[batuhan]

Adds the public guide for Connectors at /docs/connectors, marked Private Beta. The connectors feature flag's docs entry points to this page.

What's on the page

• What Connectors do: live data from your team's tools on any Space page, with no backend and no keys in the page.
• Declaring roles in spacefast.config.ts and sf.jsonc: keys, defaults, and limits.
• Binding accounts, and the three roles (team, personal, visitor): who reads and who writes through each, sign-in for writes, public Spaces and public serving, and share links.
• Calling a role from a page with @spacefast/client (core, React useConnector, and the no-build /__spacefast/client.js), plus plain fetch.
• sf client, and how sf dev and sf publish regenerate spacefast.generated.ts.
• The response states a page renders, and the error codes it can get.
• Visitor connect and disconnect routes.
• Pinned arguments, and shared reads: the cache window, the budget of 60 reads per role per minute, and stale serving.
• Site-serving requests and admin approval, and dashboard overrides (config.connectors on updateSpace).
• env.CONNECTORS in Functions, createConnectorRun for callers off the Space, and First.

It also links the page from the API overview's connectors paragraph, from Functions' env section, and from a new connectors row in the sf.jsonc reference.

Notes for review

• Every CLI command shown exists in the released CLI (spacefast@0.9.0): client, connectors bind/bindings, connectors serving create/list/approve/deny, connectors public-serving set, connectors connections connect/update, connectors create, and connectors run. The committed CLI reference snapshot is older (0.8.1) and doesn't list some of them yet. It updates on the next generated-reference export.
• The serving-request and public-serving API operations aren't in the committed OpenAPI snapshot yet, so they're named in code formatting, not linked. The same goes for error codes that don't have a generated page yet.
• Stage label: Blume's sidebar.badge in the frontmatter, plus a <Badge> at the top of the page. Both read exactly "Private Beta".

Checks run locally

build, check, validate, audit, verify:generated, verify:commands, verify:routes, verify:prose (clean), verify:public-safety, test:docs (37/37), and test:llms (11/11) all pass. The build used SPACEFAST_PRICING_FIXTURE.

Summary by CodeRabbit

• Documentation
  • Added a Connectors guide covering setup, role configuration, account binding, access rules, client usage, response states, and errors.
  • Documented role-specific restrictions, published-version behavior, shared-read caching limits, and serving rules.
  • Expanded the configuration reference to describe connector roles and their limits.
  • Clarified how functions can call connector roles and when roles are needed to display connection data on Space pages.
  • Added Connectors to the Dynamic documentation navigation.

[indent]

Issues

All clear! No issues remaining. 🎉

3 issues already resolved

• The reconnect_required row says to link connectUrl only on a visitor role, but the control plane still sets connectUrl for every reconnect_required answer, and following it on a team/personal role fails with connector_role_unavailable. The page's samples (lines 115 and 140) link connectUrl whenever present, so copied code shows a dead link. (fixed by commit 6f8fd0c)
  _{Found by Indent Review Agent}
• The error table says connector_tool_blocked covers a policy-blocked write and connection_forbidden a blocked read. That only holds for team/personal roles: a blocked write through a visitor role, or a write whose approval was denied, answers connection_forbidden. (fixed by commit 6f8fd0c)
  _{Found by Indent Review Agent}
• Only reads with neither Origin nor Sec-Fetch-Site pass the origin check. A POST with neither header answers browser_origin_not_allowed, so script authors reading the new sentence will expect a header-less write to work. (fixed by commit 7142b85)
  _{Found by Indent Review Agent}

CI Checks

All required CI checks passed on 8c289e0.

Review agents

Select any unchecked box below to run or rerun that agent.

Passed (1)

• Indent Review Agent · No issues found

Full results

Indent Review Agent

• Summary: No issues found
• Last ran on commit: 8c289e05
• Latest result

  {
    "summary": "No issues found",
    "findings": []
  }

[coderabbitai]

Warning

Review limit reached

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Next included review available in 14 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 103 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 042fa6bb-bc69-40f9-9df8-3fabbe3623db

Commits

Reviewing files that changed from the base of the PR and between dda65d0 and 8c289e0.

Files selected for processing: 5

• content/(dynamic)/connectors.mdx
• content/(dynamic)/functions.mdx
• content/(dynamic)/meta.ts
• content/(reference)/config-file.mdx
• content/api/index.mdx

No actionable comments were generated in the recent review.

Walkthrough

The changes add a Connectors guide covering role setup, access rules, client and Functions usage, serving, and API-key runs. They also add connector guidance to existing documentation and include Connectors in the Dynamic page list.

Changes: Connector documentation

Layer / File(s)	Summary
Role configuration and access content/(dynamic)/connectors.mdx, content/(reference)/config-file.mdx, content/(dynamic)/meta.ts	The new page describes role configuration and account access modes. The configuration reference documents the connectors key and its role limit. The Dynamic page list includes Connectors.
Client calls and results content/(dynamic)/connectors.mdx, content/(dynamic)/functions.mdx, content/api/index.mdx	The new page covers client calls, generated types, response states, pinned arguments, and shared reads. The Functions and API pages add related connector guidance.
Serving and additional integrations content/(dynamic)/connectors.mdx	The new page documents team-account serving grants, dashboard overrides, Functions worker calls, external API and CLI runs, and First framework support.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: Minimal · previous review dda65

This adds a Private Beta Connectors guide and links to it from existing docs. It changes no runtime behavior, and no actionable merge-blocking risk was found.

Security architecture risk: Minimal · up to dda65

The change adds documentation and links without changing runtime behavior. The guide explicitly describes access restrictions, approval requirements, and safeguards for account changes. No introduced or worsened security or ownership risk was established.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The documented maximum audience includes anonymous readers of a public Space using an approved team connection. Writes through team or personal roles require a signed-in team member or Space user. Personal roles are restricted to private Spaces without share links or passwords, and visitor roles use each viewer's own account.

Trust Boundaries and Controls

• observed — The guide states that connector routes remain behind Space access checks, reject cross-site browser requests, require same-origin proof for writes, and return private, no-store responses. These are documented controls, not independently verified runtime guarantees.

Resilience and Maintainability Implications

• observed — The documented transitions preserve account-scoped approval: public-serving permission covers the bound account and is removed on rebinding. Repeated serving requests return the same pending request, and owner/admin approval enables serving. No documented transition was found that instructs bypassing these controls.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "Document Connectors" matches the main change: the PR adds a public Connectors guide at /docs/connectors and links it from the API overview, Functions env section, sf.jsonc reference, and th…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "Document Connectors" matches the main change: the PR adds a public Connectors guide at /docs/connectors and links it from the API overview, Functions env section, sf.jsonc reference, and the docs navigation. It is short and specific, and it names the primary change from the developer's perspective. It does not cover every detail, which the title rules allow.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e8a02c74-49b2-45a4-9899-438d34af0fd0

Commits

Reviewing files that changed from the base of the PR and between 2afc4f5 and dda65d0.

Files selected for processing: 1

• content/(dynamic)/connectors.mdx

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.