@spacefast/common 0.2.1 → 0.4.1

package/dist/docs/catalog.d.ts

@@ -50,10 +50,10 @@ export declare const DOCS_CATALOG: readonly [{
     readonly slug: "spaces/rename";
     readonly title: "Rename a space";
     readonly kind: "guide";
-    readonly tier: "full";
+    readonly tier: "essential";
     readonly summary: "Change a space slug and its managed view.fast address without breaking old links.";
-    readonly keywords: readonly ["space", "rename", "slug", "view.fast", "redirect", "managed hostname"];
-    readonly url: `${string}/operate/spaces`;
+    readonly keywords: readonly ["space", "rename", "slug", "view.fast", "redirect", "managed hostname", "rename a space", "change space name", "change space url"];
+    readonly url: `${string}/cli/spaces`;
     readonly body: "Run `sf spaces update --space <space> --slug <new-slug> --wait`, or PATCH `/v1/spaces/{spaceId}` with `{ \"slug\": \"<new-slug>\" }`. The managed view.fast hostname changes with the slug. Former managed addresses and branch aliases redirect directly to their current counterparts with a temporary, path- and query-preserving 307 for the life of the space unless an operator explicitly releases them. Custom domains stay attached, and immutable version URLs do not change.";
 }, {
     readonly slug: "versions-and-rollback";
@@ -203,11 +203,11 @@ export declare const DOCS_CATALOG: readonly [{
     readonly slug: "access-control";
     readonly title: "Access control";
     readonly kind: "guide";
-    readonly tier: "full";
-    readonly summary: "Create scoped Grants, invite People, and manage Links or credentials.";
-    readonly keywords: readonly ["access", "share", "people", "links", "private", "team", "public"];
+    readonly tier: "essential";
+    readonly summary: "Make a space public, share private access, and understand permissions and scopes.";
+    readonly keywords: readonly ["access", "share", "people", "links", "private", "team", "public", "make space public", "share a space", "open to everyone", "permissions and scopes", "grant access", "who can access"];
     readonly url: `${string}/access`;
-    readonly body: "Use `sf share grant`, `sf share people`, `sf share link`, `sf share password`, or `sf share token`. Inspect one route with `sf share check`; every audience uses the same path, capability, target, and constraint evaluator.";
+    readonly body: "New spaces are private. Make the live space public with `sf share grant --to public --role viewer --path '/**' --target live`. Use People or Links for private sharing. Permissions name allowed actions; scopes limit which resources a credential can reach.";
 }, {
     readonly slug: "redirects";
     readonly title: "Redirects";
@@ -252,7 +252,16 @@ export declare const DOCS_CATALOG: readonly [{
     readonly summary: "A capsule with a database: schema, queries, mutations, endpoints.";
     readonly keywords: readonly ["zero", "capsule", "database", "schema", "query", "mutation", "endpoint", "transaction", "sql", "sf dev"];
     readonly url: `${string}/zero-runtime`;
-    readonly body: "Zero is for apps where the data is the point. Write one capsule — schema, queries, mutations, endpoints — start it locally with `sf dev`, and `sf publish` puts it live with its own database and dedicated runtime site on every plan.";
+    readonly body: "Zero is for apps where the data is the point. Write one capsule — schema, queries, mutations, endpoints — start it locally with `sf dev`, and `sf publish` puts it live with its own database and runtime site on every plan.";
+}, {
+    readonly slug: "zero-connectors";
+    readonly title: "Zero connectors";
+    readonly kind: "guide";
+    readonly tier: "full";
+    readonly summary: "Declare connector roles, bind accounts to a Space, and connect visitor accounts.";
+    readonly keywords: readonly ["zero", "connectors", "roles", "team", "owner", "visitor", "serving", "bindings", "ConnectorGate", "Linear", "Workers", "env.CONNECTORS", "env.ZERO", "audit", "runs"];
+    readonly url: `${string}/zero-connectors`;
+    readonly body: "Declare roles with connector({ as: 'team' | 'owner' | 'visitor', connector: 'linear' }). Team roles require a bound team connection with a serving grant; owner roles require the binder's personal connection and a private Space. Visitor roles use each signed-in visitor's own account. Call ctx.connectors.<role>.<tool>(args) and render connection or approval states with ConnectorGate. Workers use env.CONNECTORS and, when a capsule is attached, env.ZERO.query(name, ...args) and env.ZERO.mutate(name, ...args). Inspect calls on the connector runs page by origin and Space.";
 }, {
     readonly slug: "runtimes/functions";
     readonly title: "Spacefast Functions";
@@ -379,6 +388,15 @@ export declare const DOCS_CATALOG: readonly [{
     readonly keywords: readonly ["init", "config", "scaffold", "sf.jsonc", "setup"];
     readonly url: `${string}/cli`;
     readonly body: "`sf init` detects your framework and writes a starter `sf.jsonc` so subsequent `sf publish` runs are zero-config.";
+}, {
+    readonly slug: "feedback";
+    readonly title: "sf feedback";
+    readonly kind: "cli";
+    readonly tier: "essential";
+    readonly summary: "Send product, docs, or error feedback to Spacefast.";
+    readonly keywords: readonly ["feedback", "report", "bug", "docs", "error", "request id", "sf feedback"];
+    readonly url: `${string}/cli`;
+    readonly body: "Run `sf feedback --message \"Describe what happened\"`. For an API error, add `--category bug`, `--error-code <code>`, and `--request-id <requestId>` from the error output.";
 }, {
     readonly slug: "claim";
     readonly title: "sf spaces claim";
@@ -388,15 +406,24 @@ export declare const DOCS_CATALOG: readonly [{
     readonly keywords: readonly ["claim", "anonymous", "attach", "token", "adopt", "spaces"];
     readonly url: `${string}/cli`;
     readonly body: "After an agent publishes anonymously, run `sf spaces claim` with the space key to bind the space to your account.";
+}, {
+    readonly slug: "cli/spaces/check";
+    readonly title: "sf spaces check";
+    readonly kind: "cli";
+    readonly tier: "essential";
+    readonly summary: "Check whether a Space name and its managed hostname are available.";
+    readonly keywords: readonly ["spaces", "check", "name availability", "slug availability", "hostname availability", "view.fast", "is this name free", "taken"];
+    readonly url: `${string}/cli/spaces`;
+    readonly body: "Run `sf spaces check <name> [--team <team>]` to check a name. The command reports the team-scoped Space slug and the global `view.fast` hostname separately. The result is advisory. A create or rename operation can still lose a race. Do not check availability with an HTTP request to the hostname.";
 }, {
     readonly slug: "cli/spaces";
     readonly title: "sf spaces";
     readonly kind: "cli";
-    readonly tier: "full";
-    readonly summary: "List, inspect, download, duplicate, transfer, and remove spaces.";
-    readonly keywords: readonly ["spaces", "space", "ls", "get", "download", "duplicate", "rm", "transfer"];
-    readonly url: `${string}/cli`;
-    readonly body: "The `sf spaces` group manages spaces: `ls`, `get`, `claim`, `download`, `duplicate`, `transfer`, and `rm`. Use `sf spaces download --version <ref>` to retrieve one immutable version.";
+    readonly tier: "essential";
+    readonly summary: "Check, list, inspect, download, duplicate, transfer, and delete spaces.";
+    readonly keywords: readonly ["spaces", "space", "check", "availability", "ls", "get", "download", "duplicate", "rm", "remove", "delete", "delete a space", "remove a space", "transfer"];
+    readonly url: `${string}/cli/spaces`;
+    readonly body: "Use `sf spaces rm --space <space>` to delete a space; add `--yes` to skip confirmation. The `sf spaces` group also includes `check`, `ls`, `get`, `claim`, `download`, `duplicate`, and `transfer`.";
 }, {
     readonly slug: "cli/versions";
     readonly title: "sf versions";
@@ -473,11 +500,11 @@ export declare const DOCS_CATALOG: readonly [{
     readonly slug: "cli/api-keys";
     readonly title: "sf api-keys";
     readonly kind: "cli";
-    readonly tier: "full";
-    readonly summary: "Create and revoke API keys for the Spacefast API.";
-    readonly keywords: readonly ["api-keys", "api key", "token", "create", "revoke", "list", "credential"];
-    readonly url: `${string}/cli`;
-    readonly body: "`sf api-keys create` mints a bearer key (shown once, masked in `--json`); `sf api-keys list` and `sf api-keys revoke` manage existing keys.";
+    readonly tier: "essential";
+    readonly summary: "Create, list, and revoke API keys with explicit permissions and scopes.";
+    readonly keywords: readonly ["api-keys", "api key", "api keys", "create api key", "revoke api key", "list api keys", "token", "credential", "permissions", "scopes", "permissions and scopes"];
+    readonly url: `${string}/cli/api-keys`;
+    readonly body: "Run `sf api-keys create` to mint a bearer key, `sf api-keys list` to inspect keys, and `sf api-keys revoke` to turn one off. Presets select a permission bundle; each key is scoped to its team. The secret is shown once and masked in `--json` output.";
 }, {
     readonly slug: "cli/analytics";
     readonly title: "sf analytics";
@@ -577,6 +604,15 @@ export declare const DOCS_CATALOG: readonly [{
     readonly keywords: readonly ["api", "teams", "team", "members", "invitations", "endpoint"];
     readonly url: `${string}/api`;
     readonly body: "Create teams, list members, and manage invitations programmatically. Webhooks and API keys are team-scoped.";
+}, {
+    readonly slug: "api/connectors";
+    readonly title: "Connectors API";
+    readonly kind: "api";
+    readonly tier: "reference";
+    readonly summary: "Connect tool sources, manage connections and policy, and run tools over HTTP.";
+    readonly keywords: readonly ["api", "connectors", "connections", "tools", "policy", "runs", "mcp", "openapi", "graphql", "endpoint"];
+    readonly url: `${string}/api`;
+    readonly body: "Register OpenAPI, GraphQL, or remote MCP sources as team connectors; connect accounts whose credentials stay server-side; set an ordered tool policy; and run a single tool or a code program, with approvals when a rule asks for them.";
 }, {
     readonly slug: "api/docs";
     readonly title: "Docs API (GET /v1/docs)";
@@ -611,17 +647,17 @@ export declare const DOCS_CATALOG: readonly [{
     readonly tier: "reference";
     readonly summary: "The tenant-facing partner API for running Spacefast as infra.";
     readonly keywords: readonly ["api", "partner", "tenant", "infra", "openapi", "multi-tenant", "white label"];
-    readonly url: `${string}/partners`;
+    readonly url: string;
     readonly body: `There is no partner route tree. Partners call the same \`/v1\` routes as everyone else: successes carry a \`{ data }\` envelope and failures are RFC 9457 problem documents (\`application/problem+json\` with a stable \`code\`), exactly as elsewhere in the API. A tenant-rooted credential's policy scope and response projection decide what it sees. "Partner" is a spec visibility tier: those operations, plus tenants and principals, are published as a second OpenAPI document at ${string}/openapi.partner.json, rendered at ${string}. Point \`openapi-typescript\` at that document for types. Configuration is not a set of endpoints: a tenant declares its integration in one designated space's published manifest (see \`partner/system-space\`).`;
 }, {
     readonly slug: "partner/onboarding";
     readonly title: "Partner onboarding";
     readonly kind: "api";
     readonly tier: "reference";
-    readonly summary: "Bootstrap a tenant: one key, one space, one designation, one publish.";
+    readonly summary: "Connect your backend using separate live and test environments.";
     readonly keywords: readonly ["partner", "onboarding", "tenant", "bootstrap", "partner_admin", "api key", "setup"];
-    readonly url: `${string}/partners#onboarding`;
-    readonly body: "Tenant creation is superadmin-side and mints one bootstrap tenant-rooted API key with the `partner_admin` preset (`tenants:*`, `principals:read`, and space/domain/publish actions over the tenant). From there it is four steps you drive yourself: create a space with that key, `PATCH /v1/tenants/{tenantId}` with `systemSpaceId` to designate it, publish the manifest, then read `manifestStatus` on `GET /v1/tenants/{tenantId}` to watch each declared item converge. Mint further keys through the normal API-key routes — every one is bounded to a subset of its grantor's policy.";
+    readonly url: `${string}/v1/docs/pages/partner/onboarding`;
+    readonly body: "Enable partner access for your Spacefast team, then open Partners in the dashboard. Your team manages a linked live and test tenant. Each environment has its own customers, configuration, and credentials. Team owners and admins create tenant server keys in the dashboard or through `POST /v1/tenants/{tenantId}/api-keys`. The default key manages that environment, including bounded key creation and revocation. For your first integration, call the shared API from your backend and keep the key on your server. Create a space with the selected environment's key, designate it with `PATCH /v1/tenants/{tenantId}` using `systemSpaceId`, then publish your system manifest. Read `manifestStatus` on `GET /v1/tenants/{tenantId}` to check activation. To replace a key, create a new key, deploy it to your backend, then revoke the old key with `DELETE /v1/tenants/{tenantId}/api-keys/{apiKeyId}`. Test hosting uses simulated infrastructure; use the live environment to publish publicly reachable sites. Billing stays in your system. Spacefast plans grant features and enforce quotas.";
 }, {
     readonly slug: "partner/system-space";
     readonly title: "The system space";
@@ -629,8 +665,8 @@ export declare const DOCS_CATALOG: readonly [{
     readonly tier: "reference";
     readonly summary: "Your integration is a published space, so config versions and rolls back.";
     readonly keywords: readonly ["partner", "system space", "manifest", "sf.jsonc", "systemSpaceId", "manifestStatus", "gitops", "reconciliation", "white label"];
-    readonly url: `${string}/partners#system-space`;
-    readonly body: "A tenant designates one ordinary space as its system space, and that space's live version *is* the integration definition: a top-level `system` section in `sf.jsonc` (presentation, hostname apex, API origin, token issuers, event subscriptions) plus `_pages/` and `theme.json` as the defaults layer. One config language, one validation pipeline, one publish flow — and `sf rollback` rolls back your configuration with it. Finalize, promote, and rollback all reconcile declared state against current state. Presentation, pages, theme, and subscriptions apply immediately; hostnames, API origins, and token issuers enter `pending` until their DNS, TLS, or key-possession check passes. Dropping an item from the manifest deactivates it. Per-item state lands in `manifestStatus` (`{ key, state, detail, since }` plus the source version id) on `GET /v1/tenants/{tenantId}`. There are no imperative config routes: the fix for a failed item is a new publish. Secrets are never declared — webhook secrets and API keys are minted by their own routes.";
+    readonly url: `${string}/v1/docs/pages/partner/system-space`;
+    readonly body: "A tenant designates one ordinary space as its system space, and that space's live version *is* the integration definition: a top-level `system` section in `sf.jsonc` (presentation, hostname apex, API origin, token issuers, event subscriptions) plus `_pages/` and `theme.json` as the defaults layer. One config language, one validation pipeline, one publish flow — and `sf rollback` rolls back your configuration with it. Finalize, promote, and rollback all reconcile declared state against current state. Presentation, pages, theme, and subscriptions apply immediately; hostnames, API origins, and token issuers enter `pending` until their DNS, TLS, or key-possession check passes. Removing an issuer, API origin, subscription, or plan declaration reconciles that desired state. For a custom API origin, run an HTTPS gateway that forwards to the shared API hostname and overrides `x-spacefast-tenant-id` with your live tenant ID. Preserve paths, query strings, and Authorization. `domainSetup.api` returns the upstream origin, proxy headers, ownership DNS records, and verification URL. The gateway must forward that URL without redirects; Spacefast checks public DNS ownership and a fresh nonce-bound response over HTTPS. Existing site hostnames remain pinned to their namespace; changing a hostname default does not rename published sites. Per-item state lands in `manifestStatus` (`{ key, state, detail, since }` plus the source version id) on `GET /v1/tenants/{tenantId}`. There are no imperative config routes: the fix for a failed item is a new publish. Secrets are never declared — webhook secrets and API keys are minted by their own routes.";
 }, {
     readonly slug: "partner/tokens";
     readonly title: "Partner tokens";
@@ -638,8 +674,8 @@ export declare const DOCS_CATALOG: readonly [{
     readonly tier: "reference";
     readonly summary: "Let your own auth system mint tokens Spacefast verifies directly.";
     readonly keywords: readonly ["partner", "token", "jwt", "issuer", "eddsa", "ed25519", "auth", "partner_token", "audience", "revocation"];
-    readonly url: `${string}/partners#tokens`;
-    readonly body: "Your customers never need a Spacefast credential: your auth system mints standard JWT access tokens and Spacefast verifies them. Declare the issuer in the system-space manifest with its pinned Ed25519 public keys — there is no issuer CRUD. The first publish returns `state: pending` with a challenge nonce in `manifestStatus`; sign it with the declared key and republish with the `proof` field, and the issuer activates. Proof of key possession lives in your repo next to the declaration. The token profile is strict: `typ` of `at+jwt`, `alg` of `EdDSA` only, the per-issuer minted `aud` (never a shared value), all of `iss`/`sub`/`client_id`/`jti`/`iat`/`exp` required, `exp - iat` at most 30 minutes, 300s clock skew; embedded or fetched keys are rejected. A verified token becomes a `partner_token` credential bound to one external principal, carrying a fixed least-privilege policy: publish, read, versions, and variables over that principal's subtree — never tenant or principal management. Revoke by removing the issuer or rotating its keys; worst-case acceptance of a revoked token is the shorter of a 30s cache TTL and the token's own expiry.";
+    readonly url: `${string}/v1/docs/pages/partner/tokens`;
+    readonly body: "Your auth system mints customer JWTs that Spacefast verifies. Declare one issuer and up to five Ed25519 public keys with unique `kid` values in your system-space manifest. The first publish returns a pending status item with `audience` and `challenge`. Sign that challenge with each declared private key, then republish the JWTs in `proofs`. Every newly added or replaced key needs proof of possession. Customer tokens use `typ: at+jwt`, `alg: EdDSA`, the returned `audience` as `aud`, and all of `iss`, `sub`, `client_id`, `jti`, `iat`, and `exp`. The lifetime is at most 30 minutes, with 300 seconds of clock skew. Embedded and fetched keys are rejected. Each token grants publishing, reads, versions, and variables only for its own external principal. Tokens remain usable until expiry; `jti` does not make them single-use. To rotate without interrupting customers, publish the old and new public keys together. Sign the returned challenge with every new key and republish `proofs`. Existing keys remain active while the new keys await proof. Once activation completes, switch your signer to the new key, then publish again without the old key. Removing a key takes effect immediately and requires no new proof. The audience stays unchanged during rotation. An empty `tokenIssuers` array or removal of the field revokes the issuer. Issuer revocation invalidates all its tokens; individual customer tokens cannot be revoked separately.";
 }, {
     readonly slug: "partner/principals";
     readonly title: "Principals and ownership";
@@ -647,7 +683,7 @@ export declare const DOCS_CATALOG: readonly [{
     readonly tier: "reference";
     readonly summary: "External principals are your customer directory; spaces have exactly one owner.";
     readonly keywords: readonly ["partner", "principals", "external", "tenant", "ownership", "iam", "policy", "scope", "variables"];
-    readonly url: `${string}/partners#principals`;
+    readonly url: `${string}/v1/docs/pages/partner/principals`;
     readonly body: "Your customers are external principals inside your tenant. `GET /v1/principals` lists them within the caller's granted scope (a tenant-rooted key sees the whole tenant) and `GET /v1/principals/external/{principalId}` reads one. There is no create route: a principal is upserted implicitly in the same transaction as its first owned resource, and its identity is the normalized id — the display casing you first sent is preserved but never authoritative. Every space has exactly one owner: a team, an external principal, or an open claim token. IAM actions stay generic nouns (`tenants:read`, `tenants:write`, `principals:read`) rather than a `partner:*` namespace, evaluated per route like every other action, so a partner credential's reach is a policy fact and not a router branch. Per-principal environment variables live under `/v1/principals/{principalType}/{principalId}/variables`.";
 }, {
     readonly slug: "partner/events";
@@ -656,6 +692,6 @@ export declare const DOCS_CATALOG: readonly [{
     readonly tier: "reference";
     readonly summary: "Tenant-owned webhooks, declared in the manifest — including customer email.";
     readonly keywords: readonly ["partner", "events", "webhook", "subscriptions", "notifications", "email", "signature", "hmac"];
-    readonly url: `${string}/partners#events`;
+    readonly url: `${string}/v1/docs/pages/partner/events`;
     readonly body: "Webhooks are the one event primitive, and their ownership generalizes from teams to tenants. Declare subscriptions in the system-space manifest (`url` plus an `events` selection) and reconciliation creates, updates, or disables the rows; delivery uses the same `Spacefast-Signature` HMAC and dual-secret rotation as team webhooks, so verify the signature before trusting a payload. Email white-labeling is not a separate endpoint: subscribe to `principal.notification.*` events (claim link issued, security notice, publish receipt) and send them yourself in your own voice. For a partner tenant these events replace Spacefast-sent email to your customers — no active subscription means no send, and Spacefast never falls back to sending as itself to someone else's customer.";
 }, ...DocEntry[]];

package/dist/docs/catalog.js

@@ -51,10 +51,20 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         slug: "spaces/rename",
         title: "Rename a space",
         kind: "guide",
-        tier: "full",
+        tier: "essential",
         summary: "Change a space slug and its managed view.fast address without breaking old links.",
-        keywords: ["space", "rename", "slug", "view.fast", "redirect", "managed hostname"],
-        url: `${DOCS_BASE_URL}/operate/spaces`,
+        keywords: [
+            "space",
+            "rename",
+            "slug",
+            "view.fast",
+            "redirect",
+            "managed hostname",
+            "rename a space",
+            "change space name",
+            "change space url",
+        ],
+        url: `${DOCS_BASE_URL}/cli/spaces`,
         body: 'Run `sf spaces update --space <space> --slug <new-slug> --wait`, or PATCH `/v1/spaces/{spaceId}` with `{ "slug": "<new-slug>" }`. The managed view.fast hostname changes with the slug. Former managed addresses and branch aliases redirect directly to their current counterparts with a temporary, path- and query-preserving 307 for the life of the space unless an operator explicitly releases them. Custom domains stay attached, and immutable version URLs do not change.',
     },
     {
@@ -228,11 +238,25 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         slug: "access-control",
         title: "Access control",
         kind: "guide",
-        tier: "full",
-        summary: "Create scoped Grants, invite People, and manage Links or credentials.",
-        keywords: ["access", "share", "people", "links", "private", "team", "public"],
+        tier: "essential",
+        summary: "Make a space public, share private access, and understand permissions and scopes.",
+        keywords: [
+            "access",
+            "share",
+            "people",
+            "links",
+            "private",
+            "team",
+            "public",
+            "make space public",
+            "share a space",
+            "open to everyone",
+            "permissions and scopes",
+            "grant access",
+            "who can access",
+        ],
         url: `${DOCS_BASE_URL}/access`,
-        body: "Use `sf share grant`, `sf share people`, `sf share link`, `sf share password`, or `sf share token`. Inspect one route with `sf share check`; every audience uses the same path, capability, target, and constraint evaluator.",
+        body: "New spaces are private. Make the live space public with `sf share grant --to public --role viewer --path '/**' --target live`. Use People or Links for private sharing. Permissions name allowed actions; scopes limit which resources a credential can reach.",
     },
     {
         slug: "redirects",
@@ -293,7 +317,33 @@ const HAND_WRITTEN_DOCS_CATALOG = [
             "sf dev",
         ],
         url: `${DOCS_BASE_URL}/zero-runtime`,
-        body: "Zero is for apps where the data is the point. Write one capsule — schema, queries, mutations, endpoints — start it locally with `sf dev`, and `sf publish` puts it live with its own database and dedicated runtime site on every plan.",
+        body: "Zero is for apps where the data is the point. Write one capsule — schema, queries, mutations, endpoints — start it locally with `sf dev`, and `sf publish` puts it live with its own database and runtime site on every plan.",
+    },
+    {
+        slug: "zero-connectors",
+        title: "Zero connectors",
+        kind: "guide",
+        tier: "full",
+        summary: "Declare connector roles, bind accounts to a Space, and connect visitor accounts.",
+        keywords: [
+            "zero",
+            "connectors",
+            "roles",
+            "team",
+            "owner",
+            "visitor",
+            "serving",
+            "bindings",
+            "ConnectorGate",
+            "Linear",
+            "Workers",
+            "env.CONNECTORS",
+            "env.ZERO",
+            "audit",
+            "runs",
+        ],
+        url: `${DOCS_BASE_URL}/zero-connectors`,
+        body: "Declare roles with connector({ as: 'team' | 'owner' | 'visitor', connector: 'linear' }). Team roles require a bound team connection with a serving grant; owner roles require the binder's personal connection and a private Space. Visitor roles use each signed-in visitor's own account. Call ctx.connectors.<role>.<tool>(args) and render connection or approval states with ConnectorGate. Workers use env.CONNECTORS and, when a capsule is attached, env.ZERO.query(name, ...args) and env.ZERO.mutate(name, ...args). Inspect calls on the connector runs page by origin and Space.",
     },
     {
         slug: "runtimes/functions",
@@ -457,6 +507,16 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         url: `${DOCS_BASE_URL}/cli`,
         body: "`sf init` detects your framework and writes a starter `sf.jsonc` so subsequent `sf publish` runs are zero-config.",
     },
+    {
+        slug: "feedback",
+        title: "sf feedback",
+        kind: "cli",
+        tier: "essential",
+        summary: "Send product, docs, or error feedback to Spacefast.",
+        keywords: ["feedback", "report", "bug", "docs", "error", "request id", "sf feedback"],
+        url: `${DOCS_BASE_URL}/cli`,
+        body: 'Run `sf feedback --message "Describe what happened"`. For an API error, add `--category bug`, `--error-code <code>`, and `--request-id <requestId>` from the error output.',
+    },
     {
         slug: "claim",
         title: "sf spaces claim",
@@ -467,15 +527,49 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         url: `${DOCS_BASE_URL}/cli`,
         body: "After an agent publishes anonymously, run `sf spaces claim` with the space key to bind the space to your account.",
     },
+    {
+        slug: "cli/spaces/check",
+        title: "sf spaces check",
+        kind: "cli",
+        tier: "essential",
+        summary: "Check whether a Space name and its managed hostname are available.",
+        keywords: [
+            "spaces",
+            "check",
+            "name availability",
+            "slug availability",
+            "hostname availability",
+            "view.fast",
+            "is this name free",
+            "taken",
+        ],
+        url: `${DOCS_BASE_URL}/cli/spaces`,
+        body: "Run `sf spaces check <name> [--team <team>]` to check a name. The command reports the team-scoped Space slug and the global `view.fast` hostname separately. The result is advisory. A create or rename operation can still lose a race. Do not check availability with an HTTP request to the hostname.",
+    },
     {
         slug: "cli/spaces",
         title: "sf spaces",
         kind: "cli",
-        tier: "full",
-        summary: "List, inspect, download, duplicate, transfer, and remove spaces.",
-        keywords: ["spaces", "space", "ls", "get", "download", "duplicate", "rm", "transfer"],
-        url: `${DOCS_BASE_URL}/cli`,
-        body: "The `sf spaces` group manages spaces: `ls`, `get`, `claim`, `download`, `duplicate`, `transfer`, and `rm`. Use `sf spaces download --version <ref>` to retrieve one immutable version.",
+        tier: "essential",
+        summary: "Check, list, inspect, download, duplicate, transfer, and delete spaces.",
+        keywords: [
+            "spaces",
+            "space",
+            "check",
+            "availability",
+            "ls",
+            "get",
+            "download",
+            "duplicate",
+            "rm",
+            "remove",
+            "delete",
+            "delete a space",
+            "remove a space",
+            "transfer",
+        ],
+        url: `${DOCS_BASE_URL}/cli/spaces`,
+        body: "Use `sf spaces rm --space <space>` to delete a space; add `--yes` to skip confirmation. The `sf spaces` group also includes `check`, `ls`, `get`, `claim`, `download`, `duplicate`, and `transfer`.",
     },
     {
         slug: "cli/versions",
@@ -561,11 +655,23 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         slug: "cli/api-keys",
         title: "sf api-keys",
         kind: "cli",
-        tier: "full",
-        summary: "Create and revoke API keys for the Spacefast API.",
-        keywords: ["api-keys", "api key", "token", "create", "revoke", "list", "credential"],
-        url: `${DOCS_BASE_URL}/cli`,
-        body: "`sf api-keys create` mints a bearer key (shown once, masked in `--json`); `sf api-keys list` and `sf api-keys revoke` manage existing keys.",
+        tier: "essential",
+        summary: "Create, list, and revoke API keys with explicit permissions and scopes.",
+        keywords: [
+            "api-keys",
+            "api key",
+            "api keys",
+            "create api key",
+            "revoke api key",
+            "list api keys",
+            "token",
+            "credential",
+            "permissions",
+            "scopes",
+            "permissions and scopes",
+        ],
+        url: `${DOCS_BASE_URL}/cli/api-keys`,
+        body: "Run `sf api-keys create` to mint a bearer key, `sf api-keys list` to inspect keys, and `sf api-keys revoke` to turn one off. Presets select a permission bundle; each key is scoped to its team. The secret is shown once and masked in `--json` output.",
     },
     {
         slug: "cli/analytics",
@@ -678,6 +784,27 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         url: `${DOCS_BASE_URL}/api`,
         body: "Create teams, list members, and manage invitations programmatically. Webhooks and API keys are team-scoped.",
     },
+    {
+        slug: "api/connectors",
+        title: "Connectors API",
+        kind: "api",
+        tier: "reference",
+        summary: "Connect tool sources, manage connections and policy, and run tools over HTTP.",
+        keywords: [
+            "api",
+            "connectors",
+            "connections",
+            "tools",
+            "policy",
+            "runs",
+            "mcp",
+            "openapi",
+            "graphql",
+            "endpoint",
+        ],
+        url: `${DOCS_BASE_URL}/api`,
+        body: "Register OpenAPI, GraphQL, or remote MCP sources as team connectors; connect accounts whose credentials stay server-side; set an ordered tool policy; and run a single tool or a code program, with approvals when a rule asks for them.",
+    },
     {
         slug: "api/docs",
         title: "Docs API (GET /v1/docs)",
@@ -727,7 +854,7 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         tier: "reference",
         summary: "The tenant-facing partner API for running Spacefast as infra.",
         keywords: ["api", "partner", "tenant", "infra", "openapi", "multi-tenant", "white label"],
-        url: `${DOCS_BASE_URL}/partners`,
+        url: PARTNER_API_REFERENCE_URL,
         body: `There is no partner route tree. Partners call the same \`/v1\` routes as everyone else: successes carry a \`{ data }\` envelope and failures are RFC 9457 problem documents (\`application/problem+json\` with a stable \`code\`), exactly as elsewhere in the API. A tenant-rooted credential's policy scope and response projection decide what it sees. "Partner" is a spec visibility tier: those operations, plus tenants and principals, are published as a second OpenAPI document at ${DEFAULT_API_URL}/openapi.partner.json, rendered at ${PARTNER_API_REFERENCE_URL}. Point \`openapi-typescript\` at that document for types. Configuration is not a set of endpoints: a tenant declares its integration in one designated space's published manifest (see \`partner/system-space\`).`,
     },
     {
@@ -735,10 +862,10 @@ const HAND_WRITTEN_DOCS_CATALOG = [
         title: "Partner onboarding",
         kind: "api",
         tier: "reference",
-        summary: "Bootstrap a tenant: one key, one space, one designation, one publish.",
+        summary: "Connect your backend using separate live and test environments.",
         keywords: ["partner", "onboarding", "tenant", "bootstrap", "partner_admin", "api key", "setup"],
-        url: `${DOCS_BASE_URL}/partners#onboarding`,
-        body: "Tenant creation is superadmin-side and mints one bootstrap tenant-rooted API key with the `partner_admin` preset (`tenants:*`, `principals:read`, and space/domain/publish actions over the tenant). From there it is four steps you drive yourself: create a space with that key, `PATCH /v1/tenants/{tenantId}` with `systemSpaceId` to designate it, publish the manifest, then read `manifestStatus` on `GET /v1/tenants/{tenantId}` to watch each declared item converge. Mint further keys through the normal API-key routes — every one is bounded to a subset of its grantor's policy.",
+        url: `${DEFAULT_API_URL}/v1/docs/pages/partner/onboarding`,
+        body: "Enable partner access for your Spacefast team, then open Partners in the dashboard. Your team manages a linked live and test tenant. Each environment has its own customers, configuration, and credentials. Team owners and admins create tenant server keys in the dashboard or through `POST /v1/tenants/{tenantId}/api-keys`. The default key manages that environment, including bounded key creation and revocation. For your first integration, call the shared API from your backend and keep the key on your server. Create a space with the selected environment's key, designate it with `PATCH /v1/tenants/{tenantId}` using `systemSpaceId`, then publish your system manifest. Read `manifestStatus` on `GET /v1/tenants/{tenantId}` to check activation. To replace a key, create a new key, deploy it to your backend, then revoke the old key with `DELETE /v1/tenants/{tenantId}/api-keys/{apiKeyId}`. Test hosting uses simulated infrastructure; use the live environment to publish publicly reachable sites. Billing stays in your system. Spacefast plans grant features and enforce quotas.",
     },
     {
         slug: "partner/system-space",
@@ -757,8 +884,8 @@ const HAND_WRITTEN_DOCS_CATALOG = [
             "reconciliation",
             "white label",
         ],
-        url: `${DOCS_BASE_URL}/partners#system-space`,
-        body: "A tenant designates one ordinary space as its system space, and that space's live version *is* the integration definition: a top-level `system` section in `sf.jsonc` (presentation, hostname apex, API origin, token issuers, event subscriptions) plus `_pages/` and `theme.json` as the defaults layer. One config language, one validation pipeline, one publish flow — and `sf rollback` rolls back your configuration with it. Finalize, promote, and rollback all reconcile declared state against current state. Presentation, pages, theme, and subscriptions apply immediately; hostnames, API origins, and token issuers enter `pending` until their DNS, TLS, or key-possession check passes. Dropping an item from the manifest deactivates it. Per-item state lands in `manifestStatus` (`{ key, state, detail, since }` plus the source version id) on `GET /v1/tenants/{tenantId}`. There are no imperative config routes: the fix for a failed item is a new publish. Secrets are never declared — webhook secrets and API keys are minted by their own routes.",
+        url: `${DEFAULT_API_URL}/v1/docs/pages/partner/system-space`,
+        body: "A tenant designates one ordinary space as its system space, and that space's live version *is* the integration definition: a top-level `system` section in `sf.jsonc` (presentation, hostname apex, API origin, token issuers, event subscriptions) plus `_pages/` and `theme.json` as the defaults layer. One config language, one validation pipeline, one publish flow — and `sf rollback` rolls back your configuration with it. Finalize, promote, and rollback all reconcile declared state against current state. Presentation, pages, theme, and subscriptions apply immediately; hostnames, API origins, and token issuers enter `pending` until their DNS, TLS, or key-possession check passes. Removing an issuer, API origin, subscription, or plan declaration reconciles that desired state. For a custom API origin, run an HTTPS gateway that forwards to the shared API hostname and overrides `x-spacefast-tenant-id` with your live tenant ID. Preserve paths, query strings, and Authorization. `domainSetup.api` returns the upstream origin, proxy headers, ownership DNS records, and verification URL. The gateway must forward that URL without redirects; Spacefast checks public DNS ownership and a fresh nonce-bound response over HTTPS. Existing site hostnames remain pinned to their namespace; changing a hostname default does not rename published sites. Per-item state lands in `manifestStatus` (`{ key, state, detail, since }` plus the source version id) on `GET /v1/tenants/{tenantId}`. There are no imperative config routes: the fix for a failed item is a new publish. Secrets are never declared — webhook secrets and API keys are minted by their own routes.",
     },
     {
         slug: "partner/tokens",
@@ -778,8 +905,8 @@ const HAND_WRITTEN_DOCS_CATALOG = [
             "audience",
             "revocation",
         ],
-        url: `${DOCS_BASE_URL}/partners#tokens`,
-        body: "Your customers never need a Spacefast credential: your auth system mints standard JWT access tokens and Spacefast verifies them. Declare the issuer in the system-space manifest with its pinned Ed25519 public keys — there is no issuer CRUD. The first publish returns `state: pending` with a challenge nonce in `manifestStatus`; sign it with the declared key and republish with the `proof` field, and the issuer activates. Proof of key possession lives in your repo next to the declaration. The token profile is strict: `typ` of `at+jwt`, `alg` of `EdDSA` only, the per-issuer minted `aud` (never a shared value), all of `iss`/`sub`/`client_id`/`jti`/`iat`/`exp` required, `exp - iat` at most 30 minutes, 300s clock skew; embedded or fetched keys are rejected. A verified token becomes a `partner_token` credential bound to one external principal, carrying a fixed least-privilege policy: publish, read, versions, and variables over that principal's subtree — never tenant or principal management. Revoke by removing the issuer or rotating its keys; worst-case acceptance of a revoked token is the shorter of a 30s cache TTL and the token's own expiry.",
+        url: `${DEFAULT_API_URL}/v1/docs/pages/partner/tokens`,
+        body: "Your auth system mints customer JWTs that Spacefast verifies. Declare one issuer and up to five Ed25519 public keys with unique `kid` values in your system-space manifest. The first publish returns a pending status item with `audience` and `challenge`. Sign that challenge with each declared private key, then republish the JWTs in `proofs`. Every newly added or replaced key needs proof of possession. Customer tokens use `typ: at+jwt`, `alg: EdDSA`, the returned `audience` as `aud`, and all of `iss`, `sub`, `client_id`, `jti`, `iat`, and `exp`. The lifetime is at most 30 minutes, with 300 seconds of clock skew. Embedded and fetched keys are rejected. Each token grants publishing, reads, versions, and variables only for its own external principal. Tokens remain usable until expiry; `jti` does not make them single-use. To rotate without interrupting customers, publish the old and new public keys together. Sign the returned challenge with every new key and republish `proofs`. Existing keys remain active while the new keys await proof. Once activation completes, switch your signer to the new key, then publish again without the old key. Removing a key takes effect immediately and requires no new proof. The audience stays unchanged during rotation. An empty `tokenIssuers` array or removal of the field revokes the issuer. Issuer revocation invalidates all its tokens; individual customer tokens cannot be revoked separately.",
     },
     {
         slug: "partner/principals",
@@ -798,7 +925,7 @@ const HAND_WRITTEN_DOCS_CATALOG = [
             "scope",
             "variables",
         ],
-        url: `${DOCS_BASE_URL}/partners#principals`,
+        url: `${DEFAULT_API_URL}/v1/docs/pages/partner/principals`,
         body: "Your customers are external principals inside your tenant. `GET /v1/principals` lists them within the caller's granted scope (a tenant-rooted key sees the whole tenant) and `GET /v1/principals/external/{principalId}` reads one. There is no create route: a principal is upserted implicitly in the same transaction as its first owned resource, and its identity is the normalized id — the display casing you first sent is preserved but never authoritative. Every space has exactly one owner: a team, an external principal, or an open claim token. IAM actions stay generic nouns (`tenants:read`, `tenants:write`, `principals:read`) rather than a `partner:*` namespace, evaluated per route like every other action, so a partner credential's reach is a policy fact and not a router branch. Per-principal environment variables live under `/v1/principals/{principalType}/{principalId}/variables`.",
     },
     {
@@ -817,7 +944,7 @@ const HAND_WRITTEN_DOCS_CATALOG = [
             "signature",
             "hmac",
         ],
-        url: `${DOCS_BASE_URL}/partners#events`,
+        url: `${DEFAULT_API_URL}/v1/docs/pages/partner/events`,
         body: "Webhooks are the one event primitive, and their ownership generalizes from teams to tenants. Declare subscriptions in the system-space manifest (`url` plus an `events` selection) and reconciliation creates, updates, or disables the rows; delivery uses the same `Spacefast-Signature` HMAC and dual-secret rotation as team webhooks, so verify the signature before trusting a payload. Email white-labeling is not a separate endpoint: subscribe to `principal.notification.*` events (claim link issued, security notice, publish receipt) and send them yourself in your own voice. For a partner tenant these events replace Spacefast-sent email to your customers — no active subscription means no send, and Spacefast never falls back to sending as itself to someone else's customer.",
     },
 ];