@spacefast/common 0.0.2

package/dist/utils/runtime-upload.d.ts

@@ -0,0 +1,19 @@
+export declare const RUNTIME_UPLOAD_METHOD: "PUT";
+export declare function runtimeUploadCanonicalPath(path: string): string;
+export declare function runtimeUploadSessionBaseUrl(input: {
+    baseUrl: string;
+    uploadId: string;
+}): string;
+export declare function runtimeUploadBatchUrl(input: {
+    baseUrl: string;
+    uploadId: string;
+}): string;
+export declare function runtimeUploadFetchUrl(input: {
+    baseUrl: string;
+    uploadId: string;
+    path: string;
+}): string;
+export declare function runtimeUploadFileUrl(input: {
+    baseUrl: string;
+    path: string;
+}): string;

package/dist/utils/runtime-upload.js

@@ -0,0 +1,27 @@
+import { runtimeUploadPath } from "./runtime-paths.js";
+export const RUNTIME_UPLOAD_METHOD = "PUT";
+export function runtimeUploadCanonicalPath(path) {
+    // Canonical path form (spec "Upload Contract"): UTF-8, Unicode NFC,
+    // percent-encoded once. The runtime rejects non-canonical encodings.
+    return path
+        .normalize("NFC")
+        .split("/")
+        .map((segment) => encodeURIComponent(segment))
+        .join("/");
+}
+export function runtimeUploadSessionBaseUrl(input) {
+    return new URL(runtimeUploadPath({ op: "file", upload_id: input.uploadId, path: "" }), input.baseUrl).toString();
+}
+export function runtimeUploadBatchUrl(input) {
+    return new URL(runtimeUploadPath({ op: "batch", upload_id: input.uploadId }), input.baseUrl).toString();
+}
+export function runtimeUploadFetchUrl(input) {
+    return new URL(runtimeUploadPath({
+        op: "fetch",
+        upload_id: input.uploadId,
+        path: runtimeUploadCanonicalPath(input.path),
+    }), input.baseUrl).toString();
+}
+export function runtimeUploadFileUrl(input) {
+    return `${input.baseUrl}${runtimeUploadCanonicalPath(input.path)}`;
+}

package/dist/utils/slug.d.ts

@@ -0,0 +1,5 @@
+type NormalizeSlugOptions = {
+    maxLength?: number;
+};
+export declare function normalizeSlug(input: string, options?: NormalizeSlugOptions): string;
+export {};

package/dist/utils/slug.js

@@ -0,0 +1,13 @@
+export function normalizeSlug(input, options) {
+    const maxLength = options?.maxLength ?? Number.POSITIVE_INFINITY;
+    return input
+        .trim()
+        .normalize("NFKD")
+        .replace(/[\u0300-\u036f]/g, "")
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .replace(/-{2,}/g, "-")
+        .slice(0, maxLength)
+        .replace(/^-+|-+$/g, "");
+}

package/dist/utils/space-config.d.ts

@@ -0,0 +1,75 @@
+import { type SpaceConfig, type SpaceConfigFile } from "../contracts/space-config.js";
+export type SpaceConfigBlockingIssueCode = "config_file_too_large" | "config_templates_over_limit" | "config_meta_too_long" | "config_invalid" | "inject_snippet_too_large" | "inject_invalid";
+export type SpaceConfigIssue = {
+    severity: "info" | "warning" | "error";
+    code: SpaceConfigBlockingIssueCode | "single_html_index" | "files_mode_inferred";
+    message: string;
+    /** JSON-path-lite pointer into the config shape (e.g. `meta.title`). */
+    path?: string;
+    details?: Record<string, unknown>;
+};
+type SpaceConfigBlockingIssue = SpaceConfigIssue & {
+    code: SpaceConfigBlockingIssueCode;
+};
+/**
+ * Validates a space `config` overlay at API intake (PATCH /spaces, publish
+ * `config`): the 16 KB compiled-overlay cap plus the shared shape caps.
+ * Returns the first blocking issue, or null when the overlay is acceptable.
+ */
+export declare function spaceConfigOverlayIssue(config: SpaceConfig): SpaceConfigBlockingIssue | null;
+export declare function stripJsonComments(raw: string): string;
+export type ParsedSpaceConfigFile = {
+    /** Parsed config (cap- and shape-valid keys only); null when unusable. */
+    config: SpaceConfigFile | null;
+    issues: SpaceConfigIssue[];
+};
+/**
+ * Parses a raw `sf.jsonc` at finalize: 256 KB cap, JSONC tolerance,
+ * routing-key rejection, unknown-key diagnostics, shared shape caps. Errors
+ * fail the version; warnings ride version diagnostics.
+ */
+export declare function parseSpaceConfigFile(raw: string, options?: {
+    path?: string;
+}): ParsedSpaceConfigFile;
+export type ResolvedServingConfig = {
+    index: string | false;
+    fallback: {
+        path: string;
+        status: 200 | 404;
+    } | null;
+    listing: boolean;
+    viewer: boolean;
+    meta: NonNullable<SpaceConfig["meta"]> | null;
+    /** Hidden experimental build-pipeline flag; false keeps today's behavior. */
+    experimentalGutenberg: boolean;
+    /** Resolved inject snippets; only honored when experimentalGutenberg is true. */
+    inject: NonNullable<SpaceConfig["inject"]> | null;
+};
+export type EffectiveSpaceConfig = {
+    /** The merged SpaceConfig (defaults + file + overlay, key-wise). */
+    config: SpaceConfig;
+    /** Compiled serving primitives the runtime artifact stores. */
+    serving: ResolvedServingConfig;
+    issues: SpaceConfigIssue[];
+};
+/**
+ * Resolves the effective SpaceConfig for a version at finalize (or
+ * config-only regeneration). `manifestPaths` is the canonical committed file
+ * set; `fileConfig` the parsed sf.jsonc (null when absent); `overlay`
+ * the stored space config overlay (null when nothing overridden).
+ */
+export declare function resolveEffectiveSpaceConfig(input: {
+    manifestPaths: ReadonlySet<string>;
+    fileConfig: SpaceConfig | null;
+    overlay: SpaceConfig | null;
+}): EffectiveSpaceConfig;
+export type SpaceSettingsPatch = {
+    mode?: "website" | "files" | undefined;
+    spa?: boolean | undefined;
+    viewer?: {
+        title?: string | null | undefined;
+        description?: string | null | undefined;
+        ogImagePath?: string | null | undefined;
+    } | undefined;
+};
+export {};

package/dist/utils/space-config.js

@@ -0,0 +1,415 @@
+import { SPACE_CONFIG_CAPS, SPACE_CONFIG_CANONICAL_FILE, SPACE_CONFIG_PRIVATE_FILES, spaceConfigFileSchema, spaceConfigSchema, } from "../contracts/space-config.js";
+const TEXT_BYTES = new TextEncoder();
+function byteLength(value) {
+    return TEXT_BYTES.encode(value).length;
+}
+function capIssues(candidate) {
+    const issues = [];
+    const templates = candidate.templates;
+    if (Array.isArray(templates) && templates.length > SPACE_CONFIG_CAPS.templates) {
+        issues.push({
+            severity: "error",
+            code: "config_templates_over_limit",
+            message: `templates supports up to ${SPACE_CONFIG_CAPS.templates} entries.`,
+            path: "templates",
+            details: { count: templates.length, limit: SPACE_CONFIG_CAPS.templates },
+        });
+    }
+    // inject snippets (hidden feature, honored only with experimental_gutenberg):
+    // shape and byte caps fail with the stable codes here, before zod, so intake
+    // reports inject_invalid / inject_snippet_too_large instead of shape errors.
+    const inject = candidate.inject;
+    if (inject !== undefined) {
+        if (typeof inject !== "object" || inject === null || Array.isArray(inject)) {
+            issues.push({
+                severity: "error",
+                code: "inject_invalid",
+                message: "inject must be an object with static-placement snippet arrays.",
+                path: "inject",
+            });
+        }
+        else {
+            for (const key of ["head", "bodyStart", "bodyEnd", "noscript"]) {
+                const snippets = inject[key];
+                if (snippets === undefined) {
+                    continue;
+                }
+                if (!Array.isArray(snippets)) {
+                    issues.push({
+                        severity: "error",
+                        code: "inject_invalid",
+                        message: `inject.${key} must be an array of snippet strings.`,
+                        path: `inject.${key}`,
+                    });
+                    continue;
+                }
+                if (snippets.length > SPACE_CONFIG_CAPS.injectSnippets) {
+                    issues.push({
+                        severity: "error",
+                        code: "inject_invalid",
+                        message: `inject.${key} supports up to ${SPACE_CONFIG_CAPS.injectSnippets} snippets.`,
+                        path: `inject.${key}`,
+                        details: { count: snippets.length, limit: SPACE_CONFIG_CAPS.injectSnippets },
+                    });
+                }
+                snippets.forEach((snippet, index) => {
+                    if (typeof snippet !== "string") {
+                        issues.push({
+                            severity: "error",
+                            code: "inject_invalid",
+                            message: `inject.${key}[${index}] must be a string.`,
+                            path: `inject.${key}.${index}`,
+                        });
+                    }
+                    else if (byteLength(snippet) > SPACE_CONFIG_CAPS.injectSnippetBytes) {
+                        issues.push({
+                            severity: "error",
+                            code: "inject_snippet_too_large",
+                            message: `inject.${key}[${index}] supports up to ${SPACE_CONFIG_CAPS.injectSnippetBytes} bytes.`,
+                            path: `inject.${key}.${index}`,
+                            details: { size: byteLength(snippet), limit: SPACE_CONFIG_CAPS.injectSnippetBytes },
+                        });
+                    }
+                });
+            }
+        }
+    }
+    const meta = candidate.meta;
+    if (meta && typeof meta === "object") {
+        const caps = [
+            ["title", SPACE_CONFIG_CAPS.metaTitleChars],
+            ["description", SPACE_CONFIG_CAPS.metaDescriptionChars],
+            ["image", SPACE_CONFIG_CAPS.metaImageChars],
+        ];
+        for (const [key, limit] of caps) {
+            const value = meta[key];
+            if (typeof value === "string" && value.length > limit) {
+                issues.push({
+                    severity: "error",
+                    code: "config_meta_too_long",
+                    message: `meta.${key} supports up to ${limit} characters.`,
+                    path: `meta.${key}`,
+                    details: { length: value.length, limit },
+                });
+            }
+        }
+    }
+    return issues;
+}
+/**
+ * Validates a space `config` overlay at API intake (PATCH /spaces, publish
+ * `config`): the 16 KB compiled-overlay cap plus the shared shape caps.
+ * Returns the first blocking issue, or null when the overlay is acceptable.
+ */
+export function spaceConfigOverlayIssue(config) {
+    const encoded = JSON.stringify(config);
+    if (byteLength(encoded) > SPACE_CONFIG_CAPS.overlayBytes) {
+        return {
+            severity: "error",
+            code: "config_file_too_large",
+            message: `Space config overlays support up to ${SPACE_CONFIG_CAPS.overlayBytes} bytes.`,
+            path: "config",
+            details: { size: byteLength(encoded), limit: SPACE_CONFIG_CAPS.overlayBytes },
+        };
+    }
+    return capIssues(config)[0] ?? null;
+}
+// Routing concerns never live in sf.jsonc (spec: redirects, rewrites,
+// proxies, and headers stay exclusively in `_redirects`/`_headers`).
+const ROUTING_KEYS = new Set(["redirects", "rewrites", "proxies", "proxy", "headers", "routes"]);
+const KNOWN_FILE_KEYS = new Set(Object.keys(spaceConfigFileSchema.shape));
+// Strips JSONC comments and trailing commas (string-aware single pass).
+export function stripJsonComments(raw) {
+    let output = "";
+    let inString = false;
+    let inLineComment = false;
+    let inBlockComment = false;
+    for (let i = 0; i < raw.length; i += 1) {
+        const char = raw[i];
+        const next = raw[i + 1];
+        if (inLineComment) {
+            if (char === "\n") {
+                inLineComment = false;
+                output += char;
+            }
+            continue;
+        }
+        if (inBlockComment) {
+            if (char === "*" && next === "/") {
+                inBlockComment = false;
+                i += 1;
+            }
+            continue;
+        }
+        if (inString) {
+            output += char;
+            if (char === "\\") {
+                output += next ?? "";
+                i += 1;
+            }
+            else if (char === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (char === '"') {
+            inString = true;
+            output += char;
+            continue;
+        }
+        if (char === "/" && next === "/") {
+            inLineComment = true;
+            i += 1;
+            continue;
+        }
+        if (char === "/" && next === "*") {
+            inBlockComment = true;
+            i += 1;
+            continue;
+        }
+        if (char === ",") {
+            // Trailing comma: skip when the next non-whitespace/non-comment char closes.
+            let j = i + 1;
+            while (j < raw.length) {
+                const ahead = raw[j];
+                if (/\s/.test(ahead)) {
+                    j += 1;
+                    continue;
+                }
+                if (ahead === "/" && raw[j + 1] === "/") {
+                    while (j < raw.length && raw[j] !== "\n")
+                        j += 1;
+                    continue;
+                }
+                if (ahead === "/" && raw[j + 1] === "*") {
+                    j += 2;
+                    while (j < raw.length && !(raw[j] === "*" && raw[j + 1] === "/"))
+                        j += 1;
+                    j += 2;
+                    continue;
+                }
+                break;
+            }
+            if (raw[j] === "}" || raw[j] === "]") {
+                continue;
+            }
+        }
+        output += char;
+    }
+    return output;
+}
+/**
+ * Parses a raw `sf.jsonc` at finalize: 256 KB cap, JSONC tolerance,
+ * routing-key rejection, unknown-key diagnostics, shared shape caps. Errors
+ * fail the version; warnings ride version diagnostics.
+ */
+export function parseSpaceConfigFile(raw, options = {}) {
+    const configPath = options.path ?? SPACE_CONFIG_CANONICAL_FILE;
+    if (byteLength(raw) > SPACE_CONFIG_CAPS.fileBytes) {
+        return {
+            config: null,
+            issues: [
+                {
+                    severity: "error",
+                    code: "config_file_too_large",
+                    message: `${configPath} supports up to ${SPACE_CONFIG_CAPS.fileBytes} bytes.`,
+                    path: configPath,
+                    details: { size: byteLength(raw), limit: SPACE_CONFIG_CAPS.fileBytes },
+                },
+            ],
+        };
+    }
+    let candidate;
+    try {
+        candidate = JSON.parse(stripJsonComments(raw));
+    }
+    catch (error) {
+        return {
+            config: null,
+            issues: [
+                {
+                    severity: "error",
+                    code: "config_invalid",
+                    message: `${configPath} is not valid JSONC: ${error instanceof Error ? error.message : "parse error"}.`,
+                    path: configPath,
+                },
+            ],
+        };
+    }
+    if (typeof candidate !== "object" || candidate === null || Array.isArray(candidate)) {
+        return {
+            config: null,
+            issues: [
+                {
+                    severity: "error",
+                    code: "config_invalid",
+                    message: `${configPath} must contain a JSON object.`,
+                    path: configPath,
+                },
+            ],
+        };
+    }
+    const record = candidate;
+    const issues = [];
+    for (const key of Object.keys(record)) {
+        if (KNOWN_FILE_KEYS.has(key)) {
+            continue;
+        }
+        if (ROUTING_KEYS.has(key)) {
+            issues.push({
+                severity: "error",
+                code: "config_invalid",
+                message: `Routing never lives in ${configPath}; move "${key}" into _redirects/_headers.`,
+                path: key,
+            });
+        }
+        else {
+            issues.push({
+                severity: "warning",
+                code: "config_invalid",
+                message: `Unknown ${configPath} key "${key}" was ignored.`,
+                path: key,
+            });
+        }
+        delete record[key];
+    }
+    const caps = capIssues(record);
+    issues.push(...caps);
+    if (issues.some((issue) => issue.severity === "error")) {
+        return { config: null, issues };
+    }
+    const parsed = spaceConfigFileSchema.safeParse(record);
+    if (!parsed.success) {
+        for (const issue of parsed.error.issues) {
+            issues.push({
+                severity: "error",
+                code: "config_invalid",
+                message: issue.message,
+                path: issue.path.map(String).join(".") || configPath,
+            });
+        }
+        return { config: null, issues };
+    }
+    return { config: parsed.data, issues };
+}
+// Mirrors the runtime's private-file rules (_stattic_runtime_file_private):
+// convention/config files and dot-segment paths never serve, so they don't
+// count toward root HTML inference below.
+const PRIVATE_SERVING_FILES = new Set([
+    "_redirects",
+    "_headers",
+    "_config.json",
+    "_routes.json",
+    ...SPACE_CONFIG_PRIVATE_FILES,
+]);
+function privateServingPath(path) {
+    if (PRIVATE_SERVING_FILES.has(path) || path === ".well-known/stattic-runtime") {
+        return true;
+    }
+    const segments = path.toLowerCase().split("/");
+    return segments.some((segment, index) => !(index === 0 && segment === ".well-known") && segment.startsWith("."));
+}
+function rootHtmlPaths(manifestPaths) {
+    const htmlPaths = [];
+    for (const path of manifestPaths) {
+        if (path === "" || privateServingPath(path)) {
+            continue;
+        }
+        if (!path.includes("/") && /\.html?$/i.test(path)) {
+            htmlPaths.push(path);
+        }
+    }
+    return htmlPaths.toSorted((left, right) => left.localeCompare(right));
+}
+function normalizeFallback(fallback) {
+    if (fallback === undefined) {
+        return null;
+    }
+    if (typeof fallback === "string") {
+        return { path: fallback.replace(/^\/+/, ""), status: 200 };
+    }
+    const status = fallback.status === 404 ? 404 : 200;
+    return { path: fallback.path.replace(/^\/+/, ""), status };
+}
+/**
+ * Resolves the effective SpaceConfig for a version at finalize (or
+ * config-only regeneration). `manifestPaths` is the canonical committed file
+ * set; `fileConfig` the parsed sf.jsonc (null when absent); `overlay`
+ * the stored space config overlay (null when nothing overridden).
+ */
+export function resolveEffectiveSpaceConfig(input) {
+    const rootHtml = rootHtmlPaths(input.manifestPaths);
+    const hasRootIndex = rootHtml.includes("index.html");
+    const inferredRootHtmlIndex = hasRootIndex ? "index.html" : (rootHtml[0] ?? null);
+    const explicitServingShape = input.fileConfig?.index !== undefined ||
+        input.fileConfig?.listing !== undefined ||
+        input.overlay?.index !== undefined ||
+        input.overlay?.listing !== undefined;
+    // Content-inferred defaults (spec: the old website/files modes are exactly
+    // these two default bundles; never API fields). A root index.html always
+    // means website mode. Without it, any root-level HTML file is treated as the
+    // homepage rewrite. No root HTML means files mode.
+    const defaults = inferredRootHtmlIndex
+        ? { index: inferredRootHtmlIndex, listing: false }
+        : { index: false, listing: true };
+    const merged = { ...defaults };
+    for (const layer of [input.fileConfig, input.overlay]) {
+        if (!layer) {
+            continue;
+        }
+        for (const key of Object.keys(spaceConfigSchema.shape)) {
+            const value = layer[key];
+            if (value !== undefined) {
+                merged[key] = value;
+            }
+        }
+    }
+    const issues = [];
+    const fallback = normalizeFallback(merged.fallback);
+    // Invariant (spec "Serving resolution"): a fallback must point at a
+    // committed file — no implicit extension guessing, fail at finalize.
+    if (fallback && !input.manifestPaths.has(fallback.path)) {
+        issues.push({
+            severity: "error",
+            code: "config_invalid",
+            message: `fallback path "/${fallback.path}" is not a committed file in this version.`,
+            path: "fallback.path",
+            details: { path: fallback.path },
+        });
+    }
+    const listing = merged.listing ?? !inferredRootHtmlIndex;
+    const serving = {
+        index: merged.index ?? inferredRootHtmlIndex ?? false,
+        fallback,
+        listing,
+        // The single-file viewer rides the listing bundle (artifact-style spaces).
+        viewer: listing,
+        meta: merged.meta ?? null,
+        experimentalGutenberg: merged.experimental_gutenberg === true,
+        inject: merged.inject ?? null,
+    };
+    if (inferredRootHtmlIndex !== null && !hasRootIndex && serving.index === inferredRootHtmlIndex) {
+        // Surfaced on the publish receipt and version diagnostics so the CLI and
+        // agents learn the rewrite without probing the live URL.
+        issues.push({
+            severity: "info",
+            code: "single_html_index",
+            message: `${inferredRootHtmlIndex} is the root HTML file selected for this version, so it serves as the homepage: / rewrites to /${inferredRootHtmlIndex}.`,
+            path: "index",
+            details: { path: inferredRootHtmlIndex, rootHtmlCount: rootHtml.length },
+        });
+    }
+    if (inferredRootHtmlIndex === null &&
+        serving.index === false &&
+        serving.listing &&
+        !explicitServingShape) {
+        issues.push({
+            severity: "info",
+            code: "files_mode_inferred",
+            message: "No HTML files were found in the root of this version, so it serves in files mode with directory listing enabled.",
+            path: "listing",
+            details: { rootHtmlCount: 0 },
+        });
+    }
+    return { config: merged, serving, issues };
+}

package/dist/utils/space-theme.d.ts

@@ -0,0 +1,16 @@
+import type { SpaceTheme } from "../contracts/space-theme.js";
+export type SpaceThemeWarning = {
+    severity: "warning";
+    code: "theme_value_invalid";
+    message: string;
+    /** JSON-path-lite pointer into the theme shape. */
+    path: string;
+};
+export type CompiledSpaceTheme = {
+    /** CSS custom-property declarations (no selector), or null when empty. */
+    css: string | null;
+    warnings: SpaceThemeWarning[];
+};
+/** Engine-enforced ceiling for the compiled declaration block. */
+export declare const SPACE_THEME_CSS_MAX_BYTES: number;
+export declare function compileSpaceTheme(theme: SpaceTheme | null | undefined): CompiledSpaceTheme;

package/dist/utils/space-theme.js

@@ -0,0 +1,89 @@
+/** Engine-enforced ceiling for the compiled declaration block. */
+export const SPACE_THEME_CSS_MAX_BYTES = 16 * 1024;
+// Categorically forbidden anywhere in a value: network reach, style escape,
+// markup injection. Mirrors the runtime's defense-in-depth re-check.
+const FORBIDDEN_VALUE_PATTERN = /url\s*\(|@import|expression\s*\(|data:|[<>{};\\]|\/\*|\*\//i;
+const COLOR_PATTERN = new RegExp([
+    "^(?:",
+    "#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})",
+    "|rgba?\\([0-9.,\\s%/]{1,64}\\)",
+    "|hsla?\\([0-9.,\\s%deg/]{1,64}\\)",
+    "|[a-zA-Z]{3,30}", // CSS named colors (transparent, currentColor, rebeccapurple, ...)
+    "|var\\(--wp--preset--color--[a-z0-9-]{1,64}\\)",
+    ")$",
+].join(""));
+const SIZE_PATTERN = new RegExp([
+    "^(?:",
+    "-?\\d{1,5}(?:\\.\\d{1,4})?(?:px|rem|em|%|vw|vh|vmin|vmax|pt|ch|ex)?",
+    "|var\\(--wp--preset--(?:font-size|spacing)--[a-z0-9-]{1,64}\\)",
+    ")$",
+].join(""));
+// Font family stacks: platform-provided or validated-generic family names
+// only — letters, digits, spaces, commas, hyphens, straight quotes. No src.
+const FONT_FAMILY_PATTERN = /^[A-Za-z0-9 ,'"-]{1,256}$/;
+function safeValue(value, pattern) {
+    const trimmed = value.trim();
+    return trimmed.length > 0 && !FORBIDDEN_VALUE_PATTERN.test(trimmed) && pattern.test(trimmed);
+}
+export function compileSpaceTheme(theme) {
+    if (!theme) {
+        return { css: null, warnings: [] };
+    }
+    const declarations = [];
+    const warnings = [];
+    const drop = (path) => {
+        warnings.push({
+            severity: "warning",
+            code: "theme_value_invalid",
+            message: `Theme value at ${path} is not a safe preset token and was dropped.`,
+            path,
+        });
+    };
+    theme.color?.palette?.forEach((entry, index) => {
+        if (safeValue(entry.color, COLOR_PATTERN)) {
+            declarations.push(`--wp--preset--color--${entry.slug}:${entry.color.trim()}`);
+        }
+        else {
+            drop(`theme.color.palette[${index}].color`);
+        }
+    });
+    theme.typography?.fontSizes?.forEach((entry, index) => {
+        if (safeValue(entry.size, SIZE_PATTERN)) {
+            declarations.push(`--wp--preset--font-size--${entry.slug}:${entry.size.trim()}`);
+        }
+        else {
+            drop(`theme.typography.fontSizes[${index}].size`);
+        }
+    });
+    const fontFamily = theme.typography?.fontFamily;
+    if (fontFamily !== undefined) {
+        if (safeValue(fontFamily, FONT_FAMILY_PATTERN)) {
+            declarations.push(`--sf--font-family:${fontFamily.trim()}`);
+        }
+        else {
+            drop("theme.typography.fontFamily");
+        }
+    }
+    theme.spacing?.spacingScale?.forEach((entry, index) => {
+        if (safeValue(entry.size, SIZE_PATTERN)) {
+            declarations.push(`--wp--preset--spacing--${entry.slug}:${entry.size.trim()}`);
+        }
+        else {
+            drop(`theme.spacing.spacingScale[${index}].size`);
+        }
+    });
+    // Bounded output: drop trailing declarations past the engine ceiling with a
+    // warning instead of failing the version.
+    let css = declarations.join(";");
+    while (css.length > SPACE_THEME_CSS_MAX_BYTES && declarations.length > 0) {
+        declarations.pop();
+        warnings.push({
+            severity: "warning",
+            code: "theme_value_invalid",
+            message: `Compiled theme exceeds ${SPACE_THEME_CSS_MAX_BYTES} bytes; trailing tokens were dropped.`,
+            path: "theme",
+        });
+        css = declarations.join(";");
+    }
+    return { css: css.length > 0 ? css : null, warnings };
+}

package/dist/utils/static-runtime-policy.d.ts

@@ -0,0 +1,17 @@
+export declare const PHP_LIKE_EXTENSIONS: string[];
+export declare const PLATFORM_MANAGED_RESPONSE_HEADERS: string[];
+export declare const NON_IMMUTABLE_EXTENSIONS: string[];
+/** Lowercased extension without the leading dot, posix semantics. Dotfiles have no extension. */
+export declare function pathExtension(filePath: string): string;
+/** Basename without its extension (the "stem"), posix semantics. */
+export declare function pathStem(filePath: string): string;
+export declare function isPhpLikeStaticPath(filePath: string): boolean;
+export declare function looksLikeBundlerFingerprint(segment: string): boolean;
+export declare function isImmutableAssetPath(filePath: string): boolean;
+/** Forced inert serving policy for a committed static file. PHP-like files are never executable. */
+export declare function runtimeFileSafety(filePath: string): {
+    executable: false;
+    forced_download_or_text: boolean;
+};
+/** Forces a safe content type for PHP-like files; passes other MIME types through. */
+export declare function safeRuntimeContentType(filePath: string, mime: string): string;