@spacefast/common 0.0.21 → 0.0.24

package/dist/contracts/runtime-app.d.ts

@@ -2,137 +2,144 @@ import { z } from "zod";
 /**
  * The one answer to "what is running on this space".
  *
- * A space is exactly one runtime kind — `versionRuntimeKind()` returns a single
- * value and a publish carrying both declarations is refused at finalize — so
- * this is a discriminated union rather than a bag of optional per-product
- * fields. Anything that is not an execution tier has no member here and reads
- * as `null`, which is the overwhelmingly common answer: a static space is not a
- * degenerate app, it is the absence of one.
+ * One published tree can carry static files, a worker and a capsule at once —
+ * every space owns a site, so what answers a request is a routing decision, not
+ * a kind the space declared. This is therefore two independent members rather
+ * than a discriminated union: each is `null` when the live tree carries none of
+ * that product, and both `null` is the overwhelmingly common answer. A static
+ * space is not a degenerate app, it is the absence of one.
+ *
+ * When both are present the capsule wins a path conflict — it is the one that
+ * owns the space's database and its transaction.
  *
  * It lives in its own module because it is the only place that needs to know
  * about both products at once. `spaces.ts` imports it to describe runtime
  * status; neither `zero.ts` nor `functions.ts` has to learn about the other.
  */
-export declare const runtimeAppSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    runtimeKind: z.ZodLiteral<"zero">;
-    artifactId: z.ZodString;
-    appName: z.ZodString;
-    serverRuntime: z.ZodLiteral<"quickjs-rust">;
-    inspect: z.ZodObject<{
-        policy: z.ZodEnum<{
-            public: "public";
-            private: "private";
-        }>;
-    }, z.core.$strict>;
-    install: z.ZodObject<{
-        runtimeKind: z.ZodLiteral<"zero">;
-        engine: z.ZodLiteral<"quickjs-rust">;
-        storageRoot: z.ZodLiteral<"__spacefast/zero">;
-        artifactPath: z.ZodLiteral<"__spacefast/zero/artifact.json">;
-        configPath: z.ZodLiteral<"__spacefast/zero/config.json">;
-        binary: z.ZodObject<{
-            path: z.ZodLiteral<"__spacefast/zero/bin/stattic-runtime">;
-            compatibilityTarget: z.ZodObject<{
-                profile: z.ZodLiteral<"wpcloud-linux-x86_64-gnu-v1">;
-                os: z.ZodLiteral<"linux">;
-                cpu: z.ZodLiteral<"x86_64">;
-                libc: z.ZodLiteral<"glibc">;
-                linking: z.ZodLiteral<"dynamic">;
-                requireExecutableBit: z.ZodLiteral<true>;
+export declare const runtimeAppSchema: z.ZodObject<{
+    capsule: z.ZodNullable<z.ZodObject<{
+        artifactId: z.ZodString;
+        appName: z.ZodString;
+        serverRuntime: z.ZodLiteral<"quickjs-rust">;
+        inspect: z.ZodObject<{
+            policy: z.ZodEnum<{
+                public: "public";
+                private: "private";
+            }>;
+        }, z.core.$strict>;
+        install: z.ZodObject<{
+            runtimeKind: z.ZodLiteral<"zero">;
+            engine: z.ZodLiteral<"quickjs-rust">;
+            storageRoot: z.ZodLiteral<"__spacefast/zero">;
+            artifactPath: z.ZodLiteral<"__spacefast/zero/artifact.json">;
+            configPath: z.ZodLiteral<"__spacefast/zero/config.json">;
+            binary: z.ZodObject<{
+                path: z.ZodLiteral<"__spacefast/zero/bin/stattic-runtime">;
+                compatibilityTarget: z.ZodObject<{
+                    profile: z.ZodLiteral<"wpcloud-linux-x86_64-gnu-v1">;
+                    os: z.ZodLiteral<"linux">;
+                    cpu: z.ZodLiteral<"x86_64">;
+                    libc: z.ZodLiteral<"glibc">;
+                    linking: z.ZodLiteral<"dynamic">;
+                    requireExecutableBit: z.ZodLiteral<true>;
+                }, z.core.$strict>;
+                sha256: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+                required: z.ZodLiteral<true>;
+            }, z.core.$strict>;
+            mysql: z.ZodObject<{
+                migrateAtFinalize: z.ZodLiteral<true>;
+                blockIncompatibleRollback: z.ZodLiteral<true>;
+            }, z.core.$strict>;
+            realtime: z.ZodObject<{
+                production: z.ZodLiteral<"central">;
+                local: z.ZodLiteral<"foreground-cli-ws">;
             }, z.core.$strict>;
-            sha256: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-            required: z.ZodLiteral<true>;
         }, z.core.$strict>;
-        mysql: z.ZodObject<{
-            migrateAtFinalize: z.ZodLiteral<true>;
-            blockIncompatibleRollback: z.ZodLiteral<true>;
+        tables: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        queries: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        mutations: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        actions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        endpoints: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            method: z.ZodEnum<{
+                POST: "POST";
+                PUT: "PUT";
+                GET: "GET";
+                HEAD: "HEAD";
+                PATCH: "PATCH";
+                DELETE: "DELETE";
+                OPTIONS: "OPTIONS";
+            }>;
+            path: z.ZodString;
+        }, z.core.$strict>>>;
+        sockets: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        migrationCount: z.ZodNumber;
+        schemaHash: z.ZodNullable<z.ZodString>;
+        variables: z.ZodObject<{
+            source: z.ZodLiteral<"stattic-variables">;
+            names: z.ZodDefault<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>;
         realtime: z.ZodObject<{
-            production: z.ZodLiteral<"central">;
-            local: z.ZodLiteral<"foreground-cli-ws">;
+            mode: z.ZodEnum<{
+                local: "local";
+                cast: "cast";
+                central: "central";
+            }>;
+            centralUrl: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            path: z.ZodOptional<z.ZodString>;
+            replayPath: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            replayUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            runPath: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            runUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            resourceKey: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            ticketPath: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            socketPath: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            spaceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            versionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, z.core.$strict>;
-    }, z.core.$strict>;
-    tables: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    queries: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    mutations: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    actions: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    endpoints: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        method: z.ZodEnum<{
-            POST: "POST";
-            PUT: "PUT";
-            GET: "GET";
-            HEAD: "HEAD";
-            PATCH: "PATCH";
-            DELETE: "DELETE";
-            OPTIONS: "OPTIONS";
-        }>;
-        path: z.ZodString;
-    }, z.core.$strict>>>;
-    sockets: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    migrationCount: z.ZodNumber;
-    schemaHash: z.ZodNullable<z.ZodString>;
-    variables: z.ZodObject<{
-        source: z.ZodLiteral<"stattic-variables">;
-        names: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    }, z.core.$strict>;
-    realtime: z.ZodObject<{
-        mode: z.ZodEnum<{
-            local: "local";
-            cast: "cast";
-            central: "central";
+    }, z.core.$strict>>;
+    worker: z.ZodNullable<z.ZodObject<{
+        artifactId: z.ZodString;
+        appName: z.ZodString;
+        entry: z.ZodString;
+        compatibilityDate: z.ZodString;
+        compatibilityFlags: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        routes: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            method: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+                POST: "POST";
+                PUT: "PUT";
+                GET: "GET";
+                HEAD: "HEAD";
+                PATCH: "PATCH";
+                DELETE: "DELETE";
+                OPTIONS: "OPTIONS";
+            }>>>;
+            path: z.ZodString;
+            subtree: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>>>;
+        capabilities: z.ZodDefault<z.ZodObject<{
+            db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            gravatar: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            spam: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            email: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        }, z.core.$strip>>;
+        executionState: z.ZodEnum<{
+            ready: "ready";
+            absent: "absent";
+            serving: "serving";
         }>;
-        centralUrl: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        path: z.ZodOptional<z.ZodString>;
-        replayPath: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        replayUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        runPath: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        runUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        resourceKey: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        ticketPath: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        socketPath: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        spaceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        versionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    }, z.core.$strict>;
-}, z.core.$strict>, z.ZodObject<{
-    runtimeKind: z.ZodLiteral<"functions">;
-    artifactId: z.ZodString;
-    appName: z.ZodString;
-    entry: z.ZodString;
-    compatibilityDate: z.ZodString;
-    compatibilityFlags: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    routes: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        method: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
-            POST: "POST";
-            PUT: "PUT";
-            GET: "GET";
-            HEAD: "HEAD";
-            PATCH: "PATCH";
-            DELETE: "DELETE";
-            OPTIONS: "OPTIONS";
-        }>>>;
-        path: z.ZodString;
-        subtree: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strict>>>;
-    capabilities: z.ZodDefault<z.ZodObject<{
-        db: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-        fetch: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-        auth: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-        env: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-        realtime: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-        logging: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-    }, z.core.$strip>>;
-    executionState: z.ZodEnum<{
-        ready: "ready";
-        absent: "absent";
-        serving: "serving";
-    }>;
-    bundleSize: z.ZodNumber;
-    bundleSha256: z.ZodString;
-    variables: z.ZodObject<{
-        source: z.ZodLiteral<"spacefast-variables">;
-        names: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    }, z.core.$strict>;
-}, z.core.$strict>], "runtimeKind">;
+        bundleSize: z.ZodNumber;
+        bundleSha256: z.ZodString;
+        variables: z.ZodObject<{
+            source: z.ZodLiteral<"spacefast-variables">;
+            names: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
 export type RuntimeApp = z.infer<typeof runtimeAppSchema>;
 /**
  * Replay of the invalidation events a live runtime emitted.

package/dist/contracts/runtime-app.js

@@ -5,21 +5,30 @@ import { zeroAppSchema, zeroRealtimeEventSchema } from "./zero.js";
 /**
  * The one answer to "what is running on this space".
  *
- * A space is exactly one runtime kind — `versionRuntimeKind()` returns a single
- * value and a publish carrying both declarations is refused at finalize — so
- * this is a discriminated union rather than a bag of optional per-product
- * fields. Anything that is not an execution tier has no member here and reads
- * as `null`, which is the overwhelmingly common answer: a static space is not a
- * degenerate app, it is the absence of one.
+ * One published tree can carry static files, a worker and a capsule at once —
+ * every space owns a site, so what answers a request is a routing decision, not
+ * a kind the space declared. This is therefore two independent members rather
+ * than a discriminated union: each is `null` when the live tree carries none of
+ * that product, and both `null` is the overwhelmingly common answer. A static
+ * space is not a degenerate app, it is the absence of one.
+ *
+ * When both are present the capsule wins a path conflict — it is the one that
+ * owns the space's database and its transaction.
  *
  * It lives in its own module because it is the only place that needs to know
  * about both products at once. `spaces.ts` imports it to describe runtime
  * status; neither `zero.ts` nor `functions.ts` has to learn about the other.
  */
-export const runtimeAppSchema = z.discriminatedUnion("runtimeKind", [
-    zeroAppSchema,
-    functionsAppSchema,
-]);
+export const runtimeAppSchema = z
+    .object({
+    capsule: zeroAppSchema
+        .nullable()
+        .describe("The live version's Zero capsule, if it carries one."),
+    worker: functionsAppSchema
+        .nullable()
+        .describe("The live version's Functions worker, if it carries one."),
+})
+    .strict();
 /**
  * Replay of the invalidation events a live runtime emitted.
  *

package/dist/contracts/runtime-db.d.ts

@@ -392,8 +392,8 @@ export declare const runtimeDbMigrateResponseSchema: z.ZodObject<{
             code: z.ZodString;
             severity: z.ZodEnum<{
                 info: "info";
-                error: "error";
                 warning: "warning";
+                error: "error";
             }>;
             message: z.ZodString;
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;

package/dist/contracts/runtime-services.d.ts

@@ -0,0 +1,219 @@
+/**
+ * Platform services that tenant code reaches through the runtime rather than
+ * through a credential of its own: Gravatar, spam checking, and mail.
+ *
+ * Three properties hold for all three, and they are the reason this file
+ * exists instead of three unrelated ones:
+ *
+ * - **The credential is never in tenant reach.** An Akismet key or a Gravatar
+ *   token in a bundle is a published secret, and a wp.cloud `SMTP_PASS` in a
+ *   capsule is worse. Every call below is brokered: the runtime attaches
+ *   authority outside the code that asked for the call.
+ * - **The interface is the contract, not the accessor.** Zero hands these to a
+ *   handler as `ctx.gravatar` / `ctx.spam` / `ctx.email`; Functions binds them
+ *   as `env.GRAVATAR` / `env.SPAM` / `env.EMAIL`. Method names and semantic
+ *   fields stay shared. Zero's `check` narrows the input because its HTTP host
+ *   can add request metadata; a detached Functions call supplies that metadata
+ *   explicitly.
+ * - **The client is the same source on both tiers.** See
+ *   `RUNTIME_SERVICE_CLIENT_SOURCE`: normalization, validation and the pure
+ *   avatar-URL construction are one implementation injected into both runtimes,
+ *   so the two tiers cannot drift into behaving differently.
+ *
+ * What differs between tiers is the transport under `call()`, and only that.
+ */
+/**
+ * What Gravatar serves when an address has no image. `404` is here so callers
+ * can detect absence by status instead of receiving a generated face they then
+ * have to recognise as a placeholder.
+ */
+export declare const GRAVATAR_DEFAULTS: readonly ["404", "mp", "identicon", "monsterid", "wavatar", "retro", "robohash", "blank"];
+export type GravatarDefault = (typeof GRAVATAR_DEFAULTS)[number];
+export declare const GRAVATAR_RATINGS: readonly ["g", "pg", "r", "x"];
+export type GravatarRating = (typeof GRAVATAR_RATINGS)[number];
+/** Gravatar's own ceiling. Larger values are refused rather than clamped. */
+export declare const GRAVATAR_AVATAR_MAX_SIZE = 2048;
+export type GravatarAvatarOptions = {
+    /** Requested square edge in pixels, 1–2048. */
+    size?: number;
+    /** Image to serve when the address has no Gravatar. */
+    default?: GravatarDefault;
+    /** Maximum permitted self-rating. */
+    rating?: GravatarRating;
+    /** Serve `default` even when the address does have a Gravatar. */
+    forceDefault?: boolean;
+};
+export type GravatarVerifiedAccount = {
+    service: string;
+    url: string;
+    label: string | null;
+};
+/**
+ * The subset of the Gravatar profile that is stable, public, and useful to a
+ * page. Deliberately not the raw upstream document: passing that through would
+ * make every upstream field addition a silent contract change here.
+ */
+export type GravatarProfile = {
+    hash: string;
+    displayName: string | null;
+    profileUrl: string | null;
+    avatarUrl: string | null;
+    location: string | null;
+    description: string | null;
+    pronouns: string | null;
+    verifiedAccounts: GravatarVerifiedAccount[];
+};
+export type Gravatar = {
+    /**
+     * Pure and synchronous: an avatar URL is a hash and a query string, so it
+     * costs no network call and cannot fail. It stays on this interface anyway
+     * because an author looking for an avatar looks here, not in a utility
+     * module.
+     */
+    avatarUrl(email: string, options?: GravatarAvatarOptions): string;
+    /** The profile behind an address, or null when the address has none. */
+    profile(email: string): Promise<GravatarProfile | null>;
+};
+/**
+ * Akismet's recognised content types. The vendor is not in the name of
+ * anything an author touches — `ctx.spam` outlives whichever service answers
+ * it — but the vocabulary is Akismet's because the classifier is trained on
+ * it, and inventing synonyms would only lose signal.
+ */
+export declare const SPAM_CONTENT_TYPES: readonly ["comment", "reply", "forum-post", "contact-form", "signup", "message"];
+export type SpamContentType = (typeof SPAM_CONTENT_TYPES)[number];
+/**
+ * One complete submission, as the classifier sees it. Detached runtimes such
+ * as Functions use this shape; Zero uses {@link RequestSpamSubmission} while
+ * handling an HTTP invocation and fills the network fields itself.
+ *
+ * `userIp` and `userAgent` are the two heaviest signals Akismet uses, and
+ * accuracy drops sharply without them — hence `userIp` being required rather
+ * than another optional field an author would skip.
+ */
+export type SpamSubmission = {
+    /** The text being classified. */
+    content: string;
+    /** The submitting visitor's IP. Required: without it the verdict is weak. */
+    userIp: string;
+    userAgent?: string;
+    referrer?: string;
+    /** Permalink of the page the content was submitted on. */
+    permalink?: string;
+    type?: SpamContentType;
+    authorName?: string;
+    authorEmail?: string;
+    authorUrl?: string;
+    /**
+     * Set to `"administrator"` for a trusted, authenticated operator of the
+     * space. Akismet passes that role unconditionally, so this is an author's
+     * own escape hatch for their own team — it grants nothing beyond skipping a
+     * check the author asked for.
+     */
+    authorRole?: "administrator";
+    /** ISO-8601 UTC. Defaults to the moment of the call. */
+    createdAt?: string;
+    /** ISO-639-1 hints, e.g. `["en"]`. */
+    languages?: string[];
+};
+/**
+ * A spam check made while handling a visitor request.
+ *
+ * Network evidence is deliberately absent. The runtime, not capsule code,
+ * supplies the visitor IP, user agent, referrer, and current URL from the
+ * trusted invocation envelope. This keeps a browser from claiming its own IP
+ * through mutation arguments or an endpoint body.
+ */
+export type RequestSpamSubmission = Omit<SpamSubmission, "userIp" | "userAgent" | "referrer" | "permalink">;
+export type SpamVerdict = {
+    /** Whether the submission classifies as spam. */
+    spam: boolean;
+    /**
+     * Blatant, pervasive spam. Akismet's own guidance is that this may be
+     * dropped outright rather than held for review, so it is surfaced instead of
+     * being folded into `spam`.
+     */
+    discard: boolean;
+};
+export type SpamCheck = {
+    check(submission: SpamSubmission): Promise<SpamVerdict>;
+    /** Correct a false negative: this passed, and should not have. */
+    reportSpam(submission: SpamSubmission): Promise<void>;
+    /** Correct a false positive: this was held, and should not have been. */
+    reportHam(submission: SpamSubmission): Promise<void>;
+};
+/**
+ * Zero's request-aware spam surface. Corrections retain the original full
+ * submission because they usually run later, outside the visitor request.
+ */
+export type RequestSpamCheck = Omit<SpamCheck, "check"> & {
+    check(submission: RequestSpamSubmission): Promise<SpamVerdict>;
+};
+/** Trusted runtime metadata. This is host input, never capsule input. */
+export type RuntimeSpamRequestContext = {
+    userIp: string;
+    userAgent?: string;
+    referrer?: string;
+    permalink?: string;
+};
+/**
+ * The structured subset of Cloudflare's `SendEmail` binding, field for field.
+ *
+ * Matching it is a portability decision, not an aesthetic one: a worker
+ * deployed straight to Cloudflare gets the native binding and the same
+ * message-building code has to typecheck against both.
+ */
+export type EmailAddress = {
+    email: string;
+    name?: string;
+};
+export type EmailMessage = {
+    from: string | EmailAddress;
+    to: string | EmailAddress | Array<string | EmailAddress>;
+    subject: string;
+    text?: string;
+    html?: string;
+    cc?: string | EmailAddress | Array<string | EmailAddress>;
+    bcc?: string | EmailAddress | Array<string | EmailAddress>;
+    replyTo?: string | EmailAddress;
+    headers?: Record<string, string>;
+};
+export type SendEmail = {
+    /**
+     * Accepts one email effect. The identifier names the message; it is not a
+     * claim that anything was delivered, and no state beyond "queued" is
+     * observable from here — see the runtime's message views for that.
+     */
+    send(message: EmailMessage): Promise<{
+        messageId: string;
+    }>;
+};
+/**
+ * The hosts a broker may reach on a tenant's behalf are deliberately NOT listed
+ * here. That table lives in `stattic-runtime-core`'s egress policy, where it is
+ * generated into both the runtime's PHP constants and the Rust broker, so one
+ * declaration is enforced at both places a connection is actually made. A copy
+ * in this file would be a third statement of the same fact that nothing checks.
+ *
+ * The `gravatar.com` in the avatar URL below is not that table: it is a public
+ * URL handed to a browser, not an egress target.
+ */
+/**
+ * The client both runtimes inject, as source.
+ *
+ * It is a string rather than a module because neither runtime can import from
+ * npm at the point it needs this: Zero compiles a capsule to QuickJS bytecode
+ * with a generated prelude, and the Functions host injects modules into a
+ * tenant isolate it does not build. Shipping one source to both is what makes
+ * "the same API" a fact about the code rather than a promise in a doc.
+ *
+ * It closes over nothing of ours. The host defines `call(service, operation,
+ * payload)` and everything else — normalization, the pure avatar URL, the
+ * shapes returned to tenant code — is here, identical on both tiers.
+ *
+ * The SHA-256 is hand-rolled for the same reason: QuickJS has no WebCrypto,
+ * and Cloudflare's `crypto.subtle` is async, which would force `avatarUrl` to
+ * return a promise on one tier and a string on the other. A synchronous
+ * implementation is the only way the signature can be identical.
+ */
+export declare const RUNTIME_SERVICE_CLIENT_SOURCE: string;