@spacefast/common 0.0.11 → 0.0.13

package/dist/contracts/error-codes.js

@@ -6,8 +6,9 @@
 // `ErrorCode`, so emitting a code that is not in the table is a typecheck (CI) failure;
 // the remaining untyped string paths (low-level serializer, superadmin Better Auth
 // passthrough) fold into the typed envelope in the F2 envelope chunk.
-// Growth is additive-only: codes are never renamed or removed. Diagnostic codes share
-// this table so every diagnostic also carries a resolvable docs link.
+// A code's meaning stays stable while it can be emitted. Retiring an API surface removes
+// its dead codes and generated references together. Diagnostic codes share this table so
+// every current diagnostic also carries a resolvable docs link.
 import { ERROR_DOCS_BASE_URL } from "../brand.js";
 export { ERROR_DOCS_BASE_URL };
 /** `docsUrl` derivation rule: docs origin + `/{code}`. Asserted by the conformance suite. */
@@ -19,9 +20,11 @@ export const ERROR_CODES = [
     "abuse_report_rate_limited",
     "abuse_takedown",
     "access_denied",
+    "access_scope_suggestion",
     "account_suspended",
     "agent_handoff_declined",
     "agent_handoff_limit_reached",
+    "agent_handoff_origin_unsupported",
     "ambiguous_space_slug",
     "anonymous_expired",
     "anonymous_pool_unavailable",
@@ -68,8 +71,8 @@ export const ERROR_CODES = [
     "credential_revoked",
     "csam_blocked",
     "csam_policy_floor",
+    "custom_certificates_require_dedicated_site",
     "data_location_immutable",
-    "datacenters_unavailable",
     "device_authorization_failed",
     "device_verification_rate_limited",
     "dns_export_required",
@@ -133,10 +136,9 @@ export const ERROR_CODES = [
     "files_mode_does_not_support_spa",
     "forbidden",
     "free_external_proxy_disabled",
-    "free_headers_basic_auth_disabled",
+    "google_play_webhook_identity_not_configured",
     "idempotency_conflict_in_progress",
     "idempotency_key_reused",
-    "immutable_version_requires_login",
     "import_archive_not_uploaded",
     "import_not_cancelable",
     "import_not_waiting_for_archive",
@@ -151,6 +153,7 @@ export const ERROR_CODES = [
     "invalid_domain",
     "invalid_domain_name",
     "invalid_file_path",
+    "invalid_google_play_webhook_identity",
     "invalid_grant",
     "invalid_idempotency_key",
     "invalid_publish_archive",
@@ -180,6 +183,7 @@ export const ERROR_CODES = [
     "last_owner",
     "log_retention_clamped",
     "lost_domain_control",
+    "maintenance_in_progress",
     "malware_detected",
     "managed_domain_protected",
     "manifest_body_too_large",
@@ -224,6 +228,7 @@ export const ERROR_CODES = [
     "publish_not_cancelable",
     "publish_path_collision",
     "publish_path_invalid",
+    "publish_reference_missing",
     "publish_setup_failed",
     "publish_snapshot_empty",
     "publish_upload_failed",
@@ -242,7 +247,6 @@ export const ERROR_CODES = [
     "runtime_jti_missing",
     "runtime_jti_replayed",
     "runtime_jwks_key_missing",
-    "runtime_logs_unavailable",
     "runtime_management_unavailable",
     "runtime_not_provisioned",
     "runtime_operation_missing",
@@ -255,8 +259,8 @@ export const ERROR_CODES = [
     "runtime_upload_required",
     "scan_pending",
     "secret_variable_in_template",
+    "service_signature_invalid",
     "site_already_deleted",
-    "site_capacity_exceeded",
     "site_has_live_spaces",
     "site_not_static",
     "site_required",
@@ -265,7 +269,11 @@ export const ERROR_CODES = [
     "slug_invalid",
     "slug_reserved",
     "slug_unavailable",
+    "source_archive_decompression_timeout",
+    "source_archive_expansion_ratio_exceeded",
+    "source_archive_validation_busy",
     "space_already_claimed",
+    "space_capacity_warming",
     "space_claim_unavailable",
     "space_claimed_credential_available",
     "space_disabled",
@@ -277,6 +285,7 @@ export const ERROR_CODES = [
     "space_import_archive_too_large",
     "space_import_config_only_archive",
     "space_import_runtime_schema_unsupported",
+    "space_move_would_strand_zero_data",
     "space_moving",
     "space_no_live_version",
     "space_not_disabled",
@@ -287,6 +296,13 @@ export const ERROR_CODES = [
     "space_unclaimed",
     "ssl_renewal_blocked",
     "static_control_file_not_supported",
+    "static_mount_path_conflict",
+    "static_mount_source_not_ready",
+    "static_mount_target_forbidden",
+    "static_mount_target_in_use",
+    "static_mount_target_not_live",
+    "static_mount_target_not_ready",
+    "static_mount_target_not_static",
     "static_runtime_control_path_not_supported",
     "static_runtime_required",
     "storage_bucket_unavailable",
@@ -321,7 +337,6 @@ export const ERROR_CODES = [
     "upload_hash_mismatch",
     "upload_path_not_canonical",
     "upload_path_not_declared",
-    "upload_session_cap_exceeded",
     "upload_size_mismatch",
     "user_banned",
     "validation_error",
@@ -364,10 +379,8 @@ export const ERROR_CODES = [
     "zero_artifact_abi_mismatch",
     "zero_artifact_invalid",
     "zero_artifact_malformed",
-    "zero_artifact_missing",
     "zero_artifact_path_invalid",
     "zero_artifact_unreadable",
-    "zero_artifact_untrusted",
     "zero_auth_unavailable",
     "zero_blob_key_invalid",
     "zero_blob_store_full",
@@ -390,8 +403,11 @@ export const ERROR_CODES = [
     "zero_db_row_invalid",
     "zero_db_sql_invalid",
     "zero_db_too_many_params",
+    "zero_db_transaction_active",
     "zero_db_transaction_commit_failed",
     "zero_db_transaction_invalid",
+    "zero_db_transaction_missing",
+    "zero_db_transaction_rollback_failed",
     "zero_db_transaction_start_failed",
     "zero_db_url_invalid",
     "zero_db_url_missing",
@@ -418,7 +434,6 @@ export const ERROR_CODES = [
     "zero_js_response_malformed",
     "zero_js_runtime_init_failed",
     "zero_log_query_invalid",
-    "zero_lookup_invalid",
     "zero_method_not_allowed",
     "zero_migration_failed",
     "zero_query_name_missing",
@@ -434,6 +449,8 @@ export const ERROR_CODES = [
     "zero_replay_unavailable",
     "zero_request_body_too_large",
     "zero_requires_dedicated_plan",
+    "zero_response_header_forbidden",
+    "zero_response_header_invalid",
     "zero_response_too_large",
     "zero_routes_invalid",
     "zero_run_compile_failed",

package/dist/contracts/execution.d.ts

@@ -0,0 +1,212 @@
+import { z } from "zod";
+/**
+ * The platform execution layer: everything true of running tenant code on
+ * Spacefast regardless of which product is running it.
+ *
+ * Two products sit on top of this file, and they are genuinely different
+ * things rather than two configurations of one thing:
+ *
+ * - **Zero** (`./zero.js`) runs capsules — schema, queries, mutations and
+ *   endpoints that share one parent-owned transaction — in the native runner
+ *   on a dedicated wp.cloud site, next to that site's MySQL.
+ * - **Functions** (`./functions.js`) runs workers on Cloudflare Workers for
+ *   Platforms, carrying npm and framework output that we could never sandbox
+ *   as well ourselves.
+ *
+ * The only surface both can host is an endpoint that touches neither the
+ * database nor the caller's identity — see `endpointIsPortable`. That is the
+ * portable seam, and it is deliberately narrow: a capsule handler's semantics
+ * depend on the transaction wrapped around it, which does not exist on an
+ * isolate a continent away from the database.
+ */
+/**
+ * What a live version runs. `static` is bytes on disk with no execution at
+ * all, and remains the overwhelming majority of traffic; the other two each
+ * name a product.
+ */
+export declare const runtimeKindSchema: z.ZodEnum<{
+    zero: "zero";
+    functions: "functions";
+    static: "static";
+}>;
+export type RuntimeKind = z.infer<typeof runtimeKindSchema>;
+export declare const EXECUTION_ENV_MAX_KEYS = 64;
+export declare const EXECUTION_ENV_NAME_MAX_BYTES = 128;
+export declare const EXECUTION_ENV_VALUE_MAX_BYTES: number;
+export declare const EXECUTION_ENV_TOTAL_VALUE_MAX_BYTES: number;
+/**
+ * Names the platform reserves for itself in the tenant environment. Tenant
+ * code cannot set these, so it cannot spoof the values the broker trusts.
+ */
+export declare const EXECUTION_ENV_RESERVED_PREFIXES: readonly ["SPACEFAST_", "ZERO_"];
+/** Paths the platform owns on every space, whatever the product. */
+export declare const PLATFORM_ROUTE_PREFIX = "/__spacefast";
+/**
+ * First path segments the platform claims. Matched as segment prefixes rather
+ * than whole segments because the runtime already reserves the whole family —
+ * `/__stattic_probe` is a live serving path, and `upload-policy.php` refuses
+ * any first segment starting with either of these. Encoding it the same way
+ * here keeps a capsule or worker from declaring a route the origin would
+ * intercept before it ever reached them.
+ */
+export declare const PLATFORM_RESERVED_ROUTE_SEGMENT_PREFIXES: readonly ["__spacefast", "__stattic", "__span"];
+export declare const executionSha256Schema: z.ZodString;
+export declare const executionBase64Schema: z.ZodString;
+export declare const executionIdentifierSchema: z.ZodString;
+export declare const executionEnvNameSchema: z.ZodString;
+/**
+ * Builds the route-path schema for a product. Structural rules — normalization,
+ * traversal, wildcards, the platform's own prefixes — are identical everywhere
+ * and live here. Each product passes the extra paths and prefixes its own app
+ * shell claims, because those differ: Zero's client router owns `/auth/*`,
+ * a Functions worker owns nothing beyond what the platform reserves.
+ */
+export declare function appRoutePathSchema(options: {
+    subject: string;
+    reservedPaths?: readonly string[];
+    reservedPrefixes?: readonly string[];
+}): z.ZodString;
+export declare const httpMethodSchema: z.ZodEnum<{
+    POST: "POST";
+    PUT: "PUT";
+    GET: "GET";
+    HEAD: "HEAD";
+    PATCH: "PATCH";
+    DELETE: "DELETE";
+    OPTIONS: "OPTIONS";
+}>;
+export type HttpMethod = z.infer<typeof httpMethodSchema>;
+/**
+ * What a handler is allowed to reach. Declared at build time from what the
+ * source actually imports, not from what the author claims, and printed in the
+ * publish receipt so placement is never a surprise.
+ */
+export declare const executionCapabilitiesSchema: z.ZodDefault<z.ZodObject<{
+    db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+}, z.core.$strip>>;
+export type ExecutionCapabilities = z.infer<typeof executionCapabilitiesSchema>;
+/**
+ * The portable seam, stated as one predicate.
+ *
+ * `db` and `auth` are the two capabilities that bind a handler to the local
+ * tier. `db` because Zero's store guarantees every handler runs inside one
+ * parent-owned transaction, which an isolate reaching the database over a
+ * relay cannot offer. `auth` because capsule identity is resolved against that
+ * same transaction's view. Everything else — fetch, env, realtime, logging —
+ * is brokered identically on both tiers and does not constrain placement.
+ *
+ * Nothing here decides placement automatically: the product a version deploys
+ * to is a property of what its author wrote, and this predicate only reports
+ * whether the code could also have run on the other tier.
+ */
+export declare function endpointIsPortable(capabilities: ExecutionCapabilities): boolean;
+/**
+ * A source-carrying handler, before it is compiled to whichever tier will run
+ * it. Both products publish these; only the capability set decides which of
+ * them could accept a given one.
+ */
+export declare function executionEndpointSourceSchema(routePathSchema: z.ZodType<string>): z.ZodObject<{
+    method: z.ZodEnum<{
+        POST: "POST";
+        PUT: "PUT";
+        GET: "GET";
+        HEAD: "HEAD";
+        PATCH: "PATCH";
+        DELETE: "DELETE";
+        OPTIONS: "OPTIONS";
+    }>;
+    path: z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>;
+    endpointId: z.ZodString;
+    source: z.ZodString;
+    capabilities: z.ZodDefault<z.ZodObject<{
+        db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+/**
+ * Byte-carrying artifacts travel inline in the finalize payload rather than as
+ * a separate upload, so a version's code lands in the same atomic write as the
+ * rest of it. The storage root and ceiling differ per product, hence a factory.
+ */
+export declare function executionBundleSchema(options: {
+    bundleRoot: string;
+    maxBytes: number;
+}): z.ZodObject<{
+    path: z.ZodString;
+    sha256: z.ZodString;
+    size: z.ZodNumber;
+    contentBase64: z.ZodString;
+}, z.core.$strict>;
+export declare function executionStaticFileSchema(options: {
+    storageRoot: string;
+    maxBytes: number;
+}): z.ZodObject<{
+    path: z.ZodString;
+    contentType: z.ZodString;
+    sha256: z.ZodString;
+    size: z.ZodNumber;
+    contentBase64: z.ZodString;
+}, z.core.$strict>;
+/**
+ * Whether a version's execution surface may be read by anyone or only by the
+ * space's own members. Both products expose an inspect route; the policy is
+ * the same question on each.
+ */
+export declare const executionInspectPolicySchema: z.ZodEnum<{
+    public: "public";
+    private: "private";
+}>;
+export type ExecutionInspectPolicy = z.infer<typeof executionInspectPolicySchema>;
+export declare const executionLogEntrySchema: z.ZodObject<{
+    id: z.ZodString;
+    timestamp: z.ZodString;
+    level: z.ZodEnum<{
+        info: "info";
+        error: "error";
+        debug: "debug";
+        warn: "warn";
+    }>;
+    requestId: z.ZodNullable<z.ZodString>;
+    versionId: z.ZodNullable<z.ZodString>;
+    handlerName: z.ZodNullable<z.ZodString>;
+    message: z.ZodString;
+    metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type ExecutionLogEntry = z.infer<typeof executionLogEntrySchema>;
+export declare const executionLogListQuerySchema: z.ZodObject<{
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    cursor: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    handlerName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type ExecutionLogListQuery = z.infer<typeof executionLogListQuerySchema>;
+export declare const executionLogListResponseSchema: z.ZodObject<{
+    data: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        timestamp: z.ZodString;
+        level: z.ZodEnum<{
+            info: "info";
+            error: "error";
+            debug: "debug";
+            warn: "warn";
+        }>;
+        requestId: z.ZodNullable<z.ZodString>;
+        versionId: z.ZodNullable<z.ZodString>;
+        handlerName: z.ZodNullable<z.ZodString>;
+        message: z.ZodString;
+        metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+    pagination: z.ZodObject<{
+        nextCursor: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ExecutionLogListResponse = z.infer<typeof executionLogListResponseSchema>;

package/dist/contracts/execution.js

@@ -0,0 +1,288 @@
+import { z } from "zod";
+/**
+ * The platform execution layer: everything true of running tenant code on
+ * Spacefast regardless of which product is running it.
+ *
+ * Two products sit on top of this file, and they are genuinely different
+ * things rather than two configurations of one thing:
+ *
+ * - **Zero** (`./zero.js`) runs capsules — schema, queries, mutations and
+ *   endpoints that share one parent-owned transaction — in the native runner
+ *   on a dedicated wp.cloud site, next to that site's MySQL.
+ * - **Functions** (`./functions.js`) runs workers on Cloudflare Workers for
+ *   Platforms, carrying npm and framework output that we could never sandbox
+ *   as well ourselves.
+ *
+ * The only surface both can host is an endpoint that touches neither the
+ * database nor the caller's identity — see `endpointIsPortable`. That is the
+ * portable seam, and it is deliberately narrow: a capsule handler's semantics
+ * depend on the transaction wrapped around it, which does not exist on an
+ * isolate a continent away from the database.
+ */
+/**
+ * What a live version runs. `static` is bytes on disk with no execution at
+ * all, and remains the overwhelming majority of traffic; the other two each
+ * name a product.
+ */
+export const runtimeKindSchema = z.enum(["static", "zero", "functions"]);
+export const EXECUTION_ENV_MAX_KEYS = 64;
+export const EXECUTION_ENV_NAME_MAX_BYTES = 128;
+export const EXECUTION_ENV_VALUE_MAX_BYTES = 16 * 1024;
+export const EXECUTION_ENV_TOTAL_VALUE_MAX_BYTES = 64 * 1024;
+/**
+ * Names the platform reserves for itself in the tenant environment. Tenant
+ * code cannot set these, so it cannot spoof the values the broker trusts.
+ */
+export const EXECUTION_ENV_RESERVED_PREFIXES = ["SPACEFAST_", "ZERO_"];
+/** Paths the platform owns on every space, whatever the product. */
+export const PLATFORM_ROUTE_PREFIX = "/__spacefast";
+/**
+ * First path segments the platform claims. Matched as segment prefixes rather
+ * than whole segments because the runtime already reserves the whole family —
+ * `/__stattic_probe` is a live serving path, and `upload-policy.php` refuses
+ * any first segment starting with either of these. Encoding it the same way
+ * here keeps a capsule or worker from declaring a route the origin would
+ * intercept before it ever reached them.
+ */
+export const PLATFORM_RESERVED_ROUTE_SEGMENT_PREFIXES = [
+    "__spacefast",
+    "__stattic",
+    "__span",
+];
+export const executionSha256Schema = z.string().regex(/^sha256:[a-f0-9]{64}$/);
+export const executionBase64Schema = z
+    .string()
+    .regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/);
+export const executionIdentifierSchema = z
+    .string()
+    .min(1)
+    .max(128)
+    .regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
+export const executionEnvNameSchema = z
+    .string()
+    .min(1)
+    .max(EXECUTION_ENV_NAME_MAX_BYTES)
+    .regex(/^[A-Za-z_][A-Za-z0-9_]*$/)
+    .refine((name) => !EXECUTION_ENV_RESERVED_PREFIXES.some((prefix) => name.toUpperCase().startsWith(prefix)), { message: "Environment variable name uses a reserved prefix." });
+/**
+ * Rejects lone surrogates. A path that survives JSON but not UTF-8 encoding
+ * round-trips differently through PHP, Rust and Cloudflare's router, so it is
+ * refused at the contract rather than resolved differently on each tier.
+ */
+function hasWellFormedUnicode(value) {
+    for (let index = 0; index < value.length; index++) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
+            if (index + 1 >= value.length)
+                return false;
+            const next = value.charCodeAt(index + 1);
+            if (next < 0xdc00 || next > 0xdfff)
+                return false;
+            index++;
+        }
+        else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
+            return false;
+        }
+    }
+    return true;
+}
+function hasNoAsciiControlCharacters(value) {
+    for (let index = 0; index < value.length; index++) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit <= 0x1f || codeUnit === 0x7f)
+            return false;
+    }
+    return true;
+}
+/**
+ * Builds the route-path schema for a product. Structural rules — normalization,
+ * traversal, wildcards, the platform's own prefixes — are identical everywhere
+ * and live here. Each product passes the extra paths and prefixes its own app
+ * shell claims, because those differ: Zero's client router owns `/auth/*`,
+ * a Functions worker owns nothing beyond what the platform reserves.
+ */
+export function appRoutePathSchema(options) {
+    const reservedPaths = options.reservedPaths ?? [];
+    const reservedPrefixes = options.reservedPrefixes ?? [];
+    return z
+        .string()
+        .min(1)
+        .max(2048)
+        .startsWith("/")
+        .refine(hasWellFormedUnicode, {
+        message: `${options.subject} must contain well-formed Unicode.`,
+    })
+        .refine((path) => path.normalize("NFC") === path, {
+        message: `${options.subject} must use NFC-normalized Unicode.`,
+    })
+        .refine(hasNoAsciiControlCharacters, {
+        message: `${options.subject} must not contain ASCII control characters.`,
+    })
+        .refine((path) => !path.includes("//") &&
+        !path.includes("\\") &&
+        !path.includes("*") &&
+        !path.includes("?") &&
+        !path.includes("#") &&
+        !path.includes("%") &&
+        // The root is the one path allowed to end in a slash. Zero reserves it
+        // for its app shell anyway, but a Functions worker serving a framework
+        // app needs to claim "/" as its index route.
+        (path === "/" || !path.endsWith("/")) &&
+        path
+            .split("/")
+            .every((segment, index, segments) => segment !== "." &&
+            segment !== ".." &&
+            segment !== ":" &&
+            (segment !== ":splat" || index === segments.length - 1)), {
+        message: `${options.subject} must be absolute app paths without encoded, empty, traversal, unnamed parameter, * wildcard, non-terminal splat, \\, ?, or # segments.`,
+    })
+        .refine((path) => !PLATFORM_RESERVED_ROUTE_SEGMENT_PREFIXES.some((segmentPrefix) => (path.split("/")[1] ?? "").startsWith(segmentPrefix)), { message: `${options.subject} cannot use a path the platform reserves.` })
+        .refine((path) => !reservedPaths.some((reservedPath) => path === reservedPath), {
+        message: `${options.subject} cannot use a reserved path.`,
+    })
+        .refine((path) => !reservedPrefixes.some((prefix) => path.startsWith(prefix)), {
+        message: `${options.subject} cannot use a reserved path prefix.`,
+    });
+}
+export const httpMethodSchema = z.enum([
+    "GET",
+    "HEAD",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+    "OPTIONS",
+]);
+/**
+ * What a handler is allowed to reach. Declared at build time from what the
+ * source actually imports, not from what the author claims, and printed in the
+ * publish receipt so placement is never a surprise.
+ */
+export const executionCapabilitiesSchema = z
+    .object({
+    db: z.boolean().default(false),
+    fetch: z.boolean().default(false),
+    auth: z.boolean().default(false),
+    env: z.boolean().default(false),
+    realtime: z.boolean().default(false),
+    logging: z.boolean().default(false),
+})
+    .partial()
+    .default({});
+/**
+ * The portable seam, stated as one predicate.
+ *
+ * `db` and `auth` are the two capabilities that bind a handler to the local
+ * tier. `db` because Zero's store guarantees every handler runs inside one
+ * parent-owned transaction, which an isolate reaching the database over a
+ * relay cannot offer. `auth` because capsule identity is resolved against that
+ * same transaction's view. Everything else — fetch, env, realtime, logging —
+ * is brokered identically on both tiers and does not constrain placement.
+ *
+ * Nothing here decides placement automatically: the product a version deploys
+ * to is a property of what its author wrote, and this predicate only reports
+ * whether the code could also have run on the other tier.
+ */
+export function endpointIsPortable(capabilities) {
+    return capabilities.db !== true && capabilities.auth !== true;
+}
+/**
+ * A source-carrying handler, before it is compiled to whichever tier will run
+ * it. Both products publish these; only the capability set decides which of
+ * them could accept a given one.
+ */
+export function executionEndpointSourceSchema(routePathSchema) {
+    return z
+        .object({
+        method: httpMethodSchema,
+        path: routePathSchema,
+        endpointId: z.string().min(1).max(256),
+        source: z
+            .string()
+            .min(1)
+            .max(2 * 1024 * 1024),
+        capabilities: executionCapabilitiesSchema,
+    })
+        .strict();
+}
+/**
+ * Byte-carrying artifacts travel inline in the finalize payload rather than as
+ * a separate upload, so a version's code lands in the same atomic write as the
+ * rest of it. The storage root and ceiling differ per product, hence a factory.
+ */
+export function executionBundleSchema(options) {
+    return z
+        .object({
+        path: z
+            .string()
+            .min(1)
+            .startsWith(`${options.bundleRoot}/`)
+            .refine((bundlePath) => !bundlePath.split("/").includes(".."), {
+            message: "Bundle paths cannot traverse outside the runtime bundle root.",
+        }),
+        sha256: executionSha256Schema,
+        size: z.number().int().nonnegative().max(options.maxBytes),
+        contentBase64: executionBase64Schema,
+    })
+        .strict();
+}
+export function executionStaticFileSchema(options) {
+    return z
+        .object({
+        path: z
+            .string()
+            .min(1)
+            .max(2048)
+            .refine((path) => !path.startsWith("/") && !path.split("/").includes(".."), {
+            message: "Static file paths must be relative and cannot traverse.",
+        })
+            .refine((path) => !path.startsWith(`${options.storageRoot}/`), {
+            message: `Static files cannot use ${options.storageRoot}.`,
+        })
+            .refine((path) => !path.startsWith("_") && !path.startsWith("."), {
+            message: "Static file paths cannot use private root prefixes.",
+        }),
+        contentType: z.string().min(1).max(255),
+        sha256: executionSha256Schema,
+        size: z.number().int().nonnegative().max(options.maxBytes),
+        contentBase64: executionBase64Schema,
+    })
+        .strict();
+}
+/**
+ * Whether a version's execution surface may be read by anyone or only by the
+ * space's own members. Both products expose an inspect route; the policy is
+ * the same question on each.
+ */
+export const executionInspectPolicySchema = z.enum(["private", "public"]);
+export const executionLogEntrySchema = z
+    .object({
+    id: z.string().min(1),
+    timestamp: z.string().datetime(),
+    level: z.enum(["debug", "info", "warn", "error"]),
+    requestId: z.string().min(1).nullable(),
+    versionId: z.string().min(1).nullable(),
+    /** Zero names the mutation; Functions names the handler. */
+    handlerName: z.string().min(1).nullable(),
+    message: z.string(),
+    metadata: z.record(z.string(), z.unknown()).default({}),
+})
+    .strict();
+export const executionLogListQuerySchema = z
+    .object({
+    limit: z.coerce.number().int().min(1).max(100).default(50),
+    cursor: z.string().min(1).optional(),
+    requestId: z.string().min(1).optional(),
+    handlerName: z.string().min(1).optional(),
+})
+    .strict();
+export const executionLogListResponseSchema = z
+    .object({
+    data: z.array(executionLogEntrySchema),
+    pagination: z
+        .object({
+        nextCursor: z.string().nullable(),
+    })
+        .strict(),
+})
+    .strict();