@spacefast/common 0.0.21 → 0.0.24

package/dist/utils/pages.js

@@ -1,12 +1,13 @@
 import { defaultTreeAdapter, parse } from "parse5";
 import { SPACEFAST_WORDMARK_PATH } from "../brand-assets.js";
-import { CUSTOM_PAGE_IDS, PAGE_CATALOG, PAGE_ELEMENTS, PAGE_LAYOUT_FILE, PAGE_SOURCE_MAX_BYTES, SITE_PAGE_IDS, } from "../contracts/pages.js";
+import { COLLAB_PAGE_ELEMENTS, COLLAB_PAGE_SOURCE, CUSTOM_PAGE_IDS, PAGE_CATALOG, PAGE_ELEMENTS, PAGE_LAYOUT_FILE, PAGE_SOURCE_MAX_BYTES, SITE_PAGE_IDS, } from "../contracts/pages.js";
 import { SPACE_CONFIG_ACCEPTED_FILES } from "../contracts/space-config.js";
 import { derivePageColors, PAGE_COLOR_DEFAULTS } from "./page-colors.js";
-import { PAGE_EMBEDDED_FONT_FACES, PAGE_FONT_FACES } from "./page-fonts.js";
+import { PAGE_FONT_FACES, PAGE_FONT_PRELOAD_HTML } from "./page-fonts.js";
 export { PAGE_PREVIEW_QUERY, previewPageHref } from "./page-preview.js";
 const encoder = new TextEncoder();
 const knownElements = new Set(PAGE_ELEMENTS);
+const collabElements = new Set(COLLAB_PAGE_ELEMENTS);
 const customPageIds = new Set(CUSTOM_PAGE_IDS);
 export function isPagePublicPath(path) {
     const lower = path.toLowerCase();
@@ -129,7 +130,14 @@ export function expandPageHtml(source, context) {
         const name = (paired ?? unary)?.toLowerCase();
         return name && knownElements.has(name) ? renderElement(name, context) : _match;
     });
-    output = output.replaceAll("/*sf-default-fonts*/", context.embedPageFonts ? PAGE_EMBEDDED_FONT_FACES : PAGE_FONT_FACES);
+    if (output.includes("/*sf-default-fonts*/")) {
+        output = output.replaceAll("/*sf-default-fonts*/", PAGE_FONT_FACES);
+        // The faces point at shared font origins; preloading ahead of the inline
+        // stylesheet starts the cross-origin fetches with the parse.
+        output = /<\s*style\b/i.test(output)
+            ? output.replace(/<\s*style\b/i, (tag) => `${PAGE_FONT_PRELOAD_HTML}${tag}`)
+            : `${PAGE_FONT_PRELOAD_HTML}${output}`;
+    }
     const tokens = themeStyle(context.theme ?? {});
     if (tokens) {
         output = /<\s*\/\s*head\s*>/i.test(output)
@@ -179,7 +187,11 @@ export function validatePageSources(input) {
         const path = sourcePath.includes("_pages/") ? sourcePath : `_pages/${sourcePath}`;
         const filename = path.slice(path.lastIndexOf("_pages/") + 7);
         const id = filename.replace(/\.html$/i, "");
-        if (!customPageIds.has(id) || filename !== `${id}.html`) {
+        // A collab layout is Space-level — one review room, one URL — so unlike the
+        // gate and listing pages it has no per-directory form.
+        if (!customPageIds.has(id) ||
+            filename !== `${id}.html` ||
+            (id === "collab" && path !== COLLAB_PAGE_SOURCE)) {
             diagnostics.push({
                 severity: "error",
                 code: "unknown_page_template",
@@ -204,6 +216,10 @@ export function validatePageSources(input) {
                 path,
             });
         for (const element of foundElements(source)) {
+            // Collab elements are the browser SDK's, not the compiler's: legal in the
+            // review room, meaningless anywhere the SDK is not the point.
+            if (id === "collab" && collabElements.has(element))
+                continue;
             if (!knownElements.has(element))
                 diagnostics.push({
                     severity: "error",
@@ -361,7 +377,7 @@ export function defaultPageBody(id) {
 // The built-in palette runs through the same readability engine as pushed
 // themes, so buttons and links remain readable for every accepted accent.
 const defaultPageColors = derivePageColors({});
-const sharedCss = `/*sf-default-fonts*/:root{color-scheme:light dark;--sf-accent:${PAGE_COLOR_DEFAULTS.accent};--sf-bg:${PAGE_COLOR_DEFAULTS.bg};--sf-fg:${PAGE_COLOR_DEFAULTS.fg};--sf-muted:${PAGE_COLOR_DEFAULTS.muted};--sf-card:${PAGE_COLOR_DEFAULTS.card};--sf-border:${PAGE_COLOR_DEFAULTS.border};--sf-link:${defaultPageColors.link};--sf-on-accent:${defaultPageColors.onAccent};--sf-error:#a82d1a;--sf-font:"Haskoy",-apple-system,BlinkMacSystemFont,ui-sans-serif,"Segoe UI",sans-serif;--sf-display-font:"Merriweather",Georgia,serif;--sf-mono:ui-monospace,"SF Mono",Menlo,Consolas,monospace}*{box-sizing:border-box}html{min-width:320px;background:var(--sf-bg);-webkit-font-smoothing:antialiased}body{margin:0;min-height:100vh;background:var(--sf-bg);color:var(--sf-fg);font:14px/1.65 var(--sf-font)}a{color:inherit}.sf-page{min-height:100vh;display:flex;flex-direction:column;padding:clamp(22px,4vw,44px)}.sf-header{display:flex;align-items:center;min-height:32px}.sf-page-center .sf-header{justify-content:center}.sf-brand{display:inline-flex;min-width:0;align-items:center;gap:10px;color:var(--sf-fg);text-decoration:none}.sf-brand-mark{width:7px;height:7px;flex:none;background:var(--sf-accent)}.sf-logo{width:28px;height:28px;flex:none;object-fit:contain}.sf-brand strong{min-width:0;overflow-wrap:anywhere;font-size:13px;font-weight:600}.sf-main{flex:1;width:100%;padding:clamp(34px,9vh,84px) 0}.sf-page-plain .sf-main{max-width:680px}.sf-page-center .sf-main{max-width:620px;margin:auto;display:flex;flex-direction:column;align-items:center;text-align:center}.sf-eyebrow{margin:0 0 14px;color:var(--sf-muted);font:500 11px/1.5 var(--sf-mono);letter-spacing:.12em;text-transform:uppercase;overflow-wrap:anywhere}.sf-page-center .sf-eyebrow{margin-bottom:16px}h1{max-width:20ch;margin:0 0 12px;color:var(--sf-fg);font:430 clamp(1.9rem,5vw,2.8rem)/1.22 var(--sf-display-font);letter-spacing:-.012em;text-wrap:balance}.sf-copy,.sf-sub{max-width:52ch;margin:0;color:var(--sf-muted);text-wrap:pretty}.sf-inline-path{font-family:var(--sf-mono);font-size:.9em;color:var(--sf-fg);overflow-wrap:anywhere}.sf-actions{display:flex;flex-wrap:wrap;align-items:center;gap:14px;margin-top:22px}.sf-page-center .sf-actions{justify-content:center}.sf-button{display:inline-flex;min-height:44px;align-items:center;justify-content:center;border:0;background:var(--sf-accent);color:var(--sf-on-accent);padding:10px 16px;font:600 13px/1.4 var(--sf-font);text-decoration:none;cursor:pointer}.sf-ghost{color:var(--sf-muted);text-underline-offset:3px}.sf-button:hover{filter:brightness(1.06)}a:focus-visible,button:focus-visible{outline:2px solid var(--sf-link);outline-offset:2px}.sf-copy+.sf-copy{margin-top:12px}.sf-files{width:100%;margin:24px 0 0;padding:0;list-style:none}.sf-files li{display:flex;min-width:0;align-items:baseline;gap:18px;border-bottom:1px solid var(--sf-border)}.sf-files a{min-width:0;flex:1;padding:10px 2px;color:var(--sf-fg);font-weight:500;text-decoration:none}.sf-files a:hover{color:var(--sf-link)}.sf-file-name{overflow-wrap:anywhere}.sf-file-size{flex:none;padding:10px 2px;color:var(--sf-muted);font:12px/1.5 var(--sf-mono);white-space:nowrap}.sf-empty{max-width:420px;margin:24px 0 0;border:1px dashed var(--sf-border);padding:18px 20px;color:var(--sf-muted)}.sf-preview-wrap{width:min(100%,560px);aspect-ratio:16/9;margin:10px 0 18px;overflow:hidden;background:#fff;outline:1px solid color-mix(in srgb,var(--sf-fg) 10%,transparent);outline-offset:-1px}.sf-preview{display:block;width:100%;height:100%;border:0;object-fit:contain}.sf-file-meta{width:min(100%,560px);margin:0}.sf-file-meta div{display:flex;min-width:0;justify-content:space-between;gap:20px;border-bottom:1px solid var(--sf-border);padding:9px 2px}.sf-file-meta dt{color:var(--sf-fg);font-weight:600}.sf-file-meta dd{min-width:0;margin:0;color:var(--sf-muted);font-family:var(--sf-mono);overflow-wrap:anywhere;text-align:right}.sf-colophon{display:flex;flex-direction:column;align-items:center;gap:10px;padding:44px 0 26px;margin-top:auto;color:var(--sf-muted)}.sf-page-plain .sf-colophon{align-items:flex-start}.sf-colophon-row{display:flex;align-items:center;gap:20px;flex-wrap:wrap}.sf-powered{display:inline-flex;align-items:center;gap:10px;cursor:pointer;outline:none}.sf-powered-line{display:none;font-size:12px;color:var(--sf-muted)}.sf-powered:hover .sf-powered-line,.sf-powered:focus .sf-powered-line,.sf-powered:focus-within .sf-powered-line{display:inline}.sf-powered-line a{color:var(--sf-link);text-decoration:underline;text-underline-offset:3px}.sf-help{font-size:12px;color:var(--sf-muted);text-decoration:underline;text-underline-offset:3px}.sf-help:hover{color:var(--sf-fg)}.sf-wordmark{display:block;flex:none;width:auto;height:11px}.sf-wordmark-shadow{fill:var(--sf-accent)}.sf-wordmark-plate{fill:#141419}.sf-wordmark-paper{fill:#fbf8f1}@media(max-width:520px){.sf-page{padding:20px}.sf-button{min-height:48px}.sf-file-meta div{flex-direction:column;gap:2px}.sf-file-meta dd{text-align:left}.sf-colophon{padding-top:32px}}@media(prefers-color-scheme:dark){:root{--sf-bg:${PAGE_COLOR_DEFAULTS.darkBg};--sf-fg:${PAGE_COLOR_DEFAULTS.darkFg};--sf-muted:${PAGE_COLOR_DEFAULTS.darkMuted};--sf-card:${PAGE_COLOR_DEFAULTS.darkCard};--sf-border:${PAGE_COLOR_DEFAULTS.darkBorder};--sf-link:${defaultPageColors.linkDark};--sf-error:#ff8a7a}.sf-preview-wrap{outline-color:#ffffff1a}}@media(forced-colors:active){.sf-brand-mark{background:CanvasText}.sf-button{border:1px solid ButtonText}.sf-powered:focus{outline:1px solid CanvasText;outline-offset:3px}}`;
+const sharedCss = `/*sf-default-fonts*/:root{color-scheme:light dark;--sf-accent:${PAGE_COLOR_DEFAULTS.accent};--sf-bg:${PAGE_COLOR_DEFAULTS.bg};--sf-fg:${PAGE_COLOR_DEFAULTS.fg};--sf-muted:${PAGE_COLOR_DEFAULTS.muted};--sf-card:${PAGE_COLOR_DEFAULTS.card};--sf-border:${PAGE_COLOR_DEFAULTS.border};--sf-link:${defaultPageColors.link};--sf-on-accent:${defaultPageColors.onAccent};--sf-error:#a82d1a;--sf-font:"Haskoy",-apple-system,BlinkMacSystemFont,ui-sans-serif,"Segoe UI",sans-serif;--sf-display-font:"Recoleta",Georgia,serif;--sf-mono:ui-monospace,"SF Mono",Menlo,Consolas,monospace}*{box-sizing:border-box}html{min-width:320px;background:var(--sf-bg);-webkit-font-smoothing:antialiased}body{margin:0;min-height:100vh;background:var(--sf-bg);color:var(--sf-fg);font:14px/1.65 var(--sf-font)}a{color:inherit}.sf-page{min-height:100vh;display:flex;flex-direction:column;padding:clamp(22px,4vw,44px)}.sf-header{display:flex;align-items:center;min-height:32px}.sf-page-center .sf-header{justify-content:center}.sf-brand{display:inline-flex;min-width:0;align-items:center;gap:10px;color:var(--sf-fg);text-decoration:none}.sf-brand-mark{width:7px;height:7px;flex:none;background:var(--sf-accent)}.sf-logo{width:28px;height:28px;flex:none;object-fit:contain}.sf-brand strong{min-width:0;overflow-wrap:anywhere;font-size:13px;font-weight:600}.sf-main{flex:1;width:100%;padding:clamp(34px,9vh,84px) 0}.sf-page-plain .sf-main{max-width:680px}.sf-page-center .sf-main{max-width:620px;margin:auto;display:flex;flex-direction:column;align-items:center;text-align:center}.sf-eyebrow{margin:0 0 14px;color:var(--sf-muted);font:500 11px/1.5 var(--sf-mono);letter-spacing:.12em;text-transform:uppercase;overflow-wrap:anywhere}.sf-page-center .sf-eyebrow{margin-bottom:16px}h1{max-width:20ch;margin:0 0 12px;color:var(--sf-fg);font:400 clamp(1.9rem,5vw,2.8rem)/1.22 var(--sf-display-font);letter-spacing:-.012em;text-wrap:balance}.sf-copy,.sf-sub{max-width:52ch;margin:0;color:var(--sf-muted);text-wrap:pretty}.sf-inline-path{font-family:var(--sf-mono);font-size:.9em;color:var(--sf-fg);overflow-wrap:anywhere}.sf-actions{display:flex;flex-wrap:wrap;align-items:center;gap:14px;margin-top:22px}.sf-page-center .sf-actions{justify-content:center}.sf-button{display:inline-flex;min-height:44px;align-items:center;justify-content:center;border:0;background:var(--sf-accent);color:var(--sf-on-accent);padding:10px 16px;font:600 13px/1.4 var(--sf-font);text-decoration:none;cursor:pointer}.sf-ghost{color:var(--sf-muted);text-underline-offset:3px}.sf-button:hover{filter:brightness(1.06)}a:focus-visible,button:focus-visible{outline:2px solid var(--sf-link);outline-offset:2px}.sf-copy+.sf-copy{margin-top:12px}.sf-files{width:100%;margin:24px 0 0;padding:0;list-style:none}.sf-files li{display:flex;min-width:0;align-items:baseline;gap:18px;border-bottom:1px solid var(--sf-border)}.sf-files a{min-width:0;flex:1;padding:10px 2px;color:var(--sf-fg);font-weight:500;text-decoration:none}.sf-files a:hover{color:var(--sf-link)}.sf-file-name{overflow-wrap:anywhere}.sf-file-size{flex:none;padding:10px 2px;color:var(--sf-muted);font:12px/1.5 var(--sf-mono);white-space:nowrap}.sf-empty{max-width:420px;margin:24px 0 0;border:1px dashed var(--sf-border);padding:18px 20px;color:var(--sf-muted)}.sf-preview-wrap{width:min(100%,560px);aspect-ratio:16/9;margin:10px 0 18px;overflow:hidden;background:#fff;outline:1px solid color-mix(in srgb,var(--sf-fg) 10%,transparent);outline-offset:-1px}.sf-preview{display:block;width:100%;height:100%;border:0;object-fit:contain}.sf-file-meta{width:min(100%,560px);margin:0}.sf-file-meta div{display:flex;min-width:0;justify-content:space-between;gap:20px;border-bottom:1px solid var(--sf-border);padding:9px 2px}.sf-file-meta dt{color:var(--sf-fg);font-weight:600}.sf-file-meta dd{min-width:0;margin:0;color:var(--sf-muted);font-family:var(--sf-mono);overflow-wrap:anywhere;text-align:right}.sf-colophon{display:flex;flex-direction:column;align-items:center;gap:10px;padding:44px 0 26px;margin-top:auto;color:var(--sf-muted)}.sf-page-plain .sf-colophon{align-items:flex-start}.sf-colophon-row{display:flex;align-items:center;gap:20px;flex-wrap:wrap}.sf-powered{display:inline-flex;align-items:center;gap:10px;cursor:pointer;outline:none}.sf-powered-line{display:none;font-size:12px;color:var(--sf-muted)}.sf-powered:hover .sf-powered-line,.sf-powered:focus .sf-powered-line,.sf-powered:focus-within .sf-powered-line{display:inline}.sf-powered-line a{color:var(--sf-link);text-decoration:underline;text-underline-offset:3px}.sf-help{font-size:12px;color:var(--sf-muted);text-decoration:underline;text-underline-offset:3px}.sf-help:hover{color:var(--sf-fg)}.sf-wordmark{display:block;flex:none;width:auto;height:11px}.sf-wordmark-shadow{fill:var(--sf-accent)}.sf-wordmark-plate{fill:#141419}.sf-wordmark-paper{fill:#fbf8f1}@media(max-width:520px){.sf-page{padding:20px}.sf-button{min-height:48px}.sf-file-meta div{flex-direction:column;gap:2px}.sf-file-meta dd{text-align:left}.sf-colophon{padding-top:32px}}@media(prefers-color-scheme:dark){:root{--sf-bg:${PAGE_COLOR_DEFAULTS.darkBg};--sf-fg:${PAGE_COLOR_DEFAULTS.darkFg};--sf-muted:${PAGE_COLOR_DEFAULTS.darkMuted};--sf-card:${PAGE_COLOR_DEFAULTS.darkCard};--sf-border:${PAGE_COLOR_DEFAULTS.darkBorder};--sf-link:${defaultPageColors.linkDark};--sf-error:#ff8a7a}.sf-preview-wrap{outline-color:#ffffff1a}}@media(forced-colors:active){.sf-brand-mark{background:CanvasText}.sf-button{border:1px solid ButtonText}.sf-powered:focus{outline:1px solid CanvasText;outline-offset:3px}}`;
 const accessCss = `.sf-page.access .sf-main{max-width:26rem;padding:clamp(42px,8vh,72px) 0}.sf-page.access h1{max-width:18ch;margin-bottom:14px;font:600 clamp(2rem,7vw,2.65rem)/1.12 var(--sf-font);letter-spacing:-.035em}.sf-page.access .sf-copy{font-size:15px;line-height:1.6}.sf-access-default{display:flex;width:100%;flex-direction:column;align-items:center}.sf-access-status{padding:10px 12px;border:1px solid color-mix(in srgb,var(--sf-fg) 10%,transparent);border-radius:8px;background:color-mix(in srgb,var(--sf-fg) 4%,transparent);color:var(--sf-fg)}.sf-access-lanes{display:flex;flex-direction:column;gap:16px;width:min(23rem,100%);margin-top:30px;text-align:left}.sf-access-lanes form{display:flex;flex-direction:column;gap:14px;margin:0}.sf-input{box-sizing:border-box;width:100%;min-height:46px;padding:11px 12px;border:1px solid color-mix(in srgb,var(--sf-fg) 18%,transparent);border-radius:8px;outline:2px solid transparent;outline-offset:-1px;background:color-mix(in srgb,var(--sf-bg) 92%,var(--sf-fg));color:var(--sf-fg);font:500 15px/1.45 var(--sf-font);appearance:none}.sf-input::placeholder{color:color-mix(in srgb,var(--sf-muted) 82%,transparent);font:inherit}.sf-input:hover{border-color:color-mix(in srgb,var(--sf-fg) 34%,transparent)}.sf-input:focus-visible{border-color:var(--sf-accent);outline-color:var(--sf-accent)}textarea.sf-input{min-height:92px;resize:vertical}.sf-label{color:var(--sf-fg);font:600 13px/1.4 var(--sf-font)}.sf-access-lanes .sf-button{width:100%;min-height:46px;border-radius:8px}.sf-access-or{display:flex;align-items:center;gap:12px;color:var(--sf-muted);font-size:13px}.sf-access-or:before,.sf-access-or:after{content:"";flex:1;border-top:1px solid color-mix(in srgb,var(--sf-fg) 12%,transparent)}.sf-error{margin:0;color:var(--sf-error);font-size:14px}.sf-access-password-row{display:flex;gap:8px}.sf-access-password-row .sf-input{min-width:0;flex:1}.sf-access-password-row .sf-button{width:auto;flex:none}.sf-access-request{padding-top:2px}.sf-access-request summary{padding:4px 0;cursor:pointer;color:var(--sf-muted);font:550 14px/1.5 var(--sf-font)}.sf-access-request summary:hover{color:var(--sf-fg)}.sf-access-request[open] summary{color:var(--sf-fg)}.sf-access-request form{margin-top:16px}@media(max-width:520px){.sf-page.access .sf-main{padding:38px 0}.sf-page.access h1{font-size:2rem}.sf-page.access .sf-copy{font-size:16px}.sf-input{min-height:48px;font-size:16px}.sf-access-lanes .sf-button{min-height:48px}.sf-access-password-row{flex-direction:column}.sf-access-password-row .sf-button{width:100%}}@media(prefers-color-scheme:dark){.sf-access-status{background:color-mix(in srgb,var(--sf-fg) 5%,transparent)}}`;
 const pageHeader = '<header class="sf-header"><a class="sf-brand" href="/" aria-label="Homepage"><span class="sf-brand-mark" aria-hidden="true"></span><sf-logo></sf-logo><strong><sf-name></sf-name></strong></a></header>';
 const pageFooter = "<sf-spacefast-branding></sf-spacefast-branding>";

package/dist/utils/publish-form-data.d.ts

@@ -19,4 +19,16 @@ export declare function createPublishFormData(input: {
     slug?: string | undefined;
     title?: string | undefined;
     description?: string | undefined;
+    /** Live promotion intent for archive builds; null produces an unpromoted ready version. */
+    channel?: "live" | null | undefined;
+    /**
+     * Control-plane-only provenance for the version's build/deploy read models —
+     * a compiled runtime (Zero capsule, Functions worker) declares its artifact
+     * here under its own key (e.g. `statticZero`). Same shape the CLI sends on the
+     * declared-session path; the multipart intake reads it from the `metadata`
+     * JSON field and folds it into `publishRequestSchema.sourceMetadata`.
+     */
+    sourceMetadata?: Record<string, unknown> | undefined;
+    /** Bounded build transcript recorded on the version when a build ran. */
+    buildLog?: string | undefined;
 }): FormData;

package/dist/utils/publish-form-data.js

@@ -5,6 +5,16 @@ export function createPublishFormData(input) {
         form.append("spaceId", input.spaceId);
     if (input.description)
         form.append("description", input.description);
+    // The multipart intake merges this JSON field into the parsed publish body
+    // (it reads `payload`/`publish`/`metadata`), so build provenance rides the
+    // one-shot form exactly as it rides the CLI's declared-session JSON body.
+    if (input.sourceMetadata || input.buildLog || input.channel !== undefined) {
+        form.append("metadata", JSON.stringify({
+            ...(input.sourceMetadata ? { sourceMetadata: input.sourceMetadata } : {}),
+            ...(input.buildLog ? { buildLog: input.buildLog } : {}),
+            ...(input.channel !== undefined ? { channel: input.channel } : {}),
+        }));
+    }
     if (input.slug || input.title) {
         form.append("space", JSON.stringify({
             ...(input.slug ? { slug: input.slug } : {}),

package/dist/utils/publish-policy.d.ts

@@ -4,7 +4,27 @@ export declare const MANIFEST_MAX_PATH_BYTES = 1024;
 export declare const MANIFEST_MAX_BODY_BYTES: number;
 export declare const MAX_VERSION_FILE_SIZE_BYTES: number;
 export declare const MAX_VERSION_TOTAL_BYTES: number;
+export declare const STATIC_EXECUTION_CONTROL_FILES: string[];
+export declare const STATIC_RUNTIME_CONTROL_SEGMENT_PREFIXES: string[];
+export declare const STATIC_RUNTIME_ROOT_SEGMENTS: string[];
+export declare const STATIC_RUNTIME_CONTROL_PATHS: string[];
+export declare const STATIC_RUNTIME_CONTROL_PREFIXES: string[];
 export declare function normalizePublishPath(relativePath: string): string;
+/**
+ * The one subtree inside the runtime control prefix that a publish may write.
+ *
+ * `sf publish` compiles a version's worker into `__spacefast/functions/bundles/`
+ * so the bundle travels through the ordinary manifest and upload path instead of
+ * needing a parallel one. Keeping it under the control prefix is what makes it
+ * unservable as static content by default — the runtime answers it only behind a
+ * signature.
+ *
+ * Scoped to `bundles/` rather than the whole `__spacefast/functions/` directory
+ * on purpose: the sibling `config.json` holds the key those signatures are
+ * minted with, and a publish that could overwrite it would be a publish that
+ * could mint its own tokens.
+ */
+export declare const PUBLISHABLE_BUILD_ARTIFACT_PREFIX = "__spacefast/functions/bundles/";
 export declare function publishPathIgnored(relativePath: string): boolean;
 export declare function publishPathIsConvention(relativePath: string): boolean;
 export declare function providerRuntimeFeatureWarnings(paths: readonly string[]): PublishManifestWarning[];

package/dist/utils/publish-policy.fixtures.json

@@ -0,0 +1,397 @@
+[
+    {
+        "path": "index.html",
+        "expected": null
+    },
+    {
+        "path": "index.php",
+        "expected": null,
+        "why": "never lands in the docroot, so it serves as inert bytes"
+    },
+    {
+        "path": "nested/deep/file.txt",
+        "expected": null
+    },
+    {
+        "path": "_redirects",
+        "expected": null
+    },
+    {
+        "path": ".well-known/security.txt",
+        "expected": null
+    },
+    {
+        "path": ".env.example",
+        "expected": null
+    },
+    {
+        "path": "docs/installer.php",
+        "expected": null
+    },
+    {
+        "path": "my__stattic_thing.txt",
+        "expected": null,
+        "why": "reserved names match a segment start, not mid-string"
+    },
+    {
+        "path": "assets/app__spacefast.js",
+        "expected": null
+    },
+    {
+        "path": "__sf",
+        "expected": "static_runtime_control_path_not_supported",
+        "why": "the '/__sf' namespace row matches the bare segment"
+    },
+    {
+        "path": "__sf/redeem",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "__SF/redeem",
+        "expected": "static_runtime_control_path_not_supported",
+        "why": "the row folds case"
+    },
+    {
+        "path": "__sf/access/open",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "__sfx/endpoint.json",
+        "expected": null,
+        "why": "'namespace' is whole-segment: /__sfx is not /__sf"
+    },
+    {
+        "path": "__SF_future/endpoint.json",
+        "expected": null
+    },
+    {
+        "path": "__sfoo.html",
+        "expected": null
+    },
+    {
+        "path": "nested/__sf/content.json",
+        "expected": null,
+        "why": "the table is only consulted for paths starting /__"
+    },
+    {
+        "path": "a/b/__sf/c.txt",
+        "expected": null
+    },
+    {
+        "path": "my__sf_thing.txt",
+        "expected": null
+    },
+    {
+        "path": "__span/index.html",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "__SPAN/collision.json",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "__spanish/page.html",
+        "expected": null,
+        "why": "the control table's own example of a tenant path"
+    },
+    {
+        "path": "nested/__span/x.json",
+        "expected": null
+    },
+    {
+        "path": "__spacefast/x.txt",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "__spacefast/api.php/state",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "__spacefast_generated/theme.css",
+        "expected": "static_runtime_control_path_not_supported",
+        "why": "the runtime writes generated assets here"
+    },
+    {
+        "path": "nested/__SPACEFAST/upl/files/index.html",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "__stattic/x.txt",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "__stattic_probe",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "a/__STATTIC_probe/x.txt",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "__stattic/functions/bundles/abc/bundle.json",
+        "expected": "static_runtime_control_path_not_supported",
+        "why": "the carve-out is __spacefast only"
+    },
+    {
+        "path": "__spacefast/functions/bundles/abc123/bundle.json",
+        "expected": null,
+        "why": "compiled Functions bundle"
+    },
+    {
+        "path": "__spacefast/functions/config.json",
+        "expected": "static_runtime_control_path_not_supported",
+        "why": "holds the key that signs bundle URLs"
+    },
+    {
+        "path": "__spacefast/functions/bundlesX/evil.json",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "__spacefast/zero/deploy.json",
+        "expected": null,
+        "why": "the Zero deploy record"
+    },
+    {
+        "path": "__spacefast/zero/DEPLOY.JSON",
+        "expected": "static_runtime_control_path_not_supported",
+        "why": "the deploy record is one exact path, not folded"
+    },
+    {
+        "path": "__Spacefast/zero/deploy.json",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "__spacefast/zero/deploy.json/evil",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "__spacefast/anything",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": ".htaccess",
+        "expected": "static_control_file_not_supported"
+    },
+    {
+        "path": "a/.htaccess",
+        "expected": "static_control_file_not_supported"
+    },
+    {
+        "path": "nested/.HTACCESS",
+        "expected": "static_control_file_not_supported"
+    },
+    {
+        "path": ".user.ini",
+        "expected": "static_control_file_not_supported"
+    },
+    {
+        "path": "nested/.User.INI",
+        "expected": "static_control_file_not_supported"
+    },
+    {
+        "path": "custom-redirects.php",
+        "expected": "static_runtime_control_path_not_supported",
+        "why": "engine-manifest.json aliases it into the docroot root"
+    },
+    {
+        "path": "CUSTOM-REDIRECTS.PHP",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "engine-manifest.json",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "entrypoint-shim.php",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "nested/custom-redirects.php",
+        "expected": null,
+        "why": "only the docroot root collides"
+    },
+    {
+        "path": "init.php",
+        "expected": null,
+        "why": "engine/init.php installs under .stattic/engine/, not the docroot"
+    },
+    {
+        "path": ".spacefast/storage/routes/current.php",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": ".spacefast/engine/init.php",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": ".stattic/storage/routes/current.php",
+        "expected": "static_runtime_control_path_not_supported",
+        "why": "legacy layout still serves"
+    },
+    {
+        "path": ".stattic/engine/init.php",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": ".spacefast/config.json",
+        "expected": null,
+        "why": "state dirs also carry publishable configuration"
+    },
+    {
+        "path": ".spacefast/routes.json",
+        "expected": null
+    },
+    {
+        "path": "nested/.SPACEFAST/routes.json",
+        "expected": null
+    },
+    {
+        "path": ".spacefast/agents/settings.json",
+        "expected": null
+    },
+    {
+        "path": ".stattic/routes.json",
+        "expected": null,
+        "why": "the legacy state dir carries the same publishable configuration"
+    },
+    {
+        "path": ".well-known/spacefast-runtime",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": ".well-known/stattic-runtime",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": ".WELL-KNOWN/SPACEFAST-RUNTIME",
+        "expected": "static_runtime_control_path_not_supported"
+    },
+    {
+        "path": "../escape.txt",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "a/../b.txt",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "a//b.txt",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "a/./b.txt",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "./a.txt",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "/absolute.txt",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "a\\b.txt",
+        "expected": "invalid_file_path",
+        "why": "backslash is never a separator at intake"
+    },
+    {
+        "path": " leading.txt",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "trailing.txt ",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "trailing./x",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "trailing /x",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "dir./file.txt",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": ".",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "..",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "a/",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "/",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "caf\u00e9.txt",
+        "expected": null,
+        "why": "already NFC"
+    },
+    {
+        "path": "cafe\u0301.txt",
+        "expected": "invalid_file_path",
+        "why": "NFD: the canonical form is NFC, and intake never rewrites"
+    },
+    {
+        "path": "\u4e2d.txt",
+        "expected": null
+    },
+    {
+        "path": "\u00fcber/stra\u00dfe.html",
+        "expected": null
+    },
+    {
+        "path": "emoji-\ud83d\ude80.txt",
+        "expected": null
+    },
+    {
+        "path": "a%20b.txt",
+        "expected": null,
+        "why": "percent escapes are decoded once BEFORE this policy, never here"
+    },
+    {
+        "path": "a%2Fb.txt",
+        "expected": null
+    },
+    {
+        "path": "100%.txt",
+        "expected": null
+    },
+    {
+        "path": "nul\u0000.txt",
+        "expected": "invalid_file_path",
+        "why": "a control character can never be part of a servable path"
+    },
+    {
+        "path": "bell\u0007.txt",
+        "expected": "invalid_file_path"
+    },
+    {
+        "path": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.txt",
+        "expected": null,
+        "why": "exactly 1024 bytes"
+    },
+    {
+        "path": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.txt",
+        "expected": "path_too_long",
+        "why": "1025 bytes"
+    },
+    {
+        "path": "\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9\u00e9.test",
+        "expected": "path_too_long",
+        "why": "1025 bytes: the cap counts bytes, not code points"
+    }
+]