@spacefast/common 0.0.3 → 0.0.6

package/dist/utils/local-space-state.js

@@ -0,0 +1,251 @@
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+export const LOCAL_SPACE_STATE_DIR_NAME = ".spacefast";
+export const LEGACY_LOCAL_SPACE_STATE_DIR_NAME = ".stattic";
+export const LOCAL_SPACE_LINK_FILE_NAME = "space.json";
+export const LOCAL_SPACE_STATE_FILE_NAME = "state.json";
+/**
+ * Local Spacefast checkout contract.
+ *
+ * `.spacefast/space.json` is the committable selection axis: it names which
+ * space a checkout targets (`space`) and may carry non-secret provider/team
+ * coordinates (`team`, `apiBaseUrl`). It must not carry credentials.
+ *
+ * `.spacefast/state.json` is the local credential/cache axis: it records the
+ * resolved `spaceId`, provider `apiUrl`, anonymous `claimToken` before claim,
+ * durable `accessToken` after continuation, and small publish caches such as
+ * `lastVersionId`. It is secret, machine-written, gitignored, and merge-written
+ * so newer tools preserve unknown fields from older/newer tools.
+ */
+export const localSpaceLinkSchema = z
+    .object({
+    team: z.string().min(1).optional(),
+    space: z.string().min(1),
+    apiBaseUrl: z.string().min(1).optional(),
+})
+    .loose();
+export const localSpaceStateSchema = z
+    .object({
+    spaceId: z.string().min(1).optional(),
+    apiUrl: z.string().min(1).optional(),
+    teamSlug: z.string().min(1).optional(),
+    claimToken: z.string().min(1).optional(),
+    claimUrl: z.string().min(1).optional(),
+    expiresAt: z.string().min(1).optional(),
+    accessToken: z.string().min(1).optional(),
+    lastVersionId: z.string().min(1).optional(),
+    lastVersionUrl: z.string().min(1).optional(),
+    lastSpaceUrl: z.string().min(1).optional(),
+})
+    .loose();
+export function localSpaceStateDir(root) {
+    return path.join(root, LOCAL_SPACE_STATE_DIR_NAME);
+}
+export function localSpaceStatePath(root) {
+    return path.join(localSpaceStateDir(root), LOCAL_SPACE_STATE_FILE_NAME);
+}
+export function localSpaceLinkPath(root) {
+    return path.join(localSpaceStateDir(root), LOCAL_SPACE_LINK_FILE_NAME);
+}
+function legacyStatePath(root) {
+    return path.join(root, LEGACY_LOCAL_SPACE_STATE_DIR_NAME, LOCAL_SPACE_STATE_FILE_NAME);
+}
+function legacyLinkPath(root) {
+    return path.join(root, LEGACY_LOCAL_SPACE_STATE_DIR_NAME, LOCAL_SPACE_LINK_FILE_NAME);
+}
+async function readJsonFile(filePath) {
+    const raw = await readFile(filePath, "utf8").catch(() => undefined);
+    if (raw === undefined)
+        return undefined;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseState(value) {
+    const parsed = localSpaceStateSchema.safeParse(value);
+    return parsed.success ? parsed.data : null;
+}
+function parseLink(value) {
+    const parsed = localSpaceLinkSchema.safeParse(value);
+    return parsed.success ? parsed.data : null;
+}
+function linkSpaceId(link) {
+    return link?.space.startsWith("spc_") ? link.space : undefined;
+}
+export async function readLocalSpaceLink(root) {
+    return (await readLocalSpaceLinkWithPath(root))?.link ?? null;
+}
+/**
+ * Like readLocalSpaceLink, but reports WHICH file matched — callers surface the
+ * legacy `.stattic/space.json` path to users so migrations stay visible.
+ */
+export async function readLocalSpaceLinkWithPath(root) {
+    const primary = parseLink(await readJsonFile(localSpaceLinkPath(root)));
+    if (primary) {
+        return { link: primary, path: localSpaceLinkPath(root) };
+    }
+    const legacy = parseLink(await readJsonFile(legacyLinkPath(root)));
+    return legacy ? { link: legacy, path: legacyLinkPath(root) } : null;
+}
+export async function readLocalSpaceStateAt(root) {
+    const statePath = localSpaceStatePath(root);
+    const state = parseState(await readJsonFile(statePath)) ??
+        parseState(await readJsonFile(legacyStatePath(root)));
+    const linkPath = localSpaceLinkPath(root);
+    const link = parseLink(await readJsonFile(linkPath)) ?? parseLink(await readJsonFile(legacyLinkPath(root)));
+    if (!state && !link)
+        return null;
+    return {
+        root,
+        statePath: state ? statePath : null,
+        linkPath: link ? linkPath : null,
+        link,
+        state,
+        spaceId: state?.spaceId ?? linkSpaceId(link),
+        claimToken: state?.claimToken,
+        accessToken: state?.accessToken,
+        apiUrl: state?.apiUrl ?? link?.apiBaseUrl,
+        claimUrl: state?.claimUrl,
+        expiresAt: state?.expiresAt,
+        lastVersionId: state?.lastVersionId,
+    };
+}
+function isWithinBoundary(current, boundary) {
+    const relative = path.relative(boundary, current);
+    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+/**
+ * Walk up from `startDir` to the filesystem root (or `boundary`, when given),
+ * returning the first non-null result of `probe`. Shared by every "nearest
+ * checkout marker" lookup (state+link discovery here, the CLI's link-only
+ * discovery) so the traversal rules live in one place.
+ */
+export async function findUpward(probe, startDir = process.cwd(), boundary) {
+    let current = path.resolve(startDir);
+    const resolvedBoundary = boundary ? path.resolve(boundary) : undefined;
+    if (resolvedBoundary && !isWithinBoundary(current, resolvedBoundary)) {
+        current = resolvedBoundary;
+    }
+    for (;;) {
+        const found = await probe(current);
+        if (found)
+            return found;
+        if (resolvedBoundary && current === resolvedBoundary)
+            return null;
+        const parent = path.dirname(current);
+        if (parent === current)
+            return null;
+        if (resolvedBoundary && !isWithinBoundary(parent, resolvedBoundary))
+            return null;
+        current = parent;
+    }
+}
+export async function discoverLocalSpaceState(startDir = process.cwd(), boundary) {
+    return findUpward(readLocalSpaceStateAt, startDir, boundary);
+}
+async function writeJsonAtomic(filePath, value, mode) {
+    await mkdir(path.dirname(filePath), { recursive: true });
+    const tempPath = path.join(path.dirname(filePath), `.${path.basename(filePath)}.${process.pid}.${Date.now()}.tmp`);
+    try {
+        await writeFile(tempPath, `${JSON.stringify(value, null, 2)}\n`, {
+            encoding: "utf8",
+            ...(mode ? { mode } : {}),
+        });
+        if (mode) {
+            await chmod(tempPath, mode).catch(() => undefined);
+        }
+        await rename(tempPath, filePath);
+        if (mode) {
+            await chmod(filePath, mode).catch(() => undefined);
+        }
+    }
+    catch (error) {
+        await rm(tempPath, { force: true }).catch(() => undefined);
+        throw error;
+    }
+}
+async function ensureStateGitignored(root) {
+    const gitignorePath = path.join(root, ".gitignore");
+    const entry = `${LOCAL_SPACE_STATE_DIR_NAME}/${LOCAL_SPACE_STATE_FILE_NAME}`;
+    const raw = await readFile(gitignorePath, "utf8").catch(() => "");
+    const lines = raw.split(/\r?\n/);
+    if (lines.includes(entry))
+        return;
+    const prefix = raw.length > 0 && !raw.endsWith("\n") ? "\n" : "";
+    await writeFile(gitignorePath, `${raw}${prefix}${entry}\n`, "utf8");
+}
+function assignDefined(target, input) {
+    for (const [key, value] of Object.entries(input)) {
+        if (value === undefined) {
+            delete target[key];
+        }
+        else {
+            target[key] = value;
+        }
+    }
+}
+function assignPresent(target, input) {
+    for (const [key, value] of Object.entries(input)) {
+        if (value !== undefined) {
+            target[key] = value;
+        }
+    }
+}
+export async function writeLocalSpaceLink(root, link) {
+    const filePath = localSpaceLinkPath(root);
+    const payload = localSpaceLinkSchema.parse({
+        space: link.space,
+        ...(link.team ? { team: link.team } : {}),
+        ...(link.apiBaseUrl ? { apiBaseUrl: link.apiBaseUrl } : {}),
+    });
+    await writeJsonAtomic(filePath, payload);
+    return filePath;
+}
+export async function writeLocalSpaceState(root, state) {
+    const filePath = localSpaceStatePath(root);
+    const payload = localSpaceStateSchema.parse(state);
+    await writeJsonAtomic(filePath, payload, 0o600);
+    await ensureStateGitignored(root);
+    return filePath;
+}
+export async function saveLocalSpaceState(root, input) {
+    const existing = parseState(await readJsonFile(localSpaceStatePath(root))) ??
+        parseState(await readJsonFile(legacyStatePath(root))) ??
+        {};
+    const next = { ...existing };
+    assignPresent(next, {
+        spaceId: input.spaceId,
+        apiUrl: input.apiUrl,
+        teamSlug: input.teamSlug,
+        lastVersionId: input.lastVersionId,
+        lastVersionUrl: input.lastVersionUrl,
+        lastSpaceUrl: input.lastSpaceUrl,
+    });
+    if (input.accessToken) {
+        assignDefined(next, {
+            accessToken: input.accessToken,
+            claimToken: undefined,
+            claimUrl: undefined,
+            expiresAt: undefined,
+        });
+    }
+    else if (input.claimToken) {
+        assignDefined(next, {
+            claimToken: input.claimToken,
+            claimUrl: input.claimUrl,
+            expiresAt: input.expiresAt,
+            accessToken: undefined,
+        });
+    }
+    const statePath = await writeLocalSpaceState(root, next);
+    const existingLink = await readLocalSpaceLink(root);
+    const wroteLink = !existingLink;
+    if (!existingLink) {
+        await writeLocalSpaceLink(root, { space: input.spaceId, apiBaseUrl: input.apiUrl });
+    }
+    return { statePath, linkPath: localSpaceLinkPath(root), wroteLink };
+}

package/dist/utils/oauth-signed-query.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The signed OAuth authorize continuation carried by a query string, or null
+ * when there isn't one. Better Auth's signature covers every param it sent
+ * (the set is self-declared in `ba_param`) — anything extra that later joined
+ * the URL (a returnTo, a tracking param) must be dropped before the query is
+ * sent back, or verification fails.
+ */
+export declare function signedOAuthQuerySubset(query: string): string | null;

package/dist/utils/oauth-signed-query.js

@@ -0,0 +1,26 @@
+// Better Auth's OAuth authorize endpoint hands interaction prompts (login,
+// consent) to the dashboard by redirecting with the ENTIRE authorize query,
+// HMAC-signed by the auth server (`sig` + `exp` + `ba_*` bookkeeping params).
+// Verification hashes the query verbatim, so it must round-trip byte-exact.
+/**
+ * The signed OAuth authorize continuation carried by a query string, or null
+ * when there isn't one. Better Auth's signature covers every param it sent
+ * (the set is self-declared in `ba_param`) — anything extra that later joined
+ * the URL (a returnTo, a tracking param) must be dropped before the query is
+ * sent back, or verification fails.
+ */
+export function signedOAuthQuerySubset(query) {
+    const params = new URLSearchParams(query);
+    if (!params.get("client_id") || !params.get("sig"))
+        return null;
+    const signedNames = new Set(params.getAll("ba_param"));
+    if (signedNames.size === 0)
+        return null;
+    const signed = new URLSearchParams();
+    for (const [key, value] of params) {
+        if (key === "sig" || key === "ba_param" || signedNames.has(key)) {
+            signed.append(key, value);
+        }
+    }
+    return signed.toString();
+}

package/dist/utils/publish-detection.d.ts

@@ -1,10 +1,2 @@
-import type { SpaceConfig } from "../contracts/space-config.js";
-import type { SpaceSettingsPatch } from "./space-config.js";
 export declare function detectSpaFromPaths(paths: Iterable<string>): boolean;
 export declare function detectSpaFallbackFromPaths(paths: Iterable<string>): string | null;
-export type SpaceSettingsFromConfigJson = SpaceSettingsPatch & {
-    title?: string;
-    password?: string | null;
-};
-export declare function parseSpaceSettingsFromConfigJson(raw: string | undefined): SpaceSettingsFromConfigJson | null;
-export declare function spaceConfigFromSettings(base: SpaceConfig | null | undefined, patch: SpaceSettingsPatch): SpaceConfig;

package/dist/utils/publish-detection.js

@@ -1,6 +1,3 @@
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 export function detectSpaFromPaths(paths) {
     return detectSpaFallbackFromPaths(paths) !== null;
 }
@@ -26,93 +23,3 @@ export function detectSpaFallbackFromPaths(paths) {
         entry === "asset-manifest.json");
     return hasSpaAssets ? "/index.html" : null;
 }
-// Parses the legacy-vocabulary keys of a local `.stattic/config.json` file
-// (title/mode/spa/password/viewer). Platform SpaceConfig keys are handled
-// separately by the publish flow.
-export function parseSpaceSettingsFromConfigJson(raw) {
-    if (!raw) {
-        return null;
-    }
-    let parsedJson;
-    try {
-        parsedJson = JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-    if (!isRecord(parsedJson)) {
-        return null;
-    }
-    const settings = {};
-    if (parsedJson.title && typeof parsedJson.title === "string") {
-        settings.title = parsedJson.title;
-    }
-    if (parsedJson.mode === "website" || parsedJson.mode === "files") {
-        settings.mode = parsedJson.mode;
-    }
-    if (typeof parsedJson.spa === "boolean") {
-        settings.spa = parsedJson.spa;
-    }
-    if (parsedJson.password === null || typeof parsedJson.password === "string") {
-        settings.password = parsedJson.password;
-    }
-    if (isRecord(parsedJson.viewer)) {
-        const viewer = {};
-        for (const key of ["title", "description", "ogImagePath"]) {
-            const value = parsedJson.viewer[key];
-            if (value === null || typeof value === "string") {
-                viewer[key] = value;
-            }
-        }
-        if (Object.keys(viewer).length > 0) {
-            settings.viewer = viewer;
-        }
-    }
-    return Object.keys(settings).length > 0 ? settings : null;
-}
-// Compiles the legacy `.stattic/config.json` serving vocabulary (mode/spa/viewer)
-// onto a SpaceConfig overlay. Files mode = directory listing with no index; SPA =
-// the legacy "/index.html" fallback; viewer fields map onto meta. Only the publish flow
-// reads a legacy config.json, so this translation lives beside its parser.
-export function spaceConfigFromSettings(base, patch) {
-    const config = { ...base };
-    if (patch.mode === "files") {
-        config.listing = true;
-        config.index = false;
-    }
-    else if (patch.mode === "website") {
-        delete config.listing;
-        delete config.index;
-    }
-    if (patch.spa === true) {
-        config.fallback = "/index.html";
-    }
-    else if (patch.spa === false) {
-        delete config.fallback;
-    }
-    if (patch.viewer) {
-        const meta = { ...config.meta };
-        const entries = [
-            ["title", patch.viewer.title],
-            ["description", patch.viewer.description],
-            ["image", patch.viewer.ogImagePath],
-        ];
-        for (const [key, value] of entries) {
-            if (value === undefined)
-                continue;
-            if (value === null || value === "") {
-                delete meta[key];
-            }
-            else {
-                meta[key] = value;
-            }
-        }
-        if (Object.keys(meta).length > 0) {
-            config.meta = meta;
-        }
-        else {
-            delete config.meta;
-        }
-    }
-    return config;
-}

package/dist/utils/publish-policy.d.ts

@@ -21,6 +21,7 @@ export declare function firstStaticUploadPathViolation(paths: string[], options?
 export type PublishManifestCaps = {
     maxFiles?: number | null | undefined;
     maxFileBytes?: number | null | undefined;
+    maxTotalBytes?: number | null | undefined;
 };
 export type PublishManifestError = {
     code: ErrorCode;
@@ -50,16 +51,16 @@ export declare function validatePublishManifest<T extends {
     path: string;
     size: number;
 }>(files: readonly T[], caps?: PublishManifestCaps): PublishManifestResult<T>;
-export declare function freePlanCanUploadPath(filePath: string, options?: {
+export declare const ANONYMOUS_SERVE_CONTENT_TYPES: readonly ["text/*", "image/*", "font/*", "application/json", "application/manifest+json", "application/javascript", "application/gzip", "application/xml", "application/rss+xml", "application/atom+xml"];
+export type FreePlanContentPolicyOptions = {
     claimedSpace?: boolean;
-}): boolean;
+};
+export declare function freePlanCanUploadPath(filePath: string, options?: FreePlanContentPolicyOptions): boolean;
 export declare function freePlanCanUploadContentType(contentType: string | undefined): boolean;
 export declare function filterFreePlanManifest<T extends {
     path: string;
     contentType?: string | undefined;
-}>(files: readonly T[], options?: {
-    claimedSpace?: boolean;
-}): {
+}>(files: readonly T[], options?: FreePlanContentPolicyOptions): {
     allowed: T[];
     ignored: string[];
 };

package/dist/utils/publish-policy.js

@@ -27,6 +27,9 @@ const IGNORED_EXACT_PATHS = new Set([
     ".env.test",
     ".npmrc",
     ".netrc",
+    // CLI checkout state (current dir name plus the legacy pre-rename one —
+    // user archives may contain either; both stay out of every publish).
+    ".spacefast/state.json",
     ".stattic/state.json",
     "_routes.json",
 ]);
@@ -52,14 +55,36 @@ const SENSITIVE_FILE_PATTERNS = [
 ];
 // Denied runtime private/control paths (spec "Static path policy").
 const STATIC_EXECUTION_CONTROL_FILES = new Set([".htaccess", ".user.ini"]);
-const STATIC_RUNTIME_CONTROL_SEGMENTS = new Set(["__spacefast", "__stattic"]);
-const STATIC_RUNTIME_CONTROL_PATHS = new Set([".well-known/stattic-runtime"]);
-const STATIC_RUNTIME_CONTROL_PREFIXES = [".stattic/storage", ".stattic/engine"];
+// Reserved runtime namespace segments are matched by PREFIX: the runtime owns
+// `/__spacefast/*` plus `__spacefast_generated/`, and the `__stattic` spelling
+// (`/__stattic_probe` today, more `/__stattic/*` routes planned) stays
+// reserved the same way. Mid-segment occurrences are ordinary content.
+const STATIC_RUNTIME_CONTROL_SEGMENT_PREFIXES = ["__spacefast", "__stattic"];
+// Both the current and the legacy control-path spellings stay denied: spaces
+// published before the `.stattic` → `.spacefast` rename still serve from the
+// legacy on-disk layout, and user archives may carry either name.
+const STATIC_RUNTIME_CONTROL_PATHS = new Set([
+    ".well-known/spacefast-runtime",
+    ".well-known/stattic-runtime",
+]);
+const STATIC_RUNTIME_CONTROL_PREFIXES = [
+    ".spacefast/storage",
+    ".spacefast/engine",
+    ".stattic/storage",
+    ".stattic/engine",
+];
 export function normalizePublishPath(relativePath) {
     return relativePath.replace(/\\/g, "/").replace(/^\/+/g, "");
 }
 export function publishPathIgnored(relativePath) {
     const path = normalizePublishPath(relativePath);
+    // The agent state dirs hold one secret (state.json) plus committable tooling
+    // (space.json). Drop only those files at any depth so a checkout archived one
+    // level too high never ships a claim token — but keep serving legitimate
+    // content in the same dirs (e.g. the legacy .stattic/routes.json convention).
+    if (/(?:^|\/)\.(?:spacefast|stattic)\/(?:state|space)\.json$/.test(path)) {
+        return true;
+    }
     if (IGNORED_EXACT_PATHS.has(path) || /(?:^|\/)\.next\/cache(?:\/|$)/.test(path)) {
         return true;
     }
@@ -154,7 +179,10 @@ export function staticUploadPathViolation(path, options = {}) {
     if (reservedRuntimeControlFiles?.has(lowerName) && lowerPath === lowerName) {
         return pathViolation("static_runtime_control_path_not_supported", "Static deploys cannot upload runtime control paths.", normalizedPath);
     }
-    const controlSegment = segments.find((segment) => STATIC_RUNTIME_CONTROL_SEGMENTS.has(segment.toLowerCase()));
+    const controlSegment = segments.find((segment) => {
+        const lowerSegment = segment.toLowerCase();
+        return STATIC_RUNTIME_CONTROL_SEGMENT_PREFIXES.some((prefix) => lowerSegment.startsWith(prefix));
+    });
     if (controlSegment) {
         return pathViolation("static_runtime_control_path_not_supported", "Static deploys cannot upload runtime control paths.", normalizedPath);
     }
@@ -240,6 +268,13 @@ export function validatePublishManifest(files, caps = {}) {
                 warnings: [],
             };
         }
+        // Checkout state and credential paths (.spacefast/, .git/, .env*, …) are
+        // silently dropped rather than rejected: agents that archive one level too
+        // high must never publish a claim token to the live site, and failing the
+        // whole manifest for it would punish the common accident.
+        if (publishPathIgnored(canonicalPath)) {
+            continue;
+        }
         // Case-only-differing paths are distinct (paths are byte-exact and
         // case-sensitive) but cannot round-trip case-insensitive filesystems.
         const lowercase = canonicalPath.toLowerCase();
@@ -271,13 +306,14 @@ export function validatePublishManifest(files, caps = {}) {
             warnings: [],
         };
     }
+    const maxTotalBytes = Math.min(MAX_VERSION_TOTAL_BYTES, caps.maxTotalBytes && caps.maxTotalBytes > 0 ? caps.maxTotalBytes : MAX_VERSION_TOTAL_BYTES);
     const totalBytes = canonicalFiles.reduce((sum, file) => sum + file.size, 0);
-    if (totalBytes > MAX_VERSION_TOTAL_BYTES) {
+    if (totalBytes > maxTotalBytes) {
         return {
             error: {
                 code: "version_total_bytes_exceeded",
-                message: `Version exceeds the ${MAX_VERSION_TOTAL_BYTES} byte total size limit.`,
-                details: { totalBytes, limit: MAX_VERSION_TOTAL_BYTES },
+                message: `Version exceeds the ${maxTotalBytes} byte total size limit for this plan.`,
+                details: { totalBytes, limit: maxTotalBytes },
             },
             files: null,
             warnings: [],
@@ -319,6 +355,25 @@ const FREE_PLAN_ALLOWED_UPLOAD_EXTENSIONS = new Set([
     ".ttf",
     ".otf",
 ]);
+// THE anonymous content enforcement (accept-and-scan posture): uploads are
+// accepted like any free publish, but until the space is claimed the runtime
+// only serves these content types, pushed as the generic route-config
+// `content_types` allowlist (exact types or `prefix/*` wildcards; the engine
+// enforces the list without knowing it means "anonymous"). Web-page content
+// only — no opaque octet-streams, archives (except scanned gzip, which
+// pagefind search indexes depend on), documents, or media containers.
+export const ANONYMOUS_SERVE_CONTENT_TYPES = [
+    "text/*",
+    "image/*",
+    "font/*",
+    "application/json",
+    "application/manifest+json",
+    "application/javascript",
+    "application/gzip",
+    "application/xml",
+    "application/rss+xml",
+    "application/atom+xml",
+];
 const LINE_SPLIT_PATTERN = /\r?\n/;
 const BASIC_AUTH_HEADER_PATTERN = /^basic-auth\s*:/i;
 function extensionForPath(filePath) {
@@ -333,6 +388,13 @@ function freePlanDeniedExecutablePath(filePath) {
         .split("/")
         .some((segment) => segment === "bin");
 }
+// Acceptance is deliberately identical for claimed-free and unclaimed
+// anonymous spaces (accept-and-scan posture): rejecting file types at upload
+// adds no safety — the bytes reach us before any scan either way — so
+// publishes are accepted, every file goes through the scan pipeline, and the
+// SERVE-time content-type allowlist (ANONYMOUS_SERVE_CONTENT_TYPES via the
+// route-config `content_types` policy) is what keeps opaque binaries dark
+// until the space is claimed.
 export function freePlanCanUploadPath(filePath, options) {
     const path = normalizePublishPath(filePath);
     // Root Spacefast config files are platform machinery, not user content (spec "Space
@@ -363,6 +425,8 @@ export function freePlanCanUploadContentType(contentType) {
         normalized === "application/javascript" ||
         normalized === "application/json" ||
         normalized === "application/manifest+json" ||
+        // Gzip stays allowed for anonymous spaces too: pagefind search indexes
+        // ship as gzip fragments, and ClamAV decompresses gzip when scanning.
         normalized === "application/gzip" ||
         normalized === "image/svg+xml" ||
         normalized === "application/xml" ||

package/dist/utils/query-keys.d.ts

@@ -4,8 +4,9 @@ export declare const qk: {
     accountSessions: () => readonly ["account", "sessions"];
     accountConnections: () => readonly ["account", "connections"];
     accountInvitations: () => readonly ["account", "invitations"];
-    apiTokens: () => readonly ["api-tokens"];
+    apiTokens: (teamId?: string) => readonly ["api-tokens"] | readonly ["api-tokens", string];
     agentAccounts: () => readonly ["agent-accounts"];
+    myShelf: () => readonly ["my-shelf"];
     mcpDashboard: () => readonly ["mcp", "dashboard"];
     mcpApproval: (id: string) => readonly ["mcp", "approval", string];
     teams: () => readonly ["teams", "list"];
@@ -21,20 +22,25 @@ export declare const qk: {
     teamDomains: (id: string) => readonly ["teams", string, "domains"];
     teamManagedDomains: (id: string) => readonly ["teams", string, "managed-domains"];
     domainBindings: () => readonly ["domain-bindings"];
-    slugAvailability: (kind: "team" | "space", slug: string, teamId?: string, currentSlug?: string) => readonly ["slugs", "availability", "team" | "space", string, string, string];
+    slugAvailability: (kind: "team" | "space", slug: string, teamId?: string, currentSlug?: string) => readonly ["slugs", "availability", "space" | "team", string, string, string];
     teamVariables: (id: string) => readonly ["teams", string, "variables"];
     teamActivity: (id: string, limit: number) => readonly ["teams", string, "activity", number];
     space: (id: string) => readonly ["spaces", string];
     spaceByRef: (teamRef: string, spaceRef: string) => readonly ["spaces", "by-ref", string, string];
     spaceVersions: (id: string) => readonly ["spaces", string, "versions"];
     spaceCollaboration: (id: string) => readonly ["spaces", string, "collaboration"];
+    spaceCollaborationEmbedConfig: (id: string) => readonly ["spaces", string, "collaboration", "embed-config"];
     spaceAnnotations: (id: string) => readonly ["spaces", string, "annotations"];
     spaceActivity: (id: string, limit: number) => readonly ["spaces", string, "activity", number];
     spaceDeployments: (id: string) => readonly ["spaces", string, "deployments"];
     spaceTags: (id: string) => readonly ["spaces", string, "tags"];
-    spaceTagVersion: (id: string, versionId: string) => readonly ["spaces", string, "tags", "versions", string];
+    spaceTagVersion: (id: string, versionId: string) => readonly ["spaces", string, "tags", string];
+    spaceTagDiff: (id: string, versionId: string) => readonly ["spaces", string, "tags", string, "diff"];
+    spaceTagReleases: (id: string) => readonly ["spaces", string, "tags", "releases"];
+    spaceTagsEffective: (id: string) => readonly ["spaces", string, "tags", "effective"];
     build: (id: string) => readonly ["builds", string];
-    buildLogs: (id: string) => readonly ["builds", string, "logs"];
+    buildLogs: (id: string, limit?: number) => readonly ["builds", string, "logs"] | readonly ["builds", string, "logs", number];
+    spaceBuilds: (id: string) => readonly ["spaces", string, "builds"];
     spaceRepositoryConnection: (id: string, connectionType?: string) => readonly ["spaces", string, "repository-connection", string];
     repositoryInstallations: (spaceId: string) => readonly ["repository-connections", "installations", string];
     repositoryInstallationRepositories: (installationId: string) => readonly ["repository-connections", "installations", string, "repositories"];
@@ -44,7 +50,7 @@ export declare const qk: {
     webhook: (webhookId: string) => readonly ["webhooks", string];
     webhookDeliveries: (webhookId: string) => readonly ["webhooks", string, "deliveries"];
     spaceVersion: (id: string, versionId: string) => readonly ["spaces", string, "versions", string];
-    spaceVersionAnnotations: (id: string, versionId: string, status?: string) => readonly ["spaces", string, "versions", string, "annotations", string];
+    spaceVersionAnnotations: (id: string, versionId: string, status?: string) => readonly ["spaces", string, "versions", string, "annotations"] | readonly ["spaces", string, "versions", string, "annotations", string];
     spaceVersionFiles: (id: string, versionId: string) => readonly ["spaces", string, "versions", string, "files"];
     spaceVersionFile: (id: string, versionId: string, path: string) => readonly ["spaces", string, "versions", string, "files", string];
     spaceVersionFileDirectUrl: (id: string, versionId: string, path: string) => readonly ["spaces", string, "versions", string, "files", string, "direct-url"];
@@ -63,8 +69,13 @@ export declare const qk: {
     spaceZeroRealtimeEvents: (id: string, limit: number) => readonly ["spaces", string, "zero", "realtime", "events", number];
     spaceVariables: (id: string) => readonly ["spaces", string, "variables"];
     spaceCertificates: (id: string) => readonly ["spaces", string, "runtime", "certificates"];
-    spaceLogs: (id: string, kind: "build" | "access" | "runtime") => readonly ["spaces", string, "logs", "build" | "access" | "runtime"];
+    spaceLogs: (id: string, kind: "build" | "access" | "runtime") => readonly ["spaces", string, "logs", "build" | "runtime" | "access"];
     spaceAnalytics: (id: string, window: string) => readonly ["spaces", string, "analytics", string];
+    spaceFirewall: (id: string) => readonly ["spaces", string, "access", "firewall"];
+    spaceAccessViews: (id: string, since?: string) => readonly ["spaces", string, "access", "views", string];
+    teamServiceTokens: (teamId: string) => readonly ["teams", string, "access", "service-tokens"];
+    teamAccessDefaults: (teamId: string) => readonly ["teams", string, "access", "defaults"];
+    teamAccessConnections: (teamId: string) => readonly ["teams", string, "access", "connections"];
     domain: (teamId: string, ref: string) => readonly ["teams", string, "domains", string];
     domainDiagnostics: (teamId: string, domainId: string) => readonly ["teams", string, "domains", string, "diagnostics"];
     domainDnsCapabilities: (domainId: string) => readonly ["domains", string, "dns", "capabilities"];