@spacefast/common 0.0.12 → 0.0.13

package/dist/utils/build-settings.js

@@ -1,3 +1,4 @@
+import { load as parseYaml } from "js-yaml";
 import { parse as parseToml } from "smol-toml";
 export const BUILD_ANALYZER_CANDIDATE_ROOTS = ["apps", "packages", "sites", "docs"];
 const PACKAGE_MANAGER_ONLY_FILES = new Set([
@@ -7,6 +8,8 @@ const PACKAGE_MANAGER_ONLY_FILES = new Set([
     "pnpm-lock.yaml",
     "yarn.lock",
     "package-lock.json",
+    "Gemfile",
+    "Gemfile.lock",
 ]);
 export function hasWorkspaceSignal(fileNames, packageJsonText) {
     const names = new Set(fileNames);
@@ -102,6 +105,20 @@ function parseTomlObject(value) {
         return null;
     }
 }
+function parseYamlObject(value) {
+    if (!value) {
+        return null;
+    }
+    try {
+        const parsed = parseYaml(value);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
 export function stringField(value, key) {
     const field = value?.[key];
     return typeof field === "string" && field.trim() ? field.trim() : null;
@@ -628,9 +645,8 @@ const FRAMEWORKS = [
     },
     {
         preset: "jekyll",
-        configFiles: ["_config.yml", "_config.yaml"],
+        configFiles: ["_config.yml", "_config.yaml", "_config.toml"],
         outputDirectory: "_site",
-        defaultBuildCommand: "bundle exec jekyll build",
     },
     {
         preset: "mkdocs",
@@ -675,6 +691,26 @@ function outputDirectoryForFramework(frameworkPreset, files) {
         return framework.outputDirectory;
     return files.has("dist") ? "dist" : null;
 }
+const JEKYLL_BUNDLE_PATH = ".spacefast/cache/jekyll-bundle";
+const JEKYLL_GEM_HOME = ".spacefast/cache/jekyll-gems";
+function jekyllInstallCommand(files) {
+    return files.has("Gemfile")
+        ? `BUNDLE_PATH=${JEKYLL_BUNDLE_PATH} bundle install`
+        : `GEM_HOME=${JEKYLL_GEM_HOME} gem install jekyll --no-document`;
+}
+function jekyllConfigFile(files) {
+    return ["_config.yml", "_config.yaml", "_config.toml"].find((file) => files.has(file));
+}
+function jekyllBuildCommand(files) {
+    const command = files.has("Gemfile")
+        ? `JEKYLL_ENV=production BUNDLE_PATH=${JEKYLL_BUNDLE_PATH} bundle exec jekyll build`
+        : `JEKYLL_ENV=production GEM_HOME=${JEKYLL_GEM_HOME} ${JEKYLL_GEM_HOME}/bin/jekyll build`;
+    const configFile = jekyllConfigFile(files);
+    return configFile ? `${command} --config ${configFile}` : command;
+}
+function frameworkInstallCommand(frameworkPreset, files) {
+    return frameworkPreset === "jekyll" ? jekyllInstallCommand(files) : null;
+}
 function installCommandForManager(packageManager, packageJson) {
     switch (packageManager) {
         case "bun":
@@ -687,13 +723,15 @@ function installCommandForManager(packageManager, packageJson) {
             return packageJson ? "npm ci" : null;
     }
 }
-function buildCommandForDefaults(packageJson, run, frameworkPreset) {
+function buildCommandForDefaults(packageJson, run, frameworkPreset, files) {
     if (packageJson?.scripts?.build)
         return `${run} build`;
+    if (frameworkPreset === "jekyll")
+        return jekyllBuildCommand(files);
     return frameworkForPreset(frameworkPreset)?.defaultBuildCommand ?? null;
 }
-function packageDefaults(files, packageJsonText) {
-    const packageJson = parsePackageJson(packageJsonText);
+function packageDefaults(input, files) {
+    const packageJson = parsePackageJson(input.packageJson);
     const dependencies = {
         ...packageJson?.dependencies,
         ...packageJson?.devDependencies,
@@ -701,17 +739,26 @@ function packageDefaults(files, packageJsonText) {
     const packageManager = packageManagerForFiles(files);
     const run = packageManager === "npm" ? "npm run" : packageManager === "bun" ? "bun run" : packageManager;
     const frameworkPreset = detectFrameworkPreset(files, dependencies);
+    const installCommands = [
+        installCommandForManager(packageManager, packageJson),
+        frameworkInstallCommand(frameworkPreset, files),
+    ].filter((command) => Boolean(command));
+    const jekyllConfig = input.jekyllYaml
+        ? parseYamlObject(input.jekyllYaml)
+        : parseTomlObject(input.jekyllToml);
     return {
         frameworkPreset,
-        installCommand: installCommandForManager(packageManager, packageJson),
-        buildCommand: buildCommandForDefaults(packageJson, run, frameworkPreset),
-        outputDirectory: outputDirectoryForFramework(frameworkPreset, files),
+        installCommand: installCommands.length > 0 ? installCommands.join(" && ") : null,
+        buildCommand: buildCommandForDefaults(packageJson, run, frameworkPreset, files),
+        outputDirectory: frameworkPreset === "jekyll"
+            ? (stringField(jekyllConfig, "destination") ?? "_site")
+            : outputDirectoryForFramework(frameworkPreset, files),
     };
 }
 export function detectBuildSettings(input) {
     const files = new Set(input.fileNames);
     const defaults = {
-        ...packageDefaults(files, input.packageJson),
+        ...packageDefaults(input, files),
         rootDirectory: input.rootDirectory ?? null,
         platformPreset: null,
         detectedFiles: [
@@ -721,6 +768,11 @@ export function detectBuildSettings(input) {
             files.has("pnpm-lock.yaml") ? "pnpm-lock.yaml" : null,
             files.has("yarn.lock") ? "yarn.lock" : null,
             files.has("package-lock.json") ? "package-lock.json" : null,
+            files.has("Gemfile") ? "Gemfile" : null,
+            files.has("Gemfile.lock") ? "Gemfile.lock" : null,
+            files.has("_config.yml") ? "_config.yml" : null,
+            files.has("_config.yaml") ? "_config.yaml" : null,
+            files.has("_config.toml") ? "_config.toml" : null,
         ].filter((file) => Boolean(file)),
     };
     const vercelFramework = input.vercelJson

package/dist/utils/credential-policy.d.ts

@@ -16,7 +16,7 @@ export type PolicyAuthorizeInput = {
     resource: string | readonly string[];
     conditions?: RequestCondition;
 };
-export declare const publishActions: ("spaces:read" | "spaces:write" | "spaces:create" | "spaces:publish" | "versions:read" | "versions:promote" | "versions:download" | "builds:read" | "builds:create")[];
+export declare const publishActions: ("spaces:read" | "spaces:write" | "spaces:create" | "spaces:publish" | "versions:read" | "versions:promote" | "versions:download" | "builds:read" | "builds:trigger" | "builds:create")[];
 export declare function compileApiKeyPreset(preset: ApiKeyPreset, input: PolicyCompileInput): ApiCredentialPolicy;
 /** Expand a named API-key preset into the finite permissions sent on the public wire contract. */
 export declare function apiKeyPresetPermissions(preset: ApiKeyPreset): StatticAction[];

package/dist/utils/credential-policy.js

@@ -8,10 +8,12 @@ export const publishActions = [
     "versions:promote",
     "versions:download",
     "builds:read",
+    "builds:trigger",
     "builds:create",
 ];
 const spaceAdminActions = [
     ...publishActions,
+    "spaces:rename",
     "spaces:delete",
     "spaces:transfer",
     "spaces:export",
@@ -81,12 +83,14 @@ export function compileTeamRolePolicy(input) {
                 "spaces:read",
                 "spaces:create",
                 "spaces:write",
+                "spaces:rename",
                 "spaces:publish",
                 "versions:read",
                 "versions:promote",
                 "versions:download",
                 "domains:read",
                 "builds:read",
+                "builds:trigger",
                 "builds:create",
                 "teams:read",
                 "billing:read",

package/dist/utils/egress-policy.fixtures.json

@@ -1,5 +1,5 @@
 {
-    "comment": "Shared egress-policy corpus (spec: one proxy-egress-safety invariant). Exercised by BOTH enforcers: apps/control-plane/src/http/egress-guard.ts (control-plane SSRF guard) and runtime/engine/shared/egress.php (runtime proxy egress). Every case must produce the same verdict in TypeScript and PHP; parity is asserted by apps/control-plane/src/runtime/php-policy-parity.test.ts and src/http/egress-guard.test.ts.",
+    "comment": "Shared egress-policy corpus (spec: one proxy-egress-safety invariant). Exercised by THREE enforcers: apps/control-plane/src/http/egress-guard.ts (control-plane SSRF guard), runtime/engine/shared/egress.php (runtime proxy egress), and crates/stattic-runtime-core (Rust finalizer policy). Every case must produce the same verdict in TypeScript, PHP, and Rust; parity is asserted by apps/control-plane/src/runtime/php-policy-parity.test.ts, src/http/egress-guard.test.ts, and crates/stattic-runtime-core/src/policy.rs::proxy_destinations_match_the_shared_egress_corpus.",
     "ips": [
         { "ip": "127.0.0.1", "public": false, "reason": "loopback" },
         { "ip": "127.8.9.10", "public": false, "reason": "loopback /8" },

package/dist/utils/grants.d.ts

@@ -0,0 +1,53 @@
+import { type Grant, type GrantCapability, type GrantCheckFailure, type GrantSource } from "../contracts/grants.js";
+export type GrantPrincipal = {
+    teamIds?: readonly string[];
+    personIds?: readonly string[];
+    linkIds?: readonly string[];
+    passwordCredentialIds?: readonly string[];
+    machineIds?: readonly string[];
+    externalIdentities?: readonly {
+        issuer: string;
+        subject: string;
+    }[];
+    verifiedEmail?: boolean;
+    ipAddress?: string;
+    country?: string;
+    userAgent?: string;
+};
+export type GrantEvaluationTarget = {
+    kind: "live";
+} | {
+    kind: "version";
+    versionId: string;
+} | {
+    kind: "branch";
+    branch: string;
+};
+export type GrantEvaluationInput = {
+    grants: readonly Grant[];
+    resource: string;
+    resourceKind?: "route" | "artifact";
+    target: GrantEvaluationTarget;
+    principal?: GrantPrincipal;
+    spaceClaimed: boolean;
+    now?: Date;
+    useCounts?: Readonly<Record<string, number>>;
+    acquiredGrantIds?: readonly string[];
+};
+export type GrantMatch = {
+    grantId: string;
+    capabilities: GrantCapability[];
+    source: GrantSource;
+};
+export type GrantEvaluation = {
+    capabilities: GrantCapability[];
+    matches: GrantMatch[];
+};
+export declare function grantResourcePatternMatches(pattern: string, resource: string, resourceKind?: "route" | "artifact"): boolean;
+export type GrantEvaluationExplanation = {
+    grantId: string;
+    failures: GrantCheckFailure[];
+};
+export declare function explainGrants(input: GrantEvaluationInput): GrantEvaluationExplanation[];
+export declare function evaluateGrants(input: GrantEvaluationInput): GrantEvaluation;
+export declare function grantAllows(input: GrantEvaluationInput, capability: GrantCapability): boolean;

package/dist/utils/grants.js

@@ -0,0 +1,160 @@
+import { normalizeAccessScopePath } from "../contracts/access.js";
+import { GRANT_CAPABILITIES, grantNetworkCidrMatches, normalizeGrantResourcePattern, } from "../contracts/grants.js";
+function audienceMatches(audience, principal) {
+    switch (audience.kind) {
+        case "public":
+            return true;
+        case "team":
+            return principal.teamIds?.includes(audience.teamId) ?? false;
+        case "person":
+            return principal.personIds?.includes(audience.personId) ?? false;
+        case "link":
+            return principal.linkIds?.includes(audience.linkId) ?? false;
+        case "password":
+            return principal.passwordCredentialIds?.includes(audience.credentialId) ?? false;
+        case "machine":
+            return principal.machineIds?.includes(audience.machineId) ?? false;
+        case "external":
+            return (principal.externalIdentities?.some((identity) => identity.issuer === audience.issuer && identity.subject === audience.subject) ?? false);
+    }
+    throw new Error("Unsupported Grant audience.");
+}
+function targetMatches(selector, target) {
+    switch (selector.kind) {
+        case "live":
+            return target.kind === "live";
+        case "version":
+            return target.kind === "version" && target.versionId === selector.versionId;
+        case "branch":
+            return target.kind === "branch" && target.branch === selector.branch;
+        case "all_versions":
+            return target.kind === "version";
+    }
+    throw new Error("Unsupported Grant target.");
+}
+function normalizeGrantEvaluationResource(resource, resourceKind) {
+    if (resourceKind === "route")
+        return normalizeAccessScopePath(resource);
+    if (!resource.startsWith("/")) {
+        throw new TypeError("artifact resource must be an absolute path");
+    }
+    const canonical = normalizeGrantResourcePattern(resource);
+    if (canonical.includes("*")) {
+        throw new TypeError("artifact resource cannot contain wildcards");
+    }
+    return canonical;
+}
+export function grantResourcePatternMatches(pattern, resource, resourceKind = "route") {
+    const canonicalPattern = normalizeGrantResourcePattern(pattern);
+    const canonicalResource = normalizeGrantEvaluationResource(resource, resourceKind);
+    const patternSegments = canonicalPattern === "/" ? [] : canonicalPattern.slice(1).split("/");
+    const resourceSegments = canonicalResource === "/" ? [] : canonicalResource.slice(1).split("/");
+    const matches = (patternIndex, resourceIndex) => {
+        const patternSegment = patternSegments[patternIndex];
+        if (patternSegment === undefined)
+            return resourceIndex === resourceSegments.length;
+        if (patternSegment === "**") {
+            if (patternIndex === patternSegments.length - 1)
+                return true;
+            for (let next = resourceIndex; next <= resourceSegments.length; next++) {
+                if (matches(patternIndex + 1, next))
+                    return true;
+            }
+            return false;
+        }
+        if (resourceIndex >= resourceSegments.length)
+            return false;
+        if (patternSegment !== "*" && patternSegment !== resourceSegments[resourceIndex])
+            return false;
+        return matches(patternIndex + 1, resourceIndex + 1);
+    };
+    return matches(0, 0);
+}
+function grantCheckFailures(grant, input, principal, now) {
+    const failures = [];
+    if (grant.source.kind === "config" && !input.spaceClaimed) {
+        failures.push("space_unclaimed_config");
+    }
+    if (!audienceMatches(grant.audience, principal))
+        failures.push("audience");
+    if (!targetMatches(grant.target, input.target))
+        failures.push("target");
+    const timestamp = now.getTime();
+    if (!Number.isFinite(timestamp)) {
+        failures.push("invalid_time");
+    }
+    else {
+        const notBefore = grant.constraints.notBefore;
+        if (notBefore !== undefined && timestamp < Date.parse(notBefore))
+            failures.push("not_before");
+        const expiresAt = grant.constraints.expiresAt;
+        if (expiresAt !== undefined && timestamp >= Date.parse(expiresAt))
+            failures.push("expired");
+    }
+    const maxUses = grant.constraints.maxUses;
+    if (maxUses !== undefined && !input.acquiredGrantIds?.includes(grant.id)) {
+        const uses = input.useCounts?.[grant.id];
+        if (!Number.isInteger(uses) || (uses ?? 0) < 0 || (uses ?? 0) >= maxUses) {
+            failures.push("max_uses");
+        }
+    }
+    if (grant.constraints.requireVerifiedEmail && principal.verifiedEmail !== true) {
+        failures.push("verified_email");
+    }
+    if (grant.constraints.network &&
+        ((grant.constraints.network.ipCidrs !== undefined &&
+            (!principal.ipAddress ||
+                !grant.constraints.network.ipCidrs.some((cidr) => grantNetworkCidrMatches(cidr, principal.ipAddress ?? "")))) ||
+            (grant.constraints.network.countries !== undefined &&
+                (!principal.country ||
+                    !grant.constraints.network.countries.includes(principal.country.toUpperCase()))) ||
+            (grant.constraints.network.excludedCountries !== undefined &&
+                (!principal.country ||
+                    grant.constraints.network.excludedCountries.includes(principal.country.toUpperCase()))) ||
+            (grant.constraints.network.excludedUserAgentSubstrings !== undefined &&
+                (!principal.userAgent ||
+                    grant.constraints.network.excludedUserAgentSubstrings.some((needle) => principal.userAgent?.toLowerCase().includes(needle.toLowerCase())))))) {
+        failures.push("network");
+    }
+    const included = grant.resources.include.some((pattern) => grantResourcePatternMatches(pattern, input.resource, input.resourceKind));
+    if (!included) {
+        failures.push("resource_not_included");
+    }
+    else if (grant.resources.exclude.some((pattern) => grantResourcePatternMatches(pattern, input.resource, input.resourceKind))) {
+        failures.push("resource_excluded");
+    }
+    return failures;
+}
+export function explainGrants(input) {
+    const principal = input.principal ?? {};
+    const now = input.now ?? new Date();
+    return input.grants.map((grant) => ({
+        grantId: grant.id,
+        failures: grantCheckFailures(grant, input, principal, now),
+    }));
+}
+export function evaluateGrants(input) {
+    const principal = input.principal ?? {};
+    const now = input.now ?? new Date();
+    const matches = [];
+    const capabilities = new Set();
+    for (const grant of input.grants) {
+        if (grantCheckFailures(grant, input, principal, now).length > 0)
+            continue;
+        const matchedCapabilities = [...grant.capabilities];
+        matches.push({
+            grantId: grant.id,
+            capabilities: matchedCapabilities,
+            source: grant.source,
+        });
+        for (const capability of matchedCapabilities)
+            capabilities.add(capability);
+    }
+    return {
+        capabilities: GRANT_CAPABILITIES.filter((capability) => capabilities.has(capability)),
+        matches,
+    };
+}
+export function grantAllows(input, capability) {
+    return evaluateGrants(input).capabilities.includes(capability);
+}

package/dist/utils/local-space-state.js

@@ -131,6 +131,7 @@ export async function findUpward(probe, startDir = process.cwd(), boundary) {
         current = resolvedBoundary;
     }
     for (;;) {
+        // oxlint-disable-next-line no-await-in-loop -- each parent probe depends on the child being absent
         const found = await probe(current);
         if (found)
             return found;

package/dist/utils/pages.d.ts

@@ -16,17 +16,23 @@ export type PageFileEntry = {
 export type PagePreviewFile = {
     name: string;
     href: string;
-    downloadHref?: string;
     size?: string;
     mime?: string;
 };
+/**
+ * One URL, one representation. A file's bare path always serves its bytes;
+ * the preview page is reachable only under this query flag. The alternative —
+ * negotiating on `Accept` at the bare path — depends on `Vary`, which the edge
+ * ignores, so whichever client arrived first pinned that representation for
+ * everyone (an `<img>` could poison the human's link for a year).
+ */
+export declare const PAGE_PREVIEW_QUERY = "spacefast_view";
+/** The preview page for a file whose bytes live at `fileHref`. */
+export declare function previewPageHref(fileHref: string): string;
 export type PageExpansionContext = {
     page: SitePageId | "layout";
     theme?: PageTheme;
     content?: string;
-    passwordAction?: string;
-    passwordError?: string;
-    loginHref?: string;
     displayPath?: string;
     displayTitle?: string;
     itemCount?: number;
@@ -38,7 +44,7 @@ export type PageExpansionContext = {
 };
 export type PageDiagnostic = {
     severity: "warning" | "error";
-    code: "page_source_too_large" | "unknown_page_template" | "unknown_page_element" | "page_element_not_allowed" | "page_document_required" | "layout_missing_content" | "password_form_missing" | "index_files_missing" | "page_indexable";
+    code: "page_source_too_large" | "unknown_page_template" | "unknown_page_element" | "page_element_not_allowed" | "page_document_required" | "layout_missing_content" | "index_files_missing" | "page_indexable";
     message: string;
     path: string;
 };

package/dist/utils/pages.js

@@ -3,6 +3,18 @@ import { CUSTOM_PAGE_IDS, PAGE_CATALOG, PAGE_ELEMENTS, PAGE_LAYOUT_FILE, PAGE_SO
 import { SPACE_CONFIG_ACCEPTED_FILES } from "../contracts/space-config.js";
 import { derivePageColors, PAGE_COLOR_DEFAULTS } from "./page-colors.js";
 import { PAGE_EMBEDDED_FONT_FACES, PAGE_FONT_FACES } from "./page-fonts.js";
+/**
+ * One URL, one representation. A file's bare path always serves its bytes;
+ * the preview page is reachable only under this query flag. The alternative —
+ * negotiating on `Accept` at the bare path — depends on `Vary`, which the edge
+ * ignores, so whichever client arrived first pinned that representation for
+ * everyone (an `<img>` could poison the human's link for a year).
+ */
+export const PAGE_PREVIEW_QUERY = "spacefast_view";
+/** The preview page for a file whose bytes live at `fileHref`. */
+export function previewPageHref(fileHref) {
+    return `${fileHref}${fileHref.includes("?") ? "&" : "?"}${PAGE_PREVIEW_QUERY}=1`;
+}
 const encoder = new TextEncoder();
 const knownElements = new Set(PAGE_ELEMENTS);
 const customPageIds = new Set(CUSTOM_PAGE_IDS);
@@ -69,16 +81,14 @@ function renderFiles(files) {
 function renderFile(file) {
     if (!file)
         return '<p class="sf-empty">File unavailable.</p>';
-    const rawHref = `${file.href}${file.href.includes("?") ? "&" : "?"}spacefast_raw=1`;
-    const href = escapePageHtml(rawHref);
+    // This page is itself the `?spacefast_view=1` representation, so the embed,
+    // the download and the raw link all point straight at the canonical path.
+    const href = escapePageHtml(file.href);
     const name = escapePageHtml(file.name);
     const media = file.mime?.startsWith("image/")
         ? `<img class="sf-preview" src="${href}" alt="">`
         : `<iframe class="sf-preview" src="${href}" title="Preview of ${name}" loading="lazy" sandbox></iframe>`;
-    const downloadHref = file.downloadHref
-        ? `${file.downloadHref}${file.downloadHref.includes("?") ? "&" : "?"}spacefast_raw=1`
-        : rawHref;
-    return `<div class="sf-preview-wrap">${media}</div><dl class="sf-file-meta"><div><dt>Name</dt><dd>${name}</dd></div>${file.size ? `<div><dt>Size</dt><dd>${escapePageHtml(file.size)}</dd></div>` : ""}${file.mime ? `<div><dt>Type</dt><dd>${escapePageHtml(file.mime)}</dd></div>` : ""}</dl><div class="sf-actions"><a class="sf-button" href="${escapePageHtml(downloadHref)}" download>Download</a><a class="sf-ghost" href="${href}">View raw</a></div>`;
+    return `<div class="sf-preview-wrap">${media}</div><dl class="sf-file-meta"><div><dt>Name</dt><dd>${name}</dd></div>${file.size ? `<div><dt>Size</dt><dd>${escapePageHtml(file.size)}</dd></div>` : ""}${file.mime ? `<div><dt>Type</dt><dd>${escapePageHtml(file.mime)}</dd></div>` : ""}</dl><div class="sf-actions"><a class="sf-button" href="${href}" download>Download</a><a class="sf-ghost" href="${href}">View raw</a></div>`;
 }
 function renderSpacefastBranding(hidden) {
     const wordmark = hidden
@@ -90,18 +100,8 @@ function renderElement(element, context) {
     switch (element) {
         case "sf-content":
             return context.content ?? "";
-        case "sf-password-form": {
-            const hasError = Boolean(context.passwordError);
-            const error = hasError
-                ? `<p class="sf-error" id="sf-password-error" role="alert">${escapePageHtml(context.passwordError ?? "")}</p>`
-                : "";
-            const form = `<form class="sf-form" method="post" action="${escapePageHtml(context.passwordAction ?? "")}"><label for="sf-password">Password</label><div class="sf-form-row"><input id="sf-password" name="_pw" type="password" required autocomplete="current-password"${hasError ? ' aria-invalid="true" aria-describedby="sf-password-error"' : ""}><button type="submit">Continue</button></div>${error}</form>`;
-            return runtimeSlot("challenge", form);
-        }
-        case "sf-login":
-            return runtimeSlot("challenge", `<div class="sf-actions"><a class="sf-button" href="${escapePageHtml(context.loginHref ?? "/__spacefast/access/login")}">Continue with Spacefast</a></div>`);
         case "sf-denial-context":
-            return runtimeSlot("denial", '<p class="sf-copy">Access to this space is restricted.</p>');
+            return runtimeSlot("denial", '<p class="sf-copy">This page is private.</p>');
         case "sf-page-path":
             return context.displayPath
                 ? escapePageHtml(context.displayPath)
@@ -192,7 +192,6 @@ export function validatePageSources(input) {
                 element === "sf-name" ||
                 element === "sf-spacefast-branding" ||
                 (id === "404" && element === "sf-page-path") ||
-                (id === "password" && element === "sf-password-form") ||
                 (id === "denied" && element === "sf-denial-context") ||
                 (id === "index" &&
                     (element === "sf-files" ||
@@ -209,16 +208,6 @@ export function validatePageSources(input) {
                     path,
                 });
         }
-        if (id === "password" &&
-            !/<\s*sf-password-form\b/i.test(source) &&
-            !/<\s*input\b[^>]*\bname\s*=\s*["']_pw["']/i.test(source)) {
-            diagnostics.push({
-                severity: "error",
-                code: "password_form_missing",
-                message: "The password page needs <sf-password-form> or a form input named _pw.",
-                path,
-            });
-        }
         if (id === "index" && !/<\s*sf-files\b/i.test(source))
             diagnostics.push({
                 severity: "warning",
@@ -226,7 +215,7 @@ export function validatePageSources(input) {
                 message: "The index page does not render <sf-files>.",
                 path,
             });
-        if ((id === "password" || id === "denied") &&
+        if (id === "denied" &&
             /<\s*meta\b[^>]*\bname\s*=\s*["']robots["'][^>]*\bcontent\s*=\s*["'][^"']*\bindex\b/i.test(source))
             diagnostics.push({
                 severity: "warning",
@@ -332,7 +321,7 @@ export function defaultPageBody(id) {
 // The built-in palette runs through the same readability engine as pushed
 // themes, so buttons and links remain readable for every accepted accent.
 const defaultPageColors = derivePageColors({});
-const sharedCss = `/*sf-default-fonts*/:root{color-scheme:light dark;--sf-accent:${PAGE_COLOR_DEFAULTS.accent};--sf-bg:${PAGE_COLOR_DEFAULTS.bg};--sf-fg:${PAGE_COLOR_DEFAULTS.fg};--sf-muted:${PAGE_COLOR_DEFAULTS.muted};--sf-card:${PAGE_COLOR_DEFAULTS.card};--sf-border:${PAGE_COLOR_DEFAULTS.border};--sf-link:${defaultPageColors.link};--sf-on-accent:${defaultPageColors.onAccent};--sf-error:#a82d1a;--sf-font:"Haskoy",-apple-system,BlinkMacSystemFont,ui-sans-serif,"Segoe UI",sans-serif;--sf-display-font:"Merriweather",Georgia,serif;--sf-mono:ui-monospace,"SF Mono",Menlo,Consolas,monospace}*{box-sizing:border-box}html{min-width:320px;background:var(--sf-bg);-webkit-font-smoothing:antialiased}body{margin:0;min-height:100vh;background:var(--sf-bg);color:var(--sf-fg);font:14px/1.65 var(--sf-font)}a{color:inherit}.sf-page{min-height:100vh;display:flex;flex-direction:column;padding:clamp(22px,4vw,44px)}.sf-header{display:flex;align-items:center;min-height:32px}.sf-page-center .sf-header{justify-content:center}.sf-brand{display:inline-flex;min-width:0;align-items:center;gap:10px;color:var(--sf-fg);text-decoration:none}.sf-brand-mark{width:7px;height:7px;flex:none;background:var(--sf-accent)}.sf-logo{width:28px;height:28px;flex:none;object-fit:contain}.sf-brand strong{min-width:0;overflow-wrap:anywhere;font-size:13px;font-weight:600}.sf-main{flex:1;width:100%;padding:clamp(34px,9vh,84px) 0}.sf-page-plain .sf-main{max-width:680px}.sf-page-center .sf-main{max-width:620px;margin:auto;display:flex;flex-direction:column;align-items:center;text-align:center}.sf-eyebrow{margin:0 0 14px;color:var(--sf-muted);font:500 11px/1.5 var(--sf-mono);letter-spacing:.12em;text-transform:uppercase;overflow-wrap:anywhere}.sf-page-center .sf-eyebrow{margin-bottom:16px}h1{max-width:20ch;margin:0 0 12px;color:var(--sf-fg);font:430 clamp(1.9rem,5vw,2.8rem)/1.22 var(--sf-display-font);letter-spacing:-.012em;text-wrap:balance}.sf-copy,.sf-sub{max-width:52ch;margin:0;color:var(--sf-muted);text-wrap:pretty}.sf-inline-path{font-family:var(--sf-mono);font-size:.9em;color:var(--sf-fg);overflow-wrap:anywhere}.sf-actions{display:flex;flex-wrap:wrap;align-items:center;gap:14px;margin-top:22px}.sf-page-center .sf-actions{justify-content:center}.sf-button,.sf-form button,.sf-login{display:inline-flex;min-height:44px;align-items:center;justify-content:center;border:0;background:var(--sf-accent);color:var(--sf-on-accent);padding:10px 16px;font:600 13px/1.4 var(--sf-font);text-decoration:none;cursor:pointer}.sf-ghost{color:var(--sf-muted);text-underline-offset:3px}.sf-button:hover,.sf-form button:hover,.sf-login:hover{filter:brightness(1.06)}a:focus-visible,button:focus-visible{outline:2px solid var(--sf-link);outline-offset:2px}.sf-form{width:100%;max-width:360px;margin-top:22px;text-align:left}.sf-form label,.sf-password label{display:block;margin-bottom:8px;color:var(--sf-muted);font:500 11px/1.5 var(--sf-mono);letter-spacing:.1em;text-transform:uppercase}.sf-password label{flex-basis:100%}.sf-form-row{display:flex;gap:10px}.sf-password form{display:flex;flex-wrap:wrap;gap:10px}.sf-form input,.sf-pw{min-width:0;flex:1;border:1px solid var(--sf-border);background:transparent;color:var(--sf-fg);padding:9px 11px;font:14px/1.5 var(--sf-font)}.sf-form input:focus-visible,.sf-pw:focus-visible{outline:2px solid var(--sf-link);outline-offset:-2px}.sf-form input[aria-invalid=true],.sf-pw[aria-invalid=true]{border-color:var(--sf-error)}.sf-form button,.sf-password button{margin:0}.sf-error{margin:9px 0 0;color:var(--sf-error);font-size:14px}.sf-password .sf-error{flex-basis:100%;margin:0}.sf-block{width:100%}.sf-login-block{display:flex;justify-content:center;margin-top:20px}.sf-copy+.sf-copy{margin-top:12px}.sf-files{width:100%;margin:24px 0 0;padding:0;list-style:none}.sf-files li{display:flex;min-width:0;align-items:baseline;gap:18px;border-bottom:1px solid var(--sf-border)}.sf-files a{min-width:0;flex:1;padding:10px 2px;color:var(--sf-fg);font-weight:500;text-decoration:none}.sf-files a:hover{color:var(--sf-link)}.sf-file-name{overflow-wrap:anywhere}.sf-file-size{flex:none;padding:10px 2px;color:var(--sf-muted);font:12px/1.5 var(--sf-mono);white-space:nowrap}.sf-empty{max-width:420px;margin:24px 0 0;border:1px dashed var(--sf-border);padding:18px 20px;color:var(--sf-muted)}.sf-preview-wrap{width:min(100%,560px);aspect-ratio:16/9;margin:10px 0 18px;overflow:hidden;background:#fff;outline:1px solid color-mix(in srgb,var(--sf-fg) 10%,transparent);outline-offset:-1px}.sf-preview{display:block;width:100%;height:100%;border:0;object-fit:contain}.sf-file-meta{width:min(100%,560px);margin:0}.sf-file-meta div{display:flex;min-width:0;justify-content:space-between;gap:20px;border-bottom:1px solid var(--sf-border);padding:9px 2px}.sf-file-meta dt{color:var(--sf-fg);font-weight:600}.sf-file-meta dd{min-width:0;margin:0;color:var(--sf-muted);font-family:var(--sf-mono);overflow-wrap:anywhere;text-align:right}.sf-colophon{display:flex;flex-direction:column;align-items:center;gap:10px;padding:44px 0 26px;margin-top:auto;color:var(--sf-muted)}.sf-page-plain .sf-colophon{align-items:flex-start}.sf-colophon-row{display:flex;align-items:center;gap:20px;flex-wrap:wrap}.sf-powered{display:inline-flex;align-items:center;gap:10px;cursor:pointer;outline:none}.sf-powered-line{display:none;font-size:12px;color:var(--sf-muted)}.sf-powered:hover .sf-powered-line,.sf-powered:focus .sf-powered-line,.sf-powered:focus-within .sf-powered-line{display:inline}.sf-powered-line a{color:var(--sf-link);text-decoration:underline;text-underline-offset:3px}.sf-help{font-size:12px;color:var(--sf-muted);text-decoration:underline;text-underline-offset:3px}.sf-help:hover{color:var(--sf-fg)}.sf-wordmark{display:block;flex:none;width:auto;height:11px}.sf-wordmark-shadow{fill:var(--sf-accent)}.sf-wordmark-plate{fill:#141419}.sf-wordmark-paper{fill:#fbf8f1}@media(max-width:520px){.sf-page{padding:20px}.sf-form-row,.sf-password form{flex-direction:column}.sf-button,.sf-form button,.sf-login{min-height:48px}.sf-file-meta div{flex-direction:column;gap:2px}.sf-file-meta dd{text-align:left}.sf-colophon{padding-top:32px}}@media(prefers-color-scheme:dark){:root{--sf-bg:${PAGE_COLOR_DEFAULTS.darkBg};--sf-fg:${PAGE_COLOR_DEFAULTS.darkFg};--sf-muted:${PAGE_COLOR_DEFAULTS.darkMuted};--sf-card:${PAGE_COLOR_DEFAULTS.darkCard};--sf-border:${PAGE_COLOR_DEFAULTS.darkBorder};--sf-link:${defaultPageColors.linkDark};--sf-error:#ff8a7a}.sf-preview-wrap{outline-color:#ffffff1a}}@media(forced-colors:active){.sf-brand-mark{background:CanvasText}.sf-button,.sf-form button,.sf-login{border:1px solid ButtonText}.sf-powered:focus{outline:1px solid CanvasText;outline-offset:3px}}`;
+const sharedCss = `/*sf-default-fonts*/:root{color-scheme:light dark;--sf-accent:${PAGE_COLOR_DEFAULTS.accent};--sf-bg:${PAGE_COLOR_DEFAULTS.bg};--sf-fg:${PAGE_COLOR_DEFAULTS.fg};--sf-muted:${PAGE_COLOR_DEFAULTS.muted};--sf-card:${PAGE_COLOR_DEFAULTS.card};--sf-border:${PAGE_COLOR_DEFAULTS.border};--sf-link:${defaultPageColors.link};--sf-on-accent:${defaultPageColors.onAccent};--sf-error:#a82d1a;--sf-font:"Haskoy",-apple-system,BlinkMacSystemFont,ui-sans-serif,"Segoe UI",sans-serif;--sf-display-font:"Merriweather",Georgia,serif;--sf-mono:ui-monospace,"SF Mono",Menlo,Consolas,monospace}*{box-sizing:border-box}html{min-width:320px;background:var(--sf-bg);-webkit-font-smoothing:antialiased}body{margin:0;min-height:100vh;background:var(--sf-bg);color:var(--sf-fg);font:14px/1.65 var(--sf-font)}a{color:inherit}.sf-page{min-height:100vh;display:flex;flex-direction:column;padding:clamp(22px,4vw,44px)}.sf-header{display:flex;align-items:center;min-height:32px}.sf-page-center .sf-header{justify-content:center}.sf-brand{display:inline-flex;min-width:0;align-items:center;gap:10px;color:var(--sf-fg);text-decoration:none}.sf-brand-mark{width:7px;height:7px;flex:none;background:var(--sf-accent)}.sf-logo{width:28px;height:28px;flex:none;object-fit:contain}.sf-brand strong{min-width:0;overflow-wrap:anywhere;font-size:13px;font-weight:600}.sf-main{flex:1;width:100%;padding:clamp(34px,9vh,84px) 0}.sf-page-plain .sf-main{max-width:680px}.sf-page-center .sf-main{max-width:620px;margin:auto;display:flex;flex-direction:column;align-items:center;text-align:center}.sf-eyebrow{margin:0 0 14px;color:var(--sf-muted);font:500 11px/1.5 var(--sf-mono);letter-spacing:.12em;text-transform:uppercase;overflow-wrap:anywhere}.sf-page-center .sf-eyebrow{margin-bottom:16px}h1{max-width:20ch;margin:0 0 12px;color:var(--sf-fg);font:430 clamp(1.9rem,5vw,2.8rem)/1.22 var(--sf-display-font);letter-spacing:-.012em;text-wrap:balance}.sf-copy,.sf-sub{max-width:52ch;margin:0;color:var(--sf-muted);text-wrap:pretty}.sf-inline-path{font-family:var(--sf-mono);font-size:.9em;color:var(--sf-fg);overflow-wrap:anywhere}.sf-actions{display:flex;flex-wrap:wrap;align-items:center;gap:14px;margin-top:22px}.sf-page-center .sf-actions{justify-content:center}.sf-button{display:inline-flex;min-height:44px;align-items:center;justify-content:center;border:0;background:var(--sf-accent);color:var(--sf-on-accent);padding:10px 16px;font:600 13px/1.4 var(--sf-font);text-decoration:none;cursor:pointer}.sf-ghost{color:var(--sf-muted);text-underline-offset:3px}.sf-button:hover{filter:brightness(1.06)}a:focus-visible,button:focus-visible{outline:2px solid var(--sf-link);outline-offset:2px}.sf-copy+.sf-copy{margin-top:12px}.sf-files{width:100%;margin:24px 0 0;padding:0;list-style:none}.sf-files li{display:flex;min-width:0;align-items:baseline;gap:18px;border-bottom:1px solid var(--sf-border)}.sf-files a{min-width:0;flex:1;padding:10px 2px;color:var(--sf-fg);font-weight:500;text-decoration:none}.sf-files a:hover{color:var(--sf-link)}.sf-file-name{overflow-wrap:anywhere}.sf-file-size{flex:none;padding:10px 2px;color:var(--sf-muted);font:12px/1.5 var(--sf-mono);white-space:nowrap}.sf-empty{max-width:420px;margin:24px 0 0;border:1px dashed var(--sf-border);padding:18px 20px;color:var(--sf-muted)}.sf-preview-wrap{width:min(100%,560px);aspect-ratio:16/9;margin:10px 0 18px;overflow:hidden;background:#fff;outline:1px solid color-mix(in srgb,var(--sf-fg) 10%,transparent);outline-offset:-1px}.sf-preview{display:block;width:100%;height:100%;border:0;object-fit:contain}.sf-file-meta{width:min(100%,560px);margin:0}.sf-file-meta div{display:flex;min-width:0;justify-content:space-between;gap:20px;border-bottom:1px solid var(--sf-border);padding:9px 2px}.sf-file-meta dt{color:var(--sf-fg);font-weight:600}.sf-file-meta dd{min-width:0;margin:0;color:var(--sf-muted);font-family:var(--sf-mono);overflow-wrap:anywhere;text-align:right}.sf-colophon{display:flex;flex-direction:column;align-items:center;gap:10px;padding:44px 0 26px;margin-top:auto;color:var(--sf-muted)}.sf-page-plain .sf-colophon{align-items:flex-start}.sf-colophon-row{display:flex;align-items:center;gap:20px;flex-wrap:wrap}.sf-powered{display:inline-flex;align-items:center;gap:10px;cursor:pointer;outline:none}.sf-powered-line{display:none;font-size:12px;color:var(--sf-muted)}.sf-powered:hover .sf-powered-line,.sf-powered:focus .sf-powered-line,.sf-powered:focus-within .sf-powered-line{display:inline}.sf-powered-line a{color:var(--sf-link);text-decoration:underline;text-underline-offset:3px}.sf-help{font-size:12px;color:var(--sf-muted);text-decoration:underline;text-underline-offset:3px}.sf-help:hover{color:var(--sf-fg)}.sf-wordmark{display:block;flex:none;width:auto;height:11px}.sf-wordmark-shadow{fill:var(--sf-accent)}.sf-wordmark-plate{fill:#141419}.sf-wordmark-paper{fill:#fbf8f1}@media(max-width:520px){.sf-page{padding:20px}.sf-button{min-height:48px}.sf-file-meta div{flex-direction:column;gap:2px}.sf-file-meta dd{text-align:left}.sf-colophon{padding-top:32px}}@media(prefers-color-scheme:dark){:root{--sf-bg:${PAGE_COLOR_DEFAULTS.darkBg};--sf-fg:${PAGE_COLOR_DEFAULTS.darkFg};--sf-muted:${PAGE_COLOR_DEFAULTS.darkMuted};--sf-card:${PAGE_COLOR_DEFAULTS.darkCard};--sf-border:${PAGE_COLOR_DEFAULTS.darkBorder};--sf-link:${defaultPageColors.linkDark};--sf-error:#ff8a7a}.sf-preview-wrap{outline-color:#ffffff1a}}@media(forced-colors:active){.sf-brand-mark{background:CanvasText}.sf-button{border:1px solid ButtonText}.sf-powered:focus{outline:1px solid CanvasText;outline-offset:3px}}`;
 const pageHeader = '<header class="sf-header"><a class="sf-brand" href="/" aria-label="Homepage"><span class="sf-brand-mark" aria-hidden="true"></span><sf-logo></sf-logo><strong><sf-name></sf-name></strong></a></header>';
 const pageFooter = "<sf-spacefast-branding></sf-spacefast-branding>";
 function document(id, title, body, layout) {
@@ -341,9 +330,7 @@ function document(id, title, body, layout) {
 }
 export const DEFAULT_PAGE_TEMPLATES = {
     "404": document("404", "Page not found", '<p class="sf-eyebrow">404 · Not Found</p><h1>Page not found</h1><p class="sf-copy">There’s nothing at <span class="sf-inline-path"><sf-page-path></sf-page-path></span>.</p><div class="sf-actions"><a class="sf-button" href="/">Go to the homepage</a></div>', "center"),
-    password: document("password", "Password required", '<h1>This space is protected</h1><p class="sf-sub">Enter the password to continue.</p><sf-password-form></sf-password-form>', "center"),
     denied: document("denied", "Access denied", "<h1>Access denied</h1><sf-denial-context></sf-denial-context>", "center"),
-    login: document("login", "Sign in", '<h1>This space is for members</h1><p class="sf-sub">Sign in to continue — you’ll come right back here.</p><sf-login></sf-login>', "center"),
     index: document("index", "<sf-page-title></sf-page-title>", '<p class="sf-eyebrow"><sf-page-path></sf-page-path></p><h1><sf-page-title></sf-page-title></h1><p class="sf-sub"><sf-page-summary></sf-page-summary></p><sf-files></sf-files>', "plain"),
     preview: document("preview", "<sf-page-title></sf-page-title>", '<p class="sf-eyebrow"><sf-page-path></sf-page-path></p><h1><sf-page-title></sf-page-title></h1><sf-file></sf-file>', "plain"),
 };

package/dist/utils/publish-policy.d.ts

@@ -46,6 +46,40 @@ export type PublishManifestResult<T extends {
     files: T[];
     warnings: PublishManifestWarning[];
 };
+export type PublishRouteAnalysis = {
+    collisions: Array<{
+        route: string;
+        paths: string[];
+    }>;
+    caseCollisions: Array<{
+        route: string;
+        siblingRoute: string;
+        paths: string[];
+    }>;
+    routeOwnership: PublishRouteOwnership[];
+};
+export type PublishRouteOwnership = {
+    requestedRoute: string;
+    artifactPath: string;
+};
+/**
+ * Canonicalizes a route expanded from an already-canonical manifest path.
+ * Manifest intake has decoded percent escapes exactly once, so this must not
+ * decode again. It applies only the route-identity aliases shared with access.
+ */
+export declare function canonicalizePublishRequestedRoute(route: string): string;
+/**
+ * Expands artifact paths into the request routes they can serve. The runtime
+ * resolves literal files, directory indexes, and clean `.html` aliases; two
+ * different artifacts owning one request route is rejected at publish/finalize
+ * instead of depending on lookup order. `routeOwnership` exposes the same
+ * expansion in canonical access-route form so authorization and diagnostics
+ * never have to infer a route from an artifact path.
+ */
+export declare function analyzePublishRoutes(paths: readonly string[], options?: {
+    index?: string | false;
+    cleanUrls?: boolean;
+}): PublishRouteAnalysis;
 export declare function resolveManifestFileCap(maxFiles?: number | null): number;
 export declare function validatePublishManifest<T extends {
     path: string;
@@ -64,7 +98,3 @@ export declare function filterFreePlanManifest<T extends {
     allowed: T[];
     ignored: string[];
 };
-export declare function filterFreePlanHeaders(content: string): {
-    headers: string | undefined;
-    droppedBasicAuthCount: number;
-};