@maka/maka-cli 5.200.0 → 5.202.0

package/bundle/typescript/src/commands/game/sideQuest/commands/search.js

@@ -8,6 +8,7 @@ import { hostLabel } from '../utilities/grid-names.js';
 import { canReach, exitSpot, spotsActive, revealWithPerception, theSpot, sealedRouteTo, } from '../utilities/spots.js';
 import { placeName } from '../utilities/log-style.js';
 import { billAction, encounterOf } from '../utilities/action-cost.js';
+import { showsMechanics, mechanicsActorPrefix } from '../utilities/mechanics-audience.js';
 /**
  * Barrier rendering (2026-08-24 playtest: "I don't see THE THING I'm
  * supposed to act on -- just a description... and I still see the
@@ -166,9 +167,8 @@ export class SearchCommand extends Command {
         const { pool, limit } = matrixSearchTest(actor);
         const roll = rollPool(pool, limit);
         const seconds = matrixSearchSeconds(row.seconds, roll.hits, row.threshold, browse);
-        const isPlayer = this.scene.isHumanControlled(actor);
-        if (isPlayer) {
-            this.logger.meta(`Matrix Search (Computer + Intuition [Data Processing], threshold ${row.threshold}${browse ? ', Browse' : ''}): ${formatRoll(roll)} -- ${seconds}s`);
+        if (showsMechanics(this.scene, actor)) {
+            this.logger.meta(`${mechanicsActorPrefix(this.scene, actor)}Matrix Search (Computer + Intuition [Data Processing], threshold ${row.threshold}${browse ? ', Browse' : ''}): ${formatRoll(roll)} -- ${seconds}s`);
         }
         // THE MINUTES ARE GOD'S (p.231-232): Overwatch bills time on the
         // grid, and a search is time. Winding the last tick back by the
@@ -176,7 +176,12 @@ export class SearchCommand extends Command {
         if (actor.overwatchLastTick > 0)
             actor.overwatchLastTick -= seconds * 1000;
         actor.performAction('runs a Matrix Search', host ? `inside ${hostLabel(where)}` : `across ${where.name}'s grid`, { quiet: this.scene.isHumanControlled(actor) });
-        const files = where.offlineServer ? [] : where.inventory.getAllItems().filter(i => i.plane === 'matrix');
+        // CAMOUFLAGE (p.256, sprite-power-actions.ts): a file a sprite folded
+        // into another file is "invisible to Matrix searches" -- only a Matrix
+        // Perception specifically hunting it turns it up. This is the search
+        // it is invisible to.
+        const files = where.offlineServer ? [] : where.inventory.getAllItems()
+            .filter(i => i.plane === 'matrix' && !i.concealedBy);
         const clock = `(${seconds}s of Matrix time${browse ? ', Browse cutting it' : ''})`;
         if (roll.hits < row.threshold) {
             return host
@@ -210,8 +215,24 @@ export class SearchCommand extends Command {
         // minute inside a host), not in Action Phases -- there is no cost to
         // bill inside a Combat Turn, so it is refused there rather than
         // priced by invention.
-        if (this.actor.plane === 'matrix' && encounterOf(this.scene, this.actor)) {
-            return `Not with the ice on you -- a Matrix Search takes minutes (p.241), and a Combat Turn is three seconds. Crash the ice, "hide" from it (p.240), or get out first.`;
+        //
+        // A FINISHED FIGHT IS NOT A FIGHT. This asked `encounterOf(...)` and
+        // nothing else, while every other seam in action-cost.ts -- billAction,
+        // requirePhase, inLiveCombat -- pairs it with `!enc.ended`. An
+        // encounter object outlives the fight it ran, so a persona that had
+        // crashed the ice and watched the walls come down kept being told to
+        // crash the ice: the refusal named an exit the player had already
+        // taken. That is the reported "it says I can't do it with an IC
+        // there" (user, 2026-09-15), and the reason the answer to "is that
+        // correct?" is yes-but-not-here.
+        const enc = encounterOf(this.scene, this.actor);
+        if (this.actor.plane === 'matrix' && enc && !enc.ended) {
+            // Name the action that DOES fit in three seconds. The old line
+            // listed only ways to leave, which reads as "not now" when canon's
+            // answer is "not this verb" -- Matrix Perception is the Complex
+            // Action for looking at things mid-fight, and `look` is it
+            // (commands/look.ts bills exactly that).
+            return `Not with the ice on you -- a Matrix Search takes minutes (p.241), and a Combat Turn is three seconds. "look" is Matrix Perception (p.241), the Complex Action you CAN take right now. Otherwise crash the ice, "hide" from it (p.240), or get out first.`;
         }
         if (this.actor.plane === 'matrix')
             return this.matrixSearch();
@@ -238,10 +259,15 @@ export class SearchCommand extends Command {
         // Roll anatomy to the Mechanics ticker for the player; an NPC's
         // return string is its AI history, so IT keeps the roll inline
         // (readability pass).
-        const isPlayer = this.scene.isHumanControlled(this.actor);
-        if (isPlayer)
-            this.logger.meta(`Perception: ${formatRoll(roll)}`);
-        const rollPrefix = isPlayer ? '' : `Perception: ${formatRoll(roll)}\n`;
+        // ONE PREDICATE FOR BOTH HALVES. The roll goes to the Mechanics panel
+        // OR into the return string (an NPC's AI history), never both -- so
+        // when the gate widened to companions (showsMechanics), the inline
+        // copy had to narrow by exactly the same amount or an ordered drone
+        // would print its Perception twice.
+        const toPanel = showsMechanics(this.scene, this.actor);
+        if (toPanel)
+            this.logger.meta(`${mechanicsActorPrefix(this.scene, this.actor)}Perception: ${formatRoll(roll)}`);
+        const rollPrefix = toPanel ? '' : `Perception: ${formatRoll(roll)}\n`;
         if (roll.hits === 0) {
             return `${rollPrefix}You sweep the room and come up empty... you think.${describeContainers(room, this.actor)}${describeBarriers(room, this.actor)}`;
         }

package/bundle/typescript/src/commands/game/sideQuest/commands/sprite-power.js

@@ -0,0 +1,85 @@
+import { Command } from './command.js';
+import { hint } from '../utilities/hints.js';
+import { NPC } from '../models/npc.js';
+import { SPRITE_POWERS, SPRITE_POWER_TASK_RULE, powersForSprite } from '../sprite-powers.js';
+import { runSpritePower } from '../utilities/sprite-power-actions.js';
+/**
+ * A SPRITE POWER AS A TYPED MOVE (user 2026-09-15).
+ *
+ * The verb surface is `order <sprite> <power> [target]` -- order.ts
+ * already parses "order <name> <command>" and hands the rest to
+ * NPC.tryRunCommand, so each power name registers as an ordinary verb
+ * that only a sprite can run. That keeps the task accounting, the
+ * companion feed and the Mechanics routing that "order" already does,
+ * instead of building a second way to tell a sprite to do something.
+ *
+ * ONE TASK PER USE (p.254, p.256 -- SPRITE_POWER_TASK_RULE). order.ts
+ * bills it on the success path, so a refusal here costs nothing. That is
+ * why every guard below returns before the resolver runs.
+ */
+export class SpritePowerCommand extends Command {
+    static verb = 'cookie';
+    static description = 'A sprite power (SR5 p.256-257). Order it: "order <sprite> <power> <target>". "sprites" lists which sprite has which.';
+    static npcPolicy = 'open';
+    /** Which power this registration is -- set per alias at registration. */
+    powerKey() {
+        return this.constructor.verb;
+    }
+    async execute(args = []) {
+        const actor = this.actor;
+        const key = this.powerKey();
+        // A PERSON CANNOT DO THESE. Sprite powers are the thing a sprite has
+        // that its technomancer does not (Sz7EmXnyRYK4RYqxt's whole point),
+        // so a player typing "cookie" is told where the verb lives rather
+        // than being quietly refused by a type check.
+        if (!(actor instanceof NPC)) {
+            const power = SPRITE_POWERS.find(p => p.key === key);
+            return `${power?.name ?? key} is a SPRITE power (${power?.page ?? 'p.256-257'}) -- not something a persona does. ${hint(`Order it: "order <sprite> ${key} <target>". "sprites" shows which sprite has which.`)}`;
+        }
+        const game = this.scene.ownerGame;
+        const entry = game?.companions?.find(c => c.npc === actor);
+        if (!entry || entry.kind !== 'sprite') {
+            return `Only a sprite runs a sprite power (p.256).`;
+        }
+        const spriteKey = entry.spriteType ?? '';
+        const master = this.scene.getPlayers?.()[0];
+        if (!master)
+            return `No one is holding this sprite's thread.`;
+        // The p.259 database decides who has what; the resolver re-checks,
+        // but naming the sprite's own list here is the useful refusal.
+        if (!powersForSprite(spriteKey).some(p => p.key === key)) {
+            const mine = powersForSprite(spriteKey).map(p => p.name).join(', ');
+            return `${actor.name} is a ${spriteKey} sprite -- no ${SPRITE_POWERS.find(p => p.key === key)?.name ?? key} (p.259). It can do: ${mine || 'nothing listed'}.`;
+        }
+        // DIAGNOSTICS TAKES THE SPRITE'S WHOLE ATTENTION (p.257): any other
+        // order drops the bonus it was holding. Cleared before the new power
+        // runs, so the sprite cannot be assisting and attacking at once.
+        if (master.spriteAssist?.sprite === actor.name && key !== 'diagnostics') {
+            master.spriteAssist = undefined;
+        }
+        const result = runSpritePower(key, {
+            scene: this.scene,
+            sprite: actor,
+            level: entry.force,
+            spriteKey,
+            master,
+        }, args.join(' '));
+        for (const line of result.meta)
+            this.logger.meta(line);
+        if (!result.spent)
+            return result.text;
+        this.scene.updateStatus?.();
+        return `${result.text}${hint(`\n${SPRITE_POWER_TASK_RULE}`)}`;
+    }
+}
+/** One registered verb per power, so "order <sprite> gremlins <lock>" parses
+ *  through the ordinary command table rather than a second dispatcher. */
+export const SPRITE_POWER_COMMANDS = Object.fromEntries(SPRITE_POWERS.map(power => {
+    const cls = class extends SpritePowerCommand {
+        static verb = power.key;
+        static description = `${power.name} (${power.page}): ${power.effect}`;
+        powerKey() { return power.key; }
+    };
+    return [power.key, cls];
+}));
+//# sourceMappingURL=sprite-power.js.map

package/bundle/typescript/src/commands/game/sideQuest/commands/sprites.js

@@ -82,7 +82,14 @@ export class SpritesCommand extends Command {
                 continue;
             }
             for (const p of powers) {
-                lines.push(`  ${p.name}${hint(`  (${p.page})`)}`);
+                // WHICH POWERS ARE MOVES (ISpritePower.runnable). Eight of the
+                // nine resolve; Stability is still catalogue, and the panel says
+                // so on the power itself rather than letting a player find out
+                // by typing it -- a wrong ability is worse than a missing one.
+                const how = p.runnable
+                    ? hint(`  -- "order <sprite> ${p.key} <target>"`)
+                    : `  {yellow-fg}(reference only -- not a move yet){/yellow-fg}`;
+                lines.push(`  ${p.name}${hint(`  (${p.page})`)}${how}`);
                 lines.push(`      ${p.effect}`);
                 // The Test line is the sharpest thing on the panel for a player
                 // deciding between two types -- it says what the power rolls
@@ -95,8 +102,10 @@ export class SpritesCommand extends Command {
         }
         const footer = [
             SPRITE_POWER_TASK_RULE,
-            // Said plainly, not buried: see the class comment.
-            `These powers are CANON REFERENCE -- none is a move you can type yet. What a compiled sprite actually does today is fight ice at your side and take "order".`,
+            // Said plainly, not buried: see the class comment. Eight of the
+            // nine became real moves on 2026-09-15; Stability did not, and the
+            // footer is not allowed to round that up.
+            `Order a power like any other command: "order <sprite> <power> <target>". Stability alone is still reference -- it is listed because canon has it, not because it does anything yet.`,
             detailed ? `"sprites" lists all five.` : `"sprites <type>" for what each power actually does. "compile <type> <level>" calls one up.`,
         ].join(' ');
         const tail = hint(footer);

package/bundle/typescript/src/commands/game/sideQuest/commands/tap.js

@@ -5,6 +5,7 @@ import { accrueOverwatch } from '../utilities/overwatch.js';
 import { MAX_MARKS } from '../utilities/marks.js';
 import { isWatched, cameraMasterHost, directConnectionBlocker } from '../utilities/surveillance.js';
 import { hint } from '../utilities/hints.js';
+import { showsMechanics, mechanicsActorPrefix } from '../utilities/mechanics-audience.js';
 /**
  * TAP -- THE DIRECT CONNECTION (backlog items 9 and 10, Niko, session
  * 2026-08-27T02-07-12-404Z: "check the rules on this -- shouldn't I be
@@ -103,8 +104,8 @@ export class TapCommand extends Command {
         const pool = Math.max(1, actor.logic + actor.skillRating('hacking') + actor.bonus('hacking') + silence + actor.woundModifier - actor.sustainingPenalty);
         actor.performAction('cables into the cameras', `${room.name} -- a hand on the housing, a filament out of their deck`);
         const roll = rollPool(pool, limit);
-        if (this.scene.isHumanControlled(actor)) {
-            this.logger.meta(`Direct connection, camera (${mode === 'attack' ? 'brute force' : 'sleaze'}): ${formatRoll(roll)} (${threshold}+ -- its OWN ratings, not the host's)`);
+        if (showsMechanics(this.scene, actor)) {
+            this.logger.meta(`${mechanicsActorPrefix(this.scene, actor)}Direct connection, camera (${mode === 'attack' ? 'brute force' : 'sleaze'}): ${formatRoll(roll)} (${threshold}+ -- its OWN ratings, not the host's)`);
         }
         this.logger.write(`${actor.name} direct-connected to ${room.name}'s cameras (${mode}): ${roll.hits} vs ${threshold}, master=${host.name}.`);
         // GOD counts it either way (p.231-232) -- the same flat 2 a host

package/bundle/typescript/src/commands/game/sideQuest/engine-version.js

@@ -577,5 +577,169 @@
 //   - BENCH: repro schema 2.6.0 adds npcs[].hostile. A fixture could not
 //     express a hostile PERSON -- only `ice` -- so no meat-side
 //     hostility report could be benched at all.
-export const ENGINE_VERSION = '1.58.0';
+// 1.59.0 (2026-09-15): A HOST'S BUSINESS IS SOMETHING YOU SEARCH FOR.
+//   - THE PURPOSE PHRASE IS ARCHIVE CONTENT (np6YBSPsdfAY7NcuZ). The
+//     generator is told to fill Host.purpose with "what is worth
+//     protecting inside it", so in practice it enumerates the vault --
+//     "patient intake logs, med supply orders, and the doc's private
+//     black book of who paid what for what" -- and four renderers
+//     printed that on a SEALED host's outside icon for free, while the
+//     file names beside it were correctly gated. Two tiers now, both
+//     rolls the engine already made: Room.searchedBy (the threshold-1
+//     public row, or a meat search of the room) reveals the business;
+//     Host.searchedBy (threshold 3, from inside) still names the files.
+//     A cracked host spills both. One gate, grid-names.hostPurposeFor,
+//     read by hostLine, gridIcons, gridSculpt and hostInteriorPanel.
+//     The dock's "N files sealed" counter was ungated too and is now.
+//   - SAVE SHAPE: ISavedRoomOverlay.hostSearchedBy (optional) persists
+//     Host.searchedBy, which was session-only. Survivable while it hid
+//     a file list; not once it gates the purpose, because the search
+//     that opens it spends Matrix minutes and those minutes wind the
+//     Overwatch clock. A reload was charging the player twice.
+//   - A FINISHED FIGHT IS NOT A FIGHT. Matrix Search's Combat Turn
+//     refusal asked `encounterOf(...)` alone, while billAction,
+//     requirePhase and inLiveCombat all pair it with `!enc.ended` -- so
+//     a persona that had already crashed the ice kept being told to
+//     crash the ice. The refusal is correct in a LIVE fight (base time
+//     one minute, p.241, against a three-second Combat Turn) and now
+//     also names the action that does fit: Matrix Perception, which is
+//     `look`.
+//   - Browse's catalogue blurb promised "+2 dice on Matrix Search" and
+//     no code ever granted them; it halves the base TIME (Splintered
+//     State p.54), which is what perception.ts has always done.
+// 1.60.0 (2026-09-15): THE MECHANICS PANEL ASKS WHO IS WATCHING.
+//   - AN ORDERED COMPANION'S DICE WERE ROLLED AND THROWN AWAY
+//     (wjFBY3zgyWzJP9adw). `order <sprite> mark <lock>` runs the real
+//     verb with the sprite as actor and rolls Hack on the Fly exactly as
+//     a decker would -- then ~30 commands dropped the result on the
+//     floor, because the guard around every logger.meta asked
+//     `isHumanControlled(actor)`: is the ROLLER a human. The panel wants
+//     "is a human WATCHING", which combat-exchange has always asked
+//     (playerWitnesses) -- which is why a sprite's COMBAT rolls showed
+//     and its ordered mark did not. New utilities/mechanics-audience.ts:
+//     showsMechanics is true for a human OR a companion a human is
+//     running, and the line names the roller when it is not the player.
+//     Swept across hack, disable, edit-file, hide, jack, overwatch, tap,
+//     look and search -- sprites, spirits, agents and drones alike.
+//     Where a command forked meta-vs-inline on the old predicate, BOTH
+//     halves moved, so nothing prints twice.
+//   - A SPRITE'S TASKS ARE A BARGAIN TOO. order.ts billed services for
+//     spirits only, so an ordered sprite worked free and its ledger line
+//     never printed -- while combat-exchange has always charged both per
+//     fight. Canon is explicit (p.254, p.256): a task per order, and the
+//     refusal when the thread is spent now speaks sprite, not spirit.
+//   - The un-jumped drone recon's Piloting test wrote its dice into the
+//     PROSE line (drone-prose.droneReconLaunchLine took a rollText) --
+//     the one player roll in the engine you had to read out of a
+//     sentence. It goes to the panel; the prose is prose again.
+// 1.61.0 (2026-09-15): ERASE MARK (f79LLqTerep4nKWcA). New verb
+//   "unmark", also reached as "erase mark[s] on <icon>" -- a Complex
+//   Action, Computer + Logic [Attack] v. Willpower + Firewall (p.239),
+//   an ATTACK action so GOD bills the defender's hits. Nothing removed a
+//   mark before this: the only paths were the three canon wipes in
+//   utilities/marks.ts (reboot, jack-out, convergence), and `erase` was
+//   Edit File's delete on a FILE.
+//   - THE THREE-MARK GATE is the book's: you need three marks on the
+//     icon you are scrubbing, not on whoever placed the mark. Two marks
+//     in one action at -4, three at -10, all from the same icon.
+//   - THE OWNER EXEMPTION IS AN ENGINE RULING, labelled as one at the
+//     command. Read strictly, p.239 would make a decker mark themselves
+//     three times before clearing an IC's key off their own persona --
+//     marks nothing in the engine or the book lets you place on
+//     yourself. The gate stops you reaching into someone ELSE's icon;
+//     on your own it is waived and the roll still stands. When you hold
+//     too few marks to reach another icon, the refusal names reboot and
+//     jack out, which do it for free.
+//   - "unmark me" sweeps BOTH ledgers -- a host's key lives in
+//     Host.marksOn, not your PAN ledger -- and clearing a host's last
+//     key un-spots you (Host.spotted): an icon it no longer recognises
+//     is one it has to find again.
+//   - TWO LEDGER BUGS ALONGSIDE. Device.marksBy is the third mark
+//     ledger and no wipe had ever touched it, so a maglock you keyed
+//     last run still answered to a persona canon deleted on reboot
+//     (p.236) -- and `disable` could drive it on marks the sheet no
+//     longer showed. It is cleared by clearMarksPlacedBy now, and
+//     listed by describeMarks/marksPlaced, which had both skipped it.
+// 1.62.0 (2026-09-15): HIRING THE SCRUB. A runner who cannot reach the
+//   Matrix can now pay somebody who can. "ask <contact> about cleanup"
+//   quotes a price (no dice, no legwork budget spent); "hire cleanup
+//   [<site>]" haggles it once on Negotiation, debits the nuyen and
+//   stamps the loose end. The decker's own test rolls at the NEXT
+//   homecoming -- you paid for a result you do not get to watch.
+//   Clean, leverage (done, but they kept a copy) or botched (footage
+//   stays, grace clock keeps running, no refund).
+//   - WHY: a run leaves an ILooseEnd and the hub nagged EVERY runner to
+//     "jack in, then hop" and erase it -- a route that needs a cyberdeck
+//     and a direct neural interface. A street samurai was handed a
+//     consequence with no lever and a +1 Public Awareness on a timer.
+//     The playable cleanup scene is untouched; this is the other door.
+//   - SAVE SHAPE: ILooseEnd.hired (optional, additive -- no
+//     SAVE_VERSION bump). It rides the record that was already
+//     persisted, so a job already paid for survives a reload, and the
+//     fixer's Connection + Loyalty is BANKED at hire time so a loyalty
+//     shift in between cannot retroactively change it.
+//   - New Player.canReachMatrix(), the question commands/jack.ts answers
+//     in three separate refusals, asked once so the hub's advice can be
+//     written for the runner reading it.
+// 1.63.0 (2026-09-15): SPRITE POWERS ARE MOVES. sprite-powers.ts has
+//   been a canon-complete, individually cited catalogue of all nine
+//   since Sz7EmXnyRYK4RYqxt -- and every one was a printed Test line
+//   wired to nothing. Eight of them resolve now
+//   (utilities/sprite-power-actions.ts), keyed off the same five sprite
+//   keys so the panel and the mechanics cannot drift. Ordered like any
+//   other command: "order <sprite> <power> <target>", one TASK per use
+//   (p.254/p.256), billed on success so a refusal is free.
+//     Cookie          Hacking + Resonance [Sleaze] v. Intuition+Firewall
+//     Diagnostics     Hardware + Level [Data Processing], Teamwork
+//     Electron Storm  Cybercombat + Resonance [Attack], sustained
+//     Gremlins        Hardware + Level [Attack] v. Device Rating+Firewall
+//     Camouflage / Hash / Suppression / Watermark -- state, no roll
+//   - NEW CANON DATA: a sprite's four Matrix attributes are PER TYPE
+//     (p.259) and only Resonance equals Level (p.254). The engine had no
+//     table, which is fine while a power is a printed string and not
+//     fine the moment it needs a [Sleaze] number -- a bracket is a LIMIT.
+//     spriteMatrix()/spriteMatrixBoxes() carry it. Fault sprites gain
+//     Cybercombat and machine sprites Hardware, the skills p.259 already
+//     listed on the panel and compile.ts never gave the shell.
+//   - CONSUMERS: Camouflage hides a file from Matrix Search
+//     (commands/search.ts); Hash blocks Edit File; Suppression delays the
+//     host's launch step (utilities/host-combat.ts hostTurnStart);
+//     Electron Storm ends on any Matrix damage to the sprite, enforced on
+//     Player.takeMatrixDamage -- the one method every Matrix hit goes
+//     through. New session state: Item.concealedBy/hashedBy/watermark,
+//     Host.icLaunchDelay, Player.cookiedBy/spriteAssist, NPC.sustainedStorm.
+//   - STABILITY IS DELIBERATELY NOT WIRED, and both the catalogue and the
+//     panel say so per-power (ISpritePower.runnable). It demotes
+//     glitches, and glitches are read at sixteen scattered sites in this
+//     engine; wiring it at three would be a power that works where
+//     somebody happened to look -- the "wrong ability on a sprite is
+//     worse than a missing one" case. It wants the glitch contract in one
+//     place first, and that is its own piece of work.
+// 1.64.0 (2026-09-15): NPC KITS -- "everyone is basically naked."
+//   - NEW CATALOG KIND 'npc-kit' (v21): SR5 p.379-385's Professional
+//     Rating tiers 0-6 as rows, each the book's own statblock AND gear
+//     (npc-kits.ts reads them; catalog.ts npcKitFor). Before this every
+//     NPC was an attribute block: no armor (soak on Body alone), no
+//     weapon (bare fists, always melee).
+//   - SEED SHAPE: ISceneSeedJson.securityTier (the SITE's PR, never the
+//     campaign job number), IPlayerSeedJson.kit / lieutenant. The
+//     generator declares the tier from a closed 0-6 table, clamps it
+//     against the job number, and assigns a kit to every hostile
+//     deterministically -- the model never writes a slug.
+//   - THE PARTY NUDGE IS THE LIEUTENANT (p.380-381): a party that
+//     outguns the tier draws the printed lieutenant, and the group's PR
+//     and Group Edge read one higher. Never a kit from a tier above.
+//   - GROUP EDGE (p.380) on the CombatEncounter keyed by kit; MORALE
+//     (p.379-380) breaks a team to surrender at the book's casualty
+//     thresholds, PR 5-6 never. npc-combat-brain.ts is the gamemaster.
+//   - EPHEMERALS: gangers are the PR 1 kit, sweep officers the PR 3
+//     kit with a real Biometric Reader; bystanders stay unarmed.
+//     Scene.removeActor(name, {spill:false}) so a departing body takes
+//     its gun with it.
+//   - LOOT: worn armor is RUINED on a kill (Item.ruined -- rated 0,
+//     worth nothing, saved); guns and commlinks drop intact.
+//   - PURGED: the dead `firearms` skill key from the NPC prompt, the
+//     ganger constant and the seed doc; a seed still carrying it maps
+//     onto pistols/automatics/longarms at the boundary.
+export const ENGINE_VERSION = '1.64.0';
 //# sourceMappingURL=engine-version.js.map

package/bundle/typescript/src/commands/game/sideQuest/factories/npc-factory.js

@@ -28,6 +28,15 @@ export class NPCFactory {
             npc.setAuthoredAppearance(json.appearance);
         return npc;
     }
+    /**
+     * ONLY FOUR FIELDS CROSS HERE, on purpose. `startSpot`, `guarding`,
+     * `hostile`, `kit` and `lieutenant` are applied by scene-factory AFTER
+     * the NPC is placed (Steps 3 and 4.04), because each depends on
+     * something the constructor cannot see -- the room it stands in, the
+     * items heldBy already put in its hands. Adding one of them to this
+     * config would silently reorder it ahead of that. (`startingItems` is
+     * dropped too, and documented as ignored for NPCs in repro-scene.ts.)
+     */
     convertPlayerSeedToConstructorConfig(seed) {
         if (!seed.name) {
             throw new Error(`Cannot create NPC without a name`);
@@ -40,8 +49,35 @@ export class NPCFactory {
             playerName: seed.name,
             lifestyleChoices: seed.lifestyleChoices,
             startLocation,
-            combat: seed.combat
+            combat: seed.combat ? { ...seed.combat, skills: splitLegacySkills(seed.combat.skills) } : undefined,
         };
     }
 }
+/**
+ * A SEED STILL SPEAKING THE OLD SKILL NAMES (skills.ts, stage 3): the
+ * same group-purchase reading persistence.ts applies to saves -- a
+ * condensed `firearms: N` meant "good with guns, all of them", so it
+ * lands as Pistols, Automatics and Longarms at N (p.88) where none was
+ * set; `athletics: N` lands as Gymnastics, Running and Swimming. The
+ * retired keys are dropped so they cannot ride into `Player.skills` as
+ * dead entries. Mapped, never merely deleted: a "sharpshooter" the
+ * model wrote with the old key was a sharpshooter, not a nobody.
+ */
+export function splitLegacySkills(skills) {
+    if (!skills)
+        return undefined;
+    const out = { ...skills };
+    const spread = (legacy, onto) => {
+        const n = out[legacy];
+        if (n === undefined)
+            return;
+        if (n > 0)
+            for (const key of onto)
+                out[key] ??= n;
+        delete out[legacy];
+    };
+    spread('firearms', ['pistols', 'automatics', 'longarms']);
+    spread('athletics', ['gymnastics', 'running', 'swimming']);
+    return out;
+}
 //# sourceMappingURL=npc-factory.js.map

package/bundle/typescript/src/commands/game/sideQuest/factories/scene-chunks.js

@@ -4,6 +4,7 @@ import { Logger } from '../utilities/logger.js';
 import { catalogAugmentations } from '../utilities/catalog.js';
 import { isOutdoorsPlace } from '../utilities/outdoors.js';
 import { clampDeviceKind } from '../utilities/affordances.js';
+import { clampSecurityTier, expectedStrengthFor, kitSlugForTier, maxSecurityTierFor, partyDrawsLieutenant } from '../npc-kits.js';
 /**
  * CHUNKED scene generation (see SceneSeedGenerator.generate for the
  * pipeline that drives this module). One monolithic whole-scene completion
@@ -195,6 +196,73 @@ function repairNote(previousError) {
 export function partyHeadcount(crew) {
     return (crew?.length ?? 0) + 1;
 }
+/**
+ * HOW HARD THIS TABLE HITS, per head, on the scale npc-kits.ts
+ * expectedStrengthFor uses for a grunt (attack pool + defense pool).
+ *
+ * REUSES THE NUMBERS THAT ALREADY EXIST rather than inventing a third
+ * formula: the leader's figure is exactly the "Combat calibration"
+ * line buildPlayerDossier prints (getAttackPool + getDefensePool), and
+ * a crew member's is the body + agility + logic + magic sum the hiring
+ * price already reads (Game.spawnCrew's asking cut), scaled onto the
+ * same axis. Averaged per head, because the lieutenant question is
+ * "does this party outclass the tier", not "how many of them are there"
+ * -- head count already scales the OPPOSITION COUNT (Scope, above).
+ *
+ * A dossier player that is not a real Player (the tests' stubs, a
+ * server-side draft with no engine handle) contributes nothing and the
+ * crew alone decides; no player and no crew is 0, which never draws a
+ * lieutenant.
+ */
+export function partyStrength(player, crew) {
+    const heads = [];
+    const p = player;
+    if (p && typeof p.getAttackPool === 'function' && typeof p.getDefensePool === 'function') {
+        heads.push(p.getAttackPool() + p.getDefensePool());
+    }
+    for (const m of crew ?? []) {
+        const c = m.combat;
+        heads.push(1.5 * ((c.body ?? 3) + (c.agility ?? 3) + (c.logic ?? 3) + (c.magic ?? 0)));
+    }
+    if (heads.length === 0)
+        return 0;
+    return heads.reduce((s, h) => s + h, 0) / heads.length;
+}
+/**
+ * SETTLE WHO GUARDS THIS PLACE (npc-kits.ts, SR5 p.379-385). Called once
+ * per accepted skeleton, after validateSkeleton and before the detail
+ * passes: clamps the declared securityTier against the campaign job
+ * number (a job #1 does not draw elite corporate security however the
+ * model felt about it), and decides whether the site posts its
+ * lieutenant -- p.380-381's own mechanism for a tougher group, and the
+ * whole of how opposition scales to a strong party. The lieutenant is
+ * the hostile guarding the prize's room if there is one, else the first
+ * hostile. Returns the notes for the generation log.
+ */
+export function settleSecurity(skeleton, campaignTier, player, crew) {
+    const notes = [];
+    const declared = skeleton.securityTier;
+    const settled = clampSecurityTier(declared, campaignTier);
+    if (declared !== settled) {
+        notes.push(`securityTier ${declared === undefined ? 'absent' : JSON.stringify(declared)} -> ${settled} (job #${campaignTier} fields at most PR ${maxSecurityTierFor(campaignTier)}).`);
+    }
+    skeleton.securityTier = settled;
+    const hostiles = skeleton.npcs.filter(n => n.name !== skeleton.client && n.hostile === true);
+    if (hostiles.length === 0) {
+        delete skeleton.lieutenant;
+        return notes;
+    }
+    const strength = partyStrength(player, crew);
+    if (!partyDrawsLieutenant(strength, settled)) {
+        delete skeleton.lieutenant;
+        return notes;
+    }
+    const prizeRoom = skeleton.items.find(i => i.name === skeleton.winCondition?.item)?.room;
+    const pick = hostiles.find(n => prizeRoom !== undefined && n.startLocation === prizeRoom) ?? hostiles[0];
+    skeleton.lieutenant = pick.name;
+    notes.push(`party strength ${strength.toFixed(1)} outguns PR ${settled} (expects ~${expectedStrengthFor(settled)}) -- ${pick.name} is the lieutenant.`);
+    return notes;
+}
 function buildTeamBlock(crew) {
     if (!crew || crew.length === 0)
         return '';
@@ -478,7 +546,19 @@ ${JSON_ONLY}
                        // again more per job after that
     "rewardItem"?: string // optional bonus: an items[].name with role "reward"
   },
-  "client": string // the npcs[].name of the run's CLIENT -- see CLIENT below
+  "client": string, // the npcs[].name of the run's CLIENT -- see CLIENT below
+  "securityTier": 0|1|2|3|4|5|6 // WHO GUARDS THIS PLACE. Pick from the SITE, not the payout,
+                                // and use EXACTLY one of these integers:
+                                //   0 street thugs, squatters, a mall cop
+                                //   1 a gang's block, street scum holding a corner
+                                //   2 corporate security at an ordinary office or warehouse
+                                //   3 a police patrol, a licensed private force
+                                //   4 an organized-crime crew on its own ground
+                                //   5 elite corporate security -- a real corp facility
+                                //   6 elite special forces -- military; needs a real reason
+                                // Every "hostile" npc is armed and armored by the engine
+                                // from this tier's statblock; you write WHO they are, the
+                                // engine writes WHAT they carry.
 }
 
 CLIENT: every run has a CLIENT -- "a Mr. Johnson", the employer's deniable face, the person
@@ -646,17 +726,22 @@ For EVERY npc in the skeleton, expand its "concept":
   will refuse it and the player will burn a run trusting it. An NPC may say that a code
   EXISTS, who holds it, or where it's written down -- never what it is. The engine hands
   the real pass to whoever genuinely holds it, at runtime (see npc.ts).
-- "combat": OPTIONAL attribute block -- omit for anyone who'd never fight. Each attribute
-  1-8 (soft civilian 1-2, street-level 3-4, hardened enforcer 5-6, elite 7-8):
+- "combat": OPTIONAL attribute block -- omit for anyone who'd never fight, and OMIT IT FOR
+  EVERY HOSTILE: the engine outfits opposition from the site's security tier (the book's
+  own Professional Rating statblocks, gear included), and a "combat" block on a hostile is
+  ignored. Write one only for a NON-hostile who might still end up in a fight (a bodyguard
+  who is not security, a bartender with a shotgun). Each attribute 1-8 (soft civilian 1-2,
+  street-level 3-4, hardened enforcer 5-6, elite 7-8):
   { "body", "agility", "reaction", "combatSkill", "strength"?, "willpower"?, "logic"?,
     "intuition"?, "charisma"?, "magic"?, "resonance"?, "adept"?,
-    "skills"?: { "firearms"?, "blades"?, "clubs"?, "unarmed"?, "sneaking"?, "perception"?, "palming"?,
-                 "hacking"?, "cybercombat"?, "electronic-warfare"?, "hardware"?, "locksmith"?, "computer"?,
-                 "negotiation"?, "con"?, "intimidation"?, "etiquette"?, "leadership"?, "performance"?, "disguise"?,
-                 "medicine"?, "assensing"?, "counterspelling"?, "conjuring"?, "gunnery"? } }
-  "magic" 3-6 ONLY for a genuinely Awakened concept; give combat blocks to anyone the story
-  expects in a firefight. "skills" is
-  optional flavor for defined concepts (a sharpshooter's "firearms": 6).
+    "skills"?: { "pistols"?, "automatics"?, "longarms"?, "blades"?, "clubs"?, "unarmed"?, "sneaking"?,
+                 "perception"?, "palming"?, "hacking"?, "cybercombat"?, "electronic-warfare"?, "hardware"?,
+                 "locksmith"?, "computer"?, "negotiation"?, "con"?, "intimidation"?, "etiquette"?,
+                 "leadership"?, "performance"?, "disguise"?, "medicine"?, "assensing"?, "counterspelling"?,
+                 "conjuring"?, "gunnery"? } }
+  "magic" 3-6 ONLY for a genuinely Awakened concept. "skills" is optional flavor for defined
+  concepts (a sharpshooter's "longarms": 6). There is no generic gun skill: guns are "pistols",
+  "automatics" (SMGs, machine pistols, assault rifles) or "longarms" (rifles, shotguns).
 
 ${JSON_ONLY}
 [ { "name": string, "description": string, "dialogue": string[], "combat"?: { ... } } ]
@@ -2605,9 +2690,11 @@ export function assembleScene(skeleton, details, playerName) {
     // from the exit they hold, so moving one would leave `guarding: true`
     // with nothing behind it. See factories/npc-spread.ts.
     const spreadStations = spreadStationedNpcs(npcStation, new Map(rooms.map(r => [r.name, (r.spots ?? []).map(s => s.name)])), name => guardPost.has(name));
+    const tierKit = skeleton.securityTier === undefined ? undefined : kitSlugForTier(skeleton.securityTier);
     const npcs = skeleton.npcs.map(npc => {
         const detail = npcDetail.get(npc.name);
         const station = spreadStations.get(npc.name);
+        const kit = npc.hostile === true && npc.name !== skeleton.client ? tierKit : undefined;
         const roomSpots = (rooms.find(r => r.name === npc.startLocation)?.spots ?? []);
         const startSpot = station && station.room === npc.startLocation && roomSpots.some(s => s.name === station.spot)
             ? station.spot
@@ -2630,8 +2717,18 @@ export function assembleScene(skeleton, details, playerName) {
                 // other would put the flag on every checkpoint clerk in the
                 // game, which is the failure this feature is built to avoid.
                 hostile: npc.hostile === true || undefined,
+                // WHAT THEY CARRY (npc-kits.ts, catalog v21): every hostile is
+                // outfitted from the site's security tier, deterministically --
+                // the model never writes a kit slug, because a slug it invented
+                // is a whole failure class (itemFromCatalog throws on one) and
+                // the tier is the one number it was asked for. THE KIT IS THE
+                // STATLINE: a `combat` block the model wrote for a guard is
+                // dropped here, not merged, so a dead key cannot ride in beside
+                // the book's numbers. Non-hostiles keep theirs.
+                ...(kit ? { kit } : {}),
+                ...(kit && skeleton.lieutenant === npc.name ? { lieutenant: true } : {}),
                 lifestyleChoices: [],
-                combat: detail?.combat,
+                combat: kit ? undefined : detail?.combat,
             },
         };
     });
@@ -2772,6 +2869,7 @@ export function assembleScene(skeleton, details, playerName) {
             completionMessage: skeleton.completionMessage,
         },
         client: skeleton.client,
+        ...(skeleton.securityTier !== undefined ? { securityTier: skeleton.securityTier } : {}),
     };
 }
 /**