deepspace 0.4.3 → 0.4.5

package/dist/worker.d.ts

@@ -1,6 +1,7 @@
 import * as Y from 'yjs';
-import { LanguageModel, ModelMessage } from 'ai';
+import { LanguageModel, ToolSet, ModelMessage } from 'ai';
 import * as better_auth from 'better-auth';
+import { betterAuth } from 'better-auth';
 import * as better_auth_plugins from 'better-auth/plugins';
 
 /**
@@ -2507,6 +2508,30 @@ type ToolResult = {
     success: false;
     error: string;
 };
+/**
+ * Page size the assistant defaults to for `records.query` when it omits
+ * `limit`. Keeps a model-issued unbounded scan from blowing the tool-result
+ * byte cap and gives the model a usable first page. Raise `limit` to page
+ * through more (still subject to the cap; see
+ * `DEFAULT_CONTEXT_CONFIG.toolResultCap` / `capToolResultSize`, which truncates
+ * oversized pages gracefully rather than dropping them).
+ *
+ * Applied by the AI tool layer via `applyAiToolDefaults`, never by the shared
+ * tools-api dispatch, so internal record readers (chat history, cron, app
+ * `actions.query`) stay unbounded.
+ */
+declare const DEFAULT_QUERY_LIMIT = 50;
+/**
+ * Fill in assistant-only parameter defaults for a built-in tool call.
+ *
+ * Applied by the AI tool layer (`buildTools`) before a model-issued tool call
+ * is dispatched, so the default only affects calls the assistant makes.
+ * `records.query` doubles as the SDK's general record-read primitive (chat
+ * history, cron, app `actions.query`); those callers reach the tools dispatch
+ * directly and must return every row, so this default must not live in the
+ * dispatch itself. Pure and non-mutating.
+ */
+declare function applyAiToolDefaults(toolName: string, params: Record<string, unknown>): Record<string, unknown>;
 /**
  * Built-in tool definitions for storage, record, schema, user, and backup operations
  */
@@ -2804,7 +2829,7 @@ interface CronContext {
     };
     /**
      * Call a platform integration endpoint (e.g. "openai/chat-completion",
-     * "freepik/text-to-image-classic"). Billed to the app owner — the same
+     * "fal/run-model"). Billed to the app owner using the same
      * APP_OWNER_JWT the rest of the SDK uses for server-side billed calls.
      */
     integrations: {
@@ -2903,6 +2928,49 @@ interface DeepSpaceAIOptions {
  */
 declare function createDeepSpaceAI(env: DeepSpaceAIEnv, provider: Provider, options?: DeepSpaceAIOptions): DeepSpaceModelFactory;
 
+/**
+ * Composio tools for the Vercel AI SDK.
+ *
+ * Turns the platform's Composio integration into ready-to-use Vercel AI SDK
+ * tools, so an agent (or the DeepSpace AI chat) can take actions on a user's
+ * connected apps. Each returned tool's `execute()` calls our own
+ * `composio/execute-tool` endpoint through the api-worker proxy, so our auth
+ * and per-user billing apply. This is the managed-proxy equivalent of
+ * Composio's `@composio/vercel` provider, which talks straight to Composio.
+ *
+ * `authToken` must be the END USER's JWT: Composio resolves the user's
+ * connected accounts by the JWT subject, and that user is billed.
+ *
+ * Usage (inside a request handler, e.g. /api/ai/chat):
+ *
+ *   import { composioTools, createDeepSpaceAI } from 'deepspace/worker'
+ *   const jwt = c.req.header('Authorization')!.slice(7)
+ *   const tools = await composioTools(c.env, { toolkit: 'gmail', authToken: jwt })
+ *   const ai = createDeepSpaceAI(c.env, 'anthropic', { authToken: jwt })
+ *   const result = streamText({ model: ai('claude-sonnet-4-6'), prompt, tools })
+ *
+ * Merge with your own tools: `tools: { ...buildTools(executor), ...composio }`.
+ */
+
+interface ComposioToolsOptions {
+    /** End user's JWT. Required: the tools run as this user and bill them. */
+    authToken: string;
+    /** Restrict to one toolkit (e.g. 'gmail', 'github'). */
+    toolkit?: string;
+    /** Explicit tool slugs to expose (e.g. ['GMAIL_SEND_EMAIL']). */
+    tools?: string[];
+    /** Natural-language search to pick relevant tools. */
+    search?: string;
+    /** Cap how many tools are exposed (default 20). Keep small: the LLM sees them all. */
+    limit?: number;
+}
+/**
+ * Fetch Composio tools for the given scope and return them as a Vercel AI SDK
+ * `ToolSet`. One `list-tools` call provides each tool's JSON Schema; each tool
+ * executes via `composio/execute-tool` as the authenticated user.
+ */
+declare function composioTools(env: ApiWorkerEnv, options: ComposioToolsOptions): Promise<ToolSet>;
+
 /**
  * captureScreenshot — call platform-worker /internal/screenshot.
  *
@@ -2991,8 +3059,17 @@ declare function truncateOldToolResults(messages: ChatTurn[], keepRecent: number
  */
 declare function applySlidingWindow(messages: ChatTurn[], charCap: number, minKept: number): ChatTurn[];
 /**
- * Replace oversized tool results with an error telling the agent to narrow
- * its query. Keeps a small preview so the agent can see what it got.
+ * Keep an individual tool result under `byteCap`.
+ *
+ * If the payload carries a list of items (e.g. a `records.query` result), it is
+ * degraded gracefully: as many leading items as fit under the cap are returned,
+ * the `success: true` shape is preserved, and `{ truncated, returned, total }`
+ * flags are merged in next to the array so callers can still use the partial
+ * data and paginate for the rest.
+ *
+ * Only when there is no array to trim (or even an empty list still overflows
+ * because of oversized sibling fields) does it fall back to replacing the
+ * result with an error + small preview telling the agent to narrow its query.
  */
 declare function capToolResultSize(result: unknown, byteCap: number): unknown;
 /**
@@ -3421,11 +3498,6 @@ declare function timingSafeEqualHex(a: string, b: string): Promise<boolean>;
 
 declare function decodeJwtPayload(token: string | null | undefined): TokenDebugInfo | undefined;
 
-/**
- * Better Auth configuration factory for DeepSpace
- *
- * Provides pre-configured Better Auth instances for Cloudflare Workers + D1.
- */
 interface DeepSpaceAuthConfig {
     /** D1 database binding */
     database: D1Database;
@@ -3443,29 +3515,28 @@ interface DeepSpaceAuthConfig {
         clientId: string;
         clientSecret: string;
     };
+    /** Microsoft (Entra ID) OAuth credentials (optional) */
+    microsoft?: {
+        clientId: string;
+        clientSecret: string;
+    };
+    /**
+     * Apple (Sign in with Apple) credentials (optional). Pass the raw
+     * Sign-in-with-Apple key material; the ES256 client-secret JWT is minted
+     * on demand, so there is no six-month token to rotate by hand.
+     */
+    apple?: {
+        clientId: string;
+        teamId: string;
+        keyId: string;
+        privateKey: string;
+    };
     /** Enable email/password authentication */
     emailAndPassword?: boolean;
     /** Trusted origins for CORS */
     trustedOrigins?: string[];
 }
-/**
- * Create a Better Auth instance configured for DeepSpace.
- *
- * This is called per-request in the auth worker since D1 bindings
- * are request-scoped in Cloudflare Workers.
- */
 declare function createDeepSpaceAuth(config: DeepSpaceAuthConfig): better_auth.Auth<{
-    database: D1Database;
-    baseURL: string;
-    secret: string;
-    emailAndPassword: {
-        enabled: boolean;
-    };
-    socialProviders: Record<string, {
-        clientId: string;
-        clientSecret: string;
-    }>;
-    trustedOrigins: string[];
     plugins: [{
         id: "organization";
         endpoints: better_auth_plugins.OrganizationEndpoints<better_auth_plugins.OrganizationOptions & {
@@ -4265,6 +4336,30 @@ declare function createDeepSpaceAuth(config: DeepSpaceAuthConfig): better_auth.A
             INVALID_TWO_FACTOR_COOKIE: better_auth.RawError<"INVALID_TWO_FACTOR_COOKIE">;
         };
     }];
+    advanced?: {
+        cookies: {
+            state: {
+                attributes: {
+                    sameSite: "none";
+                    secure: true;
+                };
+            };
+            oauth_state: {
+                attributes: {
+                    sameSite: "none";
+                    secure: true;
+                };
+            };
+        };
+    } | undefined;
+    database: D1Database;
+    baseURL: string;
+    secret: string;
+    emailAndPassword: {
+        enabled: boolean;
+    };
+    socialProviders: Parameters<typeof betterAuth>[0]["socialProviders"];
+    trustedOrigins: string[];
 }>;
 type DeepSpaceAuth = ReturnType<typeof createDeepSpaceAuth>;
 
@@ -4275,4 +4370,4 @@ type DeepSpaceAuth = ReturnType<typeof createDeepSpaceAuth>;
 /** Collections that bypass schema checks (permissive access) */
 declare const SYSTEM_COLLECTIONS: Set<string>;
 
-export { AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CONVERSATION_SCHEMAS, COST_RATES, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientMessage, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ConnectionAttachment, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GetActionData, type GlobalDOType, type HandlerContext, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, type ResolvedColumn, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, SYSTEM_COLLECTIONS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotOptions, type ScreenshotResult, type ServerMessage, type SharedConnection, type StoredRecord, type Summarizer, type SyncResult, type TokenDebugInfo, type ToolResult, type ToolSchema, USERS_COLUMNS, type User, type UserAttachment, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKSPACE_SCHEMAS, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, buildCronContext, buildTableSelect, buildUiParts, canCreate, canDelete, canRead, canUpdate, capToolResultSize, captureScreenshot, checkFieldPermissions, clientBuild, coerceValue, collectionTableName, columnId, computeDoMigration, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, enqueueJob, getChat, getGlobalDOSchemas, getGlobalDOType, getMessageType, getRolePermissions, handleAwarenessMessage, handleSyncMessage, hasContent, isAutoProvision, isOwner, lintSchema, loadMessages, makeDefaultSummarizer, meterAi, meterUsage, meterVectorize, noopPermissionContext, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, readVarUint, readVarUint8Array, resolveAppName, resolveColumn, rowToData, runMigrations, serverBuild, timingSafeEqualHex, toUint8Array, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema, writeVarUint, writeVarUint8Array };
+export { AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CONVERSATION_SCHEMAS, COST_RATES, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientMessage, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConnectionAttachment, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GetActionData, type GlobalDOType, type HandlerContext, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, type ResolvedColumn, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, SYSTEM_COLLECTIONS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotOptions, type ScreenshotResult, type ServerMessage, type SharedConnection, type StoredRecord, type Summarizer, type SyncResult, type TokenDebugInfo, type ToolResult, type ToolSchema, USERS_COLUMNS, type User, type UserAttachment, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKSPACE_SCHEMAS, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, buildCronContext, buildTableSelect, buildUiParts, canCreate, canDelete, canRead, canUpdate, capToolResultSize, captureScreenshot, checkFieldPermissions, clientBuild, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, enqueueJob, getChat, getGlobalDOSchemas, getGlobalDOType, getMessageType, getRolePermissions, handleAwarenessMessage, handleSyncMessage, hasContent, isAutoProvision, isOwner, lintSchema, loadMessages, makeDefaultSummarizer, meterAi, meterUsage, meterVectorize, noopPermissionContext, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, readVarUint, readVarUint8Array, resolveAppName, resolveColumn, rowToData, runMigrations, serverBuild, timingSafeEqualHex, toUint8Array, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema, writeVarUint, writeVarUint8Array };

package/dist/worker.js

@@ -1952,17 +1952,24 @@ async function handleSetRole(ctx, ws, attachment, payload) {
 import * as Y3 from "yjs";
 
 // src/server/utils/tools.ts
+var DEFAULT_QUERY_LIMIT = 50;
+function applyAiToolDefaults(toolName, params) {
+  if (toolName === "records.query" && params.limit === void 0) {
+    return { ...params, limit: DEFAULT_QUERY_LIMIT };
+  }
+  return params;
+}
 var BUILT_IN_TOOLS = [
   // Record tools (structured collections with RBAC)
   {
     name: "records.query",
-    description: "Query records from a collection with optional filtering, ordering, and limits",
+    description: `Query records from a collection with optional filtering, ordering, and pagination. Returns at most \`limit\` records (default ${DEFAULT_QUERY_LIMIT}). Large result sets are capped at ~30KB: an oversized page is truncated to the leading records that fit and flagged with \`{ truncated, returned, total }\`, so narrow with a \`where\` filter (or page via \`orderBy\` + \`limit\`) to see the rest.`,
     params: {
       collection: { type: "string", description: "Collection name to query", required: true },
       where: { type: "object", description: "Filter object with field=value equality conditions", required: false },
       orderBy: { type: "string", description: 'Field to order by (or "createdAt"/"updatedAt")', required: false },
       orderDir: { type: "string", description: 'Order direction: "asc" or "desc" (default: "desc")', required: false },
-      limit: { type: "number", description: "Maximum number of records to return", required: false }
+      limit: { type: "number", description: `Maximum number of records to return (default: ${DEFAULT_QUERY_LIMIT}). Oversized pages are still capped at ~30KB and truncated with returned/total flags.`, required: false }
     }
   },
   {
@@ -2132,11 +2139,11 @@ async function handleToolsRequest(ctx, request, path) {
   }
   if (path.startsWith("tools/describe/")) {
     const toolName = path.replace("tools/describe/", "");
-    const tool = BUILT_IN_TOOLS.find((t) => t.name === toolName);
-    if (!tool) {
+    const tool2 = BUILT_IN_TOOLS.find((t) => t.name === toolName);
+    if (!tool2) {
       return Response.json({ error: `Tool not found: ${toolName}` }, { status: 404, headers: CORS_HEADERS });
     }
-    return Response.json({ tool }, { headers: CORS_HEADERS });
+    return Response.json({ tool: tool2 }, { headers: CORS_HEADERS });
   }
   if (path.startsWith("tools/execute") && request.method === "POST") {
     return handleToolExecute(ctx, request);
@@ -2153,8 +2160,8 @@ async function handleToolExecute(ctx, request) {
       { status: 400, headers: CORS_HEADERS }
     );
   }
-  const { tool, params = {} } = body;
-  if (!tool) {
+  const { tool: tool2, params = {} } = body;
+  if (!tool2) {
     return Response.json(
       { success: false, error: 'Missing "tool" in request body' },
       { status: 400, headers: CORS_HEADERS }
@@ -2171,8 +2178,8 @@ async function handleToolExecute(ctx, request) {
       userRole = user.role;
     }
   }
-  if (tool.startsWith("yjs.")) {
-    const result2 = await executeYjsTool(ctx, tool, params, userId, userRole);
+  if (tool2.startsWith("yjs.")) {
+    const result2 = await executeYjsTool(ctx, tool2, params, userId, userRole);
     const status2 = result2.success ? 200 : result2.error?.includes("not found") ? 404 : 400;
     return Response.json(result2, { status: status2, headers: CORS_HEADERS });
   }
@@ -2183,7 +2190,7 @@ async function handleToolExecute(ctx, request) {
     getPermissionContext: ctx.getPermissionContext,
     send: ctx.send
   };
-  const result = await executeTool(recordCtx, tool, params, userId, userRole, isAppAction);
+  const result = await executeTool(recordCtx, tool2, params, userId, userRole, isAppAction);
   const status = result.success ? 200 : result.error?.includes("not found") ? 404 : 400;
   return Response.json(result, { status, headers: CORS_HEADERS });
 }
@@ -6110,7 +6117,7 @@ function authWorkerFetch(env, path, init) {
 function buildCronContext(env, ownerUserId, roomId = "default") {
   const roomIdObj = env.RECORD_ROOMS.idFromName(roomId);
   const room = env.RECORD_ROOMS.get(roomIdObj);
-  async function executeTool3(tool, params) {
+  async function executeTool3(tool2, params) {
     const response = await room.fetch(new Request("https://internal/api/tools/execute", {
       method: "POST",
       headers: {
@@ -6118,11 +6125,11 @@ function buildCronContext(env, ownerUserId, roomId = "default") {
         "X-User-Id": ownerUserId,
         "X-App-Action": "true"
       },
-      body: JSON.stringify({ tool, params })
+      body: JSON.stringify({ tool: tool2, params })
     }));
     const result = await response.json();
     if (!result.success) {
-      throw new Error(`RecordRoom tool ${tool} failed: ${result.error || "Unknown error"}`);
+      throw new Error(`RecordRoom tool ${tool2} failed: ${result.error || "Unknown error"}`);
     }
     return result.data;
   }
@@ -6243,6 +6250,87 @@ function createDeepSpaceAI(env, provider, options = {}) {
   }
 }
 
+// src/server/utils/composio-tools.ts
+import { tool, jsonSchema } from "ai";
+var EMPTY_SCHEMA = { type: "object", properties: {} };
+async function requestComposio(env, endpoint, params, authToken) {
+  const res = await apiWorkerFetch(env, `/api/integrations/composio/${endpoint}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${authToken}`
+    },
+    body: JSON.stringify(params)
+  });
+  const text = await res.text();
+  let parsed = {};
+  try {
+    parsed = text ? JSON.parse(text) : {};
+  } catch {
+  }
+  const detail = parsed.message || parsed.error || text || `HTTP ${res.status}`;
+  return { ok: res.ok, success: parsed.success === true, data: parsed.data, detail };
+}
+function toolKey(slug) {
+  const key = slug.replace(/[^a-zA-Z0-9_-]/g, "_");
+  return key.length <= 64 ? key : key.slice(0, 64);
+}
+async function composioTools(env, options) {
+  const { authToken } = options;
+  if (!authToken) {
+    throw new Error(
+      "composioTools: options.authToken is required. Pass the end user's JWT so the tools run as that user (Composio resolves their connected accounts by it) and the calls are billed to them."
+    );
+  }
+  const list = await requestComposio(
+    env,
+    "list-tools",
+    {
+      toolkit: options.toolkit,
+      toolSlugs: options.tools?.length ? options.tools.join(",") : void 0,
+      search: options.search,
+      limit: options.limit ?? 20
+    },
+    authToken
+  );
+  if (!list.ok || !list.success) {
+    throw new Error(`composioTools: failed to list Composio tools: ${list.detail}`);
+  }
+  const items = Array.isArray(list.data?.items) ? list.data.items : [];
+  const tools = {};
+  for (const item of items) {
+    if (!item?.slug) continue;
+    const slug = item.slug;
+    const schema = item.input_parameters ?? EMPTY_SCHEMA;
+    tools[toolKey(slug)] = tool({
+      description: item.description ?? item.name ?? slug,
+      inputSchema: jsonSchema(schema),
+      execute: async (args) => {
+        const r = await requestComposio(
+          env,
+          "execute-tool",
+          { slug, arguments: args ?? {} },
+          authToken
+        );
+        if (!r.ok || !r.success) {
+          return { error: true, message: `Composio tool ${slug} failed: ${r.detail}` };
+        }
+        const data = r.data;
+        if (data && typeof data === "object" && data.requiresConnection) {
+          const toolkit = data.toolkit;
+          return {
+            requiresConnection: true,
+            toolkit,
+            message: `The user has not connected ${toolkit ?? "this app"}. Ask them to connect it before using this tool.`
+          };
+        }
+        return data;
+      }
+    });
+  }
+  return tools;
+}
+
 // src/server/utils/screenshot.ts
 async function captureScreenshot(env, opts) {
   const headers = new Headers({
@@ -6330,6 +6418,45 @@ function applySlidingWindow(messages, charCap, minKept) {
   }
   return out;
 }
+var TRIMMABLE_ARRAY_PATHS = [
+  ["records"],
+  ["data", "records"],
+  ["items"],
+  ["data", "items"],
+  ["data"]
+];
+function getPath(root, path) {
+  let cur = root;
+  for (const key of path) {
+    if (!cur || typeof cur !== "object") return void 0;
+    cur = cur[key];
+  }
+  return cur;
+}
+function setPath(root, path, value, flags) {
+  const obj = root && typeof root === "object" ? root : {};
+  const [head, ...tail] = path;
+  if (tail.length === 0) {
+    return { ...obj, [head]: value, ...flags };
+  }
+  return { ...obj, [head]: setPath(obj[head], tail, value, flags) };
+}
+function locateTrimmableArray(result) {
+  for (const path of TRIMMABLE_ARRAY_PATHS) {
+    const arr = getPath(result, path);
+    if (Array.isArray(arr)) return { path, items: arr };
+  }
+  for (const [key, value] of Object.entries(result)) {
+    if (Array.isArray(value)) return { path: [key], items: value };
+  }
+  const data = result.data;
+  if (data && typeof data === "object") {
+    for (const [key, value] of Object.entries(data)) {
+      if (Array.isArray(value)) return { path: ["data", key], items: value };
+    }
+  }
+  return void 0;
+}
 function capToolResultSize(result, byteCap) {
   let serialized;
   try {
@@ -6339,6 +6466,31 @@ function capToolResultSize(result, byteCap) {
   }
   if (typeof serialized !== "string") return result;
   if (serialized.length <= byteCap) return result;
+  if (result && typeof result === "object") {
+    const located = locateTrimmableArray(result);
+    if (located) {
+      const { path, items } = located;
+      const total = items.length;
+      const build = (k) => setPath(result, path, items.slice(0, k), { truncated: true, returned: k, total });
+      const fits = (k) => {
+        try {
+          return JSON.stringify(build(k)).length <= byteCap;
+        } catch {
+          return false;
+        }
+      };
+      if (fits(0)) {
+        let lo = 0;
+        let hi = total;
+        while (lo < hi) {
+          const mid = Math.ceil((lo + hi) / 2);
+          if (fits(mid)) lo = mid;
+          else hi = mid - 1;
+        }
+        if (lo > 0) return build(lo);
+      }
+    }
+  }
   return {
     success: false,
     truncated: true,
@@ -6547,7 +6699,7 @@ function makeDefaultSummarizer(env, options = {}) {
 }
 
 // src/server/utils/chat-history.ts
-async function executeTool2(stub, userId, tool, params) {
+async function executeTool2(stub, userId, tool2, params) {
   const res = await stub.fetch(new Request("https://internal/api/tools/execute", {
     method: "POST",
     headers: {
@@ -6555,11 +6707,11 @@ async function executeTool2(stub, userId, tool, params) {
       "X-User-Id": userId,
       "X-App-Action": "true"
     },
-    body: JSON.stringify({ tool, params })
+    body: JSON.stringify({ tool: tool2, params })
   }));
   const body = await res.json();
   if (!body.success) {
-    throw new Error(`chat-history ${tool} failed: ${body.error ?? "unknown error"}`);
+    throw new Error(`chat-history ${tool2} failed: ${body.error ?? "unknown error"}`);
   }
   return body.data;
 }
@@ -6956,6 +7108,7 @@ async function timingSafeEqualHex(a, b) {
 // src/server/auth/betterAuth.ts
 import { betterAuth } from "better-auth";
 import { organization, twoFactor } from "better-auth/plugins";
+import { SignJWT, importPKCS8 } from "jose";
 function createDeepSpaceAuth(config) {
   const socialProviders = {};
   if (config.google) {
@@ -6964,6 +7117,20 @@ function createDeepSpaceAuth(config) {
   if (config.github) {
     socialProviders.github = config.github;
   }
+  if (config.microsoft) {
+    socialProviders.microsoft = config.microsoft;
+  }
+  if (config.apple) {
+    const apple = config.apple;
+    socialProviders.apple = async () => {
+      try {
+        return { clientId: apple.clientId, clientSecret: await generateAppleClientSecret(apple) };
+      } catch (err) {
+        console.error("[deepspace] failed to mint Apple client secret; Apple sign-in disabled", err);
+        return { clientId: apple.clientId, clientSecret: "" };
+      }
+    };
+  }
   return betterAuth({
     database: config.database,
     baseURL: config.baseURL,
@@ -6976,11 +7143,42 @@ function createDeepSpaceAuth(config) {
       "https://deep.space",
       "https://*.deep.space",
       "https://*.app.space",
-      "http://localhost:*"
+      "http://localhost:*",
+      // Apple posts its OAuth callback from this origin (form_post).
+      "https://appleid.apple.com"
     ],
+    // Apple returns its callback as a cross-site form_post, which a
+    // SameSite=Lax cookie won't ride along with — so the OAuth handshake
+    // cookie must be SameSite=None. Scoped to just that cookie; the session
+    // cookie stays Lax. Gated on Apple being configured: deployments without
+    // Apple keep Lax entirely. Note that when Apple IS configured, this also
+    // relaxes the handshake cookie for Google/GitHub/Microsoft on the same
+    // instance — which is safe, since the state is encrypted and verified
+    // independently of SameSite (plus a separate per-flow CSRF cookie).
+    ...config.apple ? {
+      advanced: {
+        cookies: {
+          state: { attributes: { sameSite: "none", secure: true } },
+          oauth_state: { attributes: { sameSite: "none", secure: true } }
+        }
+      }
+    } : {},
     plugins: [organization(), twoFactor()]
   });
 }
+var cachedAppleSecret = null;
+async function generateAppleClientSecret(apple) {
+  const now = Math.floor(Date.now() / 1e3);
+  if (cachedAppleSecret && cachedAppleSecret.keyId === apple.keyId && cachedAppleSecret.expiresAt - now > 3600) {
+    return cachedAppleSecret.token;
+  }
+  const pem = apple.privateKey.replace(/\\n/g, "\n");
+  const key = await importPKCS8(pem, "ES256");
+  const expiresAt = now + 180 * 24 * 60 * 60;
+  const token = await new SignJWT({}).setProtectedHeader({ alg: "ES256", kid: apple.keyId }).setIssuer(apple.teamId).setSubject(apple.clientId).setAudience("https://appleid.apple.com").setIssuedAt(now).setExpirationTime(expiresAt).sign(key);
+  cachedAppleSecret = { keyId: apple.keyId, token, expiresAt };
+  return token;
+}
 export {
   AI_CHATS_SCHEMA,
   AI_MESSAGES_SCHEMA,
@@ -7001,6 +7199,7 @@ export {
   CronRoom,
   DEFAULT_CONTEXT_CONFIG,
   DEFAULT_DO_MANIFEST,
+  DEFAULT_QUERY_LIMIT,
   DIRECTORY_SCHEMAS,
   GLOBAL_DO_TYPES,
   GLOBAL_DO_TYPE_NAMES,
@@ -7034,6 +7233,7 @@ export {
   analyzePermissions,
   apiWorkerFetch,
   appendMessage,
+  applyAiToolDefaults,
   applySlidingWindow,
   authWorkerFetch,
   bindingManifestFromOutputConfig,
@@ -7051,6 +7251,7 @@ export {
   coerceValue,
   collectionTableName,
   columnId,
+  composioTools,
   computeDoMigration,
   computeHmacHex,
   createChat,