@@ -17,8 +17,8 @@ Only owners and admins can add or remove domains. An OAuth token needs the `team
 Over HTTP, send [`createTeamAutoEnrollEntry`](/api/reference/teams/createteamautoenrollentry):
 
 ```bash
-curl https://api.spacefast.com/v1/teams/<team-id>/auto-enroll \
-  -H "Authorization: Bearer sfa_xxxxxxxx" \
+curl "https://api.spacefast.com/v1/teams/$TEAM_ID/auto-enroll" \
+  -H "Authorization: Bearer $SPACEFAST_API_KEY" \
   -H "Content-Type: application/json" \
   -d '{"value":"example.com"}'
 ```
 
@@ -43,8 +43,8 @@ The connection appears as a row with an **OIDC** or **Signer** badge and its iss
 Send [`createTeamIdentityConnection`](/api/reference/teams/createteamidentityconnection):
 
 ```bash
-curl https://api.spacefast.com/v1/teams/<team-id>/identity-connections \
-  -H "Authorization: Bearer sfa_xxxxxxxx" \
+curl "https://api.spacefast.com/v1/teams/$TEAM_ID/identity-connections" \
+  -H "Authorization: Bearer $SPACEFAST_API_KEY" \
   -H "Content-Type: application/json" \
   -d '{"type":"oidc","name":"Acme SSO","issuer":"https://login.example.com","clientId":"<client-id>","clientSecret":"<client-secret>"}'
 ```
@@ -114,7 +114,7 @@ A `signer` connection sends visitors to your portal, and your portal vouches for
 1. The visitor presses **Continue with** on the access page. Spacefast redirects the browser to your `authorizeUrl` with the query parameters below.
 2. Your portal signs the visitor in and signs a proof token.
 3. Your server sends the proof to Spacefast and receives a short-lived token.
-4. Your portal sends the browser to `https://<host>/__sf/redeem?sf_token=<token>&return=<return>`. The Space sets a session cookie and opens the page.
+4. Your portal sends the browser to `/__sf/redeem` on `host`, with the `sf_token` and `return` query parameters. The Space sets a session cookie and opens the page.
 
 | Query parameter | What it holds |
 | --- | --- |
@@ -143,14 +143,20 @@ Send the proof from your server, not from the browser:
 
 ```bash
 curl https://api.spacefast.com/identity/acn_xxxxxxxx/exchange \
-  -H "Authorization: Bearer <proof-jwt>" \
+  -H "Authorization: Bearer $PROOF_JWT" \
   -H "Content-Type: application/json" \
   -d '{"spaceId":"<spaceId>","host":"<host>","resource":"<return>","browserState":"<browserState>"}'
 ```
 
 A `200` answers with `token` and `expiresAt`. A `403` means the proof failed or no grant admits that subject to `resource`.
 
-Redirect the browser to `/__sf/redeem` on the same `host` within 60 seconds. The token works once, and only in the browser that started the sign-in.
+Redirect the browser to `/__sf/redeem` on the same `host` within 60 seconds. The token works once, and only in the browser that started the sign-in. Encode each value as one query parameter. A `return` such as `/docs?tab=a&sort=b` holds `&` and `=`, so do not join the strings by hand:
+
+```js
+const redeem = new URL(`https://${host}/__sf/redeem`);
+redeem.searchParams.set("sf_token", token);
+redeem.searchParams.set("return", returnPath);
+```
 
 ## Update a connection
 
@@ -163,7 +169,7 @@ In **SSO providers**, press **Update** on the connection's row.
 
 Leave **Replacement client secret** blank to keep the current secret. To rename a connection or change a signer's sign-in URL, use the API or the CLI.
 
-[`updateTeamIdentityConnection`](/api/reference/teams/updateteamidentityconnection) accepts `name`, `clientId`, `clientSecret`, `authorizeUrl`, `publicKeys`, and `sessionTtlSeconds`. It accepts `sessionTtlSeconds` from 60 to 86,400. For a signer, Spacefast lowers any value above 1,800 to 1,800. `publicKeys` replaces the whole key set. The `type` and `issuer` cannot change. To change them, create a new connection.
+[`updateTeamIdentityConnection`](/api/reference/teams/updateteamidentityconnection) accepts `name`, `clientId`, `clientSecret`, `authorizeUrl`, `publicKeys`, and `sessionTtlSeconds`. It accepts `sessionTtlSeconds` from 60 to 86,400. For a signer, Spacefast lowers any value above 1,800 to 1,800. `publicKeys` replaces the whole key set. The `type` and `issuer` cannot change.
 
 Grants that use the connection keep working. A change to the client ID, client secret, keys, or session lifetime sets `rotatedAt`.
 
@@ -173,13 +179,20 @@ To rotate a signer key without a sign-in gap:
 2. Sign new proofs with the new key.
 3. Send a key set that holds only the new key.
 
+### Replace a connection
+
+A team can have one active connection per issuer. Revoking a connection also revokes its grants. Plan the order:
+
+- **To move to a new issuer**, create the new connection and its grants first. Then revoke the old connection.
+- **To change the type for the same issuer**, revoke the old connection first, because the new one uses the same issuer. Then create the new connection and add its grants again. Visitors cannot sign in through that issuer until the new grants exist.
+
 ## Revoke a connection
 
 Press **Revoke** on the row, then **Revoke connection** in the dialog. Over HTTP, send [`revokeTeamIdentityConnection`](/api/reference/teams/revoketeamidentityconnection). It answers `204`. From a terminal, run `sf share identity revoke`.
 
 Revoking removes the grants too. Spacefast revokes every grant on the team's Spaces that trusts the connection's issuer, then the connection itself.
 
-A revoked connection stays in [`listTeamIdentityConnections`](/api/reference/teams/listteamidentityconnections) with `revokedAt` set. It cannot be updated. To restore access, create a new connection and new grants.
+A revoked connection stays in [`listTeamIdentityConnections`](/api/reference/teams/listteamidentityconnections) with `revokedAt` set. It cannot be updated. To restore access, create a new connection and add its grants again.
 
 ## Errors
 
 
@@ -12,7 +12,7 @@ Subteams need an Enterprise parent team. On every other plan, subteam operations
 ## How subteams work
 
 - **The parent's owners and admins are in every subteam.** They hold the same role there. To change that role, change it on the parent team.
-- **Parent members can join a subteam.** Every subteam appears in **Teams you can join** for parent members. Pressing **Join** makes them a subteam `member`, with no new seat.
+- **Parent members can join a subteam.** A subteam appears in **Teams you can join** for parent members. Pressing **Join** makes them a subteam `member`, with no new seat. A person removed from a subteam does not see it there. An owner or admin of the parent team must add them again.
 - **Seats are shared.** Seats count across the parent and all its subteams. A person in several teams of the family uses one seat.
 - **Subteams do not nest.** A subteam cannot have subteams of its own.
 - **Leaving the parent leaves every subteam.** When someone leaves or is removed from the parent team, they also lose every subteam membership.
@@ -32,8 +32,8 @@ Spacefast creates the subteam and opens it. Its URL slug starts with the parent'
 Over HTTP, send [`createSubTeam`](/api/reference/teams/createsubteam) with a `name` of 1 to 255 characters:
 
 ```bash
-curl https://api.spacefast.com/v1/teams/<team-id>/subteams \
-  -H "Authorization: Bearer sfa_xxxxxxxx" \
+curl "https://api.spacefast.com/v1/teams/$TEAM_ID/subteams" \
+  -H "Authorization: Bearer $SPACEFAST_API_KEY" \
   -H "Content-Type: application/json" \
   -d '{"name":"Design"}'
 ```
@@ -51,7 +51,7 @@ The **Subteams** page shows the subteams you are in, each with **Open**. Below t
 Send [`updateSubTeam`](/api/reference/teams/updatesubteam) with a new `name`. The slug does not change. From a terminal:
 
 ```bash
-sf teams subteams rename <subteam-id> "Brand design"
+sf teams subteams rename "$SUBTEAM_ID" "Brand design"
 ```
 
 You can also open the subteam and rename it in **Team settings → General**.
@@ -61,9 +61,9 @@ You can also open the subteam and rename it in **Team settings → General**.
 Adding and removing members needs an owner or admin of the parent team.
 
 ```bash
-sf teams subteams members ls <subteam-id>
-sf teams subteams members add <subteam-id> <user-id>
-sf teams subteams members rm <subteam-id> <user-id>
+sf teams subteams members ls "$SUBTEAM_ID"
+sf teams subteams members add "$SUBTEAM_ID" "$USER_ID"
+sf teams subteams members rm "$SUBTEAM_ID" "$USER_ID"
 ```
 
 | Operation | What it does |
 
@@ -148,7 +148,7 @@ Two more bindings appear on `env` when the version needs them. Run `sf functions
 | `env.CONNECTORS` | The version's capsule declares connector roles, or the Space has a connector binding | A connector role |
 | `env.ZERO` | The version includes a [Zero](/zero-runtime) capsule | The capsule's queries and mutations |
 
-A Zero project ships a Worker when it also has a `functions/` directory or a root `handler.ts`. `sf publish` compiles the capsule and the Worker into one version.
+A Zero project ships a Worker when it also has a `functions/` directory or a root `handler.ts`, `handler.js`, or `handler.mjs`. `sf publish` compiles the capsule and the Worker into one version.
 
 ### `env.CONNECTORS`
 
@@ -159,16 +159,20 @@ A Zero project ships a Worker when it also has a `functions/` directory or a roo
 ```js handler.js
 export default {
   async fetch(request, env) {
-    const notes = await env.ZERO.query("notes");
-    await env.ZERO.mutate("addNote", "Written by the Worker");
-    return Response.json(notes);
+    if (request.method !== "POST") return Response.json(await env.ZERO.query("notes"));
+    const secret = env.NOTES_SECRET;
+    if (!secret || request.headers.get("authorization") !== `Bearer ${secret}`) {
+      return new Response("Unauthorized", { status: 401 });
+    }
+    const { body } = await request.json();
+    return Response.json(await env.ZERO.mutate("addNote", body), { status: 201 });
   },
 };
 ```
 
 `env.ZERO.query(name, ...args)` resolves to the query's data. `env.ZERO.mutate(name, ...args)` resolves to the mutation's return value. There is no call for actions. A failed call throws an `Error` with a `code`. The code is `zero_upstream_unavailable` when the capsule cannot be reached.
 
-Both bindings forward the request's cookie. The runtime verifies the signed Zero identity cookie before it acts for that visitor. When no visitor is signed in, `env.ZERO` runs as the Space's service principal. In the capsule handler, `ctx.auth.userId` is then `service:<spaceId>` and `ctx.auth.provider` is `service`. `ctx.auth.isAuthenticated` is `true`, so a sign-in check alone does not keep the Worker out.
+Both bindings forward the request's cookie. The runtime verifies the signed Zero identity cookie before it acts for that visitor. When no visitor is signed in, `env.ZERO` runs as the Space's service principal. In the capsule handler, `ctx.auth.userId` is then `service:<spaceId>` and `ctx.auth.provider` is `service`. `ctx.auth.isAuthenticated` is `true`, so a sign-in check alone does not keep the Worker out. Check the caller in the Worker before it calls a mutation. The example requires a secret that you set with `sf env set NOTES_SECRET --value-from-stdin`.
 
 ## Limits
 
 
@@ -35,13 +35,14 @@ export default capsule({
 
 | Key | Required | What it does |
 | --- | --- | --- |
-| `as` | yes | Whose account the role uses: `team` or `owner` |
-| `connector` | no | The connector slug for the role. The dashboard offers only connections for this connector |
+| `as` | yes | Whose account the role uses: `team`, `owner`, or `visitor` |
+| `connector` | no | The connector slug for the role. The dashboard offers only connections for this connector. A `visitor` role needs it |
 
 | `as` | Account | Condition |
 | --- | --- | --- |
 | `team` | A team connection | The connection allows sites to use it |
 | `owner` | Your own personal connection | The Space is private |
+| `visitor` | Each signed-in visitor's own account | The visitor connects it on the Space. See [Let visitors connect their own account](#let-visitors-connect-their-own-account) |
 
 A role name starts with a lowercase letter and holds only letters and digits, up to 64 characters. The compiler reads the `connectors` map from source without running it, so write it as a literal. A map that is not a literal object of roles fails the publish with "capsule() connectors must be a role map."
 
@@ -55,6 +56,7 @@ The connection must fit the role:
 
 - A `team` role needs a team connection that allows sites to use it. Turn that on with **Allow sites to use this account** in the dashboard, `sf connectors connections edit <connection> --serving`, or [`updateConnection`](/api/reference/connectors/updateconnection) with `serving: true`.
 - An `owner` role needs a personal connection that you created, on a private Space. If the Space stops being private, Spacefast removes its owner bindings.
+- A `visitor` role cannot be bound. Binding one fails with `visitor_role_not_bindable`.
 
 The request must act for a user who can manage the Space. A credential that acts for no user gets `forbidden`.
 
@@ -88,6 +90,25 @@ sf connectors unbind tracker --space my-app --yes
 
 All three need the `connectors:write` scope.
 
+## Let visitors connect their own account
+
+A `visitor` role calls the service as the signed-in visitor, with that visitor's own account. Nobody on the team binds it, and the dashboard row has no **Bind account** button.
+
+```ts server/index.ts
+connectors: {
+  myTracker: connector({ as: "visitor", connector: "linear-app" }),
+},
+```
+
+1. A call returns `connect_required` until the visitor connects an account.
+2. `ConnectorGate` shows a **Connect** button for that state. The button opens the service's sign-in in a popup.
+3. A visitor who is not signed in to the Space signs in first.
+4. After the service sign-in, the popup closes and the gate runs the call again.
+
+The connector must support OAuth sign-in. Each connection belongs to one visitor, one Space, and one role. For `reconnect_required`, the gate shows **Reconnect** instead.
+
+To disconnect, call `disconnect()` on the result of `useConnectorState(result, role)`. To see who connected, call [`listVisitorConnectionUsers`](/api/reference/spaces/listvisitorconnectionusers). It returns counts and roles per Space user, not the accounts. To disconnect one user, call [`revokeVisitorConnection`](/api/reference/spaces/revokevisitorconnection).
+
 ## Call a role from Zero
 
 `ctx.connectors.<role>` is on every query, mutation, action, and endpoint context. The property path after the role is the tool name, joined with dots. `ctx.connectors.tracker.issues.create(args)` calls the `issues.create` tool on the bound connection.
@@ -135,19 +156,27 @@ To read the state of one result yourself, call `useConnectorState(result)` from
 
 ## Call a role from a Worker
 
-A [Worker](/functions) gets `env.CONNECTORS` when the version's capsule declares roles or the Space has a binding. To ship a Worker beside a capsule, add a `functions/` directory or a root `handler.ts` to the Zero project. `sf publish` compiles both into one version.
+A [Worker](/functions) gets `env.CONNECTORS` when the version's capsule declares roles or the Space has a binding. To ship a Worker beside a capsule, add a `functions/` directory or a root `handler.ts`, `handler.js`, or `handler.mjs` to the Zero project. `sf publish` compiles both into one version.
 
 The role proxy works as it does in Zero. It resolves to the tool's result and throws a `ConnectorCallError` for any other state.
 
 ```js handler.js
 export default {
   async fetch(request, env) {
-    const issue = await env.CONNECTORS.tracker.issues.create({ title: "Checkout is down" });
-    return Response.json(issue);
+    if (request.method !== "POST") return new Response("Method not allowed", { status: 405 });
+    const secret = env.REPORT_SECRET;
+    if (!secret || request.headers.get("authorization") !== `Bearer ${secret}`) {
+      return new Response("Unauthorized", { status: 401 });
+    }
+    const { title } = await request.json();
+    const issue = await env.CONNECTORS.tracker.issues.create({ title });
+    return Response.json(issue, { status: 201 });
   },
 };
 ```
 
+A `team` role acts with the team's account for every request that reaches the Worker. Call a tool that writes only on a write method, and only after you check the caller. This example requires a secret that you set with `sf env set REPORT_SECRET --value-from-stdin`.
+
 To handle every state without a throw, call `env.CONNECTORS.call(role, tool, args)`. It resolves to `{ state, run }`. Check `state.code` before you read `run`.
 
 ```js handler.js
@@ -173,8 +202,8 @@ Every call ends in one state. `state.message` carries the text below.
 | `ok` | Connected. | The tool ran |
 | `unbound` | The site owner needs to connect this service. | No usable connection is bound to the role, or the Space has no team. An owner binding stops working when its owner leaves the team |
 | `forbidden` | You do not have permission to use this connection. | The bound connection does not fit the role, policy blocks the tool, or a Zero read handler called a tool that writes |
-| `connect_required` | Connect your account to continue. | The bound connection is still waiting for authorization |
-| `reconnect_required` | Reconnect your account to continue. | The bound connection was revoked or needs a new sign-in |
+| `connect_required` | Connect your account to continue. | The bound connection is still waiting for authorization, or the visitor has not connected an account for a `visitor` role |
+| `reconnect_required` | Reconnect your account to continue. | The connection was revoked or needs a new sign-in |
 | `approval_pending` | This action is waiting for approval. | Policy parked the call. `pendingReason` is `approval`, and `approvalUrl` links to the decision |
 | `approval_pending` | Still working on it. Try again in a moment. | The run did not finish within 25 seconds. `pendingReason` is `running` |
 | `unavailable` | This service is unavailable. Try again. | The tool failed for another reason |
@@ -203,6 +232,7 @@ Each call has an idempotency key built from the version, the request id, the han
 | --- | --- |
 | `space_must_be_claimed` | The Space does not belong to a team |
 | `connector_role_unknown` | The live version does not declare the role |
+| `visitor_role_not_bindable` | The role is a `visitor` role. Each visitor connects their own account |
 | `connection_serving_not_granted` | A `team` role got a personal connection, or a team connection that does not allow sites to use it |
 | `owner_binding_requires_private_space` | An `owner` role got a connection that is not your personal one, or the Space is not private |
 | `forbidden` | The credential does not act for a user |
 
@@ -110,9 +110,9 @@ To return at once and check later, pass `--no-wait`. The receipt has the build I
 
 ## Finish the move
 
-1. To keep an anonymous copy, open the **Claim** link and pick a team. See [Publish without an account](/anonymous-and-claim).
+1. To keep an anonymous copy, open the **Claim** link and pick a team. An unclaimed copy stops serving after 33 hours and 20 minutes. See [The clock](/anonymous-and-claim#the-clock).
 2. To serve the copy on your own domain, attach the domain to the new Space. See [Custom domains](/domains).
-3. To edit the copy after you claim it, download it with `sf spaces download`. Change the files, then publish them with `sf publish`.
+3. To edit the copy after you claim it, download it with `sf spaces download --space` and the ID from the `Space` line. Change the files, then publish them with `sf publish --space` and the same ID.
 
 ## Errors
 
 
@@ -33,6 +33,7 @@ The CLI prints the reference:
 ```text
 Feedback ref: fdb_0123456789abcdef
 Thanks! We read every one.
+Signed in with `sf login`? Read it back with `sf feedback get fdb_0123456789abcdef`.
 ```
 
 With `--json`, `data` is `{ "ref": "fdb_…", "status": "stored" }`.