@spacefast/common 0.0.26 → 0.2.1

package/dist/contracts/operations.d.ts

@@ -36,8 +36,8 @@ export declare const UserOperationSchema: z.ZodObject<{
         code: z.ZodString;
         severity: z.ZodEnum<{
             info: "info";
-            error: "error";
             warning: "warning";
+            error: "error";
         }>;
         message: z.ZodString;
         path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -68,9 +68,9 @@ export declare const UserOperationSchema: z.ZodObject<{
         integration_release: "integration_release";
     }>;
     versionSource: z.ZodOptional<z.ZodEnum<{
-        direct_upload: "direct_upload";
         git: "git";
         settings: "settings";
+        direct_upload: "direct_upload";
     }>>;
     integrationRelease: z.ZodOptional<z.ZodObject<{
         environment: z.ZodEnum<{
@@ -110,8 +110,8 @@ export declare const operationListResponseSchema: z.ZodObject<{
             code: z.ZodString;
             severity: z.ZodEnum<{
                 info: "info";
-                error: "error";
                 warning: "warning";
+                error: "error";
             }>;
             message: z.ZodString;
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -142,9 +142,9 @@ export declare const operationListResponseSchema: z.ZodObject<{
             integration_release: "integration_release";
         }>;
         versionSource: z.ZodOptional<z.ZodEnum<{
-            direct_upload: "direct_upload";
             git: "git";
             settings: "settings";
+            direct_upload: "direct_upload";
         }>>;
         integrationRelease: z.ZodOptional<z.ZodObject<{
             environment: z.ZodEnum<{
@@ -222,6 +222,29 @@ export declare const SuperadminOperationListSchema: z.ZodObject<{
     total: z.ZodNumber;
     windowHours: z.ZodNumber;
 }, z.core.$strip>;
+export declare const SuperadminOperationDetailSchema: z.ZodObject<{
+    id: z.ZodString;
+    eventType: z.ZodString;
+    status: z.ZodString;
+    resourceType: z.ZodString;
+    resourceId: z.ZodString;
+    attempts: z.ZodNumber;
+    dueAt: z.ZodNullable<z.ZodString>;
+    leaseExpiresAt: z.ZodNullable<z.ZodString>;
+    stuck: z.ZodBoolean;
+    blockedByOperationId: z.ZodNullable<z.ZodString>;
+    inflightKey: z.ZodNullable<z.ZodString>;
+    lastError: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    finishedAt: z.ZodNullable<z.ZodString>;
+    firstDueAt: z.ZodString;
+    payload: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    progress: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    receipt: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    cursor: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type SuperadminOperationDetail = z.infer<typeof SuperadminOperationDetailSchema>;
 export declare const SuperadminOperationSummarySchema: z.ZodObject<{
     windowHours: z.ZodNumber;
     live: z.ZodObject<{

package/dist/contracts/operations.js

@@ -38,7 +38,7 @@ export const operationListQuerySchema = cursorListQuerySchema.extend({
         .string()
         .min(1)
         .optional()
-        .describe("Filter to operations for one Space — its own operations plus those of its versions and builds. The Space must be readable by the caller."),
+        .describe("Filter to operations for one Space: its own operations plus those of its versions and builds. The Space must be readable by the caller."),
 });
 export const operationListResponseSchema = z.object({
     data: z.array(UserOperationSchema),
@@ -46,8 +46,7 @@ export const operationListResponseSchema = z.object({
 });
 // ---------------------------------------------------------------------------
 // Superadmin operator surface: the operations rows ARE the queue, bucketed by
-// claim eligibility. Served by the control plane's feed service and consumed
-// by the superadmin dashboard and the e2e harness.
+// claim eligibility.
 /** Buckets an operator triages by. Live buckets partition the live population:
  *  a queued row is exactly one of ready / scheduled / blocked. */
 export const SUPERADMIN_OPERATION_FILTERS = [
@@ -75,8 +74,8 @@ export const SuperadminOperationRowSchema = z.object({
     resourceType: z.string(),
     resourceId: z.string(),
     attempts: z.number().int().nonnegative(),
-    // The mutable eligibility clock, meaningless once the row is terminal — null
-    // there rather than a stale instant an operator would read as a schedule.
+    // The mutable eligibility clock. Null once the row is terminal, rather than a
+    // stale instant an operator would read as a schedule.
     dueAt: z.string().datetime().nullable(),
     leaseExpiresAt: z.string().datetime().nullable(),
     // Computed with the database clock so row labels agree with server-side
@@ -94,6 +93,13 @@ export const SuperadminOperationListSchema = z.object({
     total: z.number().int().nonnegative(),
     windowHours: z.number().int().positive(),
 });
+export const SuperadminOperationDetailSchema = SuperadminOperationRowSchema.extend({
+    firstDueAt: z.string().datetime(),
+    payload: z.record(z.string(), z.unknown()).nullable(),
+    progress: z.record(z.string(), z.unknown()).nullable(),
+    receipt: z.record(z.string(), z.unknown()).nullable(),
+    cursor: z.record(z.string(), z.unknown()).nullable(),
+});
 export const SuperadminOperationSummarySchema = z.object({
     windowHours: z.number().int().positive(),
     live: z.object({

package/dist/contracts/pages.d.ts

@@ -3,8 +3,8 @@ export declare const SITE_PAGE_IDS: readonly ["404", "denied", "access", "index"
 export declare const sitePageIdSchema: z.ZodEnum<{
     access: "access";
     denied: "denied";
-    preview: "preview";
     index: "index";
+    preview: "preview";
     404: "404";
 }>;
 export type SitePageId = z.infer<typeof sitePageIdSchema>;
@@ -15,22 +15,29 @@ export declare const routePageIdSchema: z.ZodEnum<{
     404: "404";
 }>;
 export type RoutePageId = z.infer<typeof routePageIdSchema>;
-export declare const CUSTOM_PAGE_IDS: readonly ["404", "denied", "access", "index", "preview", "collab"];
+export declare const CUSTOM_PAGE_IDS: readonly ["404", "denied", "access", "index", "preview", "collab", "login", "undeployed", "suspended", "gone", "runtime-error", "rate-limited"];
 export declare const customPageIdSchema: z.ZodEnum<{
     collab: "collab";
+    login: "login";
     access: "access";
+    suspended: "suspended";
     denied: "denied";
-    preview: "preview";
     index: "index";
+    preview: "preview";
     404: "404";
+    undeployed: "undeployed";
+    gone: "gone";
+    "runtime-error": "runtime-error";
+    "rate-limited": "rate-limited";
 }>;
 export type CustomPageId = z.infer<typeof customPageIdSchema>;
 export declare const COLLAB_PAGE_SOURCE = "_pages/collab.html";
 export declare const COLLAB_PAGE_PATH: "/_pages/collab.html";
 export declare const COLLAB_PAGE_ELEMENTS: readonly ["sf-space", "sf-comments", "sf-thread", "sf-timeline", "sf-presence", "sf-versions"];
-export declare const PLATFORM_PAGE_IDS: readonly ["undeployed", "suspended", "legal", "gone", "runtime-error", "rate-limited", "tier-unavailable", "proxy-error", "method-not-allowed", "content-too-large"];
+export declare const PLATFORM_PAGE_IDS: readonly ["login", "undeployed", "suspended", "legal", "gone", "runtime-error", "rate-limited", "tier-unavailable", "proxy-error", "method-not-allowed", "content-too-large"];
 export declare const platformPageIdSchema: z.ZodEnum<{
     legal: "legal";
+    login: "login";
     suspended: "suspended";
     undeployed: "undeployed";
     gone: "gone";
@@ -51,7 +58,10 @@ export type PageDefinition = {
     noindex: boolean;
     customTemplate: boolean;
 };
-export declare const PAGE_CATALOG: Readonly<Record<SitePageId, PageDefinition>>;
+type PageCatalog = {
+    [PageId in SitePageId]: PageDefinition;
+};
+export declare const PAGE_CATALOG: PageCatalog;
 export declare const PAGE_SOURCE_MAX_BYTES: number;
 export declare const PAGES_DIRECTORY = "_pages";
 export declare const PAGE_LAYOUT_FILE = "_layout.html";
@@ -66,6 +76,20 @@ export declare const runtimePagesSchema: z.ZodObject<{
         index: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     previews: z.ZodRecord<z.ZodString, z.ZodString>;
+    platform: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+        legal: "legal";
+        login: "login";
+        suspended: "suspended";
+        undeployed: "undeployed";
+        gone: "gone";
+        "runtime-error": "runtime-error";
+        "rate-limited": "rate-limited";
+        "tier-unavailable": "tier-unavailable";
+        "proxy-error": "proxy-error";
+        "method-not-allowed": "method-not-allowed";
+        "content-too-large": "content-too-large";
+    }>, z.ZodString>>;
     collab: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type RuntimePages = z.infer<typeof runtimePagesSchema>;
+export {};

package/dist/contracts/pages.js

@@ -6,11 +6,24 @@ export const routePageIdSchema = z.enum(ROUTE_PAGE_IDS);
 // `collab` is publishable but has no built-in template: with no layout of their
 // own a Space's reviewers get the platform frame at `/__/collab`, so there is
 // nothing for a default `_pages/collab.html` to be. Hence CUSTOM ⊃ SITE.
-export const CUSTOM_PAGE_IDS = ["404", "denied", "access", "index", "preview", "collab"];
+export const CUSTOM_PAGE_IDS = [
+    "404",
+    "denied",
+    "access",
+    "index",
+    "preview",
+    "collab",
+    "login",
+    "undeployed",
+    "suspended",
+    "gone",
+    "runtime-error",
+    "rate-limited",
+];
 export const customPageIdSchema = z.enum(CUSTOM_PAGE_IDS);
 // The Space-level review room the collaboration orb expands into, and the URL
 // its compiled document answers at (collab-public-api.html §3). One room per
-// Space, so one page, at the root — never a per-directory override.
+// Space: one page, at the root, never a per-directory override.
 // The PHP mirror is SPACEFAST_COLLAB_PAGE_PATH in runtime/engine/shared/context.php.
 export const COLLAB_PAGE_SOURCE = "_pages/collab.html";
 export const COLLAB_PAGE_PATH = `/${COLLAB_PAGE_SOURCE}`;
@@ -26,6 +39,7 @@ export const COLLAB_PAGE_ELEMENTS = [
     "sf-versions",
 ];
 export const PLATFORM_PAGE_IDS = [
+    "login",
     "undeployed",
     "suspended",
     "legal",
@@ -68,9 +82,9 @@ export const PAGE_CATALOG = {
         customTemplate: false,
     },
     // The visitor access page: the deny surface WITH lanes (sign in, SSO,
-    // password, request an invite). Rendered by the runtime at the requested URL;
-    // publishers may fully retheme it — the runtime injects the functional lane
-    // blocks into the sf-access-* slots so forms and states stay correct.
+    // password, request an invite), rendered at the requested URL. Publishers may
+    // fully retheme it; the runtime injects the lane blocks into the sf-access-*
+    // slots so forms and states stay correct.
     access: {
         id: "access",
         status: 403,
@@ -107,6 +121,9 @@ export const runtimePagesSchema = z.object({
         index: pageArtifactKeySchema.optional(),
     })),
     previews: z.record(z.string().startsWith("/").max(2048), pageArtifactKeySchema),
+    // Partner platform pages are compiled with tenant/team presentation at
+    // finalize. First-party versions omit this map and keep the PHP fallback.
+    platform: z.record(platformPageIdSchema, pageArtifactKeySchema).optional(),
     // Present only when the Space published its own review room; its absence is
     // what tells the SDK to expand into the platform frame instead.
     collab: pageArtifactKeySchema.optional(),

package/dist/contracts/partner-notifications.d.ts

@@ -0,0 +1,3 @@
+export declare const PRINCIPAL_NOTIFICATION_EVENT_CODES: readonly ["principal.notification.claim", "principal.notification.space_expiry", "principal.notification.access_invitation", "principal.notification.access_request", "principal.notification.access_verification", "principal.notification.publish_receipt", "principal.notification.comment"];
+export type PrincipalNotificationEventCode = (typeof PRINCIPAL_NOTIFICATION_EVENT_CODES)[number];
+export declare const PRINCIPAL_NOTIFICATION_EVENT_PREFIX = "principal.notification.";

package/dist/contracts/partner-notifications.js

@@ -0,0 +1,65 @@
+// The `principal.notification.*` catalog (partner API spec §7 "Events").
+//
+// For a partner tenant, Spacefast does NOT send email to the tenant's own end
+// customers (principals): a partner white-labels that surface. Instead, each
+// customer-facing notification that Spacefast would otherwise email is delivered
+// to the partner as a webhook event on the tenant subscription, and the partner
+// sends its own branded message. No active subscription → no send and no
+// Spacefast-sender fallback (§7 L343-345). `ten_main` consumer email is
+// untouched.
+//
+// This module is the subscribe-side catalog: the codes a partner subscribes to
+// and the guards over them. `activity.ts` folds this list into
+// `ACTIVITY_EVENT_CODES` so these are first-class taxonomy codes — every one
+// carries a dashboard activity-grammar row and is a valid webhook `events`
+// filter. The test pins that fold as a subset relationship.
+//
+// Enumeration is from a complete audit of the partner-reachable email send
+// sites, keeping only notifications whose recipient is a partner tenant's own
+// customer. Dropped: Spacefast dashboard-ACCOUNT auth / security notices
+// (password reset, account email verification, provider changes) — a partner
+// customer's dashboard account authenticates through the partner's own issuer via
+// partner tokens, so Spacefast never sends those; and team-member /
+// dashboard-collaborator email, which is not a partner end-customer notification.
+// NOTE: a private space's own visitor email-verification challenges (open-page
+// verify, access-request verify) are a different thing — they reach the partner's
+// end customer and ARE delegated, via `access_verification` below.
+export const PRINCIPAL_NOTIFICATION_EVENT_CODES = [
+    // A claimable space's claim link is available to hand to the customer who
+    // created it (partner API spec §13 Q3 — the one certain event). Spacefast
+    // surfaces the claim link in its own CLI/API response for `ten_main`; for a
+    // partner tenant the link reaches the customer only through the partner, so
+    // this event carries it.
+    "principal.notification.claim",
+    // A claimable space is expiring soon and can still be kept by claiming it.
+    // The Spacefast-sent expiry reminder for a partner-owned claimable space
+    // (operations/jobs/space-lifecycle.ts) becomes this event instead.
+    "principal.notification.space_expiry",
+    // A person was invited to access a space. The Spacefast-sent space access
+    // invitation for a partner space (access/email.ts) becomes this event.
+    "principal.notification.access_invitation",
+    // Someone requested access to a private space and the owner must review it,
+    // or a pending request was decided (approved/denied). The Spacefast-sent
+    // access-request review + decision mail for a partner space (access/email.ts,
+    // access/transition.ts) becomes this event.
+    "principal.notification.access_request",
+    // A visitor to a partner's private space must verify their email address —
+    // either to open a page behind a verified-email gate, or to submit an access
+    // request. Spacefast would otherwise send the visitor an essential-auth
+    // "verify your email" link (access/email.ts, access/verified-email-proof.ts);
+    // for a partner space that recipient is the partner's own end customer, so the
+    // verify URL is delegated as this event for the partner to deliver instead.
+    "principal.notification.access_verification",
+    // A publish/build lifecycle receipt for a partner space, where applicable
+    // (§7 "publish receipt where applicable"). Partner spaces early-exit the
+    // team-scoped receipt paths today; this is the code those paths emit on.
+    "principal.notification.publish_receipt",
+    // Comment activity on a partner space (a new thread, reply, or mention). The
+    // Spacefast-sent collaboration email for a partner space (cast-worker.ts)
+    // becomes this event; the partner notifies its own customer.
+    "principal.notification.comment",
+];
+// The prefix every principal-notification code shares. `subscriptions` filters
+// select on it as a wildcard (`principal.notification.*`), so a partner can
+// subscribe to the whole class in one filter.
+export const PRINCIPAL_NOTIFICATION_EVENT_PREFIX = "principal.notification.";

package/dist/contracts/{platform.d.ts → partner.d.ts}

@@ -31,22 +31,19 @@ export declare const accessLogEntrySchema: z.ZodObject<{
 /**
  * One line a space's own code wrote, whichever tier wrote it.
  *
- * There is exactly one place these come from: the hosting provider's PHP error
- * log for the space's site. A Zero mutation, a PHP function, and a Functions
- * worker on Cloudflare all end up writing to that file on the origin — the
- * worker by tailing its output back to the origin that dispatched it — because
- * it is the only stream the provider ships off the box and serves back. The
- * runtime writes each record as one JSON line behind a marker; this is what the
- * reader gets after pulling that line back out of the provider's message.
+ * These come from one place: the hosting provider's PHP error log for the
+ * space's site, the only stream the provider ships off the box and serves back.
+ * A Zero mutation, a PHP function, and a Functions worker on Cloudflare all end
+ * up writing there, the worker by tailing its output back to the origin that
+ * dispatched it. The runtime writes each record as one JSON line behind a
+ * marker, and the reader gets that line back out of the provider's message.
  *
- * `id` is minted by the runtime at write time rather than derived on read: the
- * provider's log has no identity of its own, and a caller paging a window needs
- * a stable key for a line it may see again at a page boundary.
+ * `id` is minted by the runtime at write time: the provider's log has no
+ * identity of its own, and a caller paging a window needs a stable key for a
+ * line it may see again at a page boundary.
  *
- * Unlike its access-log sibling there is no `ts` alongside `timestamp`. That
- * duplication is a compatibility alias the access log carries for callers that
- * predate the rename; runtime logs have never been served to anyone, so there
- * is no caller to keep and no reason to inherit the wart.
+ * No `ts` alias beside `timestamp`. That is an access-log compatibility wart,
+ * and runtime logs have never been served to anyone.
  */
 export declare const runtimeLogEntrySchema: z.ZodObject<{
     id: z.ZodString;
@@ -54,8 +51,8 @@ export declare const runtimeLogEntrySchema: z.ZodObject<{
     level: z.ZodEnum<{
         info: "info";
         error: "error";
-        debug: "debug";
         warn: "warn";
+        debug: "debug";
     }>;
     requestId: z.ZodNullable<z.ZodString>;
     versionId: z.ZodNullable<z.ZodString>;
@@ -65,12 +62,11 @@ export declare const runtimeLogEntrySchema: z.ZodObject<{
 }, z.core.$strict>;
 export type RuntimeLogEntry = z.infer<typeof runtimeLogEntrySchema>;
 /**
- * Windowed like its access-log sibling, because it reads the same provider
- * index — `atomic_site_id` plus a `@timestamp` range — and that index has no
- * other way in. The two log kinds sit side by side under one command, so they
- * take one query shape; `requestId` and `handlerName` are the extra narrowings
- * only handler output can answer, and they are applied over the pages the
- * server fetched rather than by the provider, which indexes neither.
+ * Windowed like its access-log sibling, because it reads the same provider index
+ * (`atomic_site_id` plus a `@timestamp` range) and that index has no other way
+ * in. `requestId` and `handlerName` are the extra narrowings only handler output
+ * can answer, applied over the pages the server fetched because the provider
+ * indexes neither.
  */
 export declare const runtimeLogListQuerySchema: z.ZodObject<{
     limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -100,8 +96,8 @@ export declare const accessLogListResponseSchema: z.ZodObject<{
         code: z.ZodString;
         severity: z.ZodEnum<{
             info: "info";
-            error: "error";
             warning: "warning";
+            error: "error";
         }>;
         message: z.ZodString;
         path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -119,26 +115,17 @@ export declare const accessLogListResponseSchema: z.ZodObject<{
 /**
  * Paged handler logs.
  *
- * One thing about that cursor is worth stating rather than discovering: **an
- * empty page does not mean the end.** The cursor walks the provider's scroll
+ * An empty page does not mean the end. The cursor walks the provider's scroll
  * over every PHP-error-log line in the window, and only some of those lines are
- * handler output — a page can come back empty because the stretch it scanned
- * held none, or held none matching `requestId`/`handlerName`. The rule is
- * **`hasMore: false` means you have seen everything; `hasMore: true` means keep
- * paging, whatever `data` held.** A client that stops on the first empty page
- * will silently truncate its own search.
- *
- * `warnings` carries the same `log_retention_clamped` diagnostic the access log
- * does, for the same reason: one window, one retention, one way of saying it
- * was cut back.
+ * handler output, so a page can come back empty. `hasMore: false` means you have
+ * seen everything; `hasMore: true` means keep paging, whatever `data` held. A
+ * client that stops on the first empty page truncates its own search.
  *
- * **These lines lag.** A record is written to a file on the origin, shipped off
- * the box, and indexed before it can be read back, so a line a request just
- * wrote will not be in the next page. Nothing here is live, and the delay is
- * the provider's ingest lag rather than anything this surface schedules — it
- * has not been measured against a real client yet, so no surface should quote
- * a figure for it until the gate probe in
- * `e2e-tests/direct/wpcloud-behavior.test.ts` has actually run.
+ * These lines lag. A record is written to a file on the origin, shipped off the
+ * box, and indexed before it can be read back, so a line a request just wrote
+ * will not be in the next page. The delay is the provider's ingest lag and has
+ * not been measured, so no surface should quote a figure for it until the gate
+ * probe in `e2e-tests/direct/wpcloud-behavior.test.ts` has run.
  */
 export declare const runtimeLogListResponseSchema: z.ZodObject<{
     data: z.ZodArray<z.ZodObject<{
@@ -147,8 +134,8 @@ export declare const runtimeLogListResponseSchema: z.ZodObject<{
         level: z.ZodEnum<{
             info: "info";
             error: "error";
-            debug: "debug";
             warn: "warn";
+            debug: "debug";
         }>;
         requestId: z.ZodNullable<z.ZodString>;
         versionId: z.ZodNullable<z.ZodString>;
@@ -164,8 +151,8 @@ export declare const runtimeLogListResponseSchema: z.ZodObject<{
         code: z.ZodString;
         severity: z.ZodEnum<{
             info: "info";
-            error: "error";
             warning: "warning";
+            error: "error";
         }>;
         message: z.ZodString;
         path: z.ZodOptional<z.ZodNullable<z.ZodString>>;

package/dist/contracts/{platform.js → partner.js}

@@ -30,22 +30,19 @@ export const accessLogEntrySchema = z.object({
 /**
  * One line a space's own code wrote, whichever tier wrote it.
  *
- * There is exactly one place these come from: the hosting provider's PHP error
- * log for the space's site. A Zero mutation, a PHP function, and a Functions
- * worker on Cloudflare all end up writing to that file on the origin — the
- * worker by tailing its output back to the origin that dispatched it — because
- * it is the only stream the provider ships off the box and serves back. The
- * runtime writes each record as one JSON line behind a marker; this is what the
- * reader gets after pulling that line back out of the provider's message.
+ * These come from one place: the hosting provider's PHP error log for the
+ * space's site, the only stream the provider ships off the box and serves back.
+ * A Zero mutation, a PHP function, and a Functions worker on Cloudflare all end
+ * up writing there, the worker by tailing its output back to the origin that
+ * dispatched it. The runtime writes each record as one JSON line behind a
+ * marker, and the reader gets that line back out of the provider's message.
  *
- * `id` is minted by the runtime at write time rather than derived on read: the
- * provider's log has no identity of its own, and a caller paging a window needs
- * a stable key for a line it may see again at a page boundary.
+ * `id` is minted by the runtime at write time: the provider's log has no
+ * identity of its own, and a caller paging a window needs a stable key for a
+ * line it may see again at a page boundary.
  *
- * Unlike its access-log sibling there is no `ts` alongside `timestamp`. That
- * duplication is a compatibility alias the access log carries for callers that
- * predate the rename; runtime logs have never been served to anyone, so there
- * is no caller to keep and no reason to inherit the wart.
+ * No `ts` alias beside `timestamp`. That is an access-log compatibility wart,
+ * and runtime logs have never been served to anyone.
  */
 export const runtimeLogEntrySchema = z
     .object({
@@ -61,12 +58,11 @@ export const runtimeLogEntrySchema = z
 })
     .strict();
 /**
- * Windowed like its access-log sibling, because it reads the same provider
- * index — `atomic_site_id` plus a `@timestamp` range — and that index has no
- * other way in. The two log kinds sit side by side under one command, so they
- * take one query shape; `requestId` and `handlerName` are the extra narrowings
- * only handler output can answer, and they are applied over the pages the
- * server fetched rather than by the provider, which indexes neither.
+ * Windowed like its access-log sibling, because it reads the same provider index
+ * (`atomic_site_id` plus a `@timestamp` range) and that index has no other way
+ * in. `requestId` and `handlerName` are the extra narrowings only handler output
+ * can answer, applied over the pages the server fetched because the provider
+ * indexes neither.
  */
 export const runtimeLogListQuerySchema = logWindowQuerySchema.extend({
     requestId: z
@@ -78,7 +74,7 @@ export const runtimeLogListQuerySchema = logWindowQuerySchema.extend({
         .string()
         .min(1)
         .optional()
-        .describe("Return only lines from this handler — a Zero mutation or a Functions handler."),
+        .describe("Return only lines from this handler, either a Zero mutation or a Functions handler."),
 });
 export const accessLogListResponseSchema = z.object({
     data: z.array(accessLogEntrySchema),
@@ -91,26 +87,17 @@ export const accessLogListResponseSchema = z.object({
 /**
  * Paged handler logs.
  *
- * One thing about that cursor is worth stating rather than discovering: **an
- * empty page does not mean the end.** The cursor walks the provider's scroll
+ * An empty page does not mean the end. The cursor walks the provider's scroll
  * over every PHP-error-log line in the window, and only some of those lines are
- * handler output — a page can come back empty because the stretch it scanned
- * held none, or held none matching `requestId`/`handlerName`. The rule is
- * **`hasMore: false` means you have seen everything; `hasMore: true` means keep
- * paging, whatever `data` held.** A client that stops on the first empty page
- * will silently truncate its own search.
+ * handler output, so a page can come back empty. `hasMore: false` means you have
+ * seen everything; `hasMore: true` means keep paging, whatever `data` held. A
+ * client that stops on the first empty page truncates its own search.
  *
- * `warnings` carries the same `log_retention_clamped` diagnostic the access log
- * does, for the same reason: one window, one retention, one way of saying it
- * was cut back.
- *
- * **These lines lag.** A record is written to a file on the origin, shipped off
- * the box, and indexed before it can be read back, so a line a request just
- * wrote will not be in the next page. Nothing here is live, and the delay is
- * the provider's ingest lag rather than anything this surface schedules — it
- * has not been measured against a real client yet, so no surface should quote
- * a figure for it until the gate probe in
- * `e2e-tests/direct/wpcloud-behavior.test.ts` has actually run.
+ * These lines lag. A record is written to a file on the origin, shipped off the
+ * box, and indexed before it can be read back, so a line a request just wrote
+ * will not be in the next page. The delay is the provider's ingest lag and has
+ * not been measured, so no surface should quote a figure for it until the gate
+ * probe in `e2e-tests/direct/wpcloud-behavior.test.ts` has run.
  */
 export const runtimeLogListResponseSchema = z.object({
     data: z.array(runtimeLogEntrySchema),
@@ -127,7 +114,7 @@ export const analyticsQuerySchema = z.object({
         .describe('Analytics summary window. Defaults to "7d".'),
 });
 // Served by `GET /v1/spaces/{spaceId}/analytics`: traffic summary over the
-// requested window, read live from the hosting provider's edge metrics — no
+// requested window, read live from the hosting provider's edge metrics. No
 // local store exists. Counts cover every hostname mapped to the space's site;
 // a provider outage means this endpoint errors rather than answers stale.
 export const analyticsResponseSchema = z.object({

package/dist/contracts/plan-policy.d.ts

@@ -54,8 +54,8 @@ export declare const PlanPolicyResponseSchema: z.ZodObject<{
     warnings: z.ZodOptional<z.ZodArray<z.ZodObject<{
         severity: z.ZodEnum<{
             info: "info";
-            error: "error";
             warning: "warning";
+            error: "error";
         }>;
         code: z.ZodString;
         message: z.ZodString;

package/dist/contracts/principal-assertion.d.ts

@@ -0,0 +1,43 @@
+import { z } from "zod";
+export declare const exactOriginSchema: z.core.$ZodBranded<z.ZodString, "ExactOrigin", "out">;
+export type ExactOrigin = z.infer<typeof exactOriginSchema>;
+export declare const principalAssertionV1Schema: z.ZodUnion<readonly [z.ZodObject<{
+    actor: z.ZodObject<{
+        kind: z.ZodLiteral<"user">;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    subject: z.ZodOptional<z.ZodObject<{
+        issuer: z.ZodString;
+        subject: z.ZodString;
+    }, z.core.$strict>>;
+    format: z.ZodLiteral<"spacefast.principal">;
+    version: z.ZodLiteral<1>;
+    audience: z.ZodObject<{
+        spaceId: z.ZodTemplateLiteral<`spc_${string}`>;
+        runtimeInstanceId: z.ZodString;
+        host: z.core.$ZodBranded<z.ZodString, "ExactOrigin", "out">;
+    }, z.core.$strict>;
+    sessionVersion: z.ZodNumber;
+    accessGeneration: z.ZodNumber;
+    nonce: z.ZodString;
+    issuedAt: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    actor: z.ZodObject<{
+        kind: z.ZodLiteral<"service">;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    format: z.ZodLiteral<"spacefast.principal">;
+    version: z.ZodLiteral<1>;
+    audience: z.ZodObject<{
+        spaceId: z.ZodTemplateLiteral<`spc_${string}`>;
+        runtimeInstanceId: z.ZodString;
+        host: z.core.$ZodBranded<z.ZodString, "ExactOrigin", "out">;
+    }, z.core.$strict>;
+    sessionVersion: z.ZodNumber;
+    accessGeneration: z.ZodNumber;
+    nonce: z.ZodString;
+    issuedAt: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+}, z.core.$strict>]>;
+export type PrincipalAssertionV1 = z.infer<typeof principalAssertionV1Schema>;