@spacefast/common 0.0.26 → 0.2.2

package/dist/dashboard-paths/index.js

@@ -1,55 +1,31 @@
+import { DERIVED_SPACE_SLUG_ROUTE_RESERVATIONS, DERIVED_TEAM_SLUG_ROUTE_RESERVATIONS, } from "./route-reservations.generated.js";
 /**
- * Dashboard route first-segments that cannot be used as team slugs.
- *
- * Append-only: add a new top-level static dashboard route's first segment here
- * before its route module lands. A repository structural test enforces this.
+ * Reservations for a dashboard surface that has not shipped yet. Shipped
+ * surfaces are derived in route-reservations.generated.ts, so this is the only
+ * hand-authored list. Delete an entry once the generator starts deriving it;
+ * leaving both is a duplicate that fails this module's own test.
  */
-export const TEAM_SLUG_ROUTE_RESERVATIONS = [
-    "accept-beta-invite",
-    "accept-invitation",
-    "account",
-    "access",
-    // Not a TanStack route module: /agent* is the edge-served handoff-document
-    // surface (apps/my/public/_redirects + vite middleware, #417). Those rewrite
-    // rules deliberately swallow every /agent-prefixed path, so a team named
-    // "agent" could never reach its canonical dashboard. Reserved per the spec's
-    // own rule that a static first segment is reserved before the surface owning
-    // it ships (#417 predates this set; this closes that drift).
-    "agent",
-    "claim",
-    "device",
-    "drop",
-    "new-team",
-    "oauth",
-    "push",
-    "sign-in",
-    "start",
-    "terminal",
-    "two-factor",
-];
+const UNBUILT_TEAM_SLUG_ROUTE_RESERVATIONS = [];
 /**
- * Dashboard route first-segments that cannot be used as space slugs.
- *
- * Append-only: add a new static route directly below a team's first segment
- * here before its route module lands. A repository structural test enforces
- * this.
+ * `connect` is held for the team-level connect page (see
+ * `reservedSegmentActivationContract` in apps/my's dashboard route ledger).
  */
+export const UNBUILT_SPACE_SLUG_ROUTE_RESERVATIONS = ["connect"];
+/** Dashboard route first-segments that cannot be used as team slugs. */
+export const TEAM_SLUG_ROUTE_RESERVATIONS = [
+    ...DERIVED_TEAM_SLUG_ROUTE_RESERVATIONS,
+    ...UNBUILT_TEAM_SLUG_ROUTE_RESERVATIONS,
+];
+/** Dashboard route first-segments that cannot be used as space slugs. */
 export const SPACE_SLUG_ROUTE_RESERVATIONS = [
-    "billing",
-    "connect",
-    "domains",
-    "drop",
-    "members",
-    "new",
-    "resume",
-    "settings",
+    ...DERIVED_SPACE_SLUG_ROUTE_RESERVATIONS,
+    ...UNBUILT_SPACE_SLUG_ROUTE_RESERVATIONS,
 ];
 export const TEAM_SLUG_ROUTE_RESERVATION_SET = new Set(TEAM_SLUG_ROUTE_RESERVATIONS);
 export const SPACE_SLUG_ROUTE_RESERVATION_SET = new Set(SPACE_SLUG_ROUTE_RESERVATIONS);
 /**
- * The Runtime page's sections. They are search params rather than path
- * segments, so `runtime` stays a single route (and a single ledger row) and a
- * space slugged "runtime" keeps its own Runtime page at
+ * The Runtime page's sections. Search params, not path segments, so `runtime`
+ * stays one route and a space slugged "runtime" keeps its own Runtime page at
  * `/<team>/runtime/runtime`.
  */
 export const SPACE_RUNTIME_SECTIONS = ["overview", "database", "storage", "logs"];
@@ -72,10 +48,19 @@ export function buildDetailPath(teamSlug, spaceSlug, buildId) {
 export function spaceDomainsPath(teamSlug, spaceSlug) {
     return `${spacePath(teamSlug, spaceSlug)}/domains`;
 }
+/** Build runs and the repository connection that produces them. */
+export function spaceBuildsPath(teamSlug, spaceSlug) {
+    return `${spacePath(teamSlug, spaceSlug)}/builds`;
+}
+export function spaceIntegrationsPath(teamSlug, spaceSlug) {
+    return `${spacePath(teamSlug, spaceSlug)}/integrations`;
+}
+export function spaceVariablesPath(teamSlug, spaceSlug) {
+    return `${spacePath(teamSlug, spaceSlug)}/variables`;
+}
 /**
- * The space's Runtime page. The default section is the bare URL — the route
- * strips it back out of the address bar — so a link to "overview" and a link to
- * the page itself are the same link.
+ * The space's Runtime page. The route strips the default section back out of the
+ * address bar, so a link to "overview" and a link to the page are the same link.
  */
 export function spaceRuntimePath(teamSlug, spaceSlug, section = DEFAULT_SPACE_RUNTIME_SECTION) {
     const root = `${spacePath(teamSlug, spaceSlug)}/runtime`;
@@ -89,7 +74,10 @@ export function teamDomainsPath(teamSlug) {
     return `${teamPath(teamSlug)}/domains`;
 }
 export function teamBillingPath(teamSlug) {
-    return `${teamPath(teamSlug)}/billing`;
+    return teamSettingsPath(teamSlug, "billing");
+}
+export function teamDeveloperSurfacePath(teamSlug, surface) {
+    return `${teamPath(teamSlug)}/${surface}`;
 }
 export function teamDomainDetailPath(teamSlug, domainRef) {
     return `${teamDomainsPath(teamSlug)}/${dynamicSegment(domainRef)}`;

package/dist/dashboard-paths/route-reservations.generated.d.ts

@@ -0,0 +1,2 @@
+export declare const DERIVED_TEAM_SLUG_ROUTE_RESERVATIONS: readonly ["accept-beta-invite", "accept-invitation", "access", "account", "approvals", "claim", "device", "drop", "new-team", "oauth", "push", "sign-in", "start", "terminal", "two-factor"];
+export declare const DERIVED_SPACE_SLUG_ROUTE_RESERVATIONS: readonly ["agents", "api-keys", "billing", "domains", "drop", "handoffs", "members", "new", "resume", "settings", "variables", "webhooks"];

package/dist/dashboard-paths/route-reservations.generated.js

@@ -0,0 +1,36 @@
+// @generated by `bun run check:dashboard-route-reservations -- --write`.
+// Source: apps/my/src/routes (static first segments of route modules) and
+// apps/my/public/_redirects (same-origin edge rules that claim a path before the
+// router sees it). Add the route or the rule, regenerate, and the slug stops
+// being claimable. Hand edits are overwritten.
+export const DERIVED_TEAM_SLUG_ROUTE_RESERVATIONS = [
+    "accept-beta-invite",
+    "accept-invitation",
+    "access",
+    "account",
+    "approvals",
+    "claim",
+    "device",
+    "drop",
+    "new-team",
+    "oauth",
+    "push",
+    "sign-in",
+    "start",
+    "terminal",
+    "two-factor",
+];
+export const DERIVED_SPACE_SLUG_ROUTE_RESERVATIONS = [
+    "agents",
+    "api-keys",
+    "billing",
+    "domains",
+    "drop",
+    "handoffs",
+    "members",
+    "new",
+    "resume",
+    "settings",
+    "variables",
+    "webhooks",
+];

package/dist/docs/agent-arrival.d.ts

@@ -0,0 +1,92 @@
+import { type AnonymousAgentHandoffStatus } from "../contracts/device-auth.js";
+export declare const AGENT_HANDOFF_REQUEST_FAILED_MESSAGE = "Request failed.";
+export declare const AGENT_HANDOFF_INVALID_RESPONSE_MESSAGE = "Invalid agent handoff response.";
+/**
+ * The messages that say nothing a person can act on. A UI showing an error
+ * detail line suppresses these, so it never renders "failed: Request failed."
+ */
+export declare const AGENT_HANDOFF_GENERIC_MESSAGES: ReadonlySet<string>;
+export declare class AgentHandoffRequestError extends Error {
+    readonly code: string | null;
+    constructor(message: string, code?: string | null);
+}
+export type AgentArrivalConfig = {
+    /** Origin the anonymous handoff endpoints live on. */
+    apiOrigin: string;
+    /**
+     * Origins a minted link may legitimately carry, most likely first. A deploy
+     * may mint on the API origin or on a front-end origin that proxies
+     * `/handoffs/*` to it, so this is a list, not a guess. Defaults to the API
+     * origin alone.
+     */
+    allowedOrigins?: readonly string[];
+    /** Transport seam: tests and the dashboard's attributed client swap it. */
+    fetch?: typeof globalThis.fetch;
+    /** Clock seam for the cadence and reuse policies. */
+    now?: () => number;
+};
+export type MintedAnonymousArrival = {
+    /** Ledger id of the handoff. Not a secret — the poll and analytics key off it. */
+    id: string;
+    /**
+     * Composes the copy-ready prompt for the task selected RIGHT NOW. It is a
+     * function, not a stored string, for two reasons: one handoff is reused
+     * across a visit while the task behind the prompt keeps changing, and the
+     * bearer stays captured in this closure instead of sitting in caller state.
+     * The result contains the one-use URL: clipboard only.
+     */
+    promptFor: (context: string) => string;
+    /** Epoch ms. */
+    expiresAt: number;
+};
+/**
+ * Mints the signed-out handoff a copied prompt carries.
+ *
+ * The anonymous surface is anonymous by contract, so this deliberately sends no
+ * credentials: it works signed out, and a mint that carried a session would
+ * answer differently for gated accounts.
+ */
+export declare function mintAnonymousArrival(config: AgentArrivalConfig): Promise<MintedAnonymousArrival>;
+/** Reads one anonymous handoff's fetch state by its non-secret ledger id. */
+export declare function readAnonymousArrivalStatus(id: string, config: AgentArrivalConfig): Promise<AnonymousAgentHandoffStatus>;
+export declare const AGENT_ARRIVAL_EAGER_POLL_MS = 2000;
+export declare const AGENT_ARRIVAL_EAGER_WINDOW_MS: number;
+export declare const AGENT_ARRIVAL_RELAXED_POLL_MS = 10000;
+/**
+ * The handoff's own TTL is the clock: with no `since` to carry, "how much
+ * runway is left" says how long ago it was minted.
+ */
+export declare const AGENT_ARRIVAL_RELAXED_AFTER_MS: number;
+/**
+ * One live handoff per visit is reused while it still has this much runway.
+ * Every copy gesture minting its own would spend rows against the caller's
+ * budget for a signal that only has to flip once.
+ */
+export declare const AGENT_ARRIVAL_REFRESH_RUNWAY_MS: number;
+/** How long to wait before the next status read, or `false` to stop polling. */
+export declare function anonymousArrivalPollDelayMs(status: AnonymousAgentHandoffStatus | undefined, now?: number): number | false;
+/** The arrival itself: one fetch of the private URL is the whole signal. */
+export declare function hasAgentArrived(status: AnonymousAgentHandoffStatus | undefined): boolean;
+export type ComposedAnonymousPrompt = {
+    /** Ledger id to watch for the arrival. */
+    id: string;
+    /** Copy-ready text carrying the one-use URL. Clipboard only. */
+    prompt: string;
+    /** Epoch ms. */
+    expiresAt: number;
+};
+export type AnonymousArrival = {
+    /** The visit's handoff: minted once, reused while it still has runway. */
+    ensureMinted: () => Promise<MintedAnonymousArrival>;
+    /** ensureMinted, then the prompt for the task selected at this moment. */
+    promptFor: (context: string) => Promise<ComposedAnonymousPrompt>;
+    readStatus: (id: string) => Promise<AnonymousAgentHandoffStatus>;
+    nextPollDelayMs: (status: AnonymousAgentHandoffStatus | undefined) => number | false;
+    hasArrived: (status: AnonymousAgentHandoffStatus | undefined) => boolean;
+};
+/**
+ * One visit's arrival flow. Hold one of these for as long as the visitor is on
+ * the surface: the reuse discipline lives in the instance, so re-copies keep
+ * the same handoff instead of piling fresh rows behind one signal.
+ */
+export declare function createAnonymousArrival(config: AgentArrivalConfig): AnonymousArrival;

package/dist/docs/agent-arrival.js

@@ -0,0 +1,227 @@
+import { z } from "zod";
+import { ANONYMOUS_AGENT_HANDOFF_TTL_MS, AnonymousAgentHandoffSchema, AnonymousAgentHandoffStatusSchema, } from "../contracts/device-auth.js";
+import { buildAnonymousAgentHandoff, parseAgentHandoffUrl } from "./agent-setup.js";
+/*
+ * Agent arrival, signed out: the whole flow behind "your agent picked the
+ * prompt up", framework-free so the dashboard and the marketing site run one
+ * implementation instead of two that drift.
+ *
+ * The shape of the flow: mint an anonymous handoff, compose the copied prompt
+ * around its one-use URL, then poll that handoff's own fetch state until the
+ * counter leaves zero. The handoff carries no team, no Space, and nothing to
+ * redeem — its only job is to make the fetch observable — so the visitor learns
+ * their agent arrived without signing up first.
+ *
+ * Everything here is a plain function: no React, no query client, no clock but
+ * the one the caller passes. Cadence and reuse are policy, so they live here
+ * with the numbers rather than in whichever UI happens to render the wait.
+ */
+const ANONYMOUS_ARRIVAL_PATH = "/v1/auth/agent-handoffs/anonymous";
+export const AGENT_HANDOFF_REQUEST_FAILED_MESSAGE = "Request failed.";
+export const AGENT_HANDOFF_INVALID_RESPONSE_MESSAGE = "Invalid agent handoff response.";
+/**
+ * The messages that say nothing a person can act on. A UI showing an error
+ * detail line suppresses these, so it never renders "failed: Request failed."
+ */
+export const AGENT_HANDOFF_GENERIC_MESSAGES = new Set([
+    AGENT_HANDOFF_REQUEST_FAILED_MESSAGE,
+    AGENT_HANDOFF_INVALID_RESPONSE_MESSAGE,
+]);
+export class AgentHandoffRequestError extends Error {
+    code;
+    constructor(message, code = null) {
+        super(message);
+        this.name = "AgentHandoffRequestError";
+        this.code = code;
+    }
+}
+/**
+ * The parts of an RFC 9457 problem document that may reach a person. Anything
+ * else the server sent is dropped here rather than carried on an error: a
+ * malformed field costs the reader a detail line, never a leaked credential.
+ */
+const AgentHandoffProblemSchema = z.object({
+    code: z.string().optional().catch(undefined),
+    detail: z.string().optional().catch(undefined),
+});
+// Codes are lowercase snake tokens; anything else (including a secret-shaped
+// blob smuggled into the field) is dropped rather than carried on the error.
+const SAFE_ERROR_CODE = /^[a-z][a-z0-9_.-]{0,63}$/;
+function safeProblemDetail(detail) {
+    if (detail === undefined || !detail.trim())
+        return AGENT_HANDOFF_REQUEST_FAILED_MESSAGE;
+    // Error copy must never echo a handoff URL or a secret-shaped opaque credential.
+    if (/https?:\/\/|[A-Za-z0-9_-]{16,}/i.test(detail))
+        return AGENT_HANDOFF_REQUEST_FAILED_MESSAGE;
+    return detail;
+}
+/** The failure a non-2xx answer becomes, sanitized at the boundary that read it. */
+async function agentHandoffErrorFromResponse(response) {
+    const parsed = AgentHandoffProblemSchema.safeParse(await response.json().catch(() => null));
+    const problem = parsed.success ? parsed.data : {};
+    const code = problem.code !== undefined && SAFE_ERROR_CODE.test(problem.code) ? problem.code : null;
+    return new AgentHandoffRequestError(safeProblemDetail(problem.detail), code);
+}
+function invalidResponse() {
+    return new AgentHandoffRequestError(AGENT_HANDOFF_INVALID_RESPONSE_MESSAGE);
+}
+/*
+ * The success envelope, parsed as one shape. `{ data }` is the API's contract
+ * and the payload schema is the handoff's, so a response that is neither never
+ * reaches a caller as a half-parsed object.
+ */
+const MintEnvelopeSchema = z.object({ data: AnonymousAgentHandoffSchema });
+const StatusEnvelopeSchema = z.object({ data: AnonymousAgentHandoffStatusSchema });
+function endpoint(config, path) {
+    return `${config.apiOrigin.replace(/\/+$/, "")}${path}`;
+}
+function transport(config) {
+    return config.fetch ?? globalThis.fetch;
+}
+function clock(config) {
+    return config.now ? config.now() : Date.now();
+}
+/**
+ * Mints the signed-out handoff a copied prompt carries.
+ *
+ * The anonymous surface is anonymous by contract, so this deliberately sends no
+ * credentials: it works signed out, and a mint that carried a session would
+ * answer differently for gated accounts.
+ */
+export async function mintAnonymousArrival(config) {
+    const response = await transport(config)(endpoint(config, ANONYMOUS_ARRIVAL_PATH), {
+        method: "POST",
+        credentials: "omit",
+        headers: { accept: "application/json" },
+    });
+    if (!response.ok)
+        throw await agentHandoffErrorFromResponse(response);
+    const parsed = MintEnvelopeSchema.safeParse(await response.json().catch(() => null));
+    if (!parsed.success)
+        throw invalidResponse();
+    const data = parsed.data.data;
+    let handoffUrl = null;
+    let secret = null;
+    for (const origin of config.allowedOrigins ?? [config.apiOrigin]) {
+        try {
+            ({ handoffUrl, secret } = parseAgentHandoffUrl(data.url, origin));
+            break;
+        }
+        catch {
+            // Try the next explicitly allowed origin.
+        }
+    }
+    // Sanitization boundary: the ledger id is rendered and polled on, so it must
+    // be provably free of the bearer whatever the server fed us.
+    if (handoffUrl === null || secret === null || data.id.includes(secret)) {
+        throw invalidResponse();
+    }
+    const url = handoffUrl;
+    const bearer = secret;
+    return {
+        id: data.id,
+        expiresAt: Date.parse(data.expiresAt),
+        promptFor: (context) => {
+            // The caller's text is authored before the mint, so it can only contain
+            // the bearer if something upstream is already broken.
+            if (context.includes(bearer))
+                throw invalidResponse();
+            return buildAnonymousAgentHandoff({
+                expectedOrigin: new URL(url).origin,
+                url,
+                context,
+            }).prompt;
+        },
+    };
+}
+/** Reads one anonymous handoff's fetch state by its non-secret ledger id. */
+export async function readAnonymousArrivalStatus(id, config) {
+    const path = `${ANONYMOUS_ARRIVAL_PATH}/${encodeURIComponent(id)}`;
+    const response = await transport(config)(endpoint(config, path), {
+        method: "GET",
+        credentials: "omit",
+        headers: { accept: "application/json" },
+    });
+    if (!response.ok)
+        throw await agentHandoffErrorFromResponse(response);
+    const parsed = StatusEnvelopeSchema.safeParse(await response.json().catch(() => null));
+    if (!parsed.success)
+        throw invalidResponse();
+    return parsed.data.data;
+}
+/*
+ * Cadence, owned in one place with its numbers.
+ *
+ * The answer being waited on is one counter that leaves zero exactly once, and
+ * it changes from outside this browser, so polling is the whole mechanism.
+ * Eager while an agent is plausibly still landing, relaxed for the rest of the
+ * handoff's life, stopped once nothing can change.
+ */
+export const AGENT_ARRIVAL_EAGER_POLL_MS = 2_000;
+export const AGENT_ARRIVAL_EAGER_WINDOW_MS = 2 * 60_000;
+export const AGENT_ARRIVAL_RELAXED_POLL_MS = 10_000;
+/**
+ * The handoff's own TTL is the clock: with no `since` to carry, "how much
+ * runway is left" says how long ago it was minted.
+ */
+export const AGENT_ARRIVAL_RELAXED_AFTER_MS = ANONYMOUS_AGENT_HANDOFF_TTL_MS - AGENT_ARRIVAL_EAGER_WINDOW_MS;
+/**
+ * One live handoff per visit is reused while it still has this much runway.
+ * Every copy gesture minting its own would spend rows against the caller's
+ * budget for a signal that only has to flip once.
+ */
+export const AGENT_ARRIVAL_REFRESH_RUNWAY_MS = 2 * 60_000;
+/** How long to wait before the next status read, or `false` to stop polling. */
+export function anonymousArrivalPollDelayMs(status, now = Date.now()) {
+    if (status === undefined)
+        return AGENT_ARRIVAL_EAGER_POLL_MS;
+    if (hasAgentArrived(status))
+        return false;
+    const remaining = Date.parse(status.expiresAt) - now;
+    if (remaining <= 0)
+        return false;
+    return remaining > AGENT_ARRIVAL_RELAXED_AFTER_MS
+        ? AGENT_ARRIVAL_EAGER_POLL_MS
+        : AGENT_ARRIVAL_RELAXED_POLL_MS;
+}
+/** The arrival itself: one fetch of the private URL is the whole signal. */
+export function hasAgentArrived(status) {
+    return (status?.fetchCount ?? 0) > 0;
+}
+/**
+ * One visit's arrival flow. Hold one of these for as long as the visitor is on
+ * the surface: the reuse discipline lives in the instance, so re-copies keep
+ * the same handoff instead of piling fresh rows behind one signal.
+ */
+export function createAnonymousArrival(config) {
+    let inflight = null;
+    const fresh = () => {
+        const pending = mintAnonymousArrival(config);
+        inflight = pending;
+        // A mint that failed is not the visit's handoff; the next copy mints anew.
+        void pending.catch(() => {
+            if (inflight === pending)
+                inflight = null;
+        });
+        return pending;
+    };
+    const ensureMinted = () => {
+        const cached = inflight;
+        if (!cached)
+            return fresh();
+        return cached.then((minted) => minted.expiresAt - clock(config) > AGENT_ARRIVAL_REFRESH_RUNWAY_MS ? minted : fresh());
+    };
+    return {
+        ensureMinted,
+        promptFor: (context) => ensureMinted().then((minted) => ({
+            id: minted.id,
+            // Composed from THIS copy's context, never the one the handoff was
+            // first minted for: one handoff spans the visit, the task does not.
+            prompt: minted.promptFor(context),
+            expiresAt: minted.expiresAt,
+        })),
+        readStatus: (id) => readAnonymousArrivalStatus(id, config),
+        nextPollDelayMs: (status) => anonymousArrivalPollDelayMs(status, clock(config)),
+        hasArrived: hasAgentArrived,
+    };
+}

package/dist/docs/agent-output-policy.d.ts

@@ -0,0 +1,6 @@
+export type AgentOutput = {
+    readonly source: string;
+    readonly text: string;
+};
+/** Reject commercial plan promotion in text that an agent can receive. */
+export declare function assertNoCommercialUpsell(outputs: readonly AgentOutput[]): void;

package/dist/docs/agent-output-policy.js

@@ -0,0 +1,22 @@
+const COMMERCIAL_UPSELL_PATTERNS = [
+    /\bpricing\b/i,
+    /\bpaid plans?\b/i,
+    /\bupgrade (?:your|the|this) (?:account|plan|subscription)\b/i,
+    /\bupgrade to (?:a )?(?:paid|premium|pro)\b/i,
+    /\bsubscribe now\b/i,
+    /\bstart (?:a )?(?:free )?trial\b/i,
+    /\bbuy now\b/i,
+    /\bcontact sales\b/i,
+    /\bcheckout\b/i,
+];
+/** Reject commercial plan promotion in text that an agent can receive. */
+export function assertNoCommercialUpsell(outputs) {
+    for (const output of outputs) {
+        for (const pattern of COMMERCIAL_UPSELL_PATTERNS) {
+            const match = pattern.exec(output.text);
+            if (match) {
+                throw new Error(`${output.source} contains commercial upsell text: ${match[0]}`);
+            }
+        }
+    }
+}

package/dist/docs/agent-prose.d.ts

@@ -1,8 +1,5 @@
 export declare const ARCHIVE_SECRET_GLOBS: readonly [".env*", ".npmrc", ".netrc", "*/.git/*", "*/.spacefast/*", "*/.ssh/*", "*/.aws/*", "*/.kube/*", "*/.docker/*", "credentials.json", "*.pem", "*.key", "*.p12", "*.pfx", "*.crt", "*id_rsa*"];
-/**
- * The credential rules every surface must repeat. Treat tokens as secrets, keep
- * them out of logs and transcripts, and never echo them back.
- */
+/** The credential rules every surface must repeat. */
 export declare const SECRET_RULES_PROSE: string;
 export declare const POSITIONING_PROSE: string;
 export declare const EXPLAIN_TO_USER_PROSE: string;
@@ -10,16 +7,15 @@ export declare const FEEDBACK_PROSE = "With user approval, send feedback with `s
 export declare const FAILURE_CONDUCT_PROSE: string;
 export declare const LANE_PICKER_PROSE: string;
 export declare const HOW_TO_RESEARCH_PROSE: string;
-/** Curl/API skill lane: docs URLs only — no MCP or CLI tools required. */
+/** Curl/API skill lane: docs URLs only, no MCP or CLI tools required. */
 export declare const HOW_TO_RESEARCH_API_PROSE: string;
 /** MCP plugin skill lane: prefer skills for workflows and execute for the OpenAPI catalog. */
 export declare const HOW_TO_RESEARCH_MCP_PROSE: string;
 export declare const ENV_NOTES_PROSE: string;
 export declare const ENV_NOTES_API_PROSE: string;
 /**
- * The CHECK verb: before ever creating a space, look for the one the project
- * already has. This is what keeps a returning agent from pushing a duplicate
- * anonymous space instead of a new version.
+ * The CHECK verb: look for an existing space before creating one, so a returning
+ * agent publishes a new version instead of a duplicate anonymous space.
  */
 export declare const CHECK_BEFORE_PUBLISH_PROSE: string;
 export declare const CHECK_BEFORE_PUBLISH_API_PROSE: string;
@@ -38,6 +34,7 @@ export declare const SAVE_STATE_MCP_PROSE: string;
  * The UPDATE verb: a new version to the SAME space. Never re-run the
  * first-publish recipe when saved state exists.
  */
+export declare const PUSH_TO_DEPLOY_PROSE: string;
 export declare const UPDATE_SPACE_PROSE: string;
 /**
  * The CLAIM / CONTINUE verb: show the claim link, and after the user claims,
@@ -46,7 +43,7 @@ export declare const UPDATE_SPACE_PROSE: string;
 export declare const CONTINUE_AFTER_CLAIM_PROSE: string;
 /**
  * The zero-install publish sequence: a replay-safe curl loop for a file, a
- * secret-preflighted zip for a folder. This is the load-bearing rung 0 — an
+ * secret-preflighted zip for a folder. This is the load-bearing rung 0. An
  * agent that stops here must still succeed.
  */
 export declare const PUBLISH_SEQUENCE_PROSE: string;
@@ -54,19 +51,15 @@ export declare const PUBLISH_SEQUENCE_PROSE: string;
  * What the JSON publish receipt contains and how to read it. The receipt is the
  * source of truth; never invent a separate success signal.
  */
-export declare const RECEIPT_SHAPE_PROSE: string;
+export declare const RECEIPT_CONTRACT_PROSE: string;
 /**
  * The large/cloud-agent path. This keeps file bytes out of MCP JSON and chat
  * transcripts while still giving agents a way to upload arbitrary artifacts.
  */
 export declare const SIGNED_UPLOAD_PROSE: string;
 /**
- * Named fragments for the skill-template generator. The templates carry
- * `{{prose.secretRules}}`, `{{prose.publishSequence}}`,
- * `{{prose.receiptShape}}`, `{{prose.signedUpload}}`,
- * `{{prose.checkBeforePublish}}`, `{{prose.saveState}}`,
- * `{{prose.updateSpace}}`, and `{{prose.continueAfterClaim}}` placeholders;
- * generate-skill.mjs substitutes these.
+ * Named fragments for the skill-template generator: the templates carry
+ * `{{prose.<key>}}` placeholders and generate-skill.mjs substitutes these.
  */
 export declare const AGENT_PROSE: {
     readonly positioning: string;
@@ -74,7 +67,7 @@ export declare const AGENT_PROSE: {
     readonly explainToUser: string;
     readonly failureConduct: string;
     readonly publishSequence: string;
-    readonly receiptShape: string;
+    readonly receiptContract: string;
     readonly signedUpload: string;
     readonly checkBeforePublish: string;
     readonly checkBeforePublishApi: string;
@@ -84,6 +77,7 @@ export declare const AGENT_PROSE: {
     readonly saveStateApi: string;
     readonly saveStateMcp: string;
     readonly updateSpace: string;
+    readonly pushToDeploy: string;
     readonly continueAfterClaim: string;
     readonly lanePicker: string;
     readonly howToResearch: string;