deepspace 0.7.0 → 0.8.1

package/dist/server.d.ts

@@ -2,16 +2,104 @@ import { LanguageModel, ToolSet, ModelMessage } from 'ai';
 import * as Y from 'yjs';
 import * as zod_v4_core from 'zod/v4/core';
 import * as zod from 'zod';
+import * as better_auth_plugins from 'better-auth/plugins';
 import * as better_auth from 'better-auth';
 import { betterAuth } from 'better-auth';
-import * as better_auth_plugins from 'better-auth/plugins';
 import { Context } from 'hono';
 
+/**
+ * Wildcard-aware CORS origin matching for the platform workers.
+ *
+ * Hono's array form of `cors({ origin: [...] })` is an exact `includes()` — it
+ * never expands `*`. Every worker that listed `https://*.app.space` or
+ * `http://localhost:*` in an array had a dead entry: the wildcard rows matched
+ * nothing, silently narrowing the effective CORS surface to the literal
+ * entries. This helper is the single implementation both the api and deploy
+ * workers pass to Hono's function-form `origin`, so the pattern semantics
+ * can't drift between them.
+ *
+ * `*` stands for exactly one host label or a port: it never crosses a dot or
+ * a slash, so `https://*.app.space` matches `https://x.app.space` but neither
+ * `https://a.b.app.space` nor `https://x.app.space.evil.com`.
+ */
+declare function matchOrigin(origin: string, patterns: string[]): string | null;
+/**
+ * The platform's standard browser-origin allow-list, derived from the
+ * environment's apexes so a second constellation (staging) trusts its own
+ * hosts and only its own. Both values are explicit deployment-plane config.
+ * Dedupes for environments that serve both roles from one apex.
+ */
+declare function platformCorsPatterns(env: {
+    APP_DOMAIN: string;
+    PLATFORM_DOMAIN: string;
+}): string[];
+
+/**
+ * Deployed-app quota defaults — the ONE copy.
+ *
+ * Two workers use these numbers for different jobs: the deploy worker
+ * ENFORCES them at registration time, the api worker DISPLAYS them via
+ * GET /api/plan-limits. They used to be independent literal sets (plus the
+ * same numbers again in six wrangler [vars] blocks as overrides) and had
+ * already diverged once — the display copy was missing the admin tier
+ * entirely. The env vars remain the per-plane override mechanism; only the
+ * fallbacks live here.
+ */
+declare const DEPLOYED_APPS_DEFAULTS: {
+    readonly free: 1;
+    readonly starter: 4;
+    readonly premium: 10;
+    readonly admin: 100;
+};
+/** Parse a quota env override; anything non-integer/negative = fallback. */
+declare function parseQuotaLimit(raw: string | undefined, fallback: number): number;
+
+/**
+ * The ONE registry client. Every platform worker reaches the app-registry
+ * Durable Object (hosted by the deploy worker, singleton `v1:global`) through
+ * a cross-script REGISTRY binding — and before this module, each of the five
+ * workers hand-rolled its own copy of the same mechanics: the instance name
+ * appeared in 6 places, the `https://registry/` URL in 6, `APP_ID_RE` in 5,
+ * and `RegistryClientError` + `registryErrorJson` existed byte-identical in
+ * two workers. Copies that must agree and nothing enforcing it.
+ *
+ * This module owns the MECHANICS: instance name, stub lookup, the wire call,
+ * the error type, and the standard route mapping. Each worker still declares
+ * its own typed convenience wrapper listing only the actions it uses — that
+ * subset is genuinely per-worker; the plumbing is not.
+ */
+/** The singleton registry instance — one DO holds every app/route/collaborator. */
+declare const REGISTRY_INSTANCE = "v1:global";
+/** App id shape: a ULID-minted `app_…` id, or a legacy name-as-id. */
+declare const APP_ID_RE: RegExp;
+/** ONLY a ULID-minted id — surfaces that must not accept a legacy name. */
+declare const STRICT_APP_ID_RE: RegExp;
+declare class RegistryClientError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(message: string, code: string, status: number);
+}
+declare function registryStub(ns: DurableObjectNamespace): DurableObjectStub;
+/**
+ * One registry action over the wire. Non-2xx answers throw
+ * {@link RegistryClientError} carrying the DO's structured `code` (or
+ * `'error'` for a transport-shaped body) — callers distinguish a registry-
+ * REPORTED miss (`code === 'not_found'`) from an outage by that code, never
+ * by treating every throw as "not found".
+ */
+declare function callRegistry<T>(stub: DurableObjectStub, body: {
+    action: string;
+} & Record<string, unknown>): Promise<T>;
+/** Standard mapping of a registry failure onto a route response. */
+declare function registryErrorJson(c: {
+    json: (body: unknown, status?: number) => Response;
+}, err: unknown): Response;
+
 /**
  * Tools API Types and Definitions
  *
  * MCP-like interface for agent tool calls.
- * Built-in tools for storage and backup operations.
+ * Built-in tools for records, schemas, users, and Yjs documents.
  */
 interface ToolSchema {
     name: string;
@@ -59,7 +147,7 @@ declare const DEFAULT_QUERY_LIMIT = 50;
  */
 declare function applyAiToolDefaults(toolName: string, params: Record<string, unknown>): Record<string, unknown>;
 /**
- * Built-in tool definitions for storage, record, schema, user, and backup operations
+ * Built-in tool definitions for record, schema, user, and Yjs operations.
  */
 declare const BUILT_IN_TOOLS: ToolSchema[];
 
@@ -119,6 +207,95 @@ type ScopedR2Handler = (request: Request, url: URL, bucket: R2Bucket, auth: Scop
  */
 declare function createScopedR2Handler(config: ScopedR2Config): ScopedR2Handler;
 
+/**
+ * Shared type definitions for the DeepSpace SDK
+ *
+ * Types used by both client-side SDK and server-side workers.
+ */
+type ColumnInterpretation = {
+    kind: 'plain';
+} | {
+    kind: 'currency';
+    symbol: string;
+    decimals: number;
+} | {
+    kind: 'date';
+    format?: string;
+} | {
+    kind: 'datetime';
+    format?: string;
+} | {
+    kind: 'boolean';
+    trueLabel?: string;
+    falseLabel?: string;
+} | {
+    kind: 'percent';
+    decimals?: number;
+} | {
+    kind: 'select';
+    options: string[];
+} | {
+    kind: 'multiselect';
+    options: string[];
+} | {
+    kind: 'url';
+} | {
+    kind: 'email';
+} | {
+    kind: 'json';
+} | {
+    kind: 'reference';
+    targetTable: string;
+    displayColumn: string;
+};
+interface ColumnDefinition {
+    /** Stable ID override (survives renames). Falls back to `col_{name}`. */
+    id?: string;
+    name: string;
+    storage: 'number' | 'text';
+    interpretation: ColumnInterpretation | string;
+    expression?: string;
+    userBound?: boolean;
+    immutable?: boolean;
+    required?: boolean;
+    default?: unknown;
+    timestampTrigger?: {
+        field: string;
+        value?: unknown;
+    };
+}
+type PermissionLevel = boolean | 'own' | 'unclaimed-or-own' | 'collaborator' | 'team' | 'access' | 'published' | 'shared';
+interface RolePermissions {
+    read: PermissionLevel;
+    /** Create has no existing record to evaluate, so it is an explicit grant. */
+    create: boolean;
+    update: PermissionLevel;
+    delete: PermissionLevel;
+    /** If set, only these columns can be updated by this role. */
+    writableFields?: string[];
+}
+interface CollectionSchema {
+    name: string;
+    /** Every collection is stored in typed SQL columns. */
+    columns: ColumnDefinition[];
+    /** Composite uniqueness constraint (for example `['userId', 'taskId']`). */
+    uniqueOn?: string[];
+    /** Ownership column; defaults to the row creator. */
+    ownerField?: string;
+    /** Column containing a JSON array of collaborator user ids. */
+    collaboratorsField?: string;
+    /** Column containing the team id used by team permission rules. */
+    teamField?: string;
+    /** A string is public when equal to `public`; an object supplies an exact value. */
+    visibilityField?: string | {
+        field: string;
+        value: unknown;
+    };
+    /** Permissions per role; `*` is the catch-all role. */
+    permissions: Record<string, RolePermissions>;
+    /** Default role assigned on the `users` collection. */
+    defaultRole?: string;
+}
 interface Query {
     collection: string;
     where?: Record<string, unknown>;
@@ -397,7 +574,7 @@ type ActionHandler<TEnv = Record<string, unknown>> = (ctx: ActionContext<TEnv>)
  *      in deployed apps.
  *
  *   2. **HTTPS URL** (`env.API_WORKER_URL` / `env.PLATFORM_WORKER_URL`) — the
- *      fallback used in local development. `deepspace dev` writes these
+ *      fallback used in local development. `deepspace dev start` writes these
  *      into `.dev.vars`, which `wrangler dev` exposes as env vars. Service
  *      bindings don't work cross-process under `wrangler dev` for SDK apps,
  *      so the URL is the only working path in dev.
@@ -415,7 +592,7 @@ type ActionHandler<TEnv = Record<string, unknown>> = (ctx: ActionContext<TEnv>)
  * History: a previous in-tree helper folded the binding/URL fallback into
  * the AI module's `resolveTransport`. Inline call sites in the starter
  * template (integrations, files, debug) used `c.env.X.fetch(...)` directly,
- * which broke `npx deepspace dev` for any app calling those routes — the
+ * which broke `npx deepspace dev start` for any app calling those routes — the
  * binding is undefined locally, so the fetch threw. These helpers
  * standardize on the same shape `resolveTransport` had, so every upstream
  * call works in both dev and prod.
@@ -536,13 +713,13 @@ declare function buildCronContext(env: CronEnv, ownerUserId: string, roomId?: st
  *   - Service binding `env.API_WORKER` (Cloudflare Fetcher) — preferred in
  *     production if the app has declared the binding in wrangler.toml.
  *   - HTTPS URL `env.API_WORKER_URL` — used in local dev and in production
- *     for apps that don't declare the binding. `deepspace dev` writes this
+ *     for apps that don't declare the binding. `deepspace dev start` writes this
  *     into `.dev.vars` automatically.
  *
  * Auth is automatic by default:
  *   - For server-side autonomous calls (cron, DO alarms, background agents),
  *     the helper reads the long-lived `env.APP_OWNER_JWT` minted at deploy
- *     time (or by `deepspace dev` in local development) and uses it for the
+ *     time (or by `deepspace dev start` in local development) and uses it for the
  *     proxy auth header. The owner is billed automatically via the JWT sub.
  *   - For user-initiated calls (e.g. an `/api/ai/chat` route handling a
  *     browser request), pass `options.authToken` explicitly with the user's
@@ -569,7 +746,7 @@ type DeepSpaceModelFactory = (modelId: string) => LanguageModel;
 type Provider = 'anthropic' | 'openai' | 'cerebras';
 interface DeepSpaceAIEnv extends ApiWorkerEnv {
     /**
-     * Long-lived owner-scoped JWT minted at deploy time (or by `deepspace dev`).
+     * Long-lived owner-scoped JWT minted at deploy time (or by `deepspace dev start`).
      * Used as the default proxy auth token when `options.authToken` is absent.
      * Bills the app owner.
      */
@@ -646,10 +823,9 @@ declare function composioTools(env: ApiWorkerEnv, options: ComposioToolsOptions)
  * own bundle. The platform holds the binding; consumers call this
  * helper to get PNG bytes for a URL.
  *
- * The platform enforces: a host allowlist (*.app.space / *.deep.space),
- * a per-app sliding rate limit, and viewport/timeout clamping. Returns
- * `null` on any non-2xx — callers should treat as "no preview available"
- * and surface their own fallback UX.
+ * The platform enforces HTTPS, a DeepSpace host allowlist, a per-app rate
+ * limit, and one fixed viewport-only capture profile. Returns `null` on any
+ * non-2xx — callers should treat that as "no preview available".
  *
  * Auth is the same HMAC-of-appId pattern `/internal/files` uses:
  *   x-app-identity-token = hmac(PLATFORM_IDENTITY_SECRET, DEEPSPACE_APP_ID)
@@ -659,16 +835,6 @@ declare function composioTools(env: ApiWorkerEnv, options: ComposioToolsOptions)
  * so this helper is a thin wrapper — no extra secrets to manage.
  */
 
-interface ScreenshotOptions {
-    url: string;
-    viewport?: {
-        width: number;
-        height: number;
-    };
-    waitUntil?: 'load' | 'domcontentloaded' | 'networkidle0' | 'networkidle2';
-    timeoutMs?: number;
-    fullPage?: boolean;
-}
 interface ScreenshotEnv extends PlatformWorkerEnv {
     /** Immutable app id — the identity the platform verifies (HMAC input). */
     DEEPSPACE_APP_ID: string;
@@ -682,14 +848,13 @@ interface ScreenshotResult {
     contentType: string;
 }
 /**
- * Capture a screenshot of `opts.url` and return the PNG bytes.
+ * Capture a screenshot of `url` and return the PNG bytes.
  *
  * Returns null on capture failure (target unreachable, timeout, BR
- * binding misconfigured platform-side). The platform endpoint logs the
- * underlying error; callers should treat null as "no preview available"
- * and surface their own UX fallback.
+ * binding misconfigured platform-side). The platform logs a generic failure
+ * without target details; callers should surface their own fallback UX.
  */
-declare function captureScreenshot(env: ScreenshotEnv, opts: ScreenshotOptions): Promise<ScreenshotResult | null>;
+declare function captureScreenshot(env: ScreenshotEnv, url: string): Promise<ScreenshotResult | null>;
 
 /**
  * Chat context pipeline — keeps the per-request payload to the LLM bounded.
@@ -833,23 +998,8 @@ declare function makeDefaultSummarizer(env: DeepSpaceAIEnv, options?: {
  * The tools API returns records as `{ recordId, data, createdAt, updatedAt }`
  * envelopes; helpers below flatten them into ChatRow / ChatMessageRow.
  */
-/**
- * Canonical chat row.
- *
- * `recordId` is the primary identifier — same envelope shape as every
- * other DeepSpace data type (records.* tools, useQuery results, etc.).
- *
- * `id` is kept as a deprecated alias so existing callers don't break,
- * but every new caller should prefer `recordId`. Without this rename
- * an integrator who reads `chat.recordId` (the obvious thing given the
- * rest of the SDK) silently gets `undefined`, then ships code that
- * sends `{"chatId": undefined}` to `/api/ai/chat` and gets back a 400
- * with a misleading error.
- */
 type ChatRow = {
     recordId: string;
-    /** @deprecated Use `recordId`. Retained for backward compatibility. */
-    id: string;
     userId: string;
     title: string;
     model?: string;
@@ -860,8 +1010,6 @@ type ChatRow = {
 };
 type ChatMessageRow = {
     recordId: string;
-    /** @deprecated Use `recordId`. Retained for backward compatibility. */
-    id: string;
     chatId: string;
     userId: string;
     role: 'user' | 'assistant' | 'system';
@@ -1412,7 +1560,7 @@ declare abstract class BaseRoom<E = Record<string, unknown>> {
     private handleWebSocketUpgrade;
     webSocketMessage(ws: WebSocket, message: ArrayBuffer | string): Promise<void>;
     webSocketClose(ws: WebSocket, _code: number, _reason: string): Promise<void>;
-    webSocketError(ws: WebSocket, error: unknown): Promise<void>;
+    webSocketError(_ws: WebSocket, error: unknown): Promise<void>;
     alarm(): Promise<void>;
     /**
      * Called when a new WebSocket connects (after auth parsing).
@@ -1523,8 +1671,6 @@ interface ConnectionAttachment extends UserAttachment {
     subscriptions: Subscription[];
     /** Yjs docs this connection is editing */
     yjsSubscriptions: YjsSubscription[];
-    /** Yjs client ID for awareness */
-    yjsClientId?: number;
     /** Client-side Yjs awareness clientId (extracted from first awareness message) */
     awarenessClientId?: number;
 }
@@ -1534,63 +1680,7 @@ interface ConnectionAttachment extends UserAttachment {
  *
  * All collections use typed SQL columns. No document-mode / fields-based storage.
  */
-type ColumnInterpretation = {
-    kind: 'plain';
-} | {
-    kind: 'currency';
-    symbol: string;
-    decimals: number;
-} | {
-    kind: 'date';
-    format?: string;
-} | {
-    kind: 'datetime';
-    format?: string;
-} | {
-    kind: 'boolean';
-    trueLabel?: string;
-    falseLabel?: string;
-} | {
-    kind: 'percent';
-    decimals?: number;
-} | {
-    kind: 'select';
-    options: string[];
-} | {
-    kind: 'multiselect';
-    options: string[];
-} | {
-    kind: 'url';
-} | {
-    kind: 'email';
-} | {
-    kind: 'json';
-} | {
-    kind: 'reference';
-    targetTable: string;
-    displayColumn: string;
-};
-interface ColumnDefinition {
-    /** Stable ID override (survives renames). Falls back to `col_{name}`. */
-    id?: string;
-    name: string;
-    storage: 'number' | 'text';
-    interpretation: ColumnInterpretation | string;
-    expression?: string;
-    /** Auto-populate with current user ID on create. */
-    userBound?: boolean;
-    /** Cannot be changed after initial creation. */
-    immutable?: boolean;
-    /** Must be provided on create (non-null). */
-    required?: boolean;
-    /** Default value if not provided on create. */
-    default?: unknown;
-    /** Auto-set ISO timestamp when the named field changes (optionally to a specific value). */
-    timestampTrigger?: {
-        field: string;
-        value?: unknown;
-    };
-}
+
 interface ResolvedColumn {
     id: string;
     name: string;
@@ -1614,41 +1704,6 @@ declare function rowToData(row: Record<string, unknown>, columns: ResolvedColumn
 declare function dataToColumnValues(data: Record<string, unknown>, columns: ResolvedColumn[]): Record<string, unknown>;
 declare function coerceValue(value: unknown, storage: 'number' | 'text', interpretation: ColumnInterpretation): unknown;
 declare function buildTableSelect(collectionName: string, columns: ResolvedColumn[]): string;
-type PermissionLevel = boolean | 'own' | 'unclaimed-or-own' | 'collaborator' | 'team' | 'access' | 'published' | 'shared';
-interface RolePermissions {
-    read: PermissionLevel;
-    create: boolean;
-    update: PermissionLevel;
-    delete: PermissionLevel;
-    /** If set, only these columns can be updated by this role. */
-    writableFields?: string[];
-}
-interface CollectionSchema {
-    name: string;
-    /** Column definitions — every collection is stored in a typed SQL table. */
-    columns: ColumnDefinition[];
-    /** Composite uniqueness constraint (e.g., ['userId', 'taskId']). */
-    uniqueOn?: string[];
-    /** Column name used for ownership checks (default: `_created_by`). */
-    ownerField?: string;
-    /** Column containing JSON array of collaborator user IDs. */
-    collaboratorsField?: string;
-    /** Column containing team ID for team-based access. */
-    teamField?: string;
-    /**
-     * Column controlling per-record read visibility.
-     * String: visible when `data[field] === 'public'`.
-     * Object: visible when `data[field] === value`.
-     */
-    visibilityField?: string | {
-        field: string;
-        value: unknown;
-    };
-    /** Permissions per role. Use '*' for a catch-all fallback. */
-    permissions: Record<string, RolePermissions>;
-    /** Default role for new users (only on 'users' collection). */
-    defaultRole?: string;
-}
 interface User {
     id: string;
     email: string;
@@ -1783,8 +1838,6 @@ declare class RecordRoom<E = Record<string, unknown>> extends BaseRoom<E> {
     private initPromise;
     /** Yjs docs loaded in memory (key: collection:recordId:fieldName) */
     private yjsDocs;
-    /** Next Yjs client ID counter */
-    private nextYjsClientId;
     /** Owner user ID — gets admin role automatically */
     private ownerUserId;
     /** True until the first fetch() completes — detects hibernation wake-up */
@@ -1799,7 +1852,7 @@ declare class RecordRoom<E = Record<string, unknown>> extends BaseRoom<E> {
      * The HTTP debug API (`/api/debug/*`) runs arbitrary SQL and role changes
      * with no auth of its own, so it is gated here at the DO's single ingress.
      * Off unless a deployment opts in with `ALLOW_DEBUG_ROUTES=true`
-     * (`deepspace dev`/`test` set it automatically). Deployments holding shared
+     * (`deepspace dev start`/`test run` set it automatically). Deployments holding shared
      * data override this to always return false.
      */
     protected get debugRoutesEnabled(): boolean;
@@ -1824,7 +1877,7 @@ declare class RecordRoom<E = Record<string, unknown>> extends BaseRoom<E> {
     protected onMessage(): void;
     webSocketMessage(ws: WebSocket, message: ArrayBuffer | string): Promise<void>;
     webSocketClose(ws: WebSocket, code: number, reason: string): Promise<void>;
-    webSocketError(ws: WebSocket, error: unknown): Promise<void>;
+    webSocketError(_ws: WebSocket, error: unknown): Promise<void>;
     private handleRecordMessage;
     private handleListSchemas;
     private createHandlerContext;
@@ -1869,7 +1922,7 @@ declare class YjsRoom<E = Record<string, unknown>> extends BaseRoom<E> {
         type: string;
         [key: string]: unknown;
     }): void;
-    protected onBinaryMessage(ws: WebSocket, user: UserAttachment, data: ArrayBuffer): void;
+    protected onBinaryMessage(ws: WebSocket, _user: UserAttachment, data: ArrayBuffer): void;
     protected onDisconnect(ws: WebSocket, _user: UserAttachment): void;
     private handleSync;
     private handleAwareness;
@@ -1936,7 +1989,7 @@ declare abstract class GameRoom<E = Record<string, unknown>> extends BaseRoom<E>
         type: string;
         [key: string]: unknown;
     }): Promise<void>;
-    protected onDisconnect(ws: WebSocket, user: UserAttachment): void;
+    protected onDisconnect(_ws: WebSocket, user: UserAttachment): void;
     protected onAlarm(): Promise<void>;
     private checkAutoStart;
     private startGame;
@@ -2036,7 +2089,7 @@ declare class CanvasRoom<E = Record<string, unknown>> extends BaseRoom<E> {
         type: string;
         [key: string]: unknown;
     }): Promise<void>;
-    protected onDisconnect(ws: WebSocket, user: UserAttachment): void;
+    protected onDisconnect(_ws: WebSocket, user: UserAttachment): void;
     private pushUndo;
     private clearRedo;
     private handleUndo;
@@ -2090,6 +2143,19 @@ declare class PresenceRoom<E = Record<string, unknown>> extends BaseRoom<E> {
     protected onDisconnect(ws: WebSocket, user: UserAttachment): void;
 }
 
+/** Pure validation and evaluation for CronRoom schedules. */
+interface CronTask {
+    name: string;
+    /** Interval in minutes (interval mode) — mutually exclusive with `schedule`. */
+    intervalMinutes?: number;
+    /** 5-field cron expression (cron mode) — requires `timezone`. */
+    schedule?: string;
+    /** IANA timezone string (e.g. "America/New_York"). Required with `schedule`. */
+    timezone?: string;
+    /** Whether the task starts paused. */
+    paused?: boolean;
+}
+
 /**
  * CronRoom — Per-app scheduled task execution Durable Object.
  *
@@ -2108,17 +2174,6 @@ declare class PresenceRoom<E = Record<string, unknown>> extends BaseRoom<E> {
  * Message types: cron.*
  */
 
-interface CronTask {
-    name: string;
-    /** Interval in minutes (interval mode) — mutually exclusive with `schedule`. */
-    intervalMinutes?: number;
-    /** 5-field cron expression (cron mode) — requires `timezone`. */
-    schedule?: string;
-    /** IANA timezone string (e.g. "America/New_York"). Required with `schedule`. */
-    timezone?: string;
-    /** Whether the task starts paused. */
-    paused?: boolean;
-}
 interface CronRoomConfig {
     tasks: CronTask[];
 }
@@ -2922,7 +2977,7 @@ interface UserUpdatePayload {
     email?: string;
     imageUrl?: string;
 }
-declare function handleUserUpdate(ctx: RecordContext, ws: WebSocket, attachment: ConnectionAttachment, payload: UserUpdatePayload): void;
+declare function handleUserUpdate(ctx: RecordContext, _ws: WebSocket, attachment: ConnectionAttachment, payload: UserUpdatePayload): void;
 /**
  * Handle set role request (admin only).
  * Updates the role field in the c_users table.
@@ -2960,7 +3015,7 @@ declare function getYjsDocKey(collection: string, recordId: string, fieldName: s
  * Get or create a Y.Doc for a record field.
  * Loads from database if exists, creates new if not.
  */
-declare function getOrCreateYjsDoc(ctx: YjsContext, docKey: YjsDocKey): Promise<Y.Doc>;
+declare function getOrCreateYjsDoc(ctx: YjsContext, docKey: YjsDocKey): Y.Doc;
 /**
  * Save Yjs doc state to database.
  */
@@ -2969,11 +3024,11 @@ declare function saveYjsDoc(sql: SqlStorage, docKey: YjsDocKey, doc: Y.Doc): voi
  * Handle request to join Yjs sync for a record field.
  * System collections (see SYSTEM_COLLECTIONS) are permissive; others require schema.
  */
-declare function handleYjsJoin(ctx: YjsContext, ws: WebSocket, attachment: ConnectionAttachment, payload: YjsJoinPayload): Promise<void>;
+declare function handleYjsJoin(ctx: YjsContext, ws: WebSocket, attachment: ConnectionAttachment, payload: YjsJoinPayload): void;
 /**
  * Handle request to leave Yjs sync for a record field.
  */
-declare function handleYjsLeave(ws: WebSocket, attachment: ConnectionAttachment, payload: YjsLeavePayload): void;
+declare function handleYjsLeave(ctx: YjsContext, ws: WebSocket, attachment: ConnectionAttachment, payload: YjsLeavePayload): void;
 /**
  * Handle binary Yjs sync messages from clients.
  *
@@ -2981,7 +3036,7 @@ declare function handleYjsLeave(ws: WebSocket, attachment: ConnectionAttachment,
  * - MSG_SYNC_STEP1: Client sends state vector → Server responds with SYNC_STEP2 (diff)
  * - MSG_SYNC_STEP2/UPDATE: Client sends update → Server applies and broadcasts
  */
-declare function handleYjsBinaryMessage(ctx: YjsContext, ws: WebSocket, attachment: ConnectionAttachment, data: Uint8Array): Promise<void>;
+declare function handleYjsBinaryMessage(ctx: YjsContext, ws: WebSocket, attachment: ConnectionAttachment, data: Uint8Array): void;
 /**
  * Broadcast a Yjs update to all subscribers of a doc, except the sender.
  */
@@ -3118,7 +3173,7 @@ declare function decodeJwtPayload(token: string | null | undefined): TokenDebugI
 /**
  * Test-account identification, shared by every platform worker.
  *
- * Test accounts (created via `deepspace test-accounts`) are real Better Auth
+ * Test accounts (created via `deepspace test accounts`) are real Better Auth
  * users demarcated three ways, and a caller may present as any of them
  * depending on where the check runs:
  *  - their email always ends with @deepspace.test (enforced at creation)
@@ -3179,8 +3234,184 @@ interface DeepSpaceAuthConfig {
     emailAndPassword?: boolean;
     /** Trusted origins for CORS */
     trustedOrigins?: string[];
+    /**
+     * Called after a new user row is created (any flow: social OAuth callback,
+     * email/password, server-side `auth.api.signUpEmail`). When the signup came
+     * in over HTTP, `ctx.request` exposes the inbound request; some better-auth
+     * entry points carry standalone `ctx.headers` instead of (or as well as) a
+     * request, so both are forwarded. For server-side creations (`auth.api.*`
+     * calls) an endpoint context usually still exists but may carry NEITHER —
+     * guard every field.
+     *
+     * Better Auth awaits `user.create.after` hooks inline before the response
+     * is sent, so keep this cheap (e.g. a single D1 write) and hand slow work
+     * to `ctx.waitUntil` at the call site. Exceptions are caught and logged so
+     * a failing observer can never break signup itself.
+     */
+    onUserCreated?: (user: {
+        id: string;
+        email: string;
+        name: string;
+    }, ctx: {
+        request?: Request;
+        headers?: Headers;
+    } | null) => Promise<void>;
 }
 declare function createDeepSpaceAuth(config: DeepSpaceAuthConfig): better_auth.Auth<{
+    databaseHooks: {
+        user?: {
+            create?: {
+                before?: (user: better_auth.User & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        email?: string | undefined;
+                        emailVerified?: boolean | undefined;
+                        name?: string | undefined;
+                        image?: string | null | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (user: better_auth.User & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (user: Partial<better_auth.User> & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        email?: string | undefined;
+                        emailVerified?: boolean | undefined;
+                        name?: string | undefined;
+                        image?: string | null | undefined;
+                    };
+                }>;
+                after?: (user: better_auth.User & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (user: better_auth.User & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (user: better_auth.User & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+        session?: {
+            create?: {
+                before?: (session: better_auth.Session & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        userId?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        token?: string | undefined;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (session: better_auth.Session & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (session: Partial<better_auth.Session> & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        userId?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        token?: string | undefined;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                }>;
+                after?: (session: better_auth.Session & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (session: better_auth.Session & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (session: better_auth.Session & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+        account?: {
+            create?: {
+                before?: (account: better_auth.Account, context: better_auth.GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        providerId?: string | undefined;
+                        accountId?: string | undefined;
+                        userId?: string | undefined;
+                        accessToken?: string | null | undefined;
+                        refreshToken?: string | null | undefined;
+                        idToken?: string | null | undefined;
+                        accessTokenExpiresAt?: Date | null | undefined;
+                        refreshTokenExpiresAt?: Date | null | undefined;
+                        scope?: string | null | undefined;
+                        password?: string | null | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (account: better_auth.Account, context: better_auth.GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (account: Partial<better_auth.Account> & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        providerId?: string | undefined;
+                        accountId?: string | undefined;
+                        userId?: string | undefined;
+                        accessToken?: string | null | undefined;
+                        refreshToken?: string | null | undefined;
+                        idToken?: string | null | undefined;
+                        accessTokenExpiresAt?: Date | null | undefined;
+                        refreshTokenExpiresAt?: Date | null | undefined;
+                        scope?: string | null | undefined;
+                        password?: string | null | undefined;
+                    };
+                }>;
+                after?: (account: better_auth.Account & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (account: better_auth.Account & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (account: better_auth.Account & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+        verification?: {
+            create?: {
+                before?: (verification: better_auth.Verification & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        value?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        identifier?: string | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (verification: better_auth.Verification & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (verification: Partial<better_auth.Verification> & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        value?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        identifier?: string | undefined;
+                    };
+                }>;
+                after?: (verification: better_auth.Verification & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (verification: better_auth.Verification & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (verification: better_auth.Verification & Record<string, unknown>, context: better_auth.GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+    } | undefined;
     plugins: [{
         id: "organization";
         version: string;
@@ -4033,6 +4264,10 @@ declare function createDeepSpaceAuth(config: DeepSpaceAuthConfig): better_auth.A
     database: D1Database;
     baseURL: string;
     secret: string;
+    session: {
+        expiresIn: number;
+        updateAge: number;
+    };
     emailAndPassword: {
         enabled: boolean;
     };
@@ -4056,9 +4291,10 @@ interface PlanPrice {
     currency?: string;
 }
 /**
- * Plan shape returned by `/api/subscriptions/me` and consumed directly by
- * `<PricingTable plans={sub.plans}>`. Fields beyond slug/rank are optional so
- * a free tier (no prices, no trial) doesn't need to fabricate them.
+ * Plan shape returned by `/api/subscriptions/me` and consumed by
+ * `<PricingTable plans={sub.plans} onSelect={...}>`. Fields beyond slug/rank
+ * are optional so a free tier (no prices, no trial) doesn't need to fabricate
+ * them.
  */
 interface PlanInfo {
     slug: string;
@@ -4198,4 +4434,4 @@ declare class RefundError extends Error {
     constructor(message: string, status: number);
 }
 
-export { AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, BaseRoom, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CONVERSATION_SCHEMAS, COST_RATES, CancelSubscriptionError, type CancelSubscriptionOpts, type CancelSubscriptionResult, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DebugApiContext, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GetActionData, type GlobalDOType, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, MESSAGES_SCHEMA, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlanInfo, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, type RecordContext, RecordRoom, type RecordRoomConfig, RefundError, type RefundOpts, type RefundResult, type ResolvedColumn, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, SYSTEM_COLLECTION_SCHEMAS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotOptions, type ScreenshotResult, type SharedConnection, type StoredRecord, SubscriptionAuthError, type SubscriptionContext, type SubscriptionRead, SubscriptionRequiredError, type SubscriptionStatus, type Summarizer, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, type ToolsApiContext, USERS_COLUMNS, type User, type UserAttachment, type UserContext, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKSPACE_SCHEMAS, type YjsContext, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, broadcastChange, broadcastYjsUpdate, buildCronContext, buildTableSelect, buildUiParts, canCreate, canDelete, canRead, canUpdate, cancelSubscription, capToolResultSize, captureScreenshot, checkFieldPermissions, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDeepSpaceAI, createDeepSpaceAuth, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deleteChatCascade, deleteRecord, enqueueJob, executeQuery, getAllUsers, getChat, getGlobalDOSchemas, getGlobalDOType, getOrCreateYjsDoc, getRecord, getRolePermissions, getSubscription, getUser, getYjsDocKey, handleApiRequest, handleDelete, handlePut, handleSetRole, handleSubscribe, handleToolsRequest, handleUnsubscribe, handleUserList, handleUserUpdate, handleYjsBinaryMessage, handleYjsJoin, handleYjsLeave, isAutoProvision, isOwner, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, lintSchema, loadMessages, makeDefaultSummarizer, meterAi, meterUsage, meterVectorize, noopPermissionContext, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, putRecord, readRecord, recordMatchesSubscription, refundInvoice, registerUser, requireSubscription, resolveAppName, resolveColumn, rowToData, runMigrations, saveYjsDoc, timingSafeEqualHex, timingSafeEqualStrings, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema };
+export { AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_ID_RE, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, BaseRoom, CHANNELS_SCHEMA, CHANNEL_INVITATIONS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, CONVERSATION_SCHEMAS, COST_RATES, CancelSubscriptionError, type CancelSubscriptionOpts, type CancelSubscriptionResult, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type CollectionPermissionSummary, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConvMemberData, type ConvMessageData, type ConvReactionData, type ConvReadCursorData, type ConvVoteData, type ConversationStateData, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, DIRECTORY_SCHEMAS, type DOBindings, type DOManifest, type DOManifestEntry, type DebugApiContext, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DirectoryCommunityData, type DirectoryConversationData, type DirectoryMembershipData, type DirectoryPostData, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, GLOBAL_DO_TYPES, GLOBAL_DO_TYPE_NAMES, type GameInput, GameRoom, type GameRoomConfig, type GetActionData, type GlobalDOType, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, MESSAGES_SCHEMA, type MutateActionData, type PermissionAnalysis, type PermissionContext, type PermissionLevel, type PermissionSource, type PlanInfo, type PlatformWorkerEnv, type Player, type PrefixResult, type PresencePeer, PresenceRoom, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, REGISTRY_INSTANCE, RESERVED_BINDING_NAMES, RESERVED_COLLECTION_NAMES, type RecordContext, RecordRoom, type RecordRoomConfig, RefundError, type RefundOpts, type RefundResult, RegistryClientError, type ResolvedColumn, type ResolvedPermission, type RolePermissions, type RunMigrationsResult, STRICT_APP_ID_RE, SYSTEM_COLLECTION_SCHEMAS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type SharedConnection, type StoredRecord, SubscriptionAuthError, type SubscriptionContext, type SubscriptionRead, SubscriptionRequiredError, type SubscriptionStatus, type Summarizer, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, type ToolsApiContext, USERS_COLUMNS, type User, type UserAttachment, type UserContext, VOTING_SCHEMAS, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKSPACE_SCHEMAS, type YjsContext, YjsRoom, analyzePermissions, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, authWorkerFetch, bindingManifestFromOutputConfig, broadcastChange, broadcastYjsUpdate, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, cancelSubscription, capToolResultSize, captureScreenshot, checkFieldPermissions, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDeepSpaceAI, createDeepSpaceAuth, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deleteChatCascade, deleteRecord, enqueueJob, executeQuery, getAllUsers, getChat, getGlobalDOSchemas, getGlobalDOType, getOrCreateYjsDoc, getRecord, getRolePermissions, getSubscription, getUser, getYjsDocKey, handleApiRequest, handleDelete, handlePut, handleSetRole, handleSubscribe, handleToolsRequest, handleUnsubscribe, handleUserList, handleUserUpdate, handleYjsBinaryMessage, handleYjsJoin, handleYjsLeave, isAutoProvision, isOwner, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, lintSchema, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, noopPermissionContext, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, putRecord, readRecord, recordMatchesSubscription, refundInvoice, registerUser, registryErrorJson, registryStub, requireSubscription, resolveAppName, resolveColumn, rowToData, runMigrations, saveYjsDoc, timingSafeEqualHex, timingSafeEqualStrings, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyJwt, workspaceAccountsSchema, workspaceContentSharesSchema, workspaceEmailHandlesSchema, workspaceFormResponsesSchema, workspacePeopleSchema, workspaceProjectsSchema, workspaceTagsSchema, workspaceTasksSchema, workspaceTeamMembersSchema, workspaceTeamsSchema, workspaceTransactionsSchema };