@spacefast/common 0.0.23 → 0.0.24

package/dist/config/domains.d.ts

@@ -1,7 +1,7 @@
 /** Deployment environment a URL is being built for. */
 export type DeployEnv = "dev" | "test" | "prod";
 /** Logical services that each get their own host. */
-export type Service = "www" | "api" | "dashboard" | "superadmin" | "cast" | "mcp" | "fieldguide";
+export type Service = "www" | "api" | "dashboard" | "superadmin" | "cast" | "mcp" | "push" | "fieldguide";
 export type EnvDomains = {
     /** Apex/base origin for the marketing site (the `www` service + bare apex). */
     readonly apex: string;

package/dist/config/domains.js

@@ -29,6 +29,7 @@ export function envDomainsFor(domain) {
             superadmin: `superadmin.${domain}`,
             cast: `cast.${domain}`,
             mcp: `mcp.${domain}`,
+            push: prod ? "push.new" : `push.${domain}`,
             fieldguide: prod ? "pitch.view.fast" : `fieldguide.${domain}`,
         },
     };

package/dist/config/index.d.ts

@@ -1,2 +1 @@
 export * from "./domains.js";
-export * from "./postgres-budget.js";

package/dist/config/index.js

@@ -1,4 +1,3 @@
 // Public entry for the centralized domain/URL registry.
 // Consumers import from "@spacefast/common/config".
 export * from "./domains.js";
-export * from "./postgres-budget.js";

package/dist/contracts/abuse.d.ts

@@ -80,6 +80,8 @@ export declare const superadminAbuseReportListQuerySchema: z.ZodObject<{
         actioned: "actioned";
         closed: "closed";
     }>>;
+    spaceId: z.ZodOptional<z.ZodString>;
+    hostname: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const superadminAbuseReportPatchSchema: z.ZodObject<{
     status: z.ZodEnum<{

package/dist/contracts/abuse.js

@@ -44,6 +44,18 @@ export const superadminAbuseReportSchema = abuseReportSchema.extend({
 });
 export const superadminAbuseReportListQuerySchema = cursorListQuerySchema.extend({
     status: abuseReportStatusSchema.optional().describe("Filter the triage list by status."),
+    spaceId: z
+        .string()
+        .trim()
+        .min(1)
+        .optional()
+        .describe("Filter to reports that resolved to one Space."),
+    hostname: z
+        .string()
+        .trim()
+        .min(1)
+        .optional()
+        .describe("Filter by the normalized reported hostname; matching is case-insensitive."),
 });
 export const superadminAbuseReportPatchSchema = z.object({
     status: abuseReportStatusSchema.describe("New triage status; must be a valid transition from the current status."),

package/dist/contracts/access.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { type GrantCapability } from "./grants.js";
 export declare const SPACE_ACCESS_PRESETS: readonly ["private", "team", "public"];
 export declare const ACCESS_HANDOFF_MEDIA_TYPE = "application/vnd.spacefast.access-handoff+json";
 export declare const spaceAccessPresetSchema: z.ZodEnum<{
@@ -7,6 +8,13 @@ export declare const spaceAccessPresetSchema: z.ZodEnum<{
     private: "private";
 }>;
 export type SpaceAccessPreset = z.infer<typeof spaceAccessPresetSchema>;
+/**
+ * The sharing vocabulary. Capabilities are the ground truth; a role is a named
+ * set of them, ordered from least to most. This is the only role enum and the
+ * only role⇄capability mapping in the product — every surface (dashboard, CLI,
+ * API, comments) names access with these four words and derives capabilities
+ * here rather than keeping its own preset list.
+ */
 export declare const ACCESS_ROLES: readonly ["viewer", "commenter", "editor", "manager"];
 export declare const accessRoleSchema: z.ZodEnum<{
     viewer: "viewer";
@@ -15,6 +23,31 @@ export declare const accessRoleSchema: z.ZodEnum<{
     manager: "manager";
 }>;
 export type AccessRole = z.infer<typeof accessRoleSchema>;
+export declare const ACCESS_ROLE_CAPABILITIES: {
+    readonly viewer: readonly ["page.view"];
+    readonly commenter: readonly ["page.view", "comments.read", "comments.write"];
+    readonly editor: readonly ["page.view", "comments.read", "comments.write", "content.publish"];
+    readonly manager: readonly ["page.view", "comments.read", "comments.write", "content.publish", "access.manage"];
+};
+export declare function accessRoleCapabilities(role: AccessRole): GrantCapability[];
+/**
+ * The role a capability set amounts to, named by the strongest capability it
+ * carries. A Grant assembled capability-by-capability need not match a role
+ * exactly; this reports the role it reaches, never more.
+ */
+export declare function accessRoleForCapabilities(capabilities: readonly GrantCapability[]): AccessRole;
+/**
+ * Roles a credential-backed audience can carry. A Link or a password is a
+ * secret anyone can forward, so it never publishes and never manages access —
+ * the same boundary `grantSchema` enforces on the capabilities themselves.
+ */
+export declare const VISITOR_ACCESS_ROLES: readonly ["viewer", "commenter"];
+export type VisitorAccessRole = (typeof VISITOR_ACCESS_ROLES)[number];
+export declare const linkCapabilitySchema: z.ZodEnum<{
+    "page.view": "page.view";
+    "comments.read": "comments.read";
+    "comments.write": "comments.write";
+}>;
 export declare function accessRoleRank(role: AccessRole): number;
 export declare function maxAccessRole(left: AccessRole | null, right: AccessRole | null): AccessRole | null;
 /**
@@ -51,6 +84,17 @@ export declare const personGrantSchema: z.ZodObject<{
         editor: "editor";
         manager: "manager";
     }>;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"all_versions">;
+    }, z.core.$strict>], "kind">;
     createdAt: z.ZodString;
     revokedAt: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
@@ -81,6 +125,17 @@ export declare const spacePersonSchema: z.ZodObject<{
             editor: "editor";
             manager: "manager";
         }>;
+        target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"live">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"version">;
+            versionId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"branch">;
+            branch: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"all_versions">;
+        }, z.core.$strict>], "kind">;
         createdAt: z.ZodString;
         revokedAt: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
@@ -125,6 +180,17 @@ export declare const spacePeopleListSchema: z.ZodObject<{
                 editor: "editor";
                 manager: "manager";
             }>;
+            target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"live">;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"version">;
+                versionId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"branch">;
+                branch: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"all_versions">;
+            }, z.core.$strict>], "kind">;
             createdAt: z.ZodString;
             revokedAt: z.ZodNullable<z.ZodString>;
         }, z.core.$strip>>;
@@ -355,6 +421,26 @@ export declare const linkCapabilitiesSchema: z.ZodArray<z.ZodEnum<{
     "comments.write": "comments.write";
 }>>;
 export type LinkCapabilities = z.infer<typeof linkCapabilitiesSchema>;
+export declare const personGrantWriteSchema: z.ZodObject<{
+    scope: z.ZodString;
+    role: z.ZodEnum<{
+        viewer: "viewer";
+        commenter: "commenter";
+        editor: "editor";
+        manager: "manager";
+    }>;
+    target: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"all_versions">;
+    }, z.core.$strict>], "kind">>;
+}, z.core.$strip>;
 export declare const spacePersonInviteWriteSchema: z.ZodObject<{
     email: z.ZodString;
     grants: z.ZodArray<z.ZodObject<{
@@ -365,17 +451,20 @@ export declare const spacePersonInviteWriteSchema: z.ZodObject<{
             editor: "editor";
             manager: "manager";
         }>;
+        target: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"live">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"version">;
+            versionId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"branch">;
+            branch: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"all_versions">;
+        }, z.core.$strict>], "kind">>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
-export declare const personGrantWriteSchema: z.ZodObject<{
-    scope: z.ZodString;
-    role: z.ZodEnum<{
-        viewer: "viewer";
-        commenter: "commenter";
-        editor: "editor";
-        manager: "manager";
-    }>;
-}, z.core.$strip>;
+export type PersonGrantWrite = z.infer<typeof personGrantWriteSchema>;
 export declare const spacePersonGrantSetWriteSchema: z.ZodObject<{
     grants: z.ZodArray<z.ZodObject<{
         scope: z.ZodString;
@@ -385,6 +474,17 @@ export declare const spacePersonGrantSetWriteSchema: z.ZodObject<{
             editor: "editor";
             manager: "manager";
         }>;
+        target: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"live">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"version">;
+            versionId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"branch">;
+            branch: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"all_versions">;
+        }, z.core.$strict>], "kind">>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const accessShareLinkCreateSchema: z.ZodObject<{
@@ -530,6 +630,15 @@ export declare const teamSpaceAccessDefaultWriteSchema: z.ZodObject<{
 }, z.core.$strip>;
 export declare const ACCESS_TOKEN_KID = "spacefast-runtime-v1";
 export declare const ACCESS_TOKEN_ALG = "EdDSA";
+/**
+ * The claim-schema version every platform token carries in `v`. One signer,
+ * one claim contract: a verifier that understands v1 refuses a token minted
+ * under a later shape instead of reading unknown claims optimistically.
+ */
+export declare const PLATFORM_TOKEN_CLAIM_VERSION: 1;
+export declare const BLOB_GATE_DOWNLOAD_TTL_SECONDS: number;
+export declare const BLOB_GATE_SCAN_TTL_SECONDS: number;
+export declare const BLOB_GATE_UPLOAD_TTL_SECONDS: number;
 export declare const RUNTIME_JWKS_WELL_KNOWN_FILENAME = "spacefast-runtime-jwks.json";
 export declare const accessTokenPublicProfileSchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
@@ -538,6 +647,8 @@ export declare const accessTokenPublicProfileSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type AccessTokenPublicProfile = z.infer<typeof accessTokenPublicProfileSchema>;
 export declare const accessTokenPayloadSchema: z.ZodObject<{
+    purpose: z.ZodLiteral<"handoff">;
+    v: z.ZodLiteral<1>;
     sub: z.ZodString;
     principal: z.ZodOptional<z.ZodString>;
     authorities: z.ZodArray<z.ZodString>;
@@ -546,6 +657,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<{
     iat: z.ZodNumber;
     iss: z.ZodString;
     aud: z.ZodString;
+    host: z.ZodString;
     spaceId: z.ZodString;
     sid: z.ZodString;
     generation: z.ZodNumber;

package/dist/contracts/access.js

@@ -6,8 +6,48 @@ import { grantConstraintsPatchSchema, grantConstraintsSchema, grantResourceSetSc
 export const SPACE_ACCESS_PRESETS = ["private", "team", "public"];
 export const ACCESS_HANDOFF_MEDIA_TYPE = "application/vnd.spacefast.access-handoff+json";
 export const spaceAccessPresetSchema = z.enum(SPACE_ACCESS_PRESETS);
+/**
+ * The sharing vocabulary. Capabilities are the ground truth; a role is a named
+ * set of them, ordered from least to most. This is the only role enum and the
+ * only role⇄capability mapping in the product — every surface (dashboard, CLI,
+ * API, comments) names access with these four words and derives capabilities
+ * here rather than keeping its own preset list.
+ */
 export const ACCESS_ROLES = ["viewer", "commenter", "editor", "manager"];
 export const accessRoleSchema = z.enum(ACCESS_ROLES);
+export const ACCESS_ROLE_CAPABILITIES = {
+    viewer: ["page.view"],
+    commenter: ["page.view", "comments.read", "comments.write"],
+    editor: ["page.view", "comments.read", "comments.write", "content.publish"],
+    manager: ["page.view", "comments.read", "comments.write", "content.publish", "access.manage"],
+};
+export function accessRoleCapabilities(role) {
+    return [...ACCESS_ROLE_CAPABILITIES[role]];
+}
+/**
+ * The role a capability set amounts to, named by the strongest capability it
+ * carries. A Grant assembled capability-by-capability need not match a role
+ * exactly; this reports the role it reaches, never more.
+ */
+export function accessRoleForCapabilities(capabilities) {
+    if (capabilities.includes("access.manage"))
+        return "manager";
+    if (capabilities.includes("content.publish"))
+        return "editor";
+    if (capabilities.includes("comments.write"))
+        return "commenter";
+    return "viewer";
+}
+/**
+ * Roles a credential-backed audience can carry. A Link or a password is a
+ * secret anyone can forward, so it never publishes and never manages access —
+ * the same boundary `grantSchema` enforces on the capabilities themselves.
+ */
+export const VISITOR_ACCESS_ROLES = [
+    "viewer",
+    "commenter",
+];
+export const linkCapabilitySchema = z.enum(["page.view", "comments.read", "comments.write"]);
 export function accessRoleRank(role) {
     return ACCESS_ROLES.indexOf(role);
 }
@@ -134,6 +174,7 @@ export const personGrantSchema = z.object({
     id: z.string().min(1),
     scope: accessScopePathSchema,
     role: accessRoleSchema,
+    target: grantTargetSelectorSchema,
     createdAt: z.string().datetime(),
     revokedAt: z.string().datetime().nullable(),
 });
@@ -184,7 +225,7 @@ export const accessShareLinkSchema = z.object({
     name: z.string().min(1),
     landingPath: accessScopePathSchema,
     resources: grantResourceSetSchema,
-    capabilities: z.array(z.enum(["page.view", "comments.read", "comments.write"])).min(1),
+    capabilities: z.array(linkCapabilitySchema).min(1),
     constraints: grantConstraintsSchema,
     target: grantTargetSelectorSchema,
     createdBy: z.string().nullable(),
@@ -240,7 +281,7 @@ export const accessFenceKindValues = ["none", "ownership", "exposure"];
 export const accessFenceKindSchema = z.enum(accessFenceKindValues);
 export const ACCESS_GRANT_SCOPE_LIMIT = 32;
 export const linkCapabilitiesSchema = z
-    .array(z.enum(["page.view", "comments.read", "comments.write"]))
+    .array(linkCapabilitySchema)
     .min(1)
     .refine((capabilities) => capabilities.includes("page.view"), {
     message: "Link capabilities must include page.view",
@@ -248,16 +289,16 @@ export const linkCapabilitiesSchema = z
     .refine((capabilities) => new Set(capabilities).size === capabilities.length, {
     message: "Link capabilities must be unique",
 });
-export const spacePersonInviteWriteSchema = z.object({
-    email: z.string().email(),
-    grants: z
-        .array(z.object({ scope: accessScopePathSchema, role: accessRoleSchema }))
-        .min(1)
-        .max(ACCESS_GRANT_SCOPE_LIMIT),
-});
 export const personGrantWriteSchema = z.object({
     scope: accessScopePathSchema,
     role: accessRoleSchema,
+    // A Person can be invited to the live site, to one immutable Version, to a
+    // branch, or to every Version — the same selector Links and Grants take.
+    target: grantTargetSelectorSchema.default({ kind: "live" }),
+});
+export const spacePersonInviteWriteSchema = z.object({
+    email: z.string().email(),
+    grants: z.array(personGrantWriteSchema).min(1).max(ACCESS_GRANT_SCOPE_LIMIT),
 });
 export const spacePersonGrantSetWriteSchema = z.object({
     grants: z.array(personGrantWriteSchema).min(1).max(ACCESS_GRANT_SCOPE_LIMIT),
@@ -317,6 +358,15 @@ export const teamSpaceAccessDefaultWriteSchema = z.object({
 // ---------------------------------------------------------------------------
 export const ACCESS_TOKEN_KID = "spacefast-runtime-v1";
 export const ACCESS_TOKEN_ALG = "EdDSA";
+/**
+ * The claim-schema version every platform token carries in `v`. One signer,
+ * one claim contract: a verifier that understands v1 refuses a token minted
+ * under a later shape instead of reading unknown claims optimistically.
+ */
+export const PLATFORM_TOKEN_CLAIM_VERSION = 1;
+export const BLOB_GATE_DOWNLOAD_TTL_SECONDS = 10 * 60;
+export const BLOB_GATE_SCAN_TTL_SECONDS = 60 * 60;
+export const BLOB_GATE_UPLOAD_TTL_SECONDS = 60 * 60;
 export const RUNTIME_JWKS_WELL_KNOWN_FILENAME = "spacefast-runtime-jwks.json";
 // Public identity attached only when a token consumer needs to render the
 // person behind an authority. Collaboration tickets carry this audience-bound
@@ -335,6 +385,13 @@ export const accessTokenPublicProfileSchema = z
 })
     .strict();
 export const accessTokenPayloadSchema = z.object({
+    // Typed purpose from the one platform signer. The runtime REQUIRES exactly
+    // this value before consuming the jti: a system-view token (or any other
+    // purpose signed by the same key) can never redeem into a visitor session,
+    // and a handoff can never pass a system-view check.
+    purpose: z.literal("handoff"),
+    // Claim-schema version stamped by the one signer.
+    v: z.literal(PLATFORM_TOKEN_CLAIM_VERSION),
     sub: authorityReferenceSchema,
     // Who this handoff authenticated, when it authenticated anybody. The account
     // lane names the signed-in user; the invite and identity-connection lanes
@@ -348,7 +405,14 @@ export const accessTokenPayloadSchema = z.object({
     nbf: z.number().int().nonnegative(),
     iat: z.number().int().nonnegative(),
     iss: z.string().min(1),
+    // The Space this handoff belongs to, and the token's identity: a Space keeps
+    // its id across claim, rename, and every custom domain it later answers on,
+    // so the audience is stable where a serving host is not.
     aud: z.string().min(1),
+    // The lowercased serving host the handoff was minted for. Host binding did
+    // not go away when `aud` stopped carrying it — it lives here, and the runtime
+    // rejects a token presented on any other host.
+    host: z.string().min(1),
     spaceId: z.string().min(1),
     // Shared opaque identity for the runtime session and its access-origin
     // collaboration session. It is random per handoff and never authorizes by itself.

package/dist/contracts/activity.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export declare const ACTIVITY_EVENT_CODES: readonly ["space.created", "space.claimed", "feedback.lead_claim_pending", "space.transferred", "space.move_requested", "space.moved", "space.expired", "space.disabled", "space.enabled", "space.deleted", "space.config_updated", "space.slug_updated", "site.provision_requested", "site.placement_hold_set", "site.placement_hold_cleared", "site.burst_toggled", "space.access_logout_all", "space.access_transfer_scrub", "space.share_link_created", "space.share_link_revoked", "space.access_request_created", "space.access_request_resolved", "space.grant_created", "space.grant_updated", "space.grant_revoked", "team.access_defaults_updated", "version.created", "version.ready", "version.warning", "version.failed", "version.expired", "version.canceled", "version.deleted", "version.retention_warning", "version.retention_deleted", "channel.promoted", "build.created", "build.succeeded", "build.failed", "build.canceled", "build.skipped", "domain.created", "domain.verified", "domain.verification_failed", "domain.control_lost", "domain.dns_updated", "domain.nameservers_updated", "domain.registration_purchased", "domain.registration_renewed", "domain.registration_expiring", "domain.registration_expired", "domain.transfer_in_started", "domain.transfer_out_started", "domain.deleted", "domain.attached", "domain.activated", "domain.blocked", "domain.detached", "transfer.requested", "transfer.confirmed", "transfer.completed", "transfer.canceled", "transfer.expired", "transfer.failed", "variable.updated", "variable.deleted", "api_key.created", "api_key.updated", "api_key.revoked", "agent_handoff.created", "agent_handoff.redeemed", "agent_handoff.revoked", "webhook.created", "webhook.updated", "webhook.secret_rotated", "webhook.disabled", "webhook.deleted", "team.updated", "team.slug_updated", "team.member_added", "team.member_removed", "team.member_role_updated", "team.builds_deploys_quota_exceeded", "tenant.past_due", "tenant.suspended", "tenant.reactivated", "tenant.deleted", "export.ready", "export.failed", "import.ready", "import.failed", "comment.token_minted", "comment.created", "comment.reply_created", "comment.archived", "comment.unarchived", "abuse_report.created", "abuse_report.updated", "claim.blocked_takedown", "claim.authority_rotated", "user.created", "user.signed_in", "user.deleted", "user.impersonation_started", "user.impersonation_stopped", "user.two_factor_enabled", "user.two_factor_disabled"];
+export declare const ACTIVITY_EVENT_CODES: readonly ["space.created", "space.claimed", "feedback.lead_claim_pending", "space.transferred", "space.expired", "space.disabled", "space.enabled", "space.deleted", "space.config_updated", "space.slug_updated", "site.provision_requested", "site.placement_hold_set", "site.placement_hold_cleared", "site.burst_toggled", "space.access_logout_all", "space.access_transfer_scrub", "space.share_link_created", "space.share_link_revoked", "space.access_request_created", "space.access_request_resolved", "space.grant_created", "space.grant_updated", "space.grant_revoked", "team.access_defaults_updated", "version.created", "version.ready", "version.warning", "version.failed", "version.expired", "version.canceled", "version.deleted", "channel.promoted", "build.created", "build.succeeded", "build.failed", "build.canceled", "build.skipped", "domain.created", "domain.verified", "domain.verification_failed", "domain.control_lost", "domain.dns_updated", "domain.nameservers_updated", "domain.registration_purchased", "domain.registration_renewed", "domain.registration_expiring", "domain.registration_expired", "domain.transfer_in_started", "domain.transfer_out_started", "domain.deleted", "domain.attached", "domain.activated", "domain.blocked", "domain.detached", "transfer.requested", "transfer.confirmed", "transfer.completed", "transfer.canceled", "transfer.expired", "transfer.failed", "variable.updated", "variable.deleted", "api_key.created", "api_key.updated", "api_key.revoked", "agent_handoff.created", "agent_handoff.redeemed", "agent_handoff.revoked", "webhook.created", "webhook.updated", "webhook.secret_rotated", "webhook.disabled", "webhook.deleted", "team.updated", "team.slug_updated", "team.member_added", "team.member_removed", "team.member_role_updated", "team.builds_deploys_quota_exceeded", "tenant.past_due", "tenant.suspended", "tenant.reactivated", "tenant.deleted", "comment.token_minted", "comment.created", "comment.reply_created", "comment.archived", "comment.unarchived", "abuse_report.created", "abuse_report.updated", "claim.blocked_takedown", "claim.authority_rotated", "user.created", "user.signed_in", "user.deleted", "user.impersonation_started", "user.impersonation_stopped", "user.two_factor_enabled", "user.two_factor_disabled"];
 export type ActivityEventCode = (typeof ACTIVITY_EVENT_CODES)[number];
 export declare function isActivityEventCode(value: string): value is ActivityEventCode;
 export declare function isValidActivityEventFilter(filter: string): boolean;

package/dist/contracts/activity.js

@@ -11,8 +11,6 @@ export const ACTIVITY_EVENT_CODES = [
     "space.claimed",
     "feedback.lead_claim_pending",
     "space.transferred",
-    "space.move_requested",
-    "space.moved",
     "space.expired",
     "space.disabled",
     "space.enabled",
@@ -43,8 +41,6 @@ export const ACTIVITY_EVENT_CODES = [
     "version.expired",
     "version.canceled",
     "version.deleted",
-    "version.retention_warning",
-    "version.retention_deleted",
     // channel
     "channel.promoted",
     // build
@@ -109,11 +105,6 @@ export const ACTIVITY_EVENT_CODES = [
     "tenant.suspended",
     "tenant.reactivated",
     "tenant.deleted",
-    // export / import
-    "export.ready",
-    "export.failed",
-    "import.ready",
-    "import.failed",
     // comments
     "comment.token_minted",
     "comment.created",