deepspace 0.4.4 → 0.4.5

package/dist/worker.js

@@ -3175,13 +3175,13 @@ var YjsRoom = class extends BaseRoom {
   onMessage(ws, user, message) {
   }
   onBinaryMessage(ws, user, data) {
-    const bytes2 = new Uint8Array(data);
-    const decoder = createDecoder(bytes2);
+    const bytes = new Uint8Array(data);
+    const decoder = createDecoder(bytes);
     const messageType = readVarUint(decoder);
     if (messageType === MSG_SYNC) {
-      this.handleSync(ws, decoder, bytes2);
+      this.handleSync(ws, decoder, bytes);
     } else if (messageType === MSG_AWARENESS) {
-      this.handleAwareness(ws, decoder, bytes2);
+      this.handleAwareness(ws, decoder, bytes);
     }
   }
   onDisconnect(ws, user) {
@@ -4386,319 +4386,6 @@ function cronMatches(parsed, timezone, date) {
   return parsed.minute.has(minute) && parsed.hour.has(hour) && parsed.dayOfMonth.has(dayOfMonth) && parsed.month.has(month) && parsed.dayOfWeek.has(dayOfWeek);
 }
 
-// src/server/rooms/secrets-room.ts
-var INTERNAL_HEADER = "x-deepspace-internal";
-var INTERNAL_VALUE = "app-secrets";
-var VERSION = "app-secret-v1";
-var NAME_INFO = "deepspace app secret name v1";
-var VALUE_INFO = "deepspace app secret value v1";
-var HMAC_INFO = "deepspace app secret lookup v1";
-var STORE_ID = "default";
-var SecretsRoom = class extends BaseRoom {
-  initialized = false;
-  onMessage(_ws, _user, _message) {
-  }
-  async fetch(request) {
-    this.ensureInitialized();
-    return super.fetch(request);
-  }
-  async onRequest(request) {
-    if (request.headers.get(INTERNAL_HEADER) !== INTERNAL_VALUE) {
-      return json({ error: "Not found" }, 404);
-    }
-    const url = new URL(request.url);
-    try {
-      if (request.method === "GET" && url.pathname.endsWith("/list")) {
-        return json({ version: this.storeVersion(), secrets: await this.list() });
-      }
-      if (request.method === "GET" && url.pathname.endsWith("/pull")) {
-        return json({ version: this.storeVersion(), secrets: await this.pull() });
-      }
-      if (request.method === "GET" && url.pathname.endsWith("/version")) {
-        return json({ version: this.storeVersion() });
-      }
-      if (request.method === "PATCH" && url.pathname.endsWith("/patch")) {
-        const body = await request.json();
-        const result = await this.patch(body);
-        return json(result);
-      }
-      if (request.method === "PUT" && url.pathname.endsWith("/replace")) {
-        const body = await request.json();
-        const result = await this.replace(body);
-        return json(result);
-      }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      const status = message.includes("conflict") ? 409 : 500;
-      return json({ error: message }, status);
-    }
-    return json({ error: "Not found" }, 404);
-  }
-  async list() {
-    const rows = this.sql.exec(
-      `SELECT name_encrypted, version, updated_by, created_at, updated_at
-         FROM app_secrets_store ORDER BY updated_at DESC`
-    ).toArray();
-    const out = [];
-    for (const row of rows) {
-      out.push({
-        name: await decryptText(this.requireKey(), row.name_encrypted, NAME_INFO),
-        version: row.version,
-        createdAt: row.created_at,
-        updatedAt: row.updated_at,
-        updatedBy: row.updated_by
-      });
-    }
-    return out.sort((a, b) => a.name.localeCompare(b.name));
-  }
-  async pull() {
-    const rows = this.sql.exec(
-      `SELECT name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at
-         FROM app_secrets_store`
-    ).toArray();
-    const out = {};
-    for (const row of rows) {
-      const name = await decryptText(this.requireKey(), row.name_encrypted, NAME_INFO);
-      out[name] = await decryptText(this.requireKey(), row.value_encrypted, VALUE_INFO);
-    }
-    return out;
-  }
-  async patch(body) {
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const actor = body.updatedBy ?? null;
-    const key = this.requireKey();
-    const setEntries = Object.entries(body.set ?? {});
-    const deleteNames = body.delete ?? [];
-    for (const name of [...setEntries.map(([name2]) => name2), ...deleteNames]) {
-      validateSecretName(name);
-    }
-    const writes = [];
-    for (const [name, value] of setEntries) {
-      const nameHash = await hashName(key, name);
-      const existing = this.sql.exec(
-        `SELECT version, created_at FROM app_secrets_store WHERE name_hash = ?`,
-        nameHash
-      ).toArray()[0];
-      writes.push({
-        nameHash,
-        nameEncrypted: await encryptText(key, name, NAME_INFO),
-        valueEncrypted: await encryptText(key, value, VALUE_INFO),
-        version: (existing?.version ?? 0) + 1,
-        createdAt: existing?.created_at ?? now
-      });
-    }
-    const deletes = [];
-    for (const name of deleteNames) {
-      deletes.push(await hashName(key, name));
-    }
-    this.transaction(() => {
-      for (const write of writes) {
-        this.sql.exec(
-          `INSERT OR REPLACE INTO app_secrets_store
-           (name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?)`,
-          write.nameHash,
-          write.nameEncrypted,
-          write.valueEncrypted,
-          write.version,
-          actor,
-          write.createdAt,
-          now
-        );
-      }
-      for (const nameHash of deletes) {
-        this.sql.exec(`DELETE FROM app_secrets_store WHERE name_hash = ?`, nameHash);
-      }
-      this.bumpStoreVersion(now);
-    });
-    return { version: this.storeVersion(), secrets: await this.list() };
-  }
-  async replace(body) {
-    const next = body.secrets ?? {};
-    for (const name of Object.keys(next)) validateSecretName(name);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const actor = body.updatedBy ?? null;
-    const key = this.requireKey();
-    const writes = [];
-    for (const [name, value] of Object.entries(next)) {
-      writes.push({
-        nameHash: await hashName(key, name),
-        nameEncrypted: await encryptText(key, name, NAME_INFO),
-        valueEncrypted: await encryptText(key, value, VALUE_INFO)
-      });
-    }
-    this.transaction(() => {
-      this.sql.exec(`DELETE FROM app_secrets_store`);
-      for (const write of writes) {
-        this.sql.exec(
-          `INSERT INTO app_secrets_store
-           (name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at)
-           VALUES (?, ?, ?, 1, ?, ?, ?)`,
-          write.nameHash,
-          write.nameEncrypted,
-          write.valueEncrypted,
-          actor,
-          now,
-          now
-        );
-      }
-      this.bumpStoreVersion(now);
-    });
-    return { version: this.storeVersion(), secrets: await this.list() };
-  }
-  transaction(run) {
-    this.state.storage.transactionSync(run);
-  }
-  migrateLegacyProductionSecrets() {
-    const legacyExists = this.sql.exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'app_secrets'`).toArray().length > 0;
-    if (!legacyExists) return;
-    const currentCount = this.sql.exec(`SELECT COUNT(*) AS count FROM app_secrets_store`).toArray()[0];
-    if ((currentCount?.count ?? 0) > 0) return;
-    this.sql.exec(`
-      INSERT OR IGNORE INTO app_secrets_store
-        (name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at)
-      SELECT name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at
-      FROM app_secrets
-      WHERE env = 'production'
-    `);
-    const legacyVersionExists = this.sql.exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'app_secret_env_versions'`).toArray().length > 0;
-    const legacyVersion = legacyVersionExists ? this.sql.exec(`SELECT version, updated_at FROM app_secret_env_versions WHERE env = 'production'`).toArray()[0] : void 0;
-    if (legacyVersion) {
-      this.sql.exec(
-        `INSERT OR REPLACE INTO app_secret_store_versions (id, version, updated_at) VALUES (?, ?, ?)`,
-        STORE_ID,
-        legacyVersion.version,
-        legacyVersion.updated_at
-      );
-    }
-    const migratedCount = this.sql.exec(`SELECT COUNT(*) AS count FROM app_secrets_store`).toArray()[0];
-    if (!legacyVersion && (migratedCount?.count ?? 0) > 0) {
-      this.sql.exec(
-        `INSERT OR REPLACE INTO app_secret_store_versions (id, version, updated_at) VALUES (?, ?, ?)`,
-        STORE_ID,
-        1,
-        (/* @__PURE__ */ new Date()).toISOString()
-      );
-    }
-  }
-  ensureInitialized() {
-    if (this.initialized) return;
-    this.initialized = true;
-    this.sql.exec(`
-      CREATE TABLE IF NOT EXISTS app_secrets_store (
-        name_hash TEXT NOT NULL,
-        name_encrypted TEXT NOT NULL,
-        value_encrypted TEXT NOT NULL,
-        version INTEGER NOT NULL,
-        updated_by TEXT,
-        created_at TEXT NOT NULL,
-        updated_at TEXT NOT NULL,
-        PRIMARY KEY (name_hash)
-      )
-    `);
-    this.sql.exec(`
-      CREATE TABLE IF NOT EXISTS app_secret_store_versions (
-        id TEXT PRIMARY KEY,
-        version INTEGER NOT NULL,
-        updated_at TEXT NOT NULL
-      )
-    `);
-    this.migrateLegacyProductionSecrets();
-  }
-  requireKey() {
-    if (!this.env.APP_SECRETS_KEY) {
-      throw new Error("APP_SECRETS_KEY binding is missing");
-    }
-    return this.env.APP_SECRETS_KEY;
-  }
-  storeVersion() {
-    const row = this.sql.exec(
-      `SELECT version FROM app_secret_store_versions WHERE id = ?`,
-      STORE_ID
-    ).toArray()[0];
-    return row?.version ?? 0;
-  }
-  bumpStoreVersion(now) {
-    const next = this.storeVersion() + 1;
-    this.sql.exec(
-      `INSERT OR REPLACE INTO app_secret_store_versions (id, version, updated_at) VALUES (?, ?, ?)`,
-      STORE_ID,
-      next,
-      now
-    );
-  }
-};
-function validateSecretName(name) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
-    throw new Error(`Invalid secret name "${name}"`);
-  }
-}
-function json(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function encryptText(root, plaintext, info) {
-  const salt = crypto.getRandomValues(new Uint8Array(16));
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const key = await aesKey(root, salt, info);
-  const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(plaintext));
-  return [VERSION, b64(salt), b64(iv), b64(new Uint8Array(ciphertext))].join(":");
-}
-async function decryptText(root, encoded, info) {
-  const [version, saltB64, ivB64, bodyB64] = encoded.split(":");
-  if (version !== VERSION || !saltB64 || !ivB64 || !bodyB64) {
-    throw new Error("Corrupt app secret ciphertext");
-  }
-  const key = await aesKey(root, unb64(saltB64), info);
-  const plaintext = await crypto.subtle.decrypt(
-    { name: "AES-GCM", iv: bytes(unb64(ivB64)) },
-    key,
-    bytes(unb64(bodyB64))
-  );
-  return new TextDecoder().decode(plaintext);
-}
-async function hashName(root, name) {
-  const key = await hmacKey(root, HMAC_INFO);
-  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`production:${name}`));
-  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function aesKey(root, salt, info) {
-  const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(root), "HKDF", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: bytes(salt), info: new TextEncoder().encode(info) },
-    base,
-    { name: "AES-GCM", length: 256 },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-async function hmacKey(root, info) {
-  const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(root), "HKDF", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: bytes(new Uint8Array(16)), info: new TextEncoder().encode(info) },
-    base,
-    { name: "HMAC", hash: "SHA-256", length: 256 },
-    false,
-    ["sign"]
-  );
-}
-function b64(bytes2) {
-  let s = "";
-  for (const b of bytes2) s += String.fromCharCode(b);
-  return btoa(s);
-}
-function unb64(value) {
-  const s = atob(value);
-  const out = new Uint8Array(s.length);
-  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i);
-  return out;
-}
-function bytes(input) {
-  return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
-}
-
 // src/server/rooms/job-room.ts
 var RUNNING_STALE_MS = 16 * 60 * 1e3;
 var DEFAULT_RETENTION_MS = 24 * 60 * 60 * 1e3;
@@ -5316,7 +5003,6 @@ var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
   "AUTH_WORKER_URL",
   "APP_IDENTITY_TOKEN",
   "APP_OWNER_JWT",
-  "APP_SECRETS_KEY",
   "USAGE_EVENTS"
 ]);
 function validateBindingManifest(manifest) {
@@ -7244,8 +6930,8 @@ import { importSPKI, jwtVerify } from "jose";
 
 // src/server/auth/utils.ts
 var BASE64_URL_REGEX = /^[A-Za-z0-9-_]+$/;
-function bufferToHex(bytes2) {
-  const view = bytes2 instanceof Uint8Array ? bytes2 : new Uint8Array(bytes2);
+function bufferToHex(bytes) {
+  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
   let hex = "";
   for (const byte of view) {
     hex += byte.toString(16).padStart(2, "0");
@@ -7268,9 +6954,9 @@ function decodeJwtPayload(token) {
   if (!BASE64_URL_REGEX.test(payloadSegment)) return void 0;
   try {
     const normalized = payloadSegment.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payloadSegment.length / 4) * 4, "=");
-    const bytes2 = base64ToUint8Array(normalized);
-    const json2 = new TextDecoder().decode(bytes2);
-    const payload = JSON.parse(json2);
+    const bytes = base64ToUint8Array(normalized);
+    const json = new TextDecoder().decode(bytes);
+    const payload = JSON.parse(json);
     return {
       iss: payload.iss ?? null,
       aud: payload.aud ?? null,
@@ -7493,176 +7179,6 @@ async function generateAppleClientSecret(apple) {
   cachedAppleSecret = { keyId: apple.keyId, token, expiresAt };
   return token;
 }
-
-// src/server/secrets.ts
-var DEFAULT_REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-function createSecrets(env, options = {}) {
-  const refreshIntervalMs = options.refreshIntervalMs ?? DEFAULT_REFRESH_INTERVAL_MS;
-  const now = options.now ?? (() => Date.now());
-  const cache = /* @__PURE__ */ new Map();
-  let loadedAll = null;
-  let loadedVersion = 0;
-  let lastCheckedAt = 0;
-  function stub() {
-    if (!env.SECRETS_ROOMS) throw new Error("SECRETS_ROOMS binding is missing");
-    if (!env.APP_SECRETS_KEY) throw new Error("APP_SECRETS_KEY binding is missing");
-    const id = env.SECRETS_ROOMS.idFromName("app-secrets");
-    return env.SECRETS_ROOMS.get(id);
-  }
-  async function fetchJson(path) {
-    const res = await stub().fetch(`https://app-secrets/${path}`, {
-      headers: { "x-deepspace-internal": "app-secrets" }
-    });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) throw new Error(body.error ?? `App secrets unavailable (${res.status})`);
-    return body;
-  }
-  async function pullAll() {
-    const body = await fetchJson("pull");
-    const version = typeof body.version === "number" ? body.version : 0;
-    cache.clear();
-    for (const [name, value] of Object.entries(body.secrets ?? {})) {
-      cache.set(name, value);
-    }
-    loadedVersion = version;
-    lastCheckedAt = now();
-    return version;
-  }
-  async function loadAll() {
-    await pullAll();
-  }
-  async function ensureLoaded() {
-    if (!loadedAll) {
-      loadedAll = loadAll().catch((err) => {
-        loadedAll = null;
-        throw err;
-      });
-    }
-    await loadedAll;
-  }
-  async function maybeCheckForUpdates() {
-    if (!loadedAll) return;
-    if (refreshIntervalMs < 0) return;
-    if (now() - lastCheckedAt < refreshIntervalMs) return;
-    try {
-      await client.checkForUpdates();
-    } catch {
-    }
-  }
-  function localDevValue(name) {
-    const value = env[name];
-    return env.APP_SECRETS_LOCAL_FALLBACK === "true" && typeof value === "string" ? value : void 0;
-  }
-  const client = {
-    async get(name) {
-      const local = localDevValue(name);
-      if (local !== void 0) return local;
-      if (!cache.has(name)) await ensureLoaded();
-      else await maybeCheckForUpdates();
-      return cache.get(name);
-    },
-    async require(name) {
-      const value = await this.get(name);
-      if (value === void 0) throw new Error(`Missing app secret "${name}"`);
-      return value;
-    },
-    async getMany(names) {
-      const out = {};
-      for (const name of names) out[name] = await this.get(name);
-      return out;
-    },
-    async preload(names) {
-      if (env.APP_SECRETS_LOCAL_FALLBACK === "true") {
-        const missing = [];
-        for (const name of names) {
-          const local = localDevValue(name);
-          if (local !== void 0) cache.set(name, local);
-          else missing.push(name);
-        }
-        if (missing.length === 0) {
-          await maybeCheckForUpdates();
-          return;
-        }
-      }
-      await ensureLoaded();
-      await maybeCheckForUpdates();
-    },
-    async refresh(refreshOptions = {}) {
-      if (refreshOptions.force || !loadedAll) {
-        const previous = loadedVersion;
-        const version = await pullAll();
-        loadedAll = Promise.resolve();
-        return { changed: version !== previous, version };
-      }
-      return this.checkForUpdates();
-    },
-    async checkForUpdates() {
-      await ensureLoaded();
-      const body = await fetchJson("version");
-      const version = typeof body.version === "number" ? body.version : 0;
-      lastCheckedAt = now();
-      if (version === loadedVersion) return { changed: false, version };
-      const pulledVersion = await pullAll();
-      return { changed: true, version: pulledVersion };
-    },
-    invalidate() {
-      cache.clear();
-      loadedAll = null;
-      loadedVersion = 0;
-      lastCheckedAt = 0;
-    },
-    async withFreshSecrets(operation, retryOptions = {}) {
-      let first;
-      try {
-        first = await operation({ secrets: client, attempt: 1, refreshed: false });
-      } catch (err) {
-        if (!shouldRefreshOnError(err)) throw err;
-        const refresh = await refreshAfterFailure(err);
-        if (!refresh.changed && !retryOptions.retryWhenUnchanged) throw err;
-        return operation({ secrets: client, attempt: 2, refreshed: refresh.changed });
-      }
-      if (first instanceof Response && shouldRefreshOnStatus(first.status)) {
-        const refresh = await refreshAfterFailure(first);
-        if (refresh.changed || retryOptions.retryWhenUnchanged) {
-          return operation({ secrets: client, attempt: 2, refreshed: refresh.changed });
-        }
-      }
-      return first;
-    }
-  };
-  async function refreshAfterFailure(original) {
-    try {
-      return await client.refresh({ force: true });
-    } catch (err) {
-      const originalMessage = describeFailure(original);
-      const refreshMessage = err instanceof Error ? err.message : String(err);
-      throw new Error(`Secret refresh failed after API failure (${originalMessage}): ${refreshMessage}`);
-    }
-  }
-  return client;
-}
-function shouldRefreshOnError(error) {
-  const status = statusFromError(error);
-  return status !== void 0 && shouldRefreshOnStatus(status);
-}
-function shouldRefreshOnStatus(status) {
-  return status === 401 || status === 403;
-}
-function statusFromError(error) {
-  if (!error || typeof error !== "object") return void 0;
-  const record = error;
-  if (typeof record.status === "number") return record.status;
-  if (typeof record.statusCode === "number") return record.statusCode;
-  if (typeof record.response?.status === "number") return record.response.status;
-  return void 0;
-}
-function describeFailure(value) {
-  if (value instanceof Response) return `HTTP ${value.status}`;
-  if (value instanceof Error) return value.message;
-  const status = statusFromError(value);
-  if (status) return `HTTP ${status}`;
-  return String(value);
-}
 export {
   AI_CHATS_SCHEMA,
   AI_MESSAGES_SCHEMA,
@@ -7710,7 +7226,6 @@ export {
   SYSTEM_COLLECTIONS,
   SYSTEM_MANAGED_COLUMNS,
   SchemaRegistry,
-  SecretsRoom,
   USERS_COLUMNS,
   VOTING_SCHEMAS,
   WORKSPACE_SCHEMAS,
@@ -7745,7 +7260,6 @@ export {
   createDeepSpaceAuth,
   createEncoder,
   createScopedR2Handler,
-  createSecrets,
   dataToColumnValues,
   decodeJwtPayload,
   deleteChatCascade,