deepspace 0.30.2 → 0.31.0

package/dist/cli.js

@@ -5732,6 +5732,7 @@ var SECURE_ROOM_BOUNDARIES_MIGRATION_ID = "2026-08-secure-room-boundaries";
 var ACTION_TOOLS_DELETE_WHERE_MIGRATION_ID = "2026-08-action-tools-delete-where";
 var BUILD_INJECTED_APP_ID_MIGRATION_ID = "2026-08-build-injected-app-id";
 var ACTION_ROUTES_BEARER_GUARD_MIGRATION_ID = "2026-08-action-routes-bearer-guard";
+var FILES_SESSION_COOKIE_READS_MIGRATION_ID = "2026-09-files-session-cookie-reads";
 function validateAppMigrationIds(value) {
   if (!Array.isArray(value)) {
     return { valid: false, reason: "app migrations must be a JSON string array" };
@@ -5789,6 +5790,12 @@ var APP_MIGRATION_GUIDANCE = [
     description: "Refuse action calls without a bearer token and document their trust boundary",
     files: ["src/server/action-routes.ts, when the app has server actions"],
     guidance: "After resolveAuth, read `const authHeader = c.req.header('Authorization') ?? ''`, accept only its `Bearer ` token, and return 401 when absent. Document that X-App-Action bypasses per-record RBAC, so each action must authorize record ownership itself. If the app has no server action route, record this migration as not applicable."
+  },
+  {
+    id: FILES_SESSION_COOKIE_READS_MIGRATION_ID,
+    description: "Let private file URLs render in <img>/<audio>/<video> for the signed-in user",
+    files: ["the app-owned HTTP route file that proxies /api/files/*"],
+    guidance: "In the /api/files/* proxy only, replace `const auth = await resolveAuth(c.req.raw, c.env)` with `const auth = (await resolveAuth(c.req.raw, c.env)) ?? (await resolveSessionReadAuth(c.req.raw, c.env))`, importing resolveSessionReadAuth from 'deepspace/worker'. It identifies same-origin GET/HEAD by the app-origin session cookie and returns null for everything else. Do not add it to resolveAuth, which also gates writes. In the same route, skip the JSON URL rewrite for HEAD: change `if (contentType.includes('application/json'))` to `if (contentType.includes('application/json') && c.req.method !== 'HEAD')`, because a HEAD answer carries the content-type but no body and parsing it would turn every failed media probe into a 500."
   }
 ];
 var APP_MIGRATION_DEFINITIONS = APP_MIGRATION_GUIDANCE.map(({ id, description }) => ({
@@ -15991,7 +15998,7 @@ import { join as join28, resolve as resolve22 } from "path";
 // package.json
 var package_default = {
   name: "deepspace",
-  version: "0.30.2",
+  version: "0.31.0",
   engines: {
     node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
   },