deepspace 0.30.1 → 0.31.0

package/dist/server.d.ts

@@ -304,7 +304,8 @@ interface StorageAdmission {
  *   POST   /api/files/multipart/complete  → assemble the parts
  *   DELETE /api/files/multipart           → abandon a chunked upload
  *   GET    /api/files                     → list   (prefix + optional user prefix)
- *   GET    /api/files/:key                → download (validated against prefix)
+ *   GET    /api/files/:key                → download (validated against prefix; Range-aware)
+ *   HEAD   /api/files/:key                → the download's headers, no body
  *   DELETE /api/files/:key                → delete   (validated against prefix)
  *
  * ## One transport discipline
@@ -531,6 +532,26 @@ interface YjsLeavePayload {
     fieldName: string;
 }
 
+/**
+ * Platform API error normalization — the one chokepoint that turns the
+ * api-worker's error envelope into a render-safe + branch-safe shape.
+ *
+ * The platform emits errors as `{ error: <machine slug>, message?: <human>,
+ * ...details }` (e.g. 402 `{ error: 'insufficient_credits', message:
+ * 'Insufficient credits.', availableCredits, requiredCredits }`; some routes
+ * send the bare slug with no `message` at all, e.g. 409
+ * `{ error: 'owner_connect_not_ready' }`). Consumers must never show the slug
+ * to a person or make an agent parse the sentence — this module separates the
+ * two once, for the integration client, server actions, billing hooks, and the
+ * CLI.
+ */
+/** One structured validation issue (Zod shape) from a `validation_failed` response. */
+interface ApiErrorIssue {
+    path?: string[];
+    message: string;
+    code?: string;
+}
+
 /**
  * Server Action Types
  *
@@ -555,7 +576,16 @@ type ActionResult<TData = unknown> = {
 } | {
     success: false;
     data?: never;
+    /** Human-readable error, safe to render directly. */
     error: string;
+    /** Machine slug for branching, when the failing tool supplied one. */
+    code?: string;
+    /** HTTP status from an upstream platform request, when applicable. */
+    status?: number;
+    /** Structured fields supplied with the error response. */
+    details?: Record<string, unknown>;
+    /** Validation issues supplied with a `validation_failed` response. */
+    issues?: ApiErrorIssue[];
 };
 /** Shape of the data field for `tools.query`. */
 interface QueryActionData<T = Record<string, unknown>> {
@@ -610,7 +640,9 @@ interface ActionTools {
      * api-worker. On success, `result.data` is the integration's response
      * body directly — there is no `.response` wrapper. So an OpenAI call
      * yields `result.data.choices`, a Freepik image call yields
-     * `result.data.images`, etc.
+     * `result.data.images`, etc. On failure, `result.error` is human-readable;
+     * branch on `result.code` and inspect `status`, `details`, or `issues` when
+     * present.
      */
     integration<T = unknown>(endpoint: string, data?: unknown): Promise<ActionResult<T>>;
     /**
@@ -3378,6 +3410,34 @@ interface VerifyOutcome {
  */
 declare function verifyJwt(config: JwtVerifierConfig, token: string | null | undefined): Promise<VerifyOutcome>;
 
+/**
+ * Session-cookie identity for header-less file reads.
+ *
+ * `<img>`, `<audio>`, `<video>`, and `<a href>` cannot send `Authorization`,
+ * but the browser attaches the app-origin Better Auth session cookie to every
+ * same-origin load. This exchanges that cookie for the same 15-minute JWT the
+ * client already holds and returns only the verified identity.
+ *
+ * Bearer always wins: this applies only when no `Authorization` header is
+ * present, only to GET/HEAD, and only when `Sec-Fetch-Site` is `same-origin`
+ * or `none`. `app.space` is not on the Public Suffix List, so a sibling
+ * `evil.app.space` is same-SITE and `SameSite=Lax` alone would let its
+ * `<img src>` carry the victim's cookie; `Sec-Fetch-Site` cannot be set by
+ * page script. A browser that omits it (Safari before 16.4) and a cross-site
+ * top-level link both get 401 by design.
+ */
+
+type SessionReadEnv = AuthWorkerEnv & {
+    AUTH_JWT_PUBLIC_KEY: string;
+    AUTH_JWT_ISSUER: string;
+};
+/**
+ * Identify a same-origin GET/HEAD by the app-origin session cookie. Returns
+ * `null` — never throws — whenever the request does not qualify or the
+ * exchange fails. Use it only as the fallback after bearer verification.
+ */
+declare function resolveSessionReadAuth(req: Request, env: SessionReadEnv): Promise<VerifyResult | null>;
+
 declare const AGENT_TOKEN_SCOPE = "agent";
 /** A separate issuer keeps agent credentials invalid at ordinary platform APIs. */
 declare function agentTokenIssuer(issuer: string): string;
@@ -4664,4 +4724,4 @@ declare class RefundError extends Error {
     constructor(message: string, status: number);
 }
 
-export { ACCOUNT_STORAGE_LIMIT_BYTES, AGENT_TOKEN_SCOPE, AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_ID_RE, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppMembership, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, BaseRoom, type BindingJsonValue, CHANNELS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, COST_RATES, CancelSubscriptionError, type CancelSubscriptionOpts, type CancelSubscriptionResult, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DELETE_WHERE_LIMIT, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, type DOBindings, type DOManifest, type DOManifestEntry, type DebugApiContext, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, DeepSpaceAgentProfileError, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, type GetActionData, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, type KnowledgeAddOptions, type KnowledgeAddResult, type KnowledgeClient, type KnowledgeEnv, KnowledgeError, type KnowledgeItem, type KnowledgeListOptions, type KnowledgeListResult, type KnowledgeSearchChunk, type KnowledgeSearchOptions, type KnowledgeSearchResult, type KnowledgeStatus, MAX_APP_FILE_BYTES, MAX_BINDING_NAME_LENGTH, MAX_DELETE_WHERE_LIMIT, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_ENV_VAR_BYTES, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, type MutateActionData, type PermissionContext, type PermissionLevel, type PlanInfo, type PlatformWorkerEnv, type PrefixResult, type PresencePeer, PresenceRoom, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, REGISTRY_INSTANCE, RESERVED_BINDING_NAMES, RESOURCE_ID_RE, type RecordContext, RecordRoom, type RecordRoomConfig, RefundError, type RefundOpts, type RefundResult, RegistryClientError, type ResolvedColumn, type RolePermissions, type RunMigrationsResult, SECRET_NAME_RE, STRICT_APP_ID_RE, SYSTEM_ASSIGNED_COLUMNS, SYSTEM_COLLECTION_SCHEMAS, SYSTEM_MAINTAINED_COLUMNS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedKnowledgeClient, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type StorageAdmission, type StoredRecord, SubscriptionAuthError, type SubscriptionContext, type SubscriptionRead, SubscriptionRequiredError, type SubscriptionStatus, type Summarizer, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, type ToolsApiContext, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, type UserContext, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, type YjsContext, YjsRoom, agentTokenIssuer, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, armCronRoom, authWorkerFetch, bindingManifestFromOutputConfig, broadcastChange, broadcastUserList, broadcastYjsUpdate, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, cancelSubscription, capToolResultSize, captureScreenshot, checkFieldPermissions, checkUnclaimedOwnerTransition, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDeepSpaceAI, createDeepSpaceAuth, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, deleteRecord, enqueueJob, epochSeconds, executeQuery, folderFilter, formatBytes, getAllUsers, getChat, getOrCreateYjsDoc, getRecord, getRolePermissions, getSubscription, getUser, getYjsDocKey, handleApiRequest, handleDelete, handlePut, handleSetRole, handleSubscribe, handleToolsRequest, handleUnsubscribe, handleUserList, handleUserUpdate, handleYjsBinaryMessage, handleYjsJoin, handleYjsLeave, isAutoProvision, isFilesVerbPath, isOwner, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, knowledge, lintSchema, lintSchemaSet, lintSchemas, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, mintAppId, mintUlid, noopPermissionContext, normalizeKnowledgeFolder, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, putRecord, readRecord, recordMatchesSubscription, refundInvoice, registerUser, registryErrorJson, registryStub, requireSubscription, resolveAppMembership, resolveAppName, resolveAppRole, resolveColumn, rowToData, runMigrations, saveYjsDoc, storageLimitForTier, storageQuotaMessage, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyAgentToken, verifyJwt };
+export { ACCOUNT_STORAGE_LIMIT_BYTES, AGENT_TOKEN_SCOPE, AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, ALLOWED_BINDING_TYPES, APP_ID_RE, APP_NAME_RULES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type ApiWorkerEnv, type AppMembership, type AppNameResolution, type AppNameValidation, type AuthWorkerEnv, BASE_USERS_SCHEMA, BUILT_IN_TOOLS, BaseRoom, type BindingJsonValue, CHANNELS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, COST_RATES, CancelSubscriptionError, type CancelSubscriptionOpts, type CancelSubscriptionResult, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEFAULT_CONTEXT_CONFIG, DEFAULT_DELETE_WHERE_LIMIT, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, type DOBindings, type DOManifest, type DOManifestEntry, type DebugApiContext, type DeepSpaceAIEnv, type DeepSpaceAIOptions, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, DeepSpaceAgentProfileError, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, type GetActionData, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, type KnowledgeAddOptions, type KnowledgeAddResult, type KnowledgeClient, type KnowledgeEnv, KnowledgeError, type KnowledgeItem, type KnowledgeListOptions, type KnowledgeListResult, type KnowledgeSearchChunk, type KnowledgeSearchOptions, type KnowledgeSearchResult, type KnowledgeStatus, MAX_APP_FILE_BYTES, MAX_BINDING_NAME_LENGTH, MAX_DELETE_WHERE_LIMIT, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_ENV_VAR_BYTES, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, type MutateActionData, type PermissionContext, type PermissionLevel, type PlanInfo, type PlatformWorkerEnv, type PrefixResult, type PresencePeer, PresenceRoom, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, REGISTRY_INSTANCE, RESERVED_BINDING_NAMES, RESOURCE_ID_RE, type RecordContext, RecordRoom, type RecordRoomConfig, RefundError, type RefundOpts, type RefundResult, RegistryClientError, type ResolvedColumn, type RolePermissions, type RunMigrationsResult, SECRET_NAME_RE, STRICT_APP_ID_RE, SYSTEM_ASSIGNED_COLUMNS, SYSTEM_COLLECTION_SCHEMAS, SYSTEM_MAINTAINED_COLUMNS, SYSTEM_MANAGED_COLUMNS, SchemaRegistry, type ScopeContext, type ScopedKnowledgeClient, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type StorageAdmission, type StoredRecord, SubscriptionAuthError, type SubscriptionContext, type SubscriptionRead, SubscriptionRequiredError, type SubscriptionStatus, type Summarizer, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, type ToolsApiContext, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, type UserContext, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, type YjsContext, YjsRoom, agentTokenIssuer, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, armCronRoom, authWorkerFetch, bindingManifestFromOutputConfig, broadcastChange, broadcastUserList, broadcastYjsUpdate, buildCronContext, buildTableSelect, buildUiParts, callRegistry, canCreate, canDelete, canRead, canUpdate, cancelSubscription, capToolResultSize, captureScreenshot, checkFieldPermissions, checkUnclaimedOwnerTransition, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDeepSpaceAI, createDeepSpaceAuth, createScopedR2Handler, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, deleteRecord, enqueueJob, epochSeconds, executeQuery, folderFilter, formatBytes, getAllUsers, getChat, getOrCreateYjsDoc, getRecord, getRolePermissions, getSubscription, getUser, getYjsDocKey, handleApiRequest, handleDelete, handlePut, handleSetRole, handleSubscribe, handleToolsRequest, handleUnsubscribe, handleUserList, handleUserUpdate, handleYjsBinaryMessage, handleYjsJoin, handleYjsLeave, isAutoProvision, isFilesVerbPath, isOwner, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, knowledge, lintSchema, lintSchemaSet, lintSchemas, loadMessages, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, mintAppId, mintUlid, noopPermissionContext, normalizeKnowledgeFolder, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, putRecord, readRecord, recordMatchesSubscription, refundInvoice, registerUser, registryErrorJson, registryStub, requireSubscription, resolveAppMembership, resolveAppName, resolveAppRole, resolveColumn, resolveSessionReadAuth, rowToData, runMigrations, saveYjsDoc, storageLimitForTier, storageQuotaMessage, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, totalChars, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppName, validateBindingManifest, validateDoManifest, verifyAgentToken, verifyJwt };

package/dist/server.js

@@ -967,7 +967,7 @@ function createScopedR2Handler(config) {
     if (!subpath && request2.method === "GET") {
       return handleList(bucket, prefix, excludedPrefixes, url, scope, auth);
     }
-    if (subpath && request2.method === "GET") {
+    if (subpath && (request2.method === "GET" || request2.method === "HEAD")) {
       if (!isKeyWithinScope(subpath, prefix, excludedPrefixes)) {
         return Response.json(
           { error: "Access denied: key outside scope" },
@@ -1574,11 +1574,64 @@ async function handleList(bucket, prefix, excludedPrefixes, url, scope, auth) {
     { headers: CORS_HEADERS2 }
   );
 }
+function parseByteRange(header, size) {
+  const [, first, last] = /^bytes=(\d*)-(\d*)$/.exec(header.trim()) ?? [];
+  if (first === void 0 || first === "" && last === "") return void 0;
+  const offset = first === "" ? Math.max(0, size - Number(last)) : Number(first);
+  if (offset >= size) return "unsatisfiable";
+  const end = first === "" || last === "" ? size - 1 : Math.min(Number(last), size - 1);
+  return end < offset ? void 0 : { offset, length: end - offset + 1 };
+}
 async function handleDownload(request2, bucket, key, scope) {
-  const object = await bucket.get(key);
-  if (!object) {
+  if (request2.method === "HEAD") {
+    const object = await bucket.head(key);
+    if (!object) {
+      return Response.json({ error: "File not found" }, { status: 404, headers: CORS_HEADERS2 });
+    }
+    const headers2 = downloadHeaders(object, key, scope);
+    if (scope === "app" && request2.headers.get("if-none-match") === object.httpEtag) {
+      return new Response(null, { status: 304, headers: headers2 });
+    }
+    headers2.set("Content-Length", String(object.size));
+    return new Response(null, { status: 200, headers: headers2 });
+  }
+  const rangeHeader = request2.headers.get("range");
+  if (rangeHeader === null) {
+    return wholeDownload(request2, await bucket.get(key), key, scope);
+  }
+  const head = await bucket.head(key);
+  if (!head) {
     return Response.json({ error: "File not found" }, { status: 404, headers: CORS_HEADERS2 });
   }
+  if (scope === "app" && request2.headers.get("if-none-match") === head.httpEtag) {
+    return new Response(null, { status: 304, headers: downloadHeaders(head, key, scope) });
+  }
+  const ifRange = request2.headers.get("if-range");
+  if (ifRange !== null && ifRange !== head.httpEtag) {
+    return wholeDownload(request2, await bucket.get(key), key, scope);
+  }
+  const range = parseByteRange(rangeHeader, head.size);
+  if (range === "unsatisfiable") {
+    const headers2 = { ...CORS_HEADERS2, "Content-Range": `bytes */${head.size}` };
+    return new Response(null, { status: 416, headers: headers2 });
+  }
+  if (!range) {
+    return wholeDownload(request2, await bucket.get(key), key, scope);
+  }
+  const conditional = await bucket.get(key, {
+    range,
+    onlyIf: { etagMatches: head.etag }
+  });
+  if (!conditional || !("body" in conditional)) {
+    return wholeDownload(request2, await bucket.get(key), key, scope);
+  }
+  const headers = downloadHeaders(conditional, key, scope);
+  const end = range.offset + range.length - 1;
+  headers.set("Content-Range", `bytes ${range.offset}-${end}/${conditional.size}`);
+  headers.set("Content-Length", String(range.length));
+  return new Response(conditional.body, { status: 206, headers });
+}
+function downloadHeaders(object, key, scope) {
   const headers = new Headers();
   const storedType = resolveMimeType(object.httpMetadata?.contentType ?? "");
   const mustDownload = DANGEROUS_MIME_TYPES.has(storedType);
@@ -1596,10 +1649,19 @@ async function handleDownload(request2, bucket, key, scope) {
     contentDisposition(originalName, mustDownload ? "attachment" : "inline")
   );
   if (mustDownload) headers.set("Content-Security-Policy", "sandbox; default-src 'none'");
+  headers.set("Accept-Ranges", "bytes");
+  return headers;
+}
+function wholeDownload(request2, object, key, scope) {
+  if (!object) {
+    return Response.json({ error: "File not found" }, { status: 404, headers: CORS_HEADERS2 });
+  }
+  const headers = downloadHeaders(object, key, scope);
   if (scope === "app" && request2.headers.get("if-none-match") === object.httpEtag) {
     return new Response(null, { status: 304, headers });
   }
-  return new Response(object.body, { headers });
+  headers.set("Content-Length", String(object.size));
+  return new Response(object.body, { status: 200, headers });
 }
 
 // src/server/utils/proxies.ts
@@ -8423,6 +8485,45 @@ async function verifyJwt(config, token) {
   }
 }
 
+// src/shared/auth-session.ts
+var SESSION_COOKIE = "__Secure-better-auth.session_token";
+
+// src/server/auth/sessionReadAuth.ts
+var TTL_MS = 5 * 6e4;
+var sessions = /* @__PURE__ */ new Map();
+async function exchange(session, env) {
+  try {
+    const res = await authWorkerFetch(env, "/api/auth/token", {
+      method: "POST",
+      headers: { Cookie: `${SESSION_COOKIE}=${session}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    const { token } = res.ok ? await res.json() : {};
+    if (typeof token !== "string") return null;
+    const config = { publicKey: env.AUTH_JWT_PUBLIC_KEY, issuer: env.AUTH_JWT_ISSUER };
+    return (await verifyJwt(config, token)).result;
+  } catch {
+    return null;
+  }
+}
+async function resolveSessionReadAuth(req, env) {
+  const site = req.headers.get("Sec-Fetch-Site");
+  if (req.method !== "GET" && req.method !== "HEAD") return null;
+  if (req.headers.has("Authorization") || site !== "same-origin" && site !== "none") return null;
+  const session = (req.headers.get("Cookie") ?? "").split(";").find((part) => part.trim().startsWith(`${SESSION_COOKIE}=`))?.trim().slice(SESSION_COOKIE.length + 1);
+  if (!session) return null;
+  const now = Date.now();
+  const cached = sessions.get(session);
+  if (cached && cached.expiresAt > now) return cached.promise;
+  if (sessions.size >= 500) sessions.clear();
+  const promise = exchange(session, env).then((result) => {
+    if (!result) sessions.delete(session);
+    return result;
+  });
+  sessions.set(session, { promise, expiresAt: now + TTL_MS });
+  return promise;
+}
+
 // src/server/auth/agentToken.ts
 var AGENT_TOKEN_SCOPE = "agent";
 function agentTokenIssuer(issuer) {
@@ -8931,6 +9032,7 @@ export {
   resolveAppName,
   resolveAppRole,
   resolveColumn,
+  resolveSessionReadAuth,
   rowToData,
   runMigrations,
   saveYjsDoc,