@usenaive-sdk/blueprints 0.3.0 → 0.4.0

package/dist/index.js

@@ -8,6 +8,112 @@ function isId(prefix, value) {
   return SUFFIX_PATTERN.test(value.slice(head.length).toLowerCase());
 }
 
+// ../core/src/errors.ts
+var CODES = {
+  window_unavailable: ["invalid_request", 400],
+  validation_failed: ["invalid_request", 400],
+  unauthorized: ["authentication", 401],
+  forbidden: ["permission", 403],
+  not_found: ["not_found", 404],
+  budget_exceeded: ["quota", 402],
+  insufficient_credits: ["quota", 402],
+  /**
+   * The organization holds no active plan, so it may not be used. `402`, alongside the other two
+   * money codes, because the remedy is a payment — not `403`, which reads as "your credential is
+   * wrong" and would send a customer to rotate a perfectly good key. Distinct from
+   * `insufficient_credits`: that one means "fund the balance", this one means "start the plan".
+   */
+  subscription_required: ["quota", 402],
+  version_conflict: ["conflict", 409],
+  /**
+   * The name is taken by a resource another project owns, and the request did not ask to take it
+   * (ADR-0375). Nothing existing fits: `validation_failed` says the request is malformed and it is
+   * not, `forbidden` reads as "your credential is wrong" and sends a customer to rotate a good key,
+   * and `version_conflict` means optimistic concurrency.
+   */
+  name_conflict: ["conflict", 409],
+  /**
+   * A shared declaration moved underneath the applier: the install's `revision` is not the
+   * `expected_revision` the apply carried (`§29.6`). Not `version_conflict`, which is one
+   * immutable-versioned object's optimistic concurrency and whose remedy is to re-read that
+   * object — this one carries a set of drifted PATHS and its remedy is a merge, and a client that
+   * cannot tell them apart shows a config diff for a stale agent version.
+   */
+  revision_conflict: ["conflict", 409],
+  idempotency_conflict: ["conflict", 409],
+  /**
+   * A lifecycle action asked of an object whose status does not admit it (§43–§45): forming a
+   * company on an unverified verification, funding a `frozen` wallet, cancelling a card that is not
+   * `active`. Not `version_conflict` — nothing raced; the remedy is to read the status.
+   */
+  state_conflict: ["conflict", 409],
+  session_running: ["conflict", 409],
+  session_terminal: ["conflict", 409],
+  computer_unavailable: ["conflict", 409],
+  /**
+   * Two P2 additions (ADR-0118). Both mean "not an error — retry later", and no existing code
+   * carries that: `feature_not_configured` is permanent, `computer_unavailable` is about a
+   * sandbox, and `validation_failed` would tell a durable runtime to give up on something that
+   * will succeed once verification or carrier approval clears.
+   */
+  job_not_ready: ["conflict", 409],
+  compliance_pending: ["conflict", 409],
+  // core-gaps: contracts (`canonical-spec §32`, §37; ADR-0448)
+  /** `--app` omitted and the org has more than one fullstack app to resolve it to (§37.2). */
+  ambiguous_app: ["conflict", 409],
+  /** A saved browser login is held by a human-login flow for the next 15 minutes (§32.6). */
+  context_locked: ["conflict", 409],
+  rate_limited: ["rate_limit", 429],
+  feature_not_configured: ["not_implemented", 501],
+  internal_error: ["api_error", 500],
+  /**
+   * A configured upstream answered with a failure of its own — a 5xx, or a browser automation that
+   * did nothing (§32.5). Not `internal_error`: the remedy is a retry, and nothing of ours broke.
+   */
+  provider_error: ["api_error", 502]
+};
+var VettaError = class extends Error {
+  type;
+  code;
+  httpStatus;
+  param;
+  constructor(code, message3, param) {
+    super(message3);
+    this.name = "VettaError";
+    const [type, httpStatus] = CODES[code];
+    this.type = type;
+    this.code = code;
+    this.httpStatus = httpStatus;
+    this.param = param;
+  }
+  toEnvelope(requestId) {
+    return {
+      error: {
+        type: this.type,
+        code: this.code,
+        message: this.message,
+        request_id: requestId,
+        ...this.param === void 0 ? {} : { param: this.param }
+      }
+    };
+  }
+};
+
+// ../core/src/money.ts
+var USD = 1e6;
+function invalid(message3) {
+  throw new VettaError("validation_failed", message3);
+}
+function microUsd(value) {
+  if (!Number.isSafeInteger(value)) invalid(`micro-USD must be an integer within range, got ${value}`);
+  return value;
+}
+function decimalStringFromMicro(amount) {
+  const absolute = BigInt(Math.abs(amount));
+  const fraction = (absolute % BigInt(USD)).toString().padStart(6, "0").replace(/0+$/, "").padEnd(2, "0");
+  return `${amount < 0 ? "-" : ""}${absolute / BigInt(USD)}.${fraction}`;
+}
+
 // ../core/src/session-token.ts
 var SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
 var encoder = new TextEncoder();
@@ -36,6 +142,8 @@ var AUDIT_ACTIONS_P1 = [
   "computer.paused",
   "computer.resumed",
   "computer.snapshot_created",
+  "computer.updated",
+  "browser.live_view_opened",
   "deployment.created",
   "deployment.updated",
   "deployment.deleted",
@@ -95,13 +203,60 @@ var AUDIT_ACTIONS_P3 = [
   "app.db_queried",
   /** A ticket was minted that lets one browser past an app's own operator gate (§29.7). */
   "app.entered",
-  "blueprint.installed"
+  /** A link was minted that serves one file's bytes to anyone holding it, for seven days (§40). */
+  "file.linked",
+  "blueprint.installed",
+  /** An install's answers were rewritten — what a template's crew is told about the business (§31.8). */
+  "blueprint.context_updated",
+  /** The one creator-program effect inside a tenant: a new organization attributed to a creator (§42.6). */
+  "referral.attributed"
+];
+var AUDIT_ACTIONS_PRIMITIVES = [
+  "legal_verification.started",
+  "legal_member.completed",
+  "legal_member.link_resent",
+  "legal_company.created",
+  "legal_company.submitted",
+  "wallet.created",
+  "wallet.policy_updated",
+  "wallet.frozen",
+  "wallet.unfrozen",
+  "wallet.funded",
+  "wallet.transferred",
+  "wallet.swept",
+  "wallet.paid",
+  "card.issued",
+  "card.retried",
+  "card.cancelled",
+  "card.refunded",
+  /** The one read that files: a credential left the vault for a caller (§45.3). */
+  "card.credentials_revealed"
+];
+var AUDIT_ACTIONS_CORE_GAPS = [
+  "browser.context_saved",
+  "browser.context_granted",
+  "browser.context_revoked",
+  "browser.credential_stored",
+  // core-gaps: U2-browser-api — §32.8's session events, audit-only when no session drove them.
+  "browser.session_opened",
+  "browser.session_closed",
+  "file.imported",
+  "app.db_rest",
+  "app.db_migrated",
+  "app.bucket_created",
+  "app.bucket_deleted",
+  "app.storage_put",
+  "app.storage_get",
+  // core-gaps: U9-storage
+  "app.storage_deleted"
 ];
 var AUDIT_ACTIONS = [
   ...AUDIT_ACTIONS_SHIPPED,
   ...AUDIT_ACTIONS_P1,
   ...AUDIT_ACTIONS_P2,
-  ...AUDIT_ACTIONS_P3
+  ...AUDIT_ACTIONS_P3,
+  ...AUDIT_ACTIONS_PRIMITIVES,
+  ...AUDIT_ACTIONS_CORE_GAPS
 ];
 
 // ../core/src/schema/common.ts
@@ -119,7 +274,7 @@ var JsonSchemaDocument = z.record(z.string(), z.unknown()).refine((schema) => sc
 var WindowSchema = z.enum(["immediate", "priority", "loose"]);
 var TOKEN_TIERS = ["input", "cache_write", "cache_read", "output", "reasoning"];
 var TokenTierSchema = z.enum(TOKEN_TIERS);
-var TOOL_TIERS = ["search", "media", "social"];
+var TOOL_TIERS = ["search", "media", "social", "browser", "storage"];
 var LINE_ITEM_TIERS = [...TOKEN_TIERS, "computer", ...TOOL_TIERS];
 var LineItemTierSchema = z.enum(LINE_ITEM_TIERS);
 var TokenUsageSchema = z.object({
@@ -142,84 +297,333 @@ var HARNESS_IDS = ["pi", "claude_code", "vetta", "hermes"];
 var HarnessIdSchema = z2.enum(HARNESS_IDS);
 
 // ../core/src/schema/agent.ts
+import { z as z5 } from "zod";
+
+// ../core/src/schema/browser.ts
+import { z as z4 } from "zod";
+
+// ../core/src/schema/org.ts
 import { z as z3 } from "zod";
-var ToolPermissionSchema = z3.enum(["allow", "ask", "deny"]);
-var ToolConfigSchema = z3.object({
+var OrganizationSchema = z3.object({
+  id: idOf("org"),
+  object: z3.literal("organization"),
+  name: z3.string(),
+  balance_micro_usd: MicroUsdField,
+  created_at: Timestamp
+});
+var RoleSchema = z3.enum(["owner", "admin", "member"]);
+var MemberSchema = z3.object({
+  id: z3.string(),
+  object: z3.literal("member"),
+  email: z3.email(),
+  role: RoleSchema,
+  invited_by: z3.string().nullable(),
+  created_at: Timestamp
+});
+var SCOPES = [
+  "agents:read",
+  "agents:write",
+  "sessions:read",
+  "sessions:write",
+  /**
+   * THE MODEL DOOR AND NOTHING ELSE. `/v1/proxy/*` used to take `sessions:write`, which also opens
+   * session create and cancel — so a credential handed to a customer's micro-VM, if it leaked, could
+   * start sessions for the whole organization. This scope buys exactly one capability, so a sandbox
+   * token can be minted with it alone.
+   *
+   * The proxy routes accept EITHER this or `sessions:write`: narrowing an already-published route
+   * would break every key that reaches it today (§17).
+   */
+  "proxy:write",
+  "computers:write",
+  "files:read",
+  "files:write",
+  "billing:read",
+  "billing:write",
+  "webhooks:*",
+  "audit:read",
+  "admin"
+];
+var ScopeSchema = z3.enum(SCOPES);
+var ApiKeySchema = z3.object({
+  id: idOf("key"),
+  object: z3.literal("api_key"),
+  name: z3.string(),
+  prefix: z3.string(),
+  scopes: z3.array(ScopeSchema),
+  created_by: PrincipalSchema,
+  last_used_at: Timestamp.nullable(),
+  created_at: Timestamp
+});
+var LedgerEntrySchema = z3.object({
+  id: idOf("led"),
+  type: z3.enum(["debit", "credit"]),
+  amount_micro_usd: MicroUsdField,
+  balance_after_micro_usd: MicroUsdField,
+  actor: PrincipalSchema,
+  session_id: idOf("ses").nullable(),
+  agent_id: idOf("agt").nullable(),
+  deployment_id: idOf("dep").nullable(),
+  line_items: z3.array(z3.object({ tier: LineItemTierSchema, amount_micro_usd: MicroUsdField })),
+  created_at: Timestamp
+});
+var TopupSchema = z3.object({
+  id: z3.string(),
+  object: z3.literal("topup"),
+  amount_micro_usd: MicroUsdField.positive(),
+  status: z3.enum(["pending", "requires_action", "succeeded", "failed"]),
+  action_url: z3.url().nullable(),
+  balance_after_micro_usd: MicroUsdField.nullable(),
+  created_at: Timestamp
+});
+var WebhookEndpointSchema = z3.object({
+  id: idOf("whk"),
+  object: z3.literal("webhook_endpoint"),
+  url: z3.url(),
+  events: z3.array(z3.string()),
   enabled: z3.boolean(),
-  permission: ToolPermissionSchema,
-  config: z3.record(z3.string(), z3.unknown()).optional()
+  created_at: Timestamp
 });
-var ToolsetSchema = z3.object({
-  default_config: z3.object({ permission: ToolPermissionSchema }),
-  configs: z3.record(z3.string(), ToolConfigSchema)
+var WebhookDeliverySchema = z3.object({
+  id: idOf("whd"),
+  event_id: idOf("evt"),
+  event_type: z3.string(),
+  status: z3.enum(["pending", "succeeded", "failed"]),
+  attempts: z3.number().int().nonnegative(),
+  response_status: z3.number().int().nullable(),
+  response_snippet: z3.string().nullable(),
+  delivered_at: Timestamp.nullable(),
+  next_retry_at: Timestamp.nullable()
+});
+var AuditEntrySchema = z3.object({
+  id: idOf("aud"),
+  object: z3.literal("audit_entry"),
+  actor: PrincipalSchema,
+  action: AuditActionSchema,
+  resource_type: z3.string(),
+  resource_id: z3.string(),
+  request_id: z3.string(),
+  metadata: Metadata,
+  created_at: Timestamp
+});
+
+// ../core/src/schema/browser.ts
+var BROWSER_MAX_TIMEOUT_MINUTES = 360;
+var BROWSER_REGIONS = ["us-west", "us-east", "eu-central", "ap-southeast"];
+var BROWSER_OS = ["windows", "mac", "linux", "mobile", "tablet"];
+var BrowserOptionsSchema = z4.object({
+  allowed_domains: z4.array(z4.string().min(1)).min(1),
+  timeout_minutes: z4.number().int().min(1).max(BROWSER_MAX_TIMEOUT_MINUTES).default(15),
+  region: z4.enum(BROWSER_REGIONS).default("us-west"),
+  keep_alive: z4.boolean().default(false),
+  viewport: z4.object({ width: z4.number().int().positive(), height: z4.number().int().positive() }).optional(),
+  os: z4.enum(BROWSER_OS).optional(),
+  block_ads: z4.boolean().default(false),
+  solve_captchas: z4.boolean().default(true),
+  stealth: z4.boolean().default(false),
+  allow_writes: z4.boolean().default(false),
+  allow_extract: z4.boolean().default(false),
+  context_name: z4.string().min(1).max(64).optional(),
+  persist_context: z4.boolean().default(false),
+  human_login: z4.boolean().default(false),
+  proxy: z4.boolean().default(false)
+}).refine((options) => !(options.proxy && options.allowed_domains.includes("*")), {
+  error: "a proxied browser needs a bounded allow-list, not *",
+  path: ["proxy"]
+});
+var BrowserSessionStatusSchema = z4.enum(["creating", "active", "closed", "error"]);
+var BrowserSessionSchema = z4.object({
+  id: idOf("brw"),
+  object: z4.literal("browser_session"),
+  computer_id: idOf("cmp").nullable(),
+  /** The agent session that opened it, if an agent did; a REST caller's browser carries `null`. */
+  session_id: idOf("ses").nullable(),
+  status: BrowserSessionStatusSchema,
+  allowed_domains: z4.array(z4.string()),
+  region: z4.enum(BROWSER_REGIONS),
+  context_id: idOf("bct").nullable(),
+  context_backed: z4.boolean(),
+  timeout_at: Timestamp,
+  opened_at: Timestamp,
+  closed_at: Timestamp.nullable(),
+  created_at: Timestamp
+});
+var BrowserLiveViewSchema = z4.object({
+  object: z4.literal("browser_live_view"),
+  url: z4.url(),
+  expires_at: Timestamp
 });
-var BudgetSchema = z3.object({
+var BrowserContextSchema = z4.object({
+  id: idOf("bct"),
+  object: z4.literal("browser_context"),
+  identity_id: idOf("idn"),
+  name: z4.string(),
+  service: z4.string().nullable(),
+  created_at: Timestamp,
+  last_used_at: Timestamp.nullable()
+});
+var BrowserGranteeTypeSchema = z4.enum(["agent", "role"]);
+var BrowserGrantSchema = z4.object({
+  id: idOf("bgr"),
+  object: z4.literal("browser_grant"),
+  context_id: idOf("bct"),
+  grantee_type: BrowserGranteeTypeSchema,
+  grantee_id: z4.union([idOf("agt"), RoleSchema]),
+  created_at: Timestamp
+});
+var SaveBrowserContextSchema = z4.object({
+  name: z4.string().min(1).max(64),
+  identity_id: idOf("idn"),
+  service: z4.string().min(1).optional()
+});
+var CreateBrowserGrantSchema = z4.object({
+  identity_id: idOf("idn"),
+  grantee_type: BrowserGranteeTypeSchema,
+  grantee_id: z4.union([idOf("agt"), RoleSchema])
+});
+var Selector = z4.string().min(1);
+var Instruction = z4.string().min(1).max(4096);
+var BrowserActionRequestSchema = z4.discriminatedUnion("action", [
+  z4.object({ action: z4.literal("goto"), url: z4.string().url() }),
+  z4.object({ action: z4.literal("click"), selector: Selector }),
+  z4.object({ action: z4.literal("type"), selector: Selector, text: z4.string() }),
+  z4.object({
+    action: z4.literal("extract"),
+    instruction: Instruction.optional(),
+    selector: Selector.optional(),
+    schema: z4.record(z4.string(), z4.unknown()).optional()
+  }),
+  z4.object({
+    action: z4.literal("act"),
+    instruction: Instruction,
+    variables: z4.record(z4.string(), z4.string()).optional()
+  }),
+  z4.object({ action: z4.literal("observe"), instruction: Instruction }),
+  z4.object({
+    action: z4.literal("links"),
+    contains: z4.string().optional(),
+    limit: z4.number().int().min(1).max(200).default(50)
+  }),
+  z4.object({ action: z4.literal("screenshot") })
+]);
+var BROWSER_ACTIONS = BrowserActionRequestSchema.options.map(
+  (option) => option.shape.action.value
+);
+var BrowserActionResultSchema = z4.object({
+  object: z4.literal("browser_action"),
+  action: z4.enum(BROWSER_ACTIONS),
+  url: z4.string(),
+  text: z4.string().nullable(),
+  data: z4.unknown().nullable(),
+  links: z4.array(z4.object({ href: z4.string(), text: z4.string() })).nullable(),
+  elements: z4.array(z4.object({ selector: z4.string(), description: z4.string() })).nullable(),
+  file_id: idOf("fil").nullable(),
+  performed: z4.boolean()
+});
+var BrowserLoginSchema = z4.object({
+  service: z4.string().min(1),
+  url: z4.string().url(),
+  identity_id: idOf("idn")
+});
+var BrowserSignupSchema = BrowserLoginSchema.extend({ email: z4.string().email() });
+var BrowserCredentialSchema = z4.object({
+  identity_id: idOf("idn"),
+  service: z4.string().min(1),
+  email: z4.string().email(),
+  password: z4.string().min(1),
+  username: z4.string().min(1).optional()
+});
+var LiveViewSchema = z4.object({ url: z4.string().url(), expires_at: Timestamp });
+
+// ../core/src/schema/agent.ts
+var ToolPermissionSchema = z5.enum(["allow", "ask", "deny"]);
+var ToolConfigSchema = z5.object({
+  enabled: z5.boolean(),
+  permission: ToolPermissionSchema,
+  config: z5.record(z5.string(), z5.unknown()).optional()
+});
+var ToolsetSchema = z5.object({
+  default_config: z5.object({ permission: ToolPermissionSchema }),
+  configs: z5.record(z5.string(), ToolConfigSchema)
+}).superRefine((tools, ctx) => {
+  const config = tools.configs["browser"]?.config;
+  if (config === void 0) return;
+  for (const issue of BrowserOptionsSchema.safeParse(config).error?.issues ?? []) {
+    ctx.addIssue({ code: "custom", message: issue.message, path: ["configs", "browser", "config", ...issue.path] });
+  }
+});
+var BudgetSchema = z5.object({
   cap_micro_usd: MicroUsdField.nonnegative(),
   max_task_micro_usd: MicroUsdField.nonnegative(),
-  period: z3.enum(["day", "week", "month"])
+  period: z5.enum(["day", "week", "month"])
 });
-var SkillRefSchema = z3.string().regex(/^[a-z0-9][a-z0-9-]*(@\d+)?$/, {
-  error: "expected `slug` or `slug@N`"
+var SkillRefSchema = z5.string().regex(/^(naive\/)?[a-z0-9][a-z0-9-]*(@\d+)?$/, {
+  error: "expected `slug`, `slug@N`, `naive/slug` or `naive/slug@N`"
 });
-var McpServerSchema = z3.object({
-  name: z3.string(),
-  url: z3.url(),
-  headers: z3.record(z3.string(), z3.string()).optional()
+var McpServerSchema = z5.object({
+  name: z5.string(),
+  url: z5.url(),
+  headers: z5.record(z5.string(), z5.string()).optional()
 });
-var RosterEntrySchema = z3.union([
+var RosterEntrySchema = z5.union([
   idOf("agt").transform((id) => ({ type: "agent", id })),
-  z3.object({
-    type: z3.literal("agent"),
+  z5.object({
+    type: z5.literal("agent"),
     id: idOf("agt"),
-    version: z3.number().int().positive().optional()
+    version: z5.number().int().positive().optional()
   }),
-  z3.object({ type: z3.literal("self") }),
-  z3.object({ type: z3.literal("advisor"), model: z3.string().min(1) })
+  z5.object({ type: z5.literal("self") }),
+  z5.object({ type: z5.literal("advisor"), model: z5.string().min(1) })
 ]);
 var SINGLETON_ENTRIES = ["self", "advisor"];
-var MultiagentSchema = z3.object({
-  type: z3.literal("coordinator"),
-  agents: z3.array(RosterEntrySchema).min(1).max(20).refine(
+var MultiagentSchema = z5.object({
+  type: z5.literal("coordinator"),
+  agents: z5.array(RosterEntrySchema).min(1).max(20).refine(
     (roster) => SINGLETON_ENTRIES.every((t) => roster.filter((e) => e.type === t).length <= 1),
     { error: "a roster carries at most one `self` and at most one `advisor` entry" }
   ),
-  board: z3.boolean().optional()
+  board: z5.boolean().optional()
 });
-var MultiagentField = z3.union([z3.boolean(), MultiagentSchema, z3.null()]);
+var MultiagentField = z5.union([z5.boolean(), MultiagentSchema, z5.null()]);
+function normaliseMultiagent(value) {
+  if (value === true) return { type: "coordinator", agents: [], board: false };
+  if (value === false || value === null) return null;
+  return value;
+}
 var agentConfigShape = {
-  model: z3.string(),
+  model: z5.string(),
   window: WindowSchema,
-  system: z3.string(),
+  system: z5.string(),
   tools: ToolsetSchema,
-  mcp_servers: z3.array(McpServerSchema),
-  skills: z3.array(SkillRefSchema),
+  mcp_servers: z5.array(McpServerSchema),
+  skills: z5.array(SkillRefSchema),
   multiagent: MultiagentField,
   budget: BudgetSchema,
   output_schema: JsonSchemaDocument.nullable(),
-  structured_output_required: z3.boolean(),
-  description: z3.string().nullable(),
+  structured_output_required: z5.boolean(),
+  description: z5.string().nullable(),
   metadata: Metadata
 };
-var AgentVersionSchema = z3.object({
-  version: z3.number().int().positive(),
+var AgentVersionSchema = z5.object({
+  version: z5.number().int().positive(),
   created_at: Timestamp,
   created_by: PrincipalSchema,
   ...agentConfigShape
 });
-var AgentSchema = z3.object({
+var AgentSchema = z5.object({
   id: idOf("agt"),
-  object: z3.literal("agent"),
-  name: z3.string(),
+  object: z5.literal("agent"),
+  name: z5.string(),
   /** The agent loop this agent runs (§19). Chosen at create; the catalog lives in `harness.ts`. */
   harness: HarnessIdSchema,
-  current_version: z3.number().int().positive(),
+  current_version: z5.number().int().positive(),
   created_at: Timestamp,
   ...agentConfigShape
 });
 
 // ../core/src/schema/session.ts
-import { z as z4 } from "zod";
-var SessionStatusSchema = z4.enum([
+import { z as z6 } from "zod";
+var SessionStatusSchema = z6.enum([
   "queued",
   "running",
   "idle",
@@ -227,7 +631,7 @@ var SessionStatusSchema = z4.enum([
   "failed",
   "cancelled"
 ]);
-var StopReasonSchema = z4.enum([
+var StopReasonSchema = z6.enum([
   "end_turn",
   "awaiting_input",
   "awaiting_approval",
@@ -253,61 +657,61 @@ var StopReasonSchema = z4.enum([
    */
   "awaiting_answer"
 ]);
-var ThreadRoleSchema = z4.enum(["coordinator", "member"]);
-var MessageSchema = z4.object({
-  role: z4.enum(["system", "user", "assistant", "tool"]),
-  content: z4.string(),
-  tool_call_id: z4.string().optional()
+var ThreadRoleSchema = z6.enum(["coordinator", "member"]);
+var MessageSchema = z6.object({
+  role: z6.enum(["system", "user", "assistant", "tool"]),
+  content: z6.string(),
+  tool_call_id: z6.string().optional()
 });
-var ToolResultSchema = z4.object({
-  output: z4.unknown(),
-  is_error: z4.boolean().optional(),
-  content: z4.string().optional()
+var ToolResultSchema = z6.object({
+  output: z6.unknown(),
+  is_error: z6.boolean().optional(),
+  content: z6.string().optional()
 });
 var QuestionFieldBase = {
-  key: z4.string().min(1).max(64),
-  label: z4.string().min(1).max(200),
-  help: z4.string().max(500).optional()
+  key: z6.string().min(1).max(64),
+  label: z6.string().min(1).max(200),
+  help: z6.string().max(500).optional()
 };
-var QuestionFieldSchema = z4.discriminatedUnion("type", [
-  z4.object({
+var QuestionFieldSchema = z6.discriminatedUnion("type", [
+  z6.object({
     ...QuestionFieldBase,
-    type: z4.literal("text"),
-    placeholder: z4.string().max(200).optional()
+    type: z6.literal("text"),
+    placeholder: z6.string().max(200).optional()
   }),
-  z4.object({
+  z6.object({
     ...QuestionFieldBase,
-    type: z4.literal("choice"),
+    type: z6.literal("choice"),
     /**
      * Plain strings: the option is both the value and the label, because the answer is read back by
      * a model, which wants the words and not an id. Fewer than two is not a choice, and more than
      * twelve is a list — which belongs in the prompt.
      */
-    options: z4.array(z4.string().min(1).max(200)).min(2).max(12),
-    multiple: z4.boolean().default(false),
+    options: z6.array(z6.string().min(1).max(200)).min(2).max(12),
+    multiple: z6.boolean().default(false),
     /**
      * The free-text escape, and it defaults to **true** on purpose: the agent wrote the options and
      * the agent is the one that does not know the answer, so an operator must always be able to say
      * something it did not think of. A question that truly admits only its list opts out explicitly.
      */
-    other: z4.boolean().default(true)
+    other: z6.boolean().default(true)
   })
 ]);
-var QuestionSchema = z4.object({
-  prompt: z4.string().min(1).max(1e3),
-  fields: z4.array(QuestionFieldSchema).min(1).max(3)
+var QuestionSchema = z6.object({
+  prompt: z6.string().min(1).max(1e3),
+  fields: z6.array(QuestionFieldSchema).min(1).max(3)
 });
-var AnswersSchema = z4.record(
-  z4.string().min(1).max(64),
-  z4.union([z4.string().max(2e3), z4.array(z4.string().max(2e3)).min(1).max(12)])
+var AnswersSchema = z6.record(
+  z6.string().min(1).max(64),
+  z6.union([z6.string().max(2e3), z6.array(z6.string().max(2e3)).min(1).max(12)])
 ).refine((answers) => Object.keys(answers).length <= 3, {
   message: "a question has at most 3 fields, so an answer has at most 3 keys"
 });
-var PendingActionSchema = z4.object({
-  kind: z4.enum(["tool", "question"]).default("tool"),
-  tool_call_id: z4.string(),
-  name: z4.string(),
-  args: z4.record(z4.string(), z4.unknown()),
+var PendingActionSchema = z6.object({
+  kind: z6.enum(["tool", "question"]).default("tool"),
+  tool_call_id: z6.string(),
+  name: z6.string(),
+  args: z6.record(z6.string(), z6.unknown()),
   /**
    * Present iff `kind` is `"question"`, and it is the parse of `args` rather than a second source
    * of truth: `args` is what the model called and therefore what replays byte-identically, while
@@ -316,11 +720,11 @@ var PendingActionSchema = z4.object({
    */
   question: QuestionSchema.optional()
 });
-var SessionSchema = z4.object({
+var SessionSchema = z6.object({
   id: idOf("ses"),
-  object: z4.literal("session"),
+  object: z6.literal("session"),
   agent_id: idOf("agt"),
-  agent_version: z4.number().int().positive(),
+  agent_version: z6.number().int().positive(),
   deployment_id: idOf("dep").nullable(),
   /**
    * The persona this session acts as (`canonical-spec §22`). Chosen per task from the personas the
@@ -349,38 +753,39 @@ var SessionSchema = z4.object({
   budget_micro_usd: MicroUsdField.nonnegative(),
   consumed_micro_usd: MicroUsdField.nonnegative(),
   token_usage: TokenUsageSchema,
-  pending_actions: z4.array(PendingActionSchema),
+  pending_actions: z6.array(PendingActionSchema),
   output_schema: JsonSchemaDocument.nullable(),
-  structured_output: z4.record(z4.string(), z4.unknown()).nullable(),
-  last_seq: z4.number().int().nonnegative(),
+  structured_output: z6.record(z6.string(), z6.unknown()).nullable(),
+  last_seq: z6.number().int().nonnegative(),
   metadata: Metadata,
   started_at: Timestamp.nullable(),
   ended_at: Timestamp.nullable(),
   created_at: Timestamp
 });
-var SendMessageSchema = z4.object({
-  message: z4.string(),
-  interrupt: z4.boolean().optional(),
-  idempotency_key: z4.string().optional()
+var SendMessageSchema = z6.object({
+  message: z6.string(),
+  interrupt: z6.boolean().optional(),
+  idempotency_key: z6.string().optional()
 });
-var SendAcceptedSchema = z4.object({
-  session_id: z4.string(),
+var SendAcceptedSchema = z6.object({
+  session_id: z6.string(),
   status: SessionStatusSchema,
-  accepted_seq: z4.number().int().nonnegative()
+  accepted_seq: z6.number().int().nonnegative()
 });
-var ToolConfirmationSchema = z4.object({
-  tool_call_id: z4.string(),
-  decision: z4.enum(["allow", "deny"]),
-  reason: z4.string().optional()
+var ToolConfirmationSchema = z6.object({
+  tool_call_id: z6.string(),
+  decision: z6.enum(["allow", "deny"]),
+  reason: z6.string().optional(),
+  scope: z6.enum(["call", "session"]).default("call")
 });
-var SessionAnswerSchema = z4.object({
-  tool_call_id: z4.string(),
-  answers: z4.record(z4.string(), z4.union([z4.string(), z4.array(z4.string())]))
+var SessionAnswerSchema = z6.object({
+  tool_call_id: z6.string(),
+  answers: z6.record(z6.string(), z6.union([z6.string(), z6.array(z6.string())]))
 });
 
 // ../core/src/schema/event.ts
-import { z as z5 } from "zod";
-var EventTypeSchema = z5.enum([
+import { z as z7 } from "zod";
+var EventTypeSchema = z7.enum([
   "message.delta",
   "message.completed",
   "tool.started",
@@ -400,57 +805,81 @@ var EventTypeSchema = z5.enum([
   "thread.created",
   "thread.running",
   "thread.idle",
-  "thread.terminated"
+  "thread.terminated",
+  // core-gaps: contracts (`canonical-spec §32.8`, §33.5, §36.3, §37.3, §38.3)
+  "browser.session.opened",
+  "browser.session.closed",
+  "browser.context.saved",
+  "browser.context.granted",
+  "browser.context.revoked",
+  "media.job.queued",
+  "media.job.completed",
+  "media.job.failed",
+  "file.imported",
+  "app.db.migrated",
+  "app.storage.bucket.created",
+  "app.storage.bucket.deleted",
+  // identity money (`canonical-spec §44.3`, §45.3). Every one of these is driven over REST, which
+  // has no session stream, so the org's webhook subscriptions are the only push a customer gets.
+  "wallet.created",
+  "wallet.policy.updated",
+  "wallet.transaction.confirmed",
+  "wallet.swept",
+  "card.issued",
+  "card.failed",
+  "card.cancelled",
+  "card.refunded",
+  "card.credentials_revealed"
 ]);
-var EventSchema = z5.object({
+var EventSchema = z7.object({
   id: idOf("evt"),
-  seq: z5.number().int().positive(),
+  seq: z7.number().int().positive(),
   type: EventTypeSchema,
   session_id: idOf("ses"),
-  data: z5.record(z5.string(), z5.unknown()),
+  data: z7.record(z7.string(), z7.unknown()),
   created_at: Timestamp
 });
-var ThreadEventDataSchema = z5.looseObject({ thread_id: idOf("ses") });
-var SessionUsageDataSchema = z5.object({
+var ThreadEventDataSchema = z7.looseObject({ thread_id: idOf("ses") });
+var SessionUsageDataSchema = z7.object({
   token_usage: TokenUsageSchema,
   consumed_micro_usd: MicroUsdField.nonnegative(),
-  active_seconds: z5.number().nonnegative(),
-  tool_calls: z5.number().int().nonnegative()
+  active_seconds: z7.number().nonnegative(),
+  tool_calls: z7.number().int().nonnegative()
 });
 
 // ../core/src/schema/board.ts
-import { z as z6 } from "zod";
+import { z as z8 } from "zod";
 var BOARD_STATUSES = ["todo", "doing", "blocked", "done"];
-var BoardStatusSchema = z6.enum(BOARD_STATUSES);
-var BoardCountsSchema = z6.object({
-  todo: z6.number().int().nonnegative(),
-  doing: z6.number().int().nonnegative(),
-  blocked: z6.number().int().nonnegative(),
-  done: z6.number().int().nonnegative()
-});
-var BoardSchema = z6.object({
+var BoardStatusSchema = z8.enum(BOARD_STATUSES);
+var BoardCountsSchema = z8.object({
+  todo: z8.number().int().nonnegative(),
+  doing: z8.number().int().nonnegative(),
+  blocked: z8.number().int().nonnegative(),
+  done: z8.number().int().nonnegative()
+});
+var BoardSchema = z8.object({
   id: idOf("brd"),
-  object: z6.literal("board"),
+  object: z8.literal("board"),
   agent_id: idOf("agt"),
   cards: BoardCountsSchema,
   created_at: Timestamp
 });
-var BoardCardSchema = z6.object({
+var BoardCardSchema = z8.object({
   id: idOf("crd"),
-  object: z6.literal("board_card"),
+  object: z8.literal("board_card"),
   board_id: idOf("brd"),
-  title: z6.string().min(1),
-  body: z6.string(),
+  title: z8.string().min(1),
+  body: z8.string(),
   status: BoardStatusSchema,
-  assignee: z6.string().nullable(),
+  assignee: z8.string().nullable(),
   /** The cards this one waits on. A `blocked` card with an empty list is stuck on the world. */
-  blocked_by: z6.array(idOf("crd")),
+  blocked_by: z8.array(idOf("crd")),
   created_at: Timestamp,
   updated_at: Timestamp
 });
-var BoardCommentSchema = z6.object({
+var BoardCommentSchema = z8.object({
   id: idOf("bcm"),
-  object: z6.literal("board_comment"),
+  object: z8.literal("board_comment"),
   card_id: idOf("crd"),
   /**
    * Who wrote it, as an id the server derived — never a name the caller supplied. A member's
@@ -458,105 +887,221 @@ var BoardCommentSchema = z6.object({
    * `key_` principal. The prefix is what lets a reader tell an agent's comment from a person's,
    * which is the distinction a free-text author field could not make and could be used to forge.
    */
-  author: z6.string(),
-  body: z6.string(),
+  author: z8.string(),
+  body: z8.string(),
   created_at: Timestamp
 });
 
 // ../core/src/schema/identity.ts
-import { z as z7 } from "zod";
+import { z as z9 } from "zod";
 var IDENTITY_NAME_MAX = 128;
 var IDENTITY_DESCRIPTION_MAX = 1024;
-var IdentitySchema = z7.object({
+var IdentitySchema = z9.object({
   id: idOf("idn"),
-  object: z7.literal("identity"),
+  object: z9.literal("identity"),
   /** Human-facing persona name. Surfaced to the model so it acts in character. */
-  name: z7.string().min(1).max(IDENTITY_NAME_MAX),
+  name: z9.string().min(1).max(IDENTITY_NAME_MAX),
   /** What the persona is for. The model reads it to choose tone, scope and endpoint. */
-  description: z7.string().max(IDENTITY_DESCRIPTION_MAX).nullable(),
+  description: z9.string().max(IDENTITY_DESCRIPTION_MAX).nullable(),
   /** Inbox addresses (`localpart@domain`) this identity owns. */
-  emails: z7.array(z7.string()),
+  emails: z9.array(z9.string()),
   /** Provisioned numbers in E.164. */
-  phones: z7.array(z7.string()),
+  phones: z9.array(z9.string()),
   /** Verified web domains reachable through this identity's inboxes. */
-  domains: z7.array(z7.string()),
+  domains: z9.array(z9.string()),
   /** `conn_` ids of authorized third-party connections. */
-  connections: z7.array(z7.string()),
+  connections: z9.array(z9.string()),
   metadata: Metadata,
   created_at: Timestamp,
   updated_at: Timestamp
 });
 
 // ../core/src/schema/resource.ts
-import { z as z8 } from "zod";
-var ComputerStatusSchema = z8.enum(["creating", "running", "paused", "failed", "destroyed"]);
-var VolumeSchema = z8.object({
+import { z as z11 } from "zod";
+
+// ../core/src/schema/files-library.ts
+import { z as z10 } from "zod";
+var FILE_KINDS = ["image", "video", "audio", "document", "other"];
+var FileKindSchema = z10.enum(FILE_KINDS);
+var FILE_SOURCE_TYPES = [
+  "upload",
+  "url_import",
+  "image_generation",
+  "video_generation",
+  "video_clipping",
+  "screenshot",
+  "speech_generation"
+];
+var FileSourceTypeSchema = z10.enum(FILE_SOURCE_TYPES);
+var FileSourceSchema = z10.object({
+  type: FileSourceTypeSchema,
+  job_id: z10.union([idOf("med"), idOf("clj")]).nullable(),
+  url: z10.string().url().nullable()
+});
+var FileTagsSchema = z10.array(z10.string().min(1).max(64)).max(32);
+var FileLibraryFieldsSchema = z10.object({
+  title: z10.string().max(256).nullable().default(null),
+  description: z10.string().max(4096).nullable().default(null),
+  tags: FileTagsSchema.default([]),
+  kind: FileKindSchema.default("other"),
+  source: FileSourceSchema.nullable().default(null),
+  thumbnail_file_id: idOf("fil").nullable().default(null),
+  width: z10.number().int().positive().nullable().default(null),
+  height: z10.number().int().positive().nullable().default(null),
+  duration_seconds: z10.number().nonnegative().nullable().default(null)
+});
+var UpdateFileSchema = z10.object({
+  title: z10.string().max(256).nullable().optional(),
+  description: z10.string().max(4096).nullable().optional(),
+  tags: FileTagsSchema.optional()
+});
+var ImportFileSchema = z10.object({
+  url: z10.string().url().startsWith("http"),
+  title: z10.string().max(256).optional(),
+  description: z10.string().max(4096).optional(),
+  tags: FileTagsSchema.optional()
+});
+
+// ../core/src/schema/resource.ts
+var ComputerStatusSchema = z11.enum(["creating", "running", "paused", "failed", "destroyed"]);
+var VolumeSchema = z11.object({
   id: idOf("vol"),
-  size_gb: z8.number().int().positive(),
-  mount_path: z8.string()
+  size_gb: z11.number().int().positive(),
+  mount_path: z11.string()
 });
-var ComputerSchema = z8.object({
+var ComputerSchema = z11.object({
   id: idOf("cmp"),
-  object: z8.literal("computer"),
-  name: z8.string(),
-  vcpu: z8.number().int().positive(),
-  memory_mb: z8.number().int().positive(),
-  disk_gb: z8.number().int().positive(),
+  object: z11.literal("computer"),
+  name: z11.string(),
+  vcpu: z11.number().int().positive(),
+  memory_mb: z11.number().int().positive(),
+  disk_gb: z11.number().int().positive(),
   status: ComputerStatusSchema,
-  browser: z8.object({ allowed_domains: z8.array(z8.string()) }).nullable(),
+  // core-gaps: U2-browser-api — the whole option object (§32.2); `{ allowed_domains }` still parses.
+  browser: BrowserOptionsSchema.nullable(),
   volume: VolumeSchema.nullable(),
   snapshot_id: idOf("snp").nullable(),
   created_at: Timestamp
 });
-var SnapshotSchema = z8.object({
+var SnapshotSchema = z11.object({
   snapshot_id: idOf("snp"),
   computer_id: idOf("cmp"),
   created_at: Timestamp
 });
-var SkillSchema = z8.object({
+var ComputerProbeSchema = z11.object({
+  sampled_at: Timestamp,
+  uptime_seconds: z11.number().int().nonnegative(),
+  processes: z11.number().int().nonnegative(),
+  load_1m: z11.number().nonnegative(),
+  memory_used_mb: z11.number().int().nonnegative(),
+  memory_total_mb: z11.number().int().positive(),
+  disk_used_gb: z11.number().nonnegative(),
+  disk_total_gb: z11.number().positive()
+});
+var ComputerInspectSchema = z11.object({
+  object: z11.literal("computer_inspect"),
+  id: idOf("cmp"),
+  status: ComputerStatusSchema,
+  last_active_at: Timestamp.nullable(),
+  /** Where the provider's file API is rooted (§41.1); `null` when it does not say. */
+  home: z11.string().min(1).nullable(),
+  probe: ComputerProbeSchema.nullable()
+});
+var COMMAND_OUTPUT_CAP = 65536;
+var ComputerCommandSchema = z11.object({
+  id: idOf("cmd"),
+  object: z11.literal("computer_command"),
+  computer_id: idOf("cmp"),
+  command: z11.string(),
+  exit_code: z11.number().int().nullable(),
+  timed_out: z11.boolean(),
+  duration_ms: z11.number().int().nonnegative(),
+  stdout: z11.string().max(COMMAND_OUTPUT_CAP),
+  stderr: z11.string().max(COMMAND_OUTPUT_CAP),
+  truncated: z11.boolean(),
+  actor: PrincipalSchema,
+  created_at: Timestamp
+});
+var ExecStreamFrameSchema = z11.union([
+  z11.object({ stdout: z11.string() }),
+  z11.object({ stderr: z11.string() }),
+  z11.object({
+    exit: z11.object({
+      exit_code: z11.number().int().nullable(),
+      timed_out: z11.boolean(),
+      duration_ms: z11.number().int().nonnegative(),
+      command_id: idOf("cmd")
+    })
+  })
+]);
+var FileEntryTypeSchema = z11.enum(["file", "directory", "symlink", "other"]);
+var FileEntrySchema = z11.object({
+  name: z11.string().min(1),
+  path: z11.string().min(1),
+  type: FileEntryTypeSchema,
+  size_bytes: z11.number().int().nonnegative(),
+  /** POSIX `st_mode`. */
+  mode: z11.number().int().nonnegative(),
+  modified_at: Timestamp.nullable()
+});
+var ComputerUpdateSchema = z11.strictObject({ name: z11.string().min(1).max(200) });
+var SkillSchema = z11.object({
   id: idOf("skl"),
-  object: z8.literal("skill"),
-  name: z8.string(),
-  description: z8.string().nullable(),
-  latest_version: z8.number().int().positive(),
+  object: z11.literal("skill"),
+  name: z11.string(),
+  description: z11.string().nullable(),
+  latest_version: z11.number().int().positive(),
   created_at: Timestamp
 });
-var ResolvedSkillRefSchema = z8.object({
+var ResolvedSkillRefSchema = z11.object({
   /** The reference exactly as the agent version wrote it: `slug` or `slug@N`. */
-  ref: z8.string().min(1),
-  slug: z8.string().min(1),
-  version: z8.number().int().positive(),
-  description: z8.string(),
-  storage_key: z8.string().min(1)
-});
-var SkillVersionSchema = z8.object({
-  version: z8.number().int().positive(),
-  sha256: z8.string().regex(/^[0-9a-f]{64}$/),
-  size_bytes: z8.number().int().nonnegative(),
+  ref: z11.string().min(1),
+  slug: z11.string().min(1),
+  version: z11.number().int().positive(),
+  description: z11.string(),
+  storage_key: z11.string().min(1)
+});
+var SkillVersionSchema = z11.object({
+  version: z11.number().int().positive(),
+  sha256: z11.string().regex(/^[0-9a-f]{64}$/),
+  size_bytes: z11.number().int().nonnegative(),
   created_at: Timestamp
 });
-var FileSchema = z8.object({
+var SkillCatalogEntrySchema = z11.object({
+  object: z11.literal("skill_catalog_entry"),
+  slug: z11.string().regex(/^[a-z0-9][a-z0-9-]*$/),
+  version: z11.number().int().positive(),
+  name: z11.string().min(1),
+  description: z11.string(),
+  tags: z11.array(z11.string().min(1)),
+  content_hash: z11.string().regex(/^[0-9a-f]{64}$/),
+  published_at: Timestamp
+});
+var SkillCatalogVersionSchema = SkillCatalogEntrySchema.extend({ content: z11.string() });
+var FileSchema = z11.object({
   id: idOf("fil"),
-  object: z8.literal("file"),
-  name: z8.string(),
-  content_type: z8.string(),
-  size_bytes: z8.number().int().nonnegative(),
-  scope: z8.enum(["session", "published"]),
+  object: z11.literal("file"),
+  name: z11.string(),
+  content_type: z11.string(),
+  size_bytes: z11.number().int().nonnegative(),
+  scope: z11.enum(["session", "published"]),
   session_id: idOf("ses").nullable(),
-  sha256: z8.string().regex(/^[0-9a-f]{64}$/),
-  created_at: Timestamp
+  sha256: z11.string().regex(/^[0-9a-f]{64}$/),
+  created_at: Timestamp,
+  // The asset-library fields (`canonical-spec §36.1`), all nullable or defaulted.
+  ...FileLibraryFieldsSchema.shape
 });
-var ScheduleStatusSchema = z8.enum(["scheduled", "paused", "unscheduled"]);
-var DeploymentSchema = z8.object({
+var ScheduleStatusSchema = z11.enum(["scheduled", "paused", "unscheduled"]);
+var DeploymentSchema = z11.object({
   id: idOf("dep"),
-  object: z8.literal("deployment"),
+  object: z11.literal("deployment"),
   agent_id: idOf("agt"),
   /** A pin. `null` tracks the agent's `current_version` on every fire (§12). */
-  agent_version: z8.number().int().positive().nullable(),
-  cron: z8.string(),
+  agent_version: z11.number().int().positive().nullable(),
+  cron: z11.string(),
   /** IANA zone the `cron` is read in. "0 9 * * 1" means 09:00 *here*, across DST (ADR-0074). */
-  timezone: z8.string(),
-  input_template: z8.string(),
+  timezone: z11.string(),
+  input_template: z11.string(),
   budget_micro_usd: MicroUsdField.nonnegative(),
   window: WindowSchema,
   /**
@@ -566,189 +1111,84 @@ var DeploymentSchema = z8.object({
    * those endpoints, and a signed delivery over cleartext is not a delivery. Until the push was
    * wired this field went nowhere, so nothing can be relying on an `http://` value (ADR-0161).
    */
-  on_idle: z8.url().startsWith("https://", { error: "a webhook URL must be https" }).nullable(),
+  on_idle: z11.url().startsWith("https://", { error: "a webhook URL must be https" }).nullable(),
   /**
    * The persona every fire speaks as, or `null` to run as nobody (§22). Written as an `idn_` id
    * **or** the persona's name, the way a session names one, and always echoed as the id: a fire at
    * 3am must not be silenced by someone renaming the persona at noon.
    */
   identity: idOf("idn").nullable(),
-  enabled: z8.boolean(),
+  enabled: z11.boolean(),
   /** Derived per deploy, never stored — the row cannot know whether a clock is watching it. */
   schedule_status: ScheduleStatusSchema,
   /** The next fire, or `null` when nothing will fire it (`schedule_status` says which). */
   next_run_at: Timestamp.nullable(),
   created_at: Timestamp
 });
-var DeploymentRunSchema = z8.object({
+var DeploymentRunSchema = z11.object({
   id: idOf("run"),
   session_id: idOf("ses"),
   status: SessionStatusSchema,
   started_at: Timestamp.nullable()
 });
 
-// ../core/src/schema/org.ts
-import { z as z9 } from "zod";
-var OrganizationSchema = z9.object({
-  id: idOf("org"),
-  object: z9.literal("organization"),
-  name: z9.string(),
-  balance_micro_usd: MicroUsdField,
-  created_at: Timestamp
-});
-var RoleSchema = z9.enum(["owner", "admin", "member"]);
-var MemberSchema = z9.object({
-  id: z9.string(),
-  object: z9.literal("member"),
-  email: z9.email(),
-  role: RoleSchema,
-  invited_by: z9.string().nullable(),
-  created_at: Timestamp
-});
-var SCOPES = [
-  "agents:read",
-  "agents:write",
-  "sessions:read",
-  "sessions:write",
-  /**
-   * THE MODEL DOOR AND NOTHING ELSE. `/v1/proxy/*` used to take `sessions:write`, which also opens
-   * session create and cancel — so a credential handed to a customer's micro-VM, if it leaked, could
-   * start sessions for the whole organization. This scope buys exactly one capability, so a sandbox
-   * token can be minted with it alone.
-   *
-   * The proxy routes accept EITHER this or `sessions:write`: narrowing an already-published route
-   * would break every key that reaches it today (§17).
-   */
-  "proxy:write",
-  "computers:write",
-  "files:read",
-  "files:write",
-  "billing:read",
-  "billing:write",
-  "webhooks:*",
-  "audit:read",
-  "admin"
-];
-var ScopeSchema = z9.enum(SCOPES);
-var ApiKeySchema = z9.object({
-  id: idOf("key"),
-  object: z9.literal("api_key"),
-  name: z9.string(),
-  prefix: z9.string(),
-  scopes: z9.array(ScopeSchema),
-  created_by: PrincipalSchema,
-  last_used_at: Timestamp.nullable(),
-  created_at: Timestamp
-});
-var LedgerEntrySchema = z9.object({
-  id: idOf("led"),
-  type: z9.enum(["debit", "credit"]),
-  amount_micro_usd: MicroUsdField,
-  balance_after_micro_usd: MicroUsdField,
-  actor: PrincipalSchema,
-  session_id: idOf("ses").nullable(),
-  agent_id: idOf("agt").nullable(),
-  deployment_id: idOf("dep").nullable(),
-  line_items: z9.array(z9.object({ tier: LineItemTierSchema, amount_micro_usd: MicroUsdField })),
-  created_at: Timestamp
-});
-var TopupSchema = z9.object({
-  id: z9.string(),
-  object: z9.literal("topup"),
-  amount_micro_usd: MicroUsdField.positive(),
-  status: z9.enum(["pending", "requires_action", "succeeded", "failed"]),
-  action_url: z9.url().nullable(),
-  balance_after_micro_usd: MicroUsdField.nullable(),
-  created_at: Timestamp
-});
-var WebhookEndpointSchema = z9.object({
-  id: idOf("whk"),
-  object: z9.literal("webhook_endpoint"),
-  url: z9.url(),
-  events: z9.array(z9.string()),
-  enabled: z9.boolean(),
-  created_at: Timestamp
-});
-var WebhookDeliverySchema = z9.object({
-  id: idOf("whd"),
-  event_id: idOf("evt"),
-  event_type: z9.string(),
-  status: z9.enum(["pending", "succeeded", "failed"]),
-  attempts: z9.number().int().nonnegative(),
-  response_status: z9.number().int().nullable(),
-  response_snippet: z9.string().nullable(),
-  delivered_at: Timestamp.nullable(),
-  next_retry_at: Timestamp.nullable()
-});
-var AuditEntrySchema = z9.object({
-  id: idOf("aud"),
-  object: z9.literal("audit_entry"),
-  actor: PrincipalSchema,
-  action: AuditActionSchema,
-  resource_type: z9.string(),
-  resource_id: z9.string(),
-  request_id: z9.string(),
-  metadata: Metadata,
-  created_at: Timestamp
-});
-
 // ../core/src/schema/comms.ts
-import { z as z10 } from "zod";
-var DomainKindSchema = z10.enum(["system", "external", "purchased"]);
-var DomainStatusSchema = z10.enum(["pending_dns", "active", "failed"]);
-var DomainDnsStatusSchema = z10.enum(["pending_verification", "provisioned", "failed"]);
-var DomainInboundStatusSchema = z10.enum(["pending", "verified", "failed"]);
-var DomainAppConnectStatusSchema = z10.enum(["pending", "connected", "failed"]);
-var DnsRecordSchema = z10.object({
-  type: z10.enum(["TXT", "CNAME", "MX"]),
-  host: z10.string(),
-  value: z10.string(),
-  priority: z10.number().int().nullable(),
+import { z as z12 } from "zod";
+var DomainKindSchema = z12.enum(["system", "external", "purchased"]);
+var DomainStatusSchema = z12.enum(["pending_dns", "active", "failed"]);
+var DomainDnsStatusSchema = z12.enum(["pending_verification", "provisioned", "failed"]);
+var DomainInboundStatusSchema = z12.enum(["pending", "verified", "failed"]);
+var DomainAppConnectStatusSchema = z12.enum(["pending", "connected", "failed"]);
+var DnsRecordSchema = z12.object({
+  type: z12.enum(["TXT", "CNAME", "MX"]),
+  host: z12.string(),
+  value: z12.string(),
+  priority: z12.number().int().nullable(),
   /** Vetta owns this record: `_dmarc`, DKIM, inbound MX. The agent may read it, never write it. */
-  managed: z10.boolean()
+  managed: z12.boolean()
 });
-var DomainSchema = z10.object({
+var DomainSchema = z12.object({
   id: idOf("dom"),
-  object: z10.literal("domain"),
+  object: z12.literal("domain"),
   /** A domain belongs to the **organization**, not to one identity: two identities share one. */
-  name: z10.string(),
+  name: z12.string(),
   kind: DomainKindSchema,
   status: DomainStatusSchema,
   dns_status: DomainDnsStatusSchema,
   inbound_status: DomainInboundStatusSchema,
   app_connect_status: DomainAppConnectStatusSchema,
-  records: z10.array(DnsRecordSchema),
+  records: z12.array(DnsRecordSchema),
   last_verified_at: Timestamp.nullable(),
   created_at: Timestamp
 });
-var EmailInboxSchema = z10.object({
+var EmailInboxSchema = z12.object({
   id: idOf("eml"),
-  object: z10.literal("email_inbox"),
+  object: z12.literal("email_inbox"),
   identity_id: idOf("idn"),
   domain_id: idOf("dom"),
-  address: z10.string(),
-  localpart: z10.string(),
+  address: z12.string(),
+  localpart: z12.string(),
   /** Inbound routing keys off this: mail to the address wakes exactly this agent. */
   owning_agent_id: idOf("agt"),
-  status: z10.enum(["active", "disabled"]),
+  status: z12.enum(["active", "disabled"]),
   created_at: Timestamp
 });
-var PhoneTierSchema = z10.enum(["sole_prop", "standard"]);
-var BrandStatusSchema = z10.enum(["none", "pending_verification", "verified", "rejected"]);
-var CampaignStatusSchema = z10.enum(["none", "pending", "approved", "rejected"]);
-var PhoneNumberSchema = z10.object({
+var PhoneTierSchema = z12.enum(["sole_prop", "standard"]);
+var BrandStatusSchema = z12.enum(["none", "pending_verification", "verified", "rejected"]);
+var CampaignStatusSchema = z12.enum(["none", "pending", "approved", "rejected"]);
+var PhoneNumberSchema = z12.object({
   id: idOf("pho"),
-  object: z10.literal("phone_number"),
+  object: z12.literal("phone_number"),
   identity_id: idOf("idn"),
-  e164: z10.string(),
-  country: z10.string(),
-  capabilities: z10.object({
+  e164: z12.string(),
+  country: z12.string(),
+  capabilities: z12.object({
     /** Live the moment the number is bought — inbound never waits on carrier registration. */
-    sms_inbound: z10.boolean(),
+    sms_inbound: z12.boolean(),
     /** True **iff** `campaign_status === "approved"`. Nothing else may set it. */
-    sms_outbound: z10.boolean(),
+    sms_outbound: z12.boolean(),
     /** Voice is not a P2 capability; the field exists so its absence is explicit. */
-    voice: z10.literal(false)
+    voice: z12.literal(false)
   }),
   tier: PhoneTierSchema,
   brand_status: BrandStatusSchema,
@@ -756,80 +1196,85 @@ var PhoneNumberSchema = z10.object({
   provisioned_at: Timestamp.nullable(),
   created_at: Timestamp
 });
-var InboundMessageSchema = z10.object({
+var InboundMessageSchema = z12.object({
   id: idOf("inb"),
-  object: z10.literal("inbound_message"),
-  channel: z10.enum(["email", "sms"]),
+  object: z12.literal("inbound_message"),
+  channel: z12.enum(["email", "sms"]),
   identity_id: idOf("idn"),
   /** The `eml_`/`pho_` endpoint it arrived at — the persona is decided by *where*, not by *who*. */
-  endpoint_id: z10.string(),
-  from: z10.string(),
-  to: z10.string(),
-  subject: z10.string().nullable(),
-  text: z10.string(),
+  endpoint_id: z12.string(),
+  from: z12.string(),
+  to: z12.string(),
+  subject: z12.string().nullable(),
+  text: z12.string(),
   /** SPF/DKIM/DMARC for mail, carrier origin for SMS. Kept for the audit of why it was accepted. */
-  auth: z10.record(z10.string(), z10.string()),
+  auth: z12.record(z12.string(), z12.string()),
   /** The session this message woke. Null until the wake seam lands (see ADR-0120). */
   session_id: idOf("ses").nullable(),
   received_at: Timestamp
 });
 
 // ../core/src/schema/app.ts
-import { z as z11 } from "zod";
-var AppTypeSchema = z11.enum(["frontend_only", "fullstack"]);
-var AppStatusSchema = z11.enum(["provisioning", "active", "error"]);
-var AppMcpPathSchema = z11.string().regex(/^\/\S*$/, "must be an absolute path beginning with /").max(128);
-var AppSchema = z11.object({
+import { z as z13 } from "zod";
+var AppTypeSchema = z13.enum(["frontend_only", "fullstack"]);
+var AppStatusSchema = z13.enum(["provisioning", "active", "error"]);
+var AppMcpPathSchema = z13.string().regex(/^\/\S*$/, "must be an absolute path beginning with /").max(128);
+var AppSchema = z13.object({
   id: idOf("app"),
-  object: z11.literal("app"),
-  name: z11.string(),
-  description: z11.string().nullable(),
+  object: z13.literal("app"),
+  name: z13.string(),
+  description: z13.string().nullable(),
   type: AppTypeSchema,
   /**
    * The customer's own project name that made this app, or `null` for one made outside a project
    * (ADR-0375). Customer-visible, unlike the provider handles: it is the word the customer typed,
    * and the refusal that guards a name quotes it.
    */
-  project: z11.string().nullable(),
+  project: z13.string().nullable(),
   status: AppStatusSchema,
   /** The address the app answers on — platform hostname until a custom domain connects. */
-  url: z11.string().nullable(),
+  url: z13.string().nullable(),
   /** White-label words when `status` is `error`; never the provider's. */
-  error: z11.string().nullable(),
+  error: z13.string().nullable(),
   /** Where the app serves MCP, or `null`. The bearer token for it is a server column. */
   mcp: AppMcpPathSchema.nullable(),
   created_at: Timestamp
 });
-var AppDeploymentStatusSchema = z11.enum(["queued", "building", "ready", "error"]);
-var AppDeploymentSchema = z11.object({
+var AppDeploymentStatusSchema = z13.enum(["queued", "building", "ready", "error"]);
+var AppDeploymentSchema = z13.object({
   id: idOf("apd"),
-  object: z11.literal("app_deployment"),
+  object: z13.literal("app_deployment"),
   app_id: idOf("app"),
   status: AppDeploymentStatusSchema,
-  url: z11.string().nullable(),
-  error: z11.string().nullable(),
+  url: z13.string().nullable(),
+  error: z13.string().nullable(),
   /** The client's opaque digest of the files, echoed verbatim so it can skip an unchanged deploy. */
-  content_hash: z11.string().nullable(),
+  content_hash: z13.string().nullable(),
   created_at: Timestamp
 });
-var AppSecretSchema = z11.object({
-  object: z11.literal("app_secret"),
-  name: z11.string(),
+var AppDeploymentFilesSchema = z13.object({
+  object: z13.literal("app_deployment_files"),
+  deployment_id: idOf("apd"),
+  files: z13.record(z13.string().min(1), z13.string())
+});
+var AppSecretSchema = z13.object({
+  object: z13.literal("app_secret"),
+  name: z13.string(),
   /** The client's opaque digest of the value, echoed verbatim so it can skip an unchanged write. */
-  value_hash: z11.string().nullable(),
+  value_hash: z13.string().nullable(),
   created_at: Timestamp
 });
-var AppEntrySchema = z11.object({
-  object: z11.literal("app_entry"),
-  url: z11.string(),
-  ticket: z11.string()
+var AppEntrySchema = z13.object({
+  object: z13.literal("app_entry"),
+  url: z13.string(),
+  ticket: z13.string()
 });
-var AppDomainStatusSchema = z11.enum(["pending", "connected", "failed"]);
-var AppDomainSchema = z11.object({
-  object: z11.literal("app_domain"),
+var AppDomainStatusSchema = z13.enum(["pending", "connected", "failed"]);
+var AppDomainSchema = z13.object({
+  object: z13.literal("app_domain"),
   app_id: idOf("app"),
   domain_id: idOf("dom"),
-  domain: z11.string(),
+  domain: z13.string(),
   status: AppDomainStatusSchema,
   created_at: Timestamp
 });
@@ -837,52 +1282,58 @@ var ENV_NAME = /^[A-Z_][A-Z0-9_]*$/;
 var APP_NAME = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
 
 // ../core/src/schema/install.ts
-import { z as z12 } from "zod";
-var BlueprintInstallSourceSchema = z12.enum(["studio", "cli"]);
-var ResourceActionSchema = z12.enum(["created", "updated", "unchanged", "deleted", "refused"]);
-var ResourceReportSchema = z12.object({
-  name: z12.string().min(1),
+import { z as z14 } from "zod";
+var BlueprintInstallSourceSchema = z14.enum(["studio", "cli"]);
+var BlueprintInstallStatusSchema = z14.enum(["pending", "applied", "failed"]);
+var ResourceActionSchema = z14.enum(["created", "updated", "unchanged", "deleted", "refused"]);
+var ResourceReportSchema = z14.object({
+  name: z14.string().min(1),
   action: ResourceActionSchema,
   /** The `agt_`/`app_`/`ses_`… the line resolved to. Absent on a refusal that never got an id. */
-  id: z12.string().optional(),
+  id: z14.string().optional(),
   /** An app's hostname once its build went live; `null` while it has none. Apps only. */
-  url: z12.string().nullable().optional(),
-  reason: z12.string().optional()
-});
-var BlueprintReportSchema = z12.object({
-  skills: z12.array(ResourceReportSchema),
-  identities: z12.array(ResourceReportSchema),
-  vaults: z12.array(ResourceReportSchema),
-  apps: z12.array(ResourceReportSchema),
-  agents: z12.array(ResourceReportSchema),
-  schedules: z12.array(ResourceReportSchema),
-  intake: z12.array(ResourceReportSchema),
-  skipped: z12.array(z12.string())
-});
-var BlueprintInstallSchema = z12.object({
+  url: z14.string().nullable().optional(),
+  reason: z14.string().optional()
+});
+var BlueprintReportSchema = z14.object({
+  skills: z14.array(ResourceReportSchema),
+  identities: z14.array(ResourceReportSchema),
+  vaults: z14.array(ResourceReportSchema),
+  apps: z14.array(ResourceReportSchema),
+  agents: z14.array(ResourceReportSchema),
+  schedules: z14.array(ResourceReportSchema),
+  intake: z14.array(ResourceReportSchema),
+  skipped: z14.array(z14.string()),
+  deselected: z14.array(z14.string()).default([])
+});
+var BlueprintSelectionSchema = z14.object({
+  agents: z14.array(z14.string().min(1)),
+  apps: z14.array(z14.string().min(1))
+});
+var BlueprintInstallSchema = z14.object({
   id: idOf("bpi"),
-  object: z12.literal("blueprint_install"),
+  object: z14.literal("blueprint_install"),
   /** The customer's own `defineProject({ name })` — the same word `app.project` stamps (§29.2). */
-  project: z12.string().min(1),
+  project: z14.string().min(1),
   /** The pair the declaration resolved to; `null` for a declaration that names no blueprint. */
-  blueprint: z12.string().nullable(),
-  template: z12.string().nullable(),
+  blueprint: z14.string().nullable(),
+  template: z14.string().nullable(),
   /**
    * Applies, not versions of anything: 1 on the first apply, +1 on each one after, whichever writer
    * made it. It is not an agent version and it never rolls back.
    */
-  revision: z12.number().int().positive(),
+  revision: z14.number().int().positive(),
   /**
    * The blueprint artifact version this came from, or `null` when it was applied from a working
    * tree — an operator editing a clone has no version to name.
    */
-  artifact_version: z12.string().nullable(),
+  artifact_version: z14.string().nullable(),
   /**
    * The setup answers this project was configured with (§7.1 fields, keyed by their `key`), so a
    * re-apply does not re-ask and both writers configure from the same answers. Configuration only:
    * a secret is a vault credential (§23) or an app secret (§29.2), and neither is ever an answer.
    */
-  answers: z12.record(z12.string(), z12.unknown()),
+  answers: z14.record(z14.string(), z14.unknown()),
   /**
    * NO `declaration` ON THE WIRE, and that is the reconciliation of §29.6 with §31.1.
    *
@@ -909,95 +1360,147 @@ var BlueprintInstallSchema = z12.object({
    * a person needs after the screen that showed it is gone.
    */
   report: BlueprintReportSchema.nullable(),
+  status: BlueprintInstallStatusSchema,
+  /** Why a `failed` run threw, in one sentence; `null` on every other row. Never a stack or a key. */
+  failure: z14.string().nullable(),
+  /**
+   * The `selection` the apply carried, or `null` — every row written before §31.2 and every apply
+   * that omitted it, both meaning "everything". Defaulted so those rows parse unchanged.
+   */
+  selection: BlueprintSelectionSchema.nullable().default(null),
+  /** When the answers were last edited through `PATCH …/installs/{id}` (§31.8); `null` if never. */
+  context_updated_at: Timestamp.nullable().default(null),
   applied_at: Timestamp,
   created_at: Timestamp
 });
+var ProjectContextAnswerSchema = z14.object({
+  key: z14.string().min(1),
+  label: z14.string(),
+  value: z14.union([z14.string(), z14.array(z14.string())])
+});
+var ProjectContextSchema = z14.object({
+  object: z14.literal("project_context"),
+  project: z14.string().min(1),
+  blueprint: z14.string().nullable(),
+  template: z14.string().nullable(),
+  artifact_version: z14.string().nullable(),
+  answers: z14.array(ProjectContextAnswerSchema),
+  apps: z14.array(z14.object({ name: z14.string().min(1), url: z14.string().nullable() })),
+  agents: z14.array(z14.object({ name: z14.string().min(1), role: z14.string().nullable() })),
+  /** `context_updated_at` once the answers have been edited, `applied_at` until then. */
+  updated_at: Timestamp
+});
 
 // ../core/src/schema/blueprint.ts
-import { z as z13 } from "zod";
-var BlueprintScheduleSchema = z13.object({
-  agent: z13.string().min(1),
-  cron: z13.string().min(1),
-  timezone: z13.string().nullable(),
+import { z as z15 } from "zod";
+var BlueprintScheduleSchema = z15.object({
+  agent: z15.string().min(1),
+  cron: z15.string().min(1),
+  timezone: z15.string().nullable(),
   /** The message each fire opens its session with — the sentence worth printing. */
-  input: z13.string().min(1),
+  input: z15.string().min(1),
   budget_micro_usd: MicroUsdField.nonnegative()
 });
-var BlueprintCrewSchema = z13.object({
-  name: z13.string().min(1),
-  description: z13.string().nullable(),
-  model: z13.string().min(1),
-  briefed: z13.boolean()
-});
-var BlueprintAppSchema = z13.object({
-  name: z13.string().min(1),
+var BlueprintBudgetSchema = BlueprintScheduleSchema.pick({ agent: true, cron: true, budget_micro_usd: true });
+var BlueprintCrewSchema = z15.object({
+  name: z15.string().min(1),
+  description: z15.string().nullable(),
+  model: z15.string().min(1),
+  briefed: z15.boolean(),
+  intake: z15.string().nullable().optional(),
+  /** What the first session may spend: the intake's own cap, else the agent's (§31.4). Set iff `briefed`. */
+  intake_micro_usd: MicroUsdField.nonnegative().optional(),
+  role: z15.string().min(1).optional(),
+  skills: z15.array(SkillRefSchema).optional(),
+  tools: z15.array(z15.string().min(1)).optional(),
+  required: z15.boolean().optional()
+});
+var BlueprintAppSchema = z15.object({
+  name: z15.string().min(1),
   type: AppTypeSchema,
-  description: z13.string().nullable()
-});
-var ContentHashSchema = z13.string().regex(/^[0-9a-f]{64}$/, "a lowercase sha-256 hex digest");
-var BlueprintTreeSchema = z13.object({
+  description: z15.string().nullable(),
+  mcp: z15.string().nullable().optional(),
+  tools: z15.array(z15.string().min(1)).optional(),
+  /** Whether an install may deselect it (§31.2). Optional: the rollout argument above. */
+  required: z15.boolean().optional()
+});
+var ContentHashSchema = z15.string().regex(/^[0-9a-f]{64}$/, "a lowercase sha-256 hex digest");
+var BlueprintTreeSchema = z15.object({
   /** `apps[].name` in the declaration — the same name §31.5 prints and the install ensures by. */
-  app: z13.string().min(1),
+  app: z15.string().min(1),
   content_hash: ContentHashSchema
 });
-var BlueprintArtifactSchema = z13.object({
+var BlueprintArtifactSchema = z15.object({
   id: idOf("bpa"),
-  object: z13.literal("blueprint_artifact"),
+  object: z15.literal("blueprint_artifact"),
   /** The machine — its repository, screens and `/api/*`. */
-  blueprint: z13.string().min(1),
+  blueprint: z15.string().min(1),
   /** Which of that blueprint's templates provides the crew. */
-  template: z13.string().min(1),
+  template: z15.string().min(1),
   /** The blueprint repository's own released version. Stored, never parsed (ADR-0401). */
-  version: z13.string().min(1),
+  version: z15.string().min(1),
   /**
    * The built trees, one per deployable app, ordered as the declaration orders its apps. Never
    * empty: an artifact that built nothing is not an artifact, and the column behind it says so
    * (migration 0040) exactly as the single `content_hash` it replaces was `not null`.
    */
-  trees: z13.array(BlueprintTreeSchema).min(1),
+  trees: z15.array(BlueprintTreeSchema).min(1),
   /**
    * The setup questions, asked by the studio **before** provisioning. `QuestionField` (§7.1) is
    * reused rather than restated: a setup question and a question a parked agent asks are the same
    * object at different times, so one component renders both.
    */
-  questions: z13.array(QuestionFieldSchema),
-  schedules: z13.array(BlueprintScheduleSchema),
+  questions: z15.array(QuestionFieldSchema),
+  schedules: z15.array(BlueprintScheduleSchema),
   /** Who the crew is, and what it deploys — §31.5. Derived from `declaration`, never stored twice. */
-  agents: z13.array(BlueprintCrewSchema),
-  apps: z13.array(BlueprintAppSchema),
+  agents: z15.array(BlueprintCrewSchema),
+  apps: z15.array(BlueprintAppSchema),
+  /**
+   * The agents a template creates per client the operator signs — printed, never provisioned by an
+   * apply (§31.1). Absent on rows published before WS12 v2, hence optional.
+   */
+  crew_per_client: z15.array(BlueprintCrewSchema).optional(),
+  /**
+   * The creator template a row was published from (§42.8), `null` on every first-party row.
+   * `creator_name` is the public display name the landing page credits. The API sends all three
+   * on every row; they are optional here only so an artifact typed before §42 still reads.
+   */
+  creator_template_id: idOf("ctp").nullish(),
+  creator_template_version: z15.number().int().positive().nullish(),
+  creator_name: z15.string().min(1).nullish(),
   published_at: Timestamp
 });
 
 // ../core/src/schema/vault.ts
-import { z as z14 } from "zod";
-var VaultCredentialKindSchema = z14.enum(["env_var", "static_bearer", "mcp_oauth"]);
-var VaultSchema = z14.object({
+import { z as z16 } from "zod";
+var VaultCredentialKindSchema = z16.enum(["env_var", "static_bearer", "mcp_oauth"]);
+var VaultSchema = z16.object({
   id: idOf("vlt"),
-  object: z14.literal("vault"),
+  object: z16.literal("vault"),
   identity_id: idOf("idn").nullable(),
-  display_name: z14.string().min(1).max(128),
-  credential_count: z14.number().int().nonnegative(),
+  display_name: z16.string().min(1).max(128),
+  credential_count: z16.number().int().nonnegative(),
   created_at: Timestamp
 });
-var VaultCredentialSchema = z14.object({
+var VaultCredentialSchema = z16.object({
   id: idOf("vcr"),
-  object: z14.literal("vault_credential"),
+  object: z16.literal("vault_credential"),
   vault_id: idOf("vlt"),
   kind: VaultCredentialKindSchema,
   /** For `env_var`, the environment variable name. For the MCP kinds, a display label. */
-  key: z14.string().min(1).max(128),
+  key: z16.string().min(1).max(128),
   /** The exact destination host an `env_var` credential is bound to. Never a wildcard. */
-  host: z14.string().nullable(),
+  host: z16.string().nullable(),
   /** The exact MCP server URL an `mcp_*` token is matched to. */
-  mcp_server_url: z14.url().nullable(),
-  placeholder_ref: z14.string(),
+  mcp_server_url: z16.url().nullable(),
+  placeholder_ref: z16.string(),
   expires_at: Timestamp.nullable(),
   last_injected_at: Timestamp.nullable(),
   created_at: Timestamp
 });
 
 // ../core/src/schema/social.ts
-import { z as z15 } from "zod";
+import { z as z17 } from "zod";
 var SOCIAL_PLATFORMS = [
   "bluesky",
   "facebook",
@@ -1019,19 +1522,27 @@ var SOCIAL_TEXT_PLATFORMS = [
   "threads",
   "x"
 ];
-var SocialPlatformSchema = z15.enum(SOCIAL_PLATFORMS);
-var SocialTextPlatformSchema = z15.enum(SOCIAL_TEXT_PLATFORMS);
-var SocialAccountSchema = z15.object({
-  id: z15.string().min(1),
-  object: z15.literal("social_account"),
+var SOCIAL_MEDIA_PLATFORMS = ["instagram", "tiktok", "youtube"];
+var SOCIAL_VISIBILITIES = ["public", "unlisted", "private"];
+var SOCIAL_VISIBILITY_PLATFORMS = ["mastodon", "youtube"];
+var SocialVisibilitySchema = z17.enum(SOCIAL_VISIBILITIES);
+var SOCIAL_VISIBILITY_RULE = `visibility is ${SOCIAL_VISIBILITIES.join(", ")} and only ${SOCIAL_VISIBILITY_PLATFORMS.join(" and ")} accept it; omit it and the post publishes at the account's own default, which on a video channel is normally public`;
+var SocialPlatformSchema = z17.enum(SOCIAL_PLATFORMS);
+var SocialTextPlatformSchema = z17.enum(SOCIAL_TEXT_PLATFORMS);
+var isText = (platform) => SOCIAL_TEXT_PLATFORMS.includes(platform);
+var isMedia = (platform) => SOCIAL_MEDIA_PLATFORMS.includes(platform);
+var SOCIAL_PLATFORM_RULE = `${SOCIAL_TEXT_PLATFORMS.join(", ")} take a text-only post; ${SOCIAL_MEDIA_PLATFORMS.join(", ")} may be named only when the post carries media_urls or file_ids; ${SOCIAL_PLATFORMS.filter((platform) => !isText(platform) && !isMedia(platform)).join(", ")} cannot be posted to`;
+var SocialAccountSchema = z17.object({
+  id: z17.string().min(1),
+  object: z17.literal("social_account"),
   identity_id: idOf("idn"),
   platform: SocialPlatformSchema,
-  username: z15.string().nullable(),
-  display_name: z15.string().nullable(),
-  avatar_url: z15.url().nullable(),
+  username: z17.string().nullable(),
+  display_name: z17.string().nullable(),
+  avatar_url: z17.url().nullable(),
   connected_at: Timestamp.nullable()
 });
-var SocialPostStatusSchema = z15.enum([
+var SocialPostStatusSchema = z17.enum([
   "draft",
   "scheduled",
   "processing",
@@ -1039,51 +1550,932 @@ var SocialPostStatusSchema = z15.enum([
   "failed",
   "deleted"
 ]);
-var SocialPostSchema = z15.object({
-  id: z15.string().min(1),
-  object: z15.literal("social_post"),
+var SocialPostSchema = z17.object({
+  id: z17.string().min(1),
+  object: z17.literal("social_post"),
   identity_id: idOf("idn"),
-  title: z15.string(),
-  platforms: z15.array(SocialTextPlatformSchema),
+  title: z17.string(),
+  platforms: z17.array(SocialPlatformSchema),
   status: SocialPostStatusSchema,
   scheduled_at: Timestamp.nullable(),
   posted_at: Timestamp.nullable(),
-  error: z15.string().nullable()
+  error: z17.string().nullable()
 });
-var SocialUploadSchema = z15.object({
-  id: z15.string().min(1),
-  object: z15.literal("social_upload"),
+var SocialUploadSchema = z17.object({
+  id: z17.string().min(1),
+  object: z17.literal("social_upload"),
   identity_id: idOf("idn"),
-  type: z15.enum(["image", "video", "document"]),
-  url: z15.url().nullable()
+  type: z17.enum(["image", "video", "document"]),
+  url: z17.url().nullable()
 });
-var SocialAnalyticsSchema = z15.object({
-  object: z15.literal("social_analytics"),
+var SocialAnalyticsSchema = z17.object({
+  object: z17.literal("social_analytics"),
   identity_id: idOf("idn"),
-  resource_id: z15.string().min(1),
+  resource_id: z17.string().min(1),
   platform: SocialPlatformSchema.nullable(),
-  data: z15.unknown()
+  data: z17.unknown()
 });
-var SocialCommentSchema = z15.object({
-  id: z15.string().min(1),
-  object: z15.literal("social_comment"),
+var SocialCommentSchema = z17.object({
+  id: z17.string().min(1),
+  object: z17.literal("social_comment"),
   identity_id: idOf("idn"),
-  post_id: z15.string().min(1),
-  platforms: z15.array(SocialPlatformSchema),
+  post_id: z17.string().min(1),
+  platforms: z17.array(SocialPlatformSchema),
   status: SocialPostStatusSchema,
   posted_at: Timestamp.nullable(),
-  data: z15.unknown()
+  data: z17.unknown()
+});
+
+// ../core/src/schema/media.ts
+import { z as z18 } from "zod";
+var MEDIA_JOB_KINDS = ["video", "clip", "transcription"];
+var MediaJobKindSchema = z18.enum(MEDIA_JOB_KINDS);
+var MediaJobStatusSchema = z18.enum(["queued", "processing", "completed", "failed"]);
+var PublicUrl = z18.string().url().startsWith("http");
+var Score = z18.number().int().min(0).max(100);
+var Seconds = z18.number().nonnegative();
+var VideoResultSchema = z18.object({
+  files: z18.array(
+    z18.object({
+      file_id: idOf("fil"),
+      content_type: z18.string(),
+      width: z18.number().int().positive().nullable(),
+      height: z18.number().int().positive().nullable(),
+      duration_seconds: Seconds.nullable()
+    })
+  )
+});
+var ViralityScoreSchema = z18.object({
+  total: Score,
+  shareability: Score,
+  hook_strength: Score,
+  story_quality: Score,
+  emotional_impact: Score
+});
+var ClipResultSchema = z18.object({
+  clips: z18.array(
+    z18.object({
+      file_id: idOf("fil"),
+      title: z18.string(),
+      start_seconds: Seconds,
+      end_seconds: Seconds,
+      duration_seconds: Seconds,
+      virality: ViralityScoreSchema
+    })
+  )
+});
+var TranscriptSchema = z18.object({
+  text: z18.string(),
+  language: z18.string().nullable(),
+  duration_seconds: Seconds.nullable(),
+  segments: z18.array(z18.object({ start_seconds: Seconds, end_seconds: Seconds, text: z18.string() }))
+});
+var MediaJobResultSchema = z18.union([VideoResultSchema, ClipResultSchema, TranscriptSchema]);
+var MediaJobSchema = z18.object({
+  id: idOf("med"),
+  object: z18.literal("media_job"),
+  kind: MediaJobKindSchema,
+  status: MediaJobStatusSchema,
+  model: z18.string().nullable(),
+  input: z18.record(z18.string(), z18.unknown()),
+  result: MediaJobResultSchema.nullable(),
+  error: z18.object({ code: z18.string(), message: z18.string() }).nullable(),
+  cost_micro_usd: MicroUsdField.nullable(),
+  session_id: idOf("ses").nullable(),
+  created_at: Timestamp,
+  completed_at: Timestamp.nullable()
+});
+var ImageRequestSchema = z18.object({
+  model: z18.string().min(1).optional(),
+  prompt: z18.string().min(1),
+  image_urls: z18.array(PublicUrl).max(4).optional(),
+  aspect_ratio: z18.string().optional(),
+  seed: z18.number().int().optional(),
+  n: z18.number().int().min(1).max(4).default(1)
+});
+var VideoRequestSchema = z18.object({
+  model: z18.string().min(1),
+  prompt: z18.string().min(1),
+  image_urls: z18.array(PublicUrl).max(1).optional(),
+  aspect_ratio: z18.string().optional(),
+  seed: z18.number().int().optional(),
+  seconds: z18.number().int().min(1).max(60).optional()
+});
+var ImageGenerationSchema = z18.object({
+  object: z18.literal("image_generation"),
+  model: z18.string(),
+  files: z18.array(FileSchema),
+  cost_micro_usd: MicroUsdField
+});
+var ClipLength = z18.number().int().min(5).max(180);
+var ClipRequestSchema = z18.object({
+  video_url: PublicUrl,
+  aspect_ratio: z18.enum(["9:16", "16:9"]).default("9:16"),
+  remove_silence: z18.boolean().default(false),
+  caption_preset: z18.enum(["none", "clean", "bold", "karaoke"]).default("none"),
+  language: z18.string().min(2).optional(),
+  min_seconds: ClipLength.default(15),
+  max_seconds: ClipLength.default(60),
+  title: z18.string().min(1).optional()
+});
+var AudioFormatSchema = z18.enum(["mp3", "wav", "ogg"]);
+var TranscriptionRequestSchema = z18.object({
+  model: z18.string().min(1).optional(),
+  file_id: idOf("fil").optional(),
+  url: PublicUrl.optional(),
+  language: z18.string().min(2).optional(),
+  timestamps: z18.boolean().default(true)
+}).refine((request) => request.file_id === void 0 !== (request.url === void 0), {
+  error: "exactly one of file_id or url",
+  path: ["file_id"]
+});
+var SpeechRequestSchema = z18.object({
+  model: z18.string().min(1).optional(),
+  text: z18.string().min(1).max(4096),
+  voice: z18.string().min(1).optional(),
+  format: AudioFormatSchema.default("mp3"),
+  speed: z18.number().min(0.5).max(2).optional()
+});
+var SpeechToSpeechRequestSchema = z18.object({
+  model: z18.string().min(1).optional(),
+  file_id: idOf("fil"),
+  voice: z18.string().min(1).optional(),
+  format: AudioFormatSchema.default("mp3")
+});
+var SpeechGenerationSchema = z18.object({
+  object: z18.literal("speech_generation"),
+  model: z18.string(),
+  file: FileSchema,
+  duration_seconds: Seconds.nullable(),
+  cost_micro_usd: MicroUsdField
+});
+
+// ../core/src/schema/app-data.ts
+import { z as z19 } from "zod";
+var DbTableSchema = z19.object({
+  object: z19.literal("db_table"),
+  name: z19.string(),
+  schema: z19.string().default("public"),
+  rows: z19.number().int().nonnegative().nullable(),
+  size_bytes: z19.number().int().nonnegative().nullable()
+});
+var DbMigrationSchema = z19.object({
+  id: idOf("dbm"),
+  object: z19.literal("db_migration"),
+  name: z19.string(),
+  sha256: z19.string().regex(/^[0-9a-f]{64}$/),
+  applied_at: Timestamp,
+  statements: z19.number().int().nonnegative()
+});
+var ApplyDbMigrationSchema = z19.object({
+  name: z19.string().min(1).max(128).regex(/^[a-z0-9][a-z0-9_-]*$/),
+  sql: z19.string().min(1)
+});
+var DB_REST_METHODS = ["GET", "POST", "PATCH", "PUT", "DELETE", "HEAD"];
+var DbRestMethodSchema = z19.enum(DB_REST_METHODS);
+var BUCKET_NAME = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
+var BucketSchema = z19.object({
+  object: z19.literal("bucket"),
+  name: z19.string().regex(BUCKET_NAME),
+  public: z19.boolean(),
+  created_at: Timestamp
+});
+var CreateBucketSchema = z19.object({
+  name: z19.string().regex(BUCKET_NAME, { error: "3\u201363 lowercase letters, digits and hyphens" }),
+  public: z19.boolean().default(false)
+});
+var StorageObjectSchema = z19.object({
+  object: z19.literal("storage_object"),
+  bucket: z19.string(),
+  key: z19.string().min(1),
+  size_bytes: z19.number().int().nonnegative(),
+  content_type: z19.string(),
+  etag: z19.string().nullable(),
+  updated_at: Timestamp
+});
+var SignedUrlMethodSchema = z19.enum(["PUT", "GET"]);
+var SignedUrlSchema = z19.object({
+  object: z19.literal("signed_url"),
+  url: z19.string().url(),
+  method: SignedUrlMethodSchema,
+  expires_at: Timestamp
+});
+var CreateUploadUrlSchema = z19.object({
+  content_type: z19.string().min(1),
+  expires_seconds: z19.number().int().min(60).max(3600).default(900)
+});
+
+// ../core/src/schema/stock-photo.ts
+import { z as z20 } from "zod";
+var STOCK_PHOTO_ORIENTATIONS = ["landscape", "portrait", "square"];
+var STOCK_PHOTO_SIZES = ["small", "medium", "large"];
+var StockPhotoQuerySchema = z20.object({
+  query: z20.string().min(1).max(200),
+  count: z20.coerce.number().int().min(1).max(30).default(10),
+  orientation: z20.enum(STOCK_PHOTO_ORIENTATIONS).optional(),
+  color: z20.string().min(1).max(32).optional(),
+  size: z20.enum(STOCK_PHOTO_SIZES).optional()
+});
+var StockPhotoSchema = z20.object({
+  object: z20.literal("stock_photo"),
+  id: z20.string().min(1),
+  width: z20.number().int().positive(),
+  height: z20.number().int().positive(),
+  url: z20.string().url(),
+  preview_url: z20.string().url(),
+  alt: z20.string().nullable(),
+  photographer: z20.string().nullable(),
+  attribution_url: z20.string().url().nullable(),
+  dominant_color: z20.string().nullable()
+});
+
+// ../core/src/schema/creator.ts
+import { z as z21 } from "zod";
+var CreatorCodeSchema = z21.string().regex(/^[a-z0-9]{3,24}$/, "3 to 24 lowercase letters or digits");
+var PayoutMethodSchema = z21.enum(["wise", "paypal"]);
+var PayoutDetailsSchema = z21.object({
+  method: PayoutMethodSchema,
+  account: z21.string().min(1).max(320)
+});
+var CreatorStatusSchema = z21.enum(["active", "suspended"]);
+var CreatorSchema = z21.object({
+  id: idOf("crt"),
+  object: z21.literal("creator"),
+  email: z21.email(),
+  display_name: z21.string().min(1).max(80),
+  code: CreatorCodeSchema,
+  status: CreatorStatusSchema,
+  payout: PayoutDetailsSchema.nullable(),
+  clicks: z21.number().int().nonnegative(),
+  created_at: Timestamp,
+  updated_at: Timestamp
+});
+var IdentityCreatorSchema = CreatorSchema.pick({
+  id: true,
+  status: true
+});
+var CreatorApplicationStatusSchema = z21.enum([
+  "pending",
+  "approved",
+  "rejected"
+]);
+var CreatorApplicationSchema = z21.object({
+  id: idOf("cra"),
+  object: z21.literal("creator_application"),
+  email: z21.email(),
+  display_name: z21.string().min(1).max(80),
+  pitch: z21.string().min(1).max(2e3),
+  links: z21.array(z21.url({ protocol: /^https$/ })).max(5),
+  status: CreatorApplicationStatusSchema,
+  note: z21.string().nullable(),
+  creator_id: idOf("crt").nullable(),
+  created_at: Timestamp,
+  decided_at: Timestamp.nullable()
+});
+var ReferralStatusSchema = z21.enum(["pending", "active", "expired"]);
+var ReferralSchema = z21.object({
+  id: idOf("crf"),
+  object: z21.literal("referral"),
+  creator_id: idOf("crt"),
+  organization_id: idOf("org"),
+  status: ReferralStatusSchema,
+  attributed_at: Timestamp,
+  first_paid_at: Timestamp.nullable(),
+  commission_until: Timestamp.nullable()
+});
+var CommissionKindSchema = z21.enum(["referral", "template"]);
+var CommissionStatusSchema = z21.enum([
+  "pending",
+  "available",
+  "claimed",
+  "paid"
+]);
+var CommissionSchema = z21.object({
+  id: idOf("crc"),
+  object: z21.literal("commission"),
+  creator_id: idOf("crt"),
+  kind: CommissionKindSchema,
+  referral_id: idOf("crf").nullable(),
+  install_id: idOf("bpi").nullable(),
+  creator_template_id: idOf("ctp").nullable(),
+  base_micro_usd: MicroUsdField.nonnegative(),
+  amount_micro_usd: MicroUsdField.nonnegative(),
+  status: CommissionStatusSchema,
+  accrued_at: Timestamp,
+  available_at: Timestamp,
+  payout_id: idOf("crp").nullable()
+});
+var PayoutStatusSchema = z21.enum(["requested", "paid", "rejected"]);
+var PayoutSchema = z21.object({
+  id: idOf("crp"),
+  object: z21.literal("payout"),
+  creator_id: idOf("crt"),
+  amount_micro_usd: MicroUsdField.positive(),
+  currency: z21.literal("USD"),
+  method: PayoutMethodSchema,
+  account: z21.string().min(1),
+  status: PayoutStatusSchema,
+  reference: z21.string().nullable(),
+  note: z21.string().nullable(),
+  requested_at: Timestamp,
+  decided_at: Timestamp.nullable()
+});
+var CREATOR_PROGRAM = {
+  referral_percent: 20,
+  template_percent: 5,
+  commission_months: 12,
+  hold_days: 30,
+  attribution_days: 30,
+  minimum_payout_micro_usd: 2e7
+};
+var CreatorTemplateSlugSchema = z21.string().max(32).regex(
+  /^[a-z0-9]+(-[a-z0-9]+)*$/,
+  "lowercase letters, digits and single dashes"
+);
+var CreatorSkillSchema = z21.object({
+  slug: z21.string().regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters, digits and dashes"),
+  body: z21.string().min(1).max(64 * 1024)
+});
+var CreatorDeclarationSchema = z21.object({
+  agents: z21.array(z21.unknown()),
+  questions: z21.array(z21.unknown()),
+  skills: z21.array(CreatorSkillSchema).max(16)
+});
+var CreatorTemplateVersionStatusSchema = z21.enum([
+  "in_review",
+  "approved",
+  "changes_requested"
+]);
+var VersionNumber = z21.number().int().positive();
+var CreatorTemplateSchema = z21.object({
+  id: idOf("ctp"),
+  object: z21.literal("creator_template"),
+  creator_id: idOf("crt"),
+  blueprint: z21.string().min(1),
+  base_template: z21.string().min(1),
+  slug: CreatorTemplateSlugSchema,
+  template: z21.string().min(1).max(64),
+  name: z21.string().min(1).max(80),
+  description: z21.string().max(2e3),
+  declaration: CreatorDeclarationSchema,
+  published_version: VersionNumber.nullable(),
+  latest_version: z21.object({
+    version: VersionNumber,
+    status: CreatorTemplateVersionStatusSchema
+  }).nullable(),
+  created_at: Timestamp,
+  updated_at: Timestamp
+});
+var CreatorTemplateVersionSchema = z21.object({
+  object: z21.literal("creator_template_version"),
+  template_id: idOf("ctp"),
+  version: VersionNumber,
+  declaration: CreatorDeclarationSchema,
+  status: CreatorTemplateVersionStatusSchema,
+  note: z21.string().nullable(),
+  artifact_id: idOf("bpa").nullable(),
+  submitted_at: Timestamp,
+  decided_at: Timestamp.nullable()
+});
+var CreatorBalanceSchema = z21.object({
+  object: z21.literal("creator_balance"),
+  pending_micro_usd: MicroUsdField.nonnegative(),
+  available_micro_usd: MicroUsdField.nonnegative(),
+  claimed_micro_usd: MicroUsdField.nonnegative(),
+  paid_micro_usd: MicroUsdField.nonnegative(),
+  minimum_payout_micro_usd: z21.literal(CREATOR_PROGRAM.minimum_payout_micro_usd)
+});
+var ReferralClickSchema = z21.object({
+  object: z21.literal("referral_click"),
+  code: CreatorCodeSchema,
+  creator: z21.object({ display_name: z21.string().min(1) }),
+  expires_at: Timestamp
+});
+var Day = z21.iso.date();
+var CreatorAnalyticsSchema = z21.object({
+  object: z21.literal("creator_analytics"),
+  days: z21.number().int().min(1).max(90),
+  from: Day,
+  to: Day,
+  clicks: z21.number().int().nonnegative(),
+  referrals: z21.number().int().nonnegative(),
+  installs: z21.number().int().nonnegative(),
+  active_installs: z21.number().int().nonnegative(),
+  usage_by_day: z21.array(
+    z21.object({ day: Day, debit_micro_usd: MicroUsdField.nonnegative() })
+  ),
+  commission_micro_usd: z21.object({
+    pending: MicroUsdField.nonnegative(),
+    available: MicroUsdField.nonnegative(),
+    claimed: MicroUsdField.nonnegative(),
+    paid: MicroUsdField.nonnegative()
+  }),
+  commissions_by_template: z21.array(
+    z21.object({
+      creator_template_id: idOf("ctp"),
+      amount_micro_usd: MicroUsdField.nonnegative()
+    })
+  ),
+  /** Every install covered, newest first: the day it was created and the day its twelve months end. */
+  install_windows: z21.array(z21.object({ install_id: idOf("bpi"), from: Day, until: Day }))
+});
+
+// ../core/src/schema/legal.ts
+import { z as z22 } from "zod";
+var LEGAL_MEMBER_STATUSES = [
+  "pending",
+  "link_ready",
+  "link_sent",
+  "in_progress",
+  "pending_review",
+  "verified",
+  "failed"
+];
+var LegalMemberStatusSchema = z22.enum(LEGAL_MEMBER_STATUSES);
+var LEGAL_VERIFICATION_STATUSES = ["in_progress", "pending_review", "verified", "failed"];
+var LegalVerificationStatusSchema = z22.enum(LEGAL_VERIFICATION_STATUSES);
+var LEGAL_COMPANY_STATUSES = ["awaiting_payment", "paid", "submitted", "formed", "failed"];
+var LegalCompanyStatusSchema = z22.enum(LEGAL_COMPANY_STATUSES);
+var LEGAL_DOCUMENT_KINDS = ["articles", "ein_letter", "operating_agreement", "other"];
+var LegalDocumentKindSchema = z22.enum(LEGAL_DOCUMENT_KINDS);
+var LegalMemberRoleSchema = z22.enum(["primary", "secondary"]);
+var LegalEinStatusSchema = z22.enum(["none", "pending", "issued"]);
+var LegalRequiredActionKindSchema = z22.enum(["signature", "information", "payment", "other"]);
+var US_STATES = [
+  "AL",
+  "AK",
+  "AZ",
+  "AR",
+  "CA",
+  "CO",
+  "CT",
+  "DE",
+  "DC",
+  "FL",
+  "GA",
+  "HI",
+  "ID",
+  "IL",
+  "IN",
+  "IA",
+  "KS",
+  "KY",
+  "LA",
+  "ME",
+  "MD",
+  "MA",
+  "MI",
+  "MN",
+  "MS",
+  "MO",
+  "MT",
+  "NE",
+  "NV",
+  "NH",
+  "NJ",
+  "NM",
+  "NY",
+  "NC",
+  "ND",
+  "OH",
+  "OK",
+  "OR",
+  "PA",
+  "RI",
+  "SC",
+  "SD",
+  "TN",
+  "TX",
+  "UT",
+  "VT",
+  "VA",
+  "WA",
+  "WV",
+  "WI",
+  "WY"
+];
+var UsStateSchema = z22.enum(US_STATES);
+var LegalMemberInputSchema = z22.object({
+  first_name: z22.string().min(1).max(128),
+  last_name: z22.string().min(1).max(128),
+  email: z22.string().min(1).max(320),
+  role: LegalMemberRoleSchema,
+  is_responsible_party: z22.boolean(),
+  ownership_percent: z22.number().int()
+});
+var LegalMemberSchema = LegalMemberInputSchema.extend({
+  id: idOf("lgm"),
+  object: z22.literal("legal_member"),
+  verification_id: idOf("lgv"),
+  status: LegalMemberStatusSchema,
+  link_url: z22.url().nullable(),
+  link_expires_at: Timestamp.nullable(),
+  completed_at: Timestamp.nullable()
+});
+var LegalVerificationSchema = z22.object({
+  id: idOf("lgv"),
+  object: z22.literal("legal_verification"),
+  identity_id: idOf("idn"),
+  status: LegalVerificationStatusSchema,
+  members: z22.array(LegalMemberSchema),
+  ready_for_formation: z22.boolean(),
+  started_at: Timestamp,
+  completed_at: Timestamp.nullable(),
+  created_at: Timestamp,
+  updated_at: Timestamp
+});
+var StartLegalVerificationSchema = z22.object({ members: z22.array(LegalMemberInputSchema) });
+var CompleteLegalMemberSchema = z22.object({ token: z22.string().min(1) });
+var LegalNameOptionSchema = z22.object({ name: z22.string().min(1).max(200), ending: z22.literal("LLC") });
+var LegalMailingAddressSchema = z22.object({
+  line1: z22.string().min(1).max(200),
+  line2: z22.string().max(200).nullable(),
+  city: z22.string().min(1).max(100),
+  state: UsStateSchema,
+  postal_code: z22.string().min(1).max(16),
+  country: z22.literal("US")
+});
+var LegalRequiredActionSchema = z22.object({
+  kind: LegalRequiredActionKindSchema,
+  description: z22.string(),
+  url: z22.url().nullable()
+});
+var LEGAL_DESCRIPTION_MAX = 50;
+var CreateLegalCompanySchema = z22.object({
+  verification_id: idOf("lgv"),
+  state: UsStateSchema,
+  name_options: z22.array(z22.string().min(1).max(200)).min(1).max(3),
+  naics_code: z22.string().regex(/^\d{2,6}$/),
+  description: z22.string().min(1).max(LEGAL_DESCRIPTION_MAX),
+  mailing_address: LegalMailingAddressSchema
+});
+var LegalCompanySchema = CreateLegalCompanySchema.omit({ name_options: true }).extend({
+  id: idOf("lgc"),
+  object: z22.literal("legal_company"),
+  identity_id: idOf("idn"),
+  status: LegalCompanyStatusSchema,
+  entity_type: z22.literal("llc"),
+  name_options: z22.array(LegalNameOptionSchema),
+  legal_name: z22.string().nullable(),
+  ein_status: LegalEinStatusSchema,
+  price_micro_usd: MicroUsdField,
+  required_actions: z22.array(LegalRequiredActionSchema),
+  failure_reason: z22.string().max(256).nullable(),
+  submitted_at: Timestamp.nullable(),
+  formed_at: Timestamp.nullable(),
+  created_at: Timestamp,
+  updated_at: Timestamp
+});
+var LegalDocumentSchema = z22.object({
+  id: idOf("lgd"),
+  object: z22.literal("legal_document"),
+  company_id: idOf("lgc"),
+  kind: LegalDocumentKindSchema,
+  name: z22.string(),
+  created_at: Timestamp
+});
+var LegalDocumentLinkSchema = z22.object({
+  object: z22.literal("legal_document_link"),
+  url: z22.url(),
+  expires_at: Timestamp
+});
+var NaicsCodeSchema = z22.object({
+  object: z22.literal("naics_code"),
+  code: z22.string().regex(/^\d{2,6}$/),
+  title: z22.string()
+});
+var LegalStateSchema = z22.object({
+  object: z22.literal("legal_state"),
+  code: UsStateSchema,
+  name: z22.string(),
+  formation_fee_micro_usd: MicroUsdField
+});
+var LegalWebhookEventSchema = z22.object({
+  provider_session_ref: z22.string().min(1),
+  status: z22.enum(["verified", "failed", "pending_review"]),
+  metadata: Metadata
+});
+var LLC_ENDING = /\s*(?:,\s*)?(?:l\.?l\.?c\.?|limited\s+liability\s+company)\s*$/i;
+function canonicalName(raw) {
+  const name = raw.replace(LLC_ENDING, "").trim();
+  if (name.length === 0) throw new VettaError("validation_failed", "A company name is required", "name_options");
+  return { name, ending: "LLC" };
+}
+
+// ../core/src/schema/wallet.ts
+import { z as z23 } from "zod";
+var WALLET_NETWORKS = ["eip155:84532", "eip155:8453"];
+var WalletNetworkSchema = z23.enum(WALLET_NETWORKS);
+var DEFAULT_WALLET_NETWORK = "eip155:84532";
+var WalletSelectSchema = z23.object({ network: WalletNetworkSchema.optional() });
+var WALLET_STATUSES = ["active", "frozen", "swept"];
+var WalletStatusSchema = z23.enum(WALLET_STATUSES);
+var WALLET_TRANSACTION_KINDS = ["fund", "transfer", "pay", "sweep"];
+var WalletTransactionKindSchema = z23.enum(WALLET_TRANSACTION_KINDS);
+var WALLET_TRANSACTION_STATUSES = ["pending", "confirmed", "failed"];
+var WalletTransactionStatusSchema = z23.enum(WALLET_TRANSACTION_STATUSES);
+var WalletDirectionSchema = z23.enum(["in", "out"]);
+var WalletFundSourceSchema = z23.enum(["faucet", "treasury"]);
+var EvmAddressSchema = z23.string().regex(/^0x[0-9a-fA-F]{40}$/, "expected a 0x address");
+var TxHashSchema = z23.string().regex(/^0x[0-9a-fA-F]{64}$/, "expected a 0x transaction hash");
+var WalletPolicySchema = z23.object({
+  per_tx_cap_micro_usd: MicroUsdField.nonnegative(),
+  daily_cap_micro_usd: MicroUsdField.positive().nullable(),
+  low_balance_micro_usd: MicroUsdField.nonnegative().nullable()
+});
+var WalletSchema = z23.object({
+  id: idOf("wlt"),
+  object: z23.literal("wallet"),
+  identity_id: idOf("idn"),
+  status: WalletStatusSchema,
+  network: WalletNetworkSchema,
+  address: EvmAddressSchema,
+  asset: z23.literal("usdc"),
+  balance_micro_usd: MicroUsdField,
+  policy: WalletPolicySchema,
+  spent_today_micro_usd: MicroUsdField,
+  created_at: Timestamp,
+  updated_at: Timestamp
+});
+var CreateWalletSchema = z23.object({
+  network: WalletNetworkSchema.optional(),
+  policy: WalletPolicySchema.partial().optional()
+});
+var UpdateWalletPolicySchema = WalletPolicySchema.partial();
+var FundWalletSchema = z23.object({
+  amount_micro_usd: MicroUsdField.positive(),
+  source: WalletFundSourceSchema
+});
+var TransferWalletSchema = z23.object({
+  to: z23.union([EvmAddressSchema, idOf("idn")]),
+  amount_micro_usd: MicroUsdField.positive(),
+  purpose: z23.string().min(1).max(256)
+});
+var SweepWalletSchema = z23.object({ to: EvmAddressSchema.optional() });
+var WalletTransactionSchema = z23.object({
+  id: idOf("wtx"),
+  object: z23.literal("wallet_transaction"),
+  wallet_id: idOf("wlt"),
+  kind: WalletTransactionKindSchema,
+  direction: WalletDirectionSchema,
+  amount_micro_usd: MicroUsdField,
+  counterparty: z23.string().nullable(),
+  origin: z23.string().nullable(),
+  purpose: z23.string().nullable(),
+  tx_hash: TxHashSchema.nullable(),
+  session_id: idOf("ses").nullable(),
+  status: WalletTransactionStatusSchema,
+  created_at: Timestamp
+});
+var ListWalletTransactionsSchema = z23.object({
+  kind: WalletTransactionKindSchema.optional(),
+  direction: WalletDirectionSchema.optional(),
+  origin: z23.string().optional(),
+  since: Timestamp.optional()
+});
+var HttpMethodSchema = z23.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]);
+var WalletQuoteRequestSchema = z23.object({ url: z23.url(), method: HttpMethodSchema.optional() });
+var WalletQuoteSchema = z23.object({
+  object: z23.literal("wallet_quote"),
+  url: z23.url(),
+  payable: z23.boolean(),
+  network: WalletNetworkSchema.nullable(),
+  asset: z23.literal("usdc").nullable(),
+  amount_micro_usd: MicroUsdField.nullable(),
+  pay_to: EvmAddressSchema.nullable(),
+  description: z23.string().nullable(),
+  max_timeout_seconds: z23.number().int().nullable()
+});
+var WalletPayRequestSchema = WalletQuoteRequestSchema.extend({
+  max_amount_micro_usd: MicroUsdField.positive().optional()
+});
+var WALLET_RESPONSE_BODY_MAX = 64 * 1024;
+var WalletPaymentSchema = z23.object({
+  object: z23.literal("wallet_payment"),
+  paid: z23.boolean(),
+  transaction_id: idOf("wtx").nullable(),
+  amount_micro_usd: MicroUsdField.nullable(),
+  response_status: z23.number().int(),
+  response_body: z23.string().max(WALLET_RESPONSE_BODY_MAX)
+});
+
+// ../core/src/schema/cards.ts
+import { z as z24 } from "zod";
+var CARD_STATUSES = ["pending_payment", "issuing", "active", "failed", "cancelled", "refunded"];
+var CardStatusSchema = z24.enum(CARD_STATUSES);
+var CARD_MIN_LOAD_MICRO_USD = 1e6;
+var CARD_MAX_LOAD_MICRO_USD = 15e7;
+var CARD_LOAD_GRANULARITY_MICRO_USD = 1e4;
+var CardSchema = z24.object({
+  id: idOf("vcd"),
+  object: z24.literal("card"),
+  identity_id: idOf("idn"),
+  kind: z24.literal("prepaid"),
+  status: CardStatusSchema,
+  label: z24.string().min(1).max(128),
+  brand: z24.string().nullable(),
+  last4: z24.string().regex(/^\d{4}$/).nullable(),
+  load_micro_usd: MicroUsdField,
+  spent_micro_usd: MicroUsdField,
+  currency: z24.literal("usd"),
+  expires_at: Timestamp.nullable(),
+  failure_reason: z24.string().max(256).nullable(),
+  created_at: Timestamp,
+  updated_at: Timestamp
+});
+var IssueCardSchema = z24.object({
+  label: CardSchema.shape.label,
+  load_micro_usd: MicroUsdField.min(CARD_MIN_LOAD_MICRO_USD).max(CARD_MAX_LOAD_MICRO_USD).multipleOf(CARD_LOAD_GRANULARITY_MICRO_USD)
+});
+var CardQuoteRequestSchema = IssueCardSchema.pick({ load_micro_usd: true });
+var CardQuoteSchema = z24.object({
+  object: z24.literal("card_quote"),
+  load_micro_usd: MicroUsdField,
+  price_micro_usd: MicroUsdField,
+  brand: z24.string().nullable(),
+  min_load_micro_usd: MicroUsdField,
+  max_load_micro_usd: MicroUsdField
+});
+var CardCredentialsSchema = z24.object({
+  object: z24.literal("card_credentials"),
+  card_id: idOf("vcd"),
+  number: z24.string().min(1),
+  pin: z24.string().nullable(),
+  cvv: z24.string().nullable(),
+  expiry: z24.string().nullable(),
+  url: z24.url().nullable(),
+  instructions: z24.string().nullable(),
+  revealed_at: Timestamp
+});
+var CardTransactionSchema = z24.object({
+  id: idOf("vct"),
+  object: z24.literal("card_transaction"),
+  card_id: idOf("vcd"),
+  amount_micro_usd: MicroUsdField,
+  merchant: z24.string().nullable(),
+  description: z24.string().nullable(),
+  session_id: idOf("ses").nullable(),
+  metadata: Metadata,
+  created_at: Timestamp
+});
+var LogCardTransactionSchema = z24.object({
+  amount_micro_usd: MicroUsdField.positive(),
+  merchant: z24.string().max(256).optional(),
+  description: z24.string().max(1024).optional(),
+  metadata: Metadata.optional()
+});
+var ListCardsSchema = z24.object({ status: CardStatusSchema.optional() });
+
+// src/define.ts
+import { z as z27 } from "zod";
+
+// src/roster.ts
+import { z as z26 } from "zod";
+
+// src/report.ts
+import { ApiError, send } from "@usenaive-sdk/vetta";
+import { z as z25 } from "zod";
+function message(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function line(name, work) {
+  try {
+    return await work();
+  } catch (error) {
+    return { name, action: "refused", reason: message(error) };
+  }
+}
+var AT_ONCE = 6;
+async function eachInFlight(items, work) {
+  const out = [];
+  for (let at = 0; at < items.length; at += AT_ONCE) {
+    out.push(...await Promise.all(items.slice(at, at + AT_ONCE).map(work)));
+  }
+  return out;
+}
+async function attempt(into, name, work) {
+  const one = await line(name, work);
+  into.push(one);
+  return one;
+}
+var canonical = (value) => {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (value === null || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.keys(value).sort().map((key) => [key, canonical(value[key])])
+  );
+};
+var changed = (declared, live) => declared !== void 0 && JSON.stringify(canonical(declared)) !== JSON.stringify(canonical(live));
+async function absent(work) {
+  try {
+    return await work;
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 404) return null;
+    throw error;
+  }
+}
+var PageShape = z25.object({
+  data: z25.array(z25.unknown()),
+  has_more: z25.boolean(),
+  next_cursor: z25.string().nullable()
 });
+function rowLabel(row) {
+  const { object, id } = row ?? {};
+  const words = [object, id].filter((one) => typeof one === "string");
+  return words.length > 0 ? words.join(" ") : "a row";
+}
+var why = (error) => error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
+async function listAll(config, path, item, skipped, query = {}) {
+  const rows = [];
+  let after;
+  for (; ; ) {
+    const response = await send(config, { method: "GET", path, query: { ...query, limit: 100, after } }, "application/json");
+    const text = await response.text();
+    if (!response.ok) throw new Error(`could not list ${path} (HTTP ${response.status})`);
+    const body = PageShape.parse(JSON.parse(text));
+    for (const row of body.data) {
+      const parsed = item.safeParse(row);
+      if (parsed.success) rows.push(parsed.data);
+      else skipped.push(`${rowLabel(row)} in ${path} could not be read and was skipped: ${why(parsed.error)}`);
+    }
+    if (!body.has_more || body.next_cursor === null) return rows;
+    after = body.next_cursor;
+  }
+}
+async function tombstone(name, current, remove, dryRun) {
+  if (!current) return { name, action: "unchanged", reason: "already absent" };
+  if (!dryRun) await remove(current.id);
+  return { name, action: "deleted", id: current.id };
+}
 
-// src/define.ts
-import { z as z16 } from "zod";
+// src/roster.ts
+var NAME = z26.string().min(1);
+var RosterNameSchema = z26.union([
+  NAME.transform((name) => ({ type: "agent", name })),
+  z26.object({ type: z26.literal("agent"), name: NAME, version: z26.number().int().positive().optional() }),
+  z26.object({ type: z26.literal("self") }),
+  z26.object({ type: z26.literal("advisor"), model: z26.string().min(1) })
+]);
+var DeclMultiagentField = z26.union([
+  z26.boolean(),
+  z26.object({ ...MultiagentSchema.shape, agents: z26.array(RosterNameSchema).min(1).max(20) }),
+  z26.null()
+]);
+var hasRoster = (value) => typeof value === "object" && value !== null;
+var rosterNames = (roster) => roster.agents.flatMap((entry) => entry.type === "agent" ? [entry.name] : []);
+var teamWithoutRoster = (value) => hasRoster(value) ? void 0 : value;
+function unpinned(desired, live) {
+  return {
+    ...live,
+    agents: live.agents.map((entry, i) => {
+      const want = desired.agents[i];
+      const pinned = want !== void 0 && "version" in want && want.version !== void 0;
+      return entry.type === "agent" && !pinned ? { type: "agent", id: entry.id } : entry;
+    })
+  };
+}
+async function patchRoster(client, decl, roster, existing, ids, dryRun, lines) {
+  const line2 = lines.find((one) => one.name === decl.name);
+  if (line2 === void 0 || line2.action === "refused") return;
+  const updated = () => {
+    if (line2.action === "unchanged") line2.action = "updated";
+  };
+  const missing = rosterNames(roster).find((name) => !ids.has(name));
+  if (missing !== void 0) {
+    if (dryRun && lines.some((one) => one.name === missing && one.action === "created")) return updated();
+    line2.action = "refused";
+    line2.reason = `multiagent roster needs agent "${missing}", which was not provisioned in this run`;
+    return;
+  }
+  const desired = {
+    ...roster,
+    agents: roster.agents.map(
+      (entry) => entry.type === "agent" ? { type: "agent", id: ids.get(entry.name), ..."version" in entry && entry.version !== void 0 ? { version: entry.version } : {} } : entry
+    )
+  };
+  const current = existing.find((agent) => agent.name === decl.name);
+  const live = current === void 0 ? null : normaliseMultiagent(current.multiagent);
+  if (live !== null && !changed(desired, unpinned(desired, live))) return;
+  if (!dryRun && line2.id !== void 0) {
+    try {
+      await client.agents.update(line2.id, { multiagent: desired });
+    } catch (error) {
+      line2.action = "refused";
+      line2.reason = error instanceof Error ? error.message : String(error);
+      return;
+    }
+  }
+  updated();
+}
 
 // src/template.ts
 var BLUEPRINTS = {
   /** Clients, pipeline, deliverables, calendar. */
   agency: { templates: ["blank", "seo-geo"], default: "blank" },
   /** Post queue, accounts, calendar, analytics. */
-  media: { templates: ["faceless", "clipping"] }
+  media: { templates: ["faceless", "clipping"] },
+  /** Pages, posts, forms, analytics — a published site with a crew behind it (`usenaive/web-blueprint`). */
+  web: { templates: ["publisher"], default: "publisher" }
 };
 var list = (names) => names.join(", ");
 function chooseTemplate(blueprint, template) {
@@ -1115,47 +2507,67 @@ function chooseTemplate(blueprint, template) {
 var BlueprintRefusal = class extends Error {
   name = "BlueprintRefusal";
 };
-var EnvValueSchema = z16.union([
-  z16.string(),
-  z16.object({ from_env: z16.string().min(1) }),
-  z16.object({ generate: z16.literal(true) })
+var EnvValueSchema = z27.union([
+  z27.string(),
+  z27.object({ from_env: z27.string().min(1) }),
+  z27.object({ generate: z27.literal(true) })
 ]);
-var AppDeclSchema = z16.object({
+var AppDeclSchema = z27.object({
   /** Becomes a hostname, so the grammar is the platform's `APP_NAME` (a DNS label). */
-  name: z16.string().regex(APP_NAME, "a lowercase DNS label, 63 characters or fewer"),
+  name: z27.string().regex(APP_NAME, "a lowercase DNS label, 63 characters or fewer"),
   type: AppTypeSchema,
-  description: z16.string().optional(),
+  description: z27.string().optional(),
   /** A directory whose files are collected and shipped as the app's file-map deployment. */
-  deploy_dir: z16.string().min(1).optional(),
+  deploy_dir: z27.string().min(1).optional(),
   /** The path the app itself serves MCP on (§29.5); `fullstack` only. Absent means none. */
   mcp: AppMcpPathSchema.optional(),
   /** Written as the app's write-only secrets (§29.2) on every apply; names follow the platform's `ENV_NAME`. */
-  env: z16.record(z16.string().regex(ENV_NAME), EnvValueSchema, { error: "keyed by environment variable name (A-Z, 0-9, _)" }).optional()
-});
-var ScheduleDeclSchema = z16.object({
-  cron: z16.string().min(1),
-  timezone: z16.string().min(1).optional(),
+  env: z27.record(z27.string().regex(ENV_NAME), EnvValueSchema, { error: "keyed by environment variable name (A-Z, 0-9, _)" }).optional(),
+  /** An install may not leave this app out of its `selection` (§31.2). Absent means it may. */
+  required: z27.boolean().optional(),
+  // core-gaps: U8-database
+  /** SQL files applied in order to the app's database after it is provisioned (§37); `fullstack` only. */
+  migrations: z27.array(z27.string().min(1)).optional(),
+  // core-gaps: storage-stock
+  /** Buckets the app's object store must hold (§38.2); `fullstack` only. `public` defaults to false. */
+  buckets: z27.array(CreateBucketSchema).optional()
+});
+var ScheduleDeclSchema = z27.object({
+  cron: z27.string().min(1),
+  timezone: z27.string().min(1).optional(),
   /** The message every fire opens its session with (`input_template` on the wire). */
-  input: z16.string().min(1),
+  input: z27.string().min(1),
   budget_micro_usd: MicroUsdField.nonnegative(),
-  identity: z16.string().min(1).optional(),
-  enabled: z16.boolean().optional()
+  identity: z27.string().min(1).optional(),
+  enabled: z27.boolean().optional()
 });
-var AgentDeclSchema = z16.object({
-  name: z16.string().min(1),
-  model: z16.string().min(1),
+var ToolsDeclSchema = ToolsetSchema;
+var AgentDeclSchema = z27.object({
+  name: z27.string().min(1),
+  model: z27.string().min(1),
   budget: BudgetSchema,
-  description: z16.string().optional(),
-  system: z16.string().optional(),
-  tools: ToolsetSchema.optional(),
-  skills: z16.array(SkillRefSchema).optional(),
-  mcp_servers: z16.array(McpServerSchema).optional(),
+  description: z27.string().optional(),
+  /** Two or three words the studio prints beside the name (§31.5) — "Head of content", not a sentence. */
+  role: z27.string().min(1).optional(),
+  /** An install may not leave this agent out of its `selection` (§31.2). Absent means it may. */
+  required: z27.boolean().optional(),
+  system: z27.string().optional(),
+  tools: ToolsDeclSchema.optional(),
+  skills: z27.array(SkillRefSchema).optional(),
+  mcp_servers: z27.array(McpServerSchema).optional(),
+  /** The rest of the runtime's agent config (§31.6), each the core schema; absent means the route's default and never drift. */
+  window: WindowSchema.optional(),
+  /** A roster names crew members by declared *name*; `up` resolves them to `agt_` ids in a second pass (`roster.ts`). */
+  multiagent: DeclMultiagentField.optional(),
+  output_schema: JsonSchemaDocument.nullable().optional(),
+  structured_output_required: z27.boolean().optional(),
+  metadata: Metadata.optional(),
   /** Declared app *names*; `up` resolves them to `app_` ids in `tools.configs.apps` (§29.3). */
-  allowed_apps: z16.array(z16.string()).optional(),
+  allowed_apps: z27.array(z27.string()).optional(),
   /** A declared identity *name*; `up` attaches it after the agent upsert (§22). */
-  identity: z16.string().min(1).optional(),
+  identity: z27.string().min(1).optional(),
   /** The agent's deployments as a complete set: declared → owned, and the rest are pruned (ADR-0355). */
-  schedules: z16.array(ScheduleDeclSchema).optional(),
+  schedules: z27.array(ScheduleDeclSchema).optional(),
   /**
    * The first thing this agent reads, once, on the apply that **creates** it (`canonical-spec
    * §31.4`). It is what turns a provisioned crew into a crew that has started working.
@@ -1168,43 +2580,58 @@ var AgentDeclSchema = z16.object({
    * repeatedly and unattended while an intake spends once, at an apply a person is watching. Absent
    * means the agent's own `budget` governs.
    */
-  intake: z16.object({ message: z16.string().min(1), budget_micro_usd: MicroUsdField.nonnegative().optional() }).optional()
+  intake: z27.object({ message: z27.string().min(1), budget_micro_usd: MicroUsdField.nonnegative().optional() }).optional()
 });
-var CredentialDeclSchema = z16.object({
+var CredentialDeclSchema = z27.object({
   kind: VaultCredentialKindSchema,
-  key: z16.string().min(1).max(128),
+  key: z27.string().min(1).max(128),
   /** The one exact destination host an `env_var` is bound to. */
-  host: z16.string().min(1).optional(),
+  host: z27.string().min(1).optional(),
   /** The MCP server URL a `static_bearer` / `mcp_oauth` token is matched to. */
-  mcp_server_url: z16.url().optional(),
-  value: z16.object({ from_env: z16.string().min(1) })
+  mcp_server_url: z27.url().optional(),
+  value: z27.object({ from_env: z27.string().min(1) })
 });
-var VaultDeclSchema = z16.object({
+var VaultDeclSchema = z27.object({
   name: VaultSchema.shape.display_name,
-  identity: z16.string().min(1).optional(),
-  credentials: z16.array(CredentialDeclSchema)
+  identity: z27.string().min(1).optional(),
+  credentials: z27.array(CredentialDeclSchema)
 });
-var SkillDeclSchema = z16.object({
-  slug: z16.string().regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters, digits and dashes"),
-  file: z16.string().min(1)
+var SkillDeclSchema = z27.object({
+  slug: z27.string().regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters, digits and dashes"),
+  file: z27.string().min(1)
 });
-var IdentityDeclSchema = IdentitySchema.pick({ name: true, description: true }).partial({
+var LegalDeclSchema = CreateLegalCompanySchema.pick({
+  state: true,
+  name_options: true,
+  naics_code: true,
   description: true
-});
-var RemovedSchema = z16.object({
-  apps: z16.array(z16.string().min(1)).default([]),
-  agents: z16.array(z16.string().min(1)).default([]),
-  skills: z16.array(z16.string().min(1)).default([]),
-  identities: z16.array(z16.string().min(1)).default([]),
-  vaults: z16.array(z16.string().min(1)).default([])
-});
-var KeptSchema = z16.object({ agents: z16.array(z16.string().min(1)).default([]) });
-var ProjectSchema = z16.object({
-  name: z16.string().min(1),
+}).extend({ label: z27.string().min(1).max(128) });
+var WalletDeclSchema = CreateWalletSchema.or(
+  z27.array(CreateWalletSchema).refine(
+    (list2) => new Set(list2.map((w) => w.network ?? DEFAULT_WALLET_NETWORK)).size === list2.length,
+    { message: "one wallet per network" }
+  )
+);
+var CardDeclSchema = IssueCardSchema;
+var IdentityDeclSchema = IdentitySchema.pick({ name: true, description: true }).partial({ description: true }).extend({
+  legal: z27.array(LegalDeclSchema).optional(),
+  wallet: WalletDeclSchema.optional(),
+  cards: z27.array(CardDeclSchema).optional()
+});
+var RemovedSchema = z27.object({
+  apps: z27.array(z27.string().min(1)).default([]),
+  agents: z27.array(z27.string().min(1)).default([]),
+  skills: z27.array(z27.string().min(1)).default([]),
+  identities: z27.array(z27.string().min(1)).default([]),
+  vaults: z27.array(z27.string().min(1)).default([])
+});
+var KeptSchema = z27.object({ agents: z27.array(z27.string().min(1)).default([]) });
+var ProjectSchema = z27.object({
+  name: z27.string().min(1),
   /** The machine this project runs: its repo, its screens, its `/api/*` (`template.ts`). */
-  blueprint: z16.string().min(1).optional(),
+  blueprint: z27.string().min(1).optional(),
   /** Which of that blueprint's templates provides the crew; a blueprint with a default may omit it. */
-  template: z16.string().min(1).optional(),
+  template: z27.string().min(1).optional(),
   /**
    * What a person is asked BEFORE the crew is provisioned (`canonical-spec §31.2`).
    *
@@ -1216,12 +2643,19 @@ var ProjectSchema = z16.object({
    *
    * **Configuration only.** A secret is a vault credential or an app secret; neither is an answer.
    */
-  questions: z16.array(QuestionFieldSchema).default([]),
-  skills: z16.array(SkillDeclSchema).default([]),
-  identities: z16.array(IdentityDeclSchema).default([]),
-  vaults: z16.array(VaultDeclSchema).default([]),
-  apps: z16.array(AppDeclSchema).default([]),
-  agents: z16.array(AgentDeclSchema).default([]),
+  questions: z27.array(QuestionFieldSchema).default([]),
+  skills: z27.array(SkillDeclSchema).default([]),
+  identities: z27.array(IdentityDeclSchema).default([]),
+  vaults: z27.array(VaultDeclSchema).default([]),
+  apps: z27.array(AppDeclSchema).default([]),
+  agents: z27.array(AgentDeclSchema).default([]),
+  /**
+   * The agents this template creates PER CLIENT the operator signs (`canonical-spec §31.1`) —
+   * printed on the artifact so a person sees the whole company, never provisioned by an apply,
+   * because the apply does not know the clients yet. Names only: a model and a budget are the
+   * crew's business at the moment a client is signed, not the declaration's.
+   */
+  crew_per_client: z27.array(z27.object({ name: z27.string().min(1), role: z27.string().min(1).optional(), description: z27.string().optional() })).optional(),
   removed: RemovedSchema.default({ apps: [], agents: [], skills: [], identities: [], vaults: [] }),
   kept: KeptSchema.default({ agents: [] })
 });
@@ -1252,11 +2686,19 @@ function applyChoice(config) {
 function parseProject(input) {
   const parsed = ProjectSchema.safeParse(input);
   if (!parsed.success) {
-    const lines = parsed.error.issues.map((i) => `${i.path.join(".") || "config"}: ${i.message}`);
+    const unwrap = (i) => {
+      if (i.code !== "invalid_union") return [i];
+      const branch = i.errors.find((b) => !b.some((e) => e.code === "invalid_type" && e.path.length === 0));
+      return branch ? branch.map((e) => ({ ...e, path: [...i.path, ...e.path] })) : [i];
+    };
+    const lines = parsed.error.issues.flatMap(unwrap).map((i) => `${i.path.join(".") || "config"}: ${i.message}`);
     refuse(`invalid project config \u2014 ${lines.join("; ")}`);
   }
   const config = parsed.data;
   applyChoice(config);
+  if (config.template !== void 0 && config.questions.length > 3) {
+    refuse(`template "${config.template}" asks ${config.questions.length} questions, but a template asks at most 3 before anything is provisioned \u2014 a fourth belongs to the crew's first conversation`);
+  }
   assertUniqueNames("app", [...config.apps.map((a) => a.name), ...config.removed.apps]);
   assertUniqueNames("agent", [...config.agents.map((a) => a.name), ...config.removed.agents, ...config.kept.agents]);
   assertUniqueNames("skill", [...config.skills.map((s) => s.slug), ...config.removed.skills]);
@@ -1267,6 +2709,13 @@ function parseProject(input) {
     if (app.type === "frontend_only" && app.mcp !== void 0) {
       refuse(`app "${app.name}": mcp is set, but a frontend_only app has no server to answer on it \u2014 declare type "fullstack" or drop mcp`);
     }
+    if (app.type === "frontend_only" && app.migrations !== void 0) {
+      refuse(`app "${app.name}": migrations are set, but a frontend_only app has no database \u2014 declare type "fullstack" or drop migrations`);
+    }
+    if (app.type === "frontend_only" && app.buckets !== void 0) {
+      refuse(`app "${app.name}": buckets are set, but a frontend_only app has no object store \u2014 declare type "fullstack" or drop buckets`);
+    }
+    assertUniqueNames("bucket", (app.buckets ?? []).map((bucket) => bucket.name));
   }
   const identityNames = new Set(config.identities.map((i) => i.name));
   for (const vault of config.vaults) {
@@ -1287,7 +2736,16 @@ function parseProject(input) {
       seen.add(at);
     }
   }
+  const agentNames = /* @__PURE__ */ new Set([...config.agents.map((a) => a.name), ...config.kept.agents]);
   for (const agent of config.agents) {
+    const rostered = /* @__PURE__ */ new Set();
+    for (const name of hasRoster(agent.multiagent) ? rosterNames(agent.multiagent) : []) {
+      if (name === agent.name) refuse(`agent "${agent.name}": multiagent roster names itself \u2014 a coordinator delegates to a copy of itself with { type: "self" }`);
+      if (config.removed.agents.includes(name)) refuse(`agent "${agent.name}": multiagent roster names "${name}", which this config removes \u2014 drop it from the roster or keep the agent`);
+      if (!agentNames.has(name)) refuse(`agent "${agent.name}": multiagent roster names "${name}", but no agent with that name is declared in this project`);
+      if (rostered.has(name)) refuse(`agent "${agent.name}": multiagent roster names "${name}" twice \u2014 a team names each member once`);
+      rostered.add(name);
+    }
     for (const name of agent.allowed_apps ?? []) {
       if (!appNames.has(name)) {
         refuse(`agent "${agent.name}": allowed_apps names "${name}", but no app with that name is declared in this project`);
@@ -1345,7 +2803,7 @@ function isMissingModule(error) {
   const code = error?.code;
   return code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND";
 }
-function message(error) {
+function message2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 function validate(path, raw) {
@@ -1369,7 +2827,7 @@ async function loadConfig(dir) {
     try {
       return validate(path, JSON.parse(readFileSync(path, "utf8")));
     } catch (error) {
-      if (error instanceof SyntaxError) return { ok: false, reason: "invalid", message: message(error) };
+      if (error instanceof SyntaxError) return { ok: false, reason: "invalid", message: message2(error) };
       throw error;
     }
   }
@@ -1378,14 +2836,14 @@ async function loadConfig(dir) {
     const { createJiti } = await import("jiti");
     importFile = createJiti(pathToFileURL(path).href).import;
   } catch (error) {
-    return { ok: false, reason: "unloadable", message: message(error) };
+    return { ok: false, reason: "unloadable", message: message2(error) };
   }
   let raw;
   try {
     const mod = await importFile(path);
     raw = mod?.default ?? mod;
   } catch (error) {
-    return { ok: false, reason: isMissingModule(error) ? "unloadable" : "invalid", message: message(error) };
+    return { ok: false, reason: isMissingModule(error) ? "unloadable" : "invalid", message: message2(error) };
   }
   if (raw === null || typeof raw !== "object") {
     return {
@@ -1441,76 +2899,28 @@ function contentHash(files) {
 
 // src/up.ts
 import { createHash as createHash3 } from "node:crypto";
-import { readFileSync as readFileSync3 } from "node:fs";
-import { resolve as resolve3 } from "node:path";
+import { readFileSync as readFileSync4 } from "node:fs";
+import { resolve as resolve4 } from "node:path";
 
-// src/report.ts
-import { ApiError, send } from "@usenaive-sdk/vetta";
-import { z as z17 } from "zod";
-function message2(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-async function attempt(into, name, work) {
-  let line;
-  try {
-    line = await work();
-  } catch (error) {
-    line = { name, action: "refused", reason: message2(error) };
-  }
-  into.push(line);
-  return line;
-}
-var canonical = (value) => {
-  if (Array.isArray(value)) return value.map(canonical);
-  if (value === null || typeof value !== "object") return value;
-  return Object.fromEntries(
-    Object.keys(value).sort().map((key) => [key, canonical(value[key])])
-  );
-};
-var changed = (declared, live) => declared !== void 0 && JSON.stringify(canonical(declared)) !== JSON.stringify(canonical(live));
-async function absent(work) {
-  try {
-    return await work;
-  } catch (error) {
-    if (error instanceof ApiError && error.status === 404) return null;
-    throw error;
-  }
-}
-var PageShape = z17.object({
-  data: z17.array(z17.unknown()),
-  has_more: z17.boolean(),
-  next_cursor: z17.string().nullable()
-});
-function rowLabel(row) {
-  const { object, id } = row ?? {};
-  const words = [object, id].filter((one) => typeof one === "string");
-  return words.length > 0 ? words.join(" ") : "a row";
-}
-var why = (error) => error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
-async function listAll(config, path, item, skipped, query = {}) {
-  const rows = [];
-  let after;
-  for (; ; ) {
-    const response = await send(config, { method: "GET", path, query: { ...query, limit: 100, after } }, "application/json");
-    const text = await response.text();
-    if (!response.ok) throw new Error(`could not list ${path} (HTTP ${response.status})`);
-    const body = PageShape.parse(JSON.parse(text));
-    for (const row of body.data) {
-      const parsed = item.safeParse(row);
-      if (parsed.success) rows.push(parsed.data);
-      else skipped.push(`${rowLabel(row)} in ${path} could not be read and was skipped: ${why(parsed.error)}`);
-    }
-    if (!body.has_more || body.next_cursor === null) return rows;
-    after = body.next_cursor;
-  }
-}
-async function tombstone(name, current, remove, dryRun) {
-  if (!current) return { name, action: "unchanged", reason: "already absent" };
-  if (!dryRun) await remove(current.id);
-  return { name, action: "deleted", id: current.id };
+// src/agents.ts
+var PROJECT_CONTEXT_PREAMBLE = "Before anything else, read the project context with the `project_context` tool. The answers in it are the client's own \u2014 never invent, assume or restate them from memory; what the context does not say, you ask. Use the context's own words for the company, its offer and its audience.";
+function desiredMetadata(decl, of, current) {
+  if (of.template === void 0) return decl.metadata;
+  return {
+    ...current?.metadata,
+    ...decl.metadata,
+    project: of.project,
+    ...of.blueprint !== void 0 ? { blueprint: of.blueprint } : {},
+    template: of.template,
+    group: of.template
+  };
 }
+function desiredSystem(decl, of) {
+  if (of.template === void 0) return decl.system;
+  return decl.system === void 0 ? PROJECT_CONTEXT_PREAMBLE : `${PROJECT_CONTEXT_PREAMBLE}
 
-// src/agents.ts
+${decl.system}`;
+}
 function desiredTools(decl, current, ids) {
   if (ids === void 0) return decl.tools;
   const base = decl.tools ?? current?.tools ?? { default_config: { permission: "allow" }, configs: {} };
@@ -1523,21 +2933,26 @@ function desiredTools(decl, current, ids) {
     }
   };
 }
-async function createAgent(client, decl, tools, identityId) {
+async function createAgent(client, decl, tools, team, identityId, system, metadata) {
   const created = await client.agents.create({
     name: decl.name,
     model: decl.model,
     budget: decl.budget,
     ...decl.description !== void 0 ? { description: decl.description } : {},
-    ...decl.system !== void 0 ? { system: decl.system } : {},
+    ...system !== void 0 ? { system } : {},
     ...decl.skills !== void 0 ? { skills: decl.skills } : {},
     ...decl.mcp_servers !== void 0 ? { mcp_servers: decl.mcp_servers } : {},
-    ...tools !== void 0 ? { tools } : {}
+    ...tools !== void 0 ? { tools } : {},
+    ...decl.window !== void 0 ? { window: decl.window } : {},
+    ...team !== void 0 ? { multiagent: team } : {},
+    ...decl.output_schema !== void 0 ? { output_schema: decl.output_schema } : {},
+    ...decl.structured_output_required !== void 0 ? { structured_output_required: decl.structured_output_required } : {},
+    ...metadata !== void 0 ? { metadata } : {}
   });
   if (identityId !== void 0) await client.identities.attach(created.id, identityId);
   return { name: decl.name, action: "created", id: created.id };
 }
-async function upsertAgent(client, decl, existing, ids, dryRun, scoped) {
+async function upsertAgent(client, decl, existing, ids, dryRun, scoped, of) {
   const unresolved = (decl.allowed_apps ?? []).filter((name) => !ids.apps.has(name));
   const identityId = decl.identity === void 0 ? void 0 : ids.identities.get(decl.identity);
   const missing = unresolved.length > 0 ? `allowed_apps needs app "${unresolved[0]}"` : decl.identity !== void 0 && identityId === void 0 ? `identity needs "${decl.identity}"` : null;
@@ -1547,15 +2962,13 @@ async function upsertAgent(client, decl, existing, ids, dryRun, scoped) {
   const appIds = decl.allowed_apps !== void 0 ? decl.allowed_apps.flatMap((name) => ids.apps.get(name) ?? []) : scoped;
   const current = existing.find((agent) => agent.name === decl.name) ?? null;
   const tools = desiredTools(decl, current, appIds);
-  if (!current) return dryRun ? { name: decl.name, action: "created" } : createAgent(client, decl, tools, identityId);
-  const patch = {};
-  if (changed(decl.model, current.model)) patch.model = decl.model;
-  if (changed(decl.budget, current.budget)) patch.budget = decl.budget;
-  if (changed(decl.description, current.description)) patch.description = decl.description;
-  if (changed(decl.system, current.system)) patch.system = decl.system;
-  if (changed(decl.skills, current.skills)) patch.skills = decl.skills;
-  if (changed(decl.mcp_servers, current.mcp_servers)) patch.mcp_servers = decl.mcp_servers;
-  if (changed(tools, current.tools)) patch.tools = tools;
+  const team = teamWithoutRoster(decl.multiagent);
+  const system = desiredSystem(decl, of);
+  const metadata = desiredMetadata(decl, of, current);
+  if (!current) {
+    return dryRun ? { name: decl.name, action: "created" } : createAgent(client, decl, tools, team, identityId, system, metadata);
+  }
+  const patch = drift(decl, current, tools, team, system, metadata);
   const held = identityId === void 0 ? [] : (await client.identities.held(current.id)).data;
   const grant = identityId === void 0 || held.some((one) => one.id === identityId) ? null : identityId;
   const drifted = Object.keys(patch).length > 0 || missing !== null || grant !== null;
@@ -1566,6 +2979,22 @@ async function upsertAgent(client, decl, existing, ids, dryRun, scoped) {
   }
   return { name: decl.name, action: "updated", id: current.id };
 }
+function drift(decl, current, tools, team, system, metadata) {
+  const patch = {};
+  if (changed(decl.model, current.model)) patch.model = decl.model;
+  if (changed(decl.budget, current.budget)) patch.budget = decl.budget;
+  if (changed(decl.description, current.description)) patch.description = decl.description;
+  if (changed(system, current.system)) patch.system = system;
+  if (changed(decl.skills, current.skills)) patch.skills = decl.skills;
+  if (changed(decl.mcp_servers, current.mcp_servers)) patch.mcp_servers = decl.mcp_servers;
+  if (changed(tools, current.tools)) patch.tools = tools;
+  if (changed(decl.window, current.window)) patch.window = decl.window;
+  if (team !== void 0 && changed(normaliseMultiagent(team), normaliseMultiagent(current.multiagent))) patch.multiagent = team;
+  if (changed(decl.output_schema, current.output_schema)) patch.output_schema = decl.output_schema;
+  if (changed(decl.structured_output_required, current.structured_output_required)) patch.structured_output_required = decl.structured_output_required;
+  if (changed(metadata, current.metadata)) patch.metadata = metadata;
+  return patch;
+}
 async function openIntake(client, agent, decl, dryRun) {
   if (dryRun || agent.id === void 0) return { name: agent.name, action: "created" };
   const started = await client.sessions.create({
@@ -1606,10 +3035,15 @@ async function upsertSchedule(client, agent, decl, current, identityIds, dryRun)
 }
 async function reconcileSchedules(client, agent, declared, live, identityIds, dryRun, into) {
   const rows = live.filter((row) => row.agent_id === agent.id);
-  for (const decl of declared) {
-    const current = rows.find((row) => row.cron === decl.cron);
-    await attempt(into, `${agent.name} @ ${decl.cron}`, () => upsertSchedule(client, agent, decl, current, identityIds, dryRun));
-  }
+  into.push(
+    ...await eachInFlight(
+      declared,
+      (decl) => line(
+        `${agent.name} @ ${decl.cron}`,
+        () => upsertSchedule(client, agent, decl, rows.find((row) => row.cron === decl.cron), identityIds, dryRun)
+      )
+    )
+  );
   for (const row of rows.filter((row2) => !declared.some((decl) => decl.cron === row2.cron))) {
     const name = `${agent.name} @ ${row.cron}`;
     await attempt(into, name, () => tombstone(name, row, (id) => client.deployments.delete(id), dryRun));
@@ -1618,7 +3052,59 @@ async function reconcileSchedules(client, agent, declared, live, identityIds, dr
 
 // src/apps.ts
 import { createHash as createHash2, randomBytes } from "node:crypto";
-import { resolve as resolve2 } from "node:path";
+import { resolve as resolve3 } from "node:path";
+
+// src/buckets.ts
+async function applyBuckets(client, appId, buckets) {
+  const live = new Set((await client.storage.buckets.list({ app: appId })).data.map((row) => row.name));
+  const missing = buckets.filter((bucket) => !live.has(bucket.name));
+  for (const bucket of missing) await client.storage.buckets.create(bucket.name, { app: appId, public: bucket.public });
+  return { fresh: missing.length, note: `${buckets.length} bucket(s), ${missing.length} new` };
+}
+
+// src/migrations.ts
+import { readFileSync as readFileSync3, readdirSync as readdirSync2 } from "node:fs";
+import { basename, dirname, extname, join as join3, resolve as resolve2 } from "node:path";
+function matcher(pattern) {
+  const source = pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*");
+  const regex = new RegExp(`^${source}$`);
+  return (name) => regex.test(name);
+}
+function migrationFiles(patterns, dir) {
+  const seen = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const pattern of patterns) {
+    const full = resolve2(dir, pattern);
+    const paths = pattern.includes("*") ? readdirSync2(dirname(full), { withFileTypes: true }).filter((entry) => entry.isFile() && matcher(basename(full))(entry.name)).map((entry) => join3(dirname(full), entry.name)).sort() : [full];
+    if (paths.length === 0) throw new Error(`migrations "${pattern}" matches no file under ${dir}`);
+    for (const path of paths) {
+      const name = basename(path, extname(path));
+      if (seen.has(name)) continue;
+      seen.add(name);
+      files.push({ name, sql: readFileSync3(path, "utf8") });
+    }
+  }
+  return files;
+}
+function declaredMigrations(decl, opts) {
+  if (decl.migrations === void 0) return [];
+  if (opts.trees === void 0) return migrationFiles(decl.migrations, opts.dir);
+  const published = opts.migrations?.[decl.name];
+  if (published === void 0) {
+    throw new Error(
+      `app "${decl.name}" declares migrations, but this apply was handed no published SQL for it. Republish the artifact, or apply them with \`naive up\` from a clone.`
+    );
+  }
+  return published;
+}
+async function applyMigrations(client, appId, files) {
+  const applied2 = new Set((await client.database.migrations({ app: appId })).map((row) => row.name));
+  for (const file of files) await client.database.migrate(file.name, file.sql, { app: appId });
+  const fresh = files.filter((file) => !applied2.has(file.name)).length;
+  return { fresh, note: `${files.length} migration(s), ${fresh} new` };
+}
+
+// src/apps.ts
 async function findApp(client, name, skipped) {
   const rows = await listAll(client.config, "/v1/apps", AppSchema, skipped, { name });
   return rows.find((app) => app.name === name) ?? null;
@@ -1634,6 +3120,8 @@ var PLATFORM_ENV = {
   api_url: "NAIVE_API_URL",
   /** The identity the install runs as, when the declaration declares exactly one. */
   identity_id: "NAIVE_IDENTITY_ID",
+  /** The install's `project` — the row the app's own context lookup lands on (§31.8). */
+  project: "NAIVE_PROJECT",
   /** A scoped organization API key minted for the app that asks for it. */
   api_key: "NAIVE_API_KEY"
 };
@@ -1696,13 +3184,14 @@ function builtTree(decl, opts) {
       `app "${decl.name}" declares deploy_dir "${decl.deploy_dir}", but this apply was handed no built tree for it` + (failed === void 0 ? "" : `: ${failed}`)
     );
   }
-  const files = collectFiles(hosted?.[decl.name] ?? resolve2(opts.dir, decl.deploy_dir));
+  const files = collectFiles(hosted?.[decl.name] ?? resolve3(opts.dir, decl.deploy_dir));
   return { files, hash: contentHash(files) };
 }
 async function writeApp(client, id, env, tree) {
-  for (const [name, value] of Object.entries(env)) {
-    await client.apps.setSecret(id, { name, value, value_hash: secretHash(name, value) });
-  }
+  await eachInFlight(
+    Object.entries(env),
+    ([name, value]) => client.apps.setSecret(id, { name, value, value_hash: secretHash(name, value) })
+  );
   if (!tree) return;
   await client.apps.deploy(id, tree.files, tree.hash);
   await settleDeploy(client, id);
@@ -1713,10 +3202,10 @@ async function settleDeploy(client, id) {
   for (let poll = 0; poll < SETTLE_TRIES; poll++) {
     const newest = (await client.apps.deployments(id, { limit: 1 })).data[0];
     if (newest === void 0 || newest.status === "ready" || newest.status === "error") return;
-    await new Promise((resolve4) => setTimeout(resolve4, SETTLE_MS));
+    await new Promise((resolve5) => setTimeout(resolve5, SETTLE_MS));
   }
 }
-async function createApp(client, decl, env, tree, opts, appIds) {
+async function createApp(client, decl, env, tree, migrations, opts, appIds) {
   const created = await ensureApp(client, {
     name: decl.name,
     type: decl.type,
@@ -1726,13 +3215,24 @@ async function createApp(client, decl, env, tree, opts, appIds) {
   });
   appIds.set(decl.name, created.id);
   await writeApp(client, created.id, env, tree);
-  return { name: decl.name, action: "created", id: created.id, url: (await client.apps.get(created.id)).url };
+  const notes = [];
+  if (migrations.length > 0) notes.push((await applyMigrations(client, created.id, migrations)).note);
+  if (decl.buckets !== void 0) notes.push((await applyBuckets(client, created.id, decl.buckets)).note);
+  return {
+    name: decl.name,
+    action: "created",
+    id: created.id,
+    url: (await client.apps.get(created.id)).url,
+    ...notes.length > 0 ? { reason: notes.join("; ") } : {}
+  };
 }
 async function upsertApp(client, decl, opts, appIds) {
   const declared = planEnv(decl, opts);
   const names = declared.map((one) => one.name);
   const note = (notes) => notes.length > 0 ? { reason: notes.join("; ") } : {};
   const mcpPlan = decl.mcp !== void 0 ? [`will set mcp ${decl.mcp}`] : [];
+  const migrationPlan = decl.migrations !== void 0 ? [`will apply migrations ${decl.migrations.join(", ")}`] : [];
+  const bucketPlan = decl.buckets !== void 0 ? [`will ensure buckets ${decl.buckets.map((one) => one.name).join(", ")}`] : [];
   const current = await findApp(client, decl.name, opts.skipped);
   if (!current) {
     const willSet = names.length > 0 ? [`will set ${names.join(", ")}`] : [];
@@ -1740,11 +3240,11 @@ async function upsertApp(client, decl, opts, appIds) {
       return {
         name: decl.name,
         action: "created",
-        ...note([...willSet, ...mcpPlan, ...decl.deploy_dir ? [`will deploy ${decl.deploy_dir}`] : []])
+        ...note([...willSet, ...mcpPlan, ...decl.deploy_dir ? [`will deploy ${decl.deploy_dir}`] : [], ...migrationPlan, ...bucketPlan])
       };
     }
     const { values } = await materialize(declared, EMPTY, false);
-    return createApp(client, decl, values, builtTree(decl, opts), opts, appIds);
+    return createApp(client, decl, values, builtTree(decl, opts), declaredMigrations(decl, opts), opts, appIds);
   }
   const owned = current.project === opts.project;
   if (!owned && !opts.adopt) {
@@ -1786,15 +3286,28 @@ async function upsertApp(client, decl, opts, appIds) {
   const tree = builtTree(decl, opts);
   const newest = tree ? (await client.apps.deployments(current.id, { limit: 1 })).data[0] : void 0;
   const stale = tree !== null && newest?.content_hash !== tree.hash;
-  const action = !owned || drifted || stale || staleNames.length > 0 ? "updated" : "unchanged";
+  let action = !owned || drifted || stale || staleNames.length > 0 ? "updated" : "unchanged";
   const plan = opts.dryRun ? [
     ...staleNames.length > 0 ? [`will set ${staleNames.join(", ")}`] : [],
     ..."mcp" in patch ? patch.mcp === null ? ["will clear mcp"] : mcpPlan : [],
-    ...decl.deploy_dir ? [stale ? `will deploy ${decl.deploy_dir}` : `${decl.deploy_dir} unchanged`] : []
+    ...decl.deploy_dir ? [stale ? `will deploy ${decl.deploy_dir}` : `${decl.deploy_dir} unchanged`] : [],
+    ...migrationPlan,
+    ...bucketPlan
   ] : [];
   if (!opts.dryRun) {
     if (drifted) await client.apps.update(current.id, { ...patch, project: opts.project });
     await writeApp(client, current.id, staleEnv, stale ? tree : null);
+    const migrations = declaredMigrations(decl, opts);
+    if (migrations.length > 0) {
+      const { fresh, note: note2 } = await applyMigrations(client, current.id, migrations);
+      if (fresh > 0) action = "updated";
+      plan.push(note2);
+    }
+    if (decl.buckets !== void 0) {
+      const { fresh, note: note2 } = await applyBuckets(client, current.id, decl.buckets);
+      if (fresh > 0) action = "updated";
+      plan.push(note2);
+    }
   }
   return {
     name: decl.name,
@@ -1806,6 +3319,106 @@ async function upsertApp(client, decl, opts, appIds) {
   };
 }
 
+// src/reconcile-cards.ts
+var LIVE = /* @__PURE__ */ new Set(["pending_payment", "issuing", "active"]);
+var nameOf = (identity, decl) => `${identity} / card ${decl.label}`;
+async function upsertCard(client, identityId, decl, live, dryRun, name) {
+  const current = live.find((card) => card.label === decl.label && LIVE.has(card.status));
+  if (current) return { name, action: "unchanged", id: current.id };
+  const spent = live.find((card) => card.label === decl.label);
+  if (spent) {
+    return { name, action: "refused", id: spent.id, reason: `a card labelled "${decl.label}" is ${spent.status}; issue a replacement by hand` };
+  }
+  if (dryRun) {
+    const quote = await client.identities.cards.quote(identityId, { load_micro_usd: decl.load_micro_usd });
+    const price = decimalStringFromMicro(microUsd(quote.price_micro_usd));
+    return { name, action: "created", reason: `would debit ${price} USD of credits (${quote.price_micro_usd} micro-USD)` };
+  }
+  const issued = await client.identities.cards.issue(identityId, decl);
+  return { name, action: "created", id: issued.id };
+}
+async function reconcileCards(client, identity, identityId, decls, dryRun, into, skipped) {
+  if (decls.length === 0) return;
+  if (identityId === void 0) {
+    for (const decl of decls) {
+      into.push(
+        dryRun ? { name: nameOf(identity, decl), action: "created", reason: "quoted once the identity exists; issuing debits credits" } : { name: nameOf(identity, decl), action: "refused", reason: `identity "${identity}" was not provisioned in this run` }
+      );
+    }
+    return;
+  }
+  const live = await listAll(client.config, `/v1/identities/${identityId}/cards`, CardSchema, skipped);
+  for (const decl of decls) {
+    const name = nameOf(identity, decl);
+    await attempt(into, name, () => upsertCard(client, identityId, decl, live, dryRun, name));
+  }
+}
+
+// src/reconcile-legal.ts
+var FILE = "vetta identity legal form";
+var VERIFY = "vetta identity legal verify";
+function latest(cases) {
+  return [...cases].sort((a, b) => b.created_at.localeCompare(a.created_at))[0];
+}
+function match(decl, companies) {
+  const wanted = new Set(
+    decl.name_options.map((raw) => canonicalName(raw).name)
+  );
+  return companies.find(
+    (c) => c.state === decl.state && c.name_options.some((o) => wanted.has(o.name))
+  );
+}
+function report(decl, company, verification) {
+  const name = decl.label;
+  if (company !== void 0) {
+    const reason = company.status === "failed" ? `failed: ${company.failure_reason ?? "the filing was rejected"}` : company.status;
+    return {
+      name,
+      action: company.status === "failed" ? "refused" : "unchanged",
+      id: company.id,
+      reason
+    };
+  }
+  if (verification === void 0)
+    return {
+      name,
+      action: "refused",
+      reason: `no verification case \u2014 a person must start one with \`${VERIFY}\``
+    };
+  if (verification.status === "verified") {
+    return {
+      name,
+      action: "refused",
+      id: verification.id,
+      reason: `verified; the fee is debited from credits, so a person files it with \`${FILE}\``
+    };
+  }
+  return {
+    name,
+    action: "refused",
+    id: verification.id,
+    reason: `verification ${verification.status}; nothing to file yet`
+  };
+}
+async function reportLegal(client, decls, identityId, skipped) {
+  if (decls.length === 0) return [];
+  if (identityId === void 0)
+    return decls.map((decl) => report(decl, void 0, void 0));
+  const base = `/v1/identities/${identityId}/legal`;
+  const [companies, cases] = await Promise.all([
+    listAll(client.config, `${base}/companies`, LegalCompanySchema, skipped),
+    listAll(
+      client.config,
+      `${base}/verifications`,
+      LegalVerificationSchema,
+      skipped
+    )
+  ]);
+  return decls.map(
+    (decl) => report(decl, match(decl, companies), latest(cases))
+  );
+}
+
 // src/vaults.ts
 async function upsertVault(client, decl, existing, identityIds, dryRun) {
   const identityId = decl.identity === void 0 ? void 0 : identityIds.get(decl.identity);
@@ -1851,23 +3464,94 @@ async function upsertCredential(client, vault, decl, existing, dryRun, from) {
   return { name, action: "created", id: created.id };
 }
 
+// src/reconcile-wallet.ts
+var declaredPolicy = (decl, live) => Object.fromEntries(
+  Object.entries(decl.policy ?? {}).filter(([key, value]) => value !== void 0 && changed(value, live[key]))
+);
+var walletName = (identity, decl) => decl.network === void 0 || decl.network === DEFAULT_WALLET_NETWORK ? `${identity} / wallet` : `${identity} / wallet ${decl.network}`;
+async function reconcileWallet(client, identity, decl, dryRun) {
+  const name = walletName(identity.name, decl);
+  const network = decl.network ?? DEFAULT_WALLET_NETWORK;
+  if (identity.id === void 0) {
+    if (dryRun) return { name, action: "created" };
+    return { name, action: "refused", reason: `identity "${identity.name}" was not provisioned in this run` };
+  }
+  const current = await absent(client.identities.wallet.get(identity.id, { network }));
+  if (!current) {
+    if (dryRun) return { name, action: "created" };
+    const created = await client.identities.wallet.create(identity.id, decl);
+    return { name, action: "created", id: created.id };
+  }
+  const patch = declaredPolicy(decl, current.policy);
+  if (Object.keys(patch).length === 0) return { name, action: "unchanged", id: current.id };
+  if (current.status !== "active") {
+    return { name, action: "refused", id: current.id, reason: `wallet is ${current.status}; unfreeze it on the platform before changing its policy` };
+  }
+  if (!dryRun) await client.identities.wallet.updatePolicy(identity.id, patch, { network });
+  return { name, action: "updated", id: current.id };
+}
+
 // src/up.ts
+var SERVING_TRIES = 90;
+var SERVING_MS = 2e3;
+async function awaitServing(addresses, probe) {
+  await Promise.all(
+    addresses.map(async (address) => {
+      for (let poll = 0; poll < SERVING_TRIES; poll++) {
+        try {
+          const { status } = await probe(address, { method: "GET" });
+          if (status < 500 && status !== 404) return;
+        } catch {
+        }
+        await new Promise((resolve5) => setTimeout(resolve5, SERVING_MS));
+      }
+    })
+  );
+}
+function selectCrew(config, select) {
+  if (select === void 0) return { apps: config.apps, agents: config.agents, deselected: [] };
+  const named = (kind, names) => names.map((name) => `${kind} "${name}"`);
+  const unknown = [
+    ...named("app", select.apps.filter((name) => !config.apps.some((decl) => decl.name === name))),
+    ...named("agent", select.agents.filter((name) => !config.agents.some((decl) => decl.name === name)))
+  ];
+  if (unknown.length > 0) {
+    throw new BlueprintRefusal(`selection names ${unknown.join(", ")}, which this declaration does not declare`);
+  }
+  const apps = config.apps.filter((decl) => select.apps.includes(decl.name));
+  const agents = config.agents.filter((decl) => select.agents.includes(decl.name));
+  const missing = [
+    ...named("app", config.apps.filter((decl) => decl.required === true && !apps.includes(decl)).map((decl) => decl.name)),
+    ...named("agent", config.agents.filter((decl) => decl.required === true && !agents.includes(decl)).map((decl) => decl.name))
+  ];
+  if (missing.length > 0) {
+    throw new BlueprintRefusal(
+      `selection leaves out ${missing.join(", ")}, which this template requires \u2014 ${missing.length === 1 ? "it" : "they"} cannot be deselected`
+    );
+  }
+  const deselected = [
+    ...config.apps.filter((decl) => !apps.includes(decl)).map((decl) => decl.name),
+    ...config.agents.filter((decl) => !agents.includes(decl)).map((decl) => decl.name)
+  ];
+  return { apps, agents, deselected };
+}
 function identityEnv(config, ids) {
   if (config.identities.length !== 1) return {};
   const id = ids.get(config.identities[0].name);
   return id === void 0 ? {} : { [PLATFORM_ENV.identity_id]: id };
 }
 async function upsertSkill(client, decl, opts) {
-  if (opts.hosted) {
+  const inline = opts.skills[decl.slug];
+  if (opts.hosted && inline === void 0) {
     throw new Error(
       `skill "${decl.slug}" is declared as the file "${decl.file}", and a hosted apply has no checkout to read it from. Push it with \`naive up\` from a clone, or publish it as part of the blueprint.`
     );
   }
-  const content = readFileSync3(resolve3(opts.dir, decl.file), "utf8");
+  const content = inline ?? readFileSync4(resolve4(opts.dir, decl.file), "utf8");
   const sha256 = createHash3("sha256").update(content).digest("hex");
   const current = await absent(client.skills.get(decl.slug));
-  const latest = current ? (await client.skills.listVersions(decl.slug, { limit: 1 })).data[0] : void 0;
-  const action = !current ? "created" : latest?.sha256 === sha256 ? "unchanged" : "updated";
+  const latest2 = current ? (await client.skills.listVersions(decl.slug, { limit: 1 })).data[0] : void 0;
+  const action = !current ? "created" : latest2?.sha256 === sha256 ? "unchanged" : "updated";
   if (action === "unchanged" || opts.dryRun) {
     return { name: decl.slug, action, ...current ? { id: current.id } : {} };
   }
@@ -1890,14 +3574,14 @@ async function upsertIdentity(client, decl, dryRun, identityIds) {
   if (drifted && !dryRun) await client.identities.update(current.id, { description: decl.description ?? null });
   return { name: decl.name, action: drifted ? "updated" : "unchanged", id: current.id };
 }
-async function applyRemoved(client, removed, live, owner, report) {
-  const dryRun = report.dry_run;
+async function applyRemoved(client, removed, live, owner, report2) {
+  const dryRun = report2.dry_run;
   for (const name of removed.agents) {
     const current = live.agents.find((agent) => agent.name === name);
-    await attempt(report.agents, name, () => tombstone(name, current, (id) => client.agents.delete(id), dryRun));
+    await attempt(report2.agents, name, () => tombstone(name, current, (id) => client.agents.delete(id), dryRun));
   }
   for (const name of removed.apps) {
-    await attempt(report.apps, name, async () => {
+    await attempt(report2.apps, name, async () => {
       const current = await findApp(client, name, owner.skipped);
       if (current !== null && current.project !== owner.project && !owner.adopt) {
         return { name, action: "refused", id: current.id, reason: ownershipRefusal(name, owner.project, current.project) };
@@ -1907,18 +3591,18 @@ async function applyRemoved(client, removed, live, owner, report) {
   }
   for (const slug of removed.skills) {
     await attempt(
-      report.skills,
+      report2.skills,
       slug,
       async () => tombstone(slug, await absent(client.skills.get(slug)), (id) => client.skills.delete(id), dryRun)
     );
   }
   for (const name of removed.vaults) {
     const current = live.vaults.find((vault) => vault.display_name === name);
-    await attempt(report.vaults, name, () => tombstone(name, current, (id) => client.vaults.delete(id), dryRun));
+    await attempt(report2.vaults, name, () => tombstone(name, current, (id) => client.vaults.delete(id), dryRun));
   }
   for (const name of removed.identities) {
     await attempt(
-      report.identities,
+      report2.identities,
       name,
       async () => tombstone(name, await absent(client.identities.get(name)), (id) => client.identities.delete(id), dryRun)
     );
@@ -1935,81 +3619,134 @@ function reportKept(config, live, into) {
     if (current !== void 0) into.push({ name, action: "unchanged", id: current.id, reason: `not declared by ${by}; kept, never deleted` });
   }
 }
+function reaches(decl, app) {
+  return Object.entries(decl.tools?.configs ?? {}).some(
+    ([name, one]) => name.startsWith(`${app}.`) && one.enabled && one.permission !== "deny"
+  );
+}
 async function up(config, client, opts = {}) {
   const dryRun = opts.dry_run ?? false;
   const dir = opts.dir ?? process.cwd();
   const ids = { apps: /* @__PURE__ */ new Map(), identities: /* @__PURE__ */ new Map() };
-  const report = { dry_run: dryRun, ...applied(config), skills: [], identities: [], vaults: [], apps: [], agents: [], schedules: [], intake: [], skipped: [] };
-  const owner = { project: config.name, adopt: opts.adopt ?? false, skipped: report.skipped };
+  const taken = selectCrew(config, opts.select);
+  const report2 = { dry_run: dryRun, ...applied(config), skills: [], identities: [], vaults: [], apps: [], agents: [], schedules: [], intake: [], skipped: [], deselected: taken.deselected };
+  const owner = { project: config.name, adopt: opts.adopt ?? false, skipped: report2.skipped };
   const hosted = opts.trees !== void 0;
   for (const decl of config.skills) {
-    await attempt(report.skills, decl.slug, () => upsertSkill(client, decl, { dryRun, dir, hosted }));
+    await attempt(report2.skills, decl.slug, () => upsertSkill(client, decl, { dryRun, dir, hosted, skills: opts.skills ?? {} }));
   }
   for (const decl of config.identities) {
-    await attempt(report.identities, decl.name, () => upsertIdentity(client, decl, dryRun, ids.identities));
+    await attempt(report2.identities, decl.name, () => upsertIdentity(client, decl, dryRun, ids.identities));
+    const identityId = ids.identities.get(decl.name);
+    report2.identities.push(...await reportLegal(client, decl.legal ?? [], identityId, report2.skipped));
+    for (const wallet of decl.wallet === void 0 ? [] : Array.isArray(decl.wallet) ? decl.wallet : [decl.wallet]) {
+      await attempt(
+        report2.identities,
+        walletName(decl.name, wallet),
+        () => reconcileWallet(client, { name: decl.name, id: identityId }, wallet, dryRun)
+      );
+    }
+    await reconcileCards(client, decl.name, identityId, decl.cards ?? [], dryRun, report2.identities, report2.skipped);
   }
-  const vaults = config.vaults.length > 0 || config.removed.vaults.length > 0 ? await listAll(client.config, "/v1/vaults", VaultSchema, report.skipped) : [];
+  const vaults = config.vaults.length > 0 || config.removed.vaults.length > 0 ? await listAll(client.config, "/v1/vaults", VaultSchema, report2.skipped) : [];
   for (const decl of config.vaults) {
-    const line = await attempt(report.vaults, decl.name, () => upsertVault(client, decl, vaults, ids.identities, dryRun));
-    const vaultId = line.action === "unchanged" ? line.id : void 0;
-    const rows = vaultId === void 0 ? [] : await listAll(client.config, `/v1/vaults/${vaultId}/credentials`, VaultCredentialSchema, report.skipped);
+    const line2 = await attempt(report2.vaults, decl.name, () => upsertVault(client, decl, vaults, ids.identities, dryRun));
+    const vaultId = line2.action === "unchanged" ? line2.id : void 0;
+    const rows = vaultId === void 0 ? [] : await listAll(client.config, `/v1/vaults/${vaultId}/credentials`, VaultCredentialSchema, report2.skipped);
     for (const cred of decl.credentials) {
       await attempt(
-        report.vaults,
+        report2.vaults,
         `${decl.name} / ${cred.key}`,
-        () => upsertCredential(client, line, cred, rows, dryRun, opts.env ?? process.env)
+        () => upsertCredential(client, line2, cred, rows, dryRun, opts.env ?? process.env)
       );
     }
   }
   const platform = opts.platform && {
     ...opts.platform,
-    known: { ...opts.platform.known, ...identityEnv(config, ids.identities) }
+    known: {
+      ...opts.platform.known,
+      [PLATFORM_ENV.project]: opts.project ?? config.name,
+      ...identityEnv(config, ids.identities)
+    }
   };
-  for (const decl of config.apps) {
-    await attempt(
-      report.apps,
-      decl.name,
-      () => upsertApp(
-        client,
-        decl,
-        { ...owner, dryRun, dir, trees: opts.trees, tree_errors: opts.tree_errors, env: opts.env ?? process.env, platform },
-        ids.apps
+  report2.apps.push(
+    ...await eachInFlight(
+      taken.apps,
+      (decl) => line(
+        decl.name,
+        () => upsertApp(
+          client,
+          decl,
+          {
+            ...owner,
+            dryRun,
+            dir,
+            trees: opts.trees,
+            tree_errors: opts.tree_errors,
+            migrations: opts.migrations,
+            env: opts.env ?? process.env,
+            platform
+          },
+          ids.apps
+        )
       )
-    );
-  }
-  const existing = config.agents.length > 0 || config.removed.agents.length > 0 || config.kept.agents.length > 0 ? await listAll(client.config, "/v1/agents", AgentSchema, report.skipped) : [];
-  const deployments = config.agents.some((decl) => decl.schedules !== void 0) ? await listAll(client.config, "/v1/deployments", DeploymentSchema, report.skipped) : [];
+    )
+  );
+  const existing = taken.agents.length > 0 || config.removed.agents.length > 0 || config.kept.agents.length > 0 ? await listAll(client.config, "/v1/agents", AgentSchema, report2.skipped) : [];
+  const deployments = taken.agents.some((decl) => decl.schedules !== void 0) ? await listAll(client.config, "/v1/deployments", DeploymentSchema, report2.skipped) : [];
   const scoped = config.apps.length > 0 ? [...ids.apps.values()] : void 0;
-  const briefed = [];
-  for (const decl of config.agents) {
-    const line = await attempt(
-      report.agents,
-      decl.name,
-      () => upsertAgent(client, decl, existing, ids, dryRun, scoped)
-    );
+  const crew = await eachInFlight(taken.agents, async (decl) => {
+    const agent = await line(decl.name, () => upsertAgent(client, decl, existing, ids, dryRun, scoped, { project: opts.project ?? config.name, ...applied(config) }));
+    const schedules = [];
     if (decl.schedules !== void 0) {
-      await reconcileSchedules(client, line, decl.schedules, deployments, ids.identities, dryRun, report.schedules);
+      await reconcileSchedules(client, agent, decl.schedules, deployments, ids.identities, dryRun, schedules);
     }
-    if (decl.intake !== void 0 && line.action === "created") briefed.push([line, decl.intake]);
+    return { decl, agent, schedules };
+  });
+  const briefed = [];
+  const unbuilt = dryRun ? [] : config.apps.map((decl) => decl.name).filter((name) => !ids.apps.has(name));
+  for (const { decl, agent, schedules } of crew) {
+    report2.agents.push(agent);
+    report2.schedules.push(...schedules);
+    if (decl.intake === void 0 || agent.action !== "created") continue;
+    const needs = unbuilt.find((app) => reaches(decl, app));
+    if (needs === void 0) briefed.push([agent, decl.intake]);
+    else report2.intake.push({ name: decl.name, action: "refused", reason: `needs app "${needs}", which was not provisioned in this run` });
   }
-  reportKept(config, existing, report.agents);
-  await applyRemoved(client, config.removed, { agents: existing, vaults }, owner, report);
-  for (const [line, decl] of briefed) {
-    await attempt(report.intake, line.name, () => openIntake(client, line, decl, dryRun));
+  const agentIds = new Map(existing.map((agent) => [agent.name, agent.id]));
+  for (const line2 of report2.agents) if (line2.id !== void 0) agentIds.set(line2.name, line2.id);
+  for (const decl of config.agents) {
+    if (hasRoster(decl.multiagent)) await patchRoster(client, decl, decl.multiagent, existing, agentIds, dryRun, report2.agents);
+  }
+  reportKept(config, existing, report2.agents);
+  await applyRemoved(client, config.removed, { agents: existing, vaults }, owner, report2);
+  if (briefed.length > 0 && !dryRun) {
+    const serving = taken.apps.flatMap((decl) => {
+      const url = report2.apps.find((one) => one.name === decl.name)?.url;
+      return decl.mcp !== void 0 && typeof url === "string" ? [url + decl.mcp] : [];
+    });
+    await awaitServing(serving, opts.probe ?? globalThis.fetch);
   }
-  return report;
+  report2.intake.push(
+    ...await eachInFlight(briefed, ([agent, decl]) => line(agent.name, () => openIntake(client, agent, decl, dryRun)))
+  );
+  return report2;
 }
 export {
   BLUEPRINTS,
   BlueprintRefusal,
   CONFIG_CANDIDATES,
   PLATFORM_ENV,
+  PROJECT_CONTEXT_PREAMBLE,
   chooseTemplate,
   collectFiles,
   contentHash,
   defineProject,
+  hasRoster,
   loadConfig,
+  migrationFiles,
   parseProject,
+  selectCrew,
   up
 };
 //# sourceMappingURL=index.js.map