@spacefast/common 0.0.23 → 0.0.24

package/dist/contracts/functions.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { appRoutePathSchema, executionCapabilitiesSchema, executionLogEntrySchema, executionLogListQuerySchema, executionLogListResponseSchema, executionSha256Schema, httpMethodSchema, runtimeKindSchema, } from "./execution.js";
+import { appRoutePathSchema, executionCapabilitiesSchema, executionSha256Schema, httpMethodSchema, } from "./execution.js";
 /**
  * Spacefast Functions: tenant workers run as Cloudflare Dynamic Workers.
  *
@@ -37,6 +37,13 @@ import { appRoutePathSchema, executionCapabilitiesSchema, executionLogEntrySchem
  * than transactional. That is why capsules are a different product rather
  * than a placement option — see `endpointIsPortable` in `./execution.js`.
  */
+/**
+ * The tag a compiled worker artifact carries — in `functionsSourceFinalizeSchema`
+ * and the runtime config built from it — so the PHP origin can tell what it is
+ * dispatching (`functions-dispatch.php` refuses a config tagged anything else).
+ * It is a property of the artifact the tree produced, not a kind a space or a
+ * version declares: a publish can carry this beside a capsule.
+ */
 export const FUNCTIONS_RUNTIME_KIND = "functions";
 export const FUNCTIONS_SOURCE_METADATA_KEY = "spacefastFunctions";
 export const FUNCTIONS_PLATFORM_ROUTE_PREFIX = "/__spacefast/functions";
@@ -45,6 +52,17 @@ export const FUNCTIONS_RUNTIME_ROUTE_PATHS = {
     /** Where a dispatched worker calls back for brokered capabilities. */
     relay: `${FUNCTIONS_PLATFORM_ROUTE_PREFIX}/relay`,
 };
+/**
+ * Where invocation counts are reported, on the CONTROL PLANE rather than the
+ * space origin.
+ *
+ * The two destinations are separate on purpose. Logs are the tenant's content
+ * and stay on their own origin; usage is a number the platform bills from and
+ * goes straight to us. Sharing one channel would make either destination a
+ * plausible place to look for the other's data, and would put log volume on the
+ * path that has to stay cheap.
+ */
+export const FUNCTIONS_USAGE_INTAKE_PATH = "/v1/runtime/functions/usage";
 /** Public, signed read path. Distinct from storage so the token is never a filename. */
 export const FUNCTIONS_BUNDLE_ROUTE_PREFIX = `${FUNCTIONS_PLATFORM_ROUTE_PREFIX}/b`;
 export const FUNCTIONS_RUNTIME_STORAGE_ROOT = "__spacefast/functions";
@@ -221,6 +239,18 @@ export const functionsWorkerArtifactSchema = z
      * so an injected dependency cannot widen authority at runtime.
      */
     capabilities: executionCapabilitiesSchema,
+    /**
+     * Platform-owned runtime services this build needs. This is deliberately
+     * separate from author capabilities: an OpenNext build needs durable cache
+     * storage even when the application itself declares no database or fetch
+     * access, and that storage must never become a general tenant credential.
+     */
+    platform: z
+        .object({
+        nextCache: z.boolean().default(false),
+    })
+        .strict()
+        .default({ nextCache: false }),
 })
     .strict();
 /**
@@ -232,13 +262,24 @@ export const functionsWorkerArtifactSchema = z
  * *grants*, resolved by the control plane at finalize so the origin forwards a
  * decision rather than making one. Anything absent fails closed at the relay.
  */
-export const FUNCTIONS_DISPATCH_CAPABILITIES = ["db.read", "db.write", "fetch", "log"];
+export const FUNCTIONS_DISPATCH_CAPABILITIES = [
+    "storage.read",
+    "storage.write",
+    "db.read",
+    "db.write",
+    "fetch",
+    "log",
+    "next.cache",
+    "gravatar.profile",
+    "spam.check",
+    "email.send",
+];
 export const functionsDispatchCapabilitySchema = z.enum(FUNCTIONS_DISPATCH_CAPABILITIES);
 /**
  * Resolves a build's declared capabilities into the grant a dispatch carries.
  *
- * Three of the six declared capabilities have no dispatch counterpart, and each
- * for its own reason:
+ * Three declared capabilities have no dispatch counterpart, each for its own
+ * reason:
  *
  * - `env` is not a runtime call at all. Values are resolved at finalize and
  *   travel in the config, so a worker reading `env` reaches nothing.
@@ -250,9 +291,17 @@ export const functionsDispatchCapabilitySchema = z.enum(FUNCTIONS_DISPATCH_CAPAB
  * touches the database, not how. Narrowing it would take per-statement analysis
  * we do not do, and guessing "read-only" from a declaration would be a grant
  * the author never asked for and cannot see.
+ *
+ * The three platform-service grants are named for the operation an author
+ * reaches for, and each covers its service's whole operation set for the same
+ * reason `db` widens: a declaration says a handler uses spam checking, not that
+ * it never files a correction.
  */
-export function functionsDispatchCapabilities(capabilities) {
-    const granted = new Set();
+export function functionsDispatchCapabilities(capabilities, platform = {}) {
+    // Storage is the durable, unversioned substrate every app receives. It is a
+    // base binding like the Zero client's `storage`, not a source-declared
+    // capability that disappears when a new version omits an import.
+    const granted = new Set(["storage.read", "storage.write"]);
     if (capabilities.db) {
         granted.add("db.read");
         granted.add("db.write");
@@ -263,14 +312,26 @@ export function functionsDispatchCapabilities(capabilities) {
     if (capabilities.logging) {
         granted.add("log");
     }
+    if (capabilities.gravatar) {
+        granted.add("gravatar.profile");
+    }
+    if (capabilities.spam) {
+        granted.add("spam.check");
+    }
+    if (capabilities.email) {
+        granted.add("email.send");
+    }
+    if (platform.nextCache) {
+        granted.add("next.cache");
+    }
     // Filtered from the canonical list so the order is stable: the grant is part
     // of the host's isolate identity, and a reordering would retire warm isolates
     // for no reason.
     return FUNCTIONS_DISPATCH_CAPABILITIES.filter((capability) => granted.has(capability));
 }
-/** Everything except `log` needs the relay to mean anything. */
+/** Logs and the host-local Next cache do not transit the origin relay. */
 export function functionsGrantNeedsRelay(granted) {
-    return granted.some((capability) => capability !== "log");
+    return granted.some((capability) => capability !== "log" && capability !== "next.cache");
 }
 /**
  * What the space origin needs in order to dispatch to the host on its own. The
@@ -321,6 +382,26 @@ export const functionsRelayConfigSchema = z
     maxConcurrentCalls: z.number().int().min(1).max(64),
 })
     .strict();
+/**
+ * Where the execution host reports how much this version ran.
+ *
+ * Absent means uncounted, not refused: a space whose configuration predates
+ * usage reporting must keep serving, and an execution tier that cannot reach
+ * the control plane must never fail a request over it. Counting is reporting
+ * only — nothing here throttles, and no limit is enforced anywhere from it.
+ */
+export const functionsUsageConfigSchema = z
+    .object({
+    url: z.string().url(),
+    /**
+     * Minted and verified by the control plane alone; the space only forwards
+     * it. Version-scoped like the relay credential, and folded into the host's
+     * isolate identity for the same reason: a rotated credential must not
+     * outlive its rotation inside a warm isolate.
+     */
+    token: z.string().min(1),
+})
+    .strict();
 /**
  * What a build declares about its worker — everything the CLI can know from the
  * author's project alone.
@@ -349,15 +430,17 @@ export const functionsSourceFinalizeSchema = z
  * The document the control plane sends to the runtime, which the engine stores
  * beside the version's files and the origin reads on every dispatch.
  *
- * It is the build's declaration plus the four things only the platform can
- * supply: where to dispatch, what the worker is allowed to do, the credential
- * that lets it do those things, and the resolved values of its variables.
+ * It is the build's declaration plus the things only the platform can supply:
+ * where to dispatch, what the worker is allowed to do, the credentials that let
+ * it do those things and report what it did, and the resolved values of its
+ * variables.
  */
 export const functionsRuntimeConfigSchema = functionsSourceFinalizeSchema
     .extend({
     host: functionsHostConfigSchema,
-    grantedCapabilities: z.array(functionsDispatchCapabilitySchema).max(8).default([]),
+    grantedCapabilities: z.array(functionsDispatchCapabilitySchema).max(10).default([]),
     relay: functionsRelayConfigSchema.nullable().default(null),
+    usage: functionsUsageConfigSchema.nullable().default(null),
     /**
      * Resolved at finalize, so a worker reading configuration never calls back
      * to us for it — and so rotating a variable is a republish with an audit
@@ -396,6 +479,7 @@ export function createFunctionsSourceFinalize(input) {
             compatibilityFlags: input.compatibilityFlags ?? [],
             routes: input.routes ?? [],
             capabilities: input.capabilities ?? {},
+            platform: { nextCache: input.nextCache ?? false },
         },
         variables: {
             source: "spacefast-variables",
@@ -421,10 +505,12 @@ export const functionsExecutionStateSchema = z.enum([
     "serving",
 ]);
 /**
- * What a live worker is, as the `app` member of a space's runtime status.
+ * What a live worker is, as the `worker` member of a space's runtime status.
+ *
+ * It carries no kind tag. The member it rides in already says which product
+ * answered, and the same tree can carry a capsule beside it — a discriminant
+ * here could only repeat the field name or contradict its sibling.
  *
- * Shaped like `zeroAppSchema` and discriminated by the same `runtimeKind`, so a
- * reader switches on one field rather than probing for which product answered.
  * No `versionId`: the status response it rides in already names the live
  * version.
  *
@@ -435,7 +521,6 @@ export const functionsExecutionStateSchema = z.enum([
  */
 export const functionsAppSchema = z
     .object({
-    runtimeKind: z.literal(FUNCTIONS_RUNTIME_KIND),
     artifactId: z.string().min(1),
     appName: z.string().min(1),
     entry: z.string().min(1),
@@ -455,21 +540,3 @@ export const functionsAppSchema = z
         .strict(),
 })
     .strict();
-/**
- * The wire shape of the origin's log-read route, not a public API contract.
- *
- * Handler logs reach callers through `GET /v1/spaces/:spaceId/logs/runtime`,
- * which serves the platform's own `runtimeLogListResponseSchema` for both
- * execution tiers. These aliases describe the hop underneath it: a worker tails
- * its output to the origin that dispatched it, and the control plane reads it
- * back from there. Keeping them named after this product is the point — the
- * origin is the only place a wp.cloud-hosted space keeps anything, and Zero's
- * records never travel this path at all.
- */
-export const functionsLogEntrySchema = executionLogEntrySchema;
-export const functionsLogListQuerySchema = executionLogListQuerySchema;
-export const functionsLogListResponseSchema = executionLogListResponseSchema;
-/** Narrows a space's live runtime kind to this product. */
-export function isFunctionsRuntime(kind) {
-    return kind === FUNCTIONS_RUNTIME_KIND;
-}

package/dist/contracts/git.d.ts

@@ -8,8 +8,8 @@ export declare const buildTarget: z.ZodEnum<{
 export declare const buildTrigger: z.ZodEnum<{
     push: "push";
     manual: "manual";
-    pull_request: "pull_request";
     retry: "retry";
+    pull_request: "pull_request";
 }>;
 export declare const buildEnvironmentScopeValues: readonly ["runtime", "build", "build:production", "build:preview"];
 export declare const buildEnvironmentScope: z.ZodEnum<{

package/dist/contracts/grants.d.ts

@@ -8,9 +8,6 @@ export declare const grantCapabilitySchema: z.ZodEnum<{
     "access.manage": "access.manage";
 }>;
 export type GrantCapability = z.infer<typeof grantCapabilitySchema>;
-export declare const GRANT_CAPABILITY_PRESETS: readonly ["view", "comment", "publish", "manage"];
-export type GrantCapabilityPreset = (typeof GRANT_CAPABILITY_PRESETS)[number];
-export declare const GRANT_PRESET_CAPABILITIES: Record<GrantCapabilityPreset, GrantCapability[]>;
 export declare const GRANT_AUDIENCE_KINDS: readonly ["public", "team", "person", "link", "password", "machine", "external"];
 export declare const grantAudienceKindSchema: z.ZodEnum<{
     link: "link";
@@ -1079,6 +1076,13 @@ export declare const identityConnectionPublicKeySchema: z.ZodObject<{
     publicKey: z.ZodString;
 }, z.core.$strict>;
 export type IdentityConnectionPublicKey = z.infer<typeof identityConnectionPublicKeySchema>;
+/**
+ * Issuers the platform stamps on its own external Grants. A Team-configured
+ * connection may not claim one: the authority reference an external audience
+ * resolves to is derived from (issuer, subject), and these three resolve into
+ * the platform's own `member:` / `claim-preview:` / owner namespaces.
+ */
+export declare const RESERVED_IDENTITY_CONNECTION_ISSUERS: readonly ["spacefast-membership", "claim-preview", "spacefast-owner"];
 export declare const identityConnectionCreateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"oidc">;
     name: z.ZodString;

package/dist/contracts/grants.js

@@ -9,13 +9,6 @@ export const GRANT_CAPABILITIES = [
     "access.manage",
 ];
 export const grantCapabilitySchema = z.enum(GRANT_CAPABILITIES);
-export const GRANT_CAPABILITY_PRESETS = ["view", "comment", "publish", "manage"];
-export const GRANT_PRESET_CAPABILITIES = {
-    view: ["page.view"],
-    comment: ["page.view", "comments.read", "comments.write"],
-    publish: ["page.view", "content.publish"],
-    manage: ["page.view", "comments.read", "comments.write", "content.publish", "access.manage"],
-};
 export const GRANT_AUDIENCE_KINDS = [
     "public",
     "team",
@@ -714,12 +707,28 @@ export const identityConnectionPublicKeySchema = z
         .regex(/^[A-Za-z0-9_-]{43}$/, "publicKey must be a raw Ed25519 public key"),
 })
     .strict();
+/**
+ * Issuers the platform stamps on its own external Grants. A Team-configured
+ * connection may not claim one: the authority reference an external audience
+ * resolves to is derived from (issuer, subject), and these three resolve into
+ * the platform's own `member:` / `claim-preview:` / owner namespaces.
+ */
+export const RESERVED_IDENTITY_CONNECTION_ISSUERS = [
+    "spacefast-membership",
+    "claim-preview",
+    "spacefast-owner",
+];
+const identityConnectionIssuerSchema = z
+    .string()
+    .min(1)
+    .max(1024)
+    .refine((issuer) => !RESERVED_IDENTITY_CONNECTION_ISSUERS.includes(issuer.trim()), { message: "issuer is reserved by Spacefast" });
 export const identityConnectionCreateSchema = z.discriminatedUnion("type", [
     z
         .object({
         type: z.literal("oidc"),
         name: z.string().trim().min(1).max(200),
-        issuer: z.string().min(1).max(1024),
+        issuer: identityConnectionIssuerSchema,
         clientId: z.string().min(1).max(512),
         clientSecret: z.string().min(1).max(2048),
         sessionTtlSeconds: z
@@ -734,7 +743,7 @@ export const identityConnectionCreateSchema = z.discriminatedUnion("type", [
         .object({
         type: z.literal("signer"),
         name: z.string().trim().min(1).max(200),
-        issuer: z.string().min(1).max(1024),
+        issuer: identityConnectionIssuerSchema,
         authorizeUrl: z.string().min(1).max(2048),
         publicKeys: z.array(identityConnectionPublicKeySchema).min(1).max(5),
         sessionTtlSeconds: z.number().int().min(60).max(EXTERNAL_IDENTITY_MAX_TTL_SECONDS).optional(),

package/dist/contracts/internal.d.ts

@@ -11,6 +11,19 @@ export declare const manifestFileSchema: z.ZodObject<{
     contentType: z.ZodOptional<z.ZodString>;
     sourceUrl: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+export declare const uploadManifestFileSchema: z.ZodUnion<readonly [z.ZodObject<{
+    path: z.ZodString;
+    size: z.ZodNumber;
+    contentType: z.ZodOptional<z.ZodString>;
+    sourceUrl: z.ZodOptional<z.ZodString>;
+    sha256: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    path: z.ZodString;
+    size: z.ZodNumber;
+    sha256: z.ZodOptional<z.ZodString>;
+    contentType: z.ZodOptional<z.ZodString>;
+    sourceUrl: z.ZodString;
+}, z.core.$strip>]>;
 export declare const pendingUploadSchema: z.ZodObject<{
     path: z.ZodString;
     size: z.ZodNumber;
@@ -84,8 +97,8 @@ export declare const uploadInstructionsSchema: z.ZodObject<{
             code: z.ZodString;
             severity: z.ZodEnum<{
                 info: "info";
-                error: "error";
                 warning: "warning";
+                error: "error";
             }>;
             message: z.ZodString;
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;

package/dist/contracts/internal.js

@@ -5,23 +5,33 @@ export const conventionFilesSchema = z.object({
     headers: z.string().optional(),
     routes: z.string().optional(),
 });
+const manifestSha256Schema = z
+    .string()
+    .regex(/^[0-9a-f]{64}$/, "sha256 must be 64 lowercase hex characters without a prefix.")
+    .describe("SHA-256 content digest: exactly 64 lowercase hex characters, no `sha256:` prefix (Version.manifestHash is the only prefixed form).");
+const manifestSourceUrlSchema = z
+    .string()
+    .url()
+    .describe("HTTPS URL the runtime can fetch directly instead of receiving local bytes.");
 export const manifestFileSchema = z.object({
     path: z
         .string()
         .describe("Version-relative POSIX path. Canonicalized at intake to UTF-8 NFC, percent-decoded exactly once; max 1,024 bytes in canonical form."),
     size: z.number().int().nonnegative().describe("File size in bytes."),
-    sha256: z
-        .string()
-        .regex(/^[0-9a-f]{64}$/, "sha256 must be 64 lowercase hex characters without a prefix.")
+    sha256: manifestSha256Schema
         .optional()
-        .describe("Optional SHA-256 content digest: exactly 64 lowercase hex characters, no `sha256:` prefix (Version.manifestHash is the only prefixed form). Omit it for fastest first uploads; include it on updates so unchanged files are never re-uploaded."),
+        .describe("SHA-256 content digest: exactly 64 lowercase hex characters, no `sha256:` prefix (Version.manifestHash is the only prefixed form). Required when the caller uploads local bytes; may be absent on historical records and sourceUrl entries."),
     contentType: z.string().optional().describe("Optional content type for serving metadata."),
-    sourceUrl: z
-        .string()
-        .url()
+    sourceUrl: manifestSourceUrlSchema
         .optional()
         .describe("Optional HTTPS URL the runtime can fetch directly for this file instead of receiving bytes from the client."),
 });
+export const uploadManifestFileSchema = z
+    .union([
+    manifestFileSchema.extend({ sha256: manifestSha256Schema }),
+    manifestFileSchema.extend({ sourceUrl: manifestSourceUrlSchema }),
+])
+    .describe("A declared upload file. Local bytes require sha256. A sourceUrl entry may omit sha256 because the runtime computes it while fetching.");
 export const pendingUploadSchema = manifestFileSchema.pick({
     path: true,
     size: true,

package/dist/contracts/oauth-resources.d.ts

@@ -3,7 +3,7 @@ export declare const OAUTH_AUTHORIZATION_SERVER_PATH: "/v1/auth";
  * mcp origin (`https://mcp.<domain>`), so it has no path entry here. */
 export declare const OAUTH_API_RESOURCE_PATH: "/v1";
 export type OAuthResourceKey = "api" | "mcp";
-export declare const OAUTH_API_RESOURCE_SCOPES: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write"];
+export declare const OAUTH_API_RESOURCE_SCOPES: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "spaces:publish", "builds:trigger"];
 export declare const OAUTH_MCP_TOOL_SCOPE: "mcp:tools";
 export declare const OAUTH_OFFLINE_ACCESS_SCOPE: "offline_access";
 export declare const OAUTH_MCP_RESOURCE_SCOPES: readonly ["mcp:tools", "teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write"];
@@ -16,6 +16,7 @@ export declare const OAUTH_MCP_RESOURCE_SCOPES: readonly ["mcp:tools", "teams:re
  * is the list of capabilities the dashboard and CLI offer per agent account.
  */
 export declare const OAUTH_MCP_RESOURCE_ALLOWED_SCOPES: readonly ["mcp:tools", "teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "offline_access"];
+export declare const OAUTH_API_RESOURCE_ALLOWED_SCOPES: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "spaces:publish", "builds:trigger", "offline_access"];
 /**
  * Interactive MCP clients should be useful after one consent. Authorization is
  * still bounded by the user's live team role and by approval gates around
@@ -23,13 +24,13 @@ export declare const OAUTH_MCP_RESOURCE_ALLOWED_SCOPES: readonly ["mcp:tools", "
  * capabilities. Machine clients may continue to request a narrower set.
  */
 export declare const OAUTH_MCP_DEFAULT_SCOPES: readonly ["mcp:tools", "teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "offline_access"];
-export declare const OAUTH_PROVIDER_SCOPES: readonly ["openid", "profile", "email", "offline_access", "teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "mcp:tools"];
+export declare const OAUTH_PROVIDER_SCOPES: readonly ["openid", "profile", "email", "offline_access", "teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "spaces:publish", "builds:trigger", "mcp:tools"];
 export declare const OAUTH_RESOURCE_DEFINITIONS: {
     readonly api: {
         readonly key: "api";
         readonly name: "Spacefast API";
         readonly accessTokenTtlSeconds: number;
-        readonly allowedScopes: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write"];
+        readonly allowedScopes: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "spaces:publish", "builds:trigger", "offline_access"];
     };
     readonly mcp: {
         readonly key: "mcp";

package/dist/contracts/oauth-resources.js

@@ -2,7 +2,7 @@ export const OAUTH_AUTHORIZATION_SERVER_PATH = "/v1/auth";
 /** The API resource is a path on the api origin; the MCP resource is the whole
  * mcp origin (`https://mcp.<domain>`), so it has no path entry here. */
 export const OAUTH_API_RESOURCE_PATH = "/v1";
-export const OAUTH_API_RESOURCE_SCOPES = [
+const OAUTH_SHARED_API_RESOURCE_SCOPES = [
     "teams:read",
     "teams:create",
     "spaces:read",
@@ -12,11 +12,16 @@ export const OAUTH_API_RESOURCE_SCOPES = [
     "domains:read",
     "domains:write",
 ];
+export const OAUTH_API_RESOURCE_SCOPES = [
+    ...OAUTH_SHARED_API_RESOURCE_SCOPES,
+    "spaces:publish",
+    "builds:trigger",
+];
 export const OAUTH_MCP_TOOL_SCOPE = "mcp:tools";
 export const OAUTH_OFFLINE_ACCESS_SCOPE = "offline_access";
 export const OAUTH_MCP_RESOURCE_SCOPES = [
     OAUTH_MCP_TOOL_SCOPE,
-    ...OAUTH_API_RESOURCE_SCOPES,
+    ...OAUTH_SHARED_API_RESOURCE_SCOPES,
 ];
 /**
  * A resource's `allowedScopes` is intersected with the requested scopes on every
@@ -30,6 +35,10 @@ export const OAUTH_MCP_RESOURCE_ALLOWED_SCOPES = [
     ...OAUTH_MCP_RESOURCE_SCOPES,
     OAUTH_OFFLINE_ACCESS_SCOPE,
 ];
+export const OAUTH_API_RESOURCE_ALLOWED_SCOPES = [
+    ...OAUTH_API_RESOURCE_SCOPES,
+    OAUTH_OFFLINE_ACCESS_SCOPE,
+];
 /**
  * Interactive MCP clients should be useful after one consent. Authorization is
  * still bounded by the user's live team role and by approval gates around
@@ -50,7 +59,7 @@ export const OAUTH_RESOURCE_DEFINITIONS = {
         key: "api",
         name: "Spacefast API",
         accessTokenTtlSeconds: 15 * 60,
-        allowedScopes: OAUTH_API_RESOURCE_SCOPES,
+        allowedScopes: OAUTH_API_RESOURCE_ALLOWED_SCOPES,
     },
     mcp: {
         key: "mcp",

package/dist/contracts/operations.d.ts

@@ -10,7 +10,6 @@ export declare const userOperationKindSchema: z.ZodEnum<{
     domain_transfer_submit: "domain_transfer_submit";
     domain_dns_apply: "domain_dns_apply";
     domain_lifecycle: "domain_lifecycle";
-    variable_cascade: "variable_cascade";
     webhook_deliver: "webhook_deliver";
     integration_release: "integration_release";
 }>;
@@ -37,8 +36,8 @@ export declare const UserOperationSchema: z.ZodObject<{
         code: z.ZodString;
         severity: z.ZodEnum<{
             info: "info";
-            error: "error";
             warning: "warning";
+            error: "error";
         }>;
         message: z.ZodString;
         path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -65,7 +64,6 @@ export declare const UserOperationSchema: z.ZodObject<{
         domain_transfer_submit: "domain_transfer_submit";
         domain_dns_apply: "domain_dns_apply";
         domain_lifecycle: "domain_lifecycle";
-        variable_cascade: "variable_cascade";
         webhook_deliver: "webhook_deliver";
         integration_release: "integration_release";
     }>;
@@ -112,8 +110,8 @@ export declare const operationListResponseSchema: z.ZodObject<{
             code: z.ZodString;
             severity: z.ZodEnum<{
                 info: "info";
-                error: "error";
                 warning: "warning";
+                error: "error";
             }>;
             message: z.ZodString;
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -140,7 +138,6 @@ export declare const operationListResponseSchema: z.ZodObject<{
             domain_transfer_submit: "domain_transfer_submit";
             domain_dns_apply: "domain_dns_apply";
             domain_lifecycle: "domain_lifecycle";
-            variable_cascade: "variable_cascade";
             webhook_deliver: "webhook_deliver";
             integration_release: "integration_release";
         }>;
@@ -162,3 +159,91 @@ export declare const operationListResponseSchema: z.ZodObject<{
         hasMore: z.ZodBoolean;
     }, z.core.$strip>;
 }, z.core.$strip>;
+/** Buckets an operator triages by. Live buckets partition the live population:
+ *  a queued row is exactly one of ready / scheduled / blocked. */
+export declare const SUPERADMIN_OPERATION_FILTERS: readonly ["all", "ready", "scheduled", "blocked", "running", "stuck", "retrying", "failed", "succeeded", "canceled"];
+export type SuperadminOperationFilter = (typeof SUPERADMIN_OPERATION_FILTERS)[number];
+export declare const superadminOperationListQuerySchema: z.ZodObject<{
+    filter: z.ZodDefault<z.ZodEnum<{
+        all: "all";
+        failed: "failed";
+        canceled: "canceled";
+        ready: "ready";
+        running: "running";
+        succeeded: "succeeded";
+        scheduled: "scheduled";
+        blocked: "blocked";
+        stuck: "stuck";
+        retrying: "retrying";
+    }>>;
+    eventType: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    order: z.ZodDefault<z.ZodEnum<{
+        newest: "newest";
+        oldest: "oldest";
+    }>>;
+}, z.core.$strip>;
+export type SuperadminOperationListQuery = z.infer<typeof superadminOperationListQuerySchema>;
+export declare const SuperadminOperationRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    eventType: z.ZodString;
+    status: z.ZodString;
+    resourceType: z.ZodString;
+    resourceId: z.ZodString;
+    attempts: z.ZodNumber;
+    dueAt: z.ZodNullable<z.ZodString>;
+    leaseExpiresAt: z.ZodNullable<z.ZodString>;
+    stuck: z.ZodBoolean;
+    blockedByOperationId: z.ZodNullable<z.ZodString>;
+    inflightKey: z.ZodNullable<z.ZodString>;
+    lastError: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    finishedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const SuperadminOperationListSchema: z.ZodObject<{
+    operations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        eventType: z.ZodString;
+        status: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+        attempts: z.ZodNumber;
+        dueAt: z.ZodNullable<z.ZodString>;
+        leaseExpiresAt: z.ZodNullable<z.ZodString>;
+        stuck: z.ZodBoolean;
+        blockedByOperationId: z.ZodNullable<z.ZodString>;
+        inflightKey: z.ZodNullable<z.ZodString>;
+        lastError: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+        finishedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    total: z.ZodNumber;
+    windowHours: z.ZodNumber;
+}, z.core.$strip>;
+export declare const SuperadminOperationSummarySchema: z.ZodObject<{
+    windowHours: z.ZodNumber;
+    live: z.ZodObject<{
+        ready: z.ZodNumber;
+        scheduled: z.ZodNumber;
+        blocked: z.ZodNumber;
+        running: z.ZodNumber;
+        stuck: z.ZodNumber;
+        retrying: z.ZodNumber;
+    }, z.core.$strip>;
+    recent: z.ZodObject<{
+        succeeded: z.ZodNumber;
+        failed: z.ZodNumber;
+        canceled: z.ZodNumber;
+    }, z.core.$strip>;
+    oldestReadyAt: z.ZodNullable<z.ZodString>;
+    oldestRunningAt: z.ZodNullable<z.ZodString>;
+    kinds: z.ZodArray<z.ZodObject<{
+        eventType: z.ZodString;
+        ready: z.ZodNumber;
+        running: z.ZodNumber;
+        stuck: z.ZodNumber;
+        failed: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;