@spacefast/common 0.0.5 → 0.0.6

package/dist/utils/build-settings.js

@@ -216,6 +216,224 @@ export function detectPlatformConfigs(input) {
         cloudflarePagesConfig(input),
     ].filter((config) => Boolean(config));
 }
+const SUPPORTED_REDIRECT_STATUSES = new Set([200, 301, 302, 303, 307, 308, 404]);
+const NETLIFY_CONDITION_KEYS = new Map([
+    ["country", "Country"],
+    ["language", "Language"],
+    ["cookie", "Cookie"],
+]);
+const VERCEL_TRAILING_REGEX_SPLAT = /\(\.\*\)$/;
+const VERCEL_TRAILING_NAMED_SPLAT = /:([A-Za-z][A-Za-z0-9_]*)[*+]$/;
+const UNSUPPORTED_PATTERN_CHARS = /[(){}+?!$^[\]|\\]/;
+function booleanField(value, key) {
+    const field = value[key];
+    return typeof field === "boolean" ? field : null;
+}
+// Converts a Vercel path-to-regexp source into `_redirects` pattern syntax.
+// Supported: literal segments, `:name` segment params, and one trailing
+// catch-all (`:name*`, `:name+`, or `(.*)`). Anything else returns null.
+function vercelSourceToPattern(source) {
+    let splat = null;
+    let pattern = source;
+    const regexSplat = pattern.match(VERCEL_TRAILING_REGEX_SPLAT);
+    if (regexSplat) {
+        pattern = pattern.slice(0, -regexSplat[0].length);
+        splat = "$1";
+    }
+    else {
+        const namedSplat = pattern.match(VERCEL_TRAILING_NAMED_SPLAT);
+        if (namedSplat?.[1]) {
+            pattern = pattern.slice(0, -namedSplat[0].length);
+            splat = `:${namedSplat[1]}`;
+        }
+    }
+    if (UNSUPPORTED_PATTERN_CHARS.test(pattern) || pattern.includes("*")) {
+        return null;
+    }
+    return { pattern: splat === null ? pattern : `${pattern}*`, splat };
+}
+function vercelDestination(destination, splat) {
+    let converted = destination;
+    if (splat === "$1") {
+        converted = converted.replaceAll("$1", ":splat");
+    }
+    else if (splat) {
+        // `:name`, `:name*`, or `:name+` — but not a longer name sharing the prefix.
+        const reference = new RegExp(`\\${splat}[*+]?(?![A-Za-z0-9_])`, "g");
+        converted = converted.replace(reference, ":splat");
+    }
+    // Unresolved regex captures cannot be expressed in `_redirects`.
+    return /\$\d/.test(converted) ? null : converted;
+}
+function vercelRedirectStatus(rule) {
+    const statusCode = numberField(rule, "statusCode");
+    if (statusCode !== null) {
+        return statusCode;
+    }
+    return booleanField(rule, "permanent") ? 308 : 307;
+}
+function convertVercelRoutingRule(rule, kind, out) {
+    const source = stringField(rule, "source");
+    const destination = stringField(rule, "destination");
+    const label = `vercel.json ${kind} ${source ?? "(missing source)"}`;
+    if (!source || !destination) {
+        out.notes.push(`${label}: skipped — missing source or destination.`);
+        return;
+    }
+    if ("has" in rule || "missing" in rule) {
+        out.notes.push(`${label}: skipped — has/missing conditions are not supported.`);
+        return;
+    }
+    const converted = vercelSourceToPattern(source);
+    if (!converted) {
+        out.notes.push(`${label}: skipped — the source pattern does not map to _redirects syntax.`);
+        return;
+    }
+    const convertedDestination = vercelDestination(destination, converted.splat);
+    if (!convertedDestination) {
+        out.notes.push(`${label}: skipped — the destination uses unsupported regex captures.`);
+        return;
+    }
+    const status = kind === "rewrite" ? 200 : vercelRedirectStatus(rule);
+    if (!SUPPORTED_REDIRECT_STATUSES.has(status)) {
+        out.notes.push(`${label}: skipped — status ${status} is not supported.`);
+        return;
+    }
+    out.redirectLines.push(`${converted.pattern} ${convertedDestination} ${status}`);
+}
+function convertNetlifyRedirect(rule, out) {
+    const from = stringField(rule, "from");
+    const to = stringField(rule, "to");
+    const label = `netlify.toml redirect ${from ?? "(missing from)"}`;
+    if (!from || !to) {
+        out.notes.push(`${label}: skipped — missing from or to.`);
+        return;
+    }
+    if ("signed" in rule || "headers" in rule) {
+        out.notes.push(`${label}: skipped — signed proxying and proxy headers are not supported.`);
+        return;
+    }
+    const status = numberField(rule, "status") ?? 301;
+    if (!SUPPORTED_REDIRECT_STATUSES.has(status)) {
+        out.notes.push(`${label}: skipped — status ${status} is not supported.`);
+        return;
+    }
+    const queryTokens = [];
+    const query = objectField(rule, "query");
+    if (query) {
+        for (const [name, capture] of Object.entries(query)) {
+            if (typeof capture !== "string" || !capture.startsWith(":")) {
+                out.notes.push(`${label}: skipped — literal query matches are not supported.`);
+                return;
+            }
+            queryTokens.push(`${name}=${capture}`);
+        }
+    }
+    const conditionTokens = [];
+    const conditions = objectField(rule, "conditions");
+    if (conditions) {
+        for (const [name, values] of Object.entries(conditions)) {
+            const mapped = NETLIFY_CONDITION_KEYS.get(name.toLowerCase());
+            const list = Array.isArray(values)
+                ? values.filter((value) => typeof value === "string")
+                : null;
+            if (!mapped || !list || list.length === 0) {
+                out.notes.push(`${label}: skipped — the ${name} condition is not supported.`);
+                return;
+            }
+            conditionTokens.push(`${mapped}=${list.join(",")}`);
+        }
+    }
+    const force = booleanField(rule, "force") ? "!" : "";
+    out.redirectLines.push([from, ...queryTokens, to, `${status}${force}`, ...conditionTokens].join(" "));
+}
+function headerBlock(matcher, headers) {
+    return [matcher, ...headers.map(([name, value]) => `  ${name}: ${value}`)].join("\n");
+}
+function convertVercelHeaderRule(rule, out) {
+    const source = stringField(rule, "source");
+    const label = `vercel.json headers ${source ?? "(missing source)"}`;
+    if (!source) {
+        out.notes.push(`${label}: skipped — missing source.`);
+        return;
+    }
+    if ("has" in rule || "missing" in rule) {
+        out.notes.push(`${label}: skipped — has/missing conditions are not supported.`);
+        return;
+    }
+    const converted = vercelSourceToPattern(source);
+    if (!converted) {
+        out.notes.push(`${label}: skipped — the source pattern does not map to _headers syntax.`);
+        return;
+    }
+    const entries = rule.headers;
+    const headers = (Array.isArray(entries) ? entries : [])
+        .map((entry) => {
+        const header = entry && typeof entry === "object" ? entry : null;
+        const key = stringField(header, "key");
+        const value = header && typeof header.value === "string" ? header.value : null;
+        return key && value !== null ? [key, value] : null;
+    })
+        .filter((entry) => entry !== null);
+    if (headers.length === 0) {
+        out.notes.push(`${label}: skipped — no header values.`);
+        return;
+    }
+    out.headerBlocks.push(headerBlock(converted.pattern, headers));
+}
+function convertNetlifyHeaderRule(rule, out) {
+    const matcher = stringField(rule, "for");
+    const label = `netlify.toml headers ${matcher ?? "(missing for)"}`;
+    const values = objectField(rule, "values");
+    if (!matcher || !values) {
+        out.notes.push(`${label}: skipped — missing for or values.`);
+        return;
+    }
+    const headers = Object.entries(values)
+        .map((entry) => {
+        const [name, value] = entry;
+        if (typeof value === "string") {
+            return [name, value];
+        }
+        if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
+            return [name, value.join(", ")];
+        }
+        return null;
+    })
+        .filter((entry) => entry !== null);
+    if (headers.length === 0) {
+        out.notes.push(`${label}: skipped — no header values.`);
+        return;
+    }
+    out.headerBlocks.push(headerBlock(matcher, headers));
+}
+export function convertPlatformRouting(configs) {
+    const out = { redirectLines: [], headerBlocks: [], notes: [] };
+    for (const config of configs) {
+        if (config.platform === "vercel") {
+            for (const rule of config.redirects) {
+                convertVercelRoutingRule(rule, "redirect", out);
+            }
+            for (const rule of config.rewrites) {
+                convertVercelRoutingRule(rule, "rewrite", out);
+            }
+            for (const rule of config.headers) {
+                convertVercelHeaderRule(rule, out);
+            }
+        }
+        if (config.platform === "netlify") {
+            // Netlify expresses rewrites as 200-status redirects; both arrive in
+            // `redirects`, already in (almost) `_redirects` syntax.
+            for (const rule of config.redirects) {
+                convertNetlifyRedirect(rule, out);
+            }
+            for (const rule of config.headers) {
+                convertNetlifyHeaderRule(rule, out);
+            }
+        }
+    }
+    return out;
+}
 function parsePackageJson(value) {
     const parsed = parseJsonObject(value);
     if (!parsed) {
@@ -243,50 +461,219 @@ function packageManagerForFiles(files) {
         return "yarn";
     return "npm";
 }
+const FRAMEWORKS = [
+    {
+        // Nextra is Next.js underneath (its docs deploy via `next build` +
+        // static export to `out`), so it must supersede the bare `next` row.
+        preset: "nextra",
+        dependency: "nextra",
+        outputDirectory: "out",
+        defaultBuildCommand: "next build",
+    },
+    {
+        preset: "next",
+        dependency: "next",
+        outputDirectory: "out",
+        defaultBuildCommand: "next build",
+    },
+    {
+        preset: "tanstack-start",
+        dependency: "@tanstack/react-start",
+        outputDirectory: "dist/client",
+    },
+    {
+        // Nuxt 3 `nuxt generate` pre-renders the site into .output/public
+        // (dist/ is just a compatibility symlink to it).
+        preset: "nuxt",
+        dependency: "nuxt",
+        outputDirectory: ".output/public",
+        defaultBuildCommand: "nuxt generate",
+    },
+    {
+        preset: "astro",
+        dependency: "astro",
+        configFiles: [
+            "astro.config.mjs",
+            "astro.config.js",
+            "astro.config.ts",
+            "astro.config.cjs",
+            "astro.config.mts",
+            "astro.config.cts",
+        ],
+        outputDirectory: "dist",
+        defaultBuildCommand: "astro build",
+    },
+    {
+        // VitePress scaffolds into ./docs and builds to <srcDir>/.vitepress/dist.
+        // Vite-based, so it must come before the bare `vite` row.
+        preset: "vitepress",
+        dependency: "vitepress",
+        outputDirectory: "docs/.vitepress/dist",
+        defaultBuildCommand: "vitepress build docs",
+    },
+    {
+        preset: "sveltekit",
+        dependency: "@sveltejs/kit",
+        outputDirectory: "build",
+    },
+    {
+        // SolidStart builds through vinxi; static assets land in .output/public.
+        preset: "solid-start",
+        dependency: "@solidjs/start",
+        outputDirectory: ".output/public",
+        defaultBuildCommand: "vinxi build",
+    },
+    {
+        // Qwik City starters build with the repo's `build` script (`qwik build`
+        // orchestrates the package.json build.* scripts, so there is no
+        // meaningful bare-binary default); static output lands in dist.
+        preset: "qwik",
+        dependency: "@builder.io/qwik-city",
+        outputDirectory: "dist",
+    },
+    {
+        preset: "gatsby",
+        dependency: "gatsby",
+        outputDirectory: "public",
+    },
+    {
+        preset: "remix",
+        dependency: "@remix-run/dev",
+        outputDirectory: "build/client",
+    },
+    {
+        preset: "docusaurus",
+        dependency: "@docusaurus/core",
+        outputDirectory: "build",
+    },
+    {
+        // RedwoodJS: `yarn rw build web` emits the static web side to web/dist.
+        preset: "redwoodjs",
+        dependency: "@redwoodjs/core",
+        configFiles: ["redwood.toml"],
+        outputDirectory: "web/dist",
+        defaultBuildCommand: "redwood build web",
+    },
+    {
+        // Angular CLI: `ng build` emits under dist/ (dist/<project>/browser on
+        // modern application builds; the runtime candidate scan finds the leaf).
+        preset: "angular",
+        dependency: "@angular/cli",
+        configFiles: ["angular.json"],
+        outputDirectory: "dist",
+        defaultBuildCommand: "ng build",
+    },
+    {
+        preset: "ember",
+        dependency: "ember-cli",
+        configFiles: ["ember-cli-build.js"],
+        outputDirectory: "dist",
+        defaultBuildCommand: "ember build",
+    },
+    {
+        preset: "gridsome",
+        dependency: "gridsome",
+        configFiles: ["gridsome.config.js"],
+        outputDirectory: "dist",
+        defaultBuildCommand: "gridsome build",
+    },
+    {
+        preset: "eleventy",
+        dependency: "@11ty/eleventy",
+        configFiles: [
+            ".eleventy.js",
+            "eleventy.config.js",
+            "eleventy.config.mjs",
+            "eleventy.config.cjs",
+        ],
+        outputDirectory: "_site",
+        defaultBuildCommand: "eleventy",
+    },
+    {
+        // Hexo is npm-managed, so the dependency is the signal; its _config.yml
+        // deliberately stays out of configFiles to avoid clashing with jekyll.
+        preset: "hexo",
+        dependency: "hexo",
+        outputDirectory: "public",
+        defaultBuildCommand: "hexo generate",
+    },
+    {
+        preset: "vite",
+        dependency: "vite",
+        configFiles: [
+            "vite.config.js",
+            "vite.config.ts",
+            "vite.config.mjs",
+            "vite.config.mts",
+            "vite.config.cjs",
+            "vite.config.cts",
+        ],
+        outputDirectory: "dist",
+        defaultBuildCommand: "vite build",
+    },
+    {
+        // Zola shares config.toml with legacy Hugo sites; a Zola site always has
+        // a templates/ directory, which legacy Hugo sites (layouts/) do not.
+        preset: "zola",
+        configFiles: ["config.toml"],
+        requiredFiles: ["templates"],
+        outputDirectory: "public",
+        defaultBuildCommand: "zola build",
+    },
+    {
+        preset: "hugo",
+        configFiles: ["hugo.toml", "config.toml"],
+        outputDirectory: "public",
+        defaultBuildCommand: "hugo",
+    },
+    {
+        preset: "jekyll",
+        configFiles: ["_config.yml", "_config.yaml"],
+        outputDirectory: "_site",
+        defaultBuildCommand: "bundle exec jekyll build",
+    },
+    {
+        preset: "mkdocs",
+        configFiles: ["mkdocs.yml", "mkdocs.yaml"],
+        outputDirectory: "site",
+        defaultBuildCommand: "mkdocs build",
+    },
+    {
+        // sphinx-quickstart default layout: conf.py at the root, no separate
+        // source dir, `sphinx-build -M html . _build` renders to _build/html.
+        preset: "sphinx",
+        configFiles: ["conf.py"],
+        outputDirectory: "_build/html",
+        defaultBuildCommand: "sphinx-build -M html . _build",
+    },
+    {
+        preset: "middleman",
+        configFiles: ["config.rb"],
+        requiredFiles: ["source"],
+        outputDirectory: "build",
+        defaultBuildCommand: "bundle exec middleman build",
+    },
+];
+function frameworkForPreset(frameworkPreset) {
+    return FRAMEWORKS.find((framework) => framework.preset === frameworkPreset) ?? null;
+}
+function hasRequiredFiles(framework, files) {
+    return (framework.requiredFiles ?? []).every((file) => files.has(file));
+}
 function detectFrameworkPreset(files, dependencies) {
-    if ("next" in dependencies)
-        return "next";
-    if ("@tanstack/react-start" in dependencies)
-        return "tanstack-start";
-    if ("vite" in dependencies)
-        return "vite";
-    if ("astro" in dependencies)
-        return "astro";
-    if ("@sveltejs/kit" in dependencies)
-        return "sveltekit";
-    if ("gatsby" in dependencies)
-        return "gatsby";
-    if ("@remix-run/dev" in dependencies)
-        return "remix";
-    if ("@docusaurus/core" in dependencies)
-        return "docusaurus";
-    if (files.has("hugo.toml") || files.has("config.toml"))
-        return "hugo";
-    if (files.has("_config.yml") || files.has("_config.yaml"))
-        return "jekyll";
-    return null;
+    const byDependency = FRAMEWORKS.find((framework) => framework.dependency !== undefined &&
+        framework.dependency in dependencies &&
+        hasRequiredFiles(framework, files));
+    if (byDependency)
+        return byDependency.preset;
+    const byConfigFile = FRAMEWORKS.find((framework) => framework.configFiles?.some((file) => files.has(file)) && hasRequiredFiles(framework, files));
+    return byConfigFile?.preset ?? null;
 }
 function outputDirectoryForFramework(frameworkPreset, files) {
-    switch (frameworkPreset) {
-        case "next":
-            return "out";
-        case "tanstack-start":
-            return "dist/client";
-        case "gatsby":
-            return "public";
-        case "sveltekit":
-            return "build";
-        case "remix":
-            return "build/client";
-        case "docusaurus":
-            return "build";
-        case "hugo":
-            return "public";
-        case "jekyll":
-            return "_site";
-        default:
-            return files.has("dist") ? "dist" : null;
-    }
+    const framework = frameworkForPreset(frameworkPreset);
+    if (framework)
+        return framework.outputDirectory;
+    return files.has("dist") ? "dist" : null;
 }
 function installCommandForManager(packageManager, packageJson) {
     switch (packageManager) {
@@ -303,11 +690,7 @@ function installCommandForManager(packageManager, packageJson) {
 function buildCommandForDefaults(packageJson, run, frameworkPreset) {
     if (packageJson?.scripts?.build)
         return `${run} build`;
-    if (frameworkPreset === "hugo")
-        return "hugo";
-    if (frameworkPreset === "jekyll")
-        return "bundle exec jekyll build";
-    return null;
+    return frameworkForPreset(frameworkPreset)?.defaultBuildCommand ?? null;
 }
 function packageDefaults(files, packageJsonText) {
     const packageJson = parsePackageJson(packageJsonText);

package/dist/utils/claim-token.d.ts

@@ -1 +1,9 @@
+export type ClaimCredential = {
+    kind: "token";
+    claimToken: string;
+} | {
+    kind: "nonce";
+    nonce: string;
+};
+export declare function classifyClaimCredential(raw: string | null | undefined): ClaimCredential | undefined;
 export declare function normalizeClaimToken(token: string | null | undefined): string | undefined;

package/dist/utils/claim-token.js

@@ -1,6 +1,27 @@
+const LEGACY_WORD_TOKEN_SHAPE = /^[a-z]+(?:-[a-z]+){2,}$/;
+export function classifyClaimCredential(raw) {
+    const trimmed = raw?.trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    if (trimmed.startsWith("sfc_")) {
+        return { kind: "token", claimToken: trimmed };
+    }
+    const normalized = normalizeClaimToken(trimmed);
+    if (normalized && LEGACY_WORD_TOKEN_SHAPE.test(normalized)) {
+        return { kind: "token", claimToken: normalized };
+    }
+    return { kind: "nonce", nonce: trimmed };
+}
 export function normalizeClaimToken(token) {
-    const normalized = token
-        ?.trim()
+    const trimmed = token?.trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    if (trimmed.startsWith("sfc_")) {
+        return trimmed;
+    }
+    const normalized = trimmed
         .toLowerCase()
         .split(/[\s_-]+/)
         .filter(Boolean)

package/dist/utils/content-type.d.ts

@@ -7,4 +7,5 @@
  * same content types when uploading and serving version files.
  */
 export declare function contentTypeForPath(filePath: string): string;
+export declare function textTypeForPath(filePath: string): string | null;
 export declare function contentTypeForBytes(filePath: string, bytes: Uint8Array): string;

package/dist/utils/content-type.js

@@ -73,7 +73,7 @@ function hasPrefix(bytes, prefix) {
 function hasAsciiPrefix(bytes, prefix) {
     return hasPrefix(bytes, Array.from(prefix, (char) => char.charCodeAt(0)));
 }
-function textTypeForPath(filePath) {
+export function textTypeForPath(filePath) {
     const contentType = contentTypeForPath(filePath);
     const normalized = contentType.split(";")[0]?.trim().toLowerCase();
     return normalized &&

package/dist/utils/credential-policy.d.ts

@@ -0,0 +1,54 @@
+import { type ApiKeyPreset, type ApiCredentialPolicy, type StatticAction } from "../contracts/api-keys.js";
+type RequestCondition = NonNullable<ApiCredentialPolicy["statements"][number]["conditions"]>;
+export type PolicyCompileInput = {
+    tenantId: string;
+    teamId: string;
+};
+export type PolicyAuthorizeInput = {
+    policy: ApiCredentialPolicy;
+    action: StatticAction;
+    /**
+     * Candidate resource URIs for one request target, evaluated together: spaces
+     * are addressed by their canonical site-rooted URI AND a principal-scoped
+     * candidate so principal wildcards cover them. A deny matching ANY candidate
+     * wins; otherwise an allow matching any candidate permits.
+     */
+    resource: string | readonly string[];
+    conditions?: RequestCondition;
+};
+export declare const publishActions: ("spaces:read" | "spaces:create" | "spaces:write" | "spaces:publish" | "versions:read" | "versions:promote" | "versions:download" | "builds:read" | "builds:create")[];
+export declare function compileApiKeyPreset(preset: ApiKeyPreset, input: PolicyCompileInput): ApiCredentialPolicy;
+export declare function compileTeamRolePolicy(input: PolicyCompileInput & {
+    role: string;
+}): ApiCredentialPolicy;
+export declare function compileSpaceContinuationPolicy(input: {
+    tenantId: string;
+    spaceId: string;
+}): ApiCredentialPolicy;
+export declare function allowPolicy(actions: StatticAction[], resources: string[]): ApiCredentialPolicy;
+export declare function denyAllPolicy(): ApiCredentialPolicy;
+export declare function policyIsSubsetOfGrantor(requested: ApiCredentialPolicy, grantor: ApiCredentialPolicy): boolean;
+export declare function policyAllows(input: PolicyAuthorizeInput): boolean;
+export declare function grantedTenantsFromPolicy(policy: ApiCredentialPolicy): {
+    all: boolean;
+    tenantIds: string[];
+};
+export declare function grantedPrincipalsFromPolicy(policy: ApiCredentialPolicy, input: {
+    tenantId: string;
+    principalType: "team" | "external";
+}): {
+    all: boolean;
+    principalIds: string[];
+    grants: ({
+        kind: "principal";
+        tenantId: string;
+        principalType: "team" | "external";
+        principalId: string;
+    } | {
+        kind: "space";
+        tenantId: string;
+        spaceId: string;
+    })[];
+};
+export declare function policyReaches(policy: ApiCredentialPolicy, resourceBase: string): boolean;
+export {};

package/dist/utils/{access-policy.js → credential-policy.js}

@@ -1,5 +1,5 @@
 import { SPACEFAST_ACCESS_POLICY_VERSION, parseStatticResource, } from "../contracts/api-keys.js";
-const publishActions = [
+export const publishActions = [
     "spaces:read",
     "spaces:create",
     "spaces:write",
@@ -35,6 +35,9 @@ const domainActions = [
 function teamResource(input) {
     return `stt://tenant/${input.tenantId}/principal/team/${input.teamId}/*`;
 }
+function spaceResource(input) {
+    return `stt://tenant/${input.tenantId}/space/${input.spaceId}`;
+}
 export function compileApiKeyPreset(preset, input) {
     const resource = teamResource(input);
     switch (preset) {
@@ -88,6 +91,9 @@ export function compileTeamRolePolicy(input) {
             return denyAllPolicy();
     }
 }
+export function compileSpaceContinuationPolicy(input) {
+    return allowPolicy(publishActions.filter((action) => action !== "spaces:create"), [spaceResource(input)]);
+}
 export function allowPolicy(actions, resources) {
     return {
         version: SPACEFAST_ACCESS_POLICY_VERSION,
@@ -145,6 +151,7 @@ export function grantedTenantsFromPolicy(policy) {
 // Used to scope list queries; specific actions still go through `policyAllows`.
 export function grantedPrincipalsFromPolicy(policy, input) {
     const principalIds = new Set();
+    const spaceIds = new Set();
     let all = false;
     for (const statement of policy.statements) {
         if (statement.effect !== "allow") {
@@ -169,9 +176,28 @@ export function grantedPrincipalsFromPolicy(policy, input) {
                     principalIds.add(parsed.principalId);
                 }
             }
+            else if (parsed.kind === "space") {
+                spaceIds.add(parsed.spaceId);
+            }
         }
     }
-    return { all, principalIds: [...principalIds] };
+    return {
+        all,
+        principalIds: [...principalIds],
+        grants: [
+            ...[...principalIds].map((principalId) => ({
+                kind: "principal",
+                tenantId: input.tenantId,
+                principalType: input.principalType,
+                principalId,
+            })),
+            ...[...spaceIds].map((spaceId) => ({
+                kind: "space",
+                tenantId: input.tenantId,
+                spaceId,
+            })),
+        ],
+    };
 }
 // Whether the policy's allow statements reach a resource subtree at all —
 // either a statement resource covers the base, or it lives inside the base.