@spacefast/common 0.0.12 → 0.0.13

package/dist/docs/catalog.d.ts

@@ -42,6 +42,15 @@ export declare const DOCS_CATALOG: readonly [{
     readonly keywords: readonly ["publish", "go live", "upload", "release", "static"];
     readonly url: "https://spacefast.com/docs/publishing";
     readonly body: "`sf publish` snapshots your output directory into an immutable version and promotes it to the production channel. Use `--no-wait` to return before serving finishes.";
+}, {
+    readonly slug: "spaces/rename";
+    readonly title: "Rename a space";
+    readonly kind: "guide";
+    readonly tier: "full";
+    readonly summary: "Change a space slug and its managed view.fast address without breaking old links.";
+    readonly keywords: readonly ["space", "rename", "slug", "view.fast", "redirect", "managed hostname"];
+    readonly url: "https://spacefast.com/docs/spaces/rename";
+    readonly body: "Run `sf spaces update --space <space> --slug <new-slug> --wait`, or PATCH `/v1/spaces/{spaceId}` with `{ \"slug\": \"<new-slug>\" }`. The managed view.fast hostname changes with the slug. Former managed addresses and branch aliases redirect directly to their current counterparts with a temporary, path- and query-preserving 307 for the life of the space unless an operator explicitly releases them. Custom domains stay attached, and immutable version URLs do not change.";
 }, {
     readonly slug: "versions-and-rollback";
     readonly title: "Versions and rollback";
@@ -83,10 +92,10 @@ export declare const DOCS_CATALOG: readonly [{
     readonly title: "Publish receipt fields";
     readonly kind: "workflow";
     readonly tier: "full";
-    readonly summary: "Use the receipt as the source of truth: space.liveUrl, version.immutableUrl, shareBlurb, claim.url, claim.expiresAt, links, diagnostics, and errors.";
+    readonly summary: "Use the receipt as the source of truth: space.liveUrl, open.url, version.immutableUrl, claim.url, claim.expiresAt, links, diagnostics, and errors.";
     readonly keywords: readonly ["receipt", "share", "claim", "diagnostics"];
     readonly url: "https://spacefast.com/docs/api#publish";
-    readonly body: "receipt liveUrl immutableUrl shareBlurb claim url expiresAt diagnostics links finalize promote upload errors docsUrl";
+    readonly body: "receipt liveUrl open url immutableUrl claim expiresAt diagnostics links finalize promote upload errors docsUrl";
 }, {
     readonly slug: "workflow/continue-after-claim";
     readonly title: "Keep publishing after the user claims";
@@ -110,10 +119,10 @@ export declare const DOCS_CATALOG: readonly [{
     readonly title: "CLI command surface";
     readonly kind: "workflow";
     readonly tier: "full";
-    readonly summary: "Use sf for repeat work: publish, versions, rollback, logs, domains, passwords, teams, API calls, and On-Device MCP serving.";
+    readonly summary: "Use sf for repeat work: publish, versions, rollback, logs, domains, sharing, teams, API calls, and On-Device MCP serving.";
     readonly keywords: readonly ["sf", "cli", "spacefast", "mcp", "json"];
     readonly url: "https://spacefast.com/docs/cli";
-    readonly body: "sf spacefast CLI publish versions rollback logs domains passwords teams api mcp setup profile login --json";
+    readonly body: "sf spacefast CLI publish versions rollback logs domains share teams api mcp setup profile login --json";
 }, {
     readonly slug: "workflow/mcp-local";
     readonly title: "On-Device MCP through the CLI";
@@ -149,7 +158,7 @@ export declare const DOCS_CATALOG: readonly [{
     readonly summary: "Spacefast recognizes _redirects, _headers, nearest 404.html, and sf.jsonc. Static artifacts are served as files; server code is not executed.";
     readonly keywords: readonly ["_redirects", "_headers", "sf.jsonc", "spacefast.jsonc", "404"];
     readonly url: "https://spacefast.com/docs/configuration";
-    readonly body: "_redirects _headers 404.html sf.jsonc static artifact server code not executed proxy rewrite headers basic auth";
+    readonly body: "_redirects _headers 404.html sf.jsonc static artifact server code not executed proxy rewrite headers";
 }, {
     readonly slug: "workflow/domains-diagnostics";
     readonly title: "Domains and DNS diagnostics";
@@ -209,10 +218,10 @@ export declare const DOCS_CATALOG: readonly [{
     readonly title: "Access control";
     readonly kind: "guide";
     readonly tier: "full";
-    readonly summary: "Password-protect a space or grant access to specific people.";
-    readonly keywords: readonly ["access", "password", "grant", "ban", "private", "audience", "auth"];
+    readonly summary: "Create scoped Grants, invite People, and manage Links or credentials.";
+    readonly keywords: readonly ["access", "share", "people", "links", "private", "team", "public"];
     readonly url: "https://spacefast.com/docs/access";
-    readonly body: "Gate a space with `sf password set`, grant individuals with `sf access grant`, and review effective rules with `sf access effective`.";
+    readonly body: "Use `sf share grant`, `sf share people`, `sf share link`, `sf share password`, or `sf share token`. Inspect one route with `sf share check`; every audience uses the same path, capability, target, and constraint evaluator.";
 }, {
     readonly slug: "redirects";
     readonly title: "Redirects";
@@ -227,10 +236,10 @@ export declare const DOCS_CATALOG: readonly [{
     readonly title: "Custom headers";
     readonly kind: "guide";
     readonly tier: "full";
-    readonly summary: "Attach response headers and path-scoped Basic Auth.";
-    readonly keywords: readonly ["headers", "cache", "security", "basic auth", "_headers", "cors"];
+    readonly summary: "Attach supported response headers by path.";
+    readonly keywords: readonly ["headers", "cache", "security", "_headers", "cors"];
     readonly url: "https://spacefast.com/docs/headers";
-    readonly body: "Add a `_headers` file at your publish root to set or remove response headers per path. Path-scoped Basic Auth credentials travel with the publish.";
+    readonly body: "Add a `_headers` file at your publish root to set or remove supported response headers per path.";
 }, {
     readonly slug: "builds";
     readonly title: "Build from Git";
@@ -239,7 +248,7 @@ export declare const DOCS_CATALOG: readonly [{
     readonly summary: "Connect a repository so pushes build and publish automatically.";
     readonly keywords: readonly ["build", "git", "github", "ci", "push", "connect", "preview"];
     readonly url: "https://spacefast.com/docs/builds";
-    readonly body: "Connect a repository with `sf git connect`; each push runs your build on Spacefast and publishes a version, with branches and pull requests getting preview URLs.";
+    readonly body: "Connect a repository with `sf git connect`; each push runs your build on Spacefast and publishes a version. Branch and pull-request previews are private by default; use Open for yourself or create a scoped Link for reviewers.";
 }, {
     readonly slug: "collab";
     readonly title: "Comments";
@@ -434,10 +443,10 @@ export declare const DOCS_CATALOG: readonly [{
     readonly title: "sf access";
     readonly kind: "cli";
     readonly tier: "full";
-    readonly summary: "Grant, ban, and inspect who can view a space.";
-    readonly keywords: readonly ["access", "grant", "ban", "password", "effective", "rules", "policy"];
+    readonly summary: "Emergency visitor-session revocation.";
+    readonly keywords: readonly ["access", "sessions", "revoke", "logout"];
     readonly url: "https://spacefast.com/docs/cli";
-    readonly body: "`sf access grant` / `sf access ban` edit access rules; `sf access effective` shows the resolved policy. Use `sf password set` for a shared password.";
+    readonly body: "Use `sf access logout-all` to revoke every opened visitor session. Define audience-specific network restrictions on the corresponding Grant.";
 }, {
     readonly slug: "cli/teams";
     readonly title: "sf teams";
@@ -527,7 +536,7 @@ export declare const DOCS_CATALOG: readonly [{
     readonly summary: "Create, list, and update spaces over HTTP.";
     readonly keywords: readonly ["api", "spaces", "space", "create", "list", "endpoint"];
     readonly url: "https://spacefast.com/docs/api";
-    readonly body: "`GET /v1/spaces` lists spaces; `POST /v1/spaces` creates one. Responses carry the space id, slug, and live URL.";
+    readonly body: "`GET /v1/spaces` lists spaces; `POST /v1/spaces` creates one. `PATCH /v1/spaces/{spaceId}` with a slug-only body renames the space and managed hostname. Former managed addresses temporarily 307 to the current hostname while immutable version URLs stay unchanged. Responses carry the space id, slug, and live URL.";
 }, {
     readonly slug: "api/versions";
     readonly title: "Versions API";
@@ -590,16 +599,16 @@ export declare const DOCS_CATALOG: readonly [{
     readonly summary: "Connect a repository so pushes publish automatically.";
     readonly keywords: readonly ["github", "git", "ci", "push", "connect", "automatic", "recipe"];
     readonly url: "https://spacefast.com/docs/builds";
-    readonly body: "Connect a repository with `sf git connect`; each push builds on Spacefast and publishes a version, with pull requests getting preview URLs.";
+    readonly body: "Connect a repository with `sf git connect`; each push builds on Spacefast and publishes a version. Pull-request previews stay private until you create a scoped Link for reviewers.";
 }, {
     readonly slug: "recipes/preview-channels";
     readonly title: "Preview channels for pull requests";
     readonly kind: "recipe";
     readonly tier: "full";
-    readonly summary: "Give every branch a shareable preview URL.";
+    readonly summary: "Give every branch a private preview with explicit sharing.";
     readonly keywords: readonly ["preview", "channel", "branch", "pull request", "staging", "recipe"];
     readonly url: "https://spacefast.com/docs/builds";
-    readonly body: "Push a branch or open a pull request on a connected repository, or publish to a named channel, to get an isolated preview URL without touching production.";
+    readonly body: "Push a branch or open a pull request on a connected repository, or publish to a named channel, to get an isolated private preview without touching production. Use Open for your own browser or create a scoped Link when someone else needs access.";
 }, {
     readonly slug: "recipes/agent-publish";
     readonly title: "Let an agent publish for you";
@@ -618,15 +627,6 @@ export declare const DOCS_CATALOG: readonly [{
     readonly keywords: readonly ["domain", "custom domain", "dns", "tls", "https", "recipe"];
     readonly url: "https://spacefast.com/help/domains";
     readonly body: "Add the domain with `sf domains add`, set the DNS records Spacefast prints, and wait for `sf domains check` to report a ready certificate.";
-}, {
-    readonly slug: "recipes/password-protect";
-    readonly title: "Password-protect a space";
-    readonly kind: "recipe";
-    readonly tier: "full";
-    readonly summary: "Put one shared password in front of a whole space.";
-    readonly keywords: readonly ["password", "protect", "private", "access", "gate", "recipe"];
-    readonly url: "https://spacefast.com/help/access";
-    readonly body: "Run `sf password set` to gate a space behind a single shared secret; clear it later with `sf password clear`.";
 }, {
     readonly slug: "recipes/redirects";
     readonly title: "Set up redirects";

package/dist/docs/catalog.js

@@ -43,6 +43,16 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         url: `${DOCS_BASE_URL}/publishing`,
         body: "`sf publish` snapshots your output directory into an immutable version and promotes it to the production channel. Use `--no-wait` to return before serving finishes.",
     },
+    {
+        slug: "spaces/rename",
+        title: "Rename a space",
+        kind: "guide",
+        tier: "full",
+        summary: "Change a space slug and its managed view.fast address without breaking old links.",
+        keywords: ["space", "rename", "slug", "view.fast", "redirect", "managed hostname"],
+        url: `${DOCS_BASE_URL}/spaces/rename`,
+        body: 'Run `sf spaces update --space <space> --slug <new-slug> --wait`, or PATCH `/v1/spaces/{spaceId}` with `{ "slug": "<new-slug>" }`. The managed view.fast hostname changes with the slug. Former managed addresses and branch aliases redirect directly to their current counterparts with a temporary, path- and query-preserving 307 for the life of the space unless an operator explicitly releases them. Custom domains stay attached, and immutable version URLs do not change.',
+    },
     {
         slug: "versions-and-rollback",
         title: "Versions and rollback",
@@ -89,10 +99,10 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         title: "Publish receipt fields",
         kind: "workflow",
         tier: "full",
-        summary: "Use the receipt as the source of truth: space.liveUrl, version.immutableUrl, shareBlurb, claim.url, claim.expiresAt, links, diagnostics, and errors.",
+        summary: "Use the receipt as the source of truth: space.liveUrl, open.url, version.immutableUrl, claim.url, claim.expiresAt, links, diagnostics, and errors.",
         keywords: ["receipt", "share", "claim", "diagnostics"],
         url: `${DOCS_BASE_URL}/api#publish`,
-        body: "receipt liveUrl immutableUrl shareBlurb claim url expiresAt diagnostics links finalize promote upload errors docsUrl",
+        body: "receipt liveUrl open url immutableUrl claim expiresAt diagnostics links finalize promote upload errors docsUrl",
     },
     {
         slug: "workflow/continue-after-claim",
@@ -125,10 +135,10 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         title: "CLI command surface",
         kind: "workflow",
         tier: "full",
-        summary: "Use sf for repeat work: publish, versions, rollback, logs, domains, passwords, teams, API calls, and On-Device MCP serving.",
+        summary: "Use sf for repeat work: publish, versions, rollback, logs, domains, sharing, teams, API calls, and On-Device MCP serving.",
         keywords: ["sf", "cli", "spacefast", "mcp", "json"],
         url: `${DOCS_BASE_URL}/cli`,
-        body: "sf spacefast CLI publish versions rollback logs domains passwords teams api mcp setup profile login --json",
+        body: "sf spacefast CLI publish versions rollback logs domains share teams api mcp setup profile login --json",
     },
     {
         slug: "workflow/mcp-local",
@@ -177,7 +187,7 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         summary: "Spacefast recognizes _redirects, _headers, nearest 404.html, and sf.jsonc. Static artifacts are served as files; server code is not executed.",
         keywords: ["_redirects", "_headers", "sf.jsonc", "spacefast.jsonc", "404"],
         url: `${DOCS_BASE_URL}/configuration`,
-        body: "_redirects _headers 404.html sf.jsonc static artifact server code not executed proxy rewrite headers basic auth",
+        body: "_redirects _headers 404.html sf.jsonc static artifact server code not executed proxy rewrite headers",
     },
     {
         slug: "workflow/domains-diagnostics",
@@ -244,10 +254,10 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         title: "Access control",
         kind: "guide",
         tier: "full",
-        summary: "Password-protect a space or grant access to specific people.",
-        keywords: ["access", "password", "grant", "ban", "private", "audience", "auth"],
+        summary: "Create scoped Grants, invite People, and manage Links or credentials.",
+        keywords: ["access", "share", "people", "links", "private", "team", "public"],
         url: `${DOCS_BASE_URL}/access`,
-        body: "Gate a space with `sf password set`, grant individuals with `sf access grant`, and review effective rules with `sf access effective`.",
+        body: "Use `sf share grant`, `sf share people`, `sf share link`, `sf share password`, or `sf share token`. Inspect one route with `sf share check`; every audience uses the same path, capability, target, and constraint evaluator.",
     },
     {
         slug: "redirects",
@@ -264,10 +274,10 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         title: "Custom headers",
         kind: "guide",
         tier: "full",
-        summary: "Attach response headers and path-scoped Basic Auth.",
-        keywords: ["headers", "cache", "security", "basic auth", "_headers", "cors"],
+        summary: "Attach supported response headers by path.",
+        keywords: ["headers", "cache", "security", "_headers", "cors"],
         url: `${DOCS_BASE_URL}/headers`,
-        body: "Add a `_headers` file at your publish root to set or remove response headers per path. Path-scoped Basic Auth credentials travel with the publish.",
+        body: "Add a `_headers` file at your publish root to set or remove supported response headers per path.",
     },
     {
         slug: "builds",
@@ -277,7 +287,7 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         summary: "Connect a repository so pushes build and publish automatically.",
         keywords: ["build", "git", "github", "ci", "push", "connect", "preview"],
         url: `${DOCS_BASE_URL}/builds`,
-        body: "Connect a repository with `sf git connect`; each push runs your build on Spacefast and publishes a version, with branches and pull requests getting preview URLs.",
+        body: "Connect a repository with `sf git connect`; each push runs your build on Spacefast and publishes a version. Branch and pull-request previews are private by default; use Open for yourself or create a scoped Link for reviewers.",
     },
     {
         slug: "collab",
@@ -495,10 +505,10 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         title: "sf access",
         kind: "cli",
         tier: "full",
-        summary: "Grant, ban, and inspect who can view a space.",
-        keywords: ["access", "grant", "ban", "password", "effective", "rules", "policy"],
+        summary: "Emergency visitor-session revocation.",
+        keywords: ["access", "sessions", "revoke", "logout"],
         url: `${DOCS_BASE_URL}/cli`,
-        body: "`sf access grant` / `sf access ban` edit access rules; `sf access effective` shows the resolved policy. Use `sf password set` for a shared password.",
+        body: "Use `sf access logout-all` to revoke every opened visitor session. Define audience-specific network restrictions on the corresponding Grant.",
     },
     {
         slug: "cli/teams",
@@ -599,7 +609,7 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         summary: "Create, list, and update spaces over HTTP.",
         keywords: ["api", "spaces", "space", "create", "list", "endpoint"],
         url: `${DOCS_BASE_URL}/api`,
-        body: "`GET /v1/spaces` lists spaces; `POST /v1/spaces` creates one. Responses carry the space id, slug, and live URL.",
+        body: "`GET /v1/spaces` lists spaces; `POST /v1/spaces` creates one. `PATCH /v1/spaces/{spaceId}` with a slug-only body renames the space and managed hostname. Former managed addresses temporarily 307 to the current hostname while immutable version URLs stay unchanged. Responses carry the space id, slug, and live URL.",
     },
     {
         slug: "api/versions",
@@ -670,17 +680,17 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         summary: "Connect a repository so pushes publish automatically.",
         keywords: ["github", "git", "ci", "push", "connect", "automatic", "recipe"],
         url: `${DOCS_BASE_URL}/builds`,
-        body: "Connect a repository with `sf git connect`; each push builds on Spacefast and publishes a version, with pull requests getting preview URLs.",
+        body: "Connect a repository with `sf git connect`; each push builds on Spacefast and publishes a version. Pull-request previews stay private until you create a scoped Link for reviewers.",
     },
     {
         slug: "recipes/preview-channels",
         title: "Preview channels for pull requests",
         kind: "recipe",
         tier: "full",
-        summary: "Give every branch a shareable preview URL.",
+        summary: "Give every branch a private preview with explicit sharing.",
         keywords: ["preview", "channel", "branch", "pull request", "staging", "recipe"],
         url: `${DOCS_BASE_URL}/builds`,
-        body: "Push a branch or open a pull request on a connected repository, or publish to a named channel, to get an isolated preview URL without touching production.",
+        body: "Push a branch or open a pull request on a connected repository, or publish to a named channel, to get an isolated private preview without touching production. Use Open for your own browser or create a scoped Link when someone else needs access.",
     },
     {
         slug: "recipes/agent-publish",
@@ -702,16 +712,6 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         url: "https://spacefast.com/help/domains",
         body: "Add the domain with `sf domains add`, set the DNS records Spacefast prints, and wait for `sf domains check` to report a ready certificate.",
     },
-    {
-        slug: "recipes/password-protect",
-        title: "Password-protect a space",
-        kind: "recipe",
-        tier: "full",
-        summary: "Put one shared password in front of a whole space.",
-        keywords: ["password", "protect", "private", "access", "gate", "recipe"],
-        url: "https://spacefast.com/help/access",
-        body: "Run `sf password set` to gate a space behind a single shared secret; clear it later with `sf password clear`.",
-    },
     {
         slug: "recipes/redirects",
         title: "Set up redirects",

package/dist/docs/error-docs.js

@@ -28,6 +28,10 @@ export const ERROR_DOCS = {
         summary: "The authorization request was denied by the user.",
         fix: "Restart the login flow and approve the request to continue.",
     },
+    access_scope_suggestion: {
+        summary: "Published dependencies cluster under paths that may be useful as explicit public scopes.",
+        fix: "If those files are safe for anyone to read, make only the suggested scopes Public. Otherwise leave access unchanged.",
+    },
     agent_handoff_declined: {
         summary: "The app-private agent handoff cannot be redeemed.",
         fix: "Ask the user to create a fresh handoff for this Space and client, then redeem that new link once.",
@@ -173,7 +177,7 @@ export const ERROR_DOCS = {
         fix: "Upgrade the CLI to the latest release and retry.",
     },
     comment_screenshot_rate_limited: {
-        summary: "Too many anonymous comment screenshot uploads were attempted.",
+        summary: "Too many comment screenshot uploads were attempted.",
         fix: "Wait for the one-minute window to reset, then retry the screenshot upload.",
     },
     config_file_too_large: {
@@ -194,11 +198,11 @@ export const ERROR_DOCS = {
     },
     continuation_unavailable: {
         summary: "This claim token can no longer be exchanged for an access token.",
-        fix: "If the space is claimed, ask its owner for an access token (dashboard: Account → Access tokens). If it is still unclaimed, keep using the claim token as bearer auth instead of exchanging it. Still stuck? POST /v1/feedback with the error code and request id.",
+        fix: "If the space is claimed, ask its owner for an API key (dashboard: Account → API keys). If it is still unclaimed, keep using the claim token as bearer auth instead of exchanging it. Still stuck? POST /v1/feedback with the error code and request id.",
     },
     continuation_used: {
         summary: "This claim token was already exchanged for a durable access token.",
-        fix: "Authenticate with the exchanged access token (check .spacefast/state.json or wherever it was saved). If it was lost, ask the space owner to mint a new access token.",
+        fix: "Authenticate with the exchanged access token (check .spacefast/state.json or wherever it was saved). If it was lost, ask the space owner to create a new API key.",
     },
     credential_expired: {
         summary: "The credential used for this request has expired.",
@@ -476,10 +480,6 @@ export const ERROR_DOCS = {
         summary: "Proxy routes to external upstreams are not available on the Free plan.",
         fix: "Remove the proxy rules before publishing. Still stuck? POST /v1/feedback with the error code and request id.",
     },
-    free_headers_basic_auth_disabled: {
-        summary: "Basic-Auth via _headers is not available on the Free plan.",
-        fix: "Use space password protection instead. Still stuck? POST /v1/feedback with the error code and request id.",
-    },
     google_play_webhook_identity_not_configured: {
         summary: "Google Play Pub/Sub push authentication is not configured on this deployment.",
         fix: "Configure the exact push audience and dedicated Pub/Sub service-account email before enabling RTDN delivery.",
@@ -492,10 +492,6 @@ export const ERROR_DOCS = {
         summary: "The Idempotency-Key was reused with a different request body.",
         fix: "Use a fresh key for new requests; keys bind to one exact request body.",
     },
-    immutable_version_requires_login: {
-        summary: "This immutable version URL is past its public window and now requires login.",
-        fix: "Sign in to view it, or promote the version to a channel for public serving.",
-    },
     import_archive_not_uploaded: {
         summary: "The import has no uploaded archive yet.",
         fix: "Upload the archive to the import's upload target, then finalize.",
@@ -845,13 +841,17 @@ export const ERROR_DOCS = {
         fix: "Wait for the publish to finish, then roll back by promoting a previous version if needed.",
     },
     publish_path_collision: {
-        summary: "Two entries in the publish payload normalize to the same path.",
-        fix: "Remove the duplicate; each path may appear once across files and deletes.",
+        summary: "Two different artifacts would serve the same URL after directory-index or clean-URL resolution.",
+        fix: "Rename or remove one artifact so every request route has one owner.",
     },
     publish_path_invalid: {
         summary: "A publish path is not a relative, normalized POSIX path.",
         fix: "Use forward-slash relative paths without traversal segments or control characters.",
     },
+    publish_reference_missing: {
+        summary: "Published HTML, CSS, or JavaScript references an internal path that is not in the version.",
+        fix: "Publish the missing artifact, or correct the reference to a route that this version serves.",
+    },
     publish_setup_failed: {
         summary: "Provisioning for this publish failed.",
         fix: "Retry the publish; if it persists, contact support with the requestId.",
@@ -924,10 +924,6 @@ export const ERROR_DOCS = {
         summary: "No signing key matching the token's key id was found.",
         fix: "Refresh the runtime JWKS; the signing keys may have rotated.",
     },
-    runtime_logs_unavailable: {
-        summary: "Server logs are not available because Spacefast serves your space as static files.",
-        fix: "There is no running server process to log. Use the request logs in your dashboard to inspect recent traffic.",
-    },
     runtime_management_unavailable: {
         summary: "The runtime management surface is unavailable for this site.",
         fix: "Retry shortly; if the site stays unreachable, contact support.",
@@ -984,10 +980,6 @@ export const ERROR_DOCS = {
         summary: "The site was already deleted.",
         fix: "No action needed; the site is gone.",
     },
-    site_capacity_exceeded: {
-        summary: "The site has reached its capacity and cannot take more content.",
-        fix: "Retry shortly; the platform rebalances spaces onto new sites automatically.",
-    },
     site_has_live_spaces: {
         summary: "The site still has live spaces assigned to it, so it cannot be deleted.",
         fix: "Delete the live spaces or move them to another site before deleting this site.",
@@ -1036,6 +1028,10 @@ export const ERROR_DOCS = {
         summary: "The space was already claimed; a claim can only succeed once.",
         fix: "If you are the agent that published this space, exchange your claim token once at POST /v1/anonymous-claim/exchange for a durable access token and keep publishing to the same spaceId. Otherwise ask the owner for access — do not publish a duplicate space.",
     },
+    space_capacity_warming: {
+        summary: "This space is waiting on serving capacity that is being provisioned in the background.",
+        fix: "Wait for the Retry-After window, then send the same publish again. No version was created and no files were uploaded.",
+    },
     space_claim_unavailable: {
         summary: "This space cannot be claimed.",
         fix: "Only anonymous, unexpired spaces with a valid claim token can be claimed.",
@@ -1080,6 +1076,10 @@ export const ERROR_DOCS = {
         summary: "The export was produced by an unsupported runtime schema version.",
         fix: "Re-export from a current runtime, or upgrade before exporting.",
     },
+    space_move_would_strand_zero_data: {
+        summary: "The Space runs Zero, whose database lives on the site the Space is placed on. Relocating it would create an empty database on the new site and leave every row behind, so the move is refused.",
+        fix: "Nothing was moved and no data was lost. Migrating Zero data between sites is not implemented; contact support if the Space genuinely has to be relocated.",
+    },
     space_moving: {
         summary: "The space is moving between sites, which blocks this operation.",
         fix: "Wait for the move to finish, then retry.",
@@ -1290,11 +1290,7 @@ export const ERROR_DOCS = {
     },
     upload_path_not_declared: {
         summary: "An uploaded path was not declared in the version's manifest.",
-        fix: "Declare every path up front, or use an open session for incremental uploads.",
-    },
-    upload_session_cap_exceeded: {
-        summary: "The open upload session exceeded its file or byte cap.",
-        fix: "Stay within the session caps, or declare a manifest for large publishes.",
+        fix: "Declare every path up front.",
     },
     upload_size_mismatch: {
         summary: "An uploaded file's size does not match the declared size.",
@@ -1650,7 +1646,7 @@ export const ERROR_DOCS = {
     },
     zero_log_query_invalid: {
         summary: "The Zero log query parameters are invalid.",
-        fix: "Use valid cursor, limit, mutationName, and requestId parameters.",
+        fix: "Use valid cursor, limit, handlerName, and requestId parameters.",
     },
     zero_method_not_allowed: {
         summary: "The request method is not allowed for this Zero endpoint.",

package/dist/utils/asset-fingerprint.d.ts

@@ -31,6 +31,17 @@ export type FingerprintPlan = {
         reason: FingerprintSkipReason;
     }>;
 };
+export type StaticDocumentDependency = {
+    sourcePath: string;
+    targetPath: string;
+};
+/**
+ * Advisory-only dependency discovery used by finalize diagnostics. It shares
+ * the exact HTML/CSS tokenizer and URL resolver with asset fingerprinting, then
+ * adds conservative static JS imports and page links. It never rewrites bytes
+ * and never changes access automatically.
+ */
+export declare function scanStaticDocumentDependencies(sourcePath: string, text: string): StaticDocumentDependency[];
 export declare function planAssetFingerprints(input: {
     files: readonly FingerprintCandidateFile[];
     /** sha256 as lowercase hex over UTF-8 bytes of `text`. */

package/dist/utils/asset-fingerprint.js

@@ -48,6 +48,52 @@ const FINGERPRINT_ASSET_EXTENSIONS = new Set([
 // no whitespace. Anything else stays on the default lane.
 const SAFE_PATH_PATTERN = /^[A-Za-z0-9/_.-]+$/;
 const SCHEME_PATTERN = /^[a-zA-Z][a-zA-Z0-9+.-]*:/;
+const HTML_ANCHOR_HREF_PATTERN = /<a\b[^>]*\bhref\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/giu;
+const JS_STATIC_REFERENCE_PATTERN = /(?:\b(?:import|export)\s+(?:[^"'()]*?\s+from\s+)?|\bimport\s*\(|\bnew\s+URL\s*\()\s*["']([^"']+)["']/gu;
+const SOURCE_MAP_REFERENCE_PATTERN = /[#@]\s*sourceMappingURL=([^\s*]+)/gu;
+/**
+ * Advisory-only dependency discovery used by finalize diagnostics. It shares
+ * the exact HTML/CSS tokenizer and URL resolver with asset fingerprinting, then
+ * adds conservative static JS imports and page links. It never rewrites bytes
+ * and never changes access automatically.
+ */
+export function scanStaticDocumentDependencies(sourcePath, text) {
+    const extension = pathExtensionOf(sourcePath);
+    const rawUrls = [];
+    if (extension === "html" || extension === "htm") {
+        const html = scanHtml(text);
+        rawUrls.push(...html.refs.map((ref) => ref.url));
+        for (const range of html.cssRanges) {
+            rawUrls.push(...scanCssRefs(range.css, range.offset).map((ref) => ref.url));
+        }
+        for (const match of text.matchAll(HTML_ANCHOR_HREF_PATTERN)) {
+            const url = match[1] ?? match[2] ?? match[3];
+            if (url)
+                rawUrls.push(url);
+        }
+    }
+    else if (extension === "css") {
+        rawUrls.push(...scanCssRefs(text, 0).map((ref) => ref.url));
+    }
+    else if (extension === "js" || extension === "mjs" || extension === "cjs") {
+        for (const match of text.matchAll(JS_STATIC_REFERENCE_PATTERN)) {
+            if (match[1])
+                rawUrls.push(match[1]);
+        }
+        for (const match of text.matchAll(SOURCE_MAP_REFERENCE_PATTERN)) {
+            if (match[1])
+                rawUrls.push(match[1]);
+        }
+    }
+    const baseDir = parentDir(sourcePath);
+    return [
+        ...new Set(rawUrls
+            .map((url) => resolveReference(baseDir, url))
+            .filter((targetPath) => targetPath !== null)),
+    ]
+        .toSorted()
+        .map((targetPath) => ({ sourcePath, targetPath }));
+}
 export function planAssetFingerprints(input) {
     const covered = input.pathCoveredByUserCacheControl ?? (() => false);
     const excluded = input.excludePath ?? (() => false);

package/dist/utils/auth-redirect.d.ts

@@ -1,3 +1 @@
-export declare function sanitizeDashboardReturnTo(returnTo: string | null | undefined, options?: {
-    apiOrigin?: string | null;
-}): string | undefined;
+export declare function sanitizeDashboardReturnTo(returnTo: string | null | undefined): string | undefined;

package/dist/utils/auth-redirect.js

@@ -17,29 +17,9 @@ function hasUnsafeReturnToChars(value) {
     }
     return false;
 }
-// The ONE absolute-URL exception to the same-origin returnTo policy
-// (access-plan X-41): the api-origin GET /v1/access/authorize URL exactly —
-// the sign-in leg of the visitor redirect chain. Everything else absolute is
-// an open-redirect surface and stays rejected.
-const API_AUTHORIZE_PATH = "/v1/access/authorize";
-export function sanitizeDashboardReturnTo(returnTo, options) {
+export function sanitizeDashboardReturnTo(returnTo) {
     const normalized = returnTo?.trim();
     const decoded = normalized ? decodedReturnTo(normalized) : null;
-    if (normalized && decoded && options?.apiOrigin) {
-        try {
-            const candidate = new URL(normalized);
-            const apiOrigin = new URL(options.apiOrigin).origin;
-            if (candidate.origin === apiOrigin &&
-                candidate.pathname === API_AUTHORIZE_PATH &&
-                !hasUnsafeReturnToChars(normalized) &&
-                !hasUnsafeReturnToChars(decoded)) {
-                return candidate.toString();
-            }
-        }
-        catch {
-            // Not an absolute URL — fall through to the same-origin path rules.
-        }
-    }
     if (!normalized ||
         !decoded ||
         !normalized.startsWith("/") ||

package/dist/utils/build-settings.d.ts

@@ -1,6 +1,8 @@
 export type BuildSettingsInput = {
     fileNames: Iterable<string>;
     packageJson?: string | null | undefined;
+    jekyllYaml?: string | null | undefined;
+    jekyllToml?: string | null | undefined;
     vercelJson?: string | null | undefined;
     netlifyToml?: string | null | undefined;
     wranglerToml?: string | null | undefined;