Describe team-private Spaces and on-demand share links

content/(concepts)/spaces.mdx

@@ -68,13 +68,14 @@ To move a Space to another team, run `sf spaces transfer <team> --space docs`, o
 
 ## Access when you create one
 
-A new Space starts at one of three presets.
+A new team-owned Space starts at one of two presets. A Space published without an account has no owning team. Its space key and claim link open it until the claim window ends; see [Publish without an account](/anonymous-and-claim).
 
 | Preset | Who can open the live site |
 | --- | --- |
-| `private` | Only people you name |
-| `team` | Everyone in the owning team |
-| `public` | Anyone with the URL |
+| `private` | The owning team, plus anyone you add |
+| `public` | The owning team, plus anyone on the web |
+
+The API still accepts `team` and treats it as `private`.
 
 Set it on the request that creates the Space, with `sf publish --access public` or the `access` field on `createPublish` and [`createSpace`](/api/reference/spaces/createspace). Sending `access` together with a `spaceId` is a validation error, because the field only applies at creation. Omit it and the Space takes the owning team's default for new Spaces.
 

content/(concepts)/teams.mdx

@@ -12,7 +12,7 @@ A team owns its Spaces, domains, API keys, and billing. Your role in that team c
 Free and Go allow only the owner. Adding another member needs [Plus](/billing#seats).
 
 - **Publish together.** Members can create Spaces, publish new versions, and roll back. The site stays with the team when a member leaves.
-- **Keep access in one place.** Invite someone to the team to give them access to team-owned work at their role. Remove them to take that access away across the team's Spaces. Set the default access for each new Space to `team`, `private`, or `public`.
+- **Keep access in one place.** Invite someone to the team to give them access to team-owned work at their role. Remove them to take that access away across the team's Spaces. Set the default access for each new Space to `private` or `public`.
 - **Separate routine work from administration.** Members can publish, while owners and admins manage invitations, domains, and billing. The [role table](#roles) shows the full boundary.
 
 ## What a team is
@@ -101,11 +101,10 @@ To hand the team over, use **Team settings → Danger zone → Transfer ownershi
 
 | Preset | What a new Space gets |
 |---|---|
-| `private` | No access grant at all. Only the team's own access reaches it |
-| `team` | A grant named "Team", so everyone in the team can open it |
-| `public` | A grant named "Public", so anyone with the URL can open it |
+| `private` | Access for the owning team |
+| `public` | Access for the owning team, plus view access for anyone on the web |
 
-The default is `team`. From a terminal, `sf teams defaults` prints the current value and `sf teams defaults public` sets it. Per-Space access, share links, and passwords are covered in [access and share links](/access).
+The default is `private`. The API accepts `team` as a legacy spelling of `private`. From a terminal, `sf teams defaults` prints the current value and `sf teams defaults public` sets it. Per-Space access, share links, and passwords are covered in [access and share links](/access).
 
 ## Move a Space to another team
 

content/(serve)/access.mdx

@@ -45,7 +45,7 @@ The **General access** card holds a segmented control with three options:
 
 | Option | What it does |
 | --- | --- |
-| **Private** | "Only people listed below can open it." |
+| **Private** | "Your team and people you add can view it." |
 | **Share link** | "The share link is the key. Anyone who has it can open it, no account needed." |
 | **Public** | "Anyone on the web can open it." |
 
@@ -77,6 +77,10 @@ Use `version:<id>` to open only one version. Branch previews need a `branch:<nam
 
 ## Share links
 
+A new team-owned Space does not create a share link in the current CLI or dashboard. The owning team signs in at the live URL. Create a link when you want to share outside the team.
+
+Team requests to `POST /v1/spaces` that do not send `capabilities: ["optional_access"]`, such as older CLI versions and dashboard tabs, still receive a compatibility Open link. Team Spaces created by current publish clients get no automatic link. Team requests that send the capability get no link, and their successful receipt can omit `access`. Anonymous Spaces keep their expiring Open link.
+
 A share link is a durable URL that opens exactly the paths you scoped it to, with no account needed. The secret rides in the query string, so the link is the page:
 
 ```text
@@ -227,8 +231,7 @@ A team decides what its new Spaces start as. In the dashboard, open team setting
 
 | Preset | New Spaces start with |
 | --- | --- |
-| `private` | No grant at all |
-| `team` | A grant admitting the owning team to view and comment on everything |
-| `public` | A grant admitting the whole web to view and comment on everything |
+| `private` | Access for the owning team |
+| `public` | Access for the owning team, plus view access for anyone on the web |
 
-The default is `team`. Changing it applies only to Spaces created after the change.
+The default is `private`. The API accepts the legacy value `team` and normalizes it to `private`. Changing the default applies only to Spaces created after the change. Neither preset creates a share link on its own.

content/agents/mcp-server.mdx

@@ -108,7 +108,7 @@ Point docs.example.com at this Space and tell me which DNS records to add.
 | `files` | array of 1 to 1000 | Inline files. Required on hosted. Each is `{ path, content, encoding }` with `encoding` one of `utf8` or `base64`, default `utf8` |
 | `spaceId` | string starting `spc_` | Update this Space. Omit to create one, or on local to use the Space linked to this workspace |
 | `teamId` | string | Destination team id or slug for a new Space. Send one after a `team_required` error |
-| `access` | `private`, `team`, or `public` | Initial root access for a Space this publish creates. Invalid with `spaceId` |
+| `access` | `private` or `public` | Initial root access for a Space this publish creates. `private` admits the owning team, `public` also admits anyone on the web. Omit to use the team default. Invalid with `spaceId` |
 | `createNew` | boolean, default `false` | Local runtime only. Forces a separate Space. Invalid with `spaceId` |
 | `slug` | string, 2 to 55 | Slug for a new Space |
 | `title` | string, 1 to 255 | Title for a new Space |

content/agents/skills.mdx

@@ -97,7 +97,7 @@ The rest sets behavior the tools alone do not enforce.
 - Call the matching tool first. Inside `execute`, search for and describe each operation before calling it.
 - Reuse the `.spacefast/` link in the current directory. Do not list Spaces before an ordinary publish, and set `createNew` only when you asked for a separate Space.
 - Publish once, then poll `operation_status` until it settles, then read the deployment, then report.
-- Report the live URL, the immutable version URL, and the access URL. For an anonymous publish, state the claim expiry and point at the claim action rather than copying the credential into the transcript.
+- Report the live URL and the immutable version URL, plus the access URL when the receipt includes one. Current clients create team-owned Spaces without automatic access URLs: the owning team signs in at the live URL, and `sf share link create` makes a link for people outside the team. For an anonymous publish, state the claim expiry and point at the claim action rather than copying the credential into the transcript.
 - Never print API keys, Space keys, upload tokens, or `.spacefast/state.json`.
 - Open the URL before claiming success, since a bare live URL is private until access is granted.
 

content/cli/agents.mdx

@@ -149,7 +149,7 @@ sf skills [--agent <id>] [-p] [-l] [--force]
 | `-l, --list` | `false` | List bundled skill files without installing |
 | `--force` | `false` | Overwrite locally modified or unverified Spacefast skill files |
 
-The skill is named `spacefast` everywhere. It tells the agent to reach for the MCP tools first, to publish once and then poll, and to report the live URL, the immutable version URL, and the access URL.
+The skill is named `spacefast` everywhere. It tells the agent to reach for the MCP tools first, to publish once and then poll, and to report the live URL, the immutable version URL, and the access URL when the receipt includes one.
 
 ```bash
 sf skills

content/cli/publish.mdx

@@ -41,7 +41,7 @@ These apply when the publish creates the Space. On an existing Space with `--tar
 | --- | --- | --- |
 | `-n, --name=<value>` | none | Set the Space title |
 | `--slug=<value>` | generated | Set the Space slug when creating a new Space. Fails with `space_selection_conflict` if a Space is already selected |
-| `--access=private\|team\|public` | team default | Set initial root access when this publish creates a team-owned Space. Requires a login or `--token`, and fails with `space_selection_conflict` if a Space is already selected |
+| `--access=private\|public` | team default | Set initial root access when this publish creates a team-owned Space. Private admits the owning team; Public also admits anyone on the web. `team` is accepted as `private`. Requires a login or `--token`, and fails with `space_selection_conflict` if a Space is already selected |
 | `--hostname-scope=team\|global` | server default | Managed hostname scope for newly created Spaces |
 | `--spa=auto\|true\|false` | `auto` | Control single-page app fallback detection |
 | `--mode=website\|files` | `website` | Serve the Space as a website or as a raw file listing. Usually set in `sf.jsonc` |

content/cli/spaces.mdx

@@ -116,7 +116,7 @@ sf spaces add --name docs
 
 ### Output
 
-The Space summary. `--json` returns the created Space with its state entry; the access URL and claim link are masked unless you pass `--show-secret`.
+The Space summary. `--json` returns the created Space with its state entry. A new team-owned Space has no automatic share link, so the receipt can omit `access`. The owning team signs in at the live URL. Create a [share link](/access#share-links) when you need one. Any access URL or claim link in a receipt is masked unless you pass `--show-secret`.
 
 ## sf spaces update
 

content/cli/teams.mdx

@@ -130,7 +130,7 @@ Shows or sets the access preset materialized for Spaces this team creates in the
 
 | Argument | Default | What it is |
 | --- | --- | --- |
-| `[rootAccess]` | show only | Future Space preset: `private`, `team`, or `public` |
+| `[rootAccess]` | show only | Future Space preset: `private` (owning team) or `public` (also anyone on the web). `team` is accepted as `private` |
 
 ### Flags
 

content/quickstart.mdx

@@ -95,7 +95,7 @@ Don't want to install anything? Open the dashboard and drag a folder, a `.zip`,
 
 ## Next
 
-Working with other people? If your Space is still anonymous, [claim it first](/anonymous-and-claim#claim-it). Signed-in publishes already belong to a team. Free and Go allow only the owner; adding another member needs [Plus](/billing#seats). Then [invite members](/teams#invite-someone) to publish and roll back together. Owners and admins can manage domains and invitations. Choose whether new Spaces start open to the team, private, or public in [team access settings](/teams#default-access-for-new-spaces).
+Working with other people? If your Space is still anonymous, [claim it first](/anonymous-and-claim#claim-it). Signed-in publishes already belong to a team. Free and Go allow only the owner; adding another member needs [Plus](/billing#seats). Then [invite members](/teams#invite-someone) to publish and roll back together. Owners and admins can manage domains and invitations. Choose whether new Spaces start private to the team or public in [team access settings](/teams#default-access-for-new-spaces).
 
 <CardGroup cols={2}>
   <Card title="Work with a team" href="/teams" icon="users">