options.refreshIntervalMs ?? DEFAULT_REFRESH_INTERVAL_MS;
+  const now = options.now ?? (() => Date.now());
+  const cache = /* @__PURE__ */ new Map();
+  let loadedAll = null;
+  let loadedVersion = 0;
+  let lastCheckedAt = 0;
+  function stub() {
+    if (!env.SECRETS_ROOMS) throw new Error("SECRETS_ROOMS binding is missing");
+    if (!env.APP_SECRETS_KEY) throw new Error("APP_SECRETS_KEY binding is missing");
+    const id = env.SECRETS_ROOMS.idFromName("app-secrets");
+    return env.SECRETS_ROOMS.get(id);
+  }
+  async function fetchJson(path) {
+    const res = await stub().fetch(`https://app-secrets/${path}`, {
+      headers: { "x-deepspace-internal": "app-secrets" }
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(body.error ?? `App secrets unavailable (${res.status})`);
+    return body;
+  }
+  async function pullAll() {
+    const body = await fetchJson("pull");
+    const version = typeof body.version === "number" ? body.version : 0;
+    cache.clear();
+    for (const [name, value] of Object.entries(body.secrets ?? {})) {
+      cache.set(name, value);
+    }
+    loadedVersion = version;
+    lastCheckedAt = now();
+    return version;
+  }
+  async function loadAll() {
+    await pullAll();
+  }
+  async function ensureLoaded() {
+    if (!loadedAll) {
+      loadedAll = loadAll().catch((err) => {
+        loadedAll = null;
+        throw err;
+      });
+    }
+    await loadedAll;
+  }
+  async function maybeCheckForUpdates() {
+    if (!loadedAll) return;
+    if (refreshIntervalMs < 0) return;
+    if (now() - lastCheckedAt < refreshIntervalMs) return;
+    try {
+      await client.checkForUpdates();
+    } catch {
+    }
+  }
+  function localDevValue(name) {
+    const value = env[name];
+    return env.APP_SECRETS_LOCAL_FALLBACK === "true" && typeof value === "string" ? value : void 0;
+  }
+  const client = {
+    async get(name) {
+      const local = localDevValue(name);
+      if (local !== void 0) return local;
+      if (!cache.has(name)) await ensureLoaded();
+      else await maybeCheckForUpdates();
+      return cache.get(name);
+    },
+    async require(name) {
+      const value = await this.get(name);
+      if (value === void 0) throw new Error(`Missing app secret "${name}"`);
+      return value;
+    },
+    async getMany(names) {
+      const out = {};
+      for (const name of names) out[name] = await this.get(name);
+      return out;
+    },
+    async preload(names) {
+      if (env.APP_SECRETS_LOCAL_FALLBACK === "true") {
+        const missing = [];
+        for (const name of names) {
+          const local = localDevValue(name);
+          if (local !== void 0) cache.set(name, local);
+          else missing.push(name);
+        }
+        if (missing.length === 0) {
+          await maybeCheckForUpdates();
+          return;
+        }
+      }
+      await ensureLoaded();
+      await maybeCheckForUpdates();
+    },
+    async refresh(refreshOptions = {}) {
+      if (refreshOptions.force || !loadedAll) {
+        const previous = loadedVersion;
+        const version = await pullAll();
+        loadedAll = Promise.resolve();
+        return { changed: version !== previous, version };
+      }
+      return this.checkForUpdates();
+    },
+    async checkForUpdates() {
+      await ensureLoaded();
+      const body = await fetchJson("version");
+      const version = typeof body.version === "number" ? body.version : 0;
+      lastCheckedAt = now();
+      if (version === loadedVersion) return { changed: false, version };
+      const pulledVersion = await pullAll();
+      return { changed: true, version: pulledVersion };
+    },
+    invalidate() {
+      cache.clear();
+      loadedAll = null;
+      loadedVersion = 0;
+      lastCheckedAt = 0;
+    },
+    async withFreshSecrets(operation, retryOptions = {}) {
+      let first;
+      try {
+        first = await operation({ secrets: client, attempt: 1, refreshed: false });
+      } catch (err) {
+        if (!shouldRefreshOnError(err)) throw err;
+        const refresh = await refreshAfterFailure(err);
+        if (!refresh.changed && !retryOptions.retryWhenUnchanged) throw err;
+        return operation({ secrets: client, attempt: 2, refreshed: refresh.changed });
+      }
+      if (first instanceof Response && shouldRefreshOnStatus(first.status)) {
+        const refresh = await refreshAfterFailure(first);
+        if (refresh.changed || retryOptions.retryWhenUnchanged) {
+          return operation({ secrets: client, attempt: 2, refreshed: refresh.changed });
+        }
+      }
+      return first;
+    }
+  };
+  async function refreshAfterFailure(original) {
+    try {
+      return await client.refresh({ force: true });
+    } catch (err) {
+      const originalMessage = describeFailure(original);
+      const refreshMessage = err instanceof Error ? err.message : String(err);
+      throw new Error(`Secret refresh failed after API failure (${originalMessage}): ${refreshMessage}`);
+    }
+  }
+  return client;
+}
+function shouldRefreshOnError(error) {
+  const status = statusFromError(error);
+  return status !== void 0 && shouldRefreshOnStatus(status);
+}
+function shouldRefreshOnStatus(status) {
+  return status === 401 || status === 403;
+}
+function statusFromError(error) {
+  if (!error || typeof error !== "object") return void 0;
+  const record = error;
+  if (typeof record.status === "number") return record.status;
+  if (typeof record.statusCode === "number") return record.statusCode;
+  if (typeof record.response?.status === "number") return record.response.status;
+  return void 0;
+}
+function describeFailure(value) {
+  if (value instanceof Response) return `HTTP ${value.status}`;
+  if (value instanceof Error) return value.message;
+  const status = statusFromError(value);
+  if (status) return `HTTP ${status}`;
+  return String(value);
+}
 
 // src/shared/subscription.ts
 var ENTITLED_STATUSES = /* @__PURE__ */ new Set([
@@ -6858,6 +7540,7 @@ export {
   CronRoom,
   DEFAULT_CONTEXT_CONFIG,
   DEFAULT_DO_MANIFEST,
+  DEFAULT_QUERY_LIMIT,
   DIRECTORY_SCHEMAS,
   GLOBAL_DO_TYPES,
   GLOBAL_DO_TYPE_NAMES,
@@ -6874,6 +7557,7 @@ export {
   SYSTEM_COLLECTION_SCHEMAS,
   SYSTEM_MANAGED_COLUMNS,
   SchemaRegistry,
+  SecretsRoom,
   SubscriptionAuthError,
   SubscriptionRequiredError,
   USERS_COLUMNS,
@@ -6883,6 +7567,7 @@ export {
   analyzePermissions,
   apiWorkerFetch,
   appendMessage,
+  applyAiToolDefaults,
   applySlidingWindow,
   authWorkerFetch,
   bindingManifestFromOutputConfig,
@@ -6902,12 +7587,14 @@ export {
   coerceValue,
   collectionTableName,
   columnId,
+  composioTools,
   computeDoMigration,
   computeHmacHex,
   createChat,
   createDeepSpaceAI,
   createDeepSpaceAuth,
   createScopedR2Handler,
+  createSecrets,
   dataToColumnValues,
   decodeJwtPayload,
   deleteChatCascade,