deepspace 0.4.4 → 0.5.0

package/dist/server.js

@@ -475,7 +475,8 @@ function buildCronContext(env, ownerUserId, roomId = "default") {
       if (opts?.where) params.where = opts.where;
       if (opts?.limit) params.limit = opts.limit;
       const data = await executeTool3("records.query", params);
-      return data.records || [];
+      const records2 = data?.records;
+      return records2 ?? [];
     },
     async create(collection, data) {
       return executeTool3("records.create", { collection, data });
@@ -632,7 +633,8 @@ async function composioTools(env, options) {
   if (!list.ok || !list.success) {
     throw new Error(`composioTools: failed to list Composio tools: ${list.detail}`);
   }
-  const items = Array.isArray(list.data?.items) ? list.data.items : [];
+  const listItems = list.data?.items;
+  const items = Array.isArray(listItems) ? listItems : [];
   const tools = {};
   for (const item of items) {
     if (!item?.slug) continue;
@@ -1333,7 +1335,7 @@ var BaseRoom = class {
       console.error(`[${this.constructor.name}] Message error:`, e);
     }
   }
-  async webSocketClose(ws, code, reason) {
+  async webSocketClose(ws, _code, _reason) {
     const attachment = ws.deserializeAttachment();
     if (attachment) {
       try {
@@ -1358,12 +1360,12 @@ var BaseRoom = class {
    * Return an augmented attachment to serialize on the WebSocket,
    * or void to use the default attachment.
    */
-  onConnect(ws, user) {
+  onConnect(_ws, _user) {
   }
   /**
    * Called when a WebSocket disconnects.
    */
-  onDisconnect(ws, user) {
+  onDisconnect(_ws, _user) {
   }
   // ==========================================================================
   // Utilities
@@ -1611,7 +1613,7 @@ function coerceValue(value, storage, interpretation) {
     if (m) return parseFloat(m[1]) / 100;
   }
   if (interpretation.kind === "currency") {
-    const cleaned2 = s.replace(/[^0-9.\-]/g, "");
+    const cleaned2 = s.replace(/[^0-9.-]/g, "");
     const n2 = parseFloat(cleaned2);
     if (!isNaN(n2)) return n2;
     return s;
@@ -1801,9 +1803,6 @@ var SchemaRegistry = class {
   has(name) {
     return this.trusted.has(name);
   }
-  hasTrusted(name) {
-    return this.trusted.has(name);
-  }
   all() {
     return Array.from(this.trusted.values());
   }
@@ -2118,7 +2117,7 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
   const columns = getResolvedColumns(schema);
   const existing = getRecord(ctx.sql, collection, recordId, schema);
   const isUpdate = existing !== null;
-  let mergedData = isUpdate ? { ...existing.data, ...data } : { ...data };
+  const mergedData = isUpdate ? { ...existing.data, ...data } : { ...data };
   for (const col of columns) {
     if (col.readonly) continue;
     if (!isUpdate) {
@@ -2173,7 +2172,10 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
     const permCtx = ctx.getPermissionContext();
     if (isUpdate) {
       if (!canUpdate(schema, userRole, { ...existing, recordId }, userId, permCtx)) {
-        return { success: false, error: `UPDATE DENIED: role=${userRole}, collection=${collection}` };
+        return {
+          success: false,
+          error: `UPDATE DENIED: role=${userRole}, collection=${collection}`
+        };
       }
       const fieldError = checkFieldPermissions(schema, userRole, finalData, existing.data);
       if (fieldError) {
@@ -2181,7 +2183,10 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
       }
     } else {
       if (!canCreate(schema, userRole)) {
-        return { success: false, error: `CREATE DENIED: role=${userRole}, collection=${collection}` };
+        return {
+          success: false,
+          error: `CREATE DENIED: role=${userRole}, collection=${collection}`
+        };
       }
     }
   }
@@ -2203,7 +2208,10 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
     );
     if (existing2.toArray().length > 0) {
       const fields = schema.uniqueOn.map((f) => `${f}=${finalData[f] ?? "null"}`).join(", ");
-      return { success: false, error: `Duplicate: a record with ${fields} already exists in ${collection}` };
+      return {
+        success: false,
+        error: `Duplicate: a record with ${fields} already exists in ${collection}`
+      };
     }
   }
   if (isUpdate) {
@@ -2217,13 +2225,16 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
     ctx.sql.exec(`UPDATE "${tbl}" SET ${setClauses.join(", ")} WHERE _row_id = ?`, ...params);
   } else {
     const colIds = Object.keys(colValues);
-    const allCols = ["_row_id", "_created_by", "_created_at", "_updated_at", ...colIds.map((c) => `"${c}"`)];
+    const allCols = [
+      "_row_id",
+      "_created_by",
+      "_created_at",
+      "_updated_at",
+      ...colIds.map((c) => `"${c}"`)
+    ];
     const placeholders = allCols.map(() => "?").join(", ");
     const params = [recordId, userId, now, now, ...colIds.map((c) => colValues[c])];
-    ctx.sql.exec(
-      `INSERT INTO "${tbl}" (${allCols.join(", ")}) VALUES (${placeholders})`,
-      ...params
-    );
+    ctx.sql.exec(`INSERT INTO "${tbl}" (${allCols.join(", ")}) VALUES (${placeholders})`, ...params);
   }
   const saved = getRecord(ctx.sql, collection, recordId, schema);
   const record = {
@@ -3456,9 +3467,21 @@ var RecordRoom = class extends BaseRoom {
   ownerUserId;
   /** True until the first fetch() completes — detects hibernation wake-up */
   freshConstruct = true;
+  /**
+   * Per-connection `[DO Perf]` timing logs are noisy on every hot path, so
+   * they're gated behind a `DEEPSPACE_DO_PERF` env binding (set it to any
+   * truthy value on the worker to opt in). Off by default.
+   */
+  get perfLogEnabled() {
+    return !!this.env?.DEEPSPACE_DO_PERF;
+  }
   constructor(state, env, schemas = [], config = {}) {
     super(state, env);
-    this.schemaRegistry = new SchemaRegistry([...SYSTEM_COLLECTION_SCHEMAS, BASE_USERS_SCHEMA, ...schemas]);
+    this.schemaRegistry = new SchemaRegistry([
+      ...SYSTEM_COLLECTION_SCHEMAS,
+      BASE_USERS_SCHEMA,
+      ...schemas
+    ]);
     this.ownerUserId = config.ownerUserId ?? null;
     const wsCount = this.state.getWebSockets().length;
     if (wsCount > 0) {
@@ -3542,10 +3565,7 @@ var RecordRoom = class extends BaseRoom {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       for (const row of oldUsers) {
         const r = row;
-        const existing = this.sql.exec(
-          `SELECT 1 FROM c_users WHERE _row_id = ?`,
-          r.user_id
-        ).toArray();
+        const existing = this.sql.exec(`SELECT 1 FROM c_users WHERE _row_id = ?`, r.user_id).toArray();
         if (existing.length > 0) continue;
         this.sql.exec(
           `INSERT INTO c_users (_row_id, _created_by, _created_at, _updated_at, col_email, col_name, col_imageurl, col_role, col_createdat, col_lastseenat) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
@@ -3579,7 +3599,6 @@ var RecordRoom = class extends BaseRoom {
       }
       let migrated = 0;
       let skipped = 0;
-      const now = (/* @__PURE__ */ new Date()).toISOString();
       for (const row of rows) {
         const r = row;
         const schema = this.schemaRegistry.get(r.collection);
@@ -3588,17 +3607,11 @@ var RecordRoom = class extends BaseRoom {
           continue;
         }
         const tbl = collectionTableName(r.collection);
-        const tblExists = this.sql.exec(
-          `SELECT name FROM sqlite_master WHERE type='table' AND name=?`,
-          tbl
-        ).toArray().length > 0;
+        const tblExists = this.sql.exec(`SELECT name FROM sqlite_master WHERE type='table' AND name=?`, tbl).toArray().length > 0;
         if (!tblExists) {
           this.ensureCollectionTable(schema);
         }
-        const existing = this.sql.exec(
-          `SELECT 1 FROM "${tbl}" WHERE _row_id = ?`,
-          r.record_id
-        ).toArray();
+        const existing = this.sql.exec(`SELECT 1 FROM "${tbl}" WHERE _row_id = ?`, r.record_id).toArray();
         if (existing.length > 0) {
           skipped++;
           continue;
@@ -3613,9 +3626,21 @@ var RecordRoom = class extends BaseRoom {
         const columns = schema.columns.map(resolveColumn);
         const colValues = dataToColumnValues(data, columns);
         const colIds = Object.keys(colValues);
-        const allCols = ["_row_id", "_created_by", "_created_at", "_updated_at", ...colIds.map((c) => `"${c}"`)];
+        const allCols = [
+          "_row_id",
+          "_created_by",
+          "_created_at",
+          "_updated_at",
+          ...colIds.map((c) => `"${c}"`)
+        ];
         const placeholders = allCols.map(() => "?").join(", ");
-        const params = [r.record_id, r.created_by, r.created_at, r.updated_at, ...colIds.map((c) => colValues[c])];
+        const params = [
+          r.record_id,
+          r.created_by,
+          r.created_at,
+          r.updated_at,
+          ...colIds.map((c) => colValues[c])
+        ];
         this.sql.exec(
           `INSERT INTO "${tbl}" (${allCols.join(", ")}) VALUES (${placeholders})`,
           ...params
@@ -3623,7 +3648,9 @@ var RecordRoom = class extends BaseRoom {
         migrated++;
       }
       if (migrated > 0 || skipped > 0) {
-        console.log(`[RecordRoom] Migrated ${migrated} records from document-mode, ${skipped} skipped`);
+        console.log(
+          `[RecordRoom] Migrated ${migrated} records from document-mode, ${skipped} skipped`
+        );
       }
       this.sql.exec(`DROP TABLE IF EXISTS records`);
     } catch (error) {
@@ -3646,7 +3673,12 @@ var RecordRoom = class extends BaseRoom {
   // ============================================================================
   async onConnect(ws, user) {
     await this.ensureInitialized();
-    const timing = this._fetchTiming ?? { fetchStart: Date.now(), isColdStart: false, needsInit: false, initMs: 0 };
+    const timing = this._fetchTiming ?? {
+      fetchStart: Date.now(),
+      isColdStart: false,
+      needsInit: false,
+      initMs: 0
+    };
     const userId = user.userId;
     const userName = user.userName;
     const userEmail = user.userEmail;
@@ -3657,7 +3689,16 @@ var RecordRoom = class extends BaseRoom {
       const isOwner2 = this.ownerUserId != null && userId === this.ownerUserId;
       const regStart = Date.now();
       const defaultRole = this.schemaRegistry.get("users")?.defaultRole ?? "member";
-      const registeredUser = await registerUser(this.sql, userId, userName, userEmail, userImageUrl, isOwner2, defaultRole, this.schemaRegistry);
+      const registeredUser = await registerUser(
+        this.sql,
+        userId,
+        userName,
+        userEmail,
+        userImageUrl,
+        isOwner2,
+        defaultRole,
+        this.schemaRegistry
+      );
       const regMs = Date.now() - regStart;
       attachment = {
         userId: registeredUser.id,
@@ -3671,7 +3712,10 @@ var RecordRoom = class extends BaseRoom {
       };
       this.send(ws, { type: MSG.USER_INFO, payload: registeredUser });
       const totalMs = Date.now() - timing.fetchStart;
-      console.log(`[DO Perf] cold=${timing.isColdStart} | init: ${timing.initMs}ms reg: ${regMs}ms | total: ${totalMs}ms`);
+      if (this.perfLogEnabled)
+        console.log(
+          `[DO Perf] cold=${timing.isColdStart} | init: ${timing.initMs}ms reg: ${regMs}ms | total: ${totalMs}ms`
+        );
     } else {
       attachment = {
         userId,
@@ -3682,63 +3726,37 @@ var RecordRoom = class extends BaseRoom {
         yjsSubscriptions: [],
         yjsClientId: this.nextYjsClientId++
       };
-      this.send(ws, { type: MSG.USER_INFO, payload: {
-        id: userId,
-        name: "Anonymous",
-        email: "",
-        role: ROLE_ANONYMOUS,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-        lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
-      } });
+      this.send(ws, {
+        type: MSG.USER_INFO,
+        payload: {
+          id: userId,
+          name: "Anonymous",
+          email: "",
+          role: ROLE_ANONYMOUS,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      });
       const totalMs = Date.now() - timing.fetchStart;
-      console.log(`[DO Perf] cold=${timing.isColdStart} anon | total: ${totalMs}ms`);
+      if (this.perfLogEnabled)
+        console.log(`[DO Perf] cold=${timing.isColdStart} anon | total: ${totalMs}ms`);
     }
     this._fetchTiming = null;
     return attachment;
   }
-  async onMessage(ws, user, msg) {
-    await this.ensureInitialized();
-    const attachment = ws.deserializeAttachment();
-    if (!attachment) {
-      this.send(ws, { type: MSG.ERROR, payload: { error: "Connection not found" } });
-      return;
-    }
-    try {
-      await this.handleRecordMessage(ws, attachment, msg);
-    } catch (e) {
-      const errMsg = e instanceof Error ? e.message : String(e);
-      console.error(`[RecordRoom] Message handler error: ${errMsg}`);
-      this.send(ws, { type: MSG.ERROR, payload: { error: `Invalid message: ${errMsg}` } });
-    }
-  }
-  async onBinaryMessage(ws, user, data) {
-    await this.ensureInitialized();
-    const attachment = ws.deserializeAttachment();
-    if (!attachment) return;
-    try {
-      await handleYjsBinaryMessage(
-        this.createYjsContext(),
-        ws,
-        attachment,
-        new Uint8Array(data)
-      );
-    } catch (e) {
-      console.error("[RecordRoom] Yjs binary message error:", e);
-    }
-  }
-  onDisconnect(ws, user) {
-    console.log(`[RecordRoom] webSocketClose`);
-    try {
-      const attachment = ws.deserializeAttachment();
-      if (attachment) {
-        broadcastAwarenessRemoval(this.createYjsContext(), attachment);
-      }
-    } catch {
-    }
+  /**
+   * Required to satisfy BaseRoom's abstract contract, but never invoked:
+   * RecordRoom overrides `webSocketMessage`/`webSocketClose` directly (below),
+   * so the BaseRoom dispatch path that would call this never runs. All real
+   * message handling lives in `handleRecordMessage`.
+   */
+  onMessage() {
+    throw new Error("RecordRoom.onMessage is unreachable; use webSocketMessage");
   }
   // ============================================================================
-  // Hibernation API (delegates to BaseRoom via super, but we need
-  // to ensure webSocketMessage gets the ensureInitialized treatment)
+  // Hibernation API — RecordRoom overrides these directly (rather than using
+  // BaseRoom's onMessage/onBinaryMessage/onDisconnect hooks) so it can run
+  // ensureInitialized() before every message after a hibernation wake-up.
   // ============================================================================
   async webSocketMessage(ws, message) {
     await this.ensureInitialized();
@@ -3809,7 +3827,12 @@ var RecordRoom = class extends BaseRoom {
         handleUserList(userCtx, ws, attachment);
         break;
       case MSG.USER_UPDATE:
-        handleUserUpdate(recordCtx, ws, attachment, payload);
+        handleUserUpdate(
+          recordCtx,
+          ws,
+          attachment,
+          payload
+        );
         break;
       case MSG.SET_ROLE:
         await handleSetRole(userCtx, ws, attachment, payload);
@@ -3975,19 +3998,19 @@ var YjsRoom = class extends BaseRoom {
     this.sendAwarenessSnapshot(ws);
     return attachment;
   }
-  onMessage(ws, user, message) {
+  onMessage(_ws, _user, _message) {
   }
   onBinaryMessage(ws, user, data) {
-    const bytes2 = new Uint8Array(data);
-    const decoder = createDecoder(bytes2);
+    const bytes = new Uint8Array(data);
+    const decoder = createDecoder(bytes);
     const messageType = readVarUint(decoder);
     if (messageType === MSG_SYNC) {
-      this.handleSync(ws, decoder, bytes2);
+      this.handleSync(ws, decoder, bytes);
     } else if (messageType === MSG_AWARENESS) {
-      this.handleAwareness(ws, decoder, bytes2);
+      this.handleAwareness(ws, decoder, bytes);
     }
   }
-  onDisconnect(ws, user) {
+  onDisconnect(ws, _user) {
     const attachment = ws.deserializeAttachment();
     if (attachment?.awarenessClientId == null) return;
     const clientId = attachment.awarenessClientId;
@@ -4348,16 +4371,16 @@ var GameRoom = class extends BaseRoom {
     return this.currentTick;
   }
   /** Called when a player connects */
-  onPlayerJoin(player) {
+  onPlayerJoin(_player) {
   }
   /** Called when a player disconnects */
-  onPlayerLeave(player) {
+  onPlayerLeave(_player) {
   }
   /** Called when the game starts */
   onGameStart() {
   }
   /** Called when the game ends */
-  onGameEnd(finalState) {
+  onGameEnd(_finalState) {
   }
   /**
    * Called once when the DO first hydrates persisted state from storage.
@@ -5189,319 +5212,6 @@ function cronMatches(parsed, timezone, date) {
   return parsed.minute.has(minute) && parsed.hour.has(hour) && parsed.dayOfMonth.has(dayOfMonth) && parsed.month.has(month) && parsed.dayOfWeek.has(dayOfWeek);
 }
 
-// src/server/rooms/secrets-room.ts
-var INTERNAL_HEADER = "x-deepspace-internal";
-var INTERNAL_VALUE = "app-secrets";
-var VERSION = "app-secret-v1";
-var NAME_INFO = "deepspace app secret name v1";
-var VALUE_INFO = "deepspace app secret value v1";
-var HMAC_INFO = "deepspace app secret lookup v1";
-var STORE_ID = "default";
-var SecretsRoom = class extends BaseRoom {
-  initialized = false;
-  onMessage(_ws, _user, _message) {
-  }
-  async fetch(request) {
-    this.ensureInitialized();
-    return super.fetch(request);
-  }
-  async onRequest(request) {
-    if (request.headers.get(INTERNAL_HEADER) !== INTERNAL_VALUE) {
-      return json({ error: "Not found" }, 404);
-    }
-    const url = new URL(request.url);
-    try {
-      if (request.method === "GET" && url.pathname.endsWith("/list")) {
-        return json({ version: this.storeVersion(), secrets: await this.list() });
-      }
-      if (request.method === "GET" && url.pathname.endsWith("/pull")) {
-        return json({ version: this.storeVersion(), secrets: await this.pull() });
-      }
-      if (request.method === "GET" && url.pathname.endsWith("/version")) {
-        return json({ version: this.storeVersion() });
-      }
-      if (request.method === "PATCH" && url.pathname.endsWith("/patch")) {
-        const body = await request.json();
-        const result = await this.patch(body);
-        return json(result);
-      }
-      if (request.method === "PUT" && url.pathname.endsWith("/replace")) {
-        const body = await request.json();
-        const result = await this.replace(body);
-        return json(result);
-      }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      const status = message.includes("conflict") ? 409 : 500;
-      return json({ error: message }, status);
-    }
-    return json({ error: "Not found" }, 404);
-  }
-  async list() {
-    const rows = this.sql.exec(
-      `SELECT name_encrypted, version, updated_by, created_at, updated_at
-         FROM app_secrets_store ORDER BY updated_at DESC`
-    ).toArray();
-    const out = [];
-    for (const row of rows) {
-      out.push({
-        name: await decryptText(this.requireKey(), row.name_encrypted, NAME_INFO),
-        version: row.version,
-        createdAt: row.created_at,
-        updatedAt: row.updated_at,
-        updatedBy: row.updated_by
-      });
-    }
-    return out.sort((a, b) => a.name.localeCompare(b.name));
-  }
-  async pull() {
-    const rows = this.sql.exec(
-      `SELECT name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at
-         FROM app_secrets_store`
-    ).toArray();
-    const out = {};
-    for (const row of rows) {
-      const name = await decryptText(this.requireKey(), row.name_encrypted, NAME_INFO);
-      out[name] = await decryptText(this.requireKey(), row.value_encrypted, VALUE_INFO);
-    }
-    return out;
-  }
-  async patch(body) {
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const actor = body.updatedBy ?? null;
-    const key = this.requireKey();
-    const setEntries = Object.entries(body.set ?? {});
-    const deleteNames = body.delete ?? [];
-    for (const name of [...setEntries.map(([name2]) => name2), ...deleteNames]) {
-      validateSecretName(name);
-    }
-    const writes = [];
-    for (const [name, value] of setEntries) {
-      const nameHash = await hashName(key, name);
-      const existing = this.sql.exec(
-        `SELECT version, created_at FROM app_secrets_store WHERE name_hash = ?`,
-        nameHash
-      ).toArray()[0];
-      writes.push({
-        nameHash,
-        nameEncrypted: await encryptText(key, name, NAME_INFO),
-        valueEncrypted: await encryptText(key, value, VALUE_INFO),
-        version: (existing?.version ?? 0) + 1,
-        createdAt: existing?.created_at ?? now
-      });
-    }
-    const deletes = [];
-    for (const name of deleteNames) {
-      deletes.push(await hashName(key, name));
-    }
-    this.transaction(() => {
-      for (const write of writes) {
-        this.sql.exec(
-          `INSERT OR REPLACE INTO app_secrets_store
-           (name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?)`,
-          write.nameHash,
-          write.nameEncrypted,
-          write.valueEncrypted,
-          write.version,
-          actor,
-          write.createdAt,
-          now
-        );
-      }
-      for (const nameHash of deletes) {
-        this.sql.exec(`DELETE FROM app_secrets_store WHERE name_hash = ?`, nameHash);
-      }
-      this.bumpStoreVersion(now);
-    });
-    return { version: this.storeVersion(), secrets: await this.list() };
-  }
-  async replace(body) {
-    const next = body.secrets ?? {};
-    for (const name of Object.keys(next)) validateSecretName(name);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const actor = body.updatedBy ?? null;
-    const key = this.requireKey();
-    const writes = [];
-    for (const [name, value] of Object.entries(next)) {
-      writes.push({
-        nameHash: await hashName(key, name),
-        nameEncrypted: await encryptText(key, name, NAME_INFO),
-        valueEncrypted: await encryptText(key, value, VALUE_INFO)
-      });
-    }
-    this.transaction(() => {
-      this.sql.exec(`DELETE FROM app_secrets_store`);
-      for (const write of writes) {
-        this.sql.exec(
-          `INSERT INTO app_secrets_store
-           (name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at)
-           VALUES (?, ?, ?, 1, ?, ?, ?)`,
-          write.nameHash,
-          write.nameEncrypted,
-          write.valueEncrypted,
-          actor,
-          now,
-          now
-        );
-      }
-      this.bumpStoreVersion(now);
-    });
-    return { version: this.storeVersion(), secrets: await this.list() };
-  }
-  transaction(run) {
-    this.state.storage.transactionSync(run);
-  }
-  migrateLegacyProductionSecrets() {
-    const legacyExists = this.sql.exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'app_secrets'`).toArray().length > 0;
-    if (!legacyExists) return;
-    const currentCount = this.sql.exec(`SELECT COUNT(*) AS count FROM app_secrets_store`).toArray()[0];
-    if ((currentCount?.count ?? 0) > 0) return;
-    this.sql.exec(`
-      INSERT OR IGNORE INTO app_secrets_store
-        (name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at)
-      SELECT name_hash, name_encrypted, value_encrypted, version, updated_by, created_at, updated_at
-      FROM app_secrets
-      WHERE env = 'production'
-    `);
-    const legacyVersionExists = this.sql.exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'app_secret_env_versions'`).toArray().length > 0;
-    const legacyVersion = legacyVersionExists ? this.sql.exec(`SELECT version, updated_at FROM app_secret_env_versions WHERE env = 'production'`).toArray()[0] : void 0;
-    if (legacyVersion) {
-      this.sql.exec(
-        `INSERT OR REPLACE INTO app_secret_store_versions (id, version, updated_at) VALUES (?, ?, ?)`,
-        STORE_ID,
-        legacyVersion.version,
-        legacyVersion.updated_at
-      );
-    }
-    const migratedCount = this.sql.exec(`SELECT COUNT(*) AS count FROM app_secrets_store`).toArray()[0];
-    if (!legacyVersion && (migratedCount?.count ?? 0) > 0) {
-      this.sql.exec(
-        `INSERT OR REPLACE INTO app_secret_store_versions (id, version, updated_at) VALUES (?, ?, ?)`,
-        STORE_ID,
-        1,
-        (/* @__PURE__ */ new Date()).toISOString()
-      );
-    }
-  }
-  ensureInitialized() {
-    if (this.initialized) return;
-    this.initialized = true;
-    this.sql.exec(`
-      CREATE TABLE IF NOT EXISTS app_secrets_store (
-        name_hash TEXT NOT NULL,
-        name_encrypted TEXT NOT NULL,
-        value_encrypted TEXT NOT NULL,
-        version INTEGER NOT NULL,
-        updated_by TEXT,
-        created_at TEXT NOT NULL,
-        updated_at TEXT NOT NULL,
-        PRIMARY KEY (name_hash)
-      )
-    `);
-    this.sql.exec(`
-      CREATE TABLE IF NOT EXISTS app_secret_store_versions (
-        id TEXT PRIMARY KEY,
-        version INTEGER NOT NULL,
-        updated_at TEXT NOT NULL
-      )
-    `);
-    this.migrateLegacyProductionSecrets();
-  }
-  requireKey() {
-    if (!this.env.APP_SECRETS_KEY) {
-      throw new Error("APP_SECRETS_KEY binding is missing");
-    }
-    return this.env.APP_SECRETS_KEY;
-  }
-  storeVersion() {
-    const row = this.sql.exec(
-      `SELECT version FROM app_secret_store_versions WHERE id = ?`,
-      STORE_ID
-    ).toArray()[0];
-    return row?.version ?? 0;
-  }
-  bumpStoreVersion(now) {
-    const next = this.storeVersion() + 1;
-    this.sql.exec(
-      `INSERT OR REPLACE INTO app_secret_store_versions (id, version, updated_at) VALUES (?, ?, ?)`,
-      STORE_ID,
-      next,
-      now
-    );
-  }
-};
-function validateSecretName(name) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
-    throw new Error(`Invalid secret name "${name}"`);
-  }
-}
-function json(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function encryptText(root, plaintext, info) {
-  const salt = crypto.getRandomValues(new Uint8Array(16));
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const key = await aesKey(root, salt, info);
-  const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(plaintext));
-  return [VERSION, b64(salt), b64(iv), b64(new Uint8Array(ciphertext))].join(":");
-}
-async function decryptText(root, encoded, info) {
-  const [version, saltB64, ivB64, bodyB64] = encoded.split(":");
-  if (version !== VERSION || !saltB64 || !ivB64 || !bodyB64) {
-    throw new Error("Corrupt app secret ciphertext");
-  }
-  const key = await aesKey(root, unb64(saltB64), info);
-  const plaintext = await crypto.subtle.decrypt(
-    { name: "AES-GCM", iv: bytes(unb64(ivB64)) },
-    key,
-    bytes(unb64(bodyB64))
-  );
-  return new TextDecoder().decode(plaintext);
-}
-async function hashName(root, name) {
-  const key = await hmacKey(root, HMAC_INFO);
-  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`production:${name}`));
-  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function aesKey(root, salt, info) {
-  const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(root), "HKDF", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: bytes(salt), info: new TextEncoder().encode(info) },
-    base,
-    { name: "AES-GCM", length: 256 },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-async function hmacKey(root, info) {
-  const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(root), "HKDF", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: bytes(new Uint8Array(16)), info: new TextEncoder().encode(info) },
-    base,
-    { name: "HMAC", hash: "SHA-256", length: 256 },
-    false,
-    ["sign"]
-  );
-}
-function b64(bytes2) {
-  let s = "";
-  for (const b of bytes2) s += String.fromCharCode(b);
-  return btoa(s);
-}
-function unb64(value) {
-  const s = atob(value);
-  const out = new Uint8Array(s.length);
-  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i);
-  return out;
-}
-function bytes(input) {
-  return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
-}
-
 // src/server/rooms/job-room.ts
 var RUNNING_STALE_MS = 16 * 60 * 1e3;
 var DEFAULT_RETENTION_MS = 24 * 60 * 60 * 1e3;
@@ -6119,7 +5829,6 @@ var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
   "AUTH_WORKER_URL",
   "APP_IDENTITY_TOKEN",
   "APP_OWNER_JWT",
-  "APP_SECRETS_KEY",
   "USAGE_EVENTS"
 ]);
 function validateBindingManifest(manifest) {
@@ -6956,8 +6665,8 @@ import { importSPKI, jwtVerify } from "jose";
 
 // src/server/auth/utils.ts
 var BASE64_URL_REGEX = /^[A-Za-z0-9-_]+$/;
-function bufferToHex(bytes2) {
-  const view = bytes2 instanceof Uint8Array ? bytes2 : new Uint8Array(bytes2);
+function bufferToHex(bytes) {
+  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
   let hex = "";
   for (const byte of view) {
     hex += byte.toString(16).padStart(2, "0");
@@ -6980,9 +6689,9 @@ function decodeJwtPayload(token) {
   if (!BASE64_URL_REGEX.test(payloadSegment)) return void 0;
   try {
     const normalized = payloadSegment.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payloadSegment.length / 4) * 4, "=");
-    const bytes2 = base64ToUint8Array(normalized);
-    const json2 = new TextDecoder().decode(bytes2);
-    const payload = JSON.parse(json2);
+    const bytes = base64ToUint8Array(normalized);
+    const json = new TextDecoder().decode(bytes);
+    const payload = JSON.parse(json);
     return {
       iss: payload.iss ?? null,
       aud: payload.aud ?? null,
@@ -7206,176 +6915,6 @@ async function generateAppleClientSecret(apple) {
   return token;
 }
 
-// src/server/secrets.ts
-var DEFAULT_REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-function createSecrets(env, options = {}) {
-  const refreshIntervalMs = options.refreshIntervalMs ?? DEFAULT_REFRESH_INTERVAL_MS;
-  const now = options.now ?? (() => Date.now());
-  const cache = /* @__PURE__ */ new Map();
-  let loadedAll = null;
-  let loadedVersion = 0;
-  let lastCheckedAt = 0;
-  function stub() {
-    if (!env.SECRETS_ROOMS) throw new Error("SECRETS_ROOMS binding is missing");
-    if (!env.APP_SECRETS_KEY) throw new Error("APP_SECRETS_KEY binding is missing");
-    const id = env.SECRETS_ROOMS.idFromName("app-secrets");
-    return env.SECRETS_ROOMS.get(id);
-  }
-  async function fetchJson(path) {
-    const res = await stub().fetch(`https://app-secrets/${path}`, {
-      headers: { "x-deepspace-internal": "app-secrets" }
-    });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) throw new Error(body.error ?? `App secrets unavailable (${res.status})`);
-    return body;
-  }
-  async function pullAll() {
-    const body = await fetchJson("pull");
-    const version = typeof body.version === "number" ? body.version : 0;
-    cache.clear();
-    for (const [name, value] of Object.entries(body.secrets ?? {})) {
-      cache.set(name, value);
-    }
-    loadedVersion = version;
-    lastCheckedAt = now();
-    return version;
-  }
-  async function loadAll() {
-    await pullAll();
-  }
-  async function ensureLoaded() {
-    if (!loadedAll) {
-      loadedAll = loadAll().catch((err) => {
-        loadedAll = null;
-        throw err;
-      });
-    }
-    await loadedAll;
-  }
-  async function maybeCheckForUpdates() {
-    if (!loadedAll) return;
-    if (refreshIntervalMs < 0) return;
-    if (now() - lastCheckedAt < refreshIntervalMs) return;
-    try {
-      await client.checkForUpdates();
-    } catch {
-    }
-  }
-  function localDevValue(name) {
-    const value = env[name];
-    return env.APP_SECRETS_LOCAL_FALLBACK === "true" && typeof value === "string" ? value : void 0;
-  }
-  const client = {
-    async get(name) {
-      const local = localDevValue(name);
-      if (local !== void 0) return local;
-      if (!cache.has(name)) await ensureLoaded();
-      else await maybeCheckForUpdates();
-      return cache.get(name);
-    },
-    async require(name) {
-      const value = await this.get(name);
-      if (value === void 0) throw new Error(`Missing app secret "${name}"`);
-      return value;
-    },
-    async getMany(names) {
-      const out = {};
-      for (const name of names) out[name] = await this.get(name);
-      return out;
-    },
-    async preload(names) {
-      if (env.APP_SECRETS_LOCAL_FALLBACK === "true") {
-        const missing = [];
-        for (const name of names) {
-          const local = localDevValue(name);
-          if (local !== void 0) cache.set(name, local);
-          else missing.push(name);
-        }
-        if (missing.length === 0) {
-          await maybeCheckForUpdates();
-          return;
-        }
-      }
-      await ensureLoaded();
-      await maybeCheckForUpdates();
-    },
-    async refresh(refreshOptions = {}) {
-      if (refreshOptions.force || !loadedAll) {
-        const previous = loadedVersion;
-        const version = await pullAll();
-        loadedAll = Promise.resolve();
-        return { changed: version !== previous, version };
-      }
-      return this.checkForUpdates();
-    },
-    async checkForUpdates() {
-      await ensureLoaded();
-      const body = await fetchJson("version");
-      const version = typeof body.version === "number" ? body.version : 0;
-      lastCheckedAt = now();
-      if (version === loadedVersion) return { changed: false, version };
-      const pulledVersion = await pullAll();
-      return { changed: true, version: pulledVersion };
-    },
-    invalidate() {
-      cache.clear();
-      loadedAll = null;
-      loadedVersion = 0;
-      lastCheckedAt = 0;
-    },
-    async withFreshSecrets(operation, retryOptions = {}) {
-      let first;
-      try {
-        first = await operation({ secrets: client, attempt: 1, refreshed: false });
-      } catch (err) {
-        if (!shouldRefreshOnError(err)) throw err;
-        const refresh = await refreshAfterFailure(err);
-        if (!refresh.changed && !retryOptions.retryWhenUnchanged) throw err;
-        return operation({ secrets: client, attempt: 2, refreshed: refresh.changed });
-      }
-      if (first instanceof Response && shouldRefreshOnStatus(first.status)) {
-        const refresh = await refreshAfterFailure(first);
-        if (refresh.changed || retryOptions.retryWhenUnchanged) {
-          return operation({ secrets: client, attempt: 2, refreshed: refresh.changed });
-        }
-      }
-      return first;
-    }
-  };
-  async function refreshAfterFailure(original) {
-    try {
-      return await client.refresh({ force: true });
-    } catch (err) {
-      const originalMessage = describeFailure(original);
-      const refreshMessage = err instanceof Error ? err.message : String(err);
-      throw new Error(`Secret refresh failed after API failure (${originalMessage}): ${refreshMessage}`);
-    }
-  }
-  return client;
-}
-function shouldRefreshOnError(error) {
-  const status = statusFromError(error);
-  return status !== void 0 && shouldRefreshOnStatus(status);
-}
-function shouldRefreshOnStatus(status) {
-  return status === 401 || status === 403;
-}
-function statusFromError(error) {
-  if (!error || typeof error !== "object") return void 0;
-  const record = error;
-  if (typeof record.status === "number") return record.status;
-  if (typeof record.statusCode === "number") return record.statusCode;
-  if (typeof record.response?.status === "number") return record.response.status;
-  return void 0;
-}
-function describeFailure(value) {
-  if (value instanceof Response) return `HTTP ${value.status}`;
-  if (value instanceof Error) return value.message;
-  const status = statusFromError(value);
-  if (status) return `HTTP ${status}`;
-  return String(value);
-}
-
 // src/shared/subscription.ts
 var ENTITLED_STATUSES = /* @__PURE__ */ new Set([
   "active",
@@ -7557,7 +7096,6 @@ export {
   SYSTEM_COLLECTION_SCHEMAS,
   SYSTEM_MANAGED_COLUMNS,
   SchemaRegistry,
-  SecretsRoom,
   SubscriptionAuthError,
   SubscriptionRequiredError,
   USERS_COLUMNS,
@@ -7594,7 +7132,6 @@ export {
   createDeepSpaceAI,
   createDeepSpaceAuth,
   createScopedR2Handler,
-  createSecrets,
   dataToColumnValues,
   decodeJwtPayload,
   deleteChatCascade,