deepspace 0.33.1 → 0.35.0

package/dist/cli.js

@@ -676,27 +676,62 @@ function findUnknownCommand(argv, rootCommands) {
   return null;
 }
 
+// src/shared/planes.ts
+var PLANES = {
+  production: {
+    auth: "https://auth.deep.space",
+    api: "https://api-worker.deep.space",
+    platform: "https://platform-worker.deep.space",
+    deploy: "https://deploy-worker.deep.space",
+    appDomain: "app.space",
+    platformDomain: "deep.space",
+    home: "https://deep.space",
+    dashboard: "https://dashboard.deep.space",
+    privacyPolicy: "https://deep.space/privacy"
+  },
+  // Services on deepspacesites.com, apps on spacestest.com: production's
+  // two-zone split, because a Worker cannot fetch one in its own zone.
+  staging: {
+    auth: "https://auth.deepspacesites.com",
+    api: "https://api.deepspacesites.com",
+    platform: "https://platform.deepspacesites.com",
+    deploy: "https://deploy.deepspacesites.com",
+    appDomain: "spacestest.com",
+    platformDomain: "deepspacesites.com",
+    home: "https://spacestest.com",
+    dashboard: "https://dashboard.deepspacesites.com",
+    privacyPolicy: "https://deep.space/privacy"
+  },
+  // Services on deepspacemedical.com, apps on deepspacemedical.app: two zones
+  // in the medical Cloudflare account. The plane has no dashboard.
+  medical: {
+    auth: "https://auth.deepspacemedical.com",
+    api: "https://api.deepspacemedical.com",
+    platform: "https://platform.deepspacemedical.com",
+    deploy: "https://deploy.deepspacemedical.com",
+    appDomain: "deepspacemedical.app",
+    platformDomain: "deepspacemedical.com",
+    home: "https://deepspacemedical.com",
+    dashboard: null,
+    privacyPolicy: "https://deepspacemedical.com/privacy"
+  }
+};
+
 // src/cli/env.ts
 function resolveDeepSpaceEnvironment(value) {
   if (value === void 0 || value === "production") return "production";
   if (value === "staging") return "staging";
+  if (value === "medical") return "medical";
   return "invalid";
 }
 var DEEPSPACE_ENV = resolveDeepSpaceEnvironment(process.env.DEEPSPACE_ENV);
-var PROD_URLS = {
-  auth: "https://auth.deep.space",
-  api: "https://api-worker.deep.space",
-  platform: "https://platform-worker.deep.space",
-  deploy: "https://deploy-worker.deep.space"
-};
-var STAGING_URLS = {
-  // Services live on deepspacesites.com, apps on spacestest.com. This mirrors
-  // prod's two-zone split because a Worker cannot fetch one in its own zone.
-  auth: "https://auth.deepspacesites.com",
-  api: "https://api.deepspacesites.com",
-  platform: "https://platform.deepspacesites.com",
-  deploy: "https://deploy.deepspacesites.com"
+var serviceUrls = (plane) => {
+  const { auth: auth2, api: api4, platform, deploy } = PLANES[plane];
+  return { auth: auth2, api: api4, platform, deploy };
 };
+var PROD_URLS = serviceUrls("production");
+var STAGING_URLS = serviceUrls("staging");
+var MEDICAL_URLS = serviceUrls("medical");
 var INVALID_URLS = {
   auth: "http://127.0.0.1:9",
   api: "http://127.0.0.1:9",
@@ -704,19 +739,21 @@ var INVALID_URLS = {
   deploy: "http://127.0.0.1:9"
 };
 function appDomainForEnv(env) {
-  return env === "production" ? "app.space" : env === "staging" ? "spacestest.com" : null;
+  return env === "invalid" ? null : PLANES[env].appDomain;
 }
 function platformDomainForEnv(env) {
-  return env === "production" ? "deep.space" : env === "staging" ? "deepspacesites.com" : null;
+  return env === "invalid" ? null : PLANES[env].platformDomain;
 }
-var PLATFORM_URLS = DEEPSPACE_ENV === "production" ? PROD_URLS : DEEPSPACE_ENV === "staging" ? STAGING_URLS : INVALID_URLS;
+var PLATFORM_URLS = DEEPSPACE_ENV === "production" ? PROD_URLS : DEEPSPACE_ENV === "staging" ? STAGING_URLS : DEEPSPACE_ENV === "medical" ? MEDICAL_URLS : INVALID_URLS;
 var PLANE_URLS = {
   production: PROD_URLS,
-  staging: STAGING_URLS
+  staging: STAGING_URLS,
+  medical: MEDICAL_URLS
 };
 var PLANE_AUTH_URLS = {
   production: PLANE_URLS.production.auth,
-  staging: PLANE_URLS.staging.auth
+  staging: PLANE_URLS.staging.auth,
+  medical: PLANE_URLS.medical.auth
 };
 function effectivePlatformUrls(env = process.env) {
   return {
@@ -732,7 +769,7 @@ var {
   platform: PLATFORM_URL,
   deploy: DEPLOY_URL
 } = effectivePlatformUrls();
-var DASHBOARD_URL = DEEPSPACE_ENV === "production" ? "https://dashboard.deep.space" : DEEPSPACE_ENV === "staging" ? "https://dashboard.deepspacesites.com" : "http://127.0.0.1:9";
+var DASHBOARD_URL = DEEPSPACE_ENV === "invalid" ? "http://127.0.0.1:9" : PLANES[DEEPSPACE_ENV].dashboard;
 
 // src/cli/auth.ts
 import { readFileSync as readFileSync2, existsSync, mkdirSync } from "fs";
@@ -1014,7 +1051,7 @@ var login_default = defineDeepspaceCommand({
       const who = await doEmailLogin(email, password);
       if (!json) {
         console.log(`Logged in as ${who.email} (${who.userId})`);
-        console.log(`Dashboard: ${DASHBOARD_URL}`);
+        if (DASHBOARD_URL) console.log(`Dashboard: ${DASHBOARD_URL}`);
       }
       return { data: { email: who.email, userId: who.userId } };
     }
@@ -1057,13 +1094,15 @@ var login_default = defineDeepspaceCommand({
     if (!json) {
       s.stop("Authenticated");
       p4.log.success(`Logged in as ${result.name ?? result.email}`);
-      p4.note(
-        `Manage your account, deployed apps, billing, and subscription
+      if (DASHBOARD_URL) {
+        p4.note(
+          `Manage your account, deployed apps, billing, and subscription
 plans on the web dashboard:
 
   ${DASHBOARD_URL}`,
-        "Dashboard"
-      );
+          "Dashboard"
+        );
+      }
       p4.outro("Done");
     }
     return { data: { email: result.email, userId } };
@@ -1686,9 +1725,8 @@ import { existsSync as existsSync6 } from "fs";
 import { tmpdir } from "os";
 import { isAbsolute as isAbsolute2, relative, resolve as resolve3 } from "path";
 function spaceRemoteName(environment = DEEPSPACE_ENV) {
-  if (environment === "staging") return "space-staging";
   if (environment === "production") return "space";
-  return "space-invalid";
+  return `space-${environment}`;
 }
 var SPACE_REMOTE = spaceRemoteName();
 function spaceTrackingRef(branch, remote = SPACE_REMOTE) {
@@ -1724,7 +1762,7 @@ function entryIsTransient(cwd) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
 }
 function helperEntryUsable(command) {
-  const match = /^!(?:DEEPSPACE_ENV=(production|staging) )?'([^']*)' '([^']*)' git-credential$/.exec(command);
+  const match = /^!(?:DEEPSPACE_ENV=(production|staging|medical) )?'([^']*)' '([^']*)' git-credential$/.exec(command);
   const expectedEnvironment = DEEPSPACE_ENV === "production" ? void 0 : DEEPSPACE_ENV;
   if (!match || match[1] !== expectedEnvironment) return false;
   return existsSync6(match[2]) && existsSync6(match[3]);
@@ -1732,7 +1770,7 @@ function helperEntryUsable(command) {
 function credentialHelperCommand(environment = DEEPSPACE_ENV) {
   const entry = process.argv[1];
   if (!entry) throw new Error("CLI entry path is unavailable");
-  const environmentPrefix = environment === "staging" ? "DEEPSPACE_ENV=staging " : "";
+  const environmentPrefix = environment === "staging" || environment === "medical" ? `DEEPSPACE_ENV=${environment} ` : "";
   return `!${environmentPrefix}${shQuote(process.execPath)} ${shQuote(entry)} git-credential`;
 }
 function installCredentialHelper(cwd, url) {
@@ -4482,10 +4520,9 @@ import { existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as re
 import { homedir as homedir2 } from "os";
 import { join as join13 } from "path";
 var TEST_ACCOUNTS_PATH = join13(homedir2(), ".deepspace", "test-accounts.json");
-var PRODUCTION_AUTH_ORIGIN = "https://auth.deep.space";
-var STAGING_AUTH_ORIGIN = "https://auth.deepspacesites.com";
 function currentTestAccountScope(env = process.env) {
-  const selected = env.DEEPSPACE_AUTH_URL ?? (env.DEEPSPACE_ENV === "staging" ? STAGING_AUTH_ORIGIN : PRODUCTION_AUTH_ORIGIN);
+  const plane = env.DEEPSPACE_ENV;
+  const selected = env.DEEPSPACE_AUTH_URL ?? (plane === "staging" || plane === "medical" ? PLANES[plane].auth : PLANES.production.auth);
   return normalizeTestAccountScope(selected);
 }
 function normalizeTestAccountScope(value) {
@@ -5753,6 +5790,7 @@ var ACTION_TOOLS_DELETE_WHERE_MIGRATION_ID = "2026-08-action-tools-delete-where"
 var BUILD_INJECTED_APP_ID_MIGRATION_ID = "2026-08-build-injected-app-id";
 var ACTION_ROUTES_BEARER_GUARD_MIGRATION_ID = "2026-08-action-routes-bearer-guard";
 var FILES_SESSION_COOKIE_READS_MIGRATION_ID = "2026-09-files-session-cookie-reads";
+var AI_SDK_7_MIGRATION_ID = "2026-09-ai-sdk-7";
 function validateAppMigrationIds(value) {
   if (!Array.isArray(value)) {
     return { valid: false, reason: "app migrations must be a JSON string array" };
@@ -5816,6 +5854,12 @@ var APP_MIGRATION_GUIDANCE = [
     description: "Let private file URLs render in <img>/<audio>/<video> for the signed-in user",
     files: ["the app-owned HTTP route file that proxies /api/files/*"],
     guidance: "In the /api/files/* proxy only, replace `const auth = await resolveAuth(c.req.raw, c.env)` with `const auth = (await resolveAuth(c.req.raw, c.env)) ?? (await resolveSessionReadAuth(c.req.raw, c.env))`, importing resolveSessionReadAuth from 'deepspace/worker'. It identifies same-origin GET/HEAD by the app-origin session cookie and returns null for everything else. Do not add it to resolveAuth, which also gates writes. In the same route, skip the JSON URL rewrite for HEAD: change `if (contentType.includes('application/json'))` to `if (contentType.includes('application/json') && c.req.method !== 'HEAD')`, because a HEAD answer carries the content-type but no body and parsing it would turn every failed media probe into a 500."
+  },
+  {
+    id: AI_SDK_7_MIGRATION_ID,
+    description: "Move the app's own AI code to AI SDK 7",
+    files: ["src/ai/chat-routes.ts", 'every other file importing from "ai"'],
+    guidance: "Run `npx @ai-sdk/codemod v7 src` and review its diff: it renames `system` to `instructions` in ANY object, including non-AI-SDK request bodies, so revert those. Then by hand: in the chat route's `onEnd` (formerly `onFinish`), persist `responseMessages` \u2014 `response.messages` now holds only the final step, which drops earlier tool calls \u2014 and since `onEnd` no longer runs after an abort, also persist in `onAbort({ steps })` from the completed steps' `response.messages`. Replace `result.toUIMessageStreamResponse(options)` with `createUIMessageStreamResponse({ headers, stream: toUIMessageStream({ stream: result.stream, ...options }) })` imported from 'ai'. A tool's `execute` options now include `context`. `role: 'system'` messages inside `messages` are rejected unless the call sets `allowSystemInMessages: true`."
   }
 ];
 var APP_MIGRATION_DEFINITIONS = APP_MIGRATION_GUIDANCE.map(({ id, description }) => ({
@@ -5867,14 +5911,18 @@ async function buildDeployBundle(options) {
   let preparedWranglerConfig;
   try {
     preparedWranglerConfig = prepareWranglerEnvConfig(appDir, envName);
-    const appDomain = DEEPSPACE_ENV === "staging" ? "spacestest.com" : "app.space";
+    const appDomain = appDomainForEnv(DEEPSPACE_ENV) ?? "app.space";
     execSync2("npx vite build", {
       cwd: appDir,
       stdio: "pipe",
       env: {
         ...wranglerViteEnv(process.env, preparedWranglerConfig),
         // The Vite plugin's one documentation compile stamps release URLs.
-        DEEPSPACE_DOCUMENTATION_BASE_URL: `https://${appName}.${appDomain}/docs`
+        DEEPSPACE_DOCUMENTATION_BASE_URL: `https://${appName}.${appDomain}/docs`,
+        // The scaffold's build-time prerender (prerender.ts) builds canonical
+        // URLs and the sitemap on this, so a staging deploy resolves to
+        // spacestest.com instead of the wrangler name on app.space.
+        DEEPSPACE_SITE_ORIGIN: `https://${appName}.${appDomain}`
       }
     });
   } catch (error) {
@@ -8256,7 +8304,7 @@ var whoami_default = defineDeepspaceCommand({
       if (payload.exp) {
         console.log(`Expires:    ${new Date(payload.exp * 1e3).toISOString()} (renews on use)`);
       }
-      console.log(`Dashboard:  ${DASHBOARD_URL}`);
+      if (DASHBOARD_URL) console.log(`Dashboard:  ${DASHBOARD_URL}`);
       if (isTestAccount) {
         console.log("");
         console.log("Note: this is a test account, not a real OAuth developer.");
@@ -8733,8 +8781,10 @@ function renderSummary(summary) {
       );
     }
   }
-  lines.push("");
-  lines.push(`Dashboard: ${DASHBOARD_URL}`);
+  if (DASHBOARD_URL) {
+    lines.push("");
+    lines.push(`Dashboard: ${DASHBOARD_URL}`);
+  }
   return lines.join("\n");
 }
 var usage_default = defineDeepspaceCommand({
@@ -10993,9 +11043,19 @@ function formatCurrency(value, currency) {
   return `${value} ${currency}`;
 }
 function priceLabel(billing) {
-  if (billing.baseCost === null) return "metered at the provider's actual cost";
-  const figure = `${formatCurrency(billing.baseCost, billing.currency)} ${billingUnit(billing.model)}`;
-  return billing.variesWithInput ? `base ${figure} (some inputs cost less or more)` : figure;
+  if (billing.baseCost === null) {
+    const price2 = "metered at the provider's actual cost plus platform markup";
+    return billing.freeTierPriceDiffers ? `${price2}; free-tier pricing differs` : price2;
+  }
+  const tokenScale = billing.model === "per_token" ? 1e6 : 1;
+  const unit = billing.model === "per_token" ? "per 1M tokens" : billingUnit(billing.model);
+  const paidCost = (billing.paidBaseCost ?? billing.baseCost) * tokenScale;
+  const figure = `${formatCurrency(paidCost, billing.currency)} ${unit}`;
+  const price = billing.variesWithInput ? `base ${figure} (some inputs cost less or more)` : figure;
+  if (!billing.freeTierPriceDiffers) return price;
+  const freeFigure = `${formatCurrency(billing.baseCost * tokenScale, billing.currency)} ${unit}`;
+  const freePrice = billing.variesWithInput ? `base ${freeFigure} (some inputs cost less or more)` : freeFigure;
+  return `paid tier: ${price}; free tier: ${freePrice}`;
 }
 function billingUnit(model) {
   if (model === "per_token") return "per token";
@@ -11561,14 +11621,31 @@ async function requestJson(url, init, token, timeout) {
     clearTimeout(timer);
   }
 }
+var MAX_DETAIL_TEXT = 2e3;
+var DETAIL_PROSE_KEYS = /* @__PURE__ */ new Set(["error", "detail", "guidance", "message"]);
+function describeDetail(detail) {
+  const parts = [];
+  for (const [key, value] of Object.entries(detail)) {
+    if (value === void 0 || value === null || value === "") continue;
+    const prose = typeof value === "string" && DETAIL_PROSE_KEYS.has(key);
+    parts.push(prose ? value : `${key}: ${JSON.stringify(value)}`);
+  }
+  const text2 = parts.join(" ");
+  return text2.length > MAX_DETAIL_TEXT ? `${text2.slice(0, MAX_DETAIL_TEXT)}\u2026` : text2;
+}
 function httpRefusal(response, tokens) {
   const server = isRecord(response.body) ? response.body : void 0;
   const code = safeServerCode(server?.code);
-  const message = typeof server?.error === "string" ? redact(server.error, tokens).slice(0, 500) : "";
+  const baseMessage = typeof server?.error === "string" ? redact(server.error, tokens).slice(0, 500) : "";
+  const redactedDetail = isRecord(server?.detail) ? redactValue(server.detail, tokens) : void 0;
+  const detail = isRecord(redactedDetail) ? { extra: { detail: redactedDetail } } : {};
+  const detailText = isRecord(redactedDetail) ? describeDetail(redactedDetail) : "";
+  const message = detailText ? `${baseMessage} ${detailText}`.trim() : baseMessage;
   if (response.status === 403) {
     return new Refusal(
       message || "You are not allowed to use this app agent.",
-      code ?? "agent_forbidden"
+      code ?? "agent_forbidden",
+      detail
     );
   }
   if (response.status === 404 && !server) {
@@ -11579,7 +11656,8 @@ function httpRefusal(response, tokens) {
   }
   return new Refusal(
     message || `App agent request failed (${response.status}).`,
-    code ?? (response.status === 404 ? "agent_endpoint_not_found" : "agent_request_failed")
+    code ?? (response.status === 404 ? "agent_endpoint_not_found" : "agent_request_failed"),
+    detail
   );
 }
 async function callAgent(target2, path, init, timeout) {
@@ -11899,7 +11977,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
       } else {
         console.log(`Submitted feedback ${result.report.id} (${result.report.type}).`);
       }
-      console.log(`Track triage status at ${DASHBOARD_URL}.`);
+      if (DASHBOARD_URL) console.log(`Track triage status at ${DASHBOARD_URL}.`);
     }
     return { data: { report: result.report } };
   }
@@ -16045,7 +16123,7 @@ import { join as join28, resolve as resolve22 } from "path";
 // package.json
 var package_default = {
   name: "deepspace",
-  version: "0.33.1",
+  version: "0.35.0",
   engines: {
     node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
   },
@@ -16086,6 +16164,10 @@ var package_default = {
       types: "./dist/build.d.ts",
       import: "./dist/build.js"
     },
+    "./expo": {
+      types: "./dist/expo.d.ts",
+      import: "./dist/expo.js"
+    },
     "./documentation": {
       types: "./dist/documentation.d.ts",
       import: "./dist/documentation.js"
@@ -16102,26 +16184,26 @@ var package_default = {
   ],
   scripts: {
     build: "node ../../scripts/clean-artifacts.mjs dist --tsbuildinfo && tsup",
-    "type-check": "tsc --noEmit",
+    "type-check": "tsc --noEmit && tsc --noEmit -p tsconfig.expo.json",
     test: "vitest run",
     "test:documentation-browser": "playwright test --config src/documentation/runtime/__browser__/playwright.config.ts",
     clean: "node ../../scripts/clean-artifacts.mjs dist --tsbuildinfo",
     prepublishOnly: "pnpm build"
   },
   dependencies: {
-    "@ai-sdk/anthropic": "2.0.91",
-    "@ai-sdk/openai": "2.0.116",
-    "@ai-sdk/openai-compatible": "1.0.46",
+    "@ai-sdk/anthropic": "4.0.58",
+    "@ai-sdk/openai": "4.0.71",
+    "@ai-sdk/openai-compatible": "3.0.53",
     "@clack/prompts": "^1.2.0",
     "@mdx-js/mdx": "^3.1.1",
     acorn: "^8.16.0",
-    ai: "5.0.222",
+    ai: "7.0.107",
     "better-auth": "1.6.23",
     citty: "^0.2.0",
     "cross-spawn": "^7.0.6",
     esbuild: "^0.27.0",
     "highlight.js": "^11.11.1",
-    hono: "^4.12.34",
+    hono: "^4.13.7",
     jose: "^6.1.0",
     marked: "^18.0.7",
     "mdast-util-gfm": "^3.1.0",
@@ -16130,7 +16212,7 @@ var package_default = {
     "remark-frontmatter": "^5.0.0",
     "remark-gfm": "^4.0.1",
     "sanitize-html": "^2.17.7",
-    "smol-toml": "^1.6.1",
+    "smol-toml": "^1.7.1",
     yaml: "^2.9.0",
     yjs: "^13.6.0",
     zod: "^4.3.6"
@@ -16141,7 +16223,11 @@ var package_default = {
     "lucide-react": ">=0.400.0",
     react: "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
-    "tailwind-merge": ">=2.0.0"
+    "tailwind-merge": ">=2.0.0",
+    "expo-crypto": "~57.0.0",
+    "expo-linking": "~57.0.0",
+    "expo-secure-store": "~57.0.0",
+    "expo-web-browser": "~57.0.0"
   },
   peerDependenciesMeta: {
     "@playwright/test": {
@@ -16161,6 +16247,18 @@ var package_default = {
     },
     "lucide-react": {
       optional: true
+    },
+    "expo-crypto": {
+      optional: true
+    },
+    "expo-linking": {
+      optional: true
+    },
+    "expo-secure-store": {
+      optional: true
+    },
+    "expo-web-browser": {
+      optional: true
     }
   },
   devDependencies: {
@@ -16554,7 +16652,7 @@ function assertKnownOptions(argv) {
 var rawArgs = process.argv.slice(2);
 var wantsHelp = rawArgs.some((arg) => arg === "--help" || arg === "-h");
 if (DEEPSPACE_ENV === "invalid") {
-  const error = `Invalid DEEPSPACE_ENV=${JSON.stringify(process.env.DEEPSPACE_ENV)}. Use \`staging\`, \`production\`, or unset it; refusing to default to production.`;
+  const error = `Invalid DEEPSPACE_ENV=${JSON.stringify(process.env.DEEPSPACE_ENV)}. Use \`production\`, \`staging\`, \`medical\`, or unset it; refusing to default to production.`;
   if (rawArgs.includes("--json") && !wantsHelp) {
     console.log(JSON.stringify({ ok: false, code: "invalid_environment", error }));
   } else {