@spacefast/common 0.0.24 → 0.2.1

package/dist/docs/error-docs.js

@@ -1,9 +1,8 @@
-// Error reference content (internal-docs/platform.md "Global API Conventions"):
-// every problem document `type` points at `https://spacefast.com/docs/errors/{code}`,
-// and those pages are GENERATED from this table — one entry per member of
-// `ERROR_CODES`, asserted complete by the conformance suite so links never rot
-// and pages never go missing. apps/www renders the HTML pages and writes the
-// `.md` twins from the same entries.
+// Error reference content (the platform spec "Global API Conventions"): every
+// problem document `type` points at `https://spacefast.com/docs/errors/{code}`,
+// and those pages are GENERATED from this table, one entry per `ERROR_CODES`
+// member. The conformance suite asserts completeness, so links never rot; the
+// website renders the HTML pages and `.md` twins from the same entries.
 import { BRAND } from "../brand.js";
 import { serviceOrigin } from "../config/domains.js";
 import { errorDocsUrl, errorTitle, PROBLEM_CONTENT_TYPE, } from "../contracts/error-codes.js";
@@ -15,7 +14,7 @@ export const ERROR_DOCS = {
     },
     account_suspended: {
         summary: "This account is suspended for a policy or abuse violation and cannot be used.",
-        fix: "Contact support to review the suspension if you believe it is a mistake.",
+        fix: "If you believe the suspension is a mistake, contact support to review it.",
     },
     abuse_report_rate_limited: {
         summary: "Too many abuse reports were submitted from this client in a short window.",
@@ -23,7 +22,7 @@ export const ERROR_DOCS = {
     },
     abuse_takedown: {
         summary: "This space was disabled by an abuse takedown and cannot be served or modified.",
-        fix: "If you believe this is a mistake, contact support with the space id.",
+        fix: "If you believe the takedown is a mistake, contact support with the space id.",
     },
     access_denied: {
         summary: "The authorization request was denied by the user.",
@@ -39,7 +38,7 @@ export const ERROR_DOCS = {
     },
     agent_handoff_origin_unsupported: {
         summary: "The dashboard origin this deployment is configured with cannot mint canonical agent handoff links.",
-        fix: "Point SPACEFAST_DASHBOARD_URL at a valid HTTP(S) origin. If you cannot change it, contact support.",
+        fix: "Point SPACEFAST_DASHBOARD_URL at a valid HTTP or HTTPS origin. If you cannot change it, contact support.",
     },
     ambiguous_space_slug: {
         summary: "The slug matches spaces in more than one of your teams, so it cannot be resolved.",
@@ -54,8 +53,8 @@ export const ERROR_DOCS = {
         fix: "Wait for the window to pass, or sign in with an API key for higher limits.",
     },
     anonymous_space_limit_reached: {
-        summary: "This client already holds the maximum number of unclaimed Spaces.",
-        fix: "Sign in and publish into your account, or claim or delete one of the unclaimed Spaces you already have.",
+        summary: "This client already holds the maximum number of unclaimed spaces.",
+        fix: "Sign in and publish into your account, or claim or delete one of the unclaimed spaces you already have.",
     },
     api_key_scope_underivable: {
         summary: "A concrete access policy cannot be derived from the requested scope and permissions.",
@@ -69,6 +68,10 @@ export const ERROR_DOCS = {
         summary: "An authorization code is required to complete this step.",
         fix: "Pass the code returned by the authorization step.",
     },
+    authorization_level_not_allowed: {
+        summary: "This operation is reserved for a signed-in person, or the credential is acting at an authorization level the operation does not accept.",
+        fix: "This is not a scope problem and elevation will not clear it. Ask the person to perform the action in the dashboard.",
+    },
     authorization_pending: {
         summary: "The device login is not approved yet.",
         fix: "Keep polling at the advised interval until the user approves the request.",
@@ -79,7 +82,7 @@ export const ERROR_DOCS = {
     },
     build_execution_unavailable: {
         summary: "Build execution is not available on this deployment.",
-        fix: "Publish prebuilt static output instead, or wait for builds to become available.",
+        fix: "Publish prebuilt output instead.",
     },
     build_failed: {
         summary: "The build run failed before producing a version.",
@@ -101,6 +104,10 @@ export const ERROR_DOCS = {
         summary: "The build process was killed, most likely after running out of memory.",
         fix: "Reduce the build's memory usage or concurrency, then start a new build.",
     },
+    build_output_contains_server_bundle: {
+        summary: "The build output contains a compiled server bundle (an OpenNext worker.js), which a file-only publish would expose as a public download.",
+        fix: "This app needs the Spacefast Functions pipeline: run `sf publish` in the project with the Spacefast CLI so the worker deploys as a Function, or point the output directory at a browser-ready export.",
+    },
     build_output_dir_missing: {
         summary: "The build finished but its output directory was not produced.",
         fix: "Point the output directory setting at the folder your build writes (for example dist, build, out, or public).",
@@ -111,7 +118,7 @@ export const ERROR_DOCS = {
     },
     blob_gate_record_missing: {
         summary: "The file behind this download link no longer exists.",
-        fix: "Ask the owner for a fresh link; the underlying object was deleted.",
+        fix: "The underlying object was deleted. Ask the owner for a fresh link.",
     },
     blob_gate_token_invalid: {
         summary: "The download token is invalid or expired.",
@@ -139,7 +146,7 @@ export const ERROR_DOCS = {
     },
     claim_blocked_takedown: {
         summary: "This space is under an abuse takedown and cannot be claimed.",
-        fix: "Contact support if you believe the takedown is a mistake.",
+        fix: "If you believe the takedown is a mistake, contact support.",
     },
     claim_target_not_found: {
         summary: "The team or account to claim the space into was not found.",
@@ -147,7 +154,7 @@ export const ERROR_DOCS = {
     },
     claimed_space_quota_exceeded: {
         summary: "Claiming this space would exceed the target team's space quota.",
-        fix: "Delete unused spaces, then claim again. Still stuck? POST /v1/feedback with the error code and request id.",
+        fix: "Delete unused spaces, then claim again. If you are still stuck, POST /v1/feedback with the error code and requestId.",
     },
     cli_upgrade_required: {
         summary: "This CLI version is too old to talk to the API safely.",
@@ -155,7 +162,7 @@ export const ERROR_DOCS = {
     },
     config_file_too_large: {
         summary: "The sf.jsonc configuration file exceeds the maximum size.",
-        fix: "Keep the configuration file under the documented size limit (256 KB).",
+        fix: "Keep the configuration file at or under 256 KB.",
     },
     config_functions_key_removed: {
         summary: "The sf.jsonc configuration still uses the removed top-level functions key.",
@@ -175,7 +182,7 @@ export const ERROR_DOCS = {
     },
     config_runtime_entry_missing: {
         summary: "The declared runtime has no entry module to compile.",
-        fix: "Name the entry in sf.jsonc: runtime.entry for functions, runtime.server and runtime.client for zero. Remove the runtime block to publish static files instead.",
+        fix: "Name the entry in sf.jsonc: runtime.entry for functions, runtime.server and runtime.client for zero. Remove the runtime block to publish files without a runtime instead.",
     },
     config_runtime_invalid_kind: {
         summary: "The runtime block in the space configuration declares an unknown kind.",
@@ -183,11 +190,31 @@ export const ERROR_DOCS = {
     },
     config_templates_over_limit: {
         summary: "The configuration declares more template files than the plan allows.",
-        fix: "Reduce the number of template entries in sf.jsonc. Still stuck? POST /v1/feedback with the error code and request id.",
+        fix: "Reduce the number of template entries in sf.jsonc. If you are still stuck, POST /v1/feedback with the error code and requestId.",
+    },
+    confirmation_denied: {
+        summary: "A person reviewed this exact action and denied it. The denial is terminal.",
+        fix: "Stop retrying. You cannot clear this yourself; report the denial to the person who asked for the action.",
+    },
+    confirmation_expired: {
+        summary: "The confirmation for this action expired before a person decided it.",
+        fix: "Request the action again to get a fresh confirmation URL and continuation token. Do not retry the old token.",
+    },
+    confirmation_mismatch: {
+        summary: "The continuation token is bound to different action terms or a different resource revision than the request presenting it.",
+        fix: "Request a fresh confirmation for the action you actually intend to perform.",
+    },
+    confirmation_required: {
+        summary: "This action destroys live content or spends money, so a person must approve this exact action before it runs.",
+        fix: "Send the person to the `url` in the error details, then poll `pollUrl` with the `continuationToken` every 5 seconds. Give up after 10 minutes and report back. No flag or environment variable can clear this.",
+    },
+    confirmation_token_required: {
+        summary: "This exact action already has a decision, and a retry without its continuation token cannot clear the gate.",
+        fix: "Resume the existing decision with its continuation token instead of repeating the original request.",
     },
     continuation_unavailable: {
         summary: "This space key can no longer be exchanged for an API key.",
-        fix: "If the space is claimed, ask its owner for an API key (dashboard: Account → API keys). If it is still unclaimed, keep using the space key as bearer auth instead of exchanging it. Still stuck? POST /v1/feedback with the error code and request id.",
+        fix: "If the space is claimed, ask its owner for an API key (dashboard: team → Agents → API keys). If it is still unclaimed, keep using the space key as bearer auth instead of exchanging it. If you are still stuck, POST /v1/feedback with the error code and requestId.",
     },
     continuation_used: {
         summary: "This space key was already exchanged for a durable API key.",
@@ -199,7 +226,7 @@ export const ERROR_DOCS = {
     },
     credential_not_yet_valid: {
         summary: "The credential is not valid yet because its start time is in the future.",
-        fix: "Wait until the credential's notBefore time, or adjust it.",
+        fix: "Wait until the credential's notBefore time, or adjust the notBefore value.",
     },
     credential_retired: {
         summary: "This request used a retired Spacefast token format or authentication header.",
@@ -209,6 +236,10 @@ export const ERROR_DOCS = {
         summary: "The credential used for this request was revoked.",
         fix: "Create a new API key and update your client.",
     },
+    credential_sponsor_inactive: {
+        summary: "The person who authorized this machine credential is no longer an active member of the team it acts for.",
+        fix: "A team admin must re-authorize the credential, or point it at a live member, before it works again.",
+    },
     csam_blocked: {
         summary: "The content was blocked because it matched known child sexual abuse material.",
         fix: "This action is final and reported as required by law. Do not retry.",
@@ -217,6 +248,18 @@ export const ERROR_DOCS = {
         summary: "CSAM enforcement policy cannot be set below the mandatory account-suspend floor.",
         fix: "Set the CSAM category enforcement tier to account suspension.",
     },
+    dashboard_prefs_key_invalid: {
+        summary: "A dashboard preference key is empty or longer than the 64-character limit.",
+        fix: "Send preference keys that are between 1 and 64 characters long.",
+    },
+    dashboard_prefs_too_large: {
+        summary: "The merged dashboard preferences would exceed the 16KB serialized size limit.",
+        fix: "Store smaller values, or delete preferences you no longer need by setting them to null.",
+    },
+    dashboard_prefs_too_many_keys: {
+        summary: "The merged dashboard preferences would hold more than the 50 allowed keys.",
+        fix: "Delete preferences you no longer need by setting them to null before adding more.",
+    },
     data_location_immutable: {
         summary: "This request tried to change data location through an immutable path.",
         fix: "Data location is fixed when the space is created and cannot be changed afterwards. Create a new space in the region you want.",
@@ -225,13 +268,21 @@ export const ERROR_DOCS = {
         summary: "The live version has no database to read.",
         fix: 'Publish a Zero app, or declare `"database": true` under `runtime` in sf.jsonc for a Functions app.',
     },
+    decision_execution_lost: {
+        summary: "The approved action's execution lease is no longer held, so its result cannot be recorded.",
+        fix: "Poll the continuation to read the decision's current state before requesting the action again.",
+    },
+    decision_in_progress: {
+        summary: "This approved action is already executing.",
+        fix: "Poll the continuation instead of retrying the action; the original receipt is returned once it finishes.",
+    },
     device_authorization_failed: {
         summary: "The device login request failed and cannot be completed.",
         fix: "Start a new device login flow.",
     },
     device_verification_rate_limited: {
         summary: "Too many incorrect device codes were entered in a short window.",
-        fix: "Wait for the lockout to pass, then enter the code shown by your CLI exactly.",
+        fix: "Wait for the lockout to pass, then enter the code exactly as your CLI shows it.",
     },
     dns_export_required: {
         summary: "This operation requires exporting the current DNS records first.",
@@ -243,7 +294,7 @@ export const ERROR_DOCS = {
     },
     dns_import_partial_visibility: {
         summary: "The DNS import cannot see the full zone, so importing would lose records.",
-        fix: "Verify delegation and retry once the full zone is visible.",
+        fix: "Verify delegation. Once the full zone is visible, retry the import.",
     },
     dns_provider_auth_expired: {
         summary: "The connected DNS provider authorization expired or was revoked.",
@@ -251,7 +302,7 @@ export const ERROR_DOCS = {
     },
     dns_provider_batch_unsupported: {
         summary: "The connected DNS provider cannot apply this batch with the required semantics.",
-        fix: "Split the change or use a provider/zone that supports atomic batch writes.",
+        fix: "Split the change, or use a provider or zone that supports atomic batch writes.",
     },
     dns_provider_change_pending: {
         summary: "The DNS provider accepted the change but propagation or provider completion is still pending.",
@@ -323,7 +374,7 @@ export const ERROR_DOCS = {
     },
     dns_provider_replace_all_write_strategy: {
         summary: "This provider applies DNS changes with a replace-all write strategy.",
-        fix: "Review the full-zone diff carefully so unrelated MX, TXT, CAA, NS, and wildcard records are preserved.",
+        fix: "To preserve unrelated MX, TXT, CAA, NS, and wildcard records, review the full-zone diff carefully.",
     },
     dns_provider_snapshot_stale: {
         summary: "The cached DNS provider snapshot is stale.",
@@ -331,7 +382,7 @@ export const ERROR_DOCS = {
     },
     dns_provider_snapshot_unavailable: {
         summary: `${BRAND.productName} cannot cache the latest DNS provider snapshot.`,
-        fix: "Retry refresh after the cache or provider recovers. Do not edit connected-provider records from stale data.",
+        fix: "Retry the refresh after the cache or provider recovers. Do not edit connected-provider records from stale data.",
     },
     dns_provider_temporarily_unavailable: {
         summary: "The DNS provider is rate-limited, degraded, or temporarily unavailable.",
@@ -403,7 +454,7 @@ export const ERROR_DOCS = {
     },
     domain_quota_exceeded: {
         summary: "Adding this domain would exceed the plan's external domain allowance.",
-        fix: "Remove unused domains. Still stuck? POST /v1/feedback with the error code and request id.",
+        fix: "Remove unused domains. If you are still stuck, POST /v1/feedback with the error code and requestId.",
     },
     domain_registration_active: {
         summary: "The domain has an active registration, which blocks this operation.",
@@ -415,7 +466,7 @@ export const ERROR_DOCS = {
     },
     domain_reserved_suffix: {
         summary: `The hostname is under a ${BRAND.productName}-managed suffix and cannot be added as a domain.`,
-        fix: `Use a domain you own. ${BRAND.productName} assigns default and management hostnames automatically.`,
+        fix: `Use a domain you own. ${BRAND.productName} assigns default hostnames automatically.`,
     },
     domain_transfer_active: {
         summary: "The domain has a transfer in progress, which blocks this operation.",
@@ -437,9 +488,21 @@ export const ERROR_DOCS = {
         summary: "The version upload declares the same file path twice.",
         fix: "Deduplicate the file list so every path appears once.",
     },
+    elevation_not_required: {
+        summary: "The grant already includes every scope the elevation asked for.",
+        fix: "Retry the operation with the credential you already have; no elevation is needed.",
+    },
+    email_already_claimed: {
+        summary: "That email address is already verified on an account.",
+        fix: "Sign in with the address instead of adding it, or use a different address.",
+    },
+    email_verification_code_invalid: {
+        summary: "The emailed confirmation code is wrong, expired, or already used.",
+        fix: "Request a new code and enter the six digits from the newest email.",
+    },
     enforcement_policy_overlap: {
         summary: "Enforcement policy severity ranges overlap within a category.",
-        fix: "Adjust the category ranges so each severity is covered by at most one policy.",
+        fix: "Adjust the category ranges so at most one policy covers each severity.",
     },
     expired_token: {
         summary: "The token is expired.",
@@ -447,7 +510,7 @@ export const ERROR_DOCS = {
     },
     feature_unavailable: {
         summary: "This feature is not available on this deployment or plan.",
-        fix: "Check the feature's availability and try again when it is enabled for your team.",
+        fix: "Check the feature's availability. When the feature is enabled for your team, try again.",
     },
     files_mode_does_not_support_spa: {
         summary: "SPA fallback cannot be combined with files-listing mode.",
@@ -459,11 +522,11 @@ export const ERROR_DOCS = {
     },
     free_external_proxy_disabled: {
         summary: "Proxy routes to external upstreams are not available on the Free plan.",
-        fix: "Remove the proxy rules before publishing. Still stuck? POST /v1/feedback with the error code and request id.",
+        fix: "Remove the proxy rules before publishing. If you are still stuck, POST /v1/feedback with the error code and requestId.",
     },
     idempotency_conflict_in_progress: {
         summary: "Another request with the same Idempotency-Key is still in flight.",
-        fix: "Wait for the original request to finish. Its response will be replayed.",
+        fix: "Wait for the original request to finish. The API will replay that request's response.",
     },
     idempotency_key_reused: {
         summary: "The Idempotency-Key was reused with a different request body.",
@@ -475,15 +538,19 @@ export const ERROR_DOCS = {
     },
     inject_invalid: {
         summary: "The inject config key is malformed.",
-        fix: "Make inject an object whose head/bodyStart/bodyEnd/noscript entries are arrays of up to 16 strings.",
+        fix: "Make `inject` an object whose `head`, `bodyStart`, `bodyEnd`, and `noscript` entries are arrays of up to 16 strings.",
     },
     inject_snippet_too_large: {
         summary: "An inject snippet exceeds the per-snippet size limit.",
         fix: "Keep each inject snippet at or under 8 KB.",
     },
+    insufficient_scope: {
+        summary: "The credential authenticated, but its granted scopes do not include a set this operation accepts.",
+        fix: "Read the `WWW-Authenticate` challenge for the missing scopes, then request elevation or reconnect with them.",
+    },
     internal_error: {
         summary: "Something went wrong on our side.",
-        fix: "Retry the request. If it persists, contact support with the requestId.",
+        fix: "Retry the request. If the error persists, contact support with the requestId.",
     },
     invalid_claim_token: {
         summary: "The space key is invalid or does not match this space.",
@@ -497,6 +564,10 @@ export const ERROR_DOCS = {
         summary: "The requested data location is not a supported region.",
         fix: "Pick a region from the documented data locations, or use auto.",
     },
+    invalid_decision_state: {
+        summary: "The decision record is in a state this endpoint cannot interpret.",
+        fix: "Request the action again to open a fresh decision.",
+    },
     invalid_device_code: {
         summary: "The device code is invalid or expired.",
         fix: "Start a new device login flow.",
@@ -507,7 +578,11 @@ export const ERROR_DOCS = {
     },
     invalid_domain_name: {
         summary: "The domain name is not a valid registrable hostname.",
-        fix: "Check the spelling and use a fully-qualified domain name.",
+        fix: "Check the spelling and use a fully qualified domain name.",
+    },
+    invalid_elevation_request: {
+        summary: "An elevation request needs at least one scope and a rationale of 1 to 1024 characters.",
+        fix: "Send a non-empty scope list and a specific rationale, then retry.",
     },
     invalid_file_path: {
         summary: "A file path in the request is not a valid space path.",
@@ -551,7 +626,19 @@ export const ERROR_DOCS = {
     },
     invalid_user_code: {
         summary: "The user code does not match a pending device login.",
-        fix: "Enter the code exactly as shown by your CLI. Codes expire after a few minutes.",
+        fix: "Enter the code exactly as your CLI shows it. Codes expire after a few minutes.",
+    },
+    invalid_usage_bucket: {
+        summary: "The usage bucket has an invalid time range.",
+        fix: "Set bucketEnd to an instant after bucketStart, then retry.",
+    },
+    invalid_usage_correction: {
+        summary: "The correction does not match the original usage record.",
+        fix: "Use the same tenant, principal, space, mode, dimension, and bucket as the original.",
+    },
+    invalid_usage_window: {
+        summary: "The requested usage window is invalid or longer than 92 days.",
+        fix: "Use a positive window of 92 days or less.",
     },
     invalid_version_path: {
         summary: "A file path in the version is not a valid space path.",
@@ -579,7 +666,7 @@ export const ERROR_DOCS = {
     },
     invalid_zero_realtime_replay_query: {
         summary: "The Zero realtime replay query parameters are invalid.",
-        fix: "Use a valid afterEventId cursor and a numeric replay limit between 1 and 100.",
+        fix: "Send a retained `afterEventId` from a previous page's `nextAfterEventId`, and a replay limit between 1 and 100.",
     },
     invitation_already_exists: {
         summary: "An invitation for this email already exists on the team.",
@@ -595,15 +682,35 @@ export const ERROR_DOCS = {
     },
     invitation_not_pending: {
         summary: "The invitation is no longer pending.",
-        fix: "Create a new invitation if the member still needs to join.",
+        fix: "If the member still needs to join, create a new invitation.",
     },
     ip_blocked: {
         summary: "Requests from this IP address are blocked for abuse or policy reasons.",
-        fix: "Contact support with your IP address if you believe this block is in error.",
+        fix: "If you believe this block is a mistake, contact support with your IP address.",
+    },
+    issuer_exists: {
+        summary: "This partner token issuer is already active for another tenant.",
+        fix: "Use a globally unique issuer URL, or revoke the existing issuer before registering it here.",
+    },
+    issuer_not_active: {
+        summary: "The partner token issuer is registered but is not active.",
+        fix: "Activate the issuer, then request a new partner token.",
+    },
+    issuer_proof_invalid: {
+        summary: "The partner token issuer key-possession proof is invalid.",
+        fix: "Sign the current challenge and minted audience with one of the registered Ed25519 keys, then retry activation.",
+    },
+    issuer_tenant_occupied: {
+        summary: "This tenant already has a pending or active partner token issuer.",
+        fix: "Activate or revoke the tenant's existing issuer before registering another one.",
+    },
+    issuer_unknown: {
+        summary: "The partner token names an issuer that Spacefast does not recognize.",
+        fix: "Register the exact token issuer, then request a new partner token.",
     },
     job_not_found: {
         summary: "The background job was not found.",
-        fix: "Verify the job id. Completed jobs are eventually pruned.",
+        fix: "Verify the job id. Spacefast eventually prunes completed jobs.",
     },
     job_not_promotable: {
         summary: "The job cannot be promoted in its current state.",
@@ -635,11 +742,11 @@ export const ERROR_DOCS = {
     },
     malware_detected: {
         summary: "Malware was detected in the uploaded content.",
-        fix: "Remove the flagged files. Contact support if you believe this is a false positive.",
+        fix: "Remove the flagged files. If you believe the detection is a false positive, contact support.",
     },
     managed_domain_protected: {
         summary: "This is a system-managed view.fast hostname and cannot be mutated like a custom domain.",
-        fix: "Use it as a read-only managed hostname, or add a custom domain if you need editable DNS and binding controls.",
+        fix: "Use the hostname as a read-only managed hostname. If you need editable DNS and binding controls, add a custom domain.",
     },
     manifest_body_too_large: {
         summary: "The upload manifest body exceeds the maximum size.",
@@ -647,7 +754,7 @@ export const ERROR_DOCS = {
     },
     manifest_duplicate_path: {
         summary: "The upload manifest declares the same path more than once.",
-        fix: "Deduplicate paths. Comparisons use the canonical (decoded, NFC) form.",
+        fix: "Deduplicate paths. Comparisons use the canonical form: decoded and NFC-normalized.",
     },
     manifest_too_many_files: {
         summary: "The upload manifest declares more files than the allowed ceiling.",
@@ -667,23 +774,27 @@ export const ERROR_DOCS = {
     },
     move_target_capacity_lost: {
         summary: "The selected move target no longer has capacity for the space.",
-        fix: "Retry the move with a different target or after capacity is freed.",
+        fix: "Retry the move with a different target, or retry after capacity is freed.",
     },
     name_managed_by_config: {
         summary: "The space name is managed by sf.jsonc while its live version declares one.",
-        fix: "Change name in sf.jsonc and publish, or remove name from the file to rename the space through the API.",
+        fix: "Change `name` in `sf.jsonc` and publish, or remove `name` from the file to rename the space through the API.",
     },
     nameserver_delegation_required: {
         summary: `This operation requires the domain to be delegated to ${BRAND.productName} nameservers.`,
-        fix: "Update the domain's nameservers at the registrar, then retry once delegation propagates.",
+        fix: "Update the domain's nameservers at the registrar. After delegation propagates, retry.",
     },
     nameserver_divergence: {
         summary: "The domain's observed nameservers diverge from the expected set.",
         fix: "Align the registrar's nameserver records with the expected set, then re-check.",
     },
+    no_space_selected: {
+        summary: "The command needs a Space and this directory does not select one.",
+        fix: "Pass --space, link the directory with `sf link --space <id>`, or run it where a project link already selects a Space. `sf spaces ls` lists what the credential can reach.",
+    },
     noop_publish: {
         summary: "The publish matched the live version exactly, so nothing changed.",
-        fix: "No action needed. The existing live version already serves this content.",
+        fix: "No action is needed. The existing live version already serves this content.",
     },
     not_enrolled: {
         summary: "This account is not enrolled in the private beta, so the API cannot be used yet.",
@@ -691,11 +802,27 @@ export const ERROR_DOCS = {
     },
     not_found: {
         summary: "The requested resource was not found.",
-        fix: "Verify the id and that your credential can access the resource.",
+        fix: "Verify that the id is correct and that your credential can access the resource.",
+    },
+    partner_preset_not_grantable: {
+        summary: "The `partner_admin` preset is a tenant-rooted partner credential and cannot be minted as an ordinary team API key.",
+        fix: "Ask an operator to bootstrap a partner key for the tenant, or request a team-scoped preset such as `space_admin`.",
+    },
+    partner_tenant_immutable_client: {
+        summary: "The tenant's provider client cannot be changed.",
+        fix: "Create a new tenant with the desired provider client instead.",
+    },
+    password_already_set: {
+        summary: "The account already has a password.",
+        fix: "Change the existing password instead of setting a new one.",
+    },
+    password_compromised: {
+        summary: "The password appears in a public breach corpus.",
+        fix: "Pick a password you have not used anywhere else, then try again.",
     },
     path_case_collision: {
         summary: "Two file paths differ only by letter case, which collides on serving.",
-        fix: "Rename one of the files so paths are unique case-insensitively.",
+        fix: "Rename one of the files so that paths are unique case-insensitively.",
     },
     path_too_long: {
         summary: "A file path exceeds the maximum length.",
@@ -707,35 +834,91 @@ export const ERROR_DOCS = {
     },
     plan_grant_already_revoked: {
         summary: "This plan grant was already revoked.",
-        fix: "Nothing to do. Create a new grant if the team should regain the plan.",
+        fix: "No action is needed. If the team should regain the plan, create a new grant.",
+    },
+    plan_unknown: {
+        summary: "The requested plan name is not in the tenant's live plan catalog, so it cannot be assigned to a principal.",
+        fix: "Assign a plan declared in the tenant's system-space manifest. List the catalog's plan names and use one of them.",
     },
     placement_invalid_burstable: {
         summary: "The placement burstable option was used with an unsupported placement mode.",
-        fix: 'Set placement.mode to "dedicated" before setting placement.burstable, or remove the burstable option.',
-    },
-    platform_tenant_immutable_client: {
-        summary: "The tenant's provider client cannot be changed.",
-        fix: "Create a new tenant with the desired provider client instead.",
+        fix: 'Set `placement.mode` to `"dedicated"` before setting `placement.burstable`, or remove the burstable option.',
     },
     policy_exceeds_grantor: {
         summary: "The requested key policy grants more than your own credential allows.",
         fix: "Request a policy that is a subset of the credential creating the key.",
     },
+    prebuilt_metadata_invalid: {
+        summary: "The metadata file next to the prebuilt archive exists but cannot be read or parsed, so the build's runtime shape is unknown.",
+        fix: "Re-run `sf build` to regenerate the archive and its metadata together. If the archive contains plain files, delete the metadata file.",
+    },
     ingest_admission_exceeded: {
         summary: "Too many concurrent uploads for this space.",
-        fix: "Wait for the Retry-After window, then resume; at most 4 uploads run per space at once.",
+        fix: "Wait for the Retry-After window, then resume. At most 4 uploads run per space at once.",
+    },
+    primary_email_not_removable: {
+        summary: "The primary email address cannot be removed while it is the primary.",
+        fix: "Make another verified address primary first, then remove this one.",
+    },
+    principal_closed: {
+        summary: "The external principal is closed. Its spaces are tombstoned and cannot be modified.",
+        fix: "A closed principal is terminal and cannot be reopened; create a new principal to resume.",
+    },
+    principal_has_active_spaces: {
+        summary: "The external principal still owns spaces, so it cannot be closed.",
+        fix: "Delete the principal's spaces first, or retry with `force` to tombstone them as part of the close.",
+    },
+    principal_not_found: {
+        summary: "No external principal with that id exists in this tenant.",
+        fix: "List `/v1/principals` to see the ids this tenant knows; a principal appears only once it owns a resource.",
     },
     principal_space_mismatch: {
         summary: "The space does not belong to the principal in the request.",
         fix: "Use the space's owning team or account in the request path.",
     },
+    principal_suspended: {
+        summary: "The external principal is suspended. Its spaces serve the suspended page and its mutations are blocked.",
+        fix: "Unsuspend the principal to restore serving and writes; a Spacefast-applied suspension can only be lifted by Spacefast.",
+    },
+    principal_suspension_locked: {
+        summary: "The suspension was applied by Spacefast (legal/abuse) and cannot be lifted by the partner.",
+        fix: "Contact Spacefast support to resolve a platform-applied suspension.",
+    },
     promote_admission_exceeded: {
         summary: "Too many archived files are being restored for this space right now.",
-        fix: "Retry shortly; restores are limited to protect the host.",
+        fix: "Retry shortly. Spacefast limits restores to protect the host.",
+    },
+    promotion_live_content_missing: {
+        summary: "The live tenant's system space has nothing published, so promotion has no content to carry forward.",
+        fix: "Publish the live system space once, then promote the test tenant again.",
+    },
+    promotion_live_system_space_invalid: {
+        summary: "The space designated as the live tenant's system space is not an active space that tenant owns.",
+        fix: "Designate a live, active space owned by this tenant as its system space, then promote again.",
+    },
+    promotion_live_system_space_not_designated: {
+        summary: "The live tenant has no designated system space, and promotion publishes the test manifest onto it.",
+        fix: "Set the live tenant's systemSpaceId to a space it owns, then promote again.",
+    },
+    promotion_not_live_tenant: {
+        summary: "Promotion targets a live tenant, and the tenant named in the request is not in live mode.",
+        fix: "Call promotion against the live tenant, not its test twin.",
+    },
+    promotion_nothing_to_promote: {
+        summary: "The test tenant's system space has no live manifest, so there is no configuration to promote.",
+        fix: "Publish the test tenant's system space first, then promote it.",
+    },
+    promotion_runtime_publish_incomplete: {
+        summary: "The promoted version was accepted but its runtime publish did not finish, so live is unchanged.",
+        fix: "Retry the promotion. If it keeps failing, contact support with the `requestId`.",
+    },
+    promotion_test_twin_missing: {
+        summary: "This live tenant has no linked test tenant, so there is nothing to promote from.",
+        fix: "Create the tenant's test twin and publish its system space before promoting.",
     },
     provider_error: {
-        summary: "The hosting provider reported an error.",
-        fix: "Retry. If the error persists, contact support with the requestId.",
+        summary: "WP Cloud reported an error.",
+        fix: "Retry. If the error persists, contact support with the `requestId`.",
     },
     provider_job_failed: {
         summary: "A hosting-provider job failed while processing this operation.",
@@ -743,35 +926,35 @@ export const ERROR_DOCS = {
     },
     provider_job_timeout: {
         summary: "A hosting-provider job timed out while processing this operation.",
-        fix: "Retry the operation. If the provider is slow right now, wait and retry again.",
+        fix: "Retry the operation. If the provider is slow, wait and retry again.",
     },
     provider_privilege: {
-        summary: "The hosting provider does not grant this client permission to change the setting.",
+        summary: "WP Cloud does not grant this client permission to change the setting.",
         fix: "Leave the provider-owned setting unchanged or contact support to request the required provider capability.",
     },
     provider_runtime_feature_unsupported: {
-        summary: "The hosting provider does not support this runtime feature.",
+        summary: "WP Cloud does not support this runtime feature.",
         fix: "Check the feature's availability for this site's runtime.",
     },
     provider_site_id_required: {
         summary: "A provider site id is required for this internal operation.",
-        fix: "Pass the provider site reference.",
+        fix: "Pass the provider site id.",
     },
     proxy_upstream_denied: {
         summary: "The proxy upstream is on a denied network and cannot be used.",
-        fix: "Proxy only to public HTTPS upstreams. Private and internal addresses are blocked.",
+        fix: "Proxy only to public HTTPS upstreams. Spacefast blocks private and internal addresses.",
     },
     proxy_upstream_unresolved: {
         summary: "The proxy upstream hostname cannot be resolved.",
-        fix: "Verify the upstream DNS name resolves publicly, then publish again.",
+        fix: "Verify that the upstream DNS name resolves publicly, then publish again.",
     },
     publish_session_expired: {
         summary: "This publish session expired before it was finalized.",
-        fix: "Start a new publish; declared uploads are kept for 24 hours only.",
+        fix: "Start a new publish. Spacefast keeps declared uploads for 24 hours only.",
     },
     publish_archive_compression_ratio_exceeded: {
         summary: "The archive's compression ratio is suspiciously high and was rejected.",
-        fix: "Repackage the content without highly-compressible filler data.",
+        fix: "Repackage the content without highly compressible filler data.",
     },
     publish_archive_expanded_size_exceeded: {
         summary: "The archive expands beyond the maximum allowed total size.",
@@ -787,7 +970,7 @@ export const ERROR_DOCS = {
     },
     publish_base_changed: {
         summary: "Someone published new space settings after the base you loaded, so saving would overwrite their change.",
-        fix: "Reload the latest settings, review the difference, and save again. Pass force only to overwrite deliberately.",
+        fix: "Reload the latest settings, review the difference, and save again. Pass `force` only to overwrite deliberately.",
     },
     publish_bytes_missing: {
         summary: "The publish has no complete staged content to materialize.",
@@ -795,7 +978,7 @@ export const ERROR_DOCS = {
     },
     publish_config_unsupported: {
         summary: "The publish carries configuration this endpoint does not support.",
-        fix: "Move the configuration into sf.jsonc or the space settings.",
+        fix: "Move the configuration into `sf.jsonc` or the space settings.",
     },
     publish_failed: {
         summary: "The publish failed before going live.",
@@ -815,11 +998,11 @@ export const ERROR_DOCS = {
     },
     publish_not_cancelable: {
         summary: "The publish is past the point where it can be canceled.",
-        fix: "Wait for the publish to finish, then roll back by promoting a previous version if needed.",
+        fix: "Wait for the publish to finish. To roll back, promote a previous version.",
     },
     publish_path_collision: {
         summary: "Two different artifacts would serve the same URL after directory-index or clean-URL resolution.",
-        fix: "Rename or remove one artifact so every request route has one owner.",
+        fix: "Rename or remove one artifact so that every request route has one owner.",
     },
     publish_path_invalid: {
         summary: "A publish path is not a relative, normalized POSIX path.",
@@ -827,7 +1010,7 @@ export const ERROR_DOCS = {
     },
     publish_setup_failed: {
         summary: "Provisioning for this publish failed.",
-        fix: "Retry the publish. If it persists, contact support with the requestId.",
+        fix: "Retry the publish. If the error persists, contact support with the `requestId`.",
     },
     publish_snapshot_empty: {
         summary: "An empty snapshot was sent without an explicit base version.",
@@ -845,13 +1028,17 @@ export const ERROR_DOCS = {
         summary: "The named job queue does not exist.",
         fix: "Check the queue name against the operator queue list.",
     },
+    quota_exceeded: {
+        summary: "This action would exceed a quota on the plan assigned to the owning customer. The problem details name which quota (for example, the spaces cap) and its limit.",
+        fix: "Delete an existing resource to free room, or assign the customer a plan whose quota allows it.",
+    },
     response_headers_unservable: {
         summary: "A file needs a response header that the platform cannot deliver for large files.",
         fix: "Reduce the file below 100 MiB or drop the custom header.",
     },
     response_table_too_large: {
         summary: "A compiled response table exceeded the 1 MiB per-file limit.",
-        fix: "This version has an unusually dense path set; contact support with the requestId.",
+        fix: "This version has an unusually dense path set. Contact support with the `requestId`.",
     },
     rate_limited: {
         summary: "Too many requests were made in a short window.",
@@ -867,23 +1054,23 @@ export const ERROR_DOCS = {
     },
     resource_revision_changed: {
         summary: "The resource changed after you loaded it, so the stale write was rejected.",
-        fix: "Use the current resource returned in error.details.current, reapply the intended fields, and send its revision as expectedRevision.",
+        fix: "Use the current resource returned in `error.details.current`, reapply the intended fields, and send its revision as `expectedRevision`.",
     },
     review_item_claimed: {
         summary: "Another reviewer already claimed this review item.",
-        fix: "Pick a different item, or ask the current assignee (error.details.assignedToUserId) to release it.",
+        fix: "Pick a different item, or ask the current assignee to release it. The assignee's id is in `error.details.assignedToUserId`.",
     },
     routing_rules_over_plan: {
         summary: "The published _redirects and _headers exceed the plan's routing-rule allowance.",
-        fix: "Reduce the rule count. Still stuck? POST /v1/feedback with the error code and request id.",
+        fix: "Reduce the rule count. If you still need more rules, POST to `/v1/feedback` with the error code and the `requestId`.",
     },
     runtime_action_forbidden: {
         summary: "The runtime credential does not allow this action.",
         fix: "Use a runtime token scoped for this action.",
     },
     runtime_api_not_found: {
-        summary: "The runtime management endpoint was not found.",
-        fix: "Send the request with the management hostname as the Host header. Management routes are not served on public hostnames.",
+        summary: "The requested runtime action was not found.",
+        fix: "Use a supported runtime action and a token scoped for that action.",
     },
     runtime_callback_forbidden: {
         summary: "The runtime callback cannot be authenticated.",
@@ -891,19 +1078,19 @@ export const ERROR_DOCS = {
     },
     runtime_dev_unsupported: {
         summary: "`sf dev` cannot run this runtime locally yet.",
-        fix: "Run your framework's own dev server (`next dev`, `vite`, …) and publish with `sf publish` when you are ready.",
+        fix: "Run your framework's own dev server, such as `next dev` or `vite`. When you are ready, publish with `sf publish`.",
     },
     runtime_hostname_unassigned: {
         summary: "The hostname is not assigned to a runtime, so the request cannot be routed.",
-        fix: `Verify the binding is active and DNS points at ${BRAND.productName}.`,
+        fix: `Verify that the binding is active and that DNS points at ${BRAND.productName}.`,
     },
     runtime_instance_mismatch: {
         summary: "The request reached a different runtime instance than the one it was issued for.",
-        fix: "Re-request instructions. The space is on another instance now.",
+        fix: "Re-request instructions. The space is on another instance.",
     },
     runtime_jti_missing: {
         summary: "The runtime token is missing its replay-protection id.",
-        fix: "Mint a fresh runtime token. Tokens must carry a jti claim.",
+        fix: "Mint a fresh runtime token. Tokens must carry a `jti` claim.",
     },
     runtime_jti_replayed: {
         summary: "The runtime token was already used. Replays are rejected.",
@@ -915,7 +1102,7 @@ export const ERROR_DOCS = {
     },
     runtime_kind_mismatch: {
         summary: "This operation is only available for a different runtime kind.",
-        fix: "Check `sf runtime status` for what the live version actually runs, then use the surface that runtime supports.",
+        fix: "Check `sf runtime status` for what the live version actually runs, then use the operations that runtime supports.",
     },
     runtime_management_unavailable: {
         summary: "The runtime management surface is unavailable for this site.",
@@ -923,7 +1110,7 @@ export const ERROR_DOCS = {
     },
     runtime_not_provisioned: {
         summary: "The space does not serve a published version yet, so it has no runtime data to read.",
-        fix: "Publish a version first. If a publish is already running, wait for it — the operation receipt reports progress.",
+        fix: "Publish a version first. If a publish is already running, wait for it. The operation receipt reports progress.",
     },
     runtime_operation_missing: {
         summary: "The runtime operation referenced by this request was not found.",
@@ -931,7 +1118,11 @@ export const ERROR_DOCS = {
     },
     runtime_purge_failed: {
         summary: "Content updated but the edge cache purge did not confirm.",
-        fix: "The runtime retries automatically; recent visitors may briefly see the previous version.",
+        fix: "The runtime retries automatically. Recent visitors may briefly see the previous version.",
+    },
+    runtime_release_unverifiable: {
+        summary: "The requested platform release could not be verified at its origin.",
+        fix: "Check that the release exists and published its full set of artifacts, then request it again.",
     },
     runtime_scope_forbidden: {
         summary: "The runtime token's scope does not cover this path or action.",
@@ -939,7 +1130,7 @@ export const ERROR_DOCS = {
     },
     runtime_token_bad_signature: {
         summary: "The runtime token signature did not verify.",
-        fix: "Mint a fresh token. Verify clocks and JWKS freshness if it persists.",
+        fix: "Mint a fresh runtime token. If the error persists, verify clocks and JWKS freshness.",
     },
     runtime_token_expired: {
         summary: "The runtime token is expired.",
@@ -951,7 +1142,7 @@ export const ERROR_DOCS = {
     },
     runtime_unauthorized: {
         summary: "The request to the runtime carried no valid credential.",
-        fix: "Send the runtime JWT in the Authorization header.",
+        fix: "Send the runtime token in the Authorization header.",
     },
     runtime_upload_operation_not_supported: {
         summary: "The runtime upload session does not support this operation.",
@@ -963,7 +1154,7 @@ export const ERROR_DOCS = {
     },
     scan_pending: {
         summary: "The content is still being scanned for safety and cannot be served yet.",
-        fix: "Wait for the scan to finish. Serving resumes automatically once it clears.",
+        fix: "Wait for the scan to finish. Serving resumes automatically once the scan clears.",
     },
     secret_variable_in_template: {
         summary: "A secret variable was referenced in a template, which is blocked.",
@@ -971,15 +1162,19 @@ export const ERROR_DOCS = {
     },
     service_booting: {
         summary: "The process that received this request is still starting and cannot serve it yet.",
-        fix: "Wait for the Retry-After window, then send the same request again.",
+        fix: "Wait for the `Retry-After` window, then send the same request again.",
     },
     service_signature_invalid: {
         summary: "The service request signature cannot be verified.",
         fix: "Sign the exact request method, path, body digest, timestamp, and a fresh nonce.",
     },
+    session_not_fresh: {
+        summary: "This action needs a recent identity confirmation.",
+        fix: "Confirm it's you (password, authenticator code, or a code sent to your primary email), then retry.",
+    },
     site_already_deleted: {
         summary: "The site was already deleted.",
-        fix: "No action needed. The site is gone.",
+        fix: "No action is needed. The site is gone.",
     },
     site_has_live_spaces: {
         summary: "The site still has live spaces assigned to it, so it cannot be deleted.",
@@ -1027,7 +1222,7 @@ export const ERROR_DOCS = {
     },
     space_already_claimed: {
         summary: "The space was already claimed. A claim can only succeed once.",
-        fix: "If you published this space, exchange your space key once at POST /v1/claim/exchange. Keep publishing to the same spaceId with that durable API key. Otherwise ask the owner for access — do not publish a duplicate space.",
+        fix: "If you published this space, exchange your space key once at `POST /v1/claim/exchange`. Keep publishing to the same `spaceId` with that durable API key. Otherwise ask the owner for access. Do not publish a duplicate space.",
     },
     space_claim_unavailable: {
         summary: "This space cannot be claimed.",
@@ -1035,15 +1230,15 @@ export const ERROR_DOCS = {
     },
     space_claimed_credential_available: {
         summary: "The space was claimed and its owner kept agent publishing enabled; this space key now works exactly once as an exchange voucher.",
-        fix: "POST /v1/claim/exchange with this space key as bearer auth. Save the returned API key (e.g. .spacefast/state.json), then retry the request with it as Authorization: Bearer. Do not publish a new space.",
+        fix: "`POST /v1/claim/exchange` with this space key as bearer auth. Save the returned API key (for example in `.spacefast/state.json`), then retry the request with that key as `Authorization: Bearer`. Do not publish a new space.",
     },
     space_disabled: {
         summary: "The space is disabled and cannot be served or modified.",
-        fix: "Check the disabled reason on the space. It explains the path to restore it.",
+        fix: "Check the disabled reason on the space. The reason explains how to restore the space.",
     },
     space_expired: {
         summary: "The space expired and is no longer served.",
-        fix: "If it is within the recovery window, claim or restore it. Otherwise publish again.",
+        fix: "If the space is within the recovery window, claim or restore it. Otherwise publish again.",
     },
     space_has_active_publish: {
         summary: "The space has a publish in progress, which blocks this operation.",
@@ -1063,7 +1258,7 @@ export const ERROR_DOCS = {
     },
     space_not_disabled: {
         summary: "The space is not disabled, so it cannot be restored.",
-        fix: "No action needed. The space is already active.",
+        fix: "No action is needed. The space is already active.",
     },
     space_not_restorable: {
         summary: "The space is past its recovery window and cannot be restored.",
@@ -1083,11 +1278,15 @@ export const ERROR_DOCS = {
     },
     space_ref_ambiguous: {
         summary: "The space reference matches more than one accessible space.",
-        fix: "Use the spc_ id, or scope the reference with a teamRef.",
+        fix: "Use the `spc_` id, or scope the reference with a `teamRef`.",
     },
     space_ref_required: {
         summary: "A space reference is required for this operation.",
-        fix: "Pass a spc_ id, slug, or hostname.",
+        fix: "Pass a `spc_` id, slug, or hostname.",
+    },
+    space_selection_conflict: {
+        summary: "The command asked to create a Space while this directory already selects one.",
+        fix: "Drop --slug to publish to the selected Space, or publish from an unlinked directory to create a new one.",
     },
     space_transferring: {
         summary: "The space has a transfer in progress, which blocks this operation.",
@@ -1139,7 +1338,7 @@ export const ERROR_DOCS = {
     },
     storage_key_invalid: {
         summary: "The storage object id is malformed.",
-        fix: "Use the 32-character object id returned by storage.upload.",
+        fix: "Use the 32-character object id returned by `storage.upload`.",
     },
     storage_object_not_found: {
         summary: "The requested storage object does not exist.",
@@ -1159,15 +1358,31 @@ export const ERROR_DOCS = {
     },
     storage_unavailable: {
         summary: "The runtime cannot read or persist object storage.",
-        fix: "Retry on a healthy runtime. Contact support if the failure persists.",
+        fix: "Retry on a healthy runtime. If the failure persists, contact support.",
     },
     stripe_error: {
         summary: "The billing provider reported an error.",
-        fix: "Retry. If it persists, check the team's billing settings.",
+        fix: "Retry. If the error persists, check the team's billing settings.",
+    },
+    superadmin_two_factor_required: {
+        summary: "The user must have two-factor authentication enrolled before being granted superadmin.",
+        fix: "Ask them to enrol a second factor in account security, then grant the role again.",
+    },
+    superadmin_wpcom_account_required: {
+        summary: "The user must have a WordPress.com account linked before being granted superadmin.",
+        fix: "Ask them to link WordPress.com in account security, then grant the role again.",
     },
     superseded_by_publish: {
         summary: "A newer publish superseded this operation, so it was skipped.",
-        fix: "No action needed. The newer publish already carries the change.",
+        fix: "No action is needed. The newer publish already carries the change.",
+    },
+    system_space_conflict: {
+        summary: "The tenant's system space changed since the value you sent as `baseSystemSpaceId`, so the update was rejected.",
+        fix: "Re-read `/v1/tenants/{tenantId}`, confirm the current `systemSpaceId`, and retry with a matching `baseSystemSpaceId`.",
+    },
+    system_space_invalid: {
+        summary: "The requested system space does not exist, is disabled, or belongs to another tenant.",
+        fix: "Designate a live space this tenant owns as its system space.",
     },
     takeover_notice_window: {
         summary: "The hostname was recently bound elsewhere. A takeover notice window applies.",
@@ -1185,6 +1400,10 @@ export const ERROR_DOCS = {
         summary: "This operation requires an acting team.",
         fix: "Choose a team or pass a team reference.",
     },
+    team_scope_mismatch: {
+        summary: "The requested team conflicts with the team this credential or resource is bound to.",
+        fix: "Drop the team parameter to act on the bound team, or use a credential for the team you named.",
+    },
     team_slug_conflict: {
         summary: "The team slug is already taken.",
         fix: "Choose a different slug.",
@@ -1199,11 +1418,11 @@ export const ERROR_DOCS = {
     },
     template_file_too_large: {
         summary: "A template file exceeds the maximum size for substitution.",
-        fix: "Keep template files under the documented size limit (16 KB).",
+        fix: "Keep template files at or under 16 KB.",
     },
     template_not_in_version: {
         summary: "The configuration names a template file the version does not contain.",
-        fix: "Upload the file or remove its templates entry from sf.jsonc.",
+        fix: "Upload the file or remove its `templates` entry from `sf.jsonc`.",
     },
     template_variable_unresolved: {
         summary: "A template references a variable that has no value.",
@@ -1235,7 +1454,43 @@ export const ERROR_DOCS = {
     },
     theme_value_invalid: {
         summary: "A theme value in the configuration is outside the allowed grammar.",
-        fix: "Use allowed CSS values. The offending key is dropped with a warning otherwise.",
+        fix: "Use allowed CSS values. Otherwise the offending key is dropped with a warning.",
+    },
+    token_alg_invalid: {
+        summary: "The partner token uses a signing algorithm that Spacefast does not allow.",
+        fix: "Sign the token with a registered Ed25519 key.",
+    },
+    token_audience_mismatch: {
+        summary: "The partner token audience does not match the audience for its issuer.",
+        fix: "Set aud to the exact audience that Spacefast assigned to the issuer.",
+    },
+    token_claims_invalid: {
+        summary: "The partner token omits a required claim or contains an invalid claim value.",
+        fix: "Add valid iss, aud, sub, client_id, jti, iat, and exp claims.",
+    },
+    token_header_forbidden: {
+        summary: "The partner token contains a header that can select an untrusted key.",
+        fix: "Remove jku, x5u, jwk, and x5c from the token header.",
+    },
+    token_malformed: {
+        summary: "The partner token is not a valid compact JWT within the size limit.",
+        fix: "Send a valid compact JWT that is no larger than 8192 bytes.",
+    },
+    token_signature_invalid: {
+        summary: "The partner token signature does not match a registered issuer key.",
+        fix: "Sign the token with an active key that is registered for the issuer.",
+    },
+    token_subject_invalid: {
+        summary: "The partner token subject is not a normalized lowercase external principal id.",
+        fix: "Use a trimmed lowercase ASCII subject without wildcards, slashes, or reserved policy characters.",
+    },
+    token_ttl_invalid: {
+        summary: "The partner token time claims are expired, premature, or outside the lifetime limit.",
+        fix: "Issue a new token with exp after iat and no more than 1800 seconds after iat.",
+    },
+    token_type_invalid: {
+        summary: "The partner token has a typ header that Spacefast does not accept.",
+        fix: "Set typ to at+jwt or application/at+jwt.",
     },
     transfer_cross_tenant_unsupported: {
         summary: "Spaces cannot be transferred across tenants.",
@@ -1247,7 +1502,7 @@ export const ERROR_DOCS = {
     },
     transfer_push_failed: {
         summary: "The source runtime cannot push the space blobs into the transfer bucket.",
-        fix: "Retry the move. If it persists, check the source runtime and bucket configuration.",
+        fix: "Retry the move. If the failure persists, check the source runtime and bucket configuration.",
     },
     transfer_source_changed: {
         summary: "The space changed since the transfer was created, so it must be re-confirmed.",
@@ -1259,7 +1514,7 @@ export const ERROR_DOCS = {
     },
     transfer_verify_failed: {
         summary: "The target runtime cannot verify transferred blob content.",
-        fix: "Retry the move. If it persists, check the target runtime and bucket integrity.",
+        fix: "Retry the move. If the failure persists, check the target runtime and bucket integrity.",
     },
     unauthorized: {
         summary: "The request carried no valid credential.",
@@ -1285,13 +1540,17 @@ export const ERROR_DOCS = {
         summary: "An uploaded file's size does not match the declared size.",
         fix: "Re-check the local file and upload it again.",
     },
+    usage_period_not_found: {
+        summary: "The requested usage period does not exist in this tenant.",
+        fix: "List usage periods and use an id returned for the selected tenant.",
+    },
     user_banned: {
         summary: "This user is banned for a policy or abuse violation and cannot perform this action.",
-        fix: "Contact support to appeal the ban if you believe it is a mistake.",
+        fix: "If you believe the ban is a mistake, contact support to appeal it.",
     },
     validation_error: {
         summary: "A request field failed validation.",
-        fix: "Fix the field referenced by pointer and details, then retry.",
+        fix: "Fix the field referenced by `pointer` and `details`, then retry.",
     },
     verification_required: {
         summary: "Domain verification is required before this operation.",
@@ -1299,7 +1558,7 @@ export const ERROR_DOCS = {
     },
     version_already_live: {
         summary: "The version is already live on this channel.",
-        fix: "No action needed.",
+        fix: "No action is needed.",
     },
     version_artifact_not_found: {
         summary: "The requested version artifact was not found.",
@@ -1343,7 +1602,7 @@ export const ERROR_DOCS = {
     },
     version_in_use: {
         summary: "The version is referenced by one or more channels and cannot be deleted.",
-        fix: "Promote another version on those channels first. Details lists them.",
+        fix: "Promote another version on those channels first. The `details` field lists them.",
     },
     version_live: {
         summary: "The version is live and cannot be deleted.",
@@ -1375,7 +1634,7 @@ export const ERROR_DOCS = {
     },
     version_quota_exceeded: {
         summary: "The space is at its version quota.",
-        fix: "Delete old versions. Still stuck? POST /v1/feedback with the error code and request id.",
+        fix: "Delete old versions. If the quota error persists, `POST /v1/feedback` with the error code and request id.",
     },
     version_total_bytes_exceeded: {
         summary: "The version exceeds the maximum total size.",
@@ -1385,6 +1644,10 @@ export const ERROR_DOCS = {
         summary: "The webhook exhausted its delivery budget and was paused.",
         fix: "Fix the receiving endpoint, then redeliver or re-enable the webhook.",
     },
+    webhook_managed_by_manifest: {
+        summary: "The webhook is declared in the tenant's system-space manifest.",
+        fix: "Edit its `system.subscriptions` entry and publish the system space.",
+    },
     whois_unavailable: {
         summary: "WHOIS data is unavailable for this domain right now.",
         fix: "Retry later.",
@@ -1395,7 +1658,7 @@ export const ERROR_DOCS = {
     },
     zero_artifact_abi_mismatch: {
         summary: "The Zero endpoint artifact was built for a different runner ABI.",
-        fix: `Rebuild and republish the Zero project with the current ${BRAND.productName} CLI and runtime.`,
+        fix: `Rebuild the Zero project with the current ${BRAND.productName} CLI and runtime, then publish it again.`,
     },
     zero_artifact_invalid: {
         summary: "The Zero endpoint artifact is missing required runtime metadata.",
@@ -1415,7 +1678,7 @@ export const ERROR_DOCS = {
     },
     zero_auth_unavailable: {
         summary: "Hosted Zero auth is not configured for this deployment.",
-        fix: "Finalize the Zero version with hosted auth URLs or use guest/local auth.",
+        fix: "Finalize the Zero version with hosted auth URLs, or use guest or local auth.",
     },
     zero_blob_key_invalid: {
         summary: "The local Zero blob key is invalid.",
@@ -1435,15 +1698,15 @@ export const ERROR_DOCS = {
     },
     zero_bootstrap_encode_failed: {
         summary: "The Zero runner cannot encode the JavaScript bootstrap data.",
-        fix: "Retry with valid request metadata. Report the issue if it persists.",
+        fix: "Retry with valid request metadata. If the issue persists, report it.",
     },
     zero_bytecode_hash_mismatch: {
         summary: "The Zero endpoint bytecode hash does not match its artifact metadata.",
-        fix: "Rebuild and republish so bytecode and endpoint metadata are from the same build.",
+        fix: "Rebuild and publish again so bytecode and endpoint metadata are from the same build.",
     },
     zero_bytecode_invalid: {
         summary: "The Zero endpoint bytecode cannot be loaded by QuickJS.",
-        fix: "Rebuild the project with the current Zero runner and redeploy.",
+        fix: "Rebuild the project with the current Zero runner and publish again.",
     },
     zero_bytecode_path_invalid: {
         summary: "The Zero endpoint bytecode path is invalid.",
@@ -1455,7 +1718,7 @@ export const ERROR_DOCS = {
     },
     zero_capabilities_encode_failed: {
         summary: "The runtime cannot encode the Zero endpoint capabilities.",
-        fix: "Rebuild with valid capability metadata. Report the failure if it persists.",
+        fix: "Rebuild with valid capability metadata. If the failure persists, report it.",
     },
     zero_client_bundle_not_loaded: {
         summary: "The local Zero dev client bundle is not generated or loaded.",
@@ -1463,11 +1726,11 @@ export const ERROR_DOCS = {
     },
     zero_db_connect_failed: {
         summary: "The Zero runner cannot connect to the configured database.",
-        fix: "Verify DATABASE_URL or the generated MySQL connection variables and retry.",
+        fix: "Verify `DATABASE_URL` or the generated MySQL connection variables and retry.",
     },
     zero_db_execute_failed: {
         summary: "A Zero database write failed.",
-        fix: "Inspect the mutation, schema, and database logs, then retry after fixing the SQL issue.",
+        fix: "Inspect the mutation, schema, and database logs. Fix the SQL issue, then retry.",
     },
     zero_db_export_cursor_invalid: {
         summary: "The local database export cursor is invalid or belongs to another export.",
@@ -1495,7 +1758,7 @@ export const ERROR_DOCS = {
     },
     zero_db_host_install_failed: {
         summary: "The Zero runner cannot install the database host bridge.",
-        fix: "Rebuild with a current runner and report the failure if it repeats.",
+        fix: "Rebuild with a current runner. If the failure repeats, report it.",
     },
     zero_db_operation_invalid: {
         summary: "The Zero database bridge received an invalid operation payload.",
@@ -1511,7 +1774,7 @@ export const ERROR_DOCS = {
     },
     zero_db_query_failed: {
         summary: "A Zero database read failed.",
-        fix: "Inspect the query, schema, and database logs, then retry after fixing the SQL issue.",
+        fix: "Inspect the query, schema, and database logs. Fix the SQL issue, then retry.",
     },
     zero_db_row_invalid: {
         summary: "A database row cannot be converted into a Zero response value.",
@@ -1527,7 +1790,7 @@ export const ERROR_DOCS = {
     },
     zero_db_transaction_active: {
         summary: "The Zero runner tried to start a database transaction while one was already active.",
-        fix: "Rebuild with the current Zero runner and report the failure if it repeats.",
+        fix: "Rebuild with the current Zero runner. If the failure repeats, report it.",
     },
     zero_db_transaction_commit_failed: {
         summary: "The Zero database transaction cannot be committed.",
@@ -1539,7 +1802,7 @@ export const ERROR_DOCS = {
     },
     zero_db_transaction_missing: {
         summary: "The Zero runner tried to finish a database transaction that was not active.",
-        fix: "Rebuild with the current Zero runner and report the failure if it repeats.",
+        fix: "Rebuild with the current Zero runner. If the failure repeats, report it.",
     },
     zero_db_transaction_rollback_failed: {
         summary: "The Zero database transaction cannot be rolled back cleanly.",
@@ -1559,11 +1822,11 @@ export const ERROR_DOCS = {
     },
     zero_db_url_invalid: {
         summary: "The Zero database URL is malformed.",
-        fix: "Set DATABASE_URL or the generated database variables to a valid MySQL connection URL.",
+        fix: "Set `DATABASE_URL` or the generated database variables to a valid MySQL connection URL.",
     },
     zero_db_url_missing: {
         summary: "No Zero database URL is configured.",
-        fix: "Configure DATABASE_URL or finalize the version with database connection variables.",
+        fix: "Configure `DATABASE_URL` or finalize the version with database connection variables.",
     },
     zero_dev_endpoint_failed: {
         summary: "A local Zero dev endpoint failed while handling the request.",
@@ -1571,7 +1834,7 @@ export const ERROR_DOCS = {
     },
     zero_dump_query_invalid: {
         summary: "The Zero database dump query parameters are invalid.",
-        fix: "Use valid table, limit, and cursor parameters.",
+        fix: "Use valid `table`, `limit`, and `cursor` parameters.",
     },
     zero_endpoint_compile_failed: {
         summary: "The runtime cannot compile the Zero endpoint bytecode.",
@@ -1591,11 +1854,11 @@ export const ERROR_DOCS = {
     },
     zero_endpoint_index_invalid: {
         summary: "The Zero endpoint index does not contain valid endpoint mappings.",
-        fix: "Rebuild and republish the Zero project.",
+        fix: "Rebuild the Zero project and publish it again.",
     },
     zero_endpoint_index_malformed: {
         summary: "The Zero endpoint index cannot be parsed.",
-        fix: "Rebuild the generated endpoint index and redeploy.",
+        fix: "Rebuild the generated endpoint index and publish again.",
     },
     zero_endpoint_index_path_invalid: {
         summary: "The Zero endpoint index path is invalid.",
@@ -1603,7 +1866,7 @@ export const ERROR_DOCS = {
     },
     zero_endpoint_index_unreadable: {
         summary: "The Zero endpoint index cannot be read.",
-        fix: "Verify the version finalized with zero/endpoints-index.json present.",
+        fix: "Verify the version finalized with `zero/endpoints-index.json` present.",
     },
     zero_endpoint_invalid: {
         summary: "A Zero endpoint definition or its database metadata is invalid.",
@@ -1611,7 +1874,7 @@ export const ERROR_DOCS = {
     },
     zero_endpoint_mismatch: {
         summary: "The requested Zero endpoint does not match the endpoint artifact.",
-        fix: "Rebuild routes and artifacts together and redeploy the version.",
+        fix: "Rebuild routes and artifacts together, then publish the version again.",
     },
     zero_endpoint_not_found: {
         summary: "No Zero endpoint artifact exists for this endpoint id.",
@@ -1625,9 +1888,17 @@ export const ERROR_DOCS = {
         summary: "The Zero endpoints payload exceeds the supported endpoint count.",
         fix: "Reduce the project to at most 128 Zero endpoints, then publish again.",
     },
+    zero_email_unavailable: {
+        summary: "The local Zero email service is not configured.",
+        fix: "Publish the capsule to call the hosted email service, or guard the `ctx.email` call so local runs skip it.",
+    },
     zero_envelope_encode_failed: {
         summary: "The PHP bridge cannot encode the Zero runner request envelope.",
-        fix: "Retry with valid request data. Report the issue if it persists.",
+        fix: "Retry with valid request data. If the issue persists, report it.",
+    },
+    zero_gravatar_unavailable: {
+        summary: "The local Zero gravatar service is not configured.",
+        fix: "Publish the capsule to call the hosted gravatar service. `ctx.gravatar.avatarUrl` needs no service and works locally.",
     },
     zero_js_context_init_failed: {
         summary: "The Zero runner cannot initialize a QuickJS context.",
@@ -1643,11 +1914,11 @@ export const ERROR_DOCS = {
     },
     zero_js_globals_failed: {
         summary: "The Zero runner cannot install runtime globals for the endpoint.",
-        fix: "Rebuild with a current runner and report the failure if it repeats.",
+        fix: "Rebuild with a current runner. If the failure repeats, report it.",
     },
     zero_js_response_malformed: {
         summary: "The Zero endpoint returned a malformed runner response.",
-        fix: "Return a valid Response or supported Zero handler result.",
+        fix: "Return a valid `Response` or supported Zero handler result.",
     },
     zero_js_runtime_init_failed: {
         summary: "The Zero runner cannot initialize QuickJS.",
@@ -1655,7 +1926,7 @@ export const ERROR_DOCS = {
     },
     zero_log_query_invalid: {
         summary: "The Zero log query parameters are invalid.",
-        fix: "Use valid cursor, limit, handlerName, and requestId parameters.",
+        fix: "Pass `cursor` exactly as the previous page's `nextCursor`, keep `limit` between 1 and 100, and send `since` and `until` as ISO timestamps.",
     },
     zero_method_not_allowed: {
         summary: "The request method is not allowed for this Zero endpoint.",
@@ -1667,7 +1938,7 @@ export const ERROR_DOCS = {
     },
     zero_query_name_missing: {
         summary: "A Zero realtime query subscription did not include a query name.",
-        fix: "Send a query.subscribe frame with a valid query name.",
+        fix: "Send a `query.subscribe` frame with a valid query name.",
     },
     zero_realtime_forbidden: {
         summary: "The Zero realtime event intake credential is invalid.",
@@ -1679,7 +1950,7 @@ export const ERROR_DOCS = {
     },
     zero_realtime_operation_unsupported: {
         summary: "The Zero realtime websocket operation is unsupported.",
-        fix: "Use a supported Zero realtime operation such as query.subscribe or query.unsubscribe.",
+        fix: "Use a supported Zero realtime operation such as `query.subscribe` or `query.unsubscribe`.",
     },
     zero_realtime_query_invalid: {
         summary: "The Zero realtime query subscription payload is invalid.",
@@ -1687,7 +1958,7 @@ export const ERROR_DOCS = {
     },
     zero_realtime_space_required: {
         summary: "The Zero realtime request does not identify a space.",
-        fix: "Use a /spaces/{spaceId} realtime URL or include a valid spaceId query parameter.",
+        fix: "Use a `/spaces/{spaceId}` realtime URL or include a valid `spaceId` query parameter.",
     },
     zero_realtime_unavailable: {
         summary: "Zero realtime helpers are unavailable for this endpoint.",
@@ -1699,11 +1970,11 @@ export const ERROR_DOCS = {
     },
     zero_replay_failed: {
         summary: "The hosted Zero runtime cannot fetch realtime replay events.",
-        fix: "Retry shortly. Check the central realtime and control-plane logs if it persists.",
+        fix: "Retry shortly. If the failure persists, check the central realtime and control-plane logs.",
     },
     zero_replay_query_invalid: {
         summary: "The hosted Zero realtime replay query is invalid.",
-        fix: "Use a valid afterEventId cursor and numeric limit.",
+        fix: "Send a retained `afterEventId` from a previous page's `nextAfterEventId`, and a numeric limit.",
     },
     zero_replay_unavailable: {
         summary: "Realtime replay is not configured for this Zero version.",
@@ -1711,7 +1982,7 @@ export const ERROR_DOCS = {
     },
     zero_request_body_too_large: {
         summary: "The Zero request body exceeds the runtime size limit.",
-        fix: "Send a smaller request body or move large payloads to blob/object storage.",
+        fix: "Send a smaller request body or move large payloads to blob or object storage.",
     },
     zero_response_header_forbidden: {
         summary: "A Zero endpoint attempted to set a platform-managed response header.",
@@ -1747,7 +2018,7 @@ export const ERROR_DOCS = {
     },
     zero_runner_envelope_invalid: {
         summary: "The Zero runner request envelope is malformed.",
-        fix: "Use the generated runtime bridge and redeploy if generated files are stale.",
+        fix: "Use the generated runtime bridge. If generated files are stale, publish again.",
     },
     zero_runner_failed: {
         summary: "The Zero runner process exited without a valid response.",
@@ -1759,15 +2030,15 @@ export const ERROR_DOCS = {
     },
     zero_runner_invalid_response: {
         summary: "The Zero runner output was not valid JSON.",
-        fix: "Inspect runner stderr and rebuild the runner if the failure persists.",
+        fix: "Inspect runner stderr. If the failure persists, rebuild the runner.",
     },
     zero_runner_invalid_status: {
         summary: "The Zero runner returned an invalid HTTP status.",
-        fix: "Ensure endpoint handlers return a status between 100 and 599.",
+        fix: "Return a status between 100 and 599 from endpoint handlers.",
     },
     zero_runner_protocol_unsupported: {
         summary: "The Zero runner received an unsupported invoke protocol.",
-        fix: "Rebuild and redeploy so the PHP bridge and Rust runner versions match.",
+        fix: "Rebuild and publish again so the PHP bridge and Rust runner versions match.",
     },
     zero_runner_response_encode_failed: {
         summary: "The Zero runner cannot encode its response.",
@@ -1775,7 +2046,7 @@ export const ERROR_DOCS = {
     },
     zero_runner_stdin_invalid: {
         summary: "The Zero runner cannot read its request envelope.",
-        fix: "Retry. Report the runtime bridge failure if it persists.",
+        fix: "Retry. If the runtime bridge failure persists, report it.",
     },
     zero_runner_stdin_too_large: {
         summary: "The Zero runner request envelope is too large.",
@@ -1785,6 +2056,10 @@ export const ERROR_DOCS = {
         summary: "The Zero runner process cannot be started.",
         fix: "Verify the runner binary is installed and executable in the runtime.",
     },
+    zero_spam_unavailable: {
+        summary: "The local Zero spam service is not configured.",
+        fix: "Publish the capsule to call the hosted spam service, or guard the `ctx.spam` call so local runs skip it.",
+    },
     zero_runs_invalid: {
         summary: "The Zero run-handler payload is invalid.",
         fix: "Send a valid array of generated run handlers and publish again.",
@@ -1829,6 +2104,8 @@ export const ERROR_DOCS = {
         summary: "The infra webhook secret is not configured on this deployment.",
         fix: "Set the infra webhook secret in the control-plane environment.",
     },
+    // `satisfies`, not an annotation, so the table keeps its literal types while
+    // still failing the build the moment a code has no entry.
 };
 const PRODUCT = BRAND.productName;
 /** One generated reference page per error code; the `.md` twin is this exact text. */