deepspace 0.6.2 → 0.8.0

package/dist/worker.js

@@ -59,7 +59,7 @@ var BaseRoom = class {
   // ==========================================================================
   // WebSocket Connection
   // ==========================================================================
-  async handleWebSocketUpgrade(request, url) {
+  async handleWebSocketUpgrade(_request, url) {
     const userId = url.searchParams.get("userId") || void 0;
     const userName = url.searchParams.get("userName") || "Anonymous";
     const userEmail = url.searchParams.get("userEmail") || "";
@@ -111,7 +111,7 @@ var BaseRoom = class {
       }
     }
   }
-  async webSocketError(ws, error) {
+  async webSocketError(_ws, error) {
     console.error(`[${this.constructor.name}] webSocketError:`, error);
   }
   async alarm() {
@@ -955,6 +955,14 @@ var Awareness = class {
       this.emit({ added: [], updated: [], removed });
     }
   }
+  /** Release all state and listeners owned by this awareness instance. */
+  destroy() {
+    this.setLocalState(null);
+    this.states.clear();
+    this.meta.clear();
+    this.updateListeners.clear();
+    this.changeListeners.clear();
+  }
 };
 function encodeAwarenessMessage(awareness, clientIds) {
   const encoder = createEncoder();
@@ -1397,6 +1405,11 @@ function parseYjsDocKey(docKey) {
     fieldName: docKey.slice(lastColon + 1)
   };
 }
+function hasYjsSubscription(attachment, target) {
+  return attachment.yjsSubscriptions.some(
+    (subscription) => subscription.collection === target.collection && subscription.recordId === target.recordId && subscription.fieldName === target.fieldName
+  );
+}
 var SYSTEM_COLLECTIONS = /* @__PURE__ */ new Set([
   "canvas-settings"
 ]);
@@ -1412,7 +1425,7 @@ var SYSTEM_COLLECTION_SCHEMAS = [
 function getYjsDocKey(collection, recordId, fieldName) {
   return `${collection}:${recordId}:${fieldName}`;
 }
-async function getOrCreateYjsDoc(ctx, docKey) {
+function getOrCreateYjsDoc(ctx, docKey) {
   let doc = ctx.yjsDocs.get(docKey);
   if (doc) return doc;
   doc = new Y2.Doc();
@@ -1434,6 +1447,20 @@ async function getOrCreateYjsDoc(ctx, docKey) {
   ctx.yjsDocs.set(docKey, doc);
   return doc;
 }
+function unloadYjsDocIfUnused(ctx, docKey, excludeWs = null) {
+  const target = parseYjsDocKey(docKey);
+  if (!target) return false;
+  for (const ws of ctx.state.getWebSockets()) {
+    if (ws === excludeWs) continue;
+    const attachment = ws.deserializeAttachment();
+    if (attachment && hasYjsSubscription(attachment, target)) return false;
+  }
+  const doc = ctx.yjsDocs.get(docKey);
+  if (!doc) return false;
+  ctx.yjsDocs.delete(docKey);
+  doc.destroy();
+  return true;
+}
 function saveYjsDoc(sql, docKey, doc) {
   const state = Y2.encodeStateAsUpdate(doc);
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -1447,7 +1474,7 @@ function saveYjsDoc(sql, docKey, doc) {
     now
   );
 }
-async function handleYjsJoin(ctx, ws, attachment, payload) {
+function handleYjsJoin(ctx, ws, attachment, payload) {
   const { collection, recordId, fieldName } = payload;
   const isSystem = SYSTEM_COLLECTIONS.has(collection);
   const schema = ctx.schemaRegistry.get(collection);
@@ -1486,10 +1513,8 @@ async function handleYjsJoin(ctx, ws, attachment, payload) {
     hasWriteAccess = canUpdate(schema, attachment.role, recordWithId, attachment.userId, permCtx);
   }
   const docKey = getYjsDocKey(collection, recordId, fieldName);
-  const doc = await getOrCreateYjsDoc(ctx, docKey);
-  if (!attachment.yjsSubscriptions.some(
-    (s) => s.collection === collection && s.recordId === recordId && s.fieldName === fieldName
-  )) {
+  const doc = getOrCreateYjsDoc(ctx, docKey);
+  if (!hasYjsSubscription(attachment, payload)) {
     attachment.yjsSubscriptions.push({ collection, recordId, fieldName });
     ws.serializeAttachment(attachment);
   }
@@ -1511,14 +1536,15 @@ async function handleYjsJoin(ctx, ws, attachment, payload) {
   }
   ctx.send(ws, { type: MSG.YJS_JOIN, payload: { collection, recordId, fieldName, canWrite: hasWriteAccess } });
 }
-function handleYjsLeave(ws, attachment, payload) {
+function handleYjsLeave(ctx, ws, attachment, payload) {
   const { collection, recordId, fieldName } = payload;
   attachment.yjsSubscriptions = attachment.yjsSubscriptions.filter(
     (s) => !(s.collection === collection && s.recordId === recordId && s.fieldName === fieldName)
   );
   ws.serializeAttachment(attachment);
+  unloadYjsDocIfUnused(ctx, getYjsDocKey(collection, recordId, fieldName), ws);
 }
-async function handleYjsBinaryMessage(ctx, ws, attachment, data) {
+function handleYjsBinaryMessage(ctx, ws, attachment, data) {
   const decoder = createDecoder(data);
   const messageType = readVarUint(decoder);
   if (messageType === MSG_YJS_AWARENESS) {
@@ -1527,11 +1553,7 @@ async function handleYjsBinaryMessage(ctx, ws, attachment, data) {
     const payload = readVarUint8Array(decoder);
     const parsed2 = parseYjsDocKey(docKey2);
     if (!parsed2) return;
-    const { collection: collection2, recordId: recordId2, fieldName: fieldName2 } = parsed2;
-    const isSubscribed2 = attachment.yjsSubscriptions.some(
-      (s) => s.collection === collection2 && s.recordId === recordId2 && s.fieldName === fieldName2
-    );
-    if (!isSubscribed2) return;
+    if (!hasYjsSubscription(attachment, parsed2)) return;
     if (attachment.awarenessClientId == null) {
       try {
         const pd = createDecoder(payload);
@@ -1551,12 +1573,9 @@ async function handleYjsBinaryMessage(ctx, ws, attachment, data) {
   const docKey = new TextDecoder().decode(docKeyBytes);
   const parsed = parseYjsDocKey(docKey);
   if (!parsed) return;
-  const { collection, recordId, fieldName } = parsed;
-  const isSubscribed = attachment.yjsSubscriptions.some(
-    (s) => s.collection === collection && s.recordId === recordId && s.fieldName === fieldName
-  );
-  if (!isSubscribed) return;
-  const doc = await getOrCreateYjsDoc(ctx, docKey);
+  const { collection, recordId } = parsed;
+  if (!hasYjsSubscription(attachment, parsed)) return;
+  const doc = getOrCreateYjsDoc(ctx, docKey);
   const syncType = readVarUint(decoder);
   switch (syncType) {
     case MSG_SYNC_STEP1: {
@@ -1581,7 +1600,6 @@ async function handleYjsBinaryMessage(ctx, ws, attachment, data) {
       }
       const update = readVarUint8Array(decoder);
       Y2.applyUpdate(doc, update, "client");
-      saveYjsDoc(ctx.sql, docKey, doc);
       broadcastYjsUpdate(ctx, docKey, update, ws);
       break;
     }
@@ -1590,7 +1608,6 @@ async function handleYjsBinaryMessage(ctx, ws, attachment, data) {
 function broadcastYjsUpdate(ctx, docKey, update, excludeWs) {
   const parsed = parseYjsDocKey(docKey);
   if (!parsed) return;
-  const { collection, recordId, fieldName } = parsed;
   const encoder = createEncoder();
   writeVarUint(encoder, MSG_YJS_SYNC);
   writeVarUint8Array(encoder, new TextEncoder().encode(docKey));
@@ -1601,10 +1618,7 @@ function broadcastYjsUpdate(ctx, docKey, update, excludeWs) {
     if (ws === excludeWs) continue;
     const attachment = ws.deserializeAttachment();
     if (!attachment) continue;
-    const isSubscribed = attachment.yjsSubscriptions.some(
-      (s) => s.collection === collection && s.recordId === recordId && s.fieldName === fieldName
-    );
-    if (isSubscribed) {
+    if (hasYjsSubscription(attachment, parsed)) {
       ctx.sendBinary(ws, message);
     }
   }
@@ -1612,7 +1626,6 @@ function broadcastYjsUpdate(ctx, docKey, update, excludeWs) {
 function broadcastAwareness(ctx, docKey, payload, excludeWs) {
   const parsed = parseYjsDocKey(docKey);
   if (!parsed) return;
-  const { collection, recordId, fieldName } = parsed;
   const encoder = createEncoder();
   writeVarUint(encoder, MSG_YJS_AWARENESS);
   writeVarUint8Array(encoder, new TextEncoder().encode(docKey));
@@ -1622,10 +1635,7 @@ function broadcastAwareness(ctx, docKey, payload, excludeWs) {
     if (ws === excludeWs) continue;
     const attachment = ws.deserializeAttachment();
     if (!attachment) continue;
-    const isSubscribed = attachment.yjsSubscriptions.some(
-      (s) => s.collection === collection && s.recordId === recordId && s.fieldName === fieldName
-    );
-    if (isSubscribed) {
+    if (hasYjsSubscription(attachment, parsed)) {
       ctx.sendBinary(ws, message);
     }
   }
@@ -1644,6 +1654,17 @@ function broadcastAwarenessRemoval(ctx, attachment) {
     broadcastAwareness(ctx, docKey, removalPayload, null);
   }
 }
+function handleYjsDisconnect(ctx, ws, attachment) {
+  broadcastAwarenessRemoval(ctx, attachment);
+  const docKeys = new Set(
+    attachment.yjsSubscriptions.map(
+      (subscription) => getYjsDocKey(subscription.collection, subscription.recordId, subscription.fieldName)
+    )
+  );
+  for (const docKey of docKeys) {
+    unloadYjsDocIfUnused(ctx, docKey, ws);
+  }
+}
 
 // src/server/handlers/subscriptions.ts
 function handleSubscribe(ctx, ws, attachment, payload) {
@@ -1977,7 +1998,7 @@ function handleUserList(ctx, ws, _attachment) {
   }));
   ctx.send(ws, { type: MSG.USER_LIST, payload: { users } });
 }
-function handleUserUpdate(ctx, ws, attachment, payload) {
+function handleUserUpdate(ctx, _ws, attachment, payload) {
   const existing = getUserRecord(ctx.sql, attachment.userId, ctx.schemaRegistry);
   if (!existing) return;
   const data = { lastSeenAt: (/* @__PURE__ */ new Date()).toISOString() };
@@ -2107,72 +2128,6 @@ var BUILT_IN_TOOLS = [
     description: "List all users in this room",
     params: {}
   },
-  // Storage tools (legacy key-value)
-  {
-    name: "storage.list",
-    description: "List all keys in a storage scope",
-    params: {
-      scope: { type: "string", description: "Storage scope: global, files, user, userFiles", required: true },
-      prefix: { type: "string", description: "Optional key prefix filter", required: false },
-      userId: { type: "string", description: "User ID (required for user/userFiles scopes)", required: false }
-    }
-  },
-  {
-    name: "storage.read",
-    description: "Read one or more keys from storage",
-    params: {
-      scope: { type: "string", description: "Storage scope: global, files, user, userFiles", required: true },
-      keys: { type: "array", description: "Array of keys to read (or single key string)", required: true },
-      userId: { type: "string", description: "User ID (required for user/userFiles scopes)", required: false }
-    }
-  },
-  {
-    name: "storage.write",
-    description: "Write one or more key-value pairs to storage (batch supported)",
-    params: {
-      scope: { type: "string", description: "Storage scope: global, files, user, userFiles", required: true },
-      data: { type: "object", description: "Object with key-value pairs to write", required: true },
-      userId: { type: "string", description: "User ID (required for user/userFiles scopes)", required: false }
-    }
-  },
-  {
-    name: "storage.delete",
-    description: "Delete one or more keys from storage",
-    params: {
-      scope: { type: "string", description: "Storage scope: global, files, user, userFiles", required: true },
-      keys: { type: "array", description: "Array of keys to delete", required: true },
-      userId: { type: "string", description: "User ID (required for user/userFiles scopes)", required: false }
-    }
-  },
-  // Backup tools
-  {
-    name: "backup.create",
-    description: "Create a backup of the current Yjs document state to R2",
-    params: {
-      description: { type: "string", description: "Optional description for the backup", required: false }
-    }
-  },
-  {
-    name: "backup.list",
-    description: "List all available backups",
-    params: {
-      limit: { type: "number", description: "Maximum number of backups to return (default: 50)", required: false }
-    }
-  },
-  {
-    name: "backup.restore",
-    description: "Restore the Yjs document from a backup",
-    params: {
-      backupId: { type: "string", description: "The backup ID to restore from", required: true }
-    }
-  },
-  {
-    name: "backup.delete",
-    description: "Delete a specific backup",
-    params: {
-      backupId: { type: "string", description: "The backup ID to delete", required: true }
-    }
-  },
   // Yjs tools (collaborative document access)
   {
     name: "yjs.list",
@@ -2256,7 +2211,7 @@ async function handleToolExecute(ctx, request) {
     }
   }
   if (tool2.startsWith("yjs.")) {
-    const result2 = await executeYjsTool(ctx, tool2, params, userId, userRole);
+    const result2 = executeYjsTool(ctx, tool2, params, userId, userRole);
     const status2 = result2.success ? 200 : result2.error?.includes("not found") ? 404 : 400;
     return Response.json(result2, { status: status2, headers: CORS_HEADERS });
   }
@@ -2411,7 +2366,15 @@ function buildYjsCtx(ctx) {
     sendBinary: ctx.sendBinary
   };
 }
-async function executeYjsTool(ctx, toolName, params, userId, userRole) {
+function withYjsDoc(ctx, docKey, operation) {
+  const doc = getOrCreateYjsDoc(ctx, docKey);
+  try {
+    return operation(doc);
+  } finally {
+    unloadYjsDocIfUnused(ctx, docKey);
+  }
+}
+function executeYjsTool(ctx, toolName, params, userId, userRole) {
   switch (toolName) {
     case "yjs.list": {
       const rows = ctx.sql.exec(
@@ -2439,20 +2402,21 @@ async function executeYjsTool(ctx, toolName, params, userId, userRole) {
       if (permError) return permError;
       const docKey = getYjsDocKey(collection, recordId, fieldName);
       const yjsCtx = buildYjsCtx(ctx);
-      const doc = await getOrCreateYjsDoc(yjsCtx, docKey);
-      const ytext = doc.getText(fieldName);
-      const text = ytext.toString();
-      const sharedTypes = {};
-      for (const [key, type] of doc.share) {
-        if (type instanceof Y3.Text) {
-          sharedTypes[key || "(default)"] = `Y.Text (${type.length} chars)`;
-        } else if (type instanceof Y3.Map) {
-          sharedTypes[key] = `Y.Map (${type.size} entries)`;
-        } else if (type instanceof Y3.Array) {
-          sharedTypes[key] = `Y.Array (${type.length} items)`;
+      return withYjsDoc(yjsCtx, docKey, (doc) => {
+        const ytext = doc.getText(fieldName);
+        const text = ytext.toString();
+        const sharedTypes = {};
+        for (const [key, type] of doc.share) {
+          if (type instanceof Y3.Text) {
+            sharedTypes[key || "(default)"] = `Y.Text (${type.length} chars)`;
+          } else if (type instanceof Y3.Map) {
+            sharedTypes[key] = `Y.Map (${type.size} entries)`;
+          } else if (type instanceof Y3.Array) {
+            sharedTypes[key] = `Y.Array (${type.length} items)`;
+          }
         }
-      }
-      return { success: true, data: { docKey, text, sharedTypes } };
+        return { success: true, data: { docKey, text, sharedTypes } };
+      });
     }
     case "yjs.setText": {
       const { collection, recordId, fieldName, text } = params;
@@ -2466,22 +2430,26 @@ async function executeYjsTool(ctx, toolName, params, userId, userRole) {
       if (permError) return permError;
       const docKey = getYjsDocKey(collection, recordId, fieldName);
       const yjsCtx = buildYjsCtx(ctx);
-      const doc = await getOrCreateYjsDoc(yjsCtx, docKey);
-      const ytext = doc.getText(fieldName);
-      let capturedUpdate = null;
-      const updateHandler = (update) => {
-        capturedUpdate = update;
-      };
-      doc.on("update", updateHandler);
-      doc.transact(() => {
-        ytext.delete(0, ytext.length);
-        ytext.insert(0, text);
+      return withYjsDoc(yjsCtx, docKey, (doc) => {
+        const ytext = doc.getText(fieldName);
+        let capturedUpdate = null;
+        const updateHandler = (update) => {
+          capturedUpdate = update;
+        };
+        doc.on("update", updateHandler);
+        try {
+          doc.transact(() => {
+            ytext.delete(0, ytext.length);
+            ytext.insert(0, text);
+          });
+        } finally {
+          doc.off("update", updateHandler);
+        }
+        if (capturedUpdate) {
+          broadcastYjsUpdate(yjsCtx, docKey, capturedUpdate, null);
+        }
+        return { success: true, data: { docKey, length: text.length } };
       });
-      doc.off("update", updateHandler);
-      if (capturedUpdate) {
-        broadcastYjsUpdate(yjsCtx, docKey, capturedUpdate, null);
-      }
-      return { success: true, data: { docKey, length: text.length } };
     }
     default:
       return { success: false, error: `Unknown Yjs tool: ${toolName}` };
@@ -2724,8 +2692,6 @@ var RecordRoom = class extends BaseRoom {
   initPromise = null;
   /** Yjs docs loaded in memory (key: collection:recordId:fieldName) */
   yjsDocs = /* @__PURE__ */ new Map();
-  /** Next Yjs client ID counter */
-  nextYjsClientId = 1;
   /** Owner user ID — gets admin role automatically */
   ownerUserId;
   /** True until the first fetch() completes — detects hibernation wake-up */
@@ -2742,7 +2708,7 @@ var RecordRoom = class extends BaseRoom {
    * The HTTP debug API (`/api/debug/*`) runs arbitrary SQL and role changes
    * with no auth of its own, so it is gated here at the DO's single ingress.
    * Off unless a deployment opts in with `ALLOW_DEBUG_ROUTES=true`
-   * (`deepspace dev`/`test` set it automatically). Deployments holding shared
+   * (`deepspace dev start`/`test run` set it automatically). Deployments holding shared
    * data override this to always return false.
    */
   get debugRoutesEnabled() {
@@ -2877,13 +2843,17 @@ var RecordRoom = class extends BaseRoom {
         this.sql.exec(`DROP TABLE IF EXISTS records`);
         return;
       }
-      let migrated = 0;
-      let skipped = 0;
+      const prepared = [];
+      const blocked = {
+        missingSchema: 0,
+        invalidData: 0,
+        targetConflict: 0
+      };
       for (const row of rows) {
         const r = row;
         const schema = this.schemaRegistry.get(r.collection);
         if (!schema || !schema.columns) {
-          skipped++;
+          blocked.missingSchema++;
           continue;
         }
         const tbl = collectionTableName(r.collection);
@@ -2893,14 +2863,18 @@ var RecordRoom = class extends BaseRoom {
         }
         const existing = this.sql.exec(`SELECT 1 FROM "${tbl}" WHERE _row_id = ?`, r.record_id).toArray();
         if (existing.length > 0) {
-          skipped++;
+          blocked.targetConflict++;
           continue;
         }
         let data;
         try {
           data = JSON.parse(r.data);
         } catch {
-          skipped++;
+          blocked.invalidData++;
+          continue;
+        }
+        if (data === null || typeof data !== "object" || Array.isArray(data)) {
+          blocked.invalidData++;
           continue;
         }
         const columns = schema.columns.map(resolveColumn);
@@ -2921,20 +2895,32 @@ var RecordRoom = class extends BaseRoom {
           r.updated_at,
           ...colIds.map((c) => colValues[c])
         ];
-        this.sql.exec(
-          `INSERT INTO "${tbl}" (${allCols.join(", ")}) VALUES (${placeholders})`,
-          ...params
-        );
-        migrated++;
+        prepared.push({
+          sql: `INSERT INTO "${tbl}" (${allCols.join(", ")}) VALUES (${placeholders})`,
+          params
+        });
       }
-      if (migrated > 0 || skipped > 0) {
-        console.log(
-          `[RecordRoom] Migrated ${migrated} records from document-mode, ${skipped} skipped`
+      const blockedCount = blocked.missingSchema + blocked.invalidData + blocked.targetConflict;
+      if (blockedCount > 0) {
+        console.error(
+          `[RecordRoom] Legacy records migration blocked; no records migrated and the records table was retained for retry (${blockedCount} blocked: ${blocked.missingSchema} missing schema, ${blocked.invalidData} invalid data, ${blocked.targetConflict} target conflict)`
         );
+        return;
       }
-      this.sql.exec(`DROP TABLE IF EXISTS records`);
+      this.state.storage.transactionSync(() => {
+        for (const record of prepared) {
+          this.sql.exec(record.sql, ...record.params);
+        }
+        this.sql.exec(`DROP TABLE IF EXISTS records`);
+      });
+      console.log(
+        `[RecordRoom] Migrated ${prepared.length} records from document-mode; legacy records table removed`
+      );
     } catch (error) {
-      console.error(`[RecordRoom] Records table migration error:`, error);
+      console.error(
+        `[RecordRoom] Legacy records migration failed; no records migrated and the records table was retained for retry:`,
+        error
+      );
     }
   }
   // ============================================================================
@@ -2987,8 +2973,7 @@ var RecordRoom = class extends BaseRoom {
         userImageUrl,
         role: registeredUser.role,
         subscriptions: [],
-        yjsSubscriptions: [],
-        yjsClientId: this.nextYjsClientId++
+        yjsSubscriptions: []
       };
       this.send(ws, { type: MSG.USER_INFO, payload: registeredUser });
       const totalMs = Date.now() - timing.fetchStart;
@@ -3003,8 +2988,7 @@ var RecordRoom = class extends BaseRoom {
         userEmail: "",
         role: ROLE_ANONYMOUS,
         subscriptions: [],
-        yjsSubscriptions: [],
-        yjsClientId: this.nextYjsClientId++
+        yjsSubscriptions: []
       };
       this.send(ws, {
         type: MSG.USER_INFO,
@@ -3073,12 +3057,12 @@ var RecordRoom = class extends BaseRoom {
     try {
       const attachment = ws.deserializeAttachment();
       if (attachment) {
-        broadcastAwarenessRemoval(this.createYjsContext(), attachment);
+        handleYjsDisconnect(this.createYjsContext(), ws, attachment);
       }
     } catch {
     }
   }
-  async webSocketError(ws, error) {
+  async webSocketError(_ws, error) {
     console.error(`[RecordRoom] webSocketError:`, error);
   }
   // ============================================================================
@@ -3121,7 +3105,7 @@ var RecordRoom = class extends BaseRoom {
         await handleYjsJoin(yjsCtx, ws, attachment, payload);
         break;
       case MSG.YJS_LEAVE:
-        handleYjsLeave(ws, attachment, payload);
+        handleYjsLeave(yjsCtx, ws, attachment, payload);
         break;
       case MSG.LIST_SCHEMAS:
         this.handleListSchemas(ws);
@@ -3280,7 +3264,7 @@ var YjsRoom = class extends BaseRoom {
   }
   onMessage(_ws, _user, _message) {
   }
-  onBinaryMessage(ws, user, data) {
+  onBinaryMessage(ws, _user, data) {
     const bytes = new Uint8Array(data);
     const decoder = createDecoder(bytes);
     const messageType = readVarUint(decoder);
@@ -3573,7 +3557,7 @@ var GameRoom = class extends BaseRoom {
         this.sendTo(ws, { type: MSG.ERROR, payload: { error: `Unknown game message type: ${type}` } });
     }
   }
-  onDisconnect(ws, user) {
+  onDisconnect(_ws, user) {
     const player = this.players.get(user.userId);
     if (player) {
       this.players.delete(user.userId);
@@ -3881,7 +3865,7 @@ var CanvasRoom = class extends BaseRoom {
         this.sendTo(ws, { type: MSG.ERROR, payload: { error: `Unknown canvas message type: ${type}` } });
     }
   }
-  onDisconnect(ws, user) {
+  onDisconnect(_ws, user) {
     this.viewports.delete(user.userId);
     this.undoStacks.delete(user.userId);
     this.redoStacks.delete(user.userId);
@@ -4075,6 +4059,140 @@ var PresenceRoom = class extends BaseRoom {
   }
 };
 
+// src/server/rooms/cron-schedule.ts
+var TASK_NAME_RE = /^[a-z0-9-]+$/;
+function validateTask(task) {
+  if (!task.name || typeof task.name !== "string") {
+    throw new Error("CronTask.name is required");
+  }
+  if (task.name.length > 64 || !TASK_NAME_RE.test(task.name)) {
+    throw new Error(
+      `CronTask.name "${task.name}" must be lowercase alphanumeric with hyphens, 1-64 chars`
+    );
+  }
+  const hasInterval = task.intervalMinutes != null;
+  const hasSchedule = task.schedule != null;
+  const hasTimezone = task.timezone != null;
+  if (hasInterval && (hasSchedule || hasTimezone)) {
+    throw new Error(`CronTask "${task.name}" cannot mix intervalMinutes with schedule/timezone`);
+  }
+  if (!hasInterval && !(hasSchedule && hasTimezone)) {
+    throw new Error(
+      `CronTask "${task.name}" must declare either intervalMinutes or schedule+timezone`
+    );
+  }
+  if (hasInterval && (!Number.isInteger(task.intervalMinutes) || task.intervalMinutes < 1 || task.intervalMinutes > 10080)) {
+    throw new Error(`CronTask "${task.name}" intervalMinutes must be an integer 1..10080`);
+  }
+  if (hasSchedule) {
+    parseCronExpression(task.schedule);
+    if (typeof task.timezone !== "string" || task.timezone.length === 0) {
+      throw new Error(`CronTask "${task.name}" timezone must be a non-empty IANA string`);
+    }
+    try {
+      new Intl.DateTimeFormat("en-US", { timeZone: task.timezone });
+    } catch {
+      throw new Error(
+        `CronTask "${task.name}" timezone "${task.timezone}" is not a valid IANA timezone`
+      );
+    }
+  }
+  return task;
+}
+function parseCronExpression(expression) {
+  const fields = expression.trim().split(/\s+/);
+  if (fields.length !== 5) {
+    throw new Error(
+      `Cron expression must have exactly 5 fields, got ${fields.length}: "${expression}"`
+    );
+  }
+  const [minute, hour, dayOfMonth, month, dayOfWeek] = fields;
+  return {
+    minute: parseField(minute, 0, 59, "minute"),
+    hour: parseField(hour, 0, 23, "hour"),
+    dayOfMonth: parseField(dayOfMonth, 1, 31, "day-of-month"),
+    month: parseField(month, 1, 12, "month"),
+    dayOfWeek: parseField(dayOfWeek, 0, 6, "day-of-week")
+  };
+}
+function parseField(field, min, max, label) {
+  const result = /* @__PURE__ */ new Set();
+  for (const part of field.split(",")) {
+    const value = part.trim();
+    if (value === "*") {
+      for (let i = min; i <= max; i++) result.add(i);
+      continue;
+    }
+    const allStep = value.match(/^\*\/(\d+)$/);
+    if (allStep) {
+      const step = Number.parseInt(allStep[1], 10);
+      if (step <= 0) throw new Error(`Cron ${label} step must be positive: "${value}"`);
+      for (let i = min; i <= max; i += step) result.add(i);
+      continue;
+    }
+    const range = value.match(/^(\d+)-(\d+)(?:\/(\d+))?$/);
+    if (range) {
+      const start = Number.parseInt(range[1], 10);
+      const end = Number.parseInt(range[2], 10);
+      const step = range[3] ? Number.parseInt(range[3], 10) : 1;
+      if (start < min || end > max || start > end || step <= 0) {
+        throw new Error(`Cron ${label} range out of bounds: "${value}" (${min}..${max})`);
+      }
+      for (let i = start; i <= end; i += step) result.add(i);
+      continue;
+    }
+    const literal = Number.parseInt(value, 10);
+    if (Number.isNaN(literal) || literal < min || literal > max || String(literal) !== value) {
+      throw new Error(`Cron ${label} value invalid: "${value}" (${min}..${max})`);
+    }
+    result.add(literal);
+  }
+  if (result.size === 0) {
+    throw new Error(`Cron ${label} field "${field}" produced no valid values`);
+  }
+  return result;
+}
+function nextCronFire(expression, timezone, from) {
+  const parsed = parseCronExpression(expression);
+  const start = Math.floor(from.getTime() / 6e4) * 6e4 + 6e4;
+  const limit = start + 366 * 24 * 60 * 6e4;
+  for (let timestamp = start; timestamp < limit; timestamp += 6e4) {
+    const candidate = new Date(timestamp);
+    if (cronMatches(parsed, timezone, candidate)) return candidate;
+  }
+  return null;
+}
+function cronMatches(parsed, timezone, date) {
+  const formatter = new Intl.DateTimeFormat("en-US", {
+    timeZone: timezone,
+    year: "numeric",
+    month: "numeric",
+    day: "numeric",
+    hour: "numeric",
+    minute: "numeric",
+    weekday: "short",
+    hour12: false
+  });
+  const parts = Object.fromEntries(
+    formatter.formatToParts(date).map((part) => [part.type, part.value])
+  );
+  const minute = Number.parseInt(parts.minute, 10);
+  const hour = Number.parseInt(parts.hour, 10) % 24;
+  const dayOfMonth = Number.parseInt(parts.day, 10);
+  const month = Number.parseInt(parts.month, 10);
+  const weekday = {
+    Sun: 0,
+    Mon: 1,
+    Tue: 2,
+    Wed: 3,
+    Thu: 4,
+    Fri: 5,
+    Sat: 6
+  };
+  const dayOfWeek = weekday[parts.weekday] ?? 0;
+  return parsed.minute.has(minute) && parsed.hour.has(hour) && parsed.dayOfMonth.has(dayOfMonth) && parsed.month.has(month) && parsed.dayOfWeek.has(dayOfWeek);
+}
+
 // src/server/rooms/cron-room.ts
 var CRON_WRITE_TYPES = /* @__PURE__ */ new Set([
   MSG.CRON_TRIGGER,
@@ -4115,10 +4233,7 @@ var CronRoom = class extends BaseRoom {
       )
     `);
     for (const task of this.tasks) {
-      const existing = this.sql.exec(
-        `SELECT name FROM cron_tasks WHERE name = ?`,
-        task.name
-      ).toArray();
+      const existing = this.sql.exec(`SELECT name FROM cron_tasks WHERE name = ?`, task.name).toArray();
       if (existing.length === 0) {
         this.sql.exec(
           `INSERT INTO cron_tasks (name, interval_minutes, schedule, timezone, paused)
@@ -4189,7 +4304,12 @@ var CronRoom = class extends BaseRoom {
           this.sendTo(ws, { type: MSG.ERROR, payload: { error: "Missing taskName" } });
           return;
         }
-        await this.executeTask(taskName);
+        if (!await this.executeTask(taskName)) {
+          this.sendTo(ws, {
+            type: MSG.ERROR,
+            payload: { error: `Unknown cron task: ${taskName}` }
+          });
+        }
         break;
       }
       case MSG.CRON_PAUSE: {
@@ -4221,7 +4341,10 @@ var CronRoom = class extends BaseRoom {
         break;
       }
       default:
-        this.sendTo(ws, { type: MSG.ERROR, payload: { error: `Unknown cron message type: ${type}` } });
+        this.sendTo(ws, {
+          type: MSG.ERROR,
+          payload: { error: `Unknown cron message type: ${type}` }
+        });
     }
   }
   async onAlarm() {
@@ -4241,6 +4364,8 @@ var CronRoom = class extends BaseRoom {
   // Task Execution
   // ==========================================================================
   async executeTask(taskName) {
+    const taskRow = this.sql.exec(`SELECT interval_minutes, schedule, timezone FROM cron_tasks WHERE name = ?`, taskName).toArray()[0];
+    if (!taskRow) return false;
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const start = Date.now();
     let success = true;
@@ -4265,21 +4390,18 @@ var CronRoom = class extends BaseRoom {
       error ?? null,
       completedAt
     );
-    const taskRow = this.sql.exec(
-      `SELECT interval_minutes, schedule, timezone FROM cron_tasks WHERE name = ?`,
+    const nextRunAt = computeNextRunAt(taskRow, new Date(completedAt));
+    this.sql.exec(
+      `UPDATE cron_tasks SET last_run_at = ?, next_run_at = ? WHERE name = ?`,
+      completedAt,
+      nextRunAt,
       taskName
-    ).toArray()[0];
-    if (taskRow) {
-      const nextRunAt = computeNextRunAt(taskRow, new Date(completedAt));
-      this.sql.exec(
-        `UPDATE cron_tasks SET last_run_at = ?, next_run_at = ? WHERE name = ?`,
-        completedAt,
-        nextRunAt,
-        taskName
-      );
-    }
-    this.sql.exec(`DELETE FROM cron_history WHERE id NOT IN (SELECT id FROM cron_history ORDER BY id DESC LIMIT 500)`);
+    );
+    this.sql.exec(
+      `DELETE FROM cron_history WHERE id NOT IN (SELECT id FROM cron_history ORDER BY id DESC LIMIT 500)`
+    );
     this.broadcastStatus();
+    return true;
   }
   // ==========================================================================
   // Scheduling
@@ -4328,10 +4450,7 @@ var CronRoom = class extends BaseRoom {
     });
   }
   getRecentHistory(limit) {
-    return this.sql.exec(
-      `SELECT * FROM cron_history ORDER BY id DESC LIMIT ?`,
-      limit
-    ).toArray().map((row) => {
+    return this.sql.exec(`SELECT * FROM cron_history ORDER BY id DESC LIMIT ?`, limit).toArray().map((row) => {
       const r = row;
       return {
         taskName: r.task_name,
@@ -4353,100 +4472,6 @@ var CronRoom = class extends BaseRoom {
     });
   }
 };
-var TASK_NAME_RE = /^[a-z0-9-]+$/;
-function validateTask(task) {
-  if (!task.name || typeof task.name !== "string") {
-    throw new Error(`CronTask.name is required`);
-  }
-  if (task.name.length > 64 || !TASK_NAME_RE.test(task.name)) {
-    throw new Error(
-      `CronTask.name "${task.name}" must be lowercase alphanumeric with hyphens, 1-64 chars`
-    );
-  }
-  const hasInterval = task.intervalMinutes != null;
-  const hasSchedule = task.schedule != null;
-  const hasTimezone = task.timezone != null;
-  if (hasInterval && (hasSchedule || hasTimezone)) {
-    throw new Error(
-      `CronTask "${task.name}" cannot mix intervalMinutes with schedule/timezone`
-    );
-  }
-  if (!hasInterval && !(hasSchedule && hasTimezone)) {
-    throw new Error(
-      `CronTask "${task.name}" must declare either intervalMinutes or schedule+timezone`
-    );
-  }
-  if (hasInterval) {
-    if (!Number.isInteger(task.intervalMinutes) || task.intervalMinutes < 1 || task.intervalMinutes > 10080) {
-      throw new Error(
-        `CronTask "${task.name}" intervalMinutes must be an integer 1..10080`
-      );
-    }
-  }
-  if (hasSchedule) {
-    parseCronExpression(task.schedule);
-    if (typeof task.timezone !== "string" || task.timezone.length === 0) {
-      throw new Error(`CronTask "${task.name}" timezone must be a non-empty IANA string`);
-    }
-    try {
-      new Intl.DateTimeFormat("en-US", { timeZone: task.timezone });
-    } catch {
-      throw new Error(`CronTask "${task.name}" timezone "${task.timezone}" is not a valid IANA timezone`);
-    }
-  }
-  return task;
-}
-function parseCronExpression(expression) {
-  const fields = expression.trim().split(/\s+/);
-  if (fields.length !== 5) {
-    throw new Error(`Cron expression must have exactly 5 fields, got ${fields.length}: "${expression}"`);
-  }
-  const [cMin, cHour, cDom, cMonth, cDow] = fields;
-  return {
-    minute: parseField(cMin, 0, 59, "minute"),
-    hour: parseField(cHour, 0, 23, "hour"),
-    dayOfMonth: parseField(cDom, 1, 31, "day-of-month"),
-    month: parseField(cMonth, 1, 12, "month"),
-    dayOfWeek: parseField(cDow, 0, 6, "day-of-week")
-  };
-}
-function parseField(field, min, max, label) {
-  const result = /* @__PURE__ */ new Set();
-  for (const part of field.split(",")) {
-    const trimmed = part.trim();
-    if (trimmed === "*") {
-      for (let i = min; i <= max; i++) result.add(i);
-      continue;
-    }
-    const allStep = trimmed.match(/^\*\/(\d+)$/);
-    if (allStep) {
-      const step = parseInt(allStep[1], 10);
-      if (step <= 0) throw new Error(`Cron ${label} step must be positive: "${trimmed}"`);
-      for (let i = min; i <= max; i += step) result.add(i);
-      continue;
-    }
-    const rangeMatch = trimmed.match(/^(\d+)-(\d+)(?:\/(\d+))?$/);
-    if (rangeMatch) {
-      const start = parseInt(rangeMatch[1], 10);
-      const end = parseInt(rangeMatch[2], 10);
-      const step = rangeMatch[3] ? parseInt(rangeMatch[3], 10) : 1;
-      if (start < min || end > max || start > end || step <= 0) {
-        throw new Error(`Cron ${label} range out of bounds: "${trimmed}" (${min}..${max})`);
-      }
-      for (let i = start; i <= end; i += step) result.add(i);
-      continue;
-    }
-    const num = parseInt(trimmed, 10);
-    if (isNaN(num) || num < min || num > max || String(num) !== trimmed) {
-      throw new Error(`Cron ${label} value invalid: "${trimmed}" (${min}..${max})`);
-    }
-    result.add(num);
-  }
-  if (result.size === 0) {
-    throw new Error(`Cron ${label} field "${field}" produced no valid values`);
-  }
-  return result;
-}
 function computeNextRunAt(task, from) {
   if (task.interval_minutes) {
     return new Date(from.getTime() + task.interval_minutes * 60 * 1e3).toISOString();
@@ -4457,40 +4482,6 @@ function computeNextRunAt(task, from) {
   }
   return null;
 }
-function nextCronFire(expression, timezone, from) {
-  const parsed = parseCronExpression(expression);
-  const start = new Date(Math.floor(from.getTime() / 6e4) * 6e4 + 6e4);
-  const limit = new Date(start.getTime() + 366 * 24 * 60 * 6e4);
-  for (let t = start.getTime(); t < limit.getTime(); t += 6e4) {
-    const candidate = new Date(t);
-    if (cronMatches(parsed, timezone, candidate)) {
-      return candidate;
-    }
-  }
-  return null;
-}
-function cronMatches(parsed, timezone, date) {
-  const formatter = new Intl.DateTimeFormat("en-US", {
-    timeZone: timezone,
-    year: "numeric",
-    month: "numeric",
-    day: "numeric",
-    hour: "numeric",
-    minute: "numeric",
-    weekday: "short",
-    hour12: false
-  });
-  const parts = Object.fromEntries(
-    formatter.formatToParts(date).map((p) => [p.type, p.value])
-  );
-  const minute = parseInt(parts.minute, 10);
-  const hour = parseInt(parts.hour, 10) % 24;
-  const dayOfMonth = parseInt(parts.day, 10);
-  const month = parseInt(parts.month, 10);
-  const weekdayMap = { Sun: 0, Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6 };
-  const dayOfWeek = weekdayMap[parts.weekday] ?? 0;
-  return parsed.minute.has(minute) && parsed.hour.has(hour) && parsed.dayOfMonth.has(dayOfMonth) && parsed.month.has(month) && parsed.dayOfWeek.has(dayOfWeek);
-}
 
 // src/server/rooms/job-room.ts
 var RUNNING_STALE_MS = 16 * 60 * 1e3;
@@ -4603,6 +4594,7 @@ var JobRoom = class extends BaseRoom {
   }
   async onAlarm() {
     this.ensureInitialized();
+    this.recoverStuckRunning();
     await this.drainDueJobs();
     this.pruneExpired();
     this.scheduleNextAlarm();
@@ -4905,22 +4897,36 @@ var JobRoom = class extends BaseRoom {
   // Scheduling / recovery / pruning
   // ==========================================================================
   scheduleNextAlarm() {
-    const row = this.sql.exec(
+    const queued = this.sql.exec(
       `SELECT next_run_at FROM jobs
           WHERE status = 'queued'
           ORDER BY (next_run_at IS NULL) ASC, next_run_at ASC
           LIMIT 1`
     ).toArray()[0];
-    if (!row) return;
     const now = Date.now();
-    const target = row.next_run_at ? Math.max(now, new Date(row.next_run_at).getTime()) : now;
-    this.state.storage.setAlarm(Math.max(target, now + 50));
+    const targets = [];
+    if (queued) {
+      const queuedAt = queued.next_run_at ? new Date(queued.next_run_at).getTime() : now;
+      targets.push(Number.isFinite(queuedAt) ? Math.max(now, queuedAt) : now);
+    }
+    const running = this.sql.exec(
+      `SELECT started_at FROM jobs
+          WHERE status = 'running'
+          ORDER BY started_at ASC
+          LIMIT 1`
+    ).toArray()[0];
+    if (running) {
+      const startedAt = running.started_at ? new Date(running.started_at).getTime() : Number.NaN;
+      targets.push(Number.isFinite(startedAt) ? Math.max(now, startedAt + RUNNING_STALE_MS) : now);
+    }
+    if (targets.length === 0) return;
+    this.state.storage.setAlarm(Math.max(Math.min(...targets), now + 50));
   }
   recoverStuckRunning() {
     const cutoff = new Date(Date.now() - RUNNING_STALE_MS).toISOString();
     const stuck = this.sql.exec(
       `SELECT id, attempts, max_attempts FROM jobs
-          WHERE status = 'running' AND started_at < ?`,
+          WHERE status = 'running' AND (started_at IS NULL OR started_at <= ?)`,
       cutoff
     ).toArray();
     for (const r of stuck) {
@@ -5940,11 +5946,83 @@ var RESERVED_COLLECTION_NAMES = new Set(
   GLOBAL_DO_TYPES.flatMap((t) => t.schemas.map((s) => s.name))
 );
 
+// src/server/utils/cors.ts
+function matchOrigin(origin, patterns) {
+  if (!origin) return null;
+  const matches = patterns.some((pattern) => {
+    const rx = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, "[^./]+");
+    return new RegExp(`^${rx}$`).test(origin);
+  });
+  return matches ? origin : null;
+}
+function platformCorsPatterns(env) {
+  const app = env.APP_DOMAIN;
+  const platform = env.PLATFORM_DOMAIN;
+  return [
+    .../* @__PURE__ */ new Set([`https://${platform}`, `https://*.${platform}`, `https://*.${app}`]),
+    "http://localhost:*"
+  ];
+}
+
+// src/server/utils/plan-quotas.ts
+var DEPLOYED_APPS_DEFAULTS = {
+  free: 1,
+  starter: 4,
+  premium: 10,
+  admin: 100
+};
+function parseQuotaLimit(raw, fallback) {
+  if (!raw) return fallback;
+  const n = Number(raw);
+  return Number.isInteger(n) && n >= 0 ? n : fallback;
+}
+
+// src/server/utils/registry-client.ts
+var REGISTRY_INSTANCE = "v1:global";
+var APP_ID_RE = /^(app_[0-9A-HJKMNP-TV-Z]{26}|[a-z0-9][a-z0-9_-]{0,63})$/;
+var STRICT_APP_ID_RE = /^app_[0-9A-HJKMNP-TV-Z]{26}$/;
+var RegistryClientError = class extends Error {
+  constructor(message, code, status) {
+    super(message);
+    this.code = code;
+    this.status = status;
+    this.name = "RegistryClientError";
+  }
+};
+function registryStub(ns) {
+  return ns.get(ns.idFromName(REGISTRY_INSTANCE));
+}
+async function callRegistry(stub, body) {
+  const res = await stub.fetch("https://registry/", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new RegistryClientError(
+      json.error ?? `Registry error (${res.status})`,
+      json.code ?? "error",
+      res.status
+    );
+  }
+  return json;
+}
+function registryErrorJson(c, err) {
+  if (err instanceof RegistryClientError) {
+    return c.json({ error: err.message, code: err.code }, err.status);
+  }
+  throw err;
+}
+
 // src/server/utils/scoped-r2-files.ts
 var CORS_HEADERS3 = { "Access-Control-Allow-Origin": "*" };
 function contentDisposition(originalName) {
-  const safe = originalName.replace(/[\x00-\x1f\x7f"\\]/g, "_") || "download";
-  const encoded = encodeURIComponent(originalName);
+  const safe = originalName.replace(/[^\x20-\x7e]|["\\]/g, "_") || "download";
+  const encoded = encodeURIComponent(originalName).replace(
+    /[!'()*]/g,
+    (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`
+  );
   return `inline; filename="${safe}"; filename*=UTF-8''${encoded}`;
 }
 function sanitizeSubpath(raw) {
@@ -5953,6 +6031,9 @@ function sanitizeSubpath(raw) {
   if (segments.some((s) => s === ".." || s === ".")) return null;
   return raw;
 }
+function encodeKeyPath(key) {
+  return key.split("/").map(encodeURIComponent).join("/");
+}
 function isKeyWithinPrefix(key, prefix) {
   return key.startsWith(prefix);
 }
@@ -5973,9 +6054,15 @@ function normalizeMimeType(raw) {
 function createScopedR2Handler(config) {
   const requireAuthForMutations = config.requireAuthForMutations ?? true;
   return async (request, url, bucket, auth) => {
-    const subpathRaw = decodeURIComponent(
-      url.pathname.replace("/api/files", "").replace(/^\//, "")
-    );
+    let subpathRaw;
+    try {
+      subpathRaw = decodeURIComponent(url.pathname.replace("/api/files", "").replace(/^\//, ""));
+    } catch {
+      return Response.json(
+        { error: "Invalid path encoding" },
+        { status: 400, headers: CORS_HEADERS3 }
+      );
+    }
     const subpath = sanitizeSubpath(subpathRaw);
     if (subpath === null) {
       return Response.json(
@@ -5983,9 +6070,10 @@ function createScopedR2Handler(config) {
         { status: 400, headers: CORS_HEADERS3 }
       );
     }
-    const isKeyedGet = subpath !== "" && request.method === "GET";
-    const defaultScope = isKeyedGet ? "app" : "self";
-    const scope = url.searchParams.get("scope") || defaultScope;
+    const scope = url.searchParams.get("scope") || "self";
+    if (scope !== "self" && scope !== "app") {
+      return Response.json({ error: "Invalid scope" }, { status: 400, headers: CORS_HEADERS3 });
+    }
     const result = config.resolvePrefix(scope, { userId: auth.userId, url });
     if (!result.prefix) {
       const errorMsg = result.error ?? "Invalid scope";
@@ -6000,10 +6088,10 @@ function createScopedR2Handler(config) {
           { status: 401, headers: CORS_HEADERS3 }
         );
       }
-      return handleUpload(request, url, bucket, prefix, auth.userId);
+      return handleUpload(request, url, bucket, prefix, auth.userId, scope);
     }
     if (!subpath && request.method === "GET") {
-      return handleList(bucket, prefix, url);
+      return handleList(bucket, prefix, url, scope);
     }
     if (subpath && request.method === "GET") {
       if (!isKeyWithinPrefix(subpath, prefix)) {
@@ -6012,7 +6100,7 @@ function createScopedR2Handler(config) {
           { status: 403, headers: CORS_HEADERS3 }
         );
       }
-      return handleDownload(bucket, subpath);
+      return handleDownload(bucket, subpath, scope);
     }
     if (subpath && request.method === "DELETE") {
       if (requireAuthForMutations && !auth.userId) {
@@ -6033,7 +6121,7 @@ function createScopedR2Handler(config) {
     return Response.json({ error: "Method not allowed" }, { status: 405, headers: CORS_HEADERS3 });
   };
 }
-async function handleUpload(request, url, bucket, prefix, userId) {
+async function handleUpload(request, url, bucket, prefix, userId, scope) {
   try {
     const contentType = request.headers.get("content-type") || "";
     let fileData;
@@ -6097,35 +6185,37 @@ async function handleUpload(request, url, bucket, prefix, userId) {
         uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
       }
     });
-    const fileUrl = `${url.origin}/api/files/${key}`;
+    const fileUrl = new URL(`/api/files/${encodeKeyPath(key)}`, url.origin);
+    fileUrl.searchParams.set("scope", scope);
     return Response.json(
-      { success: true, key, url: fileUrl, name: fileName },
+      { success: true, key, url: fileUrl.toString(), name: fileName },
       { headers: CORS_HEADERS3 }
     );
   } catch (err) {
     const msg = err instanceof Error ? err.message : "Upload failed";
     console.error("[handleUpload] Error:", msg, err instanceof Error ? err.stack : "");
-    return Response.json(
-      { error: msg },
-      { status: 500, headers: CORS_HEADERS3 }
-    );
+    return Response.json({ error: msg }, { status: 500, headers: CORS_HEADERS3 });
   }
 }
-async function handleList(bucket, prefix, url) {
+async function handleList(bucket, prefix, url, scope) {
   const userPrefix = url.searchParams.get("prefix") || "";
   const listPrefix = `${prefix}${userPrefix}`;
   const limit = parseInt(url.searchParams.get("limit") || "100", 10);
   const listed = await bucket.list({ prefix: listPrefix, limit });
-  const files = listed.objects.map((obj) => ({
-    key: obj.key,
-    size: obj.size,
-    uploaded: obj.uploaded.toISOString(),
-    url: `${url.origin}/api/files/${obj.key}`,
-    ...obj.customMetadata
-  }));
+  const files = listed.objects.map((obj) => {
+    const fileUrl = new URL(`/api/files/${encodeKeyPath(obj.key)}`, url.origin);
+    fileUrl.searchParams.set("scope", scope);
+    return {
+      key: obj.key,
+      size: obj.size,
+      uploaded: obj.uploaded.toISOString(),
+      url: fileUrl.toString(),
+      ...obj.customMetadata
+    };
+  });
   return Response.json({ files, truncated: listed.truncated }, { headers: CORS_HEADERS3 });
 }
-async function handleDownload(bucket, key) {
+async function handleDownload(bucket, key, scope) {
   const object = await bucket.get(key);
   if (!object) {
     return Response.json({ error: "File not found" }, { status: 404, headers: CORS_HEADERS3 });
@@ -6133,7 +6223,10 @@ async function handleDownload(bucket, key) {
   const headers = new Headers();
   headers.set("Content-Type", object.httpMetadata?.contentType || "application/octet-stream");
   headers.set("X-Content-Type-Options", "nosniff");
-  headers.set("Cache-Control", "public, max-age=31536000, immutable");
+  headers.set(
+    "Cache-Control",
+    scope === "app" ? "public, max-age=31536000, immutable" : "private, no-store"
+  );
   headers.set("Access-Control-Allow-Origin", "*");
   if (object.customMetadata?.originalName) {
     headers.set("Content-Disposition", contentDisposition(object.customMetadata.originalName));
@@ -6148,7 +6241,7 @@ function resolveApiTransport(env) {
     return { kind: "url", baseUrl: env.API_WORKER_URL.replace(/\/$/, "") };
   }
   throw new Error(
-    "apiWorkerFetch: neither env.API_WORKER nor env.API_WORKER_URL is set. Add a [[services]] binding in wrangler.toml for production, or let `deepspace dev` write API_WORKER_URL into .dev.vars for local development."
+    "apiWorkerFetch: neither env.API_WORKER nor env.API_WORKER_URL is set. Add a [[services]] binding in wrangler.toml for production, or let `deepspace dev start` write API_WORKER_URL into .dev.vars for local development."
   );
 }
 function resolvePlatformTransport(env) {
@@ -6157,7 +6250,7 @@ function resolvePlatformTransport(env) {
     return { kind: "url", baseUrl: env.PLATFORM_WORKER_URL.replace(/\/$/, "") };
   }
   throw new Error(
-    "platformWorkerFetch: neither env.PLATFORM_WORKER nor env.PLATFORM_WORKER_URL is set. Add a [[services]] binding in wrangler.toml for production, or let `deepspace dev` write PLATFORM_WORKER_URL into .dev.vars for local development."
+    "platformWorkerFetch: neither env.PLATFORM_WORKER nor env.PLATFORM_WORKER_URL is set. Add a [[services]] binding in wrangler.toml for production, or let `deepspace dev start` write PLATFORM_WORKER_URL into .dev.vars for local development."
   );
 }
 function buildTargetUrl(transport, path, internalHost) {
@@ -6203,7 +6296,7 @@ function platformWorkerFetch(env, pathOrRequest, init) {
 function authWorkerFetch(env, path, init) {
   if (!env.AUTH_WORKER_URL) {
     throw new Error(
-      "authWorkerFetch: env.AUTH_WORKER_URL is not set. `deepspace dev` should write this into .dev.vars; for production, set it as a wrangler var or secret."
+      "authWorkerFetch: env.AUTH_WORKER_URL is not set. `deepspace dev start` should write this into .dev.vars; for production, set it as a wrangler var or secret."
     );
   }
   const baseUrl = env.AUTH_WORKER_URL.replace(/\/$/, "");
@@ -6224,15 +6317,17 @@ function buildCronContext(env, ownerUserId, roomId = "default") {
   const roomIdObj = env.RECORD_ROOMS.idFromName(roomId);
   const room = env.RECORD_ROOMS.get(roomIdObj);
   async function executeTool3(tool2, params) {
-    const response = await room.fetch(new Request("https://internal/api/tools/execute", {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "X-User-Id": ownerUserId,
-        "X-App-Action": "true"
-      },
-      body: JSON.stringify({ tool: tool2, params })
-    }));
+    const response = await room.fetch(
+      new Request("https://internal/api/tools/execute", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-User-Id": ownerUserId,
+          "X-App-Action": "true"
+        },
+        body: JSON.stringify({ tool: tool2, params })
+      })
+    );
     const result = await response.json();
     if (!result.success) {
       throw new Error(`RecordRoom tool ${tool2} failed: ${result.error || "Unknown error"}`);
@@ -6262,7 +6357,7 @@ function buildCronContext(env, ownerUserId, roomId = "default") {
     async call(endpoint, params = {}) {
       if (!env.APP_OWNER_JWT) {
         throw new Error(
-          "integrations.call requires env.APP_OWNER_JWT. Deployed apps receive this automatically; in dev, `deepspace dev` writes it into .dev.vars."
+          "integrations.call requires env.APP_OWNER_JWT. Deployed apps receive this automatically; in dev, `deepspace dev start` writes it into .dev.vars."
         );
       }
       const response = await apiWorkerFetch(env, `/api/integrations/${endpoint}`, {
@@ -6313,7 +6408,7 @@ function createDeepSpaceAI(env, provider, options = {}) {
   const authToken = options.authToken ?? env.APP_OWNER_JWT;
   if (!authToken) {
     throw new Error(
-      "createDeepSpaceAI: no auth token available. Either pass `options.authToken` explicitly (for user-initiated calls), or ensure `env.APP_OWNER_JWT` is set (injected at deploy time or by `deepspace dev`)."
+      "createDeepSpaceAI: no auth token available. Either pass `options.authToken` explicitly (for user-initiated calls), or ensure `env.APP_OWNER_JWT` is set (injected at deploy time or by `deepspace dev start`)."
     );
   }
   const proxyFetch = (input, init) => {
@@ -6449,7 +6544,7 @@ function appendAppIdentity(headers, env) {
 }
 
 // src/server/utils/screenshot.ts
-async function captureScreenshot(env, opts) {
+async function captureScreenshot(env, url) {
   const headers = new Headers({ "content-type": "application/json" });
   appendAppIdentity(headers, env);
   const res = await platformWorkerFetch(
@@ -6457,16 +6552,11 @@ async function captureScreenshot(env, opts) {
     new Request("https://platform-internal/internal/screenshot", {
       method: "POST",
       headers,
-      body: JSON.stringify(opts)
+      body: JSON.stringify({ url })
     })
   );
   if (!res.ok) {
-    let detail = "";
-    try {
-      detail = (await res.text()).slice(0, 300);
-    } catch {
-    }
-    console.warn(`[captureScreenshot] platform returned ${res.status}:`, detail);
+    console.warn(`[captureScreenshot] platform returned ${res.status}`);
     return null;
   }
   return {
@@ -6832,8 +6922,6 @@ async function executeTool2(stub, userId, tool2, params) {
 function toChatRow(env) {
   return {
     recordId: env.recordId,
-    // Deprecated alias — populated for back-compat with callers reading `id`.
-    id: env.recordId,
     userId: env.data.userId,
     title: env.data.title ?? "",
     model: env.data.model,
@@ -6846,8 +6934,6 @@ function toChatRow(env) {
 function toMessageRow(env) {
   return {
     recordId: env.recordId,
-    // Deprecated alias — populated for back-compat with callers reading `id`.
-    id: env.recordId,
     chatId: env.data.chatId,
     userId: env.data.userId,
     role: env.data.role,
@@ -7273,6 +7359,16 @@ function createDeepSpaceAuth(config) {
     database: config.database,
     baseURL: config.baseURL,
     secret: config.secret,
+    // Login is a one-time human act; everything after it is agents minting
+    // short-lived JWTs from this session. 30 days idle (vs the 7-day
+    // default) with daily sliding renewal means any agent active within a
+    // month keeps the session alive indefinitely — the human re-logs-in
+    // only after a full month of zero activity. Short-lived access stays
+    // short: CLI JWTs expire in minutes (auth-worker /api/auth/token).
+    session: {
+      expiresIn: 60 * 60 * 24 * 30,
+      updateAge: 60 * 60 * 24
+    },
     emailAndPassword: {
       enabled: config.emailAndPassword ?? true
     },
@@ -7301,9 +7397,41 @@ function createDeepSpaceAuth(config) {
         }
       }
     } : {},
+    // Observer hook for new-user creation (see DeepSpaceAuthConfig.onUserCreated).
+    // Two-layer wiring guard — be honest about what each layer catches:
+    //  1. buildDatabaseHooks's return type is pinned to
+    //     BetterAuthOptions['databaseHooks'], so a better-auth upgrade that
+    //     renames/reshapes the option fails tsc.
+    //  2. A LOCAL typo of this key would still compile (betterAuth's generic
+    //     options parameter defeats excess-property checking even for plain
+    //     keys) — that case is caught by the runtime assertions in
+    //     __tests__/betterAuth-hooks.test.ts, which read the wired hook back
+    //     off auth.options. Don't rename the key without running them.
+    databaseHooks: buildDatabaseHooks(config.onUserCreated),
     plugins: [organization(), twoFactor()]
   });
 }
+function buildDatabaseHooks(onUserCreated) {
+  if (!onUserCreated) return void 0;
+  return {
+    user: {
+      create: {
+        after: async (user, ctx) => {
+          try {
+            await onUserCreated(
+              { id: user.id, email: user.email, name: user.name },
+              // Forward BOTH request and standalone headers — some better-auth
+              // entry points populate ctx.headers without a request.
+              ctx ? { request: ctx.request, headers: ctx.headers ?? void 0 } : null
+            );
+          } catch (err) {
+            console.error("[deepspace] onUserCreated hook failed (signup unaffected)", err);
+          }
+        }
+      }
+    }
+  };
+}
 var cachedAppleSecret = null;
 async function generateAppleClientSecret(apple) {
   const now = Math.floor(Date.now() / 1e3);
@@ -7317,10 +7445,112 @@ async function generateAppleClientSecret(apple) {
   cachedAppleSecret = { keyId: apple.keyId, token, expiresAt };
   return token;
 }
+
+// src/shared/client-errors.ts
+var CLIENT_LOG_MARKER = "[deepspace:client-error]";
+var CLIENT_ERROR_PATH = "/_deepspace/client-errors";
+var CLIENT_ERROR_CAPS = {
+  message: 1024,
+  stack: 4096,
+  name: 256,
+  url: 512
+};
+function capText(value, max) {
+  if (typeof value !== "string") return void 0;
+  return value.length > max ? value.slice(0, max) : value;
+}
+function finiteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function normalizeClientErrorReport(raw) {
+  if (typeof raw !== "object" || raw === null) return null;
+  const o = raw;
+  const kind = o.kind === "unhandledrejection" || o.kind === "react" ? o.kind : "error";
+  const message = capText(o.message, CLIENT_ERROR_CAPS.message) ?? "";
+  const name = capText(o.name, CLIENT_ERROR_CAPS.name);
+  const stack = capText(o.stack, CLIENT_ERROR_CAPS.stack);
+  const url = capText(o.url, CLIENT_ERROR_CAPS.url);
+  const line = finiteNumber(o.line);
+  const col = finiteNumber(o.col);
+  if (!message && !stack) return null;
+  const report = { kind, message: message || (name ?? "Error") };
+  if (name) report.name = name;
+  if (stack) report.stack = stack;
+  if (url) report.url = url;
+  if (line !== void 0) report.line = line;
+  if (col !== void 0) report.col = col;
+  return report;
+}
+function clientErrorToLogLine(report) {
+  return `${CLIENT_LOG_MARKER} ${JSON.stringify(report)}`;
+}
+
+// src/server/client-errors.ts
+var THROTTLE_WINDOW_MS = 1e3;
+var THROTTLE_MAX = 20;
+var windowStart = 0;
+var windowCount = 0;
+var MAX_BODY_BYTES = 64 * 1024;
+function shouldThrottleClientError(now = Date.now()) {
+  if (now - windowStart >= THROTTLE_WINDOW_MS) {
+    windowStart = now;
+    windowCount = 0;
+  }
+  windowCount += 1;
+  return windowCount > THROTTLE_MAX;
+}
+function jsonResponse(body, status) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+async function handleClientErrorReport(request) {
+  const site = request.headers.get("sec-fetch-site");
+  if (site && site !== "same-origin" && site !== "none") {
+    return new Response(null, { status: 403 });
+  }
+  if (shouldThrottleClientError()) {
+    return new Response(null, { status: 429, headers: { "Retry-After": "1" } });
+  }
+  const declared = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+    return jsonResponse({ error: "payload_too_large" }, 413);
+  }
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return jsonResponse({ error: "invalid_json" }, 400);
+  }
+  const report = normalizeClientErrorReport(body);
+  if (!report) return jsonResponse({ error: "invalid_report" }, 400);
+  console.error(clientErrorToLogLine(report));
+  return new Response(null, { status: 204 });
+}
+function registerClientErrorRoute(app) {
+  app.post(CLIENT_ERROR_PATH, (c) => handleClientErrorReport(c.req.raw));
+}
+
+// src/shared/log-events.ts
+var LOG_LEVELS = ["debug", "log", "info", "warn", "error"];
+var APP_LOG_EVENT_KEYS = [
+  "id",
+  "timestamp",
+  "level",
+  "eventType",
+  "message",
+  "source",
+  "outcome",
+  "request",
+  "exception"
+];
 export {
   AI_CHATS_SCHEMA,
   AI_MESSAGES_SCHEMA,
   ALLOWED_BINDING_TYPES,
+  APP_ID_RE,
+  APP_LOG_EVENT_KEYS,
   APP_NAME_RULES,
   AUTO_PROVISIONABLE_TYPES,
   AUTO_PROVISION_SENTINEL,
@@ -7331,6 +7561,7 @@ export {
   CHANNELS_SCHEMA,
   CHANNEL_INVITATIONS_SCHEMA,
   CHANNEL_MEMBERS_SCHEMA,
+  CLIENT_LOG_MARKER,
   CONVERSATION_SCHEMAS,
   COST_RATES,
   CanvasRoom,
@@ -7338,11 +7569,13 @@ export {
   DEFAULT_CONTEXT_CONFIG,
   DEFAULT_DO_MANIFEST,
   DEFAULT_QUERY_LIMIT,
+  DEPLOYED_APPS_DEFAULTS,
   DIRECTORY_SCHEMAS,
   GLOBAL_DO_TYPES,
   GLOBAL_DO_TYPE_NAMES,
   GameRoom,
   JobRoom,
+  LOG_LEVELS,
   MESSAGES_SCHEMA,
   MSG,
   MSG_AWARENESS,
@@ -7355,12 +7588,15 @@ export {
   PresenceRoom,
   REACTIONS_SCHEMA,
   READ_RECEIPTS_SCHEMA,
+  REGISTRY_INSTANCE,
   RESERVED_BINDING_NAMES,
   RESERVED_COLLECTION_NAMES,
   ROLE_ADMIN,
   ROLE_ANONYMOUS,
   ROLE_DEFAULT,
   RecordRoom,
+  RegistryClientError,
+  STRICT_APP_ID_RE,
   SYSTEM_COLLECTIONS,
   SYSTEM_MANAGED_COLUMNS,
   SchemaRegistry,
@@ -7379,6 +7615,7 @@ export {
   buildCronContext,
   buildTableSelect,
   buildUiParts,
+  callRegistry,
   canCreate,
   canDelete,
   canRead,
@@ -7415,6 +7652,7 @@ export {
   getMessageType,
   getRolePermissions,
   handleAwarenessMessage,
+  handleClientErrorReport,
   handleSyncMessage,
   hasContent,
   isAutoProvision,
@@ -7425,15 +7663,21 @@ export {
   lintSchema,
   loadMessages,
   makeDefaultSummarizer,
+  matchOrigin,
   meterAi,
   meterUsage,
   meterVectorize,
   noopPermissionContext,
+  parseQuotaLimit,
+  platformCorsPatterns,
   platformWorkerFetch,
   prepareMessagesWithCompaction,
   priceBindingUsageEvent,
   readVarUint,
   readVarUint8Array,
+  registerClientErrorRoute,
+  registryErrorJson,
+  registryStub,
   resolveAppName,
   resolveColumn,
   rowToData,