@spacefast/common 0.0.12 → 0.0.17

package/dist/contracts/error-codes.js

@@ -1,20 +1,28 @@
 // The single error-code table (internal-docs/platform.md "Global API Conventions").
-// Every error envelope `code` the control plane emits is a member of this table, and
-// `docsUrl` is derived mechanically from the code (`https://spacefast.com/docs/errors/{code}`).
+// Every problem document `code` the control plane emits is a member of this table, and
+// the problem `type` is derived mechanically from the code
+// (`https://spacefast.com/docs/errors/{code}`).
 // The conformance suite asserts the derivation rule so links never rot, and error docs
 // pages are generated from this enum. Control-plane error constructors are typed against
 // `ErrorCode`, so emitting a code that is not in the table is a typecheck (CI) failure;
 // the remaining untyped string paths (low-level serializer, superadmin Better Auth
-// passthrough) fold into the typed envelope in the F2 envelope chunk.
+// passthrough) fold into the typed problem document in the F2 envelope chunk.
 // A code's meaning stays stable while it can be emitted. Retiring an API surface removes
 // its dead codes and generated references together. Diagnostic codes share this table so
 // every current diagnostic also carries a resolvable docs link.
-import { ERROR_DOCS_BASE_URL } from "../brand.js";
-export { ERROR_DOCS_BASE_URL };
-/** `docsUrl` derivation rule: docs origin + `/{code}`. Asserted by the conformance suite. */
+import { DOCS_BASE_URL } from "../config/domains.js";
+export const ERROR_DOCS_BASE_URL = `${DOCS_BASE_URL}/errors`;
+/** Media type of every 4xx/5xx response body (RFC 9457 problem details). */
+export const PROBLEM_CONTENT_TYPE = "application/problem+json";
+/** Problem `type` URI derivation rule: docs origin + `/{code}`. Asserted by the conformance suite. */
 export function errorDocsUrl(code) {
     return `${ERROR_DOCS_BASE_URL}/${code}`;
 }
+/** Problem `title` derivation rule: the snake_case code as a sentence ("version_not_found" → "Version not found"). */
+export function errorTitle(code) {
+    const words = code.replaceAll("_", " ");
+    return words.charAt(0).toUpperCase() + words.slice(1);
+}
 export const ERROR_CODES = [
     "abuse_report_invalid_transition",
     "abuse_report_rate_limited",
@@ -59,8 +67,12 @@ export const ERROR_CODES = [
     "cli_upgrade_required",
     "comment_screenshot_rate_limited",
     "config_file_too_large",
+    "config_functions_key_removed",
     "config_invalid",
     "config_meta_too_long",
+    "config_name_too_long",
+    "config_runtime_entry_missing",
+    "config_runtime_invalid_kind",
     "config_templates_over_limit",
     "continuation_unavailable",
     "continuation_used",
@@ -72,6 +84,7 @@ export const ERROR_CODES = [
     "csam_policy_floor",
     "custom_certificates_require_dedicated_site",
     "data_location_immutable",
+    "db_not_available",
     "device_authorization_failed",
     "device_verification_rate_limited",
     "dns_export_required",
@@ -135,11 +148,9 @@ export const ERROR_CODES = [
     "files_mode_does_not_support_spa",
     "forbidden",
     "free_external_proxy_disabled",
-    "free_headers_basic_auth_disabled",
     "google_play_webhook_identity_not_configured",
     "idempotency_conflict_in_progress",
     "idempotency_key_reused",
-    "immutable_version_requires_login",
     "import_archive_not_uploaded",
     "import_not_cancelable",
     "import_not_waiting_for_archive",
@@ -190,10 +201,11 @@ export const ERROR_CODES = [
     "manifest_body_too_large",
     "manifest_duplicate_path",
     "manifest_too_many_files",
-    "mcp_acted_for_team_deleted",
     "member_already_exists",
+    "method_not_allowed",
     "missing_route_param",
     "move_target_capacity_lost",
+    "name_managed_by_config",
     "nameserver_delegation_required",
     "nameserver_divergence",
     "noop_publish",
@@ -237,17 +249,19 @@ export const ERROR_CODES = [
     "rate_limited",
     "registration_expired",
     "registration_expiring",
+    "resource_revision_changed",
     "routing_rules_over_plan",
     "runtime_action_forbidden",
     "runtime_api_not_found",
     "runtime_callback_forbidden",
+    "runtime_dev_unsupported",
     "runtime_engine_zip_missing",
     "runtime_hostname_unassigned",
     "runtime_instance_mismatch",
     "runtime_jti_missing",
     "runtime_jti_replayed",
     "runtime_jwks_key_missing",
-    "runtime_logs_unavailable",
+    "runtime_kind_mismatch",
     "runtime_management_unavailable",
     "runtime_not_provisioned",
     "runtime_operation_missing",
@@ -260,9 +274,9 @@ export const ERROR_CODES = [
     "runtime_upload_required",
     "scan_pending",
     "secret_variable_in_template",
+    "service_booting",
     "service_signature_invalid",
     "site_already_deleted",
-    "site_capacity_exceeded",
     "site_has_live_spaces",
     "site_not_static",
     "site_required",
@@ -275,6 +289,7 @@ export const ERROR_CODES = [
     "source_archive_expansion_ratio_exceeded",
     "source_archive_validation_busy",
     "space_already_claimed",
+    "space_capacity_warming",
     "space_claim_unavailable",
     "space_claimed_credential_available",
     "space_disabled",
@@ -286,27 +301,34 @@ export const ERROR_CODES = [
     "space_import_archive_too_large",
     "space_import_config_only_archive",
     "space_import_runtime_schema_unsupported",
+    "space_move_would_strand_zero_data",
     "space_moving",
     "space_no_live_version",
     "space_not_disabled",
     "space_not_restorable",
+    "space_person_already_member",
+    "space_person_invitation_pending",
+    "space_person_self_invite",
     "space_ref_ambiguous",
     "space_ref_required",
     "space_transferring",
     "space_unclaimed",
     "ssl_renewal_blocked",
     "static_control_file_not_supported",
-    "static_mount_path_conflict",
-    "static_mount_source_not_ready",
-    "static_mount_target_forbidden",
-    "static_mount_target_in_use",
-    "static_mount_target_not_live",
-    "static_mount_target_not_ready",
-    "static_mount_target_not_static",
     "static_runtime_control_path_not_supported",
     "static_runtime_required",
+    "storage_auth_required",
     "storage_bucket_unavailable",
+    "storage_content_blocked",
+    "storage_delete_forbidden",
+    "storage_empty_file",
+    "storage_file_too_large",
+    "storage_key_invalid",
+    "storage_object_not_found",
+    "storage_quota_already_unlimited",
+    "storage_quota_decrease_not_supported",
     "storage_quota_exceeded",
+    "storage_unavailable",
     "storage_usage_unavailable",
     "stripe_error",
     "superseded_by_publish",
@@ -337,7 +359,6 @@ export const ERROR_CODES = [
     "upload_hash_mismatch",
     "upload_path_not_canonical",
     "upload_path_not_declared",
-    "upload_session_cap_exceeded",
     "upload_size_mismatch",
     "user_banned",
     "validation_error",
@@ -396,6 +417,12 @@ export const ERROR_CODES = [
     "zero_client_bundle_not_loaded",
     "zero_db_connect_failed",
     "zero_db_execute_failed",
+    "zero_db_export_cursor_invalid",
+    "zero_db_export_failed",
+    "zero_db_export_page_too_large",
+    "zero_db_export_query_invalid",
+    "zero_db_export_schema_changed",
+    "zero_db_export_schema_unavailable",
     "zero_db_host_install_failed",
     "zero_db_operation_invalid",
     "zero_db_operation_too_large",
@@ -403,6 +430,8 @@ export const ERROR_CODES = [
     "zero_db_query_failed",
     "zero_db_row_invalid",
     "zero_db_sql_invalid",
+    "zero_db_target_denied",
+    "zero_db_tls_required",
     "zero_db_too_many_params",
     "zero_db_transaction_active",
     "zero_db_transaction_commit_failed",
@@ -472,11 +501,6 @@ export const ERROR_CODES = [
     "zero_runs_require_runtime_compiler",
     "zero_runs_too_many",
     "zero_shopify_unavailable",
-    "zero_source_compile_failed",
-    "zero_source_hash_mismatch",
-    "zero_source_invalid",
-    "zero_source_path_invalid",
-    "zero_source_unreadable",
 ];
 const ERROR_CODE_SET = new Set(ERROR_CODES);
 export function isErrorCode(value) {

package/dist/contracts/events.d.ts

@@ -29,7 +29,7 @@ export type EventActor = z.infer<typeof eventActorSchema>;
 export declare const EVENT_CATALOG: {
     "client.page_viewed": {
         sources: ("www" | "dashboard")[];
-        actors: ("anonymous_id" | "analytics_id")[];
+        actors: ("analytics_id" | "anonymous_id")[];
         properties: z.ZodObject<{
             path: z.ZodString;
             referrer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -37,7 +37,7 @@ export declare const EVENT_CATALOG: {
     };
     "client.web_vital.measured": {
         sources: ("www" | "dashboard")[];
-        actors: ("anonymous_id" | "analytics_id")[];
+        actors: ("analytics_id" | "anonymous_id")[];
         properties: z.ZodObject<{
             metric: z.ZodEnum<{
                 CLS: "CLS";
@@ -51,11 +51,18 @@ export declare const EVENT_CATALOG: {
         }, z.core.$strict>;
     };
     "client.error.observed": {
-        sources: ("www" | "dashboard" | "cli" | "other")[];
-        actors: ("anonymous_id" | "analytics_id" | "anonymous_machine")[];
+        sources: ("www" | "dashboard")[];
+        actors: ("analytics_id" | "anonymous_id")[];
         properties: z.ZodObject<{
+            kind: z.ZodEnum<{
+                uncaught_exception: "uncaught_exception";
+                unhandled_rejection: "unhandled_rejection";
+            }>;
             error_class: z.ZodString;
-            path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            message: z.ZodNullable<z.ZodString>;
+            frames: z.ZodNullable<z.ZodString>;
+            fingerprint: z.ZodString;
+            path: z.ZodString;
         }, z.core.$strict>;
     };
     "cli.command.completed": {
@@ -69,27 +76,27 @@ export declare const EVENT_CATALOG: {
     };
     "browser.funnel.claim_page_viewed": {
         sources: ("www" | "dashboard")[];
-        actors: ("anonymous_id" | "analytics_id")[];
+        actors: ("analytics_id" | "anonymous_id")[];
         properties: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
     };
     "browser.funnel.claim_token_validated": {
         sources: ("www" | "dashboard")[];
-        actors: ("anonymous_id" | "analytics_id")[];
+        actors: ("analytics_id" | "anonymous_id")[];
         properties: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
     };
     "browser.funnel.space_claimed": {
         sources: ("www" | "dashboard")[];
-        actors: ("anonymous_id" | "analytics_id")[];
+        actors: ("analytics_id" | "anonymous_id")[];
         properties: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
     };
     "browser.funnel.claim_rescue_countdown_viewed": {
         sources: ("www" | "dashboard")[];
-        actors: ("anonymous_id" | "analytics_id")[];
+        actors: ("analytics_id" | "anonymous_id")[];
         properties: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
     };
     "browser.funnel.claim_reminder_requested": {
         sources: ("www" | "dashboard")[];
-        actors: ("anonymous_id" | "analytics_id")[];
+        actors: ("analytics_id" | "anonymous_id")[];
         properties: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
     };
     "domain.search.session_started": {
@@ -190,7 +197,7 @@ export declare const EVENT_CATALOG: {
     };
     "publish.receipt.created": {
         sources: "control-plane"[];
-        actors: ("system" | "anonymous_id" | "analytics_id")[];
+        actors: ("system" | "analytics_id" | "anonymous_id")[];
         properties: z.ZodObject<{
             access: z.ZodString;
             anonymous: z.ZodBoolean;
@@ -202,7 +209,7 @@ export declare const EVENT_CATALOG: {
     };
     "version.intent.created": {
         sources: "control-plane"[];
-        actors: ("system" | "anonymous_id" | "analytics_id")[];
+        actors: ("system" | "analytics_id" | "anonymous_id")[];
         properties: z.ZodObject<{
             access: z.ZodString;
             file_count: z.ZodNumber;
@@ -217,7 +224,7 @@ export declare const EVENT_CATALOG: {
     };
     "version.finalize.queued": {
         sources: "control-plane"[];
-        actors: ("system" | "anonymous_id" | "analytics_id")[];
+        actors: ("system" | "analytics_id" | "anonymous_id")[];
         properties: z.ZodObject<{
             access: z.ZodString;
             async: z.ZodBoolean;
@@ -228,7 +235,7 @@ export declare const EVENT_CATALOG: {
     };
     "version.promote.queued": {
         sources: "control-plane"[];
-        actors: ("system" | "anonymous_id" | "analytics_id")[];
+        actors: ("system" | "analytics_id" | "anonymous_id")[];
         properties: z.ZodObject<{
             access: z.ZodString;
             async: z.ZodBoolean;
@@ -237,7 +244,7 @@ export declare const EVENT_CATALOG: {
     };
     "feature.blocked": {
         sources: "control-plane"[];
-        actors: ("system" | "anonymous_id" | "analytics_id")[];
+        actors: ("system" | "analytics_id" | "anonymous_id")[];
         properties: z.ZodObject<{
             feature: z.ZodString;
             plan: z.ZodNullable<z.ZodString>;

package/dist/contracts/events.js

@@ -9,7 +9,7 @@ const occurredAtSchema = z
     .string()
     .datetime()
     .optional()
-    .describe("Client-side event time; the server receive time is authoritative when omitted.");
+    .describe("Client-side event time; server receipt time is authoritative when omitted.");
 const pathSchema = z
     .string()
     .min(1)
@@ -68,10 +68,38 @@ const webVitalPropertiesSchema = z
     path: pathSchema,
 })
     .strict();
+// An uncaught browser error is not a single label — `error.name` is "Error" for
+// almost every application throw, so a one-field shape both fails to attribute
+// and (because it feeds the sender's dedupe key) suppresses genuinely distinct
+// errors. Model the fingerprint instead: signal kind, thrown-value class,
+// redacted message, top frames, and a deterministic grouping key. Every string
+// stays within `propertyValueSchema`'s 512-char cap — the generic property bag
+// validates alongside this schema, so a longer field would 400 at ingest.
 const clientErrorPropertiesSchema = z
     .object({
-    error_class: z.string().min(1).max(128),
-    path: pathSchema.nullable().optional(),
+    kind: z
+        .enum(["uncaught_exception", "unhandled_rejection"])
+        .describe("Which browser signal produced this — orthogonal to what was thrown."),
+    error_class: z
+        .string()
+        .min(1)
+        .max(128)
+        .describe("Constructor name, or `NonError:<typeof>` when a non-Error was thrown."),
+    message: z
+        .string()
+        .max(512)
+        .nullable()
+        .describe("Redacted, truncated message; null when the thrown value carries none."),
+    frames: z
+        .string()
+        .max(512)
+        .nullable()
+        .describe("Top stack frames, newest first, origin-relative, ' | '-joined."),
+    fingerprint: z
+        .string()
+        .regex(/^[0-9a-z]{1,16}$/)
+        .describe("Deterministic dedupe/group key over kind, class, normalized message, top frame."),
+    path: pathSchema,
 })
     .strict();
 const cliCommandPropertiesSchema = z
@@ -184,8 +212,8 @@ export const EVENT_CATALOG = {
         properties: webVitalPropertiesSchema,
     },
     "client.error.observed": {
-        sources: ["dashboard", "www", "cli", "other"],
-        actors: ["analytics_id", "anonymous_id", "anonymous_machine"],
+        sources: ["dashboard", "www"],
+        actors: ["analytics_id", "anonymous_id"],
         properties: clientErrorPropertiesSchema,
     },
     "cli.command.completed": {

package/dist/contracts/execution.d.ts

@@ -0,0 +1,238 @@
+import { z } from "zod";
+/**
+ * The platform execution layer: everything true of running tenant code on
+ * Spacefast regardless of which product is running it.
+ *
+ * Two products sit on top of this file, and they are genuinely different
+ * things rather than two configurations of one thing:
+ *
+ * - **Zero** (`./zero.js`) runs capsules — schema, queries, mutations and
+ *   endpoints that share one parent-owned transaction — in the native runner
+ *   on a dedicated wp.cloud site, next to that site's MySQL.
+ * - **Functions** (`./functions.js`) runs workers on Cloudflare Workers for
+ *   Platforms, carrying npm and framework output that we could never sandbox
+ *   as well ourselves.
+ *
+ * The only surface both can host is an endpoint that touches neither the
+ * database nor the caller's identity — see `endpointIsPortable`. That is the
+ * portable seam, and it is deliberately narrow: a capsule handler's semantics
+ * depend on the transaction wrapped around it, which does not exist on an
+ * isolate a continent away from the database.
+ */
+/**
+ * What a live version runs. `static` is bytes on disk with no execution at
+ * all, and remains the overwhelming majority of traffic; the other two each
+ * name a product.
+ */
+export declare const runtimeKindSchema: z.ZodEnum<{
+    zero: "zero";
+    functions: "functions";
+    static: "static";
+}>;
+export type RuntimeKind = z.infer<typeof runtimeKindSchema>;
+/**
+ * How a live runtime delivers realtime invalidations.
+ *
+ * One vocabulary end to end: the finalize payload, the client config a serving
+ * runtime hands the browser, and every API response all name the transport
+ * with these three values. `central` is the hosted relay, `cast` is the
+ * collaboration service, and `local` is a dev machine serving its own socket —
+ * a distinction a customer can act on, unlike the component names the transports
+ * used to be called after.
+ */
+export declare const RUNTIME_REALTIME_MODES: readonly ["central", "cast", "local"];
+export declare const runtimeRealtimeModeSchema: z.ZodEnum<{
+    local: "local";
+    cast: "cast";
+    central: "central";
+}>;
+export type RuntimeRealtimeMode = z.infer<typeof runtimeRealtimeModeSchema>;
+export declare const EXECUTION_ENV_MAX_KEYS = 64;
+export declare const EXECUTION_ENV_NAME_MAX_BYTES = 128;
+export declare const EXECUTION_ENV_VALUE_MAX_BYTES: number;
+export declare const EXECUTION_ENV_TOTAL_VALUE_MAX_BYTES: number;
+/**
+ * Server-only variables for whichever runtime this version declares. Publish
+ * syncs the file into the space's variables as secrets; the shared publish
+ * denylist (`.env.*`) keeps the file itself out of every artifact, so the
+ * values reach the runtime through variables and never through content.
+ */
+export declare const SERVER_ENV_FILE = ".env.server";
+/** Lakebed's documented server-only env filename, accepted for capsule portability. */
+export declare const LAKEBED_SERVER_ENV_FILE = ".env.lakebed.server";
+/**
+ * Names the platform reserves for itself in the tenant environment. Tenant
+ * code cannot set these, so it cannot spoof the values the broker trusts.
+ */
+export declare const EXECUTION_ENV_RESERVED_PREFIXES: readonly ["SPACEFAST_", "ZERO_"];
+/** Paths the platform owns on every space, whatever the product. */
+export declare const PLATFORM_ROUTE_PREFIX = "/__spacefast";
+/**
+ * First path segments the platform claims. Matched as segment prefixes rather
+ * than whole segments because the runtime already reserves the whole family —
+ * `/__stattic_probe` is a live serving path, and `upload-policy.php` refuses
+ * any first segment starting with either of these. Encoding it the same way
+ * here keeps a capsule or worker from declaring a route the origin would
+ * intercept before it ever reached them.
+ */
+export declare const PLATFORM_RESERVED_ROUTE_SEGMENT_PREFIXES: readonly ["__spacefast", "__stattic", "__span"];
+export declare const executionSha256Schema: z.ZodString;
+export declare const executionBase64Schema: z.ZodString;
+export declare const executionIdentifierSchema: z.ZodString;
+export declare const executionEnvNameSchema: z.ZodString;
+/**
+ * Builds the route-path schema for a product. Structural rules — normalization,
+ * traversal, wildcards, the platform's own prefixes — are identical everywhere
+ * and live here. Each product passes the extra paths and prefixes its own app
+ * shell claims, because those differ: Zero's client router owns `/auth/*`,
+ * a Functions worker owns nothing beyond what the platform reserves.
+ */
+export declare function appRoutePathSchema(options: {
+    subject: string;
+    reservedPaths?: readonly string[];
+    reservedPrefixes?: readonly string[];
+}): z.ZodString;
+export declare const httpMethodSchema: z.ZodEnum<{
+    POST: "POST";
+    PUT: "PUT";
+    GET: "GET";
+    HEAD: "HEAD";
+    PATCH: "PATCH";
+    DELETE: "DELETE";
+    OPTIONS: "OPTIONS";
+}>;
+export type HttpMethod = z.infer<typeof httpMethodSchema>;
+/**
+ * What a handler is allowed to reach. Declared at build time from what the
+ * source actually imports, not from what the author claims, and printed in the
+ * publish receipt so placement is never a surprise.
+ */
+export declare const executionCapabilitiesSchema: z.ZodDefault<z.ZodObject<{
+    db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+}, z.core.$strip>>;
+export type ExecutionCapabilities = z.infer<typeof executionCapabilitiesSchema>;
+/**
+ * The portable seam, stated as one predicate.
+ *
+ * `db` and `auth` are the two capabilities that bind a handler to the local
+ * tier. `db` because Zero's store guarantees every handler runs inside one
+ * parent-owned transaction, which an isolate reaching the database over a
+ * relay cannot offer. `auth` because capsule identity is resolved against that
+ * same transaction's view. Everything else — fetch, env, realtime, logging —
+ * is brokered identically on both tiers and does not constrain placement.
+ *
+ * Nothing here decides placement automatically: the product a version deploys
+ * to is a property of what its author wrote, and this predicate only reports
+ * whether the code could also have run on the other tier.
+ */
+export declare function endpointIsPortable(capabilities: ExecutionCapabilities): boolean;
+/**
+ * A source-carrying handler, before it is compiled to whichever tier will run
+ * it. Both products publish these; only the capability set decides which of
+ * them could accept a given one.
+ */
+export declare function executionEndpointSourceSchema(routePathSchema: z.ZodType<string>): z.ZodObject<{
+    method: z.ZodEnum<{
+        POST: "POST";
+        PUT: "PUT";
+        GET: "GET";
+        HEAD: "HEAD";
+        PATCH: "PATCH";
+        DELETE: "DELETE";
+        OPTIONS: "OPTIONS";
+    }>;
+    path: z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>;
+    endpointId: z.ZodString;
+    source: z.ZodString;
+    capabilities: z.ZodDefault<z.ZodObject<{
+        db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+/**
+ * Byte-carrying artifacts travel inline in the finalize payload rather than as
+ * a separate upload, so a version's code lands in the same atomic write as the
+ * rest of it. The storage root and ceiling differ per product, hence a factory.
+ */
+export declare function executionBundleSchema(options: {
+    bundleRoot: string;
+    maxBytes: number;
+}): z.ZodObject<{
+    path: z.ZodString;
+    sha256: z.ZodString;
+    size: z.ZodNumber;
+    contentBase64: z.ZodString;
+}, z.core.$strict>;
+export declare function executionStaticFileSchema(options: {
+    storageRoot: string;
+    maxBytes: number;
+}): z.ZodObject<{
+    path: z.ZodString;
+    contentType: z.ZodString;
+    sha256: z.ZodString;
+    size: z.ZodNumber;
+    contentBase64: z.ZodString;
+}, z.core.$strict>;
+/**
+ * Whether a version's execution surface may be read by anyone or only by the
+ * space's own members. Both products expose an inspect route; the policy is
+ * the same question on each.
+ */
+export declare const executionInspectPolicySchema: z.ZodEnum<{
+    public: "public";
+    private: "private";
+}>;
+export type ExecutionInspectPolicy = z.infer<typeof executionInspectPolicySchema>;
+export declare const executionLogEntrySchema: z.ZodObject<{
+    id: z.ZodString;
+    timestamp: z.ZodString;
+    level: z.ZodEnum<{
+        info: "info";
+        error: "error";
+        debug: "debug";
+        warn: "warn";
+    }>;
+    requestId: z.ZodNullable<z.ZodString>;
+    versionId: z.ZodNullable<z.ZodString>;
+    handlerName: z.ZodNullable<z.ZodString>;
+    message: z.ZodString;
+    metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type ExecutionLogEntry = z.infer<typeof executionLogEntrySchema>;
+export declare const executionLogListQuerySchema: z.ZodObject<{
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    cursor: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    handlerName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type ExecutionLogListQuery = z.infer<typeof executionLogListQuerySchema>;
+export declare const executionLogListResponseSchema: z.ZodObject<{
+    data: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        timestamp: z.ZodString;
+        level: z.ZodEnum<{
+            info: "info";
+            error: "error";
+            debug: "debug";
+            warn: "warn";
+        }>;
+        requestId: z.ZodNullable<z.ZodString>;
+        versionId: z.ZodNullable<z.ZodString>;
+        handlerName: z.ZodNullable<z.ZodString>;
+        message: z.ZodString;
+        metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+    pagination: z.ZodObject<{
+        nextCursor: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ExecutionLogListResponse = z.infer<typeof executionLogListResponseSchema>;