@spacefast/common 0.0.11 → 0.0.12

package/dist/contracts/zero.d.ts

@@ -43,8 +43,8 @@ export declare const zeroRuntimeKindSchema: z.ZodEnum<{
 }>;
 export type ZeroRuntimeKind = z.infer<typeof zeroRuntimeKindSchema>;
 export declare const zeroHttpMethodSchema: z.ZodEnum<{
-    PUT: "PUT";
     POST: "POST";
+    PUT: "PUT";
     GET: "GET";
     HEAD: "HEAD";
     PATCH: "PATCH";
@@ -53,8 +53,8 @@ export declare const zeroHttpMethodSchema: z.ZodEnum<{
 }>;
 export declare const zeroEndpointSchema: z.ZodObject<{
     method: z.ZodEnum<{
-        PUT: "PUT";
         POST: "POST";
+        PUT: "PUT";
         GET: "GET";
         HEAD: "HEAD";
         PATCH: "PATCH";
@@ -64,6 +64,7 @@ export declare const zeroEndpointSchema: z.ZodObject<{
     path: z.ZodString;
 }, z.core.$strict>;
 export type ZeroEndpoint = z.infer<typeof zeroEndpointSchema>;
+export declare function zeroEndpointRoutesAmbiguous(left: ZeroEndpoint, right: ZeroEndpoint): boolean;
 export declare const zeroTableColumnSchema: z.ZodObject<{
     name: z.ZodString;
     type: z.ZodEnum<{
@@ -136,6 +137,31 @@ export declare const zeroRuntimeRunSourceSchema: z.ZodObject<{
     db: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strict>;
 export type ZeroRuntimeRunSource = z.infer<typeof zeroRuntimeRunSourceSchema>;
+export declare const zeroRuntimeEndpointSourceSchema: z.ZodObject<{
+    method: z.ZodEnum<{
+        POST: "POST";
+        PUT: "PUT";
+        GET: "GET";
+        HEAD: "HEAD";
+        PATCH: "PATCH";
+        DELETE: "DELETE";
+        OPTIONS: "OPTIONS";
+    }>;
+    path: z.ZodString;
+    endpointId: z.ZodString;
+    source: z.ZodString;
+    schemaHash: z.ZodOptional<z.ZodString>;
+    capabilities: z.ZodDefault<z.ZodObject<{
+        db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    }, z.core.$strip>>;
+    db: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type ZeroRuntimeEndpointSource = z.infer<typeof zeroRuntimeEndpointSourceSchema>;
 export declare const zeroMigrationOperationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     op: z.ZodLiteral<"create_table">;
     table: z.ZodString;
@@ -410,8 +436,8 @@ export declare const zeroCapsuleArtifactSchema: z.ZodObject<{
         mutations: z.ZodDefault<z.ZodArray<z.ZodString>>;
         endpoints: z.ZodDefault<z.ZodArray<z.ZodObject<{
             method: z.ZodEnum<{
-                PUT: "PUT";
                 POST: "POST";
+                PUT: "PUT";
                 GET: "GET";
                 HEAD: "HEAD";
                 PATCH: "PATCH";
@@ -571,8 +597,8 @@ export declare const zeroRuntimeFinalizePayloadSchema: z.ZodObject<{
             mutations: z.ZodDefault<z.ZodArray<z.ZodString>>;
             endpoints: z.ZodDefault<z.ZodArray<z.ZodObject<{
                 method: z.ZodEnum<{
-                    PUT: "PUT";
                     POST: "POST";
+                    PUT: "PUT";
                     GET: "GET";
                     HEAD: "HEAD";
                     PATCH: "PATCH";
@@ -686,6 +712,30 @@ export declare const zeroRuntimeFinalizePayloadSchema: z.ZodObject<{
         size: z.ZodNumber;
         contentBase64: z.ZodString;
     }, z.core.$strict>>>;
+    endpointSources: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        method: z.ZodEnum<{
+            POST: "POST";
+            PUT: "PUT";
+            GET: "GET";
+            HEAD: "HEAD";
+            PATCH: "PATCH";
+            DELETE: "DELETE";
+            OPTIONS: "OPTIONS";
+        }>;
+        path: z.ZodString;
+        endpointId: z.ZodString;
+        source: z.ZodString;
+        schemaHash: z.ZodOptional<z.ZodString>;
+        capabilities: z.ZodDefault<z.ZodObject<{
+            db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        }, z.core.$strip>>;
+        db: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>>;
     runSources: z.ZodDefault<z.ZodArray<z.ZodObject<{
         runId: z.ZodString;
         source: z.ZodString;
@@ -786,6 +836,253 @@ export declare const zeroRuntimeFinalizePayloadSchema: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type ZeroRuntimeFinalizePayload = z.infer<typeof zeroRuntimeFinalizePayloadSchema>;
+export declare const zeroRuntimeConfigSchema: z.ZodObject<{
+    auth: z.ZodDefault<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodLiteral<"wpcom">>;
+        signInPath: z.ZodDefault<z.ZodNullable<z.ZodLiteral<"/__spacefast/zero/auth/wpcom/start">>>;
+        signInUrl: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        signOutPath: z.ZodDefault<z.ZodNullable<z.ZodLiteral<"/__spacefast/zero/auth/sign-out">>>;
+        signOutUrl: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        returnToParam: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>>;
+    variables: z.ZodObject<{
+        source: z.ZodLiteral<"stattic-variables">;
+        names: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    realtime: z.ZodObject<{
+        mode: z.ZodEnum<{
+            "stattic-central": "stattic-central";
+            "spacefast-cast": "spacefast-cast";
+            "local-dev": "local-dev";
+        }>;
+        centralUrl: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        replayUrl: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        castResourceKey: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        eventCallback: z.ZodOptional<z.ZodObject<{
+            url: z.ZodString;
+            token: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    runtimeKind: z.ZodLiteral<"zero">;
+    migrations: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+        format: z.ZodLiteral<"stattic.zero.migrations.v1">;
+        mode: z.ZodDefault<z.ZodEnum<{
+            safe: "safe";
+            drop: "drop";
+            rename: "rename";
+        }>>;
+        schemaHash: z.ZodString;
+        operations: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            op: z.ZodLiteral<"create_table">;
+            table: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            op: z.ZodLiteral<"add_column">;
+            table: z.ZodString;
+            column: z.ZodObject<{
+                name: z.ZodString;
+                type: z.ZodEnum<{
+                    string: "string";
+                    number: "number";
+                    boolean: "boolean";
+                    json: "json";
+                }>;
+                nullable: z.ZodDefault<z.ZodBoolean>;
+                default: z.ZodOptional<z.ZodUnknown>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            op: z.ZodLiteral<"add_index">;
+            table: z.ZodString;
+            columns: z.ZodArray<z.ZodString>;
+            unique: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>, z.ZodObject<{
+            op: z.ZodLiteral<"drop_table">;
+            table: z.ZodString;
+            explicit: z.ZodLiteral<"drop">;
+        }, z.core.$strict>, z.ZodObject<{
+            op: z.ZodLiteral<"drop_column">;
+            table: z.ZodString;
+            column: z.ZodString;
+            explicit: z.ZodLiteral<"drop">;
+        }, z.core.$strict>, z.ZodObject<{
+            op: z.ZodLiteral<"rename_table">;
+            from: z.ZodString;
+            to: z.ZodString;
+            explicit: z.ZodLiteral<"rename">;
+        }, z.core.$strict>, z.ZodObject<{
+            op: z.ZodLiteral<"rename_column">;
+            table: z.ZodString;
+            from: z.ZodString;
+            to: z.ZodString;
+            explicit: z.ZodLiteral<"rename">;
+        }, z.core.$strict>], "op">>;
+    }, z.core.$strict>>>;
+    install: z.ZodObject<{
+        runtimeKind: z.ZodLiteral<"zero">;
+        engine: z.ZodLiteral<"quickjs-rust">;
+        storageRoot: z.ZodLiteral<"__spacefast/zero">;
+        artifactPath: z.ZodLiteral<"__spacefast/zero/artifact.json">;
+        configPath: z.ZodLiteral<"__spacefast/zero/config.json">;
+        binary: z.ZodObject<{
+            path: z.ZodLiteral<"__spacefast/zero/bin/stattic-zero-runner">;
+            compatibilityTarget: z.ZodObject<{
+                profile: z.ZodLiteral<"wpcloud-linux-x86_64-gnu-v1">;
+                os: z.ZodLiteral<"linux">;
+                cpu: z.ZodLiteral<"x86_64">;
+                libc: z.ZodLiteral<"glibc">;
+                linking: z.ZodLiteral<"dynamic">;
+                requireExecutableBit: z.ZodLiteral<true>;
+            }, z.core.$strict>;
+            sha256: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            required: z.ZodLiteral<true>;
+        }, z.core.$strict>;
+        mysql: z.ZodObject<{
+            migrateAtFinalize: z.ZodLiteral<true>;
+            blockIncompatibleRollback: z.ZodLiteral<true>;
+        }, z.core.$strict>;
+        realtime: z.ZodObject<{
+            production: z.ZodLiteral<"stattic-central">;
+            local: z.ZodLiteral<"foreground-cli-ws">;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    artifact: z.ZodObject<{
+        format: z.ZodLiteral<"stattic.zero.capsule.v1">;
+        appName: z.ZodString;
+        serverRuntime: z.ZodLiteral<"quickjs-rust">;
+        client: z.ZodObject<{
+            bundlePath: z.ZodString;
+            basePathAware: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>;
+        server: z.ZodObject<{
+            bundlePath: z.ZodString;
+            schema: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+                name: z.ZodString;
+                columns: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    name: z.ZodString;
+                    type: z.ZodEnum<{
+                        string: "string";
+                        number: "number";
+                        boolean: "boolean";
+                        json: "json";
+                    }>;
+                    nullable: z.ZodDefault<z.ZodBoolean>;
+                    default: z.ZodOptional<z.ZodUnknown>;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>>;
+            queries: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            mutations: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            endpoints: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                method: z.ZodEnum<{
+                    POST: "POST";
+                    PUT: "PUT";
+                    GET: "GET";
+                    HEAD: "HEAD";
+                    PATCH: "PATCH";
+                    DELETE: "DELETE";
+                    OPTIONS: "OPTIONS";
+                }>;
+                path: z.ZodString;
+            }, z.core.$strict>>>;
+            sockets: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>;
+        db: z.ZodObject<{
+            backend: z.ZodLiteral<"wpcloud-mysql">;
+            migrations: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                op: z.ZodLiteral<"create_table">;
+                table: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                op: z.ZodLiteral<"add_column">;
+                table: z.ZodString;
+                column: z.ZodObject<{
+                    name: z.ZodString;
+                    type: z.ZodEnum<{
+                        string: "string";
+                        number: "number";
+                        boolean: "boolean";
+                        json: "json";
+                    }>;
+                    nullable: z.ZodDefault<z.ZodBoolean>;
+                    default: z.ZodOptional<z.ZodUnknown>;
+                }, z.core.$strict>;
+            }, z.core.$strict>, z.ZodObject<{
+                op: z.ZodLiteral<"add_index">;
+                table: z.ZodString;
+                columns: z.ZodArray<z.ZodString>;
+                unique: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>, z.ZodObject<{
+                op: z.ZodLiteral<"drop_table">;
+                table: z.ZodString;
+                explicit: z.ZodLiteral<"drop">;
+            }, z.core.$strict>, z.ZodObject<{
+                op: z.ZodLiteral<"drop_column">;
+                table: z.ZodString;
+                column: z.ZodString;
+                explicit: z.ZodLiteral<"drop">;
+            }, z.core.$strict>, z.ZodObject<{
+                op: z.ZodLiteral<"rename_table">;
+                from: z.ZodString;
+                to: z.ZodString;
+                explicit: z.ZodLiteral<"rename">;
+            }, z.core.$strict>, z.ZodObject<{
+                op: z.ZodLiteral<"rename_column">;
+                table: z.ZodString;
+                from: z.ZodString;
+                to: z.ZodString;
+                explicit: z.ZodLiteral<"rename">;
+            }, z.core.$strict>], "op">>>;
+        }, z.core.$strict>;
+        realtime: z.ZodObject<{
+            mode: z.ZodEnum<{
+                "stattic-central": "stattic-central";
+                "spacefast-cast": "spacefast-cast";
+                "local-dev": "local-dev";
+            }>;
+            mutationEvents: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>;
+        limits: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        futureCapabilities: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            ai: "ai";
+            blob: "blob";
+            "generalized-js": "generalized-js";
+        }>>>;
+        sourceManifest: z.ZodObject<{
+            entries: z.ZodObject<{
+                client: z.ZodLiteral<"client/index.tsx">;
+                server: z.ZodLiteral<"server/index.ts">;
+            }, z.core.$strict>;
+            sourceRoot: z.ZodString;
+            files: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                size: z.ZodNumber;
+                sha256: z.ZodString;
+            }, z.core.$strict>>>;
+            env: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+                file: z.ZodLiteral<".env.zero.server">;
+                names: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>>;
+            sourceConfig: z.ZodDefault<z.ZodObject<{
+                configFile: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+                    path: z.ZodLiteral<"zero.json">;
+                    appName: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+                    deployId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+                    name: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+                    title: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+                }, z.core.$strip>>>;
+                deployFile: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+                    path: z.ZodLiteral<".zero/deploy.json">;
+                    keys: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                }, z.core.$strip>>>;
+            }, z.core.$strip>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    inspect: z.ZodDefault<z.ZodObject<{
+        policy: z.ZodDefault<z.ZodEnum<{
+            public: "public";
+            private: "private";
+        }>>;
+    }, z.core.$strict>>;
+    variableValues: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strict>;
+export type ZeroRuntimeConfig = z.infer<typeof zeroRuntimeConfigSchema>;
 export declare const zeroDeployMetadataSchema: z.ZodObject<{
     artifactId: z.ZodOptional<z.ZodString>;
     finalize: z.ZodObject<{
@@ -846,8 +1143,8 @@ export declare const zeroDeployMetadataSchema: z.ZodObject<{
                 mutations: z.ZodDefault<z.ZodArray<z.ZodString>>;
                 endpoints: z.ZodDefault<z.ZodArray<z.ZodObject<{
                     method: z.ZodEnum<{
-                        PUT: "PUT";
                         POST: "POST";
+                        PUT: "PUT";
                         GET: "GET";
                         HEAD: "HEAD";
                         PATCH: "PATCH";
@@ -961,6 +1258,30 @@ export declare const zeroDeployMetadataSchema: z.ZodObject<{
             size: z.ZodNumber;
             contentBase64: z.ZodString;
         }, z.core.$strict>>>;
+        endpointSources: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            method: z.ZodEnum<{
+                POST: "POST";
+                PUT: "PUT";
+                GET: "GET";
+                HEAD: "HEAD";
+                PATCH: "PATCH";
+                DELETE: "DELETE";
+                OPTIONS: "OPTIONS";
+            }>;
+            path: z.ZodString;
+            endpointId: z.ZodString;
+            source: z.ZodString;
+            schemaHash: z.ZodOptional<z.ZodString>;
+            capabilities: z.ZodDefault<z.ZodObject<{
+                db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            }, z.core.$strip>>;
+            db: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>>;
         runSources: z.ZodDefault<z.ZodArray<z.ZodObject<{
             runId: z.ZodString;
             source: z.ZodString;
@@ -1108,8 +1429,8 @@ export declare const zeroInspectResponseSchema: z.ZodObject<{
         mutations: z.ZodDefault<z.ZodArray<z.ZodString>>;
         endpoints: z.ZodDefault<z.ZodArray<z.ZodObject<{
             method: z.ZodEnum<{
-                PUT: "PUT";
                 POST: "POST";
+                PUT: "PUT";
                 GET: "GET";
                 HEAD: "HEAD";
                 PATCH: "PATCH";
@@ -1191,8 +1512,8 @@ export declare const zeroInspectPublicResponseSchema: z.ZodObject<{
             mutations: z.ZodDefault<z.ZodArray<z.ZodString>>;
             endpoints: z.ZodDefault<z.ZodArray<z.ZodObject<{
                 method: z.ZodEnum<{
-                    PUT: "PUT";
                     POST: "POST";
+                    PUT: "PUT";
                     GET: "GET";
                     HEAD: "HEAD";
                     PATCH: "PATCH";
@@ -1519,6 +1840,7 @@ export declare function createZeroRuntimeFinalizePayload(input: {
     artifact: z.input<typeof zeroCapsuleArtifactSchema>;
     bundles?: z.input<typeof zeroRuntimeBundleSchema>[];
     staticFiles?: z.input<typeof zeroRuntimeStaticFileSchema>[];
+    endpointSources?: z.input<typeof zeroRuntimeEndpointSourceSchema>[];
     runSources?: z.input<typeof zeroRuntimeRunSourceSchema>[];
     migrations?: z.input<typeof zeroMigrationPlanSchema> | null;
     runnerSha256?: string | null;

package/dist/contracts/zero.js

@@ -54,13 +54,58 @@ const zeroEnvNameSchema = z
     .max(ZERO_ENV_NAME_MAX_BYTES)
     .regex(/^[A-Za-z_][A-Za-z0-9_]*$/)
     .refine((name) => !ZERO_ENV_RESERVED_PREFIXES.some((prefix) => name.toUpperCase().startsWith(prefix)), { message: "Zero env variable name uses a reserved prefix." });
+function hasWellFormedUnicode(value) {
+    for (let index = 0; index < value.length; index++) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
+            if (index + 1 >= value.length)
+                return false;
+            const next = value.charCodeAt(index + 1);
+            if (next < 0xdc00 || next > 0xdfff)
+                return false;
+            index++;
+        }
+        else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
+            return false;
+        }
+    }
+    return true;
+}
+function hasNoAsciiControlCharacters(value) {
+    for (let index = 0; index < value.length; index++) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit <= 0x1f || codeUnit === 0x7f)
+            return false;
+    }
+    return true;
+}
 const zeroRoutePathSchema = z
     .string()
     .min(1)
     .max(2048)
     .startsWith("/")
-    .refine((path) => !path.startsWith("//") && !path.includes("\\") && !path.includes("?") && !path.includes("#"), {
-    message: "Zero capsule routes must be absolute app paths without //, \\, ?, or #.",
+    .refine(hasWellFormedUnicode, {
+    message: "Zero capsule routes must contain well-formed Unicode.",
+})
+    .refine((path) => path.normalize("NFC") === path, {
+    message: "Zero capsule routes must use NFC-normalized Unicode.",
+})
+    .refine(hasNoAsciiControlCharacters, {
+    message: "Zero capsule routes must not contain ASCII control characters.",
+})
+    .refine((path) => !path.includes("//") &&
+    !path.includes("\\") &&
+    !path.includes("*") &&
+    !path.includes("?") &&
+    !path.includes("#") &&
+    !path.endsWith("/") &&
+    path
+        .split("/")
+        .every((segment, index, segments) => segment !== "." &&
+        segment !== ".." &&
+        segment !== ":" &&
+        (segment !== ":splat" || index === segments.length - 1)), {
+    message: "Zero capsule routes must be absolute app paths without empty, traversal, unnamed parameter, * wildcard, non-terminal splat, \\, ?, or # segments.",
 })
     .refine((path) => !ZERO_RESERVED_APP_ROUTE_PATHS.some((reservedPath) => path === reservedPath), {
     message: "Zero capsule route is reserved by the Zero app shell.",
@@ -89,6 +134,49 @@ export const zeroEndpointSchema = z
     path: zeroRoutePathSchema,
 })
     .strict();
+function zeroEndpointRouteMatchShape(path) {
+    const segments = [];
+    let score = 0;
+    let splat = false;
+    for (const segment of path.replace(/^\/+|\/+$/g, "").split("/")) {
+        if (!segment)
+            continue;
+        if (segment === ":splat") {
+            score += 1;
+            splat = true;
+            break;
+        }
+        if (segment.startsWith(":")) {
+            segments.push(null);
+            score += 2;
+        }
+        else {
+            segments.push(segment);
+            score += 10;
+        }
+    }
+    return { score, segments, splat };
+}
+export function zeroEndpointRoutesAmbiguous(left, right) {
+    const methodsOverlap = left.method === right.method ||
+        (left.method === "GET" && right.method === "HEAD") ||
+        (left.method === "HEAD" && right.method === "GET");
+    if (!methodsOverlap)
+        return false;
+    const leftShape = zeroEndpointRouteMatchShape(left.path);
+    const rightShape = zeroEndpointRouteMatchShape(right.path);
+    if (leftShape.score !== rightShape.score)
+        return false;
+    if (!leftShape.splat && leftShape.segments.length < rightShape.segments.length)
+        return false;
+    if (!rightShape.splat && rightShape.segments.length < leftShape.segments.length)
+        return false;
+    return Array.from({ length: Math.min(leftShape.segments.length, rightShape.segments.length) }, (_, index) => index).every((index) => {
+        const segment = leftShape.segments[index];
+        const other = rightShape.segments[index];
+        return segment === null || other === null || segment === other;
+    });
+}
 function zeroDefaultMatchesColumnType(column, ctx) {
     if (!Object.prototype.hasOwnProperty.call(column, "default") || column.default === null) {
         return;
@@ -201,6 +289,20 @@ export const zeroRuntimeRunSourceSchema = z
     db: z.record(z.string(), z.unknown()).optional(),
 })
     .strict();
+export const zeroRuntimeEndpointSourceSchema = z
+    .object({
+    method: zeroHttpMethodSchema,
+    path: zeroRoutePathSchema,
+    endpointId: z.string().min(1).max(256),
+    source: z
+        .string()
+        .min(1)
+        .max(2 * 1024 * 1024),
+    schemaHash: z.string().min(1).max(256).optional(),
+    capabilities: zeroRuntimeRunSourceSchema.shape.capabilities,
+    db: z.record(z.string(), z.unknown()).optional(),
+})
+    .strict();
 export const zeroMigrationOperationSchema = z.discriminatedUnion("op", [
     z
         .object({
@@ -470,6 +572,7 @@ export const zeroRuntimeFinalizePayloadSchema = z
     artifact: zeroCapsuleArtifactSchema,
     bundles: z.array(zeroRuntimeBundleSchema).max(8).default([]),
     staticFiles: z.array(zeroRuntimeStaticFileSchema).max(16).default([]),
+    endpointSources: z.array(zeroRuntimeEndpointSourceSchema).max(128).default([]),
     runSources: z.array(zeroRuntimeRunSourceSchema).max(128).default([]),
     migrations: zeroMigrationPlanSchema.nullable().default(null),
     variables: z
@@ -519,6 +622,21 @@ export const zeroRuntimeFinalizePayloadSchema = z
         .default({ policy: "private" }),
 })
     .strict();
+export const zeroRuntimeConfigSchema = zeroRuntimeFinalizePayloadSchema
+    .pick({
+    runtimeKind: true,
+    install: true,
+    artifact: true,
+    migrations: true,
+    variables: true,
+    realtime: true,
+    auth: true,
+    inspect: true,
+})
+    .extend({
+    variableValues: z.record(z.string(), z.string()).default({}),
+})
+    .strict();
 export const zeroDeployMetadataSchema = z
     .object({
     artifactId: z.string().min(1).optional(),
@@ -735,6 +853,7 @@ export function createZeroRuntimeFinalizePayload(input) {
         artifact,
         bundles: input.bundles ?? [],
         staticFiles: input.staticFiles ?? [],
+        endpointSources: input.endpointSources ?? [],
         runSources: input.runSources ?? [],
         migrations: input.migrations ?? null,
         variables: {

package/dist/dashboard-paths/index.d.ts

@@ -17,7 +17,7 @@ export type TeamSlugRouteReservation = (typeof TEAM_SLUG_ROUTE_RESERVATIONS)[num
 export type SpaceSlugRouteReservation = (typeof SPACE_SLUG_ROUTE_RESERVATIONS)[number];
 export declare const TEAM_SLUG_ROUTE_RESERVATION_SET: ReadonlySet<string>;
 export declare const SPACE_SLUG_ROUTE_RESERVATION_SET: ReadonlySet<string>;
-export type SpaceSettingsDestination = "access" | "advanced" | "appearance" | "builds" | "integrations" | "integrations/add" | "source-builds";
+export type SpaceSettingsDestination = "access" | "advanced" | "builds" | "integrations" | "integrations/add" | "source-builds";
 export type TeamSettingsDestination = "access" | "audit" | "developer" | "developer/agents" | "developer/environment-variables" | "developer/handoffs" | "developer/service-tokens" | "developer/webhooks" | "integrations";
 export declare function teamPath(teamSlug: string): string;
 export declare function spacePath(teamSlug: string, spaceSlug: string): string;

package/dist/docs/agent-setup.d.ts

@@ -31,10 +31,12 @@ export type AgentHandoff = Readonly<{
 }>;
 /**
  * The single shared grammar for handoff links:
- * `https://<app-origin>/agent/<documentId>#<secret>`. The document ID must match
+ * `<app-origin>/agent/<documentId>#<secret>`. The document ID must match
  * `[A-Za-z0-9_-]{1,512}` and the secret `[A-Za-z0-9_-]{16,512}` (the minimum keeps secrets
  * high-entropy and makes the public-projection leak check meaningful); the two must differ;
- * queries and embedded credentials are forbidden; HTTPS is required except on loopback hosts.
+ * queries and embedded credentials are forbidden. The URL must sit exactly on the caller's
+ * configured HTTP(S) app origin; that origin pin enforces scheme, hostname, and port without a
+ * second host allowlist that would reject legitimate dev or container origins.
  * Normalization is part of the contract: the input is WHATWG-URL-normalized first (backslashes,
  * dot segments, stray tab/CR/LF, empty userinfo, case, default ports), the grammar is enforced on
  * the normalized URL, and only the reconstructed canonical URL ever leaves this function.