@tealbrick/kit 0.2.6 → 0.3.0-rc.1

package/BOOTSTRAP.md

@@ -1,13 +1,12 @@
-> Eve 0.63.0 is a candidate; the approved baseline remains Eve 0.58.1. Suite 0.2.4 is an unpublished compatibility candidate.
+> Prerelease 0.3.0-rc.1 targets fresh Eve 0.70 installations. Use the explicit candidate version or `next` tag after publication. Stable `latest` remains 0.2.7 for existing Eve 0.66 installations; durable cross-version session migration is not validated.
 
 # Deployment guide: Eve agent + Teal Brick kit
 
 This guide installs the seven implemented packages through one kit and activates
-only the capabilities you select. The supported harness line is **Eve 0.63.x**;
-**0.63.0** and **AI SDK 7.0.105** are the current tested versions. Use Node **24**.
+only the capabilities you select. The supported harness line is **Eve 0.70.x**;
+**0.70.0** and **AI SDK 7.0.127** are the current tested versions. Use Node **24**.
 
-**Release status:** `@tealbrick/kit@0.2.4` is the unpublished Eve 0.63 compatibility candidate for the
-complete suite. Use the npm installation in step 3. Do not substitute an unrelated unscoped `tealbrick` package.
+**Release status:** this prerelease is prepared for the `next` tag. Until publication, use the reviewed local tarballs. The versioned npm commands apply after publication. Native onboarding additionally requires the matching Portal runtime setup endpoints.
 
 ## What installs what
 
@@ -19,12 +18,12 @@ Eve runs the agent and needs its own working primary-model authentication.
 For a fresh machine, the sequence is:
 
 1. Install Node 24 and npm.
-2. Create an Eve 0.63.0 project and configure its primary model credentials.
-3. Install `@tealbrick/kit@0.2.4` inside that project.
+2. Create an Eve 0.70.0 project and configure its primary model credentials.
+3. Install `@tealbrick/kit@0.3.0-rc.1` inside that project.
 4. Run `tealbrick setup` to sign in, select capabilities and register the card.
 5. Build and start Eve, then check a real chat from desktop.
 
-For an **existing Eve 0.63.0 project**, start at step 3 from its project directory.
+For an **existing Eve 0.70.0 project**, start at step 3 from its project directory.
 Do not run `eve init` over an existing agent. Preserve its model configuration and
 review any existing Eve channel before setup, as explained under Portal below.
 
@@ -40,14 +39,14 @@ npm --version
 
 The first command should report `v24.x`. Run the remaining commands as the account
 that will own the new agent project. For our deployment this account runs on
-Nucbox/Fedora N150. This package guide does not provision a VM or install AVMM.
+an AVMM guest on Neuu after the September23 migration. This package guide does not provision a VM or install AVMM.
 
 ## 2. Create a fresh Eve project
 
 Choose an unused project directory, outside any existing live agent:
 
 ```bash
-npx --yes eve@0.63.0 init tealbrick-agent --model openai/gpt-5.6-terra
+npx --yes eve@0.70.0 init tealbrick-agent --model openai/gpt-5.6-terra
 ```
 
 Finish scaffolding and return to the terminal before continuing. If Eve starts
@@ -55,12 +54,12 @@ Finish scaffolding and return to the terminal before continuing. If Eve starts
 
 ```bash
 cd tealbrick-agent
-npm install --save-exact eve@0.63.0 ai@7.0.105
+npm install --save-exact eve@0.70.0 ai@7.0.127
 ```
 
 Keep `package-lock.json` under version control.
 The exact Eve pin is intentional: the compatibility workflow validates patches
-before advancing it and will not cross into 0.59 automatically.
+before advancing it. No production pin changes automatically.
 
 The example model uses the Vercel AI Gateway. To supply its key for this terminal
 without putting the key in shell history, in Bash run:
@@ -82,7 +81,7 @@ Run this inside the Eve project created in step 2 (or your existing compatible
 project), not in an empty directory or as a global install:
 
 ```bash
-npm install --save-exact @tealbrick/kit@0.2.4
+npm install --save-exact @tealbrick/kit@0.3.0-rc.1
 ```
 
 This installs Portal, AVM, Voice, Vision, Deliver and the shared provider transport
@@ -245,3 +244,15 @@ Restart the running Eve process after the rebuild. Deselecting a capability remo
 its kit-owned mounts. Setup refuses to overwrite hand-edited mounts. Saved settings
 and optional local secrets live under ignored `.tealbrick/`; secrets are not embedded
 in generated source. Disabling a capability does not revoke or delete its credentials.
+
+## Eve 0.66 deployment additions (suite 0.2.7)
+
+`tealbrick setup` now includes Persistent routines and Production self-evolution.
+Routines require an enrolled host bridge, scope and runtime token; setup mounts
+CRUD, production dispatch and desktop delivery together. Self-evolution requires
+an existing `deployment/*.ts` native Eve policy module outside the writable agent
+tree. Native proposals require the deployment's existing governed activation path.
+
+AVMM/guests migrated to Neuu on September23. Verify current canonical migration
+records before targeting either host. Do not create new canary agents. Committed
+source, npm publication and installed deployment are separate states.

package/NATIVE.md

@@ -0,0 +1,77 @@
+# Native agent setup — Stage A candidate
+
+Prerelease suite **0.3.0-rc.1** targets the `next` tag. Stable npm latest remains 0.2.7, which lacks this flow. The `tealbrick` facade forwards the existing kit CLI; it is not another SDK. Matching Portal runtime setup endpoints must be deployed before native onboarding can succeed.
+
+## Install and connect
+
+Install the review tarballs with the supplied checksum-verifying `install-candidate.mjs`. Once the release is actually published, the intended installation is `npm install --save-exact tealbrick@0.3.0-rc.1`. Today that registry command is not a tested installation path.
+
+From your native agent workspace:
+
+```sh
+npx --no-install tealbrick setup
+```
+
+Choose Claude Agent SDK, Codex TypeScript SDK, LangChain or the existing Eve setup. Native setup then:
+
+1. Opens the existing Portal device-consent flow for your account.
+2. Lets you choose or create an owned workspace.
+3. Lets you create an accurately labelled agent or select an owned existing one.
+4. Creates/reuses its stable card through Portal, then enrolls its runtime connection.
+5. Saves ordinary SDK configuration at `.tealbrick/native-sdk.json`.
+
+No pre-created card, endpoint, Fleet licence, or UUID lookup is required. Names that match multiple identities require an explicit selection. Creation does not grant apps. Eve identities cannot be silently converted to native identities.
+
+Named selections also work:
+
+```sh
+npx --no-install tealbrick setup --harness claude --create-workspace Community --create-agent Researcher
+npx --no-install tealbrick setup --harness langchain --workspace-name Community --agent-name Researcher
+```
+
+The second example requires an existing **LangChain** identity. `--workspace ID --agent ID [--node ID]` remain advanced selections. Setup requires the Portal candidate's authenticated `GET/POST /api/runtime/setup`; a public gateway must expose that reviewed route. It then uses the unchanged `/api/runtime/connections` credential exchange.
+
+Repeat setup in the same workspace to reconnect. `.tealbrick/native-setup.json` retains the account-bound identity intent and idempotency key, without credentials. A lost response or enrollment failure reuses that key on retry. The local setup lock prevents concurrent installers. If the installer is killed, verify that the PID in `.tealbrick/native-setup.lock` is no longer running before removing **only that lock** and retrying; retain the journal. A different account/harness or an attempt to replace an already-bound identity fails closed.
+
+## Native SDK configuration
+
+Load `.tealbrick/native-sdk.json` into the SDK's ordinary options. No tokens are present; the installed CLI path and workspace root are absolute. Keep the package at that path. Use native SDK session persistence and continuation.
+
+```js
+const config = JSON.parse(await readFile('.tealbrick/native-sdk.json', 'utf8'));
+// Claude Agent SDK 0.3.287: preserve the generated settings hook when merging.
+const stream = query({prompt, options: {...config, model: selectedModel,
+  ...(savedSessionId ? {resume: savedSessionId} : {})}});
+// Codex TypeScript SDK 0.160.0 (not OpenAI Agents SDK)
+const codex = new Codex(config);
+const thread = savedThreadId ? codex.resumeThread(savedThreadId, options) : codex.startThread(options);
+// LangChain 1.5.15 and MCP adapters 2.0.0
+const adapter = new MCPAdapter(config);
+const agent = createAgent({model: configuredModel, tools: await adapter.listTools(), checkpointer});
+```
+
+Configure provider authentication on the native host through its supported SDK. Kit does not copy login caches, choose providers or change billing. No Eve daemon, AVMM or inbound bridge is required. Native mode emits no Eve mounts and uses the existing kit state and owner-only credential file.
+
+## Children and host authority
+
+- **Claude:** generated `settings.hooks.PreToolUse` executes the packaged guard for `mcp__tealbrick__*`. It denies requests with SDK-authored `agent_id`; parent calls receive no permission override. It preserves the host's `Agent` tool, independently scoped agents and non-Tealbrick tools. Merge this hook with existing settings instead of dropping it. Unit/process tests verify the hook; live delegated execution is still unverified.
+- **Codex:** no verified per-child credential boundary exists in this attachment. Setup explicitly asks before generating a profile with `multi_agent` and `multi_agent_v2` disabled. For scripted selection use `--delegation disabled`; the same flag is required for `native config`. It never edits the host's existing Codex config. Do not merge this profile into a delegation-enabled agent and claim isolation.
+- **LangChain:** `createAgent` receives only the two Tealbrick tools; no child tool is introduced. Do not pass this adapter into another agent. Child grants are unsupported.
+
+These controls do not isolate processes sharing an OS user. A child with unrestricted filesystem/shell access can read parent files. Keep the credential directory outside child filesystem authority; independently scoped child runtimes must receive their own grants, not the parent root or credential. No full delegated-access acceptance is claimed.
+
+## Knowledge and revocation
+
+In the selected workspace, licence/configure Knowledge, verify its instance using the existing `tealbrick app claim` flow, and save explicit CRUD tethers. The instance admin approves the claim; runtime uses a separate scoped service-principal token. Nothing automatically grants all products.
+
+```sh
+npx --no-install tealbrick app claim --workspace WORKSPACE_ID --node KNOWLEDGE_NODE_ID --binding community --endpoint https://YOUR_KNOWLEDGE_ORIGIN --company YOUR_PARTITION --issuer https://portal.tealbrick.com
+npx --no-install tealbrick native disable
+npx --no-install tealbrick native enable
+```
+
+Each request reloads local activation and fetches signed Portal authorization. Revoke or unavailable authorization blocks the next app request. In-flight side effects are not undone; cancellation reaches the app request but does not prove a write rolled back. No automatic write retry is added. Re-enrollment rotates the runtime credential and keeps the logical agent. Portal logout does not revoke that connection.
+
+## Acceptance boundary
+
+Disposable installed-artifact tests cover empty-account creation, named selection, permission/ambiguity denial, lost-response retry, signed config, scoped Knowledge-fixture read, revoke/reconnect, deactivation and MCP cancellation. They are not real browser consent or real Knowledge product proof. Root's separate Foxy receipt proves the earlier packed candidate's live Claude MCP inactive denial, exact-session process restart and compaction. Codex and LangChain have independent narrower fixture evidence, not live-provider parity. Marketplace, voice/vision and delegated Tealbrick grants are outside this Stage A claim.

package/README.md

@@ -1,4 +1,4 @@
-> Eve 0.63.0 is a candidate; the approved baseline remains Eve 0.58.1. Suite 0.2.4 is an unpublished compatibility candidate.
+> Prerelease 0.3.0-rc.1 targets fresh Eve 0.70 installations. Use the explicit candidate version or `next` tag after publication. Stable `latest` remains 0.2.7 for existing Eve 0.66 installations; durable cross-version session migration is not validated.
 
 # @tealbrick/kit
 
@@ -6,16 +6,16 @@ One installation, explicitly selected capabilities. The kit includes the current
 implemented Portal, Voice, Vision, Deliver and AVM packages. Dependencies are code
 availability, not agent permissions. Nothing is mounted by installing the kit.
 
-Install inside an existing Eve 0.63.0 project:
+Install inside an existing Eve 0.70.0 project:
 
 ```sh
-npm install --save-exact @tealbrick/kit@0.2.4
+npm install --save-exact @tealbrick/kit@0.3.0-rc.1
 npx --no-install tealbrick setup
 ```
 
 The suite is published on npm. The kit does not install, create or start Eve.
 Create the Eve project first and configure its primary-model authentication.
-Eve 0.63.0 and Node 24 are the validated host versions; VM provisioning remains
+Eve 0.70.0 and Node 24 are the validated host versions; VM provisioning remains
 host setup. After Teal Brick setup, build and start Eve to make the agent usable.
 
 See [BOOTSTRAP.md](BOOTSTRAP.md) for the complete deployment guide, including fresh-machine and existing-agent paths, provider prompts and verification.

package/dist/cli.js

@@ -4,9 +4,22 @@ import { readFile } from 'node:fs/promises';
 import { loginPortal, registerPortalCard, portalOrigin, agentOrigin } from './onboarding.js';
 import { collectSetup } from '@tealbrick/deliver/setup';
 import { applyKit, planKit, readKit } from './index.js';
+import { nativeCommand } from './native.js';
 import { runtimeOnboarding } from './runtime-onboarding.js';
 async function main() {
     const command = process.argv[2], root = process.cwd();
+    if (command === 'setup') {
+        const args = process.argv.slice(3), index = args.indexOf('--harness');
+        const harness = index >= 0 ? args[index + 1] : await select({ message: 'Agent harness', choices: [{ name: 'Claude Agent SDK', value: 'claude' }, { name: 'Codex TypeScript SDK', value: 'codex' }, { name: 'LangChain', value: 'langchain' }, { name: 'Eve', value: 'eve' }] });
+        if (harness !== 'eve') {
+            await nativeCommand(['setup', ...args, ...(index < 0 ? ['--harness', harness] : [])], root);
+            return;
+        }
+    }
+    if (command === 'native') {
+        await nativeCommand(process.argv.slice(3), root);
+        return;
+    }
     if (command === 'connect') {
         await runtimeOnboarding('connect', process.argv.slice(3), root);
         return;
@@ -37,6 +50,8 @@ async function main() {
             { name: 'Voice: live-session / STT / TTS endpoints', value: 'voice', checked: !!old.voice },
             { name: 'Vision API (native tool requires a trusted turn-auth adapter)', value: 'vision', checked: !!old.vision },
             { name: 'Deliver files to chat', value: 'deliver', checked: old.deliver !== undefined },
+            { name: 'Production self-evolution (requires deployment policy)', value: 'selfEvolution', checked: !!old.selfEvolution },
+            { name: 'Persistent routines, desktop management and AVMM wake', value: 'routines', checked: !!old.routines },
             { name: 'AVM inspection over SSH', value: 'avm', checked: !!old.avm },
         ] });
     const config = { version: 1 }, credentials = {};
@@ -95,6 +110,15 @@ async function main() {
                 delete config.avm.identityTokenFile;
         }
     }
+    if (selected.includes('selfEvolution'))
+        config.selfEvolution = { policyModule: await input({ message: 'Deployment policy module outside agent/ (deployment/name.ts)', default: old.selfEvolution?.policyModule }) };
+    if (selected.includes('routines')) {
+        const credentialRef = 'TEALBRICK_ROUTINE_BRIDGE_TOKEN';
+        const token = await password({ message: 'Host routine bridge token (blank keeps existing runtime secret)', mask: '*' });
+        if (token)
+            credentials[credentialRef] = token;
+        config.routines = { url: await input({ message: 'Enrolled host routine bridge URL including /routines', default: old.routines?.url }), credentialRef, scope: { org: login.org, workspace: workspaceId, agent: name, owner: await input({ message: 'Portal managing user ID (must match the host enrollment)', default: old.routines?.scope.owner }) }, buildCommand: JSON.parse(await input({ message: 'Build command JSON argv', default: JSON.stringify(old.routines?.buildCommand ?? ['npm', 'run', 'build']) })), restartCommand: JSON.parse(await input({ message: 'Operator-configured restart command JSON argv', default: old.routines ? JSON.stringify(old.routines.restartCommand) : undefined })) };
+    }
     console.log(JSON.stringify({ enabled: planKit(config).enabled, mounts: Object.keys(planKit(config).files) }, null, 2));
     if (!await confirm({ message: 'Apply settings and register this agent in the selected Portal workspace? Rebuild/restart Eve afterward.', default: false }))
         return;

package/dist/index.d.ts

@@ -1,6 +1,29 @@
 import { z } from 'zod';
 declare const schema: z.ZodObject<{
     version: z.ZodLiteral<1>;
+    native: z.ZodOptional<z.ZodObject<{
+        harness: z.ZodEnum<{
+            claude: "claude";
+            codex: "codex";
+            langchain: "langchain";
+        }>;
+        active: z.ZodBoolean;
+    }, z.core.$strict>>;
+    selfEvolution: z.ZodOptional<z.ZodObject<{
+        policyModule: z.ZodString;
+    }, z.core.$strict>>;
+    routines: z.ZodOptional<z.ZodObject<{
+        url: z.ZodString;
+        credentialRef: z.ZodString;
+        scope: z.ZodObject<{
+            org: z.ZodString;
+            workspace: z.ZodString;
+            agent: z.ZodString;
+            owner: z.ZodString;
+        }, z.core.$strict>;
+        buildCommand: z.ZodTuple<[z.ZodString], z.ZodString>;
+        restartCommand: z.ZodTuple<[z.ZodString], z.ZodString>;
+    }, z.core.$strict>>;
     portal: z.ZodOptional<z.ZodObject<{
         issuer: z.ZodString;
         org: z.ZodString;
@@ -922,7 +945,7 @@ declare const schema: z.ZodObject<{
     }>>>;
 }, z.core.$strict>;
 export type KitConfig = z.input<typeof schema>;
-export declare const capabilities: readonly ["portal", "runtime", "voice", "vision", "deliver", "avm"];
+export declare const capabilities: readonly ["portal", "runtime", "voice", "vision", "deliver", "avm", "routines", "selfEvolution"];
 export interface MountPlan {
     enabled: string[];
     files: Record<string, string>;

package/dist/index.js

@@ -10,19 +10,23 @@ const auth = z.object({ issuer: z.string().url().refine(v => new URL(v).protocol
 const media = z.object({ settings: z.unknown(), authorizationModule: z.string().optional() }).strict();
 const ref = z.string().regex(/^TEALBRICK_[A-Z0-9_]+$/);
 const runtime = z.object({ issuer: z.string().url(), org: z.string().min(1), workspaceId: z.string().min(1), agentId: z.string().min(1), connectionId: z.string().min(1), credentialRef: ref, bindings: z.record(z.string(), z.object({ endpoint: z.string().url(), instanceId: z.string().min(1), companyId: z.string().min(1), credentialRef: ref }).strict()) }).strict();
-const schema = z.object({ version: z.literal(1), portal: auth.optional(), runtime: runtime.optional(), voice: media.optional(), vision: media.optional(), deliver: z.unknown().optional(), avm: z.custom(v => avmConfigSchema.safeParse(v).success).transform(v => 'target' in v ? { target: v.target, sudo: v.sudo ?? false, ...Object.fromEntries(Object.entries(v).filter(([k]) => k !== 'target' && k !== 'sudo')) } : v).optional() }).strict();
-export const capabilities = ['portal', 'runtime', 'voice', 'vision', 'deliver', 'avm'];
+const command = z.tuple([z.string().min(1)]).rest(z.string());
+const routines = z.object({ url: z.string().url(), credentialRef: ref, scope: z.object({ org: z.string().min(1), workspace: z.string().min(1), agent: z.string().min(1), owner: z.string().min(1) }).strict(), buildCommand: command, restartCommand: command }).strict();
+const schema = z.object({ version: z.literal(1), native: z.object({ harness: z.enum(['claude', 'codex', 'langchain']), active: z.boolean() }).strict().optional(), selfEvolution: z.object({ policyModule: z.string().regex(/^deployment\/[a-zA-Z0-9_-]+\.(ts|js|mjs)$/) }).strict().optional(), routines: routines.optional(), portal: auth.optional(), runtime: runtime.optional(), voice: media.optional(), vision: media.optional(), deliver: z.unknown().optional(), avm: z.custom(v => avmConfigSchema.safeParse(v).success).transform(v => 'target' in v ? { target: v.target, sudo: v.sudo ?? false, ...Object.fromEntries(Object.entries(v).filter(([k]) => k !== 'target' && k !== 'sudo')) } : v).optional() }).strict();
+export const capabilities = ['portal', 'runtime', 'voice', 'vision', 'deliver', 'avm', 'routines', 'selfEvolution'];
 const marker = '// Managed by @tealbrick/kit. Change selection with tealbrick setup.\n';
 const render = (body) => marker + body + '\n';
 const hash = (data) => createHash('sha256').update(data).digest('hex');
 /** Pure mount plan: dependencies alone never contribute capabilities to Eve. */
 export function planKit(value) {
     const c = schema.parse(value), files = {};
+    if (c.native && (c.portal || c.voice || c.vision || c.deliver !== undefined || c.avm || c.routines || c.selfEvolution))
+        throw Error('kit_native_eve_configuration_conflict');
     if ((c.voice || c.vision) && !c.portal)
         throw Error('kit_media_requires_portal_binding');
     if (c.portal)
         files['agent/channels/eve.ts'] = render(`import {eveChannel} from 'eve/channels/eve';\nimport {portalAuth} from '@tealbrick/portal/eve';\nexport default eveChannel({auth:[portalAuth(${JSON.stringify(c.portal)})]});`);
-    if (c.runtime) {
+    if (c.runtime && !c.native) {
         files['agent/tools/tealbrick_capabilities.ts'] = render(`import {capabilitiesTool} from '@tealbrick/kit/runtime-eve';\nexport default capabilitiesTool(${JSON.stringify(c.runtime)});`);
         files['agent/tools/tealbrick_call.ts'] = render(`import {appCallTool} from '@tealbrick/kit/runtime-eve';\nexport default appCallTool(${JSON.stringify(c.runtime)});`);
     }
@@ -65,6 +69,25 @@ export function planKit(value) {
     }
     if (c.avm)
         files['agent/extensions/tealbrick-avm.ts'] = render(`import avm from '@tealbrick/avm/eve';\nexport default avm(${JSON.stringify(c.avm)});`);
+    if (c.selfEvolution) {
+        if (!c.portal)
+            throw Error('kit_evolution_requires_portal');
+        // Native deployed authoring policy lives outside the agent-authored tree.
+        const module = '../../' + c.selfEvolution.policyModule;
+        files['agent/extensions/tealbrick-self-evolution.ts'] = render(`import selfModification from 'eve/self-modification';\nimport policy from ${JSON.stringify(module)};\nexport default selfModification(policy);`);
+    }
+    if (c.routines) {
+        if (!c.portal || c.routines.scope.org !== c.portal.org || c.routines.scope.agent !== c.portal.agent)
+            throw Error('kit_routines_require_matching_portal');
+        const r = c.routines;
+        const endpoint = new URL(r.url);
+        if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.username || endpoint.password || endpoint.search || endpoint.hash)
+            throw Error('kit_invalid_routine_endpoint');
+        files['agent/lib/tealbrick-routines.ts'] = render(`import {createRoutineClient} from '@tealbrick/avm/routines-client';\nimport {runtimeSecret} from '@tealbrick/kit/secrets';\nexport const scope=${JSON.stringify(r.scope)};\nexport const bridge=createRoutineClient({url:${JSON.stringify(r.url)},token:async()=>{const token=await runtimeSecret(${JSON.stringify(r.credentialRef)});if(!token)throw Error('routine_credential_missing');return token;}});`);
+        files['agent/tools/tealbrick_routines.ts'] = render(`import {routineTool} from '@tealbrick/avm/routines-eve';\nimport {bridge,scope} from '../lib/tealbrick-routines';\nexport default routineTool({bridge,scope});`);
+        files['agent/channels/management.ts'] = render(`import {managementChannel} from '@tealbrick/portal/management/eve';\nimport {bridge,scope} from '../lib/tealbrick-routines';\nexport default managementChannel({auth:${JSON.stringify(c.portal)},appRoot:process.cwd(),routines:{owner:scope.owner,call:(action,input)=>bridge.call(action,input)},buildCommand:${JSON.stringify(r.buildCommand)},restartCommand:${JSON.stringify(r.restartCommand)}});`);
+        files['agent/schedules/tealbrick-routines.ts'] = render(`import {routineDispatcher} from '@tealbrick/avm/routines-eve';\nimport {bridge} from '../lib/tealbrick-routines';\nimport delivery from '../channels/management';\nexport default routineDispatcher({bridge,delivery});`);
+    }
     return { enabled: capabilities.filter(k => c[k] !== undefined), files };
 }
 async function optional(path) { try {
@@ -128,6 +151,11 @@ export async function applyKit(root, config, credentials = {}) {
             else if (content !== null)
                 throw Error(`kit_mount_conflict:${name}`);
         }
+        if (config.selfEvolution) {
+            const path = await safe(root, config.selfEvolution.policyModule);
+            if (await optional(path) === null)
+                throw Error('kit_evolution_policy_module_missing');
+        }
         if (config.vision?.authorizationModule) {
             const path = await safe(root, config.vision.authorizationModule);
             if (await optional(path) === null)

package/dist/native-child-guard.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/native-child-guard.js

@@ -0,0 +1,17 @@
+/** Claude SDK command hook: protect this MCP attachment without disabling unrelated experts.
+ * agent_id is SDK-authored context, never a model tool argument. This is not OS isolation. */
+let output = { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: 'Tealbrick child authority is not configured' } };
+try {
+    let text = '';
+    for await (const chunk of process.stdin) {
+        text += chunk;
+        if (text.length > 65536)
+            throw Error('oversized_hook');
+    }
+    const input = JSON.parse(text);
+    if (input.hook_event_name === 'PreToolUse' && typeof input.tool_name === 'string' && input.tool_name.startsWith('mcp__tealbrick__') && input.agent_id === undefined)
+        output = {};
+}
+catch { }
+process.stdout.write(JSON.stringify(output) + '\n');
+export {};

package/dist/native-selection.d.ts

@@ -0,0 +1,27 @@
+import type { PortalLogin } from './onboarding.js';
+export interface SetupPrompts {
+    choose(message: string, choices: Array<{
+        name: string;
+        value: string;
+    }>): Promise<string>;
+    name(message: string): Promise<string>;
+}
+export interface NativeSelection {
+    workspace: {
+        id: string;
+    } | {
+        name: string;
+    };
+    agent: {
+        id: string;
+    } | {
+        name: string;
+    };
+}
+export declare const harnessLabels: {
+    readonly claude: "Claude Agent SDK";
+    readonly codex: "Codex";
+    readonly langchain: "LangChain";
+};
+/** Names are display/selection hints only; Portal remains the identity and ownership authority. */
+export declare function selectNativeIdentity(root: string, flags: Record<string, string>, login: PortalLogin, prompts: SetupPrompts): Promise<NativeSelection>;

package/dist/native-selection.js

@@ -0,0 +1,72 @@
+import { readKit } from './index.js';
+export const harnessLabels = { claude: 'Claude Agent SDK', codex: 'Codex', langchain: 'LangChain' };
+const validName = (value) => { const name = value.trim(); if (!name || name.length > 80)
+    throw Error('kit_native_name_required'); return name; };
+/** Names are display/selection hints only; Portal remains the identity and ownership authority. */
+export async function selectNativeIdentity(root, flags, login, prompts) {
+    const old = await readKit(root), harness = harnessLabels[flags.harness];
+    if (!harness)
+        throw Error('kit_native_harness_required');
+    if ([flags.workspace, flags['workspace-name'], flags['create-workspace']].filter(Boolean).length > 1 || [flags.agent, flags['agent-name'], flags['create-agent']].filter(Boolean).length > 1)
+        throw Error('kit_native_conflicting_selection');
+    if (flags.node && !flags.agent)
+        throw Error('kit_native_agent_required');
+    const directory = await login.client.request('/api/runtime/setup');
+    let workspaceId = flags.workspace, workspaceName = flags['create-workspace'];
+    if (flags['workspace-name']) {
+        const matches = directory.workspaces.filter(w => w.name === flags['workspace-name']);
+        if (matches.length !== 1)
+            throw Error(matches.length ? 'kit_native_ambiguous_workspace_name' : 'kit_native_workspace_not_found');
+        workspaceId = matches[0].id;
+    }
+    if (!workspaceId && !workspaceName && old.runtime?.issuer === login.issuer && old.runtime.org === login.org)
+        workspaceId = old.runtime.workspaceId;
+    if (workspaceId && !directory.workspaces.some(w => w.id === workspaceId))
+        throw Error('kit_portal_workspace_required');
+    if (!workspaceId && !workspaceName) {
+        const choice = directory.workspaces.length ? await prompts.choose('Choose a Portal workspace', [...directory.workspaces.map(w => ({ name: `${w.name} (${w.id})`, value: w.id })), { name: 'Create a workspace', value: '__create__' }]) : '__create__';
+        if (choice === '__create__')
+            workspaceName = await prompts.name('New workspace name');
+        else {
+            if (!directory.workspaces.some(w => w.id === choice))
+                throw Error('kit_portal_workspace_required');
+            workspaceId = choice;
+        }
+    }
+    const workspace = workspaceName ? { name: validName(workspaceName) } : { id: workspaceId };
+    if (workspaceName && flags.node)
+        throw Error('kit_native_existing_node_requires_workspace');
+    const cards = directory.agents.filter(a => a.harness === harness).map(agent => ({ agent }));
+    let agentId = flags.agent;
+    if (flags['agent-name']) {
+        const matches = cards.filter((c) => c.agent.name === flags['agent-name']);
+        if (matches.length !== 1)
+            throw Error(matches.length ? 'kit_native_ambiguous_agent_name' : 'kit_native_agent_not_found');
+        agentId = matches[0].agent.id;
+    }
+    if (!agentId && !flags['create-agent'] && old.runtime && old.runtime.workspaceId === workspaceId && old.runtime.org === login.org && old.runtime.issuer === login.issuer)
+        agentId = old.runtime.agentId;
+    let name = flags['create-agent'];
+    if (!agentId && !name) {
+        const choice = cards.length ? await prompts.choose('Choose an agent to attach', [...cards.map((c) => ({ name: `${c.agent.name} (${c.agent.id})`, value: c.agent.id })), { name: 'Create an agent', value: '__create__' }]) : '__create__';
+        if (choice === '__create__')
+            name = await prompts.name('New agent name');
+        else {
+            const card = cards.find((c) => c.agent.id === choice);
+            if (!card)
+                throw Error('kit_owned_agent_card_required');
+            agentId = card.agent.id;
+        }
+    }
+    if (name)
+        return { workspace, agent: { name: validName(name) } };
+    const matches = cards.filter((c) => c.agent.id === agentId);
+    if (matches.length !== 1)
+        throw Error('kit_owned_agent_card_required');
+    if (flags.node) {
+        const snapshot = await login.client.request('/api/workspace?workspaceId=' + encodeURIComponent(workspaceId));
+        if (!snapshot.draft?.nodes?.some((n) => n.id === flags.node && n.data?.agentId === agentId && n.data?.harness === harness))
+            throw Error('kit_owned_agent_card_required');
+    }
+    return { workspace, agent: { id: matches[0].agent.id } };
+}

package/dist/native-setup.d.ts

@@ -0,0 +1,63 @@
+import type { PortalLogin } from './onboarding.js';
+import { type SetupPrompts } from './native-selection.js';
+import { type NativeHarness } from './native.js';
+export declare function nativeSdkConfig(harness: NativeHarness, root: string, options?: {
+    codexDelegationDisabled?: boolean;
+}): {
+    config: {
+        features: {
+            multi_agent: boolean;
+            multi_agent_v2: boolean;
+        };
+        mcp_servers: {
+            tealbrick: {
+                command: string;
+                args: string[];
+            };
+        };
+    };
+    servers?: undefined;
+    settings?: undefined;
+    mcpServers?: undefined;
+} | {
+    servers: {
+        tealbrick: {
+            command: string;
+            args: string[];
+        };
+    };
+    config?: undefined;
+    settings?: undefined;
+    mcpServers?: undefined;
+} | {
+    settings: {
+        hooks: {
+            PreToolUse: {
+                matcher: string;
+                hooks: {
+                    type: string;
+                    command: string;
+                    args: string[];
+                }[];
+            }[];
+        };
+    };
+    mcpServers: {
+        tealbrick: {
+            command: string;
+            args: string[];
+        };
+    };
+    config?: undefined;
+    servers?: undefined;
+};
+/** Private setup journal stores only identity intent, never account/runtime credentials. */
+export declare function guidedNativeSetup(root: string, flags: Record<string, string>, login: PortalLogin, prompts: SetupPrompts): Promise<{
+    workspaceId: string;
+    nodeId: string;
+    configPath: string;
+    connected: boolean;
+    agentId: string;
+    connectionId: string;
+    harness: "claude" | "codex" | "langchain";
+}>;

package/dist/native-setup.js

@@ -0,0 +1,99 @@
+import { randomUUID } from 'node:crypto';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { mkdir, lstat, readFile, writeFile, rename, unlink, realpath } from 'node:fs/promises';
+import { readKit } from './index.js';
+import { selectNativeIdentity, harnessLabels } from './native-selection.js';
+import { setupNative } from './native.js';
+export function nativeSdkConfig(harness, root, options = {}) {
+    if (harness === 'codex' && !options.codexDelegationDisabled)
+        throw Error('kit_native_codex_delegation_opt_in_required');
+    const server = { command: process.execPath, args: [fileURLToPath(new URL('./cli.js', import.meta.url)), 'native', 'mcp', '--root', resolve(root)] };
+    return harness === 'codex' ? { config: { features: { multi_agent: false, multi_agent_v2: false }, mcp_servers: { tealbrick: server } } } : harness === 'langchain' ? { servers: { tealbrick: server } } : { settings: { hooks: { PreToolUse: [{ matcher: 'mcp__tealbrick__.*', hooks: [{ type: 'command', command: process.execPath, args: [fileURLToPath(new URL('./native-child-guard.js', import.meta.url))] }] }] } }, mcpServers: { tealbrick: server } };
+}
+/** Private setup journal stores only identity intent, never account/runtime credentials. */
+export async function guidedNativeSetup(root, flags, login, prompts) {
+    root = await realpath(root);
+    const dir = join(root, '.tealbrick');
+    try {
+        if ((await lstat(dir)).isSymbolicLink())
+            throw Error('kit_symlink_path');
+    }
+    catch (e) {
+        if (e.code !== 'ENOENT')
+            throw e;
+    }
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    const paths = ['native-setup.json', 'native-setup.lock', 'native-sdk.json'].map(name => join(dir, name));
+    for (const path of paths) {
+        try {
+            if ((await lstat(path)).isSymbolicLink())
+                throw Error('kit_symlink_path');
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+    }
+    const [journalPath, lockPath, configPath] = paths;
+    try {
+        await writeFile(lockPath, String(process.pid), { flag: 'wx', mode: 0o600 });
+    }
+    catch (e) {
+        if (e.code === 'EEXIST')
+            throw Error('kit_native_setup_locked');
+        throw e;
+    }
+    try {
+        const harness = flags.harness;
+        if (harness === 'codex' && flags.delegation !== 'disabled')
+            throw Error('kit_native_codex_delegation_opt_in_required');
+        if (!Object.hasOwn(harnessLabels, harness))
+            throw Error('kit_native_harness_required');
+        const old = await readKit(root);
+        if (old.runtime && (old.runtime.issuer !== login.issuer || old.runtime.org !== login.org) || old.native && old.native.harness !== harness)
+            throw Error('kit_runtime_existing_binding_mismatch');
+        if (old.portal || old.voice || old.vision || old.deliver !== undefined || old.avm || old.routines || old.selfEvolution || old.runtime && !old.native)
+            throw Error('kit_native_eve_configuration_conflict');
+        let journal;
+        try {
+            journal = JSON.parse(await readFile(journalPath, 'utf8'));
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        const stamp = { issuer: login.issuer, org: login.org, userId: login.userId, harness };
+        if (journal && JSON.stringify(journal.stamp) !== JSON.stringify(stamp))
+            throw Error('kit_native_setup_account_mismatch');
+        const explicit = ['workspace', 'workspace-name', 'create-workspace', 'agent', 'node', 'agent-name', 'create-agent'].some(key => flags[key]);
+        let request = journal && !explicit ? journal.request : undefined;
+        if (!request) {
+            const chosen = await selectNativeIdentity(root, flags, login, prompts);
+            const agent = 'id' in chosen.agent ? { mode: 'attach', id: chosen.agent.id, harness: harnessLabels[harness] } : { mode: 'create', name: chosen.agent.name, harness: harnessLabels[harness] };
+            const selection = { workspace: chosen.workspace, agent };
+            if (journal && JSON.stringify({ workspace: journal.request.workspace, agent: journal.request.agent }) === JSON.stringify(selection))
+                request = journal.request;
+            else {
+                if (old.runtime)
+                    throw Error('kit_runtime_existing_binding_mismatch');
+                request = { ...selection, idempotencyKey: randomUUID() };
+                const tmp = journalPath + '.' + randomUUID();
+                await writeFile(tmp, JSON.stringify({ version: 1, stamp, request }) + '\n', { flag: 'wx', mode: 0o600 });
+                await rename(tmp, journalPath);
+            }
+        }
+        const prepared = await login.client.request('/api/runtime/setup', request);
+        if (!prepared.workspace?.id || !prepared.agent?.id || !prepared.nodeId || prepared.agent.harness !== harnessLabels[harness])
+            throw Error('kit_native_setup_response_invalid');
+        const authenticated = { ...login, workspaces: [...login.workspaces.filter(w => w.id !== prepared.workspace.id), prepared.workspace] };
+        const result = await setupNative(root, { harness, workspaceId: prepared.workspace.id, nodeId: prepared.nodeId, agentId: prepared.agent.id }, authenticated);
+        const tmp = configPath + '.' + randomUUID();
+        await writeFile(tmp, JSON.stringify(nativeSdkConfig(harness, root, { codexDelegationDisabled: flags.delegation === 'disabled' }), null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+        await rename(tmp, configPath);
+        return { ...result, workspaceId: prepared.workspace.id, nodeId: prepared.nodeId, configPath };
+    }
+    finally {
+        await unlink(lockPath);
+    }
+}

package/dist/native.d.ts

@@ -0,0 +1,39 @@
+import { guidedNativeSetup, nativeSdkConfig } from './native-setup.js';
+import { type PortalLogin } from './onboarding.js';
+import { type KnowledgeOperation } from '@tealbrick/portal/runtime';
+declare const harnesses: {
+    readonly claude: "Claude Agent SDK";
+    readonly codex: "Codex";
+    readonly langchain: "LangChain";
+};
+export type NativeHarness = keyof typeof harnesses;
+/** Enroll an existing, accurately labelled owned card. Registration belongs to Portal. */
+export declare function setupNative(root: string, input: {
+    harness: NativeHarness;
+    workspaceId: string;
+    nodeId: string;
+    agentId: string;
+}, login: PortalLogin): Promise<{
+    connected: boolean;
+    agentId: string;
+    connectionId: string;
+    harness: "claude" | "codex" | "langchain";
+}>;
+/** A fresh connector per invocation rechecks Portal and local activation. No authorization cache
+ * survives MCP reconnect, local deactivation or a request boundary. No session is created here. */
+export declare function nativeConnector(): {
+    capabilities: () => Promise<{
+        revision: string;
+        expiresAt: number;
+        apps: {
+            registrationId: string;
+            appId: "knowledge";
+            actions: import("@tealbrick/portal/runtime").CrudAction[];
+            available: boolean;
+            operations: KnowledgeOperation[];
+        }[];
+    }>;
+    call: (registrationId: string, operation: KnowledgeOperation, input?: Record<string, unknown>, signal?: AbortSignal) => Promise<any>;
+};
+export declare function nativeCommand(args: string[], root: string): Promise<void>;
+export { guidedNativeSetup, nativeSdkConfig };

package/dist/native.js

@@ -0,0 +1,104 @@
+import { resolve } from 'node:path';
+import { guidedNativeSetup, nativeSdkConfig } from './native-setup.js';
+import { applyKit, readKit } from './index.js';
+import { loginPortal, portalOrigin } from './onboarding.js';
+import { PortalHttpError } from '@tealbrick/portal';
+import { RuntimeConnector } from '@tealbrick/portal/runtime';
+import { serveMcp } from '@tealbrick/portal/mcp';
+import { runtimeSecret } from './secrets.js';
+const harnesses = { claude: 'Claude Agent SDK', codex: 'Codex', langchain: 'LangChain' };
+/** Enroll an existing, accurately labelled owned card. Registration belongs to Portal. */
+export async function setupNative(root, input, login) {
+    if (!Object.hasOwn(harnesses, input.harness))
+        throw Error('kit_native_harness_required');
+    if (!login.workspaces.some(w => w.id === input.workspaceId))
+        throw Error('kit_portal_workspace_required');
+    const old = await readKit(root);
+    if (old.runtime && (old.runtime.issuer !== login.issuer || old.runtime.org !== login.org || old.runtime.workspaceId !== input.workspaceId || old.runtime.agentId !== input.agentId))
+        throw Error('kit_runtime_existing_binding_mismatch');
+    if (old.native && old.native.harness !== input.harness)
+        throw Error('kit_native_harness_mismatch');
+    if (old.portal || old.voice || old.vision || old.deliver !== undefined || old.avm || old.routines || old.selfEvolution || old.runtime && !old.native)
+        throw Error('kit_native_eve_configuration_conflict');
+    const snapshot = await login.client.request('/api/workspace?workspaceId=' + encodeURIComponent(input.workspaceId));
+    const agent = snapshot.agents?.find((a) => a.id === input.agentId && a.bindable);
+    const node = snapshot.draft?.nodes?.find((n) => n.id === input.nodeId && n.data?.agentId === input.agentId && n.data.kind === 'agent');
+    if (snapshot.workspace?.id !== input.workspaceId || !agent || !node)
+        throw Error('kit_owned_agent_card_required');
+    if (agent.runtime !== harnesses[input.harness] || node.data.harness !== harnesses[input.harness])
+        throw Error('kit_native_portal_harness_mismatch');
+    const enrolled = await login.client.request('/api/runtime/connections', { workspaceId: input.workspaceId, nodeId: input.nodeId, agentId: input.agentId });
+    if (!enrolled.connectionId || !enrolled.credential || !Number.isFinite(enrolled.expiresAt) || enrolled.expiresAt <= Date.now())
+        throw Error('kit_runtime_enrollment_failed');
+    await applyKit(root, { version: 1, native: { harness: input.harness, active: true }, runtime: { issuer: login.issuer, org: login.org, workspaceId: input.workspaceId, agentId: input.agentId, connectionId: enrolled.connectionId, credentialRef: 'TEALBRICK_RUNTIME_CREDENTIAL', bindings: old.runtime?.bindings ?? {} } }, { TEALBRICK_RUNTIME_CREDENTIAL: enrolled.credential });
+    return { connected: true, agentId: input.agentId, connectionId: enrolled.connectionId, harness: input.harness };
+}
+/** A fresh connector per invocation rechecks Portal and local activation. No authorization cache
+ * survives MCP reconnect, local deactivation or a request boundary. No session is created here. */
+export function nativeConnector() {
+    async function current() {
+        const config = await readKit(process.cwd());
+        if (!config.native?.active || !config.runtime)
+            throw Error('runtime_product_inactive');
+        const { credentialRef, ...runtime } = config.runtime;
+        return new RuntimeConnector({ ...runtime, credential: () => runtimeSecret(credentialRef), resolveCredential: runtimeSecret });
+    }
+    return { capabilities: async () => (await current()).capabilities(true), call: async (registrationId, operation, input = {}, signal) => (await current()).call(registrationId, operation, input, signal) };
+}
+export async function nativeCommand(args, root) {
+    const command = args[0], flags = {};
+    for (let i = 1; i < args.length; i += 2) {
+        if (!/^--(root|harness|workspace|workspace-name|create-workspace|node|agent|agent-name|create-agent|delegation|issuer)$/.test(args[i]) || !args[i + 1] || flags[args[i].slice(2)])
+            throw Error('kit_native_invalid_arguments');
+        flags[args[i].slice(2)] = args[i + 1];
+    }
+    if (flags.root) {
+        root = resolve(flags.root);
+        process.chdir(root);
+    }
+    if (command === 'setup') {
+        if (flags.harness && !Object.hasOwn(harnesses, flags.harness))
+            throw Error('kit_native_harness_required');
+        if (!flags.harness)
+            throw Error('kit_native_harness_required');
+        if (flags.harness === 'codex' && flags.delegation !== 'disabled') {
+            const { confirm } = await import('@inquirer/prompts');
+            if (flags.delegation || !await confirm({ message: 'This Codex Tealbrick profile requires native delegation disabled until scoped child grants are supported. Continue with delegation disabled?', default: false }))
+                throw Error('kit_native_codex_delegation_opt_in_required');
+            flags.delegation = 'disabled';
+        }
+        const issuer = portalOrigin(flags.issuer ?? 'https://portal.tealbrick.com');
+        const login = await loginPortal(issuer, (url, code) => console.error(`Approve Tealbrick setup: ${url}\nCode: ${code}`));
+        const { select, input } = await import('@inquirer/prompts');
+        try {
+            console.log(JSON.stringify(await guidedNativeSetup(root, flags, login, { choose: (message, choices) => select({ message, choices }), name: message => input({ message }) })));
+        }
+        catch (error) {
+            if (error instanceof PortalHttpError && /^[a-z_]+$/.test(error.code ?? ''))
+                throw Error('kit_portal_' + error.code);
+            throw error;
+        }
+        return;
+    }
+    if (command === 'config') {
+        const state = await readKit(root);
+        if (!state.native)
+            throw Error('kit_native_setup_required');
+        console.log(JSON.stringify(nativeSdkConfig(state.native.harness, root, { codexDelegationDisabled: flags.delegation === 'disabled' }), null, 2));
+        return;
+    }
+    if (command === 'mcp') {
+        await serveMcp(nativeConnector());
+        return;
+    }
+    if (command === 'disable' || command === 'enable') {
+        const old = await readKit(root);
+        if (!old.native)
+            throw Error('kit_native_setup_required');
+        await applyKit(root, { ...old, native: { ...old.native, active: command === 'enable' } });
+        console.log(JSON.stringify({ active: command === 'enable' }));
+        return;
+    }
+    throw Error('Usage: tealbrick native setup --harness claude|codex|langchain [--workspace-name NAME | --create-workspace NAME] [--agent-name NAME | --create-agent NAME] [--issuer HTTPS_ORIGIN] | native mcp [--root DIRECTORY] | native enable|disable');
+}
+export { guidedNativeSetup, nativeSdkConfig };

package/dist/onboarding.d.ts

@@ -1,5 +1,6 @@
 import { PortalClient } from '@tealbrick/portal';
 export interface PortalLogin {
+    issuer: string;
     client: PortalClient;
     org: string;
     userId: string;

package/dist/onboarding.js

@@ -53,7 +53,7 @@ export async function loginPortal(issuer, show, options = {}) {
     const directory = await authenticated.request('/api/me/workspaces');
     if (!account.user?.id || !account.user.orgId || directory.accountId !== account.user.id || directory.organizationId !== account.user.orgId || !Array.isArray(directory.workspaces) || directory.workspaces.some(w => !w.id || !w.name))
         throw Error('kit_portal_account_mismatch');
-    return { client: authenticated, org: account.user.orgId, userId: account.user.id, workspaces: directory.workspaces };
+    return { issuer, client: authenticated, org: account.user.orgId, userId: account.user.id, workspaces: directory.workspaces };
 }
 /** Reuse Portal's owned registration + revision-checked canvas APIs, not a parallel card store. */
 export async function registerPortalCard(login, input) {

package/dist/runtime-onboarding.js

@@ -50,7 +50,7 @@ export async function runtimeOnboarding(command, args, root) {
         const runtime = { issuer, org: login.org, workspaceId, agentId, connectionId: enrolled.connectionId, credentialRef: 'TEALBRICK_RUNTIME_CREDENTIAL', bindings: old.runtime?.bindings ?? {} };
         await applyKit(root, { ...old, runtime }, { TEALBRICK_RUNTIME_CREDENTIAL: enrolled.credential });
         console.log(JSON.stringify({ connectionId: enrolled.connectionId, workspaceId, agentId, expiresAt: enrolled.expiresAt, requiresReload: true }));
-        console.log('Connected. Customer-side tools are mounted; rebuild/restart Eve. Claim a licensed Knowledge instance and set its local binding before calling it.');
+        console.log(old.native ? 'Connected. Native MCP will reload the current connection on each call.' : 'Connected. Customer-side tools are mounted; rebuild/restart Eve.');
         return;
     }
     if (!old.runtime || old.runtime.issuer !== issuer || old.runtime.workspaceId !== workspaceId || old.runtime.org !== login.org)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tealbrick/kit",
-  "version": "0.2.6",
+  "version": "0.3.0-rc.1",
   "type": "module",
   "license": "MIT",
   "description": "Complete Teal Brick package kit with explicit Eve capability activation",
@@ -13,7 +13,8 @@
     "LICENSE",
     "NOTICE",
     "BOOTSTRAP.md",
-    "RUNTIME.md"
+    "RUNTIME.md",
+    "NATIVE.md"
   ],
   "bin": {
     "tealbrick": "dist/cli.js"
@@ -30,23 +31,28 @@
     "./secrets": {
       "types": "./dist/secrets.d.ts",
       "import": "./dist/secrets.js"
-    }
+    },
+    "./native": {
+      "types": "./dist/native.d.ts",
+      "import": "./dist/native.js"
+    },
+    "./cli": "./dist/cli.js"
   },
   "scripts": {
     "build": "npm run build --workspace @tealbrick/provider-transport --workspace @tealbrick/portal --workspace @tealbrick/voice --workspace @tealbrick/vision --workspace @tealbrick/deliver --workspace @tealbrick/avm && tsc -p tsconfig.json",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
-    "@tealbrick/portal": "0.2.6",
-    "@tealbrick/avm": "0.2.6",
-    "@tealbrick/voice": "0.2.6",
-    "@tealbrick/vision": "0.2.6",
-    "@tealbrick/deliver": "0.2.6",
+    "@tealbrick/portal": "0.3.0-rc.1",
+    "@tealbrick/avm": "0.3.0-rc.1",
+    "@tealbrick/voice": "0.3.0-rc.1",
+    "@tealbrick/vision": "0.3.0-rc.1",
+    "@tealbrick/deliver": "0.3.0-rc.1",
     "@inquirer/prompts": "8.7.2",
     "zod": "^4.0.0"
   },
   "peerDependencies": {
-    "eve": ">=0.66.0 <0.67.0"
+    "eve": ">=0.70.0 <0.71.0"
   },
   "peerDependenciesMeta": {
     "eve": {
@@ -59,6 +65,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.org"
+    "registry": "https://registry.npmjs.org",
+    "tag": "next"
   }
 }