@f-o-h/cli 0.1.87 → 0.1.89

package/dist/foh.js

@@ -963,8 +963,8 @@ var require_command = __commonJS({
   "../../node_modules/.pnpm/commander@12.1.0/node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess = require("node:child_process");
-    var path2 = require("node:path");
-    var fs = require("node:fs");
+    var path5 = require("node:path");
+    var fs4 = require("node:fs");
     var process4 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1896,11 +1896,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path2.resolve(baseDir, baseName);
-          if (fs.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path2.extname(baseName))) return void 0;
+          const localBin = path5.resolve(baseDir, baseName);
+          if (fs4.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path5.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs.existsSync(`${localBin}${ext}`)
+            (ext) => fs4.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1912,21 +1912,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs4.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path2.resolve(
-            path2.dirname(resolvedScriptPath),
+          executableDir = path5.resolve(
+            path5.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path2.basename(
+            const legacyName = path5.basename(
               this._scriptPath,
-              path2.extname(this._scriptPath)
+              path5.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1937,7 +1937,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path2.extname(executableFile));
+        launchWithNode = sourceExt.includes(path5.extname(executableFile));
         let proc;
         if (process4.platform !== "win32") {
           if (launchWithNode) {
@@ -2777,7 +2777,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path2.basename(filename, path2.extname(filename));
+        this._name = path5.basename(filename, path5.extname(filename));
         return this;
       }
       /**
@@ -2791,9 +2791,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path3) {
-        if (path3 === void 0) return this._executableDir;
-        this._executableDir = path3;
+      executableDir(path6) {
+        if (path6 === void 0) return this._executableDir;
+        this._executableDir = path6;
         return this;
       }
       /**
@@ -6288,8 +6288,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path2) {
-      let input = path2;
+    function removeDotSegments(path5) {
+      let input = path5;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -6488,8 +6488,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path2, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path2 && path2 !== "/" ? path2 : void 0;
+        const [path5, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path5 && path5 !== "/" ? path5 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -9851,12 +9851,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs, exportName) {
+    function addFormats(ajv, list, fs4, exportName) {
       var _a2;
       var _b;
       (_a2 = (_b = ajv.opts.code).formats) !== null && _a2 !== void 0 ? _a2 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs[f]);
+        ajv.addFormat(f, fs4[f]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -10787,8 +10787,8 @@ var resolvedOrgCache = /* @__PURE__ */ new Map();
 function cacheKey(apiUrl, token) {
   return `${apiUrl}::${token}`;
 }
-function isOrgRequiredPath(path2) {
-  return path2.startsWith("/v1/console/") && !path2.startsWith("/v1/console/auth/");
+function isOrgRequiredPath(path5) {
+  return path5.startsWith("/v1/console/") && !path5.startsWith("/v1/console/auth/");
 }
 async function discoverDefaultOrgId(apiUrl, token) {
   const key = cacheKey(apiUrl, token);
@@ -10810,16 +10810,16 @@ async function discoverDefaultOrgId(apiUrl, token) {
   }
   return usable;
 }
-async function apiFetch(path2, init = {}) {
-  const res = await apiFetchRaw(path2, init);
+async function apiFetch(path5, init = {}) {
+  const res = await apiFetchRaw(path5, init);
   return res.json();
 }
-async function apiFetchRaw(path2, init = {}) {
+async function apiFetchRaw(path5, init = {}) {
   const { orgId, apiUrlOverride, ...fetchInit } = init;
   const creds = loadCredentials(apiUrlOverride);
-  const url2 = creds.apiUrl.replace(/\/$/, "") + path2;
+  const url2 = creds.apiUrl.replace(/\/$/, "") + path5;
   let resolvedOrgId = isUsableOrgId(orgId) ? orgId : isUsableOrgId(creds.orgId) ? creds.orgId : void 0;
-  if (!resolvedOrgId && isOrgRequiredPath(path2)) {
+  if (!resolvedOrgId && isOrgRequiredPath(path5)) {
     try {
       const discovered = await discoverDefaultOrgId(creds.apiUrl, creds.token);
       if (isUsableOrgId(discovered)) {
@@ -10853,7 +10853,7 @@ async function apiFetchRaw(path2, init = {}) {
     const errorMsg = body.error || responseText || `HTTP ${res.status}`;
     const remediation = body.remediation || getRemediation(res.status);
     throw new FohError({
-      step: path2,
+      step: path5,
       error: errorMsg,
       remediation,
       statusCode: res.status,
@@ -13957,11 +13957,11 @@ function serialiseManifest(manifest) {
 function flattenObject(obj, prefix = "") {
   const result = {};
   for (const [key, value] of Object.entries(obj)) {
-    const path2 = prefix ? `${prefix}.${key}` : key;
+    const path5 = prefix ? `${prefix}.${key}` : key;
     if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-      Object.assign(result, flattenObject(value, path2));
+      Object.assign(result, flattenObject(value, path5));
     } else {
-      result[path2] = value;
+      result[path5] = value;
     }
   }
   return result;
@@ -13976,12 +13976,12 @@ function diffManifest(current, desired) {
     "agent"
   );
   const diffs = [];
-  for (const [path2, desiredVal] of Object.entries(desiredFlat)) {
-    const currentVal = currentFlat[path2];
+  for (const [path5, desiredVal] of Object.entries(desiredFlat)) {
+    const currentVal = currentFlat[path5];
     const currentSer = JSON.stringify(currentVal);
     const desiredSer = JSON.stringify(desiredVal);
     if (currentSer !== desiredSer) {
-      diffs.push({ path: path2, from: currentVal, to: desiredVal });
+      diffs.push({ path: path5, from: currentVal, to: desiredVal });
     }
   }
   return diffs;
@@ -15180,12 +15180,407 @@ function registerTemplates(program3) {
   }));
 }
 
-// src/commands/widget.ts
-var SMOKE_TURNS = [
-  "Hello, I need help with a property",
-  "I am interested in buying a 3-bedroom house in the area",
-  "Can I book a viewing for this week?"
+// src/lib/widget-platforms.ts
+var import_node_fs = __toESM(require("node:fs"));
+var import_node_os = __toESM(require("node:os"));
+var import_node_path = __toESM(require("node:path"));
+var import_node_child_process = require("node:child_process");
+
+// src/lib/widget-install-guidance.ts
+function normalizeOriginHint(originOrHost) {
+  if (!originOrHost) return null;
+  const value = originOrHost.trim();
+  if (!value) return null;
+  if (/^https?:\/\//i.test(value)) return value;
+  return `https://${value}`;
+}
+function uniqueCommands(commands) {
+  return Array.from(new Set(commands.filter((command) => Boolean(command && command.trim()))));
+}
+function buildWidgetSmokeCommand(params) {
+  const origin = normalizeOriginHint(params.origin);
+  if (params.publicKey) {
+    return `foh widget smoke --channel ${params.publicKey} --json${origin ? ` --origin ${origin}` : ""}`;
+  }
+  if (params.agentId) {
+    return `foh widget smoke --agent ${params.agentId} --json`;
+  }
+  return null;
+}
+function buildWidgetVerifyInstallCommand(params) {
+  if (!params.publicKey) return null;
+  const origin = normalizeOriginHint(params.origin);
+  const resolvedOrigin = origin ?? (params.placeholderOrigin ? "https://www.example.com" : null);
+  return `foh widget verify-install --channel ${params.publicKey} --json${resolvedOrigin ? ` --origin ${resolvedOrigin}` : ""}`;
+}
+function buildWidgetInstallGuidance(params) {
+  const domainAllowlist = Array.isArray(params.domains) ? params.domains.map((domain2) => String(domain2 || "").trim()).filter(Boolean) : [];
+  const originHint = normalizeOriginHint(params.origin) ?? normalizeOriginHint(domainAllowlist[0]);
+  const installVerificationCommand = buildWidgetVerifyInstallCommand({
+    publicKey: params.publicKey,
+    origin: originHint,
+    placeholderOrigin: params.placeholderOrigin
+  });
+  const runtimeSmokeCommand = buildWidgetSmokeCommand({
+    publicKey: params.publicKey,
+    agentId: params.agentId,
+    origin: originHint
+  });
+  return {
+    widget_public_key: params.publicKey?.trim() || null,
+    domain_allowlist: domainAllowlist,
+    origin_hint: originHint,
+    install_verification_command: installVerificationCommand,
+    runtime_smoke_command: runtimeSmokeCommand,
+    verification_commands: uniqueCommands([installVerificationCommand ?? runtimeSmokeCommand])
+  };
+}
+
+// src/lib/widget-platforms.ts
+var DEFAULT_WIDGET_API_URL = "https://api.frontofhouse.okii.uk";
+var DEFAULT_WORDPRESS_PLUGIN_NAME = "Front Of House Widget";
+var SUPPORTED_INSTALL_PLATFORMS = ["custom", "wordpress", "wix", "squarespace", "webflow", "shopify"];
+var SHARED_BUILDER_INTRO = [
+  "Use the platform custom-code or embed surface, not a theme redesign path.",
+  "Paste the hosted Front Of House snippet exactly as generated unless a native adapter is provided.",
+  "Keep the widget domain allowlist aligned to the real production website hostnames."
 ];
+var BUILDER_PLATFORM_GUIDES = {
+  wordpress: {
+    label: "WordPress",
+    paste_surface: "Custom HTML block or site-wide code injection area",
+    steps: [
+      "Preferred path: generate the preconfigured WordPress plugin bundle and upload/activate it in WordPress.",
+      "Fallback path: open the page, template, or footer area where the widget should load.",
+      "Use a Custom HTML block for page-level install, or the site code-injection/header-footer area for site-wide install.",
+      "If using manual embed, paste the snippet once, publish the page/theme change, then verify on the live site domain."
+    ],
+    nativeAdapterCommand: ({ publicKey }) => publicKey ? `foh widget wordpress-plugin --channel ${publicKey} --out ./front-of-house-widget --json` : null
+  },
+  wix: {
+    label: "Wix",
+    paste_surface: "Custom code or embed area",
+    steps: [
+      "Open the site custom-code or embed settings for the target page or all pages.",
+      "Paste the snippet into the body/site code area that supports custom scripts.",
+      "Publish the Wix site, then verify on the live site domain."
+    ]
+  },
+  squarespace: {
+    label: "Squarespace",
+    paste_surface: "Code Injection or Embed block",
+    steps: [
+      "Open the target page or the global code-injection area.",
+      "Paste the snippet into a code/embed block for page-level install or the global injection area for site-wide install.",
+      "Save, publish, and verify on the live site domain."
+    ]
+  },
+  webflow: {
+    label: "Webflow",
+    paste_surface: "Embed element or page/site custom code",
+    steps: [
+      "Open the target page or the site/page custom-code settings.",
+      "Paste the snippet into an Embed element or the footer custom-code area.",
+      "Publish the site, then verify on the live site domain."
+    ]
+  },
+  shopify: {
+    label: "Shopify",
+    paste_surface: "Theme custom liquid/embed area",
+    steps: [
+      "Open the active theme customization or theme code area.",
+      "Add the snippet once through a custom liquid/embed block or the theme custom-code area.",
+      "Save the theme change, publish if needed, then verify on the live storefront domain."
+    ]
+  }
+};
+function resolveWidgetApiUrl(apiUrlOverride) {
+  return (apiUrlOverride || DEFAULT_WIDGET_API_URL).replace(/\/$/, "");
+}
+function widgetSnippetFromPublicKey(publicKey, apiUrl) {
+  const resolvedApiUrl = resolveWidgetApiUrl(apiUrl);
+  return `<script src="${resolvedApiUrl}/widget.js" data-channel="${publicKey}" data-api-url="${resolvedApiUrl}" async></script>`;
+}
+function normalizeInstallPlatform(value) {
+  const normalized = typeof value === "string" ? value.trim().toLowerCase() : "custom";
+  if (!normalized) return "custom";
+  if (SUPPORTED_INSTALL_PLATFORMS.includes(normalized)) return normalized;
+  throw new FohError({
+    step: "install.platform",
+    error: `Unsupported platform: ${String(value || "")}`,
+    remediation: `Use one of: ${SUPPORTED_INSTALL_PLATFORMS.join(", ")}`
+  });
+}
+function isBuilderHostedPlatform(platform) {
+  return platform !== "custom";
+}
+function buildBuilderPlatformInstructions(params) {
+  const guide = BUILDER_PLATFORM_GUIDES[params.platform];
+  const guidance = buildWidgetInstallGuidance({
+    publicKey: params.publicKey,
+    domains: params.domains,
+    origin: params.origin
+  });
+  return {
+    schema_version: "foh_widget_builder_install.v1",
+    platform: params.platform,
+    platform_label: guide.label,
+    paste_surface: guide.paste_surface,
+    snippet: params.snippet,
+    ...guidance,
+    steps: [...SHARED_BUILDER_INTRO, ...guide.steps],
+    native_adapter_command: guide.nativeAdapterCommand?.({ publicKey: params.publicKey }) ?? null
+  };
+}
+function slugifyWordPressPluginName(name) {
+  const normalized = name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return normalized || "front-of-house-widget";
+}
+function renderWordPressPluginPhp(params) {
+  return `<?php
+/**
+ * Plugin Name: ${params.pluginName}
+ * Description: Injects the hosted Front Of House widget site-wide.
+ * Version: 0.1.0
+ * Author: Front Of House
+ */
+
+if (!defined('ABSPATH')) {
+    exit;
+}
+
+function foh_widget_render() {
+    ?>
+<script src="<?php echo esc_url('${params.apiUrl}/widget.js'); ?>" data-channel="<?php echo esc_attr('${params.publicKey}'); ?>" data-api-url="<?php echo esc_url('${params.apiUrl}'); ?>" async></script>
+    <?php
+}
+
+add_action('wp_footer', 'foh_widget_render', 100);
+`;
+}
+function renderWordPressPluginReadme(params) {
+  return `${params.pluginName}
+======================
+
+This plugin injects the hosted Front Of House widget site-wide.
+
+Public widget key: ${params.publicKey}
+API URL: ${params.apiUrl}
+
+Install:
+1. Upload this plugin to WordPress.
+2. Activate it.
+3. Verify the live site with:
+   ${params.verificationCommand}
+`;
+}
+function writeUtf8File(targetPath, content, dryRun) {
+  if (dryRun) return;
+  import_node_fs.default.mkdirSync(import_node_path.default.dirname(targetPath), { recursive: true });
+  import_node_fs.default.writeFileSync(targetPath, content, "utf8");
+}
+function packZipDirectory(sourceDir, outputZipPath) {
+  if (process.platform === "win32") {
+    const script = `Compress-Archive -LiteralPath '${sourceDir.replace(/'/g, "''")}' -DestinationPath '${outputZipPath.replace(/'/g, "''")}' -Force`;
+    const result2 = (0, import_node_child_process.spawnSync)("powershell.exe", ["-NoProfile", "-Command", script], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true
+    });
+    if (result2.status !== 0) {
+      throw new FohError({
+        step: "widget.wordpress_plugin",
+        error: "Failed to package the WordPress plugin zip.",
+        remediation: "Use a directory output path instead of a .zip path, or rerun on a host with zip packaging support.",
+        detail: {
+          stdout: String(result2.stdout || ""),
+          stderr: String(result2.stderr || "")
+        }
+      });
+    }
+    return;
+  }
+  const result = (0, import_node_child_process.spawnSync)("zip", ["-qr", outputZipPath, import_node_path.default.basename(sourceDir)], {
+    cwd: import_node_path.default.dirname(sourceDir),
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.error || result.status !== 0) {
+    throw new FohError({
+      step: "widget.wordpress_plugin",
+      error: "Failed to package the WordPress plugin zip.",
+      remediation: "Use a directory output path instead of a .zip path, or install a zip tool and retry.",
+      detail: {
+        stdout: String(result.stdout || ""),
+        stderr: String(result.stderr || "")
+      }
+    });
+  }
+}
+function buildWordPressPluginBundle(params) {
+  const pluginName = (params.pluginName || DEFAULT_WORDPRESS_PLUGIN_NAME).trim() || DEFAULT_WORDPRESS_PLUGIN_NAME;
+  const pluginSlug = slugifyWordPressPluginName(pluginName);
+  const apiUrl = resolveWidgetApiUrl(params.apiUrl);
+  const snippet2 = widgetSnippetFromPublicKey(params.publicKey, apiUrl);
+  const guidance = buildWidgetInstallGuidance({
+    publicKey: params.publicKey,
+    placeholderOrigin: true
+  });
+  const requestedOutput = import_node_path.default.resolve(params.outPath);
+  const zipOutput = /\.zip$/i.test(requestedOutput);
+  const artifactType = zipOutput ? "zip" : "directory";
+  const bundleRoot = zipOutput ? import_node_path.default.join(import_node_fs.default.mkdtempSync(import_node_path.default.join(import_node_os.default.tmpdir(), "foh-wp-plugin-")), pluginSlug) : requestedOutput;
+  const entryFile = import_node_path.default.join(bundleRoot, `${pluginSlug}.php`);
+  const readmeFile = import_node_path.default.join(bundleRoot, "README.txt");
+  if (!params.dryRun) {
+    if (artifactType === "directory" && import_node_fs.default.existsSync(requestedOutput)) {
+      throw new FohError({
+        step: "widget.wordpress_plugin",
+        error: `Output path already exists: ${requestedOutput}`,
+        remediation: "Choose a new output path for the plugin bundle."
+      });
+    }
+    if (artifactType === "zip" && import_node_fs.default.existsSync(requestedOutput)) {
+      throw new FohError({
+        step: "widget.wordpress_plugin",
+        error: `Output zip already exists: ${requestedOutput}`,
+        remediation: "Choose a new .zip output path for the plugin bundle."
+      });
+    }
+  }
+  try {
+    writeUtf8File(entryFile, renderWordPressPluginPhp({
+      pluginName,
+      publicKey: params.publicKey,
+      apiUrl
+    }), Boolean(params.dryRun));
+    writeUtf8File(readmeFile, renderWordPressPluginReadme({
+      pluginName,
+      publicKey: params.publicKey,
+      apiUrl,
+      verificationCommand: guidance.install_verification_command || `foh widget verify-install --channel ${params.publicKey} --json --origin https://www.example.com`
+    }), Boolean(params.dryRun));
+    if (!params.dryRun && artifactType === "zip") {
+      import_node_fs.default.mkdirSync(import_node_path.default.dirname(requestedOutput), { recursive: true });
+      packZipDirectory(bundleRoot, requestedOutput);
+    }
+    return {
+      schema_version: "foh_wordpress_plugin_bundle.v1",
+      status: params.dryRun ? "dry_run" : "generated",
+      artifact_type: artifactType,
+      output_path: requestedOutput,
+      plugin_name: pluginName,
+      plugin_slug: pluginSlug,
+      plugin_entry_file: artifactType === "zip" ? `${pluginSlug}/${pluginSlug}.php` : import_node_path.default.relative(process.cwd(), entryFile).replaceAll("\\", "/"),
+      ...guidance,
+      api_url: apiUrl,
+      snippet: snippet2
+    };
+  } finally {
+    if (!params.dryRun && artifactType === "zip") {
+      try {
+        import_node_fs.default.rmSync(import_node_path.default.dirname(bundleRoot), { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+}
+
+// src/lib/widget-site-install.ts
+var import_node_fs2 = __toESM(require("node:fs"));
+var import_node_path2 = __toESM(require("node:path"));
+var WIDGET_MARKER_START = "<!-- Front Of House widget start -->";
+var WIDGET_MARKER_END = "<!-- Front Of House widget end -->";
+var WIDGET_JSX_MARKER_START = "{/* Front Of House widget start */}";
+var WIDGET_JSX_MARKER_END = "{/* Front Of House widget end */}";
+function isPathInside(basePath, candidatePath) {
+  const relative4 = import_node_path2.default.relative(basePath, candidatePath);
+  return relative4 === "" || !relative4.startsWith("..") && !import_node_path2.default.isAbsolute(relative4);
+}
+function normalizeSnippet(snippet2) {
+  return snippet2.trim();
+}
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isJsxLayoutPath(targetPath) {
+  return /\.(tsx|jsx)$/i.test(targetPath);
+}
+function markedSnippet(snippet2, targetPath) {
+  const normalized = normalizeSnippet(snippet2);
+  if (isJsxLayoutPath(targetPath)) {
+    return `${WIDGET_JSX_MARKER_START}
+${normalized}
+${WIDGET_JSX_MARKER_END}`;
+  }
+  return `${WIDGET_MARKER_START}
+${normalized}
+${WIDGET_MARKER_END}`;
+}
+function extractChannelPublicKeyFromSnippet(snippet2) {
+  const match = snippet2.match(/\bdata-channel=(["'])([^"']+)\1/i);
+  return match?.[2]?.trim() || void 0;
+}
+function installWidgetSnippetIntoShell(source, snippet2, targetPath) {
+  const jsxShell = isJsxLayoutPath(targetPath);
+  const markerStart = jsxShell ? WIDGET_JSX_MARKER_START : WIDGET_MARKER_START;
+  const markerEnd = jsxShell ? WIDGET_JSX_MARKER_END : WIDGET_MARKER_END;
+  const block = markedSnippet(snippet2, targetPath);
+  const existingBlockPattern = new RegExp(
+    `${escapeRegex(markerStart)}[\\s\\S]*?${escapeRegex(markerEnd)}`,
+    "m"
+  );
+  if (existingBlockPattern.test(source)) {
+    const html2 = source.replace(existingBlockPattern, block);
+    return {
+      html: html2,
+      changed: html2 !== source,
+      mode: html2 === source ? "unchanged" : "replaced",
+      markerStart,
+      markerEnd
+    };
+  }
+  if (!/<\/body>/i.test(source)) {
+    throw new FohError({
+      step: "widget.install_site",
+      error: "No </body> tag found in target file.",
+      remediation: "Pass --target for a site shell such as index.html or app/layout.tsx, or paste the embed snippet into the site shell manually."
+    });
+  }
+  const html = source.replace(/<\/body>/i, `  ${block}
+  </body>`);
+  return { html, changed: html !== source, mode: "inserted", markerStart, markerEnd };
+}
+function resolveWidgetInstallTarget(siteRoot, target) {
+  const root = import_node_path2.default.resolve(siteRoot || ".");
+  const candidates = target ? [target] : [
+    "index.html",
+    import_node_path2.default.join("apps", "web", "index.html"),
+    import_node_path2.default.join("apps", "frontend", "index.html"),
+    import_node_path2.default.join("apps", "site", "index.html"),
+    import_node_path2.default.join("apps", "landing", "index.html"),
+    import_node_path2.default.join("app", "layout.tsx"),
+    import_node_path2.default.join("app", "layout.jsx"),
+    import_node_path2.default.join("src", "app", "layout.tsx"),
+    import_node_path2.default.join("src", "app", "layout.jsx")
+  ];
+  for (const candidate of candidates) {
+    const resolved = import_node_path2.default.resolve(root, candidate);
+    if (!isPathInside(root, resolved)) {
+      throw new FohError({
+        step: "widget.install_site",
+        error: `Refusing to patch a file outside --site-root: ${candidate}`,
+        remediation: "Run the command from the website repository root or pass a target inside --site-root."
+      });
+    }
+    if (import_node_fs2.default.existsSync(resolved) && import_node_fs2.default.statSync(resolved).isFile()) return resolved;
+  }
+  throw new FohError({
+    step: "widget.install_site",
+    error: "Could not find a supported site shell to patch.",
+    remediation: "Pass --target index.html, --target apps/web/index.html, or --target app/layout.tsx from the website repository root."
+  });
+}
 async function resolveChannelPublicKey(agentId, orgId, apiUrlOverride) {
   const data = await apiFetch(
     "/v1/console/channels/widget/ensure",
@@ -15200,7 +15595,209 @@ async function resolveChannelPublicKey(agentId, orgId, apiUrlOverride) {
   }
   return data.channel.public_key;
 }
-async function runWidgetSmoke(publicKey, apiUrlOverride) {
+async function installWidgetSite(opts) {
+  if (!opts.snippet && !opts.agent) {
+    throw new FohError({
+      step: "widget.install_site",
+      error: "Missing --agent or --snippet.",
+      remediation: "Run: foh install <install-link>, or foh install --agent <agent-id> --domains example.com,www.example.com"
+    });
+  }
+  const agentId = opts.agent;
+  const domains = Array.isArray(opts.domains) ? opts.domains.map((domain2) => domain2.trim()).filter(Boolean) : [];
+  let snippet2 = typeof opts.snippet === "string" ? opts.snippet : "";
+  let widgetPublicKey;
+  if (!snippet2) {
+    if (!agentId) {
+      throw new FohError({
+        step: "widget.install_site",
+        error: "Missing --agent.",
+        remediation: "Run: foh install <install-link>, or foh install --agent <agent-id>"
+      });
+    }
+    await apiFetch("/v1/console/channels/widget/ensure", {
+      method: "POST",
+      body: JSON.stringify({ agentId }),
+      orgId: opts.org,
+      apiUrlOverride: opts.apiUrl
+    });
+    if (domains.length > 0) {
+      await apiFetch("/v1/console/channels/widget/domains", {
+        method: "POST",
+        body: JSON.stringify({ agentId, domains }),
+        orgId: opts.org,
+        apiUrlOverride: opts.apiUrl
+      });
+    }
+    const embed = await apiFetch(
+      "/v1/console/channels/widget/embed-snippet",
+      {
+        orgId: opts.org,
+        apiUrlOverride: opts.apiUrl,
+        headers: { "x-agent-id": agentId }
+      }
+    );
+    snippet2 = String(embed.snippet || "").trim();
+    widgetPublicKey = embed.widget_public_key;
+  } else {
+    widgetPublicKey = extractChannelPublicKeyFromSnippet(snippet2);
+  }
+  if (!snippet2) {
+    throw new FohError({
+      step: "widget.install_site",
+      error: "Widget embed snippet is empty.",
+      remediation: "Run: foh widget embed-snippet --agent <agent-id> --json"
+    });
+  }
+  const targetPath = resolveWidgetInstallTarget(opts.siteRoot || ".", opts.target);
+  const before = import_node_fs2.default.readFileSync(targetPath, "utf8");
+  const patch = installWidgetSnippetIntoShell(before, snippet2, targetPath);
+  if (!opts.dryRun && patch.changed) {
+    import_node_fs2.default.writeFileSync(targetPath, patch.html, "utf8");
+  }
+  const relativeTarget = import_node_path2.default.relative(process.cwd(), targetPath).replaceAll("\\", "/");
+  const guidance = buildWidgetInstallGuidance({
+    publicKey: widgetPublicKey ?? null,
+    agentId: opts.agent,
+    domains
+  });
+  return {
+    schema_version: "foh_widget_site_install.v1",
+    status: opts.dryRun ? "dry_run" : "installed",
+    target_path: relativeTarget,
+    absolute_target_path: targetPath,
+    changed: patch.changed,
+    mode: patch.mode,
+    marker_start: patch.markerStart,
+    marker_end: patch.markerEnd,
+    ...guidance,
+    snippet: snippet2,
+    next_commands: ["build the website", ...guidance.verification_commands]
+  };
+}
+async function ensureWidgetChannelPublicKey(agentId, orgId, apiUrlOverride) {
+  return resolveChannelPublicKey(agentId, orgId, apiUrlOverride);
+}
+
+// src/lib/widget-public.ts
+var SMOKE_TURNS = [
+  "Hello, I need help with a property",
+  "I am interested in buying a 3-bedroom house in the area",
+  "Can I book a viewing for this week?"
+];
+function isGenericTroubleReply(reply) {
+  const normalized = reply.trim().toLowerCase();
+  return /\bi'?m sorry\b/.test(normalized) && /having trouble|try again|something went wrong|unable to help right now/.test(normalized);
+}
+function isProgressPlaceholderReply(reply) {
+  const normalized = reply.trim().toLowerCase();
+  return /still working on that|one moment|just a moment|please hold|bear with me/.test(normalized);
+}
+function normalizeOrigin(originOrHost) {
+  if (!originOrHost) return void 0;
+  const value = originOrHost.trim();
+  if (!value) return void 0;
+  if (/^https?:\/\//i.test(value)) return value;
+  return `https://${value}`;
+}
+async function postPublicWidgetInbound(payload, apiUrlOverride, originOverride) {
+  const res = await fetch(`${resolveWidgetApiUrl(apiUrlOverride)}/v1/widget/inbound`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...originOverride ? { Origin: originOverride } : {}
+    },
+    body: JSON.stringify(payload)
+  });
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+    body = {};
+  }
+  if (!res.ok) {
+    throw new FohError({
+      step: "/v1/widget/inbound",
+      error: String(body?.error || `HTTP ${res.status}`),
+      remediation: String(body?.remediation || "Check the widget public key and API health, then retry."),
+      statusCode: res.status,
+      detail: body
+    });
+  }
+  return body;
+}
+async function fetchPublicWidgetInstallVerification(publicKey, apiUrlOverride, originOverride) {
+  const apiUrl = resolveWidgetApiUrl(apiUrlOverride);
+  const url2 = new URL(`${apiUrl}/v1/widget/install-verification`);
+  url2.searchParams.set("key", publicKey);
+  const res = await fetch(url2.toString(), {
+    method: "GET",
+    headers: {
+      ...originOverride ? { Origin: originOverride } : {}
+    }
+  });
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+    body = {};
+  }
+  if (!res.ok) {
+    throw new FohError({
+      step: "/v1/widget/install-verification",
+      error: String(body?.error || `HTTP ${res.status}`),
+      remediation: String(body?.code === "domain_not_allowed" ? "Use the live website origin with --origin https://www.example.com and confirm the domain allowlist." : body?.code === "invalid_widget_public_key" ? "Check the widget public key or regenerate the install link." : "Check the widget public key, origin, and API health, then retry."),
+      statusCode: res.status,
+      detail: body
+    });
+  }
+  return body;
+}
+function normalizeReplyText(value) {
+  return value.trim().toLowerCase();
+}
+function matchAnyTerms(reply, terms) {
+  if (!Array.isArray(terms) || terms.length === 0) return true;
+  const normalized = normalizeReplyText(reply);
+  return terms.some((term) => normalized.includes(term.toLowerCase()));
+}
+function matchForbiddenTerms(reply, terms) {
+  if (!Array.isArray(terms) || terms.length === 0) return false;
+  const normalized = normalizeReplyText(reply);
+  return terms.some((term) => normalized.includes(term.toLowerCase()));
+}
+function resolveSemanticEvalPack(profile) {
+  const semanticEvalProfile = typeof profile?.semantic_eval_profile === "string" ? profile.semantic_eval_profile.trim().toLowerCase() : "";
+  const businessName = typeof profile?.business_name === "string" ? profile.business_name.trim().toLowerCase() : "";
+  const businessCategory = typeof profile?.business_category === "string" ? profile.business_category.trim().toLowerCase() : "";
+  if (semanticEvalProfile === "okii_consulting" || businessName === "okii" || businessCategory === "real_estate_ai_consulting") {
+    return {
+      id: "okii_consulting",
+      scenarios: [
+        {
+          id: "identity",
+          message: "What does OKII do?",
+          required_any: ["okii", "ai", "front", "automation"],
+          forbidden_any: ["estate agency", "estate agent", "book a viewing"]
+        },
+        {
+          id: "non_estate_identity",
+          message: "Are you an estate agent?",
+          required_any: ["not an estate agency", "not an estate agent", "okii"],
+          forbidden_any: ["we can book a viewing", "valuation request"]
+        },
+        {
+          id: "consulting_lead",
+          message: "I run an estate agency and want AI help with calls and leads.",
+          required_any: ["ai", "calls", "leads", "workflow", "automate"],
+          forbidden_any: ["which property", "book the viewing"]
+        }
+      ]
+    };
+  }
+  return null;
+}
+async function runWidgetSmoke(publicKey, apiUrlOverride, originOverride) {
   let conversationId;
   const traceIds = [];
   const correlationIds = [];
@@ -15209,30 +15806,32 @@ async function runWidgetSmoke(publicKey, apiUrlOverride) {
     const message = SMOKE_TURNS[i];
     const start = Date.now();
     try {
-      const data = await apiFetch(
-        "/v1/widget/inbound",
-        {
-          method: "POST",
-          body: JSON.stringify({
-            channel_public_key: publicKey,
-            message_body: message,
-            preview: true,
-            ...conversationId ? { conversation_id: conversationId } : {}
-          }),
-          apiUrlOverride
-        }
-      );
+      const data = await postPublicWidgetInbound({
+        channel_public_key: publicKey,
+        message_body: message,
+        ...conversationId ? { conversation_id: conversationId } : {}
+      }, apiUrlOverride, originOverride);
       const latencyMs = Date.now() - start;
       if (!data.reply) throw new Error("Empty reply");
       conversationId = data.conversationId;
       if (data.trace_id) traceIds.push(data.trace_id);
       if (data.correlation_id) correlationIds.push(data.correlation_id);
+      const genericTroubleReply = isGenericTroubleReply(data.reply);
+      const placeholderReply = isProgressPlaceholderReply(data.reply);
+      const unhealthyReply = genericTroubleReply || placeholderReply;
       turns.push({
         turn: i + 1,
         message,
-        ok: true,
+        ok: !unhealthyReply,
         latency_ms: latencyMs,
         reply: data.reply,
+        ...genericTroubleReply ? {
+          reason_code: "widget_generic_trouble_reply",
+          error: "Widget returned a generic trouble reply instead of advancing the customer request."
+        } : placeholderReply ? {
+          reason_code: "widget_progress_placeholder_reply",
+          error: "Widget returned a placeholder holding reply instead of advancing the customer request."
+        } : {},
         conversation_id: data.conversationId,
         trace_id: data.trace_id ?? null,
         correlation_id: data.correlation_id ?? null,
@@ -15252,6 +15851,119 @@ async function runWidgetSmoke(publicKey, apiUrlOverride) {
     turns
   };
 }
+async function runWidgetSemanticEval(publicKey, apiUrlOverride, originOverride, profile) {
+  const pack = resolveSemanticEvalPack(profile);
+  if (!pack) {
+    return {
+      pack_id: null,
+      passed: 0,
+      failed: 0,
+      turns: []
+    };
+  }
+  const turns = [];
+  for (const scenario of pack.scenarios) {
+    try {
+      const data = await postPublicWidgetInbound({
+        channel_public_key: publicKey,
+        message_body: scenario.message
+      }, apiUrlOverride, originOverride);
+      const reply = String(data.reply || "");
+      const missingRequired = !matchAnyTerms(reply, scenario.required_any);
+      const foundForbidden = matchForbiddenTerms(reply, scenario.forbidden_any);
+      const ok = !missingRequired && !foundForbidden && !isGenericTroubleReply(reply) && !isProgressPlaceholderReply(reply);
+      turns.push({
+        scenario_id: scenario.id,
+        ok,
+        message: scenario.message,
+        reply,
+        ...ok ? {} : {
+          reason_code: missingRequired ? "widget_semantic_required_terms_missing" : foundForbidden ? "widget_semantic_forbidden_terms_found" : isGenericTroubleReply(reply) ? "widget_generic_trouble_reply" : "widget_progress_placeholder_reply"
+        },
+        trace_id: data.trace_id ?? null,
+        correlation_id: data.correlation_id ?? null
+      });
+    } catch (err) {
+      turns.push({
+        scenario_id: scenario.id,
+        ok: false,
+        message: scenario.message,
+        error: err?.message || String(err),
+        reason_code: "widget_semantic_request_failed"
+      });
+    }
+  }
+  return {
+    pack_id: pack.id,
+    passed: turns.filter((turn) => turn.ok).length,
+    failed: turns.filter((turn) => !turn.ok).length,
+    turns
+  };
+}
+async function runWidgetInstallVerification(publicKey, apiUrlOverride, originOverride) {
+  const checks = [];
+  try {
+    const config2 = await fetchPublicWidgetInstallVerification(publicKey, apiUrlOverride, originOverride);
+    checks.push({
+      name: "install_config",
+      status: "pass",
+      reason_code: "install_config_ok",
+      summary: "Public install verification config is reachable and the origin passed the domain gate.",
+      detail: config2
+    });
+  } catch (error2) {
+    checks.push({
+      name: "install_config",
+      status: "fail",
+      reason_code: error2?.detail?.code === "domain_not_allowed" ? "domain_not_allowed" : error2?.detail?.code === "invalid_widget_public_key" ? "invalid_widget_public_key" : "install_config_request_failed",
+      summary: error2?.message || String(error2),
+      detail: error2?.detail || null,
+      next_command: "Confirm the live site origin and widget public key, then rerun verification."
+    });
+    checks.push({
+      name: "widget_smoke",
+      status: "skipped",
+      reason_code: "install_config_required",
+      summary: "Skipped because install-config verification failed.",
+      next_command: "Fix install-config verification first, then rerun this command."
+    });
+    return {
+      schema_version: "foh_widget_public_install_verification.v1",
+      status: "fail",
+      widget_public_key: publicKey,
+      origin: originOverride ?? null,
+      checks
+    };
+  }
+  const smoke = await runWidgetSmoke(publicKey, apiUrlOverride, originOverride);
+  if (smoke.failed > 0) {
+    checks.push({
+      name: "widget_smoke",
+      status: "fail",
+      reason_code: "widget_smoke_failed",
+      summary: `${smoke.failed} widget smoke turn(s) failed.`,
+      detail: smoke,
+      next_command: `Run: foh widget smoke --channel ${publicKey} --json${originOverride ? ` --origin ${originOverride}` : ""}`
+    });
+  } else {
+    checks.push({
+      name: "widget_smoke",
+      status: "pass",
+      reason_code: "widget_smoke_ok",
+      summary: "Widget smoke passed from the public builder-install path.",
+      detail: smoke
+    });
+  }
+  return {
+    schema_version: "foh_widget_public_install_verification.v1",
+    status: checks.some((check2) => check2.status === "fail") ? "fail" : "pass",
+    widget_public_key: publicKey,
+    origin: originOverride ?? null,
+    checks
+  };
+}
+
+// src/commands/widget.ts
 function registerWidget(program3) {
   const widget = program3.command("widget").description("Manage the web widget channel");
   widget.command("ensure").description("Ensure a widget channel exists for an agent (idempotent)").requiredOption("--agent <id>", "Agent ID").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
@@ -15265,9 +15977,9 @@ function registerWidget(program3) {
   }));
   widget.command("set-domains").description("Update widget domain allowlist (idempotent)").requiredOption("--domains <d1,d2>", "Comma-separated domain list").requiredOption("--agent <id>", "Agent ID").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
     const domains = opts.domains.split(",").map((domain2) => domain2.trim());
-    const data = await apiFetch(`/v1/console/agents/${opts.agent}/draft`, {
-      method: "PATCH",
-      body: JSON.stringify({ allowed_domains: domains }),
+    const data = await apiFetch("/v1/console/channels/widget/domains", {
+      method: "POST",
+      body: JSON.stringify({ agentId: opts.agent, domains }),
       orgId: opts.org,
       apiUrlOverride: opts.apiUrl
     });
@@ -15285,8 +15997,47 @@ function registerWidget(program3) {
       process.stdout.write(data.snippet + "\n");
     }
   }));
+  widget.command("install-link").description("Mint a short-lived one-time website install link for an agent").requiredOption("--agent <id>", "Agent ID").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--domains <d1,d2>", "Optional comma-separated widget domain allowlist to set before minting").option("--expires-in <seconds>", "Install-link TTL in seconds", "3600").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    const domains = typeof opts.domains === "string" ? opts.domains.split(",").map((domain2) => domain2.trim()).filter(Boolean) : [];
+    const data = await apiFetch("/v1/console/channels/widget/install-link", {
+      method: "POST",
+      body: JSON.stringify({
+        agentId: opts.agent,
+        expiresInSec: Number(opts.expiresIn),
+        ...domains.length > 0 ? { domains } : {}
+      }),
+      orgId: opts.org,
+      apiUrlOverride: opts.apiUrl
+    });
+    const installUrl = typeof data?.install_url === "string" ? String(data.install_url) : null;
+    if (installUrl && domains.length > 0) {
+      const url2 = new URL(installUrl);
+      url2.searchParams.delete("domains");
+      for (const domain2 of domains) {
+        url2.searchParams.append("domains", domain2);
+      }
+      ;
+      data.install_url = url2.toString();
+      data.domains = domains;
+    }
+    format(data, { json: opts.json ?? false });
+  }));
+  widget.command("install-site").description("Install or update the hosted widget snippet in a static/Vite website shell").option("--agent <id>", "Agent ID; required unless --snippet is supplied").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--domains <d1,d2>", "Optional comma-separated widget domain allowlist").option("--site-root <path>", "Website repository root", ".").option("--target <path>", "HTML shell to patch, relative to --site-root").option("--snippet <html>", "Embed snippet to install without calling the FOH API").option("--api-url <url>", "API base URL override").option("--dry-run", "Resolve and report the patch without writing the file").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    const domains = typeof opts.domains === "string" ? opts.domains.split(",").map((domain2) => domain2.trim()).filter(Boolean) : [];
+    const result = await installWidgetSite({
+      agent: opts.agent,
+      org: opts.org,
+      domains,
+      siteRoot: opts.siteRoot,
+      target: opts.target,
+      snippet: opts.snippet,
+      apiUrl: opts.apiUrl,
+      dryRun: opts.dryRun
+    });
+    format(result, { json: opts.json ?? false });
+  }));
   widget.command("chat").description("Send a single message through the widget and return the reply").requiredOption("--agent <id>", "Agent ID").requiredOption("--message <text>", "Message to send").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
-    const publicKey = await resolveChannelPublicKey(opts.agent, opts.org, opts.apiUrl);
+    const publicKey = await ensureWidgetChannelPublicKey(opts.agent, opts.org, opts.apiUrl);
     const start = Date.now();
     const data = await apiFetch("/v1/widget/inbound", {
       method: "POST",
@@ -15307,12 +16058,52 @@ function registerWidget(program3) {
     };
     format(result, { json: opts.json ?? false });
   }));
-  widget.command("smoke").description("Run a canned 3-turn conversation to verify end-to-end widget health").requiredOption("--agent <id>", "Agent ID").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
-    const publicKey = await resolveChannelPublicKey(opts.agent, opts.org, opts.apiUrl);
-    const summary = await runWidgetSmoke(publicKey, opts.apiUrl);
+  widget.command("smoke").description("Run a canned 3-turn conversation to verify end-to-end widget health").option("--agent <id>", "Agent ID").option("--channel <publicKey>", "Widget public key; skips operator auth").option("--origin <urlOrHost>", "Website origin to simulate for domain allowlists, e.g. https://www.example.com").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    const publicKey = typeof opts.channel === "string" && opts.channel.trim() ? opts.channel.trim() : opts.agent ? await ensureWidgetChannelPublicKey(opts.agent, opts.org, opts.apiUrl) : null;
+    if (!publicKey) {
+      throw new FohError({
+        step: "widget.smoke",
+        error: "Missing --agent or --channel.",
+        remediation: "Run: foh widget smoke --channel <public-key> --json, or foh widget smoke --agent <agent-id> --json"
+      });
+    }
+    const origin = normalizeOrigin(typeof opts.origin === "string" ? opts.origin : void 0);
+    const summary = await runWidgetSmoke(publicKey, opts.apiUrl, origin);
     format(summary, { json: opts.json ?? false });
     if (summary.failed > 0) markCommandFailed(1);
   }));
+  widget.command("verify-install").description("Run the public builder-install verification path: config/domain gate plus runtime smoke").option("--agent <id>", "Agent ID").option("--channel <publicKey>", "Widget public key; skips operator auth").option("--origin <urlOrHost>", "Live website origin to verify against, e.g. https://www.example.com").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    const publicKey = typeof opts.channel === "string" && opts.channel.trim() ? opts.channel.trim() : opts.agent ? await ensureWidgetChannelPublicKey(opts.agent, opts.org, opts.apiUrl) : null;
+    if (!publicKey) {
+      throw new FohError({
+        step: "widget.verify_install",
+        error: "Missing --agent or --channel.",
+        remediation: "Run: foh widget verify-install --channel <public-key> --origin https://www.example.com --json"
+      });
+    }
+    const origin = normalizeOrigin(typeof opts.origin === "string" ? opts.origin : void 0);
+    const summary = await runWidgetInstallVerification(publicKey, opts.apiUrl, origin);
+    format(summary, { json: opts.json ?? false });
+    if (summary.status !== "pass") markCommandFailed(1);
+  }));
+  widget.command("wordpress-plugin").description("Generate a preconfigured WordPress plugin bundle for the hosted widget").option("--agent <id>", "Agent ID").option("--channel <publicKey>", "Widget public key; skips operator auth").requiredOption("--out <path>", "Output directory or .zip path for the plugin bundle").option("--plugin-name <name>", "WordPress plugin display name", DEFAULT_WORDPRESS_PLUGIN_NAME).option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--dry-run", "Resolve the bundle without writing files").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    const publicKey = typeof opts.channel === "string" && opts.channel.trim() ? opts.channel.trim() : opts.agent ? await ensureWidgetChannelPublicKey(opts.agent, opts.org, opts.apiUrl) : null;
+    if (!publicKey) {
+      throw new FohError({
+        step: "widget.wordpress_plugin",
+        error: "Missing --agent or --channel.",
+        remediation: "Run: foh widget wordpress-plugin --channel <public-key> --out <path> --json"
+      });
+    }
+    const result = buildWordPressPluginBundle({
+      publicKey,
+      apiUrl: opts.apiUrl,
+      outPath: opts.out,
+      pluginName: opts.pluginName,
+      dryRun: Boolean(opts.dryRun)
+    });
+    format(result, { json: opts.json ?? false });
+  }));
 }
 
 // src/commands/channel-instagram.ts
@@ -15400,7 +16191,7 @@ function buildReasonedNextSteps({
   const verifyTokenValue = verifyToken || "<verify_token>";
   if (has("whatsapp_channel_not_ready") || has("whatsapp_access_token_missing") || has("whatsapp_verify_token_missing") || has("whatsapp_app_secret_missing")) {
     steps.push(
-      "Connect/update channel credentials: foh channel whatsapp connect --phone-number-id <meta_phone_number_id> --access-token <meta_access_token> --verify-token <verify_token> --app-secret <meta_app_secret>"
+      "Connect/update channel credentials: foh channel whatsapp onboard --phone-number-id <meta_phone_number_id> --access-token <meta_access_token> --verify-token <verify_token> --app-secret <meta_app_secret>"
     );
   }
   if (has("whatsapp_verify_check_failed") || has("whatsapp_webhook_challenge_failed")) {
@@ -15419,8 +16210,8 @@ function buildReasonedNextSteps({
 }
 
 // src/commands/channel-whatsapp-live-proof.ts
-var import_node_fs = require("node:fs");
-var path = __toESM(require("node:path"));
+var import_node_fs3 = require("node:fs");
+var path3 = __toESM(require("node:path"));
 
 // src/lib/channel-live-proof-evaluator.mjs
 function normalizeStatusValue(value) {
@@ -15505,8 +16296,8 @@ function resolveLiveProof({
       freshness: { timestamp_field: null, timestamp: null, age_hours: null, max_age_hours: maxAgeHours }
     };
   }
-  const artifactPath = path.resolve(process.cwd(), artifactPathRaw);
-  if (!(0, import_node_fs.existsSync)(artifactPath)) {
+  const artifactPath = path3.resolve(process.cwd(), artifactPathRaw);
+  if (!(0, import_node_fs3.existsSync)(artifactPath)) {
     return {
       requested: true,
       artifact_path: artifactPath,
@@ -15518,7 +16309,7 @@ function resolveLiveProof({
   }
   let payload;
   try {
-    payload = JSON.parse((0, import_node_fs.readFileSync)(artifactPath, "utf8"));
+    payload = JSON.parse((0, import_node_fs3.readFileSync)(artifactPath, "utf8"));
   } catch {
     return {
       requested: true,
@@ -15547,7 +16338,7 @@ function resolveLiveProof({
 }
 
 // src/commands/channel-whatsapp-onboarding.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs4 = require("node:fs");
 
 // src/commands/channel-whatsapp-setup.ts
 var import_node_crypto = require("node:crypto");
@@ -15676,24 +16467,6 @@ async function runWhatsAppOnboardingSession(params) {
     apiUrlOverride: params.apiUrl
   });
 }
-function emitLegacyCommandNotice({
-  command,
-  canonical,
-  jsonMode
-}) {
-  if (!jsonMode) {
-    process.stderr.write(
-      `[deprecated] foh channel whatsapp ${command} is a compatibility wrapper.
-Use: ${canonical}
-`
-    );
-  }
-  return {
-    command,
-    canonical,
-    status: "deprecated_compat_wrapper"
-  };
-}
 function parseBatchManifest(manifestPathRaw) {
   const manifestPath = String(manifestPathRaw || "").trim();
   if (!manifestPath) {
@@ -15704,7 +16477,7 @@ function parseBatchManifest(manifestPathRaw) {
     });
   }
   try {
-    const raw = (0, import_node_fs2.readFileSync)(manifestPath, "utf8");
+    const raw = (0, import_node_fs4.readFileSync)(manifestPath, "utf8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed.businesses) || parsed.businesses.length === 0) {
       throw new Error("manifest_missing_businesses");
@@ -15843,51 +16616,10 @@ async function runWhatsAppOnboardingWizard(opts) {
   throw new FohError({
     step: "channel.whatsapp.onboard",
     error: "Unable to complete WhatsApp onboarding after guided retries.",
-    remediation: "Run again with --phone-number-id and --waba-id, or use `foh channel whatsapp start` for deterministic next steps."
+    remediation: "Run again with --phone-number-id and --waba-id, or use `foh channel whatsapp guide` for deterministic next steps."
   });
 }
 function registerWhatsAppOnboardingCommands(whatsapp, addCommonOptions) {
-  addCommonOptions(
-    whatsapp.command("start").description("[Deprecated wrapper] Start onboarding using the canonical session flow")
-  ).option("--access-token <token>", "Meta access token with WhatsApp Business access").option("--waba-id <id>", "Optional explicit WhatsApp Business Account id when /me discovery is restricted").option("--phone-number-id <id>", "Optional explicit phone number id when discovery returns multiple candidates").option("--agent-id <id>", "Agent to bind to the WhatsApp channel").option("--verify-token <token>", "Optional webhook verify token (auto-generated when omitted)").option("--app-secret <secret>", "Optional Meta app secret (required for full signature-ready closure)").option("--business-slug <slug>", "Business identifier for operator-level targeting").option("--audio-enabled <bool>", "Enable inbound WhatsApp audio fallback auto-reply (true/false)", "true").option("--wizard", "Run guided onboarding with automatic recovery prompts").action(async (opts) => withCommandErrorHandling(async () => {
-    const accessToken = String(opts.accessToken || "").trim();
-    const useWizard = Boolean(opts.wizard) || !accessToken;
-    const legacy = emitLegacyCommandNotice({
-      command: "start",
-      canonical: "foh channel whatsapp onboard --wizard",
-      jsonMode: Boolean(opts.json)
-    });
-    const data = useWizard ? await runWhatsAppOnboardingWizard({
-      ...opts,
-      dryRun: true
-    }) : await runWhatsAppOnboardingSession({
-      orgId: opts.org,
-      apiUrl: opts.apiUrl,
-      accessToken,
-      wabaId: String(opts.wabaId || "").trim() || void 0,
-      phoneNumberId: String(opts.phoneNumberId || "").trim() || void 0,
-      verifyToken: String(opts.verifyToken || "").trim() || void 0,
-      appSecret: String(opts.appSecret || "").trim() || void 0,
-      agentId: opts.agentId,
-      businessSlug: opts.businessSlug,
-      audioEnabled: parseBooleanOption({
-        value: opts.audioEnabled,
-        fallback: true,
-        optionName: "--audio-enabled",
-        step: "channel.whatsapp.start"
-      }),
-      dryRun: true
-    });
-    format({
-      ...data,
-      legacy_wrapper: legacy,
-      next_steps: dedupeSteps([
-        "Run canonical onboarding apply flow: foh channel whatsapp onboard --wizard",
-        "Run deterministic closure: foh channel whatsapp proof --strict",
-        "Capture live provider evidence: corepack pnpm ops:whatsapp:proof:live"
-      ])
-    }, { json: opts.json ?? false });
-  }));
   addCommonOptions(
     whatsapp.command("onboard").description("Run one-session WhatsApp onboarding (discover -> bind -> verify -> prove)")
   ).option("--access-token <token>", "Meta access token with WhatsApp Business access").option("--waba-id <id>", "Optional explicit WhatsApp Business Account id when /me discovery is restricted").option("--phone-number-id <id>", "Optional explicit phone number id when discovery returns multiple candidates").option("--verify-token <token>", "Optional webhook verify token (auto-generated when omitted)").option("--app-secret <secret>", "Optional Meta app secret (required for full signature-ready closure)").option("--agent-id <id>", "Agent to bind to the WhatsApp channel").option("--business-slug <slug>", "Business identifier for operator-level targeting").option("--audio-enabled <bool>", "Enable inbound WhatsApp audio fallback auto-reply (true/false)", "true").option("--dry-run", "Run discovery/binding preflight without writing channel config").option("--wizard", "Run guided onboarding with automatic recovery prompts").action(async (opts) => withCommandErrorHandling(async () => {
@@ -15993,75 +16725,6 @@ function registerWhatsAppOnboardingCommands(whatsapp, addCommonOptions) {
       results
     }, { json: opts.json ?? false });
   }));
-  addCommonOptions(
-    whatsapp.command("setup").description("[Deprecated wrapper] Use canonical onboarding session flow")
-  ).option("--phone-number-id <id>", "Meta WhatsApp phone number id").option("--access-token <token>", "Meta access token").option("--verify-token <token>", "Webhook verify token").option("--app-secret <secret>", "Meta app secret for signature verification").option("--agent-id <id>", "Agent to bind to the WhatsApp channel").option("--audio-enabled <bool>", "Enable inbound WhatsApp audio fallback auto-reply (true/false)").option("--generate-verify-token", "Generate webhook verify token automatically when missing").option("--business-slug <slug>", "Business identifier for operator-level targeting").option("--wizard", "Run guided setup wizard prompts").action(async (opts) => withCommandErrorHandling(async () => {
-    const legacy = emitLegacyCommandNotice({
-      command: "setup",
-      canonical: "foh channel whatsapp onboard --wizard",
-      jsonMode: Boolean(opts.json)
-    });
-    const useWizard = Boolean(opts.wizard) || !String(opts.accessToken || "").trim();
-    const generatedVerifyToken = String(opts.verifyToken || "").trim() || (Boolean(opts.generateVerifyToken) ? generateVerifyToken() : "");
-    const data = useWizard ? await runWhatsAppOnboardingWizard({
-      ...opts,
-      verifyToken: generatedVerifyToken || void 0,
-      dryRun: false
-    }) : await runWhatsAppOnboardingSession({
-      orgId: opts.org,
-      apiUrl: opts.apiUrl,
-      accessToken: String(opts.accessToken || "").trim(),
-      wabaId: void 0,
-      phoneNumberId: String(opts.phoneNumberId || "").trim() || void 0,
-      verifyToken: generatedVerifyToken || void 0,
-      appSecret: String(opts.appSecret || "").trim() || void 0,
-      agentId: opts.agentId,
-      businessSlug: String(opts.businessSlug || "").trim() || void 0,
-      audioEnabled: parseBooleanOption({
-        value: opts.audioEnabled,
-        fallback: true,
-        optionName: "--audio-enabled",
-        step: "channel.whatsapp.setup"
-      }),
-      dryRun: false
-    });
-    format({
-      ...data,
-      legacy_wrapper: legacy,
-      generated_verify_token: generatedVerifyToken && !opts.verifyToken ? generatedVerifyToken : null
-    }, { json: opts.json ?? false });
-  }));
-  addCommonOptions(
-    whatsapp.command("connect").description("[Deprecated wrapper] Use canonical onboarding session flow")
-  ).requiredOption("--phone-number-id <id>", "Meta WhatsApp phone number id").requiredOption("--access-token <token>", "Meta access token").option("--agent-id <id>", "Agent to bind to the WhatsApp channel").option("--verify-token <token>", "Webhook verify token").option("--app-secret <secret>", "Meta app secret for signature verification").option("--business-slug <slug>", "Business identifier for operator-level targeting").option("--audio-enabled <bool>", "Enable inbound WhatsApp audio fallback auto-reply (true/false)", "true").action(async (opts) => withCommandErrorHandling(async () => {
-    const legacy = emitLegacyCommandNotice({
-      command: "connect",
-      canonical: "foh channel whatsapp onboard --access-token <token> --phone-number-id <id>",
-      jsonMode: Boolean(opts.json)
-    });
-    const data = await runWhatsAppOnboardingSession({
-      orgId: opts.org,
-      apiUrl: opts.apiUrl,
-      accessToken: String(opts.accessToken || "").trim(),
-      wabaId: void 0,
-      phoneNumberId: String(opts.phoneNumberId || "").trim() || void 0,
-      verifyToken: String(opts.verifyToken || "").trim() || void 0,
-      appSecret: String(opts.appSecret || "").trim() || void 0,
-      agentId: opts.agentId,
-      businessSlug: String(opts.businessSlug || "").trim() || void 0,
-      audioEnabled: parseBooleanOption({
-        value: opts.audioEnabled,
-        fallback: true,
-        optionName: "--audio-enabled",
-        step: "channel.whatsapp.connect"
-      }),
-      dryRun: false
-    });
-    format({
-      ...data,
-      legacy_wrapper: legacy
-    }, { json: opts.json ?? false });
-  }));
 }
 
 // src/commands/channel-whatsapp.ts
@@ -16632,7 +17295,7 @@ function registerTools(program3) {
 }
 
 // src/commands/mcp-serve.ts
-var import_node_child_process = require("node:child_process");
+var import_node_child_process2 = require("node:child_process");
 
 // ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v3/helpers/util.js
 var util;
@@ -16993,8 +17656,8 @@ function getErrorMap() {
 
 // ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path2, errorMaps, issueData } = params;
-  const fullPath = [...path2, ...issueData.path || []];
+  const { data, path: path5, errorMaps, issueData } = params;
+  const fullPath = [...path5, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -17109,11 +17772,11 @@ var errorUtil;
 
 // ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path2, key) {
+  constructor(parent, value, path5, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path2;
+    this._path = path5;
     this._key = key;
   }
   get path() {
@@ -20611,7 +21274,7 @@ __export(util_exports, {
   createTransparentProxy: () => createTransparentProxy,
   defineLazy: () => defineLazy,
   esc: () => esc,
-  escapeRegex: () => escapeRegex,
+  escapeRegex: () => escapeRegex2,
   extend: () => extend3,
   finalizeIssue: () => finalizeIssue,
   floatSafeRemainder: () => floatSafeRemainder2,
@@ -20759,10 +21422,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema2) {
   return mergeDefs(schema2._zod.def);
 }
-function getElementAtPath(obj, path2) {
-  if (!path2)
+function getElementAtPath(obj, path5) {
+  if (!path5)
     return obj;
-  return path2.reduce((acc, key) => acc?.[key], obj);
+  return path5.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -20884,7 +21547,7 @@ var getParsedType2 = (data) => {
 };
 var propertyKeyTypes = /* @__PURE__ */ new Set(["string", "number", "symbol"]);
 var primitiveTypes = /* @__PURE__ */ new Set(["string", "number", "bigint", "boolean", "symbol", "undefined"]);
-function escapeRegex(str2) {
+function escapeRegex2(str2) {
   return str2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
@@ -21145,11 +21808,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path2, issues) {
+function prefixIssues(path5, issues) {
   return issues.map((iss) => {
     var _a2;
     (_a2 = iss).path ?? (_a2.path = []);
-    iss.path.unshift(path2);
+    iss.path.unshift(path5);
     return iss;
   });
 }
@@ -21503,7 +22166,7 @@ function emoji() {
 var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
 var mac = (delimiter) => {
-  const escapedDelim = escapeRegex(delimiter ?? ":");
+  const escapedDelim = escapeRegex2(delimiter ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 };
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -22004,7 +22667,7 @@ var $ZodCheckUpperCase = /* @__PURE__ */ $constructor("$ZodCheckUpperCase", (ins
 });
 var $ZodCheckIncludes = /* @__PURE__ */ $constructor("$ZodCheckIncludes", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const escapedRegex = escapeRegex(def.includes);
+  const escapedRegex = escapeRegex2(def.includes);
   const pattern = new RegExp(typeof def.position === "number" ? `^.{${def.position}}${escapedRegex}` : escapedRegex);
   def.pattern = pattern;
   inst._zod.onattach.push((inst2) => {
@@ -22028,7 +22691,7 @@ var $ZodCheckIncludes = /* @__PURE__ */ $constructor("$ZodCheckIncludes", (inst,
 });
 var $ZodCheckStartsWith = /* @__PURE__ */ $constructor("$ZodCheckStartsWith", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);
+  const pattern = new RegExp(`^${escapeRegex2(def.prefix)}.*`);
   def.pattern ?? (def.pattern = pattern);
   inst._zod.onattach.push((inst2) => {
     const bag = inst2._zod.bag;
@@ -22051,7 +22714,7 @@ var $ZodCheckStartsWith = /* @__PURE__ */ $constructor("$ZodCheckStartsWith", (i
 });
 var $ZodCheckEndsWith = /* @__PURE__ */ $constructor("$ZodCheckEndsWith", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);
+  const pattern = new RegExp(`.*${escapeRegex2(def.suffix)}$`);
   def.pattern ?? (def.pattern = pattern);
   inst._zod.onattach.push((inst2) => {
     const bag = inst2._zod.bag;
@@ -23593,7 +24256,7 @@ var $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
   const values = getEnumValues(def.entries);
   const valuesSet = new Set(values);
   inst._zod.values = valuesSet;
-  inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex(o) : o.toString()).join("|")})$`);
+  inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex2(o) : o.toString()).join("|")})$`);
   inst._zod.parse = (payload, _ctx) => {
     const input = payload.value;
     if (valuesSet.has(input)) {
@@ -23615,7 +24278,7 @@ var $ZodLiteral = /* @__PURE__ */ $constructor("$ZodLiteral", (inst, def) => {
   }
   const values = new Set(def.values);
   inst._zod.values = values;
-  inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$`);
+  inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex2(o) : o ? escapeRegex2(o.toString()) : String(o)).join("|")})$`);
   inst._zod.parse = (payload, _ctx) => {
     const input = payload.value;
     if (values.has(input)) {
@@ -23971,7 +24634,7 @@ var $ZodTemplateLiteral = /* @__PURE__ */ $constructor("$ZodTemplateLiteral", (i
       const end = source.endsWith("$") ? source.length - 1 : source.length;
       regexParts.push(source.slice(start, end));
     } else if (part === null || primitiveTypes.has(typeof part)) {
-      regexParts.push(escapeRegex(`${part}`));
+      regexParts.push(escapeRegex2(`${part}`));
     } else {
       throw new Error(`Invalid template literal part: ${part}`);
     }
@@ -33060,7 +33723,7 @@ var StdioServerTransport = class {
 };
 
 // src/lib/cli-version.ts
-var injectedVersion = true ? String("0.1.87").trim() : "";
+var injectedVersion = true ? String("0.1.89").trim() : "";
 var envVersion = String(process.env.FOH_CLI_VERSION || process.env.npm_package_version || "").trim();
 var CLI_VERSION = injectedVersion || envVersion || "0.0.0-dev";
 
@@ -33248,7 +33911,7 @@ async function runFohCli(params) {
   }
   const command = `foh ${effectiveArgv.join(" ")}`;
   return await new Promise((resolve16) => {
-    const child = (0, import_node_child_process.spawn)(process.execPath, [cliEntry, ...effectiveArgv], {
+    const child = (0, import_node_child_process2.spawn)(process.execPath, [cliEntry, ...effectiveArgv], {
       stdio: ["ignore", "pipe", "pipe"],
       env: {
         ...process.env,
@@ -33326,6 +33989,19 @@ var TOOL_EXECUTION_SCHEMA = {
 var APPROVAL_TOKEN_SCHEMA = {
   approval_token: string2().min(1).max(256).optional()
 };
+var MCP_OBJECTIVE_INDUSTRIES = ["real_estate", "restaurant", "general"];
+var MCP_TEMPLATE_CATEGORIES = ["buyer", "seller", "landlord", "commercial"];
+var MCP_PROOF_MISSIONS = ["setup", "widget", "voice", "publish"];
+var MCP_CONTACT_PATHS = ["auto", "managed", "byon"];
+var MCP_MUTATION_MODES = ["read-only", "ensure"];
+function appendOptionalArg(argv, flag, value) {
+  const text = asOptionalString(value);
+  if (text) argv.push(flag, text);
+}
+function appendOptionalCsvArg(argv, flag, value) {
+  const values = asStringArray(value);
+  if (values.length > 0) argv.push(flag, values.join(","));
+}
 var TYPED_TOOL_SPECS = [
   {
     name: "foh_auth_whoami",
@@ -33382,6 +34058,193 @@ var TYPED_TOOL_SPECS = [
       return argv;
     }
   },
+  {
+    name: "foh_templates_list",
+    title: "FOH Templates List",
+    description: "List available setup templates, optionally filtered by category.",
+    commandKey: "templates list",
+    risk: "read",
+    inputSchema: {
+      category: _enum(MCP_TEMPLATE_CATEGORIES).optional(),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = ["templates", "list"];
+      appendOptionalArg(argv, "--category", args.category);
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
+  {
+    name: "foh_templates_show",
+    title: "FOH Templates Show",
+    description: "Show a setup template before applying it.",
+    commandKey: "templates show",
+    risk: "read",
+    inputSchema: {
+      template: string2().min(1).max(128),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = ["templates", "show", "--template", String(args.template)];
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
+  {
+    name: "foh_templates_select",
+    title: "FOH Templates Select",
+    description: "Select candidate templates from a business requirement brief JSON string.",
+    commandKey: "templates select",
+    risk: "read",
+    inputSchema: {
+      brief_json: string2().min(2).max(5e4),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = ["templates", "select", "--brief", String(args.brief_json)];
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
+  {
+    name: "foh_setup_objective",
+    title: "FOH Setup Objective",
+    description: "Plan objective-first setup from explicit business inputs without applying changes.",
+    commandKey: "setup",
+    risk: "read",
+    inputSchema: {
+      objective: string2().min(1).max(1e3),
+      business_name: string2().min(1).max(256),
+      industry: _enum(MCP_OBJECTIVE_INDUSTRIES),
+      source_url: string2().url(),
+      location: string2().min(1).max(256).optional(),
+      tools: array(string2().min(1)).min(1).max(20).optional(),
+      target_mode: string2().min(1).max(128).optional(),
+      org: string2().uuid().optional(),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = [
+        "setup",
+        "--objective",
+        String(args.objective),
+        "--business-name",
+        String(args.business_name),
+        "--industry",
+        String(args.industry),
+        "--source-url",
+        String(args.source_url)
+      ];
+      appendOptionalArg(argv, "--location", args.location);
+      appendOptionalCsvArg(argv, "--tools", args.tools);
+      appendOptionalArg(argv, "--target-mode", args.target_mode);
+      appendOptionalArg(argv, "--org", args.org);
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
+  {
+    name: "foh_objective_status",
+    title: "FOH Objective Status",
+    description: "Compose setup and launch evidence into one objective status envelope.",
+    commandKey: "objective status",
+    risk: "read",
+    inputSchema: {
+      business_name: string2().min(1).max(256),
+      source_url: string2().url(),
+      industry: _enum(MCP_OBJECTIVE_INDUSTRIES).optional(),
+      business_objective: string2().min(1).max(1e3).optional(),
+      location: string2().min(1).max(256).optional(),
+      tools: array(string2().min(1)).min(1).max(20).optional(),
+      target_mode: string2().min(1).max(128).optional(),
+      environment: string2().min(1).max(128).optional(),
+      org: string2().uuid().optional(),
+      out: string2().min(1).max(1024).optional(),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = ["objective", "status", "--business-name", String(args.business_name), "--source-url", String(args.source_url)];
+      appendOptionalArg(argv, "--industry", args.industry);
+      appendOptionalArg(argv, "--business-objective", args.business_objective);
+      appendOptionalArg(argv, "--location", args.location);
+      appendOptionalCsvArg(argv, "--tools", args.tools);
+      appendOptionalArg(argv, "--target-mode", args.target_mode);
+      appendOptionalArg(argv, "--environment", args.environment);
+      appendOptionalArg(argv, "--org", args.org);
+      appendOptionalArg(argv, "--out", args.out);
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
+  {
+    name: "foh_objective_prove",
+    title: "FOH Objective Prove",
+    description: "Run objective proof status against the customer-live gate.",
+    commandKey: "objective prove",
+    risk: "read",
+    inputSchema: {
+      business_name: string2().min(1).max(256),
+      source_url: string2().url(),
+      industry: _enum(MCP_OBJECTIVE_INDUSTRIES).optional(),
+      business_objective: string2().min(1).max(1e3).optional(),
+      location: string2().min(1).max(256).optional(),
+      tools: array(string2().min(1)).min(1).max(20).optional(),
+      target_mode: string2().min(1).max(128).optional(),
+      environment: string2().min(1).max(128).optional(),
+      org: string2().uuid().optional(),
+      out: string2().min(1).max(1024).optional(),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = ["objective", "prove", "--business-name", String(args.business_name), "--source-url", String(args.source_url)];
+      appendOptionalArg(argv, "--industry", args.industry);
+      appendOptionalArg(argv, "--business-objective", args.business_objective);
+      appendOptionalArg(argv, "--location", args.location);
+      appendOptionalCsvArg(argv, "--tools", args.tools);
+      appendOptionalArg(argv, "--target-mode", args.target_mode);
+      appendOptionalArg(argv, "--environment", args.environment);
+      appendOptionalArg(argv, "--org", args.org);
+      appendOptionalArg(argv, "--out", args.out);
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
+  {
+    name: "foh_prove_agent",
+    title: "FOH Prove Agent",
+    description: "Produce a setup/runtime proof bundle for an agent.",
+    commandKey: "prove",
+    risk: "read",
+    inputSchema: {
+      agent: string2().min(1).max(128).optional(),
+      org: string2().uuid().optional(),
+      mission: _enum(MCP_PROOF_MISSIONS).optional(),
+      contact_path: _enum(MCP_CONTACT_PATHS).optional(),
+      mutation_mode: _enum(MCP_MUTATION_MODES).optional(),
+      require_phone: boolean2().optional(),
+      skip_smoke: boolean2().optional(),
+      skip_voice_health: boolean2().optional(),
+      out: string2().min(1).max(1024).optional(),
+      strict: boolean2().optional(),
+      api_url: string2().url().optional()
+    },
+    toArgv: (args) => {
+      const argv = ["prove"];
+      appendOptionalArg(argv, "--agent", args.agent);
+      appendOptionalArg(argv, "--org", args.org);
+      appendOptionalArg(argv, "--mission", args.mission);
+      appendOptionalArg(argv, "--contact-path", args.contact_path);
+      appendOptionalArg(argv, "--mutation-mode", args.mutation_mode);
+      if (asOptionalBoolean(args.require_phone) === true) argv.push("--require-phone");
+      if (asOptionalBoolean(args.skip_smoke) === true) argv.push("--skip-smoke");
+      if (asOptionalBoolean(args.skip_voice_health) === true) argv.push("--skip-voice-health");
+      appendOptionalArg(argv, "--out", args.out);
+      if (asOptionalBoolean(args.strict) === true) argv.push("--strict");
+      appendOptionalArg(argv, "--api-url", args.api_url);
+      return argv;
+    }
+  },
   {
     name: "foh_agent_list",
     title: "FOH Agent List",
@@ -34070,9 +34933,9 @@ function parsePositiveInt(value, fallback, min, max) {
   if (!Number.isFinite(parsed)) return fallback;
   return Math.max(min, Math.min(max, Math.trunc(parsed)));
 }
-function withQuery(path2, params) {
+function withQuery(path5, params) {
   const query = params.toString();
-  return query ? `${path2}?${query}` : path2;
+  return query ? `${path5}?${query}` : path5;
 }
 
 // src/commands/knowledge.ts
@@ -34864,8 +35727,8 @@ function signReport(reportPayload) {
     }
   };
 }
-function writeSignedJsonArtifact(path2, value) {
-  const absolutePath = (0, import_path3.resolve)(path2);
+function writeSignedJsonArtifact(path5, value) {
+  const absolutePath = (0, import_path3.resolve)(path5);
   (0, import_fs5.mkdirSync)((0, import_path3.dirname)(absolutePath), { recursive: true });
   (0, import_fs5.writeFileSync)(absolutePath, stableStringify(value), "utf-8");
   return absolutePath;
@@ -34882,8 +35745,190 @@ function writeSetupRunReport(reportPayload, reportOut) {
 }
 
 // src/commands/setup.ts
+var OBJECTIVE_SETUP_INDUSTRIES = ["real_estate", "restaurant", "general"];
+function normalizeString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function csv(value, fallback) {
+  return String(value || fallback).split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function objectiveChannels(tools) {
+  const allowed = /* @__PURE__ */ new Set(["widget", "voice", "whatsapp", "instagram", "sms"]);
+  const channels = tools.filter((tool) => allowed.has(tool));
+  return channels.length > 0 ? channels : ["widget"];
+}
+function objectiveOptimizationTarget(industry, objective) {
+  const text = objective.toLowerCase();
+  if (industry === "restaurant" || /book|booking|reservation|table/.test(text)) return "booking_rate";
+  if (/support|resolve|resolution/.test(text)) return "support_resolution";
+  if (/speed|lead|callback|call back/.test(text)) return "speed_to_lead";
+  return "lead_quality";
+}
+function objectiveSetupCommand(opts) {
+  const parts = [
+    "npx --yes @f-o-h/cli@latest setup",
+    `--objective ${JSON.stringify(normalizeString(opts.objective) || "<front-of-house objective>")}`,
+    `--business-name ${JSON.stringify(normalizeString(opts.businessName) || "<business name>")}`,
+    `--industry ${normalizeString(opts.industry) || "<real_estate|restaurant>"}`,
+    `--source-url ${JSON.stringify(normalizeString(opts.sourceUrl) || "<official url>")}`,
+    "--json"
+  ];
+  return parts.join(" ");
+}
+function selectedTemplateSummary(selection) {
+  const candidate = Array.isArray(selection?.candidates) ? selection.candidates[0] : null;
+  const template = candidate?.template;
+  const contract = template?.template_contract ?? {};
+  if (!template) return null;
+  return {
+    template_id: String(template.id || contract.template_id || ""),
+    template_name: String(template.name || contract.name || ""),
+    template_slug: String(contract.slug || ""),
+    industry: String(contract.industry || ""),
+    use_case: String(contract.use_case || ""),
+    match_score: Number.isFinite(Number(candidate.match_score)) ? Number(candidate.match_score) : null,
+    matched_reasons: Array.isArray(candidate.matched_reasons) ? candidate.matched_reasons.map(String) : []
+  };
+}
+async function emitObjectiveSetupBootstrap(opts) {
+  const businessName = normalizeString(opts.businessName);
+  const objective = normalizeString(opts.objective);
+  const industry = normalizeString(opts.industry);
+  const sourceUrl = normalizeString(opts.sourceUrl);
+  const tools = csv(opts.tools, "widget,voice,whatsapp");
+  let credentials = null;
+  try {
+    credentials = loadCredentials(opts.apiUrl);
+    if (!opts.org) opts.org = credentials.orgId;
+  } catch {
+    credentials = null;
+  }
+  if (!credentials && !opts.org) {
+    format({
+      schema_version: "foh_cli_objective_setup_bootstrap.v1",
+      ok: false,
+      status: "blocked",
+      reason_code: "auth_required",
+      summary: "Authenticate before objective setup so template selection and setup planning can use the correct org.",
+      spend_policy: resolveCliSpendPolicy(),
+      next_commands: [
+        "npx --yes @f-o-h/cli@latest auth signup --web --json",
+        "npx --yes @f-o-h/cli@latest auth login --web --json",
+        "npx --yes @f-o-h/cli@latest org list --json",
+        objectiveSetupCommand(opts)
+      ]
+    }, { json: opts.json ?? false });
+    markCommandFailed(1);
+    return;
+  }
+  const missing = [];
+  if (!businessName) missing.push("--business-name");
+  if (!industry) missing.push("--industry");
+  if (!objective) missing.push("--objective");
+  if (!sourceUrl) missing.push("--source-url");
+  if (industry && !OBJECTIVE_SETUP_INDUSTRIES.includes(industry)) missing.push("--industry:supported_value");
+  if (missing.length > 0) {
+    format({
+      schema_version: "foh_cli_objective_setup_bootstrap.v1",
+      ok: false,
+      status: "blocked",
+      reason_code: "objective_setup_required_options_missing",
+      summary: "Objective setup needs an explicit business name, industry, objective, and official source URL.",
+      missing_options: missing,
+      org_id: opts.org ?? null,
+      next_commands: [
+        objectiveSetupCommand(opts),
+        "npx --yes @f-o-h/cli@latest templates list --category general --json",
+        "npx --yes @f-o-h/cli@latest templates list --category buyer --json"
+      ],
+      claim_boundaries: {
+        customer_live_claim_allowed: false,
+        production_claim_allowed: false
+      }
+    }, { json: opts.json ?? false });
+    markCommandFailed(1);
+    return;
+  }
+  const brief = {
+    schema_version: "business_requirement_brief.v1",
+    business_name: businessName,
+    industry,
+    desired_use_cases: [objective],
+    channels: objectiveChannels(tools),
+    knowledge_sources: [{ type: "website", label: `${businessName} official website`, uri: sourceUrl }],
+    required_outcomes: [objective],
+    handoff_rules: ["handoff when approved facts, credentials, or action availability are missing"],
+    constraints: ["do not invent business facts or claim live readiness without accepted evidence"],
+    optimization_target: objectiveOptimizationTarget(industry, objective)
+  };
+  const templateSelection = await apiFetch("/v1/console/templates/select", {
+    method: "POST",
+    body: JSON.stringify(brief),
+    apiUrlOverride: opts.apiUrl
+  });
+  const selectedTemplate = selectedTemplateSummary(templateSelection);
+  if (!selectedTemplate) {
+    format({
+      schema_version: "foh_cli_objective_setup_bootstrap.v1",
+      ok: false,
+      status: "blocked",
+      reason_code: "objective_template_selection_empty",
+      summary: "No supported template matched this objective. Do not continue with a guessed template.",
+      requirement_brief: brief,
+      template_selection: templateSelection,
+      next_commands: [objectiveSetupCommand(opts)]
+    }, { json: opts.json ?? false });
+    markCommandFailed(1);
+    return;
+  }
+  const setupWorkflow = await apiFetch("/v1/console/agency-setup/workflow", {
+    method: "POST",
+    body: JSON.stringify({
+      agency_name: businessName,
+      business_objective: objective,
+      requested_tool_surface: tools,
+      target_exposure_mode: normalizeString(opts.targetMode) || "customer_owned_voice_trial",
+      source_url: sourceUrl,
+      ...normalizeString(opts.location) ? { branch_location: normalizeString(opts.location) } : {}
+    }),
+    orgId: opts.org,
+    apiUrlOverride: opts.apiUrl
+  });
+  format({
+    schema_version: "foh_cli_objective_setup_bootstrap.v1",
+    ok: true,
+    status: "hold",
+    reason_code: "objective_setup_plan_ready",
+    summary: "Objective setup plan is ready. Treat this as dry-run planning until evidence is applied and status explicitly allows live claims.",
+    dry_run: opts.apply === true ? false : true,
+    apply_requested: opts.apply === true,
+    org_id: opts.org ?? null,
+    requirement_brief: brief,
+    selected_template: selectedTemplate,
+    setup_workflow: {
+      decision: setupWorkflow?.decision ?? setupWorkflow?.status ?? null,
+      reason_codes: Array.isArray(setupWorkflow?.reason_codes) ? setupWorkflow.reason_codes : [],
+      evidence_packet: setupWorkflow?.evidence_packet ?? null,
+      operator_status: setupWorkflow?.operator_status ?? null
+    },
+    claim_boundaries: {
+      customer_live_claim_allowed: false,
+      production_claim_allowed: false,
+      fully_autonomous_claim_allowed: false
+    },
+    next_commands: [
+      `npx --yes @f-o-h/cli@latest objective status --business-name ${JSON.stringify(businessName)} --industry ${industry} --business-objective ${JSON.stringify(objective)} --source-url ${JSON.stringify(sourceUrl)} --out test-results/objective-status.latest.json --json`,
+      "npx --yes @f-o-h/cli@latest objective debug --from test-results/objective-status.latest.json --json",
+      `npx --yes @f-o-h/cli@latest templates show --template ${selectedTemplate.template_id} --json`
+    ]
+  }, { json: opts.json ?? false });
+}
 function registerSetup(program3) {
-  program3.command("setup").description("Fully provision a new agency customer in one command").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--agent-template <id>", "Agent template ID (e.g. viewing-request)").option("--agent-name <name>", "Name for the new agent").option("--phone-country <cc>", "Phone number country code", "GB").option("--phone-area-code <code>", "Phone area code preference").option("--phone-mode <mode>", "Phone path: observe, skip, or purchase", "purchase").option("--widget-domains <domains>", "Comma-separated widget domain allowlist").option("--voice-provider <p>", "TTS provider: openai, azure, twilio").option("--voice-id <id>", "Voice ID").option("--skip-compliance", "Skip compliance submission and wait").option("--skip-voice", "Skip voice configuration").option("--skip-tests", "Skip smoke tests").option("--cert-mode <m>", "Simulation cert mode: quick, full, stress", "quick").option("--cert-adaptive-runs <n>", "Adaptive run count for certification loop", "30").option("--cert-max-improvement-rounds <n>", "Max instruction improvement rounds in cert loop (0-5)", "1").option("--resume-from <step>", `Resume from a setup step (${SETUP_STEP_ORDER.join(", ")})`).option("--report-out <path>", "Optional path to write signed setup run report JSON").option("--dry-run", "Print all steps that would run without making any API calls").option("--api-url <url>", "API base URL override").option("--console-url <url>", "Console sign-in URL override").option("--json", "Output as JSON").action(async (opts) => {
+  program3.command("setup").description("Fully provision a customer or plan objective-first setup").option("--objective <text>", "Objective-first setup mode: plain-English front-of-house objective").option("--business-name <name>", "Business trading name for objective-first setup").option("--industry <industry>", "Business industry for objective-first setup: real_estate, restaurant, general").option("--source-url <url>", "Official business source URL for objective-first setup").option("--location <value>", "Location or branch represented by this setup").option("--tools <csv>", "Requested surfaces for objective-first setup", "widget,voice,whatsapp").option("--target-mode <mode>", "Target launch/exposure mode for objective-first setup", "customer_owned_voice_trial").option("--apply", "Explicitly request apply mode for objective setup; default is dry-run planning").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--agent-template <id>", "Agent template ID (e.g. viewing-request)").option("--agent-name <name>", "Name for the new agent").option("--phone-country <cc>", "Phone number country code", "GB").option("--phone-area-code <code>", "Phone area code preference").option("--phone-mode <mode>", "Phone path: observe, skip, or purchase", "purchase").option("--widget-domains <domains>", "Comma-separated widget domain allowlist").option("--voice-provider <p>", "TTS provider: openai, azure, twilio").option("--voice-id <id>", "Voice ID").option("--skip-compliance", "Skip compliance submission and wait").option("--skip-voice", "Skip voice configuration").option("--skip-tests", "Skip smoke tests").option("--cert-mode <m>", "Simulation cert mode: quick, full, stress", "quick").option("--cert-adaptive-runs <n>", "Adaptive run count for certification loop", "30").option("--cert-max-improvement-rounds <n>", "Max instruction improvement rounds in cert loop (0-5)", "1").option("--resume-from <step>", `Resume from a setup step (${SETUP_STEP_ORDER.join(", ")})`).option("--report-out <path>", "Optional path to write signed setup run report JSON").option("--dry-run", "Print all steps that would run without making any API calls").option("--api-url <url>", "API base URL override").option("--console-url <url>", "Console sign-in URL override").option("--json", "Output as JSON").action(async (opts) => {
+    if (opts.objective) {
+      await emitObjectiveSetupBootstrap(opts);
+      return;
+    }
     if (!opts.org) {
       try {
         opts.org = loadCredentials(opts.apiUrl).orgId;
@@ -35717,7 +36762,7 @@ ${passIcon}  Certification loop summary
 }
 
 // src/commands/certify.ts
-var import_node_fs3 = require("node:fs");
+var import_node_fs5 = require("node:fs");
 function normalizeProfile(raw) {
   const value = String(raw || "release").trim().toLowerCase();
   if (value === "smoke" || value === "release" || value === "stress") return value;
@@ -35738,7 +36783,7 @@ function defaultAdaptiveRuns(profile) {
   if (profile === "stress") return 30;
   return 5;
 }
-function csv(raw) {
+function csv2(raw) {
   if (!raw) return void 0;
   const values = String(raw).split(",").map((value) => value.trim()).filter(Boolean);
   return values.length > 0 ? values : void 0;
@@ -35764,8 +36809,8 @@ function registerCertify(program3) {
           body: JSON.stringify({
             mode,
             adaptive_runs: adaptiveRuns,
-            journeys: csv(opts.journeys),
-            scenario_ids: csv(opts.scenarioIds),
+            journeys: csv2(opts.journeys),
+            scenario_ids: csv2(opts.scenarioIds),
             channel: channel(opts.channel)
           }),
           apiUrlOverride: opts.apiUrl
@@ -35795,7 +36840,7 @@ function registerCertify(program3) {
         next_commands: passed ? [`foh agent publish --agent ${opts.agent} --json`] : [`foh certify run --agent ${opts.agent} --profile ${profile} --json`]
       };
       if (opts.out) {
-        (0, import_node_fs3.writeFileSync)(opts.out, JSON.stringify(result, null, 2) + "\n", "utf-8");
+        (0, import_node_fs5.writeFileSync)(opts.out, JSON.stringify(result, null, 2) + "\n", "utf-8");
       }
       if (opts.json ?? false) {
         format(result, { json: true });
@@ -35835,8 +36880,8 @@ function registerConversations(program3) {
     if (opts.provider) params.set("provider", String(opts.provider));
     params.set("page", String(parsePositiveInt(opts.page, 1, 1, 1e4)));
     params.set("limit", String(parsePositiveInt(opts.limit, 20, 1, 100)));
-    const path2 = withQuery(`/v1/console/agents/${opts.agent}/conversations`, params);
-    const data = await apiFetch(path2, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
+    const path5 = withQuery(`/v1/console/agents/${opts.agent}/conversations`, params);
+    const data = await apiFetch(path5, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
     format(data, { json: opts.json ?? false });
   }));
   conversations.command("semantic-search").description("Run semantic ranking search against an agent conversation corpus").requiredOption("--agent <id>", "Agent ID").requiredOption("--q <query>", "Query text (min 3 chars)").option("--limit <n>", "Result limit (1-100)", "20").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
@@ -35853,13 +36898,13 @@ function registerConversations(program3) {
       q: query,
       limit: String(parsePositiveInt(opts.limit, 20, 1, 100))
     });
-    const path2 = withQuery(`/v1/console/agents/${opts.agent}/conversations/semantic-search`, params);
-    const data = await apiFetch(path2, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
+    const path5 = withQuery(`/v1/console/agents/${opts.agent}/conversations/semantic-search`, params);
+    const data = await apiFetch(path5, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
     format(data, { json: opts.json ?? false });
   }));
   conversations.command("lead-data").description("Get extracted lead-data fields for a conversation").requiredOption("--agent <id>", "Agent ID").requiredOption("--conversation <id>", "Conversation ID").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
-    const path2 = `/v1/console/agents/${opts.agent}/conversations/${opts.conversation}/lead-data`;
-    const data = await apiFetch(path2, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
+    const path5 = `/v1/console/agents/${opts.agent}/conversations/${opts.conversation}/lead-data`;
+    const data = await apiFetch(path5, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
     format(data, { json: opts.json ?? false });
   }));
   conversations.command("inject-variables").description("Inject or merge conversation vars into an active flow-state").requiredOption("--agent <id>", "Agent ID").requiredOption("--conversation <id>", "Conversation ID").requiredOption("--variables <json|@file>", "Variables object JSON or @path").option("--mode <value>", "Mode: merge or replace", "merge").option("--source <value>", "Audit source tag", "cli").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
@@ -35881,8 +36926,8 @@ function registerConversations(program3) {
         statusCode: 400
       });
     }
-    const path2 = `/v1/console/agents/${opts.agent}/conversations/${opts.conversation}/inject-variables`;
-    const data = await apiFetch(path2, {
+    const path5 = `/v1/console/agents/${opts.agent}/conversations/${opts.conversation}/inject-variables`;
+    const data = await apiFetch(path5, {
       method: "POST",
       body: JSON.stringify({
         variables: parsed,
@@ -35904,8 +36949,8 @@ function registerConversations(program3) {
         statusCode: 400
       });
     }
-    const path2 = `/v1/console/agents/${opts.agent}/conversations/${opts.conversation}/inject-event`;
-    const data = await apiFetch(path2, {
+    const path5 = `/v1/console/agents/${opts.agent}/conversations/${opts.conversation}/inject-event`;
+    const data = await apiFetch(path5, {
       method: "POST",
       body: JSON.stringify({
         event_type: String(opts.eventType),
@@ -36025,8 +37070,8 @@ function registerTranscripts(program3) {
   transcripts.command("get").description("Fetch one conversation transcript and optional trace events").requiredOption("--agent <id>", "Agent ID").requiredOption("--conversation <id>", "Conversation ID").option("--include-traces", "Include ordered trace events").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
     const params = new URLSearchParams();
     if (opts.includeTraces) params.set("include_traces", "true");
-    const path2 = withQuery(`/v1/console/agents/${opts.agent}/conversations/${opts.conversation}`, params);
-    const data = await apiFetch(path2, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
+    const path5 = withQuery(`/v1/console/agents/${opts.agent}/conversations/${opts.conversation}`, params);
+    const data = await apiFetch(path5, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
     format(data, { json: opts.json ?? false });
   }));
   transcripts.command("export").description("Export recent transcripts as JSON or JSONL").requiredOption("--agent <id>", "Agent ID").option("--q <query>", "Full-text transcript query").option("--from <iso-date>", "Start datetime (ISO8601)").option("--to <iso-date>", "End datetime (ISO8601)").option("--limit <n>", "Rows to export (1-100)", "100").option("--format <value>", "Export format: jsonl or json", "jsonl").option("--hydrate", "Fetch full conversation detail for every exported row").option("--include-traces", "Hydrate each conversation with ordered trace events").option("--no-redact", "Disable default redaction of emails, phone numbers, and obvious secrets").option("--out <path>", "Output file path").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
@@ -36209,8 +37254,8 @@ function registerTests(program3) {
     if (opts.status) params.set("status", String(opts.status));
     if (opts.type) params.set("type", String(opts.type));
     params.set("limit", String(parsePositiveInt(opts.limit, 100, 1, 500)));
-    const path2 = withQuery(`/v1/console/agents/${opts.agent}/tests`, params);
-    const data = await apiFetch(path2, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
+    const path5 = withQuery(`/v1/console/agents/${opts.agent}/tests`, params);
+    const data = await apiFetch(path5, { orgId: opts.org, apiUrlOverride: opts.apiUrl });
     format(data, { json: opts.json ?? false });
   }));
   tests.command("create").description("Create a new test in an agent test catalog").requiredOption("--agent <id>", "Agent ID").requiredOption("--name <text>", "Test name").requiredOption("--config <json|@file>", "Test config JSON or @path").option("--description <text>", "Description").option("--status <value>", "Status override").option("--enabled <value>", "Enabled flag: true/false").option("--tags <csv>", "Comma-separated tags").option("--metadata <json|@file>", "Metadata JSON object").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
@@ -36336,8 +37381,8 @@ function registerTests(program3) {
     if (opts.test) params.set("testId", String(opts.test));
     if (opts.batch) params.set("batchId", String(opts.batch));
     if (opts.includeResults) params.set("includeResults", "true");
-    const path2 = withQuery(`/v1/console/agents/${opts.agent}/tests/runs`, params);
-    const data = await apiFetch(path2, {
+    const path5 = withQuery(`/v1/console/agents/${opts.agent}/tests/runs`, params);
+    const data = await apiFetch(path5, {
       orgId: opts.org,
       apiUrlOverride: opts.apiUrl
     });
@@ -36397,9 +37442,9 @@ function asStringList(value) {
   if (Array.isArray(value)) return value.map((entry) => String(entry || "").trim()).filter(Boolean);
   return [];
 }
-function getPath(source, path2) {
+function getPath(source, path5) {
   if (!source || typeof source !== "object") return void 0;
-  return path2.split(".").reduce((current, part) => {
+  return path5.split(".").reduce((current, part) => {
     if (!current || typeof current !== "object") return void 0;
     return current[part];
   }, source);
@@ -36413,12 +37458,12 @@ function valuesEqual(actual, expected) {
   }
   return String(actual ?? "") === String(expected ?? "");
 }
-function parseStructuredFile(path2) {
-  const raw = (0, import_fs7.readFileSync)(path2, "utf-8");
-  return path2.toLowerCase().endsWith(".json") ? JSON.parse(raw) : load(raw);
+function parseStructuredFile(path5) {
+  const raw = (0, import_fs7.readFileSync)(path5, "utf-8");
+  return path5.toLowerCase().endsWith(".json") ? JSON.parse(raw) : load(raw);
 }
-function parseSuiteFile(path2) {
-  const parsed = parseStructuredFile(path2);
+function parseSuiteFile(path5) {
+  const parsed = parseStructuredFile(path5);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new FohError({
       step: "test.run",
@@ -36442,8 +37487,8 @@ function turnFromFixtureEntry(entry) {
     expect: row.expect && typeof row.expect === "object" && !Array.isArray(row.expect) ? row.expect : void 0
   };
 }
-function loadFixtureTurns(path2) {
-  const parsed = parseStructuredFile(path2);
+function loadFixtureTurns(path5) {
+  const parsed = parseStructuredFile(path5);
   const entries = Array.isArray(parsed) ? parsed : parsed && typeof parsed === "object" && Array.isArray(parsed.turns) ? parsed.turns : parsed && typeof parsed === "object" && Array.isArray(parsed.messages) ? parsed.messages : [];
   return entries.map(turnFromFixtureEntry).filter((entry) => !!entry);
 }
@@ -36503,8 +37548,8 @@ function pickVariables(response) {
   return null;
 }
 function pickToolCalls(response) {
-  for (const path2 of ["tool_calls", "toolCalls", "telemetry.tool_calls", "trace.tool_calls"]) {
-    const value = getPath(response, path2);
+  for (const path5 of ["tool_calls", "toolCalls", "telemetry.tool_calls", "trace.tool_calls"]) {
+    const value = getPath(response, path5);
     if (Array.isArray(value)) return value;
   }
   return [];
@@ -36560,9 +37605,9 @@ function evaluateStructuredExpectations(response, expect, latencyMs) {
     const variables = pickVariables(response);
     if (!variables) failures.push("variables expected but response had none");
     else {
-      for (const [path2, expected] of Object.entries(expect.variables)) {
-        const actual = getPath(variables, path2);
-        if (!valuesEqual(actual, expected)) failures.push(`variables.${path2} expected ${JSON.stringify(expected)} but got ${JSON.stringify(actual)}`);
+      for (const [path5, expected] of Object.entries(expect.variables)) {
+        const actual = getPath(variables, path5);
+        if (!valuesEqual(actual, expected)) failures.push(`variables.${path5} expected ${JSON.stringify(expected)} but got ${JSON.stringify(actual)}`);
       }
     }
   }
@@ -36604,9 +37649,9 @@ function evaluateStructuredExpectations(response, expect, latencyMs) {
     }
   }
   if (expect.fields && typeof expect.fields === "object") {
-    for (const [path2, expected] of Object.entries(expect.fields)) {
-      const actual = getPath(response, path2);
-      if (!valuesEqual(actual, expected)) failures.push(`fields.${path2} expected ${JSON.stringify(expected)} but got ${JSON.stringify(actual)}`);
+    for (const [path5, expected] of Object.entries(expect.fields)) {
+      const actual = getPath(response, path5);
+      if (!valuesEqual(actual, expected)) failures.push(`fields.${path5} expected ${JSON.stringify(expected)} but got ${JSON.stringify(actual)}`);
     }
   }
   return failures;
@@ -37301,9 +38346,9 @@ function nonEmpty2(value) {
   const text = String(value ?? "").trim();
   return text.length > 0 ? text : void 0;
 }
-function getPath2(value, path2) {
+function getPath2(value, path5) {
   let current = value;
-  for (const segment of path2.split(".")) {
+  for (const segment of path5.split(".")) {
     const record2 = asRecord2(current);
     if (!record2) return void 0;
     current = record2[segment];
@@ -37460,10 +38505,10 @@ function assertRedacted(value) {
     });
   }
 }
-function readSourceArtifact(path2) {
-  if (!path2) return null;
+function readSourceArtifact(path5) {
+  if (!path5) return null;
   try {
-    return JSON.parse((0, import_fs9.readFileSync)(path2, "utf-8"));
+    return JSON.parse((0, import_fs9.readFileSync)(path5, "utf-8"));
   } catch (error2) {
     throw new FohError({
       step: "bug.improve",
@@ -37640,8 +38685,8 @@ function parseRequestBody(raw) {
     return text;
   }
 }
-function writeJsonArtifact(path2, value) {
-  const absolutePath = (0, import_path8.resolve)(path2);
+function writeJsonArtifact(path5, value) {
+  const absolutePath = (0, import_path8.resolve)(path5);
   (0, import_fs10.mkdirSync)((0, import_path8.dirname)(absolutePath), { recursive: true });
   (0, import_fs10.writeFileSync)(absolutePath, stableStringify(value), "utf-8");
   return absolutePath;
@@ -37925,8 +38970,8 @@ function registerBug(program3) {
 
 // src/lib/proof-cache.ts
 var import_node_crypto2 = require("node:crypto");
-var import_node_fs4 = require("node:fs");
-var import_node_path = require("node:path");
+var import_node_fs6 = require("node:fs");
+var import_node_path3 = require("node:path");
 var DEFAULT_MAX_AGE_MS = 15 * 60 * 1e3;
 var DEFAULT_WAIT_MS = 180 * 1e3;
 var DEFAULT_POLL_MS = 500;
@@ -37944,12 +38989,12 @@ function cacheKey2(kind, keyParts) {
   return (0, import_node_crypto2.createHash)("sha256").update(stableJson({ kind, keyParts, schema_version: "foh_proof_cache_key.v1" })).digest("hex").slice(0, 32);
 }
 function publicPath(filePath) {
-  const rel = (0, import_node_path.relative)(process.cwd(), filePath).replaceAll("\\", "/");
+  const rel = (0, import_node_path3.relative)(process.cwd(), filePath).replaceAll("\\", "/");
   return rel.startsWith("..") ? filePath.replaceAll("\\", "/") : rel;
 }
 function readFreshCache(filePath, maxAgeMs) {
   try {
-    const payload = JSON.parse((0, import_node_fs4.readFileSync)(filePath, "utf8"));
+    const payload = JSON.parse((0, import_node_fs6.readFileSync)(filePath, "utf8"));
     const createdAt = Date.parse(String(payload.created_at || ""));
     if (!Number.isFinite(createdAt)) return null;
     const ageMs = Date.now() - createdAt;
@@ -37961,8 +39006,8 @@ function readFreshCache(filePath, maxAgeMs) {
   }
 }
 function writeCache(filePath, value) {
-  (0, import_node_fs4.mkdirSync)((0, import_node_path.dirname)(filePath), { recursive: true });
-  (0, import_node_fs4.writeFileSync)(filePath, `${JSON.stringify({
+  (0, import_node_fs6.mkdirSync)((0, import_node_path3.dirname)(filePath), { recursive: true });
+  (0, import_node_fs6.writeFileSync)(filePath, `${JSON.stringify({
     schema_version: "foh_proof_cache_entry.v1",
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     value
@@ -37972,7 +39017,7 @@ function writeCache(filePath, value) {
 function resolveProofCacheDir(input) {
   const value = String(input || process.env.FOH_PROOF_CACHE_DIR || "").trim();
   if (!value) return null;
-  return (0, import_node_path.isAbsolute)(value) ? value : (0, import_node_path.resolve)(process.cwd(), value);
+  return (0, import_node_path3.isAbsolute)(value) ? value : (0, import_node_path3.resolve)(process.cwd(), value);
 }
 async function withProofCache(options, run) {
   const resolvedDir = resolveProofCacheDir(options.cacheDir);
@@ -37992,12 +39037,12 @@ async function withProofCache(options, run) {
     };
   }
   const key = cacheKey2(options.kind, options.keyParts);
-  const cachePath = (0, import_node_path.join)(resolvedDir, `${key}.json`);
-  const lockPath = (0, import_node_path.join)(resolvedDir, `${key}.lock`);
+  const cachePath = (0, import_node_path3.join)(resolvedDir, `${key}.json`);
+  const lockPath = (0, import_node_path3.join)(resolvedDir, `${key}.lock`);
   const maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
   const waitMs = options.waitMs ?? Number(process.env.FOH_PROOF_CACHE_WAIT_MS || DEFAULT_WAIT_MS);
   const pollMs = options.pollMs ?? DEFAULT_POLL_MS;
-  (0, import_node_fs4.mkdirSync)(resolvedDir, { recursive: true });
+  (0, import_node_fs6.mkdirSync)(resolvedDir, { recursive: true });
   const existing = readFreshCache(cachePath, maxAgeMs);
   if (existing) {
     return {
@@ -38016,7 +39061,7 @@ async function withProofCache(options, run) {
   }
   let lockOwner = false;
   try {
-    (0, import_node_fs4.mkdirSync)(lockPath);
+    (0, import_node_fs6.mkdirSync)(lockPath);
     lockOwner = true;
   } catch {
     const started = Date.now();
@@ -38057,7 +39102,7 @@ async function withProofCache(options, run) {
       }
     };
   } finally {
-    if (lockOwner) (0, import_node_fs4.rmSync)(lockPath, { recursive: true, force: true });
+    if (lockOwner) (0, import_node_fs6.rmSync)(lockPath, { recursive: true, force: true });
   }
 }
 
@@ -38114,6 +39159,9 @@ function fail(name, reasonCode, error2, nextCommand) {
 function skipped(name, reasonCode, summary, nextCommand) {
   return { name, category: categoryForCheck(name), status: "skipped", reason_code: reasonCode, summary, next_command: nextCommand };
 }
+function defaultCertificationProfileForMission(mission) {
+  return mission === "publish" ? "release" : "smoke";
+}
 function hasBlockingChecks(checks) {
   return checks.some((check2) => check2.status === "hold" || check2.status === "fail");
 }
@@ -38187,7 +39235,7 @@ function isProviderCapacityBlocked(onboarding) {
   return /maximum number of subaccounts|subaccount limit|reserve[- ]number pool|reserve pool exhausted|global safety limit/.test(message);
 }
 function registerProve(program3) {
-  program3.command("prove").description("Produce one setup/runtime proof bundle for an agent").option("--agent <id>", "Agent ID to prove").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--include-certification", "Run explicit simulation certification check (slow)").option("--cert-mode <m>", "Simulation cert mode when --include-certification is set: quick, full, stress", "quick").option("--cert-adaptive-runs <n>", "Adaptive runs for full/stress certification when included", "30").option("--cert-max-improvement-rounds <n>", "Max prompt improvement rounds in included cert loop (0-5)", "1").option("--mission <mission>", "Proof mission: setup, widget, voice, publish", "setup").option("--contact-path <mode>", "Voice contact path: auto, managed, or byon", "auto").option("--mutation-mode <mode>", "Proof mutation mode: read-only or ensure", "read-only").option("--repair", "Alias for --mutation-mode ensure").option("--require-phone", "Hold proof if no phone/contact number is provisioned").option("--skip-cert", "Deprecated compatibility flag; certification is skipped unless --include-certification is set").option("--skip-smoke", "Skip widget runtime smoke check").option("--skip-voice-health", "Skip realtime voice provider health check").option("--proof-cache-dir <path>", "Optional local proof cache directory for shared certification results").option("--out <path>", "Write signed proof report JSON to this path").option("--strict", "Exit non-zero unless all non-skipped checks pass").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+  program3.command("prove").description("Produce one setup/runtime proof bundle for an agent").option("--agent <id>", "Agent ID to prove").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--include-certification", "Run explicit simulation certification check (slow)").option("--cert-mode <m>", "Simulation cert mode when --include-certification is set: quick, full, stress", "quick").option("--cert-adaptive-runs <n>", "Adaptive runs for full/stress certification when included", "30").option("--cert-max-improvement-rounds <n>", "Max prompt improvement rounds in included cert loop (0-5)", "1").option("--mission <mission>", "Proof mission: setup, widget, voice, publish", "setup").option("--contact-path <mode>", "Voice contact path: auto, managed, or byon", "auto").option("--mutation-mode <mode>", "Proof mutation mode: read-only or ensure", "read-only").option("--repair", "Alias for --mutation-mode ensure").option("--require-phone", "Hold proof if no phone/contact number is provisioned").option("--skip-cert", "Deprecated compatibility flag; certification is skipped unless --include-certification is set").option("--skip-smoke", "Skip widget runtime smoke check").option("--skip-voice-health", "Skip realtime voice provider health check").option("--proof-cache-dir <path>", "Optional local proof cache directory for shared certification results").option("--origin <urlOrHost>", "Website origin to simulate for domain allowlists, e.g. https://www.example.com").option("--out <path>", "Write signed proof report JSON to this path").option("--strict", "Exit non-zero unless all non-skipped checks pass").option("--api-url <url>", "API base URL override").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
     const commandStartedMs = Date.now();
     const checks = [];
     const checkTimings = /* @__PURE__ */ new Map();
@@ -38384,16 +39432,25 @@ function registerProve(program3) {
           headers: { "x-agent-id": String(ctx.agentId) }
         }));
         const publicKey = publicKeyFromEmbedResponse(embed);
+        const allowedDomains = Array.isArray(embed.allowed_domains) ? embed.allowed_domains.map((domain2) => String(domain2 || "").trim()).filter(Boolean) : [];
+        const origin = normalizeOrigin(typeof opts.origin === "string" && opts.origin.trim() ? opts.origin : allowedDomains[0]);
         if (publicKey) {
           checkTimings.set("widget_channel", Math.max(checkTimings.get("widget_channel") ?? 0, checkTimings.get("widget_embed") ?? 0));
           ctx.widgetPublicKey = publicKey;
+          ctx.widgetOrigin = origin;
           checks.push(pass("widget_channel", "Widget channel is available in read-only proof mode.", {
             public_key_present: true,
-            mutation_mode: mutationMode
+            mutation_mode: mutationMode,
+            origin,
+            allowed_domains: allowedDomains
           }));
         }
         if (typeof embed.snippet === "string" && embed.snippet.trim()) {
-          checks.push(pass("widget_embed", "Widget embed snippet is available.", { snippet_present: true }));
+          checks.push(pass("widget_embed", "Widget embed snippet is available.", {
+            snippet_present: true,
+            allowed_domains: allowedDomains,
+            customer_runtime_profile_present: Boolean(embed.customer_runtime_profile)
+          }));
         } else {
           checks.push(hold("widget_embed", "widget_embed_missing", "Widget embed snippet is missing.", `foh widget embed-snippet --agent ${ctx.agentId}`));
         }
@@ -38433,29 +39490,57 @@ function registerProve(program3) {
         checks.push(skipped("widget_smoke", "operator_skipped", "Skipped by --skip-smoke.", `foh widget smoke --agent ${ctx.agentId} --json`));
       } else if (!ctx.widgetPublicKey) {
         checks.push(skipped("widget_smoke", "widget_public_key_required", "Skipped because widget public key is unavailable.", `foh widget ensure --agent ${ctx.agentId} --json`));
+        checks.push(skipped("widget_semantic", "widget_public_key_required", "Skipped because widget public key is unavailable.", `foh widget ensure --agent ${ctx.agentId} --json`));
       } else {
         try {
-          const smoke = await timedCheck(checkTimings, "widget_smoke", () => runWidgetSmoke(ctx.widgetPublicKey, opts.apiUrl));
+          const embed = await apiFetch("/v1/console/channels/widget/embed-snippet", {
+            orgId: ctx.orgId,
+            apiUrlOverride: opts.apiUrl,
+            headers: { "x-agent-id": String(ctx.agentId) }
+          });
+          const smoke = await timedCheck(checkTimings, "widget_smoke", () => runWidgetSmoke(ctx.widgetPublicKey, opts.apiUrl, ctx.widgetOrigin));
           ctx.conversationId = smoke.conversation_id;
           ctx.traceIds = smoke.trace_ids;
           ctx.correlationIds = smoke.correlation_ids;
           if (smoke.failed > 0) {
-            checks.push(hold("widget_smoke", "widget_smoke_failed", `${smoke.failed} widget smoke turn(s) failed.`, `foh widget smoke --agent ${ctx.agentId} --json`, smoke));
+            checks.push(hold("widget_smoke", "widget_smoke_failed", `${smoke.failed} widget smoke transport turn(s) failed.`, `foh widget smoke --agent ${ctx.agentId} --json`, {
+              ...smoke,
+              origin: ctx.widgetOrigin ?? null
+            }));
+            checks.push(skipped("widget_semantic", "widget_smoke_required", "Skipped because transport smoke failed.", `foh widget smoke --agent ${ctx.agentId} --json`));
           } else {
-            checks.push(pass("widget_smoke", "Widget runtime smoke passed.", smoke));
+            checks.push(pass("widget_smoke", "Widget transport smoke passed.", {
+              ...smoke,
+              origin: ctx.widgetOrigin ?? null
+            }));
+            const semantic = await timedCheck(checkTimings, "widget_semantic", () => runWidgetSemanticEval(
+              ctx.widgetPublicKey,
+              opts.apiUrl,
+              ctx.widgetOrigin,
+              embed.customer_runtime_profile ?? null
+            ));
+            if (!semantic.pack_id) {
+              checks.push(skipped("widget_semantic", "widget_semantic_pack_not_configured", "No widget semantic eval pack is configured for this business.", void 0));
+            } else if (semantic.failed > 0) {
+              checks.push(hold("widget_semantic", "widget_semantic_failed", `${semantic.failed} widget semantic scenario(s) failed.`, `foh widget smoke --agent ${ctx.agentId} --json`, semantic));
+            } else {
+              checks.push(pass("widget_semantic", "Widget semantic eval passed.", semantic));
+            }
           }
         } catch (error2) {
           checks.push(fail("widget_smoke", "widget_smoke_failed", error2, `foh widget smoke --agent ${ctx.agentId} --json`));
+          checks.push(skipped("widget_semantic", "widget_smoke_required", "Skipped because widget smoke threw before semantic evaluation.", `foh widget smoke --agent ${ctx.agentId} --json`));
         }
       }
       if (opts.skipCert) {
         checks.push(skipped("simulation_certification", "operator_skipped", "Skipped by --skip-cert.", `foh certify run --agent ${ctx.agentId} --profile release --json`));
       } else if (!opts.includeCertification) {
+        const certificationProfile = defaultCertificationProfileForMission(mission);
         checks.push(skipped(
           "simulation_certification",
           "certification_explicitly_required",
-          "Runtime proof does not run release certification by default.",
-          `foh certify run --agent ${ctx.agentId} --profile release --json`
+          certificationProfile === "release" ? "Runtime proof does not run release certification by default." : "Runtime proof does not run certification by default; use smoke certification for bounded external-agent verification.",
+          `foh certify run --agent ${ctx.agentId} --profile ${certificationProfile} --json`
         ));
       } else {
         try {
@@ -38530,6 +39615,7 @@ function registerProve(program3) {
         contact_path: contactPath,
         mutation_mode: mutationMode,
         widget_public_key_present: Boolean(ctx.widgetPublicKey),
+        widget_origin: ctx.widgetOrigin ?? null,
         conversation_id: ctx.conversationId ?? null,
         trace_ids: ctx.traceIds,
         correlation_ids: ctx.correlationIds
@@ -38548,17 +39634,25 @@ function registerProve(program3) {
 }
 
 // src/commands/objective.ts
-var import_node_fs5 = require("node:fs");
-var import_node_path2 = require("node:path");
+var import_node_fs7 = require("node:fs");
+var import_node_path4 = require("node:path");
 var DEFAULT_OBJECTIVE_REPORT_PATH = "test-results/objective-status.latest.json";
+var VALID_OBJECTIVE_INDUSTRIES = ["real_estate", "restaurant", "general"];
+var BUSINESS_REQUIREMENT_BRIEF_SCHEMA_VERSION = "business_requirement_brief.v1";
 function asRecord3(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function normalizeString(value) {
+function normalizeString2(value) {
   return typeof value === "string" ? value.trim() : "";
 }
+function quoteCliArg(value) {
+  const normalized = value.trim();
+  if (!normalized) return '""';
+  if (!/[\s"]/.test(normalized)) return normalized;
+  return `"${normalized.replace(/"/g, '\\"')}"`;
+}
 function uniqueStrings(values) {
-  return Array.from(new Set(values.map(normalizeString).filter(Boolean)));
+  return Array.from(new Set(values.map(normalizeString2).filter(Boolean)));
 }
 function asArray(value) {
   return Array.isArray(value) ? value : [];
@@ -38615,22 +39709,26 @@ function finiteNumber(value) {
   return Number.isFinite(number3) ? number3 : null;
 }
 function normalizeCustomerEvidenceActions(value) {
-  return asArray(value).map(asRecord3).map((action) => ({
-    id: firstString(action, ["id", "action_id"]),
-    title: firstString(action, ["title"]) || null,
-    owner: firstString(action, ["owner"]) || null,
-    blocker_count: finiteNumber(action.blocker_count) ?? (uniqueStrings(asArray(action.reason_codes)).length || null),
-    target_evidence_paths: uniqueStrings([
-      ...asArray(action.target_evidence_paths),
-      firstString(action, ["target_evidence_path"])
-    ]),
-    validator_commands: uniqueStrings([
-      ...asArray(action.validator_commands),
-      ...asArray(action.next_commands)
-    ]),
-    required_evidence: firstString(action, ["required_evidence"]) || null,
-    unlocks: firstString(action, ["unlocks"]) || null
-  })).filter((action) => normalizeString(action.id));
+  return asArray(value).map(asRecord3).map((action) => {
+    const id = firstString(action, ["id", "action_id"]);
+    return {
+      id,
+      title: firstString(action, ["title"]) || null,
+      owner: firstString(action, ["owner"]) || null,
+      blocker_count: finiteNumber(action.blocker_count) ?? (uniqueStrings(asArray(action.reason_codes)).length || null),
+      target_evidence_paths: uniqueStrings([
+        ...asArray(action.target_evidence_paths),
+        firstString(action, ["target_evidence_path"]),
+        id ? `customer-evidence/${id}.json` : ""
+      ]),
+      validator_commands: uniqueStrings([
+        ...asArray(action.validator_commands),
+        ...asArray(action.next_commands)
+      ]),
+      required_evidence: firstString(action, ["required_evidence"]) || null,
+      unlocks: firstString(action, ["unlocks"]) || null
+    };
+  }).filter((action) => normalizeString2(action.id));
 }
 function normalizeCustomerEvidenceActionPacket(value) {
   const packet = asRecord3(value);
@@ -38647,7 +39745,63 @@ function normalizeCustomerEvidenceActionPacket(value) {
     instructions: uniqueStrings(asArray(packet.instructions))
   };
 }
+function skeletonHintsById(...sources) {
+  const hints = /* @__PURE__ */ new Map();
+  for (const source of sources) {
+    const record2 = asRecord3(source);
+    const evidencePacket = asRecord3(record2.evidence_packet);
+    const skeletons = asArray(evidencePacket.skeletons).map(asRecord3);
+    for (const skeleton of skeletons) {
+      const id = normalizeString2(skeleton.id);
+      if (!id || hints.has(id)) continue;
+      hints.set(id, skeleton);
+    }
+  }
+  return hints;
+}
+function mergeActionPacketWithSkeletonHints(packet, skeletonHints) {
+  if (!packet) return void 0;
+  const actions = asArray(packet.actions).map(asRecord3).filter((action) => normalizeString2(action.id));
+  if (actions.length === 0) return packet;
+  return {
+    ...packet,
+    actions: actions.map((action) => {
+      const hint = skeletonHints.get(normalizeString2(action.id));
+      const hintedTarget = normalizeString2(hint?.target_evidence_path);
+      return {
+        ...action,
+        target_evidence_paths: uniqueStrings([
+          ...asArray(action.target_evidence_paths),
+          hintedTarget
+        ]),
+        required_evidence: action.required_evidence ?? (firstString(asRecord3(hint), ["instructions"]) || null)
+      };
+    })
+  };
+}
+function buildObjectiveApplyPlanCommand(reportPath) {
+  return `foh objective apply --plan ${quoteCliArg(reportPath)} --dry-run --json`;
+}
+function injectObjectiveApplyGuidance(packet, reportPath) {
+  if (!packet) return void 0;
+  const planCommand = buildObjectiveApplyPlanCommand(reportPath);
+  return {
+    ...packet,
+    validation_commands: dedupeCommands([
+      planCommand,
+      ...uniqueStrings(asArray(packet.validation_commands))
+    ]),
+    actions: asArray(packet.actions).map(asRecord3).filter((action) => normalizeString2(action.id)).map((action) => ({
+      ...action,
+      validator_commands: dedupeCommands([
+        planCommand,
+        ...uniqueStrings(asArray(action.validator_commands))
+      ])
+    }))
+  };
+}
 function customerEvidenceActionPacketFromSources(...sources) {
+  const skeletonHints = skeletonHintsById(...sources);
   for (const source of sources) {
     const report = asRecord3(source);
     const requestPackets = asRecord3(report.request_packets);
@@ -38667,14 +39821,14 @@ function customerEvidenceActionPacketFromSources(...sources) {
       report.customer_actions ? { actions: report.customer_actions } : null
     ];
     for (const candidate of candidates) {
-      const normalized = normalizeCustomerEvidenceActionPacket(candidate);
+      const normalized = mergeActionPacketWithSkeletonHints(normalizeCustomerEvidenceActionPacket(candidate), skeletonHints);
       if (normalized) return normalized;
     }
   }
   return void 0;
 }
 function normalizeObjectiveArtifactPath(value) {
-  return value.trim() ? (0, import_node_path2.resolve)(value.trim()) : "";
+  return value.trim() ? (0, import_node_path4.resolve)(value.trim()) : "";
 }
 function resolveObjectiveArtifactPath(value) {
   return normalizeObjectiveArtifactPath(value);
@@ -38689,10 +39843,26 @@ function pickEvidencePacket(value) {
   const payload = firstNonEmptyObject(record2.payload);
   return payload ?? record2;
 }
-function readEvidencePacketFromPlan(path2) {
-  const plan = asRecord3(readJsonArtifact(path2));
+function evidenceRequestFromSkeletonPacket(value) {
+  const packet = asRecord3(value);
+  const skeletons = asArray(packet.skeletons).map(asRecord3).filter((item) => normalizeString2(item.id));
+  if (skeletons.length === 0) return void 0;
+  const launchScopeId = normalizeString2(packet.launch_scope_id) || normalizeString2(skeletons[0]?.launch_scope_id);
+  return {
+    ...launchScopeId ? { launch_scope_id: launchScopeId } : {},
+    evidence: skeletons.map((skeleton) => ({
+      id: normalizeString2(skeleton.id),
+      launch_scope_id: normalizeString2(skeleton.launch_scope_id) || launchScopeId || void 0,
+      target_evidence_path: normalizeString2(skeleton.target_evidence_path) || `customer-evidence/${normalizeString2(skeleton.id)}.json`,
+      payload: asRecord3(skeleton.payload_template)
+    }))
+  };
+}
+function readEvidencePacketFromPlan(path5) {
+  const plan = asRecord3(readJsonArtifact(path5));
   const sourceReports = asRecord3(plan.source_reports);
-  return pickEvidencePacket(plan.evidence) ?? pickEvidencePacket(plan.evidence_packet) ?? pickEvidencePacket(sourceReports.customer_live_status && asRecord3(sourceReports.customer_live_status).evidence) ?? pickEvidencePacket(asRecord3(sourceReports.setup_workflow).evidence_packet) ?? {};
+  const packet = pickEvidencePacket(plan.evidence) ?? pickEvidencePacket(plan.evidence_packet) ?? pickEvidencePacket(sourceReports.customer_live_status && asRecord3(sourceReports.customer_live_status).evidence) ?? pickEvidencePacket(asRecord3(sourceReports.setup_workflow).evidence_packet) ?? {};
+  return evidenceRequestFromSkeletonPacket(packet) ?? packet;
 }
 function inferEvidenceFromProofPaths(evidence) {
   const record2 = asRecord3(evidence);
@@ -38716,7 +39886,7 @@ async function resolveEvidenceInput(opts) {
 }
 function firstString(record2, keys) {
   for (const key of keys) {
-    const value = normalizeString(record2[key]);
+    const value = normalizeString2(record2[key]);
     if (value) return value;
   }
   return "";
@@ -38734,13 +39904,13 @@ function statusFromDecision(value) {
   return "hold";
 }
 function firstCustomerEvidenceAction(packet) {
-  const actions = asArray(packet?.actions).map(asRecord3).filter((action) => normalizeString(action.id));
+  const actions = asArray(packet?.actions).map(asRecord3).filter((action) => normalizeString2(action.id));
   return actions[0] ?? null;
 }
 function buildDeveloperReadinessPacket(input) {
   const businessName = resolveBusinessName(input.opts);
-  const sourceUrl = normalizeString(input.opts.sourceUrl);
-  const businessObjective = normalizeString(input.opts.businessObjective);
+  const sourceUrl = normalizeString2(input.opts.sourceUrl);
+  const businessObjective = normalizeString2(input.opts.businessObjective);
   const location = resolveLocation(input.opts);
   const tools = parseCsvOption(input.opts.tools ?? "widget,voice,email,callback,calendar,crm,webhook,whatsapp") ?? [];
   const setupDecision = firstString(input.setupWorkflow, ["decision", "current_decision", "status"]);
@@ -38757,9 +39927,10 @@ function buildDeveloperReadinessPacket(input) {
     business_context: {
       business_name: businessName || null,
       business_objective: businessObjective || null,
+      industry: objectiveIndustryOrNull(input.opts),
       source_url: sourceUrl || null,
       location: location || null,
-      target_mode: normalizeString(input.opts.targetMode) || "customer_owned_voice_trial",
+      target_mode: normalizeString2(input.opts.targetMode) || "customer_owned_voice_trial",
       tools
     },
     input_completeness: {
@@ -38767,7 +39938,7 @@ function buildDeveloperReadinessPacket(input) {
       source_url: Boolean(sourceUrl),
       business_objective: Boolean(businessObjective),
       requested_tools: tools.length > 0,
-      target_mode: Boolean(normalizeString(input.opts.targetMode) || "customer_owned_voice_trial")
+      target_mode: Boolean(normalizeString2(input.opts.targetMode) || "customer_owned_voice_trial")
     },
     readiness_dimensions: {
       setup_workflow: {
@@ -38781,7 +39952,7 @@ function buildDeveloperReadinessPacket(input) {
       customer_evidence_actions: {
         status: firstAction ? "hold" : "pass",
         action_count: finiteNumber(input.customerEvidenceActionPacket?.action_count) ?? asArray(input.customerEvidenceActionPacket?.actions).length,
-        first_action_id: firstAction ? normalizeString(firstAction.id) : null,
+        first_action_id: firstAction ? normalizeString2(firstAction.id) : null,
         first_validator_command: firstActionValidator
       },
       agent_operability: {
@@ -38805,17 +39976,17 @@ function buildDeveloperReadinessPacket(input) {
   };
 }
 function resolveObjectiveReportPath(value) {
-  const raw = normalizeString(value);
-  if (!raw || raw === "latest") return (0, import_node_path2.resolve)(DEFAULT_OBJECTIVE_REPORT_PATH);
-  return (0, import_node_path2.resolve)(raw);
+  const raw = normalizeString2(value);
+  if (!raw || raw === "latest") return (0, import_node_path4.resolve)(DEFAULT_OBJECTIVE_REPORT_PATH);
+  return (0, import_node_path4.resolve)(raw);
 }
-function writeJsonArtifact2(path2, value) {
-  (0, import_node_fs5.mkdirSync)((0, import_node_path2.dirname)(path2), { recursive: true });
-  (0, import_node_fs5.writeFileSync)(path2, `${JSON.stringify(value, null, 2)}
+function writeJsonArtifact2(path5, value) {
+  (0, import_node_fs7.mkdirSync)((0, import_node_path4.dirname)(path5), { recursive: true });
+  (0, import_node_fs7.writeFileSync)(path5, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
-function readJsonArtifact(path2) {
-  return JSON.parse((0, import_node_fs5.readFileSync)(path2, "utf8"));
+function readJsonArtifact(path5) {
+  return JSON.parse((0, import_node_fs7.readFileSync)(path5, "utf8"));
 }
 function buildSetupBody(opts) {
   const tools = parseCsvOption(opts.tools ?? "widget,voice,email,callback,calendar,crm,webhook,whatsapp") ?? [];
@@ -38823,11 +39994,11 @@ function buildSetupBody(opts) {
   const location = resolveLocation(opts);
   const body = {
     agency_name: businessName,
-    business_objective: normalizeString(opts.businessObjective) || null,
+    business_objective: normalizeString2(opts.businessObjective) || null,
     requested_tool_surface: tools,
-    target_exposure_mode: normalizeString(opts.targetMode) || "customer_owned_voice_trial"
+    target_exposure_mode: normalizeString2(opts.targetMode) || "customer_owned_voice_trial"
   };
-  if (opts.sourceUrl) body.source_url = normalizeString(opts.sourceUrl);
+  if (opts.sourceUrl) body.source_url = normalizeString2(opts.sourceUrl);
   if (location) body.branch_location = location;
   return body;
 }
@@ -38835,19 +40006,176 @@ function buildStatusParams(opts) {
   const params = new URLSearchParams();
   const businessName = resolveBusinessName(opts);
   const location = resolveLocation(opts);
-  if (opts.environment) params.set("environment", normalizeString(opts.environment));
+  if (opts.environment) params.set("environment", normalizeString2(opts.environment));
   if (businessName) params.set("agency_name", businessName);
-  if (opts.sourceUrl) params.set("source_url", normalizeString(opts.sourceUrl));
+  if (opts.sourceUrl) params.set("source_url", normalizeString2(opts.sourceUrl));
   if (location) params.set("branch_location", location);
-  if (opts.tools) params.set("tools", normalizeString(opts.tools));
-  if (opts.targetMode) params.set("target_mode", normalizeString(opts.targetMode));
+  if (opts.tools) params.set("tools", normalizeString2(opts.tools));
+  if (opts.targetMode) params.set("target_mode", normalizeString2(opts.targetMode));
   return params;
 }
 function resolveBusinessName(opts) {
-  return normalizeString(opts.businessName) || normalizeString(opts.agencyName);
+  return normalizeString2(opts.businessName) || normalizeString2(opts.agencyName);
 }
 function resolveLocation(opts) {
-  return normalizeString(opts.location) || normalizeString(opts.branchLocation);
+  return normalizeString2(opts.location) || normalizeString2(opts.branchLocation);
+}
+function hasAnyToken(value, tokens) {
+  const normalized = ` ${value.toLowerCase().replace(/[^a-z0-9]+/g, " ")} `;
+  return tokens.some((token) => normalized.includes(` ${token} `));
+}
+function inferObjectiveIndustry(opts) {
+  const explicit = normalizeString2(opts.industry);
+  if (explicit) {
+    if (VALID_OBJECTIVE_INDUSTRIES.includes(explicit)) return explicit;
+    throw new FohError({
+      step: "objective.brief",
+      error: `Unsupported industry: ${explicit}.`,
+      remediation: `Use one of: ${VALID_OBJECTIVE_INDUSTRIES.join(", ")}.`,
+      statusCode: 400,
+      reasonCode: "objective_industry_unsupported"
+    });
+  }
+  const objectiveText = [
+    opts.businessObjective,
+    opts.businessName,
+    opts.agencyName,
+    opts.sourceUrl
+  ].map(normalizeString2).join(" ");
+  const realEstate = hasAnyToken(objectiveText, [
+    "estate",
+    "property",
+    "properties",
+    "viewing",
+    "valuation",
+    "buyer",
+    "seller",
+    "landlord",
+    "tenant",
+    "lettings"
+  ]);
+  const restaurant = hasAnyToken(objectiveText, [
+    "restaurant",
+    "table",
+    "booking",
+    "reservation",
+    "reservations",
+    "diner",
+    "diners",
+    "menu",
+    "allergy",
+    "hospitality"
+  ]);
+  if (realEstate && !restaurant) return "real_estate";
+  if (restaurant && !realEstate) return "restaurant";
+  throw new FohError({
+    step: "objective.brief",
+    error: realEstate && restaurant ? "Objective matches multiple industries." : "Objective is too ambiguous to select a business template.",
+    remediation: "Pass --industry real_estate or --industry restaurant, and keep --business-objective specific to one front-of-house outcome.",
+    statusCode: 400,
+    reasonCode: realEstate && restaurant ? "objective_industry_ambiguous" : "objective_industry_missing",
+    nextCommands: [
+      'foh objective plan --business-name <name> --industry restaurant --business-objective "Book tables from website and voice enquiries" --source-url <official_url> --json',
+      'foh objective plan --business-name <name> --industry real_estate --business-objective "Qualify buyers and book viewings" --source-url <official_url> --json'
+    ]
+  });
+}
+function objectiveIndustryOrNull(opts) {
+  try {
+    return inferObjectiveIndustry(opts);
+  } catch {
+    return null;
+  }
+}
+function channelsFromTools(tools) {
+  const supported = /* @__PURE__ */ new Set(["widget", "voice", "whatsapp", "instagram", "sms"]);
+  const channels = tools.filter((tool) => supported.has(tool));
+  return channels.length > 0 ? channels : ["widget"];
+}
+function inferOptimizationTarget(industry, objective) {
+  const normalized = objective.toLowerCase();
+  if (industry === "restaurant" || /book|booking|reservation|table/.test(normalized)) return "booking_rate";
+  if (/speed|fast|callback|call back|lead/.test(normalized)) return "speed_to_lead";
+  if (/support|help|resolve|resolution/.test(normalized)) return "support_resolution";
+  return "lead_quality";
+}
+function buildRequirementBrief(opts) {
+  const businessName = resolveBusinessName(opts);
+  const businessObjective = normalizeString2(opts.businessObjective);
+  if (!businessObjective) {
+    throw new FohError({
+      step: "objective.brief",
+      error: "Missing business objective.",
+      remediation: "Pass --business-objective with the concrete front-of-house outcome to configure.",
+      statusCode: 400,
+      reasonCode: "objective_business_objective_missing"
+    });
+  }
+  const industry = inferObjectiveIndustry(opts);
+  const tools = parseCsvOption(opts.tools ?? "widget,voice,email,callback,calendar,crm,webhook,whatsapp") ?? [];
+  const knowledgeSources = [];
+  const sourceUrl = normalizeString2(opts.sourceUrl);
+  if (sourceUrl) {
+    knowledgeSources.push({
+      type: "website",
+      label: `${businessName} official website`,
+      uri: sourceUrl
+    });
+  }
+  return {
+    schema_version: BUSINESS_REQUIREMENT_BRIEF_SCHEMA_VERSION,
+    business_name: businessName,
+    industry,
+    desired_use_cases: [businessObjective],
+    channels: channelsFromTools(tools),
+    knowledge_sources: knowledgeSources,
+    required_outcomes: [businessObjective],
+    handoff_rules: ["handoff when customer facts, credentials, or booking/action availability are missing"],
+    constraints: ["do not invent business facts or confirm actions without configured evidence/tool results"],
+    optimization_target: inferOptimizationTarget(industry, businessObjective)
+  };
+}
+function selectedTemplateSummary2(templateSelection) {
+  const candidates = asArray(asRecord3(templateSelection).candidates).map(asRecord3);
+  const top = candidates[0];
+  const template = asRecord3(top?.template);
+  if (!template || Object.keys(template).length === 0) return null;
+  const contract = asRecord3(template.template_contract);
+  return {
+    template_id: normalizeString2(template.id) || normalizeString2(contract.template_id) || null,
+    template_name: normalizeString2(template.name) || normalizeString2(contract.name) || null,
+    industry: normalizeString2(contract.industry) || null,
+    use_case: normalizeString2(contract.use_case) || null,
+    match_score: finiteNumber(top.match_score),
+    matched_reasons: uniqueStrings(asArray(top.matched_reasons))
+  };
+}
+function assertTemplateSelected(templateSelection) {
+  if (selectedTemplateSummary2(templateSelection)) return;
+  throw new FohError({
+    step: "objective.template_selection",
+    error: "No supported template matched this business objective.",
+    remediation: "Use a more specific --business-objective or choose a supported --industry before setup. Do not continue with a guessed template.",
+    statusCode: 422,
+    reasonCode: "objective_template_selection_empty",
+    nextCommands: [
+      "foh templates select --brief @business-brief.json --json"
+    ]
+  });
+}
+async function selectTemplateForObjective(opts) {
+  const brief = buildRequirementBrief(opts);
+  const selection = await apiFetch("/v1/console/templates/select", {
+    method: "POST",
+    body: JSON.stringify(brief),
+    apiUrlOverride: opts.apiUrl
+  });
+  assertTemplateSelected(selection);
+  return {
+    brief,
+    selection,
+    selected: selectedTemplateSummary2(selection)
+  };
 }
 function assertBusinessName(opts, step) {
   if (resolveBusinessName(opts)) return;
@@ -38894,8 +40222,14 @@ function buildObjectiveReport(input) {
     ...collectStringArrays(setup, /* @__PURE__ */ new Set(["reason_codes", "blocker_reason_codes"])),
     ...collectStringArrays(live, /* @__PURE__ */ new Set(["reason_codes", "blocker_reason_codes"]))
   ]);
-  const debugSource = normalizeString(input.opts.out) || "latest";
+  const objectiveArtifactPath = normalizeString2(input.opts.out) || DEFAULT_OBJECTIVE_REPORT_PATH;
+  const debugSource = normalizeString2(input.opts.out) || "latest";
+  let customerEvidenceActionPacket = customerEvidenceActionPacketFromSources(live, setup);
+  if (customerEvidenceActionPacket) {
+    customerEvidenceActionPacket = injectObjectiveApplyGuidance(customerEvidenceActionPacket, objectiveArtifactPath);
+  }
   const nextCommands = dedupeCommands([
+    ...customerEvidenceActionPacket ? [buildObjectiveApplyPlanCommand(objectiveArtifactPath)] : [],
     ...collectStringArrays(setup, /* @__PURE__ */ new Set(["next_commands"])),
     ...collectStringArrays(live, /* @__PURE__ */ new Set(["next_commands"])),
     `foh objective debug --from ${debugSource} --json`
@@ -38909,7 +40243,6 @@ function buildObjectiveReport(input) {
     ...collectArtifactRefs(setup),
     ...collectArtifactRefs(live)
   ]);
-  const customerEvidenceActionPacket = customerEvidenceActionPacketFromSources(live, setup);
   const developerReadinessPacket = buildDeveloperReadinessPacket({
     opts: input.opts,
     setupWorkflow: setup,
@@ -38934,15 +40267,19 @@ function buildObjectiveReport(input) {
     safeToRetry: true,
     extra: {
       objective: {
-        business_objective: normalizeString(input.opts.businessObjective) || null,
+        business_objective: normalizeString2(input.opts.businessObjective) || null,
         business_name: resolveBusinessName(input.opts) || null,
-        agency_name: normalizeString(input.opts.agencyName) || resolveBusinessName(input.opts) || null,
-        source_url: normalizeString(input.opts.sourceUrl) || null,
+        agency_name: normalizeString2(input.opts.agencyName) || resolveBusinessName(input.opts) || null,
+        industry: objectiveIndustryOrNull(input.opts),
+        source_url: normalizeString2(input.opts.sourceUrl) || null,
         location: resolveLocation(input.opts) || null,
-        branch_location: normalizeString(input.opts.branchLocation) || resolveLocation(input.opts) || null,
-        target_mode: normalizeString(input.opts.targetMode) || "customer_owned_voice_trial",
+        branch_location: normalizeString2(input.opts.branchLocation) || resolveLocation(input.opts) || null,
+        target_mode: normalizeString2(input.opts.targetMode) || "customer_owned_voice_trial",
         tools: parseCsvOption(input.opts.tools ?? "widget,voice,email,callback,calendar,crm,webhook,whatsapp") ?? []
       },
+      requirement_brief: firstNonEmptyObject(input.requirementBrief) ?? null,
+      selected_template: firstNonEmptyObject(input.selectedTemplate) ?? null,
+      template_selection: firstNonEmptyObject(input.templateSelection) ?? null,
       allowed_mode: allowedMode,
       blocked_modes: blockedModes,
       reason_codes: reasonCodes,
@@ -38996,7 +40333,7 @@ function stripDiagnosticField(target, fieldPath) {
 function buildObjectiveNormalPathOutput(report) {
   const output = JSON.parse(JSON.stringify(report));
   const artifactPolicy = asRecord3(output.artifact_policy);
-  const diagnosticFields = uniqueStrings(asArray(artifactPolicy.diagnostic_fields).map((value) => normalizeString(value)));
+  const diagnosticFields = uniqueStrings(asArray(artifactPolicy.diagnostic_fields).map((value) => normalizeString2(value)));
   for (const fieldPath of diagnosticFields) stripDiagnosticField(output, fieldPath);
   return output;
 }
@@ -39072,8 +40409,9 @@ function buildDebugReport(sourcePath, objectiveReport) {
 }
 function registerObjective(program3) {
   const objective = program3.command("objective").description("Agent-native objective workflow: plan, apply, prove, status, debug");
-  objective.command("plan").description("Generate an objective setup/workflow plan").option("--business-name <name>", "Business trading name").option("--agency-name <name>", "Legacy alias for --business-name").option("--business-objective <text>", "Natural-language business objective").option("--source-url <url>", "Official source URL").option("--location <value>", "Location or branch this setup represents").option("--branch-location <value>", "Legacy alias for --location").option("--tools <csv>", "Requested tool surfaces", "widget,voice,email,callback,calendar,crm,webhook,whatsapp").option("--target-mode <mode>", "Target launch/exposure mode", "customer_owned_voice_trial").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--out <path>", "Write objective plan JSON to this file path").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+  objective.command("plan").description("Generate an objective setup/workflow plan").option("--business-name <name>", "Business trading name").option("--agency-name <name>", "Legacy alias for --business-name").option("--industry <industry>", "Business industry: real_estate, restaurant, general").option("--business-objective <text>", "Natural-language business objective").option("--source-url <url>", "Official source URL").option("--location <value>", "Location or branch this setup represents").option("--branch-location <value>", "Legacy alias for --location").option("--tools <csv>", "Requested tool surfaces", "widget,voice,email,callback,calendar,crm,webhook,whatsapp").option("--target-mode <mode>", "Target launch/exposure mode", "customer_owned_voice_trial").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--out <path>", "Write objective plan JSON to this file path").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
     assertBusinessName(opts, "objective.plan");
+    const templateSelection = await selectTemplateForObjective(opts);
     const report = await apiFetch("/v1/console/agency-setup/workflow", {
       method: "POST",
       body: JSON.stringify(buildSetupBody(opts)),
@@ -39081,7 +40419,13 @@ function registerObjective(program3) {
       apiUrlOverride: opts.apiUrl
     });
     const outPath = opts.out ? resolveObjectiveReportPath(opts.out) : null;
-    const output = outPath ? { ...asRecord3(report), artifact_path: outPath } : report;
+    const objectiveSetup = {
+      ...asRecord3(report),
+      requirement_brief: templateSelection.brief,
+      template_selection: templateSelection.selection,
+      selected_template: templateSelection.selected
+    };
+    const output = outPath ? { ...objectiveSetup, artifact_path: outPath } : objectiveSetup;
     if (outPath) writeJsonArtifact2(outPath, output);
     format(output, { json: opts.json ?? false });
   }));
@@ -39102,7 +40446,7 @@ function registerObjective(program3) {
     if (outPath) writeJsonArtifact2(outPath, output);
     format(output, { json: opts.json ?? false });
   }));
-  objective.command("prove").description("Run objective proof status against customer-live gate").option("--business-name <name>", "Business trading name").option("--agency-name <name>", "Legacy alias for --business-name").option("--business-objective <text>", "Natural-language business objective").option("--source-url <url>", "Official source URL").option("--location <value>", "Location or branch this setup represents").option("--branch-location <value>", "Legacy alias for --location").option("--tools <csv>", "Requested tool surfaces", "widget,voice,email,callback,calendar,crm,webhook,whatsapp").option("--target-mode <mode>", "Target launch/exposure mode", "customer_owned_voice_trial").option("--environment <value>", "Environment filter").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--out <path>", "Write objective proof JSON to this file path").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+  objective.command("prove").description("Run objective proof status against customer-live gate").option("--business-name <name>", "Business trading name").option("--agency-name <name>", "Legacy alias for --business-name").option("--industry <industry>", "Business industry: real_estate, restaurant, general").option("--business-objective <text>", "Natural-language business objective").option("--source-url <url>", "Official source URL").option("--location <value>", "Location or branch this setup represents").option("--branch-location <value>", "Legacy alias for --location").option("--tools <csv>", "Requested tool surfaces", "widget,voice,email,callback,calendar,crm,webhook,whatsapp").option("--target-mode <mode>", "Target launch/exposure mode", "customer_owned_voice_trial").option("--environment <value>", "Environment filter").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--out <path>", "Write objective proof JSON to this file path").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
     assertBusinessName(opts, "objective.prove");
     const status = await apiFetch(withQuery("/v1/console/customer-live-status", buildStatusParams(opts)), {
       orgId: opts.org,
@@ -39113,8 +40457,9 @@ function registerObjective(program3) {
     if (outPath) writeJsonArtifact2(outPath, output);
     format(output, { json: opts.json ?? false });
   }));
-  objective.command("status").description("Compose setup and launch evidence into one agent workbench status envelope").option("--business-name <name>", "Business trading name").option("--agency-name <name>", "Legacy alias for --business-name").option("--business-objective <text>", "Natural-language business objective").option("--source-url <url>", "Official source URL").option("--location <value>", "Location or branch this setup represents").option("--branch-location <value>", "Legacy alias for --location").option("--tools <csv>", "Requested tool surfaces", "widget,voice,email,callback,calendar,crm,webhook,whatsapp").option("--target-mode <mode>", "Target launch/exposure mode", "customer_owned_voice_trial").option("--environment <value>", "Environment filter").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--out <path>", "Write objective report JSON to this file path").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+  objective.command("status").description("Compose setup and launch evidence into one agent workbench status envelope").option("--business-name <name>", "Business trading name").option("--agency-name <name>", "Legacy alias for --business-name").option("--industry <industry>", "Business industry: real_estate, restaurant, general").option("--business-objective <text>", "Natural-language business objective").option("--source-url <url>", "Official source URL").option("--location <value>", "Location or branch this setup represents").option("--branch-location <value>", "Legacy alias for --location").option("--tools <csv>", "Requested tool surfaces", "widget,voice,email,callback,calendar,crm,webhook,whatsapp").option("--target-mode <mode>", "Target launch/exposure mode", "customer_owned_voice_trial").option("--environment <value>", "Environment filter").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--out <path>", "Write objective report JSON to this file path").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
     assertBusinessName(opts, "objective.status");
+    const templateSelection = await selectTemplateForObjective(opts);
     const setupWorkflow = await apiFetch("/v1/console/agency-setup/workflow", {
       method: "POST",
       body: JSON.stringify(buildSetupBody(opts)),
@@ -39125,7 +40470,14 @@ function registerObjective(program3) {
       orgId: opts.org,
       apiUrlOverride: opts.apiUrl
     });
-    const report = buildObjectiveReport({ opts, setupWorkflow, customerLiveStatus });
+    const report = buildObjectiveReport({
+      opts,
+      setupWorkflow,
+      customerLiveStatus,
+      requirementBrief: templateSelection.brief,
+      templateSelection: templateSelection.selection,
+      selectedTemplate: templateSelection.selected
+    });
     const artifactPath = resolveObjectiveReportPath(opts.out);
     const fullOutput = withObjectiveArtifactPath(report, artifactPath);
     writeJsonArtifact2(artifactPath, fullOutput);
@@ -39133,7 +40485,7 @@ function registerObjective(program3) {
   }));
   objective.command("debug").description("Explain the next debugging action for an objective report").option("--from <source>", "Report source alias or path", "latest").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
     const sourcePath = resolveObjectiveReportPath(opts.from);
-    if (!(0, import_node_fs5.existsSync)(sourcePath)) {
+    if (!(0, import_node_fs7.existsSync)(sourcePath)) {
       format(cliEnvelope({
         schemaVersion: "agent_workbench_debug.v1",
         status: "fail",
@@ -39423,9 +40775,9 @@ var COMMAND_SURFACE_DEFINITIONS = [
     includeInSuggestions: false
   },
   {
-    id: "whatsapp_start",
-    commandPath: ["channel", "whatsapp", "start"],
-    label: "whatsapp start",
+    id: "whatsapp_onboard",
+    commandPath: ["channel", "whatsapp", "onboard"],
+    label: "whatsapp onboard",
     descriptionFallback: "WhatsApp readiness path",
     mutatesState: "write",
     shellSlash: "/whatsapp",
@@ -40204,6 +41556,277 @@ function registerInteractive(program3) {
   });
 }
 
+// src/commands/install.ts
+var import_node_fs8 = __toESM(require("node:fs"));
+var import_node_path5 = __toESM(require("node:path"));
+var import_node_child_process3 = require("node:child_process");
+function splitCsv(value) {
+  if (typeof value !== "string") return [];
+  return value.split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function pickFirstParam(url2, names) {
+  for (const name of names) {
+    const value = url2.searchParams.get(name);
+    if (value && value.trim()) return value.trim();
+  }
+  return void 0;
+}
+function parseInstallLink(raw) {
+  if (!raw) return {};
+  let url2;
+  try {
+    url2 = new URL(raw);
+  } catch {
+    throw new FohError({
+      step: "install.link",
+      error: "Install link is not a valid URL.",
+      remediation: "Use the one-time Front Of House install link, or run: foh install --agent <agent-id>"
+    });
+  }
+  const domainsFromRepeatedParams = [
+    ...url2.searchParams.getAll("domain"),
+    ...url2.searchParams.getAll("domains")
+  ].flatMap((value) => splitCsv(value));
+  return {
+    agent: pickFirstParam(url2, ["agent", "agent_id"]),
+    org: pickFirstParam(url2, ["org", "org_id"]),
+    domains: Array.from(new Set(domainsFromRepeatedParams)),
+    apiUrl: pickFirstParam(url2, ["api_url", "apiUrl"]),
+    publicKey: pickFirstParam(url2, ["channel", "channel_public_key", "public_key"]),
+    installToken: pickFirstParam(url2, ["token", "install_token"])
+  };
+}
+async function resolveInstallLinkToken(token, apiUrl) {
+  const baseUrl = (apiUrl || DEFAULT_WIDGET_API_URL).replace(/\/$/, "");
+  const res = await fetch(`${baseUrl}/v1/widget/install-link/resolve`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ token })
+  });
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+    body = {};
+  }
+  if (!res.ok) {
+    throw new FohError({
+      step: "install.link.resolve",
+      error: String(body?.error || `HTTP ${res.status}`),
+      remediation: String(body?.code === "install_link_token_expired" ? "Ask the operator for a fresh install link." : "Check the install link and retry."),
+      statusCode: res.status,
+      detail: body
+    });
+  }
+  return {
+    agent: typeof body?.agent_id === "string" ? body.agent_id.trim() : void 0,
+    org: typeof body?.org_id === "string" ? body.org_id.trim() : void 0,
+    publicKey: typeof body?.widget_public_key === "string" ? body.widget_public_key.trim() : void 0,
+    apiUrl: typeof body?.api_url === "string" ? body.api_url.trim() : void 0,
+    domains: Array.isArray(body?.allowed_domains) ? body.allowed_domains.map((domain2) => String(domain2 || "").trim()).filter(Boolean) : void 0
+  };
+}
+function findPackageJsonForTarget(siteRoot, targetPath) {
+  const root = import_node_path5.default.resolve(siteRoot || ".");
+  let current = import_node_path5.default.dirname(targetPath);
+  while (current.startsWith(root)) {
+    const candidate = import_node_path5.default.join(current, "package.json");
+    if (import_node_fs8.default.existsSync(candidate) && import_node_fs8.default.statSync(candidate).isFile()) return candidate;
+    const next = import_node_path5.default.dirname(current);
+    if (next === current) break;
+    current = next;
+  }
+  return null;
+}
+function packageManagerFor(cwd, siteRoot) {
+  const root = import_node_path5.default.resolve(siteRoot || ".");
+  let current = cwd;
+  while (current.startsWith(root)) {
+    if (import_node_fs8.default.existsSync(import_node_path5.default.join(current, "pnpm-lock.yaml"))) return "pnpm";
+    if (import_node_fs8.default.existsSync(import_node_path5.default.join(current, "yarn.lock"))) return "yarn";
+    if (import_node_fs8.default.existsSync(import_node_path5.default.join(current, "bun.lockb")) || import_node_fs8.default.existsSync(import_node_path5.default.join(current, "bun.lock"))) return "bun";
+    const next = import_node_path5.default.dirname(current);
+    if (next === current) break;
+    current = next;
+  }
+  return "npm";
+}
+function detectBuildCommand(siteRoot, targetPath) {
+  const packageJsonPath = findPackageJsonForTarget(siteRoot, targetPath);
+  if (!packageJsonPath) return null;
+  const packageJson = JSON.parse(import_node_fs8.default.readFileSync(packageJsonPath, "utf8"));
+  if (!packageJson.scripts?.build) return null;
+  const cwd = import_node_path5.default.dirname(packageJsonPath);
+  const packageManager = packageManagerFor(cwd, siteRoot);
+  if (packageManager === "npm") {
+    return {
+      cwd,
+      command: "npm",
+      args: ["run", "build"],
+      display: "npm run build",
+      package_manager: packageManager
+    };
+  }
+  return {
+    cwd,
+    command: packageManager,
+    args: ["build"],
+    display: `${packageManager} build`,
+    package_manager: packageManager
+  };
+}
+function runBuildCommand(build) {
+  const command = process.platform === "win32" ? "cmd.exe" : build.command;
+  const args = process.platform === "win32" ? ["/d", "/s", "/c", build.command, ...build.args] : build.args;
+  const result = (0, import_node_child_process3.spawnSync)(command, args, {
+    cwd: build.cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true
+  });
+  const stdout = String(result.stdout || "").split(/\r?\n/).filter(Boolean).slice(-20);
+  const stderr = String(result.stderr || "").split(/\r?\n/).filter(Boolean).slice(-20);
+  return {
+    ok: result.status === 0,
+    exit_code: result.status,
+    command: build.display,
+    cwd: import_node_path5.default.relative(process.cwd(), build.cwd).replaceAll("\\", "/") || ".",
+    stdout_tail: stdout,
+    stderr_tail: stderr,
+    ...result.error ? { error: result.error.message } : {}
+  };
+}
+function registerInstall(program3) {
+  program3.command("install [installLink]").description("Install Front Of House on this website").option("--agent <id>", "Agent ID; normally supplied by the install link").option("--org <id>", "Org ID; normally supplied by the install link or stored org context").option("--domains <d1,d2>", "Optional comma-separated widget domain allowlist").option("--platform <platform>", `Install target platform: ${SUPPORTED_INSTALL_PLATFORMS.join("|")}`, "custom").option("--site-root <path>", "Website repository root", ".").option("--target <path>", "HTML shell to patch, relative to --site-root").option("--api-url <url>", "API base URL override").option("--origin <urlOrHost>", "Website origin to simulate for domain allowlists, e.g. https://www.example.com").option("--dry-run", "Resolve and report install actions without writing files or running build/smoke").option("--no-build", "Do not run the website build command after installing").option("--no-smoke", "Do not run the widget smoke check after installing").option("--json", "Output as JSON").action(async (installLink, opts) => withCommandErrorHandling(async () => {
+    const parsedLink = parseInstallLink(installLink);
+    const resolvedLink = parsedLink.installToken ? await resolveInstallLinkToken(parsedLink.installToken, opts.apiUrl || parsedLink.apiUrl) : {};
+    const link = {
+      ...parsedLink,
+      ...resolvedLink,
+      apiUrl: opts.apiUrl || resolvedLink.apiUrl || parsedLink.apiUrl,
+      publicKey: resolvedLink.publicKey || parsedLink.publicKey
+    };
+    const domains = splitCsv(opts.domains);
+    const agent = opts.agent || link.agent;
+    const org = opts.org || link.org;
+    const apiUrl = opts.apiUrl || link.apiUrl;
+    const domainAllowlist = domains.length > 0 ? domains : link.domains || [];
+    const platform = normalizeInstallPlatform(opts.platform);
+    const smokeOrigin = normalizeOrigin(
+      typeof opts.origin === "string" && opts.origin.trim() ? opts.origin : domainAllowlist[0]
+    );
+    const snippet2 = link.publicKey ? widgetSnippetFromPublicKey(link.publicKey, apiUrl) : void 0;
+    if (!agent && !snippet2) {
+      throw new FohError({
+        step: "install",
+        error: "No Front Of House agent was provided.",
+        remediation: "Run: foh install <install-link>, or foh install --agent <agent-id>"
+      });
+    }
+    if (isBuilderHostedPlatform(platform)) {
+      if (!snippet2) {
+        throw new FohError({
+          step: "install",
+          error: "Builder-hosted install requires a public widget snippet or install link.",
+          remediation: "Run: foh install <install-link-with-channel-or-token> --platform <platform>"
+        });
+      }
+      const instructions = buildBuilderPlatformInstructions({
+        platform,
+        snippet: snippet2,
+        publicKey: link.publicKey,
+        domains: domainAllowlist,
+        origin: smokeOrigin
+      });
+      format({
+        schema_version: "foh_site_install.v1",
+        status: opts.dryRun ? "dry_run" : "ready_for_manual_install",
+        install_mode: "builder_platform",
+        platform,
+        site_root: null,
+        target_path: null,
+        changed: false,
+        install: instructions,
+        widget_public_key: instructions.widget_public_key,
+        domain_allowlist: instructions.domain_allowlist,
+        origin_hint: instructions.origin_hint,
+        install_verification_command: instructions.install_verification_command,
+        runtime_smoke_command: instructions.runtime_smoke_command,
+        verification_commands: instructions.verification_commands,
+        build: {
+          ok: null,
+          skipped: true,
+          reason: "builder_platform_manual_install",
+          command: null
+        },
+        smoke: {
+          ok: null,
+          skipped: true,
+          reason: "builder_platform_manual_install"
+        },
+        next_commands: instructions.verification_commands
+      }, { json: opts.json ?? false });
+      return;
+    }
+    const install = await installWidgetSite({
+      agent,
+      org,
+      domains: domainAllowlist,
+      siteRoot: opts.siteRoot,
+      target: opts.target,
+      snippet: snippet2,
+      apiUrl,
+      dryRun: opts.dryRun
+    });
+    const targetPath = install.absolute_target_path || resolveWidgetInstallTarget(opts.siteRoot, opts.target);
+    const buildCommand = detectBuildCommand(opts.siteRoot, targetPath);
+    const installGuidance = buildWidgetInstallGuidance({
+      publicKey: install.widget_public_key || link.publicKey || null,
+      agentId: agent,
+      domains: domainAllowlist,
+      origin: smokeOrigin
+    });
+    const build = !opts.dryRun && opts.build !== false && buildCommand ? runBuildCommand(buildCommand) : null;
+    const smokePublicKey = installGuidance.widget_public_key;
+    const smoke = !opts.dryRun && opts.smoke !== false && smokePublicKey ? await runWidgetSmoke(smokePublicKey, apiUrl, smokeOrigin) : null;
+    const ok = install.status === "installed" && (build ? build.ok : true) && (smoke ? smoke.failed === 0 : true);
+    const result = {
+      schema_version: "foh_site_install.v1",
+      status: opts.dryRun ? "dry_run" : ok ? "installed" : "failed",
+      install_mode: "repo_patch",
+      platform,
+      site_root: import_node_path5.default.resolve(opts.siteRoot || "."),
+      target_path: install.target_path,
+      changed: install.changed,
+      install,
+      widget_public_key: installGuidance.widget_public_key,
+      domain_allowlist: installGuidance.domain_allowlist,
+      origin_hint: installGuidance.origin_hint,
+      install_verification_command: installGuidance.install_verification_command,
+      runtime_smoke_command: installGuidance.runtime_smoke_command,
+      verification_commands: installGuidance.verification_commands,
+      build: build || {
+        ok: null,
+        skipped: opts.dryRun || opts.build === false || !buildCommand,
+        reason: opts.dryRun ? "dry_run" : opts.build === false ? "disabled" : "no package.json build script found near target",
+        command: buildCommand?.display ?? null
+      },
+      smoke: smoke || {
+        ok: null,
+        skipped: opts.dryRun || opts.smoke === false || !install.widget_public_key,
+        reason: opts.dryRun ? "dry_run" : opts.smoke === false ? "disabled" : "widget public key unavailable"
+      },
+      next_commands: ok ? [] : [
+        build && !build.ok ? build.command : null,
+        smoke && smoke.failed > 0 ? installGuidance.runtime_smoke_command : null,
+        !smoke && installGuidance.verification_commands.length > 0 ? installGuidance.verification_commands[0] : null
+      ].filter(Boolean)
+    };
+    format(result, { json: opts.json ?? false });
+    if (!ok && !opts.dryRun) markCommandFailed(1);
+  }));
+}
+
 // src/commands/home-actions.ts
 function resolveHomeState(apiUrlOverride) {
   try {
@@ -40821,9 +42444,9 @@ function compareSemver(a, b) {
   }
   return 0;
 }
-function readPackageJsonVersion(path2) {
+function readPackageJsonVersion(path5) {
   try {
-    const raw = (0, import_fs12.readFileSync)(path2, "utf-8");
+    const raw = (0, import_fs12.readFileSync)(path5, "utf-8");
     const parsed = JSON.parse(raw);
     const version2 = String(parsed.version ?? "").trim();
     return version2 || void 0;
@@ -41074,8 +42697,8 @@ var PHONE_RE2 = /(?<!\w)(?:\+?\d[\d\s().-]{7,}\d)(?!\w)/g;
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function pathVariants(path2) {
-  const resolved = (0, import_path11.resolve)(path2);
+function pathVariants(path5) {
+  const resolved = (0, import_path11.resolve)(path5);
   const slash = resolved.replace(/\\/g, "/");
   const backslash = resolved.replace(/\//g, "\\");
   return Array.from(new Set([
@@ -41119,9 +42742,9 @@ function redactExternalAgentSecretText(text) {
 }
 function artifactFiles(runDir) {
   if (!(0, import_fs13.existsSync)(runDir)) return [];
-  return (0, import_fs13.readdirSync)(runDir).map((name) => (0, import_path11.join)(runDir, name)).filter((path2) => {
-    const stat = (0, import_fs13.statSync)(path2);
-    const name = path2.split(/[\\/]/).pop() || "";
+  return (0, import_fs13.readdirSync)(runDir).map((name) => (0, import_path11.join)(runDir, name)).filter((path5) => {
+    const stat = (0, import_fs13.statSync)(path5);
+    const name = path5.split(/[\\/]/).pop() || "";
     if (name.endsWith(".redacted")) return false;
     return stat.isFile() && (TEXT_ARTIFACT_NAMES.has(name) || name.startsWith("command-output-cmd_"));
   }).sort();
@@ -41490,10 +43113,10 @@ function collectDocsFrom(value, docs) {
 }
 function readExternalAgentMetadata(runDir) {
   for (const filename of EXTERNAL_AGENT_METADATA_FILENAMES) {
-    const path2 = (0, import_path14.join)(runDir, filename);
-    if (!(0, import_fs15.existsSync)(path2)) continue;
+    const path5 = (0, import_path14.join)(runDir, filename);
+    if (!(0, import_fs15.existsSync)(path5)) continue;
     try {
-      const parsed = JSON.parse((0, import_fs15.readFileSync)(path2, "utf8"));
+      const parsed = JSON.parse((0, import_fs15.readFileSync)(path5, "utf8"));
       const docs = /* @__PURE__ */ new Set();
       collectDocsFrom(parsed.docs_pages_used, docs);
       collectDocsFrom(parsed.docs_pages_observed, docs);
@@ -41521,11 +43144,11 @@ function readExternalAgentMetadata(runDir) {
 }
 
 // src/lib/external-agent-executor-artifacts.ts
-function redactArtifactFile(path2, input = {}) {
-  if (!(0, import_fs16.existsSync)(path2)) return;
-  const original = (0, import_fs16.readFileSync)(path2, "utf8");
+function redactArtifactFile(path5, input = {}) {
+  if (!(0, import_fs16.existsSync)(path5)) return;
+  const original = (0, import_fs16.readFileSync)(path5, "utf8");
   const redacted = redactExternalAgentArtifactText(original, input);
-  if (redacted !== original) (0, import_fs16.writeFileSync)(path2, redacted, "utf8");
+  if (redacted !== original) (0, import_fs16.writeFileSync)(path5, redacted, "utf8");
 }
 function redactExternalAgentOutputArtifacts(run, input = {}) {
   redactArtifactFile(run.outputs.jsonl, input);
@@ -41566,11 +43189,11 @@ function proofArtifactPasses(runDir) {
     return false;
   }
 }
-function readIfExists(path2) {
-  return (0, import_fs17.existsSync)(path2) ? (0, import_fs17.readFileSync)(path2, "utf8") : "";
+function readIfExists(path5) {
+  return (0, import_fs17.existsSync)(path5) ? (0, import_fs17.readFileSync)(path5, "utf8") : "";
 }
-function relativeArtifactName(path2) {
-  return (0, import_path16.basename)(path2);
+function relativeArtifactName(path5) {
+  return (0, import_path16.basename)(path5);
 }
 function externalAgentSummaryTemplateCommand() {
   return [
@@ -41903,11 +43526,11 @@ async function runExternalAgentEvalAuthPreflight(env = process.env, options = {}
     matched_org: matchedOrg
   };
 }
-function normalizeForCompare(path2) {
-  const resolved = (0, import_path18.resolve)(path2);
+function normalizeForCompare(path5) {
+  const resolved = (0, import_path18.resolve)(path5);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
-function isPathInside(childPath, parentPath) {
+function isPathInside2(childPath, parentPath) {
   const child = normalizeForCompare(childPath);
   const parent = normalizeForCompare(parentPath);
   const rel = (0, import_path18.relative)(parent, child);
@@ -42294,7 +43917,7 @@ function createExternalAgentExecutorPlan(options) {
   });
   const privateRepoRoot = privateRepo.root;
   const workspaceRoot = resolveWorkspaceRoot({ batchPath, workspaceRoot: options.workspaceRoot, privateRepoRoot });
-  if (isPathInside(workspaceRoot, privateRepoRoot)) {
+  if (isPathInside2(workspaceRoot, privateRepoRoot)) {
     throw new ExternalAgentExecutorError(
       "external_agent_workspace_inside_private_repo",
       `Workspace root must be outside the private repository. workspace=${workspaceRoot} repo=${privateRepoRoot}`
@@ -42321,10 +43944,11 @@ function createExternalAgentExecutorPlan(options) {
       ].join("\n"),
       "utf8"
     );
+    const explicitPromptVersion = typeof run.prompt_version === "string" && run.prompt_version.trim() ? run.prompt_version.trim() : typeof batch.prompt_version === "string" && batch.prompt_version.trim() ? batch.prompt_version.trim() : promptVersionFromPath(promptPath);
     const env = buildCodexExecutorEnv({
       sourceEnv: options.env,
       runDir,
-      promptVersion: promptVersionFromPath(promptPath)
+      promptVersion: explicitPromptVersion
     });
     const promptVersion = String(env[EXTERNAL_AGENT_PROMPT_VERSION_ENV] || "unknown");
     const outputStem = runner === "gemini" ? "gemini" : "codex";
@@ -42423,11 +44047,11 @@ function createExternalAgentExecutorPlan(options) {
   };
 }
 function writeExternalAgentExecutorPlan(plan) {
-  const path2 = (0, import_path18.join)(plan.batch_dir, "executor-plan.json");
+  const path5 = (0, import_path18.join)(plan.batch_dir, "executor-plan.json");
   (0, import_fs19.mkdirSync)(plan.batch_dir, { recursive: true });
-  (0, import_fs19.writeFileSync)(path2, `${JSON.stringify(plan, null, 2)}
+  (0, import_fs19.writeFileSync)(path5, `${JSON.stringify(plan, null, 2)}
 `, "utf8");
-  return path2;
+  return path5;
 }
 async function executeExternalAgentExecutorPlan(plan, options = {}) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -43091,6 +44715,7 @@ var DEFAULT_PROMPT_VERSION = "blank-setup.v1";
 var DEFAULT_BATCH_MODELS = "openai/codex,anthropic/claude,cursor/agent";
 var PROMPTS = {
   "blank-setup.v1": "Go to https://frontofhouse.okii.uk. Use only public docs, public API docs, and the public npm CLI package. Always invoke the CLI with `npx --yes @f-o-h/cli@latest ...`; do not use unpinned `npx @f-o-h/cli ...`, because cached older packages can produce invalid evidence. Install or verify the FOH CLI, authenticate or reach a deterministic auth blocker, then create or configure a Front Of House voice agent and website widget. Mass evals reuse existing eval state: run `npx --yes @f-o-h/cli@latest org status --json` and `npx --yes @f-o-h/cli@latest agent list --json` before trying to create a fresh agent; if an existing eval agent is present, configure and prove that agent instead of creating a second bronze-tier agent. Prefer the certification-oriented buyer templates: run `npx --yes @f-o-h/cli@latest templates list --category buyer --json` and use `UK Buyer Qualification` or `Viewing Booking` when available; do not use a greeting-only template for proof/certification. Prefer `npx --yes @f-o-h/cli@latest setup --phone-mode observe` for the free scaffold path: agent, widget, voice config, smoke test, certification, and publish readiness together. Treat phone-number purchasing as an explicit paid/scarce contact-path step, not part of high-volume eval setup. If `FOH_CLI_SPEND_POLICY=no_spend` is active and a command returns `paid_resource_blocked_by_spend_policy`, do not try to bypass it; continue widget/setup proof and report that exact reason code for the phone path. If the customer/operator explicitly owns a number and asks for real PSTN proof, use `npx --yes @f-o-h/cli@latest provision byon attach --phone-number <e164> --confirm-owned --json`; do not invent ownership or buy a FOH-owned number. Run proof/smoke/certification where available, including widget proof, voice proof, and one explicit `foh certify run --agent <id> --profile release --json` before publish. `foh prove` does not run release certification by default; only pass `--include-certification --proof-cache-dir .foh/proof-cache` when an explicit combined proof/certification run is required. If voice proof returns `contact_phone_missing` or `voice_contact_expected_no_spend_hold`, report that exact reason code unless a BYON/customer-approved phone path already exists. If `FOH_EXTERNAL_AGENT_RUN_DIR` is set, write `${FOH_EXTERNAL_AGENT_RUN_DIR}/external-agent-metadata.json` with `schema_version`, `docs_pages_used`, key decisions, and blocker reason codes before finishing. Produce a final evidence summary with commands run, docs used, artifacts created, and any blocker reason codes. Do not assume access to the private source repository.",
+  "restaurant-table-booking-blackbox.v1": "Set up a front of house system for a real restaurant that takes table bookings. Find Front Of House online and use only public web pages, public docs, public API docs, and public package installs. Do not use or inspect any private repository, local source checkout, unpublished local commands, or hidden runbooks. Pick a real restaurant name and official website from public information, then try to reach a deterministic setup/proof result for a table-booking front-of-house agent. Use the authenticated environment if the public CLI discovers it, but do not expose credentials or secrets. Do not buy phone numbers or paid resources. If the system blocks because customer-owned credentials, booking-system access, approval, or live validation are missing, treat that as a valid hold only when the command returns machine-readable reason codes and exact next commands. If `FOH_EXTERNAL_AGENT_RUN_DIR` is set, write `${FOH_EXTERNAL_AGENT_RUN_DIR}/external-agent-metadata.json` with `schema_version`, `restaurant_name`, `restaurant_source_url`, `docs_pages_used`, `commands_run`, `artifacts_created`, `final_status`, `blocker_reason_codes`, and `friction_points` before finishing. Produce a final evidence summary with commands run, docs used, artifacts created, final pass/hold/fail status, blocker reason codes, and every friction point encountered.",
   "real-estate-buyer-enquiry.v1": "Go to https://frontofhouse.okii.uk. Use only public docs, public API docs, and the public npm CLI package. Always invoke the CLI with `npx --yes @f-o-h/cli@latest ...`; do not use unpinned `npx @f-o-h/cli ...`. Do not assume access to the private source repository. Mission: configure a buyer-enquiry real-estate agent (UK Buyer Qualification preferred), prove widget behavior, and prove voice behavior in no-spend mode. Required path: 1) verify auth/org scope and reuse existing eval org/agent where possible; 2) select/apply buyer template; 3) configure widget + voice; 4) run widget smoke and `foh certify run --profile release`; 5) run voice proof and treat no-spend contact holds as expected only when all non-contact gates pass. Do not buy numbers; if spend policy blocks purchase, record `paid_resource_blocked_by_spend_policy` and continue no-spend proof path. Final artifact must include: selected template id/slug, commands executed, pass/hold/fail per gate, reason codes, docs_pages_used, and next fix commands.",
   "real-estate-seller-valuation.v1": "Go to https://frontofhouse.okii.uk. Use only public docs, public API docs, and the public npm CLI package. Always invoke the CLI with `npx --yes @f-o-h/cli@latest ...`; do not use unpinned `npx @f-o-h/cli ...`. Do not assume access to the private source repository. Mission: configure a seller-valuation real-estate agent, prove valuation lead capture on widget and voice, and keep strict no-spend behavior. Required path: 1) verify auth/org scope and reuse existing eval state; 2) select/apply seller valuation template; 3) configure widget + voice; 4) run widget smoke and release certification; 5) run voice proof and classify holds. Do not claim precise valuation output without approved tooling; safe fallback or handoff must remain explicit. Do not buy numbers. Final artifact must include: selected template id/slug, lead fields observed, tool/action behavior, reason codes, docs_pages_used, and next fix commands.",
   "real-estate-viewing-and-qa.v1": "Go to https://frontofhouse.okii.uk. Use only public docs, public API docs, and the public npm CLI package. Always invoke the CLI with `npx --yes @f-o-h/cli@latest ...`; do not use unpinned `npx @f-o-h/cli ...`. Do not assume access to the private source repository. Mission: configure a viewing-booking/property-QA real-estate agent and prove booking-safe behavior under no-spend policy. Required path: 1) verify auth/org scope and reuse existing eval state; 2) select/apply viewing template; 3) configure widget + voice; 4) run widget smoke, release certification, and voice proof; 5) explicitly check no-duplicate-side-effect behavior and safe fallback/handoff when booking tooling or contact path is unavailable. Do not buy numbers. Final artifact must include: selected template id/slug, booking/fallback evidence, reason codes, docs_pages_used, and next fix commands.",
@@ -43259,16 +44884,16 @@ function writePrompt(runDir, promptVersion, context = {}) {
     knowledgeMissPromptContext(context.knowledgeQuestion, context.expectedAnswer),
     agencySetupPromptContext(context)
   ].join("");
-  const path2 = (0, import_path20.join)(runDir, "prompt.txt");
-  (0, import_fs21.writeFileSync)(path2, `${prompt}
+  const path5 = (0, import_path20.join)(runDir, "prompt.txt");
+  (0, import_fs21.writeFileSync)(path5, `${prompt}
 `, "utf8");
-  return path2;
+  return path5;
 }
 function writeSession(runDir, session) {
-  const path2 = (0, import_path20.join)(runDir, "session.json");
-  (0, import_fs21.writeFileSync)(path2, `${JSON.stringify(session, null, 2)}
+  const path5 = (0, import_path20.join)(runDir, "session.json");
+  (0, import_fs21.writeFileSync)(path5, `${JSON.stringify(session, null, 2)}
 `, "utf8");
-  return path2;
+  return path5;
 }
 function buildDefaultEvalState() {
   return {
@@ -43768,11 +45393,12 @@ function installSoftExitTrap() {
 // src/lib/mission-help.ts
 var CLI_MISSION_EXAMPLES = [
   { mission: "Start", command: "foh start", description: "guided setup and next action selector" },
-  { mission: "Objective Plan", command: "foh objective plan --business-name <name> --source-url <url> --out test-results/objective-plan.latest.json --json", description: "generate setup and onboarding context" },
+  { mission: "Setup Objective", command: 'foh setup --objective "<goal>" --business-name <name> --industry <industry> --source-url <url> --json', description: "select template and create/update the agent from a business goal" },
+  { mission: "Objective Plan", command: "foh objective plan --business-name <name> --source-url <url> --out test-results/objective-plan.latest.json --json", description: "preview setup and onboarding context without applying" },
   { mission: "Objective Apply", command: "foh objective apply --evidence <json|@file> --out test-results/objective-apply.latest.json --json", description: "submit verified evidence into customer-live gating path" },
   { mission: "Objective Prove", command: "foh objective prove --business-name <name> --source-url <url> --out test-results/objective-live.latest.json --json", description: "run customer-live proof check directly" },
   { mission: "Objective Status", command: "foh objective status --business-name <name> --source-url <url> --out test-results/objective-status.latest.json --json", description: "compose setup and live status into one report envelope" },
-  { mission: "Setup", command: "foh setup --phone-mode observe --json", description: "create or update agent, widget, voice config, and proof scaffold" },
+  { mission: "Setup Legacy", command: "foh setup --phone-mode observe --json", description: "create or update agent from an explicit template" },
   { mission: "Prove", command: "foh prove --agent <agent_id> --mission widget --json", description: "produce a machine-readable proof report" },
   { mission: "Publish", command: "foh publish --agent <agent_id> --json", description: "publish when proof and release evidence pass" },
   { mission: "Debug", command: "foh debug --out test-results/foh-cli-diag.latest.json --json", description: "collect auth/org/API diagnostics" }
@@ -43878,6 +45504,7 @@ registerBug(program2);
 registerProve(program2);
 registerObjective(program2);
 registerInteractive(program2);
+registerInstall(program2);
 registerAgentPublishCommand(program2, { publicAlias: true });
 registerEval(program2);
 registerUpdate(program2);