@spacefast/common 0.0.11 → 0.0.13

package/dist/docs/error-docs.js

@@ -28,6 +28,10 @@ export const ERROR_DOCS = {
         summary: "The authorization request was denied by the user.",
         fix: "Restart the login flow and approve the request to continue.",
     },
+    access_scope_suggestion: {
+        summary: "Published dependencies cluster under paths that may be useful as explicit public scopes.",
+        fix: "If those files are safe for anyone to read, make only the suggested scopes Public. Otherwise leave access unchanged.",
+    },
     agent_handoff_declined: {
         summary: "The app-private agent handoff cannot be redeemed.",
         fix: "Ask the user to create a fresh handoff for this Space and client, then redeem that new link once.",
@@ -36,6 +40,10 @@ export const ERROR_DOCS = {
         summary: "This user already has the maximum number of pending handoffs for the Space.",
         fix: "Redeem or revoke an existing pending handoff for the Space before creating another.",
     },
+    agent_handoff_origin_unsupported: {
+        summary: "The dashboard origin this deployment is configured with cannot mint canonical agent handoff links.",
+        fix: "Point SPACEFAST_DASHBOARD_URL at a valid HTTP(S) origin; if you cannot change it, contact support.",
+    },
     ambiguous_space_slug: {
         summary: "The slug matches spaces in more than one of your teams, so it cannot be resolved.",
         fix: "Pass a teamRef alongside the slug, or reference the space by its spc_ id.",
@@ -169,7 +177,7 @@ export const ERROR_DOCS = {
         fix: "Upgrade the CLI to the latest release and retry.",
     },
     comment_screenshot_rate_limited: {
-        summary: "Too many anonymous comment screenshot uploads were attempted.",
+        summary: "Too many comment screenshot uploads were attempted.",
         fix: "Wait for the one-minute window to reset, then retry the screenshot upload.",
     },
     config_file_too_large: {
@@ -190,11 +198,11 @@ export const ERROR_DOCS = {
     },
     continuation_unavailable: {
         summary: "This claim token can no longer be exchanged for an access token.",
-        fix: "If the space is claimed, ask its owner for an access token (dashboard: Account → Access tokens). If it is still unclaimed, keep using the claim token as bearer auth instead of exchanging it. Still stuck? POST /v1/feedback with the error code and request id.",
+        fix: "If the space is claimed, ask its owner for an API key (dashboard: Account → API keys). If it is still unclaimed, keep using the claim token as bearer auth instead of exchanging it. Still stuck? POST /v1/feedback with the error code and request id.",
     },
     continuation_used: {
         summary: "This claim token was already exchanged for a durable access token.",
-        fix: "Authenticate with the exchanged access token (check .spacefast/state.json or wherever it was saved). If it was lost, ask the space owner to mint a new access token.",
+        fix: "Authenticate with the exchanged access token (check .spacefast/state.json or wherever it was saved). If it was lost, ask the space owner to create a new API key.",
     },
     credential_expired: {
         summary: "The credential used for this request has expired.",
@@ -220,13 +228,13 @@ export const ERROR_DOCS = {
         summary: "CSAM enforcement policy cannot be set below the mandatory account-suspend floor.",
         fix: "Set the CSAM category enforcement tier to account suspension.",
     },
-    datacenters_unavailable: {
-        summary: "Placement regions are temporarily unavailable.",
-        fix: "Retry after the datacenter list has synced.",
+    custom_certificates_require_dedicated_site: {
+        summary: "Custom certificates are unavailable while this space uses shared placement.",
+        fix: "Move the space to dedicated placement before managing custom certificates.",
     },
     data_location_immutable: {
         summary: "This request tried to change data location through an immutable path.",
-        fix: "Use PATCH /v1/spaces/{id} to queue a region move when region changes are supported for this space.",
+        fix: "Data location is fixed when the space is created and cannot be changed afterwards. Create a new space in the region you want.",
     },
     device_authorization_failed: {
         summary: "The device login request failed and cannot be completed.",
@@ -472,9 +480,9 @@ export const ERROR_DOCS = {
         summary: "Proxy routes to external upstreams are not available on the Free plan.",
         fix: "Remove the proxy rules before publishing. Still stuck? POST /v1/feedback with the error code and request id.",
     },
-    free_headers_basic_auth_disabled: {
-        summary: "Basic-Auth via _headers is not available on the Free plan.",
-        fix: "Use space password protection instead. Still stuck? POST /v1/feedback with the error code and request id.",
+    google_play_webhook_identity_not_configured: {
+        summary: "Google Play Pub/Sub push authentication is not configured on this deployment.",
+        fix: "Configure the exact push audience and dedicated Pub/Sub service-account email before enabling RTDN delivery.",
     },
     idempotency_conflict_in_progress: {
         summary: "Another request with the same Idempotency-Key is still in flight.",
@@ -484,10 +492,6 @@ export const ERROR_DOCS = {
         summary: "The Idempotency-Key was reused with a different request body.",
         fix: "Use a fresh key for new requests; keys bind to one exact request body.",
     },
-    immutable_version_requires_login: {
-        summary: "This immutable version URL is past its public window and now requires login.",
-        fix: "Sign in to view it, or promote the version to a channel for public serving.",
-    },
     import_archive_not_uploaded: {
         summary: "The import has no uploaded archive yet.",
         fix: "Upload the archive to the import's upload target, then finalize.",
@@ -544,6 +548,10 @@ export const ERROR_DOCS = {
         summary: "A file path in the request is not a valid space path.",
         fix: "Use forward-slash relative paths without traversal segments.",
     },
+    invalid_google_play_webhook_identity: {
+        summary: "The Google Play notification did not carry a valid Pub/Sub push identity.",
+        fix: "Send the notification through the configured authenticated Pub/Sub push subscription.",
+    },
     invalid_grant: {
         summary: "The authorization grant is invalid or was already used.",
         fix: "Restart the login flow to obtain a new grant.",
@@ -660,6 +668,10 @@ export const ERROR_DOCS = {
         summary: `${BRAND.productName} no longer observes DNS control for this domain.`,
         fix: "Restore the documented DNS records, then re-run domain verification.",
     },
+    maintenance_in_progress: {
+        summary: "This change is temporarily unavailable while maintenance finishes.",
+        fix: "Wait for the Retry-After window, then send the same request again.",
+    },
     malware_detected: {
         summary: "Malware was detected in the uploaded content.",
         fix: "Remove the flagged files; contact support if you believe this is a false positive.",
@@ -829,13 +841,17 @@ export const ERROR_DOCS = {
         fix: "Wait for the publish to finish, then roll back by promoting a previous version if needed.",
     },
     publish_path_collision: {
-        summary: "Two entries in the publish payload normalize to the same path.",
-        fix: "Remove the duplicate; each path may appear once across files and deletes.",
+        summary: "Two different artifacts would serve the same URL after directory-index or clean-URL resolution.",
+        fix: "Rename or remove one artifact so every request route has one owner.",
     },
     publish_path_invalid: {
         summary: "A publish path is not a relative, normalized POSIX path.",
         fix: "Use forward-slash relative paths without traversal segments or control characters.",
     },
+    publish_reference_missing: {
+        summary: "Published HTML, CSS, or JavaScript references an internal path that is not in the version.",
+        fix: "Publish the missing artifact, or correct the reference to a route that this version serves.",
+    },
     publish_setup_failed: {
         summary: "Provisioning for this publish failed.",
         fix: "Retry the publish; if it persists, contact support with the requestId.",
@@ -908,17 +924,13 @@ export const ERROR_DOCS = {
         summary: "No signing key matching the token's key id was found.",
         fix: "Refresh the runtime JWKS; the signing keys may have rotated.",
     },
-    runtime_logs_unavailable: {
-        summary: "Server logs are not available because Spacefast serves your space as static files.",
-        fix: "There is no running server process to log. Use the request logs in your dashboard to inspect recent traffic.",
-    },
     runtime_management_unavailable: {
         summary: "The runtime management surface is unavailable for this site.",
         fix: "Retry shortly; if the site stays unreachable, contact support.",
     },
     runtime_not_provisioned: {
-        summary: "The space has no provisioned runtime yet.",
-        fix: "Wait for provisioning to finish; the operation receipt reports progress.",
+        summary: "The space has not served a published version yet, so it has no runtime data to read.",
+        fix: "Publish a version first. If a publish is already running, wait for it — the operation receipt reports progress.",
     },
     runtime_operation_missing: {
         summary: "The runtime operation referenced by this request was not found.",
@@ -960,14 +972,14 @@ export const ERROR_DOCS = {
         summary: "A secret variable was referenced in a template, which is blocked.",
         fix: "Templates may only substitute non-secret variables; remove the secret reference.",
     },
+    service_signature_invalid: {
+        summary: "The service request signature could not be verified.",
+        fix: "Sign the exact request method, path, body digest, timestamp, and a fresh nonce.",
+    },
     site_already_deleted: {
         summary: "The site was already deleted.",
         fix: "No action needed; the site is gone.",
     },
-    site_capacity_exceeded: {
-        summary: "The site has reached its capacity and cannot take more content.",
-        fix: "Retry shortly; the platform rebalances spaces onto new sites automatically.",
-    },
     site_has_live_spaces: {
         summary: "The site still has live spaces assigned to it, so it cannot be deleted.",
         fix: "Delete the live spaces or move them to another site before deleting this site.",
@@ -1000,10 +1012,26 @@ export const ERROR_DOCS = {
         summary: "The slug is already in use within the relevant ownership scope.",
         fix: "Choose another slug or use the available suggestion returned by the API.",
     },
+    source_archive_decompression_timeout: {
+        summary: "The uploaded source archive did not finish decompressing within the validation limit.",
+        fix: "Reduce the archive's compressed complexity or split it into a smaller source upload, then retry.",
+    },
+    source_archive_expansion_ratio_exceeded: {
+        summary: "The uploaded source archive expands too much relative to its compressed size.",
+        fix: "Rebuild the archive without highly compressible filler or generated content, then upload it again.",
+    },
+    source_archive_validation_busy: {
+        summary: "The service is already validating its maximum number of source archives.",
+        fix: "Wait briefly and retry the upload.",
+    },
     space_already_claimed: {
         summary: "The space was already claimed; a claim can only succeed once.",
         fix: "If you are the agent that published this space, exchange your claim token once at POST /v1/anonymous-claim/exchange for a durable access token and keep publishing to the same spaceId. Otherwise ask the owner for access — do not publish a duplicate space.",
     },
+    space_capacity_warming: {
+        summary: "This space is waiting on serving capacity that is being provisioned in the background.",
+        fix: "Wait for the Retry-After window, then send the same publish again. No version was created and no files were uploaded.",
+    },
     space_claim_unavailable: {
         summary: "This space cannot be claimed.",
         fix: "Only anonymous, unexpired spaces with a valid claim token can be claimed.",
@@ -1048,6 +1076,10 @@ export const ERROR_DOCS = {
         summary: "The export was produced by an unsupported runtime schema version.",
         fix: "Re-export from a current runtime, or upgrade before exporting.",
     },
+    space_move_would_strand_zero_data: {
+        summary: "The Space runs Zero, whose database lives on the site the Space is placed on. Relocating it would create an empty database on the new site and leave every row behind, so the move is refused.",
+        fix: "Nothing was moved and no data was lost. Migrating Zero data between sites is not implemented; contact support if the Space genuinely has to be relocated.",
+    },
     space_moving: {
         summary: "The space is moving between sites, which blocks this operation.",
         fix: "Wait for the move to finish, then retry.",
@@ -1088,6 +1120,34 @@ export const ERROR_DOCS = {
         summary: "This control file is not supported by the static runtime.",
         fix: "Remove the file; see the routing docs for supported convention files.",
     },
+    static_mount_path_conflict: {
+        summary: "The requested mount path overlaps another static mount on this space.",
+        fix: "Choose a path that is not equal to, above, or below an existing mount path.",
+    },
+    static_mount_source_not_ready: {
+        summary: "The website version that owns this mount is not ready.",
+        fix: "Wait for the website version to finish finalizing, then retry.",
+    },
+    static_mount_target_forbidden: {
+        summary: "The target space is not an authorized space in the same team.",
+        fix: "Choose another space in the source space's team and authenticate with read access to its versions.",
+    },
+    static_mount_target_in_use: {
+        summary: "A static mount dependency blocks changing or deleting this space.",
+        fix: "Remove the reported static mount before retrying the operation.",
+    },
+    static_mount_target_not_live: {
+        summary: "The target space does not have a production version to mount.",
+        fix: "Publish or promote a ready version on the target space, then retry.",
+    },
+    static_mount_target_not_ready: {
+        summary: "The target production version is not ready for static delivery.",
+        fix: "Wait for the target version to finish finalizing, then retry.",
+    },
+    static_mount_target_not_static: {
+        summary: "The target production version contains runtime functions.",
+        fix: "Promote a fully static target version or serve the dynamic application without a static mount.",
+    },
     static_runtime_control_path_not_supported: {
         summary: "This control path is not supported by the static runtime.",
         fix: "Remove the path from the upload.",
@@ -1230,11 +1290,7 @@ export const ERROR_DOCS = {
     },
     upload_path_not_declared: {
         summary: "An uploaded path was not declared in the version's manifest.",
-        fix: "Declare every path up front, or use an open session for incremental uploads.",
-    },
-    upload_session_cap_exceeded: {
-        summary: "The open upload session exceeded its file or byte cap.",
-        fix: "Stay within the session caps, or declare a manifest for large publishes.",
+        fix: "Declare every path up front.",
     },
     upload_size_mismatch: {
         summary: "An uploaded file's size does not match the declared size.",
@@ -1368,10 +1424,6 @@ export const ERROR_DOCS = {
         summary: "The Zero endpoint artifact could not be parsed.",
         fix: "Rebuild the Zero project; do not edit generated artifact JSON by hand.",
     },
-    zero_artifact_missing: {
-        summary: "A Zero route points to an endpoint artifact that is missing.",
-        fix: "Declare the endpoint in zero_endpoints, then rebuild and publish again.",
-    },
     zero_artifact_path_invalid: {
         summary: "The Zero endpoint artifact path is invalid.",
         fix: "Rebuild the Zero routes so all artifact paths stay inside the version bundle.",
@@ -1380,10 +1432,6 @@ export const ERROR_DOCS = {
         summary: "The Zero endpoint artifact could not be read by the runtime.",
         fix: "Verify the version finalized with all generated Zero files present.",
     },
-    zero_artifact_untrusted: {
-        summary: "A Zero route points to an uploaded artifact that the runtime did not compile.",
-        fix: "Declare the endpoint in zero_endpoints so finalize generates trusted bytecode.",
-    },
     zero_auth_unavailable: {
         summary: "Hosted Zero auth is not configured for this deployment.",
         fix: "Finalize the Zero version with hosted auth URLs or use guest/local auth.",
@@ -1472,6 +1520,10 @@ export const ERROR_DOCS = {
         summary: "The Zero database operation has too many parameters.",
         fix: "Reduce the number of bound parameters or split the operation.",
     },
+    zero_db_transaction_active: {
+        summary: "The Zero runner tried to start a database transaction while one was already active.",
+        fix: "Rebuild with the current Zero runner and report the failure if it repeats.",
+    },
     zero_db_transaction_commit_failed: {
         summary: "The Zero database transaction could not be committed.",
         fix: "Retry after checking database connectivity and transaction conflicts.",
@@ -1480,6 +1532,14 @@ export const ERROR_DOCS = {
         summary: "The Zero database transaction mode is invalid.",
         fix: "Use a supported generated transaction mode.",
     },
+    zero_db_transaction_missing: {
+        summary: "The Zero runner tried to finish a database transaction that was not active.",
+        fix: "Rebuild with the current Zero runner and report the failure if it repeats.",
+    },
+    zero_db_transaction_rollback_failed: {
+        summary: "The Zero database transaction could not be rolled back cleanly.",
+        fix: "Inspect the affected database state before retrying, then report the failure.",
+    },
     zero_db_transaction_start_failed: {
         summary: "The Zero database transaction could not be started.",
         fix: "Check database connectivity and retry the mutation.",
@@ -1586,11 +1646,7 @@ export const ERROR_DOCS = {
     },
     zero_log_query_invalid: {
         summary: "The Zero log query parameters are invalid.",
-        fix: "Use valid cursor, limit, mutationName, and requestId parameters.",
-    },
-    zero_lookup_invalid: {
-        summary: "The Zero lookup map contains an invalid path or action.",
-        fix: "Use normalized relative paths and valid finalized Zero actions.",
+        fix: "Use valid cursor, limit, handlerName, and requestId parameters.",
     },
     zero_method_not_allowed: {
         summary: "The request method is not allowed for this Zero endpoint.",
@@ -1648,6 +1704,14 @@ export const ERROR_DOCS = {
         summary: "The Zero request body exceeds the runtime size limit.",
         fix: "Send a smaller request body or move large payloads to blob/object storage.",
     },
+    zero_response_header_forbidden: {
+        summary: "A Zero endpoint attempted to set a platform-managed response header.",
+        fix: "Remove the reserved response header from the endpoint response.",
+    },
+    zero_response_header_invalid: {
+        summary: "A Zero endpoint response header is invalid or exceeds the header limits.",
+        fix: "Use ASCII header names, keep values under the size limits, and avoid duplicate names.",
+    },
     zero_response_too_large: {
         summary: "The Zero endpoint response exceeds the runtime size limit.",
         fix: "Return a smaller response body or paginate the data.",

package/dist/utils/asset-fingerprint.d.ts

@@ -31,6 +31,17 @@ export type FingerprintPlan = {
         reason: FingerprintSkipReason;
     }>;
 };
+export type StaticDocumentDependency = {
+    sourcePath: string;
+    targetPath: string;
+};
+/**
+ * Advisory-only dependency discovery used by finalize diagnostics. It shares
+ * the exact HTML/CSS tokenizer and URL resolver with asset fingerprinting, then
+ * adds conservative static JS imports and page links. It never rewrites bytes
+ * and never changes access automatically.
+ */
+export declare function scanStaticDocumentDependencies(sourcePath: string, text: string): StaticDocumentDependency[];
 export declare function planAssetFingerprints(input: {
     files: readonly FingerprintCandidateFile[];
     /** sha256 as lowercase hex over UTF-8 bytes of `text`. */

package/dist/utils/asset-fingerprint.js

@@ -48,6 +48,52 @@ const FINGERPRINT_ASSET_EXTENSIONS = new Set([
 // no whitespace. Anything else stays on the default lane.
 const SAFE_PATH_PATTERN = /^[A-Za-z0-9/_.-]+$/;
 const SCHEME_PATTERN = /^[a-zA-Z][a-zA-Z0-9+.-]*:/;
+const HTML_ANCHOR_HREF_PATTERN = /<a\b[^>]*\bhref\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/giu;
+const JS_STATIC_REFERENCE_PATTERN = /(?:\b(?:import|export)\s+(?:[^"'()]*?\s+from\s+)?|\bimport\s*\(|\bnew\s+URL\s*\()\s*["']([^"']+)["']/gu;
+const SOURCE_MAP_REFERENCE_PATTERN = /[#@]\s*sourceMappingURL=([^\s*]+)/gu;
+/**
+ * Advisory-only dependency discovery used by finalize diagnostics. It shares
+ * the exact HTML/CSS tokenizer and URL resolver with asset fingerprinting, then
+ * adds conservative static JS imports and page links. It never rewrites bytes
+ * and never changes access automatically.
+ */
+export function scanStaticDocumentDependencies(sourcePath, text) {
+    const extension = pathExtensionOf(sourcePath);
+    const rawUrls = [];
+    if (extension === "html" || extension === "htm") {
+        const html = scanHtml(text);
+        rawUrls.push(...html.refs.map((ref) => ref.url));
+        for (const range of html.cssRanges) {
+            rawUrls.push(...scanCssRefs(range.css, range.offset).map((ref) => ref.url));
+        }
+        for (const match of text.matchAll(HTML_ANCHOR_HREF_PATTERN)) {
+            const url = match[1] ?? match[2] ?? match[3];
+            if (url)
+                rawUrls.push(url);
+        }
+    }
+    else if (extension === "css") {
+        rawUrls.push(...scanCssRefs(text, 0).map((ref) => ref.url));
+    }
+    else if (extension === "js" || extension === "mjs" || extension === "cjs") {
+        for (const match of text.matchAll(JS_STATIC_REFERENCE_PATTERN)) {
+            if (match[1])
+                rawUrls.push(match[1]);
+        }
+        for (const match of text.matchAll(SOURCE_MAP_REFERENCE_PATTERN)) {
+            if (match[1])
+                rawUrls.push(match[1]);
+        }
+    }
+    const baseDir = parentDir(sourcePath);
+    return [
+        ...new Set(rawUrls
+            .map((url) => resolveReference(baseDir, url))
+            .filter((targetPath) => targetPath !== null)),
+    ]
+        .toSorted()
+        .map((targetPath) => ({ sourcePath, targetPath }));
+}
 export function planAssetFingerprints(input) {
     const covered = input.pathCoveredByUserCacheControl ?? (() => false);
     const excluded = input.excludePath ?? (() => false);

package/dist/utils/auth-redirect.d.ts

@@ -1,3 +1 @@
-export declare function sanitizeDashboardReturnTo(returnTo: string | null | undefined, options?: {
-    apiOrigin?: string | null;
-}): string | undefined;
+export declare function sanitizeDashboardReturnTo(returnTo: string | null | undefined): string | undefined;

package/dist/utils/auth-redirect.js

@@ -17,29 +17,9 @@ function hasUnsafeReturnToChars(value) {
     }
     return false;
 }
-// The ONE absolute-URL exception to the same-origin returnTo policy
-// (access-plan X-41): the api-origin GET /v1/access/authorize URL exactly —
-// the sign-in leg of the visitor redirect chain. Everything else absolute is
-// an open-redirect surface and stays rejected.
-const API_AUTHORIZE_PATH = "/v1/access/authorize";
-export function sanitizeDashboardReturnTo(returnTo, options) {
+export function sanitizeDashboardReturnTo(returnTo) {
     const normalized = returnTo?.trim();
     const decoded = normalized ? decodedReturnTo(normalized) : null;
-    if (normalized && decoded && options?.apiOrigin) {
-        try {
-            const candidate = new URL(normalized);
-            const apiOrigin = new URL(options.apiOrigin).origin;
-            if (candidate.origin === apiOrigin &&
-                candidate.pathname === API_AUTHORIZE_PATH &&
-                !hasUnsafeReturnToChars(normalized) &&
-                !hasUnsafeReturnToChars(decoded)) {
-                return candidate.toString();
-            }
-        }
-        catch {
-            // Not an absolute URL — fall through to the same-origin path rules.
-        }
-    }
     if (!normalized ||
         !decoded ||
         !normalized.startsWith("/") ||

package/dist/utils/build-settings.d.ts

@@ -1,6 +1,8 @@
 export type BuildSettingsInput = {
     fileNames: Iterable<string>;
     packageJson?: string | null | undefined;
+    jekyllYaml?: string | null | undefined;
+    jekyllToml?: string | null | undefined;
     vercelJson?: string | null | undefined;
     netlifyToml?: string | null | undefined;
     wranglerToml?: string | null | undefined;

package/dist/utils/build-settings.js

@@ -1,3 +1,4 @@
+import { load as parseYaml } from "js-yaml";
 import { parse as parseToml } from "smol-toml";
 export const BUILD_ANALYZER_CANDIDATE_ROOTS = ["apps", "packages", "sites", "docs"];
 const PACKAGE_MANAGER_ONLY_FILES = new Set([
@@ -7,6 +8,8 @@ const PACKAGE_MANAGER_ONLY_FILES = new Set([
     "pnpm-lock.yaml",
     "yarn.lock",
     "package-lock.json",
+    "Gemfile",
+    "Gemfile.lock",
 ]);
 export function hasWorkspaceSignal(fileNames, packageJsonText) {
     const names = new Set(fileNames);
@@ -102,6 +105,20 @@ function parseTomlObject(value) {
         return null;
     }
 }
+function parseYamlObject(value) {
+    if (!value) {
+        return null;
+    }
+    try {
+        const parsed = parseYaml(value);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
 export function stringField(value, key) {
     const field = value?.[key];
     return typeof field === "string" && field.trim() ? field.trim() : null;
@@ -628,9 +645,8 @@ const FRAMEWORKS = [
     },
     {
         preset: "jekyll",
-        configFiles: ["_config.yml", "_config.yaml"],
+        configFiles: ["_config.yml", "_config.yaml", "_config.toml"],
         outputDirectory: "_site",
-        defaultBuildCommand: "bundle exec jekyll build",
     },
     {
         preset: "mkdocs",
@@ -675,6 +691,26 @@ function outputDirectoryForFramework(frameworkPreset, files) {
         return framework.outputDirectory;
     return files.has("dist") ? "dist" : null;
 }
+const JEKYLL_BUNDLE_PATH = ".spacefast/cache/jekyll-bundle";
+const JEKYLL_GEM_HOME = ".spacefast/cache/jekyll-gems";
+function jekyllInstallCommand(files) {
+    return files.has("Gemfile")
+        ? `BUNDLE_PATH=${JEKYLL_BUNDLE_PATH} bundle install`
+        : `GEM_HOME=${JEKYLL_GEM_HOME} gem install jekyll --no-document`;
+}
+function jekyllConfigFile(files) {
+    return ["_config.yml", "_config.yaml", "_config.toml"].find((file) => files.has(file));
+}
+function jekyllBuildCommand(files) {
+    const command = files.has("Gemfile")
+        ? `JEKYLL_ENV=production BUNDLE_PATH=${JEKYLL_BUNDLE_PATH} bundle exec jekyll build`
+        : `JEKYLL_ENV=production GEM_HOME=${JEKYLL_GEM_HOME} ${JEKYLL_GEM_HOME}/bin/jekyll build`;
+    const configFile = jekyllConfigFile(files);
+    return configFile ? `${command} --config ${configFile}` : command;
+}
+function frameworkInstallCommand(frameworkPreset, files) {
+    return frameworkPreset === "jekyll" ? jekyllInstallCommand(files) : null;
+}
 function installCommandForManager(packageManager, packageJson) {
     switch (packageManager) {
         case "bun":
@@ -687,13 +723,15 @@ function installCommandForManager(packageManager, packageJson) {
             return packageJson ? "npm ci" : null;
     }
 }
-function buildCommandForDefaults(packageJson, run, frameworkPreset) {
+function buildCommandForDefaults(packageJson, run, frameworkPreset, files) {
     if (packageJson?.scripts?.build)
         return `${run} build`;
+    if (frameworkPreset === "jekyll")
+        return jekyllBuildCommand(files);
     return frameworkForPreset(frameworkPreset)?.defaultBuildCommand ?? null;
 }
-function packageDefaults(files, packageJsonText) {
-    const packageJson = parsePackageJson(packageJsonText);
+function packageDefaults(input, files) {
+    const packageJson = parsePackageJson(input.packageJson);
     const dependencies = {
         ...packageJson?.dependencies,
         ...packageJson?.devDependencies,
@@ -701,17 +739,26 @@ function packageDefaults(files, packageJsonText) {
     const packageManager = packageManagerForFiles(files);
     const run = packageManager === "npm" ? "npm run" : packageManager === "bun" ? "bun run" : packageManager;
     const frameworkPreset = detectFrameworkPreset(files, dependencies);
+    const installCommands = [
+        installCommandForManager(packageManager, packageJson),
+        frameworkInstallCommand(frameworkPreset, files),
+    ].filter((command) => Boolean(command));
+    const jekyllConfig = input.jekyllYaml
+        ? parseYamlObject(input.jekyllYaml)
+        : parseTomlObject(input.jekyllToml);
     return {
         frameworkPreset,
-        installCommand: installCommandForManager(packageManager, packageJson),
-        buildCommand: buildCommandForDefaults(packageJson, run, frameworkPreset),
-        outputDirectory: outputDirectoryForFramework(frameworkPreset, files),
+        installCommand: installCommands.length > 0 ? installCommands.join(" && ") : null,
+        buildCommand: buildCommandForDefaults(packageJson, run, frameworkPreset, files),
+        outputDirectory: frameworkPreset === "jekyll"
+            ? (stringField(jekyllConfig, "destination") ?? "_site")
+            : outputDirectoryForFramework(frameworkPreset, files),
     };
 }
 export function detectBuildSettings(input) {
     const files = new Set(input.fileNames);
     const defaults = {
-        ...packageDefaults(files, input.packageJson),
+        ...packageDefaults(input, files),
         rootDirectory: input.rootDirectory ?? null,
         platformPreset: null,
         detectedFiles: [
@@ -721,6 +768,11 @@ export function detectBuildSettings(input) {
             files.has("pnpm-lock.yaml") ? "pnpm-lock.yaml" : null,
             files.has("yarn.lock") ? "yarn.lock" : null,
             files.has("package-lock.json") ? "package-lock.json" : null,
+            files.has("Gemfile") ? "Gemfile" : null,
+            files.has("Gemfile.lock") ? "Gemfile.lock" : null,
+            files.has("_config.yml") ? "_config.yml" : null,
+            files.has("_config.yaml") ? "_config.yaml" : null,
+            files.has("_config.toml") ? "_config.toml" : null,
         ].filter((file) => Boolean(file)),
     };
     const vercelFramework = input.vercelJson

package/dist/utils/credential-policy.d.ts

@@ -16,7 +16,7 @@ export type PolicyAuthorizeInput = {
     resource: string | readonly string[];
     conditions?: RequestCondition;
 };
-export declare const publishActions: ("spaces:read" | "spaces:create" | "spaces:write" | "spaces:publish" | "versions:read" | "versions:promote" | "versions:download" | "builds:read" | "builds:create")[];
+export declare const publishActions: ("spaces:read" | "spaces:write" | "spaces:create" | "spaces:publish" | "versions:read" | "versions:promote" | "versions:download" | "builds:read" | "builds:trigger" | "builds:create")[];
 export declare function compileApiKeyPreset(preset: ApiKeyPreset, input: PolicyCompileInput): ApiCredentialPolicy;
 /** Expand a named API-key preset into the finite permissions sent on the public wire contract. */
 export declare function apiKeyPresetPermissions(preset: ApiKeyPreset): StatticAction[];

package/dist/utils/credential-policy.js

@@ -8,10 +8,12 @@ export const publishActions = [
     "versions:promote",
     "versions:download",
     "builds:read",
+    "builds:trigger",
     "builds:create",
 ];
 const spaceAdminActions = [
     ...publishActions,
+    "spaces:rename",
     "spaces:delete",
     "spaces:transfer",
     "spaces:export",
@@ -81,12 +83,14 @@ export function compileTeamRolePolicy(input) {
                 "spaces:read",
                 "spaces:create",
                 "spaces:write",
+                "spaces:rename",
                 "spaces:publish",
                 "versions:read",
                 "versions:promote",
                 "versions:download",
                 "domains:read",
                 "builds:read",
+                "builds:trigger",
                 "builds:create",
                 "teams:read",
                 "billing:read",

package/dist/utils/dns-instructions.d.ts

@@ -0,0 +1,29 @@
+import { type DnsInstruction } from "../contracts/common.js";
+export type AddressDnsInstruction = DnsInstruction & {
+    type: "A" | "AAAA";
+};
+export type UnsupportedAddressDnsRecord = {
+    type: "A" | "AAAA";
+    name: string;
+    value: string;
+};
+export declare function addressDnsInstructionsForHostname(input: {
+    hostname: string;
+    dnsInstructions: unknown[];
+}): AddressDnsInstruction[];
+export declare function isWpCloudInboundIpv4(value: string): boolean;
+export declare function addressDnsInstructionIsObserved(input: {
+    instruction: Pick<AddressDnsInstruction, "type" | "value">;
+    records: {
+        a: string[];
+        aaaa: string[];
+    };
+}): boolean;
+export declare function unsupportedAddressDnsRecordsForHostname(input: {
+    hostname: string;
+    dnsInstructions: unknown[];
+    records: {
+        a: string[];
+        aaaa: string[];
+    };
+}): UnsupportedAddressDnsRecord[];