deepspace 0.4.4 → 0.4.5

package/dist/server.d.ts

@@ -2096,49 +2096,6 @@ declare abstract class CronRoom<E = Record<string, unknown>> extends BaseRoom<E>
     protected abstract onTask(taskName: string): void | Promise<void>;
 }
 
-interface SecretMetadata {
-    name: string;
-    version: number;
-    createdAt: string;
-    updatedAt: string;
-    updatedBy: string | null;
-}
-declare class SecretsRoom<E extends {
-    APP_SECRETS_KEY?: string;
-} = {
-    APP_SECRETS_KEY?: string;
-}> extends BaseRoom<E> {
-    private initialized;
-    protected onMessage(_ws: WebSocket, _user: UserAttachment, _message: {
-        type: string;
-    }): void;
-    fetch(request: Request): Promise<Response>;
-    protected onRequest(request: Request): Promise<Response>;
-    list(): Promise<SecretMetadata[]>;
-    pull(): Promise<Record<string, string>>;
-    patch(body: {
-        set?: Record<string, string>;
-        delete?: string[];
-        updatedBy?: string;
-    }): Promise<{
-        version: number;
-        secrets: SecretMetadata[];
-    }>;
-    replace(body: {
-        secrets?: Record<string, string>;
-        updatedBy?: string;
-    }): Promise<{
-        version: number;
-        secrets: SecretMetadata[];
-    }>;
-    private transaction;
-    private migrateLegacyProductionSecrets;
-    private ensureInitialized;
-    private requireKey;
-    private storeVersion;
-    private bumpStoreVersion;
-}
-
 /**
  * JobRoom — Per-app durable background-job execution Durable Object.
  *
@@ -2440,7 +2397,7 @@ declare const ALLOWED_BINDING_TYPES: Set<string>;
  *
  * Includes:
  *   - Static-asset + service bindings the platform sets up automatically.
- *   - SDK-managed env (auth, identity, owner JWT, app-secret encryption root).
+ *   - SDK-managed env (auth, identity, owner JWT).
  *   - The auto-attached cost-tracking AE dataset (`USAGE_EVENTS`).
  *
  * DO binding names (RECORD_ROOMS, YJS_ROOMS, etc.) are NOT in this set
@@ -3956,47 +3913,6 @@ declare function createDeepSpaceAuth(config: DeepSpaceAuthConfig): better_auth.A
 }>;
 type DeepSpaceAuth = ReturnType<typeof createDeepSpaceAuth>;
 
-interface SecretsEnv {
-    SECRETS_ROOMS?: DurableObjectNamespace;
-    APP_SECRETS_KEY?: string;
-    APP_SECRETS_LOCAL_FALLBACK?: string;
-}
-interface SecretRefreshResult {
-    changed: boolean;
-    version: number;
-}
-interface WithFreshSecretsContext {
-    secrets: SecretsClient;
-    attempt: number;
-    refreshed: boolean;
-}
-interface WithFreshSecretsOptions {
-    /**
-     * By default the operation retries only when a forced refresh observes a
-     * changed secret version after an auth-like failure. Set this for idempotent
-     * operations that should retry after a successful refresh even when the
-     * version is unchanged.
-     */
-    retryWhenUnchanged?: boolean;
-}
-interface SecretsClient {
-    get(name: string): Promise<string | undefined>;
-    require(name: string): Promise<string>;
-    getMany(names: string[]): Promise<Record<string, string | undefined>>;
-    preload(names: string[]): Promise<void>;
-    refresh(options?: {
-        force?: boolean;
-    }): Promise<SecretRefreshResult>;
-    checkForUpdates(): Promise<SecretRefreshResult>;
-    invalidate(): void;
-    withFreshSecrets<T>(operation: (ctx: WithFreshSecretsContext) => Promise<T>, options?: WithFreshSecretsOptions): Promise<T>;
-}
-interface CreateSecretsOptions {
-    refreshIntervalMs?: number;
-    now?: () => number;
-}
-declare function createSecrets(env: SecretsEnv, options?: CreateSecretsOptions): SecretsClient;
-
 /**
  * Subscription primitives shared between client (useSubscription hook) and
  * server (requireSubscription helper). Pulled into a shared module so the
@@ -4150,4 +4066,4 @@ declare class RefundError extends Error {
     constructor(message: string, status: number);
 }
 
-export { AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, BaseRoom, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CONVERSATION_SCHEMAS, COST_RATES, CancelSubscriptionError, type CancelSubscriptionOpts, type CancelSubscriptionResult, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CreateSecretsOptions, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DebugApiContext, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GetActionData, type GlobalDOType, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, MESSAGES_SCHEMA, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlanInfo, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, type RecordContext, RecordRoom, type RecordRoomConfig, RefundError, type RefundOpts, type RefundResult, type ResolvedColumn, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, SYSTEM_COLLECTION_SCHEMAS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotOptions, type ScreenshotResult, type SecretMetadata, type SecretRefreshResult, type SecretsClient, type SecretsEnv, SecretsRoom, type SharedConnection, type StoredRecord, SubscriptionAuthError, type SubscriptionContext, type SubscriptionRead, SubscriptionRequiredError, type SubscriptionStatus, type Summarizer, type TokenDebugInfo, type ToolResult, type ToolSchema, type ToolsApiContext, USERS_COLUMNS, type User, type UserAttachment, type UserContext, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKSPACE_SCHEMAS, type WithFreshSecretsContext, type WithFreshSecretsOptions, type YjsContext, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, broadcastChange, broadcastYjsUpdate, buildCronContext, buildTableSelect, buildUiParts, canCreate, canDelete, canRead, canUpdate, cancelSubscription, capToolResultSize, captureScreenshot, checkFieldPermissions, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDeepSpaceAI, createDeepSpaceAuth, createScopedR2Handler, createSecrets, dataToColumnValues, decodeJwtPayload, deleteChatCascade, deleteRecord, enqueueJob, executeQuery, getAllUsers, getChat, getGlobalDOSchemas, getGlobalDOType, getOrCreateYjsDoc, getRecord, getRolePermissions, getSubscription, getUser, getYjsDocKey, handleApiRequest, handleDelete, handlePut, handleSetRole, handleSubscribe, handleToolsRequest, handleUnsubscribe, handleUserList, handleUserUpdate, handleYjsBinaryMessage, handleYjsJoin, handleYjsLeave, isAutoProvision, isOwner, lintSchema, loadMessages, makeDefaultSummarizer, meterAi, meterUsage, meterVectorize, noopPermissionContext, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, putRecord, readRecord, recordMatchesSubscription, refundInvoice, registerUser, requireSubscription, resolveAppName, resolveColumn, rowToData, runMigrations, saveYjsDoc, timingSafeEqualHex, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema };
+export { AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, BaseRoom, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CONVERSATION_SCHEMAS, COST_RATES, CancelSubscriptionError, type CancelSubscriptionOpts, type CancelSubscriptionResult, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DebugApiContext, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GetActionData, type GlobalDOType, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, MESSAGES_SCHEMA, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlanInfo, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, type RecordContext, RecordRoom, type RecordRoomConfig, RefundError, type RefundOpts, type RefundResult, type ResolvedColumn, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, SYSTEM_COLLECTION_SCHEMAS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotOptions, type ScreenshotResult, type SharedConnection, type StoredRecord, SubscriptionAuthError, type SubscriptionContext, type SubscriptionRead, SubscriptionRequiredError, type SubscriptionStatus, type Summarizer, type TokenDebugInfo, type ToolResult, type ToolSchema, type ToolsApiContext, USERS_COLUMNS, type User, type UserAttachment, type UserContext, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKSPACE_SCHEMAS, type YjsContext, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, broadcastChange, broadcastYjsUpdate, buildCronContext, buildTableSelect, buildUiParts, canCreate, canDelete, canRead, canUpdate, cancelSubscription, capToolResultSize, captureScreenshot, checkFieldPermissions, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDeepSpaceAI, createDeepSpaceAuth, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deleteChatCascade, deleteRecord, enqueueJob, executeQuery, getAllUsers, getChat, getGlobalDOSchemas, getGlobalDOType, getOrCreateYjsDoc, getRecord, getRolePermissions, getSubscription, getUser, getYjsDocKey, handleApiRequest, handleDelete, handlePut, handleSetRole, handleSubscribe, handleToolsRequest, handleUnsubscribe, handleUserList, handleUserUpdate, handleYjsBinaryMessage, handleYjsJoin, handleYjsLeave, isAutoProvision, isOwner, lintSchema, loadMessages, makeDefaultSummarizer, meterAi, meterUsage, meterVectorize, noopPermissionContext, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, putRecord, readRecord, recordMatchesSubscription, refundInvoice, registerUser, requireSubscription, resolveAppName, resolveColumn, rowToData, runMigrations, saveYjsDoc, timingSafeEqualHex, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema };

package/dist/server.js

@@ -3978,13 +3978,13 @@ var YjsRoom = class extends BaseRoom {
   onMessage(ws, user, message) {
   }
   onBinaryMessage(ws, user, data) {
-    const bytes2 = new Uint8Array(data);
-    const decoder = createDecoder(bytes2);
+    const bytes = new Uint8Array(data);
+    const decoder = createDecoder(bytes);
     const messageType = readVarUint(decoder);
     if (messageType === MSG_SYNC) {
-      this.handleSync(ws, decoder, bytes2);
+      this.handleSync(ws, decoder, bytes);
     } else if (messageType === MSG_AWARENESS) {
-      this.handleAwareness(ws, decoder, bytes2);
+      this.handleAwareness(ws, decoder, bytes);
     }
   }
   onDisconnect(ws, user) {
@@ -5189,319 +5189,6 @@ function cronMatches(parsed, timezone, date) {
   return parsed.minute.has(minute) && parsed.hour.has(hour) && parsed.dayOfMonth.has(dayOfMonth) && parsed.month.has(month) && parsed.dayOfWeek.has(dayOfWeek);
 }
 
-// src/server/rooms/secrets-room.ts
-var INTERNAL_HEADER = "x-deepspace-internal";
-var INTERNAL_VALUE = "app-secrets";
-var VERSION = "app-secret-v1";
-var NAME_INFO = "deepspace app secret name v1";
-var VALUE_INFO = "deepspace app secret value v1";
-var HMAC_INFO = "deepspace app secret lookup v1";
-var STORE_ID = "default";
-var SecretsRoom = class extends BaseRoom {
-  initialized = false;
-  onMessage(_ws, _user, _message) {
-  }
-  async fetch(request) {
-    this.ensureInitialized();
-    return super.fetch(request);
-  }
-  async onRequest(request) {
-    if (request.headers.get(INTERNAL_HEADER) !== INTERNAL_VALUE) {
-      return json({ error: "Not found" }, 404);
-    }
-    const url = new URL(request.url);
-    try {
-      if (request.method === "GET" && url.pathname.endsWith("/list")) {
-        return json({ version: this.storeVersion(), secrets: await this.list() });
-      }
-      if (request.method === "GET" && url.pathname.endsWith("/pull")) {
-        return json({ version: this.storeVersion(), secrets: await this.pull() });
-      }
-      if (request.method === "GET" && url.pathname.endsWith("/version")) {
-        return json({ version: this.storeVersion() });
-      }
-      if (request.method === "PATCH" && url.pathname.endsWith("/patch")) {
-        const body = await request.json();
-        const result = await this.patch(body);
-        return json(result);
-      }
-      if (request.method === "PUT" && url.pathname.endsWith("/replace")) {
-        const body = await request.json();
-        const result = await this.replace(body);
-        return json(result);
-      }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      const status = message.includes("conflict") ? 409 : 500;
-      return json({ error: message }, status);
-    }
-    return json({ error: "Not found" }, 404);
-  }
-  async list() {
-    const rows = this.sql.exec(
-      `SELECT name_encrypted, version, updated_by, created_at, updated_at
-         FROM app_secrets_store ORDER BY updated_at DESC`
-    ).toArray();
-    const out = [];
-    for (const row of rows) {
-      out.push({
-        name: await decryptText(this.requireKey(), row.name_encrypted, NAME_INFO),
-        version: row.version,
-        createdAt: row.created_at,
-        updatedAt: row.updated_at,
-        updatedBy: row.updated_by
-      });
-    }
-    return out.sort((a, b) => a.name.localeCompare(b.name));
-  }
-  async pull() {
-    const rows = this.sql.exec(
-      `SELECT name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at
-         FROM app_secrets_store`
-    ).toArray();
-    const out = {};
-    for (const row of rows) {
-      const name = await decryptText(this.requireKey(), row.name_encrypted, NAME_INFO);
-      out[name] = await decryptText(this.requireKey(), row.value_encrypted, VALUE_INFO);
-    }
-    return out;
-  }
-  async patch(body) {
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const actor = body.updatedBy ?? null;
-    const key = this.requireKey();
-    const setEntries = Object.entries(body.set ?? {});
-    const deleteNames = body.delete ?? [];
-    for (const name of [...setEntries.map(([name2]) => name2), ...deleteNames]) {
-      validateSecretName(name);
-    }
-    const writes = [];
-    for (const [name, value] of setEntries) {
-      const nameHash = await hashName(key, name);
-      const existing = this.sql.exec(
-        `SELECT version, created_at FROM app_secrets_store WHERE name_hash = ?`,
-        nameHash
-      ).toArray()[0];
-      writes.push({
-        nameHash,
-        nameEncrypted: await encryptText(key, name, NAME_INFO),
-        valueEncrypted: await encryptText(key, value, VALUE_INFO),
-        version: (existing?.version ?? 0) + 1,
-        createdAt: existing?.created_at ?? now
-      });
-    }
-    const deletes = [];
-    for (const name of deleteNames) {
-      deletes.push(await hashName(key, name));
-    }
-    this.transaction(() => {
-      for (const write of writes) {
-        this.sql.exec(
-          `INSERT OR REPLACE INTO app_secrets_store
-           (name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?)`,
-          write.nameHash,
-          write.nameEncrypted,
-          write.valueEncrypted,
-          write.version,
-          actor,
-          write.createdAt,
-          now
-        );
-      }
-      for (const nameHash of deletes) {
-        this.sql.exec(`DELETE FROM app_secrets_store WHERE name_hash = ?`, nameHash);
-      }
-      this.bumpStoreVersion(now);
-    });
-    return { version: this.storeVersion(), secrets: await this.list() };
-  }
-  async replace(body) {
-    const next = body.secrets ?? {};
-    for (const name of Object.keys(next)) validateSecretName(name);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const actor = body.updatedBy ?? null;
-    const key = this.requireKey();
-    const writes = [];
-    for (const [name, value] of Object.entries(next)) {
-      writes.push({
-        nameHash: await hashName(key, name),
-        nameEncrypted: await encryptText(key, name, NAME_INFO),
-        valueEncrypted: await encryptText(key, value, VALUE_INFO)
-      });
-    }
-    this.transaction(() => {
-      this.sql.exec(`DELETE FROM app_secrets_store`);
-      for (const write of writes) {
-        this.sql.exec(
-          `INSERT INTO app_secrets_store
-           (name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at)
-           VALUES (?, ?, ?, 1, ?, ?, ?)`,
-          write.nameHash,
-          write.nameEncrypted,
-          write.valueEncrypted,
-          actor,
-          now,
-          now
-        );
-      }
-      this.bumpStoreVersion(now);
-    });
-    return { version: this.storeVersion(), secrets: await this.list() };
-  }
-  transaction(run) {
-    this.state.storage.transactionSync(run);
-  }
-  migrateLegacyProductionSecrets() {
-    const legacyExists = this.sql.exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'app_secrets'`).toArray().length > 0;
-    if (!legacyExists) return;
-    const currentCount = this.sql.exec(`SELECT COUNT(*) AS count FROM app_secrets_store`).toArray()[0];
-    if ((currentCount?.count ?? 0) > 0) return;
-    this.sql.exec(`
-      INSERT OR IGNORE INTO app_secrets_store
-        (name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at)
-      SELECT name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at
-      FROM app_secrets
-      WHERE env = 'production'
-    `);
-    const legacyVersionExists = this.sql.exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'app_secret_env_versions'`).toArray().length > 0;
-    const legacyVersion = legacyVersionExists ? this.sql.exec(`SELECT version, updated_at FROM app_secret_env_versions WHERE env = 'production'`).toArray()[0] : void 0;
-    if (legacyVersion) {
-      this.sql.exec(
-        `INSERT OR REPLACE INTO app_secret_store_versions (id, version, updated_at) VALUES (?, ?, ?)`,
-        STORE_ID,
-        legacyVersion.version,
-        legacyVersion.updated_at
-      );
-    }
-    const migratedCount = this.sql.exec(`SELECT COUNT(*) AS count FROM app_secrets_store`).toArray()[0];
-    if (!legacyVersion && (migratedCount?.count ?? 0) > 0) {
-      this.sql.exec(
-        `INSERT OR REPLACE INTO app_secret_store_versions (id, version, updated_at) VALUES (?, ?, ?)`,
-        STORE_ID,
-        1,
-        (/* @__PURE__ */ new Date()).toISOString()
-      );
-    }
-  }
-  ensureInitialized() {
-    if (this.initialized) return;
-    this.initialized = true;
-    this.sql.exec(`
-      CREATE TABLE IF NOT EXISTS app_secrets_store (
-        name_hash TEXT NOT NULL,
-        name_encrypted TEXT NOT NULL,
-        value_encrypted TEXT NOT NULL,
-        version INTEGER NOT NULL,
-        updated_by TEXT,
-        created_at TEXT NOT NULL,
-        updated_at TEXT NOT NULL,
-        PRIMARY KEY (name_hash)
-      )
-    `);
-    this.sql.exec(`
-      CREATE TABLE IF NOT EXISTS app_secret_store_versions (
-        id TEXT PRIMARY KEY,
-        version INTEGER NOT NULL,
-        updated_at TEXT NOT NULL
-      )
-    `);
-    this.migrateLegacyProductionSecrets();
-  }
-  requireKey() {
-    if (!this.env.APP_SECRETS_KEY) {
-      throw new Error("APP_SECRETS_KEY binding is missing");
-    }
-    return this.env.APP_SECRETS_KEY;
-  }
-  storeVersion() {
-    const row = this.sql.exec(
-      `SELECT version FROM app_secret_store_versions WHERE id = ?`,
-      STORE_ID
-    ).toArray()[0];
-    return row?.version ?? 0;
-  }
-  bumpStoreVersion(now) {
-    const next = this.storeVersion() + 1;
-    this.sql.exec(
-      `INSERT OR REPLACE INTO app_secret_store_versions (id, version, updated_at) VALUES (?, ?, ?)`,
-      STORE_ID,
-      next,
-      now
-    );
-  }
-};
-function validateSecretName(name) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
-    throw new Error(`Invalid secret name "${name}"`);
-  }
-}
-function json(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function encryptText(root, plaintext, info) {
-  const salt = crypto.getRandomValues(new Uint8Array(16));
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const key = await aesKey(root, salt, info);
-  const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(plaintext));
-  return [VERSION, b64(salt), b64(iv), b64(new Uint8Array(ciphertext))].join(":");
-}
-async function decryptText(root, encoded, info) {
-  const [version, saltB64, ivB64, bodyB64] = encoded.split(":");
-  if (version !== VERSION || !saltB64 || !ivB64 || !bodyB64) {
-    throw new Error("Corrupt app secret ciphertext");
-  }
-  const key = await aesKey(root, unb64(saltB64), info);
-  const plaintext = await crypto.subtle.decrypt(
-    { name: "AES-GCM", iv: bytes(unb64(ivB64)) },
-    key,
-    bytes(unb64(bodyB64))
-  );
-  return new TextDecoder().decode(plaintext);
-}
-async function hashName(root, name) {
-  const key = await hmacKey(root, HMAC_INFO);
-  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`production:${name}`));
-  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function aesKey(root, salt, info) {
-  const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(root), "HKDF", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: bytes(salt), info: new TextEncoder().encode(info) },
-    base,
-    { name: "AES-GCM", length: 256 },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-async function hmacKey(root, info) {
-  const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(root), "HKDF", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: bytes(new Uint8Array(16)), info: new TextEncoder().encode(info) },
-    base,
-    { name: "HMAC", hash: "SHA-256", length: 256 },
-    false,
-    ["sign"]
-  );
-}
-function b64(bytes2) {
-  let s = "";
-  for (const b of bytes2) s += String.fromCharCode(b);
-  return btoa(s);
-}
-function unb64(value) {
-  const s = atob(value);
-  const out = new Uint8Array(s.length);
-  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i);
-  return out;
-}
-function bytes(input) {
-  return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
-}
-
 // src/server/rooms/job-room.ts
 var RUNNING_STALE_MS = 16 * 60 * 1e3;
 var DEFAULT_RETENTION_MS = 24 * 60 * 60 * 1e3;
@@ -6119,7 +5806,6 @@ var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
   "AUTH_WORKER_URL",
   "APP_IDENTITY_TOKEN",
   "APP_OWNER_JWT",
-  "APP_SECRETS_KEY",
   "USAGE_EVENTS"
 ]);
 function validateBindingManifest(manifest) {
@@ -6956,8 +6642,8 @@ import { importSPKI, jwtVerify } from "jose";
 
 // src/server/auth/utils.ts
 var BASE64_URL_REGEX = /^[A-Za-z0-9-_]+$/;
-function bufferToHex(bytes2) {
-  const view = bytes2 instanceof Uint8Array ? bytes2 : new Uint8Array(bytes2);
+function bufferToHex(bytes) {
+  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
   let hex = "";
   for (const byte of view) {
     hex += byte.toString(16).padStart(2, "0");
@@ -6980,9 +6666,9 @@ function decodeJwtPayload(token) {
   if (!BASE64_URL_REGEX.test(payloadSegment)) return void 0;
   try {
     const normalized = payloadSegment.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payloadSegment.length / 4) * 4, "=");
-    const bytes2 = base64ToUint8Array(normalized);
-    const json2 = new TextDecoder().decode(bytes2);
-    const payload = JSON.parse(json2);
+    const bytes = base64ToUint8Array(normalized);
+    const json = new TextDecoder().decode(bytes);
+    const payload = JSON.parse(json);
     return {
       iss: payload.iss ?? null,
       aud: payload.aud ?? null,
@@ -7206,176 +6892,6 @@ async function generateAppleClientSecret(apple) {
   return token;
 }
 
-// src/server/secrets.ts
-var DEFAULT_REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-function createSecrets(env, options = {}) {
-  const refreshIntervalMs = options.refreshIntervalMs ?? DEFAULT_REFRESH_INTERVAL_MS;
-  const now = options.now ?? (() => Date.now());
-  const cache = /* @__PURE__ */ new Map();
-  let loadedAll = null;
-  let loadedVersion = 0;
-  let lastCheckedAt = 0;
-  function stub() {
-    if (!env.SECRETS_ROOMS) throw new Error("SECRETS_ROOMS binding is missing");
-    if (!env.APP_SECRETS_KEY) throw new Error("APP_SECRETS_KEY binding is missing");
-    const id = env.SECRETS_ROOMS.idFromName("app-secrets");
-    return env.SECRETS_ROOMS.get(id);
-  }
-  async function fetchJson(path) {
-    const res = await stub().fetch(`https://app-secrets/${path}`, {
-      headers: { "x-deepspace-internal": "app-secrets" }
-    });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) throw new Error(body.error ?? `App secrets unavailable (${res.status})`);
-    return body;
-  }
-  async function pullAll() {
-    const body = await fetchJson("pull");
-    const version = typeof body.version === "number" ? body.version : 0;
-    cache.clear();
-    for (const [name, value] of Object.entries(body.secrets ?? {})) {
-      cache.set(name, value);
-    }
-    loadedVersion = version;
-    lastCheckedAt = now();
-    return version;
-  }
-  async function loadAll() {
-    await pullAll();
-  }
-  async function ensureLoaded() {
-    if (!loadedAll) {
-      loadedAll = loadAll().catch((err) => {
-        loadedAll = null;
-        throw err;
-      });
-    }
-    await loadedAll;
-  }
-  async function maybeCheckForUpdates() {
-    if (!loadedAll) return;
-    if (refreshIntervalMs < 0) return;
-    if (now() - lastCheckedAt < refreshIntervalMs) return;
-    try {
-      await client.checkForUpdates();
-    } catch {
-    }
-  }
-  function localDevValue(name) {
-    const value = env[name];
-    return env.APP_SECRETS_LOCAL_FALLBACK === "true" && typeof value === "string" ? value : void 0;
-  }
-  const client = {
-    async get(name) {
-      const local = localDevValue(name);
-      if (local !== void 0) return local;
-      if (!cache.has(name)) await ensureLoaded();
-      else await maybeCheckForUpdates();
-      return cache.get(name);
-    },
-    async require(name) {
-      const value = await this.get(name);
-      if (value === void 0) throw new Error(`Missing app secret "${name}"`);
-      return value;
-    },
-    async getMany(names) {
-      const out = {};
-      for (const name of names) out[name] = await this.get(name);
-      return out;
-    },
-    async preload(names) {
-      if (env.APP_SECRETS_LOCAL_FALLBACK === "true") {
-        const missing = [];
-        for (const name of names) {
-          const local = localDevValue(name);
-          if (local !== void 0) cache.set(name, local);
-          else missing.push(name);
-        }
-        if (missing.length === 0) {
-          await maybeCheckForUpdates();
-          return;
-        }
-      }
-      await ensureLoaded();
-      await maybeCheckForUpdates();
-    },
-    async refresh(refreshOptions = {}) {
-      if (refreshOptions.force || !loadedAll) {
-        const previous = loadedVersion;
-        const version = await pullAll();
-        loadedAll = Promise.resolve();
-        return { changed: version !== previous, version };
-      }
-      return this.checkForUpdates();
-    },
-    async checkForUpdates() {
-      await ensureLoaded();
-      const body = await fetchJson("version");
-      const version = typeof body.version === "number" ? body.version : 0;
-      lastCheckedAt = now();
-      if (version === loadedVersion) return { changed: false, version };
-      const pulledVersion = await pullAll();
-      return { changed: true, version: pulledVersion };
-    },
-    invalidate() {
-      cache.clear();
-      loadedAll = null;
-      loadedVersion = 0;
-      lastCheckedAt = 0;
-    },
-    async withFreshSecrets(operation, retryOptions = {}) {
-      let first;
-      try {
-        first = await operation({ secrets: client, attempt: 1, refreshed: false });
-      } catch (err) {
-        if (!shouldRefreshOnError(err)) throw err;
-        const refresh = await refreshAfterFailure(err);
-        if (!refresh.changed && !retryOptions.retryWhenUnchanged) throw err;
-        return operation({ secrets: client, attempt: 2, refreshed: refresh.changed });
-      }
-      if (first instanceof Response && shouldRefreshOnStatus(first.status)) {
-        const refresh = await refreshAfterFailure(first);
-        if (refresh.changed || retryOptions.retryWhenUnchanged) {
-          return operation({ secrets: client, attempt: 2, refreshed: refresh.changed });
-        }
-      }
-      return first;
-    }
-  };
-  async function refreshAfterFailure(original) {
-    try {
-      return await client.refresh({ force: true });
-    } catch (err) {
-      const originalMessage = describeFailure(original);
-      const refreshMessage = err instanceof Error ? err.message : String(err);
-      throw new Error(`Secret refresh failed after API failure (${originalMessage}): ${refreshMessage}`);
-    }
-  }
-  return client;
-}
-function shouldRefreshOnError(error) {
-  const status = statusFromError(error);
-  return status !== void 0 && shouldRefreshOnStatus(status);
-}
-function shouldRefreshOnStatus(status) {
-  return status === 401 || status === 403;
-}
-function statusFromError(error) {
-  if (!error || typeof error !== "object") return void 0;
-  const record = error;
-  if (typeof record.status === "number") return record.status;
-  if (typeof record.statusCode === "number") return record.statusCode;
-  if (typeof record.response?.status === "number") return record.response.status;
-  return void 0;
-}
-function describeFailure(value) {
-  if (value instanceof Response) return `HTTP ${value.status}`;
-  if (value instanceof Error) return value.message;
-  const status = statusFromError(value);
-  if (status) return `HTTP ${status}`;
-  return String(value);
-}
-
 // src/shared/subscription.ts
 var ENTITLED_STATUSES = /* @__PURE__ */ new Set([
   "active",
@@ -7557,7 +7073,6 @@ export {
   SYSTEM_COLLECTION_SCHEMAS,
   SYSTEM_MANAGED_COLUMNS,
   SchemaRegistry,
-  SecretsRoom,
   SubscriptionAuthError,
   SubscriptionRequiredError,
   USERS_COLUMNS,
@@ -7594,7 +7109,6 @@ export {
   createDeepSpaceAI,
   createDeepSpaceAuth,
   createScopedR2Handler,
-  createSecrets,
   dataToColumnValues,
   decodeJwtPayload,
   deleteChatCascade,