@construct-space/cli 1.7.6 → 1.8.0

package/dist/index.js

@@ -5312,6 +5312,7 @@ async function scaffold(nameArg, options) {
   const files = {
     "package.json.tmpl": join2(name, "package.json"),
     "vite.config.ts.tmpl": join2(name, "vite.config.ts"),
+    "style.css.tmpl": join2(name, "src", "style.css"),
     "index.vue.tmpl": join2(name, "src", "pages", "index.vue"),
     "config.md.tmpl": join2(name, "agent", "config.md"),
     "skill.md.tmpl": join2(name, "agent", "skills", "default.md"),
@@ -8154,6 +8155,9 @@ function generate(root, m) {
     "// Auto-generated entry \u2014 do not edit manually",
     "// Generated from space.manifest.json"
   ];
+  if (existsSync4(join4(root, "src", "style.css"))) {
+    lines.push("import './style.css'");
+  }
   for (const p of pages)
     lines.push(`import ${p.varName} from '${p.importPath}'`);
   for (const w of widgets)
@@ -8490,6 +8494,13 @@ async function build(options) {
         renameSync(oldCSS, newCSS);
     }
   }
+  const expectedCSS = join6(distDir, `space-${m.id}.css`);
+  if (!existsSync6(expectedCSS)) {
+    const cssMatches = readdirSync3(distDir).filter((f) => f.endsWith(".css"));
+    const renamedCSS = cssMatches.find((f) => f.startsWith("space-")) || (cssMatches.length === 1 ? cssMatches[0] : undefined);
+    if (renamedCSS)
+      renameSync(join6(distDir, renamedCSS), expectedCSS);
+  }
   const bundleData = readFileSync4(bundlePath);
   const checksum = createHash("sha256").update(bundleData).digest("hex");
   const raw = readRaw(root);
@@ -10337,7 +10348,10 @@ async function uploadSource(portalURL, identityToken, publisherKey, tarballPath,
     }
     msg += `
   Fork to a new space_id to publish your own version.`;
-    throw new Error(msg);
+    const err = new Error(msg);
+    err.ownerKind = result.owner_kind;
+    err.ownerOrgId = result.owner_org_id;
+    throw err;
   }
   if (resp.status >= 400) {
     const msg = result.error || result.errors?.join("; ") || `server returned ${resp.status}`;
@@ -10345,6 +10359,20 @@ async function uploadSource(portalURL, identityToken, publisherKey, tarballPath,
   }
   return result;
 }
+async function fetchOrgPublisherKey(portalURL, identityToken) {
+  const root = portalURL.replace(/\/api\/developer\/?$/, "").replace(/\/+$/, "");
+  try {
+    const resp = await fetch(`${root}/api/publisher/org`, {
+      headers: { Authorization: `Bearer ${identityToken}` }
+    });
+    if (!resp.ok)
+      return null;
+    const body = await resp.json();
+    return body.publisher?.api_key || null;
+  } catch {
+    return null;
+  }
+}
 function setVersionInFiles(root, oldVer, newVer) {
   const oldStr = `"version": "${oldVer}"`;
   const newStr = `"version": "${newVer}"`;
@@ -10501,7 +10529,23 @@ async function publish(options) {
   }
   const uploadSpinner = ora("Uploading & building...").start();
   try {
-    const result = await uploadSource(creds.portal, creds.token, creds.publisherKey, tarballPath, m, { private: wantPrivate, public: wantPublic });
+    const explicitKey = options?.apiKey || process.env.CONSTRUCT_PUBLISHER_KEY;
+    const initialKey = explicitKey || creds.publisherKey;
+    let result;
+    try {
+      result = await uploadSource(creds.portal, creds.token, initialKey, tarballPath, m, { private: wantPrivate, public: wantPublic });
+    } catch (e) {
+      if (e?.ownerKind === "org" && !creds.publisherKey) {
+        uploadSpinner.text = "Fetching org publisher key\u2026";
+        const orgKey = await fetchOrgPublisherKey(creds.portal, creds.token);
+        if (!orgKey)
+          throw e;
+        uploadSpinner.text = "Uploading & building (as org)\u2026";
+        result = await uploadSource(creds.portal, creds.token, orgKey, tarballPath, m, { private: wantPrivate, public: wantPublic });
+      } else {
+        throw e;
+      }
+    }
     unlinkSync2(tarballPath);
     gitSafe(root, "tag", `v${m.version}`);
     gitSafe(root, "push", "origin", `v${m.version}`);
@@ -11457,7 +11501,7 @@ function graphFork(newSpaceID) {
 // package.json
 var package_default = {
   name: "@construct-space/cli",
-  version: "1.7.6",
+  version: "1.8.0",
   description: "Construct CLI \u2014 scaffold, build, develop, and publish spaces",
   type: "module",
   bin: {
@@ -11509,7 +11553,7 @@ program2.command("scaffold [name]").alias("new").alias("create").description("Cr
 program2.command("build").description("Build the space (generate entry + run Vite)").option("--entry-only", "Only generate src/entry.ts").action(async (opts) => build(opts));
 program2.command("dev").description("Start dev mode with file watching and live reload").action(async () => dev());
 program2.command("install").alias("run").description("Install built space to Construct spaces directory").action(() => install());
-program2.command("publish").description("Publish a space to the Construct registry").option("-y, --yes", "Skip all confirmation prompts").option("--bump <type>", "Auto-bump version (patch, minor, major)").option("--private", "Publish as org-private (catalog-listed only inside the owning org). Requires an org publisher key.").option("--public", "Flip a previously-private space back to the public catalog on this publish. Without --private or --public, visibility is preserved on update (and defaults to public on first publish).").action(async (opts) => publish(opts));
+program2.command("publish").description("Publish a space to the Construct registry").option("-y, --yes", "Skip all confirmation prompts").option("--bump <type>", "Auto-bump version (patch, minor, major)").option("--private", "Publish as org-private (catalog-listed only inside the owning org). Requires an org publisher key.").option("--public", "Flip a previously-private space back to the public catalog on this publish. Without --private or --public, visibility is preserved on update (and defaults to public on first publish).").option("--api-key <key>", "Publisher API key (csk_live_\u2026). Overrides any key stored in the active profile. Also reads CONSTRUCT_PUBLISHER_KEY.").action(async (opts) => publish(opts));
 program2.command("validate").description("Validate space.manifest.json").action(() => validate3());
 program2.command("check").description("Run type-check (vue-tsc) and linter (eslint)").action(() => check());
 program2.command("clean").description("Remove build artifacts").option("--all", "Also remove node_modules and lockfiles").action((opts) => clean(opts));
@@ -11540,7 +11584,7 @@ space.command("scaffold [name]").alias("new").alias("create").option("--with-tes
 space.command("build").option("--entry-only").action(async (opts) => build(opts));
 space.command("dev").action(async () => dev());
 space.command("install").alias("run").action(() => install());
-space.command("publish").option("-y, --yes").option("--bump <type>").option("--private").option("--public").action(async (opts) => publish(opts));
+space.command("publish").option("-y, --yes").option("--bump <type>").option("--private").option("--public").option("--api-key <key>").action(async (opts) => publish(opts));
 space.command("validate").action(() => validate3());
 space.command("check").action(() => check());
 space.command("clean").option("--all").action((opts) => clean(opts));

package/dist/templates/space/actions.ts.tmpl

@@ -1,26 +1,58 @@
 /**
  * Space Actions — exposed to the AI agent via space_run_action.
  *
- * Each action: { description, params, run }.
- *  - `params` describe agent-callable inputs (type, description, required).
- *  - `run` receives the payload and returns any JSON-serialisable value.
+ * Each action: { description, params, run, tier? }.
+ *  - `params`      JSON-schema-ish input shape; each: { type, description?, required? }.
+ *  - `run`         receives the validated payload, returns any JSON-serialisable value.
+ *  - `tier`        (optional) default model bucket for useBrain() calls inside `run`:
+ *                    'small'   fast/cheap   — summarisation, classification, short Q&A
+ *                    'medium'  balanced     — general help, edits, structured output
+ *                    'large'   reasoning    — long-form writing, deep code, planning
+ *                  The host resolves tier → provider+model via the user's tier config
+ *                  (Settings → LLM Providers). Per-call `brain.complete({ tier })`
+ *                  wins over the action default.
+ *
+ * Permission for useBrain():
+ *  - Declare `{{.ID}}:brain` in `permissions.catalog` (space.manifest.json).
+ *  - Add the action to `permissions.actions` mapping to that id, e.g.
+ *      "permissions": {
+ *        "actions": { "summarize": "{{.ID}}:brain" },
+ *        "catalog": [{ "id": "{{.ID}}:brain", "label": "Use AI summaries" }]
+ *      }
  *
  * Pair with @construct-space/graph for typed multi-tenant data:
  *   import { useGraph } from '@construct-space/graph'
  *   import { Item } from './models'
  *   const items = useGraph(Item)
- *
- *   listItems: {
- *     description: 'List items',
- *     params: { limit: { type: 'number', required: false } },
- *     run: async (p: any) => ({ items: await items.find({ limit: p.limit ?? 50 }) }),
- *   }
  */
 
-export const actions = {
+import { useBrain } from '@construct-space/sdk'
+import type { SpaceActions } from '@construct-space/sdk'
+
+export const actions: SpaceActions = {
   ping: {
     description: 'Health check — returns pong with the space id.',
     params: {},
     run: () => ({ pong: true, space: '{{.ID}}' }),
   },
+
+  // Example: a tier-routed action. Delete or adapt for your space.
+  // Requires '{{.ID}}:brain' in permissions.catalog and a row in
+  // permissions.actions mapping 'summarize' to that id.
+  //
+  // summarize: {
+  //   description: 'Summarise the given text in 1-2 sentences.',
+  //   tier: 'small',
+  //   params: {
+  //     text: { type: 'string', required: true, description: 'Text to summarise.' },
+  //   },
+  //   async run({ text }: { text: string }) {
+  //     const brain = useBrain()
+  //     if (!brain) return { error: 'brain unavailable' }
+  //     const { text: summary } = await brain.complete({
+  //       prompt: `Summarise in 1-2 sentences:\n\n${text}`,
+  //     })
+  //     return { summary }
+  //   },
+  // },
 }

package/dist/templates/space/config.md.tmpl

@@ -4,7 +4,12 @@ name: {{.DisplayName}}
 category: space
 description: AI agent for the {{.DisplayName}} space
 maxIterations: 15
-tools: []
+# Whitelist of tools the agent can call. Each action in src/actions.ts is
+# exposed as `<space-id>.<actionName>`. Add yours here as you build them;
+# space_list_actions + space_run_action remain available as the fallback
+# discovery bridge, but explicit listing gives the model proper tool schemas.
+tools:
+  - {{.ID}}.ping
 canInvokeAgents: []
 ---
 
@@ -12,12 +17,14 @@ You are Construct's {{.DisplayName}} agent. You help users work within the {{.Di
 
 ## Context
 
-Use space_list_actions to discover available actions for this space.
-Use space_run_action to execute actions.
+Use the listed tools above first. If you need an action that isn't whitelisted,
+call space_list_actions to discover what else this space exposes, then
+space_run_action to invoke it.
+
 Do NOT call get_project_context — you work with space content, not project files.
 
 ## Behavior
 
-- Start by listing available actions to understand what you can do
+- Start by understanding what the user wants in this space
 - Be concise and action-oriented
 - Focus on tasks relevant to this space

package/dist/templates/space/construct.md.tmpl

@@ -162,7 +162,7 @@ export const Task = defineModel('task', {
   labels:      field.json(),
   assignee_id: field.string().index(),
 }, {
-  scope: 'org',                          // partitions schema per organization
+  scopes: ['org'],                       // partitions schema per organization
   access: {
     read:   access.authenticated(),
     create: access.authenticated(),
@@ -188,10 +188,12 @@ await tasks.remove(id)
 
 **Access helpers**: `authenticated()`, `owner()`, `admin()`, `member()`. `member()` requires org context — use `authenticated()` for org-scoped models that allow any logged-in member.
 
-**Scopes**:
-- `app` — single shared schema (rare)
-- `org` — partitioned by organization (most product spaces)
-- `project` — partitioned by project (dev-tooling spaces)
+**Scopes** (must match `scopes` in space.manifest.json):
+- `'app'` — per-user bucket (personal install)
+- `'org'` — shared across the active organization (org install)
+- both: `scopes: ['app', 'org']` — host picks bucket at install time
+
+`'project'` was removed in SDK 1.0. Older docs that show it are stale.
 
 **Push models to backend after editing**: `construct graph push`.
 
@@ -219,7 +221,9 @@ await tasks.remove(id)
 `src/actions.ts` exports an `actions` object — each entry is exposed to the space's agent as a first-class tool.
 
 ```ts
-export const actions = {
+import type { SpaceActions } from '@construct-space/sdk'
+
+export const actions: SpaceActions = {
   createTask: {
     description: 'Create a task',
     params: {
@@ -231,6 +235,75 @@ export const actions = {
 }
 ```
 
+### Tier-routed brain calls (LLM from inside an action)
+
+Actions can call the model mid-execution via `useBrain()`. The action picks
+the **cost bucket** (small / medium / large), the **user** picks the slot
+in Settings → LLM Providers. The host maps tier → provider + model.
+
+```ts
+import { useBrain } from '@construct-space/sdk'
+import type { SpaceActions } from '@construct-space/sdk'
+
+export const actions: SpaceActions = {
+  summarizeThread: {
+    description: 'Summarise one email thread in 1-2 sentences.',
+    tier: 'small',                       // default for brain calls in `run`
+    params: { threadId: { type: 'string', required: true } },
+    async run({ threadId }) {
+      const brain = useBrain()
+      if (!brain) return { error: 'brain unavailable' }
+      const thread = await loadThread(threadId as string)
+      const { text } = await brain.complete({ prompt: `Summarise:\n${thread.body}` })
+      return { summary: text }
+    },
+  },
+
+  composeReply: {
+    description: 'Draft a polished reply to the given message.',
+    tier: 'large',                       // long-form writing → opus-class
+    params: {
+      original: { type: 'string', required: true },
+      style:    { type: 'string', required: false, description: 'e.g. "warm", "formal"' },
+    },
+    async run({ original, style }) {
+      const brain = useBrain()
+      if (!brain) return { error: 'brain unavailable' }
+      const { text } = await brain.chat({
+        system: 'You write replies that feel like a thoughtful human wrote them.',
+        messages: [{ role: 'user', content: `${style ? `Tone: ${style}.\n\n` : ''}Reply to:\n${original}` }],
+      })
+      return { draft: text }
+    },
+  },
+}
+```
+
+Per-call overrides win: `brain.complete({ prompt, tier: 'large' })` upgrades
+even a small-tier action when the user asked for "detailed".
+
+**Permission required.** A space whose actions call brain must declare
+`{{.ID}}:brain` in `permissions.catalog` and map each brain-using action
+to it under `permissions.actions`. The user grants this at install time.
+
+```jsonc
+// space.manifest.json
+{
+  "permissions": {
+    "actions": {
+      "summarizeThread": "{{.ID}}:brain",
+      "composeReply":    "{{.ID}}:brain"
+    },
+    "catalog": [
+      { "id": "{{.ID}}:brain", "label": "Use AI for summaries & drafts" }
+    ]
+  }
+}
+```
+
+Without the grant, `useBrain()` throws `BrainPermissionDenied` synchronously
+on the first method call so the action can fall back gracefully.
+
 ### Wiring (REQUIRED — easy to miss)
 
 Each action becomes a tool named **`{spaceID}.{actionName}`** (dot, not underscore). The operator only pre-registers actions that are **explicitly whitelisted** in the agent config. An empty `tools: []` means the agent sees zero action tools and will report "unknown tool".

package/dist/templates/space/entry.ts.tmpl

@@ -1,5 +1,6 @@
 // Space entry — exports pages, widgets, and actions for the host loader.
 // `construct dev` regenerates this from space.manifest.json on changes.
+import './style.css'
 import IndexPage from './pages/index.vue'
 import { actions } from './actions'
 

package/dist/templates/space/full/entry.ts.tmpl

@@ -1,5 +1,6 @@
 // Space entry — exports pages, widgets, and actions for the host loader.
 // `construct dev` regenerates this from space.manifest.json on changes.
+import './style.css'
 import IndexPage from './pages/index.vue'
 import SettingsPage from './pages/settings.vue'
 import { actions } from './actions'

package/dist/templates/space/package.json.tmpl

@@ -20,10 +20,12 @@
     "@construct-space/cli": "latest",
     "@construct-space/sdk": "latest",
     "@eslint/js": "^10.0.1",
+    "@tailwindcss/vite": "^4.1.17",
     "@vitejs/plugin-vue": "^6.0.6",
     "eslint": "^10.2.1",
     "eslint-plugin-vue": "^10.0.0",
     "lucide-vue-next": "^1.0.0",
+    "tailwindcss": "^4.1.17",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.0.0",
     "vite": "^8.0.12",

package/dist/templates/space/style.css.tmpl

@@ -0,0 +1,5 @@
+@import "tailwindcss";
+
+@source "./**/*.{vue,ts,js}";
+@source "../widgets/**/*.{vue,ts,js}";
+@source "../node_modules/@construct-space/ui/dist/**/*.{js,vue}";

package/dist/templates/space/vite.config.ts.tmpl

@@ -1,4 +1,5 @@
 import { defineConfig } from 'vite'
+import tailwindcss from '@tailwindcss/vite'
 import vue from '@vitejs/plugin-vue'
 import { resolve } from 'path'
 
@@ -19,8 +20,9 @@ const hostExternals = [
   'dexie',
   'zod',
   '@construct-space/ui',
-  '@construct/sdk',
   '@construct-space/sdk',
+  '@construct-space/graph',
+  '@construct/sdk',           // legacy alias — keep during cutover
 ]
 
 function makeGlobals(externals: string[]): Record<string, string> {
@@ -37,7 +39,7 @@ function makeGlobals(externals: string[]): Record<string, string> {
 }
 
 export default defineConfig({
-  plugins: [vue()],
+  plugins: [tailwindcss(), vue()],
   build: {
     lib: {
       entry: resolve(__dirname, 'src/entry.ts'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@construct-space/cli",
-  "version": "1.7.6",
+  "version": "1.8.0",
   "description": "Construct CLI — scaffold, build, develop, and publish spaces",
   "type": "module",
   "bin": {

package/templates/space/actions.ts.tmpl

@@ -1,26 +1,58 @@
 /**
  * Space Actions — exposed to the AI agent via space_run_action.
  *
- * Each action: { description, params, run }.
- *  - `params` describe agent-callable inputs (type, description, required).
- *  - `run` receives the payload and returns any JSON-serialisable value.
+ * Each action: { description, params, run, tier? }.
+ *  - `params`      JSON-schema-ish input shape; each: { type, description?, required? }.
+ *  - `run`         receives the validated payload, returns any JSON-serialisable value.
+ *  - `tier`        (optional) default model bucket for useBrain() calls inside `run`:
+ *                    'small'   fast/cheap   — summarisation, classification, short Q&A
+ *                    'medium'  balanced     — general help, edits, structured output
+ *                    'large'   reasoning    — long-form writing, deep code, planning
+ *                  The host resolves tier → provider+model via the user's tier config
+ *                  (Settings → LLM Providers). Per-call `brain.complete({ tier })`
+ *                  wins over the action default.
+ *
+ * Permission for useBrain():
+ *  - Declare `{{.ID}}:brain` in `permissions.catalog` (space.manifest.json).
+ *  - Add the action to `permissions.actions` mapping to that id, e.g.
+ *      "permissions": {
+ *        "actions": { "summarize": "{{.ID}}:brain" },
+ *        "catalog": [{ "id": "{{.ID}}:brain", "label": "Use AI summaries" }]
+ *      }
  *
  * Pair with @construct-space/graph for typed multi-tenant data:
  *   import { useGraph } from '@construct-space/graph'
  *   import { Item } from './models'
  *   const items = useGraph(Item)
- *
- *   listItems: {
- *     description: 'List items',
- *     params: { limit: { type: 'number', required: false } },
- *     run: async (p: any) => ({ items: await items.find({ limit: p.limit ?? 50 }) }),
- *   }
  */
 
-export const actions = {
+import { useBrain } from '@construct-space/sdk'
+import type { SpaceActions } from '@construct-space/sdk'
+
+export const actions: SpaceActions = {
   ping: {
     description: 'Health check — returns pong with the space id.',
     params: {},
     run: () => ({ pong: true, space: '{{.ID}}' }),
   },
+
+  // Example: a tier-routed action. Delete or adapt for your space.
+  // Requires '{{.ID}}:brain' in permissions.catalog and a row in
+  // permissions.actions mapping 'summarize' to that id.
+  //
+  // summarize: {
+  //   description: 'Summarise the given text in 1-2 sentences.',
+  //   tier: 'small',
+  //   params: {
+  //     text: { type: 'string', required: true, description: 'Text to summarise.' },
+  //   },
+  //   async run({ text }: { text: string }) {
+  //     const brain = useBrain()
+  //     if (!brain) return { error: 'brain unavailable' }
+  //     const { text: summary } = await brain.complete({
+  //       prompt: `Summarise in 1-2 sentences:\n\n${text}`,
+  //     })
+  //     return { summary }
+  //   },
+  // },
 }

package/templates/space/config.md.tmpl

@@ -4,7 +4,12 @@ name: {{.DisplayName}}
 category: space
 description: AI agent for the {{.DisplayName}} space
 maxIterations: 15
-tools: []
+# Whitelist of tools the agent can call. Each action in src/actions.ts is
+# exposed as `<space-id>.<actionName>`. Add yours here as you build them;
+# space_list_actions + space_run_action remain available as the fallback
+# discovery bridge, but explicit listing gives the model proper tool schemas.
+tools:
+  - {{.ID}}.ping
 canInvokeAgents: []
 ---
 
@@ -12,12 +17,14 @@ You are Construct's {{.DisplayName}} agent. You help users work within the {{.Di
 
 ## Context
 
-Use space_list_actions to discover available actions for this space.
-Use space_run_action to execute actions.
+Use the listed tools above first. If you need an action that isn't whitelisted,
+call space_list_actions to discover what else this space exposes, then
+space_run_action to invoke it.
+
 Do NOT call get_project_context — you work with space content, not project files.
 
 ## Behavior
 
-- Start by listing available actions to understand what you can do
+- Start by understanding what the user wants in this space
 - Be concise and action-oriented
 - Focus on tasks relevant to this space

package/templates/space/construct.md.tmpl

@@ -162,7 +162,7 @@ export const Task = defineModel('task', {
   labels:      field.json(),
   assignee_id: field.string().index(),
 }, {
-  scope: 'org',                          // partitions schema per organization
+  scopes: ['org'],                       // partitions schema per organization
   access: {
     read:   access.authenticated(),
     create: access.authenticated(),
@@ -188,10 +188,12 @@ await tasks.remove(id)
 
 **Access helpers**: `authenticated()`, `owner()`, `admin()`, `member()`. `member()` requires org context — use `authenticated()` for org-scoped models that allow any logged-in member.
 
-**Scopes**:
-- `app` — single shared schema (rare)
-- `org` — partitioned by organization (most product spaces)
-- `project` — partitioned by project (dev-tooling spaces)
+**Scopes** (must match `scopes` in space.manifest.json):
+- `'app'` — per-user bucket (personal install)
+- `'org'` — shared across the active organization (org install)
+- both: `scopes: ['app', 'org']` — host picks bucket at install time
+
+`'project'` was removed in SDK 1.0. Older docs that show it are stale.
 
 **Push models to backend after editing**: `construct graph push`.
 
@@ -219,7 +221,9 @@ await tasks.remove(id)
 `src/actions.ts` exports an `actions` object — each entry is exposed to the space's agent as a first-class tool.
 
 ```ts
-export const actions = {
+import type { SpaceActions } from '@construct-space/sdk'
+
+export const actions: SpaceActions = {
   createTask: {
     description: 'Create a task',
     params: {
@@ -231,6 +235,75 @@ export const actions = {
 }
 ```
 
+### Tier-routed brain calls (LLM from inside an action)
+
+Actions can call the model mid-execution via `useBrain()`. The action picks
+the **cost bucket** (small / medium / large), the **user** picks the slot
+in Settings → LLM Providers. The host maps tier → provider + model.
+
+```ts
+import { useBrain } from '@construct-space/sdk'
+import type { SpaceActions } from '@construct-space/sdk'
+
+export const actions: SpaceActions = {
+  summarizeThread: {
+    description: 'Summarise one email thread in 1-2 sentences.',
+    tier: 'small',                       // default for brain calls in `run`
+    params: { threadId: { type: 'string', required: true } },
+    async run({ threadId }) {
+      const brain = useBrain()
+      if (!brain) return { error: 'brain unavailable' }
+      const thread = await loadThread(threadId as string)
+      const { text } = await brain.complete({ prompt: `Summarise:\n${thread.body}` })
+      return { summary: text }
+    },
+  },
+
+  composeReply: {
+    description: 'Draft a polished reply to the given message.',
+    tier: 'large',                       // long-form writing → opus-class
+    params: {
+      original: { type: 'string', required: true },
+      style:    { type: 'string', required: false, description: 'e.g. "warm", "formal"' },
+    },
+    async run({ original, style }) {
+      const brain = useBrain()
+      if (!brain) return { error: 'brain unavailable' }
+      const { text } = await brain.chat({
+        system: 'You write replies that feel like a thoughtful human wrote them.',
+        messages: [{ role: 'user', content: `${style ? `Tone: ${style}.\n\n` : ''}Reply to:\n${original}` }],
+      })
+      return { draft: text }
+    },
+  },
+}
+```
+
+Per-call overrides win: `brain.complete({ prompt, tier: 'large' })` upgrades
+even a small-tier action when the user asked for "detailed".
+
+**Permission required.** A space whose actions call brain must declare
+`{{.ID}}:brain` in `permissions.catalog` and map each brain-using action
+to it under `permissions.actions`. The user grants this at install time.
+
+```jsonc
+// space.manifest.json
+{
+  "permissions": {
+    "actions": {
+      "summarizeThread": "{{.ID}}:brain",
+      "composeReply":    "{{.ID}}:brain"
+    },
+    "catalog": [
+      { "id": "{{.ID}}:brain", "label": "Use AI for summaries & drafts" }
+    ]
+  }
+}
+```
+
+Without the grant, `useBrain()` throws `BrainPermissionDenied` synchronously
+on the first method call so the action can fall back gracefully.
+
 ### Wiring (REQUIRED — easy to miss)
 
 Each action becomes a tool named **`{spaceID}.{actionName}`** (dot, not underscore). The operator only pre-registers actions that are **explicitly whitelisted** in the agent config. An empty `tools: []` means the agent sees zero action tools and will report "unknown tool".

package/templates/space/entry.ts.tmpl

@@ -1,5 +1,6 @@
 // Space entry — exports pages, widgets, and actions for the host loader.
 // `construct dev` regenerates this from space.manifest.json on changes.
+import './style.css'
 import IndexPage from './pages/index.vue'
 import { actions } from './actions'
 

package/templates/space/full/entry.ts.tmpl

@@ -1,5 +1,6 @@
 // Space entry — exports pages, widgets, and actions for the host loader.
 // `construct dev` regenerates this from space.manifest.json on changes.
+import './style.css'
 import IndexPage from './pages/index.vue'
 import SettingsPage from './pages/settings.vue'
 import { actions } from './actions'

package/templates/space/package.json.tmpl

@@ -20,10 +20,12 @@
     "@construct-space/cli": "latest",
     "@construct-space/sdk": "latest",
     "@eslint/js": "^10.0.1",
+    "@tailwindcss/vite": "^4.1.17",
     "@vitejs/plugin-vue": "^6.0.6",
     "eslint": "^10.2.1",
     "eslint-plugin-vue": "^10.0.0",
     "lucide-vue-next": "^1.0.0",
+    "tailwindcss": "^4.1.17",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.0.0",
     "vite": "^8.0.12",

package/templates/space/style.css.tmpl

@@ -0,0 +1,5 @@
+@import "tailwindcss";
+
+@source "./**/*.{vue,ts,js}";
+@source "../widgets/**/*.{vue,ts,js}";
+@source "../node_modules/@construct-space/ui/dist/**/*.{js,vue}";

package/templates/space/vite.config.ts.tmpl

@@ -1,4 +1,5 @@
 import { defineConfig } from 'vite'
+import tailwindcss from '@tailwindcss/vite'
 import vue from '@vitejs/plugin-vue'
 import { resolve } from 'path'
 
@@ -19,8 +20,9 @@ const hostExternals = [
   'dexie',
   'zod',
   '@construct-space/ui',
-  '@construct/sdk',
   '@construct-space/sdk',
+  '@construct-space/graph',
+  '@construct/sdk',           // legacy alias — keep during cutover
 ]
 
 function makeGlobals(externals: string[]): Record<string, string> {
@@ -37,7 +39,7 @@ function makeGlobals(externals: string[]): Record<string, string> {
 }
 
 export default defineConfig({
-  plugins: [vue()],
+  plugins: [tailwindcss(), vue()],
   build: {
     lib: {
       entry: resolve(__dirname, 'src/entry.ts'),