@spacefast/common 0.0.10 → 0.0.12

package/dist/utils/access-verdict.fixtures.json

@@ -0,0 +1,421 @@
+{
+    "_comment": "Shared corpus for the simulate<->runtime verdict drift guard (access-plan §8/X-9). Asserted against the PHP pure kernel (_spacefast_evaluate_policy, runtime/engine/runtime/access-rules.php) in apps/control-plane/src/runtime/php-policy-parity.test.ts and against apps/control-plane/src/access/simulate.ts's simulateAccess in apps/control-plane/src/runtime/access-verdict-parity.test.ts. `rules` is a raw RuntimeRule[] (no source/order provenance). `context` carries only the 4 fields simulate.ts's SimulateRequest supports (host/path/ip/country) plus `now` for expiry. `grants` mirrors what a real visitor token would carry but is restricted to 0-or-1 `email:` entries (simulate.ts's own simplification — it only ever mints an `email:` grant); `identified` is `grants.length > 0`, matching simulateAccess. `expected` is the {ruleId, effect, satisfied} verdict tuple both sides must agree on.",
+    "verdicts": [
+        {
+            "name": "first-match wins: anonymous deny before a later allow-all",
+            "rules": [
+                { "id": "r1", "match": { "pathPattern": "/admin/**" }, "effect": "deny" },
+                { "id": "r2", "match": {}, "effect": "allow" }
+            ],
+            "context": {
+                "host": "acme.example.com",
+                "path": "/admin/x",
+                "ip": "1.2.3.4",
+                "country": "US"
+            },
+            "grants": [],
+            "identified": false,
+            "now": 1770000000,
+            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
+        },
+        {
+            "name": "first match: satisfied allow wins over a later deny",
+            "rules": [
+                {
+                    "id": "r1",
+                    "match": {},
+                    "effect": "allow",
+                    "auth": { "requiredGrants": ["email:carol@acme.com"] }
+                },
+                { "id": "r2", "match": {}, "effect": "deny" }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": ["email:carol@acme.com"],
+            "identified": true,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "expired deny rule is skipped, falls through to public allow",
+            "rules": [
+                { "id": "r1", "match": {}, "effect": "deny", "expiresAt": 1000 },
+                { "id": "r2", "match": {}, "effect": "allow" }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 2000,
+            "expected": { "ruleId": "r2", "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "not-yet-expired rule (expiresAt > now) still applies",
+            "rules": [{ "id": "r1", "match": {}, "effect": "deny", "expiresAt": 2001 }],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 2000,
+            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
+        },
+        {
+            "name": "expiresAt == now is expired at the boundary (falls through to public allow)",
+            "rules": [{ "id": "r1", "match": {}, "effect": "deny", "expiresAt": 2000 }],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 2000,
+            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "challenge unsatisfied + identified visitor becomes deny (X-32 never re-challenge)",
+            "rules": [
+                {
+                    "id": "r1",
+                    "match": {},
+                    "effect": "challenge",
+                    "auth": { "requiredGrants": ["team:t1:member"] }
+                }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": ["email:carol@acme.com"],
+            "identified": true,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": false }
+        },
+        {
+            "name": "challenge unsatisfied + anonymous stays a challenge",
+            "rules": [
+                {
+                    "id": "r1",
+                    "match": {},
+                    "effect": "challenge",
+                    "auth": { "requiredGrants": ["team:t1:member"] }
+                }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "challenge", "satisfied": false }
+        },
+        {
+            "name": "challenge satisfied becomes allow",
+            "rules": [
+                {
+                    "id": "r1",
+                    "match": {},
+                    "effect": "challenge",
+                    "auth": { "requiredGrants": ["email:carol@acme.com"] }
+                }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": ["email:carol@acme.com"],
+            "identified": true,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "allow rule unsatisfied keeps scanning to default public allow",
+            "rules": [
+                {
+                    "id": "r1",
+                    "match": {},
+                    "effect": "allow",
+                    "auth": { "requiredGrants": ["email:carol@acme.com"] }
+                }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "deny rule unsatisfied keeps scanning to default public allow",
+            "rules": [
+                {
+                    "id": "r1",
+                    "match": {},
+                    "effect": "deny",
+                    "auth": { "requiredGrants": ["email:carol@acme.com"] }
+                }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "deny rule satisfied denies immediately",
+            "rules": [
+                {
+                    "id": "r1",
+                    "match": {},
+                    "effect": "deny",
+                    "auth": { "requiredGrants": ["email:mallory@acme.com"] }
+                }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": ["email:mallory@acme.com"],
+            "identified": true,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
+        },
+        {
+            "name": "host mismatch falls through to public allow",
+            "rules": [{ "id": "r1", "match": { "host": "other.example.com" }, "effect": "deny" }],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "path glob ** matches any depth",
+            "rules": [{ "id": "r1", "match": { "pathPattern": "/docs/**" }, "effect": "deny" }],
+            "context": { "host": "acme.example.com", "path": "/docs/a/b/c", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
+        },
+        {
+            "name": "path glob * matches one segment only, deeper path falls through",
+            "rules": [
+                { "id": "r1", "match": { "pathPattern": "/docs/*" }, "effect": "deny" },
+                { "id": "r2", "match": {}, "effect": "allow" }
+            ],
+            "context": { "host": "acme.example.com", "path": "/docs/a/b", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": "r2", "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "country match denies",
+            "rules": [{ "id": "r1", "match": { "country": "KP" }, "effect": "deny" }],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "KP" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
+        },
+        {
+            "name": "country mismatch falls through to public allow",
+            "rules": [{ "id": "r1", "match": { "country": "KP" }, "effect": "deny" }],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "US" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "countryNotIn lets an explicitly allowed country fall through",
+            "rules": [{ "id": "r1", "match": { "countryNotIn": ["US"] }, "effect": "deny" }],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "US" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "countryNotIn denies a provider-special country",
+            "rules": [{ "id": "r1", "match": { "countryNotIn": ["US"] }, "effect": "deny" }],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "XX" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
+        },
+        {
+            "name": "countryNotIn denies a missing country",
+            "rules": [{ "id": "r1", "match": { "countryNotIn": ["US"] }, "effect": "deny" }],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
+        },
+        {
+            "name": "ip cidr match denies",
+            "rules": [{ "id": "r1", "match": { "ipCidrs": ["10.0.0.0/8"] }, "effect": "deny" }],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "10.1.2.3", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
+        },
+        {
+            "name": "ip cidr mismatch falls through to public allow",
+            "rules": [{ "id": "r1", "match": { "ipCidrs": ["10.0.0.0/8"] }, "effect": "deny" }],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "192.168.1.1", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "agent-conditioned rule never fires when unsimulated (simulate.ts scope gap, negative-only)",
+            "rules": [
+                { "id": "r1", "match": { "agent": "Googlebot" }, "effect": "deny" },
+                { "id": "r2", "match": {}, "effect": "allow" }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": "r2", "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "grant glob intersection: email domain wildcard satisfies",
+            "rules": [
+                {
+                    "id": "r1",
+                    "match": {},
+                    "effect": "allow",
+                    "auth": { "requiredGrants": ["email:*@acme.com"] }
+                }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": ["email:carol@acme.com"],
+            "identified": true,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "grant glob intersection: email outside the domain wildcard does not satisfy",
+            "rules": [
+                {
+                    "id": "r1",
+                    "match": {},
+                    "effect": "allow",
+                    "auth": { "requiredGrants": ["email:*@acme.com"] }
+                },
+                { "id": "r2", "match": {}, "effect": "deny" }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": ["email:carol@evil.com"],
+            "identified": true,
+            "now": 1,
+            "expected": { "ruleId": "r2", "effect": "deny", "satisfied": true }
+        },
+        {
+            "name": "anonymous rule with challenge effect collapses to deny (no credential leg can ever satisfy it)",
+            "rules": [{ "id": "r1", "match": {}, "effect": "challenge" }],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
+        },
+        {
+            "name": "anonymous allow rule passes regardless of any carried grants",
+            "rules": [{ "id": "r1", "match": {}, "effect": "allow" }],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": ["email:carol@acme.com"],
+            "identified": true,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "no rules at all: public allow",
+            "rules": [],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "no rule matches this host/path: public allow",
+            "rules": [{ "id": "r1", "match": { "pathPattern": "/private/**" }, "effect": "deny" }],
+            "context": { "host": "acme.example.com", "path": "/public/x", "ip": "", "country": "" },
+            "grants": [],
+            "identified": false,
+            "now": 1,
+            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "an irrelevant carried grant (same as a revoked/tombstoned id absent from requiredGrants) is a normal non-intersecting case",
+            "rules": [
+                {
+                    "id": "r1",
+                    "match": {},
+                    "effect": "challenge",
+                    "auth": { "requiredGrants": ["team:t1:member"] }
+                }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": ["email:zoe@acme.com"],
+            "identified": true,
+            "now": 1,
+            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": false }
+        },
+        {
+            "name": "a later invited reviewer falls through earlier identity allows and passes their own",
+            "rules": [
+                {
+                    "id": "cast-reviewer-a",
+                    "match": {},
+                    "effect": "allow",
+                    "managedBy": "cast_reviewer",
+                    "auth": { "requiredGrants": ["email:reviewer.a@example.com"] }
+                },
+                {
+                    "id": "cast-reviewer-b",
+                    "match": {},
+                    "effect": "allow",
+                    "managedBy": "cast_reviewer",
+                    "auth": { "requiredGrants": ["email:reviewer.b@example.com"] }
+                },
+                {
+                    "id": "cast-reviewers-audience",
+                    "match": {},
+                    "effect": "challenge",
+                    "managedBy": "cast_reviewer",
+                    "auth": {
+                        "requiredGrants": ["email:reviewer.a@example.com", "email:reviewer.b@example.com"]
+                    }
+                }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": ["email:reviewer.b@example.com"],
+            "identified": true,
+            "now": 1,
+            "expected": { "ruleId": "cast-reviewer-b", "effect": "allow", "satisfied": true }
+        },
+        {
+            "name": "a non-reviewer falls through identity allows and is denied by the terminal audience",
+            "rules": [
+                {
+                    "id": "cast-reviewer-a",
+                    "match": {},
+                    "effect": "allow",
+                    "managedBy": "cast_reviewer",
+                    "auth": { "requiredGrants": ["email:reviewer.a@example.com"] }
+                },
+                {
+                    "id": "cast-reviewer-b",
+                    "match": {},
+                    "effect": "allow",
+                    "managedBy": "cast_reviewer",
+                    "auth": { "requiredGrants": ["email:reviewer.b@example.com"] }
+                },
+                {
+                    "id": "cast-reviewers-audience",
+                    "match": {},
+                    "effect": "challenge",
+                    "managedBy": "cast_reviewer",
+                    "auth": {
+                        "requiredGrants": ["email:reviewer.a@example.com", "email:reviewer.b@example.com"]
+                    }
+                }
+            ],
+            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
+            "grants": ["email:outsider@example.com"],
+            "identified": true,
+            "now": 1,
+            "expected": { "ruleId": "cast-reviewers-audience", "effect": "deny", "satisfied": false }
+        }
+    ]
+}

package/dist/utils/credential-policy.d.ts

@@ -16,7 +16,7 @@ export type PolicyAuthorizeInput = {
     resource: string | readonly string[];
     conditions?: RequestCondition;
 };
-export declare const publishActions: ("spaces:read" | "spaces:create" | "spaces:write" | "spaces:publish" | "versions:read" | "versions:promote" | "versions:download" | "builds:read" | "builds:create")[];
+export declare const publishActions: ("spaces:read" | "spaces:write" | "spaces:create" | "spaces:publish" | "versions:read" | "versions:promote" | "versions:download" | "builds:read" | "builds:create")[];
 export declare function compileApiKeyPreset(preset: ApiKeyPreset, input: PolicyCompileInput): ApiCredentialPolicy;
 /** Expand a named API-key preset into the finite permissions sent on the public wire contract. */
 export declare function apiKeyPresetPermissions(preset: ApiKeyPreset): StatticAction[];

package/dist/utils/dns-instructions.d.ts

@@ -0,0 +1,29 @@
+import { type DnsInstruction } from "../contracts/common.js";
+export type AddressDnsInstruction = DnsInstruction & {
+    type: "A" | "AAAA";
+};
+export type UnsupportedAddressDnsRecord = {
+    type: "A" | "AAAA";
+    name: string;
+    value: string;
+};
+export declare function addressDnsInstructionsForHostname(input: {
+    hostname: string;
+    dnsInstructions: unknown[];
+}): AddressDnsInstruction[];
+export declare function isWpCloudInboundIpv4(value: string): boolean;
+export declare function addressDnsInstructionIsObserved(input: {
+    instruction: Pick<AddressDnsInstruction, "type" | "value">;
+    records: {
+        a: string[];
+        aaaa: string[];
+    };
+}): boolean;
+export declare function unsupportedAddressDnsRecordsForHostname(input: {
+    hostname: string;
+    dnsInstructions: unknown[];
+    records: {
+        a: string[];
+        aaaa: string[];
+    };
+}): UnsupportedAddressDnsRecord[];

package/dist/utils/dns-instructions.js

@@ -0,0 +1,78 @@
+import { DnsInstructionSchema } from "../contracts/common.js";
+function normalizeDnsName(value) {
+    return value.trim().toLowerCase().replace(/\.$/, "");
+}
+export function addressDnsInstructionsForHostname(input) {
+    const hostname = normalizeDnsName(input.hostname);
+    return input.dnsInstructions.flatMap((candidate) => {
+        const parsed = DnsInstructionSchema.safeParse(candidate);
+        if (!parsed.success) {
+            return [];
+        }
+        const instruction = parsed.data;
+        if ((instruction.type !== "A" && instruction.type !== "AAAA") ||
+            instruction.purpose !== "routing" ||
+            normalizeDnsName(instruction.name) !== hostname) {
+            return [];
+        }
+        return [
+            {
+                type: instruction.type,
+                name: instruction.name,
+                value: instruction.value,
+                purpose: instruction.purpose,
+                ...(instruction.ttl === undefined ? {} : { ttl: instruction.ttl }),
+            },
+        ];
+    });
+}
+function normalizeAddress(value) {
+    const address = value.trim().toLowerCase();
+    if (!address.includes(":")) {
+        return address;
+    }
+    try {
+        return new URL(`http://[${address}]`).hostname.slice(1, -1);
+    }
+    catch {
+        return address;
+    }
+}
+export function isWpCloudInboundIpv4(value) {
+    const match = /^192\.0\.79\.(\d{1,3})$/.exec(value);
+    if (!match) {
+        return false;
+    }
+    const octet = Number(match[1]);
+    return octet >= 128 && octet <= 191;
+}
+function instructionAcceptsObservedAddress(instruction, observedValue) {
+    const expected = normalizeAddress(instruction.value);
+    const observed = normalizeAddress(observedValue);
+    return observed === expected || (instruction.type === "A" && isWpCloudInboundIpv4(observed));
+}
+export function addressDnsInstructionIsObserved(input) {
+    const observed = input.instruction.type === "A" ? input.records.a : input.records.aaaa;
+    return observed.some((value) => instructionAcceptsObservedAddress(input.instruction, value));
+}
+export function unsupportedAddressDnsRecordsForHostname(input) {
+    const instructions = addressDnsInstructionsForHostname(input);
+    if (instructions.length === 0) {
+        return [];
+    }
+    const records = [
+        ...input.records.a.map((value) => ({ type: "A", value })),
+        ...input.records.aaaa.map((value) => ({ type: "AAAA", value })),
+    ].filter((record) => !instructions.some((instruction) => instruction.type === record.type &&
+        instructionAcceptsObservedAddress(instruction, record.value)));
+    const unique = new Set();
+    return records.flatMap((record) => {
+        const value = record.value.trim();
+        const key = `${record.type}:${value}`;
+        if (!value || unique.has(key)) {
+            return [];
+        }
+        unique.add(key);
+        return [{ ...record, name: input.hostname }];
+    });
+}

package/dist/utils/domain-diagnostics.d.ts

@@ -0,0 +1,29 @@
+export type HostnameDiagnosticsForActions = {
+    hostname: string;
+    providerIps: string[];
+    dnsInstructions: unknown[];
+    dns: {
+        pointsToProvider: boolean;
+        txtVerified: boolean | null;
+        expectedTxtValue: string | null;
+        records?: {
+            a: string[];
+            aaaa: string[];
+        };
+    };
+    ssl: {
+        status: string;
+        canRetry: boolean;
+        brokenRecord: {
+            reason: string | null;
+            lastError: string | null;
+        } | null;
+    };
+};
+export type DomainRequiredAction = {
+    code: string;
+    hostname: string;
+    message: string;
+};
+/** Turn hostname diagnostics into the actions a user must take to finish binding. */
+export declare function domainRequiredActions(hostnameDiagnostics: HostnameDiagnosticsForActions[]): DomainRequiredAction[];

package/dist/utils/domain-diagnostics.js

@@ -0,0 +1,63 @@
+import { addressDnsInstructionIsObserved, addressDnsInstructionsForHostname, unsupportedAddressDnsRecordsForHostname, } from "./dns-instructions.js";
+/** Turn hostname diagnostics into the actions a user must take to finish binding. */
+export function domainRequiredActions(hostnameDiagnostics) {
+    const actions = [];
+    for (const entry of hostnameDiagnostics) {
+        const unsupportedRecords = entry.dns.records
+            ? unsupportedAddressDnsRecordsForHostname({ ...entry, records: entry.dns.records })
+            : [];
+        actions.push(...unsupportedRecords.map((record) => ({
+            code: "dns_unaccepted_address",
+            hostname: entry.hostname,
+            message: `Remove the ${record.type} record on ${record.name} with value ${record.value}; it does not match a Spacefast target for this hostname.`,
+        })));
+        if (!entry.dns.pointsToProvider) {
+            const routingInstructions = addressDnsInstructionsForHostname(entry);
+            const observedAddressRecords = entry.dns.records;
+            const missingRoutingInstructions = observedAddressRecords
+                ? routingInstructions.filter((instruction) => !addressDnsInstructionIsObserved({
+                    instruction,
+                    records: observedAddressRecords,
+                }))
+                : routingInstructions;
+            if (missingRoutingInstructions.length > 0) {
+                actions.push(...missingRoutingInstructions.map((instruction) => ({
+                    code: "dns_not_pointing",
+                    hostname: entry.hostname,
+                    message: `Add an ${instruction.type} record on ${instruction.name} with value ${instruction.value}.`,
+                })));
+            }
+            else if (routingInstructions.length === 0) {
+                const targets = entry.providerIps.length > 0 ? entry.providerIps.join(", ") : "Spacefast";
+                actions.push({
+                    code: "dns_not_pointing",
+                    hostname: entry.hostname,
+                    message: `Point ${entry.hostname} at ${targets} using the DNS record type shown by Spacefast.`,
+                });
+            }
+        }
+        if (entry.dns.txtVerified === false && entry.dns.expectedTxtValue) {
+            actions.push({
+                code: "txt_verification_missing",
+                hostname: entry.hostname,
+                message: `Add a TXT record on ${entry.hostname} with value ${entry.dns.expectedTxtValue}.`,
+            });
+        }
+        if (entry.ssl.brokenRecord) {
+            const reason = entry.ssl.brokenRecord.reason ?? entry.ssl.brokenRecord.lastError;
+            actions.push({
+                code: "ssl_blocking_record",
+                hostname: entry.hostname,
+                message: `Fix the DNS record blocking SSL on ${entry.hostname}${reason ? ` (${reason})` : ""}.`,
+            });
+        }
+        else if (entry.ssl.status !== "active" && entry.ssl.canRetry) {
+            actions.push({
+                code: "ssl_retry_available",
+                hostname: entry.hostname,
+                message: `SSL is ${entry.ssl.status} on ${entry.hostname}; retry with \`sf domains check ${entry.hostname}\`.`,
+            });
+        }
+    }
+    return actions;
+}