@spacefast/common 0.0.26 → 0.2.2

package/dist/docs/skills.d.ts

@@ -23,14 +23,14 @@ export interface SpacefastSkillDefinition {
 export declare const SPACEFAST_SKILLS: readonly [{
     readonly name: "create-and-publish-site";
     readonly title: "Create and publish a polished website";
-    readonly description: "Turn a brief into a responsive website, review the result, publish it to Spacefast, and verify the live version.";
-    readonly whenToUse: "Use when the user wants an agent to design, build, improve, or launch a new website rather than only upload an existing build.";
+    readonly description: "Build a responsive website from a brief. Publish it and verify the live version.";
+    readonly whenToUse: "Use when the user wants a new website built, improved, or launched.";
     readonly keywords: readonly ["create", "website", "design", "build", "responsive", "launch", "publish"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["publish", "execute"];
+    readonly tools: readonly ["publish", "operation_status", "show_space_deployments"];
     readonly docs: readonly ["quickstart", "publishing"];
-    readonly instructions: readonly ["Clarify the audience, goal, required content, brand constraints, and desired call to action. If the visual direction is open, propose two or three distinct directions and choose one with the user.", "Inspect the existing workspace before editing. Reuse its framework, package manager, components, assets, and build conventions when they are sound.", "Build a focused, accessible experience with a clear hierarchy, real content, responsive layouts, useful interaction states, and no placeholder copy. Keep the main path simple and put secondary detail behind progressive disclosure.", "Run the real build and inspect the result at mobile and desktop widths. Fix overflow, illegible contrast, broken links, missing assets, keyboard traps, and avoidable layout shift.", "Review the workspace diff and summarize material design or content judgments before publishing. Never include API keys, claim credentials, upload credentials, or local auth state in the artifact.", "Publish the built output with `publish`. Present Open as the reusable access link and Claim as the one-time ownership link. Treat live and immutable-version URLs as receipt metadata, not extra actions."];
-    readonly verification: readonly ["Call `status` after publishing and confirm the intended version is live; use `diagnose` if serving is stalled or failed.", "Open the live URL and verify the primary page, navigation, assets, responsive layout, and main call to action before claiming success."];
+    readonly instructions: readonly ["Use the user's brief. Infer optional design choices from the content and workspace.", "Ask a question only when a missing required value blocks safe work.", "Inspect the workspace. Reuse its framework, package manager, components, assets, and build commands when suitable.", "Build an accessible site with real content, responsive layouts, clear hierarchy, and useful interaction states.", "Run the real build. Check mobile and desktop layouts, links, assets, keyboard use, contrast, and layout stability.", "Review the final diff. Remove secrets and local authentication data from the artifact.", "Call `publish` once with the built output. Return useful access, live, and version URLs from the receipt. If the publish is anonymous, point the user to the claim action in the publish card and state its expiry.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop."];
+    readonly verification: readonly ["Call `show_space_deployments` with `space: publish.result.receipt.space.id`. Confirm that the intended version is ready and current.", "If the deployment failed or stalled, report its stable error code and actionable diagnostics.", "Open the live URL. Verify the main page, navigation, assets, responsive layout, and primary call to action."];
     readonly runtimeNotes: {
         readonly local: "On-Device can work directly inside the configured local workspace root and publish a local build path.";
         readonly hosted: "Hosted has no filesystem. Generate small files in the client and publish them inline, or use catalog manifest and import operations for larger artifacts.";
@@ -48,10 +48,10 @@ export declare const SPACEFAST_SKILLS: readonly [{
     readonly whenToUse: "Use when the artifact already exists and the user wants it published or updated.";
     readonly keywords: readonly ["publish", "deploy", "live", "verify", "version", "claim"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["publish", "status", "diagnose"];
+    readonly tools: readonly ["publish", "operation_status", "show_space_deployments"];
     readonly docs: readonly ["publishing", "workflow/publish-receipt", "workflow/secret-handling"];
-    readonly instructions: readonly ["Identify the actual publish root or build output. Run the real build first when the source tree is not itself the artifact to publish.", "Publish with `publish`. For an anonymous On-Device publish, keep the claim credential in local custody and return only the claim URL and expiry; never expose or ask the user to paste the raw token.", "Report the bare Live URL, private Access URL when present, immutable Version URL when present, anonymous Claim URL and expiry when present, plus actionable diagnostics."];
-    readonly verification: readonly ["Call `status` and confirm the intended version is live. Use `diagnose` for a failed or stalled publish.", "Open the live URL and verify representative content and assets rather than treating a successful upload or health check as serving proof."];
+    readonly instructions: readonly ["Identify the actual publish root or build output. Run the real build first when the source tree is not the artifact.", "Call `publish` once. Keep anonymous claim credentials in local custody.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop.", "Return the live, access, and version URLs that are present. For an anonymous publish, state the claim expiry and point the user to the claim action in the publish card.", "Never expose a raw claim credential. Never ask the user to paste one."];
+    readonly verification: readonly ["Call `show_space_deployments` with `space: publish.result.receipt.space.id`. Confirm that the intended version is ready and current.", "Report the stable error code and actionable diagnostics when the deployment failed or stalled.", "Open the live URL. Verify representative content and assets before reporting success."];
     readonly runtimeNotes: {
         readonly local: "Publish a bounded local path; locally custodied claim credentials are reused automatically.";
         readonly hosted: "Publish inline files, or use catalog manifest and import operations for larger artifacts. Hosted has no filesystem.";
@@ -60,7 +60,7 @@ export declare const SPACEFAST_SKILLS: readonly [{
     readonly recipe: {
         readonly slug: "recipes/agent-publish";
         readonly tier: "full";
-        readonly url: `${string}/publishing/anonymous`;
+        readonly url: `${string}/publish/anonymous`;
     };
 }, {
     readonly name: "ci-github-actions";
@@ -69,15 +69,15 @@ export declare const SPACEFAST_SKILLS: readonly [{
     readonly whenToUse: "Use when pushes or manual workflow runs should publish automatically from GitHub.";
     readonly keywords: readonly ["github", "actions", "ci", "push", "automatic", "workflow"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute"];
+    readonly tools: readonly [];
     readonly docs: readonly ["builds", "publishing", "workflow/secret-handling"];
-    readonly instructions: readonly ["Inspect the repository's package manager, lockfile, build command, runtime version, output directory, and existing workflows before writing YAML.", "Create a least-privilege workflow triggered by the intended branch and `workflow_dispatch`: check out the repository, install with the locked dependency command, build, and run `npx -y spacefast@<pinned-version> publish <output> --json`.", "Store the credential as a masked `SPACEFAST_TOKEN` repository or environment secret. Never echo it or upload generated auth files, claim credentials, or upload credentials as artifacts.", "Use the repository's real package manager and output directory; do not copy a generic npm/dist example over a Bun, pnpm, yarn, or custom build."];
+    readonly instructions: readonly ["Inspect the package manager, lockfile, build command, runtime version, output directory, and existing workflows.", "Create one least-privilege workflow for the intended branch and `workflow_dispatch`.", "Check out the repository.", "Install dependencies with the locked command.", "Run the real build.", "Run `npx -y spacefast@<pinned-version> publish <output> --json` with the actual output directory.", "Store the credential as a masked `SPACEFAST_TOKEN` repository or environment secret.", "Never echo credentials. Never upload authentication files or credentials as artifacts.", "Use the repository's real package manager and output directory.", "Do not replace custom build steps with a generic npm/dist example."];
     readonly verification: readonly ["Validate the workflow syntax and run it on an explicit test branch or manual dispatch.", "Inspect the publish receipt and live URL; a green build step alone is not serving proof."];
     readonly prompt: true;
     readonly recipe: {
         readonly slug: "recipes/github-deploys";
         readonly tier: "full";
-        readonly url: `${string}/publishing/git`;
+        readonly url: `${string}/publish/git`;
     };
 }, {
     readonly name: "preview-channels";
@@ -86,26 +86,26 @@ export declare const SPACEFAST_SKILLS: readonly [{
     readonly whenToUse: "Use when reviewers need a realistic preview before a change goes live.";
     readonly keywords: readonly ["preview", "channel", "branch", "pull request", "review", "private"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["publish", "status", "execute"];
+    readonly tools: readonly ["publish", "operation_status", "show_space_deployments", "execute", "resume_execution"];
     readonly docs: readonly ["builds", "access-control"];
-    readonly instructions: readonly ["Publish the branch through a connected repository or to an explicit non-production channel so the live production channel is unchanged.", "Keep the preview private by default. Use an Open URL for the owner's browser or create the narrowest scoped Link needed for reviewers.", "Label the preview with the branch, change, or pull request it represents and report what is intentionally out of scope."];
-    readonly verification: readonly ["Confirm the preview serves the expected version and production still points at its previous version.", "Test the reviewer link in a signed-out context and revoke it when review is complete."];
+    readonly instructions: readonly ["Call `publish` once for an explicit non-production space or channel. Do not change the production target.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop.", "Keep the preview private unless the user requests sharing.", "For reviewer access, use one bounded `execute` program. Read current access, create the narrowest Link, then read it again.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Label the preview with its branch, change, or pull request. Report what is out of scope."];
+    readonly verification: readonly ["Call `show_space_deployments` for each affected Space. Confirm that the preview changed. Confirm that production did not change.", "Test the reviewer Link in a signed-out context. Report its scope and expiry."];
     readonly recipe: {
         readonly slug: "recipes/preview-channels";
         readonly tier: "full";
-        readonly url: `${string}/publishing/git`;
+        readonly url: `${string}/publish/git`;
     };
 }, {
     readonly name: "claim-flow";
     readonly title: "Claim an anonymous space";
-    readonly description: "Attach an anonymous space to an account or team before expiry while keeping every claim credential in server or local custody.";
-    readonly whenToUse: "Use after an anonymous publish returns a claim URL and expiry.";
+    readonly description: "Attach an anonymous space to an account or team before expiry. Keep claim credentials in server or local custody.";
+    readonly whenToUse: "Use after an anonymous publish returns a claim action and expiry.";
     readonly keywords: readonly ["claim", "anonymous", "ownership", "team", "continuation", "credential"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute", "publish"];
+    readonly tools: readonly ["publish", "operation_status", "execute", "resume_execution"];
     readonly docs: readonly ["anonymous-publish", "workflow/continue-after-claim", "workflow/secret-handling"];
-    readonly instructions: readonly ["Return the claim URL and expiry to the user, never the raw claim credential. On-Device stores that credential in `.spacefast/state.json` and reuses it without returning it to the model.", "When authenticated On-Device credentials are available, use the catalog `claim` operation with only `teamId` and the expected `spaceId`; otherwise let the user open the claim URL in their browser.", "Publish again from On-Device after the browser claim. `publish` automatically exchanges the locally held claim credential once, persists the durable space-scoped credential, and retries without exposing either secret."];
-    readonly verification: readonly ["Confirm the space no longer has a claim expiry and appears under the intended account or team.", "Publish again from the same local root or inspect the space through `execute` to verify durable access works without asking for a raw token."];
+    readonly instructions: readonly ["Point the user to the claim action in the publish card and state its expiry. Never copy the claim credential into model text.", "When account credentials are available, use one bounded `execute` program. Search and describe the claim operation before calling it.", "Pass only the required team ID and expected space ID.", "After the claim resumes, read the space in the same program. Return its owner and claim state.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Otherwise, ask the user to use the claim action in the publish card.", "After a browser claim, call `publish` again from On-Device. It exchanges the locally held credential without exposing it.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop."];
+    readonly verification: readonly ["Confirm that the space has no claim expiry. Confirm that it belongs to the intended account or team.", "Confirm that the republish uses durable access without a raw credential."];
     readonly prompt: true;
 }, {
     readonly name: "rollback-safely";
@@ -114,10 +114,10 @@ export declare const SPACEFAST_SKILLS: readonly [{
     readonly whenToUse: "Use when the current live version is broken and a prior healthy version is known or discoverable.";
     readonly keywords: readonly ["rollback", "revert", "version", "incident", "restore"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["status", "rollback", "execute", "diagnose"];
+    readonly tools: readonly ["show_space_deployments", "execute", "resume_execution"];
     readonly docs: readonly ["versions-and-rollback"];
-    readonly instructions: readonly ["Inspect recent immutable versions and current status. Compare the current live version with the candidate using the catalog `versions` and `diff` operations.", "Call `rollback` with the selected `versionId`. Rollback is additive and keeps later immutable versions available.", "If promotion returns an operation that is still settling, poll the catalog `operation_status` operation until it is done instead of assuming success."];
-    readonly verification: readonly ["Call `status` and confirm the live pointer references the selected version.", "Open the live URL and verify the failing path or behavior is restored; use `diagnose` if it is not."];
+    readonly instructions: readonly ["Call `show_space_deployments`. Select a known-good ready version that is older than the current version.", "Use one bounded `execute` program. Search and describe the version promotion operation before calling it.", "Read the live pointer, promote the selected version, then read the pointer again in the same program.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program."];
+    readonly verification: readonly ["Call `show_space_deployments`. Confirm that the selected version is current and ready.", "Open the live URL. Verify that the failing path or behavior works again."];
     readonly prompt: true;
 }, {
     readonly name: "set-up-custom-domain";
@@ -126,10 +126,10 @@ export declare const SPACEFAST_SKILLS: readonly [{
     readonly whenToUse: "Use when the user owns a domain they want a Spacefast space to serve.";
     readonly keywords: readonly ["domain", "dns", "tls", "https", "cname", "custom"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute"];
+    readonly tools: readonly ["show_space_domains", "execute", "resume_execution"];
     readonly docs: readonly ["custom-domains", "recipes/migrate-dns"];
-    readonly instructions: readonly ["Add the domain with `sf domains add <domain>` or catalog operation `domains_add`; preserve the exact record values Spacefast returns.", "Give the user those DNS records to create at their provider. Do not claim this MCP changed third-party DNS unless it actually has an authorized provider integration.", "Keep the existing production hostname available during the cutover and avoid deleting old records until the new path is proven."];
-    readonly verification: readonly ["Run `sf domains check` or catalog operation `domains_check` until DNS and certificate state are ready.", "Open the final custom-domain HTTPS URL and verify representative content before reporting it live."];
+    readonly instructions: readonly ["Call `show_space_domains`. Read the current domain, DNS, and certificate state.", "If setup is required, use one bounded `execute` program. Search and describe the add or assign operation before calling it.", "Read the domain again in the same program after the mutation resumes.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Return the exact DNS records from Spacefast. Do not claim that Spacefast changed third-party DNS.", "Keep the existing production hostname until the custom domain is ready."];
+    readonly verification: readonly ["After the external DNS change, call `show_space_domains`. Report the current verification state.", "Open the HTTPS URL only after DNS and certificate states are ready. Verify representative content."];
     readonly prompt: true;
     readonly recipe: {
         readonly slug: "recipes/custom-domain";
@@ -143,10 +143,10 @@ export declare const SPACEFAST_SKILLS: readonly [{
     readonly whenToUse: "Use for moved pages, canonical host paths, and intentional permanent or temporary redirects.";
     readonly keywords: readonly ["redirect", "rewrite", "routing", "301", "302", "path"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["publish", "execute"];
+    readonly tools: readonly ["publish", "operation_status", "show_space_deployments"];
     readonly docs: readonly ["redirects"];
-    readonly instructions: readonly ["Inspect existing routing rules, then add the smallest non-conflicting rules to `_redirects` at the publish root.", "Choose temporary or permanent status deliberately, preserve path/query semantics where required, and avoid redirect loops or rules that shadow real assets.", "Publish the redirect file as part of the same immutable version as the related content change."];
-    readonly verification: readonly ["Request representative old and new paths and confirm the exact status and Location header.", "Verify the final target serves successfully and unrelated assets are not redirected."];
+    readonly instructions: readonly ["Inspect existing routing rules, then add the smallest non-conflicting rules to `_redirects` at the publish root.", "Choose a temporary or permanent status deliberately. Preserve required path and query behavior.", "Avoid redirect loops and rules that hide real assets.", "Call `publish` once. Include the redirect file and related content in the same immutable version.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop."];
+    readonly verification: readonly ["Call `show_space_deployments` with `space: publish.result.receipt.space.id`. Confirm that the new version is current and ready.", "Request representative old and new paths and confirm the exact status and Location header.", "Verify the final target serves successfully and unrelated assets are not redirected."];
     readonly recipe: {
         readonly slug: "recipes/redirects";
         readonly tier: "reference";
@@ -159,10 +159,10 @@ export declare const SPACEFAST_SKILLS: readonly [{
     readonly whenToUse: "Use when an existing production domain must move to Spacefast.";
     readonly keywords: readonly ["dns", "migrate", "cutover", "domain", "downtime", "certificate"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute"];
+    readonly tools: readonly ["show_space_domains", "execute", "resume_execution"];
     readonly docs: readonly ["custom-domains"];
-    readonly instructions: readonly ["Inventory the current authoritative DNS records and lower TTL ahead of the cutover when the provider and timing allow it.", "Add the domain to Spacefast and pre-stage every record it returns while preserving a working rollback path.", "Cut over only after the Spacefast endpoint, expected content, and TLS readiness can be validated. Keep the previous origin available until propagation is complete."];
-    readonly verification: readonly ["Check resolution from more than one resolver and confirm the certificate matches the final hostname.", "Open the public HTTPS URL, verify representative content, and monitor for old-origin traffic before removing rollback records."];
+    readonly instructions: readonly ["Inventory the current authoritative DNS records. Lower the TTL before cutover when the provider and timing permit it.", "Call `show_space_domains`. Read the current DNS and certificate state.", "If setup is required, use one bounded `execute` program. Search and describe the add or assign operation before calling it.", "Read the domain again in the same program after the mutation resumes.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Create the returned DNS records at the provider. Keep the previous origin available during propagation.", "Cut over only after the expected content and TLS state are ready."];
+    readonly verification: readonly ["Call `show_space_domains`. Confirm that DNS and certificate states are ready.", "Check more than one resolver. Confirm that the certificate matches the final hostname.", "Open the public HTTPS URL. Verify representative content before removing rollback records."];
     readonly recipe: {
         readonly slug: "recipes/migrate-dns";
         readonly tier: "reference";
@@ -175,10 +175,10 @@ export declare const SPACEFAST_SKILLS: readonly [{
     readonly whenToUse: "Use when a build, finalize, activation, or live serving step fails or stalls.";
     readonly keywords: readonly ["debug", "failed", "build", "logs", "diagnose", "stalled"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute"];
+    readonly tools: readonly ["show_space_deployments", "execute", "publish", "operation_status"];
     readonly docs: readonly ["troubleshooting"];
-    readonly instructions: readonly ["Use `execute` to find and call the catalog diagnostics operation for the space and optional version. Read its ranked findings, locations, error codes, fix hints, and docs links instead of guessing from a generic status.", "Use the catalog `build_logs` operation for publish/finalize detail, runtime-log operations for serving errors, and version operations to compare with the last ready version.", "Apply the smallest fix tied to the evidence, rebuild, and publish again. Follow the problem document's `type` URL for any referenced error code."];
-    readonly verification: readonly ["Re-run the relevant diagnostics or status operation through `execute` and confirm the new version reaches the intended live state.", "Open the affected live path and verify the concrete failure no longer reproduces."];
+    readonly instructions: readonly ["Call `show_space_deployments`. Read the failed version, build state, stable error code, and diagnostics.", "If more detail is required, use one bounded `execute` program. Read only the required build logs or version data.", "Apply the smallest fix supported by the evidence. Run the real build.", "Call `publish` once with the fixed output.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop."];
+    readonly verification: readonly ["Call `show_space_deployments` with `space: publish.result.receipt.space.id`. Confirm that the new version is current and ready.", "Open the affected live path. Verify that the concrete failure does not occur."];
     readonly prompt: true;
 }, {
     readonly name: "manage-access";
@@ -187,23 +187,23 @@ export declare const SPACEFAST_SKILLS: readonly [{
     readonly whenToUse: "Use when a space or path must be made public, team-only, or shared with specific people or machines.";
     readonly keywords: readonly ["access", "private", "public", "people", "links", "grant", "share"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute", "whoami"];
+    readonly tools: readonly ["execute", "resume_execution"];
     readonly docs: readonly ["access-control"];
-    readonly instructions: readonly ["Inspect current Grants with `sf share` or the catalog `grants_list` operation and identify one explicit access intent. Anonymous spaces start Private.", "Apply the narrowest suitable Public or Team Grant, People invitation, scoped Link/password, or machine/external-identity Grant. Keep resource scopes explicit.", "Show newly created Link or machine secrets only to the requesting user. Never put credentials, claim credentials, or API keys in logs or committed files."];
-    readonly verification: readonly ["Use `sf share check --as public --path /docs` or the catalog `grants_check` operation for a representative request.", "Test a new Link in the intended signed-out or recipient context and confirm unrelated resources remain inaccessible."];
+    readonly instructions: readonly ["Use one bounded `execute` program. Search and describe the access operations before calling them.", "Read current access. Apply the narrowest change for one explicit access intent. Read the resulting access state.", "Run the matching access check in the same program after the mutation resumes.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Show new Link or machine secrets only to the requesting user. Never store them in logs or committed files."];
+    readonly verification: readonly ["Confirm that the access check permits the intended actor and path.", "Test a new Link in the intended signed-out context. Confirm that unrelated resources stay inaccessible."];
     readonly prompt: true;
 }];
 export declare const SPACEFAST_PROMPT_SKILLS: ({
     readonly name: "create-and-publish-site";
     readonly title: "Create and publish a polished website";
-    readonly description: "Turn a brief into a responsive website, review the result, publish it to Spacefast, and verify the live version.";
-    readonly whenToUse: "Use when the user wants an agent to design, build, improve, or launch a new website rather than only upload an existing build.";
+    readonly description: "Build a responsive website from a brief. Publish it and verify the live version.";
+    readonly whenToUse: "Use when the user wants a new website built, improved, or launched.";
     readonly keywords: readonly ["create", "website", "design", "build", "responsive", "launch", "publish"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["publish", "execute"];
+    readonly tools: readonly ["publish", "operation_status", "show_space_deployments"];
     readonly docs: readonly ["quickstart", "publishing"];
-    readonly instructions: readonly ["Clarify the audience, goal, required content, brand constraints, and desired call to action. If the visual direction is open, propose two or three distinct directions and choose one with the user.", "Inspect the existing workspace before editing. Reuse its framework, package manager, components, assets, and build conventions when they are sound.", "Build a focused, accessible experience with a clear hierarchy, real content, responsive layouts, useful interaction states, and no placeholder copy. Keep the main path simple and put secondary detail behind progressive disclosure.", "Run the real build and inspect the result at mobile and desktop widths. Fix overflow, illegible contrast, broken links, missing assets, keyboard traps, and avoidable layout shift.", "Review the workspace diff and summarize material design or content judgments before publishing. Never include API keys, claim credentials, upload credentials, or local auth state in the artifact.", "Publish the built output with `publish`. Present Open as the reusable access link and Claim as the one-time ownership link. Treat live and immutable-version URLs as receipt metadata, not extra actions."];
-    readonly verification: readonly ["Call `status` after publishing and confirm the intended version is live; use `diagnose` if serving is stalled or failed.", "Open the live URL and verify the primary page, navigation, assets, responsive layout, and main call to action before claiming success."];
+    readonly instructions: readonly ["Use the user's brief. Infer optional design choices from the content and workspace.", "Ask a question only when a missing required value blocks safe work.", "Inspect the workspace. Reuse its framework, package manager, components, assets, and build commands when suitable.", "Build an accessible site with real content, responsive layouts, clear hierarchy, and useful interaction states.", "Run the real build. Check mobile and desktop layouts, links, assets, keyboard use, contrast, and layout stability.", "Review the final diff. Remove secrets and local authentication data from the artifact.", "Call `publish` once with the built output. Return useful access, live, and version URLs from the receipt. If the publish is anonymous, point the user to the claim action in the publish card and state its expiry.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop."];
+    readonly verification: readonly ["Call `show_space_deployments` with `space: publish.result.receipt.space.id`. Confirm that the intended version is ready and current.", "If the deployment failed or stalled, report its stable error code and actionable diagnostics.", "Open the live URL. Verify the main page, navigation, assets, responsive layout, and primary call to action."];
     readonly runtimeNotes: {
         readonly local: "On-Device can work directly inside the configured local workspace root and publish a local build path.";
         readonly hosted: "Hosted has no filesystem. Generate small files in the client and publish them inline, or use catalog manifest and import operations for larger artifacts.";
@@ -221,10 +221,10 @@ export declare const SPACEFAST_PROMPT_SKILLS: ({
     readonly whenToUse: "Use when the artifact already exists and the user wants it published or updated.";
     readonly keywords: readonly ["publish", "deploy", "live", "verify", "version", "claim"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["publish", "status", "diagnose"];
+    readonly tools: readonly ["publish", "operation_status", "show_space_deployments"];
     readonly docs: readonly ["publishing", "workflow/publish-receipt", "workflow/secret-handling"];
-    readonly instructions: readonly ["Identify the actual publish root or build output. Run the real build first when the source tree is not itself the artifact to publish.", "Publish with `publish`. For an anonymous On-Device publish, keep the claim credential in local custody and return only the claim URL and expiry; never expose or ask the user to paste the raw token.", "Report the bare Live URL, private Access URL when present, immutable Version URL when present, anonymous Claim URL and expiry when present, plus actionable diagnostics."];
-    readonly verification: readonly ["Call `status` and confirm the intended version is live. Use `diagnose` for a failed or stalled publish.", "Open the live URL and verify representative content and assets rather than treating a successful upload or health check as serving proof."];
+    readonly instructions: readonly ["Identify the actual publish root or build output. Run the real build first when the source tree is not the artifact.", "Call `publish` once. Keep anonymous claim credentials in local custody.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop.", "Return the live, access, and version URLs that are present. For an anonymous publish, state the claim expiry and point the user to the claim action in the publish card.", "Never expose a raw claim credential. Never ask the user to paste one."];
+    readonly verification: readonly ["Call `show_space_deployments` with `space: publish.result.receipt.space.id`. Confirm that the intended version is ready and current.", "Report the stable error code and actionable diagnostics when the deployment failed or stalled.", "Open the live URL. Verify representative content and assets before reporting success."];
     readonly runtimeNotes: {
         readonly local: "Publish a bounded local path; locally custodied claim credentials are reused automatically.";
         readonly hosted: "Publish inline files, or use catalog manifest and import operations for larger artifacts. Hosted has no filesystem.";
@@ -233,7 +233,7 @@ export declare const SPACEFAST_PROMPT_SKILLS: ({
     readonly recipe: {
         readonly slug: "recipes/agent-publish";
         readonly tier: "full";
-        readonly url: `${string}/publishing/anonymous`;
+        readonly url: `${string}/publish/anonymous`;
     };
 } | {
     readonly name: "ci-github-actions";
@@ -242,15 +242,15 @@ export declare const SPACEFAST_PROMPT_SKILLS: ({
     readonly whenToUse: "Use when pushes or manual workflow runs should publish automatically from GitHub.";
     readonly keywords: readonly ["github", "actions", "ci", "push", "automatic", "workflow"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute"];
+    readonly tools: readonly [];
     readonly docs: readonly ["builds", "publishing", "workflow/secret-handling"];
-    readonly instructions: readonly ["Inspect the repository's package manager, lockfile, build command, runtime version, output directory, and existing workflows before writing YAML.", "Create a least-privilege workflow triggered by the intended branch and `workflow_dispatch`: check out the repository, install with the locked dependency command, build, and run `npx -y spacefast@<pinned-version> publish <output> --json`.", "Store the credential as a masked `SPACEFAST_TOKEN` repository or environment secret. Never echo it or upload generated auth files, claim credentials, or upload credentials as artifacts.", "Use the repository's real package manager and output directory; do not copy a generic npm/dist example over a Bun, pnpm, yarn, or custom build."];
+    readonly instructions: readonly ["Inspect the package manager, lockfile, build command, runtime version, output directory, and existing workflows.", "Create one least-privilege workflow for the intended branch and `workflow_dispatch`.", "Check out the repository.", "Install dependencies with the locked command.", "Run the real build.", "Run `npx -y spacefast@<pinned-version> publish <output> --json` with the actual output directory.", "Store the credential as a masked `SPACEFAST_TOKEN` repository or environment secret.", "Never echo credentials. Never upload authentication files or credentials as artifacts.", "Use the repository's real package manager and output directory.", "Do not replace custom build steps with a generic npm/dist example."];
     readonly verification: readonly ["Validate the workflow syntax and run it on an explicit test branch or manual dispatch.", "Inspect the publish receipt and live URL; a green build step alone is not serving proof."];
     readonly prompt: true;
     readonly recipe: {
         readonly slug: "recipes/github-deploys";
         readonly tier: "full";
-        readonly url: `${string}/publishing/git`;
+        readonly url: `${string}/publish/git`;
     };
 } | {
     readonly name: "preview-channels";
@@ -259,26 +259,26 @@ export declare const SPACEFAST_PROMPT_SKILLS: ({
     readonly whenToUse: "Use when reviewers need a realistic preview before a change goes live.";
     readonly keywords: readonly ["preview", "channel", "branch", "pull request", "review", "private"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["publish", "status", "execute"];
+    readonly tools: readonly ["publish", "operation_status", "show_space_deployments", "execute", "resume_execution"];
     readonly docs: readonly ["builds", "access-control"];
-    readonly instructions: readonly ["Publish the branch through a connected repository or to an explicit non-production channel so the live production channel is unchanged.", "Keep the preview private by default. Use an Open URL for the owner's browser or create the narrowest scoped Link needed for reviewers.", "Label the preview with the branch, change, or pull request it represents and report what is intentionally out of scope."];
-    readonly verification: readonly ["Confirm the preview serves the expected version and production still points at its previous version.", "Test the reviewer link in a signed-out context and revoke it when review is complete."];
+    readonly instructions: readonly ["Call `publish` once for an explicit non-production space or channel. Do not change the production target.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop.", "Keep the preview private unless the user requests sharing.", "For reviewer access, use one bounded `execute` program. Read current access, create the narrowest Link, then read it again.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Label the preview with its branch, change, or pull request. Report what is out of scope."];
+    readonly verification: readonly ["Call `show_space_deployments` for each affected Space. Confirm that the preview changed. Confirm that production did not change.", "Test the reviewer Link in a signed-out context. Report its scope and expiry."];
     readonly recipe: {
         readonly slug: "recipes/preview-channels";
         readonly tier: "full";
-        readonly url: `${string}/publishing/git`;
+        readonly url: `${string}/publish/git`;
     };
 } | {
     readonly name: "claim-flow";
     readonly title: "Claim an anonymous space";
-    readonly description: "Attach an anonymous space to an account or team before expiry while keeping every claim credential in server or local custody.";
-    readonly whenToUse: "Use after an anonymous publish returns a claim URL and expiry.";
+    readonly description: "Attach an anonymous space to an account or team before expiry. Keep claim credentials in server or local custody.";
+    readonly whenToUse: "Use after an anonymous publish returns a claim action and expiry.";
     readonly keywords: readonly ["claim", "anonymous", "ownership", "team", "continuation", "credential"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute", "publish"];
+    readonly tools: readonly ["publish", "operation_status", "execute", "resume_execution"];
     readonly docs: readonly ["anonymous-publish", "workflow/continue-after-claim", "workflow/secret-handling"];
-    readonly instructions: readonly ["Return the claim URL and expiry to the user, never the raw claim credential. On-Device stores that credential in `.spacefast/state.json` and reuses it without returning it to the model.", "When authenticated On-Device credentials are available, use the catalog `claim` operation with only `teamId` and the expected `spaceId`; otherwise let the user open the claim URL in their browser.", "Publish again from On-Device after the browser claim. `publish` automatically exchanges the locally held claim credential once, persists the durable space-scoped credential, and retries without exposing either secret."];
-    readonly verification: readonly ["Confirm the space no longer has a claim expiry and appears under the intended account or team.", "Publish again from the same local root or inspect the space through `execute` to verify durable access works without asking for a raw token."];
+    readonly instructions: readonly ["Point the user to the claim action in the publish card and state its expiry. Never copy the claim credential into model text.", "When account credentials are available, use one bounded `execute` program. Search and describe the claim operation before calling it.", "Pass only the required team ID and expected space ID.", "After the claim resumes, read the space in the same program. Return its owner and claim state.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Otherwise, ask the user to use the claim action in the publish card.", "After a browser claim, call `publish` again from On-Device. It exchanges the locally held credential without exposing it.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop."];
+    readonly verification: readonly ["Confirm that the space has no claim expiry. Confirm that it belongs to the intended account or team.", "Confirm that the republish uses durable access without a raw credential."];
     readonly prompt: true;
 } | {
     readonly name: "rollback-safely";
@@ -287,10 +287,10 @@ export declare const SPACEFAST_PROMPT_SKILLS: ({
     readonly whenToUse: "Use when the current live version is broken and a prior healthy version is known or discoverable.";
     readonly keywords: readonly ["rollback", "revert", "version", "incident", "restore"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["status", "rollback", "execute", "diagnose"];
+    readonly tools: readonly ["show_space_deployments", "execute", "resume_execution"];
     readonly docs: readonly ["versions-and-rollback"];
-    readonly instructions: readonly ["Inspect recent immutable versions and current status. Compare the current live version with the candidate using the catalog `versions` and `diff` operations.", "Call `rollback` with the selected `versionId`. Rollback is additive and keeps later immutable versions available.", "If promotion returns an operation that is still settling, poll the catalog `operation_status` operation until it is done instead of assuming success."];
-    readonly verification: readonly ["Call `status` and confirm the live pointer references the selected version.", "Open the live URL and verify the failing path or behavior is restored; use `diagnose` if it is not."];
+    readonly instructions: readonly ["Call `show_space_deployments`. Select a known-good ready version that is older than the current version.", "Use one bounded `execute` program. Search and describe the version promotion operation before calling it.", "Read the live pointer, promote the selected version, then read the pointer again in the same program.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program."];
+    readonly verification: readonly ["Call `show_space_deployments`. Confirm that the selected version is current and ready.", "Open the live URL. Verify that the failing path or behavior works again."];
     readonly prompt: true;
 } | {
     readonly name: "set-up-custom-domain";
@@ -299,10 +299,10 @@ export declare const SPACEFAST_PROMPT_SKILLS: ({
     readonly whenToUse: "Use when the user owns a domain they want a Spacefast space to serve.";
     readonly keywords: readonly ["domain", "dns", "tls", "https", "cname", "custom"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute"];
+    readonly tools: readonly ["show_space_domains", "execute", "resume_execution"];
     readonly docs: readonly ["custom-domains", "recipes/migrate-dns"];
-    readonly instructions: readonly ["Add the domain with `sf domains add <domain>` or catalog operation `domains_add`; preserve the exact record values Spacefast returns.", "Give the user those DNS records to create at their provider. Do not claim this MCP changed third-party DNS unless it actually has an authorized provider integration.", "Keep the existing production hostname available during the cutover and avoid deleting old records until the new path is proven."];
-    readonly verification: readonly ["Run `sf domains check` or catalog operation `domains_check` until DNS and certificate state are ready.", "Open the final custom-domain HTTPS URL and verify representative content before reporting it live."];
+    readonly instructions: readonly ["Call `show_space_domains`. Read the current domain, DNS, and certificate state.", "If setup is required, use one bounded `execute` program. Search and describe the add or assign operation before calling it.", "Read the domain again in the same program after the mutation resumes.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Return the exact DNS records from Spacefast. Do not claim that Spacefast changed third-party DNS.", "Keep the existing production hostname until the custom domain is ready."];
+    readonly verification: readonly ["After the external DNS change, call `show_space_domains`. Report the current verification state.", "Open the HTTPS URL only after DNS and certificate states are ready. Verify representative content."];
     readonly prompt: true;
     readonly recipe: {
         readonly slug: "recipes/custom-domain";
@@ -316,10 +316,10 @@ export declare const SPACEFAST_PROMPT_SKILLS: ({
     readonly whenToUse: "Use for moved pages, canonical host paths, and intentional permanent or temporary redirects.";
     readonly keywords: readonly ["redirect", "rewrite", "routing", "301", "302", "path"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["publish", "execute"];
+    readonly tools: readonly ["publish", "operation_status", "show_space_deployments"];
     readonly docs: readonly ["redirects"];
-    readonly instructions: readonly ["Inspect existing routing rules, then add the smallest non-conflicting rules to `_redirects` at the publish root.", "Choose temporary or permanent status deliberately, preserve path/query semantics where required, and avoid redirect loops or rules that shadow real assets.", "Publish the redirect file as part of the same immutable version as the related content change."];
-    readonly verification: readonly ["Request representative old and new paths and confirm the exact status and Location header.", "Verify the final target serves successfully and unrelated assets are not redirected."];
+    readonly instructions: readonly ["Inspect existing routing rules, then add the smallest non-conflicting rules to `_redirects` at the publish root.", "Choose a temporary or permanent status deliberately. Preserve required path and query behavior.", "Avoid redirect loops and rules that hide real assets.", "Call `publish` once. Include the redirect file and related content in the same immutable version.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop."];
+    readonly verification: readonly ["Call `show_space_deployments` with `space: publish.result.receipt.space.id`. Confirm that the new version is current and ready.", "Request representative old and new paths and confirm the exact status and Location header.", "Verify the final target serves successfully and unrelated assets are not redirected."];
     readonly recipe: {
         readonly slug: "recipes/redirects";
         readonly tier: "reference";
@@ -332,10 +332,10 @@ export declare const SPACEFAST_PROMPT_SKILLS: ({
     readonly whenToUse: "Use when an existing production domain must move to Spacefast.";
     readonly keywords: readonly ["dns", "migrate", "cutover", "domain", "downtime", "certificate"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute"];
+    readonly tools: readonly ["show_space_domains", "execute", "resume_execution"];
     readonly docs: readonly ["custom-domains"];
-    readonly instructions: readonly ["Inventory the current authoritative DNS records and lower TTL ahead of the cutover when the provider and timing allow it.", "Add the domain to Spacefast and pre-stage every record it returns while preserving a working rollback path.", "Cut over only after the Spacefast endpoint, expected content, and TLS readiness can be validated. Keep the previous origin available until propagation is complete."];
-    readonly verification: readonly ["Check resolution from more than one resolver and confirm the certificate matches the final hostname.", "Open the public HTTPS URL, verify representative content, and monitor for old-origin traffic before removing rollback records."];
+    readonly instructions: readonly ["Inventory the current authoritative DNS records. Lower the TTL before cutover when the provider and timing permit it.", "Call `show_space_domains`. Read the current DNS and certificate state.", "If setup is required, use one bounded `execute` program. Search and describe the add or assign operation before calling it.", "Read the domain again in the same program after the mutation resumes.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Create the returned DNS records at the provider. Keep the previous origin available during propagation.", "Cut over only after the expected content and TLS state are ready."];
+    readonly verification: readonly ["Call `show_space_domains`. Confirm that DNS and certificate states are ready.", "Check more than one resolver. Confirm that the certificate matches the final hostname.", "Open the public HTTPS URL. Verify representative content before removing rollback records."];
     readonly recipe: {
         readonly slug: "recipes/migrate-dns";
         readonly tier: "reference";
@@ -348,10 +348,10 @@ export declare const SPACEFAST_PROMPT_SKILLS: ({
     readonly whenToUse: "Use when a build, finalize, activation, or live serving step fails or stalls.";
     readonly keywords: readonly ["debug", "failed", "build", "logs", "diagnose", "stalled"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute"];
+    readonly tools: readonly ["show_space_deployments", "execute", "publish", "operation_status"];
     readonly docs: readonly ["troubleshooting"];
-    readonly instructions: readonly ["Use `execute` to find and call the catalog diagnostics operation for the space and optional version. Read its ranked findings, locations, error codes, fix hints, and docs links instead of guessing from a generic status.", "Use the catalog `build_logs` operation for publish/finalize detail, runtime-log operations for serving errors, and version operations to compare with the last ready version.", "Apply the smallest fix tied to the evidence, rebuild, and publish again. Follow the problem document's `type` URL for any referenced error code."];
-    readonly verification: readonly ["Re-run the relevant diagnostics or status operation through `execute` and confirm the new version reaches the intended live state.", "Open the affected live path and verify the concrete failure no longer reproduces."];
+    readonly instructions: readonly ["Call `show_space_deployments`. Read the failed version, build state, stable error code, and diagnostics.", "If more detail is required, use one bounded `execute` program. Read only the required build logs or version data.", "Apply the smallest fix supported by the evidence. Run the real build.", "Call `publish` once with the fixed output.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop."];
+    readonly verification: readonly ["Call `show_space_deployments` with `space: publish.result.receipt.space.id`. Confirm that the new version is current and ready.", "Open the affected live path. Verify that the concrete failure does not occur."];
     readonly prompt: true;
 } | {
     readonly name: "manage-access";
@@ -360,23 +360,23 @@ export declare const SPACEFAST_PROMPT_SKILLS: ({
     readonly whenToUse: "Use when a space or path must be made public, team-only, or shared with specific people or machines.";
     readonly keywords: readonly ["access", "private", "public", "people", "links", "grant", "share"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute", "whoami"];
+    readonly tools: readonly ["execute", "resume_execution"];
     readonly docs: readonly ["access-control"];
-    readonly instructions: readonly ["Inspect current Grants with `sf share` or the catalog `grants_list` operation and identify one explicit access intent. Anonymous spaces start Private.", "Apply the narrowest suitable Public or Team Grant, People invitation, scoped Link/password, or machine/external-identity Grant. Keep resource scopes explicit.", "Show newly created Link or machine secrets only to the requesting user. Never put credentials, claim credentials, or API keys in logs or committed files."];
-    readonly verification: readonly ["Use `sf share check --as public --path /docs` or the catalog `grants_check` operation for a representative request.", "Test a new Link in the intended signed-out or recipient context and confirm unrelated resources remain inaccessible."];
+    readonly instructions: readonly ["Use one bounded `execute` program. Search and describe the access operations before calling them.", "Read current access. Apply the narrowest change for one explicit access intent. Read the resulting access state.", "Run the matching access check in the same program after the mutation resumes.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Show new Link or machine secrets only to the requesting user. Never store them in logs or committed files."];
+    readonly verification: readonly ["Confirm that the access check permits the intended actor and path.", "Test a new Link in the intended signed-out context. Confirm that unrelated resources stay inaccessible."];
     readonly prompt: true;
 })[];
 export declare const SPACEFAST_RECIPE_SKILLS: (({
     readonly name: "create-and-publish-site";
     readonly title: "Create and publish a polished website";
-    readonly description: "Turn a brief into a responsive website, review the result, publish it to Spacefast, and verify the live version.";
-    readonly whenToUse: "Use when the user wants an agent to design, build, improve, or launch a new website rather than only upload an existing build.";
+    readonly description: "Build a responsive website from a brief. Publish it and verify the live version.";
+    readonly whenToUse: "Use when the user wants a new website built, improved, or launched.";
     readonly keywords: readonly ["create", "website", "design", "build", "responsive", "launch", "publish"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["publish", "execute"];
+    readonly tools: readonly ["publish", "operation_status", "show_space_deployments"];
     readonly docs: readonly ["quickstart", "publishing"];
-    readonly instructions: readonly ["Clarify the audience, goal, required content, brand constraints, and desired call to action. If the visual direction is open, propose two or three distinct directions and choose one with the user.", "Inspect the existing workspace before editing. Reuse its framework, package manager, components, assets, and build conventions when they are sound.", "Build a focused, accessible experience with a clear hierarchy, real content, responsive layouts, useful interaction states, and no placeholder copy. Keep the main path simple and put secondary detail behind progressive disclosure.", "Run the real build and inspect the result at mobile and desktop widths. Fix overflow, illegible contrast, broken links, missing assets, keyboard traps, and avoidable layout shift.", "Review the workspace diff and summarize material design or content judgments before publishing. Never include API keys, claim credentials, upload credentials, or local auth state in the artifact.", "Publish the built output with `publish`. Present Open as the reusable access link and Claim as the one-time ownership link. Treat live and immutable-version URLs as receipt metadata, not extra actions."];
-    readonly verification: readonly ["Call `status` after publishing and confirm the intended version is live; use `diagnose` if serving is stalled or failed.", "Open the live URL and verify the primary page, navigation, assets, responsive layout, and main call to action before claiming success."];
+    readonly instructions: readonly ["Use the user's brief. Infer optional design choices from the content and workspace.", "Ask a question only when a missing required value blocks safe work.", "Inspect the workspace. Reuse its framework, package manager, components, assets, and build commands when suitable.", "Build an accessible site with real content, responsive layouts, clear hierarchy, and useful interaction states.", "Run the real build. Check mobile and desktop layouts, links, assets, keyboard use, contrast, and layout stability.", "Review the final diff. Remove secrets and local authentication data from the artifact.", "Call `publish` once with the built output. Return useful access, live, and version URLs from the receipt. If the publish is anonymous, point the user to the claim action in the publish card and state its expiry.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop."];
+    readonly verification: readonly ["Call `show_space_deployments` with `space: publish.result.receipt.space.id`. Confirm that the intended version is ready and current.", "If the deployment failed or stalled, report its stable error code and actionable diagnostics.", "Open the live URL. Verify the main page, navigation, assets, responsive layout, and primary call to action."];
     readonly runtimeNotes: {
         readonly local: "On-Device can work directly inside the configured local workspace root and publish a local build path.";
         readonly hosted: "Hosted has no filesystem. Generate small files in the client and publish them inline, or use catalog manifest and import operations for larger artifacts.";
@@ -394,10 +394,10 @@ export declare const SPACEFAST_RECIPE_SKILLS: (({
     readonly whenToUse: "Use when the artifact already exists and the user wants it published or updated.";
     readonly keywords: readonly ["publish", "deploy", "live", "verify", "version", "claim"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["publish", "status", "diagnose"];
+    readonly tools: readonly ["publish", "operation_status", "show_space_deployments"];
     readonly docs: readonly ["publishing", "workflow/publish-receipt", "workflow/secret-handling"];
-    readonly instructions: readonly ["Identify the actual publish root or build output. Run the real build first when the source tree is not itself the artifact to publish.", "Publish with `publish`. For an anonymous On-Device publish, keep the claim credential in local custody and return only the claim URL and expiry; never expose or ask the user to paste the raw token.", "Report the bare Live URL, private Access URL when present, immutable Version URL when present, anonymous Claim URL and expiry when present, plus actionable diagnostics."];
-    readonly verification: readonly ["Call `status` and confirm the intended version is live. Use `diagnose` for a failed or stalled publish.", "Open the live URL and verify representative content and assets rather than treating a successful upload or health check as serving proof."];
+    readonly instructions: readonly ["Identify the actual publish root or build output. Run the real build first when the source tree is not the artifact.", "Call `publish` once. Keep anonymous claim credentials in local custody.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop.", "Return the live, access, and version URLs that are present. For an anonymous publish, state the claim expiry and point the user to the claim action in the publish card.", "Never expose a raw claim credential. Never ask the user to paste one."];
+    readonly verification: readonly ["Call `show_space_deployments` with `space: publish.result.receipt.space.id`. Confirm that the intended version is ready and current.", "Report the stable error code and actionable diagnostics when the deployment failed or stalled.", "Open the live URL. Verify representative content and assets before reporting success."];
     readonly runtimeNotes: {
         readonly local: "Publish a bounded local path; locally custodied claim credentials are reused automatically.";
         readonly hosted: "Publish inline files, or use catalog manifest and import operations for larger artifacts. Hosted has no filesystem.";
@@ -406,7 +406,7 @@ export declare const SPACEFAST_RECIPE_SKILLS: (({
     readonly recipe: {
         readonly slug: "recipes/agent-publish";
         readonly tier: "full";
-        readonly url: `${string}/publishing/anonymous`;
+        readonly url: `${string}/publish/anonymous`;
     };
 } | {
     readonly name: "ci-github-actions";
@@ -415,15 +415,15 @@ export declare const SPACEFAST_RECIPE_SKILLS: (({
     readonly whenToUse: "Use when pushes or manual workflow runs should publish automatically from GitHub.";
     readonly keywords: readonly ["github", "actions", "ci", "push", "automatic", "workflow"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute"];
+    readonly tools: readonly [];
     readonly docs: readonly ["builds", "publishing", "workflow/secret-handling"];
-    readonly instructions: readonly ["Inspect the repository's package manager, lockfile, build command, runtime version, output directory, and existing workflows before writing YAML.", "Create a least-privilege workflow triggered by the intended branch and `workflow_dispatch`: check out the repository, install with the locked dependency command, build, and run `npx -y spacefast@<pinned-version> publish <output> --json`.", "Store the credential as a masked `SPACEFAST_TOKEN` repository or environment secret. Never echo it or upload generated auth files, claim credentials, or upload credentials as artifacts.", "Use the repository's real package manager and output directory; do not copy a generic npm/dist example over a Bun, pnpm, yarn, or custom build."];
+    readonly instructions: readonly ["Inspect the package manager, lockfile, build command, runtime version, output directory, and existing workflows.", "Create one least-privilege workflow for the intended branch and `workflow_dispatch`.", "Check out the repository.", "Install dependencies with the locked command.", "Run the real build.", "Run `npx -y spacefast@<pinned-version> publish <output> --json` with the actual output directory.", "Store the credential as a masked `SPACEFAST_TOKEN` repository or environment secret.", "Never echo credentials. Never upload authentication files or credentials as artifacts.", "Use the repository's real package manager and output directory.", "Do not replace custom build steps with a generic npm/dist example."];
     readonly verification: readonly ["Validate the workflow syntax and run it on an explicit test branch or manual dispatch.", "Inspect the publish receipt and live URL; a green build step alone is not serving proof."];
     readonly prompt: true;
     readonly recipe: {
         readonly slug: "recipes/github-deploys";
         readonly tier: "full";
-        readonly url: `${string}/publishing/git`;
+        readonly url: `${string}/publish/git`;
     };
 } | {
     readonly name: "preview-channels";
@@ -432,26 +432,26 @@ export declare const SPACEFAST_RECIPE_SKILLS: (({
     readonly whenToUse: "Use when reviewers need a realistic preview before a change goes live.";
     readonly keywords: readonly ["preview", "channel", "branch", "pull request", "review", "private"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["publish", "status", "execute"];
+    readonly tools: readonly ["publish", "operation_status", "show_space_deployments", "execute", "resume_execution"];
     readonly docs: readonly ["builds", "access-control"];
-    readonly instructions: readonly ["Publish the branch through a connected repository or to an explicit non-production channel so the live production channel is unchanged.", "Keep the preview private by default. Use an Open URL for the owner's browser or create the narrowest scoped Link needed for reviewers.", "Label the preview with the branch, change, or pull request it represents and report what is intentionally out of scope."];
-    readonly verification: readonly ["Confirm the preview serves the expected version and production still points at its previous version.", "Test the reviewer link in a signed-out context and revoke it when review is complete."];
+    readonly instructions: readonly ["Call `publish` once for an explicit non-production space or channel. Do not change the production target.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop.", "Keep the preview private unless the user requests sharing.", "For reviewer access, use one bounded `execute` program. Read current access, create the narrowest Link, then read it again.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Label the preview with its branch, change, or pull request. Report what is out of scope."];
+    readonly verification: readonly ["Call `show_space_deployments` for each affected Space. Confirm that the preview changed. Confirm that production did not change.", "Test the reviewer Link in a signed-out context. Report its scope and expiry."];
     readonly recipe: {
         readonly slug: "recipes/preview-channels";
         readonly tier: "full";
-        readonly url: `${string}/publishing/git`;
+        readonly url: `${string}/publish/git`;
     };
 } | {
     readonly name: "claim-flow";
     readonly title: "Claim an anonymous space";
-    readonly description: "Attach an anonymous space to an account or team before expiry while keeping every claim credential in server or local custody.";
-    readonly whenToUse: "Use after an anonymous publish returns a claim URL and expiry.";
+    readonly description: "Attach an anonymous space to an account or team before expiry. Keep claim credentials in server or local custody.";
+    readonly whenToUse: "Use after an anonymous publish returns a claim action and expiry.";
     readonly keywords: readonly ["claim", "anonymous", "ownership", "team", "continuation", "credential"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute", "publish"];
+    readonly tools: readonly ["publish", "operation_status", "execute", "resume_execution"];
     readonly docs: readonly ["anonymous-publish", "workflow/continue-after-claim", "workflow/secret-handling"];
-    readonly instructions: readonly ["Return the claim URL and expiry to the user, never the raw claim credential. On-Device stores that credential in `.spacefast/state.json` and reuses it without returning it to the model.", "When authenticated On-Device credentials are available, use the catalog `claim` operation with only `teamId` and the expected `spaceId`; otherwise let the user open the claim URL in their browser.", "Publish again from On-Device after the browser claim. `publish` automatically exchanges the locally held claim credential once, persists the durable space-scoped credential, and retries without exposing either secret."];
-    readonly verification: readonly ["Confirm the space no longer has a claim expiry and appears under the intended account or team.", "Publish again from the same local root or inspect the space through `execute` to verify durable access works without asking for a raw token."];
+    readonly instructions: readonly ["Point the user to the claim action in the publish card and state its expiry. Never copy the claim credential into model text.", "When account credentials are available, use one bounded `execute` program. Search and describe the claim operation before calling it.", "Pass only the required team ID and expected space ID.", "After the claim resumes, read the space in the same program. Return its owner and claim state.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Otherwise, ask the user to use the claim action in the publish card.", "After a browser claim, call `publish` again from On-Device. It exchanges the locally held credential without exposing it.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop."];
+    readonly verification: readonly ["Confirm that the space has no claim expiry. Confirm that it belongs to the intended account or team.", "Confirm that the republish uses durable access without a raw credential."];
     readonly prompt: true;
 } | {
     readonly name: "rollback-safely";
@@ -460,10 +460,10 @@ export declare const SPACEFAST_RECIPE_SKILLS: (({
     readonly whenToUse: "Use when the current live version is broken and a prior healthy version is known or discoverable.";
     readonly keywords: readonly ["rollback", "revert", "version", "incident", "restore"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["status", "rollback", "execute", "diagnose"];
+    readonly tools: readonly ["show_space_deployments", "execute", "resume_execution"];
     readonly docs: readonly ["versions-and-rollback"];
-    readonly instructions: readonly ["Inspect recent immutable versions and current status. Compare the current live version with the candidate using the catalog `versions` and `diff` operations.", "Call `rollback` with the selected `versionId`. Rollback is additive and keeps later immutable versions available.", "If promotion returns an operation that is still settling, poll the catalog `operation_status` operation until it is done instead of assuming success."];
-    readonly verification: readonly ["Call `status` and confirm the live pointer references the selected version.", "Open the live URL and verify the failing path or behavior is restored; use `diagnose` if it is not."];
+    readonly instructions: readonly ["Call `show_space_deployments`. Select a known-good ready version that is older than the current version.", "Use one bounded `execute` program. Search and describe the version promotion operation before calling it.", "Read the live pointer, promote the selected version, then read the pointer again in the same program.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program."];
+    readonly verification: readonly ["Call `show_space_deployments`. Confirm that the selected version is current and ready.", "Open the live URL. Verify that the failing path or behavior works again."];
     readonly prompt: true;
 } | {
     readonly name: "set-up-custom-domain";
@@ -472,10 +472,10 @@ export declare const SPACEFAST_RECIPE_SKILLS: (({
     readonly whenToUse: "Use when the user owns a domain they want a Spacefast space to serve.";
     readonly keywords: readonly ["domain", "dns", "tls", "https", "cname", "custom"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute"];
+    readonly tools: readonly ["show_space_domains", "execute", "resume_execution"];
     readonly docs: readonly ["custom-domains", "recipes/migrate-dns"];
-    readonly instructions: readonly ["Add the domain with `sf domains add <domain>` or catalog operation `domains_add`; preserve the exact record values Spacefast returns.", "Give the user those DNS records to create at their provider. Do not claim this MCP changed third-party DNS unless it actually has an authorized provider integration.", "Keep the existing production hostname available during the cutover and avoid deleting old records until the new path is proven."];
-    readonly verification: readonly ["Run `sf domains check` or catalog operation `domains_check` until DNS and certificate state are ready.", "Open the final custom-domain HTTPS URL and verify representative content before reporting it live."];
+    readonly instructions: readonly ["Call `show_space_domains`. Read the current domain, DNS, and certificate state.", "If setup is required, use one bounded `execute` program. Search and describe the add or assign operation before calling it.", "Read the domain again in the same program after the mutation resumes.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Return the exact DNS records from Spacefast. Do not claim that Spacefast changed third-party DNS.", "Keep the existing production hostname until the custom domain is ready."];
+    readonly verification: readonly ["After the external DNS change, call `show_space_domains`. Report the current verification state.", "Open the HTTPS URL only after DNS and certificate states are ready. Verify representative content."];
     readonly prompt: true;
     readonly recipe: {
         readonly slug: "recipes/custom-domain";
@@ -489,10 +489,10 @@ export declare const SPACEFAST_RECIPE_SKILLS: (({
     readonly whenToUse: "Use for moved pages, canonical host paths, and intentional permanent or temporary redirects.";
     readonly keywords: readonly ["redirect", "rewrite", "routing", "301", "302", "path"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["publish", "execute"];
+    readonly tools: readonly ["publish", "operation_status", "show_space_deployments"];
     readonly docs: readonly ["redirects"];
-    readonly instructions: readonly ["Inspect existing routing rules, then add the smallest non-conflicting rules to `_redirects` at the publish root.", "Choose temporary or permanent status deliberately, preserve path/query semantics where required, and avoid redirect loops or rules that shadow real assets.", "Publish the redirect file as part of the same immutable version as the related content change."];
-    readonly verification: readonly ["Request representative old and new paths and confirm the exact status and Location header.", "Verify the final target serves successfully and unrelated assets are not redirected."];
+    readonly instructions: readonly ["Inspect existing routing rules, then add the smallest non-conflicting rules to `_redirects` at the publish root.", "Choose a temporary or permanent status deliberately. Preserve required path and query behavior.", "Avoid redirect loops and rules that hide real assets.", "Call `publish` once. Include the redirect file and related content in the same immutable version.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop."];
+    readonly verification: readonly ["Call `show_space_deployments` with `space: publish.result.receipt.space.id`. Confirm that the new version is current and ready.", "Request representative old and new paths and confirm the exact status and Location header.", "Verify the final target serves successfully and unrelated assets are not redirected."];
     readonly recipe: {
         readonly slug: "recipes/redirects";
         readonly tier: "reference";
@@ -505,10 +505,10 @@ export declare const SPACEFAST_RECIPE_SKILLS: (({
     readonly whenToUse: "Use when an existing production domain must move to Spacefast.";
     readonly keywords: readonly ["dns", "migrate", "cutover", "domain", "downtime", "certificate"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute"];
+    readonly tools: readonly ["show_space_domains", "execute", "resume_execution"];
     readonly docs: readonly ["custom-domains"];
-    readonly instructions: readonly ["Inventory the current authoritative DNS records and lower TTL ahead of the cutover when the provider and timing allow it.", "Add the domain to Spacefast and pre-stage every record it returns while preserving a working rollback path.", "Cut over only after the Spacefast endpoint, expected content, and TLS readiness can be validated. Keep the previous origin available until propagation is complete."];
-    readonly verification: readonly ["Check resolution from more than one resolver and confirm the certificate matches the final hostname.", "Open the public HTTPS URL, verify representative content, and monitor for old-origin traffic before removing rollback records."];
+    readonly instructions: readonly ["Inventory the current authoritative DNS records. Lower the TTL before cutover when the provider and timing permit it.", "Call `show_space_domains`. Read the current DNS and certificate state.", "If setup is required, use one bounded `execute` program. Search and describe the add or assign operation before calling it.", "Read the domain again in the same program after the mutation resumes.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Create the returned DNS records at the provider. Keep the previous origin available during propagation.", "Cut over only after the expected content and TLS state are ready."];
+    readonly verification: readonly ["Call `show_space_domains`. Confirm that DNS and certificate states are ready.", "Check more than one resolver. Confirm that the certificate matches the final hostname.", "Open the public HTTPS URL. Verify representative content before removing rollback records."];
     readonly recipe: {
         readonly slug: "recipes/migrate-dns";
         readonly tier: "reference";
@@ -521,10 +521,10 @@ export declare const SPACEFAST_RECIPE_SKILLS: (({
     readonly whenToUse: "Use when a build, finalize, activation, or live serving step fails or stalls.";
     readonly keywords: readonly ["debug", "failed", "build", "logs", "diagnose", "stalled"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute"];
+    readonly tools: readonly ["show_space_deployments", "execute", "publish", "operation_status"];
     readonly docs: readonly ["troubleshooting"];
-    readonly instructions: readonly ["Use `execute` to find and call the catalog diagnostics operation for the space and optional version. Read its ranked findings, locations, error codes, fix hints, and docs links instead of guessing from a generic status.", "Use the catalog `build_logs` operation for publish/finalize detail, runtime-log operations for serving errors, and version operations to compare with the last ready version.", "Apply the smallest fix tied to the evidence, rebuild, and publish again. Follow the problem document's `type` URL for any referenced error code."];
-    readonly verification: readonly ["Re-run the relevant diagnostics or status operation through `execute` and confirm the new version reaches the intended live state.", "Open the affected live path and verify the concrete failure no longer reproduces."];
+    readonly instructions: readonly ["Call `show_space_deployments`. Read the failed version, build state, stable error code, and diagnostics.", "If more detail is required, use one bounded `execute` program. Read only the required build logs or version data.", "Apply the smallest fix supported by the evidence. Run the real build.", "Call `publish` once with the fixed output.", "If `publish.result.status` is `publishing`, call `operation_status` with `publish.result.job.poll.operationId`.", "Call `operation_status` again only while `operation_status.result.done` is false.", "Continue only when `operation_status.result.status` is `succeeded`.", "Report `failed` or `canceled` and stop."];
+    readonly verification: readonly ["Call `show_space_deployments` with `space: publish.result.receipt.space.id`. Confirm that the new version is current and ready.", "Open the affected live path. Verify that the concrete failure does not occur."];
     readonly prompt: true;
 } | {
     readonly name: "manage-access";
@@ -533,10 +533,10 @@ export declare const SPACEFAST_RECIPE_SKILLS: (({
     readonly whenToUse: "Use when a space or path must be made public, team-only, or shared with specific people or machines.";
     readonly keywords: readonly ["access", "private", "public", "people", "links", "grant", "share"];
     readonly runtimes: readonly ["local", "hosted"];
-    readonly tools: readonly ["execute", "whoami"];
+    readonly tools: readonly ["execute", "resume_execution"];
     readonly docs: readonly ["access-control"];
-    readonly instructions: readonly ["Inspect current Grants with `sf share` or the catalog `grants_list` operation and identify one explicit access intent. Anonymous spaces start Private.", "Apply the narrowest suitable Public or Team Grant, People invitation, scoped Link/password, or machine/external-identity Grant. Keep resource scopes explicit.", "Show newly created Link or machine secrets only to the requesting user. Never put credentials, claim credentials, or API keys in logs or committed files."];
-    readonly verification: readonly ["Use `sf share check --as public --path /docs` or the catalog `grants_check` operation for a representative request.", "Test a new Link in the intended signed-out or recipient context and confirm unrelated resources remain inaccessible."];
+    readonly instructions: readonly ["Use one bounded `execute` program. Search and describe the access operations before calling them.", "Read current access. Apply the narrowest change for one explicit access intent. Read the resulting access state.", "Run the matching access check in the same program after the mutation resumes.", "If `execute` pauses, follow its `resumePrompt`. Then call `resume_execution` with the returned `executionId`.", "Do not start another `execute` program.", "Show new Link or machine secrets only to the requesting user. Never store them in logs or committed files."];
+    readonly verification: readonly ["Confirm that the access check permits the intended actor and path.", "Test a new Link in the intended signed-out context. Confirm that unrelated resources stay inaccessible."];
     readonly prompt: true;
 }) & {
     recipe: NonNullable<SpacefastSkillDefinition["recipe"]>;