@spacefast/common 0.0.24 → 0.2.1

package/dist/utils/static-runtime-policy.js

@@ -1,85 +1,21 @@
 // Single source of truth for static-runtime content policy: PHP-like inert
-// classification, immutable-asset detection, and safe content-type forcing.
+// classification and safe content-type forcing.
 //
-// This module is intentionally pure (no node:path, no I/O) so the exact same
-// rules can be mechanically code-generated into the PHP runtime (runtime
-// policies) and exercised by both TypeScript and PHP against one shared fixture
-// (static-runtime-policy.fixtures.json). Do not add platform/filesystem
+// Pure by design (no node:path, no I/O) so the same rules can be code-generated
+// into the PHP runtime and exercised against one shared fixture
+// (static-runtime-policy.fixtures.json). Do not add platform or filesystem
 // behavior here.
-export const PHP_LIKE_EXTENSIONS = ["php", "php3", "php4", "php5", "php7", "php8", "phtml", "phar"];
-// The internal-redirect/sendfile family: headers that do not describe a response, they
-// instruct the web server to produce a different one. Under nginx+php-fpm
-// X-Accel-Redirect (and every vendor spelling of it) turns a response into a server-side
-// read of an arbitrary internal path — a private-path disclosure primitive — while
-// X-Accel-Limit-Rate pins the serving worker for the length of the transfer.
-//
-// These are dangerous from ANY origin we do not control, so this family is factored out
-// of the platform-managed list below: a relay lane (runtime/engine/runtime/proxy.php)
-// must drop exactly this set from an untrusted upstream while still relaying the
-// ordinary response headers (location, content-encoding, content-range, allow) that the
-// rest of the managed list contains.
-export const INTERNAL_REDIRECT_RESPONSE_HEADERS = [
-    "x-accel-buffering",
-    "x-accel-charset",
-    "x-accel-expires",
-    "x-accel-limit-rate",
-    "x-accel-redirect",
-    "x-lighttpd-send-file",
-    "x-lighttpd-sendfile",
-    "x-lighttpd-sendfile2",
-    "x-reproxy-url",
-    "x-sendfile",
-];
-// Rejected/platform-managed response headers (internal-docs/platform.md "Routing And
-// Headers"): user `_headers` rules can never set or remove these. The
-// internal-redirect/sendfile family above is spread in, so it stays a strict subset —
-// anything the proxy lane refuses to relay is also refused from `_headers`. The rest is
-// the connection and transport surface: hop-by-hop names (Connection, Keep-Alive, TE,
-// Trailer, Transfer-Encoding, Upgrade, Proxy-*), framing, and the edge-cache trio.
-//
-// `isPlatformManagedResponseHeader` — not this list alone — is the policy: the reserved
-// `x-spacefast-*` / `x-stattic-*` namespaces below carry the platform's own response
-// signature (X-Spacefast-Runtime, X-Spacefast-Version, X-Spacefast-Reason, …), so user
-// rules can never forge or clobber them.
+// The platform-managed response-header policy is authored in Rust
+// (crates/stattic-runtime-policy) and generated into the .generated.ts beside
+// this file and into runtime/engine/shared/safety.php, so every managed header
+// name is written down exactly once.
 //
-// Every enforcement point derives from here: the `_headers` compiler in
-// @spacefast/routing imports it directly, the PHP runtime maps and prefixes are
-// generated from it into runtime/engine/shared/safety.php, and the Rust authorities
-// (crates/stattic-runtime-core policy.rs, crates/stattic-zero-runner
-// response_headers.rs) are drift-guarded against it by
-// apps/control-plane/src/runtime/php-policy-parity.test.ts.
-export const PLATFORM_MANAGED_RESPONSE_HEADERS = [
-    "accept-ranges",
-    "age",
-    "allow",
-    "alt-svc",
-    "cdn-cache-control",
-    "cloudflare-cdn-cache-control",
-    "connection",
-    "content-encoding",
-    "content-length",
-    "content-range",
-    "cookie",
-    "date",
-    "host",
-    "keep-alive",
-    "location",
-    "netlify-cdn-cache-control",
-    "proxy-authenticate",
-    "proxy-authorization",
-    "server",
-    "set-cookie",
-    "strict-transport-security",
-    "surrogate-control",
-    "te",
-    "trailer",
-    "transfer-encoding",
-    "upgrade",
-    "vary",
-    ...INTERNAL_REDIRECT_RESPONSE_HEADERS,
-];
-/** Reserved response-header namespaces owned by the platform's own serving signature. */
-export const PLATFORM_MANAGED_RESPONSE_HEADER_PREFIXES = ["x-spacefast-", "x-stattic-"];
+// To change it: edit the Rust crate, run
+// `bun scripts/check-finalizer-protocol.mjs --write`, then
+// `bun --filter @spacefast/control-plane runtime:codegen-policy`.
+import { INTERNAL_REDIRECT_RESPONSE_HEADERS, PLATFORM_MANAGED_RESPONSE_HEADER_PREFIXES, PLATFORM_MANAGED_RESPONSE_HEADERS, } from "./static-runtime-policy.generated.js";
+export { INTERNAL_REDIRECT_RESPONSE_HEADERS, PLATFORM_MANAGED_RESPONSE_HEADER_PREFIXES, PLATFORM_MANAGED_RESPONSE_HEADERS, };
+export const PHP_LIKE_EXTENSIONS = ["php", "php3", "php4", "php5", "php7", "php8", "phtml", "phar"];
 const PLATFORM_MANAGED_RESPONSE_HEADER_SET = new Set(PLATFORM_MANAGED_RESPONSE_HEADERS);
 /** True when user rules may neither set nor remove this response header. */
 export function isPlatformManagedResponseHeader(name) {
@@ -87,52 +23,24 @@ export function isPlatformManagedResponseHeader(name) {
     return (PLATFORM_MANAGED_RESPONSE_HEADER_SET.has(lower) ||
         PLATFORM_MANAGED_RESPONSE_HEADER_PREFIXES.some((prefix) => lower.startsWith(prefix)));
 }
-export const NON_IMMUTABLE_EXTENSIONS = ["html", "htm", "php", "txt", "xml"];
-const PHP_LIKE_EXTENSION_SET = new Set(PHP_LIKE_EXTENSIONS);
-const NON_IMMUTABLE_EXTENSION_SET = new Set(NON_IMMUTABLE_EXTENSIONS);
-// Immutable caching is decided by DETERMINISTIC signals only — reserved framework
-// build directories below, plus user-declared `_headers` Cache-Control rules that
-// override the baked default at serve time. There is deliberately NO filename-entropy
-// heuristic: an 8-char base64url bundler hash is character-for-character
-// indistinguishable from a short human name (D3GeoMap, McKayCV2), so any guess either
-// pins a user's mutable file for a year (stale site nobody can fix — browsers have no
-// bust channel) or silently downgrades real hashes to revalidate-every-load, which
-// under the wp.cloud edge per-IP rate limiter turned dashboard page loads into 429
-// storms (2026-07-06). Unrecognized files default to the safe direction:
-// `max-age=0, must-revalidate` for browsers, long s-maxage + purge-on-publish at the
-// edge.
-//
-// Each prefix is HIGH-CONFIDENCE guaranteed-hashed:
-//   - `_next/static/`   Next.js immutable build assets (chunks/css/media), all
-//                       [contenthash]; Next itself serves this dir with `immutable`.
-//   - `_app/immutable/` SvelteKit (Vite) — the directory is literally named `immutable`
-//                       and holds only fingerprinted chunks/assets.
-//   - `_nuxt/`          Nuxt build dir — Vite-hashed client bundle, served from a
-//                       reserved app-owned path.
-//   - `_astro/`         Astro bundled assets — all content-hashed.
-//
-// DELIBERATELY EXCLUDED: generic user-writable dirs (Vite's `assets/`, CRA/Gatsby's
-// `static/`). Users drop NON-hashed files there, so widening to them would create
-// year-long false positives. Deployments of bundler output declare those dirs immutable
-// themselves via a `_headers` rule (e.g. `/assets/*` → `Cache-Control: public,
-// max-age=31536000, immutable`), which the publisher — a build we ran, an agent, a CI
-// deploy — writes because it KNOWS the output is content-hashed.
-export const GUARANTEED_IMMUTABLE_PREFIXES = [
-    "_next/static/",
-    "_app/immutable/",
-    "_nuxt/",
-    "_astro/",
-];
-/** True when the path lives under a framework dir where every emitted asset is content-hashed. */
-function isUnderGuaranteedImmutablePrefix(filePath) {
-    const normalized = filePath.startsWith("/") ? filePath.slice(1) : filePath;
-    for (const prefix of GUARANTEED_IMMUTABLE_PREFIXES) {
-        if (normalized.startsWith(prefix)) {
-            return true;
-        }
-    }
-    return false;
+/**
+ * The token grammar a `_headers` rule accepts for a header NAME. Anything that
+ * GENERATES `_headers` rules must gate on it too, so a generated rule can
+ * never fail the author's publish.
+ */
+export const HEADER_RULE_NAME_PATTERN = /^[A-Za-z0-9-]+$/;
+/** `content-type` → `Content-Type`: the casing compiled rules and generated `_headers` carry. */
+export function canonicalHeaderName(input) {
+    return input
+        .trim()
+        .toLowerCase()
+        .split("-")
+        .map((part) => (part ? `${part[0]?.toUpperCase() ?? ""}${part.slice(1)}` : part))
+        .join("-");
 }
+const PHP_LIKE_EXTENSION_SET = new Set(PHP_LIKE_EXTENSIONS);
+// Immutable-asset detection is NOT decided here: `compiled_cache_class` in
+// crates/stattic-runtime-core (responses.rs) is the one implementation.
 function lastSegment(filePath) {
     const slash = filePath.lastIndexOf("/");
     return slash >= 0 ? filePath.slice(slash + 1) : filePath;
@@ -152,15 +60,6 @@ export function pathStem(filePath) {
 export function isPhpLikeStaticPath(filePath) {
     return PHP_LIKE_EXTENSION_SET.has(pathExtension(filePath));
 }
-export function isImmutableAssetPath(filePath) {
-    if (NON_IMMUTABLE_EXTENSION_SET.has(pathExtension(filePath))) {
-        return false;
-    }
-    // Path-convention layer: anything under a guaranteed-content-hashed framework build
-    // dir is immutable regardless of filename. The extension gate above still applies,
-    // so an `index.html` accidentally under `_next/static/` is never pinned.
-    return isUnderGuaranteedImmutablePrefix(filePath);
-}
 /** Forced inert serving policy for a committed static file. PHP-like files are never executable. */
 export function runtimeFileSafety(filePath) {
     return {

package/dist/utils/storage-policy.js

@@ -156,8 +156,7 @@ function storageHttpDateTimestamp(weekday, day, month, year, hour, minute, secon
     return date.getTime() + (second === 60 ? 1_000 : 0);
 }
 // HTTP-date has exactly three accepted wire forms (RFC 9110 §5.6.7). General
-// date parsers also accept relative/free-form input such as `tomorrow`, so
-// validators must parse the grammar and validate its calendar components.
+// date parsers also accept `tomorrow`, so this parses the grammar itself.
 export function storageParseHttpDate(value) {
     const input = value.trim();
     let match = /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat), (\d{2}) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{4}) (\d{2}):(\d{2}):(\d{2}) GMT$/.exec(input);

package/dist/utils/upload-session.d.ts

@@ -33,8 +33,10 @@ export declare class UploadTargetError extends Error {
     readonly target: UploadTarget;
     readonly status: number;
     readonly serverError?: UploadTargetServerError | undefined;
-    constructor(target: UploadTarget, status: number, message: string, serverError?: UploadTargetServerError | undefined);
+    readonly retryAfterMs?: number | undefined;
+    constructor(target: UploadTarget, status: number, message: string, serverError?: UploadTargetServerError | undefined, retryAfterMs?: number | undefined);
 }
+export declare function uploadRetryAfterMs(value: string | null, now?: number): number | undefined;
 export declare function uploadPageHasRemainder(page: UploadSession): boolean;
 export declare const UPLOAD_STALLED_RESUME_MAX_ATTEMPTS = 3;
 export declare function uploadQueueAdvanced(before: UploadSession, after: UploadSession | null): boolean;
@@ -42,6 +44,7 @@ export declare function executeUploadSession(input: {
     session: UploadSession;
     targets?: readonly UploadTarget[] | undefined;
     concurrency?: number | undefined;
+    settleOnFailure?: boolean | undefined;
     fetch?: ((...args: Parameters<typeof fetch>) => ReturnType<typeof fetch>) | undefined;
     prepareTarget?: ((target: UploadTarget) => Promise<UploadTargetBody> | UploadTargetBody) | undefined;
     onEvent?: ((event: UploadSessionEvent) => void) | undefined;

package/dist/utils/upload-session.js

@@ -2,14 +2,30 @@ export class UploadTargetError extends Error {
     target;
     status;
     serverError;
-    constructor(target, status, message, serverError) {
+    retryAfterMs;
+    constructor(target, status, message, serverError, retryAfterMs) {
         super(message);
         this.target = target;
         this.status = status;
         this.serverError = serverError;
+        this.retryAfterMs = retryAfterMs;
         this.name = "UploadTargetError";
     }
 }
+export function uploadRetryAfterMs(value, now = Date.now()) {
+    if (!value) {
+        return undefined;
+    }
+    const seconds = Number(value);
+    if (Number.isFinite(seconds) && seconds >= 0) {
+        return Math.ceil(seconds * 1000);
+    }
+    const date = Date.parse(value);
+    if (!Number.isFinite(date)) {
+        return undefined;
+    }
+    return Math.max(0, date - now);
+}
 function parseUploadTargetServerError(raw) {
     let parsed;
     try {
@@ -42,24 +58,18 @@ function parseUploadTargetServerError(raw) {
         ...(requestId ? { requestId } : {}),
     };
 }
-// Manifest paging policy — ONE definition, shared by every uploader (the CLI
-// and the control plane's inline uploader).
+// Manifest paging policy, shared by every uploader.
 //
-// `targets` is a single instruction page, bounded by the instruction payload
-// budget; `summary.upload` counts the whole declared manifest. A short page
-// therefore means a remainder that only `resume` hands out, and an uploader
-// that stops at the first page finalizes a version the runtime rejects with
-// `version_upload_incomplete`. A complete page means there is nothing left to
-// ask for — don't re-resume to double-check the uploads, since the runtime
-// verifies size and sha256 on every PUT and finalize independently enumerates
-// anything still missing.
+// `targets` is one instruction page; `summary.upload` counts the whole
+// manifest. A short page means a remainder only `resume` hands out, and an
+// uploader that stops there finalizes a version the runtime rejects with
+// `version_upload_incomplete`. Don't re-resume a complete page: finalize
+// enumerates anything still missing.
 export function uploadPageHasRemainder(page) {
     return page.summary.upload > page.targets.length;
 }
-// Resume mints the next page from runtime session truth, so a converging
-// session always hands back different work. A page that repeats the previous
-// one is a session that is not draining; retry it a bounded number of times,
-// then fail loudly rather than page forever.
+// An active session always hands back different work. A page that repeats
+// the previous one is not draining, so retry boundedly rather than page forever.
 export const UPLOAD_STALLED_RESUME_MAX_ATTEMPTS = 3;
 export function uploadQueueAdvanced(before, after) {
     if (!after || after.targets.length === 0) {
@@ -73,7 +83,7 @@ export function uploadQueueAdvanced(before, after) {
     }
     return after.targets.some((target, index) => target.path !== before.targets[index]?.path);
 }
-async function runConcurrent(items, concurrency, fn) {
+async function runConcurrent(items, concurrency, settleOnFailure, fn) {
     let nextIndex = 0;
     const runWorker = async () => {
         const item = items[nextIndex++];
@@ -83,7 +93,18 @@ async function runConcurrent(items, concurrency, fn) {
         await fn(item);
         return runWorker();
     };
-    await Promise.all(Array.from({ length: Math.min(Math.max(concurrency, 1), items.length || 1) }).map(() => runWorker()));
+    const workers = Array.from({
+        length: Math.min(Math.max(concurrency, 1), items.length || 1),
+    }).map(() => runWorker());
+    if (!settleOnFailure) {
+        await Promise.all(workers);
+        return;
+    }
+    const outcomes = await Promise.allSettled(workers);
+    const failed = outcomes.find((outcome) => outcome.status === "rejected");
+    if (failed) {
+        throw failed.reason;
+    }
 }
 export async function executeUploadSession(input) {
     const targets = input.targets ?? input.session.targets;
@@ -91,7 +112,8 @@ export async function executeUploadSession(input) {
         return;
     }
     const fetchImpl = input.fetch ?? fetch;
-    await runConcurrent(targets, input.concurrency ?? 4, async (target) => {
+    const settleOnFailure = input.settleOnFailure ?? false;
+    await runConcurrent(targets, input.concurrency ?? 4, settleOnFailure, async (target) => {
         input.onEvent?.({ type: "target-start", target });
         try {
             const prepared = input.prepareTarget
@@ -114,7 +136,7 @@ export async function executeUploadSession(input) {
                 const details = await response.text().catch(() => "");
                 const serverError = parseUploadTargetServerError(details);
                 const suffix = details.trim() ? `: ${details.trim().slice(0, 1_000)}` : "";
-                throw new UploadTargetError(target, response.status, `Upload failed for ${target.path} with ${response.status} ${response.statusText}${suffix}.`, serverError);
+                throw new UploadTargetError(target, response.status, `Upload failed for ${target.path} with ${response.status} ${response.statusText}${suffix}.`, serverError, uploadRetryAfterMs(response.headers.get("retry-after")));
             }
             input.onEvent?.({ type: "target-done", target });
         }

package/dist/utils/version-path.js

@@ -1,19 +1,14 @@
-// Canonical object-path form (internal-docs/platform.md "Upload Contract"):
-// UTF-8, Unicode NFC, percent-decoded exactly once. This canonical form is
-// what manifest paths, finalize's normalized paths, route-map keys, and dedup
-// keys all mean. The PHP runtime applies the same transform (rawurldecode once
-// + Normalizer::normalize) at upload and serve time.
+// Canonical object-path form (spec "Upload Contract"): UTF-8, Unicode NFC,
+// percent-decoded exactly once. Manifest paths, route-map keys and dedup keys
+// all mean this form. The PHP runtime applies the same transform.
 // oxlint-disable-next-line no-control-regex -- matching control characters is the point: they are never part of a servable path.
 const CONTROL_CHARS_PATTERN = /[\u0000-\u001f\u007f]/;
-// Structural normalization shared by lookups and intake: forward slashes,
-// no leading slashes, no control characters, no empty/"."/".." segments.
-// Idempotent; safe to apply to already-canonical stored paths (NFC is
-// idempotent, no percent-decoding).
+// Structural normalization shared by lookups and intake. Idempotent, so it is
+// safe on already-canonical stored paths (no percent-decoding here).
 export function normalizeVersionPath(input) {
     const normalized = input.replace(/\\/g, "/").replace(/^\/+/, "").normalize("NFC");
-    // Here rather than only in canonicalizeVersionPath: publish-policy's
-    // staticUploadPathViolation validates with this function, so a control
-    // character in an uploaded path used to pass the policy unclassified.
+    // Here, not only in canonicalizeVersionPath: staticUploadPathViolation
+    // validates with this function.
     if (CONTROL_CHARS_PATTERN.test(normalized)) {
         throw new Error(`invalid_version_path:${input}`);
     }
@@ -34,10 +29,8 @@ export function normalizeVersionPath(input) {
     return safePath;
 }
 // Intake canonicalization: percent-decode EXACTLY once, then NFC, then the
-// structural rules. Applied wherever paths enter the system (manifest intake,
-// archive extraction, runtime upload, serve-time lookup) and never to paths
-// that are already canonical — decode-once is not idempotent. Throws on
-// malformed percent sequences, control characters, traversal, and empty paths.
+// structural rules. Applied wherever paths enter the system, never to paths
+// that are already canonical, because decode-once is not idempotent.
 export function canonicalizeVersionPath(input) {
     let decoded;
     try {
@@ -47,9 +40,8 @@ export function canonicalizeVersionPath(input) {
         throw new Error(`invalid_version_path:${input}`);
     }
     const canonical = decoded.normalize("NFC");
-    // Backslashes as separators are denied at intake (spec "Static path
-    // policy"); only client-side helpers translate Windows separators.
-    // Control characters are rejected by normalizeVersionPath below.
+    // Backslashes are denied at intake (spec "Static path policy"); only
+    // client-side helpers translate Windows separators.
     if (canonical.includes("\\")) {
         throw new Error(`invalid_version_path:${input}`);
     }

package/dist/utils/wpcom-auth-redirects.d.ts

@@ -3,31 +3,22 @@ export type LoginIntentSearch = {
     returnTo?: string | undefined;
 };
 /**
- * Optional query params WordPress.com's OAuth2 authorize endpoint understands
- * (wpcom `wp-content/mu-plugins/oauth2/oauth2.php`). All are cosmetic/flow
- * hints — dropping them never breaks the OAuth handshake.
+ * Optional query params WordPress.com's OAuth2 authorize endpoint understands.
+ * All are cosmetic hints, so dropping them never breaks the handshake.
  */
 export type WpcomAuthorizeExtras = {
     /** Prefills the email field on the WP.com login screen (`user_email`). */
     userEmail?: string | undefined;
     /** Localizes the WP.com login/consent/signup screens (`locale`). */
     locale?: string | undefined;
-    /**
-     * `implicit=false`: WP.com signs the user out of WordPress.com and shows a
-     * fresh login instead of silently reusing the current WP.com session. The
-     * only way to let a user switch WP.com accounts — without it, sign-out on
-     * our side loops them straight back into the same account.
-     */
-    switchAccount?: boolean | undefined;
 };
 export declare function decorateWpcomAuthorizeUrl(authorizeUrl: string, extras?: WpcomAuthorizeExtras): string;
 export declare function buildDashboardLoginPath(input: LoginIntentSearch): string;
 export declare function buildWpcomAuthStartPath(input: LoginIntentSearch & {
     /**
-     * A signed OAuth authorize query (Better Auth's login-page redirect).
-     * Carried through the WordPress.com round trip so the auth server can
-     * resume the authorization flow the moment the session exists. Opaque
-     * here — the auth server verifies its signature.
+     * A signed OAuth authorize query, carried through the WordPress.com round
+     * trip so the auth server can resume the flow once the session exists.
+     * Opaque here; the auth server verifies its signature.
      */
     oauthQuery?: string | undefined;
 }): string;

package/dist/utils/wpcom-auth-redirects.js

@@ -6,14 +6,11 @@ export function decorateWpcomAuthorizeUrl(authorizeUrl, extras = {}) {
         url.searchParams.set("user_email", email);
     }
     // WP.com validates locales against its own list and falls back to English,
-    // so a light shape check is enough here. English is the default — omit it.
+    // so a light shape check is enough here. English is the default, so omit it.
     const locale = extras.locale?.trim().toLowerCase().replace("_", "-");
     if (locale && /^[a-z]{2}(-[a-z]{2})?$/.test(locale) && locale !== "en") {
         url.searchParams.set("locale", locale);
     }
-    if (extras.switchAccount) {
-        url.searchParams.set("implicit", "false");
-    }
     return url.toString();
 }
 export function buildDashboardLoginPath(input) {

package/dist/vocabulary.d.ts

@@ -104,8 +104,8 @@ export declare const CONCEPTS: {
         readonly id: "infra";
         readonly canonicalNoun: "infra";
         readonly aliases: readonly ["infrastructure"];
-        readonly externalTerms: readonly ["WP.Cloud"];
-        readonly deprecated: readonly ["code.storage", "Pierre"];
+        readonly externalTerms: readonly ["WP Cloud"];
+        readonly deprecated: readonly ["code.storage", "Pierre", "the hosting provider"];
         readonly description: string;
     };
 };
@@ -143,16 +143,16 @@ export declare const EXTERNAL_TERM_ALLOWLIST: readonly [{
     readonly replacement: "space";
     readonly reason: string;
 }, {
-    readonly term: "WP.Cloud";
+    readonly term: "WP Cloud";
     readonly concept: "infra";
-    readonly allowedContexts: readonly ["platform-api", "fixed-phrase"];
-    readonly allowedPhrases: readonly ["built on WP.Cloud"];
+    readonly allowedContexts: readonly ["fixed-phrase"];
+    readonly allowedPhrases: readonly ["the same infra as Automattic, WP Cloud, Pressable, and WordPress.com", "the same infrastructure as WordPress.com, Tumblr, WordPress VIP and WP Cloud"];
     readonly replacement: "infra";
     readonly reason: string;
 }];
 /**
  * AMENDMENT (DECIDED 2026-07-02): the deploy vocabulary stays, as documented,
- * first-class ALIASES of the canonical vocabulary — `deploy` is an exact alias of
+ * first-class ALIASES of the canonical vocabulary. `deploy` is an exact alias of
  * `publish` (the verb) and `deployments` is an alias of `versions` (the noun).
  * The canonical lifecycle nouns are unchanged: version / channel / build.
  *
@@ -164,7 +164,7 @@ export declare const EXTERNAL_TERM_ALLOWLIST: readonly [{
  *   - Wherever the alias is introduced, attach DEPLOY_ALIAS_DISAMBIGUATION
  *     (the one sanctioned disambiguation sentence) so readers land on the
  *     canonical nouns.
- *   - A bare "deployment" noun in FRESH prose is still discouraged — write
+ *   - A bare "deployment" noun in FRESH prose is still discouraged. Write
  *     "version" (the thing) or "publish" (the act) unless deliberately using
  *     the alias, in which case disambiguate.
  */
@@ -208,10 +208,10 @@ export declare const PROVIDER_HYGIENE: {
         readonly reason: "The build sandbox vendor is never named; it is 'Spacefast Builds'.";
     };
     readonly wpcloud: {
-        readonly internalName: "WP.Cloud";
+        readonly internalName: "WP Cloud";
         readonly replacement: "infra";
-        readonly allowedContexts: readonly ["platform-api", "fixed-phrase"];
-        readonly allowedPhrases: readonly ["built on WP.Cloud"];
+        readonly allowedContexts: readonly ["fixed-phrase"];
+        readonly allowedPhrases: readonly ["the same infra as Automattic, WP Cloud, Pressable, and WordPress.com", "the same infrastructure as WordPress.com, Tumblr, WordPress VIP and WP Cloud"];
         readonly reason: string;
     };
     readonly codeStorage: {
@@ -247,10 +247,10 @@ export type CliCanonicalVerb = keyof typeof CLI_ALIASES;
  * Disclosure tiers gate how much of a surface (CLI help, `sf docs`) shows by
  * default, so neither humans nor agents are overwhelmed:
  *
- *   - `essential` — the handful of commands/docs a new user or agent needs to
+ *   - `essential`: the handful of commands/docs a new user or agent needs to
  *     make a first publish and manage a space. The default everywhere.
- *   - `full` — the complete product CLI surface (everything not hidden).
- *   - `reference` — absolutely everything, including hidden/advanced commands.
+ *   - `full`: the complete product CLI surface (everything not hidden).
+ *   - `reference`: absolutely everything, including hidden/advanced commands.
  *
  * Tiers are cumulative for ranked surfaces (`reference` ⊇ `full` ⊇ `essential`);
  * see {@link tierVisibleAt}. This is THE source of truth for tier ids + labels.