deepspace 0.30.2 → 0.31.0

package/dist/index.d.ts

@@ -1371,6 +1371,10 @@ declare const BUILD_INJECTED_APP_ID_MIGRATION_ID = "2026-08-build-injected-app-i
  *  session has none) instead of crashing on a non-null assertion, and the
  *  file states the trust model actions run under. */
 declare const ACTION_ROUTES_BEARER_GUARD_MIGRATION_ID = "2026-08-action-routes-bearer-guard";
+/** The files proxy identifies a header-less same-origin read (an `<img>`,
+ *  `<audio>`, or `<video>` load) by the app-origin session cookie, so private
+ *  file URLs render for the signed-in user without tokens or signed URLs. */
+declare const FILES_SESSION_COOKIE_READS_MIGRATION_ID = "2026-09-files-session-cookie-reads";
 type AppMigrationIdsValidation = {
     valid: true;
     ids: string[];
@@ -3503,9 +3507,12 @@ declare function toConnectionStatus(queryStatus: string): ConnectionStatus;
  * request-size accident. Callers do nothing differently either way.
  *
  * Two scopes are supported via the `scope` option:
- *   - `'self'` (default): per-user storage. Reads require auth.
+ *   - `'self'` (default): per-user storage. Reads are private to the owner:
+ *     the URL works in `<img>`/`<audio>`/`<video>` for the signed-in user of
+ *     this origin (the session cookie identifies the load), and for nobody
+ *     else.
  *   - `'app'`: app-wide storage. Reads are public — the upload URL works
- *     directly as an `<img src>`. Use for avatars, logos, etc.
+ *     for anyone, embedded anywhere. Use for logos, shared assets, etc.
  *
  * @example
  * ```tsx
@@ -3665,9 +3672,12 @@ interface UseR2FilesReturn {
     /**
      * Build a plain URL for a file. Accepts an R2FileInfo or a raw key string.
      *
-     * **Note**: This URL has no auth token attached. It works for `'app'`-scope
-     * files (which are publicly readable) but not for `'self'`-scope files —
-     * those require an Authorization header, so use `readFile` / `downloadFile`.
+     * No token travels in the URL. An `'app'`-scope URL is readable by anyone.
+     * A `'self'`-scope URL renders in `<img>`/`<audio>`/`<video>` for the
+     * signed-in user on this origin only (see {@link R2Scope}); showing one
+     * user's private file to another user is app-level authorization, not
+     * something this URL can grant. Use `readFile` / `downloadFile` for the
+     * bytes in code.
      */
     getUrl: (fileOrKey: R2FileInfo | string) => string;
     /** Whether an upload is currently in progress. */
@@ -3677,12 +3687,15 @@ interface UseR2FilesReturn {
  * Scope controls where files live and who can read them:
  *
  *  - `'self'` (default) — `apps/<app>/users/<userId>/…`. Per-user storage.
- *    Reads require the caller's auth token; not usable from a plain `<img>`
- *    or unauthenticated browser request.
+ *    Reads need the caller's bearer token, or — for a plain `<img>`,
+ *    `<audio>`, or `<video>` load from this origin — the signed-in user's
+ *    session cookie. Nobody else can read the URL, and it cannot be
+ *    embedded from another origin; browsers that send no `Sec-Fetch-Site`
+ *    (Safari before 16.4) and cross-site links receive 401 by design.
  *  - `'app'` — `apps/<app>/…`. Shared by everyone in the app. Reads are
- *    public (no auth header needed), so the upload URL works directly as
- *    an `<img src>`. Use this for avatars, logos, attachments, and other
- *    assets meant to be embedded in pages.
+ *    public (no auth at all), so the upload URL works as an `<img src>`
+ *    anywhere. Use this for logos, attachments, and other assets meant to
+ *    be embedded in pages for everyone.
  *
  * Uploads under `'app'` still require a signed-in user.
  */
@@ -4650,4 +4663,4 @@ declare const ACCOUNT_STORAGE_LIMIT_BYTES: {
 declare function storageLimitForTier(tier: string | null | undefined): number;
 declare function formatBytes(bytes: number): string;
 
-export { ACCOUNT_STORAGE_LIMIT_BYTES, ACTION_ROUTES_BEARER_GUARD_MIGRATION_ID, ACTION_TOOLS_DELETE_WHERE_MIGRATION_ID, ANONYMOUS_USER_ID_PREFIX, APP_LOG_EVENT_KEYS, ASYNC_RESOURCE_DEFAULTS, type AdHocChargeOpts, type AiStreamAction, type AiStreamChunk, type ApiErrorIssue, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppMigrationIdsValidation, type AsyncResourceDefaults, type AsyncResourceState, type AsyncResourceStatus, AuthGate, type AuthGateProps, AuthOverlay, Awareness, type AwarenessState, type AwarenessStates, BUILD_INJECTED_APP_ID_MIGRATION_ID, type BaseMessage, type CanvasShapeClient, type Channel, type ChannelMember, type ChargeOnceOpts, type ChargeOnceResult, type ClientMessage, type CollectionSchema, type ConnectionAttachment, type ConnectionStatus, type CronHistoryEntry, type CronMutationResult, type CronTaskState, DEEPSPACE_AGENT_PROFILES, DEEPSPACE_AI_DEFAULTS, DEEPSPACE_AI_MODELS, DEEPSPACE_MODEL_CATALOG_PROVENANCE, DEEPSPACE_THEME_PROPERTIES, DEFAULT_USER_COLORS, type DeepSpaceAIModel, type DeepSpaceAIModelId, type DeepSpaceAIProvider, type DeepSpaceAgentProfile, type DeepSpaceAgentProfileId, type DeepSpaceAgentSupport, DeepSpaceAuthProvider, type DeepSpaceThemeConfig, DeepSpaceThemeProvider, type DeepSpaceThemeProviderProps, type DeriveLoadStateInput, ENV, type Environment, type FileAttachment, type GroupedReaction, GuestBanner, type HandlerContext, type IntegrationResponse, type JobStatusView, type JobView, LOG_LEVELS, type LoadState, type LoadStateAuthInput, type LoadStateStatusInput, type LogLevel, MAX_LOG_TEXT_LENGTH, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type Message, type MessageHandlers, type MsgType, type NormalizedApiError, type PagedResourceFetchArgs, type PagedResourcePage, type PagedResourceState, type PagedResourceStatus, type PlanInfo, PlatformApiError, type PresencePeerClient, PricingTable, type PricingTablePlan, type PricingTablePrice, type ProductChargeOpts, type ProtocolMessage, type Purchase, type Query, type R2FileInfo, type R2FileListPage, type R2Scope, type R2UploadResult, RECORD_NOT_FOUND, ROLES, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_CONFIG, ROLE_DEFAULT, type Reaction, type ReadReceipt, type RecordData, RecordProvider, type RecordProviderProps, RecordRoomNotReadyError, RecordScope, type RequestOptions, type ResolvedDeepSpaceAgentModel, type Role, type RoomUser, SECURE_ROOM_BOUNDARIES_MIGRATION_ID, type ScopeEntry, ScopeRegistryProvider, type ServerMessage, SignedIn, SignedOut, type SubscribeOpts, type SubscribeResult, type SubscriptionState, type SubscriptionStatus, type SyncResult, type UseAsyncResourceOptions, type UseAuthProfileReadyOptions, type UseAuthStatusOptions, type UseCanvasResult, type UseCheckoutOpts, type UseCronMonitorResult, type UseJobsResult, type UsePagedResourceOptions, type UsePresenceRoomResult, type UseR2FilesReturn, type UseVoiceAgentOptions, type UseVoiceAgentResult, type UseYjsFieldResult, type UseYjsRoomResult, type UseYjsTextResult, type User, type UserCredits, type UserInfo, type UserKarma, type UserProfile, type ViewportClient, type VoiceStatus, type VoiceTranscriptEntry, WORKER_OWNED_NOT_FOUND_MIGRATION_ID, type WriteError, applyDeepSpaceTheme, applyUIThemeTokens, authClient, canAutoLoadPagedResource, clampPagedResourceItems, clearAuthToken, clearDeepSpaceTheme, clientBuild, createDecoder, createEncoder, decodeAiStreamChunk, deriveLoadState, detectEnvironment, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, formatBytes, formatFileSize, getApiUrl, getAuthToken, getAuthUrl, getDeepSpaceAIModel, getEnvironmentConfig, getMessageType, getPagedResourceCooldownMs, getPlatformWorkerUrl, getUserColor, handleAwarenessMessage, handleSyncMessage, hasContent, integration, isAnonymousUserId, isAsyncResourceSlow, isDarkColor, isImageFile, isLocalDev, isProduction, isWriterRole, listDeepSpaceAgentModels, logEventText, loggableError, parseSseLine, readThemeFromDOM, readVarUint, readVarUint8Array, resetEnvironmentCache, resolveDeepSpaceAgentModel, serverBuild, signIn, signOut, storageLimitForTier, toConnectionStatus, toUint8Array, truncateLogText, useAsyncResource, useAuth, useAuthProfileReady, useAuthStatus, useAuthUser, useCanvas, useChannelMembers, useChannels, useCheckout, useCronMonitor, useDisplayName, useIsDarkTheme, useJobs, useMessages, useMutations, usePagedResource, usePresence, usePresenceRoom, useQuery, useR2Files, useReactions, useReadReceipts, useRecordContext, useSession, useSubscription, useUser, useUserLookup, useUsers, useVoiceAgent, useYjsField, useYjsRoom, useYjsText, validateAppMigrationIds, writeVarUint, writeVarUint8Array };
+export { ACCOUNT_STORAGE_LIMIT_BYTES, ACTION_ROUTES_BEARER_GUARD_MIGRATION_ID, ACTION_TOOLS_DELETE_WHERE_MIGRATION_ID, ANONYMOUS_USER_ID_PREFIX, APP_LOG_EVENT_KEYS, ASYNC_RESOURCE_DEFAULTS, type AdHocChargeOpts, type AiStreamAction, type AiStreamChunk, type ApiErrorIssue, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppMigrationIdsValidation, type AsyncResourceDefaults, type AsyncResourceState, type AsyncResourceStatus, AuthGate, type AuthGateProps, AuthOverlay, Awareness, type AwarenessState, type AwarenessStates, BUILD_INJECTED_APP_ID_MIGRATION_ID, type BaseMessage, type CanvasShapeClient, type Channel, type ChannelMember, type ChargeOnceOpts, type ChargeOnceResult, type ClientMessage, type CollectionSchema, type ConnectionAttachment, type ConnectionStatus, type CronHistoryEntry, type CronMutationResult, type CronTaskState, DEEPSPACE_AGENT_PROFILES, DEEPSPACE_AI_DEFAULTS, DEEPSPACE_AI_MODELS, DEEPSPACE_MODEL_CATALOG_PROVENANCE, DEEPSPACE_THEME_PROPERTIES, DEFAULT_USER_COLORS, type DeepSpaceAIModel, type DeepSpaceAIModelId, type DeepSpaceAIProvider, type DeepSpaceAgentProfile, type DeepSpaceAgentProfileId, type DeepSpaceAgentSupport, DeepSpaceAuthProvider, type DeepSpaceThemeConfig, DeepSpaceThemeProvider, type DeepSpaceThemeProviderProps, type DeriveLoadStateInput, ENV, type Environment, FILES_SESSION_COOKIE_READS_MIGRATION_ID, type FileAttachment, type GroupedReaction, GuestBanner, type HandlerContext, type IntegrationResponse, type JobStatusView, type JobView, LOG_LEVELS, type LoadState, type LoadStateAuthInput, type LoadStateStatusInput, type LogLevel, MAX_LOG_TEXT_LENGTH, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type Message, type MessageHandlers, type MsgType, type NormalizedApiError, type PagedResourceFetchArgs, type PagedResourcePage, type PagedResourceState, type PagedResourceStatus, type PlanInfo, PlatformApiError, type PresencePeerClient, PricingTable, type PricingTablePlan, type PricingTablePrice, type ProductChargeOpts, type ProtocolMessage, type Purchase, type Query, type R2FileInfo, type R2FileListPage, type R2Scope, type R2UploadResult, RECORD_NOT_FOUND, ROLES, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_CONFIG, ROLE_DEFAULT, type Reaction, type ReadReceipt, type RecordData, RecordProvider, type RecordProviderProps, RecordRoomNotReadyError, RecordScope, type RequestOptions, type ResolvedDeepSpaceAgentModel, type Role, type RoomUser, SECURE_ROOM_BOUNDARIES_MIGRATION_ID, type ScopeEntry, ScopeRegistryProvider, type ServerMessage, SignedIn, SignedOut, type SubscribeOpts, type SubscribeResult, type SubscriptionState, type SubscriptionStatus, type SyncResult, type UseAsyncResourceOptions, type UseAuthProfileReadyOptions, type UseAuthStatusOptions, type UseCanvasResult, type UseCheckoutOpts, type UseCronMonitorResult, type UseJobsResult, type UsePagedResourceOptions, type UsePresenceRoomResult, type UseR2FilesReturn, type UseVoiceAgentOptions, type UseVoiceAgentResult, type UseYjsFieldResult, type UseYjsRoomResult, type UseYjsTextResult, type User, type UserCredits, type UserInfo, type UserKarma, type UserProfile, type ViewportClient, type VoiceStatus, type VoiceTranscriptEntry, WORKER_OWNED_NOT_FOUND_MIGRATION_ID, type WriteError, applyDeepSpaceTheme, applyUIThemeTokens, authClient, canAutoLoadPagedResource, clampPagedResourceItems, clearAuthToken, clearDeepSpaceTheme, clientBuild, createDecoder, createEncoder, decodeAiStreamChunk, deriveLoadState, detectEnvironment, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, formatBytes, formatFileSize, getApiUrl, getAuthToken, getAuthUrl, getDeepSpaceAIModel, getEnvironmentConfig, getMessageType, getPagedResourceCooldownMs, getPlatformWorkerUrl, getUserColor, handleAwarenessMessage, handleSyncMessage, hasContent, integration, isAnonymousUserId, isAsyncResourceSlow, isDarkColor, isImageFile, isLocalDev, isProduction, isWriterRole, listDeepSpaceAgentModels, logEventText, loggableError, parseSseLine, readThemeFromDOM, readVarUint, readVarUint8Array, resetEnvironmentCache, resolveDeepSpaceAgentModel, serverBuild, signIn, signOut, storageLimitForTier, toConnectionStatus, toUint8Array, truncateLogText, useAsyncResource, useAuth, useAuthProfileReady, useAuthStatus, useAuthUser, useCanvas, useChannelMembers, useChannels, useCheckout, useCronMonitor, useDisplayName, useIsDarkTheme, useJobs, useMessages, useMutations, usePagedResource, usePresence, usePresenceRoom, useQuery, useR2Files, useReactions, useReadReceipts, useRecordContext, useSession, useSubscription, useUser, useUserLookup, useUsers, useVoiceAgent, useYjsField, useYjsRoom, useYjsText, validateAppMigrationIds, writeVarUint, writeVarUint8Array };

package/dist/index.js

@@ -756,6 +756,7 @@ var SECURE_ROOM_BOUNDARIES_MIGRATION_ID = "2026-08-secure-room-boundaries";
 var ACTION_TOOLS_DELETE_WHERE_MIGRATION_ID = "2026-08-action-tools-delete-where";
 var BUILD_INJECTED_APP_ID_MIGRATION_ID = "2026-08-build-injected-app-id";
 var ACTION_ROUTES_BEARER_GUARD_MIGRATION_ID = "2026-08-action-routes-bearer-guard";
+var FILES_SESSION_COOKIE_READS_MIGRATION_ID = "2026-09-files-session-cookie-reads";
 function validateAppMigrationIds(value) {
   if (!Array.isArray(value)) {
     return { valid: false, reason: "app migrations must be a JSON string array" };
@@ -3866,7 +3867,10 @@ function useR2Files(options) {
         const headers = await authHeaders();
         const response = await fetch(getUrl(key), { headers });
         if (!response.ok) {
-          return { success: false, error: describeFilesFailure(response.status, await response.text()) };
+          return {
+            success: false,
+            error: describeFilesFailure(response.status, await response.text())
+          };
         }
         const disposition = response.headers.get("Content-Disposition");
         const dispositionName = disposition?.match(/filename="(.+?)"/)?.[1];
@@ -5696,6 +5700,7 @@ export {
   DeepSpaceAuthProvider,
   DeepSpaceThemeProvider,
   ENV,
+  FILES_SESSION_COOKIE_READS_MIGRATION_ID,
   GuestBanner,
   LOG_LEVELS,
   MAX_LOG_TEXT_LENGTH,