@spacefast/common 0.0.24 → 0.0.26

package/brand-assets/LICENSE-Haskoy.txt

@@ -0,0 +1,93 @@
+Copyright 2021 The Haskoy Project Authors (https://github.com/ertekinno/haskoy)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/brand-assets/spacefast-favicon.svg

@@ -1,14 +1,14 @@
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 160 160" role="img" aria-label="Spacefast">
   <style>
-    .sf-favicon-primary { fill: #141419; }
-    @media (prefers-color-scheme: dark) { .sf-favicon-primary { fill: #fbf8f1; } }
+    .sf-favicon-primary { fill: #0c0c0c; }
+    @media (prefers-color-scheme: dark) { .sf-favicon-primary { fill: #fcfcfa; } }
   </style>
   <g transform="rotate(-1 80 80)">
-    <g transform="translate(22.5 48) scale(2.15)" fill="#ff4217">
+    <g transform="translate(22.5 48) scale(2.15)" fill="#d8f24b">
       <path d="M0 0h24v7H7v7h17v20H0v-7h17v-7H0V0Z"/>
       <path d="M0 0h25v7H7v6h15v7H7v14H0V0Z" transform="translate(31 0)"/>
     </g>
-    <g class="sf-favicon-primary" transform="translate(17.5 43) scale(2.15)" fill="#141419">
+    <g class="sf-favicon-primary" transform="translate(17.5 43) scale(2.15)" fill="#0c0c0c">
       <path d="M0 0h24v7H7v7h17v20H0v-7h17v-7H0V0Z"/>
       <path d="M0 0h25v7H7v6h15v7H7v14H0V0Z" transform="translate(31 0)"/>
     </g>

package/brand-assets/spacefast-sf-full-bleed.svg

@@ -1,11 +1,11 @@
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 160 160" role="img" aria-label="Spacefast">
-  <rect width="160" height="160" fill="#141419"/>
+  <rect width="160" height="160" fill="#0c0c0c"/>
   <g transform="rotate(-1 80 80)">
-    <g transform="translate(39.75 55.5) scale(1.5)" fill="#ff4217">
+    <g transform="translate(39.75 55.5) scale(1.5)" fill="#d8f24b">
       <path d="M0 0h24v7H7v7h17v20H0v-7h17v-7H0V0Z"/>
       <path d="M0 0h25v7H7v6h15v7H7v14H0V0Z" transform="translate(31 0)"/>
     </g>
-    <g transform="translate(34.75 50.5) scale(1.5)" fill="#fbf8f1">
+    <g transform="translate(34.75 50.5) scale(1.5)" fill="#fcfcfa">
       <path d="M0 0h24v7H7v7h17v20H0v-7h17v-7H0V0Z"/>
       <path d="M0 0h25v7H7v6h15v7H7v14H0V0Z" transform="translate(31 0)"/>
     </g>

package/brand-assets/spacefast-wordmark.svg

@@ -1,5 +1,3 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 326 62" role="img" aria-label="Spacefast">
-  <rect x="14" y="12" width="306" height="48" fill="#ff4217"/>
-  <rect x="10" y="8" width="306" height="48" fill="#141419" stroke="#141419" stroke-width="1"/>
-  <path fill="#fbf8f1" d="M20 15h24v7H27v7h17v20H20v-7h17v-7H20V15ZM51 15h24v18H58v16h-7V15Zm7 11h10v-4H58v4ZM83 15h24l9 34h-8l-2-8H84l-2 8h-8l9-34Zm3 19h18l-4-12H90l-4 12ZM145 22h-19v20h19v7h-26V15h26v7ZM152 15h26v7h-19v6h15v7h-15v7h19v7h-26V15ZM185 15h25v7h-18v6h15v7h-15v14h-7V15ZM215 15h24l9 34h-8l-2-8h-22l-2 8h-8l9-34Zm3 19h18l-4-12h-10l-4 12ZM250 15h24v7h-17v7h17v20h-24v-7h17v-7h-17V15ZM279 15h27v7h-10v27h-7V22h-10v-7Z"/>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 152 28.9062" role="img" aria-label="Spacefast">
+  <path fill="#0c0c0c" d="M9.32925 6.99344H20.5187V10.257H12.5929V13.5206H20.5187V22.8452H9.32925V19.5816H17.2551V16.318H9.32925V6.99344ZM23.7824 6.99344H34.9718V15.3856H27.046V22.8452H23.7824V6.99344ZM27.046 12.122H31.7082V10.257H27.046V12.122ZM38.7017 6.99344H49.8912L54.0872 22.8452H50.3574L49.4249 19.1154H39.1679L38.2355 22.8452H34.5056L38.7017 6.99344ZM40.1004 15.8518H48.4925L46.6276 10.257H41.9653L40.1004 15.8518ZM67.6079 10.257H58.7495V19.5816H67.6079V22.8452H55.4859V6.99344H67.6079V10.257ZM70.8715 6.99344H82.9934V10.257H74.1351V13.0544H81.1285V16.318H74.1351V19.5816H82.9934V22.8452H70.8715V6.99344ZM86.257 6.99344H97.9128V10.257H89.5206V13.0544H96.5141V16.318H89.5206V22.8452H86.257V6.99344ZM100.244 6.99344H111.433L115.629 22.8452H111.9L110.967 19.1154H100.71L99.7777 22.8452H96.0479L100.244 6.99344ZM101.643 15.8518H110.035L108.17 10.257H103.508L101.643 15.8518ZM116.562 6.99344H127.751V10.257H119.826V13.5206H127.751V22.8452H116.562V19.5816H124.488V16.318H116.562V6.99344ZM130.083 6.99344H142.671V10.257H138.008V22.8452H134.745V10.257H130.083V6.99344Z"/>
 </svg>

package/dist/agents/connect-targets.js

@@ -3,7 +3,7 @@
  *
  * One source of truth for "add Spacefast to your agent": the MCP launch config,
  * the one-click deeplinks, and the per-agent connect entries. Both the marketing
- * site (apps/www/src/lib/llmo.ts + agent-targets.ts, with the hardcoded prod
+ * standalone website (with the hardcoded prod
  * endpoint) and the Team Developer dashboard (with the runtime-derived
  * hosted endpoint) consume these, so every "connect an agent" surface advertises
  * the identical command, package, and config — they can never drift apart.

package/dist/agents/private-key-oauth.d.ts

@@ -25,7 +25,6 @@ export declare function resolveAgentApiAuthorization(config: AgentAuthConfig, ap
     resources: string[];
     scope: string | undefined;
 };
-export declare function createPrivateKeyJwtAssertion(config: AgentAuthConfig, createInvalidConfigError?: (message: string) => Error): Promise<string>;
 export declare function exchangeAgentAccessToken(input: {
     apiUrl: string;
     client: string;

package/dist/agents/private-key-oauth.js

@@ -1,6 +1,6 @@
-import { randomUUID, webcrypto } from "node:crypto";
+import { webcrypto } from "node:crypto";
+import * as oauth from "oauth4webapi";
 import { OAUTH_API_RESOURCE_SCOPES, oauthApiResourceUrl } from "../contracts/oauth-resources.js";
-const PRIVATE_KEY_JWT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
 const API_RESOURCE_SCOPES = new Set(OAUTH_API_RESOURCE_SCOPES);
 const INVALID_PRIVATE_KEY_MESSAGE = "SPACEFAST_AGENT_CONFIG private_jwk must be an ES256 P-256 JWK.";
 function isRecord(value) {
@@ -75,84 +75,67 @@ export function resolveAgentApiAuthorization(config, apiUrl) {
         scope: apiScopes.length > 0 ? apiScopes.join(" ") : undefined,
     };
 }
-function base64urlJson(value) {
-    return Buffer.from(JSON.stringify(value)).toString("base64url");
-}
-export async function createPrivateKeyJwtAssertion(config, createInvalidConfigError = (message) => new Error(message)) {
+async function privateKeyJwtClientAuth(config, createInvalidConfigError = (message) => new Error(message)) {
     if (config.private_jwk.kty !== "EC") {
         throw createInvalidConfigError(INVALID_PRIVATE_KEY_MESSAGE);
     }
-    const now = Math.floor(Date.now() / 1000);
-    const key = await webcrypto.subtle.importKey("jwk", config.private_jwk, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
-    const header = base64urlJson({
-        alg: "ES256",
-        typ: "JWT",
-        ...(config.private_jwk.kid ? { kid: config.private_jwk.kid } : {}),
-    });
-    const payload = base64urlJson({
-        iss: config.client_id,
-        sub: config.client_id,
-        aud: config.token_endpoint,
-        jti: randomUUID(),
-        iat: now,
-        exp: now + 300,
-    });
-    const signingInput = `${header}.${payload}`;
-    const signature = await webcrypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, key, new TextEncoder().encode(signingInput));
-    return `${signingInput}.${Buffer.from(signature).toString("base64url")}`;
-}
-function oauthErrorDescription(payload) {
-    return isRecord(payload) && "error_description" in payload
-        ? String(payload.error_description)
-        : undefined;
-}
-function oauthAccessToken(payload) {
-    return isRecord(payload) && typeof payload.access_token === "string"
-        ? payload.access_token
-        : undefined;
-}
-function oauthExpiresIn(payload) {
-    return isRecord(payload) && typeof payload.expires_in === "number" ? payload.expires_in : 300;
+    try {
+        const key = await webcrypto.subtle.importKey("jwk", config.private_jwk, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+        return oauth.PrivateKeyJwt({
+            key,
+            ...(config.private_jwk.kid ? { kid: config.private_jwk.kid } : {}),
+        });
+    }
+    catch {
+        throw createInvalidConfigError(INVALID_PRIVATE_KEY_MESSAGE);
+    }
 }
 export async function exchangeAgentAccessToken(input) {
     const { resources, scope } = resolveAgentApiAuthorization(input.config, input.apiUrl);
-    const body = new URLSearchParams({
-        grant_type: "client_credentials",
-        client_id: input.config.client_id,
-        client_assertion_type: PRIVATE_KEY_JWT_ASSERTION_TYPE,
-        client_assertion: await createPrivateKeyJwtAssertion(input.config, input.createInvalidConfigError),
-    });
+    const authorizationServer = {
+        // Agent credentials store the exact token endpoint rather than separate
+        // issuer metadata. RFC 7523 permits the endpoint as the assertion audience.
+        issuer: input.config.token_endpoint,
+        token_endpoint: input.config.token_endpoint,
+    };
+    const client = { client_id: input.config.client_id };
+    const body = new URLSearchParams();
     if (scope) {
         body.set("scope", scope);
     }
     for (const resource of resources) {
         body.append("resource", resource);
     }
-    const response = await (input.fetch ?? globalThis.fetch)(input.config.token_endpoint, {
-        method: "POST",
-        headers: {
-            accept: "application/json",
-            "content-type": "application/x-www-form-urlencoded",
-            "x-spacefast-client": input.client,
-        },
-        body,
+    const fetchFn = input.fetch ?? globalThis.fetch;
+    const response = await oauth.clientCredentialsGrantRequest(authorizationServer, client, await privateKeyJwtClientAuth(input.config, input.createInvalidConfigError), body, {
+        headers: { "x-spacefast-client": input.client },
         signal: input.signal,
+        [oauth.customFetch]: (url, init) => {
+            const requestInit = {
+                method: init.method,
+                headers: init.headers,
+                body: init.body,
+                redirect: init.redirect,
+            };
+            if (init.signal)
+                requestInit.signal = init.signal;
+            return fetchFn(url, requestInit);
+        },
     });
-    const payload = await response.json().catch(() => null);
-    if (!response.ok) {
-        throw input.createError({
-            status: response.status,
-            code: "agent_token_exchange_failed",
-            message: oauthErrorDescription(payload) ?? response.statusText,
-        });
+    let tokens;
+    try {
+        tokens = await oauth.processClientCredentialsResponse(authorizationServer, client, response);
     }
-    const accessToken = oauthAccessToken(payload);
-    if (accessToken === undefined) {
+    catch (error) {
+        const description = error instanceof oauth.ResponseBodyError ? error.error_description : undefined;
         throw input.createError({
-            status: response.status,
+            status: error instanceof oauth.ResponseBodyError ? error.status : response.status,
             code: "agent_token_exchange_failed",
-            message: "OAuth token endpoint did not return an access_token.",
+            message: description ??
+                (response.ok
+                    ? "OAuth token endpoint did not return a valid access-token response."
+                    : response.statusText),
         });
     }
-    return { accessToken, expiresIn: oauthExpiresIn(payload) };
+    return { accessToken: tokens.access_token, expiresIn: tokens.expires_in ?? 300 };
 }

package/dist/brand-assets-build.js

@@ -5,7 +5,7 @@
  * and render ordinary SVG markup from its constants. Only asset generators,
  * plugin packaging, and other build steps may import this module.
  */
-import { SPACEFAST_BRAND_COLORS, SPACEFAST_ICON_F_OFFSET_X, SPACEFAST_ICON_F_PATH, SPACEFAST_ICON_LETTER_ORIGIN, SPACEFAST_ICON_LETTER_SCALE, SPACEFAST_ICON_S_PATH, SPACEFAST_ICON_SHADOW_OFFSET, SPACEFAST_ICON_VIEW_BOX, SPACEFAST_WORDMARK_PATH, SPACEFAST_WORDMARK_PLATE, SPACEFAST_WORDMARK_SHADOW_OFFSET, SPACEFAST_WORDMARK_VIEW_BOX, } from "./brand-assets.js";
+import { SPACEFAST_BRAND_COLORS, SPACEFAST_ICON_F_OFFSET_X, SPACEFAST_ICON_F_PATH, SPACEFAST_ICON_LETTER_ORIGIN, SPACEFAST_ICON_LETTER_SCALE, SPACEFAST_ICON_S_PATH, SPACEFAST_ICON_SHADOW_OFFSET, SPACEFAST_ICON_VIEW_BOX, SPACEFAST_WORDMARK_PATH, SPACEFAST_WORDMARK_VIEW_BOX, } from "./brand-assets.js";
 function resolvedColors(colors) {
     return { ...SPACEFAST_BRAND_COLORS, ...colors };
 }
@@ -26,13 +26,11 @@ function numericAttribute(name, value) {
 }
 export function spacefastWordmarkSvg(options = {}) {
     const colors = resolvedColors(options.colors);
-    const plate = SPACEFAST_WORDMARK_PLATE;
-    const shadow = SPACEFAST_WORDMARK_SHADOW_OFFSET;
     const label = svgAttribute(options.ariaLabel ?? "Spacefast");
+    // The logotype is single-color: `plate` (ink) is its fill. The plate/shadow
+    // layer idiom retired with the riso system — the wordmark is bare letterforms.
     return `<svg xmlns="http://www.w3.org/2000/svg"${numericAttribute("width", options.width)}${numericAttribute("height", options.height)} viewBox="${SPACEFAST_WORDMARK_VIEW_BOX}" role="img" aria-label="${label}">
-  <rect x="${plate.x + shadow.x}" y="${plate.y + shadow.y}" width="${plate.width}" height="${plate.height}" fill="${svgAttribute(colors.shadow)}"/>
-  <rect x="${plate.x}" y="${plate.y}" width="${plate.width}" height="${plate.height}" fill="${svgAttribute(colors.plate)}" stroke="${svgAttribute(colors.plate)}" stroke-width="1"/>
-  <path fill="${svgAttribute(colors.paper)}" d="${SPACEFAST_WORDMARK_PATH}"/>
+  <path fill="${svgAttribute(colors.plate)}" d="${SPACEFAST_WORDMARK_PATH}"/>
 </svg>
 `;
 }

package/dist/brand-assets.d.ts

@@ -6,27 +6,17 @@
  * build outputs of these constants, never independent sources of truth.
  */
 export declare const SPACEFAST_BRAND_COLORS: {
-    readonly shadow: "#ff4217";
-    readonly plate: "#141419";
-    readonly paper: "#fbf8f1";
+    readonly shadow: "#d8f24b";
+    readonly plate: "#0c0c0c";
+    readonly paper: "#fcfcfa";
 };
 export type SpacefastBrandColors = {
     shadow: string;
     plate: string;
     paper: string;
 };
-export declare const SPACEFAST_WORDMARK_VIEW_BOX = "0 0 326 62";
-export declare const SPACEFAST_WORDMARK_PLATE: {
-    readonly x: 10;
-    readonly y: 8;
-    readonly width: 306;
-    readonly height: 48;
-};
-export declare const SPACEFAST_WORDMARK_SHADOW_OFFSET: {
-    readonly x: 4;
-    readonly y: 4;
-};
-export declare const SPACEFAST_WORDMARK_PATH = "M20 15h24v7H27v7h17v20H20v-7h17v-7H20V15ZM51 15h24v18H58v16h-7V15Zm7 11h10v-4H58v4ZM83 15h24l9 34h-8l-2-8H84l-2 8h-8l9-34Zm3 19h18l-4-12H90l-4 12ZM145 22h-19v20h19v7h-26V15h26v7ZM152 15h26v7h-19v6h15v7h-15v7h19v7h-26V15ZM185 15h25v7h-18v6h15v7h-15v14h-7V15ZM215 15h24l9 34h-8l-2-8h-22l-2 8h-8l9-34Zm3 19h18l-4-12h-10l-4 12ZM250 15h24v7h-17v7h17v20h-24v-7h17v-7h-17V15ZM279 15h27v7h-10v27h-7V22h-10v-7Z";
+export declare const SPACEFAST_WORDMARK_VIEW_BOX = "0 0 152 28.9062";
+export declare const SPACEFAST_WORDMARK_PATH = "M9.32925 6.99344H20.5187V10.257H12.5929V13.5206H20.5187V22.8452H9.32925V19.5816H17.2551V16.318H9.32925V6.99344ZM23.7824 6.99344H34.9718V15.3856H27.046V22.8452H23.7824V6.99344ZM27.046 12.122H31.7082V10.257H27.046V12.122ZM38.7017 6.99344H49.8912L54.0872 22.8452H50.3574L49.4249 19.1154H39.1679L38.2355 22.8452H34.5056L38.7017 6.99344ZM40.1004 15.8518H48.4925L46.6276 10.257H41.9653L40.1004 15.8518ZM67.6079 10.257H58.7495V19.5816H67.6079V22.8452H55.4859V6.99344H67.6079V10.257ZM70.8715 6.99344H82.9934V10.257H74.1351V13.0544H81.1285V16.318H74.1351V19.5816H82.9934V22.8452H70.8715V6.99344ZM86.257 6.99344H97.9128V10.257H89.5206V13.0544H96.5141V16.318H89.5206V22.8452H86.257V6.99344ZM100.244 6.99344H111.433L115.629 22.8452H111.9L110.967 19.1154H100.71L99.7777 22.8452H96.0479L100.244 6.99344ZM101.643 15.8518H110.035L108.17 10.257H103.508L101.643 15.8518ZM116.562 6.99344H127.751V10.257H119.826V13.5206H127.751V22.8452H116.562V19.5816H124.488V16.318H116.562V6.99344ZM130.083 6.99344H142.671V10.257H138.008V22.8452H134.745V10.257H130.083V6.99344Z";
 export declare const SPACEFAST_ICON_VIEW_BOX = "0 0 160 160";
 export declare const SPACEFAST_ICON_S_PATH = "M0 0h24v7H7v7h17v20H0v-7h17v-7H0V0Z";
 export declare const SPACEFAST_ICON_F_PATH = "M0 0h25v7H7v6h15v7H7v14H0V0Z";

package/dist/brand-assets.js

@@ -5,22 +5,23 @@
  * renderers, and plugin generators all consume it. Generated SVG/PNG files are
  * build outputs of these constants, never independent sources of truth.
  */
+// The 2026-08 "printed matter" palette (DESIGN.md §3). `plate`/`paper` name the
+// icon serializers' layers; the wordmark itself is a single-color logotype and
+// takes whatever ink its surface supplies.
 export const SPACEFAST_BRAND_COLORS = {
-    shadow: "#ff4217",
-    plate: "#141419",
-    paper: "#fbf8f1",
+    shadow: "#d8f24b",
+    plate: "#0c0c0c",
+    paper: "#fcfcfa",
 };
-export const SPACEFAST_WORDMARK_VIEW_BOX = "0 0 326 62";
-export const SPACEFAST_WORDMARK_PLATE = {
-    x: 10,
-    y: 8,
-    width: 306,
-    height: 48,
-};
-export const SPACEFAST_WORDMARK_SHADOW_OFFSET = { x: 4, y: 4 };
-// Re-kerned and vertically centered on the plate. This is a literal so browser
-// consumers render ordinary SVG markup without assembling path text at runtime.
-export const SPACEFAST_WORDMARK_PATH = "M20 15h24v7H27v7h17v20H20v-7h17v-7H20V15ZM51 15h24v18H58v16h-7V15Zm7 11h10v-4H58v4ZM83 15h24l9 34h-8l-2-8H84l-2 8h-8l9-34Zm3 19h18l-4-12H90l-4 12ZM145 22h-19v20h19v7h-26V15h26v7ZM152 15h26v7h-19v6h15v7h-15v7h19v7h-26V15ZM185 15h25v7h-18v6h15v7h-15v14h-7V15ZM215 15h24l9 34h-8l-2-8h-22l-2 8h-8l9-34Zm3 19h18l-4-12h-10l-4 12ZM250 15h24v7h-17v7h17v20h-24v-7h17v-7h-17V15ZM279 15h27v7h-10v27h-7V22h-10v-7Z";
+// The logotype: bare "SPACEFAST" letterforms in the right-angle stencil
+// alphabet — no plates, no offset shadow (that idiom retired with the riso
+// system). One path, one color; surfaces set the fill (ink on light grounds,
+// paper on dark). Exported from the Spacefast Figma file via the standalone
+// `www` repo (`public/static/brand/spacefast-wordmark.svg`).
+export const SPACEFAST_WORDMARK_VIEW_BOX = "0 0 152 28.9062";
+// This is a literal so browser consumers render ordinary SVG markup without
+// assembling path text at runtime.
+export const SPACEFAST_WORDMARK_PATH = "M9.32925 6.99344H20.5187V10.257H12.5929V13.5206H20.5187V22.8452H9.32925V19.5816H17.2551V16.318H9.32925V6.99344ZM23.7824 6.99344H34.9718V15.3856H27.046V22.8452H23.7824V6.99344ZM27.046 12.122H31.7082V10.257H27.046V12.122ZM38.7017 6.99344H49.8912L54.0872 22.8452H50.3574L49.4249 19.1154H39.1679L38.2355 22.8452H34.5056L38.7017 6.99344ZM40.1004 15.8518H48.4925L46.6276 10.257H41.9653L40.1004 15.8518ZM67.6079 10.257H58.7495V19.5816H67.6079V22.8452H55.4859V6.99344H67.6079V10.257ZM70.8715 6.99344H82.9934V10.257H74.1351V13.0544H81.1285V16.318H74.1351V19.5816H82.9934V22.8452H70.8715V6.99344ZM86.257 6.99344H97.9128V10.257H89.5206V13.0544H96.5141V16.318H89.5206V22.8452H86.257V6.99344ZM100.244 6.99344H111.433L115.629 22.8452H111.9L110.967 19.1154H100.71L99.7777 22.8452H96.0479L100.244 6.99344ZM101.643 15.8518H110.035L108.17 10.257H103.508L101.643 15.8518ZM116.562 6.99344H127.751V10.257H119.826V13.5206H127.751V22.8452H116.562V19.5816H124.488V16.318H116.562V6.99344ZM130.083 6.99344H142.671V10.257H138.008V22.8452H134.745V10.257H130.083V6.99344Z";
 export const SPACEFAST_ICON_VIEW_BOX = "0 0 160 160";
 export const SPACEFAST_ICON_S_PATH = "M0 0h24v7H7v7h17v20H0v-7h17v-7H0V0Z";
 export const SPACEFAST_ICON_F_PATH = "M0 0h25v7H7v6h15v7H7v14H0V0Z";

package/dist/config/domains.d.ts

@@ -1,7 +1,7 @@
 /** Deployment environment a URL is being built for. */
 export type DeployEnv = "dev" | "test" | "prod";
 /** Logical services that each get their own host. */
-export type Service = "www" | "api" | "dashboard" | "superadmin" | "cast" | "mcp" | "push" | "fieldguide";
+export type Service = "www" | "api" | "access" | "dashboard" | "superadmin" | "cast" | "mcp" | "push" | "fieldguide";
 export type EnvDomains = {
     /** Apex/base origin for the marketing site (the `www` service + bare apex). */
     readonly apex: string;
@@ -16,12 +16,35 @@ export type EnvDomains = {
 export declare const PROD_ENV_DOMAIN: "spacefast.com";
 /** The local-dev apex (portless serves every subdomain over HTTPS). */
 export declare const DEV_ENV_DOMAIN: "sf.localhost";
+/** The deployed staging apex. Not local: staging is a hosted environment. */
+export declare const STAGING_ENV_DOMAIN: "stattic.net";
+/** The deployed dev apex — distinct from local dev, which stays on sf.localhost. */
+export declare const DEV_DEPLOY_ENV_DOMAIN: "stattic.xyz";
+/**
+ * The three environments the deploy lanes ship to, keyed by the name each one
+ * carries everywhere else: the branch map in scripts/deploy-environment.mjs,
+ * the GitHub Environment, and `SPACEFAST_ENV` on the running service.
+ *
+ * Distinct from `DeployEnv` below, which names the *local* stacks (dev/test on
+ * sf.localhost) beside prod.
+ */
+export type HostedEnv = "dev" | "staging" | "prod";
+export declare const HOSTED_ENV_DOMAINS: Readonly<Record<HostedEnv, string>>;
+/**
+ * The hosted environment a `SPACEFAST_ENV` value names, or null. `production`
+ * is accepted for `prod`: it is what the running services already carry, and
+ * what their alert routing and email tags key on.
+ */
+export declare function hostedEnvFor(environment: string | undefined): HostedEnv | null;
+/** The apex a hosted environment serves from, or null when the name is not one. */
+export declare function hostedEnvDomain(environment: string | undefined): string | null;
 /**
  * Construct the full per-service host map from a single env domain
- * (`spacefast.com`, `sf.localhost`, …). One knob — services are always
- * `<service>.<domain>` over https, with two deliberate exceptions:
- * the marketing site sits on the bare prod apex, and the internal handbook
- * lives on the view.fast infra apex in prod.
+ * (`spacefast.com`, `stattic.net`, `sf.localhost`, …). One knob — services are
+ * always `<service>.<domain>` over https, with three deliberate exceptions: the
+ * marketing site sits on the bare apex of a hosted environment (so staging
+ * rehearses production's shape rather than a `www.` variant of it), and both
+ * Git push and the internal handbook live on their own apexes in prod.
  */
 export declare function envDomainsFor(domain: string): EnvDomains;
 /** Origin (scheme + host, no trailing slash) for a service in an environment. */
@@ -37,8 +60,25 @@ export declare const DOCS_BASE_URL: string;
 export declare const PROD_VIEW_FAST_APEX: "view.fast";
 /** The local-dev infrastructure apex. Never appears in committed artifacts. */
 export declare const DEV_VIEW_FAST_APEX: "preview.space";
-/** Resolve the infrastructure apex, allowing an explicit deployment override. */
-export declare function resolveViewFastApex(environment: Readonly<Partial<Pick<NodeJS.ProcessEnv, "NODE_ENV" | "SPACEFAST_VIEW_FAST_APEX">>>): string;
+/**
+ * Resolve the infrastructure apex, allowing an explicit deployment override.
+ *
+ * Only production has an apex here. Every other hosted environment names its
+ * own through `SPACEFAST_VIEW_FAST_APEX`, because a space apex is a zone that
+ * has to exist, be delegated, and be attached at the provider — not a name this
+ * registry can pick on a deployment's behalf. Two environments allocating from
+ * one apex race for the same hostname, and the one that loses is a customer's
+ * site.
+ *
+ * When nothing names the apex, this falls back to the local one rather than
+ * production's: a caller that cannot say which environment it is has no claim
+ * on production's namespace. Holding deployments to naming it belongs to the
+ * process that mints hostnames, not to this module — the control plane's env
+ * schema refuses to boot without it, while builds and browser bundles import
+ * this registry for its host scheme and must not explode over an environment
+ * they do not have.
+ */
+export declare function resolveViewFastApex(environment: Readonly<Partial<Pick<NodeJS.ProcessEnv, "NODE_ENV" | "SPACEFAST_ENV" | "SPACEFAST_VIEW_FAST_APEX">>>): string;
 /** Infrastructure apex used for public managed/custom domains. */
 export declare const VIEW_FAST_APEX: string;
 /** Reserved first-label prefix for the management namespace; users may not register it. */

package/dist/config/domains.js

@@ -9,22 +9,52 @@
 export const PROD_ENV_DOMAIN = "spacefast.com";
 /** The local-dev apex (portless serves every subdomain over HTTPS). */
 export const DEV_ENV_DOMAIN = "sf.localhost";
+/** The deployed staging apex. Not local: staging is a hosted environment. */
+export const STAGING_ENV_DOMAIN = "stattic.net";
+/** The deployed dev apex — distinct from local dev, which stays on sf.localhost. */
+export const DEV_DEPLOY_ENV_DOMAIN = "stattic.xyz";
+export const HOSTED_ENV_DOMAINS = {
+    dev: DEV_DEPLOY_ENV_DOMAIN,
+    staging: STAGING_ENV_DOMAIN,
+    prod: PROD_ENV_DOMAIN,
+};
+/**
+ * The hosted environment a `SPACEFAST_ENV` value names, or null. `production`
+ * is accepted for `prod`: it is what the running services already carry, and
+ * what their alert routing and email tags key on.
+ */
+export function hostedEnvFor(environment) {
+    if (!environment)
+        return null;
+    const normalized = environment.trim().toLowerCase();
+    if (normalized === "production")
+        return "prod";
+    return Object.hasOwn(HOSTED_ENV_DOMAINS, normalized) ? normalized : null;
+}
+/** The apex a hosted environment serves from, or null when the name is not one. */
+export function hostedEnvDomain(environment) {
+    const hosted = hostedEnvFor(environment);
+    return hosted ? HOSTED_ENV_DOMAINS[hosted] : null;
+}
 /**
  * Construct the full per-service host map from a single env domain
- * (`spacefast.com`, `sf.localhost`, …). One knob — services are always
- * `<service>.<domain>` over https, with two deliberate exceptions:
- * the marketing site sits on the bare prod apex, and the internal handbook
- * lives on the view.fast infra apex in prod.
+ * (`spacefast.com`, `stattic.net`, `sf.localhost`, …). One knob — services are
+ * always `<service>.<domain>` over https, with three deliberate exceptions: the
+ * marketing site sits on the bare apex of a hosted environment (so staging
+ * rehearses production's shape rather than a `www.` variant of it), and both
+ * Git push and the internal handbook live on their own apexes in prod.
  */
 export function envDomainsFor(domain) {
     const prod = domain === PROD_ENV_DOMAIN;
+    const hosted = Object.values(HOSTED_ENV_DOMAINS).some((hostedDomain) => hostedDomain === domain);
     return {
         apex: domain,
         cookieDomain: `.${domain}`,
         protocol: "https",
         hosts: {
-            www: prod ? domain : `www.${domain}`,
+            www: hosted ? domain : `www.${domain}`,
             api: `api.${domain}`,
+            access: `access.${domain}`,
             dashboard: `my.${domain}`,
             superadmin: `superadmin.${domain}`,
             cast: `cast.${domain}`,
@@ -65,13 +95,38 @@ export const DOCS_BASE_URL = `${serviceOrigin("www", "prod")}/docs`;
 export const PROD_VIEW_FAST_APEX = "view.fast";
 /** The local-dev infrastructure apex. Never appears in committed artifacts. */
 export const DEV_VIEW_FAST_APEX = "preview.space";
-/** Resolve the infrastructure apex, allowing an explicit deployment override. */
+/**
+ * Resolve the infrastructure apex, allowing an explicit deployment override.
+ *
+ * Only production has an apex here. Every other hosted environment names its
+ * own through `SPACEFAST_VIEW_FAST_APEX`, because a space apex is a zone that
+ * has to exist, be delegated, and be attached at the provider — not a name this
+ * registry can pick on a deployment's behalf. Two environments allocating from
+ * one apex race for the same hostname, and the one that loses is a customer's
+ * site.
+ *
+ * When nothing names the apex, this falls back to the local one rather than
+ * production's: a caller that cannot say which environment it is has no claim
+ * on production's namespace. Holding deployments to naming it belongs to the
+ * process that mints hostnames, not to this module — the control plane's env
+ * schema refuses to boot without it, while builds and browser bundles import
+ * this registry for its host scheme and must not explode over an environment
+ * they do not have.
+ */
 export function resolveViewFastApex(environment) {
+    const explicit = environment.SPACEFAST_VIEW_FAST_APEX?.trim().toLowerCase();
+    if (explicit)
+        return explicit;
+    // SPACEFAST_ENV names a hosted environment only on a deployed service, where
+    // NODE_ENV is production — the same split the control plane's env-domain
+    // derivation makes. `dev` is also the local stack's name, and a local stack
+    // must keep the local apex rather than allocate under hosted dev's.
     const nodeEnvironment = environment.NODE_ENV?.trim().toLowerCase();
-    return (environment.SPACEFAST_VIEW_FAST_APEX?.trim().toLowerCase() ||
-        (["prod", "production"].includes(nodeEnvironment ?? "")
-            ? PROD_VIEW_FAST_APEX
-            : DEV_VIEW_FAST_APEX));
+    if (!["prod", "production"].includes(nodeEnvironment ?? ""))
+        return DEV_VIEW_FAST_APEX;
+    return hostedEnvFor(environment.SPACEFAST_ENV) === "prod"
+        ? PROD_VIEW_FAST_APEX
+        : DEV_VIEW_FAST_APEX;
 }
 /** Infrastructure apex used for public managed/custom domains. */
 export const VIEW_FAST_APEX = resolveViewFastApex(typeof process === "undefined" ? {} : process.env);

package/dist/contracts/access.d.ts

@@ -4,8 +4,8 @@ export declare const SPACE_ACCESS_PRESETS: readonly ["private", "team", "public"
 export declare const ACCESS_HANDOFF_MEDIA_TYPE = "application/vnd.spacefast.access-handoff+json";
 export declare const spaceAccessPresetSchema: z.ZodEnum<{
     team: "team";
-    public: "public";
     private: "private";
+    public: "public";
 }>;
 export type SpaceAccessPreset = z.infer<typeof spaceAccessPresetSchema>;
 /**
@@ -617,15 +617,15 @@ export type PrivateOpen = z.infer<typeof privateOpenSchema>;
 export declare const teamSpaceAccessDefaultSchema: z.ZodObject<{
     newSpaceGrantPreset: z.ZodEnum<{
         team: "team";
-        public: "public";
         private: "private";
+        public: "public";
     }>;
 }, z.core.$strip>;
 export declare const teamSpaceAccessDefaultWriteSchema: z.ZodObject<{
     newSpaceGrantPreset: z.ZodEnum<{
         team: "team";
-        public: "public";
         private: "private";
+        public: "public";
     }>;
 }, z.core.$strip>;
 export declare const ACCESS_TOKEN_KID = "spacefast-runtime-v1";

package/dist/contracts/activity.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export declare const ACTIVITY_EVENT_CODES: readonly ["space.created", "space.claimed", "feedback.lead_claim_pending", "space.transferred", "space.expired", "space.disabled", "space.enabled", "space.deleted", "space.config_updated", "space.slug_updated", "site.provision_requested", "site.placement_hold_set", "site.placement_hold_cleared", "site.burst_toggled", "space.access_logout_all", "space.access_transfer_scrub", "space.share_link_created", "space.share_link_revoked", "space.access_request_created", "space.access_request_resolved", "space.grant_created", "space.grant_updated", "space.grant_revoked", "team.access_defaults_updated", "version.created", "version.ready", "version.warning", "version.failed", "version.expired", "version.canceled", "version.deleted", "channel.promoted", "build.created", "build.succeeded", "build.failed", "build.canceled", "build.skipped", "domain.created", "domain.verified", "domain.verification_failed", "domain.control_lost", "domain.dns_updated", "domain.nameservers_updated", "domain.registration_purchased", "domain.registration_renewed", "domain.registration_expiring", "domain.registration_expired", "domain.transfer_in_started", "domain.transfer_out_started", "domain.deleted", "domain.attached", "domain.activated", "domain.blocked", "domain.detached", "transfer.requested", "transfer.confirmed", "transfer.completed", "transfer.canceled", "transfer.expired", "transfer.failed", "variable.updated", "variable.deleted", "api_key.created", "api_key.updated", "api_key.revoked", "agent_handoff.created", "agent_handoff.redeemed", "agent_handoff.revoked", "webhook.created", "webhook.updated", "webhook.secret_rotated", "webhook.disabled", "webhook.deleted", "team.updated", "team.slug_updated", "team.member_added", "team.member_removed", "team.member_role_updated", "team.builds_deploys_quota_exceeded", "tenant.past_due", "tenant.suspended", "tenant.reactivated", "tenant.deleted", "comment.token_minted", "comment.created", "comment.reply_created", "comment.archived", "comment.unarchived", "abuse_report.created", "abuse_report.updated", "claim.blocked_takedown", "claim.authority_rotated", "user.created", "user.signed_in", "user.deleted", "user.impersonation_started", "user.impersonation_stopped", "user.two_factor_enabled", "user.two_factor_disabled"];
+export declare const ACTIVITY_EVENT_CODES: readonly ["space.created", "space.claimed", "feedback.lead_claim_pending", "space.transferred", "space.expired", "space.disabled", "space.enabled", "space.deleted", "space.config_updated", "space.slug_updated", "site.provision_requested", "site.placement_hold_set", "site.placement_hold_cleared", "site.burst_toggled", "space.access_logout_all", "space.access_transfer_scrub", "space.share_link_created", "space.share_link_revoked", "space.access_request_created", "space.access_request_resolved", "space.grant_created", "space.grant_updated", "space.grant_revoked", "team.access_defaults_updated", "version.created", "version.ready", "version.warning", "version.failed", "version.expired", "version.canceled", "version.deleted", "channel.promoted", "build.created", "build.succeeded", "build.failed", "build.canceled", "build.skipped", "domain.created", "domain.verified", "domain.verification_failed", "domain.control_lost", "domain.dns_updated", "domain.nameservers_updated", "domain.registration_purchased", "domain.registration_renewed", "domain.registration_expiring", "domain.registration_expired", "domain.transfer_in_started", "domain.transfer_out_started", "domain.deleted", "domain.attached", "domain.activated", "domain.blocked", "domain.detached", "transfer.requested", "transfer.confirmed", "transfer.completed", "transfer.canceled", "transfer.expired", "transfer.failed", "cron.failed", "variable.updated", "variable.deleted", "api_key.created", "api_key.updated", "api_key.revoked", "agent_handoff.created", "agent_handoff.redeemed", "agent_handoff.revoked", "webhook.created", "webhook.updated", "webhook.secret_rotated", "webhook.disabled", "webhook.deleted", "team.updated", "team.slug_updated", "team.member_added", "team.member_removed", "team.member_role_updated", "team.builds_deploys_quota_exceeded", "tenant.past_due", "tenant.suspended", "tenant.reactivated", "tenant.deleted", "comment.token_minted", "comment.created", "comment.reply_created", "comment.archived", "comment.unarchived", "abuse_report.created", "abuse_report.updated", "claim.blocked_takedown", "claim.authority_rotated", "user.created", "user.signed_in", "user.deleted", "user.impersonation_started", "user.impersonation_stopped", "user.two_factor_enabled", "user.two_factor_disabled"];
 export type ActivityEventCode = (typeof ACTIVITY_EVENT_CODES)[number];
 export declare function isActivityEventCode(value: string): value is ActivityEventCode;
 export declare function isValidActivityEventFilter(filter: string): boolean;