@integrity-labs/agt-cli 0.28.1083 → 0.28.1084

package/dist/{chunk-44254DEU.js → chunk-XJ4JK4C7.js}

@@ -24,7 +24,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-ELRALWJ7.js";
+} from "./chunk-NEGFSB2W.js";
 import {
   classifyUnanswerablePane,
   findUsageLimitResetHint,
@@ -6113,4 +6113,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-44254DEU.js.map
+//# sourceMappingURL=chunk-XJ4JK4C7.js.map

package/dist/{claude-pair-runtime-U6LVU5CI.js → claude-pair-runtime-EUFDQGRU.js}

@@ -266,7 +266,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-UHSU52GZ.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-35BXCGHB.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -734,4 +734,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-U6LVU5CI.js.map
+//# sourceMappingURL=claude-pair-runtime-EUFDQGRU.js.map

package/dist/lib/manager-worker.js

@@ -67,7 +67,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-BIR5WVM4.js";
+} from "../chunk-6ZBFVSDC.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -154,7 +154,7 @@ import {
   webFetchBaselineValue,
   webFetchRestartNeeded,
   writeEgressAllowlist
-} from "../chunk-44254DEU.js";
+} from "../chunk-XJ4JK4C7.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -263,7 +263,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-ELRALWJ7.js";
+} from "../chunk-NEGFSB2W.js";
 import {
   classifyUnanswerablePane,
   paneRemedy
@@ -14141,7 +14141,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-PKMKC2VS.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-VDL3QULE.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -14899,7 +14899,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1083" : "dev";
+var agtCliVersion = true ? "0.28.1084" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -16516,7 +16516,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-UHSU52GZ.js");
+      const { collectDiagnostics } = await import("../persistent-session-35BXCGHB.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -16658,7 +16658,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-UHSU52GZ.js");
+      const { collectDiagnostics } = await import("../persistent-session-35BXCGHB.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
@@ -16866,7 +16866,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-PKMKC2VS.js");
+      } = await import("../responsiveness-probe-VDL3QULE.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -16983,7 +16983,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-PKMKC2VS.js");
+        } = await import("../responsiveness-probe-VDL3QULE.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -17269,7 +17269,7 @@ async function pollCycleInner() {
                 }
               }
             );
-            const { parkPendingInbound } = await import("../responsiveness-probe-PKMKC2VS.js");
+            const { parkPendingInbound } = await import("../responsiveness-probe-VDL3QULE.js");
             const { parked, deadLettered } = parkPendingInbound(codeName, new Date(fatalNowMs));
             paneFatalStreak.delete(codeName);
             paneFatalRestarts.set(codeName, [...history, fatalNowMs]);
@@ -17300,7 +17300,7 @@ async function pollCycleInner() {
         TRANSCRIPT_MOUNT_ESCALATION_REFRESH_MS,
         bindSourceEscalations
       } = await import("../transcript-mount-health-OHE6IVJV.js");
-      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-UHSU52GZ.js");
+      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-35BXCGHB.js");
       const mountConfig = resolveTranscriptMountConfig();
       const liveAgents = agentState.persistentSessionAgents;
       for (const tracked of [
@@ -17465,7 +17465,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-KOZOXQOP.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-L7ZD5ZZO.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -22030,7 +22030,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-PKMKC2VS.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-VDL3QULE.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -22073,7 +22073,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-UHSU52GZ.js");
+        const { collectDiagnostics } = await import("../persistent-session-35BXCGHB.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -22124,7 +22124,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-UHSU52GZ.js");
+      const { collectDiagnostics } = await import("../persistent-session-35BXCGHB.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -22796,7 +22796,7 @@ async function processClaudePairSessions(agents) {
     // cannot take it for itself — by the time it runs, the write it is looking
     // for may already have happened.
     snapshotPairConfig
-  } = await import("../claude-pair-runtime-U6LVU5CI.js");
+  } = await import("../claude-pair-runtime-EUFDQGRU.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));

package/dist/mcp/direct-chat-channel.js

@@ -34190,6 +34190,136 @@ var INTEGRATION_REGISTRY = [
     // `registryRemoteMcpKeys`, which would strand the `.mcp.json` entry on
     // every host that installed the MCP variant.
   },
+  {
+    // Quiver (api.quiver.ai) — AI vector graphics: draw an SVG from a prompt,
+    // redraw one from an instruction, trace a raster, add animation.
+    //
+    // PREMIUM (ADR-0031, epic ENG-6920). Ninjafy holds ONE Quiver account whose
+    // key (`QUIVER_ACCOUNT_KEY`) every customer's drawing bills back to, so the
+    // credential is a single platform-held secret and never a per-install one.
+    // `auth_type: 'none'` on the catalog row and `credential_source:
+    // 'platform_env'` on every runtime scope, so `resolveBrokerToken` reads the
+    // env var and skips the install-row lookup entirely.
+    //
+    // Ships DARK: until the secret is set the resolver fails closed with
+    // `platform_credential_missing` and every drawing errors clearly.
+    // Installable but inert, by design — the same posture x-search shipped with.
+    //
+    // WHY IT STOPPED BEING BYO. It launched bring-your-own-key. Premium means WE
+    // pay the vendor, so a customer key would defeat the point: there would be
+    // nothing to meter and nothing to bill. The flip cost nothing because Quiver
+    // had never deployed — zero installs, so none of the origami free→premium
+    // grandfathering applies (there is no cohort whose `credential_source`
+    // default would misclassify them as billed and take the integration dark).
+    // A later BYO tier is possible (ADR-0055, the Firecrawl shape) and would
+    // need its own entitlement gate; it is deliberately not offered now, because
+    // offering two auth types renders a connect picker that does not check
+    // `plans.byo_credentials` (ENG-9236).
+    //
+    // WHY TWO METERS, when the vendor bills in one unit. `credits` is Quiver's
+    // own billing unit and the response carries it per call, so metering it
+    // makes our margin a constant multiple no matter which model an agent picks
+    // — `arrow-1.1-max` costs materially more than `arrow-1.1`, which a flat
+    // per-call price would silently eat. But `credits` is documented as
+    // "omitted for token-priced models, whose measured totals are returned in
+    // `usage`", so a credits-only meter bills those calls at ZERO: free to the
+    // customer, invisible to the budget gate, and with nothing in the ledger to
+    // notice it by. `svg_operation` is the floor that closes that hole — it
+    // fires ONLY when `credits` is absent, so the two can never double-bill the
+    // same call. See `lib/quiver-metering.ts`.
+    id: "quiver",
+    name: "Quiver",
+    category: "media",
+    description: "AI vector graphics \u2014 draw an SVG from a description, redraw an existing one, trace a photo or screenshot into vector shapes, and add animation. Ninjafy manages the Quiver account for you; there is no key to enter.",
+    supported_auth_types: ["none"],
+    docs_url: "https://docs.quiver.ai/developers",
+    capabilities: [
+      {
+        id: "quiver:create",
+        name: "Create and change vector graphics",
+        description: "Draw, redraw, trace and animate SVG artwork. Billed per Quiver credit consumed.",
+        access: "write"
+      },
+      {
+        id: "quiver:read",
+        name: "Read models",
+        description: "List the available drawing models and their per-call credit cost. Free.",
+        access: "read"
+      }
+    ],
+    beta: true,
+    // No `installable` on purpose: quiver is a seed integration
+    // (integration-definitions.json), so the seed catalog already makes it
+    // picker-visible. This entry exists to carry the `premium` descriptor that
+    // `isPremiumDefinition` reads — which arms the per-org opt-in gate, the
+    // priced acknowledgement modal and the admin pricing tab. Same reasoning as
+    // social-scraping above.
+    premium: {
+      pricing: "usage",
+      note: "Billed per Quiver credit consumed. Listing models is free; drawing, editing, tracing and animating each debit credits.",
+      meters: [
+        { event_type: "svg_credits", unit: "credit" },
+        { event_type: "svg_operation", unit: "operation" }
+      ]
+    }
+  },
+  {
+    // theSVG (thesvg.org) — 6,500+ REAL brand marks as SVG, so an agent building
+    // a page can use the actual Stripe/Slack/AWS logo instead of asking a
+    // drawing model for one. That distinction is the whole point of the
+    // integration: an AI-generated "Stripe logo" is a plausible fake, wrong in
+    // the way a customer notices and a trademark owner minds. Original artwork
+    // is Quiver's job; existing marks are this one's.
+    //
+    // WHY A LOCAL STDIO MCP AND NOT THE DIRECT-HTTP LANE. thesvg.org is a
+    // STATIC SITE — its own CLI says so in as many words ("there is no dynamic
+    // API"). The only two endpoints are `/api/registry.json`, the entire
+    // 2.97 MB / 6,523-entry manifest, and `/icons/{slug}/{variant}.svg`. Search
+    // is client-side filtering over that manifest, which the Direct-HTTP broker
+    // cannot do: it forwards the vendor's whole response body to the agent, so
+    // a `search_icons` descriptor would put 2.97 MB of registry into the
+    // agent's context on every call. The vendor's own MCP server bundles the
+    // registry and searches it in-process, which is precisely the shape the
+    // missing API leaves you needing.
+    //
+    // WHY THE VERSION IS PINNED and AWS's is `@latest`: this server's registry
+    // is baked in at BUILD time, so the pin is what decides which icons exist
+    // AND what markup lands on a customer's published page. Bumping it is a
+    // deliberate act that also refreshes the icon set — not a silent
+    // third-party update to artwork we are about to publish under a customer's
+    // domain.
+    //
+    // No credential anywhere: the registry and the jsDelivr CDN the server
+    // fetches SVG from are both public, so `auth_types: ['none']` is the honest
+    // classification rather than the ENG-8440 kind of lie Hard Rule 17 warns
+    // about — there genuinely is no key to enter and the install IS live
+    // immediately.
+    id: "thesvg",
+    name: "theSVG",
+    category: "media",
+    description: "Brand logos and icons as real SVG \u2014 search 6,500+ marks by name and pull the exact artwork, in mono, colour, light, dark or wordmark variants",
+    supported_auth_types: ["none"],
+    docs_url: "https://thesvg.org",
+    capabilities: [
+      {
+        id: "thesvg:read",
+        name: "Find and fetch brand icons",
+        description: "Search the icon library, list an icon's variants and categories, and fetch its SVG markup or CDN URL",
+        access: "read"
+      }
+    ],
+    installable: { category: "Media", authTypes: ["none"] },
+    beta: true,
+    // ENG-5815 data-driven path — no buildMcpJson edit, same as AWS.
+    nativeMcp: {
+      command: "npx",
+      args: ["-y", "@thesvg/mcp-server@0.8.2"],
+      env: {
+        PATH: "{{process_env.PATH}}",
+        HOME: "{{process_env.HOME}}"
+      }
+    }
+  },
   {
     id: "qmd",
     name: "QMD Memory Search",
@@ -35315,6 +35445,10 @@ var NOTICE_KIND_AUDIENCE = {
   // "Your `<verb>` approval request (`<uuid>`) EXPIRED at …" — in the report,
   // uuid and all.
   approval_expired: "agent",
+  // ENG-11334: canvas.publish_public approved / denied / approved-but-not-applied.
+  // Second-person instructions to the agent ("Tell the user...", "do not
+  // republish"); the user learns the outcome from the agent, not this row.
+  canvas_public_approval_resolved: "agent",
   // A routine fired; the agent picks the work up.
   routine_firing_result: "agent",
   // Live-advisor wake: "Call `live_read` with escalation_id …" — a literal tool
@@ -38126,7 +38260,7 @@ var FLAG_REGISTRY = [
   },
   {
     key: "approval-unified-authority",
-    description: "One authority check for every approval ingress (ENG-11207, ADR-0124 Phase 0b): canDecide() runs inside tryDispatchApprovalCore for console, Slack (channel, alerts, Socket Mode, which also carries Telegram) and Direct Chat taps alike. off = not computed. shadow = compute the verdict and log approval_authority_would_reject (ingress, verb, org, reason) for every tap it would refuse, then decide exactly as today. enforce = reserved for the per-(org, verb) allowlist slice; until that ships it behaves as shadow. Evaluated per-org. Ships dark.",
+    description: "One authority check for every approval ingress (ENG-11207, ADR-0124 Phase 0b): canDecide() runs inside tryDispatchApprovalCore for console, Slack (channel, alerts, Socket Mode, which also carries Telegram) and Direct Chat taps alike. off = not computed. shadow = compute the verdict, including the verb's declared approver boundary (ENG-11337), and log approval_authority_would_reject (ingress, verb, org, reason, boundary) for every tap it would refuse and approval_authority_would_admit (ingress, verb, org, basis, boundary) for every tap it would admit, then decide exactly as today. enforce = reserved for the per-(org, verb) allowlist slice; until that ships it behaves as shadow. Evaluated per-org. Ships dark.",
     flagType: "enum",
     allowedValues: ["off", "shadow", "enforce"],
     // Safe/default value is `off` (no computation, no extra reads on the tap path). A flag-DB read

package/dist/mcp/index.js

@@ -26693,6 +26693,136 @@ var INTEGRATION_REGISTRY = [
     // `registryRemoteMcpKeys`, which would strand the `.mcp.json` entry on
     // every host that installed the MCP variant.
   },
+  {
+    // Quiver (api.quiver.ai) — AI vector graphics: draw an SVG from a prompt,
+    // redraw one from an instruction, trace a raster, add animation.
+    //
+    // PREMIUM (ADR-0031, epic ENG-6920). Ninjafy holds ONE Quiver account whose
+    // key (`QUIVER_ACCOUNT_KEY`) every customer's drawing bills back to, so the
+    // credential is a single platform-held secret and never a per-install one.
+    // `auth_type: 'none'` on the catalog row and `credential_source:
+    // 'platform_env'` on every runtime scope, so `resolveBrokerToken` reads the
+    // env var and skips the install-row lookup entirely.
+    //
+    // Ships DARK: until the secret is set the resolver fails closed with
+    // `platform_credential_missing` and every drawing errors clearly.
+    // Installable but inert, by design — the same posture x-search shipped with.
+    //
+    // WHY IT STOPPED BEING BYO. It launched bring-your-own-key. Premium means WE
+    // pay the vendor, so a customer key would defeat the point: there would be
+    // nothing to meter and nothing to bill. The flip cost nothing because Quiver
+    // had never deployed — zero installs, so none of the origami free→premium
+    // grandfathering applies (there is no cohort whose `credential_source`
+    // default would misclassify them as billed and take the integration dark).
+    // A later BYO tier is possible (ADR-0055, the Firecrawl shape) and would
+    // need its own entitlement gate; it is deliberately not offered now, because
+    // offering two auth types renders a connect picker that does not check
+    // `plans.byo_credentials` (ENG-9236).
+    //
+    // WHY TWO METERS, when the vendor bills in one unit. `credits` is Quiver's
+    // own billing unit and the response carries it per call, so metering it
+    // makes our margin a constant multiple no matter which model an agent picks
+    // — `arrow-1.1-max` costs materially more than `arrow-1.1`, which a flat
+    // per-call price would silently eat. But `credits` is documented as
+    // "omitted for token-priced models, whose measured totals are returned in
+    // `usage`", so a credits-only meter bills those calls at ZERO: free to the
+    // customer, invisible to the budget gate, and with nothing in the ledger to
+    // notice it by. `svg_operation` is the floor that closes that hole — it
+    // fires ONLY when `credits` is absent, so the two can never double-bill the
+    // same call. See `lib/quiver-metering.ts`.
+    id: "quiver",
+    name: "Quiver",
+    category: "media",
+    description: "AI vector graphics \u2014 draw an SVG from a description, redraw an existing one, trace a photo or screenshot into vector shapes, and add animation. Ninjafy manages the Quiver account for you; there is no key to enter.",
+    supported_auth_types: ["none"],
+    docs_url: "https://docs.quiver.ai/developers",
+    capabilities: [
+      {
+        id: "quiver:create",
+        name: "Create and change vector graphics",
+        description: "Draw, redraw, trace and animate SVG artwork. Billed per Quiver credit consumed.",
+        access: "write"
+      },
+      {
+        id: "quiver:read",
+        name: "Read models",
+        description: "List the available drawing models and their per-call credit cost. Free.",
+        access: "read"
+      }
+    ],
+    beta: true,
+    // No `installable` on purpose: quiver is a seed integration
+    // (integration-definitions.json), so the seed catalog already makes it
+    // picker-visible. This entry exists to carry the `premium` descriptor that
+    // `isPremiumDefinition` reads — which arms the per-org opt-in gate, the
+    // priced acknowledgement modal and the admin pricing tab. Same reasoning as
+    // social-scraping above.
+    premium: {
+      pricing: "usage",
+      note: "Billed per Quiver credit consumed. Listing models is free; drawing, editing, tracing and animating each debit credits.",
+      meters: [
+        { event_type: "svg_credits", unit: "credit" },
+        { event_type: "svg_operation", unit: "operation" }
+      ]
+    }
+  },
+  {
+    // theSVG (thesvg.org) — 6,500+ REAL brand marks as SVG, so an agent building
+    // a page can use the actual Stripe/Slack/AWS logo instead of asking a
+    // drawing model for one. That distinction is the whole point of the
+    // integration: an AI-generated "Stripe logo" is a plausible fake, wrong in
+    // the way a customer notices and a trademark owner minds. Original artwork
+    // is Quiver's job; existing marks are this one's.
+    //
+    // WHY A LOCAL STDIO MCP AND NOT THE DIRECT-HTTP LANE. thesvg.org is a
+    // STATIC SITE — its own CLI says so in as many words ("there is no dynamic
+    // API"). The only two endpoints are `/api/registry.json`, the entire
+    // 2.97 MB / 6,523-entry manifest, and `/icons/{slug}/{variant}.svg`. Search
+    // is client-side filtering over that manifest, which the Direct-HTTP broker
+    // cannot do: it forwards the vendor's whole response body to the agent, so
+    // a `search_icons` descriptor would put 2.97 MB of registry into the
+    // agent's context on every call. The vendor's own MCP server bundles the
+    // registry and searches it in-process, which is precisely the shape the
+    // missing API leaves you needing.
+    //
+    // WHY THE VERSION IS PINNED and AWS's is `@latest`: this server's registry
+    // is baked in at BUILD time, so the pin is what decides which icons exist
+    // AND what markup lands on a customer's published page. Bumping it is a
+    // deliberate act that also refreshes the icon set — not a silent
+    // third-party update to artwork we are about to publish under a customer's
+    // domain.
+    //
+    // No credential anywhere: the registry and the jsDelivr CDN the server
+    // fetches SVG from are both public, so `auth_types: ['none']` is the honest
+    // classification rather than the ENG-8440 kind of lie Hard Rule 17 warns
+    // about — there genuinely is no key to enter and the install IS live
+    // immediately.
+    id: "thesvg",
+    name: "theSVG",
+    category: "media",
+    description: "Brand logos and icons as real SVG \u2014 search 6,500+ marks by name and pull the exact artwork, in mono, colour, light, dark or wordmark variants",
+    supported_auth_types: ["none"],
+    docs_url: "https://thesvg.org",
+    capabilities: [
+      {
+        id: "thesvg:read",
+        name: "Find and fetch brand icons",
+        description: "Search the icon library, list an icon's variants and categories, and fetch its SVG markup or CDN URL",
+        access: "read"
+      }
+    ],
+    installable: { category: "Media", authTypes: ["none"] },
+    beta: true,
+    // ENG-5815 data-driven path — no buildMcpJson edit, same as AWS.
+    nativeMcp: {
+      command: "npx",
+      args: ["-y", "@thesvg/mcp-server@0.8.2"],
+      env: {
+        PATH: "{{process_env.PATH}}",
+        HOME: "{{process_env.HOME}}"
+      }
+    }
+  },
   {
     id: "qmd",
     name: "QMD Memory Search",
@@ -27818,6 +27948,10 @@ var NOTICE_KIND_AUDIENCE = {
   // "Your `<verb>` approval request (`<uuid>`) EXPIRED at …" — in the report,
   // uuid and all.
   approval_expired: "agent",
+  // ENG-11334: canvas.publish_public approved / denied / approved-but-not-applied.
+  // Second-person instructions to the agent ("Tell the user...", "do not
+  // republish"); the user learns the outcome from the agent, not this row.
+  canvas_public_approval_resolved: "agent",
   // A routine fired; the agent picks the work up.
   routine_firing_result: "agent",
   // Live-advisor wake: "Call `live_read` with escalation_id …" — a literal tool
@@ -30344,7 +30478,7 @@ var FLAG_REGISTRY = [
   },
   {
     key: "approval-unified-authority",
-    description: "One authority check for every approval ingress (ENG-11207, ADR-0124 Phase 0b): canDecide() runs inside tryDispatchApprovalCore for console, Slack (channel, alerts, Socket Mode, which also carries Telegram) and Direct Chat taps alike. off = not computed. shadow = compute the verdict and log approval_authority_would_reject (ingress, verb, org, reason) for every tap it would refuse, then decide exactly as today. enforce = reserved for the per-(org, verb) allowlist slice; until that ships it behaves as shadow. Evaluated per-org. Ships dark.",
+    description: "One authority check for every approval ingress (ENG-11207, ADR-0124 Phase 0b): canDecide() runs inside tryDispatchApprovalCore for console, Slack (channel, alerts, Socket Mode, which also carries Telegram) and Direct Chat taps alike. off = not computed. shadow = compute the verdict, including the verb's declared approver boundary (ENG-11337), and log approval_authority_would_reject (ingress, verb, org, reason, boundary) for every tap it would refuse and approval_authority_would_admit (ingress, verb, org, basis, boundary) for every tap it would admit, then decide exactly as today. enforce = reserved for the per-(org, verb) allowlist slice; until that ships it behaves as shadow. Evaluated per-org. Ships dark.",
     flagType: "enum",
     allowedValues: ["off", "shadow", "enforce"],
     // Safe/default value is `off` (no computation, no extra reads on the tap path). A flag-DB read

package/dist/mcp/origami.js

@@ -40819,6 +40819,136 @@ var INTEGRATION_REGISTRY = [
     // `registryRemoteMcpKeys`, which would strand the `.mcp.json` entry on
     // every host that installed the MCP variant.
   },
+  {
+    // Quiver (api.quiver.ai) — AI vector graphics: draw an SVG from a prompt,
+    // redraw one from an instruction, trace a raster, add animation.
+    //
+    // PREMIUM (ADR-0031, epic ENG-6920). Ninjafy holds ONE Quiver account whose
+    // key (`QUIVER_ACCOUNT_KEY`) every customer's drawing bills back to, so the
+    // credential is a single platform-held secret and never a per-install one.
+    // `auth_type: 'none'` on the catalog row and `credential_source:
+    // 'platform_env'` on every runtime scope, so `resolveBrokerToken` reads the
+    // env var and skips the install-row lookup entirely.
+    //
+    // Ships DARK: until the secret is set the resolver fails closed with
+    // `platform_credential_missing` and every drawing errors clearly.
+    // Installable but inert, by design — the same posture x-search shipped with.
+    //
+    // WHY IT STOPPED BEING BYO. It launched bring-your-own-key. Premium means WE
+    // pay the vendor, so a customer key would defeat the point: there would be
+    // nothing to meter and nothing to bill. The flip cost nothing because Quiver
+    // had never deployed — zero installs, so none of the origami free→premium
+    // grandfathering applies (there is no cohort whose `credential_source`
+    // default would misclassify them as billed and take the integration dark).
+    // A later BYO tier is possible (ADR-0055, the Firecrawl shape) and would
+    // need its own entitlement gate; it is deliberately not offered now, because
+    // offering two auth types renders a connect picker that does not check
+    // `plans.byo_credentials` (ENG-9236).
+    //
+    // WHY TWO METERS, when the vendor bills in one unit. `credits` is Quiver's
+    // own billing unit and the response carries it per call, so metering it
+    // makes our margin a constant multiple no matter which model an agent picks
+    // — `arrow-1.1-max` costs materially more than `arrow-1.1`, which a flat
+    // per-call price would silently eat. But `credits` is documented as
+    // "omitted for token-priced models, whose measured totals are returned in
+    // `usage`", so a credits-only meter bills those calls at ZERO: free to the
+    // customer, invisible to the budget gate, and with nothing in the ledger to
+    // notice it by. `svg_operation` is the floor that closes that hole — it
+    // fires ONLY when `credits` is absent, so the two can never double-bill the
+    // same call. See `lib/quiver-metering.ts`.
+    id: "quiver",
+    name: "Quiver",
+    category: "media",
+    description: "AI vector graphics \u2014 draw an SVG from a description, redraw an existing one, trace a photo or screenshot into vector shapes, and add animation. Ninjafy manages the Quiver account for you; there is no key to enter.",
+    supported_auth_types: ["none"],
+    docs_url: "https://docs.quiver.ai/developers",
+    capabilities: [
+      {
+        id: "quiver:create",
+        name: "Create and change vector graphics",
+        description: "Draw, redraw, trace and animate SVG artwork. Billed per Quiver credit consumed.",
+        access: "write"
+      },
+      {
+        id: "quiver:read",
+        name: "Read models",
+        description: "List the available drawing models and their per-call credit cost. Free.",
+        access: "read"
+      }
+    ],
+    beta: true,
+    // No `installable` on purpose: quiver is a seed integration
+    // (integration-definitions.json), so the seed catalog already makes it
+    // picker-visible. This entry exists to carry the `premium` descriptor that
+    // `isPremiumDefinition` reads — which arms the per-org opt-in gate, the
+    // priced acknowledgement modal and the admin pricing tab. Same reasoning as
+    // social-scraping above.
+    premium: {
+      pricing: "usage",
+      note: "Billed per Quiver credit consumed. Listing models is free; drawing, editing, tracing and animating each debit credits.",
+      meters: [
+        { event_type: "svg_credits", unit: "credit" },
+        { event_type: "svg_operation", unit: "operation" }
+      ]
+    }
+  },
+  {
+    // theSVG (thesvg.org) — 6,500+ REAL brand marks as SVG, so an agent building
+    // a page can use the actual Stripe/Slack/AWS logo instead of asking a
+    // drawing model for one. That distinction is the whole point of the
+    // integration: an AI-generated "Stripe logo" is a plausible fake, wrong in
+    // the way a customer notices and a trademark owner minds. Original artwork
+    // is Quiver's job; existing marks are this one's.
+    //
+    // WHY A LOCAL STDIO MCP AND NOT THE DIRECT-HTTP LANE. thesvg.org is a
+    // STATIC SITE — its own CLI says so in as many words ("there is no dynamic
+    // API"). The only two endpoints are `/api/registry.json`, the entire
+    // 2.97 MB / 6,523-entry manifest, and `/icons/{slug}/{variant}.svg`. Search
+    // is client-side filtering over that manifest, which the Direct-HTTP broker
+    // cannot do: it forwards the vendor's whole response body to the agent, so
+    // a `search_icons` descriptor would put 2.97 MB of registry into the
+    // agent's context on every call. The vendor's own MCP server bundles the
+    // registry and searches it in-process, which is precisely the shape the
+    // missing API leaves you needing.
+    //
+    // WHY THE VERSION IS PINNED and AWS's is `@latest`: this server's registry
+    // is baked in at BUILD time, so the pin is what decides which icons exist
+    // AND what markup lands on a customer's published page. Bumping it is a
+    // deliberate act that also refreshes the icon set — not a silent
+    // third-party update to artwork we are about to publish under a customer's
+    // domain.
+    //
+    // No credential anywhere: the registry and the jsDelivr CDN the server
+    // fetches SVG from are both public, so `auth_types: ['none']` is the honest
+    // classification rather than the ENG-8440 kind of lie Hard Rule 17 warns
+    // about — there genuinely is no key to enter and the install IS live
+    // immediately.
+    id: "thesvg",
+    name: "theSVG",
+    category: "media",
+    description: "Brand logos and icons as real SVG \u2014 search 6,500+ marks by name and pull the exact artwork, in mono, colour, light, dark or wordmark variants",
+    supported_auth_types: ["none"],
+    docs_url: "https://thesvg.org",
+    capabilities: [
+      {
+        id: "thesvg:read",
+        name: "Find and fetch brand icons",
+        description: "Search the icon library, list an icon's variants and categories, and fetch its SVG markup or CDN URL",
+        access: "read"
+      }
+    ],
+    installable: { category: "Media", authTypes: ["none"] },
+    beta: true,
+    // ENG-5815 data-driven path — no buildMcpJson edit, same as AWS.
+    nativeMcp: {
+      command: "npx",
+      args: ["-y", "@thesvg/mcp-server@0.8.2"],
+      env: {
+        PATH: "{{process_env.PATH}}",
+        HOME: "{{process_env.HOME}}"
+      }
+    }
+  },
   {
     id: "qmd",
     name: "QMD Memory Search",
@@ -41944,6 +42074,10 @@ var NOTICE_KIND_AUDIENCE = {
   // "Your `<verb>` approval request (`<uuid>`) EXPIRED at …" — in the report,
   // uuid and all.
   approval_expired: "agent",
+  // ENG-11334: canvas.publish_public approved / denied / approved-but-not-applied.
+  // Second-person instructions to the agent ("Tell the user...", "do not
+  // republish"); the user learns the outcome from the agent, not this row.
+  canvas_public_approval_resolved: "agent",
   // A routine fired; the agent picks the work up.
   routine_firing_result: "agent",
   // Live-advisor wake: "Call `live_read` with escalation_id …" — a literal tool
@@ -44267,7 +44401,7 @@ var FLAG_REGISTRY = [
   },
   {
     key: "approval-unified-authority",
-    description: "One authority check for every approval ingress (ENG-11207, ADR-0124 Phase 0b): canDecide() runs inside tryDispatchApprovalCore for console, Slack (channel, alerts, Socket Mode, which also carries Telegram) and Direct Chat taps alike. off = not computed. shadow = compute the verdict and log approval_authority_would_reject (ingress, verb, org, reason) for every tap it would refuse, then decide exactly as today. enforce = reserved for the per-(org, verb) allowlist slice; until that ships it behaves as shadow. Evaluated per-org. Ships dark.",
+    description: "One authority check for every approval ingress (ENG-11207, ADR-0124 Phase 0b): canDecide() runs inside tryDispatchApprovalCore for console, Slack (channel, alerts, Socket Mode, which also carries Telegram) and Direct Chat taps alike. off = not computed. shadow = compute the verdict, including the verb's declared approver boundary (ENG-11337), and log approval_authority_would_reject (ingress, verb, org, reason, boundary) for every tap it would refuse and approval_authority_would_admit (ingress, verb, org, basis, boundary) for every tap it would admit, then decide exactly as today. enforce = reserved for the per-(org, verb) allowlist slice; until that ships it behaves as shadow. Evaluated per-org. Ships dark.",
     flagType: "enum",
     allowedValues: ["off", "shadow", "enforce"],
     // Safe/default value is `off` (no computation, no extra reads on the tap path). A flag-DB read