@spacefast/common 0.2.2 → 0.4.1

package/dist/contracts/activity.js

@@ -9,7 +9,6 @@ export const ACTIVITY_EVENT_CODES = [
     // space
     "space.created",
     "space.claimed",
-    "feedback.lead_claim_pending",
     "space.transferred",
     "space.expired",
     "space.disabled",
@@ -17,6 +16,7 @@ export const ACTIVITY_EVENT_CODES = [
     "space.deleted",
     "space.config_updated",
     "space.slug_updated",
+    "space.wp_cli_run",
     // site
     "site.provision_requested",
     "site.burst_toggled",
@@ -41,6 +41,7 @@ export const ACTIVITY_EVENT_CODES = [
     "version.deleted",
     // channel
     "channel.promoted",
+    "channel.promotion_changed",
     // build
     "build.created",
     "build.succeeded",
@@ -99,6 +100,19 @@ export const ACTIVITY_EVENT_CODES = [
     "team.member_removed",
     "team.member_role_updated",
     "team.builds_deploys_quota_exceeded",
+    // connectors (a run parks when policy asks a person to decide the call)
+    "visitor_connection.created",
+    "visitor_connection.revoked",
+    "connector_binding.created",
+    "connector_binding.removed",
+    "connection.serving_granted",
+    "connection.serving_revoked",
+    "connector_policy.created",
+    "connector_policy.updated",
+    "connector_policy.deleted",
+    "connector_run.parked",
+    "connector_run.decided",
+    "connector_run.expired",
     // tenant
     "tenant.past_due",
     "tenant.suspended",
@@ -197,14 +211,23 @@ export function matchesActivityEventFilters(filters, code) {
         filter === code ||
         (filter.endsWith(".*") && code.startsWith(filter.slice(0, -1))));
 }
-export const activityActorSchema = z.discriminatedUnion("type", [
-    z.object({ type: z.literal("user"), id: z.string().min(1) }),
-    z.object({ type: z.literal("api_key"), id: z.string().min(1) }),
-    z.object({ type: z.literal("partner_token"), id: z.string().min(1) }),
-    z.object({ type: z.literal("oauth_client"), id: z.string().min(1) }),
-    z.object({ type: z.literal("anonymous_claim"), id: z.string().min(1) }),
-    z.object({ type: z.literal("system"), id: z.string().min(1) }),
-]);
+// Who performed an event. Grant-backed credentials (`api_key`, `oauth_client`)
+// stamp the grant id, so one actor id names a connection across its whole
+// lifetime — the same id the grant ledger rows carry.
+export const ACTIVITY_ACTOR_TYPES = [
+    "visitor",
+    "user",
+    "api_key",
+    "partner_token",
+    "oauth_client",
+    "anonymous_claim",
+    "system",
+];
+export const activityActorTypeSchema = z.enum(ACTIVITY_ACTOR_TYPES);
+export const activityActorSchema = z.object({
+    type: activityActorTypeSchema,
+    id: z.string().min(1),
+});
 export const activityPrincipalSchema = z.object({
     tenantId: z.string().min(1),
     principalType: z.enum(["team", "external"]),
@@ -230,6 +253,12 @@ export const activityQuerySchema = cursorListQuerySchema.extend({
         .describe("Filter by owning principal type."),
     principalId: z.string().min(1).optional().describe("Filter to one principal."),
     spaceId: z.string().min(1).optional().describe("Filter to one space."),
+    actorType: z.enum(ACTIVITY_ACTOR_TYPES).optional().describe("Filter by acting credential type."),
+    actorId: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Filter to one actor — a user id, grant id, or key id."),
     code: z
         .string()
         .min(1)

package/dist/contracts/api-keys.d.ts

@@ -3,15 +3,20 @@ export declare const SPACEFAST_ACCESS_POLICY_VERSION = "2026-06-09";
 export declare const StatticActionSchema: z.ZodEnum<{
     "teams:read": "teams:read";
     "teams:create": "teams:create";
+    "teams:members.write": "teams:members.write";
     "spaces:read": "spaces:read";
     "spaces:write": "spaces:write";
     "spaces:rename": "spaces:rename";
+    "spaces:delete": "spaces:delete";
+    "versions:download": "versions:download";
     "domains:read": "domains:read";
+    "connectors:read": "connectors:read";
+    "connectors:write": "connectors:write";
+    "connectors:execute": "connectors:execute";
     "spaces:publish": "spaces:publish";
     "builds:trigger": "builds:trigger";
     "*": "*";
     "spaces:create": "spaces:create";
-    "spaces:delete": "spaces:delete";
     "spaces:transfer": "spaces:transfer";
     "spaces:export": "spaces:export";
     "spaces:import": "spaces:import";
@@ -19,7 +24,6 @@ export declare const StatticActionSchema: z.ZodEnum<{
     "versions:read": "versions:read";
     "versions:promote": "versions:promote";
     "versions:delete": "versions:delete";
-    "versions:download": "versions:download";
     "domains:create": "domains:create";
     "domains:verify": "domains:verify";
     "domains:assign": "domains:assign";
@@ -40,7 +44,6 @@ export declare const StatticActionSchema: z.ZodEnum<{
     "principals:write": "principals:write";
     "infrastructure:read": "infrastructure:read";
     "teams:write": "teams:write";
-    "teams:members.write": "teams:members.write";
     "billing:read": "billing:read";
     "billing:write": "billing:write";
     "tokens:read": "tokens:read";
@@ -53,6 +56,17 @@ export declare const PARTNER_MANAGEMENT_ACTIONS: readonly ["tenants:read", "tena
 export type ParsedStatticResource = {
     kind: "tenant";
     tenantId: string;
+} | {
+    kind: "partner";
+    tenantId: string;
+    teamId: string;
+    wildcard: boolean;
+} | {
+    kind: "partner-principal";
+    tenantId: string;
+    teamId: string;
+    principalId: string;
+    wildcard: boolean;
 } | {
     kind: "principal";
     tenantId: string;
@@ -90,15 +104,20 @@ export declare const ApiCredentialPolicySchema: z.ZodObject<{
         actions: z.ZodArray<z.ZodEnum<{
             "teams:read": "teams:read";
             "teams:create": "teams:create";
+            "teams:members.write": "teams:members.write";
             "spaces:read": "spaces:read";
             "spaces:write": "spaces:write";
             "spaces:rename": "spaces:rename";
+            "spaces:delete": "spaces:delete";
+            "versions:download": "versions:download";
             "domains:read": "domains:read";
+            "connectors:read": "connectors:read";
+            "connectors:write": "connectors:write";
+            "connectors:execute": "connectors:execute";
             "spaces:publish": "spaces:publish";
             "builds:trigger": "builds:trigger";
             "*": "*";
             "spaces:create": "spaces:create";
-            "spaces:delete": "spaces:delete";
             "spaces:transfer": "spaces:transfer";
             "spaces:export": "spaces:export";
             "spaces:import": "spaces:import";
@@ -106,7 +125,6 @@ export declare const ApiCredentialPolicySchema: z.ZodObject<{
             "versions:read": "versions:read";
             "versions:promote": "versions:promote";
             "versions:delete": "versions:delete";
-            "versions:download": "versions:download";
             "domains:create": "domains:create";
             "domains:verify": "domains:verify";
             "domains:assign": "domains:assign";
@@ -127,7 +145,6 @@ export declare const ApiCredentialPolicySchema: z.ZodObject<{
             "principals:write": "principals:write";
             "infrastructure:read": "infrastructure:read";
             "teams:write": "teams:write";
-            "teams:members.write": "teams:members.write";
             "billing:read": "billing:read";
             "billing:write": "billing:write";
             "tokens:read": "tokens:read";
@@ -181,7 +198,11 @@ export declare const ApiKeySchema: z.ZodObject<{
         }>;
         id: z.ZodString;
     }, z.core.$strip>>;
-    createdByUserId: z.ZodString;
+    createdByUserId: z.ZodNullable<z.ZodString>;
+    collection: z.ZodEnum<{
+        team: "team";
+        tenant: "tenant";
+    }>;
     preset: z.ZodNullable<z.ZodEnum<{
         ci_deploy: "ci_deploy";
         space_publisher: "space_publisher";
@@ -202,15 +223,20 @@ export declare const ApiKeySchema: z.ZodObject<{
             actions: z.ZodArray<z.ZodEnum<{
                 "teams:read": "teams:read";
                 "teams:create": "teams:create";
+                "teams:members.write": "teams:members.write";
                 "spaces:read": "spaces:read";
                 "spaces:write": "spaces:write";
                 "spaces:rename": "spaces:rename";
+                "spaces:delete": "spaces:delete";
+                "versions:download": "versions:download";
                 "domains:read": "domains:read";
+                "connectors:read": "connectors:read";
+                "connectors:write": "connectors:write";
+                "connectors:execute": "connectors:execute";
                 "spaces:publish": "spaces:publish";
                 "builds:trigger": "builds:trigger";
                 "*": "*";
                 "spaces:create": "spaces:create";
-                "spaces:delete": "spaces:delete";
                 "spaces:transfer": "spaces:transfer";
                 "spaces:export": "spaces:export";
                 "spaces:import": "spaces:import";
@@ -218,7 +244,6 @@ export declare const ApiKeySchema: z.ZodObject<{
                 "versions:read": "versions:read";
                 "versions:promote": "versions:promote";
                 "versions:delete": "versions:delete";
-                "versions:download": "versions:download";
                 "domains:create": "domains:create";
                 "domains:verify": "domains:verify";
                 "domains:assign": "domains:assign";
@@ -239,7 +264,6 @@ export declare const ApiKeySchema: z.ZodObject<{
                 "principals:write": "principals:write";
                 "infrastructure:read": "infrastructure:read";
                 "teams:write": "teams:write";
-                "teams:members.write": "teams:members.write";
                 "billing:read": "billing:read";
                 "billing:write": "billing:write";
                 "tokens:read": "tokens:read";
@@ -301,7 +325,11 @@ export declare const ApiKeyListResponseSchema: z.ZodObject<{
             }>;
             id: z.ZodString;
         }, z.core.$strip>>;
-        createdByUserId: z.ZodString;
+        createdByUserId: z.ZodNullable<z.ZodString>;
+        collection: z.ZodEnum<{
+            team: "team";
+            tenant: "tenant";
+        }>;
         preset: z.ZodNullable<z.ZodEnum<{
             ci_deploy: "ci_deploy";
             space_publisher: "space_publisher";
@@ -322,15 +350,20 @@ export declare const ApiKeyListResponseSchema: z.ZodObject<{
                 actions: z.ZodArray<z.ZodEnum<{
                     "teams:read": "teams:read";
                     "teams:create": "teams:create";
+                    "teams:members.write": "teams:members.write";
                     "spaces:read": "spaces:read";
                     "spaces:write": "spaces:write";
                     "spaces:rename": "spaces:rename";
+                    "spaces:delete": "spaces:delete";
+                    "versions:download": "versions:download";
                     "domains:read": "domains:read";
+                    "connectors:read": "connectors:read";
+                    "connectors:write": "connectors:write";
+                    "connectors:execute": "connectors:execute";
                     "spaces:publish": "spaces:publish";
                     "builds:trigger": "builds:trigger";
                     "*": "*";
                     "spaces:create": "spaces:create";
-                    "spaces:delete": "spaces:delete";
                     "spaces:transfer": "spaces:transfer";
                     "spaces:export": "spaces:export";
                     "spaces:import": "spaces:import";
@@ -338,7 +371,6 @@ export declare const ApiKeyListResponseSchema: z.ZodObject<{
                     "versions:read": "versions:read";
                     "versions:promote": "versions:promote";
                     "versions:delete": "versions:delete";
-                    "versions:download": "versions:download";
                     "domains:create": "domains:create";
                     "domains:verify": "domains:verify";
                     "domains:assign": "domains:assign";
@@ -359,7 +391,6 @@ export declare const ApiKeyListResponseSchema: z.ZodObject<{
                     "principals:write": "principals:write";
                     "infrastructure:read": "infrastructure:read";
                     "teams:write": "teams:write";
-                    "teams:members.write": "teams:members.write";
                     "billing:read": "billing:read";
                     "billing:write": "billing:write";
                     "tokens:read": "tokens:read";
@@ -418,15 +449,20 @@ export declare const ApiKeyCreateRequestSchema: z.ZodObject<{
             actions: z.ZodArray<z.ZodEnum<{
                 "teams:read": "teams:read";
                 "teams:create": "teams:create";
+                "teams:members.write": "teams:members.write";
                 "spaces:read": "spaces:read";
                 "spaces:write": "spaces:write";
                 "spaces:rename": "spaces:rename";
+                "spaces:delete": "spaces:delete";
+                "versions:download": "versions:download";
                 "domains:read": "domains:read";
+                "connectors:read": "connectors:read";
+                "connectors:write": "connectors:write";
+                "connectors:execute": "connectors:execute";
                 "spaces:publish": "spaces:publish";
                 "builds:trigger": "builds:trigger";
                 "*": "*";
                 "spaces:create": "spaces:create";
-                "spaces:delete": "spaces:delete";
                 "spaces:transfer": "spaces:transfer";
                 "spaces:export": "spaces:export";
                 "spaces:import": "spaces:import";
@@ -434,7 +470,6 @@ export declare const ApiKeyCreateRequestSchema: z.ZodObject<{
                 "versions:read": "versions:read";
                 "versions:promote": "versions:promote";
                 "versions:delete": "versions:delete";
-                "versions:download": "versions:download";
                 "domains:create": "domains:create";
                 "domains:verify": "domains:verify";
                 "domains:assign": "domains:assign";
@@ -455,7 +490,6 @@ export declare const ApiKeyCreateRequestSchema: z.ZodObject<{
                 "principals:write": "principals:write";
                 "infrastructure:read": "infrastructure:read";
                 "teams:write": "teams:write";
-                "teams:members.write": "teams:members.write";
                 "billing:read": "billing:read";
                 "billing:write": "billing:write";
                 "tokens:read": "tokens:read";
@@ -496,15 +530,20 @@ export declare const ApiKeyPatchRequestSchema: z.ZodObject<{
             actions: z.ZodArray<z.ZodEnum<{
                 "teams:read": "teams:read";
                 "teams:create": "teams:create";
+                "teams:members.write": "teams:members.write";
                 "spaces:read": "spaces:read";
                 "spaces:write": "spaces:write";
                 "spaces:rename": "spaces:rename";
+                "spaces:delete": "spaces:delete";
+                "versions:download": "versions:download";
                 "domains:read": "domains:read";
+                "connectors:read": "connectors:read";
+                "connectors:write": "connectors:write";
+                "connectors:execute": "connectors:execute";
                 "spaces:publish": "spaces:publish";
                 "builds:trigger": "builds:trigger";
                 "*": "*";
                 "spaces:create": "spaces:create";
-                "spaces:delete": "spaces:delete";
                 "spaces:transfer": "spaces:transfer";
                 "spaces:export": "spaces:export";
                 "spaces:import": "spaces:import";
@@ -512,7 +551,6 @@ export declare const ApiKeyPatchRequestSchema: z.ZodObject<{
                 "versions:read": "versions:read";
                 "versions:promote": "versions:promote";
                 "versions:delete": "versions:delete";
-                "versions:download": "versions:download";
                 "domains:create": "domains:create";
                 "domains:verify": "domains:verify";
                 "domains:assign": "domains:assign";
@@ -533,7 +571,6 @@ export declare const ApiKeyPatchRequestSchema: z.ZodObject<{
                 "principals:write": "principals:write";
                 "infrastructure:read": "infrastructure:read";
                 "teams:write": "teams:write";
-                "teams:members.write": "teams:members.write";
                 "billing:read": "billing:read";
                 "billing:write": "billing:write";
                 "tokens:read": "tokens:read";
@@ -573,15 +610,20 @@ export declare const ApiKeyScopedCreateRequestSchema: z.ZodObject<{
     permissions: z.ZodArray<z.ZodEnum<{
         "teams:read": "teams:read";
         "teams:create": "teams:create";
+        "teams:members.write": "teams:members.write";
         "spaces:read": "spaces:read";
         "spaces:write": "spaces:write";
         "spaces:rename": "spaces:rename";
+        "spaces:delete": "spaces:delete";
+        "versions:download": "versions:download";
         "domains:read": "domains:read";
+        "connectors:read": "connectors:read";
+        "connectors:write": "connectors:write";
+        "connectors:execute": "connectors:execute";
         "spaces:publish": "spaces:publish";
         "builds:trigger": "builds:trigger";
         "*": "*";
         "spaces:create": "spaces:create";
-        "spaces:delete": "spaces:delete";
         "spaces:transfer": "spaces:transfer";
         "spaces:export": "spaces:export";
         "spaces:import": "spaces:import";
@@ -589,7 +631,6 @@ export declare const ApiKeyScopedCreateRequestSchema: z.ZodObject<{
         "versions:read": "versions:read";
         "versions:promote": "versions:promote";
         "versions:delete": "versions:delete";
-        "versions:download": "versions:download";
         "domains:create": "domains:create";
         "domains:verify": "domains:verify";
         "domains:assign": "domains:assign";
@@ -610,7 +651,6 @@ export declare const ApiKeyScopedCreateRequestSchema: z.ZodObject<{
         "principals:write": "principals:write";
         "infrastructure:read": "infrastructure:read";
         "teams:write": "teams:write";
-        "teams:members.write": "teams:members.write";
         "billing:read": "billing:read";
         "billing:write": "billing:write";
         "tokens:read": "tokens:read";
@@ -636,15 +676,20 @@ export declare const ApiKeyScopedPatchRequestSchema: z.ZodObject<{
     permissions: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         "teams:read": "teams:read";
         "teams:create": "teams:create";
+        "teams:members.write": "teams:members.write";
         "spaces:read": "spaces:read";
         "spaces:write": "spaces:write";
         "spaces:rename": "spaces:rename";
+        "spaces:delete": "spaces:delete";
+        "versions:download": "versions:download";
         "domains:read": "domains:read";
+        "connectors:read": "connectors:read";
+        "connectors:write": "connectors:write";
+        "connectors:execute": "connectors:execute";
         "spaces:publish": "spaces:publish";
         "builds:trigger": "builds:trigger";
         "*": "*";
         "spaces:create": "spaces:create";
-        "spaces:delete": "spaces:delete";
         "spaces:transfer": "spaces:transfer";
         "spaces:export": "spaces:export";
         "spaces:import": "spaces:import";
@@ -652,7 +697,6 @@ export declare const ApiKeyScopedPatchRequestSchema: z.ZodObject<{
         "versions:read": "versions:read";
         "versions:promote": "versions:promote";
         "versions:delete": "versions:delete";
-        "versions:download": "versions:download";
         "domains:create": "domains:create";
         "domains:verify": "domains:verify";
         "domains:assign": "domains:assign";
@@ -673,7 +717,6 @@ export declare const ApiKeyScopedPatchRequestSchema: z.ZodObject<{
         "principals:write": "principals:write";
         "infrastructure:read": "infrastructure:read";
         "teams:write": "teams:write";
-        "teams:members.write": "teams:members.write";
         "billing:read": "billing:read";
         "billing:write": "billing:write";
         "tokens:read": "tokens:read";

package/dist/contracts/api-keys.js

@@ -55,6 +55,12 @@ export const StatticActionSchema = z.enum([
     "tokens:read",
     "tokens:create",
     "tokens:revoke",
+    // Connectors are team-scoped integrations reaching a customer's own accounts,
+    // so executing one is its own verb: reading the catalog and registering a
+    // source never implies the authority to call Linear as them.
+    "connectors:read",
+    "connectors:write",
+    "connectors:execute",
     "runtime:manage",
     "*",
 ]);
@@ -92,6 +98,21 @@ export function parseStatticResource(value) {
     const wildcard = segments.at(-1) === "*";
     const path = wildcard ? segments.slice(0, -1) : segments;
     const [head, a, b, c] = path;
+    if (head === "partner" && isResourceSegment(a)) {
+        if (path.length === 2) {
+            return { kind: "partner", tenantId, teamId: a, wildcard };
+        }
+        if (path.length === 4 && b === "principal" && isResourceSegment(c)) {
+            return {
+                kind: "partner-principal",
+                tenantId,
+                teamId: a,
+                principalId: c,
+                wildcard,
+            };
+        }
+        return null;
+    }
     if (head === "principal" && (a === "team" || a === "external") && isResourceSegment(b)) {
         if (path.length !== 3) {
             return null;
@@ -124,7 +145,7 @@ const StatticResourceSchema = z
     .refine((value) => parseStatticResource(value) !== null, {
     message: "Resource must be a stt:// URI from the StatticResource union (tenant, principal, site, space, site space, domain, or domain-group).",
 })
-    .describe("Resource URI from the resource union: stt://tenant/{t}, …/principal/(team|external)/{id}[/*], …/site/{id}[/*], …/space/{id}[/*], …/site/{id}/space/{id}[/*], …/domain/{id}, or …/domain-group/{id}.");
+    .describe("Resource URI from the resource union: stt://tenant/{t}, …/partner/{team}[/*], …/partner/{team}/principal/{id}[/*], …/principal/(team|external)/{id}[/*], …/site/{id}[/*], …/space/{id}[/*], …/site/{id}/space/{id}[/*], …/domain/{id}, or …/domain-group/{id}.");
 export const ApiCredentialPolicySchema = z
     .object({
     version: z
@@ -189,7 +210,13 @@ export const ApiKeySchema = z.object({
     mode: tenantMode.describe("`test` when the key belongs to a linked test tenant, `live` otherwise."),
     subject: ApiKeySubjectSchema.nullable().describe("Subject the key acts as."),
     ownerPrincipal: ApiKeyOwnerPrincipalSchema.nullable().describe("Owning principal (ownership metadata, never the authorization gate)."),
-    createdByUserId: z.string().describe("User who created the key."),
+    createdByUserId: z
+        .string()
+        .nullable()
+        .describe("User who created the key, or null for automation. Tenant-key creators are recorded for audit and do not own the key's authority."),
+    collection: z
+        .enum(["team", "tenant"])
+        .describe("Disjoint resource collection this key addresses."),
     preset: ApiKeyPresetSchema.nullable().describe("Preset the policy was compiled from, if any."),
     teamScope: DeviceTeamScopeSchema.nullable().describe("Membership-following team scope for a device-login key, or null for legacy keys."),
     policy: ApiCredentialPolicySchema.nullable().describe("Effective access policy. A key authorizes by policy only."),