@intentius/chant-lexicon-fountain 0.76.0 → 0.78.0

package/README.md

@@ -2,7 +2,7 @@
 
 fountain lexicon plugin for [chant](https://github.com/intentius/chant).
 
-[fountain](https://github.com/BinaryBourbon/fountain) runs coding agents in
+[fountain](https://github.com/managoat/fountain) runs coding agents in
 sandboxed VMs. This lexicon declares its workload layer as typed chant
 resources: `Environment` (sandbox baseline), `Vault` (env-var overrides),
 `Agent` (a runnable agent config), `Teammate` (an agent seated on the team,
@@ -41,10 +41,11 @@ export const nightly = new Schedule({
 });
 ```
 
-`runtime: "acp"` and `runtime_command` are on the generated `Agent` type as
-chant extensions. Upstream does not have them until
-[BinaryBourbon/fountain#1634](https://github.com/BinaryBourbon/fountain/pull/1634)
-lands, and an instance without that PR rejects the pair at apply.
+Types are generated from fountain v0.21.0. That release describes
+`runtime: "acp"` and `runtime_command` on `Agent` itself, so an older instance
+rejects the pair at apply. `secrets` on `Environment` and `Vault` is the one
+field the lexicon adds to the request schemas, taken from fountain's manifest
+format.
 
 For agents handling anything sensitive, `ConciergeStack` bundles the
 locked-down defaults (deny-all egress, no vault overrides, ownership marker

package/dist/coverage.d.ts

@@ -18,11 +18,12 @@
 /**
  * Request schemas with no typed resource, and why.
  *
- * Every `*Request` schema in the pinned spec is either modeled or listed here.
- * v0.16.0 describes the whole product, not just the workload layer, so most of
- * this list is one restatement of the same three reasons: it is a session and
- * not a thing, it is an account operation and not estate, or it is write-only
- * and so could never be diffed.
+ * Every `*Request` schema in the pinned spec is either modeled or listed here,
+ * and every name listed here is a schema the pinned spec has (the coverage test
+ * holds both). The spec describes the whole product, not just the workload
+ * layer, so most of this list restates three reasons: it is a session and not a
+ * thing, it is an account operation and not estate, or it is write-only and so
+ * could never be diffed.
  */
 export declare const EXCLUDED_KINDS: Record<string, string>;
 /**

package/dist/coverage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coverage.d.ts","sourceRoot":"","sources":["../src/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAmDjD,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yEAAyE;IACzE,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,iEAAiE;IACjE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,+EAA+E;IAC/E,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC7D;AAOD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,GAAG,MAAM,EACzB,OAAO,EAAE,eAAe,GACvB,sBAAsB,CAqDxB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAGpE;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAkCpE;AAED,sDAAsD;AACtD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,sBAAsB,CASrF;AAED,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAsBlC"}
+{"version":3,"file":"coverage.d.ts","sourceRoot":"","sources":["../src/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAkEjD,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yEAAyE;IACzE,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,iEAAiE;IACjE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,+EAA+E;IAC/E,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC7D;AAOD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,GAAG,MAAM,EACzB,OAAO,EAAE,eAAe,GACvB,sBAAsB,CAqDxB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAGpE;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAkCpE;AAED,sDAAsD;AACtD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,sBAAsB,CASrF;AAED,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAsBlC"}

package/dist/generated/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generated/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,KAAK,+IAAqN,CAAC;AACxO,eAAO,MAAM,WAAW,+IAA2O,CAAC;AACpQ,eAAO,MAAM,QAAQ,+IAAgR,CAAC;AACtS,eAAO,MAAM,QAAQ,+IAA4N,CAAC;AAClP,eAAO,MAAM,KAAK,+IAAqJ,CAAC;AACxK,eAAO,MAAM,OAAO,+IAAyP,CAAC;AAE9Q,eAAO,MAAM,UAAU,0GAAyD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generated/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,KAAK,+IAAqN,CAAC;AACxO,eAAO,MAAM,WAAW,+IAAuL,CAAC;AAChN,eAAO,MAAM,QAAQ,+IAAgR,CAAC;AACtS,eAAO,MAAM,QAAQ,+IAAwM,CAAC;AAC9N,eAAO,MAAM,KAAK,+IAAqJ,CAAC;AACxK,eAAO,MAAM,OAAO,+IAAyP,CAAC;AAE9Q,eAAO,MAAM,UAAU,0GAAyD,CAAC"}

package/dist/integrity.json

@@ -1,9 +1,9 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "e2a11b25b51cd9dad49c40bd4894870b6ca73ffd40feb937ccd1bb742dfd7a0d",
-    "meta.json": "ed2c507b18806e3eac6641d9b8fc85cd59401a86ab39ba39405869fab91ba729",
-    "types/index.d.ts": "242196b012731a2fb7b586159ab234bf33f63b1653e49fc625b1cff0b3f7f1f3",
+    "manifest.json": "aa3acd6881163a56c6439a5bc69623fa527034d04d4344a0fceccb01602769ee",
+    "meta.json": "3301437a2a56eaf1a5cc8f6eabb18a40767f916e09701b2d9bf20aba4066738c",
+    "types/index.d.ts": "cf6b634fe0a8e9e96f1d9d07e3df53838def2683dc93dbe3c7fd971c6d3908ae",
     "rules/ftn001-no-secret-literals.ts": "a417b194cd7039911cca9a0f14c49b042dfa6b1ee48517f7c2e22b16590a8599",
     "rules/ftn010-networking-explicit.ts": "29d62025b456b207758a32d463b686e1acc5f1d39e36a6e8999946df26bbe1fc",
     "rules/ftn011-no-unrestricted-networking.ts": "2bf44295dfa5825a7863e49514f75ea9a74fe2658869d908a50de3a287a398a8",
@@ -11,16 +11,17 @@
     "rules/ftn013-substitution-resolvable.ts": "1425ca7de9494725ad4ec0bcb22abc30cff718d3fc3816fb86322897ebcaf451",
     "rules/ftn014-vault-shadowing.ts": "e966a441c52f57fee059e3e4834da2c5f9d12c71e551924beebd7d0740f714e1",
     "rules/ftn015-mcp-secret-env-substitution.ts": "88dc87c8f403a2fe48ee43bc4a4678d95273dba810135c8e74750f1bd62d2564",
-    "rules/ftn016-runtime-model-valid.ts": "22a4f8f94b4baf55714a629ea67045a48826ceaf51222f0ac5acad9e092bca46",
+    "rules/ftn016-runtime-model-valid.ts": "5bb5e399ab4efd764816dec221e3ca424ba1ce2470d00b034fbcc95b12de4979",
     "rules/ftn017-unique-resource-names.ts": "866f3f385083f96b6e8a18fa6f5624bab43752c5d22e7291e95835e62745d26c",
     "rules/ftn020-schedule-cron-syntax.ts": "a4291345035fbfddfa443aeae59c08be4d35f383a28cd19c827bf162b79f7703",
     "rules/ftn021-typed-references-resolve.ts": "1f62b4d1a47707b00634a50960bdd8233c292898a76aac0089ab02de76460d96",
     "rules/ftn022-webhook-url-public-https.ts": "06c4997350d6ad5b713b5f205becf89f9479136f015a76ebfff79938b45c6206",
-    "rules/ftn023-acp-runtime-command.ts": "856e12f47d7fd1dfff4a2d195ea857b21d5004305bcf445887583be9df27c72a",
-    "skills/chant-fountain.md": "909864c17d34ac1f614b286555bbc4a8d859530d1808b6fb7c32a24ef6a3bf20",
-    "skills/chant-fountain-secrets.md": "27e349a91589510a92e518c7d7824a4a322cab5ef242cf5799373a55cbfcd1cd",
-    "skills/chant-fountain-ops.md": "206b9088be0c43807df32de39949888bd28eefd870a191743e051814c94b2d0c",
+    "rules/ftn023-acp-runtime-command.ts": "1c46442052061d0f817afcf12b37880c1b261f9b4cffdbe9dcf87c7967383f6d",
+    "rules/ftn024-setup-timeout-range.ts": "2f292f3ecc3175604a47f03ff0e783b25b125f2d040684f189ce17650f78f121",
+    "skills/chant-fountain.md": "906a312756a02c88de634915f63ab4dfe1b1078ff4d8cfb4b6dc97eec14bc237",
+    "skills/chant-fountain-secrets.md": "40aa847d62547581bebdde630b54796c4e1cbf498869392e0d396d96a75c0ab6",
+    "skills/chant-fountain-ops.md": "4e72f0a0c7477a9e98f85ea45e49ba69e8a699f9c13ba0f0cf1cb20a88151373",
     "skills/chant-fountain-locked-sandboxes.md": "de82f06cb3a08ba6bf3ae45fb9869e21d6da18b9ebe0fc769da8aebaceea7dd1"
   },
-  "composite": "7f81d2852dd7719fb522d023fbdc2fdca18d7c36ac0fe425e0bf342ce478a7d3"
+  "composite": "ee2fae5b543bbf3521c91d488db426aadd40cb6825299244b3432e3e91e06dc9"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AA+B1E,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAsGzD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AA+B1E,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA8GzD,CAAC"}

package/dist/lint/post-synth/ftn023-acp-runtime-command.d.ts

@@ -9,8 +9,9 @@ import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
  * expects to run that nothing will ever execute, which is worse than an error
  * because it looks configured.
  *
- * Both fields are chant extensions pending BinaryBourbon/fountain#1634; the
- * rule holds the shape steady until upstream enforces it.
+ * Both fields are in the spec since fountain v0.21.0, and the server refuses
+ * either half without the other at apply. The rule moves that refusal to
+ * build, where it is a diagnostic in review instead of a 422 in a run.
  */
 export declare const acpRuntimeCommandCheck: PostSynthCheck;
 //# sourceMappingURL=ftn023-acp-runtime-command.d.ts.map

package/dist/lint/post-synth/ftn023-acp-runtime-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ftn023-acp-runtime-command.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/ftn023-acp-runtime-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAwCpC,CAAC"}
+{"version":3,"file":"ftn023-acp-runtime-command.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/ftn023-acp-runtime-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAwCpC,CAAC"}

package/dist/lint/post-synth/ftn024-setup-timeout-range.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const setupTimeoutRangeCheck: PostSynthCheck;
+//# sourceMappingURL=ftn024-setup-timeout-range.d.ts.map

package/dist/lint/post-synth/ftn024-setup-timeout-range.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ftn024-setup-timeout-range.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/ftn024-setup-timeout-range.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAoB9G,eAAO,MAAM,sBAAsB,EAAE,cA2BpC,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAcvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAa3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAevE,eAAO,MAAM,eAAe,EAAE,cAAc,EAc3C,CAAC"}

package/dist/lsp/hover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AA0E1E,4DAA4D;AAC5D,wBAAgB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAE9D"}
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AA4E1E,4DAA4D;AAC5D,wBAAgB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAE9D"}

package/dist/manifest.json

@@ -1,7 +1,7 @@
 {
   "name": "fountain",
-  "version": "0.76.0",
+  "version": "0.78.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Fountain",
-  "specVersion": "v0.16.0"
+  "specVersion": "v0.21.0"
 }

package/dist/meta.json

@@ -5,9 +5,11 @@
     "lexicon": "fountain",
     "props": [
       "allowed_environment_ids",
+      "allowed_inference_credential_ids",
       "allowed_vault_ids",
       "description",
       "environment_id",
+      "inference_credential_id",
       "mcp_servers",
       "metadata",
       "model",
@@ -24,6 +26,9 @@
       "environment_id": {
         "format": "uuid"
       },
+      "inference_credential_id": {
+        "format": "uuid"
+      },
       "model": {
         "pattern": "^[a-z0-9_-]+/[a-z0-9._-]+$"
       },
@@ -68,7 +73,9 @@
       "networking_type",
       "packages",
       "repositories",
-      "setup_script"
+      "secrets",
+      "setup_script",
+      "setup_timeout_seconds"
     ],
     "propertyConstraints": {
       "name": {
@@ -80,6 +87,10 @@
           "unrestricted",
           "limited"
         ]
+      },
+      "setup_timeout_seconds": {
+        "minimum": 1,
+        "maximum": 900
       }
     }
   },
@@ -154,7 +165,8 @@
     "props": [
       "description",
       "metadata",
-      "name"
+      "name",
+      "secrets"
     ],
     "propertyConstraints": {
       "name": {

package/dist/okf/index.md

@@ -25,4 +25,5 @@ okf_version: '0.2'
 * [FTN020](/rules/FTN020.md) - Schedule cron must be five- or six-field UTC cron (no @nickname shorthands)
 * [FTN021](/rules/FTN021.md) - A Teammate's agent and a Schedule's teammate must resolve within the build
 * [FTN022](/rules/FTN022.md) - Webhook url must be https and must not be a loopback or private address
-* [FTN023](/rules/FTN023.md) - FTN023
+* [FTN023](/rules/FTN023.md) - Agent runtime "acp" requires runtime_command, and no other runtime accepts one
+* [FTN024](/rules/FTN024.md) - Environment setup_timeout_seconds must be an integer from 1 to 900

package/dist/okf/rules/FTN023.md

@@ -1,14 +1,14 @@
 ---
 type: post-synth-check
 title: FTN023
-description: FTN023
+description: Agent runtime "acp" requires runtime_command, and no other runtime accepts one
 id: FTN023
 severity: error
 category: post-synth
 lexicon: fountain
 docs: https://intentius.io/chant/lexicons/fountain/rules/
 ---
-FTN023
+Agent runtime "acp" requires runtime_command, and no other runtime accepts one
 
 ## Applies to
 

package/dist/okf/rules/FTN024.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: FTN024
+description: Environment setup_timeout_seconds must be an integer from 1 to 900
+id: FTN024
+severity: error
+category: post-synth
+lexicon: fountain
+docs: https://intentius.io/chant/lexicons/fountain/rules/
+---
+Environment setup_timeout_seconds must be an integer from 1 to 900
+
+## Applies to
+
+- [Environment](/types/Environment.md)

package/dist/okf/types/Agent.md

@@ -10,17 +10,19 @@ resource_type: Fountain::V1::Agent
 
 ## Properties
 
-- `model` (`string`, required)
 - `name` (`string`, required)
 - `runtime` (`"acp" | "claude" | "codex" | "gemini" | "opencode"`, required)
-- `allowed_environment_ids` (`string[]`, optional): Environments a conversation may launch this agent under instead of its own. Same shape as allowed_vault_ids: null (default) allows any environment the tenant owns; an empty list forbids overriding; a non-empty list is an allowlist. The agent's own environment always passes.
+- `allowed_environment_ids` (`string[]`, optional): Environments a conversation may launch this agent under instead of its own (environment_id on create). Same shape as allowed_vault_ids: null (default) allows any environment the tenant owns; an empty list forbids overriding; a non-empty list is an allowlist. The agent's own environment always passes.
+- `allowed_inference_credential_ids` (`string[]`, optional): Credential sets a conversation may launch this agent on instead of the agent's (inference_credential_id on create). Same shape as allowed_vault_ids: null (default) allows any set the tenant owns; an empty list forbids overriding; a non-empty list is an allowlist. The agent's own set always passes.
 - `allowed_vault_ids` (`string[]`, optional): Vaults a conversation may attach to this agent. null (default) allows any vault the tenant owns; an empty list forbids attaching any vault; a non-empty list is an allowlist.
 - `description` (`string`, optional)
 - `environment_id` (`string`, optional)
+- `inference_credential_id` (`string`, optional): The credential set this agent's conversations run on. null (default) is the account's default set, which is what every agent had before an account could hold more than one.
 - `mcp_servers` (`Record<string, unknown>`, optional)
 - `metadata` (`Record<string, unknown>`, optional)
-- `permission_policy` (`Record<string, "ask" | "auto_allow" | "auto_deny">`, optional): Per-tool permission policy: a map of key to verdict, plus an optional "default" key. A key is matched against the tool card's title first and then ACP's kind (execute, edit, read, fetch, …); prefer a kind, because claude titles a tool call with the command it is about to run. Unset keys fall back to the default, and an unset default is auto_allow. "ask" holds the tool until a human answers it on the conversation stream, and denies if nobody does before the timeout. A conversation may narrow this at launch, never widen it. A runtime that never asks (opencode) refuses anything stricter than auto_allow with 422 permission_policy_unenforceable.
-- `runtime_command` (`string`, optional): The command line an "acp" agent speaks the Agent Client Protocol over, e.g. "chant acp". chant extension, pending BinaryBourbon/fountain#1634 — an instance without that PR rejects it at apply.
+- `model` (`string`, optional)
+- `permission_policy` (`Record<string, "ask" | "auto_allow" | "auto_deny" | number>`, optional): Per-tool permission policy: a map of key to verdict, plus an optional "default" key. A key is matched against the tool card's title first and then ACP's kind (execute, edit, read, fetch, …); prefer a kind, because claude titles a tool call with the command it is about to run. Unset keys fall back to the default, and an unset default is auto_allow. "ask" holds the tool until a human answers it on the conversation stream, and denies if nobody does before the timeout. A conversation may narrow this at launch, never widen it. A runtime that never asks (opencode) refuses anything stricter than auto_allow with 422 permission_policy_unenforceable.
+- `runtime_command` (`string`, optional): The command the acp runtime launches inside the sandbox, as a shell line resolved there (for example `chant acp`). Required when runtime is acp, and rejected on every other runtime, which resolves its own executable. A free string by design: it runs under the same isolation as an environment's setup script.
 - `sandbox_mode` (`"ephemeral" | "persistent"`, optional): Where a conversation of this agent runs by default (ADR 0023). ephemeral: a sandbox per conversation, reclaimed with it. persistent: one sandbox per agent identity (agent, environment, vault) — the agent's computer — that every conversation of that identity lands on and shares; it survives a conversation ending and is parked, not destroyed, at the ceiling. A launch may name the other with sandbox_mode on POST /api/conversations.
 - `sandbox_provider` (`"daytona" | "e2b" | "runner" | "sprites"`, optional): Sandbox backend override; null inherits the instance default (SANDBOX_PROVIDER). Only providers configured on this instance are accepted
 - `skills` (`Record<string, unknown>[]`, optional): Each entry is either inline (`{name, content}` — full SKILL.md text written to the sprite) or github (`{source, ref?, name?}` — installed on the sprite via the skills.sh CLI, optionally pinned to a tag/branch/sha via `ref`). Exactly one of `content` or `source` must be set on each entry.
@@ -33,4 +35,4 @@ resource_type: Fountain::V1::Agent
 - [FTN015](/rules/FTN015.md): Secret-shaped MCP env keys must be ${VAR} references, not literals
 - [FTN016](/rules/FTN016.md): Agent runtime must be a known runtime and model canonical provider/model_id
 - [FTN021](/rules/FTN021.md): A Teammate's agent and a Schedule's teammate must resolve within the build
-- [FTN023](/rules/FTN023.md): FTN023
+- [FTN023](/rules/FTN023.md): Agent runtime "acp" requires runtime_command, and no other runtime accepts one

package/dist/okf/types/Environment.md

@@ -17,7 +17,9 @@ resource_type: Fountain::V1::Environment
 - `networking_type` (`"limited" | "unrestricted"`, optional)
 - `packages` (`Record<string, unknown>`, optional)
 - `repositories` (`Repository[]`, optional)
+- `secrets` (`{ key: string; value: string }[]`, optional): Secrets upserted with the resource at apply, as key/value pairs; fountainApply sends them as the manifest's inline `secrets` map. Values are write-only upstream and can never be read back or diffed. Write a reference that resolves at build (an env var, a secret-manager lookup), never a literal: FTN001 flags a literal here as it does anywhere else in a declaration.
 - `setup_script` (`string`, optional)
+- `setup_timeout_seconds` (`number`, optional): Setup exec timeout in seconds; defaults to 120. The overall provisioning deadline still applies.
 
 ## Governed by
 
@@ -27,3 +29,4 @@ resource_type: Fountain::V1::Environment
 - [FTN012](/rules/FTN012.md): Environment env_vars must not carry cloud-credential-shaped keys or values
 - [FTN013](/rules/FTN013.md): Agent ${VAR} references should resolve against the environment's declared keys
 - [FTN014](/rules/FTN014.md): Vault keys shadowing a declared Environment key should be visible in review
+- [FTN024](/rules/FTN024.md): Environment setup_timeout_seconds must be an integer from 1 to 900

package/dist/okf/types/Vault.md

@@ -13,6 +13,7 @@ resource_type: Fountain::V1::Vault
 - `name` (`string`, required)
 - `description` (`string`, optional)
 - `metadata` (`Record<string, unknown>`, optional)
+- `secrets` (`{ key: string; value: string }[]`, optional): Secrets upserted with the resource at apply, as key/value pairs; fountainApply sends them as the manifest's inline `secrets` map. Values are write-only upstream and can never be read back or diffed. Write a reference that resolves at build (an env var, a secret-manager lookup), never a literal: FTN001 flags a literal here as it does anywhere else in a declaration.
 
 ## Governed by
 

package/dist/rules/ftn016-runtime-model-valid.ts

@@ -8,11 +8,11 @@ import { propsOf } from "../../entity-props";
  * this backstops untyped construction (imported templates, hand-built
  * plans) so a typo fails the build instead of a 422 at apply.
  *
- * `acp` is the exception on both counts. It is a chant extension pending
- * BinaryBourbon/fountain#1634, and it names a process rather than a hosted
- * model: the model is whatever the command on the other end of the protocol
- * decides to use, so a `model` on an acp agent is a value nothing reads. The
- * command itself is FTN023's business.
+ * `acp` is the exception on the model. The runtime is in the spec since
+ * fountain v0.21.0, which also stopped requiring `model`, and it names a
+ * process rather than a hosted model: the model is whatever the command on the
+ * other end of the protocol decides to use, so a `model` on an acp agent is a
+ * value nothing reads. The command itself is FTN023's business.
  */
 
 const RUNTIMES = new Set(["claude", "codex", "gemini", "opencode", "acp"]);

package/dist/rules/ftn023-acp-runtime-command.ts

@@ -11,12 +11,13 @@ import { propsOf } from "../../entity-props";
  * expects to run that nothing will ever execute, which is worse than an error
  * because it looks configured.
  *
- * Both fields are chant extensions pending BinaryBourbon/fountain#1634; the
- * rule holds the shape steady until upstream enforces it.
+ * Both fields are in the spec since fountain v0.21.0, and the server refuses
+ * either half without the other at apply. The rule moves that refusal to
+ * build, where it is a diagnostic in review instead of a 422 in a run.
  */
 export const acpRuntimeCommandCheck: PostSynthCheck = {
   id: "FTN023",
-  description: 'Agent runtime "acp" requires runtime_command, and no other runtime accepts one',
+  description: "Agent runtime \"acp\" requires runtime_command, and no other runtime accepts one",
 
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];

package/dist/rules/ftn024-setup-timeout-range.ts

@@ -0,0 +1,48 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { propsOf } from "../../entity-props";
+
+/**
+ * FTN024: an Environment's `setup_timeout_seconds` is a whole number from 1 to 900.
+ *
+ * fountain v0.21.0 declares the field as an integer with `minimum: 1` and
+ * `maximum: 900`, and defaults it to 120 when it is absent. Codegen types it as
+ * `number` and carries neither bound into validation, so without this rule a
+ * 901 or a 12.5 builds cleanly and the first anyone hears of it is a 422 at
+ * apply.
+ *
+ * A value in range is still worth a second look in review. Changing it
+ * invalidates the environment's checkpoints (recorded on chant#2391), so an
+ * edit to this field costs what an edit to `setup_script` costs.
+ */
+
+const MIN = 1;
+const MAX = 900;
+
+export const setupTimeoutRangeCheck: PostSynthCheck = {
+  id: "FTN024",
+  description: "Environment setup_timeout_seconds must be an integer from 1 to 900",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of ctx.entities) {
+      if (entity.entityType !== "Fountain::V1::Environment") continue;
+      const timeout = propsOf(entity).setup_timeout_seconds;
+      if (timeout === undefined || timeout === null) continue;
+
+      if (typeof timeout !== "number" || !Number.isInteger(timeout) || timeout < MIN || timeout > MAX) {
+        diagnostics.push({
+          checkId: "FTN024",
+          severity: "error",
+          message:
+            `Environment "${name}" setup_timeout_seconds ${JSON.stringify(timeout)} is not an integer ` +
+            `from ${MIN} to ${MAX}; fountain refuses it at apply`,
+          entity: name,
+          lexicon: "fountain",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/skills/chant-fountain-ops.md

@@ -125,7 +125,8 @@ The second posts `chant run <op>` back onto the steward's thread, with
 now-resolved fact.
 
 `--durable-requests` (answering fountain's own permission card instead) is
-refused by name: it needs BinaryBourbon/fountain#1635, which has not shipped.
+refused by name: it needs fountain#1635's request-answer path, which fountain
+v0.21.0 carries and chant does not use yet (chant#2391).
 
 ## When the steward is busy
 
@@ -158,7 +159,7 @@ success nobody saw.
 
 ## Two upstream caveats
 
-- `runtime: "acp"` with `runtime_command` is BinaryBourbon/fountain#1634 and is
-  not in v0.16.0. An instance without it rejects the pair at apply.
-- Bulk apply covering the team-side kinds is BinaryBourbon/fountain#1636. Until
-  then they go through their own routes, which is what `fountainApply` does.
+- `runtime: "acp"` with `runtime_command` needs fountain v0.21.0 or later. An
+  older instance rejects the pair at apply.
+- Bulk apply covering the team-side kinds is fountain#1636. Until chant uses it,
+  they go through their own routes, which is what `fountainApply` does.

package/dist/skills/chant-fountain-secrets.md

@@ -11,7 +11,7 @@ user-invocable: true
 Everything materialized into a fountain sandbox must be presumed exfiltrated once untrusted agent code runs. Order of preference:
 
 1. **`${VAR}` substitution references** in agent config (MCP server env, system prompts). Resolved at spawn from the merged environment + vault sets. Never a value in source.
-2. **Environment secrets** (`spec.secrets`) — encrypted at rest, write-only over the API (values are never returned once stored). `fountainApply` sends them inline with the rest of the resource in the bulk apply request, and the server upserts them through the encrypted envelope path; a changed value cannot be detected, only overwritten.
+2. **Environment and Vault secrets** (`spec.secrets`), typed on both kinds as `secrets: { key: string; value: string }[]`. Encrypted at rest, write-only over the API (values are never returned once stored). Write the value as a reference your build resolves, not the secret itself. `fountainApply` sends them inline with the rest of the resource in the bulk apply request, and the server upserts them through the encrypted envelope path; a changed value cannot be detected, only overwritten.
 3. **`env_vars`** — plaintext config only. FTN012 errors on credential-shaped keys or values here.
 
 Never put a literal credential anywhere in a declaration: FTN001 catches known shapes (AWS keys, GitHub/Slack tokens, `sk-`/`ftn_` keys, private key material) at the AST; FTN015 errors on secret-shaped MCP env keys that are not `${VAR}` references.
@@ -26,4 +26,4 @@ FTN013 warns when an agent references `${VAR}` and its declared environment has
 
 ## Round-trips and their limits
 
-`chant import --from` exports live resources but never secrets: values are write-only upstream, and secret keys are not on the typed request surface. Re-declare imported environments' secrets through your secret provider. Upstream discussion of a reference-based model that would fix this: BinaryBourbon/fountain#148.
+`chant import --from` exports live resources but never secrets: values are write-only upstream, so there is nothing to read back into `secrets`. Re-declare imported environments' secrets through your secret provider. Upstream discussion of a reference-based model that would fix this: BinaryBourbon/fountain#148.

package/dist/skills/chant-fountain.md

@@ -8,7 +8,7 @@ user-invocable: true
 
 ## What this lexicon covers
 
-[fountain](https://github.com/BinaryBourbon/fountain) runs coding agents in sandboxed VMs. Six kinds are declarable, and this lexicon types all of them. `Environment` (sandbox baseline), `Vault` (env-var overrides) and `Agent` (a runnable agent config) are the workload layer; `Teammate` (an agent seated on the team, with a thread of its own), `Schedule` (a cron prompt into that thread) and `Webhook` (where the estate's events leave it) are the team, schedule and webhook routes. Conversations are runs, not resources: start them with the `fountainRun` op, never declare them.
+[fountain](https://github.com/managoat/fountain) runs coding agents in sandboxed VMs. Six kinds are declarable, and this lexicon types all of them. `Environment` (sandbox baseline), `Vault` (env-var overrides) and `Agent` (a runnable agent config) are the workload layer; `Teammate` (an agent seated on the team, with a thread of its own), `Schedule` (a cron prompt into that thread) and `Webhook` (where the estate's events leave it) are the team, schedule and webhook routes. Conversations are runs, not resources: start them with the `fountainRun` op, never declare them.
 
 The source of truth is the TypeScript in `src/`. `chant build` serializes it to fountain's own manifest YAML (ejectable — `fountain apply -f` accepts it verbatim). `fountainApply` sends that same YAML to fountain's bulk `POST /api/apply` endpoint in one request: create-if-new, update-by-name, opt-in owned-only prune keyed on the `managed-by: chant` metadata marker. Bulk apply covers Environment, Vault and Agent only — a Teammate, Schedule or Webhook document is emitted and valid, and applying it through its own route waits on chant #2127.
 
@@ -64,6 +64,6 @@ What a client sees:
 - A run that stops at an unapproved gate replies with the pending fact and the `chant approve <op> <gate>` line, and the turn ends. The gate is a fact on chant's ledger, not a wait — the next run re-evaluates it.
 - `session/cancel` aborts the in-flight step, runs the op's `onFailure` phases, and ends the turn `cancelled`.
 
-`--durable-requests` turns the gated reply into a `session/request_permission` with `allow_once`/`reject_once` and ends the turn `waiting`; the client answers on a later prompt carrying `_meta.chant.permission`, which records the resolution and re-runs. It is off by default because a request that outlives a turn needs BinaryBourbon/fountain#1635.
+`--durable-requests` turns the gated reply into a `session/request_permission` with `allow_once`/`reject_once` and ends the turn `waiting`; the client answers on a later prompt carrying `_meta.chant.permission`, which records the resolution and re-runs. It is off by default because a request that outlives a turn needs fountain#1635, which v0.21.0 carries and chant does not answer through yet (chant#2391).
 
 The server does not redact. A step's output reaches the thread verbatim and fountain redacts secrets on the way in; chant never reads or prints the environment it was spawned with.

package/dist/spec/fetch.d.ts

@@ -16,7 +16,10 @@
  * The committed snapshot is now only the offline path. It is not a silent
  * substitute for the pin: both routes log which one was taken and at what
  * version, because a fallback nobody can see is how you end up debugging types
- * that came from somewhere you did not expect.
+ * that came from somewhere you did not expect. And it is refused outright when
+ * its own `info.version` is not the pin (#2389). A bump that changes the
+ * constant but not the snapshot would otherwise generate the old surface on
+ * any machine without a network and label it with the new version.
  */
 /**
  * The pinned upstream spec.
@@ -24,10 +27,13 @@
  * v0.3.0 was the first release to carry the `openapi.json` asset. v0.16.0 is
  * the first that describes team, schedules, webhooks, sandboxes and the event
  * stream, which is what the Teammate, Schedule and Webhook kinds are generated
- * from. Bumping this changes the generated surface, so it belongs in its own
+ * from. v0.21.0 adds `setup_timeout_seconds` to Environment and describes the
+ * acp runtime itself (`runtime: "acp"` and `runtime_command` on Agent, with
+ * `model` no longer required), which chant had modeled as an extension until
+ * then. Bumping this changes the generated surface, so it belongs in its own
  * commit with the regenerated snapshot beside it.
  */
-export declare const FOUNTAIN_SPEC_VERSION = "v0.16.0";
+export declare const FOUNTAIN_SPEC_VERSION = "v0.21.0";
 /**
  * Fetch the pinned fountain OpenAPI spec, falling back to the committed
  * snapshot when there is no network. Returns a single-entry map — the whole
@@ -35,5 +41,14 @@ export declare const FOUNTAIN_SPEC_VERSION = "v0.16.0";
  */
 export declare function fetchSchemas(options?: {
     force?: boolean;
+    /** The offline fallback's file. Tests point it at a snapshot of another release. */
+    snapshotFile?: string;
 }): Promise<Map<string, Buffer>>;
+/**
+ * Read the committed snapshot, refusing it when it describes a release other
+ * than the pinned one. The spec's `info.version` carries no leading `v`
+ * (`0.21.0`) where the release tag does (`v0.21.0`), so both are compared
+ * without it.
+ */
+export declare function readSnapshot(file?: string, pinned?: string): Buffer;
 //# sourceMappingURL=fetch.d.ts.map

package/dist/spec/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/spec/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAQ/C;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiB9F"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/spec/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAQH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAU/C;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiB/B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAsB,EAAE,MAAM,GAAE,MAA8B,GAAG,MAAM,CAoBzG"}

package/dist/spec/parse.d.ts

@@ -20,9 +20,11 @@
  *     add one that reaches the API only as a path parameter (a schedule's
  *     teammate), into a by-name reference the serializer resolves and FTN021
  *     proves resolvable — the same shape an Agent's `environment` has.
- *   - Extensions. A prop chant accepts ahead of upstream, declared here so the
- *     generated type documents it instead of leaving authors to smuggle it
- *     through `metadata`. Today that is the ACP runtime.
+ *   - Extensions. A prop chant accepts that the request schema does not
+ *     describe, declared here so the generated type documents it instead of
+ *     leaving authors to smuggle it through `metadata` or a cast. Today that is
+ *     the inline `secrets` on Environment and Vault, which upstream documents
+ *     on its manifest format rather than on either request schema.
  */
 import { type PropertyConstraints } from "@intentius/chant/codegen/json-schema";
 export type { PropertyConstraints };

package/dist/spec/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,sCAAsC,CAAC;AAI9C,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,0EAA0E;IAC1E,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,iEAAiE;IACjE,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACjD,oEAAoE;IACpE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA0ID;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,EAAoC,CAAC;AAqBjF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,mBAAmB,EAAE,CA4GjF;AAmID,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG5D"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,sCAAsC,CAAC;AAI9C,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,0EAA0E;IAC1E,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,iEAAiE;IACjE,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACjD,oEAAoE;IACpE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA6ID;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,EAAoC,CAAC;AAqBjF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,mBAAmB,EAAE,CA6GjF;AAwKD,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG5D"}

package/dist/types/index.d.ts

@@ -4,20 +4,24 @@
 
 export declare class Agent {
   constructor(props: {
-    model: string;
     name: string;
     runtime: "acp" | "claude" | "codex" | "gemini" | "opencode";
-    /** Environments a conversation may launch this agent under instead of its own. Same shape as allowed_vault_ids: null (default) allows any environment the tenant owns; an empty list forbids overriding; a non-empty list is an allowlist. The agent's own environment always passes. */
+    /** Environments a conversation may launch this agent under instead of its own (environment_id on create). Same shape as allowed_vault_ids: null (default) allows any environment the tenant owns; an empty list forbids overriding; a non-empty list is an allowlist. The agent's own environment always passes. */
     allowed_environment_ids?: string[];
+    /** Credential sets a conversation may launch this agent on instead of the agent's (inference_credential_id on create). Same shape as allowed_vault_ids: null (default) allows any set the tenant owns; an empty list forbids overriding; a non-empty list is an allowlist. The agent's own set always passes. */
+    allowed_inference_credential_ids?: string[];
     /** Vaults a conversation may attach to this agent. null (default) allows any vault the tenant owns; an empty list forbids attaching any vault; a non-empty list is an allowlist. */
     allowed_vault_ids?: string[];
     description?: string;
     environment_id?: string;
+    /** The credential set this agent's conversations run on. null (default) is the account's default set, which is what every agent had before an account could hold more than one. */
+    inference_credential_id?: string;
     mcp_servers?: Record<string, unknown>;
     metadata?: Record<string, unknown>;
+    model?: string;
     /** Per-tool permission policy: a map of key to verdict, plus an optional "default" key. A key is matched against the tool card's title first and then ACP's kind (execute, edit, read, fetch, …); prefer a kind, because claude titles a tool call with the command it is about to run. Unset keys fall back to the default, and an unset default is auto_allow. "ask" holds the tool until a human answers it on the conversation stream, and denies if nobody does before the timeout. A conversation may narrow this at launch, never widen it. A runtime that never asks (opencode) refuses anything stricter than auto_allow with 422 permission_policy_unenforceable. */
-    permission_policy?: Record<string, "ask" | "auto_allow" | "auto_deny">;
-    /** The command line an "acp" agent speaks the Agent Client Protocol over, e.g. "chant acp". chant extension, pending BinaryBourbon/fountain#1634 — an instance without that PR rejects it at apply. */
+    permission_policy?: Record<string, "ask" | "auto_allow" | "auto_deny" | number>;
+    /** The command the acp runtime launches inside the sandbox, as a shell line resolved there (for example `chant acp`). Required when runtime is acp, and rejected on every other runtime, which resolves its own executable. A free string by design: it runs under the same isolation as an environment's setup script. */
     runtime_command?: string;
     /** Where a conversation of this agent runs by default (ADR 0023). ephemeral: a sandbox per conversation, reclaimed with it. persistent: one sandbox per agent identity (agent, environment, vault) — the agent's computer — that every conversation of that identity lands on and shares; it survives a conversation ending and is parked, not destroyed, at the ceiling. A launch may name the other with sandbox_mode on POST /api/conversations. */
     sandbox_mode?: "ephemeral" | "persistent";
@@ -45,10 +49,13 @@ export declare class Environment {
     networking_type?: "limited" | "unrestricted";
     packages?: Record<string, unknown>;
     repositories?: Repository[];
+    /** Secrets upserted with the resource at apply, as key/value pairs; fountainApply sends them as the manifest's inline `secrets` map. Values are write-only upstream and can never be read back or diffed. Write a reference that resolves at build (an env var, a secret-manager lookup), never a literal: FTN001 flags a literal here as it does anywhere else in a declaration. */
+    secrets?: { key: string; value: string }[];
     setup_script?: string;
+    /** Setup exec timeout in seconds; defaults to 120. The overall provisioning deadline still applies. */
+    setup_timeout_seconds?: number;
   });
   readonly agent_count: number;
-  readonly allowed_environment_ids: string[];
   readonly id: string;
   readonly inserted_at: string;
   readonly secret_count: number;
@@ -87,7 +94,6 @@ export declare class Teammate {
     /** Layer this vault's secrets on top. Must satisfy allowed_vault_ids. */
     vault?: Vault | string;
   });
-  readonly contact: Record<string, unknown>;
   readonly conversation: Record<string, unknown>;
   readonly last_turn: Record<string, unknown>;
   readonly presence: Record<string, unknown>;
@@ -101,6 +107,8 @@ export declare class Vault {
     name: string;
     description?: string;
     metadata?: Record<string, unknown>;
+    /** Secrets upserted with the resource at apply, as key/value pairs; fountainApply sends them as the manifest's inline `secrets` map. Values are write-only upstream and can never be read back or diffed. Write a reference that resolves at build (an env var, a secret-manager lookup), never a literal: FTN001 flags a literal here as it does anywhere else in a declaration. */
+    secrets?: { key: string; value: string }[];
   });
   readonly id: string;
   readonly inserted_at: string;