@slatesvideo/shared 0.6.2 → 0.6.4

package/dist/api-url.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The production API host. The one literal in the portfolio; every client
+ * imports it (the MCP cloud client, the CLI login, and the desktop once its
+ * `@slatesvideo/shared` dependency is bumped to a version carrying it).
+ * Kept in its own module so `clients/cloud.ts` can import it without a cycle
+ * through the barrel.
+ */
+export declare const SLATES_API_URL = "https://slates-api.fly.dev";
+//# sourceMappingURL=api-url.d.ts.map

package/dist/api-url.js

@@ -0,0 +1,9 @@
+/**
+ * The production API host. The one literal in the portfolio; every client
+ * imports it (the MCP cloud client, the CLI login, and the desktop once its
+ * `@slatesvideo/shared` dependency is bumped to a version carrying it).
+ * Kept in its own module so `clients/cloud.ts` can import it without a cycle
+ * through the barrel.
+ */
+export const SLATES_API_URL = 'https://slates-api.fly.dev';
+//# sourceMappingURL=api-url.js.map

package/dist/auth.d.ts

@@ -9,12 +9,24 @@ export interface AgentConnectionFile {
         port: number | null;
         token: string | null;
     };
+    /**
+     * The project `slates use` selected, filled into any op that takes
+     * `projectId` and was called without one.
+     *
+     * 🚨 CLI-OWNED, AND ONLY A DEFAULT. The desktop app owns the `desktop` half
+     * of this file and must never write here; an explicit `--projectId` always
+     * wins. It exists because every workspace op takes a UUID and an agent had to
+     * carry that UUID through the whole session by hand — which is exactly the
+     * kind of state a shell session is bad at holding.
+     */
+    defaultProjectId?: string | null;
 }
 export declare function readConnection(): AgentConnectionFile;
+export declare function setDefaultProjectId(projectId: string | null): void;
+export declare function readDefaultProjectId(): string | null;
 export declare function writeConnection(data: AgentConnectionFile): void;
 export declare function setCloudToken(token: string | null): void;
 export declare function clearCloudToken(): void;
-export declare function deleteConnection(): void;
 export declare class MissingCloudTokenError extends Error {
     code: string;
     constructor();

package/dist/auth.js

@@ -1,6 +1,6 @@
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, } from 'node:fs';
 // Reads/writes ~/.slates/agent-connection.json — the single file the
 // Slates desktop app produces and the MCP/CLI consume.
 //
@@ -14,6 +14,7 @@ export const CONNECTION_FILE = join(AGENT_DIR, 'agent-connection.json');
 const EMPTY = {
     cloud: { token: null },
     desktop: { enabled: false, port: null, token: null },
+    defaultProjectId: null,
 };
 export function readConnection() {
     if (!existsSync(CONNECTION_FILE))
@@ -27,12 +28,19 @@ export function readConnection() {
                 port: parsed.desktop?.port ?? null,
                 token: parsed.desktop?.token ?? null,
             },
+            defaultProjectId: parsed.defaultProjectId ?? null,
         };
     }
     catch {
         return { ...EMPTY, cloud: { ...EMPTY.cloud }, desktop: { ...EMPTY.desktop } };
     }
 }
+export function setDefaultProjectId(projectId) {
+    writeConnection({ ...readConnection(), defaultProjectId: projectId });
+}
+export function readDefaultProjectId() {
+    return readConnection().defaultProjectId ?? null;
+}
 export function writeConnection(data) {
     if (!existsSync(AGENT_DIR))
         mkdirSync(AGENT_DIR, { recursive: true });
@@ -48,10 +56,6 @@ export function setCloudToken(token) {
 export function clearCloudToken() {
     setCloudToken(null);
 }
-export function deleteConnection() {
-    if (existsSync(CONNECTION_FILE))
-        unlinkSync(CONNECTION_FILE);
-}
 export class MissingCloudTokenError extends Error {
     code = 'CLOUD_TOKEN_MISSING';
     constructor() {

package/dist/clients/cloud.d.ts

@@ -5,6 +5,9 @@ export declare class SlatesCloudClient {
     constructor(token?: string, baseUrl?: string);
     get<T>(path: string): Promise<T>;
     post<T>(path: string, body: unknown): Promise<T>;
+    /** Name the op's own path in the failure — "fetch failed" tells nobody which
+     *  call died, and a timeout must not read as a network outage. */
+    private fetchOrFriendly;
     private handle;
 }
 export interface SlatesUserInfo {

package/dist/clients/cloud.js

@@ -1,5 +1,6 @@
 import { requireCloudToken } from '../auth.js';
-const FALLBACK_CLOUD_BASE_URL = 'https://slates-api.fly.dev';
+import { SLATES_API_URL } from '../api-url.js';
+const FALLBACK_CLOUD_BASE_URL = SLATES_API_URL;
 // The slates_sk_ bearer is attached to every cloud request. SLATES_CLOUD_BASE_URL
 // may override the host for dev/staging, but ONLY over https (or http to
 // localhost) — otherwise the token could be exfiltrated to an arbitrary host
@@ -27,6 +28,18 @@ export const DEFAULT_CLOUD_BASE_URL = resolveCloudBaseUrl();
 // Thin client for slates-api. Used for credit-aware ops that route through
 // the user's account (generation proxy, credits balance, model registry,
 // license checks). The desktop client below is the local equivalent.
+/**
+ * 🚨 CLOUD REQUESTS HAD NO TIMEOUT AT ALL. A hung read hung the CLI forever and
+ * hung a Studio Agent tool call with it — no error, no retry, no way for the
+ * loop to notice. `fetch` has no default deadline; the desktop client at least
+ * inherited undici's 300s headers timeout.
+ *
+ * Two values, because two different things are being waited for: a registry or
+ * balance read that takes 30s is broken, while a generation SUBMIT legitimately
+ * waits on a provider queue.
+ */
+const CLOUD_READ_TIMEOUT_MS = 30_000;
+const CLOUD_SUBMIT_TIMEOUT_MS = 120_000;
 export class SlatesCloudClient {
     token;
     baseUrl;
@@ -35,22 +48,40 @@ export class SlatesCloudClient {
         this.baseUrl = baseUrl;
     }
     async get(path) {
-        const res = await fetch(`${this.baseUrl}${path}`, {
+        const res = await this.fetchOrFriendly(path, `${this.baseUrl}${path}`, {
             headers: { Authorization: `Bearer ${this.token}` },
+            signal: AbortSignal.timeout(CLOUD_READ_TIMEOUT_MS),
         });
         return this.handle(path, res);
     }
     async post(path, body) {
-        const res = await fetch(`${this.baseUrl}${path}`, {
+        const res = await this.fetchOrFriendly(path, `${this.baseUrl}${path}`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
                 Authorization: `Bearer ${this.token}`,
             },
             body: JSON.stringify(body),
+            signal: AbortSignal.timeout(CLOUD_SUBMIT_TIMEOUT_MS),
         });
         return this.handle(path, res);
     }
+    /** Name the op's own path in the failure — "fetch failed" tells nobody which
+     *  call died, and a timeout must not read as a network outage. */
+    async fetchOrFriendly(path, url, init) {
+        try {
+            return await fetch(url, init);
+        }
+        catch (err) {
+            const name = err?.name;
+            if (name === 'TimeoutError' || name === 'AbortError') {
+                throw new Error(`slates-api ${path} timed out. The request may still have been received — ` +
+                    `check before retrying anything that spends credits.`);
+            }
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`slates-api ${path} could not be reached: ${message}`, { cause: err });
+        }
+    }
     async handle(path, res) {
         const text = await res.text();
         let parsed = null;

package/dist/clients/desktop.js

@@ -137,6 +137,9 @@ export class SlatesDesktopClient {
                 // keep the full url
             }
             const message = err instanceof Error ? err.message : String(err);
+            // The ROUTE is in the message. "slates-desktop request failed" told the
+            // caller nothing about which of thirty-odd routes died, and a blocking
+            // render and a project list fail very differently.
             throw new Error(`slates-desktop request to ${path} failed: ${message}`, { cause: err });
         }
     }

package/dist/index.d.ts

@@ -3,8 +3,14 @@ export { SlatesCloudClient, type SlatesUserInfo, type CreditsBalance, type Model
 export { SlatesDesktopClient, type DesktopHealth } from './clients/desktop.js';
 export { SKILLS } from './skills/content.js';
 export * as operations from './operations/index.js';
-export { ALL_OPERATIONS, VIDEO_MODELS, AUDIO_MODELS, defaultContext, type Operation, type OperationContext, type OperationResult } from './operations/index.js';
-export { MODEL_FACTS, getModelFact, multimodalRefSummary, multimodalRefModels, SEEDANCE_TASK_INTENT_WORDS, seedanceTaskIntentWords, type ModelFact, } from './prompts/model-facts.js';
+export { ALL_OPERATIONS, VIDEO_MODELS, AUDIO_MODELS, IMAGE_MODELS, defaultContext, OperationCancelledError, type Operation, type OperationContext, type OperationResult, type OperationAnnotations, type OperationTier, type OperationGroup } from './operations/index.js';
+export { CONFIRM_CREDITS, DEVIATION_FACTOR } from './operations/index.js';
+export { toolDefinitions, toolDefinition, groupFor, tierFor, OPERATION_GROUPS, GROUP_SUMMARY, type ToolDefinition, } from './operations/index.js';
+export { MODEL_FACTS, getModelFact, multimodalRefSummary, multimodalRefModels, describeRouting, SEEDANCE_TASK_INTENT_WORDS, seedanceTaskIntentWords, type ModelFact, } from './prompts/model-facts.js';
 export { MODEL_CAPABILITIES, ALL_ASPECT_RATIOS, AGENT_ROUTE_PROVIDER, getModelCapability, aspectRatiosFor, videoResolutionsFor, defaultVideoResolutionFor, durationsFor, durationValuesFor, aspectRatioUnion, videoResolutionUnion, durationBounds, checkAspectRatio, checkVideoResolution, checkDuration, describeAspectRatios, describeVideoResolutions, describeDurations, describeReferenceImageCaps, type AspectRatio, type VideoResolution, type ModelCapability, type DurationCapability, type VideoResolutionCapability, } from './prompts/model-capabilities.js';
+export { buildAgentDoctrine, type AgentSurface } from './prompts/agent-doctrine.js';
+export { BANNED_PROMPT_TOKENS, describeBannedTokens, findBannedTokens, bannedTokenWarning, bannedTokensForSkill, describeBannedTokensForSkill, type BannedToken, type BannedTokenScope, } from './prompts/banned-tokens.js';
+export { CRAFT_CARDS, CRAFT_CARD_CEILING, craftCard, describeCraftCard } from './prompts/craft-cards.js';
 export { PROMPTING_TIPS, getPromptingTips, type PromptingTipsEntry, type PromptingTipCard, type PromptingTipsKey } from './prompts/prompting-tips.js';
+export { SLATES_API_URL } from './api-url.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -3,11 +3,23 @@ export { SlatesCloudClient } from './clients/cloud.js';
 export { SlatesDesktopClient } from './clients/desktop.js';
 export { SKILLS } from './skills/content.js';
 export * as operations from './operations/index.js';
-export { ALL_OPERATIONS, VIDEO_MODELS, AUDIO_MODELS, defaultContext } from './operations/index.js';
+export { ALL_OPERATIONS, VIDEO_MODELS, AUDIO_MODELS, IMAGE_MODELS, defaultContext, OperationCancelledError } from './operations/index.js';
+// The spend thresholds the DESKTOP and the SKILLS both quote. `CONFIRM_CREDITS`
+// is the op-level confirm gate; `DEVIATION_FACTOR` is the Studio Agent's
+// re-ask multiplier, which lived only in `loop.ts` while `slates-cost-discipline`
+// told the agent a different number. One home, both readers.
+export { CONFIRM_CREDITS, DEVIATION_FACTOR } from './operations/index.js';
+// 🚨 THE ONE SCHEMA RENDERER + the tier/annotation tables. The desktop rendered
+// `$refStrategy:'none'` and the MCP server rendered `openApi3`, so surface
+// parity was proven of the ID SET and unproven of the BYTES. Both call this now.
+export { toolDefinitions, toolDefinition, groupFor, tierFor, OPERATION_GROUPS, GROUP_SUMMARY, } from './operations/index.js';
 // Model routing/prompting facts — the SSOT the desktop Studio Agent system
 // prompt derives its MODEL ROUTING doctrine from (kind: image | video | audio,
 // default/premium/niche notes). Edit model-facts.ts, never prose copies.
 export { MODEL_FACTS, getModelFact, multimodalRefSummary, multimodalRefModels, 
+// THE routing renderer — the system prompt, the MCP instructions and the
+// generate ops all call this one function, so routing prose exists once.
+describeRouting, 
 // Mirrored in slate/src/shared/pricing.ts — see the constant's own header for
 // why the mirror exists and why it must never drive a prompt rewrite.
 SEEDANCE_TASK_INTENT_WORDS, seedanceTaskIntentWords, } from './prompts/model-facts.js';
@@ -17,7 +29,38 @@ SEEDANCE_TASK_INTENT_WORDS, seedanceTaskIntentWords, } from './prompts/model-fac
 // the op surface validates against them and GENERATES its `.describe()` prose
 // from them. Never hand-type a capability fact an LLM will read.
 export { MODEL_CAPABILITIES, ALL_ASPECT_RATIOS, AGENT_ROUTE_PROVIDER, getModelCapability, aspectRatiosFor, videoResolutionsFor, defaultVideoResolutionFor, durationsFor, durationValuesFor, aspectRatioUnion, videoResolutionUnion, durationBounds, checkAspectRatio, checkVideoResolution, checkDuration, describeAspectRatios, describeVideoResolutions, describeDurations, describeReferenceImageCaps, } from './prompts/model-capabilities.js';
+// 🚨 AGENT GUIDANCE SSOT — the working method, the hard rules and the guide
+// index, as ONE string both surfaces consume: the desktop Studio Agent's whole
+// system prompt (slate/src/main/studio-agent/context.ts) and the MCP server's
+// `instructions`. Neither may author doctrine prose of its own; the guidance
+// layer drifted for exactly as long as it had no single home.
+//
+// Exported from the ROOT barrel only, never from ./prompts — that subpath is
+// bundled by the desktop RENDERER and must stay small and Node-free, and this
+// module pulls in the whole embedded SKILLS record.
+// Only what a CONSUMER calls. `buildSkillIndex`, `WORKING_METHOD` and
+// `HARD_RULES` are used inside agent-doctrine.ts and by nothing else, so they
+// stay off the public surface — an export nothing calls is an export nothing
+// keeps honest, which is why `buildModelRouting` was deleted rather than left
+// here "in case".
+export { buildAgentDoctrine } from './prompts/agent-doctrine.js';
+// Banned prompt tokens — EXTRACTED from the skills' own never-use lists and
+// inlined into the generate ops' descriptions. Enforcement of "load the guide"
+// that the model cannot skip, because a description is always in context.
+export { 
+// BANNED_PROMPT_TOKENS + describeBannedTokens: the lockstep checker and the
+// ops. findBannedTokens: the eval harness scorer. bannedTokenWarning: the ops.
+// `bannedTokensFor` is internal to the module and stays there.
+BANNED_PROMPT_TOKENS, describeBannedTokens, findBannedTokens, bannedTokenWarning, 
+// Per-model lists — the 13 skills the two cross-model lists never covered.
+bannedTokensForSkill, describeBannedTokensForSkill, } from './prompts/banned-tokens.js';
+// 🚨 CRAFT CARDS — the POSITIVE half of the guide, extracted from the skills'
+// own `@card` blocks and delivered on the estimate result. The eval scorer reads
+// CRAFT_CARDS to build its lever vocabulary, so the assertion can never be
+// scored against a hand-retyped word list.
+export { CRAFT_CARDS, CRAFT_CARD_CEILING, craftCard, describeCraftCard } from './prompts/craft-cards.js';
 // Per-model prompting tips — the SSOT for the desktop "See prompting tips"
 // modals. The desktop renders these; it never hand-writes tips content.
 export { PROMPTING_TIPS, getPromptingTips } from './prompts/prompting-tips.js';
+export { SLATES_API_URL } from './api-url.js';
 //# sourceMappingURL=index.js.map

package/dist/operations/index.d.ts

@@ -2,11 +2,30 @@ import { z } from 'zod';
 import { SlatesCloudClient } from '../clients/cloud.js';
 import { SlatesDesktopClient } from '../clients/desktop.js';
 import { type AspectRatio, type VideoResolution } from '../prompts/model-capabilities.js';
+import { type OrderedAttachmentRole } from '../prompts/shot-spec.js';
 export interface OperationContext {
     cloud: () => SlatesCloudClient;
     desktop: () => SlatesDesktopClient;
+    /**
+     * Cancellation, propagated from the caller.
+     *
+     * 🚨 THIS IS WHAT MAKES "STOP" MEAN STOP. Escape in the desktop Studio Agent
+     * aborted the brain stream and marked the *remaining* tool calls cancelled,
+     * but the op already running got no signal at all — so a sequential batch
+     * (`slates_generate_from_shots`, the largest spender on the surface) kept
+     * firing generations after the user had cancelled. Ops that loop over items,
+     * or block on a long provider call, check it; everything else may ignore it.
+     *
+     * Optional so an older caller that does not pass one still type-checks.
+     */
+    signal?: AbortSignal;
 }
 export declare function defaultContext(): OperationContext;
+/** Thrown by an op that noticed `ctx.signal` had aborted mid-work. */
+export declare class OperationCancelledError extends Error {
+    code: string;
+    constructor(detail?: string);
+}
 export interface OperationResult {
     text: string;
     images?: Array<{
@@ -20,16 +39,121 @@ export interface Operation<I> {
     description: string;
     input: z.ZodType<I>;
     run: (input: I, ctx: OperationContext) => Promise<OperationResult>;
+    /**
+     * This op causes a provider call the user pays for.
+     *
+     * 🚨 IT IS THE DESKTOP'S CONSENT GATE, DECLARED WHERE THE OP IS WRITTEN.
+     * `slate/src/main/studio-agent/loop.ts` refuses a billable name until
+     * `present_plan` has been approved, and refreshes the balance-derived spend
+     * after each one so the deviation pause can fire. That list used to live only
+     * in the desktop, one repo away from the op it gated — and both
+     * `slates_generate_audio` and `slates_generate_from_shots` shipped without an
+     * entry, so the in-app agent could spend on either with no approved plan and
+     * no ledger entry. Set it HERE, beside the description, and the desktop takes
+     * the union of this and its own list (union, so an older published package can
+     * only ever gate MORE, never less).
+     *
+     * Set it on anything that spends INDIRECTLY too —
+     * `slates_generate_from_shots` fires N generations of its own.
+     *
+     * NOT part of the tool schema: it never reaches the model, so it costs no
+     * prefix bytes.
+     */
+    billable?: boolean;
+    /**
+     * MCP tool annotations (spec 2025-06-18), emitted in ListTools.
+     *
+     * 🚨 THIS IS WHAT LETS A HOST TELL A READ FROM A DELETE. Without them a
+     * Claude Desktop or Cursor user is prompted for `slates_list_assets` exactly
+     * the way they are prompted for `slates_delete_project`, and the destructive
+     * ops get no extra warning — so every prompt looks the same and the user
+     * learns to click through all of them.
+     *
+     * Never hand-set: `annotate()` derives all four from the op id below, and
+     * `scripts/agent-surface-lockstep-check.mjs` re-derives them INDEPENDENTLY
+     * from the op's own transport verbs. A `readOnlyHint` on an op whose `run`
+     * body posts is a lie that lets a host auto-approve a mutation, so the check
+     * has to be able to catch it.
+     */
+    annotations?: OperationAnnotations;
+    /**
+     * Which tier of the desktop tool surface this op belongs to.
+     *
+     * `core` is sent on every Studio Agent turn; `extended` is deferred behind
+     * `slates_load_tools` and appended to the tool list for the rest of the run
+     * once a group loads. The MCP server registers everything as before — hosts
+     * there do their own deferral (Claude Code defers stdio tool schemas through
+     * its tool search) and a stdio server has no run to append to.
+     *
+     * Defaults to `core` when absent, so a new op is visible until someone
+     * deliberately defers it.
+     */
+    tier?: OperationTier;
+    /** The `slates_load_tools` group this op arrives in. Required on `extended`. */
+    group?: OperationGroup;
+}
+/** MCP tool annotations. All four are declared on every op — a missing hint is
+ *  indistinguishable from `false` to a host, which is the wrong default for
+ *  `destructiveHint`. */
+export interface OperationAnnotations {
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+    idempotentHint: boolean;
+    openWorldHint: boolean;
 }
+export type OperationTier = 'core' | 'extended';
+export type OperationGroup = 'library' | 'timeline' | 'admin' | 'blender';
+export declare const CONFIRM_CREDITS = 17;
+/**
+ * The desktop deviation guard's ceiling multiplier: the Studio Agent pauses and
+ * re-asks when projected generation spend exceeds the approved ledger by more
+ * than this factor.
+ *
+ * 🚨 EXPORTED BECAUSE THE NUMBER IS QUOTED DOWNSTREAM. `slates-cost-discipline`
+ * told the agent the threshold was 25% while `loop.ts` paused at 20% — a skill
+ * contradicting the code on the one number that decides whether a run stops.
+ * The skill now renders it from here through `_partials/thresholds.md`; the
+ * desktop loop imports it instead of declaring its own.
+ */
+export declare const DEVIATION_FACTOR = 1.2;
+/**
+ * Per-surface bounds and defaults.
+ *
+ * 🚨 THESE FOUR NUMBERS PER SURFACE LIVE IN THREE REPOS. A change is a
+ * three-site edit, every time:
+ *   1. HERE (`audioCostKey`, the agent's pre-flight quote)
+ *   2. `slate/src/shared/pricing.ts` → MODEL_REGISTRY `audio.durationSeconds`
+ *      (min/max/default), read by `clampAudioDuration` + `audioCreditKey`
+ *   3. `slates-api/src/lib/audio-keys.ts` → the server's fail-closed bounds
+ * `slates-api/scripts/pricing-consistency-check.mjs` §4 asserts 1 and 2 agree
+ * at EVERY value including out-of-range ones; the gate check covers 3.
+ *
+ * The MINs used to be missing here, and the clamp floor was a hardcoded 1. That
+ * made `slates_estimate_generation_cost({model:'seed-audio', duration:2})`
+ * quote a real `seed-audio-2s` price for a generation the desktop would bill as
+ * 3s and the proxy would REJECT outright. Same for an omitted duration, which
+ * quoted `seed-audio-1s` against the desktop's `seed-audio-15s`.
+ */
+export declare const SEED_AUDIO_MIN_SECONDS = 3;
+export declare const SEED_AUDIO_MAX_SECONDS = 120;
+export declare const SEED_AUDIO_DEFAULT_SECONDS = 15;
+export declare const ELEVEN_SFX_MIN_SECONDS = 1;
+export declare const ELEVEN_SFX_MAX_SECONDS = 22;
+export declare const ELEVEN_SFX_DEFAULT_SECONDS = 4;
+export declare const TTS_MODEL: "inworld-tts-2";
+export declare const TTS_BUCKET_CHARS = 250;
+export declare const TTS_MAX_CHARACTERS: number;
+export declare const TTS_BUCKET_COUNT: number;
 export declare const getWorkspaceState: Operation<{
     projectId?: string;
+    limit?: number;
 }>;
 export declare const getMe: Operation<Record<string, never>>;
 export declare const getCreditBalance: Operation<Record<string, never>>;
 export declare const listAvailableModels: Operation<{
     filter?: string;
 }>;
-export declare const VIDEO_MODELS: readonly ["kling-v3.0-std", "kling-v3.0-pro", "kling-v3.0-omni", "veo-3.1-fast", "veo-3.1-standard", "seedance-2", "seedance-2.5", "omni-flash", "minimax-h3", "minimax-h3-max"];
+export declare const VIDEO_MODELS: readonly ["kling-v3.0-std", "kling-v3.0-pro", "kling-v3.0-omni", "veo-3.1-fast", "veo-3.1-standard", "seedance-2", "seedance-2.5", "omni-flash", "minimax-h3", "minimax-h3-max", "ltx-2-5", "ltx-2-5-pro"];
 type VideoModel = (typeof VIDEO_MODELS)[number];
 /** The exact `model` ids `slates_edit_video` accepts. Edit rows are deliberately
  *  NOT in VIDEO_MODELS — they take a source clip, not frames. */
@@ -39,6 +163,9 @@ export declare const estimateGenerationCost: Operation<{
     model: string;
     quantity?: number;
     duration?: number;
+    /** inworld-tts-2 only — the character count of the text, which is what it
+     *  bills on. That surface has no duration dimension at all. */
+    characters?: number;
     /** The FULL union — the runtime Zod enum is generated from MODEL_CAPABILITIES
      *  and `assertVideoCapabilities` is the per-model narrowing authority. */
     videoResolution?: VideoResolution;
@@ -227,36 +354,14 @@ export declare function seedanceEditCostKey(input: {
     seedanceFace?: boolean;
     seedanceRealFace?: boolean;
 }): string;
-export declare const AUDIO_MODELS: readonly ["seed-audio", "eleven-sfx"];
+export declare const AUDIO_MODELS: readonly ["seed-audio", "eleven-sfx", "inworld-tts-2"];
 export type AudioModel = (typeof AUDIO_MODELS)[number];
-/**
- * Per-surface bounds and defaults.
- *
- * 🚨 THESE FOUR NUMBERS PER SURFACE LIVE IN THREE REPOS. A change is a
- * three-site edit, every time:
- *   1. HERE (`audioCostKey`, the agent's pre-flight quote)
- *   2. `slate/src/shared/pricing.ts` → MODEL_REGISTRY `audio.durationSeconds`
- *      (min/max/default), read by `clampAudioDuration` + `audioCreditKey`
- *   3. `slates-api/src/lib/audio-keys.ts` → the server's fail-closed bounds
- * `slates-api/scripts/pricing-consistency-check.mjs` §4 asserts 1 and 2 agree
- * at EVERY value including out-of-range ones; the gate check covers 3.
- *
- * The MINs used to be missing here, and the clamp floor was a hardcoded 1. That
- * made `slates_estimate_generation_cost({model:'seed-audio', duration:2})`
- * quote a real `seed-audio-2s` price for a generation the desktop would bill as
- * 3s and the proxy would REJECT outright. Same for an omitted duration, which
- * quoted `seed-audio-1s` against the desktop's `seed-audio-15s`.
- */
-export declare const SEED_AUDIO_MIN_SECONDS = 3;
-export declare const SEED_AUDIO_MAX_SECONDS = 120;
-export declare const SEED_AUDIO_DEFAULT_SECONDS = 15;
-export declare const ELEVEN_SFX_MIN_SECONDS = 1;
-export declare const ELEVEN_SFX_MAX_SECONDS = 22;
-export declare const ELEVEN_SFX_DEFAULT_SECONDS = 4;
 export declare function audioCostKey(input: {
     model: AudioModel;
     /** seed-audio + eleven-sfx: the REQUESTED duration in seconds (ceiled). */
     durationSeconds?: number;
+    /** inworld-tts-2 ONLY: the character count of the text being spoken. */
+    characters?: number;
 }): string;
 export declare const generateVideo: Operation<{
     prompt: string;
@@ -294,6 +399,9 @@ export declare const generateAudio: Operation<{
     prompt: string;
     durationSeconds?: number;
     voice?: string;
+    voiceId?: string;
+    voiceReferenceAssetId?: string;
+    voiceDescription?: string;
     speed?: number;
     volume?: number;
     pitch?: number;
@@ -505,8 +613,6 @@ export declare const updateFrame: Operation<{
     assetId?: string | null;
     sceneId?: string | null;
     position?: number;
-    frameType?: 'first' | 'last' | 'ingredient' | null;
-    motionPrompt?: string | null;
 }>;
 /**
  * Batch form of `slates_update_frame`.
@@ -529,15 +635,121 @@ export declare const batchUpdateFrames: Operation<{
         assetId?: string | null;
         sceneId?: string | null;
         position?: number;
-        frameType?: 'first' | 'last' | 'ingredient' | null;
-        motionPrompt?: string | null;
     }[];
 }>;
 export declare const deleteFrame: Operation<{
     frameId: string;
 }>;
+interface ShotOpScript {
+    speaker?: string | null;
+    line?: string | null;
+    delivery?: string | null;
+    action?: string | null;
+    prop?: string | null;
+    shotSize?: string | null;
+    camera?: string | null;
+    continues?: boolean;
+}
+interface ShotOpRefs {
+    refs?: Partial<Record<OrderedAttachmentRole, string[]>>;
+    firstFrameAssetId?: string;
+    lastFrameAssetId?: string;
+    audioRefSpokenText?: string[];
+    characterIds?: string[];
+    environmentIds?: string[];
+    styleIds?: string[];
+}
+interface ShotOpParams {
+    aspectRatio?: AspectRatio;
+    duration?: number;
+    videoResolution?: VideoResolution;
+    imageResolution?: '1k' | '2k' | '3k' | '4k';
+    gptQuality?: 'medium' | 'high';
+    imageQuantity?: number;
+    negativePrompt?: string;
+    sound?: boolean;
+    seedanceFace?: boolean;
+    audioDurationSeconds?: number;
+}
+export declare const createShot: Operation<ShotOpRefs & ShotOpScript & {
+    projectId: string;
+    name?: string;
+    prompt: string;
+    model?: string;
+    params?: ShotOpParams;
+    frameId?: string;
+    sceneId?: string;
+}>;
+export declare const updateShot: Operation<ShotOpRefs & ShotOpScript & {
+    shotId: string;
+    projectId: string;
+    name?: string;
+    prompt?: string;
+    model?: string;
+    params?: ShotOpParams;
+    attachFrameId?: string;
+    detachFrameId?: string;
+    posterAssetId?: string | null;
+}>;
+export declare const duplicateShot: Operation<{
+    shotId: string;
+    name?: string;
+    prompt?: string;
+    model?: string;
+    params?: ShotOpParams;
+    frameId?: string | null;
+}>;
+export declare const listShots: Operation<{
+    projectId: string;
+    storyboardId?: string;
+    frameId?: string;
+}>;
+export declare const getShot: Operation<{
+    shotId: string;
+}>;
+/**
+ * SPLIT and MERGE — the chop decision, and the only two cross-row operations on
+ * this surface.
+ *
+ * 🔑 THIS IS THE EXECUTIVE CALL, AND IT IS WHY THEY ARE OPS. *"Sometimes you
+ * might be using more dialogue in one single 30-second generation. Sometimes it
+ * might just be a 4-second generation of one line."* Merging five lines into
+ * one long take or splitting them into five short ones changes the rhythm AND
+ * the price, and the agent has to be able to re-chop what it wrote.
+ *
+ * 🚨 NEITHER EDITS TEXT AS A SIDE EFFECT. Split moves the text after a caret
+ * the caller placed; merge joins two texts at their boundary. Nothing else in
+ * either row is rewritten. That property is what keeps a finished script
+ * finished, and it is the acceptance test for anything added here later.
+ */
+export declare const splitShot: Operation<{
+    shotId: string;
+    caret?: number;
+}>;
+export declare const mergeShots: Operation<{
+    firstId: string;
+    secondId: string;
+}>;
+export declare const generateFromShots: Operation<{
+    shotIds: string[];
+    confirm?: boolean;
+}>;
 export declare const getPromptingGuide: Operation<{
     topic: string;
+    depth?: 'card' | 'full';
+}>;
+/**
+ * The one op that changes what OTHER ops are visible.
+ *
+ * 🚨 IT EXISTS BECAUSE THE SURFACE IS 112 KB AND EVERY TURN PAYS FOR ALL OF IT.
+ * The desktop Studio Agent sends `core` plus this; a group arrives when the
+ * work needs it and stays for the rest of the run. On the MCP surface every op
+ * is registered up front (a stdio server has no run to append to), so this
+ * returns the same definitions as a plain listing — useful either way, since
+ * it is also how an agent asks "what else can you do".
+ */
+export declare const loadTools: Operation<{
+    group: OperationGroup;
 }>;
 export declare const blenderStatus: Operation<Record<string, never>>;
 export declare const blenderExecute: Operation<{
@@ -563,5 +775,5 @@ export declare const blenderRenderBlocking: Operation<{
     basename?: string;
 }>;
 export declare const ALL_OPERATIONS: ReadonlyArray<Operation<unknown>>;
-export {};
+export { toolDefinitions, toolDefinition, groupFor, tierFor, OPERATION_GROUPS, GROUP_SUMMARY, type ToolDefinition } from './surface.js';
 //# sourceMappingURL=index.d.ts.map