@spacefast/common 0.0.23 → 0.0.26

package/dist/contracts/domains.d.ts

@@ -98,7 +98,7 @@ export declare const domainVerificationSchema: z.ZodObject<{
         path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
             registrar: "registrar";
-            wpcloud: "wpcloud";
+            infra: "infra";
             dns: "dns";
             runtime: "runtime";
         }>>>;
@@ -225,6 +225,7 @@ export declare const domainRedirectTargetSchema: z.ZodUnion<readonly [z.ZodObjec
     path: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>]>;
 export declare const domainRedirectStatusSchema: z.ZodUnion<readonly [z.ZodLiteral<301>, z.ZodLiteral<302>, z.ZodLiteral<307>, z.ZodLiteral<308>]>;
+export type DomainRedirectStatus = z.infer<typeof domainRedirectStatusSchema>;
 export declare const domainRedirectSchema: z.ZodObject<{
     to: z.ZodUnion<readonly [z.ZodObject<{
         url: z.ZodString;
@@ -363,7 +364,7 @@ export declare const DomainSchema: z.ZodObject<{
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                 registrar: "registrar";
-                wpcloud: "wpcloud";
+                infra: "infra";
                 dns: "dns";
                 runtime: "runtime";
             }>>>;
@@ -621,7 +622,7 @@ export declare const domainListResponseSchema: z.ZodObject<{
                 path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                     registrar: "registrar";
-                    wpcloud: "wpcloud";
+                    infra: "infra";
                     dns: "dns";
                     runtime: "runtime";
                 }>>>;
@@ -876,7 +877,7 @@ export declare const spaceCustomDomainSchema: z.ZodObject<{
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                 registrar: "registrar";
-                wpcloud: "wpcloud";
+                infra: "infra";
                 dns: "dns";
                 runtime: "runtime";
             }>>>;
@@ -1045,7 +1046,7 @@ export declare const spaceManagedDomainSchema: z.ZodObject<{
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                 registrar: "registrar";
-                wpcloud: "wpcloud";
+                infra: "infra";
                 dns: "dns";
                 runtime: "runtime";
             }>>>;
@@ -1100,7 +1101,7 @@ export declare const spaceDomainSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                 registrar: "registrar";
-                wpcloud: "wpcloud";
+                infra: "infra";
                 dns: "dns";
                 runtime: "runtime";
             }>>>;
@@ -1240,7 +1241,7 @@ export declare const spaceDomainSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                 registrar: "registrar";
-                wpcloud: "wpcloud";
+                infra: "infra";
                 dns: "dns";
                 runtime: "runtime";
             }>>>;
@@ -1411,7 +1412,7 @@ export declare const spaceDomainListResponseSchema: z.ZodObject<{
                 path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                     registrar: "registrar";
-                    wpcloud: "wpcloud";
+                    infra: "infra";
                     dns: "dns";
                     runtime: "runtime";
                 }>>>;
@@ -1551,7 +1552,7 @@ export declare const spaceDomainListResponseSchema: z.ZodObject<{
                 path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                     registrar: "registrar";
-                    wpcloud: "wpcloud";
+                    infra: "infra";
                     dns: "dns";
                     runtime: "runtime";
                 }>>>;
@@ -1725,7 +1726,7 @@ export declare const teamManagedDomainSchema: z.ZodObject<{
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                 registrar: "registrar";
-                wpcloud: "wpcloud";
+                infra: "infra";
                 dns: "dns";
                 runtime: "runtime";
             }>>>;
@@ -1785,7 +1786,7 @@ export declare const teamManagedDomainListResponseSchema: z.ZodObject<{
                 path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                     registrar: "registrar";
-                    wpcloud: "wpcloud";
+                    infra: "infra";
                     dns: "dns";
                     runtime: "runtime";
                 }>>>;
@@ -1806,6 +1807,16 @@ export declare const teamManagedDomainListResponseSchema: z.ZodObject<{
         hasMore: z.ZodBoolean;
     }, z.core.$strip>;
 }, z.core.$strip>;
+export declare const domainPreflightQuerySchema: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
+export declare const domainPreflightSchema: z.ZodObject<{
+    name: z.ZodString;
+    unicodeName: z.ZodOptional<z.ZodString>;
+    canHost: z.ZodNullable<z.ZodBoolean>;
+    providerMessage: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type DomainPreflight = z.infer<typeof domainPreflightSchema>;
 export declare const domainCreateRequestSchema: z.ZodObject<{
     name: z.ZodString;
     teamId: z.ZodOptional<z.ZodString>;
@@ -1906,7 +1917,7 @@ export declare const domainRegistrationActionResponseSchema: z.ZodObject<{
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                 registrar: "registrar";
-                wpcloud: "wpcloud";
+                infra: "infra";
                 dns: "dns";
                 runtime: "runtime";
             }>>>;
@@ -1949,7 +1960,7 @@ export declare const domainNameserverResponseSchema: z.ZodObject<{
         path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
             registrar: "registrar";
-            wpcloud: "wpcloud";
+            infra: "infra";
             dns: "dns";
             runtime: "runtime";
         }>>>;
@@ -2098,7 +2109,7 @@ export declare const domainDnsModeResponseSchema: z.ZodObject<{
                     path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                     provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                         registrar: "registrar";
-                        wpcloud: "wpcloud";
+                        infra: "infra";
                         dns: "dns";
                         runtime: "runtime";
                     }>>>;
@@ -2231,7 +2242,7 @@ export declare const domainDnsModeResponseSchema: z.ZodObject<{
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                 registrar: "registrar";
-                wpcloud: "wpcloud";
+                infra: "infra";
                 dns: "dns";
                 runtime: "runtime";
             }>>>;
@@ -2299,7 +2310,7 @@ export declare const domainDnsModeResponseSchema: z.ZodObject<{
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                 registrar: "registrar";
-                wpcloud: "wpcloud";
+                infra: "infra";
                 dns: "dns";
                 runtime: "runtime";
             }>>>;
@@ -2798,7 +2809,7 @@ export declare const domainDnsCapabilitiesSchema: z.ZodPipe<z.ZodObject<{
         path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
             registrar: "registrar";
-            wpcloud: "wpcloud";
+            infra: "infra";
             dns: "dns";
             runtime: "runtime";
         }>>>;
@@ -2943,7 +2954,7 @@ export declare const domainDnsCapabilitiesSchema: z.ZodPipe<z.ZodObject<{
         severity: "info" | "error" | "warning";
         message: string;
         path?: string | null | undefined;
-        provider?: "registrar" | "wpcloud" | "dns" | "runtime" | null | undefined;
+        provider?: "registrar" | "infra" | "dns" | "runtime" | null | undefined;
         details?: Record<string, unknown> | null | undefined;
         fix?: string | null | undefined;
         retryable?: boolean | null | undefined;
@@ -3084,7 +3095,7 @@ export declare const domainDnsCapabilitiesSchema: z.ZodPipe<z.ZodObject<{
         severity: "info" | "error" | "warning";
         message: string;
         path?: string | null | undefined;
-        provider?: "registrar" | "wpcloud" | "dns" | "runtime" | null | undefined;
+        provider?: "registrar" | "infra" | "dns" | "runtime" | null | undefined;
         details?: Record<string, unknown> | null | undefined;
         fix?: string | null | undefined;
         retryable?: boolean | null | undefined;
@@ -3354,7 +3365,7 @@ export declare const domainProviderSnapshotRefreshResponseSchema: z.ZodObject<{
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                 registrar: "registrar";
-                wpcloud: "wpcloud";
+                infra: "infra";
                 dns: "dns";
                 runtime: "runtime";
             }>>>;
@@ -3426,7 +3437,7 @@ export declare const domainDnsOperationSchema: z.ZodObject<{
         path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
             registrar: "registrar";
-            wpcloud: "wpcloud";
+            infra: "infra";
             dns: "dns";
             runtime: "runtime";
         }>>>;
@@ -3627,7 +3638,7 @@ export declare const domainDnsOperationListResponseSchema: z.ZodObject<{
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                 registrar: "registrar";
-                wpcloud: "wpcloud";
+                infra: "infra";
                 dns: "dns";
                 runtime: "runtime";
             }>>>;
@@ -4160,7 +4171,7 @@ export declare const domainActionMutationResponseSchema: z.ZodObject<{
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                 registrar: "registrar";
-                wpcloud: "wpcloud";
+                infra: "infra";
                 dns: "dns";
                 runtime: "runtime";
             }>>>;
@@ -4490,7 +4501,7 @@ export declare const domainDnsRecordListResponseSchema: z.ZodObject<{
             path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
                 registrar: "registrar";
-                wpcloud: "wpcloud";
+                infra: "infra";
                 dns: "dns";
                 runtime: "runtime";
             }>>>;
@@ -4635,7 +4646,7 @@ export declare const domainDnsRecordListResponseSchema: z.ZodObject<{
             severity: "info" | "error" | "warning";
             message: string;
             path?: string | null | undefined;
-            provider?: "registrar" | "wpcloud" | "dns" | "runtime" | null | undefined;
+            provider?: "registrar" | "infra" | "dns" | "runtime" | null | undefined;
             details?: Record<string, unknown> | null | undefined;
             fix?: string | null | undefined;
             retryable?: boolean | null | undefined;
@@ -4776,7 +4787,7 @@ export declare const domainDnsRecordListResponseSchema: z.ZodObject<{
             severity: "info" | "error" | "warning";
             message: string;
             path?: string | null | undefined;
-            provider?: "registrar" | "wpcloud" | "dns" | "runtime" | null | undefined;
+            provider?: "registrar" | "infra" | "dns" | "runtime" | null | undefined;
             details?: Record<string, unknown> | null | undefined;
             fix?: string | null | undefined;
             retryable?: boolean | null | undefined;
@@ -5004,7 +5015,7 @@ export declare const domainDiagnosticsResponseSchema: z.ZodObject<{
         path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         provider: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
             registrar: "registrar";
-            wpcloud: "wpcloud";
+            infra: "infra";
             dns: "dns";
             runtime: "runtime";
         }>>>;

package/dist/contracts/domains.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { AnyObjectSchema, baseDiagnosticSchema, CursorPaginationSchema, cursorListQuerySchema, DnsInstructionSchema, mutationEnvelope, requiredActionsSchema, } from "./common.js";
 import { PrincipalRefSchema } from "./resources.js";
 // ---------------------------------------------------------------------------
-// Domain resource (internal-docs/platform.md L2387-2431). A canonical name
+// Domain resource (the platform spec). A canonical name
 // owned by a tenant-local principal, plus its registrar/DNS facets and THE
 // serving pointer/whole-host redirect intent.
 // ---------------------------------------------------------------------------
@@ -52,7 +52,7 @@ export const domainDnsFacetSchema = z.object({
     assignedNameservers: z
         .array(z.string())
         .optional()
-        .describe('Managed-zone delegation set the registrar should point at (mode "stattic").'),
+        .describe("Managed-zone delegation set the registrar should point at (mode `stattic`)."),
     observedNameservers: z
         .array(z.string())
         .optional()
@@ -270,6 +270,33 @@ export const teamManagedDomainListResponseSchema = z.object({
     data: z.array(teamManagedDomainSchema),
     pagination: CursorPaginationSchema,
 });
+// Pre-add advisory check. `canHost` mirrors the hosting provider's
+// hostability verdict: `false` often means the domain is blocklisted or
+// already attached to other provider infrastructure (which a later TXT
+// ownership proof can still claim), so clients warn — they never hard-block.
+export const domainPreflightQuerySchema = z.object({
+    name: z
+        .string()
+        .trim()
+        .min(1)
+        .max(253)
+        .describe("Apex or concrete hostname to preflight; canonicalized server-side."),
+});
+export const domainPreflightSchema = z.object({
+    name: z.string().describe("Canonical lowercase ASCII form of the requested hostname."),
+    unicodeName: z
+        .string()
+        .optional()
+        .describe("Read-only U-label form, present only when it differs from `name`."),
+    canHost: z
+        .boolean()
+        .nullable()
+        .describe("Provider hostability verdict. `null` when the provider check was unavailable; treat as unknown, not as failure."),
+    providerMessage: z
+        .string()
+        .nullable()
+        .describe("Provider-reported reason when the verdict is negative."),
+});
 export const domainCreateRequestSchema = z.object({
     name: z
         .string()

package/dist/contracts/enums.d.ts

@@ -1,33 +1,27 @@
 import { z } from "zod";
-export declare const spaceStatusValues: readonly ["provisioning", "active", "updating", "moving", "deleting", "failed"];
+export declare const spaceStatusValues: readonly ["provisioning", "active", "updating", "deleting", "failed"];
 export declare const spaceStatus: z.ZodEnum<{
     active: "active";
     provisioning: "provisioning";
     updating: "updating";
-    moving: "moving";
     deleting: "deleting";
     failed: "failed";
 }>;
-export declare const spaceDisabledReasonCodeValues: readonly ["anonymous_expired", "abuse_takedown", "tenant_suspended", "site_suspended"];
+export declare const spaceDisabledReasonCodeValues: readonly ["anonymous_expired", "abuse_takedown", "tenant_suspended", "site_suspended", "author_removed"];
 export declare const spaceDisabledReasonCode: z.ZodEnum<{
     anonymous_expired: "anonymous_expired";
     abuse_takedown: "abuse_takedown";
     tenant_suspended: "tenant_suspended";
     site_suspended: "site_suspended";
+    author_removed: "author_removed";
 }>;
-export declare const spaceTransferStatusValues: readonly ["pending_confirmation", "confirming_domains", "completed", "canceled", "expired"];
+export declare const spaceTransferStatusValues: readonly ["pending_confirmation", "completed", "canceled", "expired"];
 export declare const spaceTransferStatus: z.ZodEnum<{
     pending_confirmation: "pending_confirmation";
-    confirming_domains: "confirming_domains";
     completed: "completed";
     canceled: "canceled";
     expired: "expired";
 }>;
-export declare const siteIsolationValues: readonly ["site", "space"];
-export declare const siteIsolation: z.ZodEnum<{
-    site: "site";
-    space: "space";
-}>;
 export declare const tenantKindValues: readonly ["main", "platform", "partner", "internal"];
 export declare const tenantKind: z.ZodEnum<{
     internal: "internal";
@@ -51,6 +45,11 @@ export declare const siteKindValues: readonly ["static_runtime"];
 export declare const siteKind: z.ZodEnum<{
     static_runtime: "static_runtime";
 }>;
+export declare const siteIsolationValues: readonly ["site", "space"];
+export declare const siteIsolation: z.ZodEnum<{
+    site: "site";
+    space: "space";
+}>;
 export declare const siteStatusValues: readonly ["ready_pool", "active", "provisioning", "degraded", "suspended", "deleted"];
 export declare const siteStatus: z.ZodEnum<{
     active: "active";
@@ -60,22 +59,13 @@ export declare const siteStatus: z.ZodEnum<{
     ready_pool: "ready_pool";
     degraded: "degraded";
 }>;
-export declare const siteClassValues: readonly ["shared", "dedicated", "shared_org", "anonymous_pool", "dedicated_space"];
-export declare const siteClass: z.ZodEnum<{
-    shared: "shared";
-    dedicated: "dedicated";
-    shared_org: "shared_org";
-    anonymous_pool: "anonymous_pool";
-    dedicated_space: "dedicated_space";
-}>;
-export declare const normalizedSiteClassValues: readonly ["shared", "dedicated"];
-export declare const normalizedSiteClass: z.ZodEnum<{
-    shared: "shared";
-    dedicated: "dedicated";
-}>;
-export declare function normalizeSiteClass(value: SiteClass): NormalizedSiteClass;
-export declare function siteClassIsShared(value: SiteClass): boolean;
-export declare function siteClassIsDedicated(value: SiteClass): boolean;
+export declare const poolSiteStatusValues: readonly ["provisioning", "ready_pool", "degraded", "retired"];
+export declare const poolSiteStatus: z.ZodEnum<{
+    provisioning: "provisioning";
+    ready_pool: "ready_pool";
+    degraded: "degraded";
+    retired: "retired";
+}>;
 export declare const publishSourceKindValues: readonly ["direct_upload", "cli", "dashboard", "api", "git", "import", "agent", "build", "variable_update", "config_update"];
 export declare const publishSourceKind: z.ZodEnum<{
     build: "build";
@@ -121,6 +111,7 @@ export declare const buildStatus: z.ZodEnum<{
     succeeded: "succeeded";
     skipped: "skipped";
 }>;
+export type BuildStatus = z.infer<typeof buildStatus>;
 export declare const diagnosticSeverity: z.ZodEnum<{
     info: "info";
     error: "error";
@@ -128,7 +119,7 @@ export declare const diagnosticSeverity: z.ZodEnum<{
 }>;
 export declare const diagnosticProvider: z.ZodEnum<{
     registrar: "registrar";
-    wpcloud: "wpcloud";
+    infra: "infra";
     dns: "dns";
     runtime: "runtime";
 }>;
@@ -152,6 +143,19 @@ export declare const safetyCategory: z.ZodEnum<{
     compromised_account: "compromised_account";
     other_violation: "other_violation";
 }>;
+export declare const safetyResolutionReasonValues: readonly ["malware_confirmed", "phishing_confirmed", "csam_escalated", "spam_confirmed", "copyright_takedown", "false_positive", "test_detection", "duplicate", "insufficient_evidence", "other"];
+export declare const safetyResolutionReason: z.ZodEnum<{
+    malware_confirmed: "malware_confirmed";
+    phishing_confirmed: "phishing_confirmed";
+    csam_escalated: "csam_escalated";
+    spam_confirmed: "spam_confirmed";
+    copyright_takedown: "copyright_takedown";
+    false_positive: "false_positive";
+    test_detection: "test_detection";
+    duplicate: "duplicate";
+    insufficient_evidence: "insufficient_evidence";
+    other: "other";
+}>;
 export declare const SAFETY_SEVERITY: {
     readonly suspicious: 1;
     readonly low: 2;
@@ -175,11 +179,11 @@ export declare const operationStatus: z.ZodEnum<{
 }>;
 export type GitProvider = z.infer<typeof gitProvider>;
 export type PublishSourceKind = z.infer<typeof publishSourceKind>;
+export type PoolSiteStatus = z.infer<typeof poolSiteStatus>;
+export type SiteKind = z.infer<typeof siteKind>;
 export type SiteIsolation = z.infer<typeof siteIsolation>;
 export type TenantStatus = z.infer<typeof tenantStatus>;
-export type SiteKind = z.infer<typeof siteKind>;
-export type SiteClass = z.infer<typeof siteClass>;
-export type NormalizedSiteClass = z.infer<typeof normalizedSiteClass>;
 export type OperationStatus = z.infer<typeof operationStatus>;
 export type SafetyCategory = z.infer<typeof safetyCategory>;
+export type SafetyResolutionReason = z.infer<typeof safetyResolutionReason>;
 export type EnforcementTier = z.infer<typeof enforcementTier>;

package/dist/contracts/enums.js

@@ -1,17 +1,17 @@
 import { z } from "zod";
-// Space operation-lifecycle axis (internal-docs/platform.md "Space"): exactly
-// these six. Serving (disabled) and deletion (deletedAt) are separate axes —
-// a disabled space can still be updating or moving.
+// Space operation-lifecycle axis (the platform spec "Space"): exactly
+// these five. Serving (disabled) and deletion (deletedAt) are separate axes —
+// a disabled space can still be updating. There is no `moving`: a space IS a
+// site, so ownership changes commit in place and nothing relocates.
 export const spaceStatusValues = [
     "provisioning",
     "active",
     "updating",
-    "moving",
     "deleting",
     "failed",
 ];
 export const spaceStatus = z.enum(spaceStatusValues);
-// Serving-axis disable reasons (internal-docs/platform.md "Space"). Confirmed
+// Serving-axis disable reasons (the platform spec "Space"). Confirmed
 // scan takedowns use `abuse_takedown`; infected state and claim invalidation
 // are explicit enforcement effects, not reason metadata.
 export const spaceDisabledReasonCodeValues = [
@@ -19,27 +19,26 @@ export const spaceDisabledReasonCodeValues = [
     "abuse_takedown",
     "tenant_suspended",
     "site_suspended",
+    // Space-key author delete, phase one: the holder of an unclaimed space's key
+    // took the site dark. The key survives, so the same key can restore (or
+    // claim) until the claim window expires; expiry then hard-deletes as usual.
+    "author_removed",
 ];
 export const spaceDisabledReasonCode = z.enum(spaceDisabledReasonCodeValues);
-// SpaceTransfer status machine (internal-docs/platform.md "Transfer
-// semantics"), stored directly — there is no separate DB vocabulary. No
-// `failed` state: a failed move reverts to `pending_confirmation` with a
-// diagnostic. `confirming_domains` gates the move on re-confirmation of the
-// space's bound domains; withdraw (from-side) and decline (to-side) both land
-// on `canceled`.
+// SpaceTransfer status machine (the platform spec "Transfer
+// semantics"), stored directly — there is no separate DB vocabulary. A
+// transfer is a request that the receiving side accepts; accepting moves
+// ownership in one database transaction, so there is no intermediate moving
+// state and no `failed` state. Withdraw (from-side) and decline (to-side)
+// both land on `canceled`.
 export const spaceTransferStatusValues = [
     "pending_confirmation",
-    "confirming_domains",
     "completed",
     "canceled",
     "expired",
 ];
 export const spaceTransferStatus = z.enum(spaceTransferStatusValues);
-// Site axes per internal-docs/platform.md. `isolation` controls
-// whether settings/access default to the site or to each space.
-export const siteIsolationValues = ["site", "space"];
-export const siteIsolation = z.enum(siteIsolationValues);
-// A tenant is the platform-account boundary that owns every resource (internal-docs/platform.md
+// A tenant is the platform-account boundary that owns every resource (the platform spec
 // "Tenant -> Site -> Space"), Stripe-style. `main` is the single well-known
 // Stattic account (`ten_main`) all self-serve teams/users live under;
 // `platform` and `partner` are host integrations with their own user
@@ -56,12 +55,21 @@ export const tenantStatus = z.enum(tenantStatusValues);
 // (operator-only resource, `pvc_` prefix).
 export const providerClientStatusValues = ["active", "disabled"];
 export const providerClientStatus = z.enum(providerClientStatusValues);
-// Site (internal-docs/platform.md "Site", `site_`): THE placement unit. One
-// row per WP.Cloud site; spaces point at it via `space.siteId`.
+// The only site shape there is. Kept as a named vocabulary because the sites
+// table spells it as an enum column; a dead-code sweep removed it while that
+// column still referenced it.
 export const siteKindValues = ["static_runtime"];
 export const siteKind = z.enum(siteKindValues);
-// `ready_pool` is a pre-provisioned warm site waiting to be claimed for an
-// anonymous space (claim = CAS on status, wave A1).
+// Whether settings and access default to the site or to each space. Same story
+// as the two vocabularies around it: a dead-code sweep took it while the
+// `sites` table's own column still named it.
+export const siteIsolationValues = ["site", "space"];
+export const siteIsolation = z.enum(siteIsolationValues);
+// Site lifecycle. A dead-code sweep removed this vocabulary while two live
+// consumers still needed it: the `sites` table's own status column and the
+// superadmin provider-site search result. `ready_pool` is a pre-provisioned
+// warm site waiting to be claimed — load-bearing now that every space draws
+// its own site from the pool.
 export const siteStatusValues = [
     "ready_pool",
     "active",
@@ -71,28 +79,16 @@ export const siteStatusValues = [
     "deleted",
 ];
 export const siteStatus = z.enum(siteStatusValues);
-// Placement class for a WP.Cloud site. Deploy T accepts the legacy class
-// strings while new code writes the normalized shared/dedicated vocabulary.
-export const siteClassValues = [
-    "shared",
-    "dedicated",
-    "shared_org",
-    "anonymous_pool",
-    "dedicated_space",
-];
-export const siteClass = z.enum(siteClassValues);
-export const normalizedSiteClassValues = ["shared", "dedicated"];
-export const normalizedSiteClass = z.enum(normalizedSiteClassValues);
-export function normalizeSiteClass(value) {
-    return value === "dedicated" || value === "dedicated_space" ? "dedicated" : "shared";
-}
-export function siteClassIsShared(value) {
-    return normalizeSiteClass(value) === "shared";
-}
-export function siteClassIsDedicated(value) {
-    return normalizeSiteClass(value) === "dedicated";
-}
-// PublishSource.kind (internal-docs/platform.md "PublishSource"): the single
+// Warm-pool inventory (`site_pool`): provider sites provisioned ahead of
+// demand, with no owner yet. A space IS a site, so these statuses are the
+// whole lifecycle a row can have before a space adopts it and the row is
+// deleted — `active`/`suspended`/`deleted` were live-space states and now live
+// on the space's own axes. `retired` holds a drained space=site migration
+// source box: not adoptable, not reapable, kept permanently — migration
+// tooling never deletes a wp.cloud site (owner ruling 2026-08-11).
+export const poolSiteStatusValues = ["provisioning", "ready_pool", "degraded", "retired"];
+export const poolSiteStatus = z.enum(poolSiteStatusValues);
+// PublishSource.kind (the platform spec "PublishSource"): the single
 // provenance axis for how a version came to exist. `variable_update` and
 // `config_update` versions are minted by cascades/config regeneration.
 export const publishSourceKindValues = [
@@ -109,7 +105,7 @@ export const publishSourceKindValues = [
 ];
 export const publishSourceKind = z.enum(publishSourceKindValues);
 export const versionStatusValues = [
-    // Spec state machine (internal-docs/platform.md "Upload Contract"):
+    // Spec state machine (the platform spec "Upload Contract"):
     // created -> uploading -> uploaded -> finalizing -> ready, with terminal
     // failed/canceled/expired. Build runs are tracked on the Build resource;
     // a building version stays `created` until upload starts.
@@ -137,7 +133,7 @@ export const VERSION_IN_FLIGHT_STATUSES = [
     "uploaded",
     "finalizing",
 ];
-// Build resource statuses (internal-docs/platform.md "Build", `bld_`).
+// Build resource statuses (the platform spec "Build", `bld_`).
 export const buildStatusValues = [
     "waiting_for_source",
     "uploading_source",
@@ -150,9 +146,9 @@ export const buildStatusValues = [
 ];
 export const buildStatus = z.enum(buildStatusValues);
 export const diagnosticSeverity = z.enum(["info", "warning", "error"]);
-// Upstream system a Diagnostic originated from (internal-docs/platform.md L1621). Absent when
-// the diagnostic is Stattic's own (validation, routing compile, upload policy, ...).
-export const diagnosticProvider = z.enum(["wpcloud", "dns", "registrar", "runtime"]);
+// Upstream system a Diagnostic originated from. Absent when the diagnostic is
+// Stattic's own (validation, routing compile, upload policy, ...).
+export const diagnosticProvider = z.enum(["infra", "dns", "registrar", "runtime"]);
 // Internal domain DB-column vocabularies (consumed by the control-plane schema;
 // never part of the public Domain contract, which lives in contracts/domains.ts).
 export const domainOwnershipTypeValues = [
@@ -202,6 +198,24 @@ export const safetyCategoryValues = [
     "other_violation",
 ];
 export const safetyCategory = z.enum(safetyCategoryValues);
+// Why a review item was closed (or a space taken down): the operator's verdict
+// in one word, so enforcement quality is measurable without parsing notes.
+// Confirmed-* reasons say the detection was right; the tail says it wasn't
+// (false_positive, test_detection) or the item never needed its own verdict
+// (duplicate, insufficient_evidence, other).
+export const safetyResolutionReasonValues = [
+    "malware_confirmed",
+    "phishing_confirmed",
+    "csam_escalated",
+    "spam_confirmed",
+    "copyright_takedown",
+    "false_positive",
+    "test_detection",
+    "duplicate",
+    "insufficient_evidence",
+    "other",
+];
+export const safetyResolutionReason = z.enum(safetyResolutionReasonValues);
 // 1 = suspicious, 2 = low, 3 = medium, 4 = high, 5 = critical.
 export const SAFETY_SEVERITY = {
     suspicious: 1,