Token secrets, monitor fields on create, and space-type descriptions

Added

pat.secret. POST /pats, POST /pats/{id}/rotate and device-key creation now return the secret on the token object as well as in the top-level token — the same string, on the object you are likely to keep. It is still shown once and never again.

description on every space type. GET /space-types carries a paragraph per type — what it is, who writes in it, what a reader gets — beside the one-line purpose.

Changed

One recommended way to scope a token. capabilities (what) plus constraints (where), on top of the scopes read/write/admin gate. scopeGrants and the top-level spaceIds are marked legacy in the API reference: they keep working, with no removal date, but each is a second spelling of one of those two. See API tokens, scopes and capabilities.

Fixed

Status monitors apply every field on create. declaredState sent to POST …/status/monitors was accepted and ignored until a later PATCH; it is now stored on create, as alertsEnabled and both thresholds already are. PATCH now also applies method, and clamps intervalSeconds by the monitor's kind — a daily heartbeat is no longer cut to an hour.

The API reference describes what it used to leave out. edgeCache.verdict on domain setup lists and explains its four values, setup.mode explains each state of claim → verify → activate, and behaviour that only the guides stated — which fields a PATCH merges, that null deletes, the blog's two required sections, where a site's header and footer go — is now in the field descriptions.