@spacefast/common 0.0.23 → 0.0.26

package/dist/utils/publish-policy.js

@@ -2,7 +2,7 @@ import { BRAND } from "../brand.js";
 import { WORST_CASE_QUOTAS } from "../contracts/quotas.js";
 import { SPACE_CONFIG_PRIVATE_FILES } from "../contracts/space-config.js";
 import { ZERO_RUNTIME_DEPLOY_PATH } from "../contracts/zero.js";
-// The ONE static publish policy (internal-docs/platform.md "Upload Contract"):
+// The ONE static publish policy (the platform spec "Upload Contract"):
 // path denials, manifest scale caps, plan caps, duplicate detection, and the
 // free-plan content rules live here. Consumed by API manifest validation, CLI
 // local preflight, inline archive extraction, and the runtime parity fixtures
@@ -55,24 +55,40 @@ const SENSITIVE_FILE_PATTERNS = [
     /\.(pem|key|p12|pfx)$/i,
 ];
 // Denied runtime private/control paths (spec "Static path policy").
-const STATIC_EXECUTION_CONTROL_FILES = new Set([".htaccess", ".user.ini"]);
+// Every list below is generated verbatim into runtime/engine/admin/upload-policy.php
+// by apps/control-plane/src/scripts/codegen-php-policy.ts, so the two enforcers
+// cannot hold different literals. Lowercase only — both sides fold the path first.
+export const STATIC_EXECUTION_CONTROL_FILES = [".htaccess", ".user.ini"];
 // Reserved runtime namespace segments are matched by PREFIX: the runtime owns
 // `/__spacefast/*` plus `__spacefast_generated/`, and the `__stattic` spelling
 // (`/__stattic_probe` today, more `/__stattic/*` routes planned) stays
 // reserved the same way. Mid-segment occurrences are ordinary content.
-const STATIC_RUNTIME_CONTROL_SEGMENT_PREFIXES = ["__spacefast", "__stattic"];
-// Compact platform endpoints live below `/__sf`. Reserve the complete root
-// segment prefix before the first endpoint ships so uploaded content can never
-// shadow a later platform route. Nested `__sf*` directories remain content.
-const STATIC_RUNTIME_ROOT_SEGMENT_PREFIXES = ["__sf"];
+export const STATIC_RUNTIME_CONTROL_SEGMENT_PREFIXES = ["__spacefast", "__stattic"];
+// Reserved as WHOLE root segments. In runtime/engine/shared/context.php the
+// control table gives `/__sf` and `/__span` `match => 'namespace', fold => true`
+// rows, and `_stattic_control_path_row()` reads `namespace` as `=== '/__sf' ||
+// starts_with('/__sf/')`, so `/__sfx/...` and `/__spanish/page` are ordinary
+// tenant paths. Reserving more than the front door claims would refuse a publish
+// of content the front door then happily serves as tenant content.
+//
+// This is a SUBSET of what the control table reserves, not a mirror of it: the
+// table also reserves the nested exact path `/__/collab` (the review link),
+// while the `/__/` prefix around it is tenant-publishable. Publish deliberately
+// does not claim that one — the reservation that matters is enforced at request
+// time, where serve.php refuses to let either a published file or a routing rule
+// answer a reserved route, and that refusal is what runtime/tests/collab-frame.test.ts
+// exercises by publishing a file at `__/collab` on purpose. The control table is
+// the authority; this list is a publish-time convenience, so keep it a subset
+// and never let it contradict the table.
+export const STATIC_RUNTIME_ROOT_SEGMENTS = ["__sf", "__span"];
 // Both the current and the legacy control-path spellings stay denied: spaces
 // published before the `.stattic` → `.spacefast` rename still serve from the
 // legacy on-disk layout, and user archives may carry either name.
-const STATIC_RUNTIME_CONTROL_PATHS = new Set([
+export const STATIC_RUNTIME_CONTROL_PATHS = [
     ".well-known/spacefast-runtime",
     ".well-known/stattic-runtime",
-]);
-const STATIC_RUNTIME_CONTROL_PREFIXES = [
+];
+export const STATIC_RUNTIME_CONTROL_PREFIXES = [
     ".spacefast/storage",
     ".spacefast/engine",
     ".stattic/storage",
@@ -95,7 +111,14 @@ export function normalizePublishPath(relativePath) {
  * minted with, and a publish that could overwrite it would be a publish that
  * could mint its own tokens.
  */
-const PUBLISHABLE_BUILD_ARTIFACT_PREFIX = "__spacefast/functions/bundles/";
+export const PUBLISHABLE_BUILD_ARTIFACT_PREFIX = "__spacefast/functions/bundles/";
+/**
+ * The bundle carve-out's sibling for the Next-cache seed document: the same
+ * reasoning (travel through the ordinary manifest and upload path, stay
+ * unservable by default), the same deliberate narrowness (a prefix of its
+ * own, never the whole `functions/` directory — see the bundle comment).
+ */
+export const PUBLISHABLE_SEED_ARTIFACT_PREFIX = "__spacefast/functions/seeds/";
 /**
  * The one FILE inside the control prefix a publish may write.
  *
@@ -111,6 +134,7 @@ const PUBLISHABLE_BUILD_ARTIFACT_PREFIX = "__spacefast/functions/bundles/";
  */
 function isPublishableBuildArtifactPath(normalizedPath, lowerPath) {
     return (lowerPath.startsWith(PUBLISHABLE_BUILD_ARTIFACT_PREFIX) ||
+        lowerPath.startsWith(PUBLISHABLE_SEED_ARTIFACT_PREFIX) ||
         normalizedPath === ZERO_RUNTIME_DEPLOY_PATH);
 }
 export function publishPathIgnored(relativePath) {
@@ -137,8 +161,9 @@ export function publishPathIsConvention(relativePath) {
 }
 // Provider runtime features that have no Spacefast equivalent (spec "Routing And
 // Headers", migration diagnostics): Cloudflare Pages `_worker.js`/`_routes.json`
-// and Pages/Netlify function directories publish as inert content with a
-// warning so migrations are never silent.
+// and Netlify's provider-specific function directory publish as inert content
+// with a warning so migrations are never silent. A root `functions/` directory
+// is Spacefast's own file-router convention and must never reach this warning.
 function providerRuntimeFeatureForPath(path) {
     if (path === "_worker.js") {
         return "Cloudflare Pages _worker.js";
@@ -146,9 +171,6 @@ function providerRuntimeFeatureForPath(path) {
     if (path === "_routes.json") {
         return "Cloudflare Pages _routes.json";
     }
-    if (path.startsWith("functions/")) {
-        return "Pages Functions (functions/)";
-    }
     if (path.startsWith("netlify/functions/")) {
         return "Netlify Functions (netlify/functions/)";
     }
@@ -196,7 +218,10 @@ export function staticUploadPathViolation(path, options = {}) {
         return pathViolation("invalid_file_path", "File path is invalid.", rawPath);
     }
     if (normalizedPath !== rawPath) {
-        return pathViolation("invalid_file_path", "File path is invalid.", normalizedPath);
+        // The path the caller sent, not the normal form it missed: echoing a
+        // rewritten path suggests the rewrite was accepted, and it is the one place
+        // this policy used to report a different string than the runtime's copy.
+        return pathViolation("invalid_file_path", "File path is invalid.", rawPath);
     }
     if (new TextEncoder().encode(normalizedPath).length > MANIFEST_MAX_PATH_BYTES) {
         return pathViolation("path_too_long", `File paths support up to ${MANIFEST_MAX_PATH_BYTES} bytes in canonical form.`, normalizedPath);
@@ -208,7 +233,7 @@ export function staticUploadPathViolation(path, options = {}) {
     if (invalidSegment) {
         return pathViolation("invalid_file_path", "File path is invalid.", normalizedPath);
     }
-    if (STATIC_EXECUTION_CONTROL_FILES.has(lowerName)) {
+    if (STATIC_EXECUTION_CONTROL_FILES.includes(lowerName)) {
         return pathViolation("static_control_file_not_supported", "Static deploys cannot upload execution-control files.", normalizedPath);
     }
     const reservedRuntimeControlFiles = options.reservedRuntimeControlFiles
@@ -218,7 +243,7 @@ export function staticUploadPathViolation(path, options = {}) {
         return pathViolation("static_runtime_control_path_not_supported", "Static deploys cannot upload runtime control paths.", normalizedPath);
     }
     const lowerRootSegment = segments[0]?.toLowerCase() ?? "";
-    if (STATIC_RUNTIME_ROOT_SEGMENT_PREFIXES.some((prefix) => lowerRootSegment.startsWith(prefix))) {
+    if (STATIC_RUNTIME_ROOT_SEGMENTS.includes(lowerRootSegment)) {
         return pathViolation("static_runtime_control_path_not_supported", "Static deploys cannot upload runtime control paths.", normalizedPath);
     }
     const controlSegment = segments.find((segment) => {
@@ -231,7 +256,7 @@ export function staticUploadPathViolation(path, options = {}) {
     if (STATIC_RUNTIME_CONTROL_PREFIXES.some((prefix) => lowerPath === prefix || lowerPath.startsWith(`${prefix}/`))) {
         return pathViolation("static_runtime_control_path_not_supported", "Static deploys cannot upload runtime control paths.", normalizedPath);
     }
-    if (STATIC_RUNTIME_CONTROL_PATHS.has(lowerPath)) {
+    if (STATIC_RUNTIME_CONTROL_PATHS.includes(lowerPath)) {
         return pathViolation("static_runtime_control_path_not_supported", "Static deploys cannot upload runtime control paths.", normalizedPath);
     }
     return null;

package/dist/utils/push-new.d.ts

@@ -0,0 +1,7 @@
+import { type DeployEnv } from "../config/domains.js";
+export declare function pushNewRemoteUrl(input: {
+    slug: string;
+    token: string;
+    origin?: string;
+    environment?: Extract<DeployEnv, "dev" | "prod">;
+}): string;

package/dist/utils/push-new.js

@@ -0,0 +1,7 @@
+import { serviceOrigin } from "../config/domains.js";
+export function pushNewRemoteUrl(input) {
+    const url = new URL(`/${encodeURIComponent(input.slug)}`, input.origin ?? serviceOrigin("push", input.environment ?? "prod"));
+    url.username = "t";
+    url.password = input.token;
+    return url.toString();
+}

package/dist/utils/query-keys.d.ts

@@ -6,10 +6,10 @@ export declare const qk: {
     accountInvitations: () => readonly ["account", "invitations"];
     apiTokens: (teamId?: string) => readonly ["api-tokens"] | readonly ["api-tokens", string];
     agentAccounts: (teamId: string) => readonly ["agent-accounts", string];
-    myShelf: () => readonly ["my-shelf"];
     mcpDashboard: (teamId: string) => readonly ["mcp", "dashboard", string];
     teams: () => readonly ["teams", "list"];
     team: (ref: string) => readonly ["teams", "by-ref", string];
+    teamDetail: (id: string) => readonly ["teams", string, "detail"];
     teamMembers: (id: string) => readonly ["teams", string, "members"];
     teamInvites: (id: string) => readonly ["teams", string, "invites"];
     teamBilling: (id: string) => readonly ["teams", string, "billing"];
@@ -31,7 +31,6 @@ export declare const qk: {
     spaceComments: (id: string) => readonly ["spaces", string, "comments"];
     spaceCommentThread: (id: string, threadId: string) => readonly ["spaces", string, "comments", string];
     spaceActivity: (id: string, limit: number) => readonly ["spaces", string, "activity", number];
-    spaceDeployments: (id: string) => readonly ["spaces", string, "deployments"];
     spaceTags: (id: string) => readonly ["spaces", string, "tags"];
     spaceTagVersion: (id: string, versionId: string) => readonly ["spaces", string, "tags", string];
     spaceTagDiff: (id: string, versionId: string) => readonly ["spaces", string, "tags", string, "diff"];
@@ -42,7 +41,7 @@ export declare const qk: {
     spaceBuilds: (id: string) => readonly ["spaces", string, "builds"];
     spaceRepositoryConnection: (id: string, connectionType?: string) => readonly ["spaces", string, "repository-connection", string];
     repositoryInstallations: (spaceId: string) => readonly ["spaces", string, "repository-installations"];
-    repositoryInstallationRepositories: (installationId: string) => readonly ["repository-connections", "installations", string, "repositories"];
+    repositoryInstallationRepositories: (spaceId: string, installationId: string) => readonly ["spaces", string, "repository-installations", string, "repositories"];
     spaceRepositoryAnalyze: (id: string, connectionType?: string, ref?: string, root?: string) => readonly ["spaces", string, "repository-connection", string, "analyze", string, string];
     spaceRepositoryWebhookDeliveries: (id: string, connectionType?: string) => readonly ["spaces", string, "repository-webhook-deliveries", string];
     teamWebhooks: (teamId: string) => readonly ["teams", string, "webhooks"];
@@ -55,7 +54,7 @@ export declare const qk: {
     spaceVersionFileUrlPreview: (id: string, versionId: string, path: string) => readonly ["spaces", string, "versions", string, "files", string, "url-preview"];
     spaceVersionFileDiff: (id: string, versionId: string, baseVersionId?: string) => readonly ["spaces", string, "versions", string, "files", "diff", string];
     spaceVersionConventionArtifacts: (id: string, versionId: string) => readonly ["spaces", string, "versions", string, "convention-artifacts"];
-    spaceVersionConventionArtifact: (id: string, versionId: string, kind: "redirects" | "headers") => readonly ["spaces", string, "versions", string, "convention-artifacts", "redirects" | "headers"];
+    spaceVersionConventionArtifact: (id: string, versionId: string, kind: "redirects" | "headers") => readonly ["spaces", string, "versions", string, "convention-artifacts", "headers" | "redirects"];
     spaceVersionRoutingSummary: (id: string, versionId: string) => readonly ["spaces", string, "versions", string, "routing-summary"];
     spaceDiagnostics: (id: string) => readonly ["spaces", string, "diagnostics"];
     spaceDomains: (id: string) => readonly ["spaces", string, "domains"];
@@ -68,7 +67,7 @@ export declare const qk: {
     spaceRuntimeRealtimeEvents: (id: string, limit: number) => readonly ["spaces", string, "runtime", "realtime", "events", number];
     spaceVariables: (id: string) => readonly ["spaces", string, "variables"];
     spaceCertificates: (id: string) => readonly ["spaces", string, "runtime", "certificates"];
-    spaceLogs: (id: string, kind: "build" | "access" | "runtime") => readonly ["spaces", string, "logs", "build" | "runtime" | "access"];
+    spaceLogs: (id: string, kind: "build" | "access" | "runtime") => readonly ["spaces", string, "logs", "build" | "access" | "runtime"];
     spaceAnalytics: (id: string, window: string) => readonly ["spaces", string, "analytics", string];
     teamAgentHandoffs: (teamId: string) => readonly ["teams", string, "agent-handoffs"];
     teamAccessDefaults: (teamId: string) => readonly ["teams", string, "access", "defaults"];

package/dist/utils/query-keys.js

@@ -8,13 +8,13 @@ export const qk = {
     // teamId yields the bare prefix (personal scope, and invalidate-all sweeps).
     apiTokens: (teamId) => teamId === undefined ? ["api-tokens"] : ["api-tokens", teamId],
     agentAccounts: (teamId) => ["agent-accounts", teamId],
-    myShelf: () => ["my-shelf"],
     mcpDashboard: (teamId) => ["mcp", "dashboard", teamId],
     // The teams LIST gets its own leaf so invalidating it never cascades into
     // ["teams", id, ...] resource queries (members, spaces, domains, ...).
     teams: () => ["teams", "list"],
     // Keyed by slug (the URL ref), so it lives outside the id namespace.
     team: (ref) => ["teams", "by-ref", ref],
+    teamDetail: (id) => ["teams", id, "detail"],
     teamMembers: (id) => ["teams", id, "members"],
     teamInvites: (id) => ["teams", id, "invites"],
     teamBilling: (id) => ["teams", id, "billing"],
@@ -39,7 +39,6 @@ export const qk = {
     spaceComments: (id) => ["spaces", id, "comments"],
     spaceCommentThread: (id, threadId) => [...qk.spaceComments(id), threadId],
     spaceActivity: (id, limit) => ["spaces", id, "activity", limit],
-    spaceDeployments: (id) => ["spaces", id, "deployments"],
     spaceTags: (id) => ["spaces", id, "tags"],
     spaceTagVersion: (id, versionId) => ["spaces", id, "tags", versionId],
     spaceTagDiff: (id, versionId) => ["spaces", id, "tags", versionId, "diff"],
@@ -56,7 +55,7 @@ export const qk = {
     spaceBuilds: (id) => ["spaces", id, "builds"],
     spaceRepositoryConnection: (id, connectionType = "connected") => ["spaces", id, "repository-connection", connectionType],
     repositoryInstallations: (spaceId) => [...qk.space(spaceId), "repository-installations"],
-    repositoryInstallationRepositories: (installationId) => ["repository-connections", "installations", installationId, "repositories"],
+    repositoryInstallationRepositories: (spaceId, installationId) => [...qk.space(spaceId), "repository-installations", installationId, "repositories"],
     spaceRepositoryAnalyze: (id, connectionType = "connected", ref = "", root = "") => ["spaces", id, "repository-connection", connectionType, "analyze", ref, root],
     spaceRepositoryWebhookDeliveries: (id, connectionType = "connected") => ["spaces", id, "repository-webhook-deliveries", connectionType],
     teamWebhooks: (teamId) => ["teams", teamId, "webhooks"],

package/dist/utils/runtime-paths.d.ts

@@ -5,5 +5,10 @@ export declare const RUNTIME_HEALTH_PATH: "/__spacefast/health.php";
 export declare const RUNTIME_COMMENTS_CONFIG_PATH: "/__spacefast/comments/config";
 export declare const RUNTIME_COMMENTS_TICKET_PATH: "/__spacefast/comments/ticket";
 export declare const RUNTIME_COMMENTS_VERSION_URLS_PATH: "/__spacefast/comments/version-urls";
+/** The review workspace the orb expands into — a reserved control path on the
+ *  Space's own origin (collab-frame-plan §4), not part of the `/__spacefast`
+ *  exchange namespace because people paste this one into Slack.
+ *  The PHP mirror is SPACEFAST_COLLAB_FRAME_PATH in runtime/engine/shared/context.php. */
+export declare const RUNTIME_COLLAB_FRAME_PATH: "/__/collab";
 export declare function runtimeManagementPath(suffix: string): string;
 export declare function runtimeUploadPath(params: URLSearchParams | Record<string, string>): string;

package/dist/utils/runtime-paths.js

@@ -9,6 +9,11 @@ export const RUNTIME_HEALTH_PATH = `${SPACEFAST_RUNTIME_NAMESPACE}/health.php`;
 export const RUNTIME_COMMENTS_CONFIG_PATH = `${SPACEFAST_RUNTIME_NAMESPACE}/comments/config`;
 export const RUNTIME_COMMENTS_TICKET_PATH = `${SPACEFAST_RUNTIME_NAMESPACE}/comments/ticket`;
 export const RUNTIME_COMMENTS_VERSION_URLS_PATH = `${SPACEFAST_RUNTIME_NAMESPACE}/comments/version-urls`;
+/** The review workspace the orb expands into — a reserved control path on the
+ *  Space's own origin (collab-frame-plan §4), not part of the `/__spacefast`
+ *  exchange namespace because people paste this one into Slack.
+ *  The PHP mirror is SPACEFAST_COLLAB_FRAME_PATH in runtime/engine/shared/context.php. */
+export const RUNTIME_COLLAB_FRAME_PATH = "/__/collab";
 export function runtimeManagementPath(suffix) {
     const route = normalizeRuntimeRoute(suffix);
     if (route === "/") {

package/dist/utils/runtime-upload-batch.d.ts

@@ -1,13 +1,8 @@
 import { Buffer } from "node:buffer";
-import { RUNTIME_UPLOAD_BATCH_MAX_BYTES, RUNTIME_UPLOAD_BATCH_MAX_FILES } from "./runtime-upload.js";
-import { type UploadTarget } from "./upload-session.js";
-export { RUNTIME_UPLOAD_BATCH_MAX_BYTES, RUNTIME_UPLOAD_BATCH_MAX_FILES };
 export type RuntimeBatchArchiveEntry = {
     path: string;
     getBytes(): Buffer | Promise<Buffer>;
 };
-export declare function runtimeBatchUploadUnsupported(error: unknown): boolean;
-export declare function batchTargetForUploadTarget(uploadId: string, target: UploadTarget): UploadTarget | null;
 export declare function tarPathParts(filePath: string): {
     name: string;
     prefix: string;

package/dist/utils/runtime-upload-batch.js

@@ -1,31 +1,4 @@
 import { Buffer } from "node:buffer";
-import { RUNTIME_UPLOAD_BATCH_MAX_BYTES, RUNTIME_UPLOAD_BATCH_MAX_FILES, } from "./runtime-upload.js";
-import { UploadTargetError } from "./upload-session.js";
-// Batch planning + tar-writing wire contract shared by the CLI and the control
-// plane's inline publish path. This is the sender half of the runtime's tar
-// batch parser (runtime/engine/admin/upload.php); any change here must stay in
-// lockstep with that file.
-export { RUNTIME_UPLOAD_BATCH_MAX_BYTES, RUNTIME_UPLOAD_BATCH_MAX_FILES };
-export function runtimeBatchUploadUnsupported(error) {
-    return error instanceof UploadTargetError && (error.status === 404 || error.status === 405);
-}
-export function batchTargetForUploadTarget(uploadId, target) {
-    const url = new URL(target.url);
-    if (!url.pathname.endsWith("/upload.php")) {
-        return null;
-    }
-    url.search = new URLSearchParams({ op: "batch", upload_id: uploadId }).toString();
-    return {
-        ...target,
-        path: "__spacefast_batch.tar",
-        method: "POST",
-        url: url.toString(),
-        headers: {
-            ...target.headers,
-            "content-type": "application/x-tar",
-        },
-    };
-}
 export function tarPathParts(filePath) {
     if (Buffer.byteLength(filePath) <= 100) {
         return { name: filePath, prefix: "" };
@@ -57,6 +30,7 @@ export async function tarArchive(entries, pathTooLongError) {
         if (!parts) {
             throw pathTooLongError(entry.path);
         }
+        // oxlint-disable-next-line no-await-in-loop -- Tar entries must retain declared order.
         const body = Buffer.from(await entry.getBytes());
         const header = Buffer.alloc(512);
         header.write(parts.name, 0, Math.min(100, Buffer.byteLength(parts.name)), "utf8");

package/dist/utils/runtime-upload.d.ts

@@ -1,15 +1,4 @@
-export declare const RUNTIME_UPLOAD_METHOD: "PUT";
-export declare const RUNTIME_UPLOAD_BATCH_MAX_FILES = 500;
-export declare const RUNTIME_UPLOAD_BATCH_MAX_BYTES: number;
 export declare function runtimeUploadCanonicalPath(path: string): string;
-export declare function runtimeUploadSessionBaseUrl(input: {
-    baseUrl: string;
-    uploadId: string;
-}): string;
-export declare function runtimeUploadBatchUrl(input: {
-    baseUrl: string;
-    uploadId: string;
-}): string;
 export declare function runtimeUploadFetchUrl(input: {
     baseUrl: string;
     uploadId: string;
@@ -17,5 +6,11 @@ export declare function runtimeUploadFetchUrl(input: {
 }): string;
 export declare function runtimeUploadFileUrl(input: {
     baseUrl: string;
+    uploadId: string;
     path: string;
 }): string;
+export declare function runtimeUploadBlobUrl(input: {
+    baseUrl: string;
+    spaceId: string;
+    sha256: string;
+}): string;

package/dist/utils/runtime-upload.js

@@ -1,10 +1,4 @@
 import { runtimeUploadPath } from "./runtime-paths.js";
-export const RUNTIME_UPLOAD_METHOD = "PUT";
-// Mirrors STATTIC_RUNTIME_UPLOAD_BATCH_MAX_FILES/_MAX_BYTES in
-// runtime/engine/admin/upload.php (parity-guarded in
-// apps/control-plane/src/runtime/php-policy-parity.test.ts).
-export const RUNTIME_UPLOAD_BATCH_MAX_FILES = 500;
-export const RUNTIME_UPLOAD_BATCH_MAX_BYTES = 8 * 1024 * 1024;
 export function runtimeUploadCanonicalPath(path) {
     // Canonical path form (spec "Upload Contract"): UTF-8, Unicode NFC,
     // percent-encoded once. The runtime rejects non-canonical encodings.
@@ -14,12 +8,6 @@ export function runtimeUploadCanonicalPath(path) {
         .map((segment) => encodeURIComponent(segment))
         .join("/");
 }
-export function runtimeUploadSessionBaseUrl(input) {
-    return new URL(runtimeUploadPath({ op: "file", upload_id: input.uploadId, path: "" }), input.baseUrl).toString();
-}
-export function runtimeUploadBatchUrl(input) {
-    return new URL(runtimeUploadPath({ op: "batch", upload_id: input.uploadId }), input.baseUrl).toString();
-}
 export function runtimeUploadFetchUrl(input) {
     return new URL(runtimeUploadPath({
         op: "fetch",
@@ -28,5 +16,14 @@ export function runtimeUploadFetchUrl(input) {
     }), input.baseUrl).toString();
 }
 export function runtimeUploadFileUrl(input) {
-    return `${input.baseUrl}${runtimeUploadCanonicalPath(input.path)}`;
+    return new URL(runtimeUploadPath({
+        op: "file",
+        upload_id: input.uploadId,
+        path: runtimeUploadCanonicalPath(input.path),
+    }), input.baseUrl).toString();
+}
+export function runtimeUploadBlobUrl(input) {
+    return new URL(runtimeUploadPath({
+        route: `/spaces/${encodeURIComponent(input.spaceId)}/blobs/${encodeURIComponent(input.sha256)}`,
+    }), input.baseUrl).toString();
 }

package/dist/utils/secure-local-file.js

@@ -273,7 +273,6 @@ function lockName(leaf) {
     const digest = createHash("sha256").update(identity).digest("hex").slice(0, 24);
     return `.spacefast-${digest}.lock`;
 }
-const LEGACY_LEAF_LOCK_STALE_MS = 2 * 60_000;
 function serializeLeafLockOwner(owner) {
     const { phase, ...identity } = owner;
     return `${phase === "active" ? "A" : "R"}${JSON.stringify(identity)}\n`;
@@ -293,6 +292,7 @@ function parseLeafLockOwner(raw) {
             (value.temporaryName === undefined ||
                 (typeof value.temporaryName === "string" &&
                     /^\.spacefast-[0-9a-f-]{36}\.tmp$/.test(value.temporaryName)))) {
+            // SAFETY: The preceding checks establish every required LeafLockOwner field and the optional temporaryName field.
             return { ...value, phase };
         }
     }
@@ -360,14 +360,8 @@ function processIsAlive(pid) {
     }
 }
 async function leafLockRecordIsStale(record) {
-    // The original lock format was an empty exclusive file. It carries no owner
-    // identity, so a short age fence is the only safe compatibility signal: a
-    // fresh legacy writer stays exclusive, while crash wreckage can recover.
-    if (record?.kind === "legacy") {
-        return Date.now() - record.modifiedAtMs > LEGACY_LEAF_LOCK_STALE_MS;
-    }
-    // A malformed non-empty record is not proof that no writer owns it. New lock
-    // records are atomically published, so corruption still needs explicit recovery.
+    // A malformed record is not proof that no writer owns it. New lock records are
+    // atomically published, so corruption still needs explicit recovery.
     if (record?.kind !== "owned")
         return false;
     const { owner } = record;
@@ -399,13 +393,8 @@ async function readLeafLockRecord(filePath) {
             visibleMetadata.ino !== metadata.ino) {
             return { kind: "invalid" };
         }
-        const raw = await file.readFile("utf8");
-        const owner = parseLeafLockOwner(raw);
-        if (owner)
-            return { kind: "owned", owner };
-        return raw.length === 0
-            ? { kind: "legacy", modifiedAtMs: metadata.mtimeMs }
-            : { kind: "invalid" };
+        const owner = parseLeafLockOwner(await file.readFile("utf8"));
+        return owner ? { kind: "owned", owner } : { kind: "invalid" };
     }
     finally {
         await file.close();

package/dist/utils/space-config.d.ts

@@ -1,10 +1,9 @@
 import { type Grant } from "../contracts/grants.js";
-import type { RuntimeKind } from "../contracts/execution.js";
 import { type SpaceConfig, type SpaceConfigFile } from "../contracts/space-config.js";
 export type SpaceConfigBlockingIssueCode = "config_file_too_large" | "config_templates_over_limit" | "config_meta_too_long" | "config_name_too_long" | "config_functions_key_removed" | "config_invalid" | "config_runtime_invalid_kind" | "config_runtime_entry_missing" | "inject_snippet_too_large" | "inject_invalid";
 export type SpaceConfigIssue = {
     severity: "info" | "warning" | "error";
-    code: SpaceConfigBlockingIssueCode | "single_html_index" | "files_mode_inferred";
+    code: SpaceConfigBlockingIssueCode | "single_html_index" | "files_mode_inferred" | "listing_shadows_fallback";
     message: string;
     /** JSON-path-lite pointer into the config shape (e.g. `meta.title`). */
     path?: string;
@@ -32,19 +31,6 @@ export declare const SPACE_CONFIG_FILE_ONLY_KEYS: readonly ["access", "name", "r
  */
 export declare function spaceConfigOverlayIssue(config: unknown): SpaceConfigBlockingIssue | null;
 export declare function stripJsonComments(raw: string): string;
-export type ParsedSpaceConfigFile = {
-    /** Parsed config (cap- and shape-valid keys only); null when unusable. */
-    config: SpaceConfigFile | null;
-    issues: SpaceConfigIssue[];
-};
-/**
- * Parses a raw `sf.jsonc` at finalize: 256 KB cap, JSONC tolerance,
- * routing-key rejection, unknown-key diagnostics, shared shape caps. Errors
- * fail the version; warnings ride version diagnostics.
- */
-export declare function parseSpaceConfigFile(raw: string, options?: {
-    path?: string;
-}): ParsedSpaceConfigFile;
 export type ResolvedServingConfig = {
     index: string | false;
     fallback: {
@@ -63,25 +49,6 @@ export type ResolvedServingConfig = {
     /** Resolved inject snippets; only honored when experimentalGutenberg is true. */
     inject: NonNullable<SpaceConfig["inject"]> | null;
 };
-export type EffectiveSpaceConfig = {
-    /** The merged SpaceConfig (defaults + file + overlay, key-wise). */
-    config: SpaceConfig;
-    /** Compiled serving primitives the runtime artifact stores. */
-    serving: ResolvedServingConfig;
-    issues: SpaceConfigIssue[];
-};
-/**
- * Resolves the effective SpaceConfig for a version at finalize (or
- * config-only regeneration). `manifestPaths` is the canonical committed file
- * set; `fileConfig` the parsed sf.jsonc (null when absent); `overlay`
- * the stored space config overlay (null when nothing overridden).
- */
-export declare function resolveEffectiveSpaceConfig(input: {
-    manifestPaths: ReadonlySet<string>;
-    fileConfig: SpaceConfig | null;
-    overlay: SpaceConfig | null;
-    runtimeKind?: RuntimeKind;
-}): EffectiveSpaceConfig;
 export type SpaceSettingsPatch = {
     mode?: "website" | "files" | undefined;
     spa?: boolean | undefined;