@spacefast/common 0.0.12 → 0.0.17

package/dist/docs/skills.js

@@ -0,0 +1,340 @@
+import { DOCS_BASE_URL } from "../config/domains.js";
+const BOTH_RUNTIMES = ["local", "hosted"];
+/** Canonical agent workflows shared by MCP tools, prompts, resources, and recipe docs. */
+export const SPACEFAST_SKILLS = [
+    {
+        name: "create-and-publish-site",
+        title: "Create and publish a polished website",
+        description: "Turn a brief into a responsive static website, review the result, publish it to Spacefast, and verify the live version.",
+        whenToUse: "Use when the user wants an agent to design, build, improve, or launch a new website rather than only upload an existing build.",
+        keywords: ["create", "website", "design", "build", "responsive", "launch", "publish"],
+        runtimes: BOTH_RUNTIMES,
+        tools: ["publish", "execute"],
+        docs: ["quickstart", "publishing"],
+        instructions: [
+            "Clarify the audience, goal, required content, brand constraints, and desired call to action. If the visual direction is open, propose two or three distinct directions and choose one with the user.",
+            "Inspect the existing workspace before editing. Reuse its framework, package manager, components, assets, and build conventions when they are sound.",
+            "Build a focused, accessible static experience with a clear hierarchy, real content, responsive layouts, useful interaction states, and no placeholder copy. Keep the main path simple and put secondary detail behind progressive disclosure.",
+            "Run the real build and inspect the result at mobile and desktop widths. Fix overflow, illegible contrast, broken links, missing assets, keyboard traps, and avoidable layout shift.",
+            "Review the workspace diff and summarize material design or content judgments before publishing. Never include API keys, claim credentials, upload credentials, or local auth state in the artifact.",
+            "Publish the built output with `publish`. Present Open as the reusable access link and Claim as the one-time ownership link. Treat live and immutable-version URLs as receipt metadata, not extra actions.",
+        ],
+        verification: [
+            "Call `status` after publishing and confirm the intended version is live; use `diagnose` if serving is stalled or failed.",
+            "Open the live URL and verify the primary page, navigation, assets, responsive layout, and main call to action before claiming success.",
+        ],
+        runtimeNotes: {
+            local: "On-Device can work directly inside the configured local workspace root and publish a local build path.",
+            hosted: "Hosted has no filesystem. Generate small files in the client and publish them inline, or use catalog manifest and import operations for larger artifacts.",
+        },
+        prompt: true,
+        recipe: {
+            slug: "recipes/create-and-publish-site",
+            tier: "full",
+            url: `${DOCS_BASE_URL}/getting-started/agents`,
+        },
+    },
+    {
+        name: "publish-and-verify",
+        title: "Publish and verify",
+        description: "Publish an existing static build, confirm the new version is actually live, and return the useful URLs without leaking credentials.",
+        whenToUse: "Use when the artifact already exists and the user wants it published or updated.",
+        keywords: ["publish", "deploy", "live", "verify", "version", "claim"],
+        runtimes: BOTH_RUNTIMES,
+        tools: ["publish", "status", "diagnose"],
+        docs: ["publishing", "workflow/publish-receipt", "workflow/secret-handling"],
+        instructions: [
+            "Identify the actual publish root or build output. Run the real build first when the source tree is not itself the static artifact.",
+            "Publish with `publish`. For an anonymous On-Device publish, keep the claim credential in local custody and return only the claim URL and expiry; never expose or ask the user to paste the raw token.",
+            "Report the bare Live URL, private Access URL when present, immutable Version URL when present, anonymous Claim URL and expiry when present, plus actionable diagnostics.",
+        ],
+        verification: [
+            "Call `status` and confirm the intended version is live. Use `diagnose` for a failed or stalled publish.",
+            "Open the live URL and verify representative content and assets rather than treating a successful upload or health check as serving proof.",
+        ],
+        runtimeNotes: {
+            local: "Publish a bounded local path; locally custodied claim credentials are reused automatically.",
+            hosted: "Publish inline files, or use catalog manifest and import operations for larger artifacts. Hosted has no filesystem.",
+        },
+        prompt: true,
+        recipe: {
+            slug: "recipes/agent-publish",
+            tier: "full",
+            url: `${DOCS_BASE_URL}/publishing/anonymous`,
+        },
+    },
+    {
+        name: "ci-github-actions",
+        title: "Publish from GitHub Actions",
+        description: "Create a repository-aware GitHub Actions workflow that builds and publishes with a masked Spacefast token.",
+        whenToUse: "Use when pushes or manual workflow runs should publish automatically from GitHub.",
+        keywords: ["github", "actions", "ci", "push", "automatic", "workflow"],
+        runtimes: BOTH_RUNTIMES,
+        tools: ["execute"],
+        docs: ["builds", "publishing", "workflow/secret-handling"],
+        instructions: [
+            "Inspect the repository's package manager, lockfile, build command, runtime version, output directory, and existing workflows before writing YAML.",
+            "Create a least-privilege workflow triggered by the intended branch and `workflow_dispatch`: check out the repository, install with the locked dependency command, build, and run `npx -y spacefast@<pinned-version> publish <output> --json`.",
+            "Store the credential as a masked `SPACEFAST_TOKEN` repository or environment secret. Never echo it or upload generated auth files, claim credentials, or upload credentials as artifacts.",
+            "Use the repository's real package manager and output directory; do not copy a generic npm/dist example over a Bun, pnpm, yarn, or custom build.",
+        ],
+        verification: [
+            "Validate the workflow syntax and run it on an explicit test branch or manual dispatch.",
+            "Inspect the publish receipt and live URL; a green build step alone is not serving proof.",
+        ],
+        prompt: true,
+        recipe: {
+            slug: "recipes/github-deploys",
+            tier: "full",
+            url: `${DOCS_BASE_URL}/publishing/git`,
+        },
+    },
+    {
+        name: "preview-channels",
+        title: "Preview changes safely",
+        description: "Publish branch or pull-request work to an isolated private preview and share it explicitly without touching production.",
+        whenToUse: "Use when reviewers need a realistic preview before a change goes live.",
+        keywords: ["preview", "channel", "branch", "pull request", "review", "private"],
+        runtimes: BOTH_RUNTIMES,
+        tools: ["publish", "status", "execute"],
+        docs: ["builds", "access-control"],
+        instructions: [
+            "Publish the branch through a connected repository or to an explicit non-production channel so the live production channel is unchanged.",
+            "Keep the preview private by default. Use an Open URL for the owner's browser or create the narrowest scoped Link needed for reviewers.",
+            "Label the preview with the branch, change, or pull request it represents and report what is intentionally out of scope.",
+        ],
+        verification: [
+            "Confirm the preview serves the expected version and production still points at its previous version.",
+            "Test the reviewer link in a signed-out context and revoke it when review is complete.",
+        ],
+        recipe: {
+            slug: "recipes/preview-channels",
+            tier: "full",
+            url: `${DOCS_BASE_URL}/publishing/git`,
+        },
+    },
+    {
+        name: "claim-flow",
+        title: "Claim an anonymous space",
+        description: "Attach an anonymous space to an account or team before expiry while keeping every claim credential in server or local custody.",
+        whenToUse: "Use after an anonymous publish returns a claim URL and expiry.",
+        keywords: ["claim", "anonymous", "ownership", "team", "continuation", "credential"],
+        runtimes: BOTH_RUNTIMES,
+        tools: ["execute", "publish"],
+        docs: ["anonymous-publish", "workflow/continue-after-claim", "workflow/secret-handling"],
+        instructions: [
+            "Return the claim URL and expiry to the user, never the raw claim credential. On-Device stores that credential in `.spacefast/state.json` and reuses it without returning it to the model.",
+            "When authenticated On-Device credentials are available, use the catalog `claim` operation with only `teamId` and the expected `spaceId`; otherwise let the user open the claim URL in their browser.",
+            "Publish again from On-Device after the browser claim. `publish` automatically exchanges the locally held claim credential once, persists the durable space-scoped credential, and retries without exposing either secret.",
+        ],
+        verification: [
+            "Confirm the space no longer has a claim expiry and appears under the intended account or team.",
+            "Publish again from the same local root or inspect the space through `execute` to verify durable access works without asking for a raw token.",
+        ],
+        prompt: true,
+    },
+    {
+        name: "rollback-safely",
+        title: "Roll back safely",
+        description: "Promote a known-good immutable version without rebuilding, then prove the live URL serves it.",
+        whenToUse: "Use when the current live version is broken and a prior healthy version is known or discoverable.",
+        keywords: ["rollback", "revert", "version", "incident", "restore"],
+        runtimes: BOTH_RUNTIMES,
+        tools: ["status", "rollback", "execute", "diagnose"],
+        docs: ["versions-and-rollback"],
+        instructions: [
+            "Inspect recent immutable versions and current status. Compare the current live version with the candidate using the catalog `versions` and `diff` operations.",
+            "Call `rollback` with the selected `versionId`. Rollback is additive and keeps later immutable versions available.",
+            "If promotion returns an operation that is still settling, poll the catalog `operation_status` operation until it is done instead of assuming success.",
+        ],
+        verification: [
+            "Call `status` and confirm the live pointer references the selected version.",
+            "Open the live URL and verify the failing path or behavior is restored; use `diagnose` if it is not.",
+        ],
+        prompt: true,
+    },
+    {
+        name: "set-up-custom-domain",
+        title: "Set up a custom domain",
+        description: "Attach a domain, provide the exact DNS records, and wait for HTTPS serving proof before reporting it live.",
+        whenToUse: "Use when the user owns a domain they want a Spacefast space to serve.",
+        keywords: ["domain", "dns", "tls", "https", "cname", "custom"],
+        runtimes: BOTH_RUNTIMES,
+        tools: ["execute"],
+        docs: ["custom-domains", "recipes/migrate-dns"],
+        instructions: [
+            "Add the domain with `sf domains add <domain>` or catalog operation `domains_add`; preserve the exact record values Spacefast returns.",
+            "Give the user those DNS records to create at their provider. Do not claim this MCP changed third-party DNS unless it actually has an authorized provider integration.",
+            "Keep the existing production hostname available during the cutover and avoid deleting old records until the new path is proven.",
+        ],
+        verification: [
+            "Run `sf domains check` or catalog operation `domains_check` until DNS and certificate state are ready.",
+            "Open the final custom-domain HTTPS URL and verify representative content before reporting it live.",
+        ],
+        prompt: true,
+        recipe: {
+            slug: "recipes/custom-domain",
+            tier: "full",
+            url: "https://spacefast.com/help/domains",
+        },
+    },
+    {
+        name: "redirects",
+        title: "Ship redirects with a version",
+        description: "Add redirect rules to the publish artifact so routing changes are versioned and roll back with the content.",
+        whenToUse: "Use for moved pages, canonical host paths, and intentional permanent or temporary redirects.",
+        keywords: ["redirect", "rewrite", "routing", "301", "302", "path"],
+        runtimes: BOTH_RUNTIMES,
+        tools: ["publish", "execute"],
+        docs: ["redirects"],
+        instructions: [
+            "Inspect existing routing rules, then add the smallest non-conflicting rules to `_redirects` at the publish root.",
+            "Choose temporary or permanent status deliberately, preserve path/query semantics where required, and avoid redirect loops or rules that shadow real assets.",
+            "Publish the redirect file as part of the same immutable version as the related content change.",
+        ],
+        verification: [
+            "Request representative old and new paths and confirm the exact status and Location header.",
+            "Verify the final target serves successfully and unrelated assets are not redirected.",
+        ],
+        recipe: {
+            slug: "recipes/redirects",
+            tier: "reference",
+            url: "https://spacefast.com/help/redirects",
+        },
+    },
+    {
+        name: "migrate-dns",
+        title: "Migrate DNS without avoidable downtime",
+        description: "Pre-stage a custom domain, prove certificate readiness, and cut traffic over with a reversible DNS change.",
+        whenToUse: "Use when an existing production domain must move to Spacefast.",
+        keywords: ["dns", "migrate", "cutover", "domain", "downtime", "certificate"],
+        runtimes: BOTH_RUNTIMES,
+        tools: ["execute"],
+        docs: ["custom-domains"],
+        instructions: [
+            "Inventory the current authoritative DNS records and lower TTL ahead of the cutover when the provider and timing allow it.",
+            "Add the domain to Spacefast and pre-stage every record it returns while preserving a working rollback path.",
+            "Cut over only after the Spacefast endpoint, expected content, and TLS readiness can be validated. Keep the previous origin available until propagation is complete.",
+        ],
+        verification: [
+            "Check resolution from more than one resolver and confirm the certificate matches the final hostname.",
+            "Open the public HTTPS URL, verify representative content, and monitor for old-origin traffic before removing rollback records.",
+        ],
+        recipe: {
+            slug: "recipes/migrate-dns",
+            tier: "reference",
+            url: "https://spacefast.com/help/domains",
+        },
+    },
+    {
+        name: "debug-a-failed-build",
+        title: "Debug a failed build",
+        description: "Use ranked diagnostics and real logs to find why a publish failed or stalled, fix it, and re-verify.",
+        whenToUse: "Use when a build, finalize, activation, or live serving step fails or stalls.",
+        keywords: ["debug", "failed", "build", "logs", "diagnose", "stalled"],
+        runtimes: BOTH_RUNTIMES,
+        tools: ["execute"],
+        docs: ["troubleshooting"],
+        instructions: [
+            "Use `execute` to find and call the catalog diagnostics operation for the space and optional version. Read its ranked findings, locations, error codes, fix hints, and docs links instead of guessing from a generic status.",
+            "Use the catalog `build_logs` operation for publish/finalize detail, runtime-log operations for serving errors, and version operations to compare with the last ready version.",
+            "Apply the smallest fix tied to the evidence, rebuild, and publish again. Follow the problem document's `type` URL for any referenced error code.",
+        ],
+        verification: [
+            "Re-run the relevant diagnostics or status operation through `execute` and confirm the new version reaches the intended live state.",
+            "Open the affected live path and verify the concrete failure no longer reproduces.",
+        ],
+        prompt: true,
+    },
+    {
+        name: "manage-access",
+        title: "Manage access",
+        description: "Create narrowly scoped Grants, People, and Links, then verify a concrete request without leaking credentials.",
+        whenToUse: "Use when a space or path must be made public, team-only, or shared with specific people or machines.",
+        keywords: ["access", "private", "public", "people", "links", "grant", "share"],
+        runtimes: BOTH_RUNTIMES,
+        tools: ["execute", "whoami"],
+        docs: ["access-control"],
+        instructions: [
+            "Inspect current Grants with `sf share` or the catalog `grants_list` operation and identify one explicit access intent. Anonymous spaces start Private.",
+            "Apply the narrowest suitable Public or Team Grant, People invitation, scoped Link/password, or machine/external-identity Grant. Keep resource scopes explicit.",
+            "Show newly created Link or machine secrets only to the requesting user. Never put credentials, claim credentials, or API keys in logs or committed files.",
+        ],
+        verification: [
+            "Use `sf share check --as public --path /docs` or the catalog `grants_check` operation for a representative request.",
+            "Test a new Link in the intended signed-out or recipient context and confirm unrelated resources remain inaccessible.",
+        ],
+        prompt: true,
+    },
+];
+export const SPACEFAST_PROMPT_SKILLS = SPACEFAST_SKILLS.filter((skill) => "prompt" in skill && skill.prompt);
+export const SPACEFAST_RECIPE_SKILLS = SPACEFAST_SKILLS.filter((skill) => "recipe" in skill);
+export function findSpacefastSkill(name) {
+    const normalized = name.trim().toLowerCase();
+    return SPACEFAST_SKILLS.find((skill) => skill.name === normalized);
+}
+export function searchSpacefastSkills(query = "", limit = 5) {
+    const normalized = query.trim().toLowerCase();
+    const boundedLimit = Number.isFinite(limit) ? Math.max(1, Math.min(10, Math.trunc(limit))) : 5;
+    if (!normalized)
+        return SPACEFAST_SKILLS.slice(0, boundedLimit);
+    const tokens = normalized.split(/\s+/).filter(Boolean);
+    return SPACEFAST_SKILLS.map((skill) => {
+        const name = skill.name.toLowerCase();
+        const title = skill.title.toLowerCase();
+        const keywords = skill.keywords.map((candidate) => candidate.toLowerCase());
+        const body = [skill.description, skill.whenToUse, ...skill.docs].join(" ").toLowerCase();
+        let score = skill.name === normalized ? 100 : 0;
+        for (const token of tokens) {
+            let tokenScore = 0;
+            if (name === token)
+                tokenScore = 30;
+            else if (name.includes(token))
+                tokenScore = 20;
+            if (title.includes(token))
+                tokenScore = Math.max(tokenScore, 15);
+            if (keywords.some((candidate) => candidate.includes(token))) {
+                tokenScore = Math.max(tokenScore, 10);
+            }
+            if (body.includes(token))
+                tokenScore = Math.max(tokenScore, 5);
+            if (tokenScore === 0)
+                return { skill, score: 0 };
+            score += tokenScore;
+        }
+        return { skill, score };
+    })
+        .filter((match) => match.score > 0)
+        .toSorted((left, right) => right.score - left.score || left.skill.name.localeCompare(right.skill.name))
+        .slice(0, boundedLimit)
+        .map((match) => match.skill);
+}
+export function renderSpacefastSkill(skillOrName, runtime) {
+    const skill = typeof skillOrName === "string" ? findSpacefastSkill(skillOrName) : skillOrName;
+    if (!skill) {
+        const requestedName = typeof skillOrName === "string" ? skillOrName : skillOrName.name;
+        throw new Error(`Unknown Spacefast skill: ${requestedName}`);
+    }
+    const runtimeNote = skill.runtimeNotes?.[runtime];
+    return [
+        `# ${skill.title}`,
+        "",
+        skill.description,
+        "",
+        `**Use when:** ${skill.whenToUse}`,
+        ...(runtimeNote
+            ? ["", `**${runtime === "local" ? "On-Device" : "Hosted"}:** ${runtimeNote}`]
+            : []),
+        "",
+        "## Workflow",
+        "",
+        ...skill.instructions.map((step, index) => `${index + 1}. ${step}`),
+        "",
+        "## Verify",
+        "",
+        ...skill.verification.map((step) => `- ${step}`),
+        "",
+        `**Tools:** ${skill.tools.map((tool) => `\`${tool}\``).join(", ") || "none"}`,
+        `**Docs:** ${skill.docs.map((doc) => `\`${doc}\``).join(", ") || "none"}`,
+    ].join("\n");
+}

package/dist/utils/auth-redirect.d.ts

@@ -1,3 +1 @@
-export declare function sanitizeDashboardReturnTo(returnTo: string | null | undefined, options?: {
-    apiOrigin?: string | null;
-}): string | undefined;
+export declare function sanitizeDashboardReturnTo(returnTo: string | null | undefined): string | undefined;

package/dist/utils/auth-redirect.js

@@ -17,29 +17,9 @@ function hasUnsafeReturnToChars(value) {
     }
     return false;
 }
-// The ONE absolute-URL exception to the same-origin returnTo policy
-// (access-plan X-41): the api-origin GET /v1/access/authorize URL exactly —
-// the sign-in leg of the visitor redirect chain. Everything else absolute is
-// an open-redirect surface and stays rejected.
-const API_AUTHORIZE_PATH = "/v1/access/authorize";
-export function sanitizeDashboardReturnTo(returnTo, options) {
+export function sanitizeDashboardReturnTo(returnTo) {
     const normalized = returnTo?.trim();
     const decoded = normalized ? decodedReturnTo(normalized) : null;
-    if (normalized && decoded && options?.apiOrigin) {
-        try {
-            const candidate = new URL(normalized);
-            const apiOrigin = new URL(options.apiOrigin).origin;
-            if (candidate.origin === apiOrigin &&
-                candidate.pathname === API_AUTHORIZE_PATH &&
-                !hasUnsafeReturnToChars(normalized) &&
-                !hasUnsafeReturnToChars(decoded)) {
-                return candidate.toString();
-            }
-        }
-        catch {
-            // Not an absolute URL — fall through to the same-origin path rules.
-        }
-    }
     if (!normalized ||
         !decoded ||
         !normalized.startsWith("/") ||

package/dist/utils/browser-credential.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Builds a browser handoff URL around a short-lived, one-use exchange token.
+ *
+ * The durable credential never appears in this URL. The access origin consumes
+ * the final path segment once and immediately redirects browsers to a clean
+ * path-scoped session. `publicId` is used only by agent handoffs, whose clean
+ * static document remains `/agent/<id>`.
+ */
+export declare function createBrowserCredentialUrl(input: {
+    origin: string;
+    path: string;
+    publicId?: string;
+    credential: string;
+}): string;
+/** Parses a one-use browser handoff URL and reconstructs its clean public path. */
+export declare function parseBrowserCredentialUrl(value: string): {
+    credential: string;
+    requestUrl: string;
+};

package/dist/utils/browser-credential.js

@@ -0,0 +1,62 @@
+const browserHandoffSegmentPattern = /^[A-Za-z0-9_-]{16,512}$/;
+const browserHandoffPublicIdPattern = /^[A-Za-z0-9_-]{1,512}$/;
+function requireBrowserHandoffSegment(value) {
+    if (!browserHandoffSegmentPattern.test(value)) {
+        throw new TypeError("Browser handoff token must be an opaque URL-safe value.");
+    }
+    return value;
+}
+/**
+ * Builds a browser handoff URL around a short-lived, one-use exchange token.
+ *
+ * The durable credential never appears in this URL. The access origin consumes
+ * the final path segment once and immediately redirects browsers to a clean
+ * path-scoped session. `publicId` is used only by agent handoffs, whose clean
+ * static document remains `/agent/<id>`.
+ */
+export function createBrowserCredentialUrl(input) {
+    const origin = new URL(input.origin);
+    if ((origin.protocol !== "https:" && origin.protocol !== "http:") ||
+        origin.username ||
+        origin.password ||
+        origin.pathname !== "/" ||
+        origin.search ||
+        origin.hash) {
+        throw new TypeError("Browser handoff URLs require a clean HTTP(S) origin.");
+    }
+    const basePath = `/${input.path.split("/").filter(Boolean).join("/")}`;
+    if (basePath === "/" || input.path.includes("?") || input.path.includes("#")) {
+        throw new TypeError("Browser handoff URLs require a clean absolute path.");
+    }
+    const segments = [
+        ...(input.publicId === undefined
+            ? []
+            : [
+                browserHandoffPublicIdPattern.test(input.publicId)
+                    ? input.publicId
+                    : (() => {
+                        throw new TypeError("Browser handoff public id must be URL-safe.");
+                    })(),
+            ]),
+        requireBrowserHandoffSegment(input.credential),
+    ];
+    return new URL(`${basePath}/${segments.map(encodeURIComponent).join("/")}`, origin).toString();
+}
+/** Parses a one-use browser handoff URL and reconstructs its clean public path. */
+export function parseBrowserCredentialUrl(value) {
+    const url = new URL(value);
+    if ((url.protocol !== "https:" && url.protocol !== "http:") ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash) {
+        throw new TypeError("Browser handoff URL is not a clean HTTP(S) URL.");
+    }
+    const segments = url.pathname.split("/").filter(Boolean);
+    const credential = segments.pop();
+    if (!credential || !browserHandoffSegmentPattern.test(credential) || segments.length === 0) {
+        throw new TypeError("Browser handoff URL does not carry a valid one-use token.");
+    }
+    url.pathname = `/${segments.map(encodeURIComponent).join("/")}`;
+    return { credential, requestUrl: url.toString() };
+}

package/dist/utils/build-settings.d.ts

@@ -1,6 +1,8 @@
 export type BuildSettingsInput = {
     fileNames: Iterable<string>;
     packageJson?: string | null | undefined;
+    jekyllYaml?: string | null | undefined;
+    jekyllToml?: string | null | undefined;
     vercelJson?: string | null | undefined;
     netlifyToml?: string | null | undefined;
     wranglerToml?: string | null | undefined;

package/dist/utils/build-settings.js

@@ -1,3 +1,4 @@
+import { load as parseYaml } from "js-yaml";
 import { parse as parseToml } from "smol-toml";
 export const BUILD_ANALYZER_CANDIDATE_ROOTS = ["apps", "packages", "sites", "docs"];
 const PACKAGE_MANAGER_ONLY_FILES = new Set([
@@ -7,6 +8,8 @@ const PACKAGE_MANAGER_ONLY_FILES = new Set([
     "pnpm-lock.yaml",
     "yarn.lock",
     "package-lock.json",
+    "Gemfile",
+    "Gemfile.lock",
 ]);
 export function hasWorkspaceSignal(fileNames, packageJsonText) {
     const names = new Set(fileNames);
@@ -102,6 +105,20 @@ function parseTomlObject(value) {
         return null;
     }
 }
+function parseYamlObject(value) {
+    if (!value) {
+        return null;
+    }
+    try {
+        const parsed = parseYaml(value);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
 export function stringField(value, key) {
     const field = value?.[key];
     return typeof field === "string" && field.trim() ? field.trim() : null;
@@ -628,9 +645,8 @@ const FRAMEWORKS = [
     },
     {
         preset: "jekyll",
-        configFiles: ["_config.yml", "_config.yaml"],
+        configFiles: ["_config.yml", "_config.yaml", "_config.toml"],
         outputDirectory: "_site",
-        defaultBuildCommand: "bundle exec jekyll build",
     },
     {
         preset: "mkdocs",
@@ -675,6 +691,26 @@ function outputDirectoryForFramework(frameworkPreset, files) {
         return framework.outputDirectory;
     return files.has("dist") ? "dist" : null;
 }
+const JEKYLL_BUNDLE_PATH = ".spacefast/cache/jekyll-bundle";
+const JEKYLL_GEM_HOME = ".spacefast/cache/jekyll-gems";
+function jekyllInstallCommand(files) {
+    return files.has("Gemfile")
+        ? `BUNDLE_PATH=${JEKYLL_BUNDLE_PATH} bundle install`
+        : `GEM_HOME=${JEKYLL_GEM_HOME} gem install jekyll --no-document`;
+}
+function jekyllConfigFile(files) {
+    return ["_config.yml", "_config.yaml", "_config.toml"].find((file) => files.has(file));
+}
+function jekyllBuildCommand(files) {
+    const command = files.has("Gemfile")
+        ? `JEKYLL_ENV=production BUNDLE_PATH=${JEKYLL_BUNDLE_PATH} bundle exec jekyll build`
+        : `JEKYLL_ENV=production GEM_HOME=${JEKYLL_GEM_HOME} ${JEKYLL_GEM_HOME}/bin/jekyll build`;
+    const configFile = jekyllConfigFile(files);
+    return configFile ? `${command} --config ${configFile}` : command;
+}
+function frameworkInstallCommand(frameworkPreset, files) {
+    return frameworkPreset === "jekyll" ? jekyllInstallCommand(files) : null;
+}
 function installCommandForManager(packageManager, packageJson) {
     switch (packageManager) {
         case "bun":
@@ -687,13 +723,15 @@ function installCommandForManager(packageManager, packageJson) {
             return packageJson ? "npm ci" : null;
     }
 }
-function buildCommandForDefaults(packageJson, run, frameworkPreset) {
+function buildCommandForDefaults(packageJson, run, frameworkPreset, files) {
     if (packageJson?.scripts?.build)
         return `${run} build`;
+    if (frameworkPreset === "jekyll")
+        return jekyllBuildCommand(files);
     return frameworkForPreset(frameworkPreset)?.defaultBuildCommand ?? null;
 }
-function packageDefaults(files, packageJsonText) {
-    const packageJson = parsePackageJson(packageJsonText);
+function packageDefaults(input, files) {
+    const packageJson = parsePackageJson(input.packageJson);
     const dependencies = {
         ...packageJson?.dependencies,
         ...packageJson?.devDependencies,
@@ -701,17 +739,26 @@ function packageDefaults(files, packageJsonText) {
     const packageManager = packageManagerForFiles(files);
     const run = packageManager === "npm" ? "npm run" : packageManager === "bun" ? "bun run" : packageManager;
     const frameworkPreset = detectFrameworkPreset(files, dependencies);
+    const installCommands = [
+        installCommandForManager(packageManager, packageJson),
+        frameworkInstallCommand(frameworkPreset, files),
+    ].filter((command) => Boolean(command));
+    const jekyllConfig = input.jekyllYaml
+        ? parseYamlObject(input.jekyllYaml)
+        : parseTomlObject(input.jekyllToml);
     return {
         frameworkPreset,
-        installCommand: installCommandForManager(packageManager, packageJson),
-        buildCommand: buildCommandForDefaults(packageJson, run, frameworkPreset),
-        outputDirectory: outputDirectoryForFramework(frameworkPreset, files),
+        installCommand: installCommands.length > 0 ? installCommands.join(" && ") : null,
+        buildCommand: buildCommandForDefaults(packageJson, run, frameworkPreset, files),
+        outputDirectory: frameworkPreset === "jekyll"
+            ? (stringField(jekyllConfig, "destination") ?? "_site")
+            : outputDirectoryForFramework(frameworkPreset, files),
     };
 }
 export function detectBuildSettings(input) {
     const files = new Set(input.fileNames);
     const defaults = {
-        ...packageDefaults(files, input.packageJson),
+        ...packageDefaults(input, files),
         rootDirectory: input.rootDirectory ?? null,
         platformPreset: null,
         detectedFiles: [
@@ -721,6 +768,11 @@ export function detectBuildSettings(input) {
             files.has("pnpm-lock.yaml") ? "pnpm-lock.yaml" : null,
             files.has("yarn.lock") ? "yarn.lock" : null,
             files.has("package-lock.json") ? "package-lock.json" : null,
+            files.has("Gemfile") ? "Gemfile" : null,
+            files.has("Gemfile.lock") ? "Gemfile.lock" : null,
+            files.has("_config.yml") ? "_config.yml" : null,
+            files.has("_config.yaml") ? "_config.yaml" : null,
+            files.has("_config.toml") ? "_config.toml" : null,
         ].filter((file) => Boolean(file)),
     };
     const vercelFramework = input.vercelJson

package/dist/utils/comment-avatars.d.ts

@@ -0,0 +1,7 @@
+export declare const COMMENT_AVATAR_IMAGE_ORIGINS: readonly ["https://gravatar.com", "https://i0.wp.com"];
+/**
+ * Keep Comments avatar requests on origins that can be named explicitly in
+ * the host page's CSP. Gravatar is already canonical; every other HTTP(S)
+ * profile image goes through the HTTPS WordPress.com image CDN.
+ */
+export declare function normalizeCommentAvatarUrl(value: string): string | null;

package/dist/utils/comment-avatars.js

@@ -0,0 +1,42 @@
+export const COMMENT_AVATAR_IMAGE_ORIGINS = ["https://gravatar.com", "https://i0.wp.com"];
+const CANONICAL_GRAVATAR_ORIGIN = COMMENT_AVATAR_IMAGE_ORIGINS[0];
+const AVATAR_PROXY_ORIGIN = COMMENT_AVATAR_IMAGE_ORIGINS[1];
+const MAX_AVATAR_URL_LENGTH = 2_048;
+/**
+ * Keep Comments avatar requests on origins that can be named explicitly in
+ * the host page's CSP. Gravatar is already canonical; every other HTTP(S)
+ * profile image goes through the HTTPS WordPress.com image CDN.
+ */
+export function normalizeCommentAvatarUrl(value) {
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.length > MAX_AVATAR_URL_LENGTH)
+        return null;
+    try {
+        const source = new URL(trimmed);
+        if ((source.protocol !== "https:" && source.protocol !== "http:") ||
+            source.username !== "" ||
+            source.password !== "") {
+            return null;
+        }
+        if (source.origin === CANONICAL_GRAVATAR_ORIGIN || source.origin === AVATAR_PROXY_ORIGIN) {
+            return source.href.length <= MAX_AVATAR_URL_LENGTH ? source.href : null;
+        }
+        // Assign the proxy path instead of parsing `<host><path>` as a URL. A host
+        // with a non-default port contains a colon and would otherwise become a
+        // made-up scheme (`javascript:8443/...`, for example). Photon addresses an
+        // HTTPS source with `ssl=1`; without it, an HTTPS and HTTP source collapse
+        // to the same proxy URL. `source.host` deliberately retains an explicit
+        // non-default port.
+        const proxied = new URL(AVATAR_PROXY_ORIGIN);
+        proxied.pathname = `/${source.host}${source.pathname}`;
+        proxied.search = source.search;
+        if (source.protocol === "https:")
+            proxied.searchParams.set("ssl", "1");
+        if (proxied.protocol !== "https:" || proxied.origin !== AVATAR_PROXY_ORIGIN)
+            return null;
+        return proxied.href.length <= MAX_AVATAR_URL_LENGTH ? proxied.href : null;
+    }
+    catch {
+        return null;
+    }
+}