@spacefast/common 0.0.24 → 0.2.1

package/dist/utils/content-type.d.ts

@@ -1,11 +1,12 @@
 /**
- * Map a file extension to a Content-Type header value. Returns
- * `application/octet-stream` when the extension is not recognized.
- *
- * MIME extension coverage comes from the maintained `mime` database. The
- * small overrides above preserve intentional existing policy; this module
- * does not carry a second partial extension registry.
+ * Content-Type for a file extension, `application/octet-stream` when unknown.
+ * Coverage comes from the `mime` database; the overrides above are the only
+ * exceptions, and this module never grows a second extension registry.
  */
 export declare function contentTypeForPath(filePath: string): string;
 export declare function textTypeForPath(filePath: string): string | null;
+export declare const CONTENT_SNIFF_KINDS: readonly ["png", "jpeg", "gif", "webp", "avif", "ico", "pdf", "gzip", "woff", "woff2", "ttf", "otf", "text", "binary"];
+export type ContentSniffKind = (typeof CONTENT_SNIFF_KINDS)[number];
+export declare function contentSniffKind(bytes: Uint8Array): ContentSniffKind;
+export declare function contentTypeForSniff(filePath: string, sniff: ContentSniffKind): string;
 export declare function contentTypeForBytes(filePath: string, bytes: Uint8Array): string;

package/dist/utils/content-type.js

@@ -1,7 +1,7 @@
 import mime from "mime";
 const CONTENT_TYPE_OVERRIDES = {
-    // Preserve the public uploader/runtime policy where the database's preferred
-    // server-oriented type differs from the established browser-facing type.
+    // Where the mime database's server-oriented type differs from the
+    // browser-facing type we already serve.
     ".cjs": "text/javascript",
     ".cts": "text/plain",
     ".d.ts": "text/plain",
@@ -18,12 +18,9 @@ const UTF8_APPLICATION_TYPES = new Set([
     "application/xml",
 ]);
 /**
- * Map a file extension to a Content-Type header value. Returns
- * `application/octet-stream` when the extension is not recognized.
- *
- * MIME extension coverage comes from the maintained `mime` database. The
- * small overrides above preserve intentional existing policy; this module
- * does not carry a second partial extension registry.
+ * Content-Type for a file extension, `application/octet-stream` when unknown.
+ * Coverage comes from the `mime` database; the overrides above are the only
+ * exceptions, and this module never grows a second extension registry.
  */
 export function contentTypeForPath(filePath) {
     const normalizedPath = filePath.toLowerCase();
@@ -70,53 +67,78 @@ function bytesLookTextual(bytes) {
     }
     return true;
 }
-export function contentTypeForBytes(filePath, bytes) {
-    if (hasPrefix(bytes, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])) {
-        return "image/png";
-    }
-    if (hasPrefix(bytes, [0xff, 0xd8, 0xff])) {
-        return "image/jpeg";
-    }
-    if (hasAsciiPrefix(bytes, "GIF87a") || hasAsciiPrefix(bytes, "GIF89a")) {
-        return "image/gif";
-    }
-    if (hasAsciiPrefix(bytes, "RIFF") && hasAsciiPrefix(bytes.slice(8), "WEBP")) {
-        return "image/webp";
-    }
+export const CONTENT_SNIFF_KINDS = [
+    "png",
+    "jpeg",
+    "gif",
+    "webp",
+    "avif",
+    "ico",
+    "pdf",
+    "gzip",
+    "woff",
+    "woff2",
+    "ttf",
+    "otf",
+    "text",
+    "binary",
+];
+export function contentSniffKind(bytes) {
+    if (hasPrefix(bytes, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))
+        return "png";
+    if (hasPrefix(bytes, [0xff, 0xd8, 0xff]))
+        return "jpeg";
+    if (hasAsciiPrefix(bytes, "GIF87a") || hasAsciiPrefix(bytes, "GIF89a"))
+        return "gif";
+    if (hasAsciiPrefix(bytes, "RIFF") && hasAsciiPrefix(bytes.slice(8), "WEBP"))
+        return "webp";
     if (hasAsciiPrefix(bytes.slice(4), "ftypavif") || hasAsciiPrefix(bytes.slice(4), "ftypavis")) {
-        return "image/avif";
-    }
-    if (hasPrefix(bytes, [0x00, 0x00, 0x01, 0x00])) {
-        return "image/x-icon";
-    }
-    if (hasAsciiPrefix(bytes, "%PDF-")) {
-        return "application/pdf";
-    }
-    if (hasPrefix(bytes, [0x1f, 0x8b, 0x08])) {
-        return "application/gzip";
-    }
-    if (hasAsciiPrefix(bytes, "wOFF")) {
-        return "font/woff";
-    }
-    if (hasAsciiPrefix(bytes, "wOF2")) {
-        return "font/woff2";
-    }
-    if (hasPrefix(bytes, [0x00, 0x01, 0x00, 0x00]) || hasAsciiPrefix(bytes, "true")) {
-        return "font/ttf";
-    }
-    if (hasAsciiPrefix(bytes, "OTTO")) {
-        return "font/otf";
-    }
+        return "avif";
+    }
+    if (hasPrefix(bytes, [0x00, 0x00, 0x01, 0x00]))
+        return "ico";
+    if (hasAsciiPrefix(bytes, "%PDF-"))
+        return "pdf";
+    if (hasPrefix(bytes, [0x1f, 0x8b, 0x08]))
+        return "gzip";
+    if (hasAsciiPrefix(bytes, "wOFF"))
+        return "woff";
+    if (hasAsciiPrefix(bytes, "wOF2"))
+        return "woff2";
+    if (hasPrefix(bytes, [0x00, 0x01, 0x00, 0x00]) || hasAsciiPrefix(bytes, "true"))
+        return "ttf";
+    if (hasAsciiPrefix(bytes, "OTTO"))
+        return "otf";
+    return bytesLookTextual(bytes) ? "text" : "binary";
+}
+const CONTENT_TYPES_BY_SNIFF = {
+    png: "image/png",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    webp: "image/webp",
+    avif: "image/avif",
+    ico: "image/x-icon",
+    pdf: "application/pdf",
+    gzip: "application/gzip",
+    woff: "font/woff",
+    woff2: "font/woff2",
+    ttf: "font/ttf",
+    otf: "font/otf",
+    text: null,
+    binary: null,
+};
+export function contentTypeForSniff(filePath, sniff) {
+    const detected = CONTENT_TYPES_BY_SNIFF[sniff];
+    if (detected)
+        return detected;
     const textType = textTypeForPath(filePath);
-    if (textType && bytesLookTextual(bytes)) {
+    if (sniff === "text" && textType)
         return textType;
-    }
-    // Container signatures such as ISO-BMFF, WebM, and Ogg are shared by audio
-    // and video variants. The extension is the reliable discriminator for the
-    // manifest declaration, while unknown binary extensions remain generic.
     const pathType = contentTypeForPath(filePath);
-    if (pathType.startsWith("audio/") || pathType.startsWith("video/")) {
+    if (pathType.startsWith("audio/") || pathType.startsWith("video/"))
         return pathType;
-    }
     return "application/octet-stream";
 }
+export function contentTypeForBytes(filePath, bytes) {
+    return contentTypeForSniff(filePath, contentSniffKind(bytes));
+}

package/dist/utils/credential-policy.d.ts

@@ -1,3 +1,4 @@
+import { type ApprovableScope } from "../contracts/access-profiles.js";
 import { type ApiKeyPreset, type ApiCredentialPolicy, type StatticAction } from "../contracts/api-keys.js";
 type RequestCondition = NonNullable<ApiCredentialPolicy["statements"][number]["conditions"]>;
 export type PolicyCompileInput = {
@@ -8,21 +9,64 @@ export type PolicyAuthorizeInput = {
     policy: ApiCredentialPolicy;
     action: StatticAction;
     /**
-     * Candidate resource URIs for one request target, evaluated together: spaces
-     * are addressed by their canonical site-rooted URI AND a principal-scoped
-     * candidate so principal wildcards cover them. A deny matching ANY candidate
-     * wins; otherwise an allow matching any candidate permits.
+     * Candidate URIs for one request target: a space is addressed both by its
+     * site-rooted URI and by a principal-scoped one. A deny on any candidate
+     * wins; an allow on any candidate permits.
      */
     resource: string | readonly string[];
     conditions?: RequestCondition;
 };
-export declare const publishActions: ("spaces:read" | "spaces:write" | "spaces:publish" | "builds:trigger" | "spaces:create" | "versions:read" | "versions:promote" | "versions:download" | "builds:read" | "builds:create")[];
+/**
+ * What a publishing credential may do — the same set the `publish:write` OAuth
+ * scope grants, derived from the one scope⇄action table so an API-key preset
+ * and an OAuth client of the same tier can never drift apart.
+ */
+export declare const publishActions: ("teams:read" | "teams:create" | "spaces:read" | "spaces:write" | "spaces:rename" | "domains:read" | "spaces:publish" | "builds:trigger" | "*" | "spaces:create" | "spaces:delete" | "spaces:transfer" | "spaces:export" | "spaces:import" | "spaces:policy.write" | "versions:read" | "versions:promote" | "versions:delete" | "versions:download" | "domains:create" | "domains:verify" | "domains:assign" | "domains:bind" | "domains:delete" | "domains:dns.write" | "domains:dns.credentials.write" | "domains:purchase" | "webhooks:read" | "webhooks:write" | "builds:read" | "builds:create" | "variables:read" | "variables:write" | "tenants:read" | "tenants:write" | "principals:read" | "principals:write" | "infrastructure:read" | "teams:write" | "teams:members.write" | "billing:read" | "billing:write" | "tokens:read" | "tokens:create" | "tokens:revoke" | "runtime:manage")[];
+/** The canonical policy resource for a team principal's subtree. */
+export declare function teamResource(input: PolicyCompileInput): string;
 export declare function compileApiKeyPreset(preset: ApiKeyPreset, input: PolicyCompileInput): ApiCredentialPolicy;
-/** Expand a named API-key preset into the finite permissions sent on the public wire contract. */
+/**
+ * Expand a named API-key preset into the finite permissions sent on the public
+ * wire contract. Deduplicated, because presets compose overlapping action
+ * groups and `allowPolicy` dedupes what it compiles — the wire list and the
+ * compiled statement must name the same actions.
+ */
 export declare function apiKeyPresetPermissions(preset: ApiKeyPreset): StatticAction[];
+export declare function compileTenantRootedPolicy(input: {
+    tenantId: string;
+    preset: ApiKeyPreset;
+}): ApiCredentialPolicy;
+export declare function compilePartnerPrincipalPolicy(input: {
+    tenantId: string;
+    normalizedPrincipalId: string;
+}): ApiCredentialPolicy;
 export declare function compileTeamRolePolicy(input: PolicyCompileInput & {
     role: string;
 }): ApiCredentialPolicy;
+/**
+ * The authority a membership-following key resolves to for one team: an action
+ * set bounded by the member's live role.
+ *
+ * Takes the action set rather than a preset name because a key's authority is
+ * not always its preset's CURRENT meaning. A key whose stored preset was
+ * redefined under it carries an explicit pin of the actions it was granted
+ * (`preset_actions_pin`), and that pin is what it keeps authorizing by.
+ */
+export declare function compileBoundedActionsPolicy(actions: readonly StatticAction[], input: PolicyCompileInput & {
+    role: string;
+}): ApiCredentialPolicy;
+/**
+ * Whether a person holding `role` in a team can currently exercise `scope`
+ * there. Account-plane scopes are admission the person always holds for
+ * themselves — no team role could bound them. Team-plane scopes need every
+ * action they grant inside the role's compiled policy.
+ *
+ * Informational, not a gate: approval no longer fails on role (authority is
+ * bounded live, per request, by `compileBoundedActionsPolicy`); the approval
+ * page uses this to tell the approver what a grant will actually do under
+ * their current role.
+ */
+export declare function scopeGrantableByRole(scope: ApprovableScope, role: string): boolean;
 export declare function compileBoundedPresetPolicy(preset: ApiKeyPreset, input: PolicyCompileInput & {
     role: string;
 }): ApiCredentialPolicy;

package/dist/utils/credential-policy.js

@@ -1,16 +1,12 @@
+import { SCOPE_PLANES } from "../contracts/access-profiles.js";
 import { SPACEFAST_ACCESS_POLICY_VERSION, parseStatticResource, } from "../contracts/api-keys.js";
-export const publishActions = [
-    "spaces:read",
-    "spaces:create",
-    "spaces:write",
-    "spaces:publish",
-    "versions:read",
-    "versions:promote",
-    "versions:download",
-    "builds:read",
-    "builds:trigger",
-    "builds:create",
-];
+import { oauthScopeActions, oauthScopeActionsFor } from "../contracts/oauth-scope-actions.js";
+/**
+ * What a publishing credential may do — the same set the `publish:write` OAuth
+ * scope grants, derived from the one scope⇄action table so an API-key preset
+ * and an OAuth client of the same tier can never drift apart.
+ */
+export const publishActions = oauthScopeActionsFor("publish:write");
 const spaceAdminActions = [
     ...publishActions,
     "spaces:rename",
@@ -19,22 +15,13 @@ const spaceAdminActions = [
     "spaces:export",
     "spaces:import",
     "versions:delete",
-    // Resolving the owning team (name/slug) is part of administering its spaces:
-    // the CLI resolves teams before every publish, so admin-tier presets carry
-    // read access to the team resource itself.
+    // The CLI resolves the owning team before every publish, so admin-tier
+    // presets need read access to the team resource itself.
     "teams:read",
 ];
-const domainActions = [
-    "domains:read",
-    "domains:create",
-    "domains:verify",
-    "domains:assign",
-    "domains:bind",
-    "domains:delete",
-    "domains:dns.write",
-    "domains:purchase",
-];
-function teamResource(input) {
+const domainActions = oauthScopeActionsFor("domains:write");
+/** The canonical policy resource for a team principal's subtree. */
+export function teamResource(input) {
     return `stt://tenant/${input.tenantId}/principal/team/${input.teamId}/*`;
 }
 function spaceResource(input) {
@@ -43,21 +30,29 @@ function spaceResource(input) {
 export function compileApiKeyPreset(preset, input) {
     return allowPolicy(apiKeyPresetPermissions(preset), [teamResource(input)]);
 }
-/** Expand a named API-key preset into the finite permissions sent on the public wire contract. */
+/**
+ * Expand a named API-key preset into the finite permissions sent on the public
+ * wire contract. Deduplicated, because presets compose overlapping action
+ * groups and `allowPolicy` dedupes what it compiles — the wire list and the
+ * compiled statement must name the same actions.
+ */
 export function apiKeyPresetPermissions(preset) {
+    return [...new Set(presetActions(preset))];
+}
+function presetActions(preset) {
     switch (preset) {
         case "ci_deploy":
         case "space_publisher":
-            return [...publishActions];
+            // `sf publish` resolves the owning team before it creates a Space, so a
+            // publishing key that cannot read its own team cannot publish a new one
+            // at all - the CLI's team pre-flight sees an empty list and stops before
+            // the API, which would have resolved the team from the key itself.
+            // `publishActions` stays the pure set of publish actions: claim
+            // continuation checks a team role against it.
+            return [...publishActions, "teams:read"];
         case "space_admin":
-            return [...spaceAdminActions];
-        case "site_admin":
             return [
-                "sites:read",
-                "sites:create",
-                "sites:write",
-                "sites:delete",
-                "sites:policy.write",
+                "spaces:policy.write",
                 ...spaceAdminActions,
                 ...domainActions,
                 "webhooks:read",
@@ -69,9 +64,54 @@ export function apiKeyPresetPermissions(preset) {
             return ["teams:read", "billing:read"];
         case "team_admin":
             return ["*"];
+        // The partner tier: everything a partner needs to run its own customers'
+        // spaces on our infrastructure, and nothing that mints credentials, edits
+        // team membership, or moves money.
+        case "partner_admin":
+            return [
+                "tenants:read",
+                "tenants:write",
+                "principals:read",
+                "principals:write",
+                "infrastructure:read",
+                "spaces:policy.write",
+                ...spaceAdminActions,
+                ...domainActions,
+                "webhooks:read",
+                "webhooks:write",
+                "teams:read",
+                "billing:read",
+            ];
     }
     throw new Error("Unsupported API key preset.");
 }
+// A partner credential is rooted at the tenant, not at a team principal: it
+// reaches every principal the tenant owns — teams and external customers alike —
+// and stops at the tenant boundary. `compileApiKeyPreset` stays the team-rooted
+// compiler; it needs a teamId this shape has no meaning for.
+export function compileTenantRootedPolicy(input) {
+    return allowPolicy(apiKeyPresetPermissions(input.preset), [`stt://tenant/${input.tenantId}`]);
+}
+export function compilePartnerPrincipalPolicy(input) {
+    if (input.normalizedPrincipalId.includes("*") || input.normalizedPrincipalId.includes("/")) {
+        throw new Error("Partner principal id contains a reserved policy character.");
+    }
+    return allowPolicy([
+        "spaces:read",
+        "spaces:create",
+        "spaces:write",
+        "spaces:rename",
+        "spaces:publish",
+        "versions:read",
+        "versions:promote",
+        "versions:download",
+        "builds:read",
+        "builds:trigger",
+        "builds:create",
+        "variables:read",
+        "variables:write",
+    ], [`stt://tenant/${input.tenantId}/principal/external/${input.normalizedPrincipalId}/*`]);
+}
 export function compileTeamRolePolicy(input) {
     switch (input.role) {
         case "owner":
@@ -79,7 +119,6 @@ export function compileTeamRolePolicy(input) {
             return compileApiKeyPreset("team_admin", input);
         case "member":
             return allowPolicy([
-                "sites:read",
                 "spaces:read",
                 "spaces:create",
                 "spaces:write",
@@ -99,24 +138,56 @@ export function compileTeamRolePolicy(input) {
             return denyAllPolicy();
     }
 }
-export function compileBoundedPresetPolicy(preset, input) {
-    const presetPolicy = compileApiKeyPreset(preset, input);
+/**
+ * The authority a membership-following key resolves to for one team: an action
+ * set bounded by the member's live role.
+ *
+ * Takes the action set rather than a preset name because a key's authority is
+ * not always its preset's CURRENT meaning. A key whose stored preset was
+ * redefined under it carries an explicit pin of the actions it was granted
+ * (`preset_actions_pin`), and that pin is what it keeps authorizing by.
+ */
+export function compileBoundedActionsPolicy(actions, input) {
     const rolePolicy = compileTeamRolePolicy(input);
-    const presetActions = new Set(presetPolicy.statements
-        .filter((statement) => statement.effect === "allow")
-        .flatMap((statement) => statement.actions));
+    const presetActions = new Set(actions);
     const roleActions = new Set(rolePolicy.statements
         .filter((statement) => statement.effect === "allow")
         .flatMap((statement) => statement.actions));
-    const actions = presetActions.has("*")
+    const bounded = presetActions.has("*")
         ? [...roleActions]
         : roleActions.has("*")
             ? [...presetActions]
             : [...presetActions].filter((action) => roleActions.has(action));
-    if (actions.length === 0) {
+    if (bounded.length === 0) {
         return { version: SPACEFAST_ACCESS_POLICY_VERSION, statements: [] };
     }
-    return allowPolicy(actions, [teamResource(input)]);
+    return allowPolicy(bounded, [teamResource(input)]);
+}
+/**
+ * Whether a person holding `role` in a team can currently exercise `scope`
+ * there. Account-plane scopes are admission the person always holds for
+ * themselves — no team role could bound them. Team-plane scopes need every
+ * action they grant inside the role's compiled policy.
+ *
+ * Informational, not a gate: approval no longer fails on role (authority is
+ * bounded live, per request, by `compileBoundedActionsPolicy`); the approval
+ * page uses this to tell the approver what a grant will actually do under
+ * their current role.
+ */
+export function scopeGrantableByRole(scope, role) {
+    if (SCOPE_PLANES[scope] === "account") {
+        return true;
+    }
+    const roleActions = new Set(compileTeamRolePolicy({ tenantId: "-", teamId: "-", role })
+        .statements.filter((statement) => statement.effect === "allow")
+        .flatMap((statement) => statement.actions));
+    if (roleActions.has("*")) {
+        return true;
+    }
+    return oauthScopeActions([scope]).every((action) => roleActions.has(action));
+}
+export function compileBoundedPresetPolicy(preset, input) {
+    return compileBoundedActionsPolicy(apiKeyPresetPermissions(preset), input);
 }
 export function compileSpaceContinuationPolicy(input) {
     return allowPolicy(publishActions.filter((action) => action !== "spaces:create"), [spaceResource(input)]);
@@ -141,7 +212,7 @@ export function policyIsSubsetOfGrantor(requested, grantor) {
         return statement.actions.every((action) => statement.resources.every((resource) => grantorAllows(grantor, action, resource, statement.conditions)));
     }) && grantorDeniesArePreserved(requested, grantor));
 }
-// Request-time evaluation (internal-docs/platform.md IAM-lite): explicit deny wins,
+// Request-time evaluation (the platform spec IAM-lite): explicit deny wins,
 // explicit allow permits, otherwise implicit deny. Condition keys are ANDed and an
 // unresolvable condition attribute fails closed (see `conditionsMatch`).
 export function policyAllows(input) {
@@ -152,7 +223,7 @@ export function policyAllows(input) {
     return resources.some((resource) => matchesEffect(input.policy, "allow", input.action, resource, input.conditions, "request"));
 }
 // The tenants a credential's policy grants any access to. Drives tenant
-// selection (internal-docs/platform.md Tenant): `X-Spacefast-Tenant-Id` may pick
+// selection (the platform spec Tenant): `X-Spacefast-Tenant-Id` may pick
 // one granted tenant but is never an authority by itself, and a token spanning
 // multiple tenants must fail ambiguous requests with `tenant_selection_required`.
 export function grantedTenantsFromPolicy(policy) {
@@ -189,9 +260,8 @@ export function grantedPrincipalsFromPolicy(policy, input) {
             if (!parsed || (parsed.tenantId !== input.tenantId && parsed.tenantId !== "*")) {
                 continue;
             }
-            // Tenant-rooted grants (both `stt://tenant/*` and a concrete
-            // `stt://tenant/{t}` already filtered to this tenant) are scope-wide:
-            // they reach every principal in the tenant.
+            // A tenant-rooted grant is scope-wide: `stt://tenant/*` and a concrete
+            // `stt://tenant/{t}` both reach every principal in the tenant.
             if (parsed.kind === "tenant") {
                 all = true;
             }
@@ -226,9 +296,8 @@ export function grantedPrincipalsFromPolicy(policy, input) {
         ],
     };
 }
-// Whether the policy's allow statements reach a resource subtree at all —
-// either a statement resource covers the base, or it lives inside the base.
-// This is a visibility/scoping check (404 vs 403), never an action grant.
+// Whether the policy's allow statements reach a resource subtree at all. This
+// is a visibility/scoping check (404 vs 403), never an action grant.
 export function policyReaches(policy, resourceBase) {
     return policy.statements.some((statement) => statement.effect === "allow" &&
         statement.resources.some((resource) => resourceMatches(resource, resourceBase) ||
@@ -259,10 +328,8 @@ function resourceMatches(pattern, resource) {
     if (pattern.endsWith("/*")) {
         return resource === pattern.slice(0, -2) || resource.startsWith(pattern.slice(0, -1));
     }
-    // A tenant-rooted resource is scope-wide (internal-docs/platform.md L617/L879:
-    // `stt://tenant/{t}` is a grantable StatticResource and resource grants cover
-    // their subtree): it covers every resource inside that tenant. This is the
-    // tenant-scoped (partner/agency) credential shape.
+    // A tenant-rooted resource covers every resource inside that tenant. This is
+    // the tenant-scoped (partner/agency) credential shape.
     if (parseStatticResource(pattern)?.kind === "tenant") {
         return resource.startsWith(`${pattern}/`);
     }
@@ -273,11 +340,11 @@ function conditionsMatch(statementConditions, contextConditions, effect, mode) {
         return true;
     }
     return Object.entries(statementConditions).every(([key, value]) => {
+        // SAFETY: Object.entries obtains key from the named RequestCondition object immediately above.
         const resolved = contextConditions?.[key];
         if (resolved === undefined && mode === "request") {
-            // Fail closed on unresolvable condition attributes: the condition never
-            // matches for allow statements and always matches for deny statements, so
-            // callers cannot dodge a deny by stripping request context.
+            // Fail closed: a caller cannot dodge a deny by stripping the request
+            // context its condition reads.
             return effect === "deny";
         }
         return resolved === value;

package/dist/utils/dns-instructions.js

@@ -15,15 +15,15 @@ export function addressDnsInstructionsForHostname(input) {
             normalizeDnsName(instruction.name) !== hostname) {
             return [];
         }
-        return [
-            {
-                type: instruction.type,
-                name: instruction.name,
-                value: instruction.value,
-                purpose: instruction.purpose,
-                ...(instruction.ttl === undefined ? {} : { ttl: instruction.ttl }),
-            },
-        ];
+        const result = {
+            type: instruction.type,
+            name: instruction.name,
+            value: instruction.value,
+            purpose: instruction.purpose,
+        };
+        if (instruction.ttl !== undefined)
+            result.ttl = instruction.ttl;
+        return [result];
     });
 }
 function normalizeAddress(value) {

package/dist/utils/egress-policy.fixtures.json

@@ -45,7 +45,7 @@
         { "host": "sub.localhost", "allowed": false },
         { "host": "169.254.169.254", "allowed": false },
         { "host": "view.fast", "allowed": false },
-        { "host": "wpc-manage-site-123.view.fast", "allowed": false },
+        { "host": "site-123.view.fast", "allowed": false },
         { "host": "example.com", "allowed": true }
     ]
 }

package/dist/utils/error-code.js

@@ -3,5 +3,6 @@ export function hasErrorCode(error, code) {
     return (error !== null &&
         typeof error === "object" &&
         "code" in error &&
+        // SAFETY: The preceding checks prove error is a non-null object with a code property.
         error.code === code);
 }

package/dist/utils/generate-space-name.d.ts

@@ -1,12 +1,7 @@
 /**
- * Generates a short, readable space title.
- *
- * The pool mixes a little WordPress and web flavor with broad nature, color,
- * motion, and craft vocabulary. The result should suit any site instead of
- * reading like a CMS inside joke, while staying compact enough for a hostname.
- *
- * The generator is intentionally dependency-free so it can be shared by the
- * control-plane, dashboard, CLI, and future publishing surfaces.
+ * Short, readable space titles. Keep the pools site-neutral and short enough
+ * for a hostname. Dependency-free so the control plane, dashboard and CLI can
+ * all share it.
  */
 export declare const SPACE_TITLE_COMBINATION_COUNT: number;
 export declare function generateSpaceTitle(random?: () => number): string;

package/dist/utils/generate-space-name.js

@@ -1,12 +1,7 @@
 /**
- * Generates a short, readable space title.
- *
- * The pool mixes a little WordPress and web flavor with broad nature, color,
- * motion, and craft vocabulary. The result should suit any site instead of
- * reading like a CMS inside joke, while staying compact enough for a hostname.
- *
- * The generator is intentionally dependency-free so it can be shared by the
- * control-plane, dashboard, CLI, and future publishing surfaces.
+ * Short, readable space titles. Keep the pools site-neutral and short enough
+ * for a hostname. Dependency-free so the control plane, dashboard and CLI can
+ * all share it.
  */
 const ADJECTIVES = [
     "Atomic",

package/dist/utils/grant-decision.fixtures.json

@@ -1438,8 +1438,8 @@
                 "principal": {}
             },
             "expected": {
-                "capabilities": ["page.view"],
-                "matchedGrantIds": ["grt_all_versions"]
+                "capabilities": [],
+                "matchedGrantIds": []
             },
             "phpProjectionCompiles": true
         },

package/dist/utils/grants.d.ts

@@ -44,7 +44,6 @@ export type GrantEvaluation = {
     matches: GrantMatch[];
 };
 export declare function grantResourcePatternMatches(pattern: string, resource: string, resourceKind?: "route" | "artifact"): boolean;
-/** Does a Grant's resource set reach this path? Include, minus exclude. */
 export declare function grantResourceSetMatches(resources: Grant["resources"], resource: string, resourceKind?: "route" | "artifact"): boolean;
 export type GrantEvaluationExplanation = {
     grantId: string;