@spacefast/common 0.0.12 → 0.0.13

package/dist/contracts/functions.d.ts

@@ -0,0 +1,729 @@
+import { z } from "zod";
+import { executionInspectPolicySchema, runtimeKindSchema, type ExecutionCapabilities } from "./execution.js";
+/**
+ * Spacefast Functions: tenant workers run as Cloudflare Dynamic Workers.
+ *
+ * The shape of this product follows from two constraints that are not
+ * negotiable and that together rule out the obvious architecture:
+ *
+ * 1. **Cloudflare is reached from wp.cloud, never from the control plane.**
+ *    The control plane records intent; the space's own origin performs every
+ *    Cloudflare call.
+ * 2. **Every asset is served by wp.cloud.** We deliberately decline
+ *    Cloudflare's static-asset support for user workers. A worker receives
+ *    only the requests that could not be answered from bytes on disk, and
+ *    `/_next/static/*` and friends never leave our origin.
+ *
+ * Dynamic Workers is what makes both hold at once. There is no upload: a
+ * version's bundle stays in its own content store on wp.cloud, and the host
+ * worker pulls it on demand through the Worker Loader binding. So there is no
+ * script lifecycle here — no namespace, no script name, no tag budget, no
+ * eviction, no garbage collection — because there is no artefact of ours living
+ * on Cloudflare to manage. What Cloudflare holds is a warm isolate, which is a
+ * cache, not a record.
+ *
+ * That also keeps the exit cheap. The contract below is "here is a module
+ * graph, here is its configuration, run it", which is workerd's own shape; the
+ * managed runtime is an implementation of it rather than the thing we built
+ * against.
+ *
+ * What the worker gets in exchange is the thing we could not build: a real V8
+ * isolate that runs npm packages and framework output — OpenNext Next.js among
+ * them — without us having to sandbox any of it.
+ *
+ * The cost is that the worker is a continent away from the space's MySQL.
+ * `ctx.db` therefore travels back over an HTTPS relay to the same PHP broker
+ * the local tier speaks to over a pipe, which is slower and batched rather
+ * than transactional. That is why capsules are a different product rather
+ * than a placement option — see `endpointIsPortable` in `./execution.js`.
+ */
+export declare const FUNCTIONS_RUNTIME_KIND = "functions";
+export declare const FUNCTIONS_SOURCE_METADATA_KEY = "spacefastFunctions";
+export declare const FUNCTIONS_PLATFORM_ROUTE_PREFIX = "/__spacefast/functions";
+export declare const FUNCTIONS_RUNTIME_ROUTE_PATHS: {
+    readonly config: "/__spacefast/functions/config";
+    readonly inspect: "/__spacefast/functions/inspect";
+    readonly logs: "/__spacefast/functions/logs";
+    /** Where a dispatched worker calls back for brokered capabilities. */
+    readonly relay: "/__spacefast/functions/relay";
+};
+/** Public, signed read path. Distinct from storage so the token is never a filename. */
+export declare const FUNCTIONS_BUNDLE_ROUTE_PREFIX = "/__spacefast/functions/b";
+export declare const FUNCTIONS_RUNTIME_STORAGE_ROOT = "__spacefast/functions";
+/**
+ * Where a version's compiled bundle lives.
+ *
+ * Under the same `__spacefast/` prefix as every other platform-owned path, so
+ * there is one convention rather than one per product. Two consequences fall
+ * out of that placement, and both are wanted:
+ *
+ * - It is not servable as static content. The runtime treats the whole prefix
+ *   as control paths, so a tenant's compiled source is not readable at a
+ *   guessable URL — and the digest that would make it guessable appears in
+ *   build output.
+ * - It is written by the ordinary publish path anyway. The upload policy
+ *   carves out exactly this subtree (`publish-policy.ts`), so the bundle rides
+ *   the normal manifest and upload passes instead of needing a parallel one.
+ *
+ * The dispatch configuration — host, capabilities, relay credential — is not
+ * here and is not content at all. The engine writes it beside the version's
+ * file tree rather than inside it, exactly as it does for Zero, so a publish
+ * cannot reach it: no carve-out, no upload path, nothing to guard. A publish
+ * able to write that file would be a publish able to grant itself authority it
+ * was never given.
+ */
+export declare const FUNCTIONS_RUNTIME_BUNDLE_ROOT = "__spacefast/functions/bundles";
+export declare const FUNCTIONS_BUNDLE_FORMAT = "spacefast.functions.bundle.v1";
+/**
+ * Ceiling on a bundle's decoded size.
+ *
+ * The whole module graph arrives in one response so a cold isolate costs a
+ * single round trip, which means this number is also how much the host holds in
+ * memory before instantiating anything. Set below the runtime's own script
+ * limit so an oversized build fails in our tooling, where we can say which
+ * modules are large, rather than at dispatch, where the tenant sees a 502.
+ */
+export declare const FUNCTIONS_BUNDLE_MAX_BYTES: number;
+/**
+ * A worker's dynamic route table. Anything not matched here is answered from
+ * the version's static content by wp.cloud and never reaches Cloudflare, which
+ * is both the cheaper path and the one that keeps assets ours.
+ */
+export declare const functionsRouteSchema: z.ZodObject<{
+    method: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+        POST: "POST";
+        PUT: "PUT";
+        GET: "GET";
+        HEAD: "HEAD";
+        PATCH: "PATCH";
+        DELETE: "DELETE";
+        OPTIONS: "OPTIONS";
+    }>>>;
+    path: z.ZodString;
+    subtree: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+export type FunctionsRoute = z.infer<typeof functionsRouteSchema>;
+export declare const functionsEndpointSourceSchema: z.ZodObject<{
+    method: z.ZodEnum<{
+        POST: "POST";
+        PUT: "PUT";
+        GET: "GET";
+        HEAD: "HEAD";
+        PATCH: "PATCH";
+        DELETE: "DELETE";
+        OPTIONS: "OPTIONS";
+    }>;
+    path: z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>;
+    endpointId: z.ZodString;
+    source: z.ZodString;
+    capabilities: z.ZodDefault<z.ZodObject<{
+        db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+export type FunctionsEndpointSource = z.infer<typeof functionsEndpointSourceSchema>;
+/**
+ * One module in a bundle, in the shape the Worker Loader consumes.
+ *
+ * `commonjs` exists because bundlers still emit it and rejecting it would fail
+ * builds for a format the runtime accepts. Binary module types are deliberately
+ * absent: nothing we build today emits them, and adding one later is additive.
+ */
+export declare const functionsBundleModuleSchema: z.ZodUnion<readonly [z.ZodObject<{
+    js: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    cjs: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    text: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    json: z.ZodUnknown;
+}, z.core.$strict>]>;
+export type FunctionsBundleModule = z.infer<typeof functionsBundleModuleSchema>;
+/**
+ * The document served at a bundle URL and parsed by the host.
+ *
+ * Both sides of that exchange validate against this schema, which is the point
+ * of it living here: the CLI's bundler and the host's loader are separate
+ * deployments that must agree, and the only thing keeping them honest is a
+ * shared definition of the bytes in between.
+ */
+export declare const functionsBundleManifestSchema: z.ZodObject<{
+    format: z.ZodLiteral<"spacefast.functions.bundle.v1">;
+    mainModule: z.ZodString;
+    modules: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        js: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        cjs: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        text: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        json: z.ZodUnknown;
+    }, z.core.$strict>]>>;
+}, z.core.$strict>;
+export type FunctionsBundleManifest = z.infer<typeof functionsBundleManifestSchema>;
+/**
+ * Where the worker's compiled bytes live in the version's own content store.
+ * Unlike Zero's bundles these are not carried inline in the finalize payload:
+ * framework output routinely runs to megabytes, and inlining it would put the
+ * whole thing through the control plane, which the direct-from-wp.cloud rule
+ * forbids.
+ */
+export declare const functionsBundleRefSchema: z.ZodObject<{
+    path: z.ZodString;
+    sha256: z.ZodString;
+    size: z.ZodNumber;
+}, z.core.$strict>;
+export type FunctionsBundleRef = z.infer<typeof functionsBundleRefSchema>;
+/**
+ * The path a bundle is served from.
+ *
+ * Content-addressed, so the response is immutable and can be cached at our edge
+ * forever — a cold isolate anywhere in the world costs one CDN hit rather than
+ * a round trip to the space's origin.
+ *
+ * The token rides in the path rather than the query string for exactly that
+ * reason: a query parameter is subject to cache-key normalisation, and a token
+ * that gets stripped from the key would let one space's cached bundle answer
+ * another space's URL.
+ *
+ * Both halves are load-bearing. The digest alone is unguessable to anyone who
+ * lacks the bytes, but it is derivable by anyone who *has* them, and it shows up
+ * in build output and `sf functions inspect`. The token adds the dimension the
+ * digest cannot: holding the code does not entitle you to fetch it from us, and
+ * rotating the site secret invalidates every URL at once.
+ */
+export declare function functionsBundlePath(input: {
+    sha256: string;
+    token: string;
+}): string;
+/**
+ * Where the bundle actually sits in the published version — the same path minus
+ * the token segment. The token authorises the read; it does not name the file,
+ * so rotating the signing key changes every URL without moving a single byte.
+ */
+export declare function functionsBundleStoragePath(input: {
+    sha256: string;
+}): string;
+export declare const functionsWorkerArtifactSchema: z.ZodObject<{
+    format: z.ZodLiteral<"spacefast.functions.worker.v1">;
+    appName: z.ZodString;
+    entry: z.ZodString;
+    mainModule: z.ZodString;
+    bundle: z.ZodObject<{
+        path: z.ZodString;
+        sha256: z.ZodString;
+        size: z.ZodNumber;
+    }, z.core.$strict>;
+    compatibilityDate: z.ZodString;
+    compatibilityFlags: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    routes: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        method: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+            POST: "POST";
+            PUT: "PUT";
+            GET: "GET";
+            HEAD: "HEAD";
+            PATCH: "PATCH";
+            DELETE: "DELETE";
+            OPTIONS: "OPTIONS";
+        }>>>;
+        path: z.ZodString;
+        subtree: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>>;
+    capabilities: z.ZodDefault<z.ZodObject<{
+        db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    }, z.core.$strip>>;
+    endpoints: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        method: z.ZodEnum<{
+            POST: "POST";
+            PUT: "PUT";
+            GET: "GET";
+            HEAD: "HEAD";
+            PATCH: "PATCH";
+            DELETE: "DELETE";
+            OPTIONS: "OPTIONS";
+        }>;
+        path: z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>;
+        endpointId: z.ZodString;
+        source: z.ZodString;
+        capabilities: z.ZodDefault<z.ZodObject<{
+            db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        }, z.core.$strip>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type FunctionsWorkerArtifact = z.infer<typeof functionsWorkerArtifactSchema>;
+/**
+ * The authority a dispatched worker may exercise, in the vocabulary the host
+ * speaks on the wire.
+ *
+ * Deliberately a different, narrower list than `executionCapabilitiesSchema`.
+ * That one records what a build *declared* it uses; this one is what the origin
+ * *grants*, resolved by the control plane at finalize so the origin forwards a
+ * decision rather than making one. Anything absent fails closed at the relay.
+ */
+export declare const FUNCTIONS_DISPATCH_CAPABILITIES: readonly ["db.read", "db.write", "fetch", "log"];
+export declare const functionsDispatchCapabilitySchema: z.ZodEnum<{
+    fetch: "fetch";
+    "db.read": "db.read";
+    "db.write": "db.write";
+    log: "log";
+}>;
+export type FunctionsDispatchCapability = z.infer<typeof functionsDispatchCapabilitySchema>;
+/**
+ * Resolves a build's declared capabilities into the grant a dispatch carries.
+ *
+ * Three of the six declared capabilities have no dispatch counterpart, and each
+ * for its own reason:
+ *
+ * - `env` is not a runtime call at all. Values are resolved at finalize and
+ *   travel in the config, so a worker reading `env` reaches nothing.
+ * - `auth` and `realtime` bind a handler to the local tier — see
+ *   `endpointIsPortable` — so code declaring them deploys as a capsule and
+ *   never arrives here.
+ *
+ * `db` widens to both read and write because a declaration says a handler
+ * touches the database, not how. Narrowing it would take per-statement analysis
+ * we do not do, and guessing "read-only" from a declaration would be a grant
+ * the author never asked for and cannot see.
+ */
+export declare function functionsDispatchCapabilities(capabilities: ExecutionCapabilities): FunctionsDispatchCapability[];
+/** Everything except `log` needs the relay to mean anything. */
+export declare function functionsGrantNeedsRelay(granted: readonly FunctionsDispatchCapability[]): boolean;
+/**
+ * What the space origin needs in order to dispatch to the host on its own. The
+ * shared secret is a wp.cloud site secret; it is never part of a version's
+ * content and never reaches tenant code, so it is not modelled here.
+ *
+ * There is no account id and no namespace: the origin talks to one host worker
+ * over HTTPS and holds no Cloudflare API credential at all.
+ */
+export declare const functionsHostConfigSchema: z.ZodObject<{
+    hostname: z.ZodString;
+    bundleUrl: z.ZodString;
+}, z.core.$strict>;
+export type FunctionsHostConfig = z.infer<typeof functionsHostConfigSchema>;
+/**
+ * The callback a dispatched worker uses for `ctx.db`, `ctx.fetch` and logging.
+ *
+ * Each relay call re-enters the space's PHP-FPM pool, which is the deadlock
+ * hazard this product's admission control exists to bound: a proxied request
+ * occupies a worker for its whole life while its relay calls demand more. The
+ * batching allowance below is the other half of the answer — a handler that
+ * issues twenty statements must cost one relay round trip, not twenty. Measured
+ * against the PHP broker, batching twenty writes into one call is 8.3x faster
+ * than twenty separate ones.
+ */
+export declare const functionsRelayConfigSchema: z.ZodObject<{
+    url: z.ZodString;
+    token: z.ZodString;
+    maxBatchStatements: z.ZodNumber;
+    maxConcurrentCalls: z.ZodNumber;
+}, z.core.$strict>;
+export type FunctionsRelayConfig = z.infer<typeof functionsRelayConfigSchema>;
+/**
+ * What a build declares about its worker — everything the CLI can know from the
+ * author's project alone.
+ *
+ * Unlike Zero, this is *not* the same document the runtime receives. A build
+ * cannot name the host it will be dispatched to, cannot mint the credential its
+ * relay calls will carry, and cannot decide what authority it is granted; all
+ * three are the platform's to say. Keeping them out of this schema is what makes
+ * that structural rather than a convention — a version's own metadata has no
+ * field in which to assert authority it was not given.
+ */
+export declare const functionsSourceFinalizeSchema: z.ZodObject<{
+    runtimeKind: z.ZodLiteral<"functions">;
+    artifact: z.ZodObject<{
+        format: z.ZodLiteral<"spacefast.functions.worker.v1">;
+        appName: z.ZodString;
+        entry: z.ZodString;
+        mainModule: z.ZodString;
+        bundle: z.ZodObject<{
+            path: z.ZodString;
+            sha256: z.ZodString;
+            size: z.ZodNumber;
+        }, z.core.$strict>;
+        compatibilityDate: z.ZodString;
+        compatibilityFlags: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        routes: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            method: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+                POST: "POST";
+                PUT: "PUT";
+                GET: "GET";
+                HEAD: "HEAD";
+                PATCH: "PATCH";
+                DELETE: "DELETE";
+                OPTIONS: "OPTIONS";
+            }>>>;
+            path: z.ZodString;
+            subtree: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>>>;
+        capabilities: z.ZodDefault<z.ZodObject<{
+            db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        }, z.core.$strip>>;
+        endpoints: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            method: z.ZodEnum<{
+                POST: "POST";
+                PUT: "PUT";
+                GET: "GET";
+                HEAD: "HEAD";
+                PATCH: "PATCH";
+                DELETE: "DELETE";
+                OPTIONS: "OPTIONS";
+            }>;
+            path: z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>;
+            endpointId: z.ZodString;
+            source: z.ZodString;
+            capabilities: z.ZodDefault<z.ZodObject<{
+                db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            }, z.core.$strip>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
+    variables: z.ZodDefault<z.ZodObject<{
+        source: z.ZodLiteral<"spacefast-variables">;
+        names: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    inspect: z.ZodDefault<z.ZodObject<{
+        policy: z.ZodDefault<z.ZodEnum<{
+            public: "public";
+            private: "private";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type FunctionsSourceFinalize = z.infer<typeof functionsSourceFinalizeSchema>;
+/**
+ * The document the control plane sends to the runtime, which the engine stores
+ * beside the version's files and the origin reads on every dispatch.
+ *
+ * It is the build's declaration plus the four things only the platform can
+ * supply: where to dispatch, what the worker is allowed to do, the credential
+ * that lets it do those things, and the resolved values of its variables.
+ */
+export declare const functionsRuntimeConfigSchema: z.ZodObject<{
+    runtimeKind: z.ZodLiteral<"functions">;
+    artifact: z.ZodObject<{
+        format: z.ZodLiteral<"spacefast.functions.worker.v1">;
+        appName: z.ZodString;
+        entry: z.ZodString;
+        mainModule: z.ZodString;
+        bundle: z.ZodObject<{
+            path: z.ZodString;
+            sha256: z.ZodString;
+            size: z.ZodNumber;
+        }, z.core.$strict>;
+        compatibilityDate: z.ZodString;
+        compatibilityFlags: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        routes: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            method: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+                POST: "POST";
+                PUT: "PUT";
+                GET: "GET";
+                HEAD: "HEAD";
+                PATCH: "PATCH";
+                DELETE: "DELETE";
+                OPTIONS: "OPTIONS";
+            }>>>;
+            path: z.ZodString;
+            subtree: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>>>;
+        capabilities: z.ZodDefault<z.ZodObject<{
+            db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        }, z.core.$strip>>;
+        endpoints: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            method: z.ZodEnum<{
+                POST: "POST";
+                PUT: "PUT";
+                GET: "GET";
+                HEAD: "HEAD";
+                PATCH: "PATCH";
+                DELETE: "DELETE";
+                OPTIONS: "OPTIONS";
+            }>;
+            path: z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>;
+            endpointId: z.ZodString;
+            source: z.ZodString;
+            capabilities: z.ZodDefault<z.ZodObject<{
+                db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            }, z.core.$strip>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
+    variables: z.ZodDefault<z.ZodObject<{
+        source: z.ZodLiteral<"spacefast-variables">;
+        names: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    inspect: z.ZodDefault<z.ZodObject<{
+        policy: z.ZodDefault<z.ZodEnum<{
+            public: "public";
+            private: "private";
+        }>>;
+    }, z.core.$strict>>;
+    host: z.ZodObject<{
+        hostname: z.ZodString;
+        bundleUrl: z.ZodString;
+    }, z.core.$strict>;
+    grantedCapabilities: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        fetch: "fetch";
+        "db.read": "db.read";
+        "db.write": "db.write";
+        log: "log";
+    }>>>;
+    relay: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+        url: z.ZodString;
+        token: z.ZodString;
+        maxBatchStatements: z.ZodNumber;
+        maxConcurrentCalls: z.ZodNumber;
+    }, z.core.$strict>>>;
+    variableValues: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strict>;
+export type FunctionsRuntimeConfig = z.infer<typeof functionsRuntimeConfigSchema>;
+export declare const functionsDeployMetadataSchema: z.ZodObject<{
+    artifactId: z.ZodOptional<z.ZodString>;
+    finalize: z.ZodObject<{
+        runtimeKind: z.ZodLiteral<"functions">;
+        artifact: z.ZodObject<{
+            format: z.ZodLiteral<"spacefast.functions.worker.v1">;
+            appName: z.ZodString;
+            entry: z.ZodString;
+            mainModule: z.ZodString;
+            bundle: z.ZodObject<{
+                path: z.ZodString;
+                sha256: z.ZodString;
+                size: z.ZodNumber;
+            }, z.core.$strict>;
+            compatibilityDate: z.ZodString;
+            compatibilityFlags: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            routes: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                method: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+                    POST: "POST";
+                    PUT: "PUT";
+                    GET: "GET";
+                    HEAD: "HEAD";
+                    PATCH: "PATCH";
+                    DELETE: "DELETE";
+                    OPTIONS: "OPTIONS";
+                }>>>;
+                path: z.ZodString;
+                subtree: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>>>;
+            capabilities: z.ZodDefault<z.ZodObject<{
+                db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            }, z.core.$strip>>;
+            endpoints: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                method: z.ZodEnum<{
+                    POST: "POST";
+                    PUT: "PUT";
+                    GET: "GET";
+                    HEAD: "HEAD";
+                    PATCH: "PATCH";
+                    DELETE: "DELETE";
+                    OPTIONS: "OPTIONS";
+                }>;
+                path: z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>;
+                endpointId: z.ZodString;
+                source: z.ZodString;
+                capabilities: z.ZodDefault<z.ZodObject<{
+                    db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                    fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                    auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                    env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                    realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                    logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                }, z.core.$strip>>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>;
+        variables: z.ZodDefault<z.ZodObject<{
+            source: z.ZodLiteral<"spacefast-variables">;
+            names: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        inspect: z.ZodDefault<z.ZodObject<{
+            policy: z.ZodDefault<z.ZodEnum<{
+                public: "public";
+                private: "private";
+            }>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type FunctionsDeployMetadata = z.infer<typeof functionsDeployMetadataSchema>;
+/**
+ * Builds the declaration a publish attaches to its version.
+ *
+ * Exists so the CLI's publish step and every test that needs a Functions
+ * version agree on the shape by construction rather than by copying an object
+ * literal around — the same reason `createZeroRuntimeFinalizePayload` exists.
+ */
+export declare function createFunctionsSourceFinalize(input: {
+    appName: string;
+    entry: string;
+    mainModule: string;
+    bundle: z.input<typeof functionsBundleRefSchema>;
+    compatibilityDate: string;
+    compatibilityFlags?: string[];
+    routes?: z.input<typeof functionsRouteSchema>[];
+    capabilities?: ExecutionCapabilities;
+    variableNames?: string[];
+    inspectPolicy?: z.input<typeof executionInspectPolicySchema>;
+}): FunctionsSourceFinalize;
+/**
+ * What a version's worker is currently doing, as an observer of the space can
+ * actually determine.
+ *
+ * There is no upload state to report. A bundle is either in the version's
+ * content store or it is not, and dispatch is decided by which version is
+ * serving — so these three cover the whole space of answers, and each one is
+ * checkable rather than inferred from a job we ran earlier.
+ */
+export declare const functionsExecutionStateSchema: z.ZodEnum<{
+    ready: "ready";
+    absent: "absent";
+    serving: "serving";
+}>;
+export type FunctionsExecutionState = z.infer<typeof functionsExecutionStateSchema>;
+/**
+ * What a live worker is, as the `app` member of a space's runtime status.
+ *
+ * Shaped like `zeroAppSchema` and discriminated by the same `runtimeKind`, so a
+ * reader switches on one field rather than probing for which product answered.
+ * No `versionId`: the status response it rides in already names the live
+ * version.
+ */
+export declare const functionsAppSchema: z.ZodObject<{
+    runtimeKind: z.ZodLiteral<"functions">;
+    artifactId: z.ZodString;
+    appName: z.ZodString;
+    entry: z.ZodString;
+    compatibilityDate: z.ZodString;
+    compatibilityFlags: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    routes: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        method: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+            POST: "POST";
+            PUT: "PUT";
+            GET: "GET";
+            HEAD: "HEAD";
+            PATCH: "PATCH";
+            DELETE: "DELETE";
+            OPTIONS: "OPTIONS";
+        }>>>;
+        path: z.ZodString;
+        subtree: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>>;
+    capabilities: z.ZodDefault<z.ZodObject<{
+        db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    }, z.core.$strip>>;
+    executionState: z.ZodEnum<{
+        ready: "ready";
+        absent: "absent";
+        serving: "serving";
+    }>;
+    bundleSize: z.ZodNumber;
+    variables: z.ZodObject<{
+        source: z.ZodLiteral<"spacefast-variables">;
+        names: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    inspect: z.ZodObject<{
+        policy: z.ZodEnum<{
+            public: "public";
+            private: "private";
+        }>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type FunctionsApp = z.infer<typeof functionsAppSchema>;
+/**
+ * The wire shape of the origin's log-read route, not a public API contract.
+ *
+ * Handler logs reach callers through `GET /v1/spaces/:spaceId/logs/runtime`,
+ * which serves the platform's own `runtimeLogListResponseSchema` for both
+ * execution tiers. These aliases describe the hop underneath it: a worker tails
+ * its output to the origin that dispatched it, and the control plane reads it
+ * back from there. Keeping them named after this product is the point — the
+ * origin is the only place a wp.cloud-hosted space keeps anything, and Zero's
+ * records never travel this path at all.
+ */
+export declare const functionsLogEntrySchema: z.ZodObject<{
+    id: z.ZodString;
+    timestamp: z.ZodString;
+    level: z.ZodEnum<{
+        info: "info";
+        error: "error";
+        debug: "debug";
+        warn: "warn";
+    }>;
+    requestId: z.ZodNullable<z.ZodString>;
+    versionId: z.ZodNullable<z.ZodString>;
+    handlerName: z.ZodNullable<z.ZodString>;
+    message: z.ZodString;
+    metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type FunctionsLogEntry = z.infer<typeof functionsLogEntrySchema>;
+export declare const functionsLogListQuerySchema: z.ZodObject<{
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    cursor: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    handlerName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type FunctionsLogListQuery = z.infer<typeof functionsLogListQuerySchema>;
+export declare const functionsLogListResponseSchema: z.ZodObject<{
+    data: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        timestamp: z.ZodString;
+        level: z.ZodEnum<{
+            info: "info";
+            error: "error";
+            debug: "debug";
+            warn: "warn";
+        }>;
+        requestId: z.ZodNullable<z.ZodString>;
+        versionId: z.ZodNullable<z.ZodString>;
+        handlerName: z.ZodNullable<z.ZodString>;
+        message: z.ZodString;
+        metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+    pagination: z.ZodObject<{
+        nextCursor: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type FunctionsLogListResponse = z.infer<typeof functionsLogListResponseSchema>;
+/** Narrows a space's live runtime kind to this product. */
+export declare function isFunctionsRuntime(kind: z.infer<typeof runtimeKindSchema> | null): boolean;