@usenaive-sdk/cli 0.12.2 → 0.13.0

package/dist/commands/up.d.ts

@@ -1,3 +1,153 @@
 import { Command } from "commander";
+import { type NextStep } from "../output.js";
+/** What the API reports about the brains `company.brains` declared. */
+interface BrainsResult {
+    declared_in?: string | null;
+    created?: Array<{
+        name: string;
+    }>;
+    converged?: Array<{
+        name: string;
+    }>;
+    default?: {
+        name?: string | null;
+        changed?: boolean;
+    };
+    retained_undeclared?: string[];
+    /**
+     * Declared brain policy with no column to land in, per brain.
+     * `brain_knowledge_bases` has columns for name, is_default, scope, status and
+     * provider ids and nothing else, so `retention`, `partitions`, `writes`,
+     * `recall`, `lanes`, `visibility` and `bounds` are accepted and not stored.
+     */
+    unpersisted?: Record<string, string[]>;
+    /** The server's own prose for the same, plus the retained-undeclared note. */
+    notes?: string[];
+}
+/**
+ * The brain half of the report, or undefined when the config declared none.
+ *
+ * Exported for the same reason it exists: `naive up` printed `applied: true` and
+ * said NOTHING about brains, so a config that declared two of them looked
+ * identical to a config that declared none. `--plan` showed them (it prints the
+ * whole plan); apply did not. A provisioned thing that is not reported is the
+ * same silence as an unprovisioned one, one level up.
+ *
+ * 🔴 AND `unpersisted` IS PART OF THE REPORT, NOT AN EXTRA. The apply path
+ * computed the accept-and-drop list and this projection threw it away, so
+ * `naive up --plan` told the user which declared brain keys have no column and
+ * plain `naive up` — the command people actually run — did not. That is the same
+ * defect one level down: `packages/api/src/services/deployment-brains.ts`'s own
+ * header calls accept-and-drop "the exact defect this file exists to remove", and
+ * a report only the dry run prints is a report most operators never see.
+ */
+export declare function brainReport(brains: BrainsResult | undefined): {
+    declared_in: string | null;
+    created: string[];
+    converged: string[];
+    default: string | null;
+    retained: string[];
+    unpersisted?: Record<string, string[]>;
+    notes?: string[];
+} | undefined;
+/** What the plan reports per declared team, whichever runtime it asked for. */
+interface TeamPlanEntry {
+    name: string;
+    runtime: string;
+    roles?: string[];
+    lead_role?: string;
+    /** Role → runtime, present only for a MIXED team. See `role_runtimes` on the API. */
+    role_runtimes?: Record<string, string>;
+    placement?: {
+        status: string;
+        code?: string;
+        message?: string;
+    };
+    /** Keys this team declared that NOTHING on the control plane reads. */
+    unconsumed?: string[];
+}
+/**
+ * The per-team accept-and-drop warning, one line per team that declared any.
+ *
+ * The data has been on the wire the whole time (`plan.teams[].unconsumed`,
+ * computed by `unconsumedTeamKeys` in packages/api) and `naive up` printed none
+ * of it — `team({ governance: {…} })` applied green and enforced nothing, with
+ * nothing anywhere for the author to notice. Printed on the PLAN and on the
+ * APPLY, because a report only the dry run shows is a report most operators
+ * never see.
+ */
+export declare function unconsumedWarnings(teams: readonly TeamPlanEntry[]): string[];
+/**
+ * ONE deprecation line when the config still uses the legacy ECS surface —
+ * `runtime.pool()` declarations, an agent-level `runtime: "<pool>"` string, or
+ * `systems:`. All three keep working indefinitely; the line names what was
+ * found and where new configs should author instead.
+ */
+export declare function legacyDeprecationNotice(config: Record<string, unknown>): string | null;
+/**
+ * ONE rename line when the config declares `agents:`. Separate from the legacy
+ * line above on purpose: `runtime.pool()` / `systems:` are a deprecated
+ * SURFACE, while `agents:` is a deprecated SPELLING — the block compiles to
+ * byte-for-byte what `kits:` compiles to, so the honest notice is "rename",
+ * not "migrate". A notice, never a refusal, on both entrypoints.
+ */
+export declare function agentsRenameNotice(config: Record<string, unknown>): string | null;
+/**
+ * The operator credential the DURABLE RUNTIME issued, read from the ENVIRONMENT.
+ *
+ * Never from `naive.config.ts`, and that is the whole point rather than a style
+ * choice. The config is committed, so a credential in it is a credential in git —
+ * and, more importantly, the config is the one thing that must not by itself be
+ * able to change where a tenant runs. Pointing a tenant at the durable runtime
+ * overwrites its `sidecar_url` and `container_auth_token` and nulls its
+ * `instance_id`, none of which is stashed anywhere. Requiring a second, separate
+ * act means an edit alone can never do it.
+ *
+ * `NAIVE_DURABLE_CREDENTIAL_<TEAM>` names one team; `NAIVE_DURABLE_CREDENTIAL`
+ * covers them all. Neither is ever printed, and the API never echoes it back.
+ */
+export declare function durableCredentialEnvVar(team: string): string;
+/**
+ * The recovery for ONE refused team — a command that EXISTS, or none.
+ *
+ * 🔴 `naive runtime migrate` IS NOT A COMMAND, AND THIS USED TO PRINT IT.
+ * Every refusal here used to emit
+ * `naive runtime migrate --tenant … --to durable --credential-from <file>`.
+ * Measured on the built CLI: `naive runtime migrate --tenant <id> --to hermes`
+ * answers
+ * `{"code":"cli_outdated","message":"Unknown command 'runtime'. Your naive CLI
+ * is v0.12.4; this command may exist in a newer version."}` — and it exists in
+ * NO version: `packages/cli/src/index.ts` registers no `runtime` group at all.
+ * So an operator whose apply was refused was handed a command that tells them to
+ * upgrade, forever. A next_step that cannot be run is worse than none, because it
+ * ends the search.
+ *
+ * The two cases are genuinely different and are answered differently:
+ *
+ *   · `runtime_credential_required` — there IS a procedure, it works today, and
+ *     it is the one this command already implements: put the operator credential
+ *     the durable runtime issued in the environment and re-run. Never in
+ *     `naive.config.ts`, which is committed.
+ *   · everything else (`runtime_migration_requires_explicit_opt_in`,
+ *     `runtime_claim_in_flight`, `runtime_placement_lost_race`,
+ *     `runtime_not_configured`, `runtime_state_unknown`) — there is NO self-serve
+ *     command on this build. Moving an existing tenant between runtimes
+ *     overwrites `sidecar_url` and `container_auth_token` and nulls `instance_id`
+ *     with nothing stashed, so the control plane refuses it and no client can do
+ *     it either. Say that, and print the server's own message, rather than
+ *     inventing a command to carry the blame.
+ *
+ * The API writes the same vapour into `details.migrate_command`
+ * (packages/api/src/services/placement.ts MIGRATE_COMMAND). That string is not
+ * this package's to change and is reported as a follow-up; this function is why
+ * `naive up` no longer repeats it.
+ */
+export declare function refusalNextStep(t: {
+    name: string;
+    placement?: {
+        code?: string;
+    };
+}): NextStep | null;
 export declare const upCmd: Command;
 export declare const downCmd: Command;
+export {};

package/dist/commands/up.js

@@ -32,25 +32,63 @@ function collectWebFiles(root) {
     return out;
 }
 const CONFIG_CANDIDATES = ["naive.config.ts", "naive.config.js", "naive.config.mjs", "naive.config.json"];
+/**
+ * A module-resolution failure, as opposed to the config refusing itself.
+ *
+ * `ERR_MODULE_NOT_FOUND` / `MODULE_NOT_FOUND` is what an absent dependency
+ * raises. Matched on the CODE rather than the message, because a define-time
+ * refusal is free to mention a package name in its prose and must not be
+ * misread as a missing install.
+ */
+function isMissingModule(e) {
+    const code = e?.code;
+    return code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND";
+}
 /** Evaluate naive.config.{ts,js,json} to its full object (the whole NaiveConfig). */
 async function loadConfig(path) {
     if (path.endsWith(".json")) {
         try {
-            return JSON.parse(readFileSync(path, "utf8"));
+            return { ok: true, config: JSON.parse(readFileSync(path, "utf8")) };
         }
-        catch {
-            return null;
+        catch (e) {
+            // A committed .json needs no toolchain, so a parse failure is only ever
+            // the file's own fault.
+            return { ok: false, reason: "invalid", message: e instanceof Error ? e.message : String(e) };
         }
     }
+    let jiti;
     try {
         const { createJiti } = await import("jiti");
-        const jiti = createJiti(pathToFileURL(path).href);
+        jiti = createJiti(pathToFileURL(path).href);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            reason: "unloadable",
+            message: e instanceof Error ? e.message : String(e),
+        };
+    }
+    try {
         const mod = (await jiti.import(path));
         const cfg = mod?.default ?? mod;
-        return cfg && typeof cfg === "object" ? cfg : null;
+        if (!cfg || typeof cfg !== "object") {
+            return {
+                ok: false,
+                reason: "invalid",
+                message: `${path} evaluated to ${cfg === undefined ? "undefined" : typeof cfg}. It must \`export default defineConfig({...})\`.`,
+            };
+        }
+        return { ok: true, config: cfg };
     }
-    catch {
-        return null; // jiti/@usenaive-sdk/iac not resolvable — fall back to regex extraction
+    catch (e) {
+        // The config itself threw. Almost always a NAMED define-time refusal, whose
+        // message is written to be read by the person who wrote the config — so it
+        // is surfaced verbatim rather than replaced with a guess.
+        return {
+            ok: false,
+            reason: isMissingModule(e) ? "unloadable" : "invalid",
+            message: e instanceof Error ? e.message : String(e),
+        };
     }
 }
 /** Extract top-level keys inside a named object block, e.g. agentProfiles: { a, b }. */
@@ -92,6 +130,183 @@ function extractKeys(source, section) {
 function findConfig() {
     return CONFIG_CANDIDATES.map((c) => join(process.cwd(), c)).find(existsSync) ?? null;
 }
+/**
+ * The brain half of the report, or undefined when the config declared none.
+ *
+ * Exported for the same reason it exists: `naive up` printed `applied: true` and
+ * said NOTHING about brains, so a config that declared two of them looked
+ * identical to a config that declared none. `--plan` showed them (it prints the
+ * whole plan); apply did not. A provisioned thing that is not reported is the
+ * same silence as an unprovisioned one, one level up.
+ *
+ * 🔴 AND `unpersisted` IS PART OF THE REPORT, NOT AN EXTRA. The apply path
+ * computed the accept-and-drop list and this projection threw it away, so
+ * `naive up --plan` told the user which declared brain keys have no column and
+ * plain `naive up` — the command people actually run — did not. That is the same
+ * defect one level down: `packages/api/src/services/deployment-brains.ts`'s own
+ * header calls accept-and-drop "the exact defect this file exists to remove", and
+ * a report only the dry run prints is a report most operators never see.
+ */
+export function brainReport(brains) {
+    if (!brains || !brains.declared_in)
+        return undefined;
+    const unpersisted = brains.unpersisted ?? {};
+    return {
+        declared_in: brains.declared_in,
+        created: (brains.created ?? []).map((b) => b.name),
+        converged: (brains.converged ?? []).map((b) => b.name),
+        default: brains.default?.name ?? null,
+        retained: brains.retained_undeclared ?? [],
+        ...(Object.keys(unpersisted).length > 0 ? { unpersisted } : {}),
+        ...(brains.notes?.length ? { notes: brains.notes } : {}),
+    };
+}
+/**
+ * The per-team accept-and-drop warning, one line per team that declared any.
+ *
+ * The data has been on the wire the whole time (`plan.teams[].unconsumed`,
+ * computed by `unconsumedTeamKeys` in packages/api) and `naive up` printed none
+ * of it — `team({ governance: {…} })` applied green and enforced nothing, with
+ * nothing anywhere for the author to notice. Printed on the PLAN and on the
+ * APPLY, because a report only the dry run shows is a report most operators
+ * never see.
+ */
+export function unconsumedWarnings(teams) {
+    return teams
+        .filter((t) => (t.unconsumed ?? []).length > 0)
+        .map((t) => `⚠ team "${t.name}" DECLARED AND UNREAD: ${t.unconsumed.join(", ")} — carried to the ` +
+        "control plane and consumed by NOTHING. Do not treat these as in force. " +
+        "`defineProject` refuses them at define time; remove them, or keep the config on " +
+        "`defineConfig` (lenient) until a consumer lands.");
+}
+/**
+ * ONE deprecation line when the config still uses the legacy ECS surface —
+ * `runtime.pool()` declarations, an agent-level `runtime: "<pool>"` string, or
+ * `systems:`. All three keep working indefinitely; the line names what was
+ * found and where new configs should author instead.
+ */
+export function legacyDeprecationNotice(config) {
+    const found = [];
+    const pools = Object.keys(config.runtime ?? {});
+    if (pools.length > 0)
+        found.push(`runtime.pool() declarations (${pools.join(", ")})`);
+    const pinned = Object.entries(config.agents ?? {})
+        .filter(([, a]) => typeof a?.runtime === "string")
+        .map(([name]) => name);
+    if (pinned.length > 0)
+        found.push(`agent-level runtime: "<pool>" strings (${pinned.join(", ")})`);
+    const systems = Object.keys(config.systems ?? {});
+    if (systems.length > 0)
+        found.push(`systems: (${systems.join(", ")})`);
+    if (found.length === 0)
+        return null;
+    return (`DEPRECATED surface in use — ${found.join("; ")}. These keep working indefinitely; new configs ` +
+        "author `defineProject` with `teams:` on `runtime.durable()` (or `runtime.hermes()` for the hosted lane).");
+}
+/**
+ * ONE rename line when the config declares `agents:`. Separate from the legacy
+ * line above on purpose: `runtime.pool()` / `systems:` are a deprecated
+ * SURFACE, while `agents:` is a deprecated SPELLING — the block compiles to
+ * byte-for-byte what `kits:` compiles to, so the honest notice is "rename",
+ * not "migrate". A notice, never a refusal, on both entrypoints.
+ */
+export function agentsRenameNotice(config) {
+    const names = Object.keys(config.agents ?? {});
+    if (names.length === 0)
+        return null;
+    return (`DEPRECATED spelling in use — \`agents:\` (${names.join(", ")}). It keeps working indefinitely ` +
+        "and compiles to exactly what `kits:` compiles to; rename the block to `kits:` (and `agent()` " +
+        "entries to `kit()`) — an account kit is instantiated per child project via " +
+        "`naive.forProject(p).forChild(id).provision(\"<kit>\")`.");
+}
+/**
+ * The operator credential the DURABLE RUNTIME issued, read from the ENVIRONMENT.
+ *
+ * Never from `naive.config.ts`, and that is the whole point rather than a style
+ * choice. The config is committed, so a credential in it is a credential in git —
+ * and, more importantly, the config is the one thing that must not by itself be
+ * able to change where a tenant runs. Pointing a tenant at the durable runtime
+ * overwrites its `sidecar_url` and `container_auth_token` and nulls its
+ * `instance_id`, none of which is stashed anywhere. Requiring a second, separate
+ * act means an edit alone can never do it.
+ *
+ * `NAIVE_DURABLE_CREDENTIAL_<TEAM>` names one team; `NAIVE_DURABLE_CREDENTIAL`
+ * covers them all. Neither is ever printed, and the API never echoes it back.
+ */
+export function durableCredentialEnvVar(team) {
+    return `NAIVE_DURABLE_CREDENTIAL_${team.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}`;
+}
+function readDurableCredentials(teams) {
+    const out = {};
+    const all = process.env.NAIVE_DURABLE_CREDENTIAL;
+    if (all)
+        out["*"] = all;
+    for (const team of teams) {
+        const secret = process.env[durableCredentialEnvVar(team)];
+        if (secret)
+            out[team] = secret;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+/**
+ * The recovery for ONE refused team — a command that EXISTS, or none.
+ *
+ * 🔴 `naive runtime migrate` IS NOT A COMMAND, AND THIS USED TO PRINT IT.
+ * Every refusal here used to emit
+ * `naive runtime migrate --tenant … --to durable --credential-from <file>`.
+ * Measured on the built CLI: `naive runtime migrate --tenant <id> --to hermes`
+ * answers
+ * `{"code":"cli_outdated","message":"Unknown command 'runtime'. Your naive CLI
+ * is v0.12.4; this command may exist in a newer version."}` — and it exists in
+ * NO version: `packages/cli/src/index.ts` registers no `runtime` group at all.
+ * So an operator whose apply was refused was handed a command that tells them to
+ * upgrade, forever. A next_step that cannot be run is worse than none, because it
+ * ends the search.
+ *
+ * The two cases are genuinely different and are answered differently:
+ *
+ *   · `runtime_credential_required` — there IS a procedure, it works today, and
+ *     it is the one this command already implements: put the operator credential
+ *     the durable runtime issued in the environment and re-run. Never in
+ *     `naive.config.ts`, which is committed.
+ *   · everything else (`runtime_migration_requires_explicit_opt_in`,
+ *     `runtime_claim_in_flight`, `runtime_placement_lost_race`,
+ *     `runtime_not_configured`, `runtime_state_unknown`) — there is NO self-serve
+ *     command on this build. Moving an existing tenant between runtimes
+ *     overwrites `sidecar_url` and `container_auth_token` and nulls `instance_id`
+ *     with nothing stashed, so the control plane refuses it and no client can do
+ *     it either. Say that, and print the server's own message, rather than
+ *     inventing a command to carry the blame.
+ *
+ * The API writes the same vapour into `details.migrate_command`
+ * (packages/api/src/services/placement.ts MIGRATE_COMMAND). That string is not
+ * this package's to change and is reported as a follow-up; this function is why
+ * `naive up` no longer repeats it.
+ */
+export function refusalNextStep(t) {
+    if (t.placement?.code === "runtime_credential_required") {
+        return {
+            command: `${durableCredentialEnvVar(t.name)}=<operator-credential> naive up`,
+            description: `team "${t.name}": the durable runtime issued an operator credential for this tenant and it is not in ` +
+                `the environment. Export it (or NAIVE_DURABLE_CREDENTIAL for every team) and re-run. Never put it in naive.config.ts.`,
+        };
+    }
+    return null;
+}
+/** Team names declared in the config, without evaluating anything the API will re-derive. */
+function declaredTeamNames(config) {
+    const teams = config.teams;
+    return teams && typeof teams === "object" ? Object.keys(teams) : [];
+}
+/**
+ * Wrap the config only when there is something to carry alongside it.
+ *
+ * `readConfig` on the API takes `body.config ?? body`, so both shapes work — but
+ * a caller that supplies no credential sends the exact bytes it always sent.
+ */
+function applyBody(config, credentials) {
+    return credentials ? { config, runtime_credentials: credentials } : config;
+}
 export const upCmd = new Command("up")
     .description("Plan + apply the infrastructure, runtime pools, agent profiles, and systems declared in naive.config.ts")
     .option("--plan", "Preview the plan (diff) without applying")
@@ -108,9 +323,41 @@ export const upCmd = new Command("up")
         });
         return;
     }
-    const config = opts.local ? null : await loadConfig(found);
-    // Fallback: config couldn't be evaluated — local validation only.
-    if (!config) {
+    const load = opts.local ? null : await loadConfig(found);
+    /* ── THE CONFIG REFUSED ITSELF. THAT IS NOT A TOOLCHAIN PROBLEM. ──────────
+     *
+     * 🔴 THIS BRANCH IS THE POINT OF THE `ConfigLoad` UNION ABOVE. Everything a
+     * define-time refusal is for arrives here: `brain_no_partitions`,
+     * `legacy_multi_team`, `brain_partition_unknown`, `residency_widens_company`,
+     * `company_brain_and_brains`, `program_undeclared`,
+     * `workspace_allowlist_empty`, `residency_unsupported_on_runtime`. Every one
+     * of those messages is written to be read by the person who wrote the config,
+     * and every one of them used to be swallowed by `catch { return null }`,
+     * relabelled "install @usenaive-sdk/iac + jiti", printed under
+     * `success: true`, and exited 0.
+     *
+     * So it is surfaced VERBATIM and exits non-zero. No regex fallback: the
+     * fallback's whole job is to say something useful when the config could not be
+     * READ, and this config was read perfectly — it said no.
+     */
+    if (load && !load.ok && load.reason === "invalid") {
+        agentError({
+            action: "up",
+            error: {
+                code: "invalid_config",
+                message: load.message,
+                hint: `${found} evaluated and refused itself. This is the config's own named refusal, not a missing ` +
+                    "dependency — @usenaive-sdk/iac and jiti both resolved. Fix the declaration it names and re-run.",
+            },
+            recovery_steps: [
+                { command: "naive up --plan", description: "Re-check the config without applying anything" },
+            ],
+        });
+        return;
+    }
+    // Fallback: the TOOLCHAIN is missing (or --local was asked for), so the config
+    // could not be evaluated at all — local, regex-only validation.
+    if (!load || !load.ok) {
         const source = readFileSync(found, "utf8");
         const projectMatch = /project\s*:\s*["'`]([^"'`]+)["'`]/.exec(source);
         const project = projectMatch?.[1] ?? "(unknown)";
@@ -134,34 +381,135 @@ export const upCmd = new Command("up")
                 opts.local
                     ? `Local validation only for "${project}".`
                     : `Validated ${found} locally, but could not evaluate it (install @usenaive-sdk/iac + jiti, or commit a naive.config.json).`,
+                // Only ever printed for a real resolution failure now — an invalid config
+                // took the branch above. Said out loud so the two are never conflated again.
+                ...(load ? [`Module resolution failed: ${load.message}`] : []),
             ],
         });
         return;
     }
+    const config = load.config;
     const project = typeof config.project === "string" ? config.project : undefined;
     if (!project) {
         agentError({ action: "up", error: { code: "invalid_input", message: "naive.config.ts must export a `project` name" }, recovery_steps: [] });
         return;
     }
+    const credentials = readDurableCredentials(declaredTeamNames(config));
+    // The organization's OTHER projects, if the config declares any. Each is a
+    // separate deployment under its own project key — the control plane keys
+    // deployments, pools and systems by `(company_id, project)`, so applying two
+    // projects is two applies of the same shape, not a new one. A config with no
+    // `projects:` block produces an empty list and everything below is untouched.
+    const extraProjects = Object.entries(config.projects ?? {})
+        .map(([key, p]) => p?.slug ?? key)
+        .filter((slug) => slug !== project);
     // 1. Plan (diff desired vs current).
-    const planResp = await apiRequest("PUT", `/v1/deployments/${encodeURIComponent(project)}`, config);
+    const planResp = await apiRequest("PUT", `/v1/deployments/${encodeURIComponent(project)}`, applyBody(config, credentials));
     handleApiError("up", planResp);
     const plan = planResp.data?.plan;
+    const teamPlan = plan?.teams?.plan ?? [];
     if (opts.plan) {
+        // A plan REFUSAL is not a warning to scroll past — it is the reason this
+        // apply will not do what the config asks. Print it, and exit non-zero so a
+        // CI step that gates on `naive up --plan` actually gates.
+        const wouldRefuse = teamPlan.filter((t) => t.placement?.status === "refused");
+        const extraPlans = [];
+        for (const extra of extraProjects) {
+            const resp = await apiRequest("PUT", `/v1/deployments/${encodeURIComponent(extra)}`, applyBody(config, credentials));
+            handleApiError("up", resp);
+            extraPlans.push({ project: extra, plan: resp.data?.plan });
+        }
         agentOutput({
             action: "up",
-            result: { config: found, project, plan, applied: false },
+            result: {
+                config: found,
+                project,
+                plan,
+                ...(extraPlans.length ? { projects: extraPlans } : {}),
+                applied: false,
+            },
             next_steps: [{ command: "naive up", description: "Apply the plan" }],
-            hints: ["Plan only — nothing was provisioned."],
+            hints: [
+                "Plan only — nothing was provisioned.",
+                ...unconsumedWarnings(teamPlan),
+                ...(legacyDeprecationNotice(config) ? [legacyDeprecationNotice(config)] : []),
+                ...(agentsRenameNotice(config) ? [agentsRenameNotice(config)] : []),
+                ...(extraPlans.length
+                    ? [`Planned ${extraPlans.length + 1} projects: ${[project, ...extraProjects].join(", ")}.`]
+                    : []),
+                ...wouldRefuse.map((t) => `team "${t.name}" WOULD BE REFUSED (${t.placement?.code}): ${t.placement?.message}`),
+            ],
         });
+        if (wouldRefuse.length > 0)
+            process.exitCode = 1;
         return;
     }
-    // 2. Apply (provision infra, register pools/systems/agent profiles).
-    const applyResp = await apiRequest("POST", `/v1/deployments/${encodeURIComponent(project)}/apply`, config);
+    // 2. Apply (provision infra, register pools/systems/roles, materialize and
+    //    place declared teams).
+    const applyResp = await apiRequest("POST", `/v1/deployments/${encodeURIComponent(project)}/apply`, applyBody(config, credentials));
     handleApiError("up", applyResp);
     const data = applyResp.data;
     const deployment = data.deployment;
     const needsAction = (deployment?.resources ?? []).filter((r) => r.status === "needs_action" || r.status === "failed");
+    // The other declared projects, applied the same way and reported by name.
+    // Sequential on purpose: two applies of one organization touch the same
+    // brains and the same business programs, which the control plane serializes
+    // per company anyway.
+    const extraResults = [];
+    for (const extra of extraProjects) {
+        const resp = await apiRequest("POST", `/v1/deployments/${encodeURIComponent(extra)}/apply`, applyBody(config, credentials));
+        handleApiError("up", resp);
+        const extraData = resp.data;
+        extraResults.push({
+            project: extra,
+            status: extraData.deployment?.status,
+            resources: extraData.deployment?.resources,
+        });
+    }
+    // ── WHAT WAS PROVISIONED, AND WHAT WAS REFUSED AND WHY ────────────────────
+    // A declared team that produced nothing used to be indistinguishable from one
+    // that worked: `naive up` printed `applied: true` and moved on. Every declared
+    // team now appears here with the agents it materialized, and a durable team
+    // additionally with its placement — placed, converged, or refused with the
+    // reason. A refusal exits NON-ZERO: the apply did real work (infra, pools,
+    // hermes teams) and reporting that honestly means not also claiming the part
+    // that was refused succeeded.
+    const durableByTeam = new Map((data.teams ?? []).map((t) => [t.team, t]));
+    const hermesByTeam = new Map((data.staffing ?? []).map((s) => [s.system, s]));
+    const teams = teamPlan.map((t) => {
+        const durable = durableByTeam.get(t.name);
+        const hermes = hermesByTeam.get(t.name);
+        // BOTH LANES, not the first one that answered. A MIXED team — a hermes lead
+        // with a member pinned to `runtime.durable` — is reported by BOTH
+        // materializers, and `durable ?? hermes` printed one half and silently
+        // dropped the other, so the agents an apply created did not add up to the
+        // agents it reported. Each role is tagged with the runtime it landed on when
+        // the team has two, so "which lane is this agent in" is answerable from the
+        // output rather than by reading the config back.
+        const lanes = t.role_runtimes;
+        const label = (role, status) => lanes?.[role] ? `${role} (${status}, ${lanes[role]})` : `${role} (${status})`;
+        const agents = [...(hermes?.agents ?? []), ...(durable?.agents ?? [])].map((a) => label(a.role, a.provision_status));
+        return {
+            name: t.name,
+            runtime: t.runtime,
+            lead: t.lead_role,
+            ...(lanes ? { role_runtimes: lanes } : {}),
+            ...(durable?.subject ? { subject: durable.subject } : {}),
+            agents,
+            archived: [...(hermes?.archived ?? []), ...(durable?.archived ?? [])],
+            ...(durable?.placement
+                ? {
+                    placement: {
+                        status: durable.placement.status,
+                        ...(durable.placement.code ? { code: durable.placement.code } : {}),
+                        ...(durable.placement.message ? { reason: durable.placement.message } : {}),
+                    },
+                }
+                : {}),
+        };
+    });
+    const refusedTeams = teams.filter((t) => t.placement?.status === "refused");
+    const brains = brainReport(data.brains);
     // Deploy cloud.web source to the provisioned web project(s) (Vercel builds + hosts).
     const webDeploys = {};
     if (opts.deploy !== false) {
@@ -199,20 +547,71 @@ export const upCmd = new Command("up")
             resources: deployment?.resources,
             runtime_pools: Object.keys(config.runtime ?? {}),
             systems: Object.keys(config.systems ?? {}),
+            ...(brains ? { brains } : {}),
             agents: Object.keys(config.agents ?? config.agentProfiles ?? config.templates ?? {}),
+            teams,
             outputs: deployment?.outputs ?? {},
             web_deployments: webDeploys,
+            ...(extraResults.length ? { projects: extraResults } : {}),
             applied: true,
         },
         next_steps: [
             ...needsAction.map((r) => ({ command: `naive status`, description: `${r.name}: ${r.requirement ?? r.status}` })),
+            ...refusedTeams.map(refusalNextStep).filter((s) => s !== null),
             { command: `naive agent-profiles provision <name> --user <tenant>`, description: "Provision an agent profile for a tenant" },
         ],
         hints: [
             `Deployment "${project}" is ${deployment?.status ?? "?"}.`,
+            ...unconsumedWarnings(teamPlan),
+            ...(legacyDeprecationNotice(config) ? [legacyDeprecationNotice(config)] : []),
+            ...(agentsRenameNotice(config) ? [agentsRenameNotice(config)] : []),
+            ...extraResults.map((r) => `Deployment "${r.project}" is ${r.status ?? "?"}.`),
             needsAction.length ? `${needsAction.length} resource(s) need action — see next_steps.` : "All declared infrastructure is ready.",
+            ...(brains
+                ? [
+                    `brains (${brains.declared_in}): ${brains.created.length} created` +
+                        `${brains.created.length ? ` (${brains.created.join(", ")})` : ""}, ` +
+                        `${brains.converged.length} already present` +
+                        `${brains.converged.length ? ` (${brains.converged.join(", ")})` : ""}` +
+                        `${brains.default ? `; default is "${brains.default}"` : ""}` +
+                        `${brains.retained.length ? `. RETAINED, not declared by this config: ${brains.retained.join(", ")} — remove one deliberately with \`naive brain rm\`.` : "."}`,
+                    // The accept-and-drop list, on the APPLY path and not only in --plan.
+                    ...(brains.unpersisted
+                        ? [
+                            "DECLARED BUT NOT STORED — " +
+                                Object.entries(brains.unpersisted)
+                                    .map(([name, keys]) => `${name}: ${keys.join(", ")}`)
+                                    .join("; ") +
+                                ". `brain_knowledge_bases` has no column for these, so they were accepted and dropped. " +
+                                "Nothing reads them; do not treat them as in force.",
+                        ]
+                        : []),
+                    ...(brains.notes ?? []),
+                ]
+                : []),
+            ...teams
+                .filter((t) => t.placement?.status === "placed" || t.placement?.status === "converged")
+                .map((t) => t.placement?.status === "placed"
+                ? `team "${t.name}" PLACED on the durable runtime (${t.agents.length} agent(s)). Its jurisdiction is fixed permanently by the first control request.`
+                : `team "${t.name}" was already on the durable runtime (${t.agents.length} agent(s)); nothing was rewritten.`),
+            ...refusedTeams.map((t) => `team "${t.name}" REFUSED (${t.placement?.code}): ${t.placement?.reason}`),
+            // Said once, not per team. `naive runtime migrate` does not exist in this
+            // CLI or any released one — see refusalNextStep — so a refusal with no
+            // next_step gets the reason it has none instead of a command that 404s.
+            ...(refusedTeams.some((t) => refusalNextStep(t) === null)
+                ? [
+                    "No `naive` command moves an existing tenant between runtimes, on this or any released version. " +
+                        "Placement rewrites sidecar_url and container_auth_token and nulls instance_id with nothing stashed, " +
+                        "so the control plane refuses a config edit that would do it. Read the refusal above and, if the move " +
+                        "is intended, take it to an operator with direct access — there is no self-serve path.",
+                ]
+                : []),
         ],
     });
+    // The apply did real work and said so; it must not ALSO report success for
+    // the teams it refused. Non-zero, so a CI pipeline stops here.
+    if (refusedTeams.length > 0)
+        process.exitCode = 1;
 });
 export const downCmd = new Command("down")
     .description("Tear down the infrastructure provisioned for this project (naive.config.ts)")
@@ -232,6 +631,7 @@ export const downCmd = new Command("down")
     // Without --yes: preview what would be destroyed (no side effects).
     if (!opts.yes) {
         const current = await apiRequest("GET", `/v1/deployments/${encodeURIComponent(project)}`);
+        handleApiError("down", current);
         const d = current.data ?? {};
         agentOutput({
             action: "down",