@stackbone/cli 0.1.0-alpha.2 → 0.1.0-alpha.4

package/main.js

@@ -82,6 +82,7 @@ var installationStatusSchema = z.enum([
 	"deprovisioning",
 	"deprovisioned"
 ]);
+var installationKindSchema = z.enum(["cloud", "local"]);
 var installationProviderSchema = z.enum([
 	"neon",
 	"r2",
@@ -109,17 +110,30 @@ z.object({
 	slug: organizationSlugSchema,
 	id: z.uuid()
 });
-z.object({
+var installationResponseSchema = z.object({
 	id: z.uuid(),
 	organizationId: z.uuid(),
 	agentId: z.uuid(),
 	agentVersion: z.string(),
 	status: installationStatusSchema,
+	kind: installationKindSchema.default("cloud"),
+	localTunnelUrl: z.url().nullable().optional(),
+	lastActiveAt: z.iso.datetime().nullable().optional(),
 	config: jsonObject(),
 	createdByUserId: z.uuid(),
 	createdAt: z.iso.datetime(),
 	updatedAt: z.iso.datetime()
 });
+z.object({
+	creatorOrganizationSlug: organizationSlugSchema,
+	agentTemplateSlug: z.string().min(1).max(80),
+	endUserOrganizationSlug: organizationSlugSchema.optional()
+});
+z.object({ localTunnelUrl: z.url().nullable() });
+var localDevInstallationResponseSchema = installationResponseSchema.extend({
+	organizationSlug: organizationSlugSchema,
+	agentSlug: z.string().min(1).max(80)
+});
 z.object({
 	id: z.uuid(),
 	installationId: z.uuid(),
@@ -468,6 +482,11 @@ z.object({
 	nextCursor: z.string().nullable(),
 	prevCursor: z.string().nullable()
 });
+z.object({ fxtId: z.uuid() });
+z.object({
+	input: jsonObject().nullable(),
+	output: jsonObject().nullable()
+});
 //#endregion
 //#region ../../libs/validators/src/lib/auth/session.ts
 var sessionUserSchema = z.object({
@@ -931,12 +950,30 @@ var credentialsSchema = z.object({
 * Project-local config is written by `stackbone init`/`link` to
 * `<cwd>/.stackbone/project.json`. Tracks which agent in which organization this
 * directory points at. Excluded from git by the same `.gitignore` patch.
+*
+* Feature 42: `localDevInstallationId` + `organizationSlug` + `agentSlug` are
+* captured at `init`/`link` time so `stackbone dev` can build the path-aware
+* deeplink (`/app/<orgSlug>/installations/<id>?stackbone-dev=…`) and patch
+* the tunnel URL without a separate `GET` round-trip. They are optional so
+* old project.json files continue to load — a future `stackbone dev` against
+* a pre-feature-42 directory simply re-registers the local-dev row.
 */
 var projectConfigSchema = z.object({
 	schemaVersion: z.literal(1),
 	organizationId: z.uuid(),
 	agentId: z.uuid(),
-	controlPlaneUrl: z.url()
+	controlPlaneUrl: z.url(),
+	localDevInstallationId: z.uuid().optional(),
+	organizationSlug: z.string().optional(),
+	agentSlug: z.string().optional(),
+	/** F5: slug of the CLI starter the project was scaffolded from. */
+	starter: z.string().optional(),
+	/**
+	* F5 read-compat: pre-rename CLIs wrote a `template` field. Accepted on
+	* read for one release so a re-`init` over an existing project upgrades
+	* the file to `starter`; never written by current code.
+	*/
+	template: z.string().optional()
 });
 /**
 * Project-shared config at `<cwd>/stackbone.config.json` (committable, unlike
@@ -1263,7 +1300,8 @@ var createHttpAdapter = (opts) => {
 	};
 	return {
 		get: (path) => request("GET", path),
-		post: (path, body) => request("POST", path, body)
+		post: (path, body) => request("POST", path, body),
+		patch: (path, body) => request("PATCH", path, body)
 	};
 };
 //#endregion
@@ -1361,7 +1399,6 @@ var flagValue = (argv, flag) => {
 var parseFlags = (argv, env) => ({
 	json: detectJsonMode(argv, env),
 	yes: flagPresent(argv, "-y") || flagPresent(argv, "--yes"),
-	autoLogin: env["STACKBONE_AUTO_LOGIN"] !== "0" && !flagPresent(argv, "--no-auto-login"),
 	apiUrlOverride: flagValue(argv, "--api-url") ?? env["STACKBONE_API_URL"] ?? null,
 	verbose: flagPresent(argv, "--verbose") || env["STACKBONE_VERBOSE"] === "1"
 });
@@ -1422,7 +1459,7 @@ var isVersionFlag = (rawArgs) => rawArgs.length === 1 && VERSION_FLAGS.has(rawAr
 var formatVersionOutput = (input) => `stackbone-cli ${input.cliVersion}\ncontract ${input.contractVersion}`;
 //#endregion
 //#region src/dev/contract.ts
-var STACKBONE_CLI_BUILD_VERSION = "0.1.0-alpha.2";
+var STACKBONE_CLI_BUILD_VERSION = "0.1.0-alpha.4";
 /**
 * Capabilities the local emulator advertises on `GET /api/contract`. Typed as
 * `readonly Capability[]` so the compiler refuses any string outside the
@@ -1743,55 +1780,25 @@ var clearSession = async (ctx) => {
 };
 //#endregion
 //#region src/commands/_shared/protected.ts
-var isAuthError = (err) => isStackboneCliError(err) && err.code === "auth";
-var refuseWithAuthError = () => {
-	throw new StackboneCliError({
-		code: "auth",
-		message: "Not authenticated",
-		suggestion: "Run `stackbone login`"
-	});
-};
-var ensureSession = async (ctx) => {
-	const existing = await getCurrentSession(ctx);
-	if (existing) return existing;
-	if (!ctx.flags.autoLogin) refuseWithAuthError();
-	await runLoginFlow(ctx);
-	return await getCurrentSession(ctx) ?? refuseWithAuthError();
-};
 /**
 * Wraps a command handler so it always receives a non-null `Session`.
 *
-* If the credentials store is empty or the session expired:
-*   - With auto-login enabled (default): runs the device-code flow inline,
-*     reloads the session, and runs the handler.
-*   - With auto-login disabled (`STACKBONE_AUTO_LOGIN=0` or `--no-auto-login`):
-*     refuses immediately with `code: 'auth'` and exit 2.
-*
-* Retries once if the handler itself throws an auth error mid-flight
-* (token expired between the pre-check and the request). If the retry
-* also fails with auth, the corrupt credentials are dropped from disk so
-* the next invocation does not loop through the same broken session.
+* If the credentials store is empty or the session has expired, refuses
+* immediately with `code: 'auth'` (exit 2) and points the user at
+* `stackbone login`. Auth flow and command flow are kept strictly separate
+* — protected commands never trigger the device-code dance on the user's
+* behalf, and a 401 mid-flight propagates as-is so the same `stackbone
+* login` instruction is the only path back.
 */
 var protectedCommand = (handler) => {
 	return async (ctx) => {
-		const session = await ensureSession(ctx);
-		try {
-			await handler(ctx, session);
-		} catch (err) {
-			if (!isAuthError(err) || !ctx.flags.autoLogin) throw err;
-			ctx.logger.debug("auth error mid-flight, retrying after re-login");
-			await runLoginFlow(ctx);
-			const refreshed = await getCurrentSession(ctx) ?? refuseWithAuthError();
-			try {
-				await handler(ctx, refreshed);
-			} catch (retryErr) {
-				if (isAuthError(retryErr)) {
-					ctx.logger.warn("auth still failing after re-login, clearing the stored session");
-					await clearSession(ctx);
-				}
-				throw retryErr;
-			}
-		}
+		const session = await getCurrentSession(ctx);
+		if (!session) throw new StackboneCliError({
+			code: "auth",
+			message: "Not authenticated",
+			suggestion: "Run `stackbone login`"
+		});
+		await handler(ctx, session);
 	};
 };
 //#endregion
@@ -2614,7 +2621,7 @@ var buildMigrateStatusCommand = (ctx) => defineCommand({
 			env: ctx.env,
 			json: ctx.flags.json
 		});
-	})({})
+	})()
 });
 /**
 * Pure handler for `stackbone db migrate add-rag`. Reads `agent.yaml` to
@@ -2702,7 +2709,7 @@ var buildStudioCommand = (ctx) => defineCommand({
 			env: ctx.env,
 			json: ctx.flags.json
 		});
-	})({})
+	})()
 });
 var createDbCommand = (ctx) => defineCommand({
 	meta: {
@@ -2747,7 +2754,6 @@ var createDeployCommand = (ctx) => buildStubCommand(ctx, {
 });
 //#endregion
 //#region src/dev/boot-banner.ts
-var STUDIO_CLOUD_BASE_URL = "https://app.stackbone.ai/app";
 var ANSI = {
 	reset: "\x1B[0m",
 	bold: "\x1B[1m",
@@ -2757,7 +2763,6 @@ var ANSI = {
 };
 var ANSI_RE = /\x1b\[[0-9;]*m/g;
 var visibleLength = (s) => s.replace(ANSI_RE, "").length;
-var buildDeeplink = (tunnelUrl) => `${STUDIO_CLOUD_BASE_URL}?stackbone-dev=${encodeURIComponent(tunnelUrl)}`;
 var LABEL_WIDTH = 11;
 var renderRow = (row, colors) => {
 	const marker = colors && row.marker.trim() ? `${ANSI.cyan}${row.marker}${ANSI.reset}` : row.marker;
@@ -2768,11 +2773,11 @@ var TITLE = "stackbone studio";
 var formatBootBanner = (input) => {
 	const colors = input.colors ?? false;
 	const rows = [];
-	if (input.tunnelUrl) {
+	if (input.deeplink && input.tunnelUrl) {
 		rows.push({
 			marker: "▸",
 			label: "Open Studio",
-			value: buildDeeplink(input.tunnelUrl),
+			value: input.deeplink,
 			primary: true
 		});
 		rows.push({
@@ -2790,6 +2795,23 @@ var formatBootBanner = (input) => {
 			label: "Local",
 			value: input.localUrl
 		});
+	} else if (input.tunnelUrl) {
+		rows.push({
+			marker: "▸",
+			label: "Tunnel",
+			value: input.tunnelUrl,
+			primary: true
+		});
+		rows.push({
+			marker: " ",
+			label: "",
+			value: ""
+		});
+		rows.push({
+			marker: " ",
+			label: "Local",
+			value: input.localUrl
+		});
 	} else rows.push({
 		marker: "▸",
 		label: "Local",
@@ -2973,6 +2995,7 @@ var fetchActiveConfigValue = async (client) => {
 //#region src/dev/connections.ts
 var STACKBONE_ENV_KEYS = {
 	contractVersion: "STACKBONE_CONTRACT_VERSION",
+	agentId: "STACKBONE_AGENT_ID",
 	postgresUrl: "STACKBONE_POSTGRES_URL",
 	queueUrl: "STACKBONE_QUEUE_URL",
 	s3Endpoint: "STACKBONE_S3_ENDPOINT",
@@ -2987,6 +3010,7 @@ var buildAgentEnv = (base, injection, options = {}) => {
 	const env = {
 		...base,
 		[STACKBONE_ENV_KEYS.contractVersion]: String(10),
+		[STACKBONE_ENV_KEYS.agentId]: injection.agentId,
 		[STACKBONE_ENV_KEYS.postgresUrl]: injection.services.postgresUrl,
 		[STACKBONE_ENV_KEYS.queueUrl]: injection.services.queueUrl,
 		[STACKBONE_ENV_KEYS.s3Endpoint]: injection.services.s3Endpoint,
@@ -4142,7 +4166,7 @@ var quoteIdent = (raw) => `"${raw.replace(/"/g, "\"\"")}"`;
 //#region src/dev/fixtures-store.ts
 var defaultFixturesDir = () => resolve(homedir(), ".stackbone", "dev", "fixtures");
 var filenameFor = (baseDir, agentSlug) => resolve(baseDir, `${agentSlug}.jsonl`);
-var isSerializedFixture = (value) => !!value && typeof value === "object" && typeof value.id === "string" && typeof value.name === "string" && typeof value.created_at === "string";
+var isSerializedFixture = (value) => !!value && typeof value === "object" && typeof value.id === "string" && typeof value.name === "string" && typeof value.createdAt === "string";
 var readJsonl = async (path) => {
 	let raw;
 	try {
@@ -4169,7 +4193,7 @@ var createFixturesStore = (opts) => {
 	};
 	return {
 		async list() {
-			return (await readJsonl(path)).sort((a, b) => a.created_at < b.created_at ? 1 : -1);
+			return (await readJsonl(path)).sort((a, b) => a.createdAt < b.createdAt ? 1 : -1);
 		},
 		async create(input) {
 			await ensureDir();
@@ -4179,7 +4203,7 @@ var createFixturesStore = (opts) => {
 				name: input.name,
 				input: input.input,
 				description: input.description ?? null,
-				created_at: (/* @__PURE__ */ new Date()).toISOString()
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
 			};
 			await appendFile(path, `${JSON.stringify(fixture)}\n`, "utf8");
 			return fixture;
@@ -5426,22 +5450,25 @@ var buildEmulatorApp = (opts) => {
 	app.get("/api/logs/stream", (c) => streamSSE(c, (stream) => {
 		return runLogTail(stream, parseLogFilters(new URL(c.req.url).searchParams), (emit) => tailJsonlDirectory(logsDir, emit));
 	}));
-	const proxyAgentJson = async (path) => {
+	app.get("/api/schema", async (c) => {
 		try {
-			const resp = await fetch(`${agentBaseUrl}${path}`);
-			const body = await resp.text();
-			return new Response(body, {
-				status: resp.status,
-				headers: { "content-type": "application/json" }
+			const resp = await fetch(`${agentBaseUrl}/schema`);
+			if (!resp.ok) return c.json({
+				input: null,
+				output: null
+			});
+			const raw = await resp.json().catch(() => null);
+			return c.json({
+				input: extractSchemaField(raw, "input"),
+				output: extractSchemaField(raw, "output")
 			});
 		} catch {
-			return new Response(JSON.stringify({ error: "agent_unreachable" }), {
-				status: 502,
-				headers: { "content-type": "application/json" }
+			return c.json({
+				input: null,
+				output: null
 			});
 		}
-	};
-	app.get("/api/schema", () => proxyAgentJson("/schema"));
+	});
 	const dbExplorerOptions = { connectionString: opts.injection.services.postgresUrl };
 	app.get("/api/db/schemas", async (c) => {
 		const response = await listSchemas(dbExplorerOptions);
@@ -6044,6 +6071,12 @@ var buildEmulatorApp = (opts) => {
 	}));
 	return app;
 };
+var extractSchemaField = (raw, field) => {
+	if (!raw) return null;
+	const value = raw[field];
+	if (value && typeof value === "object" && !Array.isArray(value)) return value;
+	return null;
+};
 var eventMatchesRunId = (event, runId) => {
 	const data = event.data;
 	if (!data || typeof data["run_id"] === "undefined") return true;
@@ -6706,7 +6739,7 @@ var requestDevTunnelGrant = async (input) => {
 	if (response.status === 503) throw new StackboneCliError({
 		code: "tunnel_relay_unhealthy",
 		message: "Stackbone tunnel relay is unhealthy and cannot mint grants right now",
-		suggestion: `Check ${isError503Body(parsedBody) && typeof parsedBody.statusUrl === "string" ? parsedBody.statusUrl : DEFAULT_STATUS_URL} for relay status and re-run with \`--no-tunnel\` to skip the tunnel.`,
+		suggestion: `Check ${isError503Body(parsedBody) && typeof parsedBody.statusUrl === "string" ? parsedBody.statusUrl : DEFAULT_STATUS_URL} for relay status and re-run once the relay is back. The tunnel is mandatory, so there is no opt-out flag.`,
 		cause: parsedBody
 	});
 	if (!response.ok) throw new StackboneCliError({
@@ -6849,7 +6882,7 @@ var resolveFrpcBin = async (input) => {
 		throw new StackboneCliError({
 			code: "generic",
 			message: "Could not auto-fetch frpc",
-			suggestion: "Check your network or install frpc manually (https://github.com/fatedier/frp/releases) and re-run, or pass `--no-tunnel` / `--no-auto-frpc`",
+			suggestion: "Check your network, or install frpc manually from https://github.com/fatedier/frp/releases and point STACKBONE_FRPC_BIN at the binary before re-running.",
 			cause: err
 		});
 	} finally {
@@ -6933,7 +6966,7 @@ var TUNNEL_HOST_SUFFIX = "tun.stackbone.ai";
 var frpcNotInstalledError = (cause) => new StackboneCliError({
 	code: "generic",
 	message: "`frpc` is not installed or not on PATH",
-	suggestion: "Install frpc from https://github.com/fatedier/frp/releases, set STACKBONE_FRPC_BIN to override the binary, or run `stackbone dev --no-tunnel` to skip the tunnel",
+	suggestion: "Install frpc from https://github.com/fatedier/frp/releases, or set STACKBONE_FRPC_BIN to point at an existing binary. The tunnel is mandatory — there is no opt-out flag.",
 	cause
 });
 var buildFrpcConfig = (grant, targetUrl) => {
@@ -7176,6 +7209,7 @@ var startDevSession = async (input) => {
 	const bus = createEventBus();
 	const agentPort = await pickFreePort();
 	const injection = {
+		agentId: input.agent.slug,
 		agentPort,
 		services: DEFAULT_DEV_SERVICES
 	};
@@ -7503,6 +7537,24 @@ var startDevSession = async (input) => {
 	}
 };
 //#endregion
+//#region src/services/local-dev-installations.service.ts
+var parse$1 = (raw, context) => {
+	const parsed = localDevInstallationResponseSchema.safeParse(raw);
+	if (!parsed.success) throw new StackboneCliError({
+		code: "generic",
+		message: `Unexpected response shape from ${context}`,
+		cause: parsed.error
+	});
+	return parsed.data;
+};
+var upsertLocalDevInstallation = async (ctx, body) => {
+	return parse$1(await ctx.http.post("/api/v1/installations/local-dev", body), "POST /api/v1/installations/local-dev");
+};
+var patchLocalDevInstallation = async (ctx, id, body) => {
+	const path = `/api/v1/installations/local-dev/${encodeURIComponent(id)}`;
+	return parse$1(await ctx.http.patch(path, body), `PATCH ${path}`);
+};
+//#endregion
 //#region src/commands/dev/print-contract.ts
 var defaultWriteStdout = (chunk) => {
 	process.stdout.write(chunk);
@@ -7599,15 +7651,37 @@ var buildHandler$2 = (ctx, flags) => protectedCommand(async (innerCtx) => {
 			name: agent.name
 		},
 		emulatorPort: flags.port,
-		tunnel: flags.tunnel,
+		tunnel: true,
 		listen: flags.listen,
 		verbose: flags.verbose,
 		...renderStage ? { onStage: renderStage } : {}
 	});
+	const activeOrg = await getActiveOrganization(innerCtx);
+	let localDevId = config.localDevInstallationId;
+	let installationOrgSlug = config.organizationSlug ?? activeOrg.slug;
+	if (!localDevId) {
+		const upserted = await upsertLocalDevInstallation(innerCtx, {
+			creatorOrganizationSlug: activeOrg.slug,
+			agentTemplateSlug: agent.slug
+		});
+		localDevId = upserted.id;
+		installationOrgSlug = upserted.organizationSlug;
+	}
+	if (session.publicUrl) {
+		const patched = await patchLocalDevInstallation(innerCtx, localDevId, { localTunnelUrl: session.publicUrl }).catch((err) => {
+			innerCtx.logger.warn({ err: err.message }, "failed to PATCH local-dev tunnel URL (continuing)");
+			return null;
+		});
+		if (patched) installationOrgSlug = patched.organizationSlug;
+	}
+	const studioBaseUrl = innerCtx.apiUrl.includes("localhost") ? "http://localhost:4200/app" : "https://app.stackbone.ai/app";
+	const deeplink = session.publicUrl ? `${studioBaseUrl}/${installationOrgSlug}/installations/${localDevId}?stackbone-dev=${encodeURIComponent(session.publicUrl)}` : null;
 	if (innerCtx.flags.json) emit(innerCtx.flags, () => "", {
 		emulator_url: session.emulatorUrl,
 		agent_url: session.agentUrl,
 		public_url: session.publicUrl,
+		deeplink,
+		local_dev_installation_id: localDevId,
 		services: {
 			postgres_url: session.injection.services.postgresUrl,
 			queue_url: session.injection.services.queueUrl,
@@ -7619,6 +7693,7 @@ var buildHandler$2 = (ctx, flags) => protectedCommand(async (innerCtx) => {
 		const inlineLines = formatBootBanner({
 			tunnelUrl: session.publicUrl,
 			localUrl: session.emulatorUrl,
+			deeplink,
 			contractVersion: 10,
 			capabilityCount: EMULATOR_CAPABILITIES.length,
 			agentName: agent.name,
@@ -7630,7 +7705,13 @@ var buildHandler$2 = (ctx, flags) => protectedCommand(async (innerCtx) => {
 		log.step("Press Ctrl-C to stop");
 	}
 	const sigintHandler = () => {
-		session.stop();
+		(async () => {
+			if (localDevId) await patchLocalDevInstallation(innerCtx, localDevId, { localTunnelUrl: null }).catch((err) => {
+				innerCtx.logger.debug({ err: err.message }, "failed to null local-dev tunnel URL on exit (safety net will catch up)");
+				return null;
+			});
+			await session.stop();
+		})();
 	};
 	process.once("SIGINT", sigintHandler);
 	process.once("SIGTERM", sigintHandler);
@@ -7648,12 +7729,6 @@ var createDevCommand = (ctx) => defineCommand({
 			description: `Emulator port. Defaults to ${DEFAULT_EMULATOR_PORT}.`,
 			default: String(DEFAULT_EMULATOR_PORT)
 		},
-		tunnel: {
-			type: "boolean",
-			description: "Open a public tunnel to the emulator (default: on).",
-			negativeDescription: "Skip the public tunnel and serve the emulator only on localhost.",
-			default: true
-		},
 		listen: {
 			type: "boolean",
 			description: "Bind the HTTP server to 0.0.0.0 (reachable from your LAN). Default binds to 127.0.0.1 only.",
@@ -7663,11 +7738,6 @@ var createDevCommand = (ctx) => defineCommand({
 			type: "boolean",
 			description: "Print the JSON contract this CLI advertises (the same payload the emulator serves at /api/contract) and exit without booting the dev session.",
 			default: false
-		},
-		verbose: {
-			type: "boolean",
-			description: "Stream every log line and docker compose output. Default UI uses per-stage spinners; --verbose switches back to the raw firehose.",
-			default: false
 		}
 	},
 	run: ({ args }) => safeRun(ctx.flags, async (a) => {
@@ -7683,9 +7753,8 @@ var createDevCommand = (ctx) => defineCommand({
 		});
 		await buildHandler$2(ctx, {
 			port,
-			tunnel: Boolean(a.tunnel),
 			listen: Boolean(a.listen),
-			verbose: Boolean(a.verbose)
+			verbose: ctx.flags.verbose
 		});
 	})(args)
 });
@@ -7720,10 +7789,6 @@ several exploratory calls.
 - \`-y, --yes\`
   Skip every confirmation prompt. Required in CI / non-TTY contexts.
 
-- \`--no-auto-login\` (or \`STACKBONE_AUTO_LOGIN=0\`)
-  When a protected command finds no valid session, fail fast with exit
-  code 2 instead of triggering the device-code flow inline.
-
 ## Exit codes
 
 - \`0\` ok
@@ -7735,18 +7800,20 @@ several exploratory calls.
 
 ## Commands shipped today
 
+- \`stackbone login\` / \`logout\` — device-code flow over magic link
 - \`stackbone whoami\` — show the active user and organization
 - \`stackbone current\` — print the active organization slug
 - \`stackbone list\` — list organizations the current user owns
 - \`stackbone metadata\` — agent-friendly one-shot overview
+- \`stackbone init\` / \`link\` — scaffold a new project, or link an existing one
+- \`stackbone dev\` — local emulator of the control plane
+- \`stackbone db migrate up | create | status | add-rag\` — Drizzle migrations
+- \`stackbone db studio\` — open Drizzle Studio against the dev Postgres
 - \`stackbone docs <topic>\` — print this kind of help inline
 
-## Commands shipped by sibling tasks
+## Pending
 
-- \`stackbone login\` / \`logout\` — device-code flow over magic link
-- \`stackbone init\` / \`link\` — scaffold a new project, or link an existing one
-- \`stackbone dev\` — local emulator of the control plane
-- \`stackbone deploy\` — push to Fly Machines
+- \`stackbone deploy\` — push to Fly Machines (stub)
 
 ## State on disk
 
@@ -7755,34 +7822,35 @@ several exploratory calls.
 `;
 var sdk = `# @stackbone/sdk
 
-Monolithic SDK for the agent container with six modules and explicit
-escape hatches to the upstream SDKs. Refer to the
-\`Implementar @stackbone-sdk con 6 modulos monoliticos\` task for the canonical
-shape.
+Monolithic SDK for the agent container with wrapper modules over the
+underlying data primitives plus control-plane façades. The creator
+keeps explicit escape hatches to the upstream SDKs.
 
 ## Modules
 
-- \`client.database\` — Drizzle + @neondatabase/serverless (HTTP driver)
-- \`client.storage\` — @aws-sdk/client-s3 + Cloudflare R2
+- \`client.database\` — Drizzle + postgres-js (any Postgres URL)
+- \`client.storage\` — @aws-sdk/client-s3 + Cloudflare R2 / MinIO
 - \`client.ai\` — openai SDK with OpenRouter base URL override
-- \`client.queues\` — @upstash/qstash publisher + Hono receiver
+- \`client.queues\` — pgmq publisher (surface defined, runtime pending)
 - \`client.rag\` — LlamaParse (opt-in) + chunker + embeddings + pgvector + tsvector
-- \`client.observability\` — @opentelemetry/sdk-node with auto-instrumentations
+- \`client.observability\` — OpenTelemetry span processor + run-cost aggregator + per-run logger
+- \`client.memory\` — long-term mem0-backed memory (surface defined, runtime pending)
 
 ## Façades on top of the control plane
 
 - \`client.approval.*\` — HITL queue and workflow resume
 - \`client.secrets.*\` — organization-scoped encrypted secrets
 - \`client.connections.*\` — OAuth connections (Notion, GDrive, Slack, …)
-- \`client.config.*\` — runtime config injected via \`AGENT_CONFIG\`
+- \`client.config.*\` — typed reads of dynamic config from the control plane
 - \`client.events.*\` — emit events to the organization eventbus
+- \`client.prompts.*\` — typed prompt templates fetched from the control plane
 
 ## Escape hatch
 
-Every upstream env var (\`DATABASE_URL\`, \`AWS_*\`, \`S3_ENDPOINT\`,
+Every upstream env var (\`STACKBONE_POSTGRES_URL\`, \`STACKBONE_S3_*\`,
 \`OPENROUTER_API_KEY\`, \`OPENROUTER_BASE_URL\`, \`LLAMA_PARSE_API_KEY\` if
-opt-in, \`QSTASH_*\`) is also injected, so the creator can swap any module
-for the upstream SDK without losing access to its data.
+opt-in, \`MEM0_API_KEY\` if opt-in) is also injected, so the creator can
+swap any module for the upstream SDK without losing access to its data.
 
 The runtime target is **Hono + Node 24 LTS** (Bun 1.x as opt-in via the
 \`runtime.engine: bun\` field of \`agent.yaml\`). No adapters for Next,
@@ -7796,15 +7864,23 @@ runs your agent under \`@stackbone/sdk\`, and exposes the Studio API at
 
 ## Defaults that matter
 
-- \`--tunnel\` (default on) — opens a public tunnel against the
+- Mandatory tunnel — \`stackbone dev\` always opens a tunnel against the
   Stackbone-owned relay (\`*.tun.stackbone.ai\`) so the HTTPS bundle of
-  \`app.stackbone.ai/studio\` can reach the emulator from
-  Safari/Brave/Chrome (mixed-content / local-network-access
-  restrictions). Pass \`--no-tunnel\` to skip it on permissive
-  browsers. Override the binary with \`STACKBONE_FRPC_BIN\`.
+  \`app.stackbone.ai\` can reach the emulator from Safari/Brave/Chrome
+  (mixed-content / local-network-access restrictions). There is no
+  opt-out flag — the \`local_tunnel_url\` field on the installation row
+  is what makes the session shareable from the dashboard. The CLI
+  auto-fetches \`frpc\` into \`~/.cache/stackbone/bin/\` if missing.
+  Override the binary with \`STACKBONE_FRPC_BIN\` and pin the release
+  with \`STACKBONE_FRPC_VERSION\`.
 - HTTP server bound to \`127.0.0.1\` by default — not reachable from
   the LAN. Pass \`--listen\` to bind to \`0.0.0.0\` instead; the CLI
   prints a visible warning so the exposure isn't silent.
+- \`--print-contract\` — print the JSON contract this CLI advertises
+  (same payload as the emulator's \`/api/contract\`) and exit without
+  booting the dev session. Useful for cross-version handshake debugging.
+- \`--verbose\` (also \`STACKBONE_VERBOSE=1\`) — stream every log line
+  and docker compose output. Default UI uses per-stage spinners.
 
 ## CORS allowlist
 
@@ -7910,6 +7986,32 @@ before booting the agent process and re-runs it whenever the migrations
 folder changes. The default is opt-out so a noisy schema cannot silently
 mutate your local database.
 
+### \`rag\` (optional)
+
+    rag:
+      embeddingModel: openai/text-embedding-3-small  # default
+      autoMigrate: false                              # default
+
+The block \`client.rag\` reads. \`embeddingModel\` is the OpenRouter/OpenAI
+identifier the pipeline embeds chunks with — change it before ingesting
+the first document, since collections are pinned to the dimensionality of
+the model that created them. \`autoMigrate: true\` lets \`stackbone dev\`
+apply the per-agent RAG schema on boot (off by default to keep the
+migration explicit). Strict — unknown keys fail parse.
+
+### \`protocol\` (optional)
+
+    protocol:
+      required: 10
+
+Creator-side floor on the Stackbone Agent Protocol contract version. The
+CLI forwards \`protocol.required\` to the SDK as \`protocolRequired\`; the
+SDK's contract gate fails closed with \`contract_version_unsupported\`
+whenever the datapath advertises a contract below this floor, before any
+per-module capability check runs. Omit the block to fall back to the SDK's
+hard floor (\`MIN_SUPPORTED_CONTRACT_VERSION\`). Strict — unknown keys fail
+parse.
+
 ## Reference
 
 This file lives in the validators contract (\`agentManifestSchema\`) and is
@@ -7917,7 +8019,7 @@ shared by \`stackbone init\`, \`stackbone dev\`, \`stackbone deploy\` and the
 \`stackbone db migrate ...\` family. Keep it under version control — the
 control plane never writes to it.
 `,
-	templates: stubFor("Epic 5 — official templates", "Crear template workflow LangGraph basico"),
+	starters: stubFor("Epic 5 — official starters", "Document the starter catalogue (CLI scaffold sources)"),
 	connections: stubFor("Epic 6 — data layer", "Montar docker-compose embebido con Postgres pgvector pgmq y MinIO para stackbone dev")
 };
 var docTopicList = Object.keys(docTopics);
@@ -8016,7 +8118,6 @@ Branch on these instead of parsing stack traces.
 
 - \`STACKBONE_JSON=1\` — same as \`--json\`
 - \`STACKBONE_API_URL\` — same as \`--api-url <url>\`
-- \`STACKBONE_AUTO_LOGIN=0\` — same as \`--no-auto-login\`
 - \`STACKBONE_LOG_LEVEL\` — \`debug\`, \`info\`, \`warn\`, \`error\` (logger goes
   to stderr, never pollutes the JSON payload on stdout)
 
@@ -8045,7 +8146,7 @@ stackbone metadata --json  # one-shot overview that replaces 5–7 explorer call
 ### Start a new project
 
 \`\`\`sh
-stackbone init             # menu of templates (workflow / autonomous / RAG)
+stackbone init             # menu of starters (hello-world + 9 capability demos)
 stackbone dev              # local emulator at http://localhost:4242
 \`\`\`
 
@@ -8072,7 +8173,7 @@ stackbone deploy           # build + push + Fly Machines
 - \`stackbone docs cli\` — command reference
 - \`stackbone docs sdk\` — \`@stackbone/sdk\` modules
 - \`stackbone docs agent-yaml\` — manifest reference (Epic 3)
-- \`stackbone docs templates\` — official templates (Epic 5)
+- \`stackbone docs starters\` — official starters (Epic 5)
 - \`stackbone docs connections\` — data layer (Epic 6)
 `;
 //#endregion
@@ -8155,18 +8256,22 @@ var writeFileSafe = async (path, contents, force) => {
 	await mkdir(dirname(path), { recursive: true });
 	await writeFile(path, contents);
 };
-var writeTemplateFiles = async (files, input) => {
+var writeStarterFiles = async (files, input) => {
 	for (const file of files) await writeFileSafe(join(input.root, file.path), file.contents, input.force);
 };
 var writeAgentManifest = async (agentName, input) => {
 	await writeFileSafe(join(input.root, "agent.yaml"), renderAgentYaml({ name: agentName }), input.force);
 };
-var writeProjectConfig = async (ctx, agent, input) => {
+var writeProjectConfig = async (ctx, agent, input, extras = {}) => {
 	const config = {
 		schemaVersion: 1,
 		organizationId: agent.organizationId,
 		agentId: agent.id,
-		controlPlaneUrl: ctx.apiUrl
+		controlPlaneUrl: ctx.apiUrl,
+		...extras.localDevInstallationId !== void 0 ? { localDevInstallationId: extras.localDevInstallationId } : {},
+		...extras.organizationSlug !== void 0 ? { organizationSlug: extras.organizationSlug } : {},
+		...extras.agentSlug !== void 0 ? { agentSlug: extras.agentSlug } : {},
+		...extras.starter !== void 0 ? { starter: extras.starter } : {}
 	};
 	await mkdir(join(input.root, ".stackbone"), { recursive: true });
 	await writeFile(join(input.root, ".stackbone", "project.json"), JSON.stringify(config, null, 2));
@@ -8198,209 +8303,779 @@ var detectExistingProjectFiles = async (root, paths) => {
 	return found;
 };
 //#endregion
-//#region src/templates/autonomous/template.yaml?raw
-var template_default$2 = "id: autonomous\nlabel: autonomous (mock)\nhint: ReAct loop with two tools. Mock LLM output until @stackbone/sdk lands.\norder: 3\nvariables:\n  - agentName\n  - agentSlug\n";
+//#region ../../starters/ai/package.json?raw
+var package_default$9 = "{\n  \"name\": \"starter-ai\",\n  \"version\": \"0.0.1\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"node --watch src/index.ts\",\n    \"start\": \"node src/index.ts\"\n  },\n  \"engines\": {\n    \"node\": \">=24\"\n  },\n  \"dependencies\": {\n    \"@hono/node-server\": \"^1.13.0\",\n    \"@stackbone/sdk\": \"^0.1.0-alpha.1\",\n    \"hono\": \"^4.6.0\"\n  },\n  \"stackbone\": {\n    \"label\": \"AI (LLM via OpenRouter)\",\n    \"hint\": \"Demo of `client.ai` — chat completions and embeddings against any OpenRouter model.\",\n    \"order\": 1,\n    \"category\": \"Capabilities\"\n  }\n}\n";
 //#endregion
-//#region src/templates/hello-world/template.yaml?raw
-var template_default$1 = "id: hello-world\nlabel: hello-world\nhint: Minimal Hono /invoke that echoes its input. Best to learn the contract.\norder: 1\nvariables:\n  - agentName\n  - agentSlug\n";
+//#region ../../starters/config/package.json?raw
+var package_default$8 = "{\n  \"name\": \"starter-config\",\n  \"version\": \"0.0.1\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"node --watch src/index.ts\",\n    \"start\": \"node src/index.ts\"\n  },\n  \"engines\": {\n    \"node\": \">=24\"\n  },\n  \"dependencies\": {\n    \"@hono/node-server\": \"^1.13.0\",\n    \"@stackbone/sdk\": \"^0.1.0-alpha.1\",\n    \"hono\": \"^4.6.0\"\n  },\n  \"stackbone\": {\n    \"label\": \"Config\",\n    \"hint\": \"Demo of `client.config` — runtime config injected via `AGENT_CONFIG`.\",\n    \"order\": 9,\n    \"category\": \"Capabilities\"\n  }\n}\n";
 //#endregion
-//#region src/templates/workflow/template.yaml?raw
-var template_default = "id: workflow\nlabel: workflow (mock)\nhint: Multi-node state machine. Mock LLM output until @stackbone/sdk lands.\norder: 2\nvariables:\n  - agentName\n  - agentSlug\n";
+//#region ../../starters/db/package.json?raw
+var package_default$7 = "{\n  \"name\": \"starter-db\",\n  \"version\": \"0.0.1\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"node --watch src/index.ts\",\n    \"start\": \"node src/index.ts\"\n  },\n  \"engines\": {\n    \"node\": \">=24\"\n  },\n  \"dependencies\": {\n    \"@hono/node-server\": \"^1.13.0\",\n    \"@stackbone/sdk\": \"^0.1.0-alpha.1\",\n    \"hono\": \"^4.6.0\"\n  },\n  \"stackbone\": {\n    \"label\": \"Database (Drizzle + Postgres)\",\n    \"hint\": \"Demo of `client.database` — Drizzle ORM against per-agent Postgres.\",\n    \"order\": 3,\n    \"category\": \"Capabilities\"\n  }\n}\n";
 //#endregion
-//#region src/templates/autonomous/.stackbone/migrations/0000_init.sql?raw
-var _0000_init_default$2 = "CREATE TABLE \"examples\" (\n	\"id\" serial PRIMARY KEY NOT NULL,\n	\"name\" text NOT NULL,\n	\"created_at\" timestamp DEFAULT now() NOT NULL\n);\n";
+//#region ../../starters/hello-world/package.json?raw
+var package_default$6 = "{\n  \"name\": \"starter-hello-world\",\n  \"version\": \"0.0.1\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"node --watch src/index.ts\",\n    \"start\": \"node src/index.ts\"\n  },\n  \"engines\": {\n    \"node\": \">=24\"\n  },\n  \"dependencies\": {\n    \"@hono/node-server\": \"^1.13.0\",\n    \"@stackbone/sdk\": \"^0.1.0-alpha.1\",\n    \"hono\": \"^4.6.0\"\n  },\n  \"stackbone\": {\n    \"label\": \"Hello world\",\n    \"hint\": \"Minimal Hono /invoke that echoes its input. Best place to learn the contract.\",\n    \"order\": 1,\n    \"category\": \"Core\"\n  }\n}\n";
 //#endregion
-//#region src/templates/autonomous/.stackbone/migrations/meta/0000_snapshot.json?raw
-var _0000_snapshot_default$2 = "{\n  \"id\": \"00000000-0000-4000-8000-000000000001\",\n  \"prevId\": \"00000000-0000-0000-0000-000000000000\",\n  \"version\": \"7\",\n  \"dialect\": \"postgresql\",\n  \"tables\": {\n    \"public.examples\": {\n      \"name\": \"examples\",\n      \"schema\": \"\",\n      \"columns\": {\n        \"id\": {\n          \"name\": \"id\",\n          \"type\": \"serial\",\n          \"primaryKey\": true,\n          \"notNull\": true\n        },\n        \"name\": {\n          \"name\": \"name\",\n          \"type\": \"text\",\n          \"primaryKey\": false,\n          \"notNull\": true\n        },\n        \"created_at\": {\n          \"name\": \"created_at\",\n          \"type\": \"timestamp\",\n          \"primaryKey\": false,\n          \"notNull\": true,\n          \"default\": \"now()\"\n        }\n      },\n      \"indexes\": {},\n      \"foreignKeys\": {},\n      \"compositePrimaryKeys\": {},\n      \"uniqueConstraints\": {},\n      \"policies\": {},\n      \"checkConstraints\": {},\n      \"isRLSEnabled\": false\n    }\n  },\n  \"enums\": {},\n  \"schemas\": {},\n  \"sequences\": {},\n  \"roles\": {},\n  \"policies\": {},\n  \"views\": {},\n  \"_meta\": {\n    \"columns\": {},\n    \"schemas\": {},\n    \"tables\": {}\n  }\n}\n";
+//#region ../../starters/hitl/package.json?raw
+var package_default$5 = "{\n  \"name\": \"starter-hitl\",\n  \"version\": \"0.0.1\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"node --watch src/index.ts\",\n    \"start\": \"node src/index.ts\"\n  },\n  \"engines\": {\n    \"node\": \">=24\"\n  },\n  \"dependencies\": {\n    \"@hono/node-server\": \"^1.13.0\",\n    \"@stackbone/sdk\": \"^0.1.0-alpha.1\",\n    \"hono\": \"^4.6.0\"\n  },\n  \"stackbone\": {\n    \"label\": \"Human-in-the-loop\",\n    \"hint\": \"Demo of `client.approval` — pause and wait for human approval before continuing.\",\n    \"order\": 6,\n    \"category\": \"Capabilities\"\n  }\n}\n";
 //#endregion
-//#region src/templates/autonomous/.stackbone/migrations/meta/_journal.json?raw
-var _journal_default$2 = "{\n  \"version\": \"7\",\n  \"dialect\": \"postgresql\",\n  \"entries\": [\n    {\n      \"idx\": 0,\n      \"version\": \"7\",\n      \"when\": 1778889700000,\n      \"tag\": \"0000_init\",\n      \"breakpoints\": true\n    }\n  ]\n}\n";
+//#region ../../starters/prompts/package.json?raw
+var package_default$4 = "{\n  \"name\": \"starter-prompts\",\n  \"version\": \"0.0.1\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"node --watch src/index.ts\",\n    \"start\": \"node src/index.ts\"\n  },\n  \"engines\": {\n    \"node\": \">=24\"\n  },\n  \"dependencies\": {\n    \"@hono/node-server\": \"^1.13.0\",\n    \"@stackbone/sdk\": \"^0.1.0-alpha.1\",\n    \"hono\": \"^4.6.0\"\n  },\n  \"stackbone\": {\n    \"label\": \"Prompts\",\n    \"hint\": \"Demo of `client.prompts` — managed prompts with versioned templates.\",\n    \"order\": 8,\n    \"category\": \"Capabilities\"\n  }\n}\n";
 //#endregion
-//#region src/templates/autonomous/Dockerfile?raw
-var Dockerfile_raw_default$2 = "# Distroless Node 24 image. Multi-stage so the runtime stays minimal.\nFROM node:24-alpine AS deps\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --omit=dev\n\nFROM gcr.io/distroless/nodejs24-debian12\nWORKDIR /app\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY src ./src\nCOPY agent.yaml ./\nENV PORT=8080\nEXPOSE 8080\nCMD [\"src/index.ts\"]\n";
+//#region ../../starters/queues/package.json?raw
+var package_default$3 = "{\n  \"name\": \"starter-queues\",\n  \"version\": \"0.0.1\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"node --watch src/index.ts\",\n    \"start\": \"node src/index.ts\"\n  },\n  \"engines\": {\n    \"node\": \">=24\"\n  },\n  \"dependencies\": {\n    \"@hono/node-server\": \"^1.13.0\",\n    \"@stackbone/sdk\": \"^0.1.0-alpha.1\",\n    \"hono\": \"^4.6.0\"\n  },\n  \"stackbone\": {\n    \"label\": \"Queues (QStash)\",\n    \"hint\": \"Demo of `client.queues` — QStash publisher + signed webhook receiver.\",\n    \"order\": 5,\n    \"category\": \"Capabilities\"\n  }\n}\n";
 //#endregion
-//#region src/templates/autonomous/README.md?raw
-var README_default$2 = "# {{agentName}}\n\nStackbone agent scaffolded by `stackbone init`. The runtime contract is the\nHTTP surface in `src/index.ts`: `/invoke`, `/health`, `/schema`.\n\n## Develop\n\n```sh\npnpm install\npnpm dev          # node --watch src/index.ts\n```\n\n## Deploy\n\n```sh\nstackbone deploy     # builds the image and pushes it to Fly Machines\n```\n\nSee `stackbone docs sdk` for the SDK reference and `stackbone docs cli`\nfor the full command surface.\n";
+//#region ../../starters/rag/package.json?raw
+var package_default$2 = "{\n  \"name\": \"starter-rag\",\n  \"version\": \"0.0.1\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"node --watch src/index.ts\",\n    \"start\": \"node src/index.ts\"\n  },\n  \"engines\": {\n    \"node\": \">=24\"\n  },\n  \"dependencies\": {\n    \"@hono/node-server\": \"^1.13.0\",\n    \"@stackbone/sdk\": \"^0.1.0-alpha.1\",\n    \"hono\": \"^4.6.0\"\n  },\n  \"stackbone\": {\n    \"label\": \"RAG (pgvector)\",\n    \"hint\": \"Demo of `client.rag` — pgvector-backed retrieval-augmented generation.\",\n    \"order\": 2,\n    \"category\": \"Capabilities\"\n  }\n}\n";
 //#endregion
-//#region src/templates/autonomous/package.json?raw
-var package_default$2 = "{\n  \"name\": \"{{agentSlug}}\",\n  \"version\": \"0.0.1\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"node --watch src/index.ts\",\n    \"start\": \"node src/index.ts\"\n  },\n  \"engines\": {\n    \"node\": \">=24\"\n  },\n  \"dependencies\": {\n    \"@hono/node-server\": \"^1.13.0\",\n    \"@stackbone/sdk\": \"^0.0.1\",\n    \"hono\": \"^4.6.0\"\n  }\n}\n";
+//#region ../../starters/secrets/package.json?raw
+var package_default$1 = "{\n  \"name\": \"starter-secrets\",\n  \"version\": \"0.0.1\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"node --watch src/index.ts\",\n    \"start\": \"node src/index.ts\"\n  },\n  \"engines\": {\n    \"node\": \">=24\"\n  },\n  \"dependencies\": {\n    \"@hono/node-server\": \"^1.13.0\",\n    \"@stackbone/sdk\": \"^0.1.0-alpha.1\",\n    \"hono\": \"^4.6.0\"\n  },\n  \"stackbone\": {\n    \"label\": \"Secrets\",\n    \"hint\": \"Demo of `client.secrets` — workspace-scoped encrypted values.\",\n    \"order\": 7,\n    \"category\": \"Capabilities\"\n  }\n}\n";
 //#endregion
-//#region src/templates/autonomous/src/index.ts?raw
-var src_default$2 = "import { serve } from '@hono/node-server';\nimport { Hono } from 'hono';\n\n// MOCK autonomous loop. In MVP this is a real ReAct loop driven by\n// `client.ai.completion` from `@stackbone/sdk`. For POC the agent runs a\n// fixed-iteration loop with two example tools so the contract works and\n// `stackbone dev` has something to invoke.\n\nconst MAX_ITERATIONS = 4;\n\nconst tools = {\n  search: (query: string): string => `mocked search result for \"${query}\"`,\n  summarise: (text: string): string => `summary: ${text.slice(0, 80)}`,\n};\n\ninterface Step {\n  tool: keyof typeof tools;\n  input: string;\n  output: string;\n}\n\nconst runLoop = (goal: string): { goal: string; steps: Step[]; answer: string } => {\n  const steps: Step[] = [];\n  for (let i = 0; i < MAX_ITERATIONS && steps.length < 2; i++) {\n    if (steps.length === 0) {\n      const output = tools.search(goal);\n      steps.push({ tool: 'search', input: goal, output });\n    } else {\n      const lastOutput = steps[steps.length - 1]?.output ?? '';\n      const output = tools.summarise(lastOutput);\n      steps.push({ tool: 'summarise', input: lastOutput, output });\n    }\n  }\n  return {\n    goal,\n    steps,\n    answer: steps[steps.length - 1]?.output ?? 'no steps executed',\n  };\n};\n\nconst app = new Hono();\n\napp.post('/invoke', async (c) => {\n  const body = await c.req.json().catch(() => ({ goal: '' }));\n  return c.json(runLoop(typeof body.goal === 'string' ? body.goal : ''));\n});\n\napp.get('/health', (c) => c.json({ status: 'ok' }));\napp.get('/schema', (c) =>\n  c.json({\n    input: { type: 'object', properties: { goal: { type: 'string' } }, required: ['goal'] },\n    output: {\n      type: 'object',\n      properties: {\n        goal: { type: 'string' },\n        steps: { type: 'array' },\n        answer: { type: 'string' },\n      },\n    },\n  }),\n);\n\nconst port = Number(process.env.PORT ?? 8080);\nserve({ fetch: app.fetch, port });\nconsole.log(`autonomous agent listening on :${port}`);\n";
+//#region ../../starters/storage/package.json?raw
+var package_default = "{\n  \"name\": \"starter-storage\",\n  \"version\": \"0.0.1\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"node --watch src/index.ts\",\n    \"start\": \"node src/index.ts\"\n  },\n  \"engines\": {\n    \"node\": \">=24\"\n  },\n  \"dependencies\": {\n    \"@hono/node-server\": \"^1.13.0\",\n    \"@stackbone/sdk\": \"^0.1.0-alpha.1\",\n    \"hono\": \"^4.6.0\"\n  },\n  \"stackbone\": {\n    \"label\": \"Object storage (S3)\",\n    \"hint\": \"Demo of `client.storage` — S3 / MinIO object storage scoped to the agent.\",\n    \"order\": 4,\n    \"category\": \"Capabilities\"\n  }\n}\n";
 //#endregion
-//#region src/templates/autonomous/src/schema.ts?raw
-var schema_default$2 = "// Drizzle schema for {{agentName}}.\n//\n// Tables declared here are managed by `stackbone db migrate up`. Edit this\n// file, then run `stackbone db migrate create <name>` to emit the next SQL\n// migration under `.stackbone/migrations/`. The first migration shipped with\n// the template (`0000_init.sql`) creates the `examples` table below so the\n// agent has something queryable on its first `stackbone dev` boot.\n//\n// Drizzle column helpers re-export through `@stackbone/sdk/db` — never import\n// from `drizzle-orm/pg-core` directly. The SDK barrel is the single contract\n// the platform supports.\nimport { pgTable, serial, text, timestamp } from '@stackbone/sdk/db';\n\nexport const examples = pgTable('examples', {\n  id: serial('id').primaryKey(),\n  name: text('name').notNull(),\n  createdAt: timestamp('created_at').defaultNow().notNull(),\n});\n";
+//#region ../../starters/ai/.claude/skills/stackbone/SKILL.md?raw
+var SKILL_default$8 = "---\nname: stackbone\ndescription: Use this skill when the user is working with the Stackbone CLI, the `@stackbone/sdk` package, the `agent.yaml` manifest, official templates, or connections to the Stackbone control plane. Triggers on commands like `stackbone init`, `stackbone dev`, `stackbone deploy`, on questions about organization state, exit codes, or environment variables, and on any reference to `@stackbone/*` imports in TypeScript code. Provides the command surface, output contract, exit codes, environment variables and idiomatic workflows.\n---\n\n# Stackbone — agent operating manual\n\nThis skill is regenerated by `stackbone init` / `stackbone link` and ships\ninside the CLI release 0.1.0-alpha.1. Edit the upstream template in\n`apps/cli/src/skills/templates.ts` if something here is wrong.\n\n## CLI surface\n\nThe CLI binary is `stackbone` (also reachable as `npx @stackbone/cli@alpha ...`). Run\n`stackbone docs cli` for the canonical command/flag reference, or\n`stackbone docs sdk` for the `@stackbone/sdk` overview — neither command does\nnetwork IO.\n\n## Output contract\n\nEvery command supports `--json` (or `STACKBONE_JSON=1`). Successful JSON\nresponses look like:\n\n```json\n{ \"schema_version\": 1, \"...\": \"...\" }\n```\n\nErrors look like:\n\n```json\n{\n  \"schema_version\": 1,\n  \"error\": { \"code\": \"auth\", \"message\": \"...\", \"suggestion\": \"Run \\`stackbone login\\`\" },\n  \"exit_code\": 2\n}\n```\n\n`schema_version` only bumps on backward-incompatible shape changes. If you\nsee a different value, refuse to parse and ask the user to upgrade.\n\n## Exit codes\n\n- `0` ok\n- `1` generic\n- `2` auth (no session, expired, refused login)\n- `3` no project linked (no `.stackbone/project.json` in cwd)\n- `4` not found (organization, agent, deployment)\n- `5` permission denied\n\nBranch on these instead of parsing stack traces.\n\n## Environment variables\n\n- `STACKBONE_JSON=1` — same as `--json`\n- `STACKBONE_API_URL` — same as `--api-url <url>`\n- `STACKBONE_AUTO_LOGIN=0` — same as `--no-auto-login`\n- `STACKBONE_LOG_LEVEL` — `debug`, `info`, `warn`, `error` (logger goes\n  to stderr, never pollutes the JSON payload on stdout)\n\n## State on disk\n\n- `<cwd>/.stackbone/project.json` — organization + agent linked to this folder.\n  Created by `stackbone init` / `link`.\n- `~/.stackbone/credentials.json` (chmod 600) — sessions keyed by control\n  plane URL.\n- `~/.stackbone/config.json` — global preferences (default API URL,\n  telemetry opt-in).\n\nThe control plane this skill points at: `https://api.stackbone.ai`.\nActive organization slug: `template1-2`.\n\n## Common workflows\n\n### Authenticate\n\n```sh\nstackbone login            # interactive (device-code flow)\nstackbone whoami           # confirm session\nstackbone metadata --json  # one-shot overview that replaces 5–7 explorer calls\n```\n\n### Start a new project\n\n```sh\nstackbone init             # menu of templates (workflow / autonomous / RAG)\nstackbone dev              # local emulator at http://localhost:4242\n```\n\n### Deploy\n\n```sh\nstackbone deploy           # build + push + Fly Machines\n```\n\n## Anti-patterns\n\n- Do not hardcode organization IDs, credentials or control plane URLs into\n  agent code — the SDK reads them from the environment at runtime.\n- Do not parse human output. Re-run the command with `--json` and use\n  `JSON.parse`.\n- Do not call the control plane HTTP API directly from a creator's agent.\n  Use `@stackbone/sdk` so credential rotation, observability and metering\n  stay correct.\n- Do not commit `.stackbone/` or `~/.stackbone/` — the entries are in the\n  project's `.gitignore` for a reason.\n\n## Where to learn more\n\n- `stackbone docs cli` — command reference\n- `stackbone docs sdk` — `@stackbone/sdk` modules\n- `stackbone docs agent-yaml` — manifest reference (Epic 3)\n- `stackbone docs templates` — official templates (Epic 5)\n- `stackbone docs connections` — data layer (Epic 6)\n";
 //#endregion
-//#region src/templates/hello-world/.stackbone/migrations/0000_init.sql?raw
-var _0000_init_default$1 = "CREATE TABLE \"examples\" (\n	\"id\" serial PRIMARY KEY NOT NULL,\n	\"name\" text NOT NULL,\n	\"created_at\" timestamp DEFAULT now() NOT NULL\n);\n";
+//#region ../../starters/ai/.gitignore?raw
+var _gitignore_raw_default$8 = "# >>> stackbone >>>\n.stackbone/\nnode_modules/\ndist/\n# <<< stackbone <<<\n";
 //#endregion
-//#region src/templates/hello-world/.stackbone/migrations/meta/0000_snapshot.json?raw
-var _0000_snapshot_default$1 = "{\n  \"id\": \"00000000-0000-4000-8000-000000000001\",\n  \"prevId\": \"00000000-0000-0000-0000-000000000000\",\n  \"version\": \"7\",\n  \"dialect\": \"postgresql\",\n  \"tables\": {\n    \"public.examples\": {\n      \"name\": \"examples\",\n      \"schema\": \"\",\n      \"columns\": {\n        \"id\": {\n          \"name\": \"id\",\n          \"type\": \"serial\",\n          \"primaryKey\": true,\n          \"notNull\": true\n        },\n        \"name\": {\n          \"name\": \"name\",\n          \"type\": \"text\",\n          \"primaryKey\": false,\n          \"notNull\": true\n        },\n        \"created_at\": {\n          \"name\": \"created_at\",\n          \"type\": \"timestamp\",\n          \"primaryKey\": false,\n          \"notNull\": true,\n          \"default\": \"now()\"\n        }\n      },\n      \"indexes\": {},\n      \"foreignKeys\": {},\n      \"compositePrimaryKeys\": {},\n      \"uniqueConstraints\": {},\n      \"policies\": {},\n      \"checkConstraints\": {},\n      \"isRLSEnabled\": false\n    }\n  },\n  \"enums\": {},\n  \"schemas\": {},\n  \"sequences\": {},\n  \"roles\": {},\n  \"policies\": {},\n  \"views\": {},\n  \"_meta\": {\n    \"columns\": {},\n    \"schemas\": {},\n    \"tables\": {}\n  }\n}\n";
+//#region ../../starters/ai/Dockerfile?raw
+var Dockerfile_raw_default$9 = "# Distroless Node 24 image. Multi-stage so the runtime stays minimal.\nFROM node:24-alpine AS deps\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --omit=dev\n\nFROM gcr.io/distroless/nodejs24-debian12\nWORKDIR /app\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY src ./src\nCOPY agent.yaml ./\nENV PORT=8080\nEXPOSE 8080\nCMD [\"src/index.ts\"]\n";
 //#endregion
-//#region src/templates/hello-world/.stackbone/migrations/meta/_journal.json?raw
-var _journal_default$1 = "{\n  \"version\": \"7\",\n  \"dialect\": \"postgresql\",\n  \"entries\": [\n    {\n      \"idx\": 0,\n      \"version\": \"7\",\n      \"when\": 1778889700000,\n      \"tag\": \"0000_init\",\n      \"breakpoints\": true\n    }\n  ]\n}\n";
+//#region ../../starters/ai/README.md?raw
+var README_default$9 = "# starter-ai\n\nDemo of `client.ai` (chat completions, embeddings, models) from `@stackbone/sdk`.\n\n`client.ai` proxies the OpenAI SDK against OpenRouter, so any model id\n(`openai/gpt-4o-mini`, `anthropic/claude-3.5-sonnet`, …) works.\n\n## Layout\n\n```\nsrc/\n  index.ts                      # Hono server, mounts routes, logs every request\n  lib/\n    client.ts                   # Shared Stackbone client\n    logger.ts                   # JSON line logger\n  routes/\n    health.ts                   # GET  /health\n    schema-info.ts              # GET  /schema\n    invoke.ts                   # POST /invoke      -> chat completion\n    embeddings.ts               # POST /embeddings  -> create embedding(s)\n    models.ts                   # GET  /models      -> list available models\n```\n\n## Run\n\n```sh\nnpm install\nstackbone dev\n```\n\nThen:\n\n```sh\ncurl http://127.0.0.1:8080/health\ncurl -X POST http://127.0.0.1:8080/invoke -H 'content-type: application/json' \\\n  -d '{\"prompt\":\"Say hi in one short sentence.\"}'\ncurl -X POST http://127.0.0.1:8080/embeddings -H 'content-type: application/json' \\\n  -d '{\"input\":\"the quick brown fox\"}'\ncurl http://127.0.0.1:8080/models\n```\n\nRequires `OPENROUTER_API_KEY` (or whichever upstream env the SDK falls back to)\nin the agent environment.\n";
 //#endregion
-//#region src/templates/hello-world/Dockerfile?raw
-var Dockerfile_raw_default$1 = "# Distroless Node 24 image. Multi-stage so the runtime stays minimal.\nFROM node:24-alpine AS deps\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --omit=dev\n\nFROM gcr.io/distroless/nodejs24-debian12\nWORKDIR /app\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY src ./src\nCOPY agent.yaml ./\nENV PORT=8080\nEXPOSE 8080\nCMD [\"src/index.ts\"]\n";
+//#region ../../starters/ai/agent.yaml?raw
+var agent_default$9 = "# Stackbone agent manifest. Schema: stackbone.ai/v1.\n# Run `stackbone docs agent-yaml` for the full reference.\n\napiVersion: stackbone.ai/v1\nname: starter-ai\nruntime:\n  engine: node\n  entry: src/index.ts\ndatabase:\n  schema: ./src/schema.ts\n  migrations: ./.stackbone/migrations\ndev:\n  autoMigrate: false\nrag:\n  embeddingModel: openai/text-embedding-3-small\n  autoMigrate: false\n";
+//#endregion
+//#region ../../starters/ai/src/index.ts?raw
+var src_default$9 = "import { serve } from '@hono/node-server';\nimport { Hono } from 'hono';\n\nimport { log } from './lib/logger.ts';\nimport embeddings from './routes/embeddings.ts';\nimport health from './routes/health.ts';\nimport invoke from './routes/invoke.ts';\nimport models from './routes/models.ts';\nimport schemaInfo from './routes/schema-info.ts';\n\nconst app = new Hono();\n\napp.use('*', async (c, next) => {\n  const start = Date.now();\n  await next();\n  log('info', 'request', {\n    method: c.req.method,\n    path: c.req.path,\n    status: c.res.status,\n    durationMs: Date.now() - start,\n  });\n});\n\napp.route('/', health);\napp.route('/', schemaInfo);\napp.route('/', invoke);\napp.route('/', embeddings);\napp.route('/', models);\n\nconst port = Number(process.env.PORT ?? 8080);\nserve({ fetch: app.fetch, port });\nlog('info', 'starter-ai listening', { port });\n";
+//#endregion
+//#region ../../starters/ai/src/lib/client.ts?raw
+var client_default$8 = "import { createClient } from '@stackbone/sdk';\n\nexport const client = createClient({\n  stackboneApiUrl: process.env.STACKBONE_DEV_API_URL ?? 'http://127.0.0.1:4242',\n});\n";
+//#endregion
+//#region ../../starters/ai/src/lib/logger.ts?raw
+var logger_default$8 = "type Level = 'info' | 'warn' | 'error';\n\nexport function log(level: Level, msg: string, fields?: Record<string, unknown>): void {\n  const line = JSON.stringify({ ts: new Date().toISOString(), level, msg, ...fields });\n  if (level === 'error') console.error(line);\n  else console.log(line);\n}\n";
+//#endregion
+//#region ../../starters/ai/src/routes/embeddings.ts?raw
+var embeddings_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.post('/embeddings', async (c) => {\n  const body = await c.req.json().catch(() => ({}) as { input?: string | string[]; model?: string });\n  const input = body.input ?? '';\n  const model = typeof body.model === 'string' ? body.model : 'openai/text-embedding-3-small';\n\n  log('info', 'embeddings', { model, count: Array.isArray(input) ? input.length : 1 });\n\n  const result = await client.ai.embeddings.create({ model, input });\n\n  if (result.error) {\n    log('error', 'embeddings failed', { code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  const vectors = result.data.data.map((d) => ({ index: d.index, dimensions: d.embedding.length }));\n  log('info', 'embeddings done', { model, vectors: vectors.length });\n  return c.json({ model, vectors });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/ai/src/routes/health.ts?raw
+var health_default$8 = "import { Hono } from 'hono';\n\nconst route = new Hono();\nroute.get('/health', (c) => c.json({ status: 'ok' }));\nexport default route;\n";
+//#endregion
+//#region ../../starters/ai/src/routes/invoke.ts?raw
+var invoke_default$8 = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.post('/invoke', async (c) => {\n  const body = await c.req.json().catch(() => ({}) as { prompt?: string; model?: string });\n  const prompt = typeof body.prompt === 'string' ? body.prompt : 'Say hi in one short sentence.';\n  const model = typeof body.model === 'string' ? body.model : 'openai/gpt-4o-mini';\n\n  log('info', 'invoke', { model, prompt });\n\n  const result = await client.ai.chat.completions.create({\n    model,\n    messages: [{ role: 'user', content: prompt }],\n  });\n\n  if (result.error) {\n    log('error', 'chat completion failed', { code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  const reply = result.data.choices[0]?.message?.content ?? '';\n  log('info', 'invoke reply', { model, length: reply.length });\n  return c.json({ reply, model });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/ai/src/routes/models.ts?raw
+var models_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.get('/models', async (c) => {\n  log('info', 'list models');\n\n  const result = await client.ai.models.list();\n  if (result.error) {\n    log('error', 'list models failed', { code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  const ids = result.data.data.slice(0, 50).map((m) => m.id);\n  log('info', 'list models done', { total: result.data.data.length, returned: ids.length });\n  return c.json({ total: result.data.data.length, ids });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/ai/src/routes/schema-info.ts?raw
+var schema_info_default$8 = "import { Hono } from 'hono';\n\nconst route = new Hono();\n\nroute.get('/schema', (c) =>\n  c.json({\n    input: {\n      type: 'object',\n      properties: {\n        prompt: { type: 'string' },\n        model: { type: 'string' },\n      },\n      required: ['prompt'],\n    },\n    output: {\n      type: 'object',\n      properties: {\n        reply: { type: 'string' },\n        model: { type: 'string' },\n      },\n    },\n  }),\n);\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/config/.claude/skills/stackbone/SKILL.md?raw
+var SKILL_default$7 = "---\nname: stackbone\ndescription: Use this skill when the user is working with the Stackbone CLI, the `@stackbone/sdk` package, the `agent.yaml` manifest, official templates, or connections to the Stackbone control plane. Triggers on commands like `stackbone init`, `stackbone dev`, `stackbone deploy`, on questions about organization state, exit codes, or environment variables, and on any reference to `@stackbone/*` imports in TypeScript code. Provides the command surface, output contract, exit codes, environment variables and idiomatic workflows.\n---\n\n# Stackbone — agent operating manual\n\nThis skill is regenerated by `stackbone init` / `stackbone link` and ships\ninside the CLI release 0.1.0-alpha.1. Edit the upstream template in\n`apps/cli/src/skills/templates.ts` if something here is wrong.\n\n## CLI surface\n\nThe CLI binary is `stackbone` (also reachable as `npx @stackbone/cli@alpha ...`). Run\n`stackbone docs cli` for the canonical command/flag reference, or\n`stackbone docs sdk` for the `@stackbone/sdk` overview — neither command does\nnetwork IO.\n\n## Output contract\n\nEvery command supports `--json` (or `STACKBONE_JSON=1`). Successful JSON\nresponses look like:\n\n```json\n{ \"schema_version\": 1, \"...\": \"...\" }\n```\n\nErrors look like:\n\n```json\n{\n  \"schema_version\": 1,\n  \"error\": { \"code\": \"auth\", \"message\": \"...\", \"suggestion\": \"Run \\`stackbone login\\`\" },\n  \"exit_code\": 2\n}\n```\n\n`schema_version` only bumps on backward-incompatible shape changes. If you\nsee a different value, refuse to parse and ask the user to upgrade.\n\n## Exit codes\n\n- `0` ok\n- `1` generic\n- `2` auth (no session, expired, refused login)\n- `3` no project linked (no `.stackbone/project.json` in cwd)\n- `4` not found (organization, agent, deployment)\n- `5` permission denied\n\nBranch on these instead of parsing stack traces.\n\n## Environment variables\n\n- `STACKBONE_JSON=1` — same as `--json`\n- `STACKBONE_API_URL` — same as `--api-url <url>`\n- `STACKBONE_AUTO_LOGIN=0` — same as `--no-auto-login`\n- `STACKBONE_LOG_LEVEL` — `debug`, `info`, `warn`, `error` (logger goes\n  to stderr, never pollutes the JSON payload on stdout)\n\n## State on disk\n\n- `<cwd>/.stackbone/project.json` — organization + agent linked to this folder.\n  Created by `stackbone init` / `link`.\n- `~/.stackbone/credentials.json` (chmod 600) — sessions keyed by control\n  plane URL.\n- `~/.stackbone/config.json` — global preferences (default API URL,\n  telemetry opt-in).\n\nThe control plane this skill points at: `https://api.stackbone.ai`.\nActive organization slug: `template1-2`.\n\n## Common workflows\n\n### Authenticate\n\n```sh\nstackbone login            # interactive (device-code flow)\nstackbone whoami           # confirm session\nstackbone metadata --json  # one-shot overview that replaces 5–7 explorer calls\n```\n\n### Start a new project\n\n```sh\nstackbone init             # menu of templates (workflow / autonomous / RAG)\nstackbone dev              # local emulator at http://localhost:4242\n```\n\n### Deploy\n\n```sh\nstackbone deploy           # build + push + Fly Machines\n```\n\n## Anti-patterns\n\n- Do not hardcode organization IDs, credentials or control plane URLs into\n  agent code — the SDK reads them from the environment at runtime.\n- Do not parse human output. Re-run the command with `--json` and use\n  `JSON.parse`.\n- Do not call the control plane HTTP API directly from a creator's agent.\n  Use `@stackbone/sdk` so credential rotation, observability and metering\n  stay correct.\n- Do not commit `.stackbone/` or `~/.stackbone/` — the entries are in the\n  project's `.gitignore` for a reason.\n\n## Where to learn more\n\n- `stackbone docs cli` — command reference\n- `stackbone docs sdk` — `@stackbone/sdk` modules\n- `stackbone docs agent-yaml` — manifest reference (Epic 3)\n- `stackbone docs templates` — official templates (Epic 5)\n- `stackbone docs connections` — data layer (Epic 6)\n";
+//#endregion
+//#region ../../starters/config/.gitignore?raw
+var _gitignore_raw_default$7 = "# >>> stackbone >>>\n.stackbone/\nnode_modules/\ndist/\n# <<< stackbone <<<\n";
+//#endregion
+//#region ../../starters/config/Dockerfile?raw
+var Dockerfile_raw_default$8 = "# Distroless Node 24 image. Multi-stage so the runtime stays minimal.\nFROM node:24-alpine AS deps\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --omit=dev\n\nFROM gcr.io/distroless/nodejs24-debian12\nWORKDIR /app\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY src ./src\nCOPY agent.yaml ./\nENV PORT=8080\nEXPOSE 8080\nCMD [\"src/index.ts\"]\n";
+//#endregion
+//#region ../../starters/config/README.md?raw
+var README_default$8 = "# starter-config\n\nDemo of `client.config` (runtime config injected via `AGENT_CONFIG`) from\n`@stackbone/sdk`.\n\n## Layout\n\n```\nsrc/\n  index.ts                      # Hono server\n  lib/\n    client.ts                   # Shared Stackbone client\n    logger.ts                   # JSON line logger\n  routes/\n    health.ts                   # GET  /health\n    schema-info.ts              # GET  /schema\n    invoke.ts                   # POST /invoke      -> get one key (soft-miss on absence)\n    get-config.ts               # GET  /config/:key\n    get-many.ts                 # POST /config/bulk -> { values: { key: any } }\n```\n\n## Run\n\n```sh\nnpm install\nstackbone dev\n```\n\nThen:\n\n```sh\ncurl -X POST http://127.0.0.1:8080/invoke -H 'content-type: application/json' \\\n  -d '{\"key\":\"feature_flags.new_ui\"}'\ncurl http://127.0.0.1:8080/config/api.timeout_ms\ncurl -X POST http://127.0.0.1:8080/config/bulk -H 'content-type: application/json' \\\n  -d '{\"keys\":[\"api.timeout_ms\",\"feature_flags.new_ui\"]}'\n```\n";
+//#endregion
+//#region ../../starters/config/agent.yaml?raw
+var agent_default$8 = "# Stackbone agent manifest. Schema: stackbone.ai/v1.\n# Run `stackbone docs agent-yaml` for the full reference.\n\napiVersion: stackbone.ai/v1\nname: starter-config\nruntime:\n  engine: node\n  entry: src/index.ts\ndatabase:\n  schema: ./src/schema.ts\n  migrations: ./.stackbone/migrations\ndev:\n  autoMigrate: false\nrag:\n  embeddingModel: openai/text-embedding-3-small\n  autoMigrate: false\n";
+//#endregion
+//#region ../../starters/config/src/index.ts?raw
+var src_default$8 = "import { serve } from '@hono/node-server';\nimport { Hono } from 'hono';\n\nimport { log } from './lib/logger.ts';\nimport getConfig from './routes/get-config.ts';\nimport getMany from './routes/get-many.ts';\nimport health from './routes/health.ts';\nimport invoke from './routes/invoke.ts';\nimport schemaInfo from './routes/schema-info.ts';\n\nconst app = new Hono();\n\napp.use('*', async (c, next) => {\n  const start = Date.now();\n  await next();\n  log('info', 'request', {\n    method: c.req.method,\n    path: c.req.path,\n    status: c.res.status,\n    durationMs: Date.now() - start,\n  });\n});\n\napp.route('/', health);\napp.route('/', schemaInfo);\napp.route('/', invoke);\napp.route('/', getConfig);\napp.route('/', getMany);\n\nconst port = Number(process.env.PORT ?? 8080);\nserve({ fetch: app.fetch, port });\nlog('info', 'starter-config listening', { port });\n";
+//#endregion
+//#region ../../starters/config/src/lib/client.ts?raw
+var client_default$7 = "import { createClient } from '@stackbone/sdk';\n\nexport const client = createClient({\n  stackboneApiUrl: process.env.STACKBONE_DEV_API_URL ?? 'http://127.0.0.1:4242',\n});\n";
+//#endregion
+//#region ../../starters/config/src/lib/logger.ts?raw
+var logger_default$7 = "type Level = 'info' | 'warn' | 'error';\n\nexport function log(level: Level, msg: string, fields?: Record<string, unknown>): void {\n  const line = JSON.stringify({ ts: new Date().toISOString(), level, msg, ...fields });\n  if (level === 'error') console.error(line);\n  else console.log(line);\n}\n";
+//#endregion
+//#region ../../starters/config/src/routes/get-config.ts?raw
+var get_config_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.get('/config/:key', async (c) => {\n  const key = c.req.param('key');\n  log('info', 'fetch config', { key });\n\n  const result = await client.config.get(key);\n  if (result.error) {\n    log('error', 'fetch config failed', { key, code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  return c.json({ key, value: result.data });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/config/src/routes/get-many.ts?raw
+var get_many_default$1 = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.post('/config/bulk', async (c) => {\n  const body = await c.req.json().catch(() => ({}) as { keys?: string[] });\n  const keys = Array.isArray(body.keys) ? body.keys : [];\n  if (keys.length === 0) return c.json({ error: 'missing keys[]' }, 400);\n\n  log('info', 'config bulk', { count: keys.length });\n\n  const result = await client.config.getMany(keys);\n  if (result.error) {\n    log('error', 'config bulk failed', { code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'config bulk done', { resolved: Object.keys(result.data).length });\n  return c.json({ values: result.data });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/config/src/routes/health.ts?raw
+var health_default$7 = "import { Hono } from 'hono';\n\nconst route = new Hono();\nroute.get('/health', (c) => c.json({ status: 'ok' }));\nexport default route;\n";
+//#endregion
+//#region ../../starters/config/src/routes/invoke.ts?raw
+var invoke_default$7 = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.post('/invoke', async (c) => {\n  const body = await c.req.json().catch(() => ({}) as { key?: string });\n  const key = typeof body.key === 'string' ? body.key : '';\n  if (!key) return c.json({ error: 'missing key' }, 400);\n\n  log('info', 'config get', { key });\n  const result = await client.config.get(key);\n\n  if (result.error) {\n    log('warn', 'config miss', { key, code: result.error.code });\n    return c.json({ key, value: null, code: result.error.code });\n  }\n\n  log('info', 'config hit', { key });\n  return c.json({ key, value: result.data });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/config/src/routes/schema-info.ts?raw
+var schema_info_default$7 = "import { Hono } from 'hono';\n\nconst route = new Hono();\n\nroute.get('/schema', (c) =>\n  c.json({\n    input: { type: 'object', properties: { key: { type: 'string' } }, required: ['key'] },\n    output: { type: 'object', properties: { key: { type: 'string' }, value: {} } },\n  }),\n);\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/db/.claude/skills/stackbone/SKILL.md?raw
+var SKILL_default$6 = "---\nname: stackbone\ndescription: Use this skill when the user is working with the Stackbone CLI, the `@stackbone/sdk` package, the `agent.yaml` manifest, official templates, or connections to the Stackbone control plane. Triggers on commands like `stackbone init`, `stackbone dev`, `stackbone deploy`, on questions about organization state, exit codes, or environment variables, and on any reference to `@stackbone/*` imports in TypeScript code. Provides the command surface, output contract, exit codes, environment variables and idiomatic workflows.\n---\n\n# Stackbone — agent operating manual\n\nThis skill is regenerated by `stackbone init` / `stackbone link` and ships\ninside the CLI release 0.1.0-alpha.1. Edit the upstream template in\n`apps/cli/src/skills/templates.ts` if something here is wrong.\n\n## CLI surface\n\nThe CLI binary is `stackbone` (also reachable as `npx @stackbone/cli@alpha ...`). Run\n`stackbone docs cli` for the canonical command/flag reference, or\n`stackbone docs sdk` for the `@stackbone/sdk` overview — neither command does\nnetwork IO.\n\n## Output contract\n\nEvery command supports `--json` (or `STACKBONE_JSON=1`). Successful JSON\nresponses look like:\n\n```json\n{ \"schema_version\": 1, \"...\": \"...\" }\n```\n\nErrors look like:\n\n```json\n{\n  \"schema_version\": 1,\n  \"error\": { \"code\": \"auth\", \"message\": \"...\", \"suggestion\": \"Run \\`stackbone login\\`\" },\n  \"exit_code\": 2\n}\n```\n\n`schema_version` only bumps on backward-incompatible shape changes. If you\nsee a different value, refuse to parse and ask the user to upgrade.\n\n## Exit codes\n\n- `0` ok\n- `1` generic\n- `2` auth (no session, expired, refused login)\n- `3` no project linked (no `.stackbone/project.json` in cwd)\n- `4` not found (organization, agent, deployment)\n- `5` permission denied\n\nBranch on these instead of parsing stack traces.\n\n## Environment variables\n\n- `STACKBONE_JSON=1` — same as `--json`\n- `STACKBONE_API_URL` — same as `--api-url <url>`\n- `STACKBONE_AUTO_LOGIN=0` — same as `--no-auto-login`\n- `STACKBONE_LOG_LEVEL` — `debug`, `info`, `warn`, `error` (logger goes\n  to stderr, never pollutes the JSON payload on stdout)\n\n## State on disk\n\n- `<cwd>/.stackbone/project.json` — organization + agent linked to this folder.\n  Created by `stackbone init` / `link`.\n- `~/.stackbone/credentials.json` (chmod 600) — sessions keyed by control\n  plane URL.\n- `~/.stackbone/config.json` — global preferences (default API URL,\n  telemetry opt-in).\n\nThe control plane this skill points at: `https://api.stackbone.ai`.\nActive organization slug: `template1-2`.\n\n## Common workflows\n\n### Authenticate\n\n```sh\nstackbone login            # interactive (device-code flow)\nstackbone whoami           # confirm session\nstackbone metadata --json  # one-shot overview that replaces 5–7 explorer calls\n```\n\n### Start a new project\n\n```sh\nstackbone init             # menu of templates (workflow / autonomous / RAG)\nstackbone dev              # local emulator at http://localhost:4242\n```\n\n### Deploy\n\n```sh\nstackbone deploy           # build + push + Fly Machines\n```\n\n## Anti-patterns\n\n- Do not hardcode organization IDs, credentials or control plane URLs into\n  agent code — the SDK reads them from the environment at runtime.\n- Do not parse human output. Re-run the command with `--json` and use\n  `JSON.parse`.\n- Do not call the control plane HTTP API directly from a creator's agent.\n  Use `@stackbone/sdk` so credential rotation, observability and metering\n  stay correct.\n- Do not commit `.stackbone/` or `~/.stackbone/` — the entries are in the\n  project's `.gitignore` for a reason.\n\n## Where to learn more\n\n- `stackbone docs cli` — command reference\n- `stackbone docs sdk` — `@stackbone/sdk` modules\n- `stackbone docs agent-yaml` — manifest reference (Epic 3)\n- `stackbone docs templates` — official templates (Epic 5)\n- `stackbone docs connections` — data layer (Epic 6)\n";
+//#endregion
+//#region ../../starters/db/.gitignore?raw
+var _gitignore_raw_default$6 = "# >>> stackbone >>>\n.stackbone/\nnode_modules/\ndist/\n# <<< stackbone <<<\n";
+//#endregion
+//#region ../../starters/db/Dockerfile?raw
+var Dockerfile_raw_default$7 = "# Distroless Node 24 image. Multi-stage so the runtime stays minimal.\nFROM node:24-alpine AS deps\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --omit=dev\n\nFROM gcr.io/distroless/nodejs24-debian12\nWORKDIR /app\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY src ./src\nCOPY agent.yaml ./\nENV PORT=8080\nEXPOSE 8080\nCMD [\"src/index.ts\"]\n";
+//#endregion
+//#region ../../starters/db/README.md?raw
+var README_default$7 = "# starter-db\n\nDemo of `client.database` (Drizzle + Postgres) from `@stackbone/sdk`.\n\n## Layout\n\n```\nsrc/\n  index.ts                      # Hono server, mounts routes, logs every request\n  schema.ts                     # Drizzle table definitions\n  lib/\n    client.ts                   # Shared Stackbone client\n    logger.ts                   # JSON line logger (captured by stackbone dev)\n  routes/\n    health.ts                   # GET /health\n    schema-info.ts              # GET /schema\n    invoke.ts                   # POST /invoke    -> insert example\n    list-examples.ts            # GET /examples   -> list latest 20\n    delete-example.ts           # DELETE /examples/:id\n```\n\n## Run\n\n```sh\nnpm install\nstackbone dev\n```\n\nThen:\n\n```sh\ncurl http://127.0.0.1:8080/health\ncurl -X POST http://127.0.0.1:8080/invoke -d '{\"name\":\"luis\"}' -H 'content-type: application/json'\ncurl http://127.0.0.1:8080/examples\ncurl -X DELETE http://127.0.0.1:8080/examples/1\n```\n";
+//#endregion
+//#region ../../starters/db/agent.yaml?raw
+var agent_default$7 = "# Stackbone agent manifest. Schema: stackbone.ai/v1.\n# Run `stackbone docs agent-yaml` for the full reference.\n\napiVersion: stackbone.ai/v1\nname: starter-db\nruntime:\n  engine: node\n  entry: src/index.ts\ndatabase:\n  schema: ./src/schema.ts\n  migrations: ./.stackbone/migrations\ndev:\n  autoMigrate: false\nrag:\n  embeddingModel: openai/text-embedding-3-small\n  autoMigrate: false\n";
+//#endregion
+//#region ../../starters/db/src/index.ts?raw
+var src_default$7 = "import { serve } from '@hono/node-server';\nimport { Hono } from 'hono';\n\nimport { log } from './lib/logger.ts';\nimport deleteExample from './routes/delete-example.ts';\nimport health from './routes/health.ts';\nimport invoke from './routes/invoke.ts';\nimport listExamples from './routes/list-examples.ts';\nimport schemaInfo from './routes/schema-info.ts';\n\nconst app = new Hono();\n\napp.use('*', async (c, next) => {\n  const start = Date.now();\n  await next();\n  log('info', 'request', {\n    method: c.req.method,\n    path: c.req.path,\n    status: c.res.status,\n    durationMs: Date.now() - start,\n  });\n});\n\napp.route('/', health);\napp.route('/', schemaInfo);\napp.route('/', invoke);\napp.route('/', listExamples);\napp.route('/', deleteExample);\n\nconst port = Number(process.env.PORT ?? 8080);\nserve({ fetch: app.fetch, port });\nlog('info', 'starter-db listening', { port });\n";
+//#endregion
+//#region ../../starters/db/src/lib/client.ts?raw
+var client_default$6 = "import { createClient } from '@stackbone/sdk';\n\n// Shared Stackbone client. Every route imports it from here so we open one\n// pool against STACKBONE_POSTGRES_URL and reuse the same datapath handle.\nexport const client = createClient({\n  stackboneApiUrl: process.env.STACKBONE_DEV_API_URL ?? 'http://127.0.0.1:4242',\n});\n";
 //#endregion
-//#region src/templates/hello-world/README.md?raw
-var README_default$1 = "# {{agentName}}\n\nStackbone agent scaffolded by `stackbone init`. The runtime contract is the\nHTTP surface in `src/index.ts`: `/invoke`, `/health`, `/schema`.\n\n## Develop\n\n```sh\npnpm install\npnpm dev          # node --watch src/index.ts\n```\n\n## Deploy\n\n```sh\nstackbone deploy     # builds the image and pushes it to Fly Machines\n```\n\nSee `stackbone docs sdk` for the SDK reference and `stackbone docs cli`\nfor the full command surface.\n";
+//#region ../../starters/db/src/lib/logger.ts?raw
+var logger_default$6 = "// Minimal JSON logger. Every line is captured by `stackbone dev` and surfaced\n// in Stackbone Studio. Keep one log per route entry/exit so traces are easy\n// to follow.\n\ntype Level = 'info' | 'warn' | 'error';\n\nexport function log(level: Level, msg: string, fields?: Record<string, unknown>): void {\n  const record = { ts: new Date().toISOString(), level, msg, ...fields };\n  const line = JSON.stringify(record);\n  if (level === 'error') console.error(line);\n  else console.log(line);\n}\n";
 //#endregion
-//#region src/templates/hello-world/package.json?raw
-var package_default$1 = "{\n  \"name\": \"{{agentSlug}}\",\n  \"version\": \"0.0.1\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"node --watch src/index.ts\",\n    \"start\": \"node src/index.ts\"\n  },\n  \"engines\": {\n    \"node\": \">=24\"\n  },\n  \"dependencies\": {\n    \"@hono/node-server\": \"^1.13.0\",\n    \"@stackbone/sdk\": \"^0.0.1\",\n    \"hono\": \"^4.6.0\"\n  }\n}\n";
+//#region ../../starters/db/src/routes/delete-example.ts?raw
+var delete_example_default = "import { eq } from '@stackbone/sdk/db';\nimport { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\nimport { examples } from '../schema.ts';\n\nconst route = new Hono();\n\nroute.delete('/examples/:id', async (c) => {\n  const id = Number(c.req.param('id'));\n  if (!Number.isInteger(id)) {\n    log('warn', 'delete example: invalid id', { id: c.req.param('id') });\n    return c.json({ error: 'invalid id' }, 400);\n  }\n\n  log('info', 'delete example', { id });\n  const deleted = await client.database\n    .delete(examples)\n    .where(eq(examples.id, id))\n    .returning();\n\n  return c.json({ deleted });\n});\n\nexport default route;\n";
 //#endregion
-//#region src/templates/hello-world/src/index.ts?raw
-var src_default$1 = "import { serve } from '@hono/node-server';\nimport { Hono } from 'hono';\n\nconst app = new Hono();\n\napp.post('/invoke', async (c) => {\n  const body = await c.req.json().catch(() => ({}));\n  return c.json({ hello: body.who ?? 'world' });\n});\n\napp.get('/health', (c) => c.json({ status: 'ok' }));\n\napp.get('/schema', (c) =>\n  c.json({\n    input: { type: 'object', properties: { who: { type: 'string' } } },\n    output: { type: 'object', properties: { hello: { type: 'string' } } },\n  }),\n);\n\nconst port = Number(process.env.PORT ?? 8080);\nserve({ fetch: app.fetch, port });\nconsole.log(`hello-world agent listening on :${port}`);\n";
+//#region ../../starters/db/src/routes/health.ts?raw
+var health_default$6 = "import { Hono } from 'hono';\n\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.get('/health', (c) => {\n  log('info', 'health check');\n  return c.json({ status: 'ok' });\n});\n\nexport default route;\n";
 //#endregion
-//#region src/templates/hello-world/src/schema.ts?raw
-var schema_default$1 = "// Drizzle schema for {{agentName}}.\n//\n// Tables declared here are managed by `stackbone db migrate up`. Edit this\n// file, then run `stackbone db migrate create <name>` to emit the next SQL\n// migration under `.stackbone/migrations/`. The first migration shipped with\n// the template (`0000_init.sql`) creates the `examples` table below so the\n// agent has something queryable on its first `stackbone dev` boot.\n//\n// Drizzle column helpers re-export through `@stackbone/sdk/db` — never import\n// from `drizzle-orm/pg-core` directly. The SDK barrel is the single contract\n// the platform supports.\nimport { pgTable, serial, text, timestamp } from '@stackbone/sdk/db';\n\nexport const examples = pgTable('examples', {\n  id: serial('id').primaryKey(),\n  name: text('name').notNull(),\n  createdAt: timestamp('created_at').defaultNow().notNull(),\n});\n";
+//#region ../../starters/db/src/routes/invoke.ts?raw
+var invoke_default$6 = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\nimport { examples } from '../schema.ts';\n\nconst route = new Hono();\n\nroute.post('/invoke', async (c) => {\n  const body = await c.req.json().catch(() => ({}) as { name?: string });\n  const name = typeof body.name === 'string' ? body.name : 'anonymous';\n\n  log('info', 'invoke received', { name });\n  const [row] = await client.database.insert(examples).values({ name }).returning();\n  log('info', 'invoke inserted', { id: row?.id, name });\n\n  return c.json({ inserted: row });\n});\n\nexport default route;\n";
 //#endregion
-//#region src/templates/workflow/.stackbone/migrations/0000_init.sql?raw
+//#region ../../starters/db/src/routes/list-examples.ts?raw
+var list_examples_default = "import { desc } from '@stackbone/sdk/db';\nimport { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\nimport { examples } from '../schema.ts';\n\nconst route = new Hono();\n\nroute.get('/examples', async (c) => {\n  const limit = Number(c.req.query('limit') ?? 20);\n  log('info', 'list examples', { limit });\n\n  const rows = await client.database\n    .select()\n    .from(examples)\n    .orderBy(desc(examples.id))\n    .limit(limit);\n\n  return c.json({ rows });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/db/src/routes/schema-info.ts?raw
+var schema_info_default$6 = "import { Hono } from 'hono';\n\nconst route = new Hono();\n\nroute.get('/schema', (c) =>\n  c.json({\n    input: {\n      type: 'object',\n      properties: { name: { type: 'string' } },\n      required: ['name'],\n    },\n    output: {\n      type: 'object',\n      properties: {\n        id: { type: 'number' },\n        name: { type: 'string' },\n        createdAt: { type: 'string' },\n      },\n    },\n  }),\n);\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/db/src/schema.ts?raw
+var schema_default$1 = "// Drizzle schema for template1.\n//\n// Tables declared here are managed by `stackbone db migrate up`. Edit this\n// file, then run `stackbone db migrate create <name>` to emit the next SQL\n// migration under `.stackbone/migrations/`. The first migration shipped with\n// the template (`0000_init.sql`) creates the `examples` table below so the\n// agent has something queryable on its first `stackbone dev` boot.\n//\n// Drizzle column helpers re-export through `@stackbone/sdk/db` — never import\n// from `drizzle-orm/pg-core` directly. The SDK barrel is the single contract\n// the platform supports.\nimport { pgTable, serial, text, timestamp } from '@stackbone/sdk/db';\n\nexport const examples = pgTable('examples', {\n  id: serial('id').primaryKey(),\n  name: text('name').notNull(),\n  createdAt: timestamp('created_at').defaultNow().notNull(),\n});\n";
+//#endregion
+//#region ../../starters/hello-world/.stackbone/migrations/0000_init.sql?raw
 var _0000_init_default = "CREATE TABLE \"examples\" (\n	\"id\" serial PRIMARY KEY NOT NULL,\n	\"name\" text NOT NULL,\n	\"created_at\" timestamp DEFAULT now() NOT NULL\n);\n";
 //#endregion
-//#region src/templates/workflow/.stackbone/migrations/meta/0000_snapshot.json?raw
+//#region ../../starters/hello-world/.stackbone/migrations/meta/0000_snapshot.json?raw
 var _0000_snapshot_default = "{\n  \"id\": \"00000000-0000-4000-8000-000000000001\",\n  \"prevId\": \"00000000-0000-0000-0000-000000000000\",\n  \"version\": \"7\",\n  \"dialect\": \"postgresql\",\n  \"tables\": {\n    \"public.examples\": {\n      \"name\": \"examples\",\n      \"schema\": \"\",\n      \"columns\": {\n        \"id\": {\n          \"name\": \"id\",\n          \"type\": \"serial\",\n          \"primaryKey\": true,\n          \"notNull\": true\n        },\n        \"name\": {\n          \"name\": \"name\",\n          \"type\": \"text\",\n          \"primaryKey\": false,\n          \"notNull\": true\n        },\n        \"created_at\": {\n          \"name\": \"created_at\",\n          \"type\": \"timestamp\",\n          \"primaryKey\": false,\n          \"notNull\": true,\n          \"default\": \"now()\"\n        }\n      },\n      \"indexes\": {},\n      \"foreignKeys\": {},\n      \"compositePrimaryKeys\": {},\n      \"uniqueConstraints\": {},\n      \"policies\": {},\n      \"checkConstraints\": {},\n      \"isRLSEnabled\": false\n    }\n  },\n  \"enums\": {},\n  \"schemas\": {},\n  \"sequences\": {},\n  \"roles\": {},\n  \"policies\": {},\n  \"views\": {},\n  \"_meta\": {\n    \"columns\": {},\n    \"schemas\": {},\n    \"tables\": {}\n  }\n}\n";
 //#endregion
-//#region src/templates/workflow/.stackbone/migrations/meta/_journal.json?raw
+//#region ../../starters/hello-world/.stackbone/migrations/meta/_journal.json?raw
 var _journal_default = "{\n  \"version\": \"7\",\n  \"dialect\": \"postgresql\",\n  \"entries\": [\n    {\n      \"idx\": 0,\n      \"version\": \"7\",\n      \"when\": 1778889700000,\n      \"tag\": \"0000_init\",\n      \"breakpoints\": true\n    }\n  ]\n}\n";
 //#endregion
-//#region src/templates/workflow/Dockerfile?raw
+//#region ../../starters/hello-world/Dockerfile?raw
+var Dockerfile_raw_default$6 = "# Distroless Node 24 image. Multi-stage so the runtime stays minimal.\nFROM node:24-alpine AS deps\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --omit=dev\n\nFROM gcr.io/distroless/nodejs24-debian12\nWORKDIR /app\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY src ./src\nCOPY agent.yaml ./\nENV PORT=8080\nEXPOSE 8080\nCMD [\"src/index.ts\"]\n";
+//#endregion
+//#region ../../starters/hello-world/README.md?raw
+var README_default$6 = "# starter-hello-world\n\nStackbone agent scaffolded by `stackbone init`. The runtime contract is the\nHTTP surface in `src/index.ts`: `/invoke`, `/health`, `/schema`.\n\n## Develop\n\n```sh\npnpm install\npnpm dev          # node --watch src/index.ts\n```\n\n## Deploy\n\n```sh\nstackbone deploy     # builds the image and pushes it to Fly Machines\n```\n\nSee `stackbone docs sdk` for the SDK reference and `stackbone docs cli`\nfor the full command surface.\n";
+//#endregion
+//#region ../../starters/hello-world/agent.yaml?raw
+var agent_default$6 = "# Stackbone agent manifest. Schema: stackbone.ai/v1.\n# Run `stackbone docs agent-yaml` for the full reference.\n\napiVersion: stackbone.ai/v1\nname: starter-hello-world\nruntime:\n  engine: node\n  entry: src/index.ts\n";
+//#endregion
+//#region ../../starters/hello-world/src/index.ts?raw
+var src_default$6 = "import { serve } from '@hono/node-server';\nimport { Hono } from 'hono';\n\nconst app = new Hono();\n\napp.post('/invoke', async (c) => {\n  const body = await c.req.json().catch(() => ({}));\n  return c.json({ hello: body.who ?? 'world' });\n});\n\napp.get('/health', (c) => c.json({ status: 'ok' }));\n\napp.get('/schema', (c) =>\n  c.json({\n    input: { type: 'object', properties: { who: { type: 'string' } } },\n    output: { type: 'object', properties: { hello: { type: 'string' } } },\n  }),\n);\n\nconst port = Number(process.env.PORT ?? 8080);\nserve({ fetch: app.fetch, port });\nconsole.log(`hello-world agent listening on :${port}`);\n";
+//#endregion
+//#region ../../starters/hello-world/src/schema.ts?raw
+var schema_default = "// Drizzle schema for starter-hello-world.\n//\n// Tables declared here are managed by `stackbone db migrate up`. Edit this\n// file, then run `stackbone db migrate create <name>` to emit the next SQL\n// migration under `.stackbone/migrations/`. The first migration shipped with\n// the template (`0000_init.sql`) creates the `examples` table below so the\n// agent has something queryable on its first `stackbone dev` boot.\n//\n// Drizzle column helpers re-export through `@stackbone/sdk/db` — never import\n// from `drizzle-orm/pg-core` directly. The SDK barrel is the single contract\n// the platform supports.\nimport { pgTable, serial, text, timestamp } from '@stackbone/sdk/db';\n\nexport const examples = pgTable('examples', {\n  id: serial('id').primaryKey(),\n  name: text('name').notNull(),\n  createdAt: timestamp('created_at').defaultNow().notNull(),\n});\n";
+//#endregion
+//#region ../../starters/hitl/.claude/skills/stackbone/SKILL.md?raw
+var SKILL_default$5 = "---\nname: stackbone\ndescription: Use this skill when the user is working with the Stackbone CLI, the `@stackbone/sdk` package, the `agent.yaml` manifest, official templates, or connections to the Stackbone control plane. Triggers on commands like `stackbone init`, `stackbone dev`, `stackbone deploy`, on questions about organization state, exit codes, or environment variables, and on any reference to `@stackbone/*` imports in TypeScript code. Provides the command surface, output contract, exit codes, environment variables and idiomatic workflows.\n---\n\n# Stackbone — agent operating manual\n\nThis skill is regenerated by `stackbone init` / `stackbone link` and ships\ninside the CLI release 0.1.0-alpha.1. Edit the upstream template in\n`apps/cli/src/skills/templates.ts` if something here is wrong.\n\n## CLI surface\n\nThe CLI binary is `stackbone` (also reachable as `npx @stackbone/cli@alpha ...`). Run\n`stackbone docs cli` for the canonical command/flag reference, or\n`stackbone docs sdk` for the `@stackbone/sdk` overview — neither command does\nnetwork IO.\n\n## Output contract\n\nEvery command supports `--json` (or `STACKBONE_JSON=1`). Successful JSON\nresponses look like:\n\n```json\n{ \"schema_version\": 1, \"...\": \"...\" }\n```\n\nErrors look like:\n\n```json\n{\n  \"schema_version\": 1,\n  \"error\": { \"code\": \"auth\", \"message\": \"...\", \"suggestion\": \"Run \\`stackbone login\\`\" },\n  \"exit_code\": 2\n}\n```\n\n`schema_version` only bumps on backward-incompatible shape changes. If you\nsee a different value, refuse to parse and ask the user to upgrade.\n\n## Exit codes\n\n- `0` ok\n- `1` generic\n- `2` auth (no session, expired, refused login)\n- `3` no project linked (no `.stackbone/project.json` in cwd)\n- `4` not found (organization, agent, deployment)\n- `5` permission denied\n\nBranch on these instead of parsing stack traces.\n\n## Environment variables\n\n- `STACKBONE_JSON=1` — same as `--json`\n- `STACKBONE_API_URL` — same as `--api-url <url>`\n- `STACKBONE_AUTO_LOGIN=0` — same as `--no-auto-login`\n- `STACKBONE_LOG_LEVEL` — `debug`, `info`, `warn`, `error` (logger goes\n  to stderr, never pollutes the JSON payload on stdout)\n\n## State on disk\n\n- `<cwd>/.stackbone/project.json` — organization + agent linked to this folder.\n  Created by `stackbone init` / `link`.\n- `~/.stackbone/credentials.json` (chmod 600) — sessions keyed by control\n  plane URL.\n- `~/.stackbone/config.json` — global preferences (default API URL,\n  telemetry opt-in).\n\nThe control plane this skill points at: `https://api.stackbone.ai`.\nActive organization slug: `template1-2`.\n\n## Common workflows\n\n### Authenticate\n\n```sh\nstackbone login            # interactive (device-code flow)\nstackbone whoami           # confirm session\nstackbone metadata --json  # one-shot overview that replaces 5–7 explorer calls\n```\n\n### Start a new project\n\n```sh\nstackbone init             # menu of templates (workflow / autonomous / RAG)\nstackbone dev              # local emulator at http://localhost:4242\n```\n\n### Deploy\n\n```sh\nstackbone deploy           # build + push + Fly Machines\n```\n\n## Anti-patterns\n\n- Do not hardcode organization IDs, credentials or control plane URLs into\n  agent code — the SDK reads them from the environment at runtime.\n- Do not parse human output. Re-run the command with `--json` and use\n  `JSON.parse`.\n- Do not call the control plane HTTP API directly from a creator's agent.\n  Use `@stackbone/sdk` so credential rotation, observability and metering\n  stay correct.\n- Do not commit `.stackbone/` or `~/.stackbone/` — the entries are in the\n  project's `.gitignore` for a reason.\n\n## Where to learn more\n\n- `stackbone docs cli` — command reference\n- `stackbone docs sdk` — `@stackbone/sdk` modules\n- `stackbone docs agent-yaml` — manifest reference (Epic 3)\n- `stackbone docs templates` — official templates (Epic 5)\n- `stackbone docs connections` — data layer (Epic 6)\n";
+//#endregion
+//#region ../../starters/hitl/.gitignore?raw
+var _gitignore_raw_default$5 = "# >>> stackbone >>>\n.stackbone/\nnode_modules/\ndist/\n# <<< stackbone <<<\n";
+//#endregion
+//#region ../../starters/hitl/Dockerfile?raw
+var Dockerfile_raw_default$5 = "# Distroless Node 24 image. Multi-stage so the runtime stays minimal.\nFROM node:24-alpine AS deps\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --omit=dev\n\nFROM gcr.io/distroless/nodejs24-debian12\nWORKDIR /app\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY src ./src\nCOPY agent.yaml ./\nENV PORT=8080\nEXPOSE 8080\nCMD [\"src/index.ts\"]\n";
+//#endregion
+//#region ../../starters/hitl/README.md?raw
+var README_default$5 = "# starter-hitl\n\nDemo of `client.approval` (Human-in-the-Loop) from `@stackbone/sdk`.\n\nThe agent opens an approval request on `POST /invoke`. The control plane\nnotifies the approver out-of-band, then POSTs the signed decision back to\n`POST /decide`. The agent verifies the signature with the workspace key and\nrecords the outcome.\n\n## Layout\n\n```\nsrc/\n  index.ts                      # Hono server\n  lib/\n    client.ts                   # Shared Stackbone client\n    logger.ts                   # JSON line logger\n  routes/\n    health.ts                   # GET    /health\n    schema-info.ts              # GET    /schema\n    invoke.ts                   # POST   /invoke           -> open approval\n    decide.ts                   # POST   /decide           -> signed decision callback\n    get-approval.ts             # GET    /approvals/:id\n    list-approvals.ts           # GET    /approvals        -> ?status&topic\n    cancel.ts                   # DELETE /approvals/:id    -> cancel pending request\n```\n\n## Run\n\n```sh\nnpm install\nstackbone dev\n```\n\nThen:\n\n```sh\ncurl -X POST http://127.0.0.1:8080/invoke -H 'content-type: application/json' -d '{\n  \"topic\": \"refund-request\",\n  \"title\": \"Issue $50 refund\",\n  \"payload\": {\"order_id\": \"ord_123\", \"amount\": 50}\n}'\n\ncurl http://127.0.0.1:8080/approvals\n```\n\nRequires `STACKBONE_APPROVAL_SIGNING_KEY` so `/decide` can verify the HMAC\nsignature the control plane attaches.\n";
+//#endregion
+//#region ../../starters/hitl/agent.yaml?raw
+var agent_default$5 = "# Stackbone agent manifest. Schema: stackbone.ai/v1.\n# Run `stackbone docs agent-yaml` for the full reference.\n\napiVersion: stackbone.ai/v1\nname: starter-hitl\nruntime:\n  engine: node\n  entry: src/index.ts\ndatabase:\n  schema: ./src/schema.ts\n  migrations: ./.stackbone/migrations\ndev:\n  autoMigrate: false\nrag:\n  embeddingModel: openai/text-embedding-3-small\n  autoMigrate: false\n";
+//#endregion
+//#region ../../starters/hitl/src/index.ts?raw
+var src_default$5 = "import { serve } from '@hono/node-server';\nimport { Hono } from 'hono';\n\nimport { log } from './lib/logger.ts';\nimport cancel from './routes/cancel.ts';\nimport decide from './routes/decide.ts';\nimport getApproval from './routes/get-approval.ts';\nimport health from './routes/health.ts';\nimport invoke from './routes/invoke.ts';\nimport listApprovals from './routes/list-approvals.ts';\nimport schemaInfo from './routes/schema-info.ts';\n\nconst app = new Hono();\n\napp.use('*', async (c, next) => {\n  const start = Date.now();\n  await next();\n  log('info', 'request', {\n    method: c.req.method,\n    path: c.req.path,\n    status: c.res.status,\n    durationMs: Date.now() - start,\n  });\n});\n\napp.route('/', health);\napp.route('/', schemaInfo);\napp.route('/', invoke);\napp.route('/', decide);\napp.route('/', getApproval);\napp.route('/', listApprovals);\napp.route('/', cancel);\n\nconst port = Number(process.env.PORT ?? 8080);\nserve({ fetch: app.fetch, port });\nlog('info', 'starter-hitl listening', { port });\n";
+//#endregion
+//#region ../../starters/hitl/src/lib/client.ts?raw
+var client_default$5 = "import { createClient } from '@stackbone/sdk';\n\nexport const client = createClient({\n  stackboneApiUrl: process.env.STACKBONE_DEV_API_URL ?? 'http://127.0.0.1:4242',\n});\n";
+//#endregion
+//#region ../../starters/hitl/src/lib/logger.ts?raw
+var logger_default$5 = "type Level = 'info' | 'warn' | 'error';\n\nexport function log(level: Level, msg: string, fields?: Record<string, unknown>): void {\n  const line = JSON.stringify({ ts: new Date().toISOString(), level, msg, ...fields });\n  if (level === 'error') console.error(line);\n  else console.log(line);\n}\n";
+//#endregion
+//#region ../../starters/hitl/src/routes/cancel.ts?raw
+var cancel_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.delete('/approvals/:id', async (c) => {\n  const id = c.req.param('id');\n  const reason = c.req.query('reason') ?? undefined;\n  log('info', 'cancel approval', { id, reason });\n\n  const result = await client.approval.cancel(id, reason);\n  if (result.error) {\n    log('error', 'cancel failed', { id, code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  return c.json({ status: 'cancelled', id });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/hitl/src/routes/decide.ts?raw
+var decide_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\n// Webhook the control plane POSTs to with the approver's decision.\n// `client.approval.verify` validates the HMAC signature using the workspace's\n// signing key (`STACKBONE_APPROVAL_SIGNING_KEY`).\nroute.post('/decide', async (c) => {\n  log('info', 'decide received');\n\n  const verified = await client.approval.verify(c.req.raw);\n  if (verified.error) {\n    log('warn', 'verify failed', { code: verified.error.code });\n    return c.json({ error: verified.error }, 401);\n  }\n\n  log('info', 'decision', { status: verified.data.status });\n  return c.json({ status: 'recorded', decision: verified.data });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/hitl/src/routes/get-approval.ts?raw
+var get_approval_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.get('/approvals/:id', async (c) => {\n  const id = c.req.param('id');\n  log('info', 'get approval', { id });\n\n  const result = await client.approval.get(id);\n  if (result.error) {\n    log('error', 'get failed', { id, code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/hitl/src/routes/health.ts?raw
+var health_default$5 = "import { Hono } from 'hono';\n\nconst route = new Hono();\nroute.get('/health', (c) => c.json({ status: 'ok' }));\nexport default route;\n";
+//#endregion
+//#region ../../starters/hitl/src/routes/invoke.ts?raw
+var invoke_default$5 = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\n// Opens a HITL approval request. The agent pauses on `/approvals/:id` (or via\n// the SDK's poll/wait helpers); the control plane delivers the decision to\n// the `/decide` route below.\nroute.post('/invoke', async (c) => {\n  const body = await c.req.json().catch(\n    () =>\n      ({}) as {\n        topic?: string;\n        payload?: unknown;\n        title?: string;\n        description?: string;\n      },\n  );\n\n  const topic = typeof body.topic === 'string' ? body.topic : 'demo-approval';\n  log('info', 'request approval', { topic });\n\n  const result = await client.approval.request({\n    topic,\n    payload: body.payload ?? { reason: 'starter-hitl demo' },\n    title: body.title ?? 'Demo approval',\n    description: body.description,\n    onDecide: '/decide',\n  });\n\n  if (result.error) {\n    log('error', 'request failed', { code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'request done', { approvalId: result.data.approvalId });\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/hitl/src/routes/list-approvals.ts?raw
+var list_approvals_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.get('/approvals', async (c) => {\n  const status = c.req.query('status');\n  const topic = c.req.query('topic');\n\n  log('info', 'list approvals', { status, topic });\n\n  const result = await client.approval.list({\n    status: status as never,\n    topic,\n    limit: 50,\n  });\n\n  if (result.error) {\n    log('error', 'list failed', { code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'list done', { count: result.data.items.length });\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/hitl/src/routes/schema-info.ts?raw
+var schema_info_default$5 = "import { Hono } from 'hono';\n\nconst route = new Hono();\n\nroute.get('/schema', (c) =>\n  c.json({\n    input: {\n      type: 'object',\n      properties: {\n        topic: { type: 'string' },\n        payload: {},\n      },\n      required: ['topic'],\n    },\n    output: {\n      type: 'object',\n      properties: {\n        approvalId: { type: 'string' },\n        status: { type: 'string' },\n      },\n    },\n  }),\n);\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/prompts/.claude/skills/stackbone/SKILL.md?raw
+var SKILL_default$4 = "---\nname: stackbone\ndescription: Use this skill when the user is working with the Stackbone CLI, the `@stackbone/sdk` package, the `agent.yaml` manifest, official templates, or connections to the Stackbone control plane. Triggers on commands like `stackbone init`, `stackbone dev`, `stackbone deploy`, on questions about organization state, exit codes, or environment variables, and on any reference to `@stackbone/*` imports in TypeScript code. Provides the command surface, output contract, exit codes, environment variables and idiomatic workflows.\n---\n\n# Stackbone — agent operating manual\n\nThis skill is regenerated by `stackbone init` / `stackbone link` and ships\ninside the CLI release 0.1.0-alpha.1. Edit the upstream template in\n`apps/cli/src/skills/templates.ts` if something here is wrong.\n\n## CLI surface\n\nThe CLI binary is `stackbone` (also reachable as `npx @stackbone/cli@alpha ...`). Run\n`stackbone docs cli` for the canonical command/flag reference, or\n`stackbone docs sdk` for the `@stackbone/sdk` overview — neither command does\nnetwork IO.\n\n## Output contract\n\nEvery command supports `--json` (or `STACKBONE_JSON=1`). Successful JSON\nresponses look like:\n\n```json\n{ \"schema_version\": 1, \"...\": \"...\" }\n```\n\nErrors look like:\n\n```json\n{\n  \"schema_version\": 1,\n  \"error\": { \"code\": \"auth\", \"message\": \"...\", \"suggestion\": \"Run \\`stackbone login\\`\" },\n  \"exit_code\": 2\n}\n```\n\n`schema_version` only bumps on backward-incompatible shape changes. If you\nsee a different value, refuse to parse and ask the user to upgrade.\n\n## Exit codes\n\n- `0` ok\n- `1` generic\n- `2` auth (no session, expired, refused login)\n- `3` no project linked (no `.stackbone/project.json` in cwd)\n- `4` not found (organization, agent, deployment)\n- `5` permission denied\n\nBranch on these instead of parsing stack traces.\n\n## Environment variables\n\n- `STACKBONE_JSON=1` — same as `--json`\n- `STACKBONE_API_URL` — same as `--api-url <url>`\n- `STACKBONE_AUTO_LOGIN=0` — same as `--no-auto-login`\n- `STACKBONE_LOG_LEVEL` — `debug`, `info`, `warn`, `error` (logger goes\n  to stderr, never pollutes the JSON payload on stdout)\n\n## State on disk\n\n- `<cwd>/.stackbone/project.json` — organization + agent linked to this folder.\n  Created by `stackbone init` / `link`.\n- `~/.stackbone/credentials.json` (chmod 600) — sessions keyed by control\n  plane URL.\n- `~/.stackbone/config.json` — global preferences (default API URL,\n  telemetry opt-in).\n\nThe control plane this skill points at: `https://api.stackbone.ai`.\nActive organization slug: `template1-2`.\n\n## Common workflows\n\n### Authenticate\n\n```sh\nstackbone login            # interactive (device-code flow)\nstackbone whoami           # confirm session\nstackbone metadata --json  # one-shot overview that replaces 5–7 explorer calls\n```\n\n### Start a new project\n\n```sh\nstackbone init             # menu of templates (workflow / autonomous / RAG)\nstackbone dev              # local emulator at http://localhost:4242\n```\n\n### Deploy\n\n```sh\nstackbone deploy           # build + push + Fly Machines\n```\n\n## Anti-patterns\n\n- Do not hardcode organization IDs, credentials or control plane URLs into\n  agent code — the SDK reads them from the environment at runtime.\n- Do not parse human output. Re-run the command with `--json` and use\n  `JSON.parse`.\n- Do not call the control plane HTTP API directly from a creator's agent.\n  Use `@stackbone/sdk` so credential rotation, observability and metering\n  stay correct.\n- Do not commit `.stackbone/` or `~/.stackbone/` — the entries are in the\n  project's `.gitignore` for a reason.\n\n## Where to learn more\n\n- `stackbone docs cli` — command reference\n- `stackbone docs sdk` — `@stackbone/sdk` modules\n- `stackbone docs agent-yaml` — manifest reference (Epic 3)\n- `stackbone docs templates` — official templates (Epic 5)\n- `stackbone docs connections` — data layer (Epic 6)\n";
+//#endregion
+//#region ../../starters/prompts/.gitignore?raw
+var _gitignore_raw_default$4 = "# >>> stackbone >>>\n.stackbone/\nnode_modules/\ndist/\n# <<< stackbone <<<\n";
+//#endregion
+//#region ../../starters/prompts/Dockerfile?raw
+var Dockerfile_raw_default$4 = "# Distroless Node 24 image. Multi-stage so the runtime stays minimal.\nFROM node:24-alpine AS deps\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --omit=dev\n\nFROM gcr.io/distroless/nodejs24-debian12\nWORKDIR /app\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY src ./src\nCOPY agent.yaml ./\nENV PORT=8080\nEXPOSE 8080\nCMD [\"src/index.ts\"]\n";
+//#endregion
+//#region ../../starters/prompts/README.md?raw
+var README_default$4 = "# starter-prompts\n\nDemo of `client.prompts` (managed prompts with Mustache-style `{{var}}`\nsubstitution, versioned in the control plane) from `@stackbone/sdk`.\n\n## Layout\n\n```\nsrc/\n  index.ts                      # Hono server\n  lib/\n    client.ts                   # Shared Stackbone client\n    logger.ts                   # JSON line logger\n  routes/\n    health.ts                   # GET  /health\n    schema-info.ts              # GET  /schema\n    invoke.ts                   # POST /invoke         -> compile a prompt with variables\n    list-prompts.ts             # GET  /prompts        -> latest version of each prompt\n    get-prompt.ts               # GET  /prompts/:name  -> single prompt (?version=N)\n    create-prompt.ts            # POST /prompts        -> register a new prompt\n```\n\n## Run\n\n```sh\nnpm install\nstackbone dev\n```\n\nThen:\n\n```sh\ncurl -X POST http://127.0.0.1:8080/prompts -H 'content-type: application/json' -d '{\n  \"name\": \"greeting\",\n  \"template\": \"Hello {{user}}, welcome to {{product}}.\"\n}'\n\ncurl -X POST http://127.0.0.1:8080/invoke -H 'content-type: application/json' -d '{\n  \"name\": \"greeting\",\n  \"variables\": {\"user\": \"Luis\", \"product\": \"Stackbone\"}\n}'\n\ncurl http://127.0.0.1:8080/prompts\n```\n\nNote: the `client.prompts` facade is a scaffolding placeholder in this SDK\nversion — every call returns `not_implemented` until the control plane lands.\n";
+//#endregion
+//#region ../../starters/prompts/agent.yaml?raw
+var agent_default$4 = "# Stackbone agent manifest. Schema: stackbone.ai/v1.\n# Run `stackbone docs agent-yaml` for the full reference.\n\napiVersion: stackbone.ai/v1\nname: starter-prompts\nruntime:\n  engine: node\n  entry: src/index.ts\ndatabase:\n  schema: ./src/schema.ts\n  migrations: ./.stackbone/migrations\ndev:\n  autoMigrate: false\nrag:\n  embeddingModel: openai/text-embedding-3-small\n  autoMigrate: false\n";
+//#endregion
+//#region ../../starters/prompts/src/index.ts?raw
+var src_default$4 = "import { serve } from '@hono/node-server';\nimport { Hono } from 'hono';\n\nimport { log } from './lib/logger.ts';\nimport createPrompt from './routes/create-prompt.ts';\nimport getPrompt from './routes/get-prompt.ts';\nimport health from './routes/health.ts';\nimport invoke from './routes/invoke.ts';\nimport listPrompts from './routes/list-prompts.ts';\nimport schemaInfo from './routes/schema-info.ts';\n\nconst app = new Hono();\n\napp.use('*', async (c, next) => {\n  const start = Date.now();\n  await next();\n  log('info', 'request', {\n    method: c.req.method,\n    path: c.req.path,\n    status: c.res.status,\n    durationMs: Date.now() - start,\n  });\n});\n\napp.route('/', health);\napp.route('/', schemaInfo);\napp.route('/', invoke);\napp.route('/', listPrompts);\napp.route('/', getPrompt);\napp.route('/', createPrompt);\n\nconst port = Number(process.env.PORT ?? 8080);\nserve({ fetch: app.fetch, port });\nlog('info', 'starter-prompts listening', { port });\n";
+//#endregion
+//#region ../../starters/prompts/src/lib/client.ts?raw
+var client_default$4 = "import { createClient } from '@stackbone/sdk';\n\nexport const client = createClient({\n  stackboneApiUrl: process.env.STACKBONE_DEV_API_URL ?? 'http://127.0.0.1:4242',\n});\n";
+//#endregion
+//#region ../../starters/prompts/src/lib/logger.ts?raw
+var logger_default$4 = "type Level = 'info' | 'warn' | 'error';\n\nexport function log(level: Level, msg: string, fields?: Record<string, unknown>): void {\n  const line = JSON.stringify({ ts: new Date().toISOString(), level, msg, ...fields });\n  if (level === 'error') console.error(line);\n  else console.log(line);\n}\n";
+//#endregion
+//#region ../../starters/prompts/src/routes/create-prompt.ts?raw
+var create_prompt_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.post('/prompts', async (c) => {\n  const body = await c.req.json().catch(\n    () =>\n      ({}) as {\n        name?: string;\n        template?: string;\n        metadata?: Record<string, unknown>;\n      },\n  );\n\n  if (!body.name || !body.template) {\n    return c.json({ error: 'missing name or template' }, 400);\n  }\n\n  log('info', 'create prompt', { name: body.name });\n\n  const result = await client.prompts.create({\n    name: body.name,\n    template: body.template,\n    metadata: body.metadata,\n  });\n\n  if (result.error) {\n    log('error', 'create failed', { code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'create done', { name: result.data.name, version: result.data.version });\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/prompts/src/routes/get-prompt.ts?raw
+var get_prompt_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.get('/prompts/:name', async (c) => {\n  const name = c.req.param('name');\n  const version = c.req.query('version') ? Number(c.req.query('version')) : undefined;\n\n  log('info', 'fetch prompt', { name, version });\n\n  const result = await client.prompts.get(name, { version });\n  if (result.error) {\n    log('error', 'fetch failed', { name, code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/prompts/src/routes/health.ts?raw
+var health_default$4 = "import { Hono } from 'hono';\n\nconst route = new Hono();\nroute.get('/health', (c) => c.json({ status: 'ok' }));\nexport default route;\n";
+//#endregion
+//#region ../../starters/prompts/src/routes/invoke.ts?raw
+var invoke_default$4 = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\n// Compiles a managed prompt with `{{var}}` substitution and returns the\n// resulting string. The agent typically passes this to `client.ai`.\nroute.post('/invoke', async (c) => {\n  const body = await c.req.json().catch(\n    () => ({}) as { name?: string; variables?: Record<string, unknown> },\n  );\n  const name = typeof body.name === 'string' ? body.name : '';\n  if (!name) return c.json({ error: 'missing name' }, 400);\n\n  log('info', 'compile', { name });\n\n  const result = await client.prompts.compile(name, body.variables ?? {});\n  if (result.error) {\n    log('error', 'compile failed', { name, code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'compile done', { name, length: result.data.length });\n  return c.json({ name, compiled: result.data });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/prompts/src/routes/list-prompts.ts?raw
+var list_prompts_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.get('/prompts', async (c) => {\n  log('info', 'list prompts');\n\n  const result = await client.prompts.list({ limit: 50 });\n  if (result.error) {\n    log('error', 'list failed', { code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'list done', { count: result.data.items.length });\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/prompts/src/routes/schema-info.ts?raw
+var schema_info_default$4 = "import { Hono } from 'hono';\n\nconst route = new Hono();\n\nroute.get('/schema', (c) =>\n  c.json({\n    input: {\n      type: 'object',\n      properties: {\n        name: { type: 'string' },\n        variables: { type: 'object' },\n      },\n      required: ['name'],\n    },\n    output: { type: 'object', properties: { compiled: { type: 'string' } } },\n  }),\n);\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/queues/.claude/skills/stackbone/SKILL.md?raw
+var SKILL_default$3 = "---\nname: stackbone\ndescription: Use this skill when the user is working with the Stackbone CLI, the `@stackbone/sdk` package, the `agent.yaml` manifest, official templates, or connections to the Stackbone control plane. Triggers on commands like `stackbone init`, `stackbone dev`, `stackbone deploy`, on questions about organization state, exit codes, or environment variables, and on any reference to `@stackbone/*` imports in TypeScript code. Provides the command surface, output contract, exit codes, environment variables and idiomatic workflows.\n---\n\n# Stackbone — agent operating manual\n\nThis skill is regenerated by `stackbone init` / `stackbone link` and ships\ninside the CLI release 0.1.0-alpha.1. Edit the upstream template in\n`apps/cli/src/skills/templates.ts` if something here is wrong.\n\n## CLI surface\n\nThe CLI binary is `stackbone` (also reachable as `npx @stackbone/cli@alpha ...`). Run\n`stackbone docs cli` for the canonical command/flag reference, or\n`stackbone docs sdk` for the `@stackbone/sdk` overview — neither command does\nnetwork IO.\n\n## Output contract\n\nEvery command supports `--json` (or `STACKBONE_JSON=1`). Successful JSON\nresponses look like:\n\n```json\n{ \"schema_version\": 1, \"...\": \"...\" }\n```\n\nErrors look like:\n\n```json\n{\n  \"schema_version\": 1,\n  \"error\": { \"code\": \"auth\", \"message\": \"...\", \"suggestion\": \"Run \\`stackbone login\\`\" },\n  \"exit_code\": 2\n}\n```\n\n`schema_version` only bumps on backward-incompatible shape changes. If you\nsee a different value, refuse to parse and ask the user to upgrade.\n\n## Exit codes\n\n- `0` ok\n- `1` generic\n- `2` auth (no session, expired, refused login)\n- `3` no project linked (no `.stackbone/project.json` in cwd)\n- `4` not found (organization, agent, deployment)\n- `5` permission denied\n\nBranch on these instead of parsing stack traces.\n\n## Environment variables\n\n- `STACKBONE_JSON=1` — same as `--json`\n- `STACKBONE_API_URL` — same as `--api-url <url>`\n- `STACKBONE_AUTO_LOGIN=0` — same as `--no-auto-login`\n- `STACKBONE_LOG_LEVEL` — `debug`, `info`, `warn`, `error` (logger goes\n  to stderr, never pollutes the JSON payload on stdout)\n\n## State on disk\n\n- `<cwd>/.stackbone/project.json` — organization + agent linked to this folder.\n  Created by `stackbone init` / `link`.\n- `~/.stackbone/credentials.json` (chmod 600) — sessions keyed by control\n  plane URL.\n- `~/.stackbone/config.json` — global preferences (default API URL,\n  telemetry opt-in).\n\nThe control plane this skill points at: `https://api.stackbone.ai`.\nActive organization slug: `template1-2`.\n\n## Common workflows\n\n### Authenticate\n\n```sh\nstackbone login            # interactive (device-code flow)\nstackbone whoami           # confirm session\nstackbone metadata --json  # one-shot overview that replaces 5–7 explorer calls\n```\n\n### Start a new project\n\n```sh\nstackbone init             # menu of templates (workflow / autonomous / RAG)\nstackbone dev              # local emulator at http://localhost:4242\n```\n\n### Deploy\n\n```sh\nstackbone deploy           # build + push + Fly Machines\n```\n\n## Anti-patterns\n\n- Do not hardcode organization IDs, credentials or control plane URLs into\n  agent code — the SDK reads them from the environment at runtime.\n- Do not parse human output. Re-run the command with `--json` and use\n  `JSON.parse`.\n- Do not call the control plane HTTP API directly from a creator's agent.\n  Use `@stackbone/sdk` so credential rotation, observability and metering\n  stay correct.\n- Do not commit `.stackbone/` or `~/.stackbone/` — the entries are in the\n  project's `.gitignore` for a reason.\n\n## Where to learn more\n\n- `stackbone docs cli` — command reference\n- `stackbone docs sdk` — `@stackbone/sdk` modules\n- `stackbone docs agent-yaml` — manifest reference (Epic 3)\n- `stackbone docs templates` — official templates (Epic 5)\n- `stackbone docs connections` — data layer (Epic 6)\n";
+//#endregion
+//#region ../../starters/queues/.gitignore?raw
+var _gitignore_raw_default$3 = "# >>> stackbone >>>\n.stackbone/\nnode_modules/\ndist/\n# <<< stackbone <<<\n";
+//#endregion
+//#region ../../starters/queues/Dockerfile?raw
+var Dockerfile_raw_default$3 = "# Distroless Node 24 image. Multi-stage so the runtime stays minimal.\nFROM node:24-alpine AS deps\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --omit=dev\n\nFROM gcr.io/distroless/nodejs24-debian12\nWORKDIR /app\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY src ./src\nCOPY agent.yaml ./\nENV PORT=8080\nEXPOSE 8080\nCMD [\"src/index.ts\"]\n";
+//#endregion
+//#region ../../starters/queues/README.md?raw
+var README_default$3 = "# starter-queues\n\nDemo of `client.queues` (QStash publisher + signed webhook receiver) from\n`@stackbone/sdk`.\n\n## Layout\n\n```\nsrc/\n  index.ts                      # Hono server\n  lib/\n    client.ts                   # Shared Stackbone client\n    logger.ts                   # JSON line logger\n  routes/\n    health.ts                   # GET  /health\n    schema-info.ts              # GET  /schema\n    invoke.ts                   # POST /invoke    -> publish to own /receive\n    publish.ts                  # POST /publish   -> publish to arbitrary url\n    receive.ts                  # POST /receive   -> queue webhook target\n```\n\n## Run\n\n```sh\nnpm install\nstackbone dev\n```\n\nThen:\n\n```sh\ncurl -X POST http://127.0.0.1:8080/publish -H 'content-type: application/json' \\\n  -d '{\"url\":\"https://httpbin.org/post\",\"body\":{\"hello\":\"world\"}}'\n\ncurl -X POST http://127.0.0.1:8080/invoke -H 'content-type: application/json' \\\n  -d '{\"payload\":{\"hello\":\"from invoke\"}}'\n```\n\nRequires `QSTASH_TOKEN` (and `QSTASH_*_SIGNING_KEY` if you want signature\nverification on `/receive`).\n";
+//#endregion
+//#region ../../starters/queues/agent.yaml?raw
+var agent_default$3 = "# Stackbone agent manifest. Schema: stackbone.ai/v1.\n# Run `stackbone docs agent-yaml` for the full reference.\n\napiVersion: stackbone.ai/v1\nname: starter-queues\nruntime:\n  engine: node\n  entry: src/index.ts\ndatabase:\n  schema: ./src/schema.ts\n  migrations: ./.stackbone/migrations\ndev:\n  autoMigrate: false\nrag:\n  embeddingModel: openai/text-embedding-3-small\n  autoMigrate: false\n";
+//#endregion
+//#region ../../starters/queues/src/index.ts?raw
+var src_default$3 = "import { serve } from '@hono/node-server';\nimport { Hono } from 'hono';\n\nimport { log } from './lib/logger.ts';\nimport health from './routes/health.ts';\nimport invoke from './routes/invoke.ts';\nimport publish from './routes/publish.ts';\nimport receive from './routes/receive.ts';\nimport schemaInfo from './routes/schema-info.ts';\n\nconst app = new Hono();\n\napp.use('*', async (c, next) => {\n  const start = Date.now();\n  await next();\n  log('info', 'request', {\n    method: c.req.method,\n    path: c.req.path,\n    status: c.res.status,\n    durationMs: Date.now() - start,\n  });\n});\n\napp.route('/', health);\napp.route('/', schemaInfo);\napp.route('/', invoke);\napp.route('/', publish);\napp.route('/', receive);\n\nconst port = Number(process.env.PORT ?? 8080);\nserve({ fetch: app.fetch, port });\nlog('info', 'starter-queues listening', { port });\n";
+//#endregion
+//#region ../../starters/queues/src/lib/client.ts?raw
+var client_default$3 = "import { createClient } from '@stackbone/sdk';\n\nexport const client = createClient({\n  stackboneApiUrl: process.env.STACKBONE_DEV_API_URL ?? 'http://127.0.0.1:4242',\n});\n";
+//#endregion
+//#region ../../starters/queues/src/lib/logger.ts?raw
+var logger_default$3 = "type Level = 'info' | 'warn' | 'error';\n\nexport function log(level: Level, msg: string, fields?: Record<string, unknown>): void {\n  const line = JSON.stringify({ ts: new Date().toISOString(), level, msg, ...fields });\n  if (level === 'error') console.error(line);\n  else console.log(line);\n}\n";
+//#endregion
+//#region ../../starters/queues/src/routes/health.ts?raw
+var health_default$3 = "import { Hono } from 'hono';\n\nconst route = new Hono();\nroute.get('/health', (c) => c.json({ status: 'ok' }));\nexport default route;\n";
+//#endregion
+//#region ../../starters/queues/src/routes/invoke.ts?raw
+var invoke_default$3 = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\n// Convenience entrypoint: publishes a message back to this same agent's\n// `/receive` route, so the round-trip is visible end-to-end.\nroute.post('/invoke', async (c) => {\n  const body = await c.req.json().catch(() => ({}) as { selfUrl?: string; payload?: unknown });\n  const selfUrl = body.selfUrl ?? 'http://127.0.0.1:8080/receive';\n\n  log('info', 'invoke -> queue', { selfUrl });\n\n  const result = await client.queues.publish({\n    url: selfUrl,\n    body: body.payload ?? { hello: 'from invoke' },\n  });\n\n  if (result.error) {\n    log('error', 'invoke publish failed', { code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/queues/src/routes/publish.ts?raw
+var publish_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.post('/publish', async (c) => {\n  const body = await c.req.json().catch(\n    () =>\n      ({}) as {\n        url?: string;\n        body?: unknown;\n        retries?: number;\n        delay?: number;\n      },\n  );\n\n  const url = typeof body.url === 'string' ? body.url : '';\n  if (!url) return c.json({ error: 'missing url' }, 400);\n\n  log('info', 'publish', { url, retries: body.retries, delay: body.delay });\n\n  const result = await client.queues.publish({\n    url,\n    body: body.body ?? {},\n    retries: body.retries,\n    delay: body.delay,\n  });\n\n  if (result.error) {\n    log('error', 'publish failed', { code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'publish done', { messageId: result.data.messageId });\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/queues/src/routes/receive.ts?raw
+var receive_default = "import { Hono } from 'hono';\n\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\n// Webhook endpoint that the queue calls back into. In production QStash sends\n// the `Upstash-Signature` header and the SDK exposes a verifier — for the\n// template we just log the body so you can observe the round-trip from\n// `/publish` -> queue -> `/receive`.\nroute.post('/receive', async (c) => {\n  const signature = c.req.header('upstash-signature');\n  const body = await c.req.json().catch(() => null);\n\n  log('info', 'receive', {\n    hasSignature: Boolean(signature),\n    bodySize: body ? JSON.stringify(body).length : 0,\n  });\n\n  return c.json({ status: 'received' });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/queues/src/routes/schema-info.ts?raw
+var schema_info_default$3 = "import { Hono } from 'hono';\n\nconst route = new Hono();\n\nroute.get('/schema', (c) =>\n  c.json({\n    input: {\n      type: 'object',\n      properties: { url: { type: 'string' }, body: { type: 'object' } },\n      required: ['url'],\n    },\n    output: {\n      type: 'object',\n      properties: { messageId: { type: 'string' } },\n    },\n  }),\n);\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/rag/.claude/skills/stackbone/SKILL.md?raw
+var SKILL_default$2 = "---\nname: stackbone\ndescription: Use this skill when the user is working with the Stackbone CLI, the `@stackbone/sdk` package, the `agent.yaml` manifest, official templates, or connections to the Stackbone control plane. Triggers on commands like `stackbone init`, `stackbone dev`, `stackbone deploy`, on questions about organization state, exit codes, or environment variables, and on any reference to `@stackbone/*` imports in TypeScript code. Provides the command surface, output contract, exit codes, environment variables and idiomatic workflows.\n---\n\n# Stackbone — agent operating manual\n\nThis skill is regenerated by `stackbone init` / `stackbone link` and ships\ninside the CLI release 0.1.0-alpha.1. Edit the upstream template in\n`apps/cli/src/skills/templates.ts` if something here is wrong.\n\n## CLI surface\n\nThe CLI binary is `stackbone` (also reachable as `npx @stackbone/cli@alpha ...`). Run\n`stackbone docs cli` for the canonical command/flag reference, or\n`stackbone docs sdk` for the `@stackbone/sdk` overview — neither command does\nnetwork IO.\n\n## Output contract\n\nEvery command supports `--json` (or `STACKBONE_JSON=1`). Successful JSON\nresponses look like:\n\n```json\n{ \"schema_version\": 1, \"...\": \"...\" }\n```\n\nErrors look like:\n\n```json\n{\n  \"schema_version\": 1,\n  \"error\": { \"code\": \"auth\", \"message\": \"...\", \"suggestion\": \"Run \\`stackbone login\\`\" },\n  \"exit_code\": 2\n}\n```\n\n`schema_version` only bumps on backward-incompatible shape changes. If you\nsee a different value, refuse to parse and ask the user to upgrade.\n\n## Exit codes\n\n- `0` ok\n- `1` generic\n- `2` auth (no session, expired, refused login)\n- `3` no project linked (no `.stackbone/project.json` in cwd)\n- `4` not found (organization, agent, deployment)\n- `5` permission denied\n\nBranch on these instead of parsing stack traces.\n\n## Environment variables\n\n- `STACKBONE_JSON=1` — same as `--json`\n- `STACKBONE_API_URL` — same as `--api-url <url>`\n- `STACKBONE_AUTO_LOGIN=0` — same as `--no-auto-login`\n- `STACKBONE_LOG_LEVEL` — `debug`, `info`, `warn`, `error` (logger goes\n  to stderr, never pollutes the JSON payload on stdout)\n\n## State on disk\n\n- `<cwd>/.stackbone/project.json` — organization + agent linked to this folder.\n  Created by `stackbone init` / `link`.\n- `~/.stackbone/credentials.json` (chmod 600) — sessions keyed by control\n  plane URL.\n- `~/.stackbone/config.json` — global preferences (default API URL,\n  telemetry opt-in).\n\nThe control plane this skill points at: `https://api.stackbone.ai`.\nActive organization slug: `template1-2`.\n\n## Common workflows\n\n### Authenticate\n\n```sh\nstackbone login            # interactive (device-code flow)\nstackbone whoami           # confirm session\nstackbone metadata --json  # one-shot overview that replaces 5–7 explorer calls\n```\n\n### Start a new project\n\n```sh\nstackbone init             # menu of templates (workflow / autonomous / RAG)\nstackbone dev              # local emulator at http://localhost:4242\n```\n\n### Deploy\n\n```sh\nstackbone deploy           # build + push + Fly Machines\n```\n\n## Anti-patterns\n\n- Do not hardcode organization IDs, credentials or control plane URLs into\n  agent code — the SDK reads them from the environment at runtime.\n- Do not parse human output. Re-run the command with `--json` and use\n  `JSON.parse`.\n- Do not call the control plane HTTP API directly from a creator's agent.\n  Use `@stackbone/sdk` so credential rotation, observability and metering\n  stay correct.\n- Do not commit `.stackbone/` or `~/.stackbone/` — the entries are in the\n  project's `.gitignore` for a reason.\n\n## Where to learn more\n\n- `stackbone docs cli` — command reference\n- `stackbone docs sdk` — `@stackbone/sdk` modules\n- `stackbone docs agent-yaml` — manifest reference (Epic 3)\n- `stackbone docs templates` — official templates (Epic 5)\n- `stackbone docs connections` — data layer (Epic 6)\n";
+//#endregion
+//#region ../../starters/rag/.gitignore?raw
+var _gitignore_raw_default$2 = "# >>> stackbone >>>\n.stackbone/\nnode_modules/\ndist/\n# <<< stackbone <<<\n";
+//#endregion
+//#region ../../starters/rag/Dockerfile?raw
+var Dockerfile_raw_default$2 = "# Distroless Node 24 image. Multi-stage so the runtime stays minimal.\nFROM node:24-alpine AS deps\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --omit=dev\n\nFROM gcr.io/distroless/nodejs24-debian12\nWORKDIR /app\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY src ./src\nCOPY agent.yaml ./\nENV PORT=8080\nEXPOSE 8080\nCMD [\"src/index.ts\"]\n";
+//#endregion
+//#region ../../starters/rag/README.md?raw
+var README_default$2 = "# starter-rag\n\nDemo of `client.rag` (pgvector-backed retrieval) from `@stackbone/sdk`.\n\n## Layout\n\n```\nsrc/\n  index.ts                      # Hono server\n  lib/\n    client.ts                   # Shared Stackbone client\n    logger.ts                   # JSON line logger\n  routes/\n    health.ts                   # GET    /health\n    schema-info.ts              # GET    /schema\n    invoke.ts                   # POST   /invoke           -> action: ingest | retrieve\n    chunk.ts                    # POST   /chunk            -> preview chunker output\n    ingest.ts                   # POST   /ingest           -> chunk + embed + write\n    retrieve.ts                 # POST   /retrieve         -> embed + topK\n    delete.ts                   # DELETE /documents/:id\n```\n\n## Run\n\n```sh\nnpm install\nstackbone dev\n```\n\nThen:\n\n```sh\ncurl -X POST http://127.0.0.1:8080/ingest -H 'content-type: application/json' -d '{\n  \"id\": \"doc-1\",\n  \"text\": \"Stackbone is a marketplace and hosting platform for AI agents.\"\n}'\n\ncurl -X POST http://127.0.0.1:8080/retrieve -H 'content-type: application/json' -d '{\n  \"text\": \"what is stackbone\",\n  \"topK\": 3\n}'\n```\n\nRequires `OPENROUTER_API_KEY` for the embedding model.\n";
+//#endregion
+//#region ../../starters/rag/agent.yaml?raw
+var agent_default$2 = "# Stackbone agent manifest. Schema: stackbone.ai/v1.\n# Run `stackbone docs agent-yaml` for the full reference.\n\napiVersion: stackbone.ai/v1\nname: starter-rag\nruntime:\n  engine: node\n  entry: src/index.ts\ndatabase:\n  schema: ./src/schema.ts\n  migrations: ./.stackbone/migrations\ndev:\n  autoMigrate: false\nrag:\n  embeddingModel: openai/text-embedding-3-small\n  autoMigrate: true\n";
+//#endregion
+//#region ../../starters/rag/src/index.ts?raw
+var src_default$2 = "import { serve } from '@hono/node-server';\nimport { Hono } from 'hono';\n\nimport { log } from './lib/logger.ts';\nimport chunk from './routes/chunk.ts';\nimport deleteDoc from './routes/delete.ts';\nimport health from './routes/health.ts';\nimport ingest from './routes/ingest.ts';\nimport invoke from './routes/invoke.ts';\nimport retrieve from './routes/retrieve.ts';\nimport schemaInfo from './routes/schema-info.ts';\n\nconst app = new Hono();\n\napp.use('*', async (c, next) => {\n  const start = Date.now();\n  await next();\n  log('info', 'request', {\n    method: c.req.method,\n    path: c.req.path,\n    status: c.res.status,\n    durationMs: Date.now() - start,\n  });\n});\n\napp.route('/', health);\napp.route('/', schemaInfo);\napp.route('/', invoke);\napp.route('/', chunk);\napp.route('/', ingest);\napp.route('/', retrieve);\napp.route('/', deleteDoc);\n\nconst port = Number(process.env.PORT ?? 8080);\nserve({ fetch: app.fetch, port });\nlog('info', 'starter-rag listening', { port });\n";
+//#endregion
+//#region ../../starters/rag/src/lib/client.ts?raw
+var client_default$2 = "import { createClient } from '@stackbone/sdk';\n\nexport const client = createClient({\n  stackboneApiUrl: process.env.STACKBONE_DEV_API_URL ?? 'http://127.0.0.1:4242',\n});\n";
+//#endregion
+//#region ../../starters/rag/src/lib/logger.ts?raw
+var logger_default$2 = "type Level = 'info' | 'warn' | 'error';\n\nexport function log(level: Level, msg: string, fields?: Record<string, unknown>): void {\n  const line = JSON.stringify({ ts: new Date().toISOString(), level, msg, ...fields });\n  if (level === 'error') console.error(line);\n  else console.log(line);\n}\n";
+//#endregion
+//#region ../../starters/rag/src/routes/chunk.ts?raw
+var chunk_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\n// Pure helper — splits text into chunks without touching DB or AI. Useful to\n// preview the chunker before paying for embeddings.\nroute.post('/chunk', async (c) => {\n  const body = await c.req.json().catch(() => ({}) as { text?: string; size?: number; overlap?: number });\n  const text = typeof body.text === 'string' ? body.text : '';\n  if (!text) return c.json({ error: 'missing text' }, 400);\n\n  log('info', 'chunk', { length: text.length, size: body.size, overlap: body.overlap });\n  const chunks = client.rag.chunk(text, { size: body.size, overlap: body.overlap });\n  return c.json({ count: chunks.length, chunks });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/rag/src/routes/delete.ts?raw
+var delete_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.delete('/documents/:id', async (c) => {\n  const id = c.req.param('id');\n  log('info', 'delete document', { id });\n\n  const result = await client.rag.delete(id);\n  if (result.error) {\n    log('error', 'delete failed', { id, code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'delete done', { id, deleted: result.data.deleted });\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/rag/src/routes/health.ts?raw
+var health_default$2 = "import { Hono } from 'hono';\n\nconst route = new Hono();\nroute.get('/health', (c) => c.json({ status: 'ok' }));\nexport default route;\n";
+//#endregion
+//#region ../../starters/rag/src/routes/ingest.ts?raw
+var ingest_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.post('/ingest', async (c) => {\n  const body = await c.req.json().catch(\n    () =>\n      ({}) as {\n        id?: string;\n        text?: string;\n        model?: string;\n        metadata?: Record<string, unknown>;\n      },\n  );\n\n  const id = typeof body.id === 'string' ? body.id : crypto.randomUUID();\n  const text = typeof body.text === 'string' ? body.text : '';\n  const model = typeof body.model === 'string' ? body.model : 'openai/text-embedding-3-small';\n\n  if (!text) return c.json({ error: 'missing text' }, 400);\n\n  log('info', 'ingest start', { id, model, length: text.length });\n  const chunks = client.rag.chunk(text);\n  log('info', 'ingest chunked', { id, chunks: chunks.length });\n\n  const result = await client.rag.ingest({ id, chunks, model, metadata: body.metadata });\n\n  if (result.error) {\n    log('error', 'ingest failed', { id, code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'ingest done', { id, chunks: result.data.chunks });\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/rag/src/routes/invoke.ts?raw
+var invoke_default$2 = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\n// `/invoke` is the canonical Stackbone agent entrypoint. We dispatch by an\n// `action` field so the agent has a single contract while the dev surface\n// still exposes the granular routes (ingest / retrieve / chunk / delete).\nroute.post('/invoke', async (c) => {\n  const body = await c.req.json().catch(\n    () => ({}) as { action?: 'ingest' | 'retrieve'; id?: string; text?: string },\n  );\n\n  log('info', 'invoke', { action: body.action });\n\n  if (body.action === 'ingest') {\n    const text = body.text ?? '';\n    const id = body.id ?? crypto.randomUUID();\n    const chunks = client.rag.chunk(text);\n    const result = await client.rag.ingest({\n      id,\n      chunks,\n      model: 'openai/text-embedding-3-small',\n    });\n    return result.error ? c.json({ error: result.error }, 502) : c.json(result.data);\n  }\n\n  if (body.action === 'retrieve') {\n    const result = await client.rag.retrieve({\n      text: body.text ?? '',\n      model: 'openai/text-embedding-3-small',\n      topK: 3,\n      includeContent: true,\n    });\n    return result.error ? c.json({ error: result.error }, 502) : c.json({ hits: result.data });\n  }\n\n  return c.json({ error: 'unknown action — use \"ingest\" or \"retrieve\"' }, 400);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/rag/src/routes/retrieve.ts?raw
+var retrieve_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.post('/retrieve', async (c) => {\n  const body = await c.req.json().catch(\n    () => ({}) as { text?: string; topK?: number; model?: string },\n  );\n  const text = typeof body.text === 'string' ? body.text : '';\n  const model = typeof body.model === 'string' ? body.model : 'openai/text-embedding-3-small';\n  const topK = typeof body.topK === 'number' ? body.topK : 5;\n\n  if (!text) return c.json({ error: 'missing text' }, 400);\n\n  log('info', 'retrieve', { topK, model, length: text.length });\n\n  const result = await client.rag.retrieve({ text, model, topK, includeContent: true });\n  if (result.error) {\n    log('error', 'retrieve failed', { code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'retrieve done', { hits: result.data.length });\n  return c.json({ hits: result.data });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/rag/src/routes/schema-info.ts?raw
+var schema_info_default$2 = "import { Hono } from 'hono';\n\nconst route = new Hono();\n\nroute.get('/schema', (c) =>\n  c.json({\n    input: {\n      type: 'object',\n      properties: {\n        action: { type: 'string', enum: ['ingest', 'retrieve'] },\n        text: { type: 'string' },\n      },\n      required: ['action'],\n    },\n  }),\n);\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/secrets/.claude/skills/stackbone/SKILL.md?raw
+var SKILL_default$1 = "---\nname: stackbone\ndescription: Use this skill when the user is working with the Stackbone CLI, the `@stackbone/sdk` package, the `agent.yaml` manifest, official templates, or connections to the Stackbone control plane. Triggers on commands like `stackbone init`, `stackbone dev`, `stackbone deploy`, on questions about organization state, exit codes, or environment variables, and on any reference to `@stackbone/*` imports in TypeScript code. Provides the command surface, output contract, exit codes, environment variables and idiomatic workflows.\n---\n\n# Stackbone — agent operating manual\n\nThis skill is regenerated by `stackbone init` / `stackbone link` and ships\ninside the CLI release 0.1.0-alpha.1. Edit the upstream template in\n`apps/cli/src/skills/templates.ts` if something here is wrong.\n\n## CLI surface\n\nThe CLI binary is `stackbone` (also reachable as `npx @stackbone/cli@alpha ...`). Run\n`stackbone docs cli` for the canonical command/flag reference, or\n`stackbone docs sdk` for the `@stackbone/sdk` overview — neither command does\nnetwork IO.\n\n## Output contract\n\nEvery command supports `--json` (or `STACKBONE_JSON=1`). Successful JSON\nresponses look like:\n\n```json\n{ \"schema_version\": 1, \"...\": \"...\" }\n```\n\nErrors look like:\n\n```json\n{\n  \"schema_version\": 1,\n  \"error\": { \"code\": \"auth\", \"message\": \"...\", \"suggestion\": \"Run \\`stackbone login\\`\" },\n  \"exit_code\": 2\n}\n```\n\n`schema_version` only bumps on backward-incompatible shape changes. If you\nsee a different value, refuse to parse and ask the user to upgrade.\n\n## Exit codes\n\n- `0` ok\n- `1` generic\n- `2` auth (no session, expired, refused login)\n- `3` no project linked (no `.stackbone/project.json` in cwd)\n- `4` not found (organization, agent, deployment)\n- `5` permission denied\n\nBranch on these instead of parsing stack traces.\n\n## Environment variables\n\n- `STACKBONE_JSON=1` — same as `--json`\n- `STACKBONE_API_URL` — same as `--api-url <url>`\n- `STACKBONE_AUTO_LOGIN=0` — same as `--no-auto-login`\n- `STACKBONE_LOG_LEVEL` — `debug`, `info`, `warn`, `error` (logger goes\n  to stderr, never pollutes the JSON payload on stdout)\n\n## State on disk\n\n- `<cwd>/.stackbone/project.json` — organization + agent linked to this folder.\n  Created by `stackbone init` / `link`.\n- `~/.stackbone/credentials.json` (chmod 600) — sessions keyed by control\n  plane URL.\n- `~/.stackbone/config.json` — global preferences (default API URL,\n  telemetry opt-in).\n\nThe control plane this skill points at: `https://api.stackbone.ai`.\nActive organization slug: `template1-2`.\n\n## Common workflows\n\n### Authenticate\n\n```sh\nstackbone login            # interactive (device-code flow)\nstackbone whoami           # confirm session\nstackbone metadata --json  # one-shot overview that replaces 5–7 explorer calls\n```\n\n### Start a new project\n\n```sh\nstackbone init             # menu of templates (workflow / autonomous / RAG)\nstackbone dev              # local emulator at http://localhost:4242\n```\n\n### Deploy\n\n```sh\nstackbone deploy           # build + push + Fly Machines\n```\n\n## Anti-patterns\n\n- Do not hardcode organization IDs, credentials or control plane URLs into\n  agent code — the SDK reads them from the environment at runtime.\n- Do not parse human output. Re-run the command with `--json` and use\n  `JSON.parse`.\n- Do not call the control plane HTTP API directly from a creator's agent.\n  Use `@stackbone/sdk` so credential rotation, observability and metering\n  stay correct.\n- Do not commit `.stackbone/` or `~/.stackbone/` — the entries are in the\n  project's `.gitignore` for a reason.\n\n## Where to learn more\n\n- `stackbone docs cli` — command reference\n- `stackbone docs sdk` — `@stackbone/sdk` modules\n- `stackbone docs agent-yaml` — manifest reference (Epic 3)\n- `stackbone docs templates` — official templates (Epic 5)\n- `stackbone docs connections` — data layer (Epic 6)\n";
+//#endregion
+//#region ../../starters/secrets/.gitignore?raw
+var _gitignore_raw_default$1 = "# >>> stackbone >>>\n.stackbone/\nnode_modules/\ndist/\n# <<< stackbone <<<\n";
+//#endregion
+//#region ../../starters/secrets/Dockerfile?raw
+var Dockerfile_raw_default$1 = "# Distroless Node 24 image. Multi-stage so the runtime stays minimal.\nFROM node:24-alpine AS deps\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --omit=dev\n\nFROM gcr.io/distroless/nodejs24-debian12\nWORKDIR /app\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY src ./src\nCOPY agent.yaml ./\nENV PORT=8080\nEXPOSE 8080\nCMD [\"src/index.ts\"]\n";
+//#endregion
+//#region ../../starters/secrets/README.md?raw
+var README_default$1 = "# starter-secrets\n\nDemo of `client.secrets` (workspace-scoped encrypted values) from\n`@stackbone/sdk`.\n\n## Layout\n\n```\nsrc/\n  index.ts                      # Hono server\n  lib/\n    client.ts                   # Shared Stackbone client\n    logger.ts                   # JSON line logger\n  routes/\n    health.ts                   # GET  /health\n    schema-info.ts              # GET  /schema\n    invoke.ts                   # POST /invoke         -> check if secret is present\n    get-secret.ts               # GET  /secrets/:name  -> fetch value (demo only)\n    get-many.ts                 # POST /secrets/bulk   -> bulk check (names[] -> present/missing)\n```\n\n## Run\n\n```sh\nnpm install\nstackbone dev\n```\n\nThen (after registering `OPENAI_API_KEY` and `STRIPE_KEY` in the control plane):\n\n```sh\ncurl -X POST http://127.0.0.1:8080/invoke -H 'content-type: application/json' \\\n  -d '{\"name\":\"OPENAI_API_KEY\"}'\ncurl -X POST http://127.0.0.1:8080/secrets/bulk -H 'content-type: application/json' \\\n  -d '{\"names\":[\"OPENAI_API_KEY\",\"STRIPE_KEY\",\"NOT_SET\"]}'\n```\n";
+//#endregion
+//#region ../../starters/secrets/agent.yaml?raw
+var agent_default$1 = "# Stackbone agent manifest. Schema: stackbone.ai/v1.\n# Run `stackbone docs agent-yaml` for the full reference.\n\napiVersion: stackbone.ai/v1\nname: starter-secrets\nruntime:\n  engine: node\n  entry: src/index.ts\ndatabase:\n  schema: ./src/schema.ts\n  migrations: ./.stackbone/migrations\ndev:\n  autoMigrate: false\nrag:\n  embeddingModel: openai/text-embedding-3-small\n  autoMigrate: false\n";
+//#endregion
+//#region ../../starters/secrets/src/index.ts?raw
+var src_default$1 = "import { serve } from '@hono/node-server';\nimport { Hono } from 'hono';\n\nimport { log } from './lib/logger.ts';\nimport getMany from './routes/get-many.ts';\nimport getSecret from './routes/get-secret.ts';\nimport health from './routes/health.ts';\nimport invoke from './routes/invoke.ts';\nimport schemaInfo from './routes/schema-info.ts';\n\nconst app = new Hono();\n\napp.use('*', async (c, next) => {\n  const start = Date.now();\n  await next();\n  log('info', 'request', {\n    method: c.req.method,\n    path: c.req.path,\n    status: c.res.status,\n    durationMs: Date.now() - start,\n  });\n});\n\napp.route('/', health);\napp.route('/', schemaInfo);\napp.route('/', invoke);\napp.route('/', getSecret);\napp.route('/', getMany);\n\nconst port = Number(process.env.PORT ?? 8080);\nserve({ fetch: app.fetch, port });\nlog('info', 'starter-secrets listening', { port });\n";
+//#endregion
+//#region ../../starters/secrets/src/lib/client.ts?raw
+var client_default$1 = "import { createClient } from '@stackbone/sdk';\n\nexport const client = createClient({\n  stackboneApiUrl: process.env.STACKBONE_DEV_API_URL ?? 'http://127.0.0.1:4242',\n});\n";
+//#endregion
+//#region ../../starters/secrets/src/lib/logger.ts?raw
+var logger_default$1 = "type Level = 'info' | 'warn' | 'error';\n\nexport function log(level: Level, msg: string, fields?: Record<string, unknown>): void {\n  const line = JSON.stringify({ ts: new Date().toISOString(), level, msg, ...fields });\n  if (level === 'error') console.error(line);\n  else console.log(line);\n}\n";
+//#endregion
+//#region ../../starters/secrets/src/routes/get-many.ts?raw
+var get_many_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.post('/secrets/bulk', async (c) => {\n  const body = await c.req.json().catch(() => ({}) as { names?: string[] });\n  const names = Array.isArray(body.names) ? body.names : [];\n  if (names.length === 0) return c.json({ error: 'missing names[]' }, 400);\n\n  log('info', 'fetch secrets bulk', { count: names.length });\n\n  const result = await client.secrets.getMany(names);\n  if (result.error) {\n    log('error', 'bulk failed', { code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  // Mask values — just return which names resolved.\n  const present = Object.keys(result.data);\n  const missing = names.filter((name) => !present.includes(name));\n  log('info', 'bulk done', { present: present.length, missing: missing.length });\n  return c.json({ present, missing });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/secrets/src/routes/get-secret.ts?raw
+var get_secret_default = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\n// Returns the raw secret value. Real agents would consume the value\n// internally — exposing it over HTTP defeats the purpose. This endpoint is\n// scaffolded for the demo only.\nroute.get('/secrets/:name', async (c) => {\n  const name = c.req.param('name');\n  log('info', 'fetch secret', { name });\n\n  const result = await client.secrets.get(name);\n  if (result.error) {\n    log('error', 'fetch secret failed', { name, code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'fetch secret done', { name, length: result.data.length });\n  return c.json({ name, value: result.data });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/secrets/src/routes/health.ts?raw
+var health_default$1 = "import { Hono } from 'hono';\n\nconst route = new Hono();\nroute.get('/health', (c) => c.json({ status: 'ok' }));\nexport default route;\n";
+//#endregion
+//#region ../../starters/secrets/src/routes/invoke.ts?raw
+var invoke_default$1 = "import { Hono } from 'hono';\n\nimport { client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\n// Checks whether a named secret is present in the agent's workspace without\n// leaking the value. Useful as a probe before running the dependent task.\nroute.post('/invoke', async (c) => {\n  const body = await c.req.json().catch(() => ({}) as { name?: string });\n  const name = typeof body.name === 'string' ? body.name : '';\n  if (!name) return c.json({ error: 'missing name' }, 400);\n\n  log('info', 'check secret', { name });\n  const result = await client.secrets.get(name);\n\n  if (result.error) {\n    log('warn', 'secret missing', { name, code: result.error.code });\n    return c.json({ name, present: false, code: result.error.code });\n  }\n\n  log('info', 'secret present', { name, length: result.data.length });\n  return c.json({ name, present: true, length: result.data.length });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/secrets/src/routes/schema-info.ts?raw
+var schema_info_default$1 = "import { Hono } from 'hono';\n\nconst route = new Hono();\n\nroute.get('/schema', (c) =>\n  c.json({\n    input: {\n      type: 'object',\n      properties: { name: { type: 'string' } },\n      required: ['name'],\n    },\n    output: {\n      type: 'object',\n      properties: { name: { type: 'string' }, present: { type: 'boolean' } },\n    },\n  }),\n);\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/storage/.claude/skills/stackbone/SKILL.md?raw
+var SKILL_default = "---\nname: stackbone\ndescription: Use this skill when the user is working with the Stackbone CLI, the `@stackbone/sdk` package, the `agent.yaml` manifest, official templates, or connections to the Stackbone control plane. Triggers on commands like `stackbone init`, `stackbone dev`, `stackbone deploy`, on questions about organization state, exit codes, or environment variables, and on any reference to `@stackbone/*` imports in TypeScript code. Provides the command surface, output contract, exit codes, environment variables and idiomatic workflows.\n---\n\n# Stackbone — agent operating manual\n\nThis skill is regenerated by `stackbone init` / `stackbone link` and ships\ninside the CLI release 0.1.0-alpha.1. Edit the upstream template in\n`apps/cli/src/skills/templates.ts` if something here is wrong.\n\n## CLI surface\n\nThe CLI binary is `stackbone` (also reachable as `npx @stackbone/cli@alpha ...`). Run\n`stackbone docs cli` for the canonical command/flag reference, or\n`stackbone docs sdk` for the `@stackbone/sdk` overview — neither command does\nnetwork IO.\n\n## Output contract\n\nEvery command supports `--json` (or `STACKBONE_JSON=1`). Successful JSON\nresponses look like:\n\n```json\n{ \"schema_version\": 1, \"...\": \"...\" }\n```\n\nErrors look like:\n\n```json\n{\n  \"schema_version\": 1,\n  \"error\": { \"code\": \"auth\", \"message\": \"...\", \"suggestion\": \"Run \\`stackbone login\\`\" },\n  \"exit_code\": 2\n}\n```\n\n`schema_version` only bumps on backward-incompatible shape changes. If you\nsee a different value, refuse to parse and ask the user to upgrade.\n\n## Exit codes\n\n- `0` ok\n- `1` generic\n- `2` auth (no session, expired, refused login)\n- `3` no project linked (no `.stackbone/project.json` in cwd)\n- `4` not found (organization, agent, deployment)\n- `5` permission denied\n\nBranch on these instead of parsing stack traces.\n\n## Environment variables\n\n- `STACKBONE_JSON=1` — same as `--json`\n- `STACKBONE_API_URL` — same as `--api-url <url>`\n- `STACKBONE_AUTO_LOGIN=0` — same as `--no-auto-login`\n- `STACKBONE_LOG_LEVEL` — `debug`, `info`, `warn`, `error` (logger goes\n  to stderr, never pollutes the JSON payload on stdout)\n\n## State on disk\n\n- `<cwd>/.stackbone/project.json` — organization + agent linked to this folder.\n  Created by `stackbone init` / `link`.\n- `~/.stackbone/credentials.json` (chmod 600) — sessions keyed by control\n  plane URL.\n- `~/.stackbone/config.json` — global preferences (default API URL,\n  telemetry opt-in).\n\nThe control plane this skill points at: `https://api.stackbone.ai`.\nActive organization slug: `template1-2`.\n\n## Common workflows\n\n### Authenticate\n\n```sh\nstackbone login            # interactive (device-code flow)\nstackbone whoami           # confirm session\nstackbone metadata --json  # one-shot overview that replaces 5–7 explorer calls\n```\n\n### Start a new project\n\n```sh\nstackbone init             # menu of templates (workflow / autonomous / RAG)\nstackbone dev              # local emulator at http://localhost:4242\n```\n\n### Deploy\n\n```sh\nstackbone deploy           # build + push + Fly Machines\n```\n\n## Anti-patterns\n\n- Do not hardcode organization IDs, credentials or control plane URLs into\n  agent code — the SDK reads them from the environment at runtime.\n- Do not parse human output. Re-run the command with `--json` and use\n  `JSON.parse`.\n- Do not call the control plane HTTP API directly from a creator's agent.\n  Use `@stackbone/sdk` so credential rotation, observability and metering\n  stay correct.\n- Do not commit `.stackbone/` or `~/.stackbone/` — the entries are in the\n  project's `.gitignore` for a reason.\n\n## Where to learn more\n\n- `stackbone docs cli` — command reference\n- `stackbone docs sdk` — `@stackbone/sdk` modules\n- `stackbone docs agent-yaml` — manifest reference (Epic 3)\n- `stackbone docs templates` — official templates (Epic 5)\n- `stackbone docs connections` — data layer (Epic 6)\n";
+//#endregion
+//#region ../../starters/storage/.gitignore?raw
+var _gitignore_raw_default = "# >>> stackbone >>>\n.stackbone/\nnode_modules/\ndist/\n# <<< stackbone <<<\n";
+//#endregion
+//#region ../../starters/storage/Dockerfile?raw
 var Dockerfile_raw_default = "# Distroless Node 24 image. Multi-stage so the runtime stays minimal.\nFROM node:24-alpine AS deps\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --omit=dev\n\nFROM gcr.io/distroless/nodejs24-debian12\nWORKDIR /app\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY src ./src\nCOPY agent.yaml ./\nENV PORT=8080\nEXPOSE 8080\nCMD [\"src/index.ts\"]\n";
 //#endregion
-//#region src/templates/workflow/README.md?raw
-var README_default = "# {{agentName}}\n\nStackbone agent scaffolded by `stackbone init`. The runtime contract is the\nHTTP surface in `src/index.ts`: `/invoke`, `/health`, `/schema`.\n\n## Develop\n\n```sh\npnpm install\npnpm dev          # node --watch src/index.ts\n```\n\n## Deploy\n\n```sh\nstackbone deploy     # builds the image and pushes it to Fly Machines\n```\n\nSee `stackbone docs sdk` for the SDK reference and `stackbone docs cli`\nfor the full command surface.\n";
+//#region ../../starters/storage/README.md?raw
+var README_default = "# starter-storage\n\nDemo of `client.storage` (S3 / MinIO) from `@stackbone/sdk`.\n\nThe template writes into a logical bucket called `demo`. Real keys land in\n`<agentId>/demo/...` inside the physical bucket configured via `S3_BUCKET`.\n\n## Layout\n\n```\nsrc/\n  index.ts                      # Hono server\n  lib/\n    client.ts                   # Shared Stackbone client + BUCKET constant\n    logger.ts                   # JSON line logger\n  routes/\n    health.ts                   # GET    /health\n    schema-info.ts              # GET    /schema\n    invoke.ts                   # POST   /invoke                -> upload text\n    list-objects.ts             # GET    /objects               -> list (prefix?, limit?)\n    download.ts                 # GET    /objects/:key          -> download bytes\n    delete-object.ts            # DELETE /objects/:key\n    signed-url.ts               # GET    /signed-download/:key  -> presigned GET\n                                # POST   /signed-upload         -> presigned PUT\n```\n\n## Run\n\n```sh\nnpm install\nstackbone dev\n```\n\nThen:\n\n```sh\ncurl -X POST http://127.0.0.1:8080/invoke -H 'content-type: application/json' \\\n  -d '{\"key\":\"hello.txt\",\"body\":\"hello stackbone\"}'\ncurl http://127.0.0.1:8080/objects\ncurl http://127.0.0.1:8080/objects/hello.txt\ncurl http://127.0.0.1:8080/signed-download/hello.txt\ncurl -X DELETE http://127.0.0.1:8080/objects/hello.txt\n```\n\n`stackbone dev` provisions a local MinIO but does not inject S3 credentials\ninto the agent process — export them yourself before booting:\n\n```sh\nexport STACKBONE_AGENT_ID=$(jq -r .agentId .stackbone/project.json)\nexport AWS_ACCESS_KEY_ID=stackbone\nexport AWS_SECRET_ACCESS_KEY=stackbone-secret\nexport S3_ENDPOINT=http://127.0.0.1:9004\nexport S3_BUCKET=stackbone-dev\nstackbone dev\n```\n\nIn production these come from the control plane / Fly secrets.\n";
 //#endregion
-//#region src/templates/workflow/package.json?raw
-var package_default = "{\n  \"name\": \"{{agentSlug}}\",\n  \"version\": \"0.0.1\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"node --watch src/index.ts\",\n    \"start\": \"node src/index.ts\"\n  },\n  \"engines\": {\n    \"node\": \">=24\"\n  },\n  \"dependencies\": {\n    \"@hono/node-server\": \"^1.13.0\",\n    \"@stackbone/sdk\": \"^0.0.1\",\n    \"hono\": \"^4.6.0\"\n  }\n}\n";
+//#region ../../starters/storage/agent.yaml?raw
+var agent_default = "# Stackbone agent manifest. Schema: stackbone.ai/v1.\n# Run `stackbone docs agent-yaml` for the full reference.\n\napiVersion: stackbone.ai/v1\nname: starter-storage\nruntime:\n  engine: node\n  entry: src/index.ts\ndatabase:\n  schema: ./src/schema.ts\n  migrations: ./.stackbone/migrations\ndev:\n  autoMigrate: false\nrag:\n  embeddingModel: openai/text-embedding-3-small\n  autoMigrate: false\n";
 //#endregion
-//#region src/templates/workflow/src/index.ts?raw
-var src_default = "import { serve } from '@hono/node-server';\nimport { Hono } from 'hono';\n\n// MOCK workflow. In MVP this becomes a LangGraph state machine driven by\n// `@stackbone/sdk` (`client.ai.completion`); for POC the nodes are pure JS\n// returning hardcoded structured output so `stackbone dev` has something to\n// iterate on without an LLM bill.\n\ninterface State {\n  input: string;\n  classified?: 'lead' | 'spam';\n  reply?: string;\n}\n\nconst classify = (s: State): State => ({\n  ...s,\n  classified: s.input.toLowerCase().includes('buy') ? 'lead' : 'spam',\n});\n\nconst draftReply = (s: State): State => ({\n  ...s,\n  reply:\n    s.classified === 'lead'\n      ? `Thanks! A human will follow up about: ${s.input}`\n      : 'Filtered as spam.',\n});\n\nconst fallback = (s: State): State =>\n  s.reply ? s : { ...s, reply: 'Could not produce a reply, escalating.' };\n\nconst runGraph = (input: string): State => fallback(draftReply(classify({ input })));\n\nconst app = new Hono();\n\napp.post('/invoke', async (c) => {\n  const body = await c.req.json().catch(() => ({ input: '' }));\n  const state = runGraph(typeof body.input === 'string' ? body.input : '');\n  return c.json(state);\n});\n\napp.get('/health', (c) => c.json({ status: 'ok' }));\napp.get('/schema', (c) =>\n  c.json({\n    input: { type: 'object', properties: { input: { type: 'string' } }, required: ['input'] },\n    output: {\n      type: 'object',\n      properties: {\n        input: { type: 'string' },\n        classified: { type: 'string', enum: ['lead', 'spam'] },\n        reply: { type: 'string' },\n      },\n    },\n  }),\n);\n\nconst port = Number(process.env.PORT ?? 8080);\nserve({ fetch: app.fetch, port });\nconsole.log(`workflow agent listening on :${port}`);\n";
+//#region ../../starters/storage/src/index.ts?raw
+var src_default = "import { serve } from '@hono/node-server';\nimport { Hono } from 'hono';\n\nimport { log } from './lib/logger.ts';\nimport deleteObject from './routes/delete-object.ts';\nimport download from './routes/download.ts';\nimport health from './routes/health.ts';\nimport invoke from './routes/invoke.ts';\nimport listObjects from './routes/list-objects.ts';\nimport schemaInfo from './routes/schema-info.ts';\nimport signedUrl from './routes/signed-url.ts';\n\nconst app = new Hono();\n\napp.use('*', async (c, next) => {\n  const start = Date.now();\n  await next();\n  log('info', 'request', {\n    method: c.req.method,\n    path: c.req.path,\n    status: c.res.status,\n    durationMs: Date.now() - start,\n  });\n});\n\napp.route('/', health);\napp.route('/', schemaInfo);\napp.route('/', invoke);\napp.route('/', listObjects);\napp.route('/', download);\napp.route('/', deleteObject);\napp.route('/', signedUrl);\n\nconst port = Number(process.env.PORT ?? 8080);\nserve({ fetch: app.fetch, port });\nlog('info', 'starter-storage listening', { port });\n";
 //#endregion
-//#region src/templates/workflow/src/schema.ts?raw
-var schema_default = "// Drizzle schema for {{agentName}}.\n//\n// Tables declared here are managed by `stackbone db migrate up`. Edit this\n// file, then run `stackbone db migrate create <name>` to emit the next SQL\n// migration under `.stackbone/migrations/`. The first migration shipped with\n// the template (`0000_init.sql`) creates the `examples` table below so the\n// agent has something queryable on its first `stackbone dev` boot.\n//\n// Drizzle column helpers re-export through `@stackbone/sdk/db` — never import\n// from `drizzle-orm/pg-core` directly. The SDK barrel is the single contract\n// the platform supports.\nimport { pgTable, serial, text, timestamp } from '@stackbone/sdk/db';\n\nexport const examples = pgTable('examples', {\n  id: serial('id').primaryKey(),\n  name: text('name').notNull(),\n  createdAt: timestamp('created_at').defaultNow().notNull(),\n});\n";
+//#region ../../starters/storage/src/lib/client.ts?raw
+var client_default = "import { createClient } from '@stackbone/sdk';\n\nexport const client = createClient({\n  stackboneApiUrl: process.env.STACKBONE_DEV_API_URL ?? 'http://127.0.0.1:4242',\n});\n\n// Single logical bucket the template writes into. Real keys are namespaced\n// underneath by `client.storage` (prefixed with the agent id).\nexport const BUCKET = 'demo';\n";
 //#endregion
-//#region src/services/scaffolding.ts
-var TOKEN_PATTERN = /{{\s*(\w+)\s*}}/g;
-var manifestModules = /* @__PURE__ */ Object.assign({
-	"../templates/autonomous/template.yaml": template_default$2,
-	"../templates/hello-world/template.yaml": template_default$1,
-	"../templates/workflow/template.yaml": template_default
-});
-var fileModules = /* @__PURE__ */ Object.assign({
-	"../templates/autonomous/.stackbone/migrations/0000_init.sql": _0000_init_default$2,
-	"../templates/autonomous/.stackbone/migrations/meta/0000_snapshot.json": _0000_snapshot_default$2,
-	"../templates/autonomous/.stackbone/migrations/meta/_journal.json": _journal_default$2,
-	"../templates/autonomous/Dockerfile": Dockerfile_raw_default$2,
-	"../templates/autonomous/README.md": README_default$2,
-	"../templates/autonomous/package.json": package_default$2,
-	"../templates/autonomous/src/index.ts": src_default$2,
-	"../templates/autonomous/src/schema.ts": schema_default$2,
-	"../templates/hello-world/.stackbone/migrations/0000_init.sql": _0000_init_default$1,
-	"../templates/hello-world/.stackbone/migrations/meta/0000_snapshot.json": _0000_snapshot_default$1,
-	"../templates/hello-world/.stackbone/migrations/meta/_journal.json": _journal_default$1,
-	"../templates/hello-world/Dockerfile": Dockerfile_raw_default$1,
-	"../templates/hello-world/README.md": README_default$1,
-	"../templates/hello-world/package.json": package_default$1,
-	"../templates/hello-world/src/index.ts": src_default$1,
-	"../templates/hello-world/src/schema.ts": schema_default$1,
-	"../templates/workflow/.stackbone/migrations/0000_init.sql": _0000_init_default,
-	"../templates/workflow/.stackbone/migrations/meta/0000_snapshot.json": _0000_snapshot_default,
-	"../templates/workflow/.stackbone/migrations/meta/_journal.json": _journal_default,
-	"../templates/workflow/Dockerfile": Dockerfile_raw_default,
-	"../templates/workflow/README.md": README_default,
-	"../templates/workflow/package.json": package_default,
-	"../templates/workflow/src/index.ts": src_default,
-	"../templates/workflow/src/schema.ts": schema_default
-});
-var requireString = (value, field, id) => {
-	if (typeof value !== "string" || value.length === 0) throw new Error(`Template '${id}': field '${field}' must be a non-empty string.`);
+//#region ../../starters/storage/src/lib/logger.ts?raw
+var logger_default = "type Level = 'info' | 'warn' | 'error';\n\nexport function log(level: Level, msg: string, fields?: Record<string, unknown>): void {\n  const line = JSON.stringify({ ts: new Date().toISOString(), level, msg, ...fields });\n  if (level === 'error') console.error(line);\n  else console.log(line);\n}\n";
+//#endregion
+//#region ../../starters/storage/src/routes/delete-object.ts?raw
+var delete_object_default = "import { Hono } from 'hono';\n\nimport { BUCKET, client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.delete('/objects/:key', async (c) => {\n  const key = c.req.param('key');\n  log('info', 'remove', { key });\n\n  const result = await client.storage.from(BUCKET).remove(key);\n  if (result.error) {\n    log('error', 'remove failed', { key, code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'remove done', { key });\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/storage/src/routes/download.ts?raw
+var download_default = "import { Hono } from 'hono';\n\nimport { BUCKET, client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\n// Returns the object body verbatim. Streaming-safe via response cloning so\n// the agent does not have to materialise large objects fully in memory.\nroute.get('/objects/:key', async (c) => {\n  const key = c.req.param('key');\n  log('info', 'download', { key });\n\n  const result = await client.storage.from(BUCKET).download(key);\n  if (result.error) {\n    log('error', 'download failed', { key, code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  const buffer = await result.data.arrayBuffer();\n  log('info', 'download done', { key, bytes: buffer.byteLength });\n  return new Response(buffer, {\n    headers: { 'content-type': result.data.type || 'application/octet-stream' },\n  });\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/storage/src/routes/health.ts?raw
+var health_default = "import { Hono } from 'hono';\n\nconst route = new Hono();\nroute.get('/health', (c) => c.json({ status: 'ok' }));\nexport default route;\n";
+//#endregion
+//#region ../../starters/storage/src/routes/invoke.ts?raw
+var invoke_default = "import { Hono } from 'hono';\n\nimport { BUCKET, client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\n// `/invoke` uploads a small text blob to the demo bucket — the simplest path\n// to validate the agent has working S3 credentials.\nroute.post('/invoke', async (c) => {\n  const body = await c.req.json().catch(() => ({}) as { key?: string; body?: string });\n  const key = body.key ?? `invoke-${Date.now()}.txt`;\n  const content = body.body ?? 'hello from starter-storage';\n\n  log('info', 'upload', { key, bytes: content.length });\n\n  const result = await client.storage.from(BUCKET).upload(key, content, {\n    contentType: 'text/plain',\n  });\n\n  if (result.error) {\n    log('error', 'upload failed', { key, code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'upload done', { key: result.data.key });\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/storage/src/routes/list-objects.ts?raw
+var list_objects_default = "import { Hono } from 'hono';\n\nimport { BUCKET, client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\nroute.get('/objects', async (c) => {\n  const prefix = c.req.query('prefix');\n  const limit = c.req.query('limit') ? Number(c.req.query('limit')) : undefined;\n\n  log('info', 'list objects', { prefix, limit });\n\n  const result = await client.storage.from(BUCKET).list({ prefix, limit });\n  if (result.error) {\n    log('error', 'list failed', { code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  log('info', 'list done', { count: result.data.objects.length });\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/storage/src/routes/schema-info.ts?raw
+var schema_info_default = "import { Hono } from 'hono';\n\nconst route = new Hono();\n\nroute.get('/schema', (c) =>\n  c.json({\n    input: {\n      type: 'object',\n      properties: { key: { type: 'string' }, body: { type: 'string' } },\n      required: ['key', 'body'],\n    },\n    output: {\n      type: 'object',\n      properties: { key: { type: 'string' }, etag: { type: 'string' } },\n    },\n  }),\n);\n\nexport default route;\n";
+//#endregion
+//#region ../../starters/storage/src/routes/signed-url.ts?raw
+var signed_url_default = "import { Hono } from 'hono';\n\nimport { BUCKET, client } from '../lib/client.ts';\nimport { log } from '../lib/logger.ts';\n\nconst route = new Hono();\n\n// Pre-signed download URL — used by clients that pull large objects directly\n// from S3/MinIO without going through the agent.\nroute.get('/signed-download/:key', async (c) => {\n  const key = c.req.param('key');\n  const expiresIn = c.req.query('expiresIn') ? Number(c.req.query('expiresIn')) : undefined;\n\n  log('info', 'signed download', { key, expiresIn });\n\n  const result = await client.storage.from(BUCKET).getSignedDownloadUrl(key, { expiresIn });\n  if (result.error) {\n    log('error', 'signed download failed', { key, code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  return c.json(result.data);\n});\n\n// Pre-signed upload URL — clients PUT directly to S3 with a matching\n// content-type to avoid going through the agent on the upload path.\nroute.post('/signed-upload', async (c) => {\n  const body = await c.req.json().catch(() => ({}) as { key?: string; contentType?: string });\n  const key = body.key ?? `upload-${Date.now()}.bin`;\n\n  log('info', 'signed upload', { key, contentType: body.contentType });\n\n  const result = await client.storage\n    .from(BUCKET)\n    .getSignedUploadUrl(key, { contentType: body.contentType });\n  if (result.error) {\n    log('error', 'signed upload failed', { key, code: result.error.code });\n    return c.json({ error: result.error }, 502);\n  }\n\n  return c.json(result.data);\n});\n\nexport default route;\n";
+//#endregion
+//#region src/services/starter-loader.ts
+var STARTERS_PATH_RE = /(?:^|\/)starters\/([^/]+)\/(.+)$/;
+var OTHER_CATEGORY = "Other";
+var slugFromManifestPath$1 = (path) => {
+	const match = STARTERS_PATH_RE.exec(path);
+	if (!match || match[2] !== "package.json") return null;
+	return match[1];
+};
+var slugFromFilePath = (path) => {
+	const match = STARTERS_PATH_RE.exec(path);
+	if (!match) return null;
+	const rel = match[2];
+	if (rel === "package.json") return null;
+	return {
+		slug: match[1],
+		rel
+	};
+};
+var requireString = (value, field, slug) => {
+	if (typeof value !== "string" || value.length === 0) throw new Error(`Starter '${slug}': field 'stackbone.${field}' must be a non-empty string.`);
 	return value;
 };
-var idFromManifestPath = (path) => {
-	const match = path.match(/\/templates\/([^/]+)\/template\.yaml$/);
-	if (!match || !match[1]) throw new Error(`Unexpected manifest path '${path}' (expected '../templates/<id>/template.yaml').`);
-	return match[1];
+var parseManifest = (slug, raw) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		throw new Error(`Starter '${slug}': package.json is not valid JSON (${reason}).`);
+	}
+	if (typeof parsed.name !== "string" || parsed.name.length === 0) throw new Error(`Starter '${slug}': package.json 'name' must be a non-empty string.`);
+	const expected = `starter-${slug}`;
+	if (parsed.name !== expected) throw new Error(`Starter '${slug}': package.json 'name' is '${parsed.name}' but must be '${expected}'.`);
+	const stackbone = parsed.stackbone ?? {};
+	const label = requireString(stackbone.label, "label", slug);
+	const hint = requireString(stackbone.hint, "hint", slug);
+	let order = null;
+	if (stackbone.order !== void 0) {
+		if (typeof stackbone.order !== "number" || !Number.isFinite(stackbone.order)) throw new Error(`Starter '${slug}': field 'stackbone.order' must be a finite number.`);
+		order = stackbone.order;
+	}
+	let category = null;
+	if (stackbone.category !== void 0) {
+		if (typeof stackbone.category !== "string" || stackbone.category.length === 0) throw new Error(`Starter '${slug}': field 'stackbone.category' must be a non-empty string when present.`);
+		category = stackbone.category;
+	}
+	return {
+		packageName: parsed.name,
+		meta: {
+			label,
+			hint,
+			order,
+			category
+		}
+	};
 };
-var groupFilesByTemplate = () => {
+var groupFiles = (fileMap) => {
 	const grouped = /* @__PURE__ */ new Map();
-	for (const [path, contents] of Object.entries(fileModules)) {
-		const match = path.match(/\/templates\/([^/]+)\/(.+)$/);
-		if (!match) continue;
-		const id = match[1];
-		const rel = match[2];
-		let bucket = grouped.get(id);
+	for (const [path, contents] of Object.entries(fileMap)) {
+		const parsed = slugFromFilePath(path);
+		if (!parsed) continue;
+		let bucket = grouped.get(parsed.slug);
 		if (!bucket) {
 			bucket = [];
-			grouped.set(id, bucket);
+			grouped.set(parsed.slug, bucket);
 		}
 		bucket.push({
-			path: rel,
+			path: parsed.rel,
 			contents
 		});
 	}
 	for (const bucket of grouped.values()) bucket.sort((a, b) => a.path.localeCompare(b.path));
 	return grouped;
 };
-var validateVariables = (id, variables, files) => {
-	const declared = new Set(variables);
-	const undeclared = /* @__PURE__ */ new Set();
-	for (const file of files) for (const match of file.contents.matchAll(TOKEN_PATTERN)) {
-		const name = match[1];
-		if (name && !declared.has(name)) undeclared.add(name);
+/**
+* Compare two starters by the documented ordering: `(category, order, slug)`.
+*
+* - `category`: starters without a declared category fall into an `Other` bucket
+*   placed after named categories (lex order among named categories).
+* - `order`: lower numeric values come first; missing `order` is treated as
+*   `+Infinity` so explicit-order starters always win against defaults.
+* - `slug`: final tiebreaker, lexicographic.
+*/
+var compareStarters = (a, b) => {
+	const catA = a.metadata.category ?? OTHER_CATEGORY;
+	const catB = b.metadata.category ?? OTHER_CATEGORY;
+	if (catA !== catB) {
+		if (catA === OTHER_CATEGORY) return 1;
+		if (catB === OTHER_CATEGORY) return -1;
+		return catA.localeCompare(catB);
 	}
-	if (undeclared.size > 0) throw new Error(`Template '${id}' uses undeclared variables: ${[...undeclared].join(", ")}. Add them to template.yaml 'variables'.`);
-};
-var parseManifest = (id, raw, files) => {
-	const parsed = parse(raw);
-	if (!parsed) throw new Error(`Template '${id}': empty or invalid YAML.`);
-	if (parsed.id !== id) throw new Error(`Template '${id}': manifest id '${String(parsed.id)}' does not match directory name.`);
-	if (typeof parsed.order !== "number") throw new Error(`Template '${id}': field 'order' must be a number.`);
-	const variables = Array.isArray(parsed.variables) ? parsed.variables.map(String) : [];
-	validateVariables(id, variables, files);
-	return {
-		id,
-		label: requireString(parsed.label, "label", id),
-		hint: requireString(parsed.hint, "hint", id),
-		order: parsed.order,
-		variables,
-		files
-	};
+	const orderA = a.metadata.order ?? Number.POSITIVE_INFINITY;
+	const orderB = b.metadata.order ?? Number.POSITIVE_INFINITY;
+	if (orderA !== orderB) return orderA - orderB;
+	return a.slug.localeCompare(b.slug);
 };
-var loadTemplates = () => {
-	const filesByTemplate = groupFilesByTemplate();
-	const all = [];
-	for (const [path, raw] of Object.entries(manifestModules)) {
-		const id = idFromManifestPath(path);
-		all.push(parseManifest(id, raw, filesByTemplate.get(id) ?? []));
+/**
+* Load starters from raw `import.meta.glob` maps.
+*
+* @param manifestMap one entry per `starters/<slug>/package.json` (raw JSON contents)
+* @param fileMap every other file under `starters/<slug>/**` (raw string contents)
+* @returns the loaded starters ordered by `(category, order, slug)`
+*/
+var loadStarters = (manifestMap, fileMap) => {
+	const filesBySlug = groupFiles(fileMap);
+	const loaded = [];
+	for (const [path, raw] of Object.entries(manifestMap)) {
+		const slug = slugFromManifestPath$1(path);
+		if (!slug) continue;
+		const { packageName, meta } = parseManifest(slug, raw);
+		loaded.push({
+			slug,
+			packageName,
+			metadata: meta,
+			files: filesBySlug.get(slug) ?? []
+		});
 	}
-	all.sort((a, b) => a.order - b.order || a.id.localeCompare(b.id));
-	return new Map(all.map((t) => [t.id, t]));
-};
-var TEMPLATES_BY_ID = loadTemplates();
-var TEMPLATES = [...TEMPLATES_BY_ID.values()].map((t) => ({
-	id: t.id,
-	label: t.label,
-	hint: t.hint
-}));
-var parseTemplateId = (value) => {
-	if (!value) return null;
-	return TEMPLATES_BY_ID.has(value) ? value : null;
+	loaded.sort(compareStarters);
+	return loaded;
 };
-var substitute = (contents, input) => contents.replace(TOKEN_PATTERN, (_match, key) => {
-	if (key in input) return input[key];
-	throw new Error(`Template variable '${key}' is not provided. Known: ${Object.keys(input).join(", ")}.`);
-});
-var renderTemplate = (templateId, input) => {
-	const template = TEMPLATES_BY_ID.get(templateId);
-	if (!template) throw new Error(`Unknown template id '${templateId}'. Known: ${[...TEMPLATES_BY_ID.keys()].join(", ")}.`);
-	return template.files.map((file) => ({
+//#endregion
+//#region src/services/starter-renderer.ts
+/**
+* Replace every literal occurrence of `needle` in `haystack` with
+* `replacement`. The needle is treated as a literal string even when it
+* contains regex-special characters.
+*/
+var replaceAllLiteral = (haystack, needle, replacement) => {
+	if (needle.length === 0) return haystack;
+	return haystack.split(needle).join(replacement);
+};
+/**
+* Render a loaded starter into a file collection ready to be written to disk.
+*
+* The renderer is pure and idempotent: re-running with the same `agentSlug`
+* on already-rendered contents is a no-op.
+*
+* @param starter the loaded starter, carrying its `packageName` source string
+* @param options `{ agentSlug }` — the target slug to substitute in contents
+* @returns a new file collection with substituted contents; paths preserved
+*/
+var renderStarter$1 = (starter, options) => {
+	const { agentSlug } = options;
+	const { packageName } = starter;
+	return starter.files.map((file) => ({
 		path: file.path,
-		contents: substitute(file.contents, input),
-		...file.executable ? { executable: true } : {}
+		contents: replaceAllLiteral(file.contents, packageName, agentSlug)
 	}));
 };
 //#endregion
+//#region src/services/scaffolding.ts
+var manifestModules = /* @__PURE__ */ Object.assign({
+	"../../../../starters/ai/package.json": package_default$9,
+	"../../../../starters/config/package.json": package_default$8,
+	"../../../../starters/db/package.json": package_default$7,
+	"../../../../starters/hello-world/package.json": package_default$6,
+	"../../../../starters/hitl/package.json": package_default$5,
+	"../../../../starters/prompts/package.json": package_default$4,
+	"../../../../starters/queues/package.json": package_default$3,
+	"../../../../starters/rag/package.json": package_default$2,
+	"../../../../starters/secrets/package.json": package_default$1,
+	"../../../../starters/storage/package.json": package_default
+});
+var fileModules = /* @__PURE__ */ Object.assign({
+	"../../../../starters/ai/.claude/skills/stackbone/SKILL.md": SKILL_default$8,
+	"../../../../starters/ai/.gitignore": _gitignore_raw_default$8,
+	"../../../../starters/ai/Dockerfile": Dockerfile_raw_default$9,
+	"../../../../starters/ai/README.md": README_default$9,
+	"../../../../starters/ai/agent.yaml": agent_default$9,
+	"../../../../starters/ai/src/index.ts": src_default$9,
+	"../../../../starters/ai/src/lib/client.ts": client_default$8,
+	"../../../../starters/ai/src/lib/logger.ts": logger_default$8,
+	"../../../../starters/ai/src/routes/embeddings.ts": embeddings_default,
+	"../../../../starters/ai/src/routes/health.ts": health_default$8,
+	"../../../../starters/ai/src/routes/invoke.ts": invoke_default$8,
+	"../../../../starters/ai/src/routes/models.ts": models_default,
+	"../../../../starters/ai/src/routes/schema-info.ts": schema_info_default$8,
+	"../../../../starters/config/.claude/skills/stackbone/SKILL.md": SKILL_default$7,
+	"../../../../starters/config/.gitignore": _gitignore_raw_default$7,
+	"../../../../starters/config/Dockerfile": Dockerfile_raw_default$8,
+	"../../../../starters/config/README.md": README_default$8,
+	"../../../../starters/config/agent.yaml": agent_default$8,
+	"../../../../starters/config/src/index.ts": src_default$8,
+	"../../../../starters/config/src/lib/client.ts": client_default$7,
+	"../../../../starters/config/src/lib/logger.ts": logger_default$7,
+	"../../../../starters/config/src/routes/get-config.ts": get_config_default,
+	"../../../../starters/config/src/routes/get-many.ts": get_many_default$1,
+	"../../../../starters/config/src/routes/health.ts": health_default$7,
+	"../../../../starters/config/src/routes/invoke.ts": invoke_default$7,
+	"../../../../starters/config/src/routes/schema-info.ts": schema_info_default$7,
+	"../../../../starters/db/.claude/skills/stackbone/SKILL.md": SKILL_default$6,
+	"../../../../starters/db/.gitignore": _gitignore_raw_default$6,
+	"../../../../starters/db/Dockerfile": Dockerfile_raw_default$7,
+	"../../../../starters/db/README.md": README_default$7,
+	"../../../../starters/db/agent.yaml": agent_default$7,
+	"../../../../starters/db/src/index.ts": src_default$7,
+	"../../../../starters/db/src/lib/client.ts": client_default$6,
+	"../../../../starters/db/src/lib/logger.ts": logger_default$6,
+	"../../../../starters/db/src/routes/delete-example.ts": delete_example_default,
+	"../../../../starters/db/src/routes/health.ts": health_default$6,
+	"../../../../starters/db/src/routes/invoke.ts": invoke_default$6,
+	"../../../../starters/db/src/routes/list-examples.ts": list_examples_default,
+	"../../../../starters/db/src/routes/schema-info.ts": schema_info_default$6,
+	"../../../../starters/db/src/schema.ts": schema_default$1,
+	"../../../../starters/hello-world/.stackbone/migrations/0000_init.sql": _0000_init_default,
+	"../../../../starters/hello-world/.stackbone/migrations/meta/0000_snapshot.json": _0000_snapshot_default,
+	"../../../../starters/hello-world/.stackbone/migrations/meta/_journal.json": _journal_default,
+	"../../../../starters/hello-world/Dockerfile": Dockerfile_raw_default$6,
+	"../../../../starters/hello-world/README.md": README_default$6,
+	"../../../../starters/hello-world/agent.yaml": agent_default$6,
+	"../../../../starters/hello-world/src/index.ts": src_default$6,
+	"../../../../starters/hello-world/src/schema.ts": schema_default,
+	"../../../../starters/hitl/.claude/skills/stackbone/SKILL.md": SKILL_default$5,
+	"../../../../starters/hitl/.gitignore": _gitignore_raw_default$5,
+	"../../../../starters/hitl/Dockerfile": Dockerfile_raw_default$5,
+	"../../../../starters/hitl/README.md": README_default$5,
+	"../../../../starters/hitl/agent.yaml": agent_default$5,
+	"../../../../starters/hitl/src/index.ts": src_default$5,
+	"../../../../starters/hitl/src/lib/client.ts": client_default$5,
+	"../../../../starters/hitl/src/lib/logger.ts": logger_default$5,
+	"../../../../starters/hitl/src/routes/cancel.ts": cancel_default,
+	"../../../../starters/hitl/src/routes/decide.ts": decide_default,
+	"../../../../starters/hitl/src/routes/get-approval.ts": get_approval_default,
+	"../../../../starters/hitl/src/routes/health.ts": health_default$5,
+	"../../../../starters/hitl/src/routes/invoke.ts": invoke_default$5,
+	"../../../../starters/hitl/src/routes/list-approvals.ts": list_approvals_default,
+	"../../../../starters/hitl/src/routes/schema-info.ts": schema_info_default$5,
+	"../../../../starters/prompts/.claude/skills/stackbone/SKILL.md": SKILL_default$4,
+	"../../../../starters/prompts/.gitignore": _gitignore_raw_default$4,
+	"../../../../starters/prompts/Dockerfile": Dockerfile_raw_default$4,
+	"../../../../starters/prompts/README.md": README_default$4,
+	"../../../../starters/prompts/agent.yaml": agent_default$4,
+	"../../../../starters/prompts/src/index.ts": src_default$4,
+	"../../../../starters/prompts/src/lib/client.ts": client_default$4,
+	"../../../../starters/prompts/src/lib/logger.ts": logger_default$4,
+	"../../../../starters/prompts/src/routes/create-prompt.ts": create_prompt_default,
+	"../../../../starters/prompts/src/routes/get-prompt.ts": get_prompt_default,
+	"../../../../starters/prompts/src/routes/health.ts": health_default$4,
+	"../../../../starters/prompts/src/routes/invoke.ts": invoke_default$4,
+	"../../../../starters/prompts/src/routes/list-prompts.ts": list_prompts_default,
+	"../../../../starters/prompts/src/routes/schema-info.ts": schema_info_default$4,
+	"../../../../starters/queues/.claude/skills/stackbone/SKILL.md": SKILL_default$3,
+	"../../../../starters/queues/.gitignore": _gitignore_raw_default$3,
+	"../../../../starters/queues/Dockerfile": Dockerfile_raw_default$3,
+	"../../../../starters/queues/README.md": README_default$3,
+	"../../../../starters/queues/agent.yaml": agent_default$3,
+	"../../../../starters/queues/src/index.ts": src_default$3,
+	"../../../../starters/queues/src/lib/client.ts": client_default$3,
+	"../../../../starters/queues/src/lib/logger.ts": logger_default$3,
+	"../../../../starters/queues/src/routes/health.ts": health_default$3,
+	"../../../../starters/queues/src/routes/invoke.ts": invoke_default$3,
+	"../../../../starters/queues/src/routes/publish.ts": publish_default,
+	"../../../../starters/queues/src/routes/receive.ts": receive_default,
+	"../../../../starters/queues/src/routes/schema-info.ts": schema_info_default$3,
+	"../../../../starters/rag/.claude/skills/stackbone/SKILL.md": SKILL_default$2,
+	"../../../../starters/rag/.gitignore": _gitignore_raw_default$2,
+	"../../../../starters/rag/Dockerfile": Dockerfile_raw_default$2,
+	"../../../../starters/rag/README.md": README_default$2,
+	"../../../../starters/rag/agent.yaml": agent_default$2,
+	"../../../../starters/rag/src/index.ts": src_default$2,
+	"../../../../starters/rag/src/lib/client.ts": client_default$2,
+	"../../../../starters/rag/src/lib/logger.ts": logger_default$2,
+	"../../../../starters/rag/src/routes/chunk.ts": chunk_default,
+	"../../../../starters/rag/src/routes/delete.ts": delete_default,
+	"../../../../starters/rag/src/routes/health.ts": health_default$2,
+	"../../../../starters/rag/src/routes/ingest.ts": ingest_default,
+	"../../../../starters/rag/src/routes/invoke.ts": invoke_default$2,
+	"../../../../starters/rag/src/routes/retrieve.ts": retrieve_default,
+	"../../../../starters/rag/src/routes/schema-info.ts": schema_info_default$2,
+	"../../../../starters/secrets/.claude/skills/stackbone/SKILL.md": SKILL_default$1,
+	"../../../../starters/secrets/.gitignore": _gitignore_raw_default$1,
+	"../../../../starters/secrets/Dockerfile": Dockerfile_raw_default$1,
+	"../../../../starters/secrets/README.md": README_default$1,
+	"../../../../starters/secrets/agent.yaml": agent_default$1,
+	"../../../../starters/secrets/src/index.ts": src_default$1,
+	"../../../../starters/secrets/src/lib/client.ts": client_default$1,
+	"../../../../starters/secrets/src/lib/logger.ts": logger_default$1,
+	"../../../../starters/secrets/src/routes/get-many.ts": get_many_default,
+	"../../../../starters/secrets/src/routes/get-secret.ts": get_secret_default,
+	"../../../../starters/secrets/src/routes/health.ts": health_default$1,
+	"../../../../starters/secrets/src/routes/invoke.ts": invoke_default$1,
+	"../../../../starters/secrets/src/routes/schema-info.ts": schema_info_default$1,
+	"../../../../starters/storage/.claude/skills/stackbone/SKILL.md": SKILL_default,
+	"../../../../starters/storage/.gitignore": _gitignore_raw_default,
+	"../../../../starters/storage/Dockerfile": Dockerfile_raw_default,
+	"../../../../starters/storage/README.md": README_default,
+	"../../../../starters/storage/agent.yaml": agent_default,
+	"../../../../starters/storage/src/index.ts": src_default,
+	"../../../../starters/storage/src/lib/client.ts": client_default,
+	"../../../../starters/storage/src/lib/logger.ts": logger_default,
+	"../../../../starters/storage/src/routes/delete-object.ts": delete_object_default,
+	"../../../../starters/storage/src/routes/download.ts": download_default,
+	"../../../../starters/storage/src/routes/health.ts": health_default,
+	"../../../../starters/storage/src/routes/invoke.ts": invoke_default,
+	"../../../../starters/storage/src/routes/list-objects.ts": list_objects_default,
+	"../../../../starters/storage/src/routes/schema-info.ts": schema_info_default,
+	"../../../../starters/storage/src/routes/signed-url.ts": signed_url_default
+});
+var slugFromManifestPath = (path) => {
+	const match = /(?:^|\/)starters\/([^/]+)\/package\.json$/.exec(path);
+	return match ? match[1] : null;
+};
+var manifestContentsBySlug = new Map(Object.entries(manifestModules).map(([path, raw]) => {
+	const slug = slugFromManifestPath(path);
+	return slug ? [slug, raw] : null;
+}).filter((entry) => entry !== null));
+var withManifestFile = (starter) => {
+	const manifestContents = manifestContentsBySlug.get(starter.slug);
+	if (!manifestContents) return starter;
+	const files = [{
+		path: "package.json",
+		contents: manifestContents
+	}, ...starter.files];
+	files.sort((a, b) => a.path.localeCompare(b.path));
+	return {
+		...starter,
+		files
+	};
+};
+var STARTERS_BY_ID = new Map(loadStarters(manifestModules, fileModules).map(withManifestFile).map((s) => [s.slug, s]));
+var STARTERS = [...STARTERS_BY_ID.values()].map((s) => ({
+	id: s.slug,
+	label: s.metadata.label,
+	hint: s.metadata.hint
+}));
+var parseStarterId = (value) => {
+	if (!value) return null;
+	return STARTERS_BY_ID.has(value) ? value : null;
+};
+var renderStarter = (starterId, input) => {
+	const starter = STARTERS_BY_ID.get(starterId);
+	if (!starter) throw new Error(`Unknown starter id '${starterId}'. Known: ${[...STARTERS_BY_ID.keys()].join(", ")}.`);
+	return renderStarter$1(starter, { agentSlug: input.agentSlug });
+};
+var STARTER_DESCRIPTORS = [...STARTERS_BY_ID.values()].map((s) => ({
+	id: s.slug,
+	label: s.metadata.label,
+	hint: s.metadata.hint,
+	category: s.metadata.category,
+	order: s.metadata.order
+}));
+//#endregion
 //#region src/commands/init/init.command.ts
+var DEFAULT_STARTER_ID = "hello-world";
 var STACKBONE_OWNED_FILES = [
 	"agent.yaml",
 	".stackbone/project.json",
@@ -8415,6 +9090,11 @@ var STACKBONE_OWNED_FILES = [
 	".claude/skills/stackbone/SKILL.md"
 ];
 var NAME_REGEX = /^[a-z0-9][a-z0-9-]{0,63}$/i;
+var CATEGORY_PRIORITY = {
+	Core: 0,
+	Capabilities: 1
+};
+var UNCATEGORISED_LABEL = "Other";
 var directoryNameOrFallback = (cwd) => {
 	const base = basename(cwd) || "stackbone-agent";
 	return NAME_REGEX.test(base) ? base : "stackbone-agent";
@@ -8439,8 +9119,18 @@ var ensureEmptyOrForce = async (targetDir, force) => {
 		suggestion: "Re-run with `--force` or pick an empty directory"
 	});
 };
+var bailIfCancelled = (value) => {
+	if (isCancel(value)) {
+		cancel("Init cancelled.");
+		throw new StackboneCliError({
+			code: "generic",
+			message: "Init cancelled by user"
+		});
+	}
+	return value;
+};
 var promptForName = async (defaultName) => {
-	const value = await text({
+	return bailIfCancelled(await text({
 		message: "Agent name",
 		placeholder: defaultName,
 		defaultValue: defaultName,
@@ -8449,42 +9139,58 @@ var promptForName = async (defaultName) => {
 			if (v.length === 0) return "Name cannot be empty";
 			if (v.length > 120) return "Name is too long";
 		}
-	});
-	if (isCancel(value)) {
-		cancel("Init cancelled.");
-		throw new StackboneCliError({
-			code: "generic",
-			message: "Init cancelled by user"
-		});
-	}
-	return value.trim();
-};
-var promptForTemplate = async () => {
-	const value = await select({
-		message: "Pick a template",
-		options: TEMPLATES.map((t) => ({
-			value: t.id,
-			label: t.label,
-			hint: t.hint
-		}))
-	});
-	if (isCancel(value)) {
-		cancel("Init cancelled.");
-		throw new StackboneCliError({
-			code: "generic",
-			message: "Init cancelled by user"
+	})).trim();
+};
+var buildPickerOptions = () => {
+	const sections = /* @__PURE__ */ new Map();
+	for (const starter of STARTER_DESCRIPTORS) {
+		const category = starter.category ?? UNCATEGORISED_LABEL;
+		let bucket = sections.get(category);
+		if (!bucket) {
+			bucket = [];
+			sections.set(category, bucket);
+		}
+		bucket.push({
+			value: starter.id,
+			label: `[${category}] ${starter.label}`,
+			hint: starter.hint
 		});
 	}
-	return value;
+	const sectionOrder = (name) => {
+		if (name === UNCATEGORISED_LABEL) return [Number.POSITIVE_INFINITY, name];
+		return [CATEGORY_PRIORITY[name] ?? Number.POSITIVE_INFINITY - 1, name];
+	};
+	return [...sections.entries()].sort(([a], [b]) => {
+		const [pa, na] = sectionOrder(a);
+		const [pb, nb] = sectionOrder(b);
+		if (pa !== pb) return pa - pb;
+		return na.localeCompare(nb);
+	}).flatMap(([, options]) => options);
+};
+var promptForStarter = async () => {
+	return bailIfCancelled(await select({
+		message: "Pick a starter",
+		options: buildPickerOptions()
+	}));
 };
-var resolveInputs = async (ctx, flags, namePositional) => {
+var validSlugList = () => STARTERS.map((s) => s.id).join(", ");
+var resolveInitInputs = async (ctx, flags, namePositional) => {
+	if (flags.legacyTemplate !== void 0) throw new StackboneCliError({
+		code: "generic",
+		message: `--template was renamed to --starter; rerun with --starter ${flags.legacyTemplate}`
+	});
 	const targetDir = resolve(ctx.cwd, namePositional ?? ".");
 	const fallbackName = namePositional ?? directoryNameOrFallback(targetDir);
 	const interactive = isInteractiveStdin(ctx.env) && !ctx.flags.yes && !ctx.flags.json;
 	let agentName = flags.name ?? namePositional ?? (interactive ? await promptForName(fallbackName) : fallbackName);
 	agentName = agentName.trim();
-	let templateId = parseTemplateId(flags.template);
-	if (!templateId) templateId = interactive ? await promptForTemplate() : "hello-world";
+	let starterId = parseStarterId(flags.starter);
+	if (flags.starter !== void 0 && starterId === null) throw new StackboneCliError({
+		code: "generic",
+		message: `Unknown starter '${flags.starter}'`,
+		suggestion: `Valid starters: ${validSlugList()}`
+	});
+	if (!starterId) starterId = interactive ? await promptForStarter() : DEFAULT_STARTER_ID;
 	if (flags.slug !== void 0) {
 		if (!agentSlugSchema.safeParse(flags.slug).success) throw new StackboneCliError({
 			code: "generic",
@@ -8496,27 +9202,29 @@ var resolveInputs = async (ctx, flags, namePositional) => {
 		agentName,
 		agentSlug: flags.slug,
 		description: flags.description,
-		templateId,
+		starterId,
 		targetDir
 	};
 };
-var writeProject = async (ctx, resolved, agent, force) => {
+var writeProject = async (ctx, resolved, agent, force, localDev) => {
 	const writeInput = {
 		root: resolved.targetDir,
 		force
 	};
 	await mkdir(resolved.targetDir, { recursive: true });
-	const templateFiles = renderTemplate(resolved.templateId, {
-		agentName: resolved.agentName,
-		agentSlug: agent.slug
-	});
-	await writeTemplateFiles(templateFiles, writeInput);
+	const starterFiles = renderStarter(resolved.starterId, { agentSlug: agent.slug });
+	await writeStarterFiles(starterFiles, writeInput);
 	await writeAgentManifest(resolved.agentName, writeInput);
-	const projectConfig = await writeProjectConfig(ctx, agent, writeInput);
+	const projectConfig = await writeProjectConfig(ctx, agent, writeInput, {
+		localDevInstallationId: localDev.id,
+		organizationSlug: localDev.organizationSlug,
+		agentSlug: localDev.agentSlug,
+		starter: resolved.starterId
+	});
 	await ensureGitignore(resolved.targetDir);
 	const skillFiles = await writeSkillFiles(ctx, agent, projectConfig, writeInput);
 	return { filesWritten: [
-		...templateFiles.map((f) => f.path),
+		...starterFiles.map((f) => f.path),
 		"agent.yaml",
 		".stackbone/project.json",
 		".gitignore",
@@ -8527,21 +9235,31 @@ var buildHandler$1 = (ctx, args) => protectedCommand(async (innerCtx) => {
 	if (!innerCtx.flags.json) intro("stackbone init");
 	const flags = {
 		name: args.name,
-		template: args.template,
+		starter: args.starter,
+		legacyTemplate: args.template,
 		slug: args.slug,
 		description: args.description,
 		force: Boolean(args.force)
 	};
-	const resolved = await resolveInputs(innerCtx, flags, args.name);
+	const resolved = await resolveInitInputs(innerCtx, flags, args.name);
 	await ensureEmptyOrForce(resolved.targetDir, flags.force);
-	if (!innerCtx.flags.json) log.step(`Creating "${resolved.agentName}" (template: ${resolved.templateId})`);
+	if (!innerCtx.flags.json) log.step(`Creating "${resolved.agentName}" (starter: ${resolved.starterId})`);
+	const activeOrg = await getActiveOrganization(innerCtx);
 	const agent = await createAgent(innerCtx, {
-		organizationSlug: (await getActiveOrganization(innerCtx)).slug,
+		organizationSlug: activeOrg.slug,
 		name: resolved.agentName,
 		...resolved.agentSlug !== void 0 ? { slug: resolved.agentSlug } : {},
 		...resolved.description !== void 0 ? { description: resolved.description } : {}
 	});
-	const { filesWritten } = await writeProject(innerCtx, resolved, agent, flags.force);
+	const localDev = await upsertLocalDevInstallation(innerCtx, {
+		creatorOrganizationSlug: activeOrg.slug,
+		agentTemplateSlug: agent.slug
+	});
+	const { filesWritten } = await writeProject(innerCtx, resolved, agent, flags.force, {
+		id: localDev.id,
+		organizationSlug: localDev.organizationSlug,
+		agentSlug: localDev.agentSlug
+	});
 	emit(innerCtx.flags, () => "", {
 		agent: {
 			id: agent.id,
@@ -8549,8 +9267,12 @@ var buildHandler$1 = (ctx, args) => protectedCommand(async (innerCtx) => {
 			name: agent.name
 		},
 		organization_id: agent.organizationId,
+		local_dev_installation: {
+			id: localDev.id,
+			organization_slug: localDev.organizationSlug
+		},
 		target_dir: resolved.targetDir,
-		template: resolved.templateId,
+		starter: resolved.starterId,
 		files_written: filesWritten
 	});
 	if (!innerCtx.flags.json) outro([
@@ -8566,7 +9288,7 @@ var buildHandler$1 = (ctx, args) => protectedCommand(async (innerCtx) => {
 var createInitCommand = (ctx) => defineCommand({
 	meta: {
 		name: "init",
-		description: "Scaffold a new Stackbone project with templates + Claude skill."
+		description: "Scaffold a new Stackbone project with starters + Claude skill."
 	},
 	args: {
 		name: {
@@ -8574,9 +9296,13 @@ var createInitCommand = (ctx) => defineCommand({
 			description: "Subdirectory + initial agent name. Omit to use the current directory.",
 			required: false
 		},
+		starter: {
+			type: "string",
+			description: `Starter slug. One of ${validSlugList()}. Default: ${DEFAULT_STARTER_ID}.`
+		},
 		template: {
 			type: "string",
-			description: `Template id. One of ${TEMPLATES.map((t) => t.id).join(", ")}. Default: hello-world.`
+			description: "(removed) renamed to --starter; pre-rename flag kept only to emit the migration message."
 		},
 		slug: {
 			type: "string",
@@ -8637,11 +9363,20 @@ var buildHandler = (ctx, args) => protectedCommand(async (innerCtx) => {
 		}
 		chosenSlug = value;
 	}
-	const agent = await getAgentByOwnerAndSlug(innerCtx, (await getActiveOrganization(innerCtx)).slug, chosenSlug);
+	const activeOrg = await getActiveOrganization(innerCtx);
+	const agent = await getAgentByOwnerAndSlug(innerCtx, activeOrg.slug, chosenSlug);
 	if (!innerCtx.flags.json) log.step(`Linking ${targetDir} to ${agent.slug}`);
+	const localDev = await upsertLocalDevInstallation(innerCtx, {
+		creatorOrganizationSlug: activeOrg.slug,
+		agentTemplateSlug: agent.slug
+	});
 	const projectConfig = await writeProjectConfig(innerCtx, agent, {
 		root: targetDir,
 		force: true
+	}, {
+		localDevInstallationId: localDev.id,
+		organizationSlug: localDev.organizationSlug,
+		agentSlug: localDev.agentSlug
 	});
 	await ensureGitignore(targetDir);
 	const skillFiles = await writeSkillFiles(innerCtx, agent, projectConfig, {
@@ -8655,6 +9390,10 @@ var buildHandler = (ctx, args) => protectedCommand(async (innerCtx) => {
 			name: agent.name
 		},
 		organization_id: agent.organizationId,
+		local_dev_installation: {
+			id: localDev.id,
+			organization_slug: localDev.organizationSlug
+		},
 		target_dir: targetDir,
 		files_written: [
 			".stackbone/project.json",
@@ -8884,9 +9623,9 @@ var buildRootCommand = async () => {
 				type: "string",
 				description: "Override the control plane URL."
 			},
-			"no-auto-login": {
+			verbose: {
 				type: "boolean",
-				description: "Refuse to start the device-code flow when no session exists.",
+				description: "Stream every log line and docker compose output instead of the per-stage spinner UI.",
 				default: false
 			}
 		},