@spacefast/common 0.0.12 → 0.0.17

package/dist/utils/access-verdict.fixtures.json

@@ -1,421 +0,0 @@
-{
-    "_comment": "Shared corpus for the simulate<->runtime verdict drift guard (access-plan §8/X-9). Asserted against the PHP pure kernel (_spacefast_evaluate_policy, runtime/engine/runtime/access-rules.php) in apps/control-plane/src/runtime/php-policy-parity.test.ts and against apps/control-plane/src/access/simulate.ts's simulateAccess in apps/control-plane/src/runtime/access-verdict-parity.test.ts. `rules` is a raw RuntimeRule[] (no source/order provenance). `context` carries only the 4 fields simulate.ts's SimulateRequest supports (host/path/ip/country) plus `now` for expiry. `grants` mirrors what a real visitor token would carry but is restricted to 0-or-1 `email:` entries (simulate.ts's own simplification — it only ever mints an `email:` grant); `identified` is `grants.length > 0`, matching simulateAccess. `expected` is the {ruleId, effect, satisfied} verdict tuple both sides must agree on.",
-    "verdicts": [
-        {
-            "name": "first-match wins: anonymous deny before a later allow-all",
-            "rules": [
-                { "id": "r1", "match": { "pathPattern": "/admin/**" }, "effect": "deny" },
-                { "id": "r2", "match": {}, "effect": "allow" }
-            ],
-            "context": {
-                "host": "acme.example.com",
-                "path": "/admin/x",
-                "ip": "1.2.3.4",
-                "country": "US"
-            },
-            "grants": [],
-            "identified": false,
-            "now": 1770000000,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "first match: satisfied allow wins over a later deny",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "allow",
-                    "auth": { "requiredGrants": ["email:carol@acme.com"] }
-                },
-                { "id": "r2", "match": {}, "effect": "deny" }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:carol@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "expired deny rule is skipped, falls through to public allow",
-            "rules": [
-                { "id": "r1", "match": {}, "effect": "deny", "expiresAt": 1000 },
-                { "id": "r2", "match": {}, "effect": "allow" }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 2000,
-            "expected": { "ruleId": "r2", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "not-yet-expired rule (expiresAt > now) still applies",
-            "rules": [{ "id": "r1", "match": {}, "effect": "deny", "expiresAt": 2001 }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 2000,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "expiresAt == now is expired at the boundary (falls through to public allow)",
-            "rules": [{ "id": "r1", "match": {}, "effect": "deny", "expiresAt": 2000 }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 2000,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "challenge unsatisfied + identified visitor becomes deny (X-32 never re-challenge)",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "challenge",
-                    "auth": { "requiredGrants": ["team:t1:member"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:carol@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": false }
-        },
-        {
-            "name": "challenge unsatisfied + anonymous stays a challenge",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "challenge",
-                    "auth": { "requiredGrants": ["team:t1:member"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "challenge", "satisfied": false }
-        },
-        {
-            "name": "challenge satisfied becomes allow",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "challenge",
-                    "auth": { "requiredGrants": ["email:carol@acme.com"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:carol@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "allow rule unsatisfied keeps scanning to default public allow",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "allow",
-                    "auth": { "requiredGrants": ["email:carol@acme.com"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "deny rule unsatisfied keeps scanning to default public allow",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "deny",
-                    "auth": { "requiredGrants": ["email:carol@acme.com"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "deny rule satisfied denies immediately",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "deny",
-                    "auth": { "requiredGrants": ["email:mallory@acme.com"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:mallory@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "host mismatch falls through to public allow",
-            "rules": [{ "id": "r1", "match": { "host": "other.example.com" }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "path glob ** matches any depth",
-            "rules": [{ "id": "r1", "match": { "pathPattern": "/docs/**" }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/docs/a/b/c", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "path glob * matches one segment only, deeper path falls through",
-            "rules": [
-                { "id": "r1", "match": { "pathPattern": "/docs/*" }, "effect": "deny" },
-                { "id": "r2", "match": {}, "effect": "allow" }
-            ],
-            "context": { "host": "acme.example.com", "path": "/docs/a/b", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r2", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "country match denies",
-            "rules": [{ "id": "r1", "match": { "country": "KP" }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "KP" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "country mismatch falls through to public allow",
-            "rules": [{ "id": "r1", "match": { "country": "KP" }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "US" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "countryNotIn lets an explicitly allowed country fall through",
-            "rules": [{ "id": "r1", "match": { "countryNotIn": ["US"] }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "US" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "countryNotIn denies a provider-special country",
-            "rules": [{ "id": "r1", "match": { "countryNotIn": ["US"] }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "XX" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "countryNotIn denies a missing country",
-            "rules": [{ "id": "r1", "match": { "countryNotIn": ["US"] }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "ip cidr match denies",
-            "rules": [{ "id": "r1", "match": { "ipCidrs": ["10.0.0.0/8"] }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "10.1.2.3", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "ip cidr mismatch falls through to public allow",
-            "rules": [{ "id": "r1", "match": { "ipCidrs": ["10.0.0.0/8"] }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "192.168.1.1", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "agent-conditioned rule never fires when unsimulated (simulate.ts scope gap, negative-only)",
-            "rules": [
-                { "id": "r1", "match": { "agent": "Googlebot" }, "effect": "deny" },
-                { "id": "r2", "match": {}, "effect": "allow" }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r2", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "grant glob intersection: email domain wildcard satisfies",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "allow",
-                    "auth": { "requiredGrants": ["email:*@acme.com"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:carol@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "grant glob intersection: email outside the domain wildcard does not satisfy",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "allow",
-                    "auth": { "requiredGrants": ["email:*@acme.com"] }
-                },
-                { "id": "r2", "match": {}, "effect": "deny" }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:carol@evil.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r2", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "anonymous rule with challenge effect collapses to deny (no credential leg can ever satisfy it)",
-            "rules": [{ "id": "r1", "match": {}, "effect": "challenge" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": true }
-        },
-        {
-            "name": "anonymous allow rule passes regardless of any carried grants",
-            "rules": [{ "id": "r1", "match": {}, "effect": "allow" }],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:carol@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "no rules at all: public allow",
-            "rules": [],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "no rule matches this host/path: public allow",
-            "rules": [{ "id": "r1", "match": { "pathPattern": "/private/**" }, "effect": "deny" }],
-            "context": { "host": "acme.example.com", "path": "/public/x", "ip": "", "country": "" },
-            "grants": [],
-            "identified": false,
-            "now": 1,
-            "expected": { "ruleId": null, "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "an irrelevant carried grant (same as a revoked/tombstoned id absent from requiredGrants) is a normal non-intersecting case",
-            "rules": [
-                {
-                    "id": "r1",
-                    "match": {},
-                    "effect": "challenge",
-                    "auth": { "requiredGrants": ["team:t1:member"] }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:zoe@acme.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "r1", "effect": "deny", "satisfied": false }
-        },
-        {
-            "name": "a later invited reviewer falls through earlier identity allows and passes their own",
-            "rules": [
-                {
-                    "id": "cast-reviewer-a",
-                    "match": {},
-                    "effect": "allow",
-                    "managedBy": "cast_reviewer",
-                    "auth": { "requiredGrants": ["email:reviewer.a@example.com"] }
-                },
-                {
-                    "id": "cast-reviewer-b",
-                    "match": {},
-                    "effect": "allow",
-                    "managedBy": "cast_reviewer",
-                    "auth": { "requiredGrants": ["email:reviewer.b@example.com"] }
-                },
-                {
-                    "id": "cast-reviewers-audience",
-                    "match": {},
-                    "effect": "challenge",
-                    "managedBy": "cast_reviewer",
-                    "auth": {
-                        "requiredGrants": ["email:reviewer.a@example.com", "email:reviewer.b@example.com"]
-                    }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:reviewer.b@example.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "cast-reviewer-b", "effect": "allow", "satisfied": true }
-        },
-        {
-            "name": "a non-reviewer falls through identity allows and is denied by the terminal audience",
-            "rules": [
-                {
-                    "id": "cast-reviewer-a",
-                    "match": {},
-                    "effect": "allow",
-                    "managedBy": "cast_reviewer",
-                    "auth": { "requiredGrants": ["email:reviewer.a@example.com"] }
-                },
-                {
-                    "id": "cast-reviewer-b",
-                    "match": {},
-                    "effect": "allow",
-                    "managedBy": "cast_reviewer",
-                    "auth": { "requiredGrants": ["email:reviewer.b@example.com"] }
-                },
-                {
-                    "id": "cast-reviewers-audience",
-                    "match": {},
-                    "effect": "challenge",
-                    "managedBy": "cast_reviewer",
-                    "auth": {
-                        "requiredGrants": ["email:reviewer.a@example.com", "email:reviewer.b@example.com"]
-                    }
-                }
-            ],
-            "context": { "host": "acme.example.com", "path": "/", "ip": "", "country": "" },
-            "grants": ["email:outsider@example.com"],
-            "identified": true,
-            "now": 1,
-            "expected": { "ruleId": "cast-reviewers-audience", "effect": "deny", "satisfied": false }
-        }
-    ]
-}

package/dist/utils/asset-fingerprint.d.ts

@@ -1,53 +0,0 @@
-export declare const FINGERPRINT_IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
-export declare const FINGERPRINT_HASH_LENGTH = 8;
-export type FingerprintCandidateFile = {
-    /** Canonical manifest path (no leading slash). */
-    path: string;
-    /** Full lowercase-hex sha256 of the file's bytes. */
-    sha256?: string | undefined;
-    /** UTF-8 text for html/css files that may need reference rewriting. */
-    text?: string | undefined;
-};
-export type FingerprintSkipReason = "css_cycle" | "alias_collision" | "user_cache_control" | "budget";
-export type FingerprintPlan = {
-    /**
-     * Alias manifest entries to add, sorted by sourcePath; content is identical
-     * to sourcePath's. This is also the "what got fingerprinted" relation —
-     * one array, `path` = the hashed alias, `sourcePath` = the original.
-     */
-    aliases: Array<{
-        path: string;
-        sourcePath: string;
-    }>;
-    /** html/css files whose published content changes (both paths, one blob). */
-    rewrites: Array<{
-        path: string;
-        text: string;
-        sha256: string;
-    }>;
-    /** Eligible-looking files the pass left on the default lane, with reasons. */
-    skipped: Array<{
-        path: string;
-        reason: FingerprintSkipReason;
-    }>;
-};
-export declare function planAssetFingerprints(input: {
-    files: readonly FingerprintCandidateFile[];
-    /** sha256 as lowercase hex over UTF-8 bytes of `text`. */
-    hashHex: (text: string) => string;
-    /**
-     * True when a user `_headers` Cache-Control rule already covers this URL
-     * path ("/"-prefixed). Files whose original OR probe-alias path is covered
-     * are never fingerprinted — user rules always win.
-     */
-    pathCoveredByUserCacheControl?: ((urlPath: string) => boolean) | undefined;
-    /** Extra per-path exclusion (e.g. header-rule budget trimming). */
-    excludePath?: ((path: string) => boolean) | undefined;
-}): FingerprintPlan;
-/**
- * Merges the generated immutable pins into user `_headers` content. The user
- * content is preserved byte-for-byte; generated exact-path rules are appended
- * (per-path Cache-Control conflicts are impossible — files covered by a user
- * Cache-Control rule are never fingerprinted).
- */
-export declare function mergeFingerprintHeaders(userHeaders: string | undefined, aliasPaths: readonly string[]): string;