@spacefast/common 0.0.12 → 0.0.13

package/dist/utils/access-verdict.fixtures.json

@@ -1,421 +0,0 @@
-{
-    "_comment": "Shared corpus for the simulate<->runtime verdict drift guard (access-plan §8/X-9). Asserted against the PHP pure kernel (_spacefast_evaluate_policy, runtime/engine/runtime/access-rules.php) in apps/control-plane/src/runtime/php-policy-parity.test.ts and against apps/control-plane/src/access/simulate.ts's simulateAccess in apps/control-plane/src/runtime/access-verdict-parity.test.ts. `rules` is a raw RuntimeRule[] (no source/order provenance). `context` carries only the 4 fields simulate.ts's SimulateRequest supports (host/path/ip/country) plus `now` for expiry. `grants` mirrors what a real visitor token would carry but is restricted to 0-or-1 `email:` entries (simulate.ts's own simplification — it only ever mints an `email:` grant); `identified` is `grants.length > 0`, matching simulateAccess. `expected` is the {ruleId, effect, satisfied} verdict tuple both sides must agree on.",
-    "verdicts": [
-        {
-            "name": "first-match wins: anonymous deny before a later allow-all",
-            "rules": [
-                { "id": "r1", "match": { "pathPattern": "/admin/**" }, "effect": "deny" },
-                { "id": "r2", "match": {}, "effect": "allow" }
-            ],
-            "context": {
-                "host": "acme.example.com",
-                "path": "/admin/x",
-                "ip": "1.2.3.4",
-                "country": "US"
-            },
-            "grants": [],
-            "identified": false,
-            "now": 1770000000,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "first match: satisfied allow wins over a later deny",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "allow",
-                    "auth": { "requiredGrants": ["email:carol@acme.com"] }
-                },
-                { "id": "r2", "match": {}, "effect": "deny" }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:carol@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "expired deny rule is skipped, falls through to public allow",
-            "rules": [
-                { "id": "r1", "match": {}, "effect": "deny", "expiresAt": 1000 },
-                { "id": "r2", "match": {}, "effect": "allow" }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 2000,
-            "expected": { "ruleId": "r2", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "not-yet-expired rule (expiresAt > now) still applies",
-            "rules": [{ "id": "r1", "match": {}, "effect": "deny", "expiresAt": 2001 }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 2000,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "expiresAt == now is expired at the boundary (falls through to public allow)",
-            "rules": [{ "id": "r1", "match": {}, "effect": "deny", "expiresAt": 2000 }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 2000,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "challenge unsatisfied + identified visitor becomes deny (X-32 never re-challenge)",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "challenge",
-                    "auth": { "requiredGrants": ["team:t1:member"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:carol@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": false }
-        },
-        {
-            "name": "challenge unsatisfied + anonymous stays a challenge",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "challenge",
-                    "auth": { "requiredGrants": ["team:t1:member"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "challenge", "satisfied": false }
-        },
-        {
-            "name": "challenge satisfied becomes allow",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "challenge",
-                    "auth": { "requiredGrants": ["email:carol@acme.com"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:carol@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "allow rule unsatisfied keeps scanning to default public allow",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "allow",
-                    "auth": { "requiredGrants": ["email:carol@acme.com"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "deny rule unsatisfied keeps scanning to default public allow",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "deny",
-                    "auth": { "requiredGrants": ["email:carol@acme.com"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "deny rule satisfied denies immediately",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "deny",
-                    "auth": { "requiredGrants": ["email:mallory@acme.com"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:mallory@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "host mismatch falls through to public allow",
-            "rules": [{ "id": "r1", "match": { "host": "other.example.com" }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "path glob ** matches any depth",
-            "rules": [{ "id": "r1", "match": { "pathPattern": "/docs/**" }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/docs/a/b/c", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "path glob * matches one segment only, deeper path falls through",
-            "rules": [
-                { "id": "r1", "match": { "pathPattern": "/docs/*" }, "effect": "deny" },
-                { "id": "r2", "match": {}, "effect": "allow" }
-            ],
-            "context": { "host": "acme.example.com", "path": "/docs/a/b", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r2", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "country match denies",
-            "rules": [{ "id": "r1", "match": { "country": "KP" }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "KP" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "country mismatch falls through to public allow",
-            "rules": [{ "id": "r1", "match": { "country": "KP" }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "US" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "countryNotIn lets an explicitly allowed country fall through",
-            "rules": [{ "id": "r1", "match": { "countryNotIn": ["US"] }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "US" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "countryNotIn denies a provider-special country",
-            "rules": [{ "id": "r1", "match": { "countryNotIn": ["US"] }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "XX" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "countryNotIn denies a missing country",
-            "rules": [{ "id": "r1", "match": { "countryNotIn": ["US"] }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "ip cidr match denies",
-            "rules": [{ "id": "r1", "match": { "ipCidrs": ["10.0.0.0/8"] }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "10.1.2.3", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "ip cidr mismatch falls through to public allow",
-            "rules": [{ "id": "r1", "match": { "ipCidrs": ["10.0.0.0/8"] }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "192.168.1.1", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "agent-conditioned rule never fires when unsimulated (simulate.ts scope gap, negative-only)",
-            "rules": [
-                { "id": "r1", "match": { "agent": "Googlebot" }, "effect": "deny" },
-                { "id": "r2", "match": {}, "effect": "allow" }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r2", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "grant glob intersection: email domain wildcard satisfies",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "allow",
-                    "auth": { "requiredGrants": ["email:*@acme.com"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:carol@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "grant glob intersection: email outside the domain wildcard does not satisfy",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "allow",
-                    "auth": { "requiredGrants": ["email:*@acme.com"] }
-                },
-                { "id": "r2", "match": {}, "effect": "deny" }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:carol@evil.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r2", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "anonymous rule with challenge effect collapses to deny (no credential leg can ever satisfy it)",
-            "rules": [{ "id": "r1", "match": {}, "effect": "challenge" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "anonymous allow rule passes regardless of any carried grants",
-            "rules": [{ "id": "r1", "match": {}, "effect": "allow" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:carol@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "no rules at all: public allow",
-            "rules": [],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "no rule matches this host/path: public allow",
-            "rules": [{ "id": "r1", "match": { "pathPattern": "/private/**" }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/public/x", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "an irrelevant carried grant (same as a revoked/tombstoned id absent from requiredGrants) is a normal non-intersecting case",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "challenge",
-                    "auth": { "requiredGrants": ["team:t1:member"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:zoe@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": false }
-        },
-        {
-            "name": "a later invited reviewer falls through earlier identity allows and passes their own",
-            "rules": [
-                {
-                    "id": "cast-reviewer-a",
-                    "match": {},
-                    "effect": "allow",
-                    "managedBy": "cast_reviewer",
-                    "auth": { "requiredGrants": ["email:reviewer.a@example.com"] }
-                },
-                {
-                    "id": "cast-reviewer-b",
-                    "match": {},
-                    "effect": "allow",
-                    "managedBy": "cast_reviewer",
-                    "auth": { "requiredGrants": ["email:reviewer.b@example.com"] }
-                },
-                {
-                    "id": "cast-reviewers-audience",
-                    "match": {},
-                    "effect": "challenge",
-                    "managedBy": "cast_reviewer",
-                    "auth": {
-                        "requiredGrants": ["email:reviewer.a@example.com", "email:reviewer.b@example.com"]
-                    }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:reviewer.b@example.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "cast-reviewer-b", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "a non-reviewer falls through identity allows and is denied by the terminal audience",
-            "rules": [
-                {
-                    "id": "cast-reviewer-a",
-                    "match": {},
-                    "effect": "allow",
-                    "managedBy": "cast_reviewer",
-                    "auth": { "requiredGrants": ["email:reviewer.a@example.com"] }
-                },
-                {
-                    "id": "cast-reviewer-b",
-                    "match": {},
-                    "effect": "allow",
-                    "managedBy": "cast_reviewer",
-                    "auth": { "requiredGrants": ["email:reviewer.b@example.com"] }
-                },
-                {
-                    "id": "cast-reviewers-audience",
-                    "match": {},
-                    "effect": "challenge",
-                    "managedBy": "cast_reviewer",
-                    "auth": {
-                        "requiredGrants": ["email:reviewer.a@example.com", "email:reviewer.b@example.com"]
-                    }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:outsider@example.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "cast-reviewers-audience", "effect": "deny", "satisfied": false }
-        }
-    ]
-}

package/dist/utils/sf-config-v1.d.ts

@@ -1,2 +0,0 @@
-import { type CompileSfConfigV1Options, type SfConfigV1CompileResult } from "../contracts/sf-config-v1.js";
-export declare function compileSfConfigV1(source: string, options?: CompileSfConfigV1Options): SfConfigV1CompileResult;

package/dist/utils/sf-config-v1.fixtures.json

@@ -1,9 +0,0 @@
-{
-    "minimal.jsonc": "{\n  // The canonical starter is intentionally tiny.\n  \"$schema\": \"https://spacefast.com/schemas/sf.v1.json\",\n  \"version\": 1,\n}\n",
-    "full.jsonc": "{\n  \"version\": 1,\n  \"build\": {\n    \"installRoot\": \"packages/site\",\n    \"installCommand\": \"bun install --frozen-lockfile\",\n    \"command\": \"bun run build\",\n    \"output\": \"dist\",\n    \"timeoutSeconds\": 600\n  },\n  \"serve\": {\n    \"index\": \"index.html\",\n    \"spaFallback\": \"index.html\",\n    \"cleanUrls\": false,\n    \"directoryListing\": false\n  },\n  \"metadata\": {\n    \"title\": \"Docs\",\n    \"description\": \"The useful bits.\",\n    \"image\": \"/og.png\"\n  },\n  \"substitute\": { \"files\": [\"assets/runtime.js\"] }\n}\n",
-    "invalid-values.jsonc": "{\n  \"version\": 1,\n  \"build\": {\n    \"installRoot\": \"/outside\",\n    \"timeoutSeconds\": 30\n  },\n  \"serve\": { \"cleanUrls\": null },\n  \"substitute\": { \"files\": \"index.html\" }\n}\n",
-    "removed-identity.jsonc": "{\n  \"version\": 1,\n  \"space\": \"docs\",\n  \"placement\": \"dedicated\",\n  \"inject\": { \"head\": \"nope\" }\n}\n",
-    "retired-template.jsonc": "{\n  \"version\": 1,\n  \"substitute\": { \"files\": [\"runtime.js\"] }\n}\n",
-    "syntax-error.jsonc": "{\n  \"version\": 1,\n  \"serve\": { \"index\": \"index.html\" }\n",
-    "unknown-nested.jsonc": "{\n  \"version\": 1,\n  \"serve\": {\n    \"directoryListings\": true\n  }\n}\n"
-}