@spacefast/common 0.0.10 → 0.0.12

package/dist/contracts/access.d.ts

@@ -210,6 +210,7 @@ export declare const ruleMatchSchema: z.ZodObject<{
     ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
     agent: z.ZodOptional<z.ZodString>;
     country: z.ZodOptional<z.ZodString>;
+    countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
     header: z.ZodOptional<z.ZodObject<{
         name: z.ZodString;
         value: z.ZodString;
@@ -235,6 +236,7 @@ export declare const runtimeRuleSchema: z.ZodObject<{
         ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         agent: z.ZodOptional<z.ZodString>;
         country: z.ZodOptional<z.ZodString>;
+        countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
         header: z.ZodOptional<z.ZodObject<{
             name: z.ZodString;
             value: z.ZodString;
@@ -293,6 +295,9 @@ export declare const accessTokenPayloadSchema: z.ZodObject<{
     aud: z.ZodOptional<z.ZodString>;
     sv: z.ZodOptional<z.ZodNumber>;
     jti: z.ZodOptional<z.ZodString>;
+    room: z.ZodOptional<z.ZodString>;
+    anonymous_id: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type AccessTokenPayload = z.infer<typeof accessTokenPayloadSchema>;
 export declare const authorizeRequestSchema: z.ZodObject<{
@@ -310,6 +315,9 @@ export declare const authorizeResponseSchema: z.ZodObject<{
         aud: z.ZodOptional<z.ZodString>;
         sv: z.ZodOptional<z.ZodNumber>;
         jti: z.ZodOptional<z.ZodString>;
+        room: z.ZodOptional<z.ZodString>;
+        anonymous_id: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     expiresAt: z.ZodNumber;
 }, z.core.$strip>;
@@ -332,7 +340,6 @@ export declare function spaceLevelGrant(spaceId: string, level: SpaceLevel): str
 export declare function shareLinkGrant(linkId: string): string;
 export declare function inviteGrant(inviteId: string): string;
 export declare function serviceTokenGrant(tokenId: string): string;
-export declare const SHARE_LINK_TOKEN_MAX_TTL_SECONDS: number;
 export declare const shareLinkSchema: z.ZodObject<{
     id: z.ZodString;
     spaceId: z.ZodString;
@@ -366,34 +373,42 @@ export declare const shareLinkWithUrlSchema: z.ZodObject<{
     url: z.ZodString;
 }, z.core.$strip>;
 export type ShareLinkWithUrl = z.infer<typeof shareLinkWithUrlSchema>;
-export declare const GENERAL_ACCESS_MODES: readonly ["public", "password", "link", "people"];
-export declare const generalAccessModeSchema: z.ZodEnum<{
-    link: "link";
-    password: "password";
+export declare const SPACE_VISIBILITIES: readonly ["public", "restricted"];
+export declare const spaceVisibilitySchema: z.ZodEnum<{
     public: "public";
-    people: "people";
+    restricted: "restricted";
 }>;
-export type GeneralAccessMode = z.infer<typeof generalAccessModeSchema>;
+export type SpaceVisibility = z.infer<typeof spaceVisibilitySchema>;
 export declare const sharingConnectionAudienceSchema: z.ZodObject<{
     connectionId: z.ZodString;
     tag: z.ZodOptional<z.ZodString>;
     emailDomain: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type SharingConnectionAudience = z.infer<typeof sharingConnectionAudienceSchema>;
-export declare const generalAccessWriteSchema: z.ZodObject<{
-    mode: z.ZodEnum<{
-        link: "link";
-        password: "password";
+export declare const visibilityWriteSchema: z.ZodObject<{
+    visibility: z.ZodEnum<{
         public: "public";
-        people: "people";
+        restricted: "restricted";
     }>;
-    password: z.ZodOptional<z.ZodString>;
-    audiences: z.ZodOptional<z.ZodArray<z.ZodObject<{
+}, z.core.$strip>;
+export declare const sharingPasswordWriteSchema: z.ZodObject<{
+    password: z.ZodString;
+}, z.core.$strip>;
+export declare const sharingAudiencesWriteSchema: z.ZodObject<{
+    audiences: z.ZodArray<z.ZodObject<{
         connectionId: z.ZodString;
         tag: z.ZodOptional<z.ZodString>;
         emailDomain: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const spaceProtectionWriteSchema: z.ZodObject<{
+    visibility: z.ZodEnum<{
+        public: "public";
+        restricted: "restricted";
+    }>;
+    password: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
+export type SpaceProtectionWrite = z.infer<typeof spaceProtectionWriteSchema>;
 export declare const sharingAudienceSchema: z.ZodObject<{
     connectionId: z.ZodString;
     type: z.ZodEnum<{
@@ -686,15 +701,11 @@ export declare function isTeamPreviewLockRule(rule: Pick<RuntimeRule, "id">): bo
 export declare function teamPreviewLockActive(rules: ReadonlyArray<Pick<RuntimeRule, "id">>): boolean;
 export declare function withTeamPreviewLock(rules: RuntimeRule[], teamId: string, enabled: boolean): RuntimeRule[];
 export declare const spaceSharingSchema: z.ZodObject<{
-    generalAccess: z.ZodObject<{
-        mode: z.ZodEnum<{
-            link: "link";
-            password: "password";
-            public: "public";
-            people: "people";
-        }>;
-        hasPassword: z.ZodBoolean;
-    }, z.core.$strip>;
+    visibility: z.ZodEnum<{
+        public: "public";
+        restricted: "restricted";
+    }>;
+    hasPassword: z.ZodBoolean;
     people: z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
             team_member: "team_member";
@@ -788,6 +799,7 @@ export declare const policyDocSchema: z.ZodObject<{
             ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
             agent: z.ZodOptional<z.ZodString>;
             country: z.ZodOptional<z.ZodString>;
+            countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
             header: z.ZodOptional<z.ZodObject<{
                 name: z.ZodString;
                 value: z.ZodString;
@@ -852,6 +864,7 @@ export declare const spacePolicySchema: z.ZodObject<{
             ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
             agent: z.ZodOptional<z.ZodString>;
             country: z.ZodOptional<z.ZodString>;
+            countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
             header: z.ZodOptional<z.ZodObject<{
                 name: z.ZodString;
                 value: z.ZodString;
@@ -910,6 +923,7 @@ export declare const spaceAccessRulesWriteSchema: z.ZodObject<{
             ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
             agent: z.ZodOptional<z.ZodString>;
             country: z.ZodOptional<z.ZodString>;
+            countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
             header: z.ZodOptional<z.ZodObject<{
                 name: z.ZodString;
                 value: z.ZodString;
@@ -968,6 +982,7 @@ export declare const spaceAccessRulesReadSchema: z.ZodObject<{
             ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
             agent: z.ZodOptional<z.ZodString>;
             country: z.ZodOptional<z.ZodString>;
+            countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
             header: z.ZodOptional<z.ZodObject<{
                 name: z.ZodString;
                 value: z.ZodString;
@@ -1057,6 +1072,7 @@ export declare const effectiveRuleSchema: z.ZodObject<{
         ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         agent: z.ZodOptional<z.ZodString>;
         country: z.ZodOptional<z.ZodString>;
+        countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
         header: z.ZodOptional<z.ZodObject<{
             name: z.ZodString;
             value: z.ZodString;
@@ -1119,6 +1135,7 @@ export declare const effectivePolicySchema: z.ZodObject<{
             ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
             agent: z.ZodOptional<z.ZodString>;
             country: z.ZodOptional<z.ZodString>;
+            countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
             header: z.ZodOptional<z.ZodObject<{
                 name: z.ZodString;
                 value: z.ZodString;
@@ -1197,6 +1214,7 @@ export declare const accessSimulateResultSchema: z.ZodObject<{
             ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
             agent: z.ZodOptional<z.ZodString>;
             country: z.ZodOptional<z.ZodString>;
+            countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
             header: z.ZodOptional<z.ZodObject<{
                 name: z.ZodString;
                 value: z.ZodString;

package/dist/contracts/access.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { ISO_COUNTRY_CODES } from "./countries.js";
 // Unified access contracts (internal-docs/access-plan.html — the only access
 // document).
 //
@@ -131,7 +132,8 @@ export function externalGrant(connectionId, tag) {
 // STORED form of a connection login acquire (`loginAcquireSchema.url`): the
 // compiler stores the symbolic `connection:{acn}` reference and the resolver
 // rewrites it to the live URL on every policy resolution (the OIDC leg URL or
-// the shop's authorizeUrl with the CURRENT space/sv/host baked in). Nothing
+// the shop's authorizeUrl with the CURRENT space/sv baked in). The serving
+// runtime adds the actual request host and same-origin return path. Nothing
 // stored ever carries a stale sessionVersion; a revoked connection's acquire
 // resolves to nothing (the login block disappears — fail closed).
 export function connectionAcquireRef(connectionId) {
@@ -296,9 +298,11 @@ export const passwordAcquireSchema = z.object({
 });
 export const loginAcquireSchema = z.object({
     type: z.literal("login"),
-    // Interactive login surface the challenge page links to (the cloud authorize
-    // endpoint, or a BYO connection's authorizeUrl). Hydrated by the compiler;
-    // the runtime appends `return=` as a plain same-origin path.
+    // Interactive handoff target (the cloud authorize endpoint, or a BYO
+    // connection's authorizeUrl). The challenge page links only to the runtime's
+    // same-origin login endpoint; it never exposes this target directly. The
+    // compiler hydrates static identity intent, then the runtime sets `host=`
+    // from the actual serving request and `return=` as a plain same-origin path.
     url: z.string().min(1),
     // Display label for the challenge-page button (e.g. "Continue with
     // Spacefast", "Sign in with Acme Shop").
@@ -339,6 +343,10 @@ export const ruleMatchSchema = z.object({
     agent: z.string().min(1).optional(),
     // ISO 3166-1 alpha-2 country code matcher.
     country: z.string().min(2).max(2).optional(),
+    // Matches when the resolved country is NOT in this list. Unlike compiling
+    // an allowlist as the finite ISO complement, this also matches missing,
+    // provider-special, malformed, and future country values.
+    countryNotIn: z.array(z.string().min(2).max(2)).min(1).max(250).optional(),
     // Single request-header matcher: name + expected value.
     header: z.object({ name: z.string().min(1), value: z.string() }).optional(),
 });
@@ -425,6 +433,13 @@ export const accessTokenPayloadSchema = z.object({
     // from browser history is dead after first use. Share tokens carry no `jti`
     // (the share URL IS the credential; revocation is structural).
     jti: z.string().min(1).optional(),
+    // Cast room capability. Collaboration tokens are valid for exactly one
+    // canonical room; other visitor tokens omit it.
+    room: z.string().min(1).optional(),
+    // Anonymous Comments tokens remain anonymous identities even though they
+    // carry a signed room capability.
+    anonymous_id: z.string().min(1).optional(),
+    name: z.string().min(1).max(120).optional(),
 });
 // Authorize request for `POST /v1/spaces/:id/access/authorize` — surviving for
 // exactly one caller: the dashboard preview-token mint (iframe → runtime
@@ -492,9 +507,11 @@ export function serviceTokenGrant(tokenId) {
 // 3d. Share links + the sharing projection (access-plan §5.1/§5.2, X-33)
 // ---------------------------------------------------------------------------
 // Share tokens are re-signed on demand from the link row (§5.2): the JWT is
-// never stored, only the row. `exp` = the link's expiry capped at this ceiling
-// (and re-copying re-mints, so a live link's URL never goes stale).
-export const SHARE_LINK_TOKEN_MAX_TTL_SECONDS = 30 * 24 * 60 * 60; // 30 days
+// never stored, only the row. Credential lifetime = artifact lifetime: `exp`
+// IS the link's expiry and is omitted for a never-expiring link. The runtime
+// permits that omission only for a signed, audience-bound token whose subject
+// and sole grant are the same `link:` capability. Revocation remains
+// structural — the grant drops from the compiled rules.
 // A share link row projected onto the wire (§4.4). `path` is "/" for a
 // space-wide link; any other value scopes the link's grant to that subtree
 // (compile-time: the grant only ever appears in rules matching the path).
@@ -507,8 +524,8 @@ export const shareLinkSchema = z.object({
     label: z.string().min(1).nullable().default(null),
     path: z.string().min(1),
     createdBy: z.string().min(1).nullable().default(null),
-    // Unix seconds; null = the link never expires (tokens still cap at 30d and
-    // re-mint from the row on copy).
+    // Unix seconds; null = the link never expires. The minted token mirrors this
+    // by omitting exp — there is no hidden shorter fuse.
     expiresAt: z.number().int().nonnegative().nullable().default(null),
     createdAt: z.string().min(1).describe("ISO 8601 timestamp."),
     lastUsedAt: z.string().min(1).nullable().default(null),
@@ -528,11 +545,14 @@ export const shareLinkCreateSchema = z.object({
 export const shareLinkWithUrlSchema = shareLinkSchema.extend({
     url: z.string().min(1).describe("https://<host><path>?sf_share=<token>"),
 });
-// The Share modal's General-access selector (§5.1). The mode is DERIVED from
-// the `sharing:` managed block — never stored separately — so "who can see
-// this" has exactly one home.
-export const GENERAL_ACCESS_MODES = ["public", "password", "link", "people"];
-export const generalAccessModeSchema = z.enum(GENERAL_ACCESS_MODES);
+// Who can open the space — ONE exclusive bit, always explicit. Everything
+// else (password, share links, invites, connection audiences, service tokens)
+// is an additive KEY into a restricted space: union semantics, any key
+// admits; keys are dormant on a public space, never errors. Visibility is
+// DERIVED from the `sharing:` managed block (a restricted space is one whose
+// block carries the space-wide challenge rule) — never stored separately.
+export const SPACE_VISIBILITIES = ["public", "restricted"];
+export const spaceVisibilitySchema = z.enum(SPACE_VISIBILITIES);
 // A connection audience member on the People-only selector state (§6.2/§6.3):
 // "your company SSO" (oidc — optionally narrowed to a verified email domain)
 // or "Acme Shop subscribers" (external — the owner-defined grant tag).
@@ -556,16 +576,32 @@ export const sharingConnectionAudienceSchema = z.object({
         .regex(/^[a-z0-9.-]+\.[a-z]{2,}$/i)
         .optional(),
 });
-export const generalAccessWriteSchema = z.object({
-    mode: generalAccessModeSchema,
-    // Required when switching to "password" for the first time; optional when a
-    // stored password already exists (it is kept).
-    password: z.string().min(1).max(256).optional(),
-    // People-mode connection audiences (§6.4): compiled INTO the one sharing
-    // general rule (mixed audiences = one rule, multiple acquires — the chooser
-    // is the challenge page, never a new surface). Omitted = keep the current
-    // audiences; [] = remove them.
-    audiences: z.array(sharingConnectionAudienceSchema).max(20).optional(),
+// PUT …/sharing/visibility — the ONE exclusive choice. Flipping visibility
+// never creates or destroys keys: restricting re-arms whatever keys exist;
+// going public leaves them dormant (including a stored password).
+export const visibilityWriteSchema = z.object({
+    visibility: spaceVisibilitySchema,
+});
+// PUT …/sharing/password — set/replace the password KEY. Setting a password
+// also restricts a public space (the intent is unambiguous); it never touches
+// other keys. DELETE clears the key and leaves visibility alone (fail-closed:
+// a restricted space stays restricted, team-only if that was the last key).
+export const sharingPasswordWriteSchema = z.object({
+    password: z.string().min(1).max(256),
+});
+// PUT …/sharing/audiences — replace the connection-audience keys (§6.2/§6.3).
+// Compiled INTO the one sharing general rule (mixed audiences = one rule,
+// multiple acquires — the chooser is the challenge page, never a new surface).
+export const sharingAudiencesWriteSchema = z.object({
+    audiences: z.array(sharingConnectionAudienceSchema).max(20),
+});
+// The core protection op (agent surface): visibility plus the password key in
+// one write. `password: string` sets the key (and restricts), `null` clears
+// it, omitted leaves it alone. Deeper key management (links, invites,
+// audiences) lives on the sharing surface.
+export const spaceProtectionWriteSchema = z.object({
+    visibility: spaceVisibilitySchema,
+    password: z.string().min(1).max(256).nullable().optional(),
 });
 // A connection audience projected back on the sharing read (derived from the
 // compiled block — never stored separately, X-33).
@@ -782,13 +818,17 @@ export const serviceTokenWithSecretSchema = serviceTokenSchema.extend({
 export const FIREWALL_EFFECTS = ["deny", "challenge"];
 export const firewallEffectSchema = z.enum(FIREWALL_EFFECTS);
 // Country section: `block` denies/challenges the listed countries; `allow`
-// admits ONLY the listed countries (the compiler enumerates the complement —
-// rule `match.country` is an exact ISO code with no negation, so allow-mode
-// is expressed as one rule per non-listed country).
+// admits ONLY the listed countries (one fail-closed `countryNotIn` rule).
 export const firewallCountriesSchema = z.object({
     mode: z.enum(["block", "allow"]),
     // ISO 3166-1 alpha-2, uppercased server-side.
-    list: z.array(z.string().length(2)).min(1).max(250),
+    list: z
+        .array(z
+        .string()
+        .length(2)
+        .refine((code) => ISO_COUNTRY_CODES.includes(code.toUpperCase()), "Country must be an ISO 3166-1 alpha-2 code."))
+        .min(1)
+        .max(250),
     // deny = blocked outright; challenge = "visitors from these countries must
     // sign in" (the team-viewer audience per §5.6).
     effect: firewallEffectSchema.default("deny"),
@@ -874,12 +914,11 @@ export function withTeamPreviewLock(rules, teamId, enabled) {
 // dashboard renders this and posts intents; it never interprets or compiles
 // rules.
 export const spaceSharingSchema = z.object({
-    generalAccess: z.object({
-        mode: generalAccessModeSchema,
-        // Whether a stored space password exists (the verifier hash, never the
-        // password) — lets the modal say "keep existing password".
-        hasPassword: z.boolean(),
-    }),
+    // The one exclusive bit. Everything below it is keys.
+    visibility: spaceVisibilitySchema,
+    // Whether the password KEY exists (the verifier hash, never the password).
+    // Independent of visibility: a public space can hold a dormant password.
+    hasPassword: z.boolean(),
     people: z.array(sharingPersonSchema).default([]),
     // Connection audiences on the People-only state (§6.2/§6.3), derived from
     // the compiled sharing block.

package/dist/contracts/activity.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export declare const ACTIVITY_EVENT_CODES: readonly ["space.created", "space.claimed", "feedback.lead_claim_pending", "space.transferred", "space.move_requested", "space.moved", "space.expired", "space.disabled", "space.enabled", "space.deleted", "space.config_updated", "space.slug_updated", "space.password_updated", "site.provision_requested", "site.placement_hold_set", "site.placement_hold_cleared", "site.burst_toggled", "space.access_logout_all", "space.access_transfer_scrub", "space.access_operator_token", "space.sharing_updated", "space.share_link_created", "space.share_link_revoked", "space.invite_created", "space.invite_revoked", "space.access_request_created", "space.access_request_resolved", "space.firewall_updated", "team.access_defaults_updated", "team.service_token_created", "team.service_token_revoked", "team.access_connection_created", "team.access_connection_updated", "team.access_connection_revoked", "version.created", "version.ready", "version.warning", "version.failed", "version.expired", "version.canceled", "version.deleted", "version.retention_warning", "version.retention_deleted", "channel.promoted", "build.created", "build.succeeded", "build.failed", "build.canceled", "build.skipped", "domain.created", "domain.verified", "domain.verification_failed", "domain.control_lost", "domain.dns_updated", "domain.nameservers_updated", "domain.registration_purchased", "domain.registration_renewed", "domain.registration_expiring", "domain.registration_expired", "domain.transfer_in_started", "domain.transfer_out_started", "domain.deleted", "binding.created", "binding.activated", "binding.blocked", "binding.deleted", "transfer.requested", "transfer.confirmed", "transfer.completed", "transfer.canceled", "transfer.expired", "transfer.failed", "variable.updated", "variable.deleted", "api_key.created", "api_key.updated", "api_key.revoked", "agent_handoff.created", "agent_handoff.redeemed", "agent_handoff.revoked", "webhook.created", "webhook.updated", "webhook.secret_rotated", "webhook.disabled", "webhook.deleted", "team.updated", "team.slug_updated", "team.member_added", "team.member_removed", "team.member_role_updated", "team.builds_deploys_quota_exceeded", "tenant.past_due", "tenant.suspended", "tenant.reactivated", "tenant.deleted", "export.ready", "export.failed", "import.ready", "import.failed", "comment.token_minted", "comment.created", "comment.reply_created", "comment.archived", "comment.unarchived", "abuse_report.created", "abuse_report.updated", "claim.blocked_takedown", "user.created", "user.signed_in", "user.deleted", "user.impersonation_started", "user.impersonation_stopped", "user.two_factor_enabled", "user.two_factor_disabled"];
+export declare const ACTIVITY_EVENT_CODES: readonly ["space.created", "space.claimed", "feedback.lead_claim_pending", "space.transferred", "space.move_requested", "space.moved", "space.expired", "space.disabled", "space.enabled", "space.deleted", "space.config_updated", "space.slug_updated", "space.password_updated", "site.provision_requested", "site.placement_hold_set", "site.placement_hold_cleared", "site.burst_toggled", "space.access_logout_all", "space.access_transfer_scrub", "space.access_operator_token", "space.sharing_updated", "space.share_link_created", "space.share_link_revoked", "space.invite_created", "space.invite_revoked", "space.access_request_created", "space.access_request_resolved", "space.firewall_updated", "team.access_defaults_updated", "team.service_token_created", "team.service_token_revoked", "team.access_connection_created", "team.access_connection_updated", "team.access_connection_revoked", "version.created", "version.ready", "version.warning", "version.failed", "version.expired", "version.canceled", "version.deleted", "version.retention_warning", "version.retention_deleted", "channel.promoted", "build.created", "build.succeeded", "build.failed", "build.canceled", "build.skipped", "domain.created", "domain.verified", "domain.verification_failed", "domain.control_lost", "domain.dns_updated", "domain.nameservers_updated", "domain.registration_purchased", "domain.registration_renewed", "domain.registration_expiring", "domain.registration_expired", "domain.transfer_in_started", "domain.transfer_out_started", "domain.deleted", "domain.attached", "domain.activated", "domain.blocked", "domain.detached", "transfer.requested", "transfer.confirmed", "transfer.completed", "transfer.canceled", "transfer.expired", "transfer.failed", "variable.updated", "variable.deleted", "api_key.created", "api_key.updated", "api_key.revoked", "agent_handoff.created", "agent_handoff.redeemed", "agent_handoff.revoked", "webhook.created", "webhook.updated", "webhook.secret_rotated", "webhook.disabled", "webhook.deleted", "team.updated", "team.slug_updated", "team.member_added", "team.member_removed", "team.member_role_updated", "team.builds_deploys_quota_exceeded", "tenant.past_due", "tenant.suspended", "tenant.reactivated", "tenant.deleted", "export.ready", "export.failed", "import.ready", "import.failed", "comment.token_minted", "comment.created", "comment.reply_created", "comment.archived", "comment.unarchived", "abuse_report.created", "abuse_report.updated", "claim.blocked_takedown", "user.created", "user.signed_in", "user.deleted", "user.impersonation_started", "user.impersonation_stopped", "user.two_factor_enabled", "user.two_factor_disabled"];
 export type ActivityEventCode = (typeof ACTIVITY_EVENT_CODES)[number];
 export declare function isActivityEventCode(value: string): value is ActivityEventCode;
 export declare function isValidActivityEventFilter(filter: string): boolean;

package/dist/contracts/activity.js

@@ -77,10 +77,10 @@ export const ACTIVITY_EVENT_CODES = [
     "domain.transfer_out_started",
     "domain.deleted",
     // binding
-    "binding.created",
-    "binding.activated",
-    "binding.blocked",
-    "binding.deleted",
+    "domain.attached",
+    "domain.activated",
+    "domain.blocked",
+    "domain.detached",
     // transfer
     "transfer.requested",
     "transfer.confirmed",
@@ -123,7 +123,7 @@ export const ACTIVITY_EVENT_CODES = [
     "export.failed",
     "import.ready",
     "import.failed",
-    // annotations
+    // comments
     "comment.token_minted",
     "comment.created",
     "comment.reply_created",