@spacefast/common 0.0.11 → 0.0.12

package/dist/utils/pages.js

@@ -1,7 +1,27 @@
-import { CUSTOM_PAGE_IDS, PAGE_ELEMENTS, PAGE_LAYOUT_FILE, PAGE_SOURCE_MAX_BYTES, SITE_PAGE_IDS, } from "../contracts/pages.js";
+import { SPACEFAST_WORDMARK_PATH } from "../brand-assets.js";
+import { CUSTOM_PAGE_IDS, PAGE_CATALOG, PAGE_ELEMENTS, PAGE_LAYOUT_FILE, PAGE_SOURCE_MAX_BYTES, SITE_PAGE_IDS, } from "../contracts/pages.js";
+import { SPACE_CONFIG_ACCEPTED_FILES } from "../contracts/space-config.js";
+import { derivePageColors, PAGE_COLOR_DEFAULTS } from "./page-colors.js";
+import { PAGE_EMBEDDED_FONT_FACES, PAGE_FONT_FACES } from "./page-fonts.js";
 const encoder = new TextEncoder();
 const knownElements = new Set(PAGE_ELEMENTS);
 const customPageIds = new Set(CUSTOM_PAGE_IDS);
+export function isPagePublicPath(path) {
+    const lower = path.toLowerCase();
+    if (lower === "theme.json" ||
+        lower === "_redirects" ||
+        lower === "_headers" ||
+        lower === "_config.json" ||
+        lower === "_routes.json" ||
+        SPACE_CONFIG_ACCEPTED_FILES.some((candidate) => candidate === lower) ||
+        lower.split("/").includes("_pages") ||
+        lower === "_layout.html" ||
+        lower.endsWith("/_layout.html"))
+        return false;
+    return !lower
+        .split("/")
+        .some((segment, index) => segment.startsWith(".") && !(index === 0 && segment === ".well-known"));
+}
 export function escapePageHtml(value) {
     return value
         .replaceAll("&", "&")
@@ -10,38 +30,92 @@ export function escapePageHtml(value) {
         .replaceAll('"', """)
         .replaceAll("'", "'");
 }
+// Pushed colors are intent; the readability engine (page-colors.ts) derives
+// what the templates actually paint with. A custom background pins a complete
+// scheme for both OS modes — emitting `--sf-bg` alone used to leave dark-mode
+// visitors with the dark foreground on the user's light background.
 function themeStyle(theme) {
-    const declarations = [
-        theme.accent ? `--sf-accent:${theme.accent}` : "",
-        theme.background ? `--sf-bg:${theme.background}` : "",
-        theme.font ? `--sf-font:${theme.font}` : "",
-    ].filter(Boolean);
-    return declarations.length > 0 ? `<style>:root{${declarations.join(";")}}</style>` : "";
+    const root = [];
+    const dark = [];
+    if (theme.accent || theme.background) {
+        const derived = derivePageColors(theme);
+        // `derived.accent` is the parse-validated input (or the default), never
+        // an arbitrary string straight from the theme.
+        if (theme.accent)
+            root.push(`--sf-accent:${derived.accent}`);
+        root.push(`--sf-on-accent:${derived.onAccent}`, `--sf-link:${derived.link}`);
+        if (derived.pinned) {
+            root.push(`--sf-bg:${derived.pinned.bg}`, `--sf-fg:${derived.pinned.fg}`, `--sf-muted:${derived.pinned.muted}`, `--sf-card:${derived.pinned.card}`, `--sf-border:${derived.pinned.border}`, `--sf-error:${derived.pinned.error}`, `color-scheme:${derived.scheme}`);
+        }
+        else if (derived.linkDark) {
+            dark.push(`--sf-link:${derived.linkDark}`);
+        }
+    }
+    if (theme.font)
+        root.push(`--sf-font:${theme.font}`, `--sf-display-font:${theme.font}`);
+    if (root.length === 0)
+        return "";
+    const darkBlock = dark.length > 0 ? `@media(prefers-color-scheme:dark){:root{${dark.join(";")}}}` : "";
+    return `<style>:root{${root.join(";")}}${darkBlock}</style>`;
 }
+const runtimeSlot = (name, fallback) => `<!--sf-runtime:${name}:start-->${fallback}<!--sf-runtime:${name}:end-->`;
 function renderFiles(files) {
     if (files.length === 0)
         return '<p class="sf-empty">Nothing here yet.</p>';
-    return `<ul class="sf-files">${files
-        .map((file) => `<li><a href="${escapePageHtml(file.href)}">${file.directory ? "↳ " : ""}${escapePageHtml(file.name)}</a>${file.size ? `<span>${escapePageHtml(file.size)}</span>` : ""}</li>`)
+    return `<ul class="sf-files" role="list">${files
+        .map((file) => `<li><a href="${escapePageHtml(file.href)}"><span class="sf-file-name">${escapePageHtml(file.name)}${file.directory ? '<span aria-hidden="true">/</span>' : ""}</span></a>${file.size ? `<span class="sf-file-size">${escapePageHtml(file.size)}</span>` : ""}</li>`)
         .join("")}</ul>`;
 }
 function renderFile(file) {
     if (!file)
         return '<p class="sf-empty">File unavailable.</p>';
-    const href = escapePageHtml(file.href);
-    const image = file.mime?.startsWith("image/")
-        ? `<img class="sf-preview" src="${href}" alt="${escapePageHtml(file.name)}">`
-        : `<iframe class="sf-preview" src="${href}" title="${escapePageHtml(file.name)}"></iframe>`;
-    return `${image}<dl class="sf-file-meta"><div><dt>Name</dt><dd>${escapePageHtml(file.name)}</dd></div>${file.size ? `<div><dt>Size</dt><dd>${escapePageHtml(file.size)}</dd></div>` : ""}${file.mime ? `<div><dt>Type</dt><dd>${escapePageHtml(file.mime)}</dd></div>` : ""}</dl><a class="sf-button" href="${escapePageHtml(file.downloadHref ?? file.href)}" download>Download</a>`;
+    const rawHref = `${file.href}${file.href.includes("?") ? "&" : "?"}spacefast_raw=1`;
+    const href = escapePageHtml(rawHref);
+    const name = escapePageHtml(file.name);
+    const media = file.mime?.startsWith("image/")
+        ? `<img class="sf-preview" src="${href}" alt="">`
+        : `<iframe class="sf-preview" src="${href}" title="Preview of ${name}" loading="lazy" sandbox></iframe>`;
+    const downloadHref = file.downloadHref
+        ? `${file.downloadHref}${file.downloadHref.includes("?") ? "&" : "?"}spacefast_raw=1`
+        : rawHref;
+    return `<div class="sf-preview-wrap">${media}</div><dl class="sf-file-meta"><div><dt>Name</dt><dd>${name}</dd></div>${file.size ? `<div><dt>Size</dt><dd>${escapePageHtml(file.size)}</dd></div>` : ""}${file.mime ? `<div><dt>Type</dt><dd>${escapePageHtml(file.mime)}</dd></div>` : ""}</dl><div class="sf-actions"><a class="sf-button" href="${escapePageHtml(downloadHref)}" download>Download</a><a class="sf-ghost" href="${href}">View raw</a></div>`;
+}
+function renderSpacefastBranding(hidden) {
+    const wordmark = hidden
+        ? ""
+        : `<span class="sf-powered" tabindex="0"><svg class="sf-wordmark" viewBox="0 0 326 62" role="img" aria-label="Spacefast"><rect class="sf-wordmark-shadow" x="14" y="12" width="306" height="48"></rect><rect class="sf-wordmark-plate" x="10" y="8" width="306" height="48"></rect><path class="sf-wordmark-paper" d="${SPACEFAST_WORDMARK_PATH}"></path></svg><span class="sf-powered-line"><a href="https://spacefast.com">Best way to share what your agent made</a></span></span>`;
+    return `<footer class="sf-colophon"><div class="sf-colophon-row">${wordmark}<a class="sf-help" href="https://spacefast.com/help">Need help?</a></div></footer>`;
 }
 function renderElement(element, context) {
     switch (element) {
         case "sf-content":
             return context.content ?? "";
-        case "sf-password-form":
-            return `${context.passwordError ? `<p class="sf-error" role="alert">${escapePageHtml(context.passwordError)}</p>` : ""}<form class="sf-form" method="post" action="${escapePageHtml(context.passwordAction ?? "")}"><label>Password<input name="_pw" type="password" required autocomplete="current-password"></label><button type="submit">Continue</button></form>`;
+        case "sf-password-form": {
+            const hasError = Boolean(context.passwordError);
+            const error = hasError
+                ? `<p class="sf-error" id="sf-password-error" role="alert">${escapePageHtml(context.passwordError ?? "")}</p>`
+                : "";
+            const form = `<form class="sf-form" method="post" action="${escapePageHtml(context.passwordAction ?? "")}"><label for="sf-password">Password</label><div class="sf-form-row"><input id="sf-password" name="_pw" type="password" required autocomplete="current-password"${hasError ? ' aria-invalid="true" aria-describedby="sf-password-error"' : ""}><button type="submit">Continue</button></div>${error}</form>`;
+            return runtimeSlot("challenge", form);
+        }
         case "sf-login":
-            return `<a class="sf-button" href="${escapePageHtml(context.loginHref ?? "/__spacefast/access/login")}">Log in</a>`;
+            return runtimeSlot("challenge", `<div class="sf-actions"><a class="sf-button" href="${escapePageHtml(context.loginHref ?? "/__spacefast/access/login")}">Continue with Spacefast</a></div>`);
+        case "sf-denial-context":
+            return runtimeSlot("denial", '<p class="sf-copy">Access to this space is restricted.</p>');
+        case "sf-page-path":
+            return context.displayPath
+                ? escapePageHtml(context.displayPath)
+                : runtimeSlot("request-path", "this address");
+        case "sf-page-title":
+            return escapePageHtml(context.displayTitle ?? context.theme?.name ?? "This space");
+        case "sf-page-summary": {
+            const count = context.itemCount ?? context.files?.length ?? 0;
+            const visible = context.visibleItemCount ?? context.files?.length ?? count;
+            const label = `${count} ${count === 1 ? "item" : "items"}`;
+            return escapePageHtml(visible < count ? `${label} · showing first ${visible}` : label);
+        }
+        case "sf-spacefast-branding":
+            return renderSpacefastBranding(context.hideSpacefastBranding);
         case "sf-files":
             return renderFiles(context.files ?? []);
         case "sf-file":
@@ -61,6 +135,7 @@ export function expandPageHtml(source, context) {
         const name = (paired ?? unary)?.toLowerCase();
         return name && knownElements.has(name) ? renderElement(name, context) : _match;
     });
+    output = output.replaceAll("/*sf-default-fonts*/", context.embedPageFonts ? PAGE_EMBEDDED_FONT_FACES : PAGE_FONT_FACES);
     const tokens = themeStyle(context.theme ?? {});
     if (tokens) {
         output = /<\s*\/\s*head\s*>/i.test(output)
@@ -115,9 +190,17 @@ export function validatePageSources(input) {
                 });
             const allowed = element === "sf-logo" ||
                 element === "sf-name" ||
+                element === "sf-spacefast-branding" ||
+                (id === "404" && element === "sf-page-path") ||
                 (id === "password" && element === "sf-password-form") ||
-                (id === "index" && element === "sf-files") ||
-                (id === "preview" && element === "sf-file");
+                (id === "denied" && element === "sf-denial-context") ||
+                (id === "index" &&
+                    (element === "sf-files" ||
+                        element === "sf-page-path" ||
+                        element === "sf-page-title" ||
+                        element === "sf-page-summary")) ||
+                (id === "preview" &&
+                    (element === "sf-file" || element === "sf-page-path" || element === "sf-page-title"));
             if (knownElements.has(element) && !allowed)
                 diagnostics.push({
                     severity: "error",
@@ -169,7 +252,11 @@ export function validatePageSources(input) {
                     message: `Unknown Pages element <${element}>.`,
                     path,
                 });
-            else if (element !== "sf-content" && element !== "sf-logo" && element !== "sf-name")
+            else if (element !== "sf-content" &&
+                element !== "sf-logo" &&
+                element !== "sf-name" &&
+                element !== "sf-page-title" &&
+                element !== "sf-spacefast-branding")
                 diagnostics.push({
                     severity: "error",
                     code: "page_element_not_allowed",
@@ -242,26 +329,25 @@ export function defaultPageBody(id) {
     const source = DEFAULT_PAGE_TEMPLATES[id];
     return source.match(/<body[^>]*>([\s\S]*?)<\/body>/i)?.[1] ?? source;
 }
-const sharedCss = `:root{color-scheme:light dark;--sf-accent:#ff603d;--sf-bg:#faf9f7;--sf-fg:#1c1b1a;--sf-muted:#6b6862;--sf-card:#fff;--sf-border:#e5e2dc;--sf-font:Inter,ui-sans-serif,system-ui,sans-serif}*{box-sizing:border-box}body{margin:0;background:var(--sf-bg);color:var(--sf-fg);font:16px/1.55 var(--sf-font);min-height:100vh;display:grid;place-items:center;padding:24px}.sf-shell{width:min(100%,640px)}.sf-card{background:var(--sf-card);border:1px solid var(--sf-border);border-radius:18px;padding:clamp(24px,5vw,48px);box-shadow:0 18px 55px #1c1b1a12}h1{font-size:clamp(2rem,7vw,3.5rem);line-height:1;letter-spacing:-.05em;margin:16px 0}p{color:var(--sf-muted)}a{color:var(--sf-accent)}.sf-brand{display:flex;align-items:center;gap:10px;font-weight:650}.sf-logo{width:28px;height:28px;object-fit:contain}.sf-badge{margin-top:28px;font-size:12px;color:var(--sf-muted)}.sf-badge a{text-decoration:none}.sf-form label{display:grid;gap:8px;font-weight:600}.sf-form input{width:100%;margin-top:6px;padding:12px 14px;border:1px solid var(--sf-border);border-radius:10px;background:transparent;color:inherit;font:inherit}.sf-form button,.sf-button{display:inline-block;border:0;border-radius:10px;background:var(--sf-accent);color:#fff;padding:12px 16px;font:600 14px/1 var(--sf-font);text-decoration:none;margin-top:14px;cursor:pointer}.sf-error{color:#b42318}.sf-files{list-style:none;padding:0;margin:24px 0}.sf-files li{display:flex;border-top:1px solid var(--sf-border)}.sf-files a{padding:12px 0;flex:1;text-decoration:none}.sf-files span{padding:12px 0;color:var(--sf-muted);font-size:13px}.sf-preview{width:100%;min-height:320px;border:1px solid var(--sf-border);border-radius:10px;object-fit:contain;background:#fff}.sf-file-meta div{display:flex;justify-content:space-between;border-bottom:1px solid var(--sf-border);padding:8px 0}.sf-file-meta dt{color:var(--sf-muted)}.sf-file-meta dd{margin:0}@media(prefers-color-scheme:dark){:root{--sf-bg:#16151a;--sf-fg:#e8e6e3;--sf-muted:#a8a49c;--sf-card:#1e1d23;--sf-border:#343239}.sf-card{box-shadow:0 18px 55px #0005}}`;
-function document(title, body, noindex = false) {
-    return `<!doctype html>\n<html lang="en">\n<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">${noindex ? '<meta name="robots" content="noindex">' : ""}<title>${title}</title><style>${sharedCss}</style></head>\n<body><main class="sf-shell"><section class="sf-card">${body}</section></main></body>\n</html>\n`;
+// The built-in palette runs through the same readability engine as pushed
+// themes, so buttons and links remain readable for every accepted accent.
+const defaultPageColors = derivePageColors({});
+const sharedCss = `/*sf-default-fonts*/:root{color-scheme:light dark;--sf-accent:${PAGE_COLOR_DEFAULTS.accent};--sf-bg:${PAGE_COLOR_DEFAULTS.bg};--sf-fg:${PAGE_COLOR_DEFAULTS.fg};--sf-muted:${PAGE_COLOR_DEFAULTS.muted};--sf-card:${PAGE_COLOR_DEFAULTS.card};--sf-border:${PAGE_COLOR_DEFAULTS.border};--sf-link:${defaultPageColors.link};--sf-on-accent:${defaultPageColors.onAccent};--sf-error:#a82d1a;--sf-font:"Haskoy",-apple-system,BlinkMacSystemFont,ui-sans-serif,"Segoe UI",sans-serif;--sf-display-font:"Merriweather",Georgia,serif;--sf-mono:ui-monospace,"SF Mono",Menlo,Consolas,monospace}*{box-sizing:border-box}html{min-width:320px;background:var(--sf-bg);-webkit-font-smoothing:antialiased}body{margin:0;min-height:100vh;background:var(--sf-bg);color:var(--sf-fg);font:14px/1.65 var(--sf-font)}a{color:inherit}.sf-page{min-height:100vh;display:flex;flex-direction:column;padding:clamp(22px,4vw,44px)}.sf-header{display:flex;align-items:center;min-height:32px}.sf-page-center .sf-header{justify-content:center}.sf-brand{display:inline-flex;min-width:0;align-items:center;gap:10px;color:var(--sf-fg);text-decoration:none}.sf-brand-mark{width:7px;height:7px;flex:none;background:var(--sf-accent)}.sf-logo{width:28px;height:28px;flex:none;object-fit:contain}.sf-brand strong{min-width:0;overflow-wrap:anywhere;font-size:13px;font-weight:600}.sf-main{flex:1;width:100%;padding:clamp(34px,9vh,84px) 0}.sf-page-plain .sf-main{max-width:680px}.sf-page-center .sf-main{max-width:620px;margin:auto;display:flex;flex-direction:column;align-items:center;text-align:center}.sf-eyebrow{margin:0 0 14px;color:var(--sf-muted);font:500 11px/1.5 var(--sf-mono);letter-spacing:.12em;text-transform:uppercase;overflow-wrap:anywhere}.sf-page-center .sf-eyebrow{margin-bottom:16px}h1{max-width:20ch;margin:0 0 12px;color:var(--sf-fg);font:430 clamp(1.9rem,5vw,2.8rem)/1.22 var(--sf-display-font);letter-spacing:-.012em;text-wrap:balance}.sf-copy,.sf-sub{max-width:52ch;margin:0;color:var(--sf-muted);text-wrap:pretty}.sf-inline-path{font-family:var(--sf-mono);font-size:.9em;color:var(--sf-fg);overflow-wrap:anywhere}.sf-actions{display:flex;flex-wrap:wrap;align-items:center;gap:14px;margin-top:22px}.sf-page-center .sf-actions{justify-content:center}.sf-button,.sf-form button,.sf-login{display:inline-flex;min-height:44px;align-items:center;justify-content:center;border:0;background:var(--sf-accent);color:var(--sf-on-accent);padding:10px 16px;font:600 13px/1.4 var(--sf-font);text-decoration:none;cursor:pointer}.sf-ghost{color:var(--sf-muted);text-underline-offset:3px}.sf-button:hover,.sf-form button:hover,.sf-login:hover{filter:brightness(1.06)}a:focus-visible,button:focus-visible{outline:2px solid var(--sf-link);outline-offset:2px}.sf-form{width:100%;max-width:360px;margin-top:22px;text-align:left}.sf-form label,.sf-password label{display:block;margin-bottom:8px;color:var(--sf-muted);font:500 11px/1.5 var(--sf-mono);letter-spacing:.1em;text-transform:uppercase}.sf-password label{flex-basis:100%}.sf-form-row{display:flex;gap:10px}.sf-password form{display:flex;flex-wrap:wrap;gap:10px}.sf-form input,.sf-pw{min-width:0;flex:1;border:1px solid var(--sf-border);background:transparent;color:var(--sf-fg);padding:9px 11px;font:14px/1.5 var(--sf-font)}.sf-form input:focus-visible,.sf-pw:focus-visible{outline:2px solid var(--sf-link);outline-offset:-2px}.sf-form input[aria-invalid=true],.sf-pw[aria-invalid=true]{border-color:var(--sf-error)}.sf-form button,.sf-password button{margin:0}.sf-error{margin:9px 0 0;color:var(--sf-error);font-size:14px}.sf-password .sf-error{flex-basis:100%;margin:0}.sf-block{width:100%}.sf-login-block{display:flex;justify-content:center;margin-top:20px}.sf-copy+.sf-copy{margin-top:12px}.sf-files{width:100%;margin:24px 0 0;padding:0;list-style:none}.sf-files li{display:flex;min-width:0;align-items:baseline;gap:18px;border-bottom:1px solid var(--sf-border)}.sf-files a{min-width:0;flex:1;padding:10px 2px;color:var(--sf-fg);font-weight:500;text-decoration:none}.sf-files a:hover{color:var(--sf-link)}.sf-file-name{overflow-wrap:anywhere}.sf-file-size{flex:none;padding:10px 2px;color:var(--sf-muted);font:12px/1.5 var(--sf-mono);white-space:nowrap}.sf-empty{max-width:420px;margin:24px 0 0;border:1px dashed var(--sf-border);padding:18px 20px;color:var(--sf-muted)}.sf-preview-wrap{width:min(100%,560px);aspect-ratio:16/9;margin:10px 0 18px;overflow:hidden;background:#fff;outline:1px solid color-mix(in srgb,var(--sf-fg) 10%,transparent);outline-offset:-1px}.sf-preview{display:block;width:100%;height:100%;border:0;object-fit:contain}.sf-file-meta{width:min(100%,560px);margin:0}.sf-file-meta div{display:flex;min-width:0;justify-content:space-between;gap:20px;border-bottom:1px solid var(--sf-border);padding:9px 2px}.sf-file-meta dt{color:var(--sf-fg);font-weight:600}.sf-file-meta dd{min-width:0;margin:0;color:var(--sf-muted);font-family:var(--sf-mono);overflow-wrap:anywhere;text-align:right}.sf-colophon{display:flex;flex-direction:column;align-items:center;gap:10px;padding:44px 0 26px;margin-top:auto;color:var(--sf-muted)}.sf-page-plain .sf-colophon{align-items:flex-start}.sf-colophon-row{display:flex;align-items:center;gap:20px;flex-wrap:wrap}.sf-powered{display:inline-flex;align-items:center;gap:10px;cursor:pointer;outline:none}.sf-powered-line{display:none;font-size:12px;color:var(--sf-muted)}.sf-powered:hover .sf-powered-line,.sf-powered:focus .sf-powered-line,.sf-powered:focus-within .sf-powered-line{display:inline}.sf-powered-line a{color:var(--sf-link);text-decoration:underline;text-underline-offset:3px}.sf-help{font-size:12px;color:var(--sf-muted);text-decoration:underline;text-underline-offset:3px}.sf-help:hover{color:var(--sf-fg)}.sf-wordmark{display:block;flex:none;width:auto;height:11px}.sf-wordmark-shadow{fill:var(--sf-accent)}.sf-wordmark-plate{fill:#141419}.sf-wordmark-paper{fill:#fbf8f1}@media(max-width:520px){.sf-page{padding:20px}.sf-form-row,.sf-password form{flex-direction:column}.sf-button,.sf-form button,.sf-login{min-height:48px}.sf-file-meta div{flex-direction:column;gap:2px}.sf-file-meta dd{text-align:left}.sf-colophon{padding-top:32px}}@media(prefers-color-scheme:dark){:root{--sf-bg:${PAGE_COLOR_DEFAULTS.darkBg};--sf-fg:${PAGE_COLOR_DEFAULTS.darkFg};--sf-muted:${PAGE_COLOR_DEFAULTS.darkMuted};--sf-card:${PAGE_COLOR_DEFAULTS.darkCard};--sf-border:${PAGE_COLOR_DEFAULTS.darkBorder};--sf-link:${defaultPageColors.linkDark};--sf-error:#ff8a7a}.sf-preview-wrap{outline-color:#ffffff1a}}@media(forced-colors:active){.sf-brand-mark{background:CanvasText}.sf-button,.sf-form button,.sf-login{border:1px solid ButtonText}.sf-powered:focus{outline:1px solid CanvasText;outline-offset:3px}}`;
+const pageHeader = '<header class="sf-header"><a class="sf-brand" href="/" aria-label="Homepage"><span class="sf-brand-mark" aria-hidden="true"></span><sf-logo></sf-logo><strong><sf-name></sf-name></strong></a></header>';
+const pageFooter = "<sf-spacefast-branding></sf-spacefast-branding>";
+function document(id, title, body, layout) {
+    const noindex = PAGE_CATALOG[id].noindex ? '<meta name="robots" content="noindex">' : "";
+    return `<!doctype html>\n<html lang="en">\n<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">${noindex}<title>${title}</title><style>${sharedCss}</style></head>\n<body><div class="sf-page sf-page-${layout}">${pageHeader}<main class="sf-main">${body}</main>${pageFooter}</div></body>\n</html>\n`;
 }
-const badge = '<p class="sf-badge">Hosted with <a href="https://spacefast.com">Spacefast</a></p>';
 export const DEFAULT_PAGE_TEMPLATES = {
-    "404": document("Page not found", '<div class="sf-brand"><sf-logo></sf-logo><sf-name></sf-name></div><h1>Lost in space.</h1><p>This page doesn’t exist. Check the address or head back home.</p><a class="sf-button" href="/">Go home</a>' +
-        badge),
-    password: document("Password required", '<div class="sf-brand"><sf-logo></sf-logo><sf-name></sf-name></div><h1>This one’s private.</h1><p>Enter the password to keep going.</p><sf-password-form></sf-password-form>' +
-        badge, true),
-    denied: document("Access denied", '<div class="sf-brand"><sf-logo></sf-logo><sf-name></sf-name></div><h1>Not for this account.</h1><p>You don’t have access to this page.</p>' +
-        badge, true),
-    login: document("Log in", '<div class="sf-brand"><sf-logo></sf-logo><sf-name></sf-name></div><h1>Log in to continue.</h1><p>This space knows its people.</p><sf-login></sf-login>' +
-        badge, true),
-    index: document("Files", '<div class="sf-brand"><sf-logo></sf-logo><sf-name></sf-name></div><h1>Files</h1><sf-files></sf-files>' +
-        badge),
-    preview: document("File preview", '<div class="sf-brand"><sf-logo></sf-logo><sf-name></sf-name></div><h1>Preview</h1><sf-file></sf-file>' +
-        badge),
+    "404": document("404", "Page not found", '<p class="sf-eyebrow">404 · Not Found</p><h1>Page not found</h1><p class="sf-copy">There’s nothing at <span class="sf-inline-path"><sf-page-path></sf-page-path></span>.</p><div class="sf-actions"><a class="sf-button" href="/">Go to the homepage</a></div>', "center"),
+    password: document("password", "Password required", '<h1>This space is protected</h1><p class="sf-sub">Enter the password to continue.</p><sf-password-form></sf-password-form>', "center"),
+    denied: document("denied", "Access denied", "<h1>Access denied</h1><sf-denial-context></sf-denial-context>", "center"),
+    login: document("login", "Sign in", '<h1>This space is for members</h1><p class="sf-sub">Sign in to continue — you’ll come right back here.</p><sf-login></sf-login>', "center"),
+    index: document("index", "<sf-page-title></sf-page-title>", '<p class="sf-eyebrow"><sf-page-path></sf-page-path></p><h1><sf-page-title></sf-page-title></h1><p class="sf-sub"><sf-page-summary></sf-page-summary></p><sf-files></sf-files>', "plain"),
+    preview: document("preview", "<sf-page-title></sf-page-title>", '<p class="sf-eyebrow"><sf-page-path></sf-page-path></p><h1><sf-page-title></sf-page-title></h1><sf-file></sf-file>', "plain"),
 };
-export const DEFAULT_LAYOUT_TEMPLATE = `<!doctype html>\n<html lang="en">\n<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title><sf-name></sf-name></title></head>\n<body>\n  <header><a href="/"><sf-logo></sf-logo><sf-name></sf-name></a></header>\n  <main><sf-content></sf-content></main>\n</body>\n</html>\n`;
+export const DEFAULT_LAYOUT_TEMPLATE = `<!doctype html>\n<html lang="en">\n<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title><sf-page-title></sf-page-title></title><style>${sharedCss}</style></head>\n<body><sf-content></sf-content></body>\n</html>\n`;
 export function defaultPageTemplate(id) {
     return DEFAULT_PAGE_TEMPLATES[id];
 }

package/dist/utils/production-runtime.d.ts

@@ -0,0 +1,18 @@
+type RuntimeEnvironment = Record<string, string | undefined>;
+type RailwayRuntimeEvidence = {
+    kind: "railway";
+    runtimeEnvironment: string | undefined;
+    env: RuntimeEnvironment;
+};
+type BrowserRuntimeEvidence = {
+    kind: "browser";
+    currentUrl: string;
+    productionOrigin: string;
+};
+export type ProductionRuntimeEvidence = RailwayRuntimeEvidence | BrowserRuntimeEvidence;
+/**
+ * Proves that telemetry is executing in a deployed production runtime.
+ * Environment labels alone are configuration, not runtime evidence.
+ */
+export declare function isProductionRuntime(evidence: ProductionRuntimeEvidence): boolean;
+export {};

package/dist/utils/production-runtime.js

@@ -0,0 +1,28 @@
+const RAILWAY_RUNTIME_IDENTITY_KEYS = [
+    "RAILWAY_PROJECT_ID",
+    "RAILWAY_ENVIRONMENT_ID",
+    "RAILWAY_SERVICE_ID",
+    "RAILWAY_DEPLOYMENT_ID",
+];
+function present(value) {
+    return Boolean(value?.trim());
+}
+/**
+ * Proves that telemetry is executing in a deployed production runtime.
+ * Environment labels alone are configuration, not runtime evidence.
+ */
+export function isProductionRuntime(evidence) {
+    if (evidence.kind === "railway") {
+        return (evidence.runtimeEnvironment?.trim().toLowerCase() === "production" &&
+            evidence.env.RAILWAY_ENVIRONMENT_NAME?.trim().toLowerCase() === "production" &&
+            RAILWAY_RUNTIME_IDENTITY_KEYS.every((key) => present(evidence.env[key])));
+    }
+    try {
+        const current = new URL(evidence.currentUrl);
+        const production = new URL(evidence.productionOrigin);
+        return production.protocol === "https:" && current.origin === production.origin;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/utils/query-keys.d.ts

@@ -21,7 +21,6 @@ export declare const qk: {
     teamSpaces: (id: string) => readonly ["teams", string, "spaces"];
     teamDomains: (id: string) => readonly ["teams", string, "domains"];
     teamManagedDomains: (id: string) => readonly ["teams", string, "managed-domains"];
-    domainBindings: () => readonly ["domain-bindings"];
     slugAvailability: (kind: "team" | "space", slug: string, teamId?: string, currentSlug?: string) => readonly ["slugs", "availability", "space" | "team", string, string, string];
     teamVariables: (id: string) => readonly ["teams", string, "variables"];
     teamActivity: (id: string, limit: number) => readonly ["teams", string, "activity", number];
@@ -30,8 +29,8 @@ export declare const qk: {
     spaceVersions: (id: string) => readonly ["spaces", string, "versions"];
     spaceVersionsHistory: (id: string) => readonly ["spaces", string, "versions", "history"];
     spaceCollaboration: (id: string) => readonly ["spaces", string, "collaboration"];
-    spaceCollaborationEmbedConfig: (id: string) => readonly ["spaces", string, "collaboration", "embed-config"];
-    spaceAnnotations: (id: string) => readonly ["spaces", string, "annotations"];
+    spaceComments: (id: string) => readonly ["spaces", string, "comments"];
+    spaceCommentThread: (id: string, threadId: string) => readonly ["spaces", string, "comments", string];
     spaceActivity: (id: string, limit: number) => readonly ["spaces", string, "activity", number];
     spaceDeployments: (id: string) => readonly ["spaces", string, "deployments"];
     spaceTags: (id: string) => readonly ["spaces", string, "tags"];
@@ -39,11 +38,11 @@ export declare const qk: {
     spaceTagDiff: (id: string, versionId: string) => readonly ["spaces", string, "tags", string, "diff"];
     spaceTagReleases: (id: string) => readonly ["spaces", string, "tags", "releases"];
     spaceTagsEffective: (id: string) => readonly ["spaces", string, "tags", "effective"];
-    build: (id: string) => readonly ["builds", string];
-    buildLogs: (id: string, limit?: number) => readonly ["builds", string, "logs"] | readonly ["builds", string, "logs", number];
+    build: (spaceId: string, id: string) => readonly ["spaces", string, "builds", string];
+    buildLogs: (spaceId: string, id: string, limit?: number) => readonly ["spaces", string, "builds", string, "logs"] | readonly ["spaces", string, "builds", string, "logs", number];
     spaceBuilds: (id: string) => readonly ["spaces", string, "builds"];
     spaceRepositoryConnection: (id: string, connectionType?: string) => readonly ["spaces", string, "repository-connection", string];
-    repositoryInstallations: (spaceId: string) => readonly ["repository-connections", "installations", string];
+    repositoryInstallations: (spaceId: string) => readonly ["spaces", string, "repository-installations"];
     repositoryInstallationRepositories: (installationId: string) => readonly ["repository-connections", "installations", string, "repositories"];
     spaceRepositoryAnalyze: (id: string, connectionType?: string, ref?: string, root?: string) => readonly ["spaces", string, "repository-connection", string, "analyze", string, string];
     spaceRepositoryWebhookDeliveries: (id: string, connectionType?: string) => readonly ["spaces", string, "repository-webhook-deliveries", string];
@@ -51,7 +50,7 @@ export declare const qk: {
     webhook: (webhookId: string) => readonly ["webhooks", string];
     webhookDeliveries: (webhookId: string) => readonly ["webhooks", string, "deliveries"];
     spaceVersion: (id: string, versionId: string) => readonly ["spaces", string, "versions", string];
-    spaceVersionAnnotations: (id: string, versionId: string, status?: string) => readonly ["spaces", string, "versions", string, "annotations"] | readonly ["spaces", string, "versions", string, "annotations", string];
+    spaceVersionComments: (id: string, versionId: string, status?: string) => readonly ["spaces", string, "versions", string, "comments"] | readonly ["spaces", string, "versions", string, "comments", string];
     spaceVersionFiles: (id: string, versionId: string) => readonly ["spaces", string, "versions", string, "files"];
     spaceVersionFile: (id: string, versionId: string, path: string) => readonly ["spaces", string, "versions", string, "files", string];
     spaceVersionFileDirectUrl: (id: string, versionId: string, path: string) => readonly ["spaces", string, "versions", string, "files", string, "direct-url"];

package/dist/utils/query-keys.js

@@ -26,7 +26,6 @@ export const qk = {
     teamSpaces: (id) => ["teams", id, "spaces"],
     teamDomains: (id) => ["teams", id, "domains"],
     teamManagedDomains: (id) => ["teams", id, "managed-domains"],
-    domainBindings: () => ["domain-bindings"],
     slugAvailability: (kind, slug, teamId, currentSlug) => ["slugs", "availability", kind, slug, teamId ?? "", currentSlug ?? ""],
     teamVariables: (id) => ["teams", id, "variables"],
     teamActivity: (id, limit) => ["teams", id, "activity", limit],
@@ -38,8 +37,8 @@ export const qk = {
     // `invalidateQueries({ queryKey: qk.spaceVersions(id) })` still reaches it.
     spaceVersionsHistory: (id) => [...qk.spaceVersions(id), "history"],
     spaceCollaboration: (id) => ["spaces", id, "collaboration"],
-    spaceCollaborationEmbedConfig: (id) => ["spaces", id, "collaboration", "embed-config"],
-    spaceAnnotations: (id) => ["spaces", id, "annotations"],
+    spaceComments: (id) => ["spaces", id, "comments"],
+    spaceCommentThread: (id, threadId) => [...qk.spaceComments(id), threadId],
     spaceActivity: (id, limit) => ["spaces", id, "activity", limit],
     spaceDeployments: (id) => ["spaces", id, "deployments"],
     spaceTags: (id) => ["spaces", id, "tags"],
@@ -49,15 +48,15 @@ export const qk = {
     // The merged (system+team+space) read-only view; never a write base — see
     // `fetchSpaceReleasedGraph` in apps/my/src/lib/space-queries.ts.
     spaceTagsEffective: (id) => ["spaces", id, "tags", "effective"],
-    build: (id) => ["builds", id],
+    build: (spaceId, id) => [...qk.spaceBuilds(spaceId), id],
     // Observers with different limits must not share a cache entry; calling with
     // no limit yields the bare prefix for invalidating every limit at once.
-    buildLogs: (id, limit) => limit === undefined
-        ? ["builds", id, "logs"]
-        : ["builds", id, "logs", limit],
+    buildLogs: (spaceId, id, limit) => limit === undefined
+        ? [...qk.build(spaceId, id), "logs"]
+        : [...qk.build(spaceId, id), "logs", limit],
     spaceBuilds: (id) => ["spaces", id, "builds"],
     spaceRepositoryConnection: (id, connectionType = "connected") => ["spaces", id, "repository-connection", connectionType],
-    repositoryInstallations: (spaceId) => ["repository-connections", "installations", spaceId],
+    repositoryInstallations: (spaceId) => [...qk.space(spaceId), "repository-installations"],
     repositoryInstallationRepositories: (installationId) => ["repository-connections", "installations", installationId, "repositories"],
     spaceRepositoryAnalyze: (id, connectionType = "connected", ref = "", root = "") => ["spaces", id, "repository-connection", connectionType, "analyze", ref, root],
     spaceRepositoryWebhookDeliveries: (id, connectionType = "connected") => ["spaces", id, "repository-webhook-deliveries", connectionType],
@@ -66,10 +65,10 @@ export const qk = {
     webhookDeliveries: (webhookId) => ["webhooks", webhookId, "deliveries"],
     spaceVersion: (id, versionId) => ["spaces", id, "versions", versionId],
     // Calling with no status yields the bare prefix, for invalidating every
-    // status-scoped annotations list at once.
-    spaceVersionAnnotations: (id, versionId, status) => status === undefined
-        ? ["spaces", id, "versions", versionId, "annotations"]
-        : ["spaces", id, "versions", versionId, "annotations", status],
+    // status-scoped version comment list at once.
+    spaceVersionComments: (id, versionId, status) => status === undefined
+        ? ["spaces", id, "versions", versionId, "comments"]
+        : ["spaces", id, "versions", versionId, "comments", status],
     spaceVersionFiles: (id, versionId) => ["spaces", id, "versions", versionId, "files"],
     spaceVersionFile: (id, versionId, path) => ["spaces", id, "versions", versionId, "files", path],
     spaceVersionFileDirectUrl: (id, versionId, path) => ["spaces", id, "versions", versionId, "files", path, "direct-url"],

package/dist/utils/sf-config-v1.fixtures.json

@@ -0,0 +1,9 @@
+{
+    "minimal.jsonc": "{\n  // The canonical starter is intentionally tiny.\n  \"$schema\": \"https://spacefast.com/schemas/sf.v1.json\",\n  \"version\": 1,\n}\n",
+    "full.jsonc": "{\n  \"version\": 1,\n  \"build\": {\n    \"installRoot\": \"packages/site\",\n    \"installCommand\": \"bun install --frozen-lockfile\",\n    \"command\": \"bun run build\",\n    \"output\": \"dist\",\n    \"timeoutSeconds\": 600\n  },\n  \"serve\": {\n    \"index\": \"index.html\",\n    \"spaFallback\": \"index.html\",\n    \"cleanUrls\": false,\n    \"directoryListing\": false\n  },\n  \"metadata\": {\n    \"title\": \"Docs\",\n    \"description\": \"The useful bits.\",\n    \"image\": \"/og.png\"\n  },\n  \"substitute\": { \"files\": [\"assets/runtime.js\"] }\n}\n",
+    "invalid-values.jsonc": "{\n  \"version\": 1,\n  \"build\": {\n    \"installRoot\": \"/outside\",\n    \"timeoutSeconds\": 30\n  },\n  \"serve\": { \"cleanUrls\": null },\n  \"substitute\": { \"files\": \"index.html\" }\n}\n",
+    "removed-identity.jsonc": "{\n  \"version\": 1,\n  \"space\": \"docs\",\n  \"placement\": \"dedicated\",\n  \"inject\": { \"head\": \"nope\" }\n}\n",
+    "retired-template.jsonc": "{\n  \"version\": 1,\n  \"substitute\": { \"files\": [\"runtime.js\"] }\n}\n",
+    "syntax-error.jsonc": "{\n  \"version\": 1,\n  \"serve\": { \"index\": \"index.html\" }\n",
+    "unknown-nested.jsonc": "{\n  \"version\": 1,\n  \"serve\": {\n    \"directoryListings\": true\n  }\n}\n"
+}

package/dist/utils/sf-config-v1.js

@@ -127,7 +127,7 @@ class JsoncReader {
             }
             this.offset += 4;
         }
-        this.fail("Unterminated string", start);
+        return this.fail("Unterminated string", start);
     }
     trivia() {
         while (this.offset < this.source.length) {
@@ -286,16 +286,20 @@ export function compileSfConfigV1(source, options = {}) {
         config,
         effective: {
             version: 1,
-            ...(config.build ? {
-                build: {
-                    ...config.build,
-                    installRoot: config.build.installRoot ?? ".",
-                    timeoutSeconds: config.build.timeoutSeconds ?? 900,
-                },
-            } : {}),
+            ...(config.build
+                ? {
+                    build: {
+                        ...config.build,
+                        installRoot: config.build.installRoot ?? ".",
+                        timeoutSeconds: config.build.timeoutSeconds ?? 900,
+                    },
+                }
+                : {}),
             serve: {
                 index,
-                ...(config.serve?.spaFallback !== undefined ? { spaFallback: config.serve.spaFallback } : {}),
+                ...(config.serve?.spaFallback !== undefined
+                    ? { spaFallback: config.serve.spaFallback }
+                    : {}),
                 cleanUrls: config.serve?.cleanUrls ?? true,
                 directoryListing: config.serve?.directoryListing ?? index === false,
             },
@@ -311,14 +315,16 @@ function invalidResult(message, line, column) {
         success: false,
         config: null,
         effective: null,
-        issues: [{
+        issues: [
+            {
                 code: "config_invalid",
                 severity: "error",
                 path: "$",
                 line,
                 column,
                 message,
-            }],
+            },
+        ],
         locations: new Map([["$", { line, column }]]),
     };
 }
@@ -374,9 +380,8 @@ function validateShape(value, issue) {
     }
     if (isObject(value.build)) {
         const timeout = value.build.timeoutSeconds;
-        if (typeof timeout === "number" && (!Number.isInteger(timeout)
-            || timeout < 60
-            || timeout > 7200)) {
+        if (typeof timeout === "number" &&
+            (!Number.isInteger(timeout) || timeout < 60 || timeout > 7200)) {
             issue("config_invalid", "$.build.timeoutSeconds", "build.timeoutSeconds must be an integer from 60 to 7200.");
         }
         const installRoot = value.build.installRoot;
@@ -470,9 +475,9 @@ function editDistance(left, right) {
     return previous[right.length] ?? right.length;
 }
 function isCommittedPath(candidate) {
-    return candidate.length > 0
-        && !/^[A-Za-z][A-Za-z0-9+.-]*:/.test(candidate)
-        && !isAbsoluteOrEscaping(candidate);
+    return (candidate.length > 0 &&
+        !/^[A-Za-z][A-Za-z0-9+.-]*:/.test(candidate) &&
+        !isAbsoluteOrEscaping(candidate));
 }
 function isCommittedImagePath(candidate) {
     return /^\/(?!\/)/.test(candidate) && !candidate.split(/[\\/]/).includes("..");
@@ -505,14 +510,18 @@ function validateArtifactReferences(value, artifactPaths, issue) {
     if (isObject(value.serve)) {
         for (const key of ["index", "spaFallback"]) {
             const candidate = value.serve[key];
-            if (typeof candidate === "string" && isCommittedPath(candidate) && !artifacts.has(candidate)) {
+            if (typeof candidate === "string" &&
+                isCommittedPath(candidate) &&
+                !artifacts.has(candidate)) {
                 issue("config_invalid", `$.serve.${key}`, `serve.${key} must reference a committed artifact.`);
             }
         }
     }
     if (isObject(value.substitute) && Array.isArray(value.substitute.files)) {
         value.substitute.files.forEach((candidate, index) => {
-            if (typeof candidate === "string" && isCommittedPath(candidate) && !artifacts.has(candidate)) {
+            if (typeof candidate === "string" &&
+                isCommittedPath(candidate) &&
+                !artifacts.has(candidate)) {
                 issue("config_invalid", `$.substitute.files[${index}]`, "substitute.files entries must reference committed artifacts.");
             }
         });

package/dist/utils/source-archive-policy.d.ts

@@ -0,0 +1,2 @@
+export declare const SOURCE_ARCHIVE_MAX_EXPANSION_RATIO = 200;
+export declare const SOURCE_ARCHIVE_EXPANSION_RATIO_FLOOR_BYTES: number;

package/dist/utils/source-archive-policy.js

@@ -0,0 +1,2 @@
+export const SOURCE_ARCHIVE_MAX_EXPANSION_RATIO = 200;
+export const SOURCE_ARCHIVE_EXPANSION_RATIO_FLOOR_BYTES = 8 * 1024 * 1024;

package/dist/utils/static-runtime-policy.fixtures.json

@@ -0,0 +1,57 @@
+{
+    "phpLike": [
+        { "path": "index.php", "expected": true },
+        { "path": "nested/app.phtml", "expected": true },
+        { "path": "lib.phar", "expected": true },
+        { "path": "legacy.php5", "expected": true },
+        { "path": "index.html", "expected": false },
+        { "path": "assets/main.js", "expected": false },
+        { "path": ".env", "expected": false }
+    ],
+    "immutable": [
+        { "path": "_next/static/chunks/main-app-4A_iFExJ.js", "expected": true },
+        { "path": "_next/static/chunks/framework-2c1d4f8a.js", "expected": true },
+        { "path": "_next/static/chunks/pages/index-a1b2c3d4e5f6.js", "expected": true },
+        { "path": "_next/static/chunks/oton0Guf.js", "expected": true },
+        { "path": "_next/static/css/app.plainname.css", "expected": true },
+        { "path": "/_next/static/chunks/oton0Guf.js", "expected": true },
+        { "path": "_app/immutable/entry/start.DYyuCeEr.js", "expected": true },
+        { "path": "_nuxt/index.oton0Guf.js", "expected": true },
+        { "path": "_astro/about.DYyuCeEr.css", "expected": true },
+        { "path": "_next/static/index.html", "expected": false },
+        { "path": "_next/static/sitemap.xml", "expected": false },
+        { "path": "_app/immutable/manifest.txt", "expected": false },
+        { "path": "_nextish/chunks/oton0Guf.js", "expected": false },
+        { "path": "nested/_next/static/chunks/oton0Guf.js", "expected": false },
+        { "path": "assets/index-BzeDGMM3.js", "expected": false },
+        { "path": "assets/auth-client-P1Tx-Cyu.js", "expected": false },
+        { "path": "assets/index-DYyuCeEr.js", "expected": false },
+        { "path": "assets/index-9f8e7d6c.js", "expected": false },
+        { "path": "assets/D3GeoMap.js", "expected": false },
+        { "path": "assets/index.js", "expected": false },
+        { "path": "assets/client-widget.js", "expected": false },
+        { "path": "app.1a2b3c4d.css", "expected": false },
+        { "path": "vendor.3f9a2b7e.js", "expected": false },
+        { "path": "static/js/main.d41d8cd98f00b204e9800998.js", "expected": false },
+        { "path": "index.html", "expected": false },
+        { "path": "robots.txt", "expected": false },
+        { "path": "config.xml", "expected": false },
+        { "path": "page.php", "expected": false },
+        { "path": "MyComponent.js", "expected": false },
+        { "path": "image01.png", "expected": false }
+    ],
+    "safeContentType": [
+        {
+            "path": "index.php",
+            "mime": "application/x-httpd-php",
+            "expected": "text/plain; charset=utf-8"
+        },
+        { "path": "lib.phar", "mime": "application/zip", "expected": "application/octet-stream" },
+        {
+            "path": "assets/main.js",
+            "mime": "text/javascript; charset=utf-8",
+            "expected": "text/javascript; charset=utf-8"
+        },
+        { "path": "logo.svg", "mime": "image/svg+xml", "expected": "image/svg+xml" }
+    ]
+}

package/dist/utils/static-runtime-policy.js

@@ -11,7 +11,7 @@ export const PHP_LIKE_EXTENSIONS = ["php", "php3", "php4", "php5", "php7", "php8
 // Headers"): user `_headers` rules can never set or remove these. The list includes the
 // internal-redirect/sendfile family (X-Accel-Redirect, X-Sendfile, X-LIGHTTPD-send-file,
 // X-Accel-Buffering) because under nginx+php-fpm those headers turn a response into a
-// server-side file read — a private-path disclosure primitive. The routing compiler
+// server-side file read — a private-path disclosure primitive. The native Rust compiler
 // rejects them at publish; the PHP runtime refuses them again at apply time so a compiler
 // gap can never emit one.
 export const PLATFORM_MANAGED_RESPONSE_HEADERS = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spacefast/common",
-  "version": "0.0.11",
+  "version": "0.0.12",
   "license": "MIT",
   "description": "Shared TypeScript contracts and utilities for Spacefast packages.",
   "repository": {
@@ -91,8 +91,9 @@
     }
   },
   "dependencies": {
-    "@tanstack/react-query": "^5.101.1",
-    "smol-toml": "^1.6.1",
-    "zod": "^4.3.6"
+    "@tanstack/react-query": "^5.101.4",
+    "culori": "^4.0.2",
+    "smol-toml": "^1.7.0",
+    "zod": "^4.4.3"
   }
 }