deepspace 0.19.5 → 0.21.0

package/dist/{public-CFAj1hL2.d.ts → public-DenQ1TsZ.d.ts}

@@ -1,4 +1,24 @@
 import { ReactNode, ReactElement, ComponentType } from 'react';
+import { z } from 'zod';
+
+declare const themeObjectSchema: z.ZodObject<{
+    accent: z.ZodOptional<z.ZodString>;
+    accentDark: z.ZodOptional<z.ZodString>;
+    background: z.ZodOptional<z.ZodString>;
+    density: z.ZodOptional<z.ZodEnum<{
+        comfortable: "comfortable";
+        compact: "compact";
+    }>>;
+    logo: z.ZodOptional<z.ZodString>;
+    logoDark: z.ZodOptional<z.ZodString>;
+    favicon: z.ZodOptional<z.ZodString>;
+    defaultMode: z.ZodOptional<z.ZodEnum<{
+        light: "light";
+        dark: "dark";
+        system: "system";
+    }>>;
+    strictMode: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
 
 type DocumentationAssistantAccess = 'disabled' | 'public' | 'authenticated';
 type DocumentationMcpAccess = 'disabled' | 'public';
@@ -10,11 +30,21 @@ interface DocumentationFontConfig {
     source?: string;
     format?: string;
 }
-interface DocumentationThemeConfig {
-    preset?: string;
-    accent?: string;
-    accentDark?: string;
-    background?: string;
+/**
+ * The `theme` object as authored in documentation.json — exactly the keys
+ * the config schema accepts under `theme.*`, derived from that schema so
+ * the two can never drift. Everything else (fonts, background decoration,
+ * styling, logo href) is configured through the Mintlify-style top-level
+ * keys and only exists on the resolved theme.
+ */
+type DocumentationThemeConfig = z.infer<typeof themeObjectSchema>;
+/**
+ * The fully resolved theme after config loading merges `theme.*` with the
+ * Mintlify top-level keys (`colors`, `logo`, `favicon`, `appearance`,
+ * `background`, `fonts`, `styling`). This is what the template and runtime
+ * consume; it is an output shape, never accepted as `theme.*` input.
+ */
+interface ResolvedDocumentationTheme extends DocumentationThemeConfig {
     backgroundDark?: string;
     backgroundDecoration?: 'none' | 'gradient' | 'grid';
     bodyFont?: DocumentationFontConfig;
@@ -22,12 +52,7 @@ interface DocumentationThemeConfig {
     monoFont?: DocumentationFontConfig;
     codeBlockMode?: 'dark' | 'system';
     eyebrowStyle?: 'section' | 'breadcrumbs' | 'none';
-    logo?: string;
-    logoDark?: string;
     logoHref?: string;
-    favicon?: string;
-    defaultMode?: 'light' | 'dark' | 'system';
-    strictMode?: boolean;
 }
 interface DocumentationLinkConfig {
     label: string;
@@ -79,7 +104,7 @@ interface DocumentationConfig {
     url?: string;
     /** Explicit custom hostnames that mount this documentation at `/`. */
     domains: string[];
-    theme: DocumentationThemeConfig;
+    theme: ResolvedDocumentationTheme;
     navigation?: DocumentationNavigationItem[];
     links: DocumentationLinkConfig[];
     footer: DocumentationLinkConfig[];

package/dist/server.d.ts

@@ -207,13 +207,9 @@ declare const UPLOAD_PART_BYTES: number;
 /**
  * The highest part number the server accepts.
  *
- * The handler holds no per-session state, so this — not the declared total —
- * is what bounds an in-flight upload. It is computed against
- * {@link UPLOAD_PART_BYTES}, which is why the server refuses a part larger
- * than that even though a whole small file may be 25 MiB: admitting 25 MiB
- * parts would make the real in-flight bound 52 × 25 MiB = 1300 MiB while the
- * advertised ceiling stayed 1 GiB. With both numbers agreeing, a session's
- * worst case is 52 × 20 MiB = 1040 MiB — the ceiling plus one part.
+ * The server derives the only valid part number and byte length from the
+ * declared total and {@link UPLOAD_PART_BYTES}. The maximum part count is
+ * therefore the exact number needed to reach the file ceiling.
  *
  * R2 allows 10,000 parts, so this is far inside what the API permits.
  */
@@ -253,6 +249,25 @@ declare function storageQuotaMessage(incomingBytes: number, usedBytes: number, l
 declare const MAX_DEPLOY_ASSET_FILE_BYTES: number;
 declare function formatBytes(bytes: number): string;
 
+/**
+ * Everything the files handler needs to enforce one account allocation.
+ *
+ * `quotaKey` is required because an exact scan followed by an uncoordinated
+ * write cannot enforce a limit under concurrency. Callers that do not want a
+ * quota omit `storage`; callers that do want one must name its serialized
+ * summary.
+ */
+interface StorageAdmission {
+    /** The app prefix receiving this request's write. */
+    prefix: string;
+    /** Internal R2 key for the account's ETag-serialized usage summary. */
+    quotaKey: string;
+    /** Resolve the account's limit. `null` fails writes closed. */
+    limitBytes: () => Promise<number | null>;
+    /** Resolve the other app prefixes in the account. `null` fails closed. */
+    siblingPrefixes?: () => Promise<string[] | null>;
+}
+
 /**
  * Shared Scoped R2 Files Handler
  *
@@ -296,6 +311,7 @@ interface ScopeContext {
 }
 type PrefixResult = {
     prefix: string;
+    excludedPrefixes?: readonly string[];
     error?: undefined;
 } | {
     prefix?: undefined;
@@ -318,32 +334,12 @@ interface ScopedR2Config {
  * mount. The handler is the enforcer; the mount only knows whose limit
  * applies.
  */
-interface StorageAdmission {
-    /** This app's own prefix — the one the incoming write lands under. */
-    prefix: string;
-    /**
-     * Resolve the owner's limit in bytes. `null` means the lookup failed;
-     * writes then fail closed (503) rather than admitting unmetered storage.
-     */
-    limitBytes: () => Promise<number | null>;
-    /**
-     * The OTHER app prefixes this owner's storage spans, if any.
-     *
-     * The limit is per ACCOUNT, not per app: an owner's allocation is the total
-     * across everything they own, so admission has to see the siblings too. `[]`
-     * for an owner with one app, which is the common case and costs exactly what
-     * it did when this was a per-app limit.
-     *
-     * Returning `null` means the owner's apps could not be enumerated. Like a
-     * failed limit lookup that fails the write closed rather than admitting a
-     * write against an allocation we cannot measure.
-     */
-    siblingPrefixes?: () => Promise<string[] | null>;
-}
 interface ScopedR2Auth {
     userId: string | null;
     /** Absent = no quota on this mount (e.g. an app's own bucket). */
     storage?: StorageAdmission;
+    /** Account-wide quota details are private to an authorized owner surface. */
+    includeStorageUsage?: boolean;
 }
 type ScopedR2Handler = (request: Request, url: URL, bucket: R2Bucket, auth: ScopedR2Auth) => Promise<Response>;
 declare function isFilesVerbPath(method: string, subpath: string): boolean;
@@ -1536,6 +1532,7 @@ declare const MSG: {
     readonly CRON_PAUSE: "cron.pause";
     readonly CRON_RESUME: "cron.resume";
     readonly CRON_STATUS: "cron.status";
+    readonly CRON_ACK: "cron.ack";
     readonly JOB_ENQUEUE: "job.enqueue";
     readonly JOB_CANCEL: "job.cancel";
     readonly JOB_RETRY: "job.retry";
@@ -1703,6 +1700,16 @@ type ServerMessage = BaseMessage<typeof MSG.QUERY_RESULT, {
 }> | BaseMessage<typeof MSG.CRON_STATUS, {
     tasks: unknown;
     recentHistory: unknown;
+}> | BaseMessage<typeof MSG.CRON_ACK, {
+    requestId: string;
+    taskName: string;
+    ok: true;
+} | {
+    requestId: string;
+    taskName?: string;
+    ok: false;
+    reason: 'read_only' | 'unknown_task' | 'failed';
+    error?: string;
 }> | BaseMessage<typeof MSG.JOB_UPDATE, {
     kind: 'snapshot' | 'enqueued' | 'progress' | 'succeeded' | 'failed' | 'canceled' | 'retried';
     job?: unknown;
@@ -2317,12 +2324,22 @@ declare abstract class CronRoom<E = Record<string, unknown>> extends BaseRoom<E>
         type: string;
         [key: string]: unknown;
     }): Promise<void>;
+    private dispatchMessage;
     protected onAlarm(): Promise<void>;
     private executeTask;
     private scheduleNextAlarm;
     private getTaskStates;
     private getRecentHistory;
     private broadcastStatus;
+    /**
+     * Receipt for a mutation frame, addressed only to its sender. Receipts
+     * are opt-in by correlation id: frames without a `requestId` keep the
+     * fire-and-forget contract, so the (untyped) `requestId` from the wire
+     * is the single gate here rather than a check at every call site.
+     * Frames go through the shared `serverBuild` constructors so the wire
+     * shape is enforced by the protocol types, not re-spelled here.
+     */
+    private ackMutation;
     /**
      * Execute a scheduled task by name.
      * Called both by the alarm scheduler and manual trigger.