@spacefast/common 0.0.26 → 0.2.1

package/dist/contracts/api-keys.d.ts

@@ -9,18 +9,13 @@ export declare const StatticActionSchema: z.ZodEnum<{
     "domains:read": "domains:read";
     "spaces:publish": "spaces:publish";
     "builds:trigger": "builds:trigger";
-    "mcp:tools": "mcp:tools";
     "*": "*";
-    "sites:read": "sites:read";
-    "sites:create": "sites:create";
-    "sites:write": "sites:write";
-    "sites:delete": "sites:delete";
-    "sites:policy.write": "sites:policy.write";
     "spaces:create": "spaces:create";
     "spaces:delete": "spaces:delete";
     "spaces:transfer": "spaces:transfer";
     "spaces:export": "spaces:export";
     "spaces:import": "spaces:import";
+    "spaces:policy.write": "spaces:policy.write";
     "versions:read": "versions:read";
     "versions:promote": "versions:promote";
     "versions:delete": "versions:delete";
@@ -37,6 +32,13 @@ export declare const StatticActionSchema: z.ZodEnum<{
     "webhooks:write": "webhooks:write";
     "builds:read": "builds:read";
     "builds:create": "builds:create";
+    "variables:read": "variables:read";
+    "variables:write": "variables:write";
+    "tenants:read": "tenants:read";
+    "tenants:write": "tenants:write";
+    "principals:read": "principals:read";
+    "principals:write": "principals:write";
+    "infrastructure:read": "infrastructure:read";
     "teams:write": "teams:write";
     "teams:members.write": "teams:members.write";
     "billing:read": "billing:read";
@@ -47,6 +49,7 @@ export declare const StatticActionSchema: z.ZodEnum<{
     "runtime:manage": "runtime:manage";
 }>;
 export type StatticAction = z.infer<typeof StatticActionSchema>;
+export declare const PARTNER_MANAGEMENT_ACTIONS: readonly ["tenants:read", "tenants:write", "principals:read", "infrastructure:read"];
 export type ParsedStatticResource = {
     kind: "tenant";
     tenantId: string;
@@ -93,18 +96,13 @@ export declare const ApiCredentialPolicySchema: z.ZodObject<{
             "domains:read": "domains:read";
             "spaces:publish": "spaces:publish";
             "builds:trigger": "builds:trigger";
-            "mcp:tools": "mcp:tools";
             "*": "*";
-            "sites:read": "sites:read";
-            "sites:create": "sites:create";
-            "sites:write": "sites:write";
-            "sites:delete": "sites:delete";
-            "sites:policy.write": "sites:policy.write";
             "spaces:create": "spaces:create";
             "spaces:delete": "spaces:delete";
             "spaces:transfer": "spaces:transfer";
             "spaces:export": "spaces:export";
             "spaces:import": "spaces:import";
+            "spaces:policy.write": "spaces:policy.write";
             "versions:read": "versions:read";
             "versions:promote": "versions:promote";
             "versions:delete": "versions:delete";
@@ -121,6 +119,13 @@ export declare const ApiCredentialPolicySchema: z.ZodObject<{
             "webhooks:write": "webhooks:write";
             "builds:read": "builds:read";
             "builds:create": "builds:create";
+            "variables:read": "variables:read";
+            "variables:write": "variables:write";
+            "tenants:read": "tenants:read";
+            "tenants:write": "tenants:write";
+            "principals:read": "principals:read";
+            "principals:write": "principals:write";
+            "infrastructure:read": "infrastructure:read";
             "teams:write": "teams:write";
             "teams:members.write": "teams:members.write";
             "billing:read": "billing:read";
@@ -146,16 +151,20 @@ export declare const ApiKeyPresetSchema: z.ZodEnum<{
     ci_deploy: "ci_deploy";
     space_publisher: "space_publisher";
     space_admin: "space_admin";
-    site_admin: "site_admin";
     domain_manager: "domain_manager";
     team_admin: "team_admin";
     billing_viewer: "billing_viewer";
+    partner_admin: "partner_admin";
 }>;
 export type ApiKeyPreset = z.infer<typeof ApiKeyPresetSchema>;
 export declare const ApiKeySchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodNullable<z.ZodString>;
     tenantId: z.ZodNullable<z.ZodString>;
+    mode: z.ZodEnum<{
+        live: "live";
+        test: "test";
+    }>;
     subject: z.ZodNullable<z.ZodObject<{
         type: z.ZodEnum<{
             team: "team";
@@ -177,10 +186,10 @@ export declare const ApiKeySchema: z.ZodObject<{
         ci_deploy: "ci_deploy";
         space_publisher: "space_publisher";
         space_admin: "space_admin";
-        site_admin: "site_admin";
         domain_manager: "domain_manager";
         team_admin: "team_admin";
         billing_viewer: "billing_viewer";
+        partner_admin: "partner_admin";
     }>>;
     teamScope: z.ZodNullable<z.ZodType<import("./device-team-scope.js").DeviceTeamScope, unknown, z.core.$ZodTypeInternals<import("./device-team-scope.js").DeviceTeamScope, unknown>>>;
     policy: z.ZodNullable<z.ZodObject<{
@@ -199,18 +208,13 @@ export declare const ApiKeySchema: z.ZodObject<{
                 "domains:read": "domains:read";
                 "spaces:publish": "spaces:publish";
                 "builds:trigger": "builds:trigger";
-                "mcp:tools": "mcp:tools";
                 "*": "*";
-                "sites:read": "sites:read";
-                "sites:create": "sites:create";
-                "sites:write": "sites:write";
-                "sites:delete": "sites:delete";
-                "sites:policy.write": "sites:policy.write";
                 "spaces:create": "spaces:create";
                 "spaces:delete": "spaces:delete";
                 "spaces:transfer": "spaces:transfer";
                 "spaces:export": "spaces:export";
                 "spaces:import": "spaces:import";
+                "spaces:policy.write": "spaces:policy.write";
                 "versions:read": "versions:read";
                 "versions:promote": "versions:promote";
                 "versions:delete": "versions:delete";
@@ -227,6 +231,13 @@ export declare const ApiKeySchema: z.ZodObject<{
                 "webhooks:write": "webhooks:write";
                 "builds:read": "builds:read";
                 "builds:create": "builds:create";
+                "variables:read": "variables:read";
+                "variables:write": "variables:write";
+                "tenants:read": "tenants:read";
+                "tenants:write": "tenants:write";
+                "principals:read": "principals:read";
+                "principals:write": "principals:write";
+                "infrastructure:read": "infrastructure:read";
                 "teams:write": "teams:write";
                 "teams:members.write": "teams:members.write";
                 "billing:read": "billing:read";
@@ -270,6 +281,10 @@ export declare const ApiKeyListResponseSchema: z.ZodObject<{
         id: z.ZodString;
         name: z.ZodNullable<z.ZodString>;
         tenantId: z.ZodNullable<z.ZodString>;
+        mode: z.ZodEnum<{
+            live: "live";
+            test: "test";
+        }>;
         subject: z.ZodNullable<z.ZodObject<{
             type: z.ZodEnum<{
                 team: "team";
@@ -291,10 +306,10 @@ export declare const ApiKeyListResponseSchema: z.ZodObject<{
             ci_deploy: "ci_deploy";
             space_publisher: "space_publisher";
             space_admin: "space_admin";
-            site_admin: "site_admin";
             domain_manager: "domain_manager";
             team_admin: "team_admin";
             billing_viewer: "billing_viewer";
+            partner_admin: "partner_admin";
         }>>;
         teamScope: z.ZodNullable<z.ZodType<import("./device-team-scope.js").DeviceTeamScope, unknown, z.core.$ZodTypeInternals<import("./device-team-scope.js").DeviceTeamScope, unknown>>>;
         policy: z.ZodNullable<z.ZodObject<{
@@ -313,18 +328,13 @@ export declare const ApiKeyListResponseSchema: z.ZodObject<{
                     "domains:read": "domains:read";
                     "spaces:publish": "spaces:publish";
                     "builds:trigger": "builds:trigger";
-                    "mcp:tools": "mcp:tools";
                     "*": "*";
-                    "sites:read": "sites:read";
-                    "sites:create": "sites:create";
-                    "sites:write": "sites:write";
-                    "sites:delete": "sites:delete";
-                    "sites:policy.write": "sites:policy.write";
                     "spaces:create": "spaces:create";
                     "spaces:delete": "spaces:delete";
                     "spaces:transfer": "spaces:transfer";
                     "spaces:export": "spaces:export";
                     "spaces:import": "spaces:import";
+                    "spaces:policy.write": "spaces:policy.write";
                     "versions:read": "versions:read";
                     "versions:promote": "versions:promote";
                     "versions:delete": "versions:delete";
@@ -341,6 +351,13 @@ export declare const ApiKeyListResponseSchema: z.ZodObject<{
                     "webhooks:write": "webhooks:write";
                     "builds:read": "builds:read";
                     "builds:create": "builds:create";
+                    "variables:read": "variables:read";
+                    "variables:write": "variables:write";
+                    "tenants:read": "tenants:read";
+                    "tenants:write": "tenants:write";
+                    "principals:read": "principals:read";
+                    "principals:write": "principals:write";
+                    "infrastructure:read": "infrastructure:read";
                     "teams:write": "teams:write";
                     "teams:members.write": "teams:members.write";
                     "billing:read": "billing:read";
@@ -386,10 +403,10 @@ export declare const ApiKeyCreateRequestSchema: z.ZodObject<{
         ci_deploy: "ci_deploy";
         space_publisher: "space_publisher";
         space_admin: "space_admin";
-        site_admin: "site_admin";
         domain_manager: "domain_manager";
         team_admin: "team_admin";
         billing_viewer: "billing_viewer";
+        partner_admin: "partner_admin";
     }>>;
     policy: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         version: z.ZodLiteral<"2026-06-09">;
@@ -407,18 +424,13 @@ export declare const ApiKeyCreateRequestSchema: z.ZodObject<{
                 "domains:read": "domains:read";
                 "spaces:publish": "spaces:publish";
                 "builds:trigger": "builds:trigger";
-                "mcp:tools": "mcp:tools";
                 "*": "*";
-                "sites:read": "sites:read";
-                "sites:create": "sites:create";
-                "sites:write": "sites:write";
-                "sites:delete": "sites:delete";
-                "sites:policy.write": "sites:policy.write";
                 "spaces:create": "spaces:create";
                 "spaces:delete": "spaces:delete";
                 "spaces:transfer": "spaces:transfer";
                 "spaces:export": "spaces:export";
                 "spaces:import": "spaces:import";
+                "spaces:policy.write": "spaces:policy.write";
                 "versions:read": "versions:read";
                 "versions:promote": "versions:promote";
                 "versions:delete": "versions:delete";
@@ -435,6 +447,13 @@ export declare const ApiKeyCreateRequestSchema: z.ZodObject<{
                 "webhooks:write": "webhooks:write";
                 "builds:read": "builds:read";
                 "builds:create": "builds:create";
+                "variables:read": "variables:read";
+                "variables:write": "variables:write";
+                "tenants:read": "tenants:read";
+                "tenants:write": "tenants:write";
+                "principals:read": "principals:read";
+                "principals:write": "principals:write";
+                "infrastructure:read": "infrastructure:read";
                 "teams:write": "teams:write";
                 "teams:members.write": "teams:members.write";
                 "billing:read": "billing:read";
@@ -483,18 +502,13 @@ export declare const ApiKeyPatchRequestSchema: z.ZodObject<{
                 "domains:read": "domains:read";
                 "spaces:publish": "spaces:publish";
                 "builds:trigger": "builds:trigger";
-                "mcp:tools": "mcp:tools";
                 "*": "*";
-                "sites:read": "sites:read";
-                "sites:create": "sites:create";
-                "sites:write": "sites:write";
-                "sites:delete": "sites:delete";
-                "sites:policy.write": "sites:policy.write";
                 "spaces:create": "spaces:create";
                 "spaces:delete": "spaces:delete";
                 "spaces:transfer": "spaces:transfer";
                 "spaces:export": "spaces:export";
                 "spaces:import": "spaces:import";
+                "spaces:policy.write": "spaces:policy.write";
                 "versions:read": "versions:read";
                 "versions:promote": "versions:promote";
                 "versions:delete": "versions:delete";
@@ -511,6 +525,13 @@ export declare const ApiKeyPatchRequestSchema: z.ZodObject<{
                 "webhooks:write": "webhooks:write";
                 "builds:read": "builds:read";
                 "builds:create": "builds:create";
+                "variables:read": "variables:read";
+                "variables:write": "variables:write";
+                "tenants:read": "tenants:read";
+                "tenants:write": "tenants:write";
+                "principals:read": "principals:read";
+                "principals:write": "principals:write";
+                "infrastructure:read": "infrastructure:read";
                 "teams:write": "teams:write";
                 "teams:members.write": "teams:members.write";
                 "billing:read": "billing:read";
@@ -558,18 +579,13 @@ export declare const ApiKeyScopedCreateRequestSchema: z.ZodObject<{
         "domains:read": "domains:read";
         "spaces:publish": "spaces:publish";
         "builds:trigger": "builds:trigger";
-        "mcp:tools": "mcp:tools";
         "*": "*";
-        "sites:read": "sites:read";
-        "sites:create": "sites:create";
-        "sites:write": "sites:write";
-        "sites:delete": "sites:delete";
-        "sites:policy.write": "sites:policy.write";
         "spaces:create": "spaces:create";
         "spaces:delete": "spaces:delete";
         "spaces:transfer": "spaces:transfer";
         "spaces:export": "spaces:export";
         "spaces:import": "spaces:import";
+        "spaces:policy.write": "spaces:policy.write";
         "versions:read": "versions:read";
         "versions:promote": "versions:promote";
         "versions:delete": "versions:delete";
@@ -586,6 +602,13 @@ export declare const ApiKeyScopedCreateRequestSchema: z.ZodObject<{
         "webhooks:write": "webhooks:write";
         "builds:read": "builds:read";
         "builds:create": "builds:create";
+        "variables:read": "variables:read";
+        "variables:write": "variables:write";
+        "tenants:read": "tenants:read";
+        "tenants:write": "tenants:write";
+        "principals:read": "principals:read";
+        "principals:write": "principals:write";
+        "infrastructure:read": "infrastructure:read";
         "teams:write": "teams:write";
         "teams:members.write": "teams:members.write";
         "billing:read": "billing:read";
@@ -619,18 +642,13 @@ export declare const ApiKeyScopedPatchRequestSchema: z.ZodObject<{
         "domains:read": "domains:read";
         "spaces:publish": "spaces:publish";
         "builds:trigger": "builds:trigger";
-        "mcp:tools": "mcp:tools";
         "*": "*";
-        "sites:read": "sites:read";
-        "sites:create": "sites:create";
-        "sites:write": "sites:write";
-        "sites:delete": "sites:delete";
-        "sites:policy.write": "sites:policy.write";
         "spaces:create": "spaces:create";
         "spaces:delete": "spaces:delete";
         "spaces:transfer": "spaces:transfer";
         "spaces:export": "spaces:export";
         "spaces:import": "spaces:import";
+        "spaces:policy.write": "spaces:policy.write";
         "versions:read": "versions:read";
         "versions:promote": "versions:promote";
         "versions:delete": "versions:delete";
@@ -647,6 +665,13 @@ export declare const ApiKeyScopedPatchRequestSchema: z.ZodObject<{
         "webhooks:write": "webhooks:write";
         "builds:read": "builds:read";
         "builds:create": "builds:create";
+        "variables:read": "variables:read";
+        "variables:write": "variables:write";
+        "tenants:read": "tenants:read";
+        "tenants:write": "tenants:write";
+        "principals:read": "principals:read";
+        "principals:write": "principals:write";
+        "infrastructure:read": "infrastructure:read";
         "teams:write": "teams:write";
         "teams:members.write": "teams:members.write";
         "billing:read": "billing:read";

package/dist/contracts/api-keys.js

@@ -1,13 +1,9 @@
 import { z } from "zod";
 import { AnyObjectSchema, CursorPaginationSchema, cursorListQuerySchema } from "./common.js";
 import { DeviceTeamScopeSchema } from "./device-team-scope.js";
+import { tenantMode } from "./enums.js";
 export const SPACEFAST_ACCESS_POLICY_VERSION = "2026-06-09";
 export const StatticActionSchema = z.enum([
-    "sites:read",
-    "sites:create",
-    "sites:write",
-    "sites:delete",
-    "sites:policy.write",
     "spaces:read",
     "spaces:create",
     "spaces:write",
@@ -17,6 +13,7 @@ export const StatticActionSchema = z.enum([
     "spaces:transfer",
     "spaces:export",
     "spaces:import",
+    "spaces:policy.write",
     "versions:read",
     "versions:promote",
     "versions:delete",
@@ -35,6 +32,20 @@ export const StatticActionSchema = z.enum([
     "builds:read",
     "builds:trigger",
     "builds:create",
+    // Variables hang off a principal (a team or an external customer), not off a
+    // team's administration. They get their own verbs so a route can grant
+    // variable access without handing out team-write authority, and so a
+    // principal-scoped credential never has to borrow `teams:write` to reach them.
+    "variables:read",
+    "variables:write",
+    // Partner-tier actions. They are only ever grantable on a tenant-rooted
+    // resource: a tenant, the principals it owns, and the infrastructure its
+    // spaces run on are tenant-level nouns with no team-scoped meaning.
+    "tenants:read",
+    "tenants:write",
+    "principals:read",
+    "principals:write",
+    "infrastructure:read",
     "teams:read",
     "teams:create",
     "teams:write",
@@ -44,10 +55,23 @@ export const StatticActionSchema = z.enum([
     "tokens:read",
     "tokens:create",
     "tokens:revoke",
-    "mcp:tools",
     "runtime:manage",
     "*",
 ]);
+// The partner-management actions: the ones whose subject IS the tenant rather
+// than something inside it. Holding any of them on a tenant root is what makes
+// a credential a partner credential — and therefore what earns the partner
+// response projection. Tenant-rooted RESOURCES alone cannot mean that: the
+// consumer admission action `teams:create` is also granted on the tenant root
+// because that is where creating a not-yet-existing team has to hang. It is
+// admission-only — no team-scoped route gates on it — so its tenant-root reach
+// grants no team authority.
+export const PARTNER_MANAGEMENT_ACTIONS = [
+    "tenants:read",
+    "tenants:write",
+    "principals:read",
+    "infrastructure:read",
+];
 const DescribedStatticActionSchema = StatticActionSchema.describe("Namespaced IAM-lite action (`noun:verb`), or `*` for all actions.");
 const RESOURCE_PREFIX = "stt://tenant/";
 function isResourceSegment(value) {
@@ -105,13 +129,11 @@ export const ApiCredentialPolicySchema = z
     .object({
     version: z
         .literal(SPACEFAST_ACCESS_POLICY_VERSION)
-        .describe("Policy schema version. Must be the current platform policy version."),
+        .describe("Must be the current platform policy version."),
     statements: z
         .array(z
         .object({
-        effect: z
-            .enum(["allow", "deny"])
-            .describe("Statement effect. Explicit deny always wins over allow."),
+        effect: z.enum(["allow", "deny"]).describe("Explicit deny always wins over allow."),
         actions: z
             .array(DescribedStatticActionSchema)
             .min(1)
@@ -142,14 +164,14 @@ export const ApiKeyPresetSchema = z
     "ci_deploy",
     "space_publisher",
     "space_admin",
-    "site_admin",
     "domain_manager",
     "team_admin",
     "billing_viewer",
+    "partner_admin",
 ])
-    .describe("Named policy preset compiled into a concrete access policy when the key is created.");
-// `system` is never a principal type: runtime/internal credentials are
-// platform-owned and omit ownerPrincipal entirely (the platform spec).
+    .describe("Preset compiled into a concrete access policy when the key is created.");
+// Runtime and internal credentials are platform-owned and omit ownerPrincipal
+// entirely, so `system` is never a principal type here.
 const ApiKeyOwnerPrincipalSchema = z.object({
     type: z.enum(["team", "external"]).describe("Principal type that owns this key."),
     id: z.string().min(1).describe("Stable principal id (Better Auth team id, or external id)."),
@@ -164,6 +186,7 @@ export const ApiKeySchema = z.object({
     id: z.string().describe("API key id."),
     name: z.string().nullable().describe("Human-readable key name."),
     tenantId: z.string().nullable().describe("Tenant the key belongs to."),
+    mode: tenantMode.describe("`test` when the key belongs to a linked test tenant, `live` otherwise."),
     subject: ApiKeySubjectSchema.nullable().describe("Subject the key acts as."),
     ownerPrincipal: ApiKeyOwnerPrincipalSchema.nullable().describe("Owning principal (ownership metadata, never the authorization gate)."),
     createdByUserId: z.string().describe("User who created the key."),
@@ -179,7 +202,7 @@ export const ApiKeySchema = z.object({
         .array(z.string())
         .nullable()
         .describe("CIDR/IP allowlist. Requests from other addresses are rejected."),
-    revokedAt: z.string().datetime().nullable().describe("Revocation instant, if revoked."),
+    revokedAt: z.string().datetime().nullable().describe("Revocation instant."),
     enabled: z.boolean().describe("Whether the key currently authenticates."),
     createdAt: z.string().datetime().describe("Creation instant."),
     updatedAt: z.string().datetime().describe("Last update instant."),
@@ -190,7 +213,7 @@ export const ApiKeyListQuerySchema = cursorListQuerySchema.extend({
         .string()
         .min(1)
         .optional()
-        .describe("Owning team whose keys to list. Defaults to the caller's own team. Any team that the credential policy reaches is allowed."),
+        .describe("Owning team whose keys to list. Defaults to the caller's own team; any team the credential policy reaches is allowed."),
 });
 export const ApiKeyListResponseSchema = z.object({
     data: z.array(ApiKeySchema),
@@ -239,14 +262,11 @@ export const ApiKeyPatchRequestSchema = z
     .refine((value) => Object.keys(value).length > 0, {
     message: "At least one mutable API key field is required.",
 });
-// Target §5C contract (the internal plan
-// "API key: finite permissions, no broad role"): key creation selects an
-// explicit, finite scope and permission set — never a team-wide role that
-// falls out of an omitted field. This is deliberately a DISJOINT shape from
-// `ApiKeyCreateRequestSchema` (no teamId/preset/policy): the legacy shape
-// stays valid only on the legacy route (api-keys/routes.ts); this is the only
-// request shape the public core contract (api-contracts/core/api-keys.ts)
-// accepts.
+// Key creation selects an explicit, finite scope and permission set, never a
+// team-wide role that falls out of an omitted field. Deliberately DISJOINT from
+// `ApiKeyCreateRequestSchema`: that shape stays valid only on the legacy route
+// (api-keys/routes.ts), while this is the only shape the public core contract
+// (api-contracts/core/api-keys.ts) accepts.
 export const ApiKeyScopeSchema = z
     .discriminatedUnion("kind", [
     z.object({ kind: z.literal("team"), teamId: z.string().min(1) }).strict(),