@spacefast/common 0.0.23 → 0.0.26

package/dist/utils/space-config.js

@@ -1,5 +1,5 @@
 import { CONFIG_PUBLIC_GRANT_SOURCE_REFERENCE, grantSchema, } from "../contracts/grants.js";
-import { SPACE_CONFIG_CAPS, SPACE_CONFIG_CANONICAL_FILE, SPACE_CONFIG_PRIVATE_FILES, spaceConfigFileSchema, spaceConfigSchema, } from "../contracts/space-config.js";
+import { SPACE_CONFIG_CAPS, SPACE_CONFIG_CANONICAL_FILE, } from "../contracts/space-config.js";
 const TEXT_BYTES = new TextEncoder();
 export const CONFIG_PUBLIC_GRANT_COMPILED_ID = "config:access.public";
 function byteLength(value) {
@@ -57,6 +57,7 @@ function capIssues(candidate) {
         }
         else {
             for (const key of ["head", "bodyStart", "bodyEnd", "noscript"]) {
+                // SAFETY: The enclosing branch proves inject is a non-null, non-array object.
                 const snippets = inject[key];
                 if (snippets === undefined) {
                     continue;
@@ -107,6 +108,7 @@ function capIssues(candidate) {
             ["title", SPACE_CONFIG_CAPS.metaTitleChars],
             ["description", SPACE_CONFIG_CAPS.metaDescriptionChars],
             ["image", SPACE_CONFIG_CAPS.metaImageChars],
+            ["favicon", SPACE_CONFIG_CAPS.metaImageChars],
         ];
         for (const [key, limit] of caps) {
             const value = meta[key];
@@ -123,75 +125,6 @@ function capIssues(candidate) {
     }
     return issues;
 }
-// File-only keys (`name`, `runtime`) never reach the API overlay, so their
-// checks live beside the shared caps rather than inside them. Both run BEFORE
-// zod so a bad declaration reports its stable code instead of a shape error.
-const RUNTIME_KINDS = new Set(["zero", "functions"]);
-function fileOnlyIssues(candidate) {
-    const issues = [];
-    const name = candidate.name;
-    if (typeof name === "string" && name.trim().length > SPACE_CONFIG_CAPS.nameChars) {
-        issues.push({
-            severity: "error",
-            code: "config_name_too_long",
-            message: `name supports up to ${SPACE_CONFIG_CAPS.nameChars} characters.`,
-            path: "name",
-            details: { length: name.trim().length, limit: SPACE_CONFIG_CAPS.nameChars },
-        });
-    }
-    const runtime = candidate.runtime;
-    if (runtime === undefined) {
-        return issues;
-    }
-    if (typeof runtime !== "object" || runtime === null || Array.isArray(runtime)) {
-        issues.push({
-            severity: "error",
-            code: "config_runtime_invalid_kind",
-            message: 'runtime must be an object declaring a kind of "zero" or "functions".',
-            path: "runtime",
-        });
-        return issues;
-    }
-    const declaration = runtime;
-    const kind = declaration.kind;
-    if (typeof kind !== "string" || !RUNTIME_KINDS.has(kind)) {
-        issues.push({
-            severity: "error",
-            code: "config_runtime_invalid_kind",
-            message: 'runtime.kind must be "zero" or "functions".',
-            path: "runtime.kind",
-            ...(typeof kind === "string" ? { details: { kind } } : {}),
-        });
-        return issues;
-    }
-    if (kind === "zero") {
-        // Zero is never inferred, so a declaration that names neither entry has
-        // nothing to compile — failing here beats publishing static files under a
-        // config that promised a database app.
-        for (const key of ["server", "client"]) {
-            const value = declaration[key];
-            if (typeof value !== "string" || value.trim().length === 0) {
-                issues.push({
-                    severity: "error",
-                    code: "config_runtime_entry_missing",
-                    message: `runtime.${key} is required and must name a module when runtime.kind is "zero".`,
-                    path: `runtime.${key}`,
-                });
-            }
-        }
-        return issues;
-    }
-    const entry = declaration.entry;
-    if (entry !== undefined && (typeof entry !== "string" || entry.trim().length === 0)) {
-        issues.push({
-            severity: "error",
-            code: "config_runtime_entry_missing",
-            message: "runtime.entry must name a module when present; omit it to detect the worker instead.",
-            path: "runtime.entry",
-        });
-    }
-    return issues;
-}
 /**
  * Keys a committed `sf.jsonc` owns outright: they are facts about the content
  * of a version (who may read it, what it is called, what runs it), so they roll
@@ -233,26 +166,16 @@ export function spaceConfigOverlayIssue(config) {
     }
     return capIssues(config)[0] ?? null;
 }
-// Other platforms' routing vocabulary. We have one matcher grammar; naming it
-// four more ways would be four more things to keep in sync.
-const ROUTING_KEYS = new Set(["proxies", "proxy", "routes"]);
-// OUR routing vocabulary. These keys are real sf.jsonc keys, owned end to end
-// by the routing compiler (crates/stattic-runtime-core): the strict v1 compiler
-// validates them and the merge folds them in behind `_redirects`/`_headers`.
-// This lane resolves the serving config, so it neither validates nor carries
-// them — it just leaves them alone.
-const ROUTING_RULE_KEYS = new Set(["redirects", "rewrites", "headers"]);
-// Replaced by the `runtime` declaration; never silently ignored like other
-// unknown keys, because it is the one key whose loss changes what gets served.
-const REMOVED_FUNCTIONS_KEY = "functions";
-const KNOWN_FILE_KEYS = new Set(Object.keys(spaceConfigFileSchema.shape));
-// Strips JSONC comments and trailing commas (string-aware single pass).
+// Strips JSONC comments and trailing commas (string-aware single pass). The
+// config file itself is parsed by the crate; this stays for the OTHER JSONC
+// files the CLI reads (agent configs, exported platform env).
 export function stripJsonComments(raw) {
     let output = "";
     let inString = false;
     let inLineComment = false;
     let inBlockComment = false;
     for (let i = 0; i < raw.length; i += 1) {
+        // SAFETY: The loop condition proves i addresses a character in raw.
         const char = raw[i];
         const next = raw[i + 1];
         if (inLineComment) {
@@ -299,6 +222,7 @@ export function stripJsonComments(raw) {
             // Trailing comma: skip when the next non-whitespace/non-comment char closes.
             let j = i + 1;
             while (j < raw.length) {
+                // SAFETY: The loop condition proves j addresses a character in raw.
                 const ahead = raw[j];
                 if (/\s/.test(ahead)) {
                     j += 1;
@@ -326,245 +250,3 @@ export function stripJsonComments(raw) {
     }
     return output;
 }
-/**
- * Parses a raw `sf.jsonc` at finalize: 256 KB cap, JSONC tolerance,
- * routing-key rejection, unknown-key diagnostics, shared shape caps. Errors
- * fail the version; warnings ride version diagnostics.
- */
-export function parseSpaceConfigFile(raw, options = {}) {
-    const configPath = options.path ?? SPACE_CONFIG_CANONICAL_FILE;
-    if (byteLength(raw) > SPACE_CONFIG_CAPS.fileBytes) {
-        return {
-            config: null,
-            issues: [
-                {
-                    severity: "error",
-                    code: "config_file_too_large",
-                    message: `${configPath} supports up to ${SPACE_CONFIG_CAPS.fileBytes} bytes.`,
-                    path: configPath,
-                    details: { size: byteLength(raw), limit: SPACE_CONFIG_CAPS.fileBytes },
-                },
-            ],
-        };
-    }
-    let candidate;
-    try {
-        candidate = JSON.parse(stripJsonComments(raw));
-    }
-    catch (error) {
-        return {
-            config: null,
-            issues: [
-                {
-                    severity: "error",
-                    code: "config_invalid",
-                    message: `${configPath} is not valid JSONC: ${error instanceof Error ? error.message : "parse error"}.`,
-                    path: configPath,
-                },
-            ],
-        };
-    }
-    if (typeof candidate !== "object" || candidate === null || Array.isArray(candidate)) {
-        return {
-            config: null,
-            issues: [
-                {
-                    severity: "error",
-                    code: "config_invalid",
-                    message: `${configPath} must contain a JSON object.`,
-                    path: configPath,
-                },
-            ],
-        };
-    }
-    const record = candidate;
-    const issues = [];
-    for (const key of Object.keys(record)) {
-        if (KNOWN_FILE_KEYS.has(key)) {
-            continue;
-        }
-        if (ROUTING_RULE_KEYS.has(key)) {
-            delete record[key];
-            continue;
-        }
-        if (key === REMOVED_FUNCTIONS_KEY) {
-            // The runtime declaration replaced this key outright (spec "The old
-            // top-level functions.* key is removed in the same cutover"): warning-and-
-            // strip would publish static files under a config that asked for a
-            // worker, so it blocks with its own code instead.
-            issues.push({
-                severity: "error",
-                code: "config_functions_key_removed",
-                message: `The "${REMOVED_FUNCTIONS_KEY}" key was removed from ${configPath}; declare runtime.kind "functions" instead.`,
-                path: key,
-            });
-        }
-        else if (ROUTING_KEYS.has(key)) {
-            issues.push({
-                severity: "error",
-                code: "config_invalid",
-                message: `Routing never lives in ${configPath}; move "${key}" into _redirects/_headers.`,
-                path: key,
-            });
-        }
-        else {
-            issues.push({
-                severity: "warning",
-                code: "config_invalid",
-                message: `Unknown ${configPath} key "${key}" was ignored.`,
-                path: key,
-            });
-        }
-        delete record[key];
-    }
-    issues.push(...capIssues(record), ...fileOnlyIssues(record));
-    if (issues.some((issue) => issue.severity === "error")) {
-        return { config: null, issues };
-    }
-    const parsed = spaceConfigFileSchema.safeParse(record);
-    if (!parsed.success) {
-        for (const issue of parsed.error.issues) {
-            issues.push({
-                severity: "error",
-                code: "config_invalid",
-                message: issue.message,
-                path: issue.path.map(String).join(".") || configPath,
-            });
-        }
-        return { config: null, issues };
-    }
-    return { config: parsed.data, issues };
-}
-// Mirrors the runtime's private-file rules (_stattic_runtime_file_private):
-// convention/config files and dot-segment paths never serve, so they don't
-// count toward root HTML inference below.
-const PRIVATE_SERVING_FILES = new Set([
-    "_redirects",
-    "_headers",
-    "_config.json",
-    "_routes.json",
-    ...SPACE_CONFIG_PRIVATE_FILES,
-]);
-function privateServingPath(path) {
-    if (PRIVATE_SERVING_FILES.has(path) ||
-        path === ".well-known/spacefast-runtime" ||
-        path === ".well-known/stattic-runtime") {
-        return true;
-    }
-    const segments = path.toLowerCase().split("/");
-    return segments.some((segment, index) => !(index === 0 && segment === ".well-known") && segment.startsWith("."));
-}
-function rootHtmlPaths(manifestPaths) {
-    const htmlPaths = [];
-    for (const path of manifestPaths) {
-        if (path === "" || privateServingPath(path)) {
-            continue;
-        }
-        if (!path.includes("/") && /\.html?$/i.test(path)) {
-            htmlPaths.push(path);
-        }
-    }
-    return htmlPaths.toSorted((left, right) => left.localeCompare(right));
-}
-function normalizeFallback(fallback) {
-    if (fallback === undefined) {
-        return null;
-    }
-    if (typeof fallback === "string") {
-        return { path: fallback.replace(/^\/+/, ""), status: 200 };
-    }
-    const status = fallback.status === 404 ? 404 : 200;
-    return { path: fallback.path.replace(/^\/+/, ""), status };
-}
-/**
- * Resolves the effective SpaceConfig for a version at finalize (or
- * config-only regeneration). `manifestPaths` is the canonical committed file
- * set; `fileConfig` the parsed sf.jsonc (null when absent); `overlay`
- * the stored space config overlay (null when nothing overridden).
- */
-export function resolveEffectiveSpaceConfig(input) {
-    const rootHtml = rootHtmlPaths(input.manifestPaths);
-    const hasRootIndex = rootHtml.includes("index.html");
-    const inferredRootHtmlIndex = hasRootIndex ? "index.html" : (rootHtml[0] ?? null);
-    const explicitServingShape = input.fileConfig?.index !== undefined ||
-        input.fileConfig?.listing !== undefined ||
-        input.overlay?.index !== undefined ||
-        input.overlay?.listing !== undefined;
-    // Content-inferred defaults (spec: the old website/files modes are exactly
-    // these two default bundles; never API fields). A Functions version is an
-    // application even when it has no root HTML: unresolved requests, including
-    // `/`, belong to its worker. Static versions retain the content inference —
-    // a root index.html means website mode, any other root HTML becomes the
-    // homepage rewrite, and no root HTML means files mode.
-    const functionsApplication = input.runtimeKind === "functions";
-    const defaults = inferredRootHtmlIndex
-        ? { index: inferredRootHtmlIndex, listing: false }
-        : { index: false, listing: !functionsApplication };
-    const merged = { ...defaults };
-    for (const layer of [input.fileConfig, input.overlay]) {
-        if (!layer) {
-            continue;
-        }
-        for (const key of Object.keys(spaceConfigSchema.shape)) {
-            const value = layer[key];
-            if (value !== undefined) {
-                merged[key] = value;
-            }
-        }
-    }
-    const issues = [];
-    const fallback = normalizeFallback(merged.fallback);
-    // Invariant (spec "Serving resolution"): a fallback must point at a
-    // committed file — no implicit extension guessing, fail at finalize.
-    if (fallback && !input.manifestPaths.has(fallback.path)) {
-        issues.push({
-            severity: "error",
-            code: "config_invalid",
-            message: `fallback path "/${fallback.path}" is not a committed file in this version.`,
-            path: "fallback.path",
-            details: { path: fallback.path },
-        });
-    }
-    const listing = merged.listing ?? (!functionsApplication && !inferredRootHtmlIndex);
-    const serving = {
-        index: merged.index ?? inferredRootHtmlIndex ?? false,
-        fallback,
-        // Clean URLs (runtime W7.1): an explicit config value wins; the default is
-        // ON for plain static sites and OFF when a 200-status SPA fallback owns
-        // extensionless routes (the fallback answers them instead). The runtime
-        // resolver (management.php) applies the same default for artifacts
-        // finalized without the key.
-        cleanUrls: merged.cleanUrls ?? !(fallback && fallback.status === 200),
-        listing,
-        // The single-file viewer rides the listing bundle (artifact-style spaces).
-        viewer: listing,
-        meta: merged.meta ?? null,
-        pageTheme: merged.theme && Object.keys(merged.theme).length > 0 ? merged.theme : null,
-        experimentalGutenberg: merged.experimental_gutenberg === true,
-        inject: merged.inject ?? null,
-    };
-    if (inferredRootHtmlIndex !== null && !hasRootIndex && serving.index === inferredRootHtmlIndex) {
-        // Surfaced on the publish receipt and version diagnostics so the CLI and
-        // agents learn the rewrite without probing the live URL.
-        issues.push({
-            severity: "info",
-            code: "single_html_index",
-            message: `${inferredRootHtmlIndex} is the root HTML file selected for this version, so it serves as the homepage: / rewrites to /${inferredRootHtmlIndex}.`,
-            path: "index",
-            details: { path: inferredRootHtmlIndex, rootHtmlCount: rootHtml.length },
-        });
-    }
-    if (inferredRootHtmlIndex === null &&
-        serving.index === false &&
-        serving.listing &&
-        !explicitServingShape) {
-        issues.push({
-            severity: "info",
-            code: "files_mode_inferred",
-            message: "No HTML files were found in the root of this version, so it serves in files mode with directory listing enabled.",
-            path: "listing",
-            details: { rootHtmlCount: 0 },
-        });
-    }
-    return { config: merged, serving, issues };
-}

package/dist/utils/static-runtime-policy.d.ts

@@ -5,14 +5,20 @@ export declare const PLATFORM_MANAGED_RESPONSE_HEADERS: string[];
 export declare const PLATFORM_MANAGED_RESPONSE_HEADER_PREFIXES: string[];
 /** True when user rules may neither set nor remove this response header. */
 export declare function isPlatformManagedResponseHeader(name: string): boolean;
-export declare const NON_IMMUTABLE_EXTENSIONS: string[];
-export declare const GUARANTEED_IMMUTABLE_PREFIXES: string[];
+/**
+ * The token grammar a `_headers` rule accepts for a header NAME. The routing
+ * compiler enforces it; anything that GENERATES `_headers` rules (the Next
+ * materializer's framework sections) must gate on the same pattern, so a
+ * generated rule can never fail the author's publish.
+ */
+export declare const HEADER_RULE_NAME_PATTERN: RegExp;
+/** `content-type` → `Content-Type`: the casing compiled rules and generated `_headers` carry. */
+export declare function canonicalHeaderName(input: string): string;
 /** Lowercased extension without the leading dot, posix semantics. Dotfiles have no extension. */
 export declare function pathExtension(filePath: string): string;
 /** Basename without its extension (the "stem"), posix semantics. */
 export declare function pathStem(filePath: string): string;
 export declare function isPhpLikeStaticPath(filePath: string): boolean;
-export declare function isImmutableAssetPath(filePath: string): boolean;
 /** Forced inert serving policy for a committed static file. PHP-like files are never executable. */
 export declare function runtimeFileSafety(filePath: string): {
     executable: false;

package/dist/utils/static-runtime-policy.fixtures.json

@@ -1,44 +1,33 @@
 {
     "phpLike": [
-        { "path": "index.php", "expected": true },
-        { "path": "nested/app.phtml", "expected": true },
-        { "path": "lib.phar", "expected": true },
-        { "path": "legacy.php5", "expected": true },
-        { "path": "index.html", "expected": false },
-        { "path": "assets/main.js", "expected": false },
-        { "path": ".env", "expected": false }
-    ],
-    "immutable": [
-        { "path": "_next/static/chunks/main-app-4A_iFExJ.js", "expected": true },
-        { "path": "_next/static/chunks/framework-2c1d4f8a.js", "expected": true },
-        { "path": "_next/static/chunks/pages/index-a1b2c3d4e5f6.js", "expected": true },
-        { "path": "_next/static/chunks/oton0Guf.js", "expected": true },
-        { "path": "_next/static/css/app.plainname.css", "expected": true },
-        { "path": "/_next/static/chunks/oton0Guf.js", "expected": true },
-        { "path": "_app/immutable/entry/start.DYyuCeEr.js", "expected": true },
-        { "path": "_nuxt/index.oton0Guf.js", "expected": true },
-        { "path": "_astro/about.DYyuCeEr.css", "expected": true },
-        { "path": "_next/static/index.html", "expected": false },
-        { "path": "_next/static/sitemap.xml", "expected": false },
-        { "path": "_app/immutable/manifest.txt", "expected": false },
-        { "path": "_nextish/chunks/oton0Guf.js", "expected": false },
-        { "path": "nested/_next/static/chunks/oton0Guf.js", "expected": false },
-        { "path": "assets/index-BzeDGMM3.js", "expected": false },
-        { "path": "assets/auth-client-P1Tx-Cyu.js", "expected": false },
-        { "path": "assets/index-DYyuCeEr.js", "expected": false },
-        { "path": "assets/index-9f8e7d6c.js", "expected": false },
-        { "path": "assets/D3GeoMap.js", "expected": false },
-        { "path": "assets/index.js", "expected": false },
-        { "path": "assets/client-widget.js", "expected": false },
-        { "path": "app.1a2b3c4d.css", "expected": false },
-        { "path": "vendor.3f9a2b7e.js", "expected": false },
-        { "path": "static/js/main.d41d8cd98f00b204e9800998.js", "expected": false },
-        { "path": "index.html", "expected": false },
-        { "path": "robots.txt", "expected": false },
-        { "path": "config.xml", "expected": false },
-        { "path": "page.php", "expected": false },
-        { "path": "MyComponent.js", "expected": false },
-        { "path": "image01.png", "expected": false }
+        {
+            "path": "index.php",
+            "expected": true
+        },
+        {
+            "path": "nested/app.phtml",
+            "expected": true
+        },
+        {
+            "path": "lib.phar",
+            "expected": true
+        },
+        {
+            "path": "legacy.php5",
+            "expected": true
+        },
+        {
+            "path": "index.html",
+            "expected": false
+        },
+        {
+            "path": "assets/main.js",
+            "expected": false
+        },
+        {
+            "path": ".env",
+            "expected": false
+        }
     ],
     "safeContentType": [
         {
@@ -46,12 +35,20 @@
             "mime": "application/x-httpd-php",
             "expected": "text/plain; charset=utf-8"
         },
-        { "path": "lib.phar", "mime": "application/zip", "expected": "application/octet-stream" },
+        {
+            "path": "lib.phar",
+            "mime": "application/zip",
+            "expected": "application/octet-stream"
+        },
         {
             "path": "assets/main.js",
             "mime": "text/javascript; charset=utf-8",
             "expected": "text/javascript; charset=utf-8"
         },
-        { "path": "logo.svg", "mime": "image/svg+xml", "expected": "image/svg+xml" }
+        {
+            "path": "logo.svg",
+            "mime": "image/svg+xml",
+            "expected": "image/svg+xml"
+        }
     ]
 }

package/dist/utils/static-runtime-policy.js

@@ -1,5 +1,5 @@
 // Single source of truth for static-runtime content policy: PHP-like inert
-// classification, immutable-asset detection, and safe content-type forcing.
+// classification and safe content-type forcing.
 //
 // This module is intentionally pure (no node:path, no I/O) so the exact same
 // rules can be mechanically code-generated into the PHP runtime (runtime
@@ -30,7 +30,7 @@ export const INTERNAL_REDIRECT_RESPONSE_HEADERS = [
     "x-reproxy-url",
     "x-sendfile",
 ];
-// Rejected/platform-managed response headers (internal-docs/platform.md "Routing And
+// Rejected/platform-managed response headers (the platform spec "Routing And
 // Headers"): user `_headers` rules can never set or remove these. The
 // internal-redirect/sendfile family above is spread in, so it stays a strict subset —
 // anything the proxy lane refuses to relay is also refused from `_headers`. The rest is
@@ -87,52 +87,27 @@ export function isPlatformManagedResponseHeader(name) {
     return (PLATFORM_MANAGED_RESPONSE_HEADER_SET.has(lower) ||
         PLATFORM_MANAGED_RESPONSE_HEADER_PREFIXES.some((prefix) => lower.startsWith(prefix)));
 }
-export const NON_IMMUTABLE_EXTENSIONS = ["html", "htm", "php", "txt", "xml"];
-const PHP_LIKE_EXTENSION_SET = new Set(PHP_LIKE_EXTENSIONS);
-const NON_IMMUTABLE_EXTENSION_SET = new Set(NON_IMMUTABLE_EXTENSIONS);
-// Immutable caching is decided by DETERMINISTIC signals only — reserved framework
-// build directories below, plus user-declared `_headers` Cache-Control rules that
-// override the baked default at serve time. There is deliberately NO filename-entropy
-// heuristic: an 8-char base64url bundler hash is character-for-character
-// indistinguishable from a short human name (D3GeoMap, McKayCV2), so any guess either
-// pins a user's mutable file for a year (stale site nobody can fix — browsers have no
-// bust channel) or silently downgrades real hashes to revalidate-every-load, which
-// under the wp.cloud edge per-IP rate limiter turned dashboard page loads into 429
-// storms (2026-07-06). Unrecognized files default to the safe direction:
-// `max-age=0, must-revalidate` for browsers, long s-maxage + purge-on-publish at the
-// edge.
-//
-// Each prefix is HIGH-CONFIDENCE guaranteed-hashed:
-//   - `_next/static/`   Next.js immutable build assets (chunks/css/media), all
-//                       [contenthash]; Next itself serves this dir with `immutable`.
-//   - `_app/immutable/` SvelteKit (Vite) — the directory is literally named `immutable`
-//                       and holds only fingerprinted chunks/assets.
-//   - `_nuxt/`          Nuxt build dir — Vite-hashed client bundle, served from a
-//                       reserved app-owned path.
-//   - `_astro/`         Astro bundled assets — all content-hashed.
-//
-// DELIBERATELY EXCLUDED: generic user-writable dirs (Vite's `assets/`, CRA/Gatsby's
-// `static/`). Users drop NON-hashed files there, so widening to them would create
-// year-long false positives. Deployments of bundler output declare those dirs immutable
-// themselves via a `_headers` rule (e.g. `/assets/*` → `Cache-Control: public,
-// max-age=31536000, immutable`), which the publisher — a build we ran, an agent, a CI
-// deploy — writes because it KNOWS the output is content-hashed.
-export const GUARANTEED_IMMUTABLE_PREFIXES = [
-    "_next/static/",
-    "_app/immutable/",
-    "_nuxt/",
-    "_astro/",
-];
-/** True when the path lives under a framework dir where every emitted asset is content-hashed. */
-function isUnderGuaranteedImmutablePrefix(filePath) {
-    const normalized = filePath.startsWith("/") ? filePath.slice(1) : filePath;
-    for (const prefix of GUARANTEED_IMMUTABLE_PREFIXES) {
-        if (normalized.startsWith(prefix)) {
-            return true;
-        }
-    }
-    return false;
+/**
+ * The token grammar a `_headers` rule accepts for a header NAME. The routing
+ * compiler enforces it; anything that GENERATES `_headers` rules (the Next
+ * materializer's framework sections) must gate on the same pattern, so a
+ * generated rule can never fail the author's publish.
+ */
+export const HEADER_RULE_NAME_PATTERN = /^[A-Za-z0-9-]+$/;
+/** `content-type` → `Content-Type`: the casing compiled rules and generated `_headers` carry. */
+export function canonicalHeaderName(input) {
+    return input
+        .trim()
+        .toLowerCase()
+        .split("-")
+        .map((part) => (part ? `${part[0]?.toUpperCase() ?? ""}${part.slice(1)}` : part))
+        .join("-");
 }
+const PHP_LIKE_EXTENSION_SET = new Set(PHP_LIKE_EXTENSIONS);
+// Immutable-asset detection is NOT decided here: `compiled_cache_class` in
+// crates/stattic-runtime-core (responses.rs) is the one implementation, at
+// finalize. A TS re-implementation lived here once, drifted from the
+// enforcer, and was deleted rather than re-synced.
 function lastSegment(filePath) {
     const slash = filePath.lastIndexOf("/");
     return slash >= 0 ? filePath.slice(slash + 1) : filePath;
@@ -152,15 +127,6 @@ export function pathStem(filePath) {
 export function isPhpLikeStaticPath(filePath) {
     return PHP_LIKE_EXTENSION_SET.has(pathExtension(filePath));
 }
-export function isImmutableAssetPath(filePath) {
-    if (NON_IMMUTABLE_EXTENSION_SET.has(pathExtension(filePath))) {
-        return false;
-    }
-    // Path-convention layer: anything under a guaranteed-content-hashed framework build
-    // dir is immutable regardless of filename. The extension gate above still applies,
-    // so an `index.html` accidentally under `_next/static/` is never pinned.
-    return isUnderGuaranteedImmutablePrefix(filePath);
-}
 /** Forced inert serving policy for a committed static file. PHP-like files are never executable. */
 export function runtimeFileSafety(filePath) {
     return {

package/dist/utils/storage-policy.d.ts

@@ -1,6 +1,6 @@
 export declare const STORAGE_OBJECT_MAX_FILE_BYTES: number;
-export declare const STORAGE_OBJECT_MAX_OWNER_BYTES: number;
 export declare const STORAGE_CONTENT_SNIFF_BYTES = 512;
+export declare const STORAGE_ANON_DAILY_BYTES: number;
 export declare const STORAGE_BLOCKED_CONTENT_TYPES: string[];
 export declare const STORAGE_BLOCKED_CONTENT_TYPE_FRAGMENTS: string[];
 export declare const STORAGE_BLOCKED_MAGIC_HEX: string[];

package/dist/utils/storage-policy.js

@@ -5,8 +5,10 @@
 // `bun --filter @spacefast/control-plane runtime:codegen-policy`. Both execute
 // the same storage-policy.fixtures.json corpus.
 export const STORAGE_OBJECT_MAX_FILE_BYTES = 5 * 1024 * 1024;
-export const STORAGE_OBJECT_MAX_OWNER_BYTES = 100 * 1024 * 1024;
 export const STORAGE_CONTENT_SNIFF_BYTES = 512;
+// Anonymous commenters share a per-space rolling daily upload budget; identified
+// principals and Functions relays are accountable and carry no budget.
+export const STORAGE_ANON_DAILY_BYTES = 200 * 1024 * 1024;
 export const STORAGE_BLOCKED_CONTENT_TYPES = [
     "application/java-archive",
     "application/java-vm",

package/dist/utils/structured-error.d.ts

@@ -0,0 +1,14 @@
+export declare class StructuredError extends Error {
+    readonly code: string;
+    readonly details: Record<string, unknown> | undefined;
+    readonly exitCode: number;
+    readonly type: string | undefined;
+    constructor(input: {
+        code: string;
+        message: string;
+        details?: Record<string, unknown> | undefined;
+        exitCode?: number | undefined;
+        type?: string | undefined;
+    });
+}
+export declare function structuredValidationError(message: string, details?: Record<string, unknown>): StructuredError;