npm - @spacefast/common - Versions diffs - 0.0.12 → 0.0.17 - Mend

@spacefast/common 0.0.12 → 0.0.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (189) hide show

package/dist/agents/client-registry.d.ts +22 -0
package/dist/agents/client-registry.js +41 -0
package/dist/agents/connect-targets.d.ts +51 -6
package/dist/agents/connect-targets.js +93 -28
package/dist/brand.d.ts +0 -11
package/dist/brand.js +0 -20
package/dist/config/domains.d.ts +15 -6
package/dist/config/domains.js +24 -10
package/dist/config/postgres-budget.d.ts +3 -0
package/dist/config/postgres-budget.js +6 -1
package/dist/config/postgres-budget.json +2 -1
package/dist/contracts/abuse.js +1 -1
package/dist/contracts/access.d.ts +486 -1196
package/dist/contracts/access.js +323 -1054
package/dist/contracts/activity.d.ts +1 -1
package/dist/contracts/activity.js +11 -15
package/dist/contracts/api-keys.d.ts +16 -0
package/dist/contracts/api-keys.js +11 -9
package/dist/contracts/archives.d.ts +1 -2
package/dist/contracts/archives.js +15 -17
package/dist/contracts/beta.js +1 -1
package/dist/contracts/builds.js +14 -14
package/dist/contracts/channels.js +2 -2
package/dist/contracts/comments.d.ts +143 -99
package/dist/contracts/comments.js +194 -79
package/dist/contracts/common.d.ts +12 -12
package/dist/contracts/common.js +33 -30
package/dist/contracts/continuation.js +5 -5
package/dist/contracts/countries.js +2 -7
package/dist/contracts/data-source-routes.d.ts +20 -0
package/dist/contracts/data-source-routes.js +15 -0
package/dist/contracts/device-auth.d.ts +13 -9
package/dist/contracts/device-auth.js +12 -12
package/dist/contracts/docs.d.ts +10 -10
package/dist/contracts/domains.js +39 -33
package/dist/contracts/enums.d.ts +4 -14
package/dist/contracts/enums.js +3 -10
package/dist/contracts/error-code-meta.d.ts +122 -56
package/dist/contracts/error-code-meta.js +43 -19
package/dist/contracts/error-codes.d.ts +7 -4
package/dist/contracts/error-codes.js +48 -24
package/dist/contracts/events.d.ts +22 -15
package/dist/contracts/events.js +33 -5
package/dist/contracts/execution.d.ts +238 -0
package/dist/contracts/execution.js +309 -0
package/dist/contracts/feature-lifecycle.d.ts +39 -188
package/dist/contracts/feature-lifecycle.js +52 -196
package/dist/contracts/features.d.ts +13 -115
package/dist/contracts/features.js +5 -35
package/dist/contracts/functions.d.ts +597 -0
package/dist/contracts/functions.js +475 -0
package/dist/contracts/grants.d.ts +1175 -0
package/dist/contracts/grants.js +783 -0
package/dist/contracts/ids.d.ts +7 -5
package/dist/contracts/ids.js +7 -7
package/dist/contracts/internal.js +2 -2
package/dist/contracts/mcp.d.ts +17 -556
package/dist/contracts/mcp.js +9 -103
package/dist/contracts/me.js +3 -4
package/dist/contracts/notifications.d.ts +108 -0
package/dist/contracts/notifications.js +54 -0
package/dist/contracts/oauth-resources.d.ts +22 -5
package/dist/contracts/oauth-resources.js +23 -2
package/dist/contracts/operations.d.ts +0 -48
package/dist/contracts/operations.js +0 -19
package/dist/contracts/pages.d.ts +10 -14
package/dist/contracts/pages.js +17 -21
package/dist/contracts/plan-policy.d.ts +1 -8
package/dist/contracts/plan-policy.js +1 -4
package/dist/contracts/platform.d.ts +78 -30
package/dist/contracts/platform.js +69 -20
package/dist/contracts/problem-document.d.ts +14 -0
package/dist/contracts/problem-document.js +35 -0
package/dist/contracts/push-new.d.ts +41 -2
package/dist/contracts/push-new.js +4 -0
package/dist/contracts/quotas.d.ts +0 -1
package/dist/contracts/quotas.js +0 -5
package/dist/contracts/repository-connections.d.ts +1 -1
package/dist/contracts/resources.d.ts +16 -71
package/dist/contracts/resources.js +13 -16
package/dist/contracts/runtime-api.d.ts +666 -303
package/dist/contracts/runtime-api.js +272 -113
package/dist/contracts/runtime-app.d.ts +168 -0
package/dist/contracts/runtime-app.js +42 -0
package/dist/contracts/runtime-db.d.ts +424 -0
package/dist/contracts/runtime-db.js +108 -0
package/dist/contracts/runtime-storage.d.ts +120 -0
package/dist/contracts/runtime-storage.js +40 -0
package/dist/contracts/sf-config-v1.d.ts +54 -1
package/dist/contracts/sf-config-v1.js +2 -2
package/dist/contracts/sites.d.ts +6 -0
package/dist/contracts/sites.js +30 -11
package/dist/contracts/space-config.d.ts +91 -121
package/dist/contracts/space-config.js +464 -42
package/dist/contracts/spaces.d.ts +300 -171
package/dist/contracts/spaces.js +128 -98
package/dist/contracts/superadmin-emails.d.ts +2 -2
package/dist/contracts/superadmin-spaces.d.ts +26 -130
package/dist/contracts/superadmin-spaces.js +22 -0
package/dist/contracts/superadmin-tenants.js +4 -4
package/dist/contracts/superadmin.d.ts +4 -0
package/dist/contracts/superadmin.js +14 -1
package/dist/contracts/tags.d.ts +6 -6
package/dist/contracts/tags.js +1 -1
package/dist/contracts/teams.d.ts +9 -9
package/dist/contracts/teams.js +25 -16
package/dist/contracts/theme-json.js +1 -1
package/dist/contracts/transfers.d.ts +0 -1
package/dist/contracts/transfers.js +4 -4
package/dist/contracts/variables.js +3 -3
package/dist/contracts/zero.d.ts +384 -596
package/dist/contracts/zero.js +167 -299
package/dist/dashboard-paths/index.d.ts +18 -3
package/dist/dashboard-paths/index.js +19 -0
package/dist/docs/agent-handoff-document.d.ts +2 -2
package/dist/docs/agent-handoff-document.js +8 -7
package/dist/docs/agent-prose.d.ts +22 -3
package/dist/docs/agent-prose.js +227 -55
package/dist/docs/agent-setup.d.ts +14 -11
package/dist/docs/agent-setup.js +289 -61
package/dist/docs/agent-solutions.d.ts +6 -6
package/dist/docs/agent-solutions.js +24 -22
package/dist/docs/catalog.d.ts +53 -98
package/dist/docs/catalog.js +90 -117
package/dist/docs/error-docs.js +304 -236
package/dist/docs/skill-distribution.d.ts +2 -0
package/dist/docs/skill-distribution.js +7 -4
package/dist/docs/skills.d.ts +546 -0
package/dist/docs/skills.js +340 -0
package/dist/utils/auth-redirect.d.ts +1 -3
package/dist/utils/auth-redirect.js +1 -21
package/dist/utils/browser-credential.d.ts +19 -0
package/dist/utils/browser-credential.js +62 -0
package/dist/utils/build-settings.d.ts +2 -0
package/dist/utils/build-settings.js +61 -9
package/dist/utils/comment-avatars.d.ts +7 -0
package/dist/utils/comment-avatars.js +42 -0
package/dist/utils/content-type.d.ts +3 -3
package/dist/utils/content-type.js +38 -61
package/dist/utils/credential-policy.d.ts +1 -1
package/dist/utils/credential-policy.js +4 -0
package/dist/utils/domain-diagnostics.d.ts +5 -5
package/dist/utils/domain-diagnostics.js +21 -10
package/dist/utils/egress-policy.fixtures.json +1 -1
package/dist/utils/grants.d.ts +53 -0
package/dist/utils/grants.js +160 -0
package/dist/utils/local-space-state.d.ts +78 -4
package/dist/utils/local-space-state.js +384 -82
package/dist/utils/one-shot-replay.d.ts +14 -0
package/dist/utils/one-shot-replay.js +21 -0
package/dist/utils/page-preview.d.ts +7 -0
package/dist/utils/page-preview.js +9 -0
package/dist/utils/pages.d.ts +2 -5
package/dist/utils/pages.js +64 -33
package/dist/utils/publish-form-data.d.ts +22 -0
package/dist/utils/publish-form-data.js +26 -0
package/dist/utils/publish-policy.d.ts +34 -4
package/dist/utils/publish-policy.js +149 -62
package/dist/utils/query-keys.d.ts +8 -10
package/dist/utils/query-keys.js +14 -10
package/dist/utils/runtime-paths.d.ts +3 -0
package/dist/utils/runtime-paths.js +7 -0
package/dist/utils/secure-local-file.d.ts +73 -0
package/dist/utils/secure-local-file.js +1373 -0
package/dist/utils/space-config.d.ts +17 -4
package/dist/utils/space-config.js +151 -8
package/dist/utils/static-runtime-policy.d.ts +5 -0
package/dist/utils/static-runtime-policy.js +54 -10
package/dist/utils/storage-policy.d.ts +20 -0
package/dist/utils/storage-policy.fixtures.json +174 -0
package/dist/utils/storage-policy.js +193 -0
package/dist/utils/upload-session.d.ts +15 -1
package/dist/utils/upload-session.js +68 -2
package/dist/utils/version-file-browser.d.ts +13 -0
package/dist/utils/version-file-browser.js +59 -0
package/package.json +20 -1
package/dist/contracts/mounts.d.ts +0 -142
package/dist/contracts/mounts.js +0 -56
package/dist/utils/access-grant.d.ts +0 -14
package/dist/utils/access-grant.js +0 -88
package/dist/utils/access-match.d.ts +0 -46
package/dist/utils/access-match.fixtures.json +0 -513
package/dist/utils/access-match.js +0 -312
package/dist/utils/access-verdict.fixtures.json +0 -421
package/dist/utils/asset-fingerprint.d.ts +0 -53
package/dist/utils/asset-fingerprint.js +0 -574
package/dist/utils/sf-config-v1.d.ts +0 -2
package/dist/utils/sf-config-v1.fixtures.json +0 -9
package/dist/utils/sf-config-v1.js +0 -551

package/dist/utils/storage-policy.js ADDED Viewed

@@ -0,0 +1,193 @@
+// Single source of truth for storage HTTP and object-intake policy.
+//
+// TypeScript adapters import this module directly. The PHP runtime binding is
+// generated into runtime/engine/shared/storage-policy.generated.php by
+// `bun --filter @spacefast/control-plane runtime:codegen-policy`. Both execute
+// the same storage-policy.fixtures.json corpus.
+export const STORAGE_OBJECT_MAX_FILE_BYTES = 5 * 1024 * 1024;
+export const STORAGE_OBJECT_MAX_OWNER_BYTES = 100 * 1024 * 1024;
+export const STORAGE_CONTENT_SNIFF_BYTES = 512;
+export const STORAGE_BLOCKED_CONTENT_TYPES = [
+    "application/java-archive",
+    "application/java-vm",
+    "application/vnd.microsoft.portable-executable",
+    "application/x-dosexec",
+    "application/x-httpd-php",
+    "application/x-java-archive",
+    "application/x-mach-binary",
+    "application/x-msdownload",
+    "application/xhtml+xml",
+    "text/html",
+];
+export const STORAGE_BLOCKED_CONTENT_TYPE_FRAGMENTS = ["javascript", "ecmascript"];
+export const STORAGE_BLOCKED_MAGIC_HEX = [
+    "4d5a",
+    "7f454c46",
+    "feedface",
+    "cefaedfe",
+    "feedfacf",
+    "cffaedfe",
+    "cafebabe",
+];
+export const STORAGE_BLOCKED_TEXT_PREFIXES = ["#!", "<!doctype html", "<html", "<script", "<?php"];
+const BLOCKED_CONTENT_TYPES = new Set(STORAGE_BLOCKED_CONTENT_TYPES);
+export function storageDeclaredTypeBlocked(contentType) {
+    const declared = contentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+    return (BLOCKED_CONTENT_TYPES.has(declared) ||
+        STORAGE_BLOCKED_CONTENT_TYPE_FRAGMENTS.some((fragment) => declared.includes(fragment)));
+}
+function bytesStartWithHex(bytes, hex) {
+    if (bytes.byteLength < hex.length / 2)
+        return false;
+    for (let offset = 0; offset < hex.length; offset += 2) {
+        if (bytes[offset / 2] !== Number.parseInt(hex.slice(offset, offset + 2), 16)) {
+            return false;
+        }
+    }
+    return true;
+}
+export function storageContentBlocked(contentType, input) {
+    if (storageDeclaredTypeBlocked(contentType))
+        return true;
+    const prefix = input.subarray(0, STORAGE_CONTENT_SNIFF_BYTES);
+    if (STORAGE_BLOCKED_MAGIC_HEX.some((magic) => bytesStartWithHex(prefix, magic))) {
+        return true;
+    }
+    const decoded = new TextDecoder().decode(prefix);
+    let contentStart = 0;
+    while (contentStart < decoded.length) {
+        const code = decoded.charCodeAt(contentStart);
+        if (code !== 0 && code !== 9 && code !== 10 && code !== 11 && code !== 13 && code !== 32) {
+            break;
+        }
+        contentStart += 1;
+    }
+    const text = decoded.slice(contentStart).toLowerCase();
+    return STORAGE_BLOCKED_TEXT_PREFIXES.some((blocked) => text.startsWith(blocked));
+}
+export function storageParseSingleRange(rangeHeader, size) {
+    if (!rangeHeader || rangeHeader.trim() === "" || rangeHeader.includes(","))
+        return null;
+    const match = /^bytes=(\d*)-(\d*)$/.exec(rangeHeader.trim());
+    if (!match || (!match[1] && !match[2]))
+        return null;
+    if (!match[1]) {
+        const suffix = Number(match[2]);
+        if (!Number.isSafeInteger(suffix) || suffix <= 0 || size <= 0) {
+            return { unsatisfiable: true };
+        }
+        const start = Math.max(0, size - suffix);
+        const end = size - 1;
+        return { start, end, header: `bytes=${start}-${end}` };
+    }
+    const start = Number(match[1]);
+    const requestedEnd = match[2] ? Number(match[2]) : size - 1;
+    const end = Math.min(requestedEnd, size - 1);
+    if (!Number.isSafeInteger(start) ||
+        !Number.isSafeInteger(requestedEnd) ||
+        start >= size ||
+        start > end ||
+        size < 0) {
+        return { unsatisfiable: true };
+    }
+    return { start, end, header: `bytes=${start}-${end}` };
+}
+function storageEtagOpaqueTag(etag) {
+    const trimmed = etag.trim();
+    return /^W\//i.test(trimmed) ? trimmed.slice(2).trim() : trimmed;
+}
+export function storageIfNoneMatchMatches(header, etag) {
+    const value = header?.trim() ?? "";
+    if (value === "")
+        return false;
+    if (value === "*")
+        return true;
+    const target = storageEtagOpaqueTag(etag);
+    if (target === "")
+        return false;
+    return value
+        .split(",")
+        .map((candidate) => candidate.trim())
+        .filter(Boolean)
+        .some((candidate) => storageEtagOpaqueTag(candidate) === target);
+}
+const HTTP_MONTHS = [
+    "Jan",
+    "Feb",
+    "Mar",
+    "Apr",
+    "May",
+    "Jun",
+    "Jul",
+    "Aug",
+    "Sep",
+    "Oct",
+    "Nov",
+    "Dec",
+];
+const HTTP_WEEKDAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+const HTTP_WEEKDAYS_LONG = [
+    "Sunday",
+    "Monday",
+    "Tuesday",
+    "Wednesday",
+    "Thursday",
+    "Friday",
+    "Saturday",
+];
+function storageHttpDateTimestamp(weekday, day, month, year, hour, minute, second) {
+    if (hour > 23 || minute > 59 || second > 60)
+        return null;
+    const normalizedSecond = Math.min(second, 59);
+    const date = new Date(0);
+    date.setUTCFullYear(year, month, day);
+    date.setUTCHours(hour, minute, normalizedSecond, 0);
+    if (date.getUTCFullYear() !== year ||
+        date.getUTCMonth() !== month ||
+        date.getUTCDate() !== day ||
+        date.getUTCHours() !== hour ||
+        date.getUTCMinutes() !== minute ||
+        date.getUTCSeconds() !== normalizedSecond ||
+        (weekday !== null && date.getUTCDay() !== weekday)) {
+        return null;
+    }
+    return date.getTime() + (second === 60 ? 1_000 : 0);
+}
+// HTTP-date has exactly three accepted wire forms (RFC 9110 §5.6.7). General
+// date parsers also accept relative/free-form input such as `tomorrow`, so
+// validators must parse the grammar and validate its calendar components.
+export function storageParseHttpDate(value) {
+    const input = value.trim();
+    let match = /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat), (\d{2}) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{4}) (\d{2}):(\d{2}):(\d{2}) GMT$/.exec(input);
+    if (match) {
+        return storageHttpDateTimestamp(HTTP_WEEKDAYS.indexOf(match[1] ?? ""), Number(match[2]), HTTP_MONTHS.indexOf(match[3] ?? ""), Number(match[4]), Number(match[5]), Number(match[6]), Number(match[7]));
+    }
+    match =
+        /^(Sunday|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday), (\d{2})-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{2}) (\d{2}):(\d{2}):(\d{2}) GMT$/.exec(input);
+    if (match) {
+        const now = new Date();
+        let year = Math.floor(now.getUTCFullYear() / 100) * 100 + Number(match[4]);
+        const candidate = storageHttpDateTimestamp(null, Number(match[2]), HTTP_MONTHS.indexOf(match[3] ?? ""), year, Number(match[5]), Number(match[6]), Number(match[7]));
+        const fiftyYearsFromNow = new Date(now);
+        fiftyYearsFromNow.setUTCFullYear(now.getUTCFullYear() + 50);
+        if (candidate !== null && candidate > fiftyYearsFromNow.getTime())
+            year -= 100;
+        return storageHttpDateTimestamp(HTTP_WEEKDAYS_LONG.indexOf(match[1] ?? ""), Number(match[2]), HTTP_MONTHS.indexOf(match[3] ?? ""), year, Number(match[5]), Number(match[6]), Number(match[7]));
+    }
+    match =
+        /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (?:([0-9]{2})| ([0-9])) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/.exec(input);
+    if (!match)
+        return null;
+    return storageHttpDateTimestamp(HTTP_WEEKDAYS.indexOf(match[1] ?? ""), Number(match[3] ?? match[4]), HTTP_MONTHS.indexOf(match[2] ?? ""), Number(match[8]), Number(match[5]), Number(match[6]), Number(match[7]));
+}
+export function storageIfRangeMatches(ifRange, etag, lastModified) {
+    const value = ifRange.trim();
+    if (value === "" || /^W\//i.test(value))
+        return false;
+    if (value.startsWith('"')) {
+        return !/^W\//i.test(etag.trim()) && etag.trim() === value;
+    }
+    const requestTime = storageParseHttpDate(value);
+    const modifiedTime = storageParseHttpDate(lastModified);
+    return requestTime !== null && modifiedTime !== null && requestTime >= modifiedTime;
+}

package/dist/utils/upload-session.d.ts CHANGED Viewed

@@ -19,11 +19,25 @@ export type UploadSessionEvent = {
     target: UploadTarget;
     error: unknown;
 };
+/** The RFC 9457 problem document a runtime upload target returns on failure. */
+export type UploadTargetServerError = {
+    code: string;
+    message: string;
+    pointer?: string;
+    type?: string;
+    details?: unknown;
+    suggestions?: readonly string[];
+    requestId?: string;
+};
 export declare class UploadTargetError extends Error {
     readonly target: UploadTarget;
     readonly status: number;
-    constructor(target: UploadTarget, status: number, message: string);
+    readonly serverError?: UploadTargetServerError | undefined;
+    constructor(target: UploadTarget, status: number, message: string, serverError?: UploadTargetServerError | undefined);
 }
+export declare function uploadPageHasRemainder(page: UploadSession): boolean;
+export declare const UPLOAD_STALLED_RESUME_MAX_ATTEMPTS = 3;
+export declare function uploadQueueAdvanced(before: UploadSession, after: UploadSession | null): boolean;
 export declare function executeUploadSession(input: {
     session: UploadSession;
     targets?: readonly UploadTarget[] | undefined;

package/dist/utils/upload-session.js CHANGED Viewed

@@ -1,13 +1,78 @@
 export class UploadTargetError extends Error {
     target;
     status;
-    constructor(target, status, message) {
+    serverError;
+    constructor(target, status, message, serverError) {
         super(message);
         this.target = target;
         this.status = status;
+        this.serverError = serverError;
         this.name = "UploadTargetError";
     }
 }
+function parseUploadTargetServerError(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (!parsed || typeof parsed !== "object") {
+        return undefined;
+    }
+    const record = parsed;
+    if (typeof record.code !== "string" || typeof record.detail !== "string") {
+        return undefined;
+    }
+    const stringField = (name) => typeof record[name] === "string" ? record[name] : undefined;
+    const suggestions = Array.isArray(record.suggestions)
+        ? record.suggestions.filter((entry) => typeof entry === "string")
+        : [];
+    const pointer = stringField("pointer");
+    const type = stringField("type");
+    const requestId = stringField("requestId");
+    return {
+        code: record.code,
+        message: record.detail,
+        ...(pointer ? { pointer } : {}),
+        ...(type ? { type } : {}),
+        ...(record.details === undefined ? {} : { details: record.details }),
+        ...(suggestions.length > 0 ? { suggestions } : {}),
+        ...(requestId ? { requestId } : {}),
+    };
+}
+// Manifest paging policy — ONE definition, shared by every uploader (the CLI
+// and the control plane's inline uploader).
+//
+// `targets` is a single instruction page, bounded by the instruction payload
+// budget; `summary.upload` counts the whole declared manifest. A short page
+// therefore means a remainder that only `resume` hands out, and an uploader
+// that stops at the first page finalizes a version the runtime rejects with
+// `version_upload_incomplete`. A complete page means there is nothing left to
+// ask for — don't re-resume to double-check the uploads, since the runtime
+// verifies size and sha256 on every PUT and finalize independently enumerates
+// anything still missing.
+export function uploadPageHasRemainder(page) {
+    return page.summary.upload > page.targets.length;
+}
+// Resume mints the next page from runtime session truth, so a converging
+// session always hands back different work. A page that repeats the previous
+// one is a session that is not draining; retry it a bounded number of times,
+// then fail loudly rather than page forever.
+export const UPLOAD_STALLED_RESUME_MAX_ATTEMPTS = 3;
+export function uploadQueueAdvanced(before, after) {
+    if (!after || after.targets.length === 0) {
+        return true;
+    }
+    if (after.targets.length < before.targets.length) {
+        return true;
+    }
+    if (after.targets.length > before.targets.length) {
+        return false;
+    }
+    return after.targets.some((target, index) => target.path !== before.targets[index]?.path);
+}
 async function runConcurrent(items, concurrency, fn) {
     let nextIndex = 0;
     const runWorker = async () => {
@@ -47,8 +112,9 @@ export async function executeUploadSession(input) {
             });
             if (!response.ok) {
                 const details = await response.text().catch(() => "");
+                const serverError = parseUploadTargetServerError(details);
                 const suffix = details.trim() ? `: ${details.trim().slice(0, 1_000)}` : "";
-                throw new UploadTargetError(target, response.status, `Upload failed for ${target.path} with ${response.status} ${response.statusText}${suffix}.`);
+                throw new UploadTargetError(target, response.status, `Upload failed for ${target.path} with ${response.status} ${response.statusText}${suffix}.`, serverError);
             }
             input.onEvent?.({ type: "target-done", target });
         }

package/dist/utils/version-file-browser.d.ts ADDED Viewed

@@ -0,0 +1,13 @@
+/**
+ * Returns the canonical MIME essence only when browsers may render the bytes
+ * on an authenticated origin. Active document formats (HTML, SVG, XML, and
+ * scripts) are intentionally absent; `nosniff` is the other half of this
+ * contract at the response boundary.
+ */
+export declare function inlineVersionFileContentType(contentType: string | null | undefined): string | null;
+export declare function versionFileContentDisposition(disposition: "attachment" | "inline", filePath: string): string;
+/**
+ * A download remains inert even if a user agent ignores attachment handling:
+ * the CSP sandbox gives it an opaque origin and permits no script or fetch.
+ */
+export declare function versionFileAttachmentHeaders(filePath: string): Record<string, string>;

package/dist/utils/version-file-browser.js ADDED Viewed

@@ -0,0 +1,59 @@
+const INLINE_VERSION_FILE_CONTENT_TYPES = new Set([
+    "application/pdf",
+    "audio/aac",
+    "audio/flac",
+    "audio/mp4",
+    "audio/mpeg",
+    "audio/ogg",
+    "audio/opus",
+    "audio/wav",
+    "audio/webm",
+    "audio/x-m4a",
+    "audio/x-wav",
+    "image/apng",
+    "image/avif",
+    "image/bmp",
+    "image/gif",
+    "image/jpeg",
+    "image/png",
+    "image/vnd.microsoft.icon",
+    "image/webp",
+    "image/x-icon",
+    "video/mp4",
+    "video/ogg",
+    "video/quicktime",
+    "video/webm",
+    "video/x-m4v",
+]);
+/**
+ * Returns the canonical MIME essence only when browsers may render the bytes
+ * on an authenticated origin. Active document formats (HTML, SVG, XML, and
+ * scripts) are intentionally absent; `nosniff` is the other half of this
+ * contract at the response boundary.
+ */
+export function inlineVersionFileContentType(contentType) {
+    const essence = contentType?.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+    return INLINE_VERSION_FILE_CONTENT_TYPES.has(essence) ? essence : null;
+}
+function dispositionFilename(filePath) {
+    const basename = filePath.split("/").findLast(Boolean) ?? "download";
+    const ascii = basename
+        .replace(/[^\x20-\x7e]/g, "_")
+        .replace(/["\\]/g, "_")
+        .slice(0, 180);
+    return ascii || "download";
+}
+export function versionFileContentDisposition(disposition, filePath) {
+    return `${disposition}; filename="${dispositionFilename(filePath)}"`;
+}
+/**
+ * A download remains inert even if a user agent ignores attachment handling:
+ * the CSP sandbox gives it an opaque origin and permits no script or fetch.
+ */
+export function versionFileAttachmentHeaders(filePath) {
+    return {
+        "content-disposition": versionFileContentDisposition("attachment", filePath),
+        "content-security-policy": "default-src 'none'; sandbox; frame-ancestors 'none'",
+        "x-content-type-options": "nosniff",
+    };
+}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@spacefast/common",
-  "version": "0.0.12",
+  "version": "0.0.17",
   "license": "MIT",
   "description": "Shared TypeScript contracts and utilities for Spacefast packages.",
   "repository": {
@@ -20,6 +20,22 @@
     "brand-assets",
     "dist"
   ],
+  "spacefastTestCache": {
+    "mode": "hermetic",
+    "inputs": [
+      "../../apps/www/dist/.well-known/agent-card.json",
+      "../../apps/www/dist/ai.txt",
+      "../../apps/www/dist/llms-full.txt",
+      "../../apps/www/dist/llms.txt",
+      "../../apps/www/public/skill-references.md",
+      "../../apps/www/public/skill.md",
+      "../../e2e-tests/fixtures/zero-all-features/api-finalize-request.json",
+      "../../e2e-tests/fixtures/zero-all-features/runtime-compiler-finalize-input.json",
+      "../../runtime/engine/shared/fonts",
+      "../cli/SKILL.md",
+      "../cli/references.md"
+    ]
+  },
   "exports": {
     "./brand": {
       "types": "./dist/brand.d.ts",
@@ -93,6 +109,9 @@
   "dependencies": {
     "@tanstack/react-query": "^5.101.4",
     "culori": "^4.0.2",
+    "js-yaml": "^4.1.1",
+    "mime": "^4.1.0",
+    "parse5": "^7.3.0",
     "smol-toml": "^1.7.0",
     "zod": "^4.4.3"
   }

package/dist/contracts/mounts.d.ts DELETED Viewed

@@ -1,142 +0,0 @@
-import { z } from "zod";
-export declare function normalizeMountPathPrefix(value: string): string;
-export declare const mountPathPrefixSchema: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-export declare const spaceMountCreateSchema: z.ZodObject<{
-    sourceVersionId: z.ZodCustom<`ver_${string}`, `ver_${string}`>;
-    pathPrefix: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-    targetSpaceId: z.ZodCustom<`spc_${string}`, `spc_${string}`>;
-    channel: z.ZodDefault<z.ZodLiteral<"live">>;
-}, z.core.$strip>;
-export declare const spaceMountSchema: z.ZodObject<{
-    id: z.ZodCustom<`mnt_${string}`, `mnt_${string}`>;
-    spaceId: z.ZodCustom<`spc_${string}`, `spc_${string}`>;
-    sourceVersionId: z.ZodCustom<`ver_${string}`, `ver_${string}`>;
-    pathPrefix: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-    targetSpaceId: z.ZodCustom<`spc_${string}`, `spc_${string}`>;
-    targetSpaceSlug: z.ZodString;
-    channel: z.ZodLiteral<"live">;
-    versionId: z.ZodNullable<z.ZodCustom<`ver_${string}`, `ver_${string}`>>;
-    targetVersionId: z.ZodNullable<z.ZodCustom<`ver_${string}`, `ver_${string}`>>;
-    createdAt: z.ZodString;
-    updatedAt: z.ZodString;
-}, z.core.$strip>;
-export declare const spaceMountListResponseSchema: z.ZodObject<{
-    data: z.ZodArray<z.ZodObject<{
-        id: z.ZodCustom<`mnt_${string}`, `mnt_${string}`>;
-        spaceId: z.ZodCustom<`spc_${string}`, `spc_${string}`>;
-        sourceVersionId: z.ZodCustom<`ver_${string}`, `ver_${string}`>;
-        pathPrefix: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-        targetSpaceId: z.ZodCustom<`spc_${string}`, `spc_${string}`>;
-        targetSpaceSlug: z.ZodString;
-        channel: z.ZodLiteral<"live">;
-        versionId: z.ZodNullable<z.ZodCustom<`ver_${string}`, `ver_${string}`>>;
-        targetVersionId: z.ZodNullable<z.ZodCustom<`ver_${string}`, `ver_${string}`>>;
-        createdAt: z.ZodString;
-        updatedAt: z.ZodString;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export declare const spaceMountResponseSchema: z.ZodObject<{
-    data: z.ZodObject<{
-        id: z.ZodCustom<`mnt_${string}`, `mnt_${string}`>;
-        spaceId: z.ZodCustom<`spc_${string}`, `spc_${string}`>;
-        sourceVersionId: z.ZodCustom<`ver_${string}`, `ver_${string}`>;
-        pathPrefix: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-        targetSpaceId: z.ZodCustom<`spc_${string}`, `spc_${string}`>;
-        targetSpaceSlug: z.ZodString;
-        channel: z.ZodLiteral<"live">;
-        versionId: z.ZodNullable<z.ZodCustom<`ver_${string}`, `ver_${string}`>>;
-        targetVersionId: z.ZodNullable<z.ZodCustom<`ver_${string}`, `ver_${string}`>>;
-        createdAt: z.ZodString;
-        updatedAt: z.ZodString;
-    }, z.core.$strip>;
-    operation: z.ZodNullable<z.ZodObject<{
-        id: z.ZodString;
-        kind: z.ZodString;
-        status: z.ZodEnum<{
-            failed: "failed";
-            canceled: "canceled";
-            queued: "queued";
-            running: "running";
-            succeeded: "succeeded";
-        }>;
-        resources: z.ZodArray<z.ZodObject<{
-            type: z.ZodString;
-            id: z.ZodString;
-        }, z.core.$strip>>;
-        progress: z.ZodOptional<z.ZodObject<{
-            total: z.ZodNumber;
-            completed: z.ZodNumber;
-            failed: z.ZodNumber;
-        }, z.core.$strip>>;
-        diagnostics: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            code: z.ZodString;
-            severity: z.ZodEnum<{
-                info: "info";
-                error: "error";
-                warning: "warning";
-            }>;
-            message: z.ZodString;
-            path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-            provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
-                registrar: "registrar";
-                wpcloud: "wpcloud";
-                dns: "dns";
-                runtime: "runtime";
-            }>>>;
-            details: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
-            fix: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-            retryable: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
-        }, z.core.$strip>>>;
-        createdAt: z.ZodString;
-        finishedAt: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export declare const spaceMountDeleteResponseSchema: z.ZodObject<{
-    data: z.ZodObject<{
-        id: z.ZodCustom<`mnt_${string}`, `mnt_${string}`>;
-        deleted: z.ZodLiteral<true>;
-    }, z.core.$strip>;
-    operation: z.ZodNullable<z.ZodObject<{
-        id: z.ZodString;
-        kind: z.ZodString;
-        status: z.ZodEnum<{
-            failed: "failed";
-            canceled: "canceled";
-            queued: "queued";
-            running: "running";
-            succeeded: "succeeded";
-        }>;
-        resources: z.ZodArray<z.ZodObject<{
-            type: z.ZodString;
-            id: z.ZodString;
-        }, z.core.$strip>>;
-        progress: z.ZodOptional<z.ZodObject<{
-            total: z.ZodNumber;
-            completed: z.ZodNumber;
-            failed: z.ZodNumber;
-        }, z.core.$strip>>;
-        diagnostics: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            code: z.ZodString;
-            severity: z.ZodEnum<{
-                info: "info";
-                error: "error";
-                warning: "warning";
-            }>;
-            message: z.ZodString;
-            path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-            provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
-                registrar: "registrar";
-                wpcloud: "wpcloud";
-                dns: "dns";
-                runtime: "runtime";
-            }>>>;
-            details: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
-            fix: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-            retryable: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
-        }, z.core.$strip>>>;
-        createdAt: z.ZodString;
-        finishedAt: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export type SpaceMountCreate = z.infer<typeof spaceMountCreateSchema>;
-export type SpaceMount = z.infer<typeof spaceMountSchema>;

package/dist/contracts/mounts.js DELETED Viewed

@@ -1,56 +0,0 @@
-import { z } from "zod";
-import { dataEnvelope, mutationEnvelope } from "./common.js";
-import { registeredIdSchema } from "./ids.js";
-const RESERVED_MOUNT_PREFIXES = ["/__spacefast", "/__stattic", "/.well-known"];
-export function normalizeMountPathPrefix(value) {
-    const trimmed = value.trim();
-    if (trimmed === "" || trimmed === "/")
-        return "/";
-    return `/${trimmed.replace(/^\/+|\/+$/g, "")}`;
-}
-export const mountPathPrefixSchema = z
-    .string()
-    .min(1)
-    .max(1024)
-    .transform(normalizeMountPathPrefix)
-    .refine((value) => value !== "/", "A mount path must be below the site root.")
-    .refine((value) => Array.from(value).every((character) => {
-    const codePoint = character.codePointAt(0) ?? 0;
-    return codePoint > 0x9f || (codePoint > 0x1f && codePoint !== 0x7f);
-}), "Mount path is invalid.")
-    .refine((value) => !value.includes("\\") && !value.includes("//"), "Mount path is invalid.")
-    .refine((value) => !value
-    .split("/")
-    .filter(Boolean)
-    .some((segment) => segment === "." || segment === ".."), "Mount path is invalid.")
-    .refine((value) => !RESERVED_MOUNT_PREFIXES.some((reserved) => value === reserved || value.startsWith(`${reserved}/`)), "Mount path uses a Spacefast-reserved prefix.")
-    .describe("Normalized path prefix on the website, for example `/docs`.");
-export const spaceMountCreateSchema = z.object({
-    sourceVersionId: registeredIdSchema("ver").describe("Immutable website version whose production activation enables this mount."),
-    pathPrefix: mountPathPrefixSchema,
-    targetSpaceId: registeredIdSchema("spc").describe("Explicitly authorized same-team space to mount."),
-    channel: z
-        .literal("live")
-        .default("live")
-        .describe("Target production channel followed by this mount."),
-});
-export const spaceMountSchema = z.object({
-    id: registeredIdSchema("mnt"),
-    spaceId: registeredIdSchema("spc"),
-    sourceVersionId: registeredIdSchema("ver"),
-    pathPrefix: mountPathPrefixSchema,
-    targetSpaceId: registeredIdSchema("spc"),
-    targetSpaceSlug: z.string(),
-    channel: z.literal("live"),
-    versionId: registeredIdSchema("ver")
-        .nullable()
-        .describe("Immutable target version currently serving from the mount."),
-    targetVersionId: registeredIdSchema("ver")
-        .nullable()
-        .describe("Target production-channel version the durable synchronizer is converging toward."),
-    createdAt: z.string().datetime(),
-    updatedAt: z.string().datetime(),
-});
-export const spaceMountListResponseSchema = dataEnvelope(z.array(spaceMountSchema));
-export const spaceMountResponseSchema = mutationEnvelope(spaceMountSchema);
-export const spaceMountDeleteResponseSchema = mutationEnvelope(z.object({ id: registeredIdSchema("mnt"), deleted: z.literal(true) }));

package/dist/utils/access-grant.d.ts DELETED Viewed

@@ -1,14 +0,0 @@
-import type { RuntimeRule } from "../contracts/access.js";
-export declare const ACCESS_GRANT_GATE_RULE_ID = "access-grant-gate";
-export declare const ACCESS_GRANT_ADMISSION_RULE_ID = "access-grant-admission";
-export type AccessGrantExposure = {
-    anonymousAccess: "gated" | "gated_with_exceptions" | "partly_public" | "shadowed";
-    earlierAnonymousAllowRules: number;
-    earlierManagedAccessRules: number;
-    precedingTerminalRules: number;
-};
-export declare function withAccessGrantGate(rules: RuntimeRule[], grant: string): RuntimeRule[];
-export declare function withoutAccessGrantRule(rules: RuntimeRule[], selectedIndex: number): RuntimeRule[];
-export declare function isAccessGrantAdmissionRule(rule: RuntimeRule): boolean;
-export declare function isAccessGrantFallbackRule(rule: RuntimeRule): boolean;
-export declare function accessGrantExposure(rules: RuntimeRule[]): AccessGrantExposure;