@floless/app 0.28.0 → 0.30.0

package/dist/floless-server.cjs

@@ -3201,7 +3201,7 @@ var require_validation = __commonJS({
         return false;
       }
     }
-    function validate(context, request, execution) {
+    function validate2(context, request, execution) {
       const runExecution = execution === void 0;
       if (runExecution || !execution.skipParams) {
         const params = validateParam(context[paramsSchema], request, "params");
@@ -3258,7 +3258,7 @@ var require_validation = __commonJS({
         if (paramsResult) {
           return wrapValidationError(paramsResult, "params", context.schemaErrorFormatter);
         }
-        return validate(context, request, { skipParams: true });
+        return validate2(context, request, { skipParams: true });
       });
     }
     function validateAsyncBody(validatePromise, context, request) {
@@ -3266,7 +3266,7 @@ var require_validation = __commonJS({
         if (bodyResult) {
           return wrapValidationError(bodyResult, "body", context.schemaErrorFormatter);
         }
-        return validate(context, request, { skipParams: true, skipBody: true });
+        return validate2(context, request, { skipParams: true, skipBody: true });
       });
     }
     function validateAsyncQuery(validatePromise, context, request) {
@@ -3274,7 +3274,7 @@ var require_validation = __commonJS({
         if (queryResult) {
           return wrapValidationError(queryResult, "querystring", context.schemaErrorFormatter);
         }
-        return validate(context, request, { skipParams: true, skipBody: true, skipQuery: true });
+        return validate2(context, request, { skipParams: true, skipBody: true, skipQuery: true });
       });
     }
     function validateAsyncHeaders(validatePromise, context, request) {
@@ -3307,7 +3307,7 @@ var require_validation = __commonJS({
       symbols: { bodySchema, querystringSchema, responseSchema, paramsSchema, headersSchema },
       compileSchemasForValidation,
       compileSchemasForSerialization,
-      validate
+      validate: validate2
     };
   }
 });
@@ -5489,7 +5489,7 @@ var require_thread_stream = __commonJS({
     var { version } = require_package();
     var { EventEmitter: EventEmitter2 } = require("events");
     var { Worker } = require("worker_threads");
-    var { join: join25 } = require("path");
+    var { join: join28 } = require("path");
     var { pathToFileURL } = require("url");
     var { wait } = require_wait();
     var {
@@ -5540,7 +5540,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join25(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join28(__dirname, "lib", "worker.js");
       const worker = new Worker(toExecute, {
         ...opts.workerOpts,
         name: opts.workerOpts?.name || "thread-stream",
@@ -6006,10 +6006,10 @@ var require_transport = __commonJS({
   "node_modules/pino/lib/transport.js"(exports2, module2) {
     "use strict";
     var { createRequire: createRequire4 } = require("module");
-    var { existsSync: existsSync23 } = require("node:fs");
+    var { existsSync: existsSync24 } = require("node:fs");
     var getCallers = require_caller();
-    var { join: join25, isAbsolute: isAbsolute2, sep: sep4 } = require("node:path");
-    var { fileURLToPath: fileURLToPath4 } = require("node:url");
+    var { join: join28, isAbsolute: isAbsolute2, sep: sep4 } = require("node:path");
+    var { fileURLToPath: fileURLToPath5 } = require("node:url");
     var sleep = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
     var ThreadStream = require_thread_stream();
@@ -6075,12 +6075,12 @@ var require_transport = __commonJS({
       let path = unquoted;
       if (path.startsWith("file://")) {
         try {
-          path = fileURLToPath4(path);
+          path = fileURLToPath5(path);
         } catch {
           return false;
         }
       }
-      return isAbsolute2(path) && !existsSync23(path);
+      return isAbsolute2(path) && !existsSync24(path);
     }
     function stripQuotes(value) {
       const first = value[0];
@@ -6161,7 +6161,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join25(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join28(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -6179,7 +6179,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline2) {
-        target = bundlerOverrides["pino-worker"] || join25(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join28(__dirname, "worker.js");
         options.pipelines = [pipeline2.map((dest) => {
           return {
             ...dest,
@@ -6202,7 +6202,7 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join25(__dirname, "..", "file.js");
+          return join28(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
@@ -7182,7 +7182,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join25 = ",";
+            let join28 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -7196,7 +7196,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join25 = `,
+                join28 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -7204,13 +7204,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join25;
+                res += join28;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join25}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join28}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -7231,7 +7231,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join25 = `,
+              join28 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -7245,13 +7245,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join25;
+                separator = join28;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join25;
+              separator = join28;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -7292,7 +7292,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join25 = ",";
+            let join28 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -7305,7 +7305,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join25 = `,
+                join28 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -7313,13 +7313,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join25;
+                res += join28;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join25}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join28}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -7332,7 +7332,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join25 = `,
+              join28 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -7341,7 +7341,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join25;
+                separator = join28;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -7399,20 +7399,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join26 = `,
+              const join29 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join26;
+                res2 += join29;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join26}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join29}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -7428,16 +7428,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join25 = `,
+            const join28 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join25, maximumBreadth);
+              res += stringifyTypedArray(value, join28, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join25;
+              separator = join28;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -7448,13 +7448,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join25;
+                separator = join28;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join25;
+              separator = join28;
             }
             if (separator !== "") {
               res = `
@@ -11094,21 +11094,21 @@ var require_request = __commonJS({
         value: function(input, schema, httpPart) {
           httpPart = typeof schema === "string" ? schema : httpPart;
           const symbol = httpPart != null && typeof httpPart === "string" && HTTP_PART_SYMBOL_MAP[httpPart];
-          let validate;
+          let validate2;
           if (symbol) {
-            validate = this[kRouteContext][symbol];
+            validate2 = this[kRouteContext][symbol];
           }
-          if (validate == null && (schema == null || typeof schema !== "object" || Array.isArray(schema))) {
+          if (validate2 == null && (schema == null || typeof schema !== "object" || Array.isArray(schema))) {
             throw new FST_ERR_REQ_INVALID_VALIDATION_INVOCATION(httpPart);
           }
-          if (validate == null) {
+          if (validate2 == null) {
             if (this[kRouteContext][kRequestCacheValidateFns]?.has(schema)) {
-              validate = this[kRouteContext][kRequestCacheValidateFns].get(schema);
+              validate2 = this[kRouteContext][kRequestCacheValidateFns].get(schema);
             } else {
-              validate = this.compileValidationSchema(schema, httpPart);
+              validate2 = this.compileValidationSchema(schema, httpPart);
             }
           }
-          return validate(input);
+          return validate2(input);
         }
       },
       getDecorator: {
@@ -14195,8 +14195,8 @@ var require_keyword = __commonJS({
       var _a;
       const { gen, keyword, schema, parentSchema, $data, it } = cxt;
       checkAsyncKeyword(it, def);
-      const validate = !$data && def.compile ? def.compile.call(it.self, schema, parentSchema, it) : def.validate;
-      const validateRef = useKeyword(gen, keyword, validate);
+      const validate2 = !$data && def.compile ? def.compile.call(it.self, schema, parentSchema, it) : def.validate;
+      const validateRef = useKeyword(gen, keyword, validate2);
       const valid = gen.let("valid");
       cxt.block$data(valid, validateKeyword);
       cxt.ok((_a = def.valid) !== null && _a !== void 0 ? _a : valid);
@@ -15269,28 +15269,28 @@ var require_compile = __commonJS({
         if (this.opts.code.process)
           sourceCode = this.opts.code.process(sourceCode, sch);
         const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
-        const validate = makeValidate(this, this.scope.get());
-        this.scope.value(validateName, { ref: validate });
-        validate.errors = null;
-        validate.schema = sch.schema;
-        validate.schemaEnv = sch;
+        const validate2 = makeValidate(this, this.scope.get());
+        this.scope.value(validateName, { ref: validate2 });
+        validate2.errors = null;
+        validate2.schema = sch.schema;
+        validate2.schemaEnv = sch;
         if (sch.$async)
-          validate.$async = true;
+          validate2.$async = true;
         if (this.opts.code.source === true) {
-          validate.source = { validateName, validateCode, scopeValues: gen._values };
+          validate2.source = { validateName, validateCode, scopeValues: gen._values };
         }
         if (this.opts.unevaluated) {
           const { props, items } = schemaCxt;
-          validate.evaluated = {
+          validate2.evaluated = {
             props: props instanceof codegen_1.Name ? void 0 : props,
             items: items instanceof codegen_1.Name ? void 0 : items,
             dynamicProps: props instanceof codegen_1.Name,
             dynamicItems: items instanceof codegen_1.Name
           };
-          if (validate.source)
-            validate.source.evaluated = (0, codegen_1.stringify)(validate.evaluated);
+          if (validate2.source)
+            validate2.source.evaluated = (0, codegen_1.stringify)(validate2.evaluated);
         }
-        sch.validate = validate;
+        sch.validate = validate2;
         return sch;
       } catch (e) {
         delete sch.validate;
@@ -15303,7 +15303,7 @@ var require_compile = __commonJS({
       }
     }
     exports2.compileSchema = compileSchema;
-    function resolveRef(root, baseId, ref) {
+    function resolveRef2(root, baseId, ref) {
       var _a;
       ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
       const schOrFunc = root.refs[ref];
@@ -15320,7 +15320,7 @@ var require_compile = __commonJS({
         return;
       return root.refs[ref] = inlineOrCompile.call(this, _sch);
     }
-    exports2.resolveRef = resolveRef;
+    exports2.resolveRef = resolveRef2;
     function inlineOrCompile(sch) {
       if ((0, resolve_1.inlineRef)(sch.schema, this.opts.inlineRefs))
         return sch.schema;
@@ -20616,8 +20616,8 @@ var require_formats = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.formatNames = exports2.fastFormats = exports2.fullFormats = void 0;
-    function fmtDef(validate, compare) {
-      return { validate, compare };
+    function fmtDef(validate2, compare) {
+      return { validate: validate2, compare };
     }
     exports2.fullFormats = {
       // date: http://tools.ietf.org/html/rfc3339#section-5.6
@@ -21058,14 +21058,14 @@ var require_standalone = __commonJS({
             const v = vRef;
             return validateCode(usedValues, v.source);
           } else if ((n.prefix === "root" || n.prefix === "wrapper") && typeof vRef == "object") {
-            const { validate, validateName } = vRef;
+            const { validate: validate2, validateName } = vRef;
             if (!validateName)
               throw new Error("ajv internal error");
             const def = ajv.opts.code.es5 ? scope_1.varKinds.var : scope_1.varKinds.const;
             const wrapper = (0, code_1._)`${def} ${n} = {validate: ${validateName}};`;
             if (usedState(validateName) === scope_1.UsedValueState.Started)
               return wrapper;
-            const vCode = validateCode(usedValues, validate === null || validate === void 0 ? void 0 : validate.source);
+            const vCode = validateCode(usedValues, validate2 === null || validate2 === void 0 ? void 0 : validate2.source);
             return (0, code_1._)`${wrapper}${_n}${vCode}`;
           }
           return void 0;
@@ -21259,7 +21259,7 @@ var require_dist2 = __commonJS({
 var require_json_schema_ref_resolver = __commonJS({
   "node_modules/json-schema-ref-resolver/index.js"(exports2, module2) {
     "use strict";
-    var { dequal: deepEqual } = require_dist2();
+    var { dequal: deepEqual2 } = require_dist2();
     var jsonSchemaRefSymbol = /* @__PURE__ */ Symbol.for("json-schema-ref");
     var RefResolver = class {
       #schemas;
@@ -21445,7 +21445,7 @@ var require_json_schema_ref_resolver = __commonJS({
         for (const key in targetSchema) {
           if (key === "$id") continue;
           if (sourceSchema[key] !== void 0) {
-            if (deepEqual(sourceSchema[key], targetSchema[key])) continue;
+            if (deepEqual2(sourceSchema[key], targetSchema[key])) continue;
             throw new Error(
               `Cannot resolve ref "${ref.ref}". Property "${key}" already exists in schema "${ref.sourceSchemaId}".`
             );
@@ -21457,7 +21457,7 @@ var require_json_schema_ref_resolver = __commonJS({
       #insertSchemaBySchemaId(schema, schemaId) {
         const foundSchema = this.#schemas[schemaId];
         if (foundSchema !== void 0) {
-          if (this.#allowEqualDuplicates && deepEqual(schema, foundSchema.schema)) return;
+          if (this.#allowEqualDuplicates && deepEqual2(schema, foundSchema.schema)) return;
           throw new Error(`There is already another schema with id "${schemaId}".`);
         }
         this.#schemas[schemaId] = { schema, anchors: {}, refs: [] };
@@ -22696,7 +22696,7 @@ var require_errors4 = __commonJS({
 var require_resolvers = __commonJS({
   "node_modules/@fastify/merge-json-schemas/lib/resolvers.js"(exports2, module2) {
     "use strict";
-    var { dequal: deepEqual } = require_dist2();
+    var { dequal: deepEqual2 } = require_dist2();
     var { MergeError } = require_errors4();
     function _arraysIntersection(arrays) {
       let intersection = arrays[0];
@@ -22765,7 +22765,7 @@ var require_resolvers = __commonJS({
     function allEqual(keyword, values, mergedSchema) {
       const firstValue = values[0];
       for (let i = 1; i < values.length; i++) {
-        if (!deepEqual(values[i], firstValue)) {
+        if (!deepEqual2(values[i], firstValue)) {
           throw new MergeError(keyword, values);
         }
       }
@@ -22810,7 +22810,7 @@ var require_resolvers = __commonJS({
 var require_merge_json_schemas = __commonJS({
   "node_modules/@fastify/merge-json-schemas/index.js"(exports2, module2) {
     "use strict";
-    var { dequal: deepEqual } = require_dist2();
+    var { dequal: deepEqual2 } = require_dist2();
     var resolvers = require_resolvers();
     var errors = require_errors4();
     var keywordsResolvers = {
@@ -23082,7 +23082,7 @@ var require_merge_json_schemas = __commonJS({
       }
       let allValuesEqual = true;
       for (let i = 1; i < values.length; i++) {
-        if (!deepEqual(values[i], values[0])) {
+        if (!deepEqual2(values[i], values[0])) {
           allValuesEqual = false;
           break;
         }
@@ -23165,7 +23165,7 @@ var require_fast_json_stringify = __commonJS({
     var Serializer = require_serializer();
     var Validator = require_validator();
     var Location = require_location();
-    var validate = require_schema_validator();
+    var validate2 = require_schema_validator();
     var mergeSchemas = require_merge_schemas();
     var SINGLE_TICK = /'/g;
     var largeArraySize = 2e4;
@@ -23196,19 +23196,19 @@ const asInteger = serializer.asInteger.bind(serializer)
     ]);
     var schemaIdCounter = 0;
     function isValidSchema(schema, name) {
-      if (!validate(schema)) {
+      if (!validate2(schema)) {
         if (name) {
           name = `"${name}" `;
         } else {
           name = "";
         }
-        const first = validate.errors[0];
+        const first = validate2.errors[0];
         const err = new Error(`${name}schema is invalid: data${first.instancePath} ${first.message}`);
         err.errors = isValidSchema.errors;
         throw err;
       }
     }
-    function resolveRef(context, location) {
+    function resolveRef2(context, location) {
       const ref = location.schema.$ref;
       let hashIndex = ref.indexOf("#");
       if (hashIndex === -1) {
@@ -23222,7 +23222,7 @@ const asInteger = serializer.asInteger.bind(serializer)
       }
       const newLocation = new Location(schema, schemaId, jsonPointer);
       if (schema.$ref !== void 0) {
-        return resolveRef(context, newLocation);
+        return resolveRef2(context, newLocation);
       }
       return newLocation;
     }
@@ -23485,7 +23485,7 @@ ${contextFunctionCode}`,
           const propertyLocation = propertiesLocation.getPropertyLocation(key);
           let resolvedLocation = propertyLocation;
           if (propertyLocation.schema.$ref) {
-            resolvedLocation = resolveRef(context, propertyLocation);
+            resolvedLocation = resolveRef2(context, propertyLocation);
           }
           const sanitizedKey = JSON.stringify(key);
           const value = `value_${key.replace(/[^a-zA-Z0-9]/g, "_")}_${context.uid++}`;
@@ -23525,7 +23525,7 @@ ${contextFunctionCode}`,
         for (const key of propertiesKeys) {
           let propertyLocation = propertiesLocation.getPropertyLocation(key);
           if (propertyLocation.schema.$ref) {
-            propertyLocation = resolveRef(context, propertyLocation);
+            propertyLocation = resolveRef2(context, propertyLocation);
           }
           const sanitizedKey = JSON.stringify(key);
           const value = `value_${key.replace(/[^a-zA-Z0-9]/g, "_")}_${context.uid++}`;
@@ -23567,7 +23567,7 @@ ${contextFunctionCode}`,
         const location = mergedLocations[i];
         const schema = location.schema;
         if (schema.$ref) {
-          mergedLocations[i] = resolveRef(context, location);
+          mergedLocations[i] = resolveRef2(context, location);
         }
       }
       const mergedSchemas = [];
@@ -23654,7 +23654,7 @@ ${contextFunctionCode}`,
       let itemsLocation = location.getPropertyLocation("items");
       itemsLocation.schema = itemsLocation.schema || {};
       if (itemsLocation.schema.$ref) {
-        itemsLocation = resolveRef(context, itemsLocation);
+        itemsLocation = resolveRef2(context, itemsLocation);
       }
       const itemsSchema = itemsLocation.schema;
       if (context.functionsNamesBySchema.has(schema)) {
@@ -23700,7 +23700,7 @@ ${contextFunctionCode}`,
             let item = itemsSchema[i];
             let itemLocation = itemsLocation.getPropertyLocation(i);
             if (itemLocation.schema.$ref) {
-              itemLocation = resolveRef(context, itemLocation);
+              itemLocation = resolveRef2(context, itemLocation);
               item = itemLocation.schema;
             }
             const value = `value_${i}`;
@@ -23781,7 +23781,7 @@ ${contextFunctionCode}`,
           let item = itemsSchema[i];
           let itemLocation = itemsLocation.getPropertyLocation(i);
           if (itemLocation.schema.$ref) {
-            itemLocation = resolveRef(context, itemLocation);
+            itemLocation = resolveRef2(context, itemLocation);
             item = itemLocation.schema;
           }
           const value = `value_${i}_${context.uid++}`;
@@ -24008,7 +24008,7 @@ ${contextFunctionCode}`,
         pathStack.add(fullPath);
         if (schema.$ref) {
           try {
-            const res = resolveRef(context, location2);
+            const res = resolveRef2(context, location2);
             traverse(res);
           } catch (err) {
           }
@@ -24213,7 +24213,7 @@ ${contextFunctionCode}`,
         return `json += JSON.stringify(${input})`;
       }
       if (schema.$ref) {
-        location = resolveRef(context, location);
+        location = resolveRef2(context, location);
         schema = location.schema;
       }
       if (schema.allOf) {
@@ -28124,7 +28124,7 @@ var require_safe_regex2 = __commonJS({
     "use strict";
     var parse = require_dist3();
     var { types } = require_dist3();
-    function walk(node, opts, starHeight) {
+    function walk2(node, opts, starHeight) {
       let i;
       let ok;
       let len;
@@ -28137,14 +28137,14 @@ var require_safe_regex2 = __commonJS({
       const options = node.options || node.value?.options;
       if (options) {
         for (i = 0, len = options.length; i < len; i++) {
-          ok = walk({ stack: options[i] }, opts, starHeight);
+          ok = walk2({ stack: options[i] }, opts, starHeight);
           if (!ok) return false;
         }
       }
       const stack = node.stack || node.value?.stack;
       if (!stack) return true;
       for (i = 0, len = stack.length; i < len; i++) {
-        ok = walk(stack[i], opts, starHeight);
+        ok = walk2(stack[i], opts, starHeight);
         if (!ok) return false;
       }
       return true;
@@ -28157,7 +28157,7 @@ var require_safe_regex2 = __commonJS({
       if (isRegExp(re)) re = re.source;
       else if (typeof re !== "string") re = String(re);
       try {
-        return walk(parse(re), opts, 0);
+        return walk2(parse(re), opts, 0);
       } catch {
         return false;
       }
@@ -28199,7 +28199,7 @@ var require_http_method = __commonJS({
 var require_pretty_print = __commonJS({
   "node_modules/find-my-way/lib/pretty-print.js"(exports2, module2) {
     "use strict";
-    var deepEqual = require_fast_deep_equal();
+    var deepEqual2 = require_fast_deep_equal();
     var httpMethodStrategy = require_http_method();
     var treeDataSymbol = /* @__PURE__ */ Symbol("treeData");
     function printObjectTree(obj, parentPrefix = "") {
@@ -28275,7 +28275,7 @@ var require_pretty_print = __commonJS({
     function mergeSimilarRoutes(routes) {
       return routes.reduce((mergedRoutes, route) => {
         for (const nodeRoute of mergedRoutes) {
-          if (deepEqual(route.opts.constraints, nodeRoute.opts.constraints) && deepEqual(route.metaData, nodeRoute.metaData)) {
+          if (deepEqual2(route.opts.constraints, nodeRoute.opts.constraints) && deepEqual2(route.metaData, nodeRoute.metaData)) {
             nodeRoute.method += ", " + route.method;
             return mergedRoutes;
           }
@@ -29058,7 +29058,7 @@ var require_find_my_way = __commonJS({
     var assert = require("node:assert");
     var querystring = require_lib();
     var isRegexSafe = require_safe_regex2();
-    var deepEqual = require_fast_deep_equal();
+    var deepEqual2 = require_fast_deep_equal();
     var { prettyPrintTree } = require_pretty_print();
     var { StaticNode, NODE_TYPES } = require_node();
     var Constrainer = require_constrainer();
@@ -29269,7 +29269,7 @@ var require_find_my_way = __commonJS({
       }
       for (const existRoute of this.routes) {
         const routeConstraints = existRoute.opts.constraints || {};
-        if (existRoute.method === method && existRoute.pattern === pattern && deepEqual(routeConstraints, constraints)) {
+        if (existRoute.method === method && existRoute.pattern === pattern && deepEqual2(routeConstraints, constraints)) {
           throw new Error(`Method '${method}' already declared for route '${pattern}' with constraints '${JSON.stringify(constraints)}'`);
         }
       }
@@ -29382,7 +29382,7 @@ var require_find_my_way = __commonJS({
       }
       for (const existRoute of this.routes) {
         const routeConstraints = existRoute.opts.constraints || {};
-        if (existRoute.method === method && existRoute.pattern === pattern && deepEqual(routeConstraints, constraints)) {
+        if (existRoute.method === method && existRoute.pattern === pattern && deepEqual2(routeConstraints, constraints)) {
           return {
             handler: existRoute.handler,
             store: existRoute.store,
@@ -29438,7 +29438,7 @@ var require_find_my_way = __commonJS({
         return method !== route.method || path !== route.path;
       }
       function matcherWithConstraints(route) {
-        return matcherWithoutConstraints(route) || !deepEqual(constraints, route.opts.constraints || {});
+        return matcherWithoutConstraints(route) || !deepEqual2(constraints, route.opts.constraints || {});
       }
       const predicate = constraints ? matcherWithConstraints : matcherWithoutConstraints;
       const newRoutes = this.routes.filter(predicate);
@@ -31612,14 +31612,14 @@ var require_config_validator = __commonJS({
 var require_initial_config_validation = __commonJS({
   "node_modules/fastify/lib/initial-config-validation.js"(exports2, module2) {
     "use strict";
-    var validate = require_config_validator();
+    var validate2 = require_config_validator();
     var deepClone = require_rfdc()({ circles: true, proto: false });
     var { FST_ERR_INIT_OPTS_INVALID } = require_errors2();
     function validateInitialConfig(options) {
       const opts = deepClone(options);
-      if (!validate(opts)) {
-        const error = new FST_ERR_INIT_OPTS_INVALID(JSON.stringify(validate.errors.map((e) => e.message)));
-        error.errors = validate.errors;
+      if (!validate2(opts)) {
+        const error = new FST_ERR_INIT_OPTS_INVALID(JSON.stringify(validate2.errors.map((e) => e.message)));
+        error.errors = validate2.errors;
         throw error;
       }
       return deepFreezeObject(opts);
@@ -31636,7 +31636,7 @@ var require_initial_config_validation = __commonJS({
       return Object.freeze(object);
     }
     module2.exports = validateInitialConfig;
-    module2.exports.defaultInitOptions = validate.defaultInitOptions;
+    module2.exports.defaultInitOptions = validate2.defaultInitOptions;
     module2.exports.utils = { deepFreezeObject };
   }
 });
@@ -39303,7 +39303,7 @@ var require_commonjs5 = __commonJS({
           results.push(withFileTypes ? entry2 : entry2.fullpath());
         }
         const dirs = /* @__PURE__ */ new Set();
-        const walk = (dir, cb) => {
+        const walk2 = (dir, cb) => {
           dirs.add(dir);
           dir.readdirCB((er, entries) => {
             if (er) {
@@ -39322,10 +39322,10 @@ var require_commonjs5 = __commonJS({
                 results.push(withFileTypes ? e : e.fullpath());
               }
               if (follow && e.isSymbolicLink()) {
-                e.realpath().then((r) => r?.isUnknown() ? r.lstat() : r).then((r) => r?.shouldWalk(dirs, walkFilter) ? walk(r, next) : next());
+                e.realpath().then((r) => r?.isUnknown() ? r.lstat() : r).then((r) => r?.shouldWalk(dirs, walkFilter) ? walk2(r, next) : next());
               } else {
                 if (e.shouldWalk(dirs, walkFilter)) {
-                  walk(e, next);
+                  walk2(e, next);
                 } else {
                   next();
                 }
@@ -39335,7 +39335,7 @@ var require_commonjs5 = __commonJS({
         };
         const start = entry2;
         return new Promise((res, rej) => {
-          walk(start, (er) => {
+          walk2(start, (er) => {
             if (er)
               return rej(er);
             res(results);
@@ -41991,7 +41991,7 @@ var require_send = __commonJS({
     var { parseTokenList } = require_parseTokenList();
     var { createHttpError } = require_createHttpError();
     var extname2 = path.extname;
-    var join25 = path.join;
+    var join28 = path.join;
     var normalize2 = path.normalize;
     var resolve6 = path.resolve;
     var sep4 = path.sep;
@@ -42078,7 +42078,7 @@ var require_send = __commonJS({
           return { statusCode: 403 };
         }
         parts = path2.split(sep4);
-        path2 = normalize2(join25(root, path2));
+        path2 = normalize2(join28(root, path2));
       } else {
         if (UP_PATH_REGEXP.test(path2)) {
           debug('malicious path "%s"', path2);
@@ -42361,7 +42361,7 @@ var require_send = __commonJS({
       let err;
       for (let i = 0; i < options.index.length; i++) {
         const index = options.index[i];
-        const p = join25(path2, index);
+        const p = join28(path2, index);
         const { error, stat: stat4 } = await tryStat(p);
         if (error) {
           err = error;
@@ -43011,7 +43011,7 @@ var require_static = __commonJS({
   "node_modules/@fastify/static/index.js"(exports2, module2) {
     "use strict";
     var path = require("node:path");
-    var { fileURLToPath: fileURLToPath4 } = require("node:url");
+    var { fileURLToPath: fileURLToPath5 } = require("node:url");
     var { statSync: statSync8 } = require("node:fs");
     var { glob } = require_commonjs6();
     var fp = require_plugin2();
@@ -43145,8 +43145,8 @@ var require_static = __commonJS({
               }
             }
           }
-          for (const [dirname10, rootPath] of indexDirs.entries()) {
-            const pathname = dirname10 + (dirname10.endsWith("/") ? "" : "/");
+          for (const [dirname11, rootPath] of indexDirs.entries()) {
+            const pathname = dirname11 + (dirname11.endsWith("/") ? "" : "/");
             const file = "/" + pathname.replace(prefix, "");
             setUpHeadAndGet(routeOpts, pathname, file, rootPath);
             if (opts.redirect === true) {
@@ -43330,13 +43330,13 @@ var require_static = __commonJS({
         return root;
       }
       if (root instanceof URL && root.protocol === "file:") {
-        return fileURLToPath4(root);
+        return fileURLToPath5(root);
       }
       if (Array.isArray(root)) {
         const result = [];
         for (let i = 0, il = root.length; i < il; ++i) {
           if (root[i] instanceof URL && root[i].protocol === "file:") {
-            result.push(fileURLToPath4(root[i]));
+            result.push(fileURLToPath5(root[i]));
           } else {
             result.push(root[i]);
           }
@@ -43454,10 +43454,10 @@ var require_identity = __commonJS({
     var NODE_TYPE = /* @__PURE__ */ Symbol.for("yaml.node.type");
     var isAlias = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === ALIAS;
     var isDocument = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === DOC;
-    var isMap = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === MAP;
+    var isMap3 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === MAP;
     var isPair = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === PAIR;
     var isScalar = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SCALAR;
-    var isSeq = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SEQ;
+    var isSeq3 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SEQ;
     function isCollection(node) {
       if (node && typeof node === "object")
         switch (node[NODE_TYPE]) {
@@ -43490,11 +43490,11 @@ var require_identity = __commonJS({
     exports2.isAlias = isAlias;
     exports2.isCollection = isCollection;
     exports2.isDocument = isDocument;
-    exports2.isMap = isMap;
+    exports2.isMap = isMap3;
     exports2.isNode = isNode;
     exports2.isPair = isPair;
     exports2.isScalar = isScalar;
-    exports2.isSeq = isSeq;
+    exports2.isSeq = isSeq3;
   }
 });
 
@@ -47600,9 +47600,9 @@ var require_resolve_flow_collection = __commonJS({
     var blockMsg = "Block collections are not allowed within flow collections";
     var isBlock = (token) => token && (token.type === "block-map" || token.type === "block-seq");
     function resolveFlowCollection({ composeNode, composeEmptyNode }, ctx, fc, onError, tag) {
-      const isMap = fc.start.source === "{";
-      const fcName = isMap ? "flow map" : "flow sequence";
-      const NodeClass = tag?.nodeClass ?? (isMap ? YAMLMap.YAMLMap : YAMLSeq.YAMLSeq);
+      const isMap3 = fc.start.source === "{";
+      const fcName = isMap3 ? "flow map" : "flow sequence";
+      const NodeClass = tag?.nodeClass ?? (isMap3 ? YAMLMap.YAMLMap : YAMLSeq.YAMLSeq);
       const coll = new NodeClass(ctx.schema);
       coll.flow = true;
       const atRoot = ctx.atRoot;
@@ -47638,7 +47638,7 @@ var require_resolve_flow_collection = __commonJS({
             offset = props.end;
             continue;
           }
-          if (!isMap && ctx.options.strict && utilContainsNewline.containsNewline(key))
+          if (!isMap3 && ctx.options.strict && utilContainsNewline.containsNewline(key))
             onError(
               key,
               // checked by containsNewline()
@@ -47678,7 +47678,7 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap && !sep4 && !props.found) {
+        if (!isMap3 && !sep4 && !props.found) {
           const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep4, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
@@ -47701,7 +47701,7 @@ var require_resolve_flow_collection = __commonJS({
             startOnNewline: false
           });
           if (valueProps.found) {
-            if (!isMap && !props.found && ctx.options.strict) {
+            if (!isMap3 && !props.found && ctx.options.strict) {
               if (sep4)
                 for (const st of sep4) {
                   if (st === valueProps.found)
@@ -47733,7 +47733,7 @@ var require_resolve_flow_collection = __commonJS({
           const pair = new Pair.Pair(keyNode, valueNode);
           if (ctx.options.keepSourceTokens)
             pair.srcToken = collItem;
-          if (isMap) {
+          if (isMap3) {
             const map = coll;
             if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
               onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
@@ -47749,7 +47749,7 @@ var require_resolve_flow_collection = __commonJS({
           offset = valueNode ? valueNode.range[2] : valueProps.end;
         }
       }
-      const expectedEnd = isMap ? "}" : "]";
+      const expectedEnd = isMap3 ? "}" : "]";
       const [ce, ...ee] = fc.end;
       let cePos = offset;
       if (ce?.source === expectedEnd)
@@ -50649,7 +50649,7 @@ var require_public_api = __commonJS({
         return docs;
       return Object.assign([], { empty: true }, composer$1.streamInfo());
     }
-    function parseDocument2(source, options = {}) {
+    function parseDocument4(source, options = {}) {
       const { lineCounter: lineCounter2, prettyErrors } = parseOptions(options);
       const parser$1 = new parser.Parser(lineCounter2?.addNewLine);
       const composer$1 = new composer.Composer(options);
@@ -50675,7 +50675,7 @@ var require_public_api = __commonJS({
       } else if (options === void 0 && reviver && typeof reviver === "object") {
         options = reviver;
       }
-      const doc2 = parseDocument2(src, options);
+      const doc2 = parseDocument4(src, options);
       if (!doc2)
         return null;
       doc2.warnings.forEach((warning) => log2.warn(doc2.options.logLevel, warning));
@@ -50711,7 +50711,7 @@ var require_public_api = __commonJS({
     }
     exports2.parse = parse;
     exports2.parseAllDocuments = parseAllDocuments;
-    exports2.parseDocument = parseDocument2;
+    exports2.parseDocument = parseDocument4;
     exports2.stringify = stringify;
   }
 });
@@ -50826,10 +50826,10 @@ var import_node_child_process8 = require("node:child_process");
 var import_node_readline2 = require("node:readline");
 
 // index.ts
-var import_node_url3 = require("node:url");
-var import_node_path23 = require("node:path");
-var import_node_os17 = require("node:os");
-var import_node_fs24 = require("node:fs");
+var import_node_url4 = require("node:url");
+var import_node_path26 = require("node:path");
+var import_node_os18 = require("node:os");
+var import_node_fs28 = require("node:fs");
 var import_node_child_process6 = require("node:child_process");
 
 // log.mjs
@@ -50920,6 +50920,10 @@ function appDir(id) {
   if (!(0, import_node_fs3.existsSync)(dir)) throw new AppNotFoundError(id);
   return dir;
 }
+function appPath(id) {
+  if (id.includes("/") || id.includes("\\") || id.includes("..")) throw new AppNotFoundError(id);
+  return (0, import_node_path2.join)(APPS_DIR, id);
+}
 function appExists(id) {
   if (id.includes("/") || id.includes("\\") || id.includes("..")) return false;
   return (0, import_node_fs3.existsSync)((0, import_node_path2.join)(APPS_DIR, id));
@@ -51012,6 +51016,8 @@ function readApp(id) {
       kind: locked && typeof locked.kind === "string" ? locked.kind : "agent",
       mode: lockMode === "write" || lockMode === "read" ? lockMode : "unknown",
       runtimeModel: !!locked && locked["runtime-model"] === true,
+      // `frozen:` lives on the SOURCE node (the user froze it); present (non-null) = frozen.
+      frozen: n.frozen != null,
       inputs: asRecord(locked?.inputs),
       config: asRecord(n.config),
       notes: notes2,
@@ -51623,6 +51629,10 @@ function assertId(id) {
   if (!APP_ID.test(id)) throw new AwareError(`invalid app id: ${JSON.stringify(id)}`);
   return id;
 }
+function assertNodeId(id) {
+  if (!APP_ID.test(id)) throw new AwareError(`invalid node id: ${JSON.stringify(id)}`);
+  return id;
+}
 var SOURCE_EXT = /\.(flo|app|flow|aware)$/i;
 function assertSourcePath(p) {
   if (!SOURCE_EXT.test(p)) throw new AwareError(`source must be a .flo/.app file: ${JSON.stringify(p)}`);
@@ -52004,6 +52014,39 @@ var aware = {
     }
     return { compiled: /lock refreshed/i.test(stdout), output: stdout.trim() };
   },
+  /**
+   * Freeze a node (`aware app freeze <app> <node>`, CLI ≥ 0.77, aware-aeco#261). Pins the
+   * node's LAST run output into the source as a `frozen:` block so Run skips the agent
+   * (replays the pinned value, never re-runs it) and recompiles the lock. Fails when the
+   * node has never produced output (nothing to pin) — the route relays that as "run it
+   * once first". Throws AwareUnsupportedError on a pre-0.77 CLI so the route can say "update
+   * AWARE" instead of treating an old CLI as a hard fault (mirrors rename/duplicate).
+   */
+  async freeze(appId, nodeId) {
+    const { code, stdout, stderr } = await runRaw(["app", "freeze", assertId(appId), assertNodeId(nodeId)]);
+    if (code !== 0) {
+      if (isInvokeUnsupported({ stdout, stderr })) {
+        throw new AwareUnsupportedError("aware CLI does not support `app freeze` (needs \u2265 0.77) \u2014 update AWARE", { stdout, stderr });
+      }
+      throw new AwareError(`aware app freeze ${nodeId} failed (exit ${code})`, { stdout, stderr, code });
+    }
+    return { output: stdout.trim() };
+  },
+  /**
+   * Unfreeze a node (`aware app unfreeze <app> <node>`, CLI ≥ 0.77). Removes the node's
+   * `frozen:` block so it runs normally again and recompiles. Same unsupported-degradation
+   * contract as freeze.
+   */
+  async unfreeze(appId, nodeId) {
+    const { code, stdout, stderr } = await runRaw(["app", "unfreeze", assertId(appId), assertNodeId(nodeId)]);
+    if (code !== 0) {
+      if (isInvokeUnsupported({ stdout, stderr })) {
+        throw new AwareUnsupportedError("aware CLI does not support `app unfreeze` (needs \u2265 0.77) \u2014 update AWARE", { stdout, stderr });
+      }
+      throw new AwareError(`aware app unfreeze ${nodeId} failed (exit ${code})`, { stdout, stderr, code });
+    }
+    return { output: stdout.trim() };
+  },
   /**
    * Install a first-party agent by registry id (`aware agent install <id>`). The
    * registry install pulls a large tarball (~200s observed) — far over runRaw's 60s
@@ -52792,7 +52835,7 @@ function appVersion() {
   return resolveVersion({
     isSea: isSea2(),
     sqVersionXml: readSqVersionXml(),
-    define: true ? "0.28.0" : void 0,
+    define: true ? "0.30.0" : void 0,
     pkgVersion: readPkgVersion()
   });
 }
@@ -52802,7 +52845,7 @@ function resolveChannel(s) {
   return "dev";
 }
 function appChannel() {
-  return resolveChannel({ isSea: isSea2(), define: true ? "0.28.0" : void 0 });
+  return resolveChannel({ isSea: isSea2(), define: true ? "0.30.0" : void 0 });
 }
 
 // oauth-presets.ts
@@ -53492,14 +53535,323 @@ function deleteVisualInputs(id) {
   if ((0, import_node_fs14.existsSync)(dir)) (0, import_node_fs14.rmSync)(dir, { recursive: true, force: true });
 }
 
-// app-lifecycle.ts
+// contract-store.ts
+var import_node_fs16 = require("node:fs");
+var import_node_path14 = require("node:path");
+var import_node_os11 = require("node:os");
+
+// contract-schema.ts
+var import_node_fs15 = require("node:fs");
+var import_node_path13 = require("node:path");
+var import_node_url = require("node:url");
+function validate(doc2, schema) {
+  const errors = [];
+  walk(doc2, schema, schema, "$", errors);
+  return { valid: errors.length === 0, errors };
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function resolveRef(root, ref) {
+  const m = /^#\/\$defs\/(.+)$/.exec(ref);
+  if (!m) return null;
+  return root.$defs?.[m[1]] ?? null;
+}
+function typeMatches(value, t) {
+  switch (t) {
+    case "object":
+      return isPlainObject(value);
+    case "array":
+      return Array.isArray(value);
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number";
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "boolean":
+      return typeof value === "boolean";
+    case "null":
+      return value === null;
+    default:
+      return false;
+  }
+}
+function kindOf(v) {
+  if (v === null) return "null";
+  if (Array.isArray(v)) return "array";
+  return typeof v;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    return a.length === b.length && a.every((x, i) => deepEqual(x, b[i]));
+  }
+  return false;
+}
+function walk(value, node, root, path, errors) {
+  if (node.$ref) {
+    const target = resolveRef(root, node.$ref);
+    if (!target) {
+      errors.push({ path, message: `unresolved $ref ${node.$ref}` });
+      return;
+    }
+    walk(value, target, root, path, errors);
+    return;
+  }
+  if ("const" in node && !deepEqual(value, node.const)) {
+    errors.push({ path, message: `must equal ${JSON.stringify(node.const)}` });
+  }
+  if (node.enum && !node.enum.some((e) => deepEqual(value, e))) {
+    errors.push({ path, message: `must be one of ${JSON.stringify(node.enum)}` });
+  }
+  if (node.type) {
+    const types = Array.isArray(node.type) ? node.type : [node.type];
+    if (!types.some((t) => typeMatches(value, t))) {
+      errors.push({ path, message: `expected ${types.join(" | ")}, got ${kindOf(value)}` });
+      return;
+    }
+  }
+  if (isPlainObject(value)) {
+    for (const r of node.required ?? []) {
+      if (!Object.hasOwn(value, r)) errors.push({ path: `${path}.${r}`, message: "required" });
+    }
+    const props = node.properties ?? {};
+    const ap = node.additionalProperties;
+    for (const key of Object.keys(value)) {
+      if (Object.hasOwn(props, key)) {
+        walk(value[key], props[key], root, `${path}.${key}`, errors);
+      } else if (ap === false) {
+        errors.push({ path: `${path}.${key}`, message: "additional property not allowed" });
+      } else if (ap && typeof ap === "object") {
+        walk(value[key], ap, root, `${path}.${key}`, errors);
+      }
+    }
+  }
+  if (Array.isArray(value)) {
+    if (typeof node.minItems === "number" && value.length < node.minItems) {
+      errors.push({ path, message: `expected at least ${node.minItems} items, got ${value.length}` });
+    }
+    if (typeof node.maxItems === "number" && value.length > node.maxItems) {
+      errors.push({ path, message: `expected at most ${node.maxItems} items, got ${value.length}` });
+    }
+    if (node.items) {
+      value.forEach((el, i) => walk(el, node.items, root, `${path}[${i}]`, errors));
+    }
+  }
+}
+var _cached = null;
+function loadSteelTakeoffSchema() {
+  if (_cached) return _cached;
+  const here = (0, import_node_path13.dirname)((0, import_node_url.fileURLToPath)(__import_meta_url));
+  const candidates = [
+    (0, import_node_path13.join)(here, "..", "schemas", "steel.takeoff.v1.schema.json"),
+    // dev: server/ next to schemas/
+    (0, import_node_path13.join)(here, "schemas", "steel.takeoff.v1.schema.json")
+    // bundled: dist/ holds ./schemas
+  ];
+  for (const p of candidates) {
+    try {
+      const text = (0, import_node_fs15.readFileSync)(p, "utf8");
+      _cached = JSON.parse(text);
+      return _cached;
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  }
+  throw new Error("steel.takeoff/v1 schema file not found");
+}
+function validateSteelTakeoff(doc2) {
+  return validate(doc2, loadSteelTakeoffSchema());
+}
+
+// contract-store.ts
+var ContractError = class extends Error {
+};
+var ROOT3 = process.env.FLOLESS_HOME ?? (0, import_node_path14.join)((0, import_node_os11.homedir)(), ".floless");
+var DIR = (0, import_node_path14.join)(ROOT3, "contracts");
+function safeId(appId) {
+  if (!/^[a-z0-9][a-z0-9._-]*$/i.test(appId)) throw new ContractError(`invalid appId: ${appId}`);
+  return appId;
+}
+function contractPath(appId) {
+  return (0, import_node_path14.join)(DIR, `${safeId(appId)}.json`);
+}
+function readContract(appId) {
+  const p = contractPath(appId);
+  if (!(0, import_node_fs16.existsSync)(p)) return null;
+  try {
+    return JSON.parse((0, import_node_fs16.readFileSync)(p, "utf8"));
+  } catch (e) {
+    console.warn(`readContract: ignoring unreadable contract at ${p}: ${e instanceof Error ? e.message : e}`);
+    return null;
+  }
+}
+function writeContract(appId, doc2) {
+  const p = contractPath(appId);
+  const res = validateSteelTakeoff(doc2);
+  if (!res.valid) {
+    const first = res.errors.slice(0, 5).map((e) => `${e.path}: ${e.message}`).join("; ");
+    throw new ContractError(`contract failed schema validation \u2014 ${first}`);
+  }
+  if (!(0, import_node_fs16.existsSync)(DIR)) (0, import_node_fs16.mkdirSync)(DIR, { recursive: true });
+  (0, import_node_fs16.writeFileSync)(p, JSON.stringify(doc2));
+}
+
+// contract-bake.ts
 var import_node_fs17 = require("node:fs");
-var import_node_os12 = require("node:os");
+var import_yaml4 = __toESM(require_dist6(), 1);
+function bakeContractIntoApp(sourcePath, contract) {
+  const doc2 = (0, import_yaml4.parseDocument)((0, import_node_fs17.readFileSync)(sourcePath, "utf8"));
+  if (doc2.errors.length > 0) {
+    throw new Error(`contract bake: source is not valid YAML: ${doc2.errors[0]?.message ?? "parse error"}`);
+  }
+  const seq = doc2.get("nodes");
+  const items = (0, import_yaml4.isSeq)(seq) ? seq.items : [];
+  const nodeOf = (it) => (0, import_yaml4.isMap)(it) ? it.toJSON() : null;
+  let idx = items.findIndex((it) => nodeOf(it)?.config?.contract === contract.type);
+  if (idx < 0) idx = items.findIndex((it) => nodeOf(it)?.agent === "steel-takeoff-us");
+  if (idx < 0) throw new Error("no contract-emitting node to bake the contract into");
+  doc2.setIn(["nodes", idx, "config", "contract"], contract.type);
+  doc2.setIn(["nodes", idx, "config", "takeoff"], contract);
+  (0, import_node_fs17.writeFileSync)(sourcePath, doc2.toString());
+}
+
+// contract-to-scene.ts
+var FT_TO_MM = 304.8;
+var IN_TO_MM = 25.4;
+function profileDims(profile) {
+  if (!profile) return null;
+  const p = profile.trim().toUpperCase();
+  if (p === "" || /(^|[^A-Z])MF($|[^A-Z])/.test(p)) return null;
+  const m = p.match(/^([A-Z]+)\s*([0-9X./]+)/);
+  if (!m) return null;
+  const prefix = m[1];
+  const nums = m[2].split("X").map((t) => parseFloat(t)).filter((n) => !isNaN(n));
+  if (nums.length === 0) return null;
+  if ((prefix === "HSS" || prefix === "TUBE" || prefix === "L") && nums.length >= 3) {
+    return { d: nums[0] * IN_TO_MM, w: nums[1] * IN_TO_MM, approx: false };
+  }
+  if (prefix === "HSS" || prefix === "PIPE") {
+    const dia = nums[0] * IN_TO_MM;
+    return { d: dia, w: dia, approx: false };
+  }
+  if (/^(W|S|M|HP|C|MC|WT|ST|MT)$/.test(prefix)) {
+    const d = nums[0] * IN_TO_MM;
+    const ratio = prefix === "C" || prefix === "MC" ? 0.28 : 0.42;
+    return { d, w: d * ratio, approx: true };
+  }
+  return null;
+}
+function pickColor(profile, idx, contract) {
+  const pc = contract.profile_colors ?? {};
+  const override = pc[profile] ?? Object.entries(pc).find(([k]) => k.toUpperCase() === profile)?.[1];
+  if (override) return override;
+  const pal = contract.palette ?? [];
+  if (pal.length === 0) return "#94a3b8";
+  return pal[(idx % pal.length + pal.length) % pal.length];
+}
+function dispToMm(pt, ptPerFt) {
+  const k = FT_TO_MM / ptPerFt;
+  return [pt[0] * k, -pt[1] * k];
+}
+function contractToScene(contractInput) {
+  const contract = contractInput ?? {};
+  const elements = [];
+  const skipped = [];
+  const profileOrder = [];
+  const seenProfile = /* @__PURE__ */ new Set();
+  for (const plan of contract.plans ?? []) {
+    const ptPerFt = plan.pt_per_ft && plan.pt_per_ft > 0 ? plan.pt_per_ft : 1;
+    const defaultTosMm = (plan.default_tos ?? 0) * IN_TO_MM;
+    for (const m of plan.members ?? []) {
+      const dims = profileDims(m.profile);
+      if (!dims || !Array.isArray(m.wp) || m.wp.length < 2) {
+        skipped.push(m.id);
+        continue;
+      }
+      const profile = (m.profile ?? "").trim().toUpperCase();
+      if (!seenProfile.has(profile)) {
+        seenProfile.add(profile);
+        profileOrder.push(profile);
+      }
+      const [ax, ay] = dispToMm(m.wp[0], ptPerFt);
+      const [bx, by] = dispToMm(m.wp[1], ptPerFt);
+      let from;
+      let to;
+      if (m.role === "column") {
+        const bos = m.col?.bos != null ? m.col.bos * IN_TO_MM : 0;
+        const tos = m.col?.tos != null ? m.col.tos * IN_TO_MM : defaultTosMm;
+        from = [ax, ay, bos];
+        to = [ax, ay, tos];
+      } else {
+        const z0 = m.ends?.[0]?.tos != null ? m.ends[0].tos * IN_TO_MM : defaultTosMm;
+        const z1 = m.ends?.[1]?.tos != null ? m.ends[1].tos * IN_TO_MM : defaultTosMm;
+        from = [ax, ay, z0];
+        to = [bx, by, z1];
+      }
+      elements.push({ id: m.id, group: profile, kind: "box", from, to, section: { w: dims.w, d: dims.d }, meta: { profile } });
+    }
+  }
+  const groups = profileOrder.map((profile, i) => ({
+    key: profile,
+    label: profile,
+    color: pickColor(profile, i, contract)
+  }));
+  return {
+    scene: { meta: { name: contract.title || "Steel takeoff", units: "mm", up: "z" }, groups, elements },
+    skipped
+  };
+}
+
+// scene-bake.ts
+var import_node_fs18 = require("node:fs");
 var import_node_path15 = require("node:path");
+var import_yaml5 = __toESM(require_dist6(), 1);
+function bakeSceneIntoApp(sourcePath, scene, agent = "viewer-3d") {
+  const doc2 = (0, import_yaml5.parseDocument)((0, import_node_fs18.readFileSync)(sourcePath, "utf8"));
+  if (doc2.errors.length > 0) {
+    throw new Error(`scene bake: source is not valid YAML: ${doc2.errors[0]?.message ?? "parse error"}`);
+  }
+  const seq = doc2.get("nodes");
+  const items = (0, import_yaml5.isSeq)(seq) ? seq.items : [];
+  const idx = items.findIndex((it) => ((0, import_yaml5.isMap)(it) ? it.toJSON() : null)?.agent === agent);
+  if (idx < 0) throw new Error(`no ${agent} render node to bake the scene into`);
+  doc2.setIn(["nodes", idx, "config", "scene"], scene);
+  (0, import_node_fs18.writeFileSync)(sourcePath, doc2.toString());
+}
+function writeViewer3dApp(dir, appId, scene) {
+  (0, import_node_fs18.mkdirSync)(dir, { recursive: true });
+  const flo = (0, import_node_path15.join)(dir, `${appId}.flo`);
+  (0, import_node_fs18.writeFileSync)(flo, [
+    `app: ${appId}`,
+    "version: 0.1.0",
+    "display-name: Steel 3D",
+    "description: 3D model rendered from an approved steel.takeoff/v1 contract (a companion view; the contract is the source of truth).",
+    "exposes-as-agent: false",
+    "requires:",
+    "  - viewer-3d@0.1.x",
+    "layout: linear",
+    "nodes:",
+    "  - id: view",
+    "    agent: viewer-3d",
+    "    command: render",
+    "    config:",
+    "      scene: {}",
+    ""
+  ].join("\n"));
+  bakeSceneIntoApp(flo, scene);
+  return flo;
+}
+
+// app-lifecycle.ts
+var import_node_fs21 = require("node:fs");
+var import_node_os13 = require("node:os");
+var import_node_path18 = require("node:path");
 
 // routines.ts
-var import_node_fs16 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_fs20 = require("node:fs");
+var import_node_path17 = require("node:path");
 
 // sse.ts
 var clients = /* @__PURE__ */ new Set();
@@ -53536,11 +53888,11 @@ function clientCount() {
 }
 
 // trigger-sessions.ts
-var import_node_fs15 = require("node:fs");
-var import_node_os11 = require("node:os");
-var import_node_path13 = require("node:path");
-var import_yaml4 = __toESM(require_dist6(), 1);
-var AGENTS_DIR2 = process.env.AWARE_HOME ? (0, import_node_path13.join)(process.env.AWARE_HOME, "agents") : (0, import_node_path13.join)((0, import_node_os11.homedir)(), ".aware", "agents");
+var import_node_fs19 = require("node:fs");
+var import_node_os12 = require("node:os");
+var import_node_path16 = require("node:path");
+var import_yaml6 = __toESM(require_dist6(), 1);
+var AGENTS_DIR2 = process.env.AWARE_HOME ? (0, import_node_path16.join)(process.env.AWARE_HOME, "agents") : (0, import_node_path16.join)((0, import_node_os12.homedir)(), ".aware", "agents");
 function summarizeFire(data) {
   if (!data) return "event";
   const type = typeof data.type === "string" ? data.type : "";
@@ -53557,10 +53909,10 @@ function mapTriggerState(phase) {
 function isHostBacked(agent, agentsDir = AGENTS_DIR2) {
   const safe = (n) => !n.includes("/") && !n.includes("\\") && !n.includes("..");
   if (!safe(agent)) return false;
-  const manifestPath = (0, import_node_path13.join)(agentsDir, agent, "manifest.yaml");
-  if (!(0, import_node_fs15.existsSync)(manifestPath)) return false;
+  const manifestPath = (0, import_node_path16.join)(agentsDir, agent, "manifest.yaml");
+  if (!(0, import_node_fs19.existsSync)(manifestPath)) return false;
   try {
-    const doc2 = (0, import_yaml4.parse)((0, import_node_fs15.readFileSync)(manifestPath, "utf8"));
+    const doc2 = (0, import_yaml6.parse)((0, import_node_fs19.readFileSync)(manifestPath, "utf8"));
     const transport = doc2?.transport;
     return !!(transport && typeof transport === "object" && "cli" in transport);
   } catch {
@@ -53845,7 +54197,7 @@ var RoutineError = class extends Error {
   }
   status;
 };
-var ROUTINES_FILE = (0, import_node_path14.join)(flolessRoot, "routines.json");
+var ROUTINES_FILE = (0, import_node_path17.join)(flolessRoot, "routines.json");
 var routines = [];
 var loaded = false;
 function ensureLoaded() {
@@ -53881,10 +54233,10 @@ function sanitizeRoutine(raw) {
   };
 }
 function loadFromDisk() {
-  if (!(0, import_node_fs16.existsSync)(ROUTINES_FILE)) return [];
+  if (!(0, import_node_fs20.existsSync)(ROUTINES_FILE)) return [];
   let text;
   try {
-    text = (0, import_node_fs16.readFileSync)(ROUTINES_FILE, "utf8");
+    text = (0, import_node_fs20.readFileSync)(ROUTINES_FILE, "utf8");
   } catch {
     return [];
   }
@@ -53893,17 +54245,17 @@ function loadFromDisk() {
     return Array.isArray(parsed) ? parsed.map(sanitizeRoutine).filter((r) => r !== null) : [];
   } catch {
     try {
-      (0, import_node_fs16.renameSync)(ROUTINES_FILE, `${ROUTINES_FILE}.corrupt-${Date.now()}`);
+      (0, import_node_fs20.renameSync)(ROUTINES_FILE, `${ROUTINES_FILE}.corrupt-${Date.now()}`);
     } catch {
     }
     return [];
   }
 }
 function saveRoutines() {
-  if (!(0, import_node_fs16.existsSync)(flolessRoot)) (0, import_node_fs16.mkdirSync)(flolessRoot, { recursive: true });
+  if (!(0, import_node_fs20.existsSync)(flolessRoot)) (0, import_node_fs20.mkdirSync)(flolessRoot, { recursive: true });
   const tmp = `${ROUTINES_FILE}.${process.pid}.tmp`;
-  (0, import_node_fs16.writeFileSync)(tmp, JSON.stringify(routines, null, 2));
-  (0, import_node_fs16.renameSync)(tmp, ROUTINES_FILE);
+  (0, import_node_fs20.writeFileSync)(tmp, JSON.stringify(routines, null, 2));
+  (0, import_node_fs20.renameSync)(tmp, ROUTINES_FILE);
 }
 function listRoutines() {
   ensureLoaded();
@@ -54311,13 +54663,13 @@ var AppLifecycleError = class extends Error {
   }
 };
 function appsDir() {
-  return process.env.AWARE_HOME ? (0, import_node_path15.join)(process.env.AWARE_HOME, "apps") : (0, import_node_path15.join)((0, import_node_os12.homedir)(), ".aware", "apps");
+  return process.env.AWARE_HOME ? (0, import_node_path18.join)(process.env.AWARE_HOME, "apps") : (0, import_node_path18.join)((0, import_node_os13.homedir)(), ".aware", "apps");
 }
 function appDirPath(id) {
-  return (0, import_node_path15.join)(appsDir(), id);
+  return (0, import_node_path18.join)(appsDir(), id);
 }
 function appInstalled(id) {
-  return APP_ID3.test(id) && (0, import_node_fs17.existsSync)(appDirPath(id));
+  return APP_ID3.test(id) && (0, import_node_fs21.existsSync)(appDirPath(id));
 }
 function logCascade(what, e) {
   console.error(`[app-lifecycle] cascade step failed (${what}):`, e instanceof Error ? e.message : e);
@@ -54410,14 +54762,17 @@ function isGatedAwareRoute(url, method) {
   if (path.startsWith("/api/trigger-run/")) return false;
   if (path === "/api/trigger-run") return m === "POST";
   if (path.startsWith("/api/app/")) return m === "PATCH" || m === "POST" || m === "DELETE";
+  if (path.startsWith("/api/contract/")) {
+    return m === "POST" && (path.endsWith("/approve") || path.endsWith("/export-3d"));
+  }
   return AWARE_ROUTES.some((p) => path.startsWith(p));
 }
 
 // autostart.mjs
 var import_node_child_process3 = require("node:child_process");
-var import_node_fs18 = require("node:fs");
-var import_node_os13 = require("node:os");
-var import_node_path16 = require("node:path");
+var import_node_fs22 = require("node:fs");
+var import_node_os14 = require("node:os");
+var import_node_path19 = require("node:path");
 
 // teardown.mjs
 var RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
@@ -54529,8 +54884,8 @@ function removeLegacyRunKey() {
 }
 function logLine(msg) {
   try {
-    (0, import_node_fs18.mkdirSync)(logDir(), { recursive: true });
-    (0, import_node_fs18.appendFileSync)(logFilePath(), `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
+    (0, import_node_fs22.mkdirSync)(logDir(), { recursive: true });
+    (0, import_node_fs22.appendFileSync)(logFilePath(), `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
 `);
   } catch {
   }
@@ -54538,8 +54893,8 @@ function logLine(msg) {
 function registerAutostart(exePath) {
   if (!isWin) return;
   const xml = buildAutostartTaskXml(exePath, currentUserId());
-  const tmp = (0, import_node_path16.join)((0, import_node_os13.tmpdir)(), `floless-autostart-${process.pid}-${Date.now()}.xml`);
-  (0, import_node_fs18.writeFileSync)(tmp, "\uFEFF" + xml, { encoding: "utf16le" });
+  const tmp = (0, import_node_path19.join)((0, import_node_os14.tmpdir)(), `floless-autostart-${process.pid}-${Date.now()}.xml`);
+  (0, import_node_fs22.writeFileSync)(tmp, "\uFEFF" + xml, { encoding: "utf16le" });
   try {
     (0, import_node_child_process3.execFileSync)("schtasks", ["/Create", "/TN", TASK_NAME, "/XML", tmp, "/F"], {
       stdio: ["ignore", "ignore", "ignore"],
@@ -54550,7 +54905,7 @@ function registerAutostart(exePath) {
     throw err;
   } finally {
     try {
-      (0, import_node_fs18.rmSync)(tmp, { force: true });
+      (0, import_node_fs22.rmSync)(tmp, { force: true });
     } catch {
     }
   }
@@ -54585,26 +54940,26 @@ function unregisterAutostart() {
 // updater.ts
 var import_node_child_process4 = require("node:child_process");
 var import_node_crypto6 = require("node:crypto");
-var import_node_fs20 = require("node:fs");
+var import_node_fs24 = require("node:fs");
 var import_node_stream = require("node:stream");
 var import_promises = require("node:stream/promises");
-var import_node_path18 = require("node:path");
+var import_node_path21 = require("node:path");
 
 // post-update-marker.mjs
-var import_node_fs19 = require("node:fs");
-var import_node_os14 = require("node:os");
-var import_node_path17 = require("node:path");
+var import_node_fs23 = require("node:fs");
+var import_node_os15 = require("node:os");
+var import_node_path20 = require("node:path");
 var FRESH_MS = 12e4;
 function markerPath() {
   const override = (process.env.FLOLESS_POST_UPDATE_MARKER ?? "").trim();
   if (override) return override;
-  const root = process.env.FLOLESS_HOME ?? (0, import_node_path17.join)((0, import_node_os14.homedir)(), ".floless");
-  return (0, import_node_path17.join)(root, ".post-update");
+  const root = process.env.FLOLESS_HOME ?? (0, import_node_path20.join)((0, import_node_os15.homedir)(), ".floless");
+  return (0, import_node_path20.join)(root, ".post-update");
 }
 function legacyMarkerPath() {
   if ((process.env.FLOLESS_POST_UPDATE_MARKER ?? "").trim()) return null;
   try {
-    return (0, import_node_path17.join)((0, import_node_path17.dirname)((0, import_node_path17.dirname)(process.execPath)), ".floless-post-update");
+    return (0, import_node_path20.join)((0, import_node_path20.dirname)((0, import_node_path20.dirname)(process.execPath)), ".floless-post-update");
   } catch {
     return null;
   }
@@ -54614,7 +54969,7 @@ function writePostUpdateMarker() {
   for (const p of [markerPath(), legacyMarkerPath()]) {
     if (!p) continue;
     try {
-      (0, import_node_fs19.writeFileSync)(p, (/* @__PURE__ */ new Date()).toISOString());
+      (0, import_node_fs23.writeFileSync)(p, (/* @__PURE__ */ new Date()).toISOString());
       wrote = true;
     } catch {
     }
@@ -54626,9 +54981,9 @@ function consumePostUpdateMarker() {
   for (const p of [markerPath(), legacyMarkerPath()]) {
     if (!p) continue;
     try {
-      if (!(0, import_node_fs19.existsSync)(p)) continue;
-      const ageMs = Date.now() - (0, import_node_fs19.statSync)(p).mtimeMs;
-      (0, import_node_fs19.rmSync)(p, { force: true });
+      if (!(0, import_node_fs23.existsSync)(p)) continue;
+      const ageMs = Date.now() - (0, import_node_fs23.statSync)(p).mtimeMs;
+      (0, import_node_fs23.rmSync)(p, { force: true });
       if (ageMs < FRESH_MS) fresh = true;
     } catch {
     }
@@ -54645,13 +55000,13 @@ function currentVersion() {
   return appVersion();
 }
 function installRoot() {
-  return (0, import_node_path18.dirname)((0, import_node_path18.dirname)(process.execPath));
+  return (0, import_node_path21.dirname)((0, import_node_path21.dirname)(process.execPath));
 }
 function updateExePath() {
-  return (0, import_node_path18.join)(installRoot(), "Update.exe");
+  return (0, import_node_path21.join)(installRoot(), "Update.exe");
 }
 function packagesDir() {
-  return (0, import_node_path18.join)(installRoot(), "packages");
+  return (0, import_node_path21.join)(installRoot(), "packages");
 }
 function feedUrl() {
   const env2 = (process.env.FLOLESS_UPDATE_URL ?? "").trim().replace(/\/+$/, "");
@@ -54744,22 +55099,22 @@ async function checkForUpdate() {
 }
 async function sha1OfFile(path) {
   const hash = (0, import_node_crypto6.createHash)("sha1");
-  await (0, import_promises.pipeline)((0, import_node_fs20.createReadStream)(path), hash);
+  await (0, import_promises.pipeline)((0, import_node_fs24.createReadStream)(path), hash);
   return hash.digest("hex").toUpperCase();
 }
 async function downloadPackage(asset) {
   if (!NUPKG_NAME.test(asset.FileName)) throw new Error(`refusing suspicious package name: ${asset.FileName}`);
   const want = asset.SHA1.toUpperCase();
   const dir = packagesDir();
-  (0, import_node_fs20.mkdirSync)(dir, { recursive: true });
-  const dest = (0, import_node_path18.join)(dir, asset.FileName);
-  if ((0, import_node_fs20.existsSync)(dest) && await sha1OfFile(dest) === want) return dest;
+  (0, import_node_fs24.mkdirSync)(dir, { recursive: true });
+  const dest = (0, import_node_path21.join)(dir, asset.FileName);
+  if ((0, import_node_fs24.existsSync)(dest) && await sha1OfFile(dest) === want) return dest;
   const res = await authedFetch(`${feedUrl()}/${encodeURIComponent(asset.FileName)}`, {
     redirect: "follow",
     signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
   });
   if (!res.ok || !res.body) throw new Error(`download failed: HTTP ${res.status} for ${asset.FileName}`);
-  await (0, import_promises.pipeline)(import_node_stream.Readable.fromWeb(res.body), (0, import_node_fs20.createWriteStream)(dest));
+  await (0, import_promises.pipeline)(import_node_stream.Readable.fromWeb(res.body), (0, import_node_fs24.createWriteStream)(dest));
   const got = await sha1OfFile(dest);
   if (got !== want) throw new Error(`SHA1 mismatch for ${asset.FileName}: feed=${want} got=${got}`);
   return dest;
@@ -54768,7 +55123,7 @@ async function applyUpdate(check, opts) {
   if (!check.supported) return { applied: false, message: check.reason ?? "auto-update not supported in this runtime" };
   if (!check.updateAvailable || !check.asset) return { applied: false, message: check.reason ?? "no update available" };
   const exe = updateExePath();
-  if (!(0, import_node_fs20.existsSync)(exe)) {
+  if (!(0, import_node_fs24.existsSync)(exe)) {
     return { applied: false, message: `Update.exe not found at ${exe} \u2014 is this a Velopack install?` };
   }
   const pkg = await downloadPackage(check.asset);
@@ -55008,12 +55363,12 @@ function isTraceCorrupt(events) {
 
 // launch.mjs
 var import_node_child_process5 = require("node:child_process");
-var import_node_path19 = require("node:path");
-var import_node_url = require("node:url");
-var import_node_fs21 = require("node:fs");
+var import_node_path22 = require("node:path");
+var import_node_url2 = require("node:url");
+var import_node_fs25 = require("node:fs");
 var import_node_http = __toESM(require("node:http"), 1);
 var import_node_readline = require("node:readline");
-var __dirname2 = (0, import_node_path19.dirname)((0, import_node_url.fileURLToPath)(__import_meta_url));
+var __dirname2 = (0, import_node_path22.dirname)((0, import_node_url2.fileURLToPath)(__import_meta_url));
 var PORT = Number(process.env.PORT ?? 4317);
 var HEALTH_URL = `http://127.0.0.1:${PORT}/api/health`;
 var BROWSER_URL = `http://floless.localhost:${PORT}`;
@@ -55085,8 +55440,8 @@ async function waitHealthy(timeoutMs = 3e4) {
 function resolveServerStart() {
   const packaged = /flolessapp\.exe$/i.test(process.execPath);
   if (packaged) return { cmd: process.execPath, args: ["--serve"], shell: false };
-  const bundle = (0, import_node_path19.join)(__dirname2, "dist", "floless-server.cjs");
-  if ((0, import_node_fs21.existsSync)(bundle)) return { cmd: process.execPath, args: [bundle, "--serve"], shell: false };
+  const bundle = (0, import_node_path22.join)(__dirname2, "dist", "floless-server.cjs");
+  if ((0, import_node_fs25.existsSync)(bundle)) return { cmd: process.execPath, args: [bundle, "--serve"], shell: false };
   return { cmd: "npm", args: ["run", "start"], shell: isWin2 };
 }
 function startServerDetached() {
@@ -55239,8 +55594,8 @@ function taskkillArgs(pid, { tree = true } = {}) {
 }
 function killSupervisor({ tree = true } = {}) {
   if (!isWin2) return;
-  const isNpmChannel = /^node(\.exe)?$/i.test((0, import_node_path19.basename)(process.execPath));
-  const scriptMatch = isNpmChannel ? (0, import_node_path19.basename)((0, import_node_url.fileURLToPath)(__import_meta_url)) : void 0;
+  const isNpmChannel = /^node(\.exe)?$/i.test((0, import_node_path22.basename)(process.execPath));
+  const scriptMatch = isNpmChannel ? (0, import_node_path22.basename)((0, import_node_url2.fileURLToPath)(__import_meta_url)) : void 0;
   const realExe = resolveRealInstallExe(process.execPath);
   const exeMatch = realExe === process.execPath ? process.execPath : [process.execPath, realExe];
   const pids = supervisorPidsToKill(enumerateProcesses(), process.pid, exeMatch, scriptMatch);
@@ -55405,7 +55760,7 @@ async function runAction(arg, flagArgv = [], selfVersion = null) {
   }
   await action(parseTeardownFlags(flagArgv));
 }
-var entry = (0, import_node_path19.basename)(process.argv[1] ?? "").toLowerCase();
+var entry = (0, import_node_path22.basename)(process.argv[1] ?? "").toLowerCase();
 if (entry === "launch.mjs") {
   runAction(process.argv[2], process.argv.slice(3)).catch((e) => {
     log(`error: ${e?.message ?? e}`);
@@ -55479,11 +55834,11 @@ function awareUpgradeBlockReason(s) {
 }
 
 // skill-sync.ts
-var import_node_fs22 = require("node:fs");
-var import_node_os15 = require("node:os");
-var import_node_path20 = require("node:path");
-var import_node_url2 = require("node:url");
-var import_yaml5 = __toESM(require_dist6(), 1);
+var import_node_fs26 = require("node:fs");
+var import_node_os16 = require("node:os");
+var import_node_path23 = require("node:path");
+var import_node_url3 = require("node:url");
+var import_yaml7 = __toESM(require_dist6(), 1);
 
 // build/ship-skills.mjs
 var PRODUCT_SKILLS = [
@@ -55499,6 +55854,8 @@ var PRODUCT_SKILLS = [
   //      author event-driven ("on trigger") routines
   "floless-app-steel-from-drawings",
   // read a steel drawing into an interactive 3D model (bake the viewer-3d scene)
+  "floless-app-tweak-contract",
+  // handle a tweak-contract request from the steel-takeoff contract editor (Slice 2 AI round-trip)
   "floless-app-ui",
   //            compose Custom Panels (~/.floless/ui/extensions.json) for the Dashboard
   "floless-app-workflows"
@@ -55510,33 +55867,33 @@ function selectShippedSkillNames(names) {
 }
 
 // skill-sync.ts
-var __dirname3 = (0, import_node_path20.dirname)((0, import_node_url2.fileURLToPath)(__import_meta_url));
+var __dirname3 = (0, import_node_path23.dirname)((0, import_node_url3.fileURLToPath)(__import_meta_url));
 function bundledSkillsRoot() {
   const candidates = [
-    (0, import_node_path20.join)(__dirname3, "skills"),
-    (0, import_node_path20.join)((0, import_node_path20.dirname)(process.execPath), "skills"),
-    (0, import_node_path20.join)(__dirname3, "..", ".claude", "skills")
+    (0, import_node_path23.join)(__dirname3, "skills"),
+    (0, import_node_path23.join)((0, import_node_path23.dirname)(process.execPath), "skills"),
+    (0, import_node_path23.join)(__dirname3, "..", ".claude", "skills")
   ];
-  return candidates.find((p) => (0, import_node_fs22.existsSync)(p)) ?? null;
+  return candidates.find((p) => (0, import_node_fs26.existsSync)(p)) ?? null;
 }
 function targetConfigDirs() {
   const override = process.env.FLOLESS_SKILL_TARGETS;
   if (override) {
     return override.split(";").map((d) => d.trim()).filter(Boolean).map((dir) => ({ runtime: "custom", dir }));
   }
-  const home = (0, import_node_os15.homedir)();
+  const home = (0, import_node_os16.homedir)();
   return [
-    { runtime: "claude", dir: (0, import_node_path20.join)(home, ".claude") },
-    { runtime: "codex", dir: (0, import_node_path20.join)(home, ".codex") },
-    { runtime: "opencode", dir: (0, import_node_path20.join)(home, ".opencode") }
+    { runtime: "claude", dir: (0, import_node_path23.join)(home, ".claude") },
+    { runtime: "codex", dir: (0, import_node_path23.join)(home, ".codex") },
+    { runtime: "opencode", dir: (0, import_node_path23.join)(home, ".opencode") }
   ];
 }
 function skillVersion(skillMdPath) {
   try {
-    const text = (0, import_node_fs22.readFileSync)(skillMdPath, "utf8");
+    const text = (0, import_node_fs26.readFileSync)(skillMdPath, "utf8");
     const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text);
     if (!m || m[1] === void 0) return null;
-    const fm = (0, import_yaml5.parse)(m[1]);
+    const fm = (0, import_yaml7.parse)(m[1]);
     const meta = fm?.metadata;
     const v = meta?.version;
     return typeof v === "string" || typeof v === "number" ? String(v) : null;
@@ -55573,21 +55930,21 @@ function decideAction(installed, bundled) {
 function bundledSkills(root) {
   let entries = [];
   try {
-    entries = selectShippedSkillNames((0, import_node_fs22.readdirSync)(root));
+    entries = selectShippedSkillNames((0, import_node_fs26.readdirSync)(root));
   } catch {
     return [];
   }
   const out = [];
   for (const name of entries) {
-    const dir = (0, import_node_path20.join)(root, name);
+    const dir = (0, import_node_path23.join)(root, name);
     let isDir = false;
     try {
-      isDir = (0, import_node_fs22.statSync)(dir).isDirectory();
+      isDir = (0, import_node_fs26.statSync)(dir).isDirectory();
     } catch {
       isDir = false;
     }
     if (!isDir) continue;
-    const v = skillVersion((0, import_node_path20.join)(dir, "SKILL.md"));
+    const v = skillVersion((0, import_node_path23.join)(dir, "SKILL.md"));
     if (!v) continue;
     out.push({ name, dir, version: v });
   }
@@ -55600,17 +55957,17 @@ function syncSkills() {
   const skills = bundledSkills(root);
   if (!skills.length) return results;
   for (const { runtime, dir: cfg } of targetConfigDirs()) {
-    if (!(0, import_node_fs22.existsSync)(cfg)) continue;
-    const skillsDir = (0, import_node_path20.join)(cfg, "skills");
+    if (!(0, import_node_fs26.existsSync)(cfg)) continue;
+    const skillsDir = (0, import_node_path23.join)(cfg, "skills");
     for (const s of skills) {
-      const dest = (0, import_node_path20.join)(skillsDir, s.name);
-      const installedMd = (0, import_node_path20.join)(dest, "SKILL.md");
-      const installed = (0, import_node_fs22.existsSync)(installedMd) ? skillVersion(installedMd) : null;
+      const dest = (0, import_node_path23.join)(skillsDir, s.name);
+      const installedMd = (0, import_node_path23.join)(dest, "SKILL.md");
+      const installed = (0, import_node_fs26.existsSync)(installedMd) ? skillVersion(installedMd) : null;
       const action = decideAction(installed, s.version);
       if (action === "installed" || action === "updated") {
         try {
-          if (action === "updated") (0, import_node_fs22.rmSync)(dest, { recursive: true, force: true });
-          (0, import_node_fs22.cpSync)(s.dir, dest, { recursive: true });
+          if (action === "updated") (0, import_node_fs26.rmSync)(dest, { recursive: true, force: true });
+          (0, import_node_fs26.cpSync)(s.dir, dest, { recursive: true });
           results.push({ runtime, skill: s.name, action, from: installed, to: s.version });
         } catch {
         }
@@ -55623,9 +55980,9 @@ function syncSkills() {
 }
 
 // watch.ts
-var import_node_os16 = require("node:os");
-var import_node_path22 = require("node:path");
-var import_node_fs23 = require("node:fs");
+var import_node_os17 = require("node:os");
+var import_node_path25 = require("node:path");
+var import_node_fs27 = require("node:fs");
 
 // node_modules/chokidar/esm/index.js
 var import_fs2 = require("fs");
@@ -55636,7 +55993,7 @@ var sysPath2 = __toESM(require("path"), 1);
 // node_modules/readdirp/esm/index.js
 var import_promises2 = require("node:fs/promises");
 var import_node_stream2 = require("node:stream");
-var import_node_path21 = require("node:path");
+var import_node_path24 = require("node:path");
 var EntryTypes = {
   FILE_TYPE: "files",
   DIR_TYPE: "directories",
@@ -55711,7 +56068,7 @@ var ReaddirpStream = class extends import_node_stream2.Readable {
     this._wantsDir = type ? DIR_TYPES.has(type) : false;
     this._wantsFile = type ? FILE_TYPES.has(type) : false;
     this._wantsEverything = type === EntryTypes.EVERYTHING_TYPE;
-    this._root = (0, import_node_path21.resolve)(root);
+    this._root = (0, import_node_path24.resolve)(root);
     this._isDirent = !opts.alwaysStat;
     this._statsProp = this._isDirent ? "dirent" : "stats";
     this._rdOptions = { encoding: "utf8", withFileTypes: this._isDirent };
@@ -55782,8 +56139,8 @@ var ReaddirpStream = class extends import_node_stream2.Readable {
     let entry2;
     const basename5 = this._isDirent ? dirent.name : dirent;
     try {
-      const fullPath = (0, import_node_path21.resolve)((0, import_node_path21.join)(path, basename5));
-      entry2 = { path: (0, import_node_path21.relative)(this._root, fullPath), fullPath, basename: basename5 };
+      const fullPath = (0, import_node_path24.resolve)((0, import_node_path24.join)(path, basename5));
+      entry2 = { path: (0, import_node_path24.relative)(this._root, fullPath), fullPath, basename: basename5 };
       entry2[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
     } catch (err) {
       this._onError(err);
@@ -55817,7 +56174,7 @@ var ReaddirpStream = class extends import_node_stream2.Readable {
         }
         if (entryRealPathStats.isDirectory()) {
           const len = entryRealPath.length;
-          if (full.startsWith(entryRealPath) && full.substr(len, 1) === import_node_path21.sep) {
+          if (full.startsWith(entryRealPath) && full.substr(len, 1) === import_node_path24.sep) {
             const recursiveError = new Error(`Circular symlink detected: "${full}" points to "${entryRealPath}"`);
             recursiveError.code = RECURSIVE_ERROR_CODE;
             return this._onError(recursiveError);
@@ -56356,9 +56713,9 @@ var NodeFsHandler = class {
     if (this.fsw.closed) {
       return;
     }
-    const dirname10 = sysPath.dirname(file);
+    const dirname11 = sysPath.dirname(file);
     const basename5 = sysPath.basename(file);
-    const parent = this.fsw._getWatchedDir(dirname10);
+    const parent = this.fsw._getWatchedDir(dirname11);
     let prevStats = stats;
     if (parent.has(basename5))
       return;
@@ -56385,7 +56742,7 @@ var NodeFsHandler = class {
             prevStats = newStats2;
           }
         } catch (error) {
-          this.fsw._remove(dirname10, basename5);
+          this.fsw._remove(dirname11, basename5);
         }
       } else if (parent.has(basename5)) {
         const at = newStats.atimeMs;
@@ -57325,33 +57682,33 @@ function appIdFromLogPath(path) {
   return i >= 0 && parts[i + 1] ? parts[i + 1] : null;
 }
 function samePath(a, b) {
-  const ra = (0, import_node_path22.resolve)(a);
-  const rb = (0, import_node_path22.resolve)(b);
+  const ra = (0, import_node_path25.resolve)(a);
+  const rb = (0, import_node_path25.resolve)(b);
   return process.platform === "win32" ? ra.toLowerCase() === rb.toLowerCase() : ra === rb;
 }
 function underDir(path, dir) {
-  const rp = (0, import_node_path22.resolve)(path);
-  const rd = (0, import_node_path22.resolve)(dir);
+  const rp = (0, import_node_path25.resolve)(path);
+  const rd = (0, import_node_path25.resolve)(dir);
   const [p, d] = process.platform === "win32" ? [rp.toLowerCase(), rd.toLowerCase()] : [rp, rd];
-  return p === d || p.startsWith(d + import_node_path22.sep);
+  return p === d || p.startsWith(d + import_node_path25.sep);
 }
 function startWatcher() {
-  const awareDir = process.env.AWARE_HOME ?? (0, import_node_path22.join)((0, import_node_os16.homedir)(), ".aware");
-  const credentialsDir = (0, import_node_path22.join)(awareDir, "credentials");
-  if (!(0, import_node_fs23.existsSync)(credentialsDir)) {
+  const awareDir = process.env.AWARE_HOME ?? (0, import_node_path25.join)((0, import_node_os17.homedir)(), ".aware");
+  const credentialsDir = (0, import_node_path25.join)(awareDir, "credentials");
+  if (!(0, import_node_fs27.existsSync)(credentialsDir)) {
     try {
-      (0, import_node_fs23.mkdirSync)(credentialsDir, { recursive: true });
+      (0, import_node_fs27.mkdirSync)(credentialsDir, { recursive: true });
     } catch {
     }
   }
-  if (!(0, import_node_fs23.existsSync)(uiDir)) {
+  if (!(0, import_node_fs27.existsSync)(uiDir)) {
     try {
-      (0, import_node_fs23.mkdirSync)(uiDir, { recursive: true });
+      (0, import_node_fs27.mkdirSync)(uiDir, { recursive: true });
     } catch {
     }
   }
-  const targets = ["apps", "logs", "credentials"].map((d) => (0, import_node_path22.join)(awareDir, d)).filter((p) => (0, import_node_fs23.existsSync)(p));
-  if ((0, import_node_fs23.existsSync)(uiDir)) targets.push(uiDir);
+  const targets = ["apps", "logs", "credentials"].map((d) => (0, import_node_path25.join)(awareDir, d)).filter((p) => (0, import_node_fs27.existsSync)(p));
+  if ((0, import_node_fs27.existsSync)(uiDir)) targets.push(uiDir);
   if (targets.length === 0) {
     return null;
   }
@@ -57380,11 +57737,11 @@ function startWatcher() {
     const isCredential = path.split(/[\\/]/).includes("credentials");
     const kind = isCredential ? "credential" : path.endsWith(".jsonl") ? "trace" : path.endsWith(".lock") ? "lock" : path.endsWith(".flo") || path.endsWith(".app") ? "source" : "file";
     broadcast({ type: "fs-change", kind, event, path });
-    if (kind === "trace" && event !== "unlink" && (0, import_node_fs23.existsSync)(path)) {
+    if (kind === "trace" && event !== "unlink" && (0, import_node_fs27.existsSync)(path)) {
       const id = appIdFromLogPath(path);
       if (!id) return;
       try {
-        broadcast({ type: "trace-file", id, runId: path.split(import_node_path22.sep).pop()?.replace(/\.jsonl$/, "") ?? null, events: parseTrace((0, import_node_fs23.readFileSync)(path, "utf8")) });
+        broadcast({ type: "trace-file", id, runId: path.split(import_node_path25.sep).pop()?.replace(/\.jsonl$/, "") ?? null, events: parseTrace((0, import_node_fs27.readFileSync)(path, "utf8")) });
       } catch {
       }
     }
@@ -57393,10 +57750,10 @@ function startWatcher() {
 }
 
 // index.ts
-var __dirname4 = (0, import_node_path23.dirname)((0, import_node_url3.fileURLToPath)(__import_meta_url));
-var WEB_ROOT = [(0, import_node_path23.join)(__dirname4, "web"), (0, import_node_path23.join)((0, import_node_path23.dirname)(process.execPath), "web"), (0, import_node_path23.join)(__dirname4, "..", "web")].find(
-  (p) => (0, import_node_fs24.existsSync)(p)
-) ?? (0, import_node_path23.join)(__dirname4, "..", "web");
+var __dirname4 = (0, import_node_path26.dirname)((0, import_node_url4.fileURLToPath)(__import_meta_url));
+var WEB_ROOT = [(0, import_node_path26.join)(__dirname4, "web"), (0, import_node_path26.join)((0, import_node_path26.dirname)(process.execPath), "web"), (0, import_node_path26.join)(__dirname4, "..", "web")].find(
+  (p) => (0, import_node_fs28.existsSync)(p)
+) ?? (0, import_node_path26.join)(__dirname4, "..", "web");
 var PORT2 = Number(process.env.PORT ?? 4317);
 var HOST = "127.0.0.1";
 var crashHandlersInstalled = false;
@@ -57412,7 +57769,7 @@ function installCrashHandlers() {
 ${stack}
 `;
     try {
-      (0, import_node_fs24.appendFileSync)(logFilePath(), line);
+      (0, import_node_fs28.appendFileSync)(logFilePath(), line);
     } catch {
     }
     if (process.stderr.isTTY) process.stderr.write(line);
@@ -57492,6 +57849,9 @@ async function startServer() {
     if (err instanceof AppNotFoundError) {
       return reply.status(404).send({ ok: false, error: err.message });
     }
+    if (err instanceof ContractError) {
+      return reply.status(400).send({ ok: false, error: err.message });
+    }
     if (err instanceof RoutineError) {
       return reply.status(err.status).send({ ok: false, error: err.message });
     }
@@ -57786,6 +58146,95 @@ async function startServer() {
   app.get("/api/app/:id", async (req) => {
     return { ok: true, app: readApp(req.params.id) };
   });
+  app.get("/api/contract/:appId", async (req, reply) => {
+    const doc2 = readContract(req.params.appId);
+    if (doc2 == null) return reply.status(404).send({ ok: false, error: "no contract for this app yet" });
+    return doc2;
+  });
+  app.put(
+    "/api/contract/:appId",
+    { bodyLimit: 25 * 1024 * 1024 },
+    // contracts embed rasters
+    async (req, reply) => {
+      try {
+        writeContract(req.params.appId, req.body);
+      } catch (e) {
+        if (e instanceof ContractError) return reply.status(400).send({ ok: false, error: e.message });
+        throw e;
+      }
+      broadcast({ type: "contract-changed", appId: req.params.appId });
+      return { ok: true };
+    }
+  );
+  app.post("/api/contract/:appId/approve", async (req, reply) => {
+    const doc2 = readContract(req.params.appId);
+    if (doc2 == null) return reply.status(404).send({ ok: false, error: "no contract to approve" });
+    const v = validateSteelTakeoff(doc2);
+    if (!v.valid) return reply.status(400).send({ ok: false, error: "stored contract is invalid \u2014 re-save it in the editor" });
+    const sourcePath = readApp(req.params.appId).source.path;
+    try {
+      bakeContractIntoApp(sourcePath, doc2);
+    } catch (e) {
+      return reply.status(422).send({ ok: false, error: e instanceof Error ? e.message : "bake failed" });
+    }
+    let result;
+    try {
+      result = await aware.compile(sourcePath);
+    } catch (e) {
+      return reply.status(422).send({
+        ok: false,
+        error: `contract was baked but compile failed \u2014 fix the workflow and Approve again: ${e instanceof Error ? e.message : "compile error"}`
+      });
+    }
+    broadcast({ type: "compiled", id: req.params.appId, lockPath: result.lockPath });
+    return { ok: true, result };
+  });
+  function awareStderr(e) {
+    if (e instanceof AwareError && e.detail && typeof e.detail === "object") {
+      const s = e.detail.stderr;
+      return typeof s === "string" && s.trim() ? s.trim() : null;
+    }
+    return null;
+  }
+  app.post("/api/contract/:appId/export-3d", async (req, reply) => {
+    const doc2 = readContract(req.params.appId);
+    if (doc2 == null) return reply.status(404).send({ ok: false, error: "no contract to export" });
+    const v = validateSteelTakeoff(doc2);
+    if (!v.valid) return reply.status(400).send({ ok: false, error: "stored contract is invalid \u2014 re-save it in the editor" });
+    const { scene, skipped } = contractToScene(doc2);
+    if (scene.elements.length === 0) {
+      return reply.status(422).send({ ok: false, error: "no resolvable members to render \u2014 every member is an RFI (no AISC size yet)", skipped });
+    }
+    const companionId = `${req.params.appId}-3d`;
+    let flo;
+    try {
+      flo = writeViewer3dApp(appPath(companionId), companionId, scene);
+    } catch (e) {
+      app.log.error({ companionId, err: e instanceof Error ? e.message : e }, "export-3d: companion app write failed");
+      return reply.status(500).send({ ok: false, error: `could not write the 3D companion app: ${e instanceof Error ? e.message : "write error"}` });
+    }
+    try {
+      await aware.compile(flo);
+    } catch (e) {
+      app.log.warn({ companionId, detail: e instanceof AwareError ? e.detail : void 0 }, "3D compile failed");
+      return reply.status(422).send({ ok: false, error: `3D compile failed: ${e instanceof Error ? e.message : "compile error"}`, reason: awareStderr(e) });
+    }
+    let result;
+    try {
+      result = await aware.run(companionId, {});
+    } catch (e) {
+      if (e instanceof AwareError) {
+        app.log.warn({ companionId, detail: e.detail }, "3D render failed");
+        return reply.send({ ok: false, error: e.message, reason: awareStderr(e) });
+      }
+      throw e;
+    }
+    const events = result.traceText ? parseTrace(result.traceText) : [];
+    const extracted = extractReportHtml(events, companionId);
+    if (!extracted) return reply.send({ ok: false, error: "the 3D render produced no html" });
+    broadcast({ type: "apps-changed" });
+    return { ok: true, report: { ...extracted, interactive: true }, skipped };
+  });
   async function stopForegroundSession(id) {
     try {
       const sid = foregroundSessionId(id);
@@ -57815,6 +58264,42 @@ async function startServer() {
     broadcast({ type: "apps-changed", id: req.params.id });
     return { ok: true };
   });
+  app.post("/api/app/:id/freeze", async (req, reply) => {
+    const nodeId = typeof req.body?.nodeId === "string" ? req.body.nodeId.trim() : "";
+    if (!nodeId) return reply.status(400).send({ ok: false, error: "nodeId required" });
+    try {
+      await aware.freeze(req.params.id, nodeId);
+    } catch (e) {
+      if (e instanceof AwareUnsupportedError) {
+        return reply.status(422).send({ ok: false, error: "Freezing needs AWARE 0.77 or newer \u2014 update AWARE from the footer." });
+      }
+      if (e instanceof AwareError) {
+        app.log.warn({ id: req.params.id, nodeId, detail: e.detail }, "freeze failed");
+        return reply.status(422).send({ ok: false, error: "Couldn't freeze this node \u2014 it may have no saved output yet (run it once first).", reason: awareStderr(e) });
+      }
+      throw e;
+    }
+    broadcast({ type: "apps-changed", id: req.params.id });
+    return { ok: true };
+  });
+  app.post("/api/app/:id/unfreeze", async (req, reply) => {
+    const nodeId = typeof req.body?.nodeId === "string" ? req.body.nodeId.trim() : "";
+    if (!nodeId) return reply.status(400).send({ ok: false, error: "nodeId required" });
+    try {
+      await aware.unfreeze(req.params.id, nodeId);
+    } catch (e) {
+      if (e instanceof AwareUnsupportedError) {
+        return reply.status(422).send({ ok: false, error: "Freezing needs AWARE 0.77 or newer \u2014 update AWARE from the footer." });
+      }
+      if (e instanceof AwareError) {
+        app.log.warn({ id: req.params.id, nodeId, detail: e.detail }, "unfreeze failed");
+        return reply.status(422).send({ ok: false, error: "Could not unfreeze this node.", reason: awareStderr(e) });
+      }
+      throw e;
+    }
+    broadcast({ type: "apps-changed", id: req.params.id });
+    return { ok: true };
+  });
   app.post("/api/compile", async (req, reply) => {
     const { id, sourcePath } = req.body ?? {};
     const path = sourcePath ?? (id ? readApp(id).source.path : void 0);
@@ -57837,11 +58322,11 @@ async function startServer() {
     if (appExists(id)) {
       return reply.status(409).send({ ok: false, error: `a workflow named "${id}" is already installed \u2014 remove it first, or rename the file's app: id`, code: "exists", id });
     }
-    const stageRoot = (0, import_node_fs24.mkdtempSync)((0, import_node_path23.join)((0, import_node_os17.tmpdir)(), "floless-import-"));
+    const stageRoot = (0, import_node_fs28.mkdtempSync)((0, import_node_path26.join)((0, import_node_os18.tmpdir)(), "floless-import-"));
     try {
-      const stageDir = (0, import_node_path23.join)(stageRoot, id);
-      (0, import_node_fs24.mkdirSync)(stageDir);
-      (0, import_node_fs24.writeFileSync)((0, import_node_path23.join)(stageDir, `${id}.flo`), content);
+      const stageDir = (0, import_node_path26.join)(stageRoot, id);
+      (0, import_node_fs28.mkdirSync)(stageDir);
+      (0, import_node_fs28.writeFileSync)((0, import_node_path26.join)(stageDir, `${id}.flo`), content);
       await aware.install(stageDir);
     } catch (err) {
       try {
@@ -57851,7 +58336,7 @@ async function startServer() {
       const msg = err instanceof AwareError ? err.message : String(err?.message ?? err);
       return reply.status(502).send({ ok: false, error: `import failed: ${msg}` });
     } finally {
-      (0, import_node_fs24.rmSync)(stageRoot, { recursive: true, force: true });
+      (0, import_node_fs28.rmSync)(stageRoot, { recursive: true, force: true });
     }
     broadcast({ type: "apps-changed", id });
     return { ok: true, id };
@@ -57865,13 +58350,13 @@ async function startServer() {
     }
     const inputs = appData.inputs.map((i) => ({ name: i.name, type: i.type }));
     const baked = bakeFloSource(appData.source.text, inputs);
-    const tmpRoot = (0, import_node_fs24.mkdtempSync)((0, import_node_path23.join)((0, import_node_os17.tmpdir)(), "floless-bake-"));
-    const backupDir = (0, import_node_path23.join)(tmpRoot, `${id}-backup`);
-    const bakeDir = (0, import_node_path23.join)(tmpRoot, id);
-    (0, import_node_fs24.cpSync)(appDir(id), backupDir, { recursive: true });
-    (0, import_node_fs24.cpSync)(appDir(id), bakeDir, { recursive: true });
+    const tmpRoot = (0, import_node_fs28.mkdtempSync)((0, import_node_path26.join)((0, import_node_os18.tmpdir)(), "floless-bake-"));
+    const backupDir = (0, import_node_path26.join)(tmpRoot, `${id}-backup`);
+    const bakeDir = (0, import_node_path26.join)(tmpRoot, id);
+    (0, import_node_fs28.cpSync)(appDir(id), backupDir, { recursive: true });
+    (0, import_node_fs28.cpSync)(appDir(id), bakeDir, { recursive: true });
     const floName = appData.source.path.split(/[\\/]/).pop();
-    (0, import_node_fs24.writeFileSync)((0, import_node_path23.join)(bakeDir, floName), baked);
+    (0, import_node_fs28.writeFileSync)((0, import_node_path26.join)(bakeDir, floName), baked);
     let appInstalled2 = true;
     try {
       await aware.uninstall(id);
@@ -57893,17 +58378,17 @@ async function startServer() {
         throw installErr;
       }
       try {
-        await aware.compile((0, import_node_path23.join)(appDir(id), floName));
+        await aware.compile((0, import_node_path26.join)(appDir(id), floName));
       } catch (compileErr) {
         app.log.warn({ id, compileErr: String(compileErr) }, "bake: post-install recompile failed (app baked but may need a manual Compile)");
       }
       broadcast({ type: "baked", id });
       return { ok: true, id, agent: id, inputs };
     } finally {
-      if (appInstalled2) (0, import_node_fs24.rmSync)(tmpRoot, { recursive: true, force: true });
+      if (appInstalled2) (0, import_node_fs28.rmSync)(tmpRoot, { recursive: true, force: true });
     }
   });
-  const graftAgentsDir = () => (0, import_node_path23.join)((0, import_node_os17.homedir)(), ".aware", "agents");
+  const graftAgentsDir = () => (0, import_node_path26.join)((0, import_node_os18.homedir)(), ".aware", "agents");
   app.post("/api/graft/match", async (req, reply) => {
     const { glob } = req.body ?? {};
     if (!glob) return reply.status(400).send({ ok: false, error: "glob required" });
@@ -57920,7 +58405,7 @@ async function startServer() {
     if (!sourceKind || !sourceRef) {
       return reply.status(400).send({ ok: false, error: "sourceKind and sourceRef required" });
     }
-    const tempHome = (0, import_node_fs24.mkdtempSync)((0, import_node_path23.join)((0, import_node_os17.tmpdir)(), "floless-graft-"));
+    const tempHome = (0, import_node_fs28.mkdtempSync)((0, import_node_path26.join)((0, import_node_os18.tmpdir)(), "floless-graft-"));
     let result;
     try {
       result = await aware.build({
@@ -57933,19 +58418,19 @@ async function startServer() {
         awareHome: tempHome
       });
     } catch (err) {
-      (0, import_node_fs24.rmSync)(tempHome, { recursive: true, force: true });
+      (0, import_node_fs28.rmSync)(tempHome, { recursive: true, force: true });
       const msg = err instanceof AwareError ? err.message : String(err?.message ?? err);
       return reply.status(422).send({ ok: false, error: msg });
     }
     const manifest = readStagedManifest(result.agentDir);
     if (!manifest) {
-      (0, import_node_fs24.rmSync)(tempHome, { recursive: true, force: true });
+      (0, import_node_fs28.rmSync)(tempHome, { recursive: true, force: true });
       return reply.status(502).send({ ok: false, error: `build produced output at ${result.agentDir} but no manifest.yaml` });
     }
     const token = (0, import_node_crypto7.randomUUID)();
     registerStage(token, tempHome, result.agentId);
     const preview = buildPreview(manifest, sourceKind, sourceRef, token);
-    if ((0, import_node_fs24.existsSync)((0, import_node_path23.join)(graftAgentsDir(), result.agentId))) {
+    if ((0, import_node_fs28.existsSync)((0, import_node_path26.join)(graftAgentsDir(), result.agentId))) {
       preview.warnings.unshift(`An agent named "${result.agentId}" is already installed \u2014 creating it will overwrite it.`);
     }
     return { ok: true, preview };
@@ -57964,7 +58449,7 @@ async function startServer() {
         registerStage(stagedRef, stage.tempDir, stage.agentId);
         return reply.status(409).send({ ok: false, error: err.message, agentId: stage.agentId, collision: true });
       }
-      (0, import_node_fs24.rmSync)(stage.tempDir, { recursive: true, force: true });
+      (0, import_node_fs28.rmSync)(stage.tempDir, { recursive: true, force: true });
       throw err;
     }
     broadcast({ type: "grafted", id: stage.agentId });
@@ -58197,11 +58682,11 @@ async function startServer() {
   app.get("/api/requests/:id/snapshot/:n", async (req, reply) => {
     const n = Number.parseInt(req.params.n, 10);
     const p = Number.isInteger(n) ? snapshotPathFor(req.params.id, n) : null;
-    if (!p || !(0, import_node_fs24.existsSync)(p)) return reply.status(404).send({ ok: false, error: "snapshot not found" });
+    if (!p || !(0, import_node_fs28.existsSync)(p)) return reply.status(404).send({ ok: false, error: "snapshot not found" });
     const ext = p.split(".").pop().toLowerCase();
     reply.header("Content-Type", ext === "png" ? "image/png" : ext === "webp" ? "image/webp" : ext === "pdf" ? "application/pdf" : "image/jpeg");
     reply.header("Cache-Control", "no-store");
-    return (0, import_node_fs24.readFileSync)(p);
+    return (0, import_node_fs28.readFileSync)(p);
   });
   app.post(
     "/api/tweak",
@@ -58222,6 +58707,25 @@ async function startServer() {
       return { ok: true, request };
     }
   );
+  app.post(
+    "/api/contract-request",
+    { bodyLimit: 25 * 1024 * 1024 },
+    async (req, reply) => {
+      const { appId, instruction, snapshots } = req.body ?? {};
+      if (!appId || !instruction) {
+        return reply.status(400).send({ ok: false, error: "appId, instruction required" });
+      }
+      let decoded;
+      try {
+        decoded = decodeSnapshots(snapshots);
+      } catch (e) {
+        return reply.status(400).send({ ok: false, error: e instanceof Error ? e.message : "bad snapshot" });
+      }
+      const request = addRequest({ type: "tweak-contract", appId, instruction }, decoded);
+      broadcast({ type: "request-added", request });
+      return { ok: true, request };
+    }
+  );
   const REBAKE_INSTRUCTION = "Re-read the attached drawing and re-bake the extracted values into this app's config.yaml (the literals the deterministic run uses), then `aware app compile` the app and tell me to approve the new lock. Do not change node logic \u2014 only the baked config values.";
   app.post(
     "/api/rebake",
@@ -58331,7 +58835,7 @@ async function startServer() {
         warn(`last-run-status:${ref} \u2014 trace exists but couldn't be parsed (corrupt/truncated)`);
         let finishedAt2 = null;
         try {
-          finishedAt2 = (0, import_node_fs24.statSync)(latest.path).mtime.toISOString();
+          finishedAt2 = (0, import_node_fs28.statSync)(latest.path).mtime.toISOString();
         } catch {
           finishedAt2 = null;
         }
@@ -58341,7 +58845,7 @@ async function startServer() {
       let finishedAt = typeof runEnd?.ts === "string" ? runEnd.ts : null;
       if (!finishedAt) {
         try {
-          finishedAt = (0, import_node_fs24.statSync)(latest.path).mtime.toISOString();
+          finishedAt = (0, import_node_fs28.statSync)(latest.path).mtime.toISOString();
         } catch {
           finishedAt = null;
         }