deepspace 0.4.5 → 0.5.0

package/dist/testing.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/testing/fixtures.ts","../src/testing/accounts.ts","../src/testing/storage-state.ts"],"sourcesContent":["/**\n * Multi-user Playwright fixture for DeepSpace apps.\n *\n * Usage:\n *\n *   import { test, expect } from 'deepspace/testing'\n *\n *   test('A sends, B sees', async ({ users }) => {\n *     const [a, b] = await users(2)\n *     await a.page.goto('/chat')\n *     await b.page.goto('/chat')\n *     await a.page.getByTestId('message-input').fill('hi')\n *     await a.page.getByTestId('send-message-btn').click()\n *     await expect(b.page.getByText('hi')).toBeVisible()\n *   })\n *\n * `users(N)` picks the first N test accounts from\n * `~/.deepspace/test-accounts.json` (created via\n * `deepspace test-accounts create`). `users(['Alice', 'Bob'])` picks\n * specific accounts by name.\n *\n * Each user gets a separate browser context with cached storageState\n * (per-account JSON in `~/.deepspace/playwright-states/`). Sign-in\n * happens once per account, not once per test, sidestepping Better\n * Auth's per-IP rate limit on `/api/auth/sign-in/email`.\n *\n * Contexts are auto-closed when the test finishes.\n */\n\nimport { test as baseTest, type Browser, type BrowserContext, type Page } from '@playwright/test'\nimport {\n  type TestAccount,\n  pickTestAccounts,\n  findTestAccountByName,\n} from './accounts'\nimport { ensureStorageState } from './storage-state'\n\nexport interface MultiplayerUser {\n  context: BrowserContext\n  page: Page\n  email: string\n  name: string\n  /** Test account user ID, if known from the accounts registry. */\n  userId?: string\n}\n\n/**\n * Fixture function signature. Pass either a count (`users(2)`) or an\n * array of account names (`users(['Alice', 'Bob'])`). Returns one entry\n * per requested user.\n */\nexport type UsersFixture = (\n  selector: number | string[],\n  options?: { label?: string },\n) => Promise<MultiplayerUser[]>\n\ninterface MultiplayerFixtures {\n  users: UsersFixture\n}\n\nasync function buildUser(\n  browser: Browser,\n  account: TestAccount,\n  baseURL: string,\n): Promise<{ user: MultiplayerUser; cleanup: () => Promise<void> }> {\n  const statePath = await ensureStorageState(browser, account, baseURL)\n  const context = await browser.newContext({ storageState: statePath, baseURL })\n  const page = await context.newPage()\n  return {\n    user: {\n      context,\n      page,\n      email: account.email,\n      name: account.name ?? account.email.split('@')[0],\n      userId: account.userId,\n    },\n    cleanup: async () => {\n      await context.close()\n    },\n  }\n}\n\nexport const test = baseTest.extend<MultiplayerFixtures>({\n  users: async ({ browser, baseURL }, use) => {\n    if (!baseURL) {\n      throw new Error(\n        '`users` fixture requires a baseURL. Set it on your Playwright config ' +\n          '(e.g. `use: { baseURL: \"http://localhost:5173\" }`) or via the ' +\n          'webServer.url shortcut.',\n      )\n    }\n\n    const cleanups: Array<() => Promise<void>> = []\n\n    const usersFn: UsersFixture = async (selector, options) => {\n      const accounts: TestAccount[] = Array.isArray(selector)\n        ? selector.map((name) => findTestAccountByName(name))\n        : pickTestAccounts(selector, options)\n\n      const built = await Promise.all(\n        accounts.map((acct) => buildUser(browser, acct, baseURL)),\n      )\n      for (const b of built) cleanups.push(b.cleanup)\n      return built.map((b) => b.user)\n    }\n\n    await use(usersFn)\n\n    // Tear down any contexts we created. Errors are swallowed — a test\n    // failure shouldn't be masked by a cleanup error.\n    for (const cleanup of cleanups) {\n      await cleanup().catch(() => {})\n    }\n  },\n})\n\nexport { expect } from '@playwright/test'\n","/**\n * Account-credential plumbing for the testing module.\n *\n * Reads test accounts from `~/.deepspace/test-accounts.json` (the same\n * file `deepspace test-accounts create` writes). Each account has at\n * minimum `{email, password}`; `name` and `label` are optional.\n *\n * Used by the multi-user Playwright fixture in `./fixtures.ts` and is\n * also exported standalone in case suites want to do their own\n * orchestration.\n */\n\nimport { existsSync, readFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\n\nexport interface TestAccount {\n  email: string\n  password: string\n  name?: string\n  label?: string | null\n  id?: string\n  userId?: string\n  createdAt?: number\n}\n\nconst ACCOUNTS_PATH = join(homedir(), '.deepspace', 'test-accounts.json')\n\n/**\n * Load all test accounts the developer has created. Returns an empty\n * array if the file doesn't exist yet.\n */\nexport function loadAllTestAccounts(): TestAccount[] {\n  if (!existsSync(ACCOUNTS_PATH)) return []\n  try {\n    const raw = JSON.parse(readFileSync(ACCOUNTS_PATH, 'utf-8'))\n    if (!Array.isArray(raw)) return []\n    // Filter out any malformed entries (missing email or password). Keep\n    // bare {email, password} rows so the file format stays forgiving.\n    return raw.filter(\n      (r) => r && typeof r.email === 'string' && typeof r.password === 'string',\n    )\n  } catch {\n    return []\n  }\n}\n\n/**\n * Pick `count` test accounts from the local registry, optionally\n * filtered by `label`. Order-stable: sorted by `createdAt` ascending so\n * the first test account you created is always the first one returned.\n *\n * Throws with a helpful message if not enough accounts exist.\n */\nexport function pickTestAccounts(\n  count: number,\n  options?: { label?: string },\n): TestAccount[] {\n  const all = loadAllTestAccounts()\n  const filtered = options?.label\n    ? all.filter((a) => a.label === options.label)\n    : all\n  const sorted = filtered.slice().sort((a, b) => (a.createdAt ?? 0) - (b.createdAt ?? 0))\n\n  if (sorted.length < count) {\n    const labelHint = options?.label ? ` (label=\"${options.label}\")` : ''\n    throw new Error(\n      `Multiplayer test needs ${count} test accounts${labelHint}, but only ${sorted.length} ` +\n        `are present in ${ACCOUNTS_PATH}. Create more with:\\n` +\n        `  deepspace test-accounts create --email <name>@deepspace.test --password <pw> --name \"<name>\"${\n          options?.label ? ` --label ${options.label}` : ''\n        }`,\n    )\n  }\n\n  return sorted.slice(0, count)\n}\n\n/**\n * Find a single account by name. Used by `users(['Alice', 'Bob'])`.\n * Throws if not found.\n */\nexport function findTestAccountByName(name: string): TestAccount {\n  const all = loadAllTestAccounts()\n  const match = all.find((a) => a.name === name)\n  if (!match) {\n    throw new Error(\n      `No test account named \"${name}\" in ${ACCOUNTS_PATH}. Create with:\\n` +\n        `  deepspace test-accounts create --email ${name.toLowerCase()}@deepspace.test --password <pw> --name \"${name}\"`,\n    )\n  }\n  return match\n}\n","/**\n * Per-account `storageState` cache for Playwright.\n *\n * Better Auth applies a per-IP rate limit on `/api/auth/sign-in/email`\n * (~5 sign-ins / 60s / endpoint). A multiplayer suite that spins up\n * 5+ users per spec would hit the limit and start failing in non-obvious\n * ways. This module signs each account in *once*, persists the\n * resulting browser cookies + storage to disk, and reuses the file on\n * subsequent runs.\n *\n * Cache layout:\n *   ~/.deepspace/playwright-states/<sha256(email)>.json\n *\n * Validity: a cached file is reused if Playwright successfully loads it\n * AND the resulting context produces a non-anonymous session on the\n * target app. If validation fails, we fall back to a fresh sign-in and\n * overwrite the cache.\n */\n\nimport { createHash } from 'node:crypto'\nimport { existsSync, mkdirSync, writeFileSync, readFileSync, statSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport type { Browser, BrowserContext } from '@playwright/test'\n\nconst STATES_DIR = join(homedir(), '.deepspace', 'playwright-states')\n\n/** Default freshness window — re-sign-in if the cache is older than this. */\nconst DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000 // 7 days\n\nfunction statePathForEmail(email: string): string {\n  const hash = createHash('sha256').update(email.trim().toLowerCase()).digest('hex').slice(0, 24)\n  return join(STATES_DIR, `${hash}.json`)\n}\n\nfunction ensureStatesDir() {\n  if (!existsSync(STATES_DIR)) mkdirSync(STATES_DIR, { recursive: true })\n}\n\n/** Returns true if a cache file exists and is younger than `maxAgeMs`. */\nfunction isCacheFresh(path: string, maxAgeMs: number): boolean {\n  if (!existsSync(path)) return false\n  try {\n    const age = Date.now() - statSync(path).mtimeMs\n    return age < maxAgeMs\n  } catch {\n    return false\n  }\n}\n\n/**\n * Sign `account` in by POSTing `/api/auth/sign-in/email` against\n * `baseURL` and capturing the resulting cookies. Returns the path to the\n * Playwright `storageState` JSON file.\n *\n * The browser-driven approach is intentional: we want the cookies set\n * on the same origin Playwright contexts will load from, otherwise the\n * Set-Cookie domain attribute won't match.\n */\nasync function signInAndSaveState(\n  browser: Browser,\n  account: { email: string; password: string },\n  baseURL: string,\n  outPath: string,\n): Promise<string> {\n  ensureStatesDir()\n  const ctx = await browser.newContext({ baseURL })\n  try {\n    const page = await ctx.newPage()\n    // Hit the app first so the origin is established (some auth plugins\n    // require a same-origin Origin header on sign-in).\n    await page.goto('/')\n    const ok = await page.evaluate(\n      async ({ email, password }: { email: string; password: string }) => {\n        const res = await fetch('/api/auth/sign-in/email', {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({ email, password }),\n        })\n        return res.ok\n      },\n      account,\n    )\n    if (!ok) {\n      throw new Error(\n        `Sign-in failed for ${account.email}. Check the password is current; ` +\n          `if the account was deleted on the server, re-create with ` +\n          `\\`deepspace test-accounts create\\`.`,\n      )\n    }\n    await ctx.storageState({ path: outPath })\n    return outPath\n  } finally {\n    await ctx.close()\n  }\n}\n\nexport interface EnsureStorageStateOptions {\n  /** Max age of a cached state file before we re-sign-in. Default 7 days. */\n  maxAgeMs?: number\n  /** Force a fresh sign-in even if the cache is fresh. */\n  force?: boolean\n}\n\n/**\n * Ensure a Playwright `storageState` file exists for `account` and\n * return its path. Signs in once if the cache is missing, stale, or\n * `force: true`.\n */\nexport async function ensureStorageState(\n  browser: Browser,\n  account: { email: string; password: string },\n  baseURL: string,\n  options: EnsureStorageStateOptions = {},\n): Promise<string> {\n  const path = statePathForEmail(account.email)\n  const maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS\n\n  if (!options.force && isCacheFresh(path, maxAgeMs)) {\n    return path\n  }\n\n  return signInAndSaveState(browser, account, baseURL, path)\n}\n\n/**\n * Convenience: open a fresh `BrowserContext` for `account` using the\n * cached storage state (signing in if needed). The caller is responsible\n * for closing the context.\n */\nexport async function newSignedInContext(\n  browser: Browser,\n  account: { email: string; password: string },\n  baseURL: string,\n  options: EnsureStorageStateOptions = {},\n): Promise<BrowserContext> {\n  const statePath = await ensureStorageState(browser, account, baseURL, options)\n  return browser.newContext({ storageState: statePath, baseURL })\n}\n\n/** Read a cached storageState file (mostly for debugging). */\nexport function readCachedState(email: string): unknown | null {\n  const path = statePathForEmail(email)\n  if (!existsSync(path)) return null\n  try {\n    return JSON.parse(readFileSync(path, 'utf-8'))\n  } catch {\n    return null\n  }\n}\n\n/** Where the cache for `email` lives. Useful for diagnostics. */\nexport function getStatePathForEmail(email: string): string {\n  return statePathForEmail(email)\n}\n"],"mappings":";AA6BA,SAAS,QAAQ,gBAA8D;;;ACjB/E,SAAS,YAAY,oBAAoB;AACzC,SAAS,eAAe;AACxB,SAAS,YAAY;AAYrB,IAAM,gBAAgB,KAAK,QAAQ,GAAG,cAAc,oBAAoB;AAMjE,SAAS,sBAAqC;AACnD,MAAI,CAAC,WAAW,aAAa,EAAG,QAAO,CAAC;AACxC,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,aAAa,eAAe,OAAO,CAAC;AAC3D,QAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AAGjC,WAAO,IAAI;AAAA,MACT,CAAC,MAAM,KAAK,OAAO,EAAE,UAAU,YAAY,OAAO,EAAE,aAAa;AAAA,IACnE;AAAA,EACF,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AASO,SAAS,iBACd,OACA,SACe;AACf,QAAM,MAAM,oBAAoB;AAChC,QAAM,WAAW,SAAS,QACtB,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,QAAQ,KAAK,IAC3C;AACJ,QAAM,SAAS,SAAS,MAAM,EAAE,KAAK,CAAC,GAAG,OAAO,EAAE,aAAa,MAAM,EAAE,aAAa,EAAE;AAEtF,MAAI,OAAO,SAAS,OAAO;AACzB,UAAM,YAAY,SAAS,QAAQ,YAAY,QAAQ,KAAK,OAAO;AACnE,UAAM,IAAI;AAAA,MACR,0BAA0B,KAAK,iBAAiB,SAAS,cAAc,OAAO,MAAM,mBAChE,aAAa;AAAA,gGAE7B,SAAS,QAAQ,YAAY,QAAQ,KAAK,KAAK,EACjD;AAAA,IACJ;AAAA,EACF;AAEA,SAAO,OAAO,MAAM,GAAG,KAAK;AAC9B;AAMO,SAAS,sBAAsB,MAA2B;AAC/D,QAAM,MAAM,oBAAoB;AAChC,QAAM,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AAC7C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,0BAA0B,IAAI,QAAQ,aAAa;AAAA,2CACL,KAAK,YAAY,CAAC,2CAA2C,IAAI;AAAA,IACjH;AAAA,EACF;AACA,SAAO;AACT;;;ACzEA,SAAS,kBAAkB;AAC3B,SAAS,cAAAA,aAAY,WAA0B,gBAAAC,eAAc,gBAAgB;AAC7E,SAAS,WAAAC,gBAAe;AACxB,SAAS,QAAAC,aAAY;AAGrB,IAAM,aAAaA,MAAKD,SAAQ,GAAG,cAAc,mBAAmB;AAGpE,IAAM,qBAAqB,IAAI,KAAK,KAAK,KAAK;AAE9C,SAAS,kBAAkB,OAAuB;AAChD,QAAM,OAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC9F,SAAOC,MAAK,YAAY,GAAG,IAAI,OAAO;AACxC;AAEA,SAAS,kBAAkB;AACzB,MAAI,CAACH,YAAW,UAAU,EAAG,WAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AACxE;AAGA,SAAS,aAAa,MAAc,UAA2B;AAC7D,MAAI,CAACA,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,EAAE;AACxC,WAAO,MAAM;AAAA,EACf,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAe,mBACb,SACA,SACA,SACA,SACiB;AACjB,kBAAgB;AAChB,QAAM,MAAM,MAAM,QAAQ,WAAW,EAAE,QAAQ,CAAC;AAChD,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,QAAQ;AAG/B,UAAM,KAAK,KAAK,GAAG;AACnB,UAAM,KAAK,MAAM,KAAK;AAAA,MACpB,OAAO,EAAE,OAAO,SAAS,MAA2C;AAClE,cAAM,MAAM,MAAM,MAAM,2BAA2B;AAAA,UACjD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,SAAS,CAAC;AAAA,QAC1C,CAAC;AACD,eAAO,IAAI;AAAA,MACb;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,IAAI;AACP,YAAM,IAAI;AAAA,QACR,sBAAsB,QAAQ,KAAK;AAAA,MAGrC;AAAA,IACF;AACA,UAAM,IAAI,aAAa,EAAE,MAAM,QAAQ,CAAC;AACxC,WAAO;AAAA,EACT,UAAE;AACA,UAAM,IAAI,MAAM;AAAA,EAClB;AACF;AAcA,eAAsB,mBACpB,SACA,SACA,SACA,UAAqC,CAAC,GACrB;AACjB,QAAM,OAAO,kBAAkB,QAAQ,KAAK;AAC5C,QAAM,WAAW,QAAQ,YAAY;AAErC,MAAI,CAAC,QAAQ,SAAS,aAAa,MAAM,QAAQ,GAAG;AAClD,WAAO;AAAA,EACT;AAEA,SAAO,mBAAmB,SAAS,SAAS,SAAS,IAAI;AAC3D;AAOA,eAAsB,mBACpB,SACA,SACA,SACA,UAAqC,CAAC,GACb;AACzB,QAAM,YAAY,MAAM,mBAAmB,SAAS,SAAS,SAAS,OAAO;AAC7E,SAAO,QAAQ,WAAW,EAAE,cAAc,WAAW,QAAQ,CAAC;AAChE;AAGO,SAAS,gBAAgB,OAA+B;AAC7D,QAAM,OAAO,kBAAkB,KAAK;AACpC,MAAI,CAACA,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,WAAO,KAAK,MAAMC,cAAa,MAAM,OAAO,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,qBAAqB,OAAuB;AAC1D,SAAO,kBAAkB,KAAK;AAChC;;;AFtCA,SAAS,cAAc;AAxDvB,eAAe,UACb,SACA,SACA,SACkE;AAClE,QAAM,YAAY,MAAM,mBAAmB,SAAS,SAAS,OAAO;AACpE,QAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,cAAc,WAAW,QAAQ,CAAC;AAC7E,QAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,SAAO;AAAA,IACL,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ,QAAQ,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAChD,QAAQ,QAAQ;AAAA,IAClB;AAAA,IACA,SAAS,YAAY;AACnB,YAAM,QAAQ,MAAM;AAAA,IACtB;AAAA,EACF;AACF;AAEO,IAAM,OAAO,SAAS,OAA4B;AAAA,EACvD,OAAO,OAAO,EAAE,SAAS,QAAQ,GAAG,QAAQ;AAC1C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AAEA,UAAM,WAAuC,CAAC;AAE9C,UAAM,UAAwB,OAAO,UAAU,YAAY;AACzD,YAAM,WAA0B,MAAM,QAAQ,QAAQ,IAClD,SAAS,IAAI,CAAC,SAAS,sBAAsB,IAAI,CAAC,IAClD,iBAAiB,UAAU,OAAO;AAEtC,YAAM,QAAQ,MAAM,QAAQ;AAAA,QAC1B,SAAS,IAAI,CAAC,SAAS,UAAU,SAAS,MAAM,OAAO,CAAC;AAAA,MAC1D;AACA,iBAAW,KAAK,MAAO,UAAS,KAAK,EAAE,OAAO;AAC9C,aAAO,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IAChC;AAEA,UAAM,IAAI,OAAO;AAIjB,eAAW,WAAW,UAAU;AAC9B,YAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAChC;AAAA,EACF;AACF,CAAC;","names":["existsSync","readFileSync","homedir","join"]}
+{"version":3,"sources":["../src/testing/fixtures.ts","../src/testing/accounts.ts","../src/testing/storage-state.ts"],"sourcesContent":["/**\n * Multi-user Playwright fixture for DeepSpace apps.\n *\n * Usage:\n *\n *   import { test, expect } from 'deepspace/testing'\n *\n *   test('A sends, B sees', async ({ users }) => {\n *     const [a, b] = await users(2)\n *     await a.page.goto('/chat')\n *     await b.page.goto('/chat')\n *     await a.page.getByTestId('message-input').fill('hi')\n *     await a.page.getByTestId('send-message-btn').click()\n *     await expect(b.page.getByText('hi')).toBeVisible()\n *   })\n *\n * `users(N)` picks the first N test accounts from\n * `~/.deepspace/test-accounts.json` (created via\n * `deepspace test-accounts create`). `users(['Alice', 'Bob'])` picks\n * specific accounts by name.\n *\n * Each user gets a separate browser context with cached storageState\n * (per-account JSON in `~/.deepspace/playwright-states/`). Sign-in\n * happens once per account, not once per test, sidestepping Better\n * Auth's per-IP rate limit on `/api/auth/sign-in/email`.\n *\n * Contexts are auto-closed when the test finishes.\n */\n\nimport { test as baseTest, type Browser, type BrowserContext, type Page } from '@playwright/test'\nimport {\n  type TestAccount,\n  pickTestAccounts,\n  findTestAccountByName,\n} from './accounts'\nimport { ensureStorageState } from './storage-state'\n\nexport interface MultiplayerUser {\n  context: BrowserContext\n  page: Page\n  email: string\n  name: string\n  /** Test account user ID, if known from the accounts registry. */\n  userId?: string\n}\n\n/**\n * Fixture function signature. Pass either a count (`users(2)`) or an\n * array of account names (`users(['Alice', 'Bob'])`). Returns one entry\n * per requested user.\n */\nexport type UsersFixture = (\n  selector: number | string[],\n  options?: { label?: string },\n) => Promise<MultiplayerUser[]>\n\ninterface MultiplayerFixtures {\n  users: UsersFixture\n}\n\nasync function buildUser(\n  browser: Browser,\n  account: TestAccount,\n  baseURL: string,\n): Promise<{ user: MultiplayerUser; cleanup: () => Promise<void> }> {\n  const statePath = await ensureStorageState(browser, account, baseURL)\n  const context = await browser.newContext({ storageState: statePath, baseURL })\n  const page = await context.newPage()\n  return {\n    user: {\n      context,\n      page,\n      email: account.email,\n      name: account.name ?? account.email.split('@')[0],\n      userId: account.userId,\n    },\n    cleanup: async () => {\n      await context.close()\n    },\n  }\n}\n\nexport const test = baseTest.extend<MultiplayerFixtures>({\n  users: async ({ browser, baseURL }, use) => {\n    if (!baseURL) {\n      throw new Error(\n        '`users` fixture requires a baseURL. Set it on your Playwright config ' +\n          '(e.g. `use: { baseURL: \"http://localhost:5173\" }`) or via the ' +\n          'webServer.url shortcut.',\n      )\n    }\n\n    const cleanups: Array<() => Promise<void>> = []\n\n    const usersFn: UsersFixture = async (selector, options) => {\n      const accounts: TestAccount[] = Array.isArray(selector)\n        ? selector.map((name) => findTestAccountByName(name))\n        : pickTestAccounts(selector, options)\n\n      const built = await Promise.all(\n        accounts.map((acct) => buildUser(browser, acct, baseURL)),\n      )\n      for (const b of built) cleanups.push(b.cleanup)\n      return built.map((b) => b.user)\n    }\n\n    await use(usersFn)\n\n    // Tear down any contexts we created. Errors are swallowed — a test\n    // failure shouldn't be masked by a cleanup error.\n    for (const cleanup of cleanups) {\n      await cleanup().catch(() => {})\n    }\n  },\n})\n\nexport { expect } from '@playwright/test'\n","/**\n * Account-credential plumbing for the testing module.\n *\n * Reads test accounts from `~/.deepspace/test-accounts.json` (the same\n * file `deepspace test-accounts create` writes). Each account has at\n * minimum `{email, password}`; `name` and `label` are optional.\n *\n * Used by the multi-user Playwright fixture in `./fixtures.ts` and is\n * also exported standalone in case suites want to do their own\n * orchestration.\n */\n\nimport { existsSync, readFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\n\nexport interface TestAccount {\n  email: string\n  password: string\n  name?: string\n  label?: string | null\n  id?: string\n  userId?: string\n  createdAt?: number\n}\n\nconst ACCOUNTS_PATH = join(homedir(), '.deepspace', 'test-accounts.json')\n\n/**\n * Load all test accounts the developer has created. Returns an empty\n * array if the file doesn't exist yet.\n */\nexport function loadAllTestAccounts(): TestAccount[] {\n  if (!existsSync(ACCOUNTS_PATH)) return []\n  try {\n    const raw = JSON.parse(readFileSync(ACCOUNTS_PATH, 'utf-8'))\n    if (!Array.isArray(raw)) return []\n    // Filter out any malformed entries (missing email or password). Keep\n    // bare {email, password} rows so the file format stays forgiving.\n    return raw.filter(\n      (r) => r && typeof r.email === 'string' && typeof r.password === 'string',\n    )\n  } catch {\n    return []\n  }\n}\n\n/**\n * Pick `count` test accounts from the local registry, optionally\n * filtered by `label`. Order-stable: sorted by `createdAt` ascending so\n * the first test account you created is always the first one returned.\n *\n * Throws with a helpful message if not enough accounts exist.\n */\nexport function pickTestAccounts(\n  count: number,\n  options?: { label?: string },\n): TestAccount[] {\n  const all = loadAllTestAccounts()\n  const filtered = options?.label\n    ? all.filter((a) => a.label === options.label)\n    : all\n  const sorted = filtered.slice().sort((a, b) => (a.createdAt ?? 0) - (b.createdAt ?? 0))\n\n  if (sorted.length < count) {\n    const labelHint = options?.label ? ` (label=\"${options.label}\")` : ''\n    throw new Error(\n      `Multiplayer test needs ${count} test accounts${labelHint}, but only ${sorted.length} ` +\n        `are present in ${ACCOUNTS_PATH}. Create more with:\\n` +\n        `  deepspace test-accounts create --email <name>@deepspace.test --password <pw> --name \"<name>\"${\n          options?.label ? ` --label ${options.label}` : ''\n        }`,\n    )\n  }\n\n  return sorted.slice(0, count)\n}\n\n/**\n * Find a single account by name. Used by `users(['Alice', 'Bob'])`.\n * Throws if not found.\n */\nexport function findTestAccountByName(name: string): TestAccount {\n  const all = loadAllTestAccounts()\n  const match = all.find((a) => a.name === name)\n  if (!match) {\n    throw new Error(\n      `No test account named \"${name}\" in ${ACCOUNTS_PATH}. Create with:\\n` +\n        `  deepspace test-accounts create --email ${name.toLowerCase()}@deepspace.test --password <pw> --name \"${name}\"`,\n    )\n  }\n  return match\n}\n","/**\n * Per-account `storageState` cache for Playwright.\n *\n * Better Auth applies a per-IP rate limit on `/api/auth/sign-in/email`\n * (~5 sign-ins / 60s / endpoint). A multiplayer suite that spins up\n * 5+ users per spec would hit the limit and start failing in non-obvious\n * ways. This module signs each account in *once*, persists the\n * resulting browser cookies + storage to disk, and reuses the file on\n * subsequent runs.\n *\n * Cache layout:\n *   ~/.deepspace/playwright-states/<sha256(email)>.json\n *\n * Validity: a cached file is reused if Playwright successfully loads it\n * AND the resulting context produces a non-anonymous session on the\n * target app. If validation fails, we fall back to a fresh sign-in and\n * overwrite the cache.\n */\n\nimport { createHash } from 'node:crypto'\nimport { existsSync, mkdirSync, readFileSync, statSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport type { Browser, BrowserContext } from '@playwright/test'\n\nconst STATES_DIR = join(homedir(), '.deepspace', 'playwright-states')\n\n/** Default freshness window — re-sign-in if the cache is older than this. */\nconst DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000 // 7 days\n\nfunction statePathForEmail(email: string): string {\n  const hash = createHash('sha256').update(email.trim().toLowerCase()).digest('hex').slice(0, 24)\n  return join(STATES_DIR, `${hash}.json`)\n}\n\nfunction ensureStatesDir() {\n  if (!existsSync(STATES_DIR)) mkdirSync(STATES_DIR, { recursive: true })\n}\n\n/** Returns true if a cache file exists and is younger than `maxAgeMs`. */\nfunction isCacheFresh(path: string, maxAgeMs: number): boolean {\n  if (!existsSync(path)) return false\n  try {\n    const age = Date.now() - statSync(path).mtimeMs\n    return age < maxAgeMs\n  } catch {\n    return false\n  }\n}\n\n/**\n * Sign `account` in by POSTing `/api/auth/sign-in/email` against\n * `baseURL` and capturing the resulting cookies. Returns the path to the\n * Playwright `storageState` JSON file.\n *\n * The browser-driven approach is intentional: we want the cookies set\n * on the same origin Playwright contexts will load from, otherwise the\n * Set-Cookie domain attribute won't match.\n */\nasync function signInAndSaveState(\n  browser: Browser,\n  account: { email: string; password: string },\n  baseURL: string,\n  outPath: string,\n): Promise<string> {\n  ensureStatesDir()\n  const ctx = await browser.newContext({ baseURL })\n  try {\n    const page = await ctx.newPage()\n    // Hit the app first so the origin is established (some auth plugins\n    // require a same-origin Origin header on sign-in).\n    await page.goto('/')\n    const ok = await page.evaluate(\n      async ({ email, password }: { email: string; password: string }) => {\n        const res = await fetch('/api/auth/sign-in/email', {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({ email, password }),\n        })\n        return res.ok\n      },\n      account,\n    )\n    if (!ok) {\n      throw new Error(\n        `Sign-in failed for ${account.email}. Check the password is current; ` +\n          `if the account was deleted on the server, re-create with ` +\n          `\\`deepspace test-accounts create\\`.`,\n      )\n    }\n    await ctx.storageState({ path: outPath })\n    return outPath\n  } finally {\n    await ctx.close()\n  }\n}\n\nexport interface EnsureStorageStateOptions {\n  /** Max age of a cached state file before we re-sign-in. Default 7 days. */\n  maxAgeMs?: number\n  /** Force a fresh sign-in even if the cache is fresh. */\n  force?: boolean\n}\n\n/**\n * Ensure a Playwright `storageState` file exists for `account` and\n * return its path. Signs in once if the cache is missing, stale, or\n * `force: true`.\n */\nexport async function ensureStorageState(\n  browser: Browser,\n  account: { email: string; password: string },\n  baseURL: string,\n  options: EnsureStorageStateOptions = {},\n): Promise<string> {\n  const path = statePathForEmail(account.email)\n  const maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS\n\n  if (!options.force && isCacheFresh(path, maxAgeMs)) {\n    return path\n  }\n\n  return signInAndSaveState(browser, account, baseURL, path)\n}\n\n/**\n * Convenience: open a fresh `BrowserContext` for `account` using the\n * cached storage state (signing in if needed). The caller is responsible\n * for closing the context.\n */\nexport async function newSignedInContext(\n  browser: Browser,\n  account: { email: string; password: string },\n  baseURL: string,\n  options: EnsureStorageStateOptions = {},\n): Promise<BrowserContext> {\n  const statePath = await ensureStorageState(browser, account, baseURL, options)\n  return browser.newContext({ storageState: statePath, baseURL })\n}\n\n/** Read a cached storageState file (mostly for debugging). */\nexport function readCachedState(email: string): unknown | null {\n  const path = statePathForEmail(email)\n  if (!existsSync(path)) return null\n  try {\n    return JSON.parse(readFileSync(path, 'utf-8'))\n  } catch {\n    return null\n  }\n}\n\n/** Where the cache for `email` lives. Useful for diagnostics. */\nexport function getStatePathForEmail(email: string): string {\n  return statePathForEmail(email)\n}\n"],"mappings":";AA6BA,SAAS,QAAQ,gBAA8D;;;ACjB/E,SAAS,YAAY,oBAAoB;AACzC,SAAS,eAAe;AACxB,SAAS,YAAY;AAYrB,IAAM,gBAAgB,KAAK,QAAQ,GAAG,cAAc,oBAAoB;AAMjE,SAAS,sBAAqC;AACnD,MAAI,CAAC,WAAW,aAAa,EAAG,QAAO,CAAC;AACxC,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,aAAa,eAAe,OAAO,CAAC;AAC3D,QAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AAGjC,WAAO,IAAI;AAAA,MACT,CAAC,MAAM,KAAK,OAAO,EAAE,UAAU,YAAY,OAAO,EAAE,aAAa;AAAA,IACnE;AAAA,EACF,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AASO,SAAS,iBACd,OACA,SACe;AACf,QAAM,MAAM,oBAAoB;AAChC,QAAM,WAAW,SAAS,QACtB,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,QAAQ,KAAK,IAC3C;AACJ,QAAM,SAAS,SAAS,MAAM,EAAE,KAAK,CAAC,GAAG,OAAO,EAAE,aAAa,MAAM,EAAE,aAAa,EAAE;AAEtF,MAAI,OAAO,SAAS,OAAO;AACzB,UAAM,YAAY,SAAS,QAAQ,YAAY,QAAQ,KAAK,OAAO;AACnE,UAAM,IAAI;AAAA,MACR,0BAA0B,KAAK,iBAAiB,SAAS,cAAc,OAAO,MAAM,mBAChE,aAAa;AAAA,gGAE7B,SAAS,QAAQ,YAAY,QAAQ,KAAK,KAAK,EACjD;AAAA,IACJ;AAAA,EACF;AAEA,SAAO,OAAO,MAAM,GAAG,KAAK;AAC9B;AAMO,SAAS,sBAAsB,MAA2B;AAC/D,QAAM,MAAM,oBAAoB;AAChC,QAAM,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AAC7C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,0BAA0B,IAAI,QAAQ,aAAa;AAAA,2CACL,KAAK,YAAY,CAAC,2CAA2C,IAAI;AAAA,IACjH;AAAA,EACF;AACA,SAAO;AACT;;;ACzEA,SAAS,kBAAkB;AAC3B,SAAS,cAAAA,aAAY,WAAW,gBAAAC,eAAc,gBAAgB;AAC9D,SAAS,WAAAC,gBAAe;AACxB,SAAS,QAAAC,aAAY;AAGrB,IAAM,aAAaA,MAAKD,SAAQ,GAAG,cAAc,mBAAmB;AAGpE,IAAM,qBAAqB,IAAI,KAAK,KAAK,KAAK;AAE9C,SAAS,kBAAkB,OAAuB;AAChD,QAAM,OAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC9F,SAAOC,MAAK,YAAY,GAAG,IAAI,OAAO;AACxC;AAEA,SAAS,kBAAkB;AACzB,MAAI,CAACH,YAAW,UAAU,EAAG,WAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AACxE;AAGA,SAAS,aAAa,MAAc,UAA2B;AAC7D,MAAI,CAACA,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,EAAE;AACxC,WAAO,MAAM;AAAA,EACf,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAe,mBACb,SACA,SACA,SACA,SACiB;AACjB,kBAAgB;AAChB,QAAM,MAAM,MAAM,QAAQ,WAAW,EAAE,QAAQ,CAAC;AAChD,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,QAAQ;AAG/B,UAAM,KAAK,KAAK,GAAG;AACnB,UAAM,KAAK,MAAM,KAAK;AAAA,MACpB,OAAO,EAAE,OAAO,SAAS,MAA2C;AAClE,cAAM,MAAM,MAAM,MAAM,2BAA2B;AAAA,UACjD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,SAAS,CAAC;AAAA,QAC1C,CAAC;AACD,eAAO,IAAI;AAAA,MACb;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,IAAI;AACP,YAAM,IAAI;AAAA,QACR,sBAAsB,QAAQ,KAAK;AAAA,MAGrC;AAAA,IACF;AACA,UAAM,IAAI,aAAa,EAAE,MAAM,QAAQ,CAAC;AACxC,WAAO;AAAA,EACT,UAAE;AACA,UAAM,IAAI,MAAM;AAAA,EAClB;AACF;AAcA,eAAsB,mBACpB,SACA,SACA,SACA,UAAqC,CAAC,GACrB;AACjB,QAAM,OAAO,kBAAkB,QAAQ,KAAK;AAC5C,QAAM,WAAW,QAAQ,YAAY;AAErC,MAAI,CAAC,QAAQ,SAAS,aAAa,MAAM,QAAQ,GAAG;AAClD,WAAO;AAAA,EACT;AAEA,SAAO,mBAAmB,SAAS,SAAS,SAAS,IAAI;AAC3D;AAOA,eAAsB,mBACpB,SACA,SACA,SACA,UAAqC,CAAC,GACb;AACzB,QAAM,YAAY,MAAM,mBAAmB,SAAS,SAAS,SAAS,OAAO;AAC7E,SAAO,QAAQ,WAAW,EAAE,cAAc,WAAW,QAAQ,CAAC;AAChE;AAGO,SAAS,gBAAgB,OAA+B;AAC7D,QAAM,OAAO,kBAAkB,KAAK;AACpC,MAAI,CAACA,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,WAAO,KAAK,MAAMC,cAAa,MAAM,OAAO,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,qBAAqB,OAAuB;AAC1D,SAAO,kBAAkB,KAAK;AAChC;;;AFtCA,SAAS,cAAc;AAxDvB,eAAe,UACb,SACA,SACA,SACkE;AAClE,QAAM,YAAY,MAAM,mBAAmB,SAAS,SAAS,OAAO;AACpE,QAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,cAAc,WAAW,QAAQ,CAAC;AAC7E,QAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,SAAO;AAAA,IACL,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ,QAAQ,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAChD,QAAQ,QAAQ;AAAA,IAClB;AAAA,IACA,SAAS,YAAY;AACnB,YAAM,QAAQ,MAAM;AAAA,IACtB;AAAA,EACF;AACF;AAEO,IAAM,OAAO,SAAS,OAA4B;AAAA,EACvD,OAAO,OAAO,EAAE,SAAS,QAAQ,GAAG,QAAQ;AAC1C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AAEA,UAAM,WAAuC,CAAC;AAE9C,UAAM,UAAwB,OAAO,UAAU,YAAY;AACzD,YAAM,WAA0B,MAAM,QAAQ,QAAQ,IAClD,SAAS,IAAI,CAAC,SAAS,sBAAsB,IAAI,CAAC,IAClD,iBAAiB,UAAU,OAAO;AAEtC,YAAM,QAAQ,MAAM,QAAQ;AAAA,QAC1B,SAAS,IAAI,CAAC,SAAS,UAAU,SAAS,MAAM,OAAO,CAAC;AAAA,MAC1D;AACA,iBAAW,KAAK,MAAO,UAAS,KAAK,EAAE,OAAO;AAC9C,aAAO,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IAChC;AAEA,UAAM,IAAI,OAAO;AAIjB,eAAW,WAAW,UAAU;AAC9B,YAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAChC;AAAA,EACF;AACF,CAAC;","names":["existsSync","readFileSync","homedir","join"]}

package/dist/worker.d.ts

@@ -917,7 +917,7 @@ declare abstract class BaseRoom<E = Record<string, unknown>> {
     fetch(request: Request): Promise<Response>;
     private handleWebSocketUpgrade;
     webSocketMessage(ws: WebSocket, message: ArrayBuffer | string): Promise<void>;
-    webSocketClose(ws: WebSocket, code: number, reason: string): Promise<void>;
+    webSocketClose(ws: WebSocket, _code: number, _reason: string): Promise<void>;
     webSocketError(ws: WebSocket, error: unknown): Promise<void>;
     alarm(): Promise<void>;
     /**
@@ -925,7 +925,7 @@ declare abstract class BaseRoom<E = Record<string, unknown>> {
      * Return an augmented attachment to serialize on the WebSocket,
      * or void to use the default attachment.
      */
-    protected onConnect(ws: WebSocket, user: UserAttachment): UserAttachment | void | Promise<UserAttachment | void>;
+    protected onConnect(_ws: WebSocket, _user: UserAttachment): UserAttachment | void | Promise<UserAttachment | void>;
     /**
      * Called for each parsed JSON message.
      */
@@ -940,7 +940,7 @@ declare abstract class BaseRoom<E = Record<string, unknown>> {
     /**
      * Called when a WebSocket disconnects.
      */
-    protected onDisconnect(ws: WebSocket, user: UserAttachment): void | Promise<void>;
+    protected onDisconnect(_ws: WebSocket, _user: UserAttachment): void | Promise<void>;
     /**
      * Called for HTTP requests that are NOT WebSocket upgrades.
      */
@@ -1322,7 +1322,6 @@ declare class SchemaRegistry {
     registerTrusted(schema: CollectionSchema): void;
     get(name: string): CollectionSchema | undefined;
     has(name: string): boolean;
-    hasTrusted(name: string): boolean;
     all(): CollectionSchema[];
     names(): string[];
 }
@@ -1394,6 +1393,12 @@ declare class RecordRoom<E = Record<string, unknown>> extends BaseRoom<E> {
     private ownerUserId;
     /** True until the first fetch() completes — detects hibernation wake-up */
     private freshConstruct;
+    /**
+     * Per-connection `[DO Perf]` timing logs are noisy on every hot path, so
+     * they're gated behind a `DEEPSPACE_DO_PERF` env binding (set it to any
+     * truthy value on the worker to opt in). Off by default.
+     */
+    private get perfLogEnabled();
     constructor(state: DurableObjectState, env: unknown, schemas?: CollectionSchema[], config?: RecordRoomConfig);
     private getPermissionContext;
     fetch(request: Request): Promise<Response>;
@@ -1406,12 +1411,13 @@ declare class RecordRoom<E = Record<string, unknown>> extends BaseRoom<E> {
     private ensureCollectionTable;
     private ensureAllCollectionTables;
     protected onConnect(ws: WebSocket, user: UserAttachment): Promise<ConnectionAttachment>;
-    protected onMessage(ws: WebSocket, user: UserAttachment, msg: {
-        type: string;
-        [key: string]: unknown;
-    }): Promise<void>;
-    protected onBinaryMessage(ws: WebSocket, user: UserAttachment, data: ArrayBuffer): Promise<void>;
-    protected onDisconnect(ws: WebSocket, user: UserAttachment): void;
+    /**
+     * Required to satisfy BaseRoom's abstract contract, but never invoked:
+     * RecordRoom overrides `webSocketMessage`/`webSocketClose` directly (below),
+     * so the BaseRoom dispatch path that would call this never runs. All real
+     * message handling lives in `handleRecordMessage`.
+     */
+    protected onMessage(): void;
     webSocketMessage(ws: WebSocket, message: ArrayBuffer | string): Promise<void>;
     webSocketClose(ws: WebSocket, code: number, reason: string): Promise<void>;
     webSocketError(ws: WebSocket, error: unknown): Promise<void>;
@@ -1455,12 +1461,12 @@ declare class YjsRoom<E = Record<string, unknown>> extends BaseRoom<E> {
     private getDoc;
     private persistDoc;
     protected onConnect(ws: WebSocket, user: UserAttachment): YjsAttachment;
-    protected onMessage(ws: WebSocket, user: UserAttachment, message: {
+    protected onMessage(_ws: WebSocket, _user: UserAttachment, _message: {
         type: string;
         [key: string]: unknown;
     }): void;
     protected onBinaryMessage(ws: WebSocket, user: UserAttachment, data: ArrayBuffer): void;
-    protected onDisconnect(ws: WebSocket, user: UserAttachment): void;
+    protected onDisconnect(ws: WebSocket, _user: UserAttachment): void;
     private handleSync;
     private handleAwareness;
     private readAwarenessUpdates;
@@ -1542,13 +1548,13 @@ declare abstract class GameRoom<E = Record<string, unknown>> extends BaseRoom<E>
      */
     protected abstract onTick(state: Record<string, unknown>, inputs: GameInput[], tick: number): Record<string, unknown> | undefined | Promise<Record<string, unknown> | undefined>;
     /** Called when a player connects */
-    protected onPlayerJoin(player: Player): void;
+    protected onPlayerJoin(_player: Player): void;
     /** Called when a player disconnects */
-    protected onPlayerLeave(player: Player): void;
+    protected onPlayerLeave(_player: Player): void;
     /** Called when the game starts */
     protected onGameStart(): void;
     /** Called when the game ends */
-    protected onGameEnd(finalState: Record<string, unknown>): void;
+    protected onGameEnd(_finalState: Record<string, unknown>): void;
     /**
      * Called once when the DO first hydrates persisted state from storage.
      * Receives the parsed state blob as it was written by a previous build.
@@ -2822,10 +2828,10 @@ interface CronContext {
         query(collection: string, opts?: {
             where?: Record<string, unknown>;
             limit?: number;
-        }): Promise<any[]>;
-        create(collection: string, data: Record<string, unknown>): Promise<any>;
-        update(collection: string, recordId: string, data: Record<string, unknown>): Promise<any>;
-        delete(collection: string, recordId: string): Promise<any>;
+        }): Promise<unknown[]>;
+        create(collection: string, data: Record<string, unknown>): Promise<unknown>;
+        update(collection: string, recordId: string, data: Record<string, unknown>): Promise<unknown>;
+        delete(collection: string, recordId: string): Promise<unknown>;
     };
     /**
      * Call a platform integration endpoint (e.g. "openai/chat-completion",
@@ -2833,7 +2839,7 @@ interface CronContext {
      * APP_OWNER_JWT the rest of the SDK uses for server-side billed calls.
      */
     integrations: {
-        call(endpoint: string, params?: Record<string, unknown>): Promise<any>;
+        call(endpoint: string, params?: Record<string, unknown>): Promise<unknown>;
     };
     /** App owner's user ID */
     ownerUserId: string;
@@ -3455,8 +3461,7 @@ interface VerifiedAuth {
     userId: string;
     claims: JwtClaims;
 }
-interface VerifyResult extends VerifiedAuth {
-}
+type VerifyResult = VerifiedAuth;
 interface TokenDebugInfo {
     iss?: string | null;
     aud?: string | string[] | null;

package/dist/worker.js

@@ -70,7 +70,7 @@ var BaseRoom = class {
       console.error(`[${this.constructor.name}] Message error:`, e);
     }
   }
-  async webSocketClose(ws, code, reason) {
+  async webSocketClose(ws, _code, _reason) {
     const attachment = ws.deserializeAttachment();
     if (attachment) {
       try {
@@ -95,12 +95,12 @@ var BaseRoom = class {
    * Return an augmented attachment to serialize on the WebSocket,
    * or void to use the default attachment.
    */
-  onConnect(ws, user) {
+  onConnect(_ws, _user) {
   }
   /**
    * Called when a WebSocket disconnects.
    */
-  onDisconnect(ws, user) {
+  onDisconnect(_ws, _user) {
   }
   // ==========================================================================
   // Utilities
@@ -350,7 +350,7 @@ function coerceValue(value, storage, interpretation) {
     if (m) return parseFloat(m[1]) / 100;
   }
   if (interpretation.kind === "currency") {
-    const cleaned2 = s.replace(/[^0-9.\-]/g, "");
+    const cleaned2 = s.replace(/[^0-9.-]/g, "");
     const n2 = parseFloat(cleaned2);
     if (!isNaN(n2)) return n2;
     return s;
@@ -540,9 +540,6 @@ var SchemaRegistry = class {
   has(name) {
     return this.trusted.has(name);
   }
-  hasTrusted(name) {
-    return this.trusted.has(name);
-  }
   all() {
     return Array.from(this.trusted.values());
   }
@@ -1141,7 +1138,7 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
   const columns = getResolvedColumns(schema);
   const existing = getRecord(ctx.sql, collection, recordId, schema);
   const isUpdate = existing !== null;
-  let mergedData = isUpdate ? { ...existing.data, ...data } : { ...data };
+  const mergedData = isUpdate ? { ...existing.data, ...data } : { ...data };
   for (const col of columns) {
     if (col.readonly) continue;
     if (!isUpdate) {
@@ -1196,7 +1193,10 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
     const permCtx = ctx.getPermissionContext();
     if (isUpdate) {
       if (!canUpdate(schema, userRole, { ...existing, recordId }, userId, permCtx)) {
-        return { success: false, error: `UPDATE DENIED: role=${userRole}, collection=${collection}` };
+        return {
+          success: false,
+          error: `UPDATE DENIED: role=${userRole}, collection=${collection}`
+        };
       }
       const fieldError = checkFieldPermissions(schema, userRole, finalData, existing.data);
       if (fieldError) {
@@ -1204,7 +1204,10 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
       }
     } else {
       if (!canCreate(schema, userRole)) {
-        return { success: false, error: `CREATE DENIED: role=${userRole}, collection=${collection}` };
+        return {
+          success: false,
+          error: `CREATE DENIED: role=${userRole}, collection=${collection}`
+        };
       }
     }
   }
@@ -1226,7 +1229,10 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
     );
     if (existing2.toArray().length > 0) {
       const fields = schema.uniqueOn.map((f) => `${f}=${finalData[f] ?? "null"}`).join(", ");
-      return { success: false, error: `Duplicate: a record with ${fields} already exists in ${collection}` };
+      return {
+        success: false,
+        error: `Duplicate: a record with ${fields} already exists in ${collection}`
+      };
     }
   }
   if (isUpdate) {
@@ -1240,13 +1246,16 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
     ctx.sql.exec(`UPDATE "${tbl}" SET ${setClauses.join(", ")} WHERE _row_id = ?`, ...params);
   } else {
     const colIds = Object.keys(colValues);
-    const allCols = ["_row_id", "_created_by", "_created_at", "_updated_at", ...colIds.map((c) => `"${c}"`)];
+    const allCols = [
+      "_row_id",
+      "_created_by",
+      "_created_at",
+      "_updated_at",
+      ...colIds.map((c) => `"${c}"`)
+    ];
     const placeholders = allCols.map(() => "?").join(", ");
     const params = [recordId, userId, now, now, ...colIds.map((c) => colValues[c])];
-    ctx.sql.exec(
-      `INSERT INTO "${tbl}" (${allCols.join(", ")}) VALUES (${placeholders})`,
-      ...params
-    );
+    ctx.sql.exec(`INSERT INTO "${tbl}" (${allCols.join(", ")}) VALUES (${placeholders})`, ...params);
   }
   const saved = getRecord(ctx.sql, collection, recordId, schema);
   const record = {
@@ -2653,9 +2662,21 @@ var RecordRoom = class extends BaseRoom {
   ownerUserId;
   /** True until the first fetch() completes — detects hibernation wake-up */
   freshConstruct = true;
+  /**
+   * Per-connection `[DO Perf]` timing logs are noisy on every hot path, so
+   * they're gated behind a `DEEPSPACE_DO_PERF` env binding (set it to any
+   * truthy value on the worker to opt in). Off by default.
+   */
+  get perfLogEnabled() {
+    return !!this.env?.DEEPSPACE_DO_PERF;
+  }
   constructor(state, env, schemas = [], config = {}) {
     super(state, env);
-    this.schemaRegistry = new SchemaRegistry([...SYSTEM_COLLECTION_SCHEMAS, BASE_USERS_SCHEMA, ...schemas]);
+    this.schemaRegistry = new SchemaRegistry([
+      ...SYSTEM_COLLECTION_SCHEMAS,
+      BASE_USERS_SCHEMA,
+      ...schemas
+    ]);
     this.ownerUserId = config.ownerUserId ?? null;
     const wsCount = this.state.getWebSockets().length;
     if (wsCount > 0) {
@@ -2739,10 +2760,7 @@ var RecordRoom = class extends BaseRoom {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       for (const row of oldUsers) {
         const r = row;
-        const existing = this.sql.exec(
-          `SELECT 1 FROM c_users WHERE _row_id = ?`,
-          r.user_id
-        ).toArray();
+        const existing = this.sql.exec(`SELECT 1 FROM c_users WHERE _row_id = ?`, r.user_id).toArray();
         if (existing.length > 0) continue;
         this.sql.exec(
           `INSERT INTO c_users (_row_id, _created_by, _created_at, _updated_at, col_email, col_name, col_imageurl, col_role, col_createdat, col_lastseenat) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
@@ -2776,7 +2794,6 @@ var RecordRoom = class extends BaseRoom {
       }
       let migrated = 0;
       let skipped = 0;
-      const now = (/* @__PURE__ */ new Date()).toISOString();
       for (const row of rows) {
         const r = row;
         const schema = this.schemaRegistry.get(r.collection);
@@ -2785,17 +2802,11 @@ var RecordRoom = class extends BaseRoom {
           continue;
         }
         const tbl = collectionTableName(r.collection);
-        const tblExists = this.sql.exec(
-          `SELECT name FROM sqlite_master WHERE type='table' AND name=?`,
-          tbl
-        ).toArray().length > 0;
+        const tblExists = this.sql.exec(`SELECT name FROM sqlite_master WHERE type='table' AND name=?`, tbl).toArray().length > 0;
         if (!tblExists) {
           this.ensureCollectionTable(schema);
         }
-        const existing = this.sql.exec(
-          `SELECT 1 FROM "${tbl}" WHERE _row_id = ?`,
-          r.record_id
-        ).toArray();
+        const existing = this.sql.exec(`SELECT 1 FROM "${tbl}" WHERE _row_id = ?`, r.record_id).toArray();
         if (existing.length > 0) {
           skipped++;
           continue;
@@ -2810,9 +2821,21 @@ var RecordRoom = class extends BaseRoom {
         const columns = schema.columns.map(resolveColumn);
         const colValues = dataToColumnValues(data, columns);
         const colIds = Object.keys(colValues);
-        const allCols = ["_row_id", "_created_by", "_created_at", "_updated_at", ...colIds.map((c) => `"${c}"`)];
+        const allCols = [
+          "_row_id",
+          "_created_by",
+          "_created_at",
+          "_updated_at",
+          ...colIds.map((c) => `"${c}"`)
+        ];
         const placeholders = allCols.map(() => "?").join(", ");
-        const params = [r.record_id, r.created_by, r.created_at, r.updated_at, ...colIds.map((c) => colValues[c])];
+        const params = [
+          r.record_id,
+          r.created_by,
+          r.created_at,
+          r.updated_at,
+          ...colIds.map((c) => colValues[c])
+        ];
         this.sql.exec(
           `INSERT INTO "${tbl}" (${allCols.join(", ")}) VALUES (${placeholders})`,
           ...params
@@ -2820,7 +2843,9 @@ var RecordRoom = class extends BaseRoom {
         migrated++;
       }
       if (migrated > 0 || skipped > 0) {
-        console.log(`[RecordRoom] Migrated ${migrated} records from document-mode, ${skipped} skipped`);
+        console.log(
+          `[RecordRoom] Migrated ${migrated} records from document-mode, ${skipped} skipped`
+        );
       }
       this.sql.exec(`DROP TABLE IF EXISTS records`);
     } catch (error) {
@@ -2843,7 +2868,12 @@ var RecordRoom = class extends BaseRoom {
   // ============================================================================
   async onConnect(ws, user) {
     await this.ensureInitialized();
-    const timing = this._fetchTiming ?? { fetchStart: Date.now(), isColdStart: false, needsInit: false, initMs: 0 };
+    const timing = this._fetchTiming ?? {
+      fetchStart: Date.now(),
+      isColdStart: false,
+      needsInit: false,
+      initMs: 0
+    };
     const userId = user.userId;
     const userName = user.userName;
     const userEmail = user.userEmail;
@@ -2854,7 +2884,16 @@ var RecordRoom = class extends BaseRoom {
       const isOwner2 = this.ownerUserId != null && userId === this.ownerUserId;
       const regStart = Date.now();
       const defaultRole = this.schemaRegistry.get("users")?.defaultRole ?? "member";
-      const registeredUser = await registerUser(this.sql, userId, userName, userEmail, userImageUrl, isOwner2, defaultRole, this.schemaRegistry);
+      const registeredUser = await registerUser(
+        this.sql,
+        userId,
+        userName,
+        userEmail,
+        userImageUrl,
+        isOwner2,
+        defaultRole,
+        this.schemaRegistry
+      );
       const regMs = Date.now() - regStart;
       attachment = {
         userId: registeredUser.id,
@@ -2868,7 +2907,10 @@ var RecordRoom = class extends BaseRoom {
       };
       this.send(ws, { type: MSG.USER_INFO, payload: registeredUser });
       const totalMs = Date.now() - timing.fetchStart;
-      console.log(`[DO Perf] cold=${timing.isColdStart} | init: ${timing.initMs}ms reg: ${regMs}ms | total: ${totalMs}ms`);
+      if (this.perfLogEnabled)
+        console.log(
+          `[DO Perf] cold=${timing.isColdStart} | init: ${timing.initMs}ms reg: ${regMs}ms | total: ${totalMs}ms`
+        );
     } else {
       attachment = {
         userId,
@@ -2879,63 +2921,37 @@ var RecordRoom = class extends BaseRoom {
         yjsSubscriptions: [],
         yjsClientId: this.nextYjsClientId++
       };
-      this.send(ws, { type: MSG.USER_INFO, payload: {
-        id: userId,
-        name: "Anonymous",
-        email: "",
-        role: ROLE_ANONYMOUS,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-        lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
-      } });
+      this.send(ws, {
+        type: MSG.USER_INFO,
+        payload: {
+          id: userId,
+          name: "Anonymous",
+          email: "",
+          role: ROLE_ANONYMOUS,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      });
       const totalMs = Date.now() - timing.fetchStart;
-      console.log(`[DO Perf] cold=${timing.isColdStart} anon | total: ${totalMs}ms`);
+      if (this.perfLogEnabled)
+        console.log(`[DO Perf] cold=${timing.isColdStart} anon | total: ${totalMs}ms`);
     }
     this._fetchTiming = null;
     return attachment;
   }
-  async onMessage(ws, user, msg) {
-    await this.ensureInitialized();
-    const attachment = ws.deserializeAttachment();
-    if (!attachment) {
-      this.send(ws, { type: MSG.ERROR, payload: { error: "Connection not found" } });
-      return;
-    }
-    try {
-      await this.handleRecordMessage(ws, attachment, msg);
-    } catch (e) {
-      const errMsg = e instanceof Error ? e.message : String(e);
-      console.error(`[RecordRoom] Message handler error: ${errMsg}`);
-      this.send(ws, { type: MSG.ERROR, payload: { error: `Invalid message: ${errMsg}` } });
-    }
-  }
-  async onBinaryMessage(ws, user, data) {
-    await this.ensureInitialized();
-    const attachment = ws.deserializeAttachment();
-    if (!attachment) return;
-    try {
-      await handleYjsBinaryMessage(
-        this.createYjsContext(),
-        ws,
-        attachment,
-        new Uint8Array(data)
-      );
-    } catch (e) {
-      console.error("[RecordRoom] Yjs binary message error:", e);
-    }
-  }
-  onDisconnect(ws, user) {
-    console.log(`[RecordRoom] webSocketClose`);
-    try {
-      const attachment = ws.deserializeAttachment();
-      if (attachment) {
-        broadcastAwarenessRemoval(this.createYjsContext(), attachment);
-      }
-    } catch {
-    }
+  /**
+   * Required to satisfy BaseRoom's abstract contract, but never invoked:
+   * RecordRoom overrides `webSocketMessage`/`webSocketClose` directly (below),
+   * so the BaseRoom dispatch path that would call this never runs. All real
+   * message handling lives in `handleRecordMessage`.
+   */
+  onMessage() {
+    throw new Error("RecordRoom.onMessage is unreachable; use webSocketMessage");
   }
   // ============================================================================
-  // Hibernation API (delegates to BaseRoom via super, but we need
-  // to ensure webSocketMessage gets the ensureInitialized treatment)
+  // Hibernation API — RecordRoom overrides these directly (rather than using
+  // BaseRoom's onMessage/onBinaryMessage/onDisconnect hooks) so it can run
+  // ensureInitialized() before every message after a hibernation wake-up.
   // ============================================================================
   async webSocketMessage(ws, message) {
     await this.ensureInitialized();
@@ -3006,7 +3022,12 @@ var RecordRoom = class extends BaseRoom {
         handleUserList(userCtx, ws, attachment);
         break;
       case MSG.USER_UPDATE:
-        handleUserUpdate(recordCtx, ws, attachment, payload);
+        handleUserUpdate(
+          recordCtx,
+          ws,
+          attachment,
+          payload
+        );
         break;
       case MSG.SET_ROLE:
         await handleSetRole(userCtx, ws, attachment, payload);
@@ -3172,7 +3193,7 @@ var YjsRoom = class extends BaseRoom {
     this.sendAwarenessSnapshot(ws);
     return attachment;
   }
-  onMessage(ws, user, message) {
+  onMessage(_ws, _user, _message) {
   }
   onBinaryMessage(ws, user, data) {
     const bytes = new Uint8Array(data);
@@ -3184,7 +3205,7 @@ var YjsRoom = class extends BaseRoom {
       this.handleAwareness(ws, decoder, bytes);
     }
   }
-  onDisconnect(ws, user) {
+  onDisconnect(ws, _user) {
     const attachment = ws.deserializeAttachment();
     if (attachment?.awarenessClientId == null) return;
     const clientId = attachment.awarenessClientId;
@@ -3545,16 +3566,16 @@ var GameRoom = class extends BaseRoom {
     return this.currentTick;
   }
   /** Called when a player connects */
-  onPlayerJoin(player) {
+  onPlayerJoin(_player) {
   }
   /** Called when a player disconnects */
-  onPlayerLeave(player) {
+  onPlayerLeave(_player) {
   }
   /** Called when the game starts */
   onGameStart() {
   }
   /** Called when the game ends */
-  onGameEnd(finalState) {
+  onGameEnd(_finalState) {
   }
   /**
    * Called once when the DO first hydrates persisted state from storage.
@@ -6139,7 +6160,8 @@ function buildCronContext(env, ownerUserId, roomId = "default") {
       if (opts?.where) params.where = opts.where;
       if (opts?.limit) params.limit = opts.limit;
       const data = await executeTool3("records.query", params);
-      return data.records || [];
+      const records2 = data?.records;
+      return records2 ?? [];
     },
     async create(collection, data) {
       return executeTool3("records.create", { collection, data });
@@ -6296,7 +6318,8 @@ async function composioTools(env, options) {
   if (!list.ok || !list.success) {
     throw new Error(`composioTools: failed to list Composio tools: ${list.detail}`);
   }
-  const items = Array.isArray(list.data?.items) ? list.data.items : [];
+  const listItems = list.data?.items;
+  const items = Array.isArray(listItems) ? listItems : [];
   const tools = {};
   for (const item of items) {
     if (!item?.slug) continue;