@spacefast/common 0.0.23 → 0.0.24

package/dist/utils/publish-policy.js

@@ -55,24 +55,40 @@ const SENSITIVE_FILE_PATTERNS = [
     /\.(pem|key|p12|pfx)$/i,
 ];
 // Denied runtime private/control paths (spec "Static path policy").
-const STATIC_EXECUTION_CONTROL_FILES = new Set([".htaccess", ".user.ini"]);
+// Every list below is generated verbatim into runtime/engine/admin/upload-policy.php
+// by apps/control-plane/src/scripts/codegen-php-policy.ts, so the two enforcers
+// cannot hold different literals. Lowercase only — both sides fold the path first.
+export const STATIC_EXECUTION_CONTROL_FILES = [".htaccess", ".user.ini"];
 // Reserved runtime namespace segments are matched by PREFIX: the runtime owns
 // `/__spacefast/*` plus `__spacefast_generated/`, and the `__stattic` spelling
 // (`/__stattic_probe` today, more `/__stattic/*` routes planned) stays
 // reserved the same way. Mid-segment occurrences are ordinary content.
-const STATIC_RUNTIME_CONTROL_SEGMENT_PREFIXES = ["__spacefast", "__stattic"];
-// Compact platform endpoints live below `/__sf`. Reserve the complete root
-// segment prefix before the first endpoint ships so uploaded content can never
-// shadow a later platform route. Nested `__sf*` directories remain content.
-const STATIC_RUNTIME_ROOT_SEGMENT_PREFIXES = ["__sf"];
+export const STATIC_RUNTIME_CONTROL_SEGMENT_PREFIXES = ["__spacefast", "__stattic"];
+// Reserved as WHOLE root segments. In runtime/engine/shared/context.php the
+// control table gives `/__sf` and `/__span` `match => 'namespace', fold => true`
+// rows, and `_stattic_control_path_row()` reads `namespace` as `=== '/__sf' ||
+// starts_with('/__sf/')`, so `/__sfx/...` and `/__spanish/page` are ordinary
+// tenant paths. Reserving more than the front door claims would refuse a publish
+// of content the front door then happily serves as tenant content.
+//
+// This is a SUBSET of what the control table reserves, not a mirror of it: the
+// table also reserves the nested exact path `/__/collab` (the review link),
+// while the `/__/` prefix around it is tenant-publishable. Publish deliberately
+// does not claim that one — the reservation that matters is enforced at request
+// time, where serve.php refuses to let either a published file or a routing rule
+// answer a reserved route, and that refusal is what runtime/tests/collab-frame.test.ts
+// exercises by publishing a file at `__/collab` on purpose. The control table is
+// the authority; this list is a publish-time convenience, so keep it a subset
+// and never let it contradict the table.
+export const STATIC_RUNTIME_ROOT_SEGMENTS = ["__sf", "__span"];
 // Both the current and the legacy control-path spellings stay denied: spaces
 // published before the `.stattic` → `.spacefast` rename still serve from the
 // legacy on-disk layout, and user archives may carry either name.
-const STATIC_RUNTIME_CONTROL_PATHS = new Set([
+export const STATIC_RUNTIME_CONTROL_PATHS = [
     ".well-known/spacefast-runtime",
     ".well-known/stattic-runtime",
-]);
-const STATIC_RUNTIME_CONTROL_PREFIXES = [
+];
+export const STATIC_RUNTIME_CONTROL_PREFIXES = [
     ".spacefast/storage",
     ".spacefast/engine",
     ".stattic/storage",
@@ -95,7 +111,7 @@ export function normalizePublishPath(relativePath) {
  * minted with, and a publish that could overwrite it would be a publish that
  * could mint its own tokens.
  */
-const PUBLISHABLE_BUILD_ARTIFACT_PREFIX = "__spacefast/functions/bundles/";
+export const PUBLISHABLE_BUILD_ARTIFACT_PREFIX = "__spacefast/functions/bundles/";
 /**
  * The one FILE inside the control prefix a publish may write.
  *
@@ -137,8 +153,9 @@ export function publishPathIsConvention(relativePath) {
 }
 // Provider runtime features that have no Spacefast equivalent (spec "Routing And
 // Headers", migration diagnostics): Cloudflare Pages `_worker.js`/`_routes.json`
-// and Pages/Netlify function directories publish as inert content with a
-// warning so migrations are never silent.
+// and Netlify's provider-specific function directory publish as inert content
+// with a warning so migrations are never silent. A root `functions/` directory
+// is Spacefast's own file-router convention and must never reach this warning.
 function providerRuntimeFeatureForPath(path) {
     if (path === "_worker.js") {
         return "Cloudflare Pages _worker.js";
@@ -146,9 +163,6 @@ function providerRuntimeFeatureForPath(path) {
     if (path === "_routes.json") {
         return "Cloudflare Pages _routes.json";
     }
-    if (path.startsWith("functions/")) {
-        return "Pages Functions (functions/)";
-    }
     if (path.startsWith("netlify/functions/")) {
         return "Netlify Functions (netlify/functions/)";
     }
@@ -196,7 +210,10 @@ export function staticUploadPathViolation(path, options = {}) {
         return pathViolation("invalid_file_path", "File path is invalid.", rawPath);
     }
     if (normalizedPath !== rawPath) {
-        return pathViolation("invalid_file_path", "File path is invalid.", normalizedPath);
+        // The path the caller sent, not the normal form it missed: echoing a
+        // rewritten path suggests the rewrite was accepted, and it is the one place
+        // this policy used to report a different string than the runtime's copy.
+        return pathViolation("invalid_file_path", "File path is invalid.", rawPath);
     }
     if (new TextEncoder().encode(normalizedPath).length > MANIFEST_MAX_PATH_BYTES) {
         return pathViolation("path_too_long", `File paths support up to ${MANIFEST_MAX_PATH_BYTES} bytes in canonical form.`, normalizedPath);
@@ -208,7 +225,7 @@ export function staticUploadPathViolation(path, options = {}) {
     if (invalidSegment) {
         return pathViolation("invalid_file_path", "File path is invalid.", normalizedPath);
     }
-    if (STATIC_EXECUTION_CONTROL_FILES.has(lowerName)) {
+    if (STATIC_EXECUTION_CONTROL_FILES.includes(lowerName)) {
         return pathViolation("static_control_file_not_supported", "Static deploys cannot upload execution-control files.", normalizedPath);
     }
     const reservedRuntimeControlFiles = options.reservedRuntimeControlFiles
@@ -218,7 +235,7 @@ export function staticUploadPathViolation(path, options = {}) {
         return pathViolation("static_runtime_control_path_not_supported", "Static deploys cannot upload runtime control paths.", normalizedPath);
     }
     const lowerRootSegment = segments[0]?.toLowerCase() ?? "";
-    if (STATIC_RUNTIME_ROOT_SEGMENT_PREFIXES.some((prefix) => lowerRootSegment.startsWith(prefix))) {
+    if (STATIC_RUNTIME_ROOT_SEGMENTS.includes(lowerRootSegment)) {
         return pathViolation("static_runtime_control_path_not_supported", "Static deploys cannot upload runtime control paths.", normalizedPath);
     }
     const controlSegment = segments.find((segment) => {
@@ -231,7 +248,7 @@ export function staticUploadPathViolation(path, options = {}) {
     if (STATIC_RUNTIME_CONTROL_PREFIXES.some((prefix) => lowerPath === prefix || lowerPath.startsWith(`${prefix}/`))) {
         return pathViolation("static_runtime_control_path_not_supported", "Static deploys cannot upload runtime control paths.", normalizedPath);
     }
-    if (STATIC_RUNTIME_CONTROL_PATHS.has(lowerPath)) {
+    if (STATIC_RUNTIME_CONTROL_PATHS.includes(lowerPath)) {
         return pathViolation("static_runtime_control_path_not_supported", "Static deploys cannot upload runtime control paths.", normalizedPath);
     }
     return null;

package/dist/utils/push-new.d.ts

@@ -0,0 +1,7 @@
+import { type DeployEnv } from "../config/domains.js";
+export declare function pushNewRemoteUrl(input: {
+    slug: string;
+    token: string;
+    origin?: string;
+    environment?: Extract<DeployEnv, "dev" | "prod">;
+}): string;

package/dist/utils/push-new.js

@@ -0,0 +1,7 @@
+import { serviceOrigin } from "../config/domains.js";
+export function pushNewRemoteUrl(input) {
+    const url = new URL(`/${encodeURIComponent(input.slug)}`, input.origin ?? serviceOrigin("push", input.environment ?? "prod"));
+    url.username = "t";
+    url.password = input.token;
+    return url.toString();
+}

package/dist/utils/query-keys.d.ts

@@ -31,7 +31,6 @@ export declare const qk: {
     spaceComments: (id: string) => readonly ["spaces", string, "comments"];
     spaceCommentThread: (id: string, threadId: string) => readonly ["spaces", string, "comments", string];
     spaceActivity: (id: string, limit: number) => readonly ["spaces", string, "activity", number];
-    spaceDeployments: (id: string) => readonly ["spaces", string, "deployments"];
     spaceTags: (id: string) => readonly ["spaces", string, "tags"];
     spaceTagVersion: (id: string, versionId: string) => readonly ["spaces", string, "tags", string];
     spaceTagDiff: (id: string, versionId: string) => readonly ["spaces", string, "tags", string, "diff"];

package/dist/utils/query-keys.js

@@ -39,7 +39,6 @@ export const qk = {
     spaceComments: (id) => ["spaces", id, "comments"],
     spaceCommentThread: (id, threadId) => [...qk.spaceComments(id), threadId],
     spaceActivity: (id, limit) => ["spaces", id, "activity", limit],
-    spaceDeployments: (id) => ["spaces", id, "deployments"],
     spaceTags: (id) => ["spaces", id, "tags"],
     spaceTagVersion: (id, versionId) => ["spaces", id, "tags", versionId],
     spaceTagDiff: (id, versionId) => ["spaces", id, "tags", versionId, "diff"],

package/dist/utils/runtime-paths.d.ts

@@ -5,5 +5,10 @@ export declare const RUNTIME_HEALTH_PATH: "/__spacefast/health.php";
 export declare const RUNTIME_COMMENTS_CONFIG_PATH: "/__spacefast/comments/config";
 export declare const RUNTIME_COMMENTS_TICKET_PATH: "/__spacefast/comments/ticket";
 export declare const RUNTIME_COMMENTS_VERSION_URLS_PATH: "/__spacefast/comments/version-urls";
+/** The review workspace the orb expands into — a reserved control path on the
+ *  Space's own origin (collab-frame-plan §4), not part of the `/__spacefast`
+ *  exchange namespace because people paste this one into Slack.
+ *  The PHP mirror is SPACEFAST_COLLAB_FRAME_PATH in runtime/engine/shared/context.php. */
+export declare const RUNTIME_COLLAB_FRAME_PATH: "/__/collab";
 export declare function runtimeManagementPath(suffix: string): string;
 export declare function runtimeUploadPath(params: URLSearchParams | Record<string, string>): string;

package/dist/utils/runtime-paths.js

@@ -9,6 +9,11 @@ export const RUNTIME_HEALTH_PATH = `${SPACEFAST_RUNTIME_NAMESPACE}/health.php`;
 export const RUNTIME_COMMENTS_CONFIG_PATH = `${SPACEFAST_RUNTIME_NAMESPACE}/comments/config`;
 export const RUNTIME_COMMENTS_TICKET_PATH = `${SPACEFAST_RUNTIME_NAMESPACE}/comments/ticket`;
 export const RUNTIME_COMMENTS_VERSION_URLS_PATH = `${SPACEFAST_RUNTIME_NAMESPACE}/comments/version-urls`;
+/** The review workspace the orb expands into — a reserved control path on the
+ *  Space's own origin (collab-frame-plan §4), not part of the `/__spacefast`
+ *  exchange namespace because people paste this one into Slack.
+ *  The PHP mirror is SPACEFAST_COLLAB_FRAME_PATH in runtime/engine/shared/context.php. */
+export const RUNTIME_COLLAB_FRAME_PATH = "/__/collab";
 export function runtimeManagementPath(suffix) {
     const route = normalizeRuntimeRoute(suffix);
     if (route === "/") {

package/dist/utils/runtime-upload-batch.d.ts

@@ -1,13 +1,8 @@
 import { Buffer } from "node:buffer";
-import { RUNTIME_UPLOAD_BATCH_MAX_BYTES, RUNTIME_UPLOAD_BATCH_MAX_FILES } from "./runtime-upload.js";
-import { type UploadTarget } from "./upload-session.js";
-export { RUNTIME_UPLOAD_BATCH_MAX_BYTES, RUNTIME_UPLOAD_BATCH_MAX_FILES };
 export type RuntimeBatchArchiveEntry = {
     path: string;
     getBytes(): Buffer | Promise<Buffer>;
 };
-export declare function runtimeBatchUploadUnsupported(error: unknown): boolean;
-export declare function batchTargetForUploadTarget(uploadId: string, target: UploadTarget): UploadTarget | null;
 export declare function tarPathParts(filePath: string): {
     name: string;
     prefix: string;

package/dist/utils/runtime-upload-batch.js

@@ -1,31 +1,4 @@
 import { Buffer } from "node:buffer";
-import { RUNTIME_UPLOAD_BATCH_MAX_BYTES, RUNTIME_UPLOAD_BATCH_MAX_FILES, } from "./runtime-upload.js";
-import { UploadTargetError } from "./upload-session.js";
-// Batch planning + tar-writing wire contract shared by the CLI and the control
-// plane's inline publish path. This is the sender half of the runtime's tar
-// batch parser (runtime/engine/admin/upload.php); any change here must stay in
-// lockstep with that file.
-export { RUNTIME_UPLOAD_BATCH_MAX_BYTES, RUNTIME_UPLOAD_BATCH_MAX_FILES };
-export function runtimeBatchUploadUnsupported(error) {
-    return error instanceof UploadTargetError && (error.status === 404 || error.status === 405);
-}
-export function batchTargetForUploadTarget(uploadId, target) {
-    const url = new URL(target.url);
-    if (!url.pathname.endsWith("/upload.php")) {
-        return null;
-    }
-    url.search = new URLSearchParams({ op: "batch", upload_id: uploadId }).toString();
-    return {
-        ...target,
-        path: "__spacefast_batch.tar",
-        method: "POST",
-        url: url.toString(),
-        headers: {
-            ...target.headers,
-            "content-type": "application/x-tar",
-        },
-    };
-}
 export function tarPathParts(filePath) {
     if (Buffer.byteLength(filePath) <= 100) {
         return { name: filePath, prefix: "" };
@@ -57,6 +30,7 @@ export async function tarArchive(entries, pathTooLongError) {
         if (!parts) {
             throw pathTooLongError(entry.path);
         }
+        // oxlint-disable-next-line no-await-in-loop -- Tar entries must retain declared order.
         const body = Buffer.from(await entry.getBytes());
         const header = Buffer.alloc(512);
         header.write(parts.name, 0, Math.min(100, Buffer.byteLength(parts.name)), "utf8");

package/dist/utils/runtime-upload.d.ts

@@ -1,21 +1,11 @@
-export declare const RUNTIME_UPLOAD_METHOD: "PUT";
-export declare const RUNTIME_UPLOAD_BATCH_MAX_FILES = 500;
-export declare const RUNTIME_UPLOAD_BATCH_MAX_BYTES: number;
 export declare function runtimeUploadCanonicalPath(path: string): string;
-export declare function runtimeUploadSessionBaseUrl(input: {
-    baseUrl: string;
-    uploadId: string;
-}): string;
-export declare function runtimeUploadBatchUrl(input: {
-    baseUrl: string;
-    uploadId: string;
-}): string;
 export declare function runtimeUploadFetchUrl(input: {
     baseUrl: string;
     uploadId: string;
     path: string;
 }): string;
-export declare function runtimeUploadFileUrl(input: {
+export declare function runtimeUploadBlobUrl(input: {
     baseUrl: string;
-    path: string;
+    spaceId: string;
+    sha256: string;
 }): string;

package/dist/utils/runtime-upload.js

@@ -1,10 +1,4 @@
 import { runtimeUploadPath } from "./runtime-paths.js";
-export const RUNTIME_UPLOAD_METHOD = "PUT";
-// Mirrors STATTIC_RUNTIME_UPLOAD_BATCH_MAX_FILES/_MAX_BYTES in
-// runtime/engine/admin/upload.php (parity-guarded in
-// apps/control-plane/src/runtime/php-policy-parity.test.ts).
-export const RUNTIME_UPLOAD_BATCH_MAX_FILES = 500;
-export const RUNTIME_UPLOAD_BATCH_MAX_BYTES = 8 * 1024 * 1024;
 export function runtimeUploadCanonicalPath(path) {
     // Canonical path form (spec "Upload Contract"): UTF-8, Unicode NFC,
     // percent-encoded once. The runtime rejects non-canonical encodings.
@@ -14,12 +8,6 @@ export function runtimeUploadCanonicalPath(path) {
         .map((segment) => encodeURIComponent(segment))
         .join("/");
 }
-export function runtimeUploadSessionBaseUrl(input) {
-    return new URL(runtimeUploadPath({ op: "file", upload_id: input.uploadId, path: "" }), input.baseUrl).toString();
-}
-export function runtimeUploadBatchUrl(input) {
-    return new URL(runtimeUploadPath({ op: "batch", upload_id: input.uploadId }), input.baseUrl).toString();
-}
 export function runtimeUploadFetchUrl(input) {
     return new URL(runtimeUploadPath({
         op: "fetch",
@@ -27,6 +15,8 @@ export function runtimeUploadFetchUrl(input) {
         path: runtimeUploadCanonicalPath(input.path),
     }), input.baseUrl).toString();
 }
-export function runtimeUploadFileUrl(input) {
-    return `${input.baseUrl}${runtimeUploadCanonicalPath(input.path)}`;
+export function runtimeUploadBlobUrl(input) {
+    return new URL(runtimeUploadPath({
+        route: `/spaces/${encodeURIComponent(input.spaceId)}/blobs/${encodeURIComponent(input.sha256)}`,
+    }), input.baseUrl).toString();
 }

package/dist/utils/space-config.d.ts

@@ -1,5 +1,4 @@
 import { type Grant } from "../contracts/grants.js";
-import type { RuntimeKind } from "../contracts/execution.js";
 import { type SpaceConfig, type SpaceConfigFile } from "../contracts/space-config.js";
 export type SpaceConfigBlockingIssueCode = "config_file_too_large" | "config_templates_over_limit" | "config_meta_too_long" | "config_name_too_long" | "config_functions_key_removed" | "config_invalid" | "config_runtime_invalid_kind" | "config_runtime_entry_missing" | "inject_snippet_too_large" | "inject_invalid";
 export type SpaceConfigIssue = {
@@ -32,19 +31,6 @@ export declare const SPACE_CONFIG_FILE_ONLY_KEYS: readonly ["access", "name", "r
  */
 export declare function spaceConfigOverlayIssue(config: unknown): SpaceConfigBlockingIssue | null;
 export declare function stripJsonComments(raw: string): string;
-export type ParsedSpaceConfigFile = {
-    /** Parsed config (cap- and shape-valid keys only); null when unusable. */
-    config: SpaceConfigFile | null;
-    issues: SpaceConfigIssue[];
-};
-/**
- * Parses a raw `sf.jsonc` at finalize: 256 KB cap, JSONC tolerance,
- * routing-key rejection, unknown-key diagnostics, shared shape caps. Errors
- * fail the version; warnings ride version diagnostics.
- */
-export declare function parseSpaceConfigFile(raw: string, options?: {
-    path?: string;
-}): ParsedSpaceConfigFile;
 export type ResolvedServingConfig = {
     index: string | false;
     fallback: {
@@ -63,25 +49,6 @@ export type ResolvedServingConfig = {
     /** Resolved inject snippets; only honored when experimentalGutenberg is true. */
     inject: NonNullable<SpaceConfig["inject"]> | null;
 };
-export type EffectiveSpaceConfig = {
-    /** The merged SpaceConfig (defaults + file + overlay, key-wise). */
-    config: SpaceConfig;
-    /** Compiled serving primitives the runtime artifact stores. */
-    serving: ResolvedServingConfig;
-    issues: SpaceConfigIssue[];
-};
-/**
- * Resolves the effective SpaceConfig for a version at finalize (or
- * config-only regeneration). `manifestPaths` is the canonical committed file
- * set; `fileConfig` the parsed sf.jsonc (null when absent); `overlay`
- * the stored space config overlay (null when nothing overridden).
- */
-export declare function resolveEffectiveSpaceConfig(input: {
-    manifestPaths: ReadonlySet<string>;
-    fileConfig: SpaceConfig | null;
-    overlay: SpaceConfig | null;
-    runtimeKind?: RuntimeKind;
-}): EffectiveSpaceConfig;
 export type SpaceSettingsPatch = {
     mode?: "website" | "files" | undefined;
     spa?: boolean | undefined;