@spacefast/common 0.0.13 → 0.0.18

package/dist/docs/error-docs.js

@@ -1,11 +1,12 @@
 // Error reference content (internal-docs/platform.md "Global API Conventions"):
-// every error envelope `docsUrl` points at `https://spacefast.com/docs/errors/{code}`,
+// every problem document `type` points at `https://spacefast.com/docs/errors/{code}`,
 // and those pages are GENERATED from this table — one entry per member of
 // `ERROR_CODES`, asserted complete by the conformance suite so links never rot
 // and pages never go missing. apps/www renders the HTML pages and writes the
 // `.md` twins from the same entries.
 import { BRAND } from "../brand.js";
-import { errorDocsUrl } from "../contracts/error-codes.js";
+import { serviceOrigin } from "../config/domains.js";
+import { errorDocsUrl, errorTitle, PROBLEM_CONTENT_TYPE, } from "../contracts/error-codes.js";
 // Restore upgrade-oriented recovery copy here when paid plan checkout is live.
 export const ERROR_DOCS = {
     abuse_report_invalid_transition: {
@@ -28,21 +29,17 @@ export const ERROR_DOCS = {
         summary: "The authorization request was denied by the user.",
         fix: "Restart the login flow and approve the request to continue.",
     },
-    access_scope_suggestion: {
-        summary: "Published dependencies cluster under paths that may be useful as explicit public scopes.",
-        fix: "If those files are safe for anyone to read, make only the suggested scopes Public. Otherwise leave access unchanged.",
-    },
     agent_handoff_declined: {
         summary: "The app-private agent handoff cannot be redeemed.",
-        fix: "Ask the user to create a fresh handoff for this Space and client, then redeem that new link once.",
+        fix: "Ask the user to create a fresh handoff for this space and client, then redeem that new link once.",
     },
     agent_handoff_limit_reached: {
-        summary: "This user already has the maximum number of pending handoffs for the Space.",
-        fix: "Redeem or revoke an existing pending handoff for the Space before creating another.",
+        summary: "This user already has the maximum number of pending handoffs for the space.",
+        fix: "Redeem or revoke an existing pending handoff for the space before creating another.",
     },
     agent_handoff_origin_unsupported: {
         summary: "The dashboard origin this deployment is configured with cannot mint canonical agent handoff links.",
-        fix: "Point SPACEFAST_DASHBOARD_URL at a valid HTTP(S) origin; if you cannot change it, contact support.",
+        fix: "Point SPACEFAST_DASHBOARD_URL at a valid HTTP(S) origin. If you cannot change it, contact support.",
     },
     ambiguous_space_slug: {
         summary: "The slug matches spaces in more than one of your teams, so it cannot be resolved.",
@@ -50,11 +47,11 @@ export const ERROR_DOCS = {
     },
     anonymous_expired: {
         summary: "This anonymous space expired before it was claimed.",
-        fix: "Publish a fresh space and share its claim link right away this time. If you meant to update a space that is still live, check .spacefast/ (or your saved receipt) for its spaceId and publish to that with its credential instead of creating a new space.",
+        fix: "Publish a fresh space and share its claim link right away this time. If you meant to update a live space, check .spacefast/ (or your saved receipt) for its spaceId. Publish to that space with its credential instead of creating a new space.",
     },
     anonymous_pool_unavailable: {
         summary: "No pooled capacity is available for anonymous publishes right now.",
-        fix: "Retry shortly; capacity replenishes automatically.",
+        fix: "Retry shortly. Capacity replenishes automatically.",
     },
     anonymous_publish_rate_limited: {
         summary: "Too many anonymous publishes came from this network in a short window.",
@@ -65,8 +62,8 @@ export const ERROR_DOCS = {
         fix: "Log in to publish into an authenticated space, or claim/delete an existing anonymous space before creating another.",
     },
     api_key_scope_underivable: {
-        summary: "A concrete access policy could not be derived from the requested scope and permissions.",
-        fix: "Point scope at a resource you can already reach (an existing space owned by a team) and request permissions your credential already has.",
+        summary: "A concrete access policy cannot be derived from the requested scope and permissions.",
+        fix: "Point scope at a resource you can already reach (an existing space owned by a team). Request only permissions your credential already has.",
     },
     archive_body_required: {
         summary: "This request must carry an archive body but none was provided.",
@@ -81,12 +78,12 @@ export const ERROR_DOCS = {
         fix: "Pass the code returned by the authorization step.",
     },
     authorization_pending: {
-        summary: "The device login has not been approved yet.",
+        summary: "The device login is not approved yet.",
         fix: "Keep polling at the advised interval until the user approves the request.",
     },
     billing_receipt_invalid: {
-        summary: "The store receipt or notification could not be verified with the payment provider.",
-        fix: "Re-check the transaction id or purchase token and retry; contact support if it persists.",
+        summary: "The store receipt or notification cannot be verified with the payment provider.",
+        fix: "Re-check the transaction id or purchase token and retry. Contact support if it persists.",
     },
     billing_receipt_not_bound_to_team: {
         summary: "The store purchase was made under a different account token than this team's.",
@@ -105,7 +102,7 @@ export const ERROR_DOCS = {
         fix: "Check the product id against the store catalog returned by the billing endpoints.",
     },
     build_command_missing: {
-        summary: "A build or install command could not be found during the build run.",
+        summary: "A build or install command cannot be found during the build run.",
         fix: "Check the command spelling and ensure its tool is declared in package.json or available in the build image.",
     },
     build_execution_unavailable: {
@@ -122,10 +119,10 @@ export const ERROR_DOCS = {
     },
     build_no_index_html: {
         summary: "The build produced output but no index.html at the site root.",
-        fix: "Make sure your build writes an index.html to the output directory, or point the output directory at the folder that contains it.",
+        fix: "Ensure your build writes an index.html to the output directory. Otherwise point the output directory at the folder that contains index.html.",
     },
     build_not_created: {
-        summary: "The build could not be created.",
+        summary: "The build cannot be created.",
         fix: "Verify the build request payload and retry.",
     },
     build_oom: {
@@ -150,7 +147,7 @@ export const ERROR_DOCS = {
     },
     channel_name_reserved: {
         summary: "The channel name collides with a reserved hostname suffix and cannot be used.",
-        fix: "Choose a different channel name; v-prefixed numeric names and ver- prefixes are reserved.",
+        fix: "Choose a different channel name. V-prefixed numeric names and ver- prefixes are reserved.",
     },
     channel_pointer_moved: {
         summary: "The channel was promoted to a different version since you read it.",
@@ -184,6 +181,10 @@ export const ERROR_DOCS = {
         summary: "The sf.jsonc configuration file exceeds the maximum size.",
         fix: "Keep the configuration file under the documented size limit (256 KB).",
     },
+    config_functions_key_removed: {
+        summary: "The sf.jsonc configuration still uses the removed top-level functions key.",
+        fix: 'Replace the functions block with a runtime block: set runtime.kind to "functions" and move entry, compatibilityDate, and database under it.',
+    },
     config_invalid: {
         summary: "The space configuration failed validation.",
         fix: "Fix the reported fields against the published schema at /schemas/sf.json.",
@@ -192,20 +193,32 @@ export const ERROR_DOCS = {
         summary: "A meta field in the space configuration exceeds its maximum length.",
         fix: "Shorten the meta title, description, or other reported field.",
     },
+    config_name_too_long: {
+        summary: "The name in the space configuration exceeds its maximum length.",
+        fix: "Shorten the name in sf.jsonc to 255 characters or fewer.",
+    },
+    config_runtime_entry_missing: {
+        summary: "The declared runtime has no entry module to compile.",
+        fix: "Name the entry in sf.jsonc: runtime.entry for functions, runtime.server and runtime.client for zero. Remove the runtime block to publish static files instead.",
+    },
+    config_runtime_invalid_kind: {
+        summary: "The runtime block in the space configuration declares an unknown kind.",
+        fix: 'Set runtime.kind to "zero" or "functions" in sf.jsonc.',
+    },
     config_templates_over_limit: {
         summary: "The configuration declares more template files than the plan allows.",
         fix: "Reduce the number of template entries in sf.jsonc. Still stuck? POST /v1/feedback with the error code and request id.",
     },
     continuation_unavailable: {
-        summary: "This claim token can no longer be exchanged for an access token.",
+        summary: "This claim token can no longer be exchanged for an API key.",
         fix: "If the space is claimed, ask its owner for an API key (dashboard: Account → API keys). If it is still unclaimed, keep using the claim token as bearer auth instead of exchanging it. Still stuck? POST /v1/feedback with the error code and request id.",
     },
     continuation_used: {
-        summary: "This claim token was already exchanged for a durable access token.",
-        fix: "Authenticate with the exchanged access token (check .spacefast/state.json or wherever it was saved). If it was lost, ask the space owner to create a new API key.",
+        summary: "This claim token was already exchanged for a durable API key.",
+        fix: "Authenticate with the exchanged API key (check .spacefast/state.json or wherever it was saved). If it was lost, ask the space owner to create a new API key.",
     },
     credential_expired: {
-        summary: "The credential used for this request has expired.",
+        summary: "The credential used for this request is expired.",
         fix: "Create a new API key or sign in again.",
     },
     credential_not_yet_valid: {
@@ -222,7 +235,7 @@ export const ERROR_DOCS = {
     },
     csam_blocked: {
         summary: "The content was blocked because it matched known child sexual abuse material.",
-        fix: "This action is final and reported as required by law; do not retry.",
+        fix: "This action is final and reported as required by law. Do not retry.",
     },
     csam_policy_floor: {
         summary: "CSAM enforcement policy cannot be set below the mandatory account-suspend floor.",
@@ -236,6 +249,10 @@ export const ERROR_DOCS = {
         summary: "This request tried to change data location through an immutable path.",
         fix: "Data location is fixed when the space is created and cannot be changed afterwards. Create a new space in the region you want.",
     },
+    db_not_available: {
+        summary: "The live version has no database to read.",
+        fix: 'Publish a Zero app, or declare `"database": true` under `runtime` in sf.jsonc for a Functions app.',
+    },
     device_authorization_failed: {
         summary: "The device login request failed and cannot be completed.",
         fix: "Start a new device login flow.",
@@ -253,7 +270,7 @@ export const ERROR_DOCS = {
         fix: "Follow the capability rule in the error details and submit only the compatible fields.",
     },
     dns_import_partial_visibility: {
-        summary: "The DNS import could not see the full zone, so importing would lose records.",
+        summary: "The DNS import cannot see the full zone, so importing would lose records.",
         fix: "Verify delegation and retry once the full zone is visible.",
     },
     dns_provider_auth_expired: {
@@ -285,7 +302,7 @@ export const ERROR_DOCS = {
         fix: "Use the provider workflow template or primary-domain action for this provider-managed zone.",
     },
     dns_provider_credentials_expired: {
-        summary: "The DNS provider credentials have expired or were revoked.",
+        summary: "The DNS provider credentials are expired or revoked.",
         fix: "Reconnect the provider account or replace the API token.",
     },
     dns_provider_feature_descriptors: {
@@ -341,8 +358,8 @@ export const ERROR_DOCS = {
         fix: "Refresh the provider snapshot, review the new diff, and retry the change against the latest record ids.",
     },
     dns_provider_snapshot_unavailable: {
-        summary: `${BRAND.productName} could not cache the latest DNS provider snapshot.`,
-        fix: "Retry refresh after the cache or provider recovers; do not edit connected-provider records from stale data.",
+        summary: `${BRAND.productName} cannot cache the latest DNS provider snapshot.`,
+        fix: "Retry refresh after the cache or provider recovers. Do not edit connected-provider records from stale data.",
     },
     dns_provider_temporarily_unavailable: {
         summary: "The DNS provider is rate-limited, degraded, or temporarily unavailable.",
@@ -361,12 +378,12 @@ export const ERROR_DOCS = {
         fix: "Preview and run the advertised template so provider-specific side effects and receipts are captured.",
     },
     dns_provider_zone_not_found: {
-        summary: "The connected DNS provider zone could not be found.",
+        summary: "The connected DNS provider zone cannot be found.",
         fix: "Refresh the provider account, reattach the zone, or reconnect the provider.",
     },
     dns_record_conflicts_with_managed: {
         summary: `The DNS change conflicts with a record ${BRAND.productName} manages for this domain.`,
-        fix: "Remove or adjust the conflicting record; managed records cannot be overridden.",
+        fix: "Remove or adjust the conflicting record. Managed records cannot be overridden.",
     },
     dns_record_managed: {
         summary: `This DNS record is managed by ${BRAND.productName} and cannot be edited directly.`,
@@ -386,7 +403,7 @@ export const ERROR_DOCS = {
     },
     domain_facet_already_managed: {
         summary: `This facet of the domain is already managed by ${BRAND.productName}.`,
-        fix: "No action is needed; the facet is already active.",
+        fix: "No action is needed. The facet is already active.",
     },
     domain_facet_external: {
         summary: `This facet of the domain is managed outside ${BRAND.productName}.`,
@@ -426,7 +443,7 @@ export const ERROR_DOCS = {
     },
     domain_reserved_suffix: {
         summary: `The hostname is under a ${BRAND.productName}-managed suffix and cannot be added as a domain.`,
-        fix: `Use a domain you own; ${BRAND.productName} default and management hostnames are assigned automatically.`,
+        fix: `Use a domain you own. ${BRAND.productName} assigns default and management hostnames automatically.`,
     },
     domain_transfer_active: {
         summary: "The domain has a transfer in progress, which blocks this operation.",
@@ -453,7 +470,7 @@ export const ERROR_DOCS = {
         fix: "Adjust the category ranges so each severity is covered by at most one policy.",
     },
     expired_token: {
-        summary: "The token has expired.",
+        summary: "The token is expired.",
         fix: "Request a new token and retry.",
     },
     export_archive_not_ready: {
@@ -486,23 +503,23 @@ export const ERROR_DOCS = {
     },
     idempotency_conflict_in_progress: {
         summary: "Another request with the same Idempotency-Key is still in flight.",
-        fix: "Wait for the original request to finish; its response will be replayed.",
+        fix: "Wait for the original request to finish. Its response will be replayed.",
     },
     idempotency_key_reused: {
         summary: "The Idempotency-Key was reused with a different request body.",
-        fix: "Use a fresh key for new requests; keys bind to one exact request body.",
+        fix: "Use a fresh key for new requests. Keys bind to one exact request body.",
     },
     import_archive_not_uploaded: {
         summary: "The import has no uploaded archive yet.",
         fix: "Upload the archive to the import's upload target, then finalize.",
     },
     import_not_cancelable: {
-        summary: "The import has progressed past the point where it can be canceled.",
-        fix: "Wait for the import to finish; completed imports can be deleted as versions.",
+        summary: "The import is past the point where it can be canceled.",
+        fix: "Wait for the import to finish. Completed imports can be deleted as versions.",
     },
     import_not_waiting_for_archive: {
         summary: "The import is not waiting for an archive upload.",
-        fix: "Check the import status; the archive step may already be complete.",
+        fix: "Check the import status. If the archive step is complete, continue to the next step.",
     },
     incumbent_controls_dns: {
         summary: "Another team controls this domain's DNS, so the operation is blocked.",
@@ -518,7 +535,7 @@ export const ERROR_DOCS = {
     },
     internal_error: {
         summary: "Something went wrong on our side.",
-        fix: "Retry the request; if it persists, contact support with the requestId.",
+        fix: "Retry the request. If it persists, contact support with the requestId.",
     },
     invalid_claim_token: {
         summary: "The claim token is invalid or does not match this space.",
@@ -533,7 +550,7 @@ export const ERROR_DOCS = {
         fix: "Pick a region from the documented data locations, or use auto.",
     },
     invalid_device_code: {
-        summary: "The device code is invalid or has expired.",
+        summary: "The device code is invalid or expired.",
         fix: "Start a new device login flow.",
     },
     invalid_domain: {
@@ -557,11 +574,11 @@ export const ERROR_DOCS = {
         fix: "Restart the login flow to obtain a new grant.",
     },
     invalid_idempotency_key: {
-        summary: "The Idempotency-Key header is missing, empty, or too long.",
-        fix: "Send a non-empty Idempotency-Key header of at most 512 characters.",
+        summary: "The Idempotency-Key is missing or invalid, or an anonymous publish omitted its secret replay principal.",
+        fix: "Send a non-empty Idempotency-Key of at most 255 characters. Credential-free publish retries also need a stable, secret X-Spacefast-Idempotency-Principal containing 64 hexadecimal characters.",
     },
     invalid_publish_archive: {
-        summary: "The uploaded archive could not be read as a valid zip.",
+        summary: "The uploaded archive cannot be read as a valid zip.",
         fix: "Re-create the archive as a standard zip and upload again.",
     },
     invalid_publish_path: {
@@ -574,7 +591,7 @@ export const ERROR_DOCS = {
     },
     invalid_request: {
         summary: "The request is malformed.",
-        fix: "Fix the field referenced by param and details, then retry.",
+        fix: "Fix the field referenced by pointer and details, then retry.",
     },
     invalid_runtime_event: {
         summary: "The runtime event payload is not recognized.",
@@ -590,7 +607,7 @@ export const ERROR_DOCS = {
     },
     invalid_user_code: {
         summary: "The user code does not match a pending device login.",
-        fix: "Enter the code exactly as shown by your CLI; codes expire after a few minutes.",
+        fix: "Enter the code exactly as shown by your CLI. Codes expire after a few minutes.",
     },
     invalid_version_path: {
         summary: "A file path in the version is not a valid space path.",
@@ -602,7 +619,7 @@ export const ERROR_DOCS = {
     },
     invalid_webhook_payload: {
         summary: "The webhook configuration payload is malformed.",
-        fix: "Fix the field referenced by param and retry.",
+        fix: "Fix the field referenced by pointer and retry.",
     },
     invalid_webhook_signature: {
         summary: "The webhook signature did not verify.",
@@ -610,7 +627,7 @@ export const ERROR_DOCS = {
     },
     invalid_webhook_url: {
         summary: "The webhook URL is not an allowed public HTTPS endpoint.",
-        fix: "Use a public HTTPS URL; private networks and link-local addresses are blocked.",
+        fix: "Use a public HTTPS URL. Private networks and link-local addresses are blocked.",
     },
     invalid_zero_realtime_event: {
         summary: "The Zero realtime event payload is malformed or scoped to the wrong space.",
@@ -629,7 +646,7 @@ export const ERROR_DOCS = {
         fix: "Sign in as the invited email, or ask an admin to invite your current address.",
     },
     invitation_expired: {
-        summary: "The invitation has expired and can no longer be accepted.",
+        summary: "The invitation is expired and can no longer be accepted.",
         fix: "Ask a team admin to send a fresh invitation, then accept the new one.",
     },
     invitation_not_pending: {
@@ -642,7 +659,7 @@ export const ERROR_DOCS = {
     },
     job_not_found: {
         summary: "The background job was not found.",
-        fix: "Verify the job id; completed jobs are eventually pruned.",
+        fix: "Verify the job id. Completed jobs are eventually pruned.",
     },
     job_not_promotable: {
         summary: "The job cannot be promoted in its current state.",
@@ -674,7 +691,7 @@ export const ERROR_DOCS = {
     },
     malware_detected: {
         summary: "Malware was detected in the uploaded content.",
-        fix: "Remove the flagged files; contact support if you believe this is a false positive.",
+        fix: "Remove the flagged files. Contact support if you believe this is a false positive.",
     },
     managed_domain_protected: {
         summary: "This is a system-managed view.fast hostname and cannot be mutated like a custom domain.",
@@ -682,24 +699,24 @@ export const ERROR_DOCS = {
     },
     manifest_body_too_large: {
         summary: "The upload manifest body exceeds the maximum size.",
-        fix: "Keep the manifest under 16 MB; split very large publishes into batches.",
+        fix: "Keep the manifest under 16 MB. Split very large publishes into batches.",
     },
     manifest_duplicate_path: {
         summary: "The upload manifest declares the same path more than once.",
-        fix: "Deduplicate paths; comparisons use the canonical (decoded, NFC) form.",
+        fix: "Deduplicate paths. Comparisons use the canonical (decoded, NFC) form.",
     },
     manifest_too_many_files: {
         summary: "The upload manifest declares more files than the allowed ceiling.",
         fix: "Reduce the file count or split content across multiple spaces.",
     },
-    mcp_acted_for_team_deleted: {
-        summary: "This MCP approval or execution run acted only for a team that has since been deleted, so it can no longer be approved, denied, or canceled.",
-        fix: "Nothing to do — the record is read-only history. Restore the deleted team within its recovery window if you still need to act on it.",
-    },
     member_already_exists: {
         summary: "This user is already a member of the team.",
         fix: "Update the existing member's role instead of inviting again.",
     },
+    method_not_allowed: {
+        summary: "The requested HTTP method is not supported for this endpoint.",
+        fix: "Use one of the methods listed in the Allow response header.",
+    },
     missing_route_param: {
         summary: "A required route parameter is missing from the request path.",
         fix: "Check the endpoint path in the API reference and include every parameter.",
@@ -708,6 +725,10 @@ export const ERROR_DOCS = {
         summary: "The selected move target no longer has capacity for the space.",
         fix: "Retry the move with a different target or after capacity is freed.",
     },
+    name_managed_by_config: {
+        summary: "The space name is managed by sf.jsonc while its live version declares one.",
+        fix: "Change name in sf.jsonc and publish, or remove name from the file to rename the space through the API.",
+    },
     nameserver_delegation_required: {
         summary: `This operation requires the domain to be delegated to ${BRAND.productName} nameservers.`,
         fix: "Update the domain's nameservers at the registrar, then retry once delegation propagates.",
@@ -718,7 +739,7 @@ export const ERROR_DOCS = {
     },
     noop_publish: {
         summary: "The publish matched the live version exactly, so nothing changed.",
-        fix: "No action needed; the existing live version already serves this content.",
+        fix: "No action needed. The existing live version already serves this content.",
     },
     not_enrolled: {
         summary: "This account is not enrolled in the private beta, so the API cannot be used yet.",
@@ -742,7 +763,7 @@ export const ERROR_DOCS = {
     },
     plan_grant_already_revoked: {
         summary: "This plan grant was already revoked.",
-        fix: "Nothing to do; create a new grant if the team should regain the plan.",
+        fix: "Nothing to do. Create a new grant if the team should regain the plan.",
     },
     placement_invalid_burstable: {
         summary: "The placement burstable option was used with an unsupported placement mode.",
@@ -766,15 +787,15 @@ export const ERROR_DOCS = {
     },
     provider_error: {
         summary: "The hosting provider reported an error.",
-        fix: "Retry; if the error persists, contact support with the requestId.",
+        fix: "Retry. If the error persists, contact support with the requestId.",
     },
     provider_job_failed: {
         summary: "A hosting-provider job failed while processing this operation.",
-        fix: "Retry the operation; if it keeps failing, contact support with the operation id.",
+        fix: "Retry the operation. If it keeps failing, contact support with the operation id.",
     },
     provider_job_timeout: {
         summary: "A hosting-provider job timed out while processing this operation.",
-        fix: "Retry the operation; the provider may be slow right now.",
+        fix: "Retry the operation. If the provider is slow right now, wait and retry again.",
     },
     provider_runtime_feature_unsupported: {
         summary: "The hosting provider does not support this runtime feature.",
@@ -786,10 +807,10 @@ export const ERROR_DOCS = {
     },
     proxy_upstream_denied: {
         summary: "The proxy upstream is on a denied network and cannot be used.",
-        fix: "Proxy only to public HTTPS upstreams; private and internal addresses are blocked.",
+        fix: "Proxy only to public HTTPS upstreams. Private and internal addresses are blocked.",
     },
     proxy_upstream_unresolved: {
-        summary: "The proxy upstream hostname could not be resolved.",
+        summary: "The proxy upstream hostname cannot be resolved.",
         fix: "Verify the upstream DNS name resolves publicly, then publish again.",
     },
     publish_archive_compression_ratio_exceeded: {
@@ -810,7 +831,7 @@ export const ERROR_DOCS = {
     },
     publish_base_changed: {
         summary: "Someone published new space settings after the base you loaded, so saving would overwrite their change.",
-        fix: "Reload the latest settings, review the difference, and save again; pass force only to overwrite deliberately.",
+        fix: "Reload the latest settings, review the difference, and save again. Pass force only to overwrite deliberately.",
     },
     publish_bytes_missing: {
         summary: "The publish has no complete staged content to materialize.",
@@ -837,7 +858,7 @@ export const ERROR_DOCS = {
         fix: "Trim the inline payload, or switch to an upload-based publish for larger content.",
     },
     publish_not_cancelable: {
-        summary: "The publish has progressed past the point where it can be canceled.",
+        summary: "The publish is past the point where it can be canceled.",
         fix: "Wait for the publish to finish, then roll back by promoting a previous version if needed.",
     },
     publish_path_collision: {
@@ -848,13 +869,9 @@ export const ERROR_DOCS = {
         summary: "A publish path is not a relative, normalized POSIX path.",
         fix: "Use forward-slash relative paths without traversal segments or control characters.",
     },
-    publish_reference_missing: {
-        summary: "Published HTML, CSS, or JavaScript references an internal path that is not in the version.",
-        fix: "Publish the missing artifact, or correct the reference to a route that this version serves.",
-    },
     publish_setup_failed: {
         summary: "Provisioning for this publish failed.",
-        fix: "Retry the publish; if it persists, contact support with the requestId.",
+        fix: "Retry the publish. If it persists, contact support with the requestId.",
     },
     publish_snapshot_empty: {
         summary: "An empty snapshot was sent without an explicit base version.",
@@ -862,11 +879,11 @@ export const ERROR_DOCS = {
     },
     publish_upload_failed: {
         summary: "Uploading the publish content failed.",
-        fix: "Retry the publish; partial uploads are resumable through the upload session.",
+        fix: "Retry the publish. Partial uploads are resumable through the upload session.",
     },
     publish_verification_failed: {
         summary: "Post-publish verification did not see the new content serving.",
-        fix: "Retry; if the space still serves stale content, contact support.",
+        fix: "Retry. If the space still serves stale content, contact support.",
     },
     queue_not_found: {
         summary: "The named job queue does not exist.",
@@ -877,13 +894,17 @@ export const ERROR_DOCS = {
         fix: "Wait for the window in the Retry-After header to pass, then retry.",
     },
     registration_expired: {
-        summary: "The domain registration has expired.",
+        summary: "The domain registration is expired.",
         fix: "Renew the domain at its registrar before retrying.",
     },
     registration_expiring: {
         summary: "The domain registration is about to expire, which blocks this operation.",
         fix: "Renew the domain first, then retry.",
     },
+    resource_revision_changed: {
+        summary: "The resource changed after you loaded it, so the stale write was rejected.",
+        fix: "Use the current resource returned in error.details.current, reapply the intended fields, and send its revision as expectedRevision.",
+    },
     routing_rules_over_plan: {
         summary: "The published _redirects and _headers exceed the plan's routing-rule allowance.",
         fix: "Reduce the rule count. Still stuck? POST /v1/feedback with the error code and request id.",
@@ -894,12 +915,16 @@ export const ERROR_DOCS = {
     },
     runtime_api_not_found: {
         summary: "The runtime management endpoint was not found.",
-        fix: "Send the request with the management hostname as the Host header; management routes are not served on public hostnames.",
+        fix: "Send the request with the management hostname as the Host header. Management routes are not served on public hostnames.",
     },
     runtime_callback_forbidden: {
-        summary: "The runtime callback could not be authenticated.",
+        summary: "The runtime callback cannot be authenticated.",
         fix: "Verify the callback secret configuration for this runtime.",
     },
+    runtime_dev_unsupported: {
+        summary: "`sf dev` cannot run this runtime locally yet.",
+        fix: "Run your framework's own dev server (`next dev`, `vite`, …) and publish with `sf publish` when you are ready.",
+    },
     runtime_engine_zip_missing: {
         summary: "The runtime engine artifact is missing from this deployment.",
         fix: "Rebuild the control plane so dist/runtime-engine.zip exists.",
@@ -910,26 +935,30 @@ export const ERROR_DOCS = {
     },
     runtime_instance_mismatch: {
         summary: "The request reached a different runtime instance than the one it was issued for.",
-        fix: "Re-request instructions; the space may have moved to another instance.",
+        fix: "Re-request instructions. The space is on another instance now.",
     },
     runtime_jti_missing: {
         summary: "The runtime token is missing its replay-protection id.",
-        fix: "Mint a fresh runtime token; tokens must carry a jti claim.",
+        fix: "Mint a fresh runtime token. Tokens must carry a jti claim.",
     },
     runtime_jti_replayed: {
-        summary: "The runtime token was already used; replays are rejected.",
+        summary: "The runtime token was already used. Replays are rejected.",
         fix: "Mint a fresh runtime token for each request.",
     },
     runtime_jwks_key_missing: {
         summary: "No signing key matching the token's key id was found.",
-        fix: "Refresh the runtime JWKS; the signing keys may have rotated.",
+        fix: "Refresh the runtime JWKS to load the current signing keys.",
+    },
+    runtime_kind_mismatch: {
+        summary: "This operation is only available for a different runtime kind.",
+        fix: "Check `sf runtime status` for what the live version actually runs, then use the surface that runtime supports.",
     },
     runtime_management_unavailable: {
         summary: "The runtime management surface is unavailable for this site.",
-        fix: "Retry shortly; if the site stays unreachable, contact support.",
+        fix: "Retry shortly. If the site stays unreachable, contact support.",
     },
     runtime_not_provisioned: {
-        summary: "The space has not served a published version yet, so it has no runtime data to read.",
+        summary: "The space does not serve a published version yet, so it has no runtime data to read.",
         fix: "Publish a version first. If a publish is already running, wait for it — the operation receipt reports progress.",
     },
     runtime_operation_missing: {
@@ -942,14 +971,14 @@ export const ERROR_DOCS = {
     },
     runtime_token_bad_signature: {
         summary: "The runtime token signature did not verify.",
-        fix: "Mint a fresh token; verify clocks and JWKS freshness if it persists.",
+        fix: "Mint a fresh token. Verify clocks and JWKS freshness if it persists.",
     },
     runtime_token_expired: {
-        summary: "The runtime token has expired.",
-        fix: "Mint a fresh runtime token; step tokens are short-lived by design.",
+        summary: "The runtime token is expired.",
+        fix: "Mint a fresh runtime token. Step tokens are short-lived by design.",
     },
     runtime_token_invalid: {
-        summary: "The runtime token could not be parsed or validated.",
+        summary: "The runtime token cannot be parsed or validated.",
         fix: "Mint a fresh runtime token.",
     },
     runtime_unauthorized: {
@@ -961,24 +990,28 @@ export const ERROR_DOCS = {
         fix: "Follow the upload instructions returned when the session was created.",
     },
     runtime_upload_required: {
-        summary: "This step requires uploaded content that has not arrived yet.",
+        summary: "This step requires uploaded content, but that content is not uploaded yet.",
         fix: "Complete the uploads for this session, then retry the step.",
     },
     scan_pending: {
         summary: "The content is still being scanned for safety and cannot be served yet.",
-        fix: "Wait for the scan to finish; serving resumes automatically once it clears.",
+        fix: "Wait for the scan to finish. Serving resumes automatically once it clears.",
     },
     secret_variable_in_template: {
         summary: "A secret variable was referenced in a template, which is blocked.",
-        fix: "Templates may only substitute non-secret variables; remove the secret reference.",
+        fix: "Use only non-secret variables in templates. Remove the secret reference.",
+    },
+    service_booting: {
+        summary: "The process that received this request is still starting and cannot serve it yet.",
+        fix: "Wait for the Retry-After window, then send the same request again.",
     },
     service_signature_invalid: {
-        summary: "The service request signature could not be verified.",
+        summary: "The service request signature cannot be verified.",
         fix: "Sign the exact request method, path, body digest, timestamp, and a fresh nonce.",
     },
     site_already_deleted: {
         summary: "The site was already deleted.",
-        fix: "No action needed; the site is gone.",
+        fix: "No action needed. The site is gone.",
     },
     site_has_live_spaces: {
         summary: "The site still has live spaces assigned to it, so it cannot be deleted.",
@@ -998,11 +1031,11 @@ export const ERROR_DOCS = {
     },
     slow_down: {
         summary: "The device login is being polled faster than the advised interval.",
-        fix: "Increase the polling interval; aggressive polling invalidates the flow.",
+        fix: "Increase the polling interval. Aggressive polling invalidates the flow.",
     },
     slug_invalid: {
         summary: "The slug does not meet the structural rules for managed names.",
-        fix: "Use lowercase letters, numbers, and single dashes within the allowed length; the error message identifies the failed rule.",
+        fix: "Use lowercase letters, numbers, and single dashes within the allowed length. The error message identifies the failed rule.",
     },
     slug_reserved: {
         summary: "The slug is reserved for infrastructure, product, or impersonation protection.",
@@ -1025,8 +1058,8 @@ export const ERROR_DOCS = {
         fix: "Wait briefly and retry the upload.",
     },
     space_already_claimed: {
-        summary: "The space was already claimed; a claim can only succeed once.",
-        fix: "If you are the agent that published this space, exchange your claim token once at POST /v1/anonymous-claim/exchange for a durable access token and keep publishing to the same spaceId. Otherwise ask the owner for access — do not publish a duplicate space.",
+        summary: "The space was already claimed. A claim can only succeed once.",
+        fix: "If you published this space, exchange your claim token once at POST /v1/anonymous-claim/exchange. Keep publishing to the same spaceId with that durable API key. Otherwise ask the owner for access — do not publish a duplicate space.",
     },
     space_capacity_warming: {
         summary: "This space is waiting on serving capacity that is being provisioned in the background.",
@@ -1038,15 +1071,15 @@ export const ERROR_DOCS = {
     },
     space_claimed_credential_available: {
         summary: "The space was claimed and its owner kept agent publishing enabled; this claim token now works exactly once as an exchange voucher.",
-        fix: "POST /v1/anonymous-claim/exchange with this claim token as bearer auth. Save the returned access token (e.g. .spacefast/state.json), then retry the request with it as Authorization: Bearer. Do not publish a new space.",
+        fix: "POST /v1/anonymous-claim/exchange with this claim token as bearer auth. Save the returned API key (e.g. .spacefast/state.json), then retry the request with it as Authorization: Bearer. Do not publish a new space.",
     },
     space_disabled: {
         summary: "The space is disabled and cannot be served or modified.",
-        fix: "Check the disabled reason on the space; it explains the path to restore it.",
+        fix: "Check the disabled reason on the space. It explains the path to restore it.",
     },
     space_expired: {
         summary: "The space expired and is no longer served.",
-        fix: "If it is within the recovery window, claim or restore it; otherwise publish again.",
+        fix: "If it is within the recovery window, claim or restore it. Otherwise publish again.",
     },
     space_has_active_publish: {
         summary: "The space has a publish in progress, which blocks this operation.",
@@ -1077,8 +1110,8 @@ export const ERROR_DOCS = {
         fix: "Re-export from a current runtime, or upgrade before exporting.",
     },
     space_move_would_strand_zero_data: {
-        summary: "The Space runs Zero, whose database lives on the site the Space is placed on. Relocating it would create an empty database on the new site and leave every row behind, so the move is refused.",
-        fix: "Nothing was moved and no data was lost. Migrating Zero data between sites is not implemented; contact support if the Space genuinely has to be relocated.",
+        summary: "The Space runs Zero, whose database and object storage live on the site the Space is placed on. Relocating it would strand that data on the old site, so the move is refused.",
+        fix: "Nothing was moved and no data was lost. Migrating Zero data between sites is not implemented. Contact support if the space genuinely has to be relocated.",
     },
     space_moving: {
         summary: "The space is moving between sites, which blocks this operation.",
@@ -1090,12 +1123,24 @@ export const ERROR_DOCS = {
     },
     space_not_disabled: {
         summary: "The space is not disabled, so it cannot be restored.",
-        fix: "No action needed; the space is already active.",
+        fix: "No action needed. The space is already active.",
     },
     space_not_restorable: {
         summary: "The space is past its recovery window and cannot be restored.",
         fix: "Publish the content to a new space.",
     },
+    space_person_already_member: {
+        summary: "The email already belongs to a member of the space.",
+        fix: "Use the existing member entry instead of sending another invitation.",
+    },
+    space_person_invitation_pending: {
+        summary: "A Person invitation is already pending for this email.",
+        fix: "Resend or update the pending invitation instead of creating another one.",
+    },
+    space_person_self_invite: {
+        summary: "The inviter already belongs to the space.",
+        fix: "Use your existing space access instead of inviting yourself.",
+    },
     space_ref_ambiguous: {
         summary: "The space reference matches more than one accessible space.",
         fix: "Use the spc_ id, or scope the reference with a teamRef.",
@@ -1118,35 +1163,7 @@ export const ERROR_DOCS = {
     },
     static_control_file_not_supported: {
         summary: "This control file is not supported by the static runtime.",
-        fix: "Remove the file; see the routing docs for supported convention files.",
-    },
-    static_mount_path_conflict: {
-        summary: "The requested mount path overlaps another static mount on this space.",
-        fix: "Choose a path that is not equal to, above, or below an existing mount path.",
-    },
-    static_mount_source_not_ready: {
-        summary: "The website version that owns this mount is not ready.",
-        fix: "Wait for the website version to finish finalizing, then retry.",
-    },
-    static_mount_target_forbidden: {
-        summary: "The target space is not an authorized space in the same team.",
-        fix: "Choose another space in the source space's team and authenticate with read access to its versions.",
-    },
-    static_mount_target_in_use: {
-        summary: "A static mount dependency blocks changing or deleting this space.",
-        fix: "Remove the reported static mount before retrying the operation.",
-    },
-    static_mount_target_not_live: {
-        summary: "The target space does not have a production version to mount.",
-        fix: "Publish or promote a ready version on the target space, then retry.",
-    },
-    static_mount_target_not_ready: {
-        summary: "The target production version is not ready for static delivery.",
-        fix: "Wait for the target version to finish finalizing, then retry.",
-    },
-    static_mount_target_not_static: {
-        summary: "The target production version contains runtime functions.",
-        fix: "Promote a fully static target version or serve the dynamic application without a static mount.",
+        fix: "Remove the file. See the routing docs for supported convention files.",
     },
     static_runtime_control_path_not_supported: {
         summary: "This control path is not supported by the static runtime.",
@@ -1156,33 +1173,73 @@ export const ERROR_DOCS = {
         summary: "This operation only applies to static-runtime spaces.",
         fix: "Target a static-runtime space.",
     },
+    storage_auth_required: {
+        summary: "This storage operation requires an authenticated Zero user.",
+        fix: "Sign in to the hosted Zero app, then retry the storage operation.",
+    },
     storage_bucket_unavailable: {
         summary: "No usable internal storage bucket is configured for this operation.",
         fix: "Check the storage bucket registry and credential environment references, then retry.",
     },
+    storage_content_blocked: {
+        summary: "The object contains executable or active web content that Zero storage does not serve.",
+        fix: "Upload a passive file type without HTML, script, SVG, PHP, or executable bytes.",
+    },
+    storage_delete_forbidden: {
+        summary: "The current Zero user did not upload this object.",
+        fix: "Sign in as the original uploader before deleting the object.",
+    },
+    storage_empty_file: {
+        summary: "The Zero storage upload is empty.",
+        fix: "Upload a file containing at least 1 byte.",
+    },
+    storage_file_too_large: {
+        summary: "The Zero storage object exceeds the 5 MiB file limit.",
+        fix: "Upload a smaller object.",
+    },
+    storage_key_invalid: {
+        summary: "The Zero storage key is malformed.",
+        fix: "Use the public or private object key returned by storage.upload.",
+    },
+    storage_object_not_found: {
+        summary: "The requested Zero storage object does not exist.",
+        fix: "Check the object key or upload the object again.",
+    },
+    storage_quota_already_unlimited: {
+        summary: "The team already has unlimited storage.",
+        fix: "No quota override is needed.",
+    },
+    storage_quota_decrease_not_supported: {
+        summary: "This control cannot reduce a team's storage quota.",
+        fix: "Use a billing or plan change to reduce the quota.",
+    },
     storage_quota_exceeded: {
-        summary: "The publish would exceed the plan's storage allowance.",
-        fix: "Delete old versions. Still stuck? POST /v1/feedback with the error code and request id.",
+        summary: "The operation would exceed its storage allowance.",
+        fix: "Delete unused Zero objects or old versions, reduce the upload size, then retry.",
+    },
+    storage_unavailable: {
+        summary: "The Zero runtime cannot read or persist object storage.",
+        fix: "Retry on a healthy runtime. Contact support if the failure persists.",
     },
     storage_usage_unavailable: {
-        summary: "Storage usage could not be computed right now.",
+        summary: "Storage usage cannot be computed right now.",
         fix: "Retry shortly.",
     },
     stripe_error: {
         summary: "The billing provider reported an error.",
-        fix: "Retry; if it persists, check the team's billing settings.",
+        fix: "Retry. If it persists, check the team's billing settings.",
     },
     superseded_by_publish: {
         summary: "A newer publish superseded this operation, so it was skipped.",
-        fix: "No action needed; the newer publish already carries the change.",
+        fix: "No action needed. The newer publish already carries the change.",
     },
     takeover_notice_window: {
-        summary: "The hostname was recently bound elsewhere; a takeover notice window applies.",
+        summary: "The hostname was recently bound elsewhere. A takeover notice window applies.",
         fix: "Retry after the notice window, or have the current holder release the binding.",
     },
     team_member_quota_exceeded: {
         summary: "Inviting this person would exceed the team's seat limit.",
-        fix: "Remove a team member or cancel a pending invitation to free a seat; pending invitations count toward the limit.",
+        fix: "Remove a team member or cancel a pending invitation to free a seat. Pending invitations count toward the limit.",
     },
     team_ref_required: {
         summary: "A team reference is required for this operation.",
@@ -1202,7 +1259,7 @@ export const ERROR_DOCS = {
     },
     event_rate_limited: {
         summary: "Too many event submissions came from this client in a short window.",
-        fix: "Drop or batch events; event delivery is best-effort and never required.",
+        fix: "Drop or batch events. Event delivery is best-effort and never required.",
     },
     template_file_too_large: {
         summary: "A template file exceeds the maximum size for substitution.",
@@ -1229,7 +1286,7 @@ export const ERROR_DOCS = {
         fix: "Use a credential issued for this tenant.",
     },
     tenant_past_due: {
-        summary: "The tenant is past due; mutations are rejected while serving continues.",
+        summary: "The tenant is past due. Mutations are rejected while serving continues.",
         fix: "Settle the outstanding balance to restore full access.",
     },
     tenant_selection_required: {
@@ -1242,7 +1299,7 @@ export const ERROR_DOCS = {
     },
     theme_value_invalid: {
         summary: "A theme value in the configuration is outside the allowed grammar.",
-        fix: "Use allowed CSS values; the offending key is dropped with a warning otherwise.",
+        fix: "Use allowed CSS values. The offending key is dropped with a warning otherwise.",
     },
     transfer_cross_tenant_unsupported: {
         summary: "Spaces cannot be transferred across tenants.",
@@ -1250,15 +1307,15 @@ export const ERROR_DOCS = {
     },
     transfer_move_failed: {
         summary: "The space move backing this transfer failed.",
-        fix: "Retry the transfer; if it persists, contact support with the transfer id.",
+        fix: "Retry the transfer. If it persists, contact support with the transfer id.",
     },
     transfer_not_cancelable: {
-        summary: "The transfer has progressed past the point where it can be canceled.",
+        summary: "The transfer is past the point where it can be canceled.",
         fix: "Wait for the transfer to finish.",
     },
     transfer_push_failed: {
-        summary: "The source runtime could not push the space blobs into the transfer bucket.",
-        fix: "Retry the move; if it persists, check the source runtime and bucket configuration.",
+        summary: "The source runtime cannot push the space blobs into the transfer bucket.",
+        fix: "Retry the move. If it persists, check the source runtime and bucket configuration.",
     },
     transfer_source_changed: {
         summary: "The space changed since the transfer was created, so it must be re-confirmed.",
@@ -1269,12 +1326,12 @@ export const ERROR_DOCS = {
         fix: "Pick a different target team or account.",
     },
     transfer_verify_failed: {
-        summary: "The target runtime could not verify transferred blob content.",
-        fix: "Retry the move; if it persists, check the target runtime and bucket integrity.",
+        summary: "The target runtime cannot verify transferred blob content.",
+        fix: "Retry the move. If it persists, check the target runtime and bucket integrity.",
     },
     unauthorized: {
         summary: "The request carried no valid credential.",
-        fix: "Send a bearer access token, use an agent OAuth client, or sign in.",
+        fix: "Send a bearer API key, use an agent OAuth client, or sign in.",
     },
     unsupported_publish_media_type: {
         summary: "The publish content-type is not supported.",
@@ -1302,11 +1359,11 @@ export const ERROR_DOCS = {
     },
     validation_error: {
         summary: "A request field failed validation.",
-        fix: "Fix the field referenced by param and details, then retry.",
+        fix: "Fix the field referenced by pointer and details, then retry.",
     },
     variable_cascade_failed: {
         summary: "Republishing spaces after a variable change failed.",
-        fix: "Check the operation's diagnostics; live content keeps serving the previous values.",
+        fix: "Check the operation's diagnostics. Live content keeps serving the previous values.",
     },
     verification_required: {
         summary: "Domain verification is required before this operation.",
@@ -1329,7 +1386,7 @@ export const ERROR_DOCS = {
         fix: "Start a new version.",
     },
     version_closed: {
-        summary: "The version's upload session is closed; no more files can be added.",
+        summary: "The version's upload session is closed. No more files can be added.",
         fix: "Start a new version for additional changes.",
     },
     version_expired: {
@@ -1358,7 +1415,7 @@ export const ERROR_DOCS = {
     },
     version_in_use: {
         summary: "The version is referenced by one or more channels and cannot be deleted.",
-        fix: "Promote another version on those channels first; details lists them.",
+        fix: "Promote another version on those channels first. Details lists them.",
     },
     version_live: {
         summary: "The version is live and cannot be deleted.",
@@ -1370,7 +1427,7 @@ export const ERROR_DOCS = {
     },
     version_not_finalizable: {
         summary: "The version cannot be finalized in its current status.",
-        fix: "Only uploaded versions finalize; check the version status.",
+        fix: "Only uploaded versions finalize. Check the version status.",
     },
     version_not_found: {
         summary: "The version was not found.",
@@ -1386,10 +1443,10 @@ export const ERROR_DOCS = {
     },
     version_not_ready: {
         summary: "The version is not ready yet.",
-        fix: "Wait for finalize to complete; the operation receipt reports progress.",
+        fix: "Wait for finalize to complete. The operation receipt reports progress.",
     },
     version_quota_exceeded: {
-        summary: "The space has reached its version quota.",
+        summary: "The space is at its version quota.",
         fix: "Delete old versions. Still stuck? POST /v1/feedback with the error code and request id.",
     },
     version_total_bytes_exceeded: {
@@ -1410,7 +1467,7 @@ export const ERROR_DOCS = {
     },
     zero_ai_unavailable: {
         summary: "The local Zero AI service is not configured.",
-        fix: "Configure an AI handler for zero dev before calling the AI service.",
+        fix: "Configure an AI handler in the project, then restart `sf dev` before calling the AI service.",
     },
     zero_artifact_abi_mismatch: {
         summary: "The Zero endpoint artifact was built for a different runner ABI.",
@@ -1421,15 +1478,15 @@ export const ERROR_DOCS = {
         fix: "Rebuild the Zero project and verify the generated zero endpoint artifacts are uploaded.",
     },
     zero_artifact_malformed: {
-        summary: "The Zero endpoint artifact could not be parsed.",
-        fix: "Rebuild the Zero project; do not edit generated artifact JSON by hand.",
+        summary: "The Zero endpoint artifact cannot be parsed.",
+        fix: "Rebuild the Zero project. Do not edit generated artifact JSON by hand.",
     },
     zero_artifact_path_invalid: {
         summary: "The Zero endpoint artifact path is invalid.",
         fix: "Rebuild the Zero routes so all artifact paths stay inside the version bundle.",
     },
     zero_artifact_unreadable: {
-        summary: "The Zero endpoint artifact could not be read by the runtime.",
+        summary: "The Zero endpoint artifact cannot be read by the runtime.",
         fix: "Verify the version finalized with all generated Zero files present.",
     },
     zero_auth_unavailable: {
@@ -1453,15 +1510,15 @@ export const ERROR_DOCS = {
         fix: "Send a valid blob body within the configured local size limits.",
     },
     zero_bootstrap_encode_failed: {
-        summary: "The Zero runner could not encode the JavaScript bootstrap data.",
-        fix: "Retry with valid request metadata; report the issue if it persists.",
+        summary: "The Zero runner cannot encode the JavaScript bootstrap data.",
+        fix: "Retry with valid request metadata. Report the issue if it persists.",
     },
     zero_bytecode_hash_mismatch: {
         summary: "The Zero endpoint bytecode hash does not match its artifact metadata.",
         fix: "Rebuild and republish so bytecode and endpoint metadata are from the same build.",
     },
     zero_bytecode_invalid: {
-        summary: "The Zero endpoint bytecode could not be loaded by QuickJS.",
+        summary: "The Zero endpoint bytecode cannot be loaded by QuickJS.",
         fix: "Rebuild the project with the current Zero runner and redeploy.",
     },
     zero_bytecode_path_invalid: {
@@ -1469,27 +1526,51 @@ export const ERROR_DOCS = {
         fix: "Rebuild the Zero routes so bytecode paths stay inside the version bundle.",
     },
     zero_bytecode_unreadable: {
-        summary: "The Zero endpoint bytecode file could not be read.",
+        summary: "The Zero endpoint bytecode file cannot be read.",
         fix: "Verify the version finalized with the generated bytecode files present.",
     },
     zero_capabilities_encode_failed: {
-        summary: "The runtime could not encode the Zero endpoint capabilities.",
-        fix: "Rebuild with valid capability metadata; report the failure if it persists.",
+        summary: "The runtime cannot encode the Zero endpoint capabilities.",
+        fix: "Rebuild with valid capability metadata. Report the failure if it persists.",
     },
     zero_client_bundle_not_loaded: {
-        summary: "The local Zero dev client bundle has not been generated or loaded.",
-        fix: "Restart zero dev or run a fresh local build before loading the client route.",
+        summary: "The local Zero dev client bundle is not generated or loaded.",
+        fix: "Restart `sf dev` or run a fresh local build before loading the client route.",
     },
     zero_db_connect_failed: {
-        summary: "The Zero runner could not connect to the configured database.",
+        summary: "The Zero runner cannot connect to the configured database.",
         fix: "Verify DATABASE_URL or the generated MySQL connection variables and retry.",
     },
     zero_db_execute_failed: {
         summary: "A Zero database write failed.",
         fix: "Inspect the mutation, schema, and database logs, then retry after fixing the SQL issue.",
     },
+    zero_db_export_cursor_invalid: {
+        summary: "The local database export cursor is invalid or belongs to another export.",
+        fix: "Start a fresh export and use only cursors returned by that same table and schema.",
+    },
+    zero_db_export_failed: {
+        summary: "The runtime cannot read a database export page.",
+        fix: "Retry the export. If it repeats, inspect the live database and runtime logs.",
+    },
+    zero_db_export_page_too_large: {
+        summary: "One database export page exceeded the 16 MiB response limit.",
+        fix: "Retry with a smaller export page size.",
+    },
+    zero_db_export_query_invalid: {
+        summary: "The local database export request has an invalid table or page size.",
+        fix: "Use a declared table name and a page size within the documented limit.",
+    },
+    zero_db_export_schema_changed: {
+        summary: "The database schema changed while an export was in progress.",
+        fix: "Start a fresh export so every page uses the same schema.",
+    },
+    zero_db_export_schema_unavailable: {
+        summary: "The live capsule has no stable schema hash for a complete export.",
+        fix: "Publish the capsule with a current Zero schema, then start the export again.",
+    },
     zero_db_host_install_failed: {
-        summary: "The Zero runner could not install the database host bridge.",
+        summary: "The Zero runner cannot install the database host bridge.",
         fix: "Rebuild with a current runner and report the failure if it repeats.",
     },
     zero_db_operation_invalid: {
@@ -1509,7 +1590,7 @@ export const ERROR_DOCS = {
         fix: "Inspect the query, schema, and database logs, then retry after fixing the SQL issue.",
     },
     zero_db_row_invalid: {
-        summary: "A database row could not be converted into a Zero response value.",
+        summary: "A database row cannot be converted into a Zero response value.",
         fix: "Check the table schema and stored values for unsupported data.",
     },
     zero_db_sql_invalid: {
@@ -1525,7 +1606,7 @@ export const ERROR_DOCS = {
         fix: "Rebuild with the current Zero runner and report the failure if it repeats.",
     },
     zero_db_transaction_commit_failed: {
-        summary: "The Zero database transaction could not be committed.",
+        summary: "The Zero database transaction cannot be committed.",
         fix: "Retry after checking database connectivity and transaction conflicts.",
     },
     zero_db_transaction_invalid: {
@@ -1537,13 +1618,21 @@ export const ERROR_DOCS = {
         fix: "Rebuild with the current Zero runner and report the failure if it repeats.",
     },
     zero_db_transaction_rollback_failed: {
-        summary: "The Zero database transaction could not be rolled back cleanly.",
+        summary: "The Zero database transaction cannot be rolled back cleanly.",
         fix: "Inspect the affected database state before retrying, then report the failure.",
     },
     zero_db_transaction_start_failed: {
-        summary: "The Zero database transaction could not be started.",
+        summary: "The Zero database transaction cannot be started.",
         fix: "Check database connectivity and retry the mutation.",
     },
+    zero_db_target_denied: {
+        summary: "The application Zero database target is not a public TCP address.",
+        fix: "Use a public database hostname whose complete DNS answer set contains only public addresses.",
+    },
+    zero_db_tls_required: {
+        summary: "The application Zero database cannot be connected with verified pinned TLS.",
+        fix: "Use the provider-managed database until verified external database TLS is supported.",
+    },
     zero_db_url_invalid: {
         summary: "The Zero database URL is malformed.",
         fix: "Set DATABASE_URL or the generated database variables to a valid MySQL connection URL.",
@@ -1561,7 +1650,7 @@ export const ERROR_DOCS = {
         fix: "Use valid table, limit, and cursor parameters.",
     },
     zero_endpoint_compile_failed: {
-        summary: "The runtime could not compile the Zero endpoint bytecode.",
+        summary: "The runtime cannot compile the Zero endpoint bytecode.",
         fix: "Inspect the compile diagnostics, fix the endpoint source, and publish again.",
     },
     zero_endpoint_conflict: {
@@ -1581,7 +1670,7 @@ export const ERROR_DOCS = {
         fix: "Rebuild and republish the Zero project.",
     },
     zero_endpoint_index_malformed: {
-        summary: "The Zero endpoint index could not be parsed.",
+        summary: "The Zero endpoint index cannot be parsed.",
         fix: "Rebuild the generated endpoint index and redeploy.",
     },
     zero_endpoint_index_path_invalid: {
@@ -1589,7 +1678,7 @@ export const ERROR_DOCS = {
         fix: "Verify the runtime bundle was finalized with the standard Zero layout.",
     },
     zero_endpoint_index_unreadable: {
-        summary: "The Zero endpoint index could not be read.",
+        summary: "The Zero endpoint index cannot be read.",
         fix: "Verify the version finalized with zero/endpoints-index.json present.",
     },
     zero_endpoint_invalid: {
@@ -1617,12 +1706,12 @@ export const ERROR_DOCS = {
         fix: "Upgrade the team to a plan that includes Zero and dedicated runtime, then publish again.",
     },
     zero_envelope_encode_failed: {
-        summary: "The PHP bridge could not encode the Zero runner request envelope.",
-        fix: "Retry with valid request data; report the issue if it persists.",
+        summary: "The PHP bridge cannot encode the Zero runner request envelope.",
+        fix: "Retry with valid request data. Report the issue if it persists.",
     },
     zero_js_context_init_failed: {
-        summary: "The Zero runner could not initialize a QuickJS context.",
-        fix: "Retry or rebuild the runner; report persistent runtime initialization failures.",
+        summary: "The Zero runner cannot initialize a QuickJS context.",
+        fix: "Retry or rebuild the runner. Report persistent runtime initialization failures.",
     },
     zero_js_execution_failed: {
         summary: "The Zero endpoint JavaScript threw during execution.",
@@ -1633,7 +1722,7 @@ export const ERROR_DOCS = {
         fix: "Reduce synchronous work or database round trips in the handler.",
     },
     zero_js_globals_failed: {
-        summary: "The Zero runner could not install runtime globals for the endpoint.",
+        summary: "The Zero runner cannot install runtime globals for the endpoint.",
         fix: "Rebuild with a current runner and report the failure if it repeats.",
     },
     zero_js_response_malformed: {
@@ -1641,7 +1730,7 @@ export const ERROR_DOCS = {
         fix: "Return a valid Response or supported Zero handler result.",
     },
     zero_js_runtime_init_failed: {
-        summary: "The Zero runner could not initialize QuickJS.",
+        summary: "The Zero runner cannot initialize QuickJS.",
         fix: "Retry on a healthy runtime or rebuild the runner binary.",
     },
     zero_log_query_invalid: {
@@ -1689,8 +1778,8 @@ export const ERROR_DOCS = {
         fix: "Send the configured realtime client token by query, header, bearer token, or websocket subprotocol.",
     },
     zero_replay_failed: {
-        summary: "The hosted Zero runtime could not fetch realtime replay events.",
-        fix: "Retry shortly; check the central realtime and control-plane logs if it persists.",
+        summary: "The hosted Zero runtime cannot fetch realtime replay events.",
+        fix: "Retry shortly. Check the central realtime and control-plane logs if it persists.",
     },
     zero_replay_query_invalid: {
         summary: "The hosted Zero realtime replay query is invalid.",
@@ -1721,7 +1810,7 @@ export const ERROR_DOCS = {
         fix: "Rebuild the generated routes and publish the version again.",
     },
     zero_run_compile_failed: {
-        summary: "The runtime could not compile a Zero run handler.",
+        summary: "The runtime cannot compile a Zero run handler.",
         fix: "Inspect the compile diagnostics, fix the run-handler source, and publish again.",
     },
     zero_run_duplicate: {
@@ -1761,19 +1850,19 @@ export const ERROR_DOCS = {
         fix: "Rebuild and redeploy so the PHP bridge and Rust runner versions match.",
     },
     zero_runner_response_encode_failed: {
-        summary: "The Zero runner could not encode its response.",
+        summary: "The Zero runner cannot encode its response.",
         fix: "Return JSON-serializable response metadata from the endpoint.",
     },
     zero_runner_stdin_invalid: {
-        summary: "The Zero runner could not read its request envelope.",
-        fix: "Retry; report the runtime bridge failure if it persists.",
+        summary: "The Zero runner cannot read its request envelope.",
+        fix: "Retry. Report the runtime bridge failure if it persists.",
     },
     zero_runner_stdin_too_large: {
         summary: "The Zero runner request envelope is too large.",
         fix: "Reduce request headers, body size, or route parameters.",
     },
     zero_runner_unavailable: {
-        summary: "The Zero runner process could not be started.",
+        summary: "The Zero runner process cannot be started.",
         fix: "Verify the runner binary is installed and executable in the runtime.",
     },
     zero_runs_invalid: {
@@ -1790,27 +1879,7 @@ export const ERROR_DOCS = {
     },
     zero_shopify_unavailable: {
         summary: "The local Zero Shopify service is not configured.",
-        fix: "Configure a Shopify handler for zero dev before calling the Shopify service.",
-    },
-    zero_source_compile_failed: {
-        summary: "The Zero endpoint source fallback failed to compile.",
-        fix: "Fix the endpoint source and rebuild bytecode.",
-    },
-    zero_source_hash_mismatch: {
-        summary: "The Zero endpoint source hash does not match its artifact metadata.",
-        fix: "Rebuild and republish so source and endpoint metadata are from the same build.",
-    },
-    zero_source_invalid: {
-        summary: "The Zero endpoint source is invalid.",
-        fix: "Fix the generated endpoint source and rebuild.",
-    },
-    zero_source_path_invalid: {
-        summary: "The Zero endpoint source path is invalid.",
-        fix: "Rebuild the Zero routes so source paths stay inside the version bundle.",
-    },
-    zero_source_unreadable: {
-        summary: "The Zero endpoint source file could not be read.",
-        fix: "Verify the version finalized with generated source files present.",
+        fix: "Configure a Shopify handler in the project, then restart `sf dev` before calling the Shopify service.",
     },
     wp_cloud_anonymous_pool_required: {
         summary: "This operation requires an anonymous pool site.",
@@ -1860,24 +1929,27 @@ export function errorDocMarkdown(code) {
         "",
         `**How to resolve:** ${doc.fix}`,
         "",
-        "## Error envelope",
+        "## Error shape",
         "",
-        `Every ${PRODUCT} API error uses one envelope. \`code\` is stable and machine-readable,`,
-        "`param` (when present) points at the offending request field, and `details` may carry",
-        "structured context. Match on `code`, never on `message`.",
+        `Every ${PRODUCT} API error is an RFC 9457 problem document, served as`,
+        `\`${PROBLEM_CONTENT_TYPE}\`. \`code\` is stable and machine-readable, \`type\` links to`,
+        "this page, `title` is a short label, `status` repeats the HTTP status, and `detail`",
+        "explains this occurrence. `pointer` (when present) is an RFC 6901 JSON Pointer at the",
+        "offending field in the request body, and `details` may carry structured context. Match on",
+        "`code`, never on `detail`.",
         "",
         "```json",
         JSON.stringify({
-            error: {
-                code,
-                message: doc.summary,
-                docsUrl: errorDocsUrl(code),
-                requestId: "req_4mz0v8qk",
-            },
+            type: errorDocsUrl(code),
+            title: errorTitle(code),
+            status: 400,
+            detail: doc.summary,
+            code,
+            requestId: "req_4mz0v8qk",
         }, null, 2),
         "```",
         "",
-        `See the full list of error codes in the [error reference](${BRAND.websiteOrigin}/docs/errors).`,
+        `See the full list of error codes in the [error reference](${serviceOrigin("www", "prod")}/docs/errors).`,
         "",
     ].join("\n");
 }