@spacefast/common 0.0.13 → 0.0.17

package/dist/contracts/grants.js

@@ -104,16 +104,16 @@ export const grantResourcePatternSchema = z
     .string()
     .min(1)
     .max(1024)
-    .transform((value, context) => {
+    .check((context) => {
     try {
-        return normalizeGrantResourcePattern(value);
+        context.value = normalizeGrantResourcePattern(context.value);
     }
     catch (error) {
-        context.addIssue({
+        context.issues.push({
             code: "custom",
+            input: context.value,
             message: error instanceof Error ? error.message : "invalid resource pattern",
         });
-        return z.NEVER;
     }
 });
 function uniqueArray(values) {
@@ -244,53 +244,54 @@ const grantNetworkCidrSchema = z
     .string()
     .min(1)
     .max(64)
-    .transform((value, context) => {
+    .check((context) => {
     try {
-        return normalizeGrantNetworkCidr(value);
+        context.value = normalizeGrantNetworkCidr(context.value);
     }
     catch (error) {
-        context.addIssue({
+        context.issues.push({
             code: "custom",
+            input: context.value,
             message: error instanceof Error ? error.message : "invalid network rule",
         });
-        return z.NEVER;
     }
 });
 const grantCountrySchema = z
     .string()
     .length(2)
-    .transform((country) => country.toUpperCase())
+    .overwrite((country) => country.toUpperCase())
     .refine((country) => ISO_COUNTRY_CODES.includes(country), "Country must be an ISO 3166-1 alpha-2 code.");
+const grantConstraintDateSchema = z.string().datetime();
+const grantConstraintMaxUsesSchema = z.number().int().positive().max(1_000_000);
+const grantConstraintIpCidrsSchema = z.array(grantNetworkCidrSchema).min(1).max(50);
+const grantConstraintCountriesSchema = z.array(grantCountrySchema).min(1).max(250);
+const grantConstraintUserAgentsSchema = z.array(z.string().trim().min(1).max(200)).min(1).max(50);
+const grantNetworkConstraintsSchema = z
+    .object({
+    ipCidrs: grantConstraintIpCidrsSchema.optional(),
+    countries: grantConstraintCountriesSchema.optional(),
+    excludedCountries: grantConstraintCountriesSchema.optional(),
+    excludedUserAgentSubstrings: grantConstraintUserAgentsSchema.optional(),
+})
+    .strict()
+    .superRefine((network, context) => {
+    if (network.ipCidrs === undefined &&
+        network.countries === undefined &&
+        network.excludedCountries === undefined &&
+        network.excludedUserAgentSubstrings === undefined) {
+        context.addIssue({
+            code: "custom",
+            message: "network requires at least one IP, country, or user-agent selector",
+        });
+    }
+});
 export const grantConstraintsSchema = z
     .object({
-    notBefore: z.string().datetime().optional(),
-    expiresAt: z.string().datetime().optional(),
-    maxUses: z.number().int().positive().max(1_000_000).optional(),
+    notBefore: grantConstraintDateSchema.optional(),
+    expiresAt: grantConstraintDateSchema.optional(),
+    maxUses: grantConstraintMaxUsesSchema.optional(),
     requireVerifiedEmail: z.boolean().optional(),
-    network: z
-        .object({
-        ipCidrs: z.array(grantNetworkCidrSchema).min(1).max(50).optional(),
-        countries: z.array(grantCountrySchema).min(1).max(250).optional(),
-        excludedCountries: z.array(grantCountrySchema).min(1).max(250).optional(),
-        excludedUserAgentSubstrings: z
-            .array(z.string().trim().min(1).max(200))
-            .min(1)
-            .max(50)
-            .optional(),
-    })
-        .strict()
-        .superRefine((network, context) => {
-        if (network.ipCidrs === undefined &&
-            network.countries === undefined &&
-            network.excludedCountries === undefined &&
-            network.excludedUserAgentSubstrings === undefined) {
-            context.addIssue({
-                code: "custom",
-                message: "network requires at least one IP, country, or user-agent selector",
-            });
-        }
-    })
-        .optional(),
+    network: grantNetworkConstraintsSchema.optional(),
 })
     .strict()
     .superRefine((value, context) => {
@@ -304,9 +305,98 @@ export const grantConstraintsSchema = z
         });
     }
 });
+/** Field-scoped PATCH shape. `null` clears one constraint without replacing its siblings. */
+export const grantConstraintsPatchSchema = z
+    .object({
+    notBefore: grantConstraintDateSchema.nullable().optional(),
+    expiresAt: grantConstraintDateSchema.nullable().optional(),
+    maxUses: grantConstraintMaxUsesSchema.nullable().optional(),
+    requireVerifiedEmail: z.boolean().nullable().optional(),
+    network: z
+        .object({
+        ipCidrs: grantConstraintIpCidrsSchema.nullable().optional(),
+        countries: grantConstraintCountriesSchema.nullable().optional(),
+        excludedCountries: grantConstraintCountriesSchema.nullable().optional(),
+        excludedUserAgentSubstrings: grantConstraintUserAgentsSchema.nullable().optional(),
+    })
+        .strict()
+        .nullable()
+        .optional(),
+})
+    .strict();
+export function diffGrantConstraints(original, draft) {
+    const network = JSON.stringify(original.network) === JSON.stringify(draft.network)
+        ? undefined
+        : draft.network === undefined
+            ? null
+            : {
+                ...(JSON.stringify(original.network?.ipCidrs) === JSON.stringify(draft.network.ipCidrs)
+                    ? {}
+                    : { ipCidrs: draft.network.ipCidrs ?? null }),
+                ...(JSON.stringify(original.network?.countries) ===
+                    JSON.stringify(draft.network.countries)
+                    ? {}
+                    : { countries: draft.network.countries ?? null }),
+                ...(JSON.stringify(original.network?.excludedCountries) ===
+                    JSON.stringify(draft.network.excludedCountries)
+                    ? {}
+                    : { excludedCountries: draft.network.excludedCountries ?? null }),
+                ...(JSON.stringify(original.network?.excludedUserAgentSubstrings) ===
+                    JSON.stringify(draft.network.excludedUserAgentSubstrings)
+                    ? {}
+                    : {
+                        excludedUserAgentSubstrings: draft.network.excludedUserAgentSubstrings ?? null,
+                    }),
+            };
+    const patch = {
+        ...(original.notBefore === draft.notBefore ? {} : { notBefore: draft.notBefore ?? null }),
+        ...(original.expiresAt === draft.expiresAt ? {} : { expiresAt: draft.expiresAt ?? null }),
+        ...(original.maxUses === draft.maxUses ? {} : { maxUses: draft.maxUses ?? null }),
+        ...(original.requireVerifiedEmail === draft.requireVerifiedEmail
+            ? {}
+            : { requireVerifiedEmail: draft.requireVerifiedEmail ?? null }),
+        ...(network === undefined ? {} : { network }),
+    };
+    return Object.keys(patch).length === 0 ? undefined : patch;
+}
+export function applyGrantConstraintsPatch(current, patch) {
+    const network = patch.network === undefined
+        ? current.network
+        : patch.network === null
+            ? undefined
+            : {
+                ...current.network,
+                ...(patch.network.ipCidrs === undefined
+                    ? {}
+                    : { ipCidrs: patch.network.ipCidrs ?? undefined }),
+                ...(patch.network.countries === undefined
+                    ? {}
+                    : { countries: patch.network.countries ?? undefined }),
+                ...(patch.network.excludedCountries === undefined
+                    ? {}
+                    : { excludedCountries: patch.network.excludedCountries ?? undefined }),
+                ...(patch.network.excludedUserAgentSubstrings === undefined
+                    ? {}
+                    : {
+                        excludedUserAgentSubstrings: patch.network.excludedUserAgentSubstrings ?? undefined,
+                    }),
+            };
+    const compactNetwork = network && Object.values(network).some((value) => value !== undefined) ? network : undefined;
+    return grantConstraintsSchema.parse({
+        ...current,
+        ...(patch.notBefore === undefined ? {} : { notBefore: patch.notBefore ?? undefined }),
+        ...(patch.expiresAt === undefined ? {} : { expiresAt: patch.expiresAt ?? undefined }),
+        ...(patch.maxUses === undefined ? {} : { maxUses: patch.maxUses ?? undefined }),
+        ...(patch.requireVerifiedEmail === undefined
+            ? {}
+            : { requireVerifiedEmail: patch.requireVerifiedEmail ?? undefined }),
+        network: compactNetwork,
+    });
+}
 export const GRANT_SOURCE_KINDS = ["config", "managed", "system"];
 export const grantSourceKindSchema = z.enum(GRANT_SOURCE_KINDS);
 export const PRECLAIM_OPEN_GRANT_SOURCE_REFERENCE = "open:preclaim-author";
+export const SPACE_OPEN_GRANT_SOURCE_REFERENCE = "open:space";
 export const OWNING_TEAM_MANAGEMENT_GRANT_SOURCE_REFERENCE = "ownership:team";
 export const OWNING_TEAM_VERSION_GRANT_SOURCE_REFERENCE = "ownership:team:versions";
 export const OWNING_EXTERNAL_MANAGEMENT_GRANT_SOURCE_REFERENCE = "ownership:external";
@@ -380,14 +470,11 @@ const grantObjectSchema = grantDimensionsSchema.extend({
 });
 function validateGrantCapabilityBoundary(value, context) {
     validateGrantAudienceCapabilityBoundary(value, context);
-    if (value.audience.kind === "link" &&
-        value.capabilities.includes("content.publish") &&
-        (value.source.kind !== "system" ||
-            value.source.reference !== PRECLAIM_OPEN_GRANT_SOURCE_REFERENCE)) {
+    if (value.audience.kind === "link" && value.capabilities.includes("content.publish")) {
         context.addIssue({
             code: "custom",
             path: ["capabilities"],
-            message: "link audiences can publish only through the system-issued pre-claim Open author Grant",
+            message: "link audiences cannot publish content",
         });
     }
 }
@@ -538,7 +625,7 @@ const credentialGrantFields = {
 export const passwordCredentialCreateSchema = z
     .object({
     ...credentialGrantFields,
-    password: z.string().min(10).max(1024),
+    password: z.string().min(1).max(1024),
 })
     .strict()
     .superRefine((value, context) => {
@@ -552,7 +639,7 @@ export const passwordCredentialCreateSchema = z
     }
 });
 export const passwordCredentialRotateSchema = z
-    .object({ password: z.string().min(10).max(1024) })
+    .object({ password: z.string().min(1).max(1024) })
     .strict();
 export const machineCredentialCreateSchema = z
     .object(credentialGrantFields)

package/dist/contracts/ids.d.ts

@@ -19,6 +19,7 @@ export declare const ID_PREFIXES: {
     readonly whd: "WebhookDelivery";
     readonly rec: "DnsRecord";
     readonly evt: "ActivityEvent";
+    readonly ntf: "Notification";
     readonly pvc: "ProviderClient";
     readonly tgs: "TagSet";
     readonly tgv: "TagVersion";
@@ -33,13 +34,12 @@ export declare const ID_PREFIXES: {
     readonly acn: "IdentityConnection";
     readonly pwd: "SpacePasswordCredential";
     readonly mch: "SpaceMachineCredential";
-    readonly mnt: "StaticMount";
 };
 export type IdPrefix = keyof typeof ID_PREFIXES;
 /** Any registered public resource id, e.g. `spc_…` or `ver_…`. */
 export type Id = `${IdPrefix}_${string}`;
 /** Validate an id belonging to one registered public resource family. */
-export declare function registeredIdSchema<P extends IdPrefix>(prefix: P): z.ZodCustom<`${P}_${string}`, `${P}_${string}`>;
+export declare function registeredIdSchema<P extends IdPrefix>(prefix: P): z.ZodTemplateLiteral<`${`${P}_` extends infer T extends string | number | bigint | boolean | null | undefined ? T extends undefined ? "" : T : never}${string}`>;
 export declare const MAIN_TENANT_ID = "ten_main";
 /** Mint a globally unique id for a registered public resource prefix. */
 export declare function createId<P extends IdPrefix>(prefix: P): `${P}_${string}`;

package/dist/contracts/ids.js

@@ -26,6 +26,7 @@ export const ID_PREFIXES = {
     whd: "WebhookDelivery",
     rec: "DnsRecord",
     evt: "ActivityEvent",
+    ntf: "Notification",
     pvc: "ProviderClient",
     tgs: "TagSet",
     tgv: "TagVersion",
@@ -41,13 +42,10 @@ export const ID_PREFIXES = {
     acn: "IdentityConnection",
     pwd: "SpacePasswordCredential",
     mch: "SpaceMachineCredential",
-    mnt: "StaticMount",
 };
 /** Validate an id belonging to one registered public resource family. */
 export function registeredIdSchema(prefix) {
-    return z.custom((value) => typeof value === "string" &&
-        value.startsWith(`${prefix}_`) &&
-        /^[A-Za-z0-9]+$/.test(value.slice(prefix.length + 1)), `Invalid ${ID_PREFIXES[prefix]} id`);
+    return z.templateLiteral([z.literal(`${prefix}_`), z.string().regex(/^[A-Za-z0-9]+$/)], `Invalid ${ID_PREFIXES[prefix]} id`);
 }
 // The main Stattic tenant every self-serve team/user/resource lives under. A
 // well-known CONSTANT, never configuration: grammatically a normal tenant id with

package/dist/contracts/internal.js

@@ -30,7 +30,7 @@ export const pendingUploadSchema = manifestFileSchema.pick({
 });
 export const uploadSessionModeSchema = z
     .enum(["dist", "source"])
-    .describe("`dist` bytes are deployable output; `source` bytes must be transformed, unpacked, or built before deploy.");
+    .describe("`dist` bytes are publishable output. `source` bytes must be transformed, unpacked, or built before publish.");
 export const uploadTargetSchema = z.object({
     path: z.string().describe("Caller-local path/key identifying the bytes this target accepts."),
     method: z.enum(["PUT", "POST"]).describe("HTTP method to use for this target."),
@@ -66,7 +66,7 @@ export const uploadInstructionsSchema = z.object({
     expiresAt: z
         .string()
         .datetime()
-        .describe("Session-token expiry. Token rotation only, never a version-lifecycle boundary: resume always mints a fresh token."),
+        .describe("Instant when the session token expires. This rotates only the token, never the version lifecycle boundary. Resume always mints a fresh token."),
     summary: z
         .object({
         upload: z.number().int().nonnegative().describe("Files that still need uploading."),