From 42ac955052d5d5353752e27ad6fceedf0935d746 Mon Sep 17 00:00:00 2001
From: "Leon.Schmidt" <leonmauricewill15@gmail.com>
Date: Tue, 11 Aug 2026 00:22:39 +0200
Subject: [PATCH 01/13] ADD - expand phone application platform

Add the Companies app, resilient call handling, custom app registry, vendor compatibility, storage policies, frontend bridge, tests, documentation, config, locale, and SQL migrations.
---
 README.md                                     |   10 +
 frontend/src/App.vue                          |  182 +-
 .../src/assets/img/app-icons/companies.svg    |   29 +
 frontend/src/assets/main.css                  |   10 +
 frontend/src/components/AppIcon.vue           |   33 +-
 frontend/src/components/CustomAppFrame.vue    |  421 +++
 .../components/NotificationPhonePreview.vue   |    2 +
 frontend/src/components/PayphoneOverlay.vue   |    2 +
 frontend/src/components/PhoneLockScreen.vue   |   22 +-
 frontend/src/components/PhoneMediaCapture.vue |    2 +
 .../src/components/PhoneNotifications.vue     |   13 +
 frontend/src/components/RadioHud.vue          |    2 +
 frontend/src/config/apps.test.ts              |    7 +
 frontend/src/config/apps.ts                   |   65 +-
 frontend/src/stores/app-catalog.test.ts       |  135 +
 frontend/src/stores/app-catalog.ts            |  314 ++
 frontend/src/stores/app-store.test.ts         |   78 +-
 frontend/src/stores/app-store.ts              |  185 +-
 frontend/src/stores/companies.test.ts         |  327 ++
 frontend/src/stores/companies.ts              |  539 +++
 frontend/src/stores/notifications.test.ts     |   15 +-
 frontend/src/stores/notifications.ts          |   51 +-
 frontend/src/stores/phone.ts                  |  329 +-
 frontend/src/types/apps.ts                    |  112 +-
 frontend/src/types/companies.ts               |  271 ++
 frontend/src/types/phone.ts                   |    7 +
 frontend/src/utils/customAppBridge.test.ts    |  268 ++
 frontend/src/utils/customAppBridge.ts         |  512 +++
 frontend/src/utils/customAppLifecycle.test.ts |  229 ++
 frontend/src/utils/customAppLifecycle.ts      |  183 +
 frontend/src/utils/homeLayout.test.ts         |   26 +-
 frontend/src/utils/homeLayout.ts              |   30 +-
 frontend/src/utils/nui.ts                     |    2 +-
 frontend/src/utils/preferences.test.ts        |   22 +
 frontend/src/utils/preferences.ts             |   50 +-
 frontend/src/utils/windowMessages.test.ts     |   19 +
 frontend/src/utils/windowMessages.ts          |    6 +
 frontend/src/views/PhoneAppWindow.vue         |   13 +-
 frontend/src/views/SpringboardView.vue        |   29 +-
 frontend/src/views/apps/AppStoreApp.vue       |   26 +-
 frontend/src/views/apps/BillingApp.vue        |    2 +
 frontend/src/views/apps/CameraApp.vue         |    2 +
 frontend/src/views/apps/CompaniesApp.vue      | 3331 +++++++++++++++++
 frontend/src/views/apps/CrewLinkApp.vue       |    2 +
 frontend/src/views/apps/GalleryApp.vue        |    2 +
 frontend/src/views/apps/GarageApp.vue         |    2 +
 frontend/src/views/apps/MailApp.vue           |    2 +
 frontend/src/views/apps/MessagesApp.vue       |   86 +-
 frontend/src/views/apps/PhoneApp.vue          |   36 +-
 frontend/src/views/apps/RadioApp.vue          |    2 +
 frontend/src/views/apps/SettingsApp.vue       |   18 +-
 frontend/src/views/apps/SkyRideApp.vue        |    2 +
 frontend/testserver/index.cjs                 |  960 ++++-
 sky_phone/config/companies.lua                |  248 ++
 sky_phone/config/config.lua                   |   17 +
 sky_phone/config/locales/en.lua               |  315 +-
 sky_phone/custom_apps/_sdk/default-icon.svg   |   13 +
 sky_phone/custom_apps/_sdk/sky-phone-app.d.ts |   74 +
 sky_phone/custom_apps/_sdk/sky-phone-app.js   |  211 ++
 sky_phone/fxmanifest.lua                      |   21 +
 sky_phone/source/client/custom_app_compat.lua |  581 +++
 sky_phone/source/client/custom_apps.lua       | 1396 +++++++
 sky_phone/source/client/main.lua              |   39 +
 sky_phone/source/server/calls.lua             |  720 +++-
 sky_phone/source/server/companies.lua         | 3028 +++++++++++++++
 sky_phone/source/server/custom_app_compat.lua |  138 +
 .../source/server/custom_app_storage.lua      |  271 ++
 sky_phone/source/server/custom_apps.lua       |  385 ++
 sky_phone/source/server/db_migrate.lua        |  286 ++
 sky_phone/source/server/phone.lua             |   25 +
 sky_phone/source/server/sim.lua               |   24 +
 sky_phone/source/shared/custom_app_compat.lua |  229 ++
 sky_phone/source/shared/custom_apps.lua       |  451 +++
 sky_phone/sql/install.sql                     |  178 +
 tests/custom_app_compat.lua                   |   80 +
 tests/custom_app_compat_client.lua            |  140 +
 tests/custom_app_compat_server.lua            |   68 +
 77 files changed, 17630 insertions(+), 333 deletions(-)
 create mode 100644 frontend/src/assets/img/app-icons/companies.svg
 create mode 100644 frontend/src/components/CustomAppFrame.vue
 create mode 100644 frontend/src/stores/app-catalog.test.ts
 create mode 100644 frontend/src/stores/app-catalog.ts
 create mode 100644 frontend/src/stores/companies.test.ts
 create mode 100644 frontend/src/stores/companies.ts
 create mode 100644 frontend/src/types/companies.ts
 create mode 100644 frontend/src/utils/customAppBridge.test.ts
 create mode 100644 frontend/src/utils/customAppBridge.ts
 create mode 100644 frontend/src/utils/customAppLifecycle.test.ts
 create mode 100644 frontend/src/utils/customAppLifecycle.ts
 create mode 100644 frontend/src/utils/windowMessages.test.ts
 create mode 100644 frontend/src/utils/windowMessages.ts
 create mode 100644 frontend/src/views/apps/CompaniesApp.vue
 create mode 100644 sky_phone/config/companies.lua
 create mode 100644 sky_phone/custom_apps/_sdk/default-icon.svg
 create mode 100644 sky_phone/custom_apps/_sdk/sky-phone-app.d.ts
 create mode 100644 sky_phone/custom_apps/_sdk/sky-phone-app.js
 create mode 100644 sky_phone/source/client/custom_app_compat.lua
 create mode 100644 sky_phone/source/client/custom_apps.lua
 create mode 100644 sky_phone/source/server/companies.lua
 create mode 100644 sky_phone/source/server/custom_app_compat.lua
 create mode 100644 sky_phone/source/server/custom_app_storage.lua
 create mode 100644 sky_phone/source/server/custom_apps.lua
 create mode 100644 sky_phone/source/shared/custom_app_compat.lua
 create mode 100644 sky_phone/source/shared/custom_apps.lua
 create mode 100644 tests/custom_app_compat.lua
 create mode 100644 tests/custom_app_compat_client.lua
 create mode 100644 tests/custom_app_compat_server.lua

diff --git a/README.md b/README.md
index 90802cd..9786b89 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,15 @@
 # sky_phone
 
+## Custom Apps
+
+`sky_phone` erkennt Registrierungen gestarteter Fremd-App-Ressourcen über integrierte
+Hersteller-Aliase und übernimmt unterstützte Apps automatisch in Springboard und App Store. In
+App-Ressourcen müssen dafür keine Sky-Vorlagen abgelegt werden. Unterstützt werden die
+dokumentierten Basisverträge von LB Phone, 17Movement, High Phone, Quasar Smartphone V3 und
+YSeries; die Aliase `lb-phone`, `17mov_Phone`, `high-phone`, `qs-smartphone` und `yseries` werden
+direkt von `sky_phone` bereitgestellt. Einrichtung und ehrliche Kompatibilitätsgrenzen stehen in der
+[deutschen Custom-App-Anleitung](docs/custom-apps.md).
+
 ## FlipTok verification
 
 FlipTok verification is server-authoritative and limited to the framework groups configured in
diff --git a/frontend/src/App.vue b/frontend/src/App.vue
index b7c966a..dee09c2 100644
--- a/frontend/src/App.vue
+++ b/frontend/src/App.vue
@@ -29,6 +29,7 @@ import { useGamesStore } from '@/features/games/store'
 import { useCallsStore } from '@/stores/calls'
 import { useBankingStore } from '@/stores/banking'
 import { useBillingStore } from '@/stores/billing'
+import { useCompaniesStore } from '@/stores/companies'
 import { useAccountStore } from '@/stores/account'
 import { useMailStore } from '@/stores/mail'
 import { useMessagesStore } from '@/stores/messages'
@@ -39,6 +40,7 @@ import { usePicstagramStore } from '@/stores/picstagram'
 import { useFeatherStore } from '@/stores/feather'
 import { useMediaStore } from '@/stores/media'
 import { useMarketplaceStore } from '@/stores/marketplace'
+import { useAppCatalogStore } from '@/stores/app-catalog'
 import { useAppStoreStore } from '@/stores/app-store'
 import { useWidgetsStore } from '@/stores/widgets'
 import { isPhoneAppId } from '@/config/apps'
@@ -46,16 +48,22 @@ import { useNotesStore } from '@/stores/notes'
 import { useWeatherStore } from '@/stores/weather'
 import {
   useNotificationsStore,
+  type PhoneNotification,
   type PhoneNotificationInput,
 } from '@/stores/notifications'
 import { usePhoneStore, type PhoneOpenPayload } from '@/stores/phone'
 import type { PhoneNotificationDevicePayload } from '@/types/device'
 import type { MailCounts } from '@/types/mail'
 import type { MarketplaceCounts } from '@/types/marketplace'
+import type {
+  CompanyChangedPayload,
+  CompanyUnreadCounts,
+} from '@/types/companies'
 import type { PhoneCall } from '@/types/phone'
 import { nuiCall } from '@/utils/nui'
 import { formatTimer } from '@/utils/clock'
 import { parsePhonePreferences } from '@/utils/preferences'
+import { isTrustedRootMessageSource } from '@/utils/windowMessages'
 import SpringboardView from '@/views/SpringboardView.vue'
 
 type AppMessage = {
@@ -64,6 +72,7 @@ type AppMessage = {
     | CalendarReminderData
     | MailEventData
     | MarketplaceEventData
+    | CompaniesEventData
     | MessagesEventData
     | DarkChatEventData
     | FlareEventData
@@ -76,6 +85,18 @@ type AppMessage = {
     | PhoneCall
     | PhoneNotificationInput
     | PhoneOpenPayload
+    | CustomAppCatalogEventData
+    | CustomAppEventData
+}
+
+type CustomAppCatalogEventData = {
+  apps?: unknown
+}
+
+type CustomAppEventData = {
+  appId?: unknown
+  data?: unknown
+  payload?: unknown
 }
 
 type SimPickerPayload = {
@@ -104,6 +125,18 @@ type MessagesEventData = {
   title?: string
 }
 
+type CompaniesEventData = {
+  area?: CompanyChangedPayload['area']
+  companyId?: string
+  counts?: CompanyUnreadCounts
+  device?: PhoneNotificationDevicePayload
+  kind?: 'assigned' | 'newMessage' | 'newRequest' | 'requestUpdated'
+  requestId?: string
+  subtitle?: string
+  text?: string
+  title?: string
+}
+
 type DarkChatEventData = {
   conversationId?: string
   device?: PhoneNotificationDevicePayload
@@ -209,6 +242,7 @@ const games = useGamesStore()
 const calls = useCallsStore()
 const banking = useBankingStore()
 const billing = useBillingStore()
+const companies = useCompaniesStore()
 const mail = useMailStore()
 const messages = useMessagesStore()
 const darkchat = useDarkChatStore()
@@ -218,6 +252,7 @@ const picstagram = usePicstagramStore()
 const feather = useFeatherStore()
 const media = useMediaStore()
 const marketplace = useMarketplaceStore()
+const appCatalog = useAppCatalogStore()
 const appStore = useAppStoreStore()
 const widgets = useWidgetsStore()
 const notes = useNotesStore()
@@ -267,6 +302,8 @@ const phoneFrameImage = computed(
   () => PHONE_FRAME_IMAGES[phone.preferences.settings.frame],
 )
 let clockTicker: ReturnType<typeof setInterval> | undefined
+let companiesChangeTimer: number | undefined
+let pendingCompaniesChange: CompanyChangedPayload | null = null
 let unlockTimer: number | undefined
 let passcodeLockTimer: number | undefined
 let unlockedServicesFrame: number | undefined
@@ -279,7 +316,16 @@ function getViewportScale(): number {
 }
 
 function hydratePhone(payload: PhoneOpenPayload): void {
+  if (payload.device?.imei) {
+    companies.bindDeviceScope(
+      payload.device.imei,
+      payload.device.sim?.id ?? null,
+    )
+  }
   phone.open(payload)
+  phone.ensureAppNotificationPreferences(
+    appCatalog.externalApps.map((app) => app.id),
+  )
   if (payload.device?.imei) {
     notifications.hydrate(
       payload.device.data.notifications?.payload,
@@ -296,6 +342,31 @@ function hydratePhone(payload: PhoneOpenPayload): void {
   widgets.hydrate(payload.device?.data.widgets?.payload)
 }
 
+function queueCompaniesChange(change: CompanyChangedPayload): void {
+  if (!pendingCompaniesChange) {
+    pendingCompaniesChange = { ...change }
+  } else {
+    pendingCompaniesChange = {
+      area: pendingCompaniesChange.area === change.area ? change.area : 'all',
+      companyId:
+        pendingCompaniesChange.companyId === change.companyId
+          ? change.companyId
+          : undefined,
+      requestId:
+        pendingCompaniesChange.requestId === change.requestId
+          ? change.requestId
+          : undefined,
+    }
+  }
+  if (companiesChangeTimer !== undefined) return
+  companiesChangeTimer = window.setTimeout(() => {
+    companiesChangeTimer = undefined
+    const queuedChange = pendingCompaniesChange
+    pendingCompaniesChange = null
+    if (queuedChange) void companies.applyChanged(queuedChange)
+  }, 2000)
+}
+
 function loadUnlockedPhoneData(): void {
   if (unlockedServicesLoaded.value) return
   unlockedServicesLoaded.value = true
@@ -315,6 +386,7 @@ function loadUnlockedPhoneData(): void {
     void calls.bootstrap()
     void messages.loadConversations()
     void billing.loadOverview()
+    void companies.refreshUnreadCounts()
     if (account.email) void darkchat.bootstrap()
   })
 }
@@ -345,7 +417,35 @@ async function hydrateDevelopmentPhone(): Promise<void> {
 }
 
 function onMessage(event: MessageEvent<AppMessage>): void {
-  if (event.data?.type === 'app:open') {
+  if (!isTrustedRootMessageSource(event.source, window)) return
+
+  if (event.data?.type === 'custom-apps:catalog') {
+    appCatalog.replaceCatalog(event.data.data)
+    const activeAppId = route.params.appId
+    if (typeof activeAppId === 'string' && !isPhoneAppId(activeAppId)) {
+      void router.push('/')
+    }
+  } else if (event.data?.type === 'custom-app:message') {
+    const data = event.data.data as CustomAppEventData | undefined
+    if (typeof data?.appId === 'string') {
+      appCatalog.queueHostMessage(data.appId, data.payload)
+    } else {
+      console.error('[Custom apps] Ignored a message without a valid app id.')
+    }
+  } else if (event.data?.type === 'custom-app:open') {
+    const data = event.data.data as CustomAppEventData | undefined
+    if (
+      typeof data?.appId === 'string' &&
+      appCatalog.requestOpen(data.appId, data.data)
+    ) {
+      void router.push(`/apps/${data.appId}`)
+    }
+  } else if (event.data?.type === 'custom-app:close') {
+    const data = event.data.data as CustomAppEventData | undefined
+    if (typeof data?.appId === 'string' && route.params.appId === data.appId) {
+      void router.push('/')
+    }
+  } else if (event.data?.type === 'app:open') {
     hydratePhone(event.data.data as PhoneOpenPayload)
     void nuiCall('ui:opened')
   } else if (event.data?.type === 'device:updated') {
@@ -361,10 +461,7 @@ function onMessage(event: MessageEvent<AppMessage>): void {
     const data = event.data.data as NotificationEventData
     const { device, ...input } = data
     const notification: PhoneNotificationInput = input
-    if (
-      device &&
-      (!phone.isOpen || device.imei !== phone.device?.imei)
-    ) {
+    if (device && (!phone.isOpen || device.imei !== phone.device?.imei)) {
       notification.device = {
         imei: device.imei,
         name: device.name,
@@ -406,6 +503,47 @@ function onMessage(event: MessageEvent<AppMessage>): void {
   } else if (event.data?.type === 'marketplace:changed' && event.data.data) {
     const data = event.data.data as MarketplaceEventData
     if (data.counts) marketplace.setCounts(data.counts)
+  } else if (event.data?.type === 'companies:changed') {
+    const data = event.data.data as CompaniesEventData | undefined
+    if (data?.counts) companies.applyUnreadCounts(data.counts)
+    if (data?.area) {
+      queueCompaniesChange({
+        area: data.area,
+        companyId: data.companyId,
+        requestId: data.requestId,
+      })
+    } else if (!data?.counts) queueCompaniesChange({ area: 'all' })
+  } else if (event.data?.type === 'companies:notification' && event.data.data) {
+    const data = event.data.data as CompaniesEventData
+    if (data.counts) companies.applyUnreadCounts(data.counts)
+
+    const notification: PhoneNotificationInput = {
+      appId: 'companies',
+      ...(data.requestId && data.area
+        ? {
+            route: `/apps/companies?requestId=${encodeURIComponent(data.requestId)}&area=${encodeURIComponent(data.area)}`,
+          }
+        : {}),
+      persistent: !phone.isOpen && Boolean(data.requestId && data.area),
+      subtitle: data.subtitle,
+      text:
+        data.text ??
+        phone.t(
+          `Apps.companies.notifications.${data.kind ?? 'requestUpdated'}`,
+        ),
+      title: data.title ?? phone.t('Apps.companies.name'),
+    }
+    if (
+      data.device &&
+      (!phone.isOpen || data.device.imei !== phone.device?.imei)
+    ) {
+      notification.device = {
+        imei: data.device.imei,
+        name: data.device.name,
+        preferences: parsePhonePreferences(data.device.settings ?? null),
+      }
+    }
+    notifications.show(notification)
   } else if (
     event.data?.type === 'fliptok:verification-changed' &&
     event.data.data
@@ -667,10 +805,7 @@ function onMessage(event: MessageEvent<AppMessage>): void {
       }
     }
     notifications.show(notification)
-  } else if (
-    event.data?.type === 'crewlink:notification' &&
-    event.data.data
-  ) {
+  } else if (event.data?.type === 'crewlink:notification' && event.data.data) {
     const data = event.data.data as CrewLinkNotificationData
     const notification: PhoneNotificationInput = {
       appId: 'crewlink',
@@ -756,6 +891,28 @@ function unlockPhone(): void {
   finishUnlock()
 }
 
+function openLockScreenNotification(notification: PhoneNotification): void {
+  if (!notification.route) return
+  pendingUnlockRoute.value = notification.route
+  notifications.dismissFromLockScreen(notification.id)
+  unlockPhone()
+}
+
+async function openNotificationPreview(
+  notification: PhoneNotification,
+): Promise<void> {
+  if (!notification.route) return
+  const imei = notification.device?.imei ?? phone.device?.imei
+  if (!imei) return
+  pendingUnlockRoute.value = notification.route
+  const response = await nuiCall('device:notification-open', { imei })
+  if (!response.success) {
+    pendingUnlockRoute.value = null
+    return
+  }
+  notifications.dismissFromLockScreen(notification.id, imei)
+}
+
 function cancelPasscode(): void {
   if (passcodeBusy.value) return
   passcodeVisible.value = false
@@ -907,6 +1064,7 @@ watch(
   (isOpen) => {
     if (unlockTimer !== undefined) window.clearTimeout(unlockTimer)
     if (!isOpen) {
+      appStore.cancelPendingInstalls()
       if (unlockedServicesFrame !== undefined) {
         window.cancelAnimationFrame(unlockedServicesFrame)
         unlockedServicesFrame = undefined
@@ -961,6 +1119,9 @@ onBeforeUnmount(() => {
   }
   weather.stop()
   if (clockTicker) clearInterval(clockTicker)
+  if (companiesChangeTimer !== undefined) {
+    window.clearTimeout(companiesChangeTimer)
+  }
   if (unlockTimer !== undefined) window.clearTimeout(unlockTimer)
   if (passcodeLockTimer !== undefined) window.clearInterval(passcodeLockTimer)
   window.removeEventListener('message', onMessage)
@@ -1007,6 +1168,7 @@ onBeforeUnmount(() => {
               100)
           "
           @close="notifications.dismiss(notification.id)"
+          @open="openNotificationPreview"
         />
         <div
           v-if="phone.isOpen || notifications.current"
@@ -1070,6 +1232,7 @@ onBeforeUnmount(() => {
                     @camera="unlockCamera"
                     @clear-notifications="notifications.clearLockScreen"
                     @dismiss-notification="notifications.dismissFromLockScreen"
+                    @open-notification="openLockScreenNotification"
                     @unlock="unlockPhone"
                   />
                 </Transition>
@@ -1096,6 +1259,7 @@ onBeforeUnmount(() => {
                 <PhoneNotifications
                   :notification="phone.isOpen ? null : notifications.current"
                   @close="notifications.dismissCurrent()"
+                  @open="openNotificationPreview"
                 />
                 <div class="phone-display-dimmer" aria-hidden="true"></div>
               </k-app>
diff --git a/frontend/src/assets/img/app-icons/companies.svg b/frontend/src/assets/img/app-icons/companies.svg
new file mode 100644
index 0000000..b52f7ce
--- /dev/null
+++ b/frontend/src/assets/img/app-icons/companies.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 120 120" role="img">
+  <defs>
+    <linearGradient id="companies-bg" x1="18" y1="12" x2="104" y2="110" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#38BDF8"/>
+      <stop offset="1" stop-color="#2563EB"/>
+    </linearGradient>
+    <linearGradient id="companies-glass" x1="42" y1="31" x2="86" y2="101" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#FFFFFF" stop-opacity=".96"/>
+      <stop offset="1" stop-color="#DBEAFE" stop-opacity=".82"/>
+    </linearGradient>
+  </defs>
+  <rect width="120" height="120" rx="27" fill="url(#companies-bg)"/>
+  <path d="M26 96V45c0-5 4-9 9-9h26c5 0 9 4 9 9v51H26Z" fill="url(#companies-glass)"/>
+  <path d="M60 96V28c0-5 4-9 9-9h18c5 0 9 4 9 9v68H60Z" fill="#EFF6FF" fill-opacity=".9"/>
+  <g fill="#3B82F6" fill-opacity=".82">
+    <rect x="36" y="48" width="9" height="9" rx="2"/>
+    <rect x="51" y="48" width="9" height="9" rx="2"/>
+    <rect x="36" y="64" width="9" height="9" rx="2"/>
+    <rect x="51" y="64" width="9" height="9" rx="2"/>
+    <rect x="70" y="33" width="8" height="8" rx="2"/>
+    <rect x="83" y="33" width="8" height="8" rx="2"/>
+    <rect x="70" y="48" width="8" height="8" rx="2"/>
+    <rect x="83" y="48" width="8" height="8" rx="2"/>
+    <rect x="70" y="63" width="8" height="8" rx="2"/>
+    <rect x="83" y="63" width="8" height="8" rx="2"/>
+  </g>
+  <path d="M18 96h84" stroke="#FFFFFF" stroke-width="6" stroke-linecap="round"/>
+  <circle cx="96" cy="25" r="10" fill="#22C55E" stroke="#FFFFFF" stroke-width="4"/>
+</svg>
diff --git a/frontend/src/assets/main.css b/frontend/src/assets/main.css
index 6006bb2..fb69afa 100644
--- a/frontend/src/assets/main.css
+++ b/frontend/src/assets/main.css
@@ -679,6 +679,16 @@ button {
   background-color: rgb(28 28 32 / 72%);
   text-shadow: 0 1px 3px #0009;
 }
+.phone-notification.is-actionable {
+  cursor: pointer;
+}
+.lock-screen__notification.is-actionable {
+  cursor: pointer;
+}
+.lock-screen__notification.is-actionable:focus-visible {
+  outline: 2px solid #fff;
+  outline-offset: 2px;
+}
 .lock-screen__notification-icon {
   width: 42px;
   height: 42px;
diff --git a/frontend/src/components/AppIcon.vue b/frontend/src/components/AppIcon.vue
index c56d222..17fb331 100644
--- a/frontend/src/components/AppIcon.vue
+++ b/frontend/src/components/AppIcon.vue
@@ -1,12 +1,13 @@
 <script setup lang="ts">
 import { kBadge } from 'konsta/vue'
 import { Minus } from 'lucide-vue-next'
-import { computed, onBeforeUnmount, onMounted, ref } from 'vue'
+import { computed, onBeforeUnmount, onMounted, ref, watch } from 'vue'
 import { useRouter } from 'vue-router'
 
-import { NON_REMOVABLE_PHONE_APP_IDS } from '@/config/apps'
+import { getPhoneAppLabel, isPhoneAppRemovable } from '@/config/apps'
 import { useMailStore } from '@/stores/mail'
 import { useBillingStore } from '@/stores/billing'
+import { useCompaniesStore } from '@/stores/companies'
 import { useMarketplaceStore } from '@/stores/marketplace'
 import { useDarkChatStore } from '@/stores/darkchat'
 import { usePhoneStore } from '@/stores/phone'
@@ -37,6 +38,7 @@ const emit = defineEmits<{
 const phone = usePhoneStore()
 const mail = useMailStore()
 const billing = useBillingStore()
+const companies = useCompaniesStore()
 const marketplace = useMarketplaceStore()
 const darkchat = useDarkChatStore()
 const router = useRouter()
@@ -54,15 +56,29 @@ const dragStyle = computed(() =>
       }
     : undefined,
 )
+const iconStyle = computed(() =>
+  props.app.kind === 'external' && props.app.iconBackground
+    ? { backgroundColor: props.app.iconBackground }
+    : undefined,
+)
 const suppressClick = ref(false)
 let holdTimer: number | undefined
 let calendarTimer: number | undefined
 let pointerStart = { x: 0, y: 0 }
+
+watch(
+  () => props.app.iconImage,
+  () => {
+    iconFailed.value = false
+  },
+)
+
 const unreadCount = computed(() => {
   if (props.app.id === 'mail') return mail.counts.unread
   if (props.app.id === 'citymarkt') return marketplace.counts.unread
   if (props.app.id === 'darkchat') return darkchat.unreadCount
   if (props.app.id === 'billing') return billing.overview?.unreadCount ?? 0
+  if (props.app.id === 'companies') return companies.unreadCount
   return 0
 })
 const notificationBadgeColors = {
@@ -216,7 +232,7 @@ onBeforeUnmount(() => {
       class="app-icon-button"
       :class="{ 'app-icon-button--compact': compact }"
       type="button"
-      :aria-label="phone.t(app.labelKey)"
+      :aria-label="getPhoneAppLabel(app, phone.t)"
       :aria-disabled="!app.route"
       @click="launch"
       @contextmenu.prevent
@@ -233,6 +249,7 @@ onBeforeUnmount(() => {
             app.iconClass,
             { 'app-icon--image': !iconFailed && app.id !== 'calendar' },
           ]"
+          :style="iconStyle"
         >
           <span v-if="app.id === 'calendar'" class="app-icon-calendar">
             <strong>{{ calendarWeekday }}</strong>
@@ -262,14 +279,18 @@ onBeforeUnmount(() => {
         </k-badge>
       </span>
       <span v-if="showLabel" class="app-icon-label">{{
-        phone.t(app.labelKey)
+        getPhoneAppLabel(app, phone.t)
       }}</span>
     </button>
     <button
-      v-if="editMode && !NON_REMOVABLE_PHONE_APP_IDS.has(app.id)"
+      v-if="editMode && isPhoneAppRemovable(app)"
       class="app-icon-remove"
       type="button"
-      :aria-label="phone.t('Home.removeApp', { app: phone.t(app.labelKey) })"
+      :aria-label="
+        phone.t('Home.removeApp', {
+          app: getPhoneAppLabel(app, phone.t),
+        })
+      "
       @click.stop="emit('remove')"
       @pointerdown.stop
     >
diff --git a/frontend/src/components/CustomAppFrame.vue b/frontend/src/components/CustomAppFrame.vue
new file mode 100644
index 0000000..1b11e4f
--- /dev/null
+++ b/frontend/src/components/CustomAppFrame.vue
@@ -0,0 +1,421 @@
+<script setup lang="ts">
+import { kBlock, kButton, kPage, kPreloader } from 'konsta/vue'
+import { computed, onBeforeMount, onBeforeUnmount, ref, watch } from 'vue'
+import { useRouter } from 'vue-router'
+
+import { getPhoneApp, isExternalPhoneApp } from '@/config/apps'
+import { useAppCatalogStore } from '@/stores/app-catalog'
+import { useNotificationsStore } from '@/stores/notifications'
+import { usePhoneStore } from '@/stores/phone'
+import type {
+  CustomAppOpenRequest,
+  ExternalPhoneAppDefinition,
+  LaunchablePhoneAppId,
+  SkyPhoneAppBridgeRequest,
+  SkyPhoneAppBridgeResponse,
+  SkyPhoneAppContextV1,
+} from '@/types/apps'
+import {
+  createCustomAppBridgeRequestHandler,
+  getSkyPhoneAppCapabilities,
+  shouldReportCustomAppReady,
+} from '@/utils/customAppBridge'
+import {
+  createCustomAppLifecycleReporter,
+  customAppOrientationCoordinator,
+  customAppLifecycleScheduler,
+  getCustomAppSafeArea,
+} from '@/utils/customAppLifecycle'
+import { nuiCall } from '@/utils/nui'
+
+const props = defineProps<{
+  app: ExternalPhoneAppDefinition
+}>()
+
+const PROTOCOL_VERSION = 1
+
+const catalog = useAppCatalogStore()
+const notifications = useNotificationsStore()
+const phone = usePhoneStore()
+const router = useRouter()
+const frame = ref<HTMLIFrameElement | null>(null)
+const frameLoaded = ref(false)
+const frameUnavailable = ref(false)
+const skyBridgeReady = ref(false)
+let loadTimeout: ReturnType<typeof setTimeout> | undefined
+const lifecycleAppId = props.app.id
+const initialOpenRequest: CustomAppOpenRequest | undefined =
+  catalog.openRequests[lifecycleAppId]
+const orientation = customAppOrientationCoordinator.createSession((landscape) =>
+  phone.setCameraLandscape(landscape),
+)
+
+const lifecycle = createCustomAppLifecycleReporter({
+  onFailure(event, error) {
+    console.error(
+      `[Custom apps] ${event} lifecycle failed for ${lifecycleAppId}: ${error}`,
+    )
+  },
+  scheduler: customAppLifecycleScheduler,
+  send: (event, data) =>
+    nuiCall('custom-app:lifecycle', {
+      appId: lifecycleAppId,
+      ...(data === undefined ? {} : { data }),
+      event,
+    }),
+})
+
+const bridgeRequests = createCustomAppBridgeRequestHandler({
+  createNotification(notification) {
+    return notifications.show({
+      ...notification,
+      appId: notification.appId as LaunchablePhoneAppId,
+    })
+  },
+  getSourceApp: () => props.app,
+  prepareExternalOpen: (appId, data) => catalog.requestOpen(appId, data),
+  resolveTarget(appId) {
+    const target = getPhoneApp(appId)
+    return target
+      ? {
+          external: isExternalPhoneApp(target),
+          id: target.id,
+          route: target.route,
+        }
+      : null
+  },
+  storageCall: (endpoint, payload) => nuiCall(endpoint, payload),
+})
+
+const frameUrl = computed(() => {
+  const url = new URL(props.app.ui)
+  url.searchParams.set('skyPhoneAppId', props.app.id)
+  return url.href
+})
+const frameOrigin = computed(() => new URL(frameUrl.value).origin)
+const postMessageOrigin = computed(() =>
+  props.app.bundled ? '*' : frameOrigin.value,
+)
+const sandbox = computed(() =>
+  props.app.bundled
+    ? 'allow-downloads allow-forms allow-modals allow-scripts'
+    : 'allow-downloads allow-forms allow-modals allow-same-origin allow-scripts',
+)
+const frameReady = computed(
+  () =>
+    frameLoaded.value &&
+    (props.app.bridgeMode === 'legacy' || skyBridgeReady.value),
+)
+const context = computed<SkyPhoneAppContextV1>(() => ({
+  appId: props.app.id,
+  capabilities: getSkyPhoneAppCapabilities(props.app.capabilities),
+  colorScheme: phone.isDarkMode ? 'dark' : 'light',
+  language: phone.lang,
+  locale: {
+    description: props.app.description,
+    name: props.app.name,
+  },
+  phoneScale: phone.preferences.settings.phoneScale / 100,
+  protocolVersion: PROTOCOL_VERSION,
+  safeArea: getCustomAppSafeArea(props.app.orientation),
+}))
+
+function postToFrame(payload: unknown): boolean {
+  const target = frame.value?.contentWindow
+  if (!target) return false
+
+  try {
+    target.postMessage(payload, postMessageOrigin.value)
+    return true
+  } catch (error) {
+    console.error(`[Custom apps] Could not message ${props.app.id}.`, error)
+    return false
+  }
+}
+
+function queueReadyLifecycle(): void {
+  void lifecycle.report('open', initialOpenRequest?.data)
+  void lifecycle.report('ready')
+}
+
+function sendContext(): void {
+  if (!skyBridgeReady.value) return
+  postToFrame({
+    appId: props.app.id,
+    context: context.value,
+    protocolVersion: PROTOCOL_VERSION,
+    type: 'sky-phone-app:context',
+  })
+}
+
+function flushOpenRequest(): void {
+  const request = catalog.openRequests[props.app.id]
+  if (!request || !frameLoaded.value) return
+  if (props.app.bridgeMode === 'sky' && !skyBridgeReady.value) return
+
+  if (
+    props.app.bridgeMode === 'legacy' ||
+    postToFrame({
+      appId: props.app.id,
+      data: request.data,
+      protocolVersion: PROTOCOL_VERSION,
+      type: 'sky-phone-app:open',
+    })
+  ) {
+    catalog.consumeOpenRequest(props.app.id, request.sequence)
+  }
+}
+
+function flushHostMessages(): void {
+  if (!frameLoaded.value) return
+  if (props.app.bridgeMode === 'sky' && !skyBridgeReady.value) return
+
+  let lastDeliveredSequence = 0
+  for (const message of catalog.hostMessages[props.app.id] ?? []) {
+    const delivered = postToFrame(
+      props.app.bridgeMode === 'sky'
+        ? {
+            appId: props.app.id,
+            payload: message.payload,
+            protocolVersion: PROTOCOL_VERSION,
+            type: 'sky-phone-app:message',
+          }
+        : message.payload,
+    )
+    if (!delivered) break
+    lastDeliveredSequence = message.sequence
+  }
+  if (lastDeliveredSequence) {
+    catalog.consumeHostMessages(props.app.id, lastDeliveredSequence)
+  }
+}
+
+function sendResponse(response: SkyPhoneAppBridgeResponse): void {
+  postToFrame({
+    appId: props.app.id,
+    ...response,
+    protocolVersion: PROTOCOL_VERSION,
+    type: 'sky-phone-app:response',
+  })
+}
+
+async function handleBridgeRequest(
+  request: SkyPhoneAppBridgeRequest,
+): Promise<void> {
+  const result = await bridgeRequests.handle(request)
+  if (!result) return
+
+  sendResponse(result.response)
+  if (result.effect?.type === 'close') {
+    void router.push('/')
+  } else if (result.effect?.type === 'open') {
+    void router.push(result.effect.route)
+  }
+}
+
+function isTrustedFrameMessage(event: MessageEvent): boolean {
+  if (event.source !== frame.value?.contentWindow) return false
+  if (props.app.bundled) {
+    return event.origin === 'null' || event.origin === frameOrigin.value
+  }
+  return event.origin === frameOrigin.value
+}
+
+function onFrameMessage(event: MessageEvent): void {
+  if (!isTrustedFrameMessage(event)) return
+  if (
+    !event.data ||
+    typeof event.data !== 'object' ||
+    Array.isArray(event.data)
+  ) {
+    return
+  }
+
+  const message = event.data as Record<string, unknown>
+  if (
+    message.appId !== props.app.id ||
+    message.protocolVersion !== PROTOCOL_VERSION
+  ) {
+    return
+  }
+
+  if (message.type === 'sky-phone-app:ready') {
+    if (!skyBridgeReady.value) {
+      if (loadTimeout !== undefined) clearTimeout(loadTimeout)
+      loadTimeout = undefined
+      skyBridgeReady.value = true
+      frameUnavailable.value = false
+      sendContext()
+      flushOpenRequest()
+      flushHostMessages()
+    }
+    if (shouldReportCustomAppReady(props.app.bridgeMode, 'bridge-ready')) {
+      queueReadyLifecycle()
+    }
+    return
+  }
+
+  if (message.type === 'sky-phone-app:request') {
+    void handleBridgeRequest(message as unknown as SkyPhoneAppBridgeRequest)
+  }
+}
+
+function onFrameLoad(): void {
+  if (props.app.bridgeMode === 'legacy') {
+    if (loadTimeout !== undefined) clearTimeout(loadTimeout)
+    loadTimeout = undefined
+  }
+  frameLoaded.value = true
+  if (props.app.bridgeMode === 'legacy' || skyBridgeReady.value) {
+    frameUnavailable.value = false
+  }
+  if (shouldReportCustomAppReady(props.app.bridgeMode, 'frame-load')) {
+    queueReadyLifecycle()
+  }
+  flushOpenRequest()
+  flushHostMessages()
+}
+
+function closeApp(): void {
+  void router.push('/')
+}
+
+onBeforeMount(() => {
+  window.addEventListener('message', onFrameMessage)
+  orientation.apply(props.app.orientation)
+  void lifecycle.report('open', initialOpenRequest?.data)
+  if (props.app.bridgeMode === 'legacy' && initialOpenRequest) {
+    catalog.consumeOpenRequest(props.app.id, initialOpenRequest.sequence)
+  }
+  loadTimeout = setTimeout(() => {
+    loadTimeout = undefined
+    frameUnavailable.value = true
+    console.error(
+      `[Custom apps] Frame readiness timed out for ${props.app.id}.`,
+    )
+  }, props.app.readyTimeoutMs)
+})
+
+onBeforeUnmount(() => {
+  if (loadTimeout !== undefined) clearTimeout(loadTimeout)
+  window.removeEventListener('message', onFrameMessage)
+  orientation.release()
+  void lifecycle.report('close')
+})
+
+watch(context, sendContext, { deep: true })
+watch(
+  () => props.app.orientation,
+  (nextOrientation) => orientation.apply(nextOrientation),
+)
+watch(() => catalog.hostMessages[props.app.id], flushHostMessages, {
+  deep: true,
+})
+watch(() => catalog.openRequests[props.app.id], flushOpenRequest, {
+  deep: true,
+})
+</script>
+
+<template>
+  <k-page
+    component="main"
+    class="custom-app-page"
+    :class="{
+      'custom-app-page--landscape': app.orientation === 'landscape',
+    }"
+  >
+    <iframe
+      ref="frame"
+      v-show="frameReady && !frameUnavailable"
+      class="custom-app-frame"
+      :class="{
+        'custom-app-frame--fix-blur': app.compatibility.fixBlur === true,
+      }"
+      :name="app.ownerResource"
+      :sandbox="sandbox"
+      :src="frameUrl"
+      :title="app.name"
+      referrerpolicy="no-referrer"
+      @load="onFrameLoad"
+    />
+
+    <div
+      v-if="!frameReady && !frameUnavailable"
+      class="custom-app-state"
+      role="status"
+    >
+      <k-preloader />
+      <k-block>{{ phone.t('Apps.customApps.loading') }}</k-block>
+    </div>
+
+    <div v-else-if="frameUnavailable" class="custom-app-state" role="alert">
+      <k-block>
+        <strong>{{ phone.t('Apps.customApps.unavailableTitle') }}</strong>
+        <p>{{ phone.t('Apps.customApps.unavailableBody') }}</p>
+      </k-block>
+      <k-button rounded @click="closeApp">
+        {{ phone.t('Apps.customApps.close') }}
+      </k-button>
+    </div>
+  </k-page>
+</template>
+
+<style scoped>
+.custom-app-page {
+  position: absolute;
+  inset: 0;
+  overflow: hidden;
+  background: var(--phone-app-background, #000);
+}
+
+.custom-app-page--landscape {
+  top: 50%;
+  right: auto;
+  bottom: auto;
+  left: 50%;
+  width: 100cqh;
+  height: 100cqw;
+  transform: translate(-50%, -50%) rotate(90deg);
+}
+
+.custom-app-frame {
+  position: absolute;
+  inset: 0;
+  width: 100%;
+  height: 100%;
+  border: 0;
+  background: transparent;
+}
+
+.custom-app-frame--fix-blur {
+  transform: translateZ(0);
+}
+
+.custom-app-state {
+  position: absolute;
+  inset: 44px 20px 25px;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 14px;
+  text-align: center;
+}
+
+.custom-app-state :deep(.k-block) {
+  margin: 0;
+}
+
+.custom-app-state strong {
+  display: block;
+  margin-bottom: 7px;
+  font-size: 17px;
+}
+
+.custom-app-state p {
+  margin: 0;
+  color: rgb(142 142 147);
+  font-size: 13px;
+  line-height: 1.35;
+}
+</style>
diff --git a/frontend/src/components/NotificationPhonePreview.vue b/frontend/src/components/NotificationPhonePreview.vue
index d5e8e1a..3d253fc 100644
--- a/frontend/src/components/NotificationPhonePreview.vue
+++ b/frontend/src/components/NotificationPhonePreview.vue
@@ -14,6 +14,7 @@ const props = defineProps<{
 }>()
 const emit = defineEmits<{
   close: []
+  open: [notification: PhoneNotification]
 }>()
 const phone = usePhoneStore()
 const device = computed(() => props.notification.device!)
@@ -69,6 +70,7 @@ const wrapperStyle = computed<CSSProperties>(() => ({ zoom: props.zoom }))
           <PhoneNotifications
             :notification="notification"
             @close="emit('close')"
+            @open="emit('open', $event)"
           />
         </k-app>
       </div>
diff --git a/frontend/src/components/PayphoneOverlay.vue b/frontend/src/components/PayphoneOverlay.vue
index 8dd459e..cf547c1 100644
--- a/frontend/src/components/PayphoneOverlay.vue
+++ b/frontend/src/components/PayphoneOverlay.vue
@@ -3,6 +3,7 @@ import { computed, nextTick, onBeforeUnmount, onMounted, ref } from 'vue'
 
 import payphoneFrame from '@/assets/img/payphone/american-payphone-frame.png'
 import { nuiCall } from '@/utils/nui'
+import { isTrustedRootMessageSource } from '@/utils/windowMessages'
 
 type PayphoneState =
   | 'idle'
@@ -214,6 +215,7 @@ async function close(): Promise<void> {
 }
 
 function onMessage(event: MessageEvent): void {
+  if (!isTrustedRootMessageSource(event.source, window)) return
   if (event.data?.type === 'payphone:open' && event.data.data) {
     const payload = event.data.data as PayphoneOpenPayload
     currency.value = payload.currency
diff --git a/frontend/src/components/PhoneLockScreen.vue b/frontend/src/components/PhoneLockScreen.vue
index fe3b714..f7e7a78 100644
--- a/frontend/src/components/PhoneLockScreen.vue
+++ b/frontend/src/components/PhoneLockScreen.vue
@@ -19,6 +19,7 @@ const emit = defineEmits<{
   camera: []
   clearNotifications: []
   dismissNotification: [id: string]
+  openNotification: [notification: PhoneNotification]
   unlock: []
 }>()
 
@@ -72,9 +73,7 @@ const flashlightShortcutColors = computed(() =>
 function onPointerDown(event: PointerEvent): void {
   if (props.preview) return
   if (
-    (event.target as HTMLElement).closest(
-      'button, .lock-screen__notifications',
-    )
+    (event.target as HTMLElement).closest('button, .lock-screen__notifications')
   )
     return
   pointerStart = event.clientY
@@ -83,6 +82,10 @@ function onPointerDown(event: PointerEvent): void {
   ;(event.currentTarget as HTMLElement).setPointerCapture(event.pointerId)
 }
 
+function openNotification(notification: PhoneNotification): void {
+  if (notification.route) emit('openNotification', notification)
+}
+
 function onPointerMove(event: PointerEvent): void {
   if (!dragging.value) return
   dragOffset.value = Math.min(0, event.clientY - pointerStart)
@@ -194,7 +197,16 @@ onBeforeUnmount(() => {
         v-for="notification in props.notifications"
         :key="notification.id"
         class="lock-screen__notification"
+        :class="{ 'is-actionable': !!notification.route }"
         :highlight="false"
+        :role="notification.route ? 'button' : undefined"
+        :tabindex="notification.route ? 0 : undefined"
+        :aria-label="
+          notification.route ? phone.t('Notifications.open') : undefined
+        "
+        @click="openNotification(notification)"
+        @keydown.enter.prevent="openNotification(notification)"
+        @keydown.space.prevent="openNotification(notification)"
       >
         <img
           v-if="getPhoneApp(notification.appId)?.iconImage"
@@ -207,7 +219,9 @@ onBeforeUnmount(() => {
             <strong>{{ notification.title }}</strong>
             <span>{{ phone.t('Notifications.now') }}</span>
           </div>
-          <small v-if="notification.subtitle">{{ notification.subtitle }}</small>
+          <small v-if="notification.subtitle">{{
+            notification.subtitle
+          }}</small>
           <p>{{ notification.text }}</p>
         </div>
         <button
diff --git a/frontend/src/components/PhoneMediaCapture.vue b/frontend/src/components/PhoneMediaCapture.vue
index cf6f48d..eeb4c80 100644
--- a/frontend/src/components/PhoneMediaCapture.vue
+++ b/frontend/src/components/PhoneMediaCapture.vue
@@ -5,6 +5,7 @@ import { onBeforeUnmount, onMounted, ref } from 'vue'
 import type { UploadReady } from '@/types/media'
 import { createGameView, type GameView } from '@/utils/gameView'
 import { nuiCall } from '@/utils/nui'
+import { isTrustedRootMessageSource } from '@/utils/windowMessages'
 
 type RecordingChunk = { blob: Blob; durationMs: number }
 type PendingVideo = { blob: Blob; fileName: string }
@@ -341,6 +342,7 @@ async function uploadReady(ready: UploadReady): Promise<void> {
 }
 
 function onMessage(event: MessageEvent): void {
+  if (!isTrustedRootMessageSource(event.source, window)) return
   const message = event.data as {
     data?: Record<string, unknown>
     type?: string
diff --git a/frontend/src/components/PhoneNotifications.vue b/frontend/src/components/PhoneNotifications.vue
index 4aac0d7..03298ba 100644
--- a/frontend/src/components/PhoneNotifications.vue
+++ b/frontend/src/components/PhoneNotifications.vue
@@ -11,6 +11,7 @@ const props = defineProps<{
 }>()
 const emit = defineEmits<{
   close: []
+  open: [notification: PhoneNotification]
 }>()
 const phone = usePhoneStore()
 const icon = computed(() =>
@@ -18,6 +19,16 @@ const icon = computed(() =>
     ? getPhoneApp(props.notification.appId)?.iconImage
     : undefined,
 )
+
+function openNotification(event: MouseEvent): void {
+  if (
+    !props.notification?.route ||
+    (event.target as HTMLElement).closest('button')
+  ) {
+    return
+  }
+  emit('open', props.notification)
+}
 </script>
 
 <template>
@@ -29,7 +40,9 @@ const icon = computed(() =>
     :title-right-text="phone.t('Notifications.now')"
     button="close"
     class="phone-notification"
+    :class="{ 'is-actionable': !!notification?.route }"
     @close="emit('close')"
+    @click="openNotification"
   >
     <template v-if="icon" #icon>
       <img :src="icon" alt="" class="phone-notification__icon" />
diff --git a/frontend/src/components/RadioHud.vue b/frontend/src/components/RadioHud.vue
index b46a754..e219864 100644
--- a/frontend/src/components/RadioHud.vue
+++ b/frontend/src/components/RadioHud.vue
@@ -3,6 +3,7 @@ import { Headphones } from 'lucide-vue-next'
 import { computed, onBeforeUnmount, onMounted, reactive, ref } from 'vue'
 
 import type { RadioHudConfig, RadioHudMember } from '@/types/radio'
+import { isTrustedRootMessageSource } from '@/utils/windowMessages'
 
 type RadioHudEntry = RadioHudMember & {
   state: 'recent' | 'talking'
@@ -122,6 +123,7 @@ function updateConfig(value: Partial<RadioHudConfig>): void {
 }
 
 function onMessage(event: MessageEvent<RadioHudMessage>): void {
+  if (!isTrustedRootMessageSource(event.source, window)) return
   if (event.data?.type === 'radio:hud-config' && event.data.data) {
     updateConfig(event.data.data as Partial<RadioHudConfig>)
   } else if (event.data?.type === 'radio:hud-update' && event.data.data) {
diff --git a/frontend/src/config/apps.test.ts b/frontend/src/config/apps.test.ts
index f69db3a..4a76207 100644
--- a/frontend/src/config/apps.test.ts
+++ b/frontend/src/config/apps.test.ts
@@ -52,6 +52,12 @@ describe('app registry', () => {
       labelKey: 'Apps.house.name',
       route: '/apps/house',
     })
+    expect(PHONE_APPS.find((app) => app.id === 'companies')).toMatchObject({
+      category: 'utilities',
+      gridOrder: 28,
+      labelKey: 'Apps.companies.name',
+      route: '/apps/companies',
+    })
     expect(PHONE_APPS.find((app) => app.id === 'music')).toMatchObject({
       category: 'utilities',
       gridOrder: 26,
@@ -128,6 +134,7 @@ describe('app registry', () => {
     expect(isPhoneAppId('clock')).toBe(true)
     expect(isPhoneAppId('skyride')).toBe(true)
     expect(isPhoneAppId('music')).toBe(true)
+    expect(isPhoneAppId('companies')).toBe(true)
     expect(
       PHONE_APPS.filter((app) => app.category === 'games').map((app) => app.id),
     ).toEqual([
diff --git a/frontend/src/config/apps.ts b/frontend/src/config/apps.ts
index efcac80..4f49726 100644
--- a/frontend/src/config/apps.ts
+++ b/frontend/src/config/apps.ts
@@ -32,8 +32,9 @@ import {
   Feather,
   ReceiptText,
   UsersRound,
+  Building2,
 } from 'lucide-vue-next'
-import { defineAsyncComponent, markRaw } from 'vue'
+import { defineAsyncComponent, markRaw, shallowReactive } from 'vue'
 
 import appStoreIcon from '@/assets/img/app-icons/apps.webp'
 import calculatorIcon from '@/assets/img/app-icons/calculator.webp'
@@ -70,13 +71,32 @@ import skyRideIcon from '@/assets/img/app-icons/skyride.svg'
 import musicIcon from '@/assets/img/app-icons/music.svg'
 import featherIcon from '@/assets/img/app-icons/feather.svg'
 import crewLinkIcon from '@/assets/img/app-icons/crewlink.svg'
+import companiesIcon from '@/assets/img/app-icons/companies.svg'
 import type {
+  BuiltinPhoneAppDefinition,
+  BuiltinPhoneAppId,
+  ExternalPhoneAppDefinition,
+  ExternalPhoneAppId,
   LaunchablePhoneAppDefinition,
   LaunchablePhoneAppId,
   PhoneAppDefinition,
 } from '@/types/apps'
 
-export const PHONE_APPS: PhoneAppDefinition[] = [
+export const PHONE_APPS = shallowReactive<PhoneAppDefinition[]>([
+  {
+    category: 'utilities',
+    component: markRaw(
+      defineAsyncComponent(() => import('@/views/apps/CompaniesApp.vue')),
+    ),
+    dockOrder: null,
+    gridOrder: 28,
+    icon: markRaw(Building2),
+    iconClass: 'app-icon--companies',
+    iconImage: companiesIcon,
+    id: 'companies',
+    labelKey: 'Apps.companies.name',
+    route: '/apps/companies',
+  },
   {
     category: 'utilities',
     component: markRaw(
@@ -567,7 +587,13 @@ export const PHONE_APPS: PhoneAppDefinition[] = [
     labelKey: 'Apps.neonDrop.name',
     route: '/apps/neon-drop',
   },
-]
+])
+
+const BUILTIN_PHONE_APPS = [...PHONE_APPS] as BuiltinPhoneAppDefinition[]
+
+export const BUILTIN_PHONE_APP_IDS: ReadonlySet<BuiltinPhoneAppId> = new Set(
+  BUILTIN_PHONE_APPS.map((app) => app.id),
+)
 
 export const NON_REMOVABLE_PHONE_APP_IDS: ReadonlySet<LaunchablePhoneAppId> =
   new Set([
@@ -582,6 +608,12 @@ export const NON_REMOVABLE_PHONE_APP_IDS: ReadonlySet<LaunchablePhoneAppId> =
 
 export const PHONE_APP_IDS = PHONE_APPS.map((app) => app.id)
 
+export function replaceExternalPhoneApps(
+  apps: ExternalPhoneAppDefinition[],
+): void {
+  PHONE_APPS.splice(0, PHONE_APPS.length, ...BUILTIN_PHONE_APPS, ...apps)
+}
+
 export function getPhoneApp(
   id: string | string[] | undefined,
 ): PhoneAppDefinition | undefined {
@@ -594,8 +626,33 @@ export function isPhoneAppId(value: string): value is LaunchablePhoneAppId {
   return !!app && isLaunchablePhoneApp(app)
 }
 
+export function isExternalPhoneApp(
+  app: PhoneAppDefinition | undefined,
+): app is ExternalPhoneAppDefinition {
+  return app?.kind === 'external'
+}
+
+export function isValidExternalPhoneAppId(
+  value: string,
+): value is ExternalPhoneAppId {
+  return /^[a-z0-9][a-z0-9._-]{1,63}$/.test(value)
+}
+
+export function getPhoneAppLabel(
+  app: PhoneAppDefinition,
+  translate: (key: string) => string,
+): string {
+  return app.kind === 'external' ? app.name : translate(app.labelKey)
+}
+
+export function isPhoneAppRemovable(app: PhoneAppDefinition): boolean {
+  return app.kind === 'external'
+    ? app.removable
+    : !NON_REMOVABLE_PHONE_APP_IDS.has(app.id)
+}
+
 export function isLaunchablePhoneApp(
   app: PhoneAppDefinition,
 ): app is LaunchablePhoneAppDefinition {
-  return app.component !== null && app.route !== null
+  return app.kind === 'external' || app.component !== null
 }
diff --git a/frontend/src/stores/app-catalog.test.ts b/frontend/src/stores/app-catalog.test.ts
new file mode 100644
index 0000000..ada00e3
--- /dev/null
+++ b/frontend/src/stores/app-catalog.test.ts
@@ -0,0 +1,135 @@
+import { createPinia, setActivePinia } from 'pinia'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import {
+  getPhoneApp,
+  isExternalPhoneApp,
+  replaceExternalPhoneApps,
+} from '@/config/apps'
+import {
+  normalizeExternalPhoneApp,
+  useAppCatalogStore,
+} from '@/stores/app-catalog'
+
+const mocks = vi.hoisted(() => ({
+  ensureAppNotificationPreferences: vi.fn(),
+  reconcileCatalog: vi.fn(),
+}))
+
+vi.mock('@/stores/app-store', () => ({
+  useAppStoreStore: () => ({ reconcileCatalog: mocks.reconcileCatalog }),
+}))
+vi.mock('@/stores/phone', () => ({
+  usePhoneStore: () => ({
+    ensureAppNotificationPreferences: mocks.ensureAppNotificationPreferences,
+  }),
+}))
+
+function validApp(overrides: Record<string, unknown> = {}) {
+  return {
+    bundled: false,
+    category: 'utilities',
+    icon: 'https://cfx-nui-example/web/icon.webp',
+    id: 'example-app',
+    name: 'Example App',
+    ownerResource: 'example_resource',
+    ui: 'https://cfx-nui-example/web/index.html',
+    ...overrides,
+  }
+}
+
+describe('custom app catalog', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia())
+    replaceExternalPhoneApps([])
+    mocks.ensureAppNotificationPreferences.mockReset()
+    mocks.reconcileCatalog.mockReset()
+  })
+
+  afterEach(() => {
+    replaceExternalPhoneApps([])
+    vi.restoreAllMocks()
+  })
+
+  it('normalizes a validated external iframe app', () => {
+    const app = normalizeExternalPhoneApp(
+      validApp({
+        compatibility: { fixBlur: true, unsafe: () => undefined },
+        defaultInstalled: true,
+        iconBackground: '#1d4ed8',
+        permissions: ['app.close', 'app.close', 'device.storage'],
+      }),
+    )
+
+    expect(app).toMatchObject({
+      bridgeMode: 'legacy',
+      capabilities: ['app.close', 'device.storage'],
+      compatibility: { fixBlur: true },
+      defaultInstalled: true,
+      id: 'example-app',
+      iconBackground: '#1d4ed8',
+      kind: 'external',
+      readyTimeoutMs: 8000,
+      removable: true,
+      route: '/apps/example-app',
+    })
+  })
+
+  it('accepts only color-shaped icon backgrounds', () => {
+    expect(
+      normalizeExternalPhoneApp(
+        validApp({ iconBackground: 'hsl(221 83% 53%)' }),
+      ),
+    ).toMatchObject({ iconBackground: 'hsl(221 83% 53%)' })
+    expect(
+      normalizeExternalPhoneApp(
+        validApp({
+          iconBackground: 'url(https://attacker.test/tracker.png)',
+        }),
+      ),
+    ).not.toHaveProperty('iconBackground')
+  })
+
+  it('rejects unsafe URLs and built-in id collisions', () => {
+    expect(
+      normalizeExternalPhoneApp(validApp({ ui: 'javascript:alert(1)' })),
+    ).toBeNull()
+    expect(normalizeExternalPhoneApp(validApp({ id: 'phone' }))).toBeNull()
+    expect(
+      normalizeExternalPhoneApp(validApp({ readyTimeoutMs: 31_000 })),
+    ).toMatchObject({ readyTimeoutMs: 8000 })
+  })
+
+  it('replaces the runtime entries and reconciles dependent stores', () => {
+    const catalog = useAppCatalogStore()
+
+    catalog.replaceCatalog({
+      apps: [
+        validApp(),
+        validApp(),
+        validApp({ id: 'invalid', ui: 'http://example.test' }),
+      ],
+    })
+
+    const app = getPhoneApp('example-app')
+    expect(isExternalPhoneApp(app)).toBe(true)
+    expect(catalog.externalApps).toHaveLength(1)
+    expect(mocks.ensureAppNotificationPreferences).toHaveBeenCalledWith([
+      'example-app',
+    ])
+    expect(mocks.reconcileCatalog).toHaveBeenCalledOnce()
+  })
+
+  it('queues messages only for registered external apps', () => {
+    const catalog = useAppCatalogStore()
+    catalog.replaceCatalog({ apps: [validApp()] })
+
+    expect(catalog.queueHostMessage('example-app', { hello: 'world' })).toBe(
+      true,
+    )
+    expect(catalog.queueHostMessage('phone', {})).toBe(false)
+    expect(catalog.hostMessages['example-app']).toMatchObject([
+      { payload: { hello: 'world' }, sequence: 1 },
+    ])
+  })
+})
diff --git a/frontend/src/stores/app-catalog.ts b/frontend/src/stores/app-catalog.ts
new file mode 100644
index 0000000..3c0be3d
--- /dev/null
+++ b/frontend/src/stores/app-catalog.ts
@@ -0,0 +1,314 @@
+import { Grid2X2 } from 'lucide-vue-next'
+import { defineStore } from 'pinia'
+import { markRaw } from 'vue'
+
+import {
+  BUILTIN_PHONE_APP_IDS,
+  getPhoneApp,
+  isExternalPhoneApp,
+  isValidExternalPhoneAppId,
+  PHONE_APPS,
+  replaceExternalPhoneApps,
+} from '@/config/apps'
+import { useAppStoreStore } from '@/stores/app-store'
+import { usePhoneStore } from '@/stores/phone'
+import type {
+  CustomAppHostMessage,
+  CustomAppOpenRequest,
+  BuiltinPhoneAppId,
+  ExternalPhoneAppDefinition,
+  PhoneAppCategory,
+} from '@/types/apps'
+
+const APP_CATEGORIES: ReadonlySet<PhoneAppCategory> = new Set([
+  'games',
+  'productivity',
+  'shopping',
+  'social',
+  'utilities',
+])
+const MAX_PENDING_MESSAGES = 50
+const ICON_BACKGROUND_HEX_PATTERN =
+  /^#(?:[\da-f]{3}|[\da-f]{4}|[\da-f]{6}|[\da-f]{8})$/i
+const ICON_BACKGROUND_NAMED_PATTERN = /^[a-z]{3,32}$/i
+const ICON_BACKGROUND_FUNCTION_PATTERN =
+  /^(?:rgb|rgba|hsl|hsla)\([\d\s.,%+\-/degraturn]+\)$/i
+
+function readRecord(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null
+}
+
+function readRequiredString(
+  source: Record<string, unknown>,
+  key: string,
+  maximumLength: number,
+): string | null {
+  const value = source[key]
+  if (typeof value !== 'string') return null
+  const normalized = value.trim()
+  return normalized && normalized.length <= maximumLength ? normalized : null
+}
+
+function readOptionalString(
+  source: Record<string, unknown>,
+  key: string,
+  maximumLength: number,
+): string {
+  const value = source[key]
+  if (typeof value !== 'string') return ''
+  return value.trim().slice(0, maximumLength)
+}
+
+function readIconBackground(value: unknown): string {
+  if (typeof value !== 'string') return ''
+  const normalized = value.trim()
+  if (!normalized || normalized.length > 64) return ''
+
+  return ICON_BACKGROUND_HEX_PATTERN.test(normalized) ||
+    ICON_BACKGROUND_NAMED_PATTERN.test(normalized) ||
+    ICON_BACKGROUND_FUNCTION_PATTERN.test(normalized)
+    ? normalized
+    : ''
+}
+
+function readHttpsUrl(value: unknown): string | null {
+  if (typeof value !== 'string' || value.length > 2048) return null
+
+  try {
+    const parsed = new URL(value)
+    if (parsed.protocol !== 'https:' || parsed.username || parsed.password) {
+      return null
+    }
+    return parsed.href
+  } catch {
+    return null
+  }
+}
+
+function readCapabilities(value: unknown): string[] {
+  if (!Array.isArray(value)) return []
+
+  const capabilities: string[] = []
+  for (const capability of value) {
+    if (
+      typeof capability === 'string' &&
+      /^[a-z][a-z0-9._-]{1,63}$/.test(capability) &&
+      !capabilities.includes(capability)
+    ) {
+      capabilities.push(capability)
+    }
+  }
+  return capabilities
+}
+
+function readCompatibilityValue(value: unknown, depth = 0): unknown {
+  if (
+    value === null ||
+    typeof value === 'boolean' ||
+    (typeof value === 'number' && Number.isFinite(value))
+  ) {
+    return value
+  }
+  if (typeof value === 'string') return value.slice(0, 256)
+  if (depth >= 2) return undefined
+  if (Array.isArray(value)) {
+    return value
+      .slice(0, 32)
+      .map((item) => readCompatibilityValue(item, depth + 1))
+      .filter((item) => item !== undefined)
+  }
+
+  const source = readRecord(value)
+  if (!source) return undefined
+  const result: Record<string, unknown> = {}
+  for (const [key, item] of Object.entries(source).slice(0, 32)) {
+    if (!/^[A-Za-z0-9_.-]{1,64}$/.test(key)) continue
+    const normalized = readCompatibilityValue(item, depth + 1)
+    if (normalized !== undefined) result[key] = normalized
+  }
+  return result
+}
+
+function readCompatibility(value: unknown): Record<string, unknown> {
+  const source = readRecord(value)
+  if (!source) return {}
+  return (readCompatibilityValue(source) as Record<string, unknown>) ?? {}
+}
+
+export function normalizeExternalPhoneApp(
+  value: unknown,
+  fallbackOrder = 0,
+): ExternalPhoneAppDefinition | null {
+  const source = readRecord(value)
+  if (!source) return null
+
+  const id = readRequiredString(source, 'id', 64)
+  const name = readRequiredString(source, 'name', 64)
+  const ownerResource = readRequiredString(source, 'ownerResource', 128)
+  const ui = readHttpsUrl(source.ui)
+  const icon = readHttpsUrl(source.icon)
+  if (
+    !id ||
+    !isValidExternalPhoneAppId(id) ||
+    BUILTIN_PHONE_APP_IDS.has(id as BuiltinPhoneAppId) ||
+    !name ||
+    !ownerResource ||
+    !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(ownerResource) ||
+    !ui ||
+    !icon
+  ) {
+    return null
+  }
+
+  const category = APP_CATEGORIES.has(source.category as PhoneAppCategory)
+    ? (source.category as PhoneAppCategory)
+    : 'utilities'
+  const bundled = source.bundled === true
+  const gridOrder =
+    typeof source.gridOrder === 'number' &&
+    Number.isFinite(source.gridOrder) &&
+    source.gridOrder >= 0
+      ? Math.floor(source.gridOrder)
+      : 1000 + fallbackOrder
+  const iconBackground = readIconBackground(source.iconBackground)
+
+  return {
+    bridgeMode:
+      source.bridgeMode === 'sky' || source.bridgeMode === 'legacy'
+        ? source.bridgeMode
+        : bundled
+          ? 'sky'
+          : 'legacy',
+    bundled,
+    capabilities: readCapabilities(source.capabilities ?? source.permissions),
+    category,
+    component: null,
+    compatibility: readCompatibility(source.compatibility),
+    defaultInstalled: source.defaultInstalled === true,
+    description: readOptionalString(source, 'description', 320),
+    developer: readOptionalString(source, 'developer', 96),
+    dockOrder: null,
+    gridOrder,
+    icon: markRaw(Grid2X2),
+    ...(iconBackground ? { iconBackground } : {}),
+    iconClass: 'app-icon--custom',
+    iconImage: icon,
+    id,
+    kind: 'external',
+    name,
+    orientation: source.orientation === 'landscape' ? 'landscape' : 'portrait',
+    ownerResource,
+    readyTimeoutMs:
+      typeof source.readyTimeoutMs === 'number' &&
+      Number.isFinite(source.readyTimeoutMs) &&
+      source.readyTimeoutMs >= 1000 &&
+      source.readyTimeoutMs <= 30_000
+        ? Math.floor(source.readyTimeoutMs)
+        : 8000,
+    removable: source.removable !== false,
+    route: `/apps/${id}`,
+    ui,
+  }
+}
+
+export const useAppCatalogStore = defineStore('app-catalog', {
+  state: () => ({
+    externalApps: [] as ExternalPhoneAppDefinition[],
+    hostMessages: {} as Record<string, CustomAppHostMessage[]>,
+    nextSequence: 1,
+    openRequests: {} as Record<string, CustomAppOpenRequest>,
+  }),
+  getters: {
+    apps: () => PHONE_APPS,
+  },
+  actions: {
+    replaceCatalog(payload: unknown): void {
+      const source = readRecord(payload)
+      if (!source || !Array.isArray(source.apps)) {
+        console.error('[Custom apps] Ignored an invalid catalog payload.')
+        return
+      }
+
+      const seenIds = new Set<string>()
+      const apps: ExternalPhoneAppDefinition[] = []
+      for (const [index, value] of source.apps.entries()) {
+        const app = normalizeExternalPhoneApp(value, index)
+        if (!app) {
+          console.error(
+            `[Custom apps] Ignored invalid catalog entry at index ${index}.`,
+          )
+          continue
+        }
+        if (seenIds.has(app.id)) {
+          console.error(`[Custom apps] Ignored duplicate app id: ${app.id}`)
+          continue
+        }
+        seenIds.add(app.id)
+        apps.push(app)
+      }
+
+      this.externalApps = apps
+      replaceExternalPhoneApps(apps)
+
+      for (const appId of Object.keys(this.hostMessages)) {
+        if (!seenIds.has(appId)) delete this.hostMessages[appId]
+      }
+      for (const appId of Object.keys(this.openRequests)) {
+        if (!seenIds.has(appId)) delete this.openRequests[appId]
+      }
+
+      usePhoneStore().ensureAppNotificationPreferences(
+        apps.map((app) => app.id),
+      )
+      useAppStoreStore().reconcileCatalog()
+    },
+    queueHostMessage(appId: string, payload: unknown): boolean {
+      const app = getPhoneApp(appId)
+      if (!isExternalPhoneApp(app)) {
+        console.error(
+          `[Custom apps] Message target is not registered: ${appId}`,
+        )
+        return false
+      }
+
+      const messages = this.hostMessages[appId] ?? []
+      messages.push({ payload, sequence: this.nextSequence })
+      this.nextSequence += 1
+      if (messages.length > MAX_PENDING_MESSAGES) {
+        console.error(
+          `[Custom apps] Pending message limit reached for ${appId}; dropped the oldest message.`,
+        )
+      }
+      this.hostMessages[appId] = messages.slice(-MAX_PENDING_MESSAGES)
+      return true
+    },
+    consumeHostMessages(appId: string, throughSequence: number): void {
+      const remaining = (this.hostMessages[appId] ?? []).filter(
+        (message) => message.sequence > throughSequence,
+      )
+      if (remaining.length) this.hostMessages[appId] = remaining
+      else delete this.hostMessages[appId]
+    },
+    requestOpen(appId: string, data?: unknown): boolean {
+      const app = getPhoneApp(appId)
+      if (!isExternalPhoneApp(app)) {
+        console.error(`[Custom apps] Open target is not registered: ${appId}`)
+        return false
+      }
+
+      this.openRequests[appId] = {
+        ...(data === undefined ? {} : { data }),
+        sequence: this.nextSequence,
+      }
+      this.nextSequence += 1
+      return true
+    },
+    consumeOpenRequest(appId: string, sequence: number): void {
+      if (this.openRequests[appId]?.sequence === sequence) {
+        delete this.openRequests[appId]
+      }
+    },
+  },
+})
diff --git a/frontend/src/stores/app-store.test.ts b/frontend/src/stores/app-store.test.ts
index c09d8da..a57a421 100644
--- a/frontend/src/stores/app-store.test.ts
+++ b/frontend/src/stores/app-store.test.ts
@@ -5,17 +5,23 @@ import { NON_REMOVABLE_PHONE_APP_IDS } from '@/config/apps'
 import { useAppStoreStore } from '@/stores/app-store'
 import { removeHomeApp } from '@/utils/homeLayout'
 
-const mocks = vi.hoisted(() => ({ saveDeviceNamespace: vi.fn() }))
+const mocks = vi.hoisted(() => ({
+  phone: {
+    device: { imei: 'phone-a' },
+    isOpen: true,
+    saveDeviceNamespace: vi.fn(),
+  },
+}))
 vi.mock('@/stores/phone', () => ({
-  usePhoneStore: () => ({
-    saveDeviceNamespace: mocks.saveDeviceNamespace,
-  }),
+  usePhoneStore: () => mocks.phone,
 }))
 
 describe('app store', () => {
   beforeEach(() => {
     setActivePinia(createPinia())
-    mocks.saveDeviceNamespace.mockReset()
+    mocks.phone.device.imei = 'phone-a'
+    mocks.phone.isOpen = true
+    mocks.phone.saveDeviceNamespace.mockReset()
   })
 
   afterEach(() => {
@@ -32,7 +38,7 @@ describe('app store', () => {
     apps.recordLaunch('mail')
 
     expect(apps.launchCounts).toEqual({ mail: 4 })
-    expect(mocks.saveDeviceNamespace).toHaveBeenCalledWith('apps', {
+    expect(mocks.phone.saveDeviceNamespace).toHaveBeenCalledWith('apps', {
       claimedApps: ['snake'],
       homeLayout: apps.homeLayout,
       launchCounts: { mail: 4 },
@@ -54,7 +60,7 @@ describe('app store', () => {
     vi.advanceTimersByTime(1)
     expect(apps.installingApps.snake).toBeUndefined()
     expect(apps.claimedApps).toEqual(['snake'])
-    expect(mocks.saveDeviceNamespace).toHaveBeenCalledWith('apps', {
+    expect(mocks.phone.saveDeviceNamespace).toHaveBeenCalledWith('apps', {
       claimedApps: ['snake'],
       homeLayout: apps.homeLayout,
       launchCounts: {},
@@ -71,7 +77,7 @@ describe('app store', () => {
     vi.advanceTimersByTime(3000)
 
     expect(apps.claimedApps).toEqual(['memory', 'snake'])
-    expect(mocks.saveDeviceNamespace).toHaveBeenCalledTimes(1)
+    expect(mocks.phone.saveDeviceNamespace).toHaveBeenCalledTimes(1)
   })
 
   it('reinstalls core and claimed apps removed from the Home Screen', () => {
@@ -81,7 +87,7 @@ describe('app store', () => {
     apps.hydrate({ claimedApps: ['memory'] })
     apps.removeHomeApp('notes')
     apps.removeHomeApp('memory')
-    mocks.saveDeviceNamespace.mockClear()
+    mocks.phone.saveDeviceNamespace.mockClear()
 
     apps.installApp('notes')
     apps.installApp('memory')
@@ -96,13 +102,13 @@ describe('app store', () => {
     expect(apps.homeLayout.grid).toContain('notes')
     expect(apps.homeLayout.grid).toContain('memory')
     expect(apps.claimedApps).toEqual(['memory'])
-    expect(mocks.saveDeviceNamespace).toHaveBeenCalledTimes(2)
+    expect(mocks.phone.saveDeviceNamespace).toHaveBeenCalledTimes(2)
   })
 
   it('prevents protected apps from being removed from the Home Screen', () => {
     const apps = useAppStoreStore()
     apps.hydrate(null)
-    mocks.saveDeviceNamespace.mockClear()
+    mocks.phone.saveDeviceNamespace.mockClear()
 
     expect([...NON_REMOVABLE_PHONE_APP_IDS]).toEqual([
       'app-store',
@@ -118,7 +124,7 @@ describe('app store', () => {
       expect(apps.homeLayout.hidden).not.toContain(appId)
     }
 
-    expect(mocks.saveDeviceNamespace).not.toHaveBeenCalled()
+    expect(mocks.phone.saveDeviceNamespace).not.toHaveBeenCalled()
   })
 
   it('restores protected apps hidden by older persisted layouts', () => {
@@ -129,7 +135,7 @@ describe('app store', () => {
 
     expect(apps.homeLayout.hidden).not.toContain('mail')
     expect(apps.homeLayout.grid).toContain('mail')
-    expect(mocks.saveDeviceNamespace).toHaveBeenCalledWith('apps', {
+    expect(mocks.phone.saveDeviceNamespace).toHaveBeenCalledWith('apps', {
       claimedApps: [],
       homeLayout: apps.homeLayout,
       launchCounts: {},
@@ -147,10 +153,54 @@ describe('app store', () => {
     apps.removeHomeApp('notes')
     expect(apps.homeLayout.grid).not.toContain('notes')
     expect(apps.homeLayout.hidden).toContain('notes')
-    expect(mocks.saveDeviceNamespace).toHaveBeenLastCalledWith('apps', {
+    expect(mocks.phone.saveDeviceNamespace).toHaveBeenLastCalledWith('apps', {
       claimedApps: [],
       homeLayout: apps.homeLayout,
       launchCounts: {},
     })
   })
+
+  it('does not commit an installation to a different phone', () => {
+    vi.useFakeTimers()
+    const apps = useAppStoreStore()
+
+    apps.installApp('snake')
+    mocks.phone.device.imei = 'phone-b'
+    vi.advanceTimersByTime(3000)
+
+    expect(apps.installingApps).toEqual({})
+    expect(apps.claimedApps).toEqual([])
+    expect(mocks.phone.saveDeviceNamespace).not.toHaveBeenCalled()
+  })
+
+  it('cancels installation timers when hydration changes device scope', () => {
+    vi.useFakeTimers()
+    const apps = useAppStoreStore()
+
+    apps.installApp('snake')
+    expect(vi.getTimerCount()).toBe(1)
+
+    mocks.phone.device.imei = 'phone-b'
+    apps.hydrate(null)
+    expect(vi.getTimerCount()).toBe(0)
+
+    vi.advanceTimersByTime(3000)
+    expect(apps.claimedApps).toEqual([])
+    expect(mocks.phone.saveDeviceNamespace).not.toHaveBeenCalled()
+  })
+
+  it('cancels installation timers when the phone closes', () => {
+    vi.useFakeTimers()
+    const apps = useAppStoreStore()
+
+    apps.installApp('snake')
+    mocks.phone.isOpen = false
+    apps.cancelPendingInstalls()
+
+    expect(vi.getTimerCount()).toBe(0)
+    expect(apps.installingApps).toEqual({})
+    vi.advanceTimersByTime(3000)
+    expect(apps.claimedApps).toEqual([])
+    expect(mocks.phone.saveDeviceNamespace).not.toHaveBeenCalled()
+  })
 })
diff --git a/frontend/src/stores/app-store.ts b/frontend/src/stores/app-store.ts
index 401cb9c..3c37870 100644
--- a/frontend/src/stores/app-store.ts
+++ b/frontend/src/stores/app-store.ts
@@ -1,7 +1,11 @@
 import { defineStore } from 'pinia'
 
 import {
+  getPhoneApp,
+  isExternalPhoneApp,
   isPhoneAppId,
+  isPhoneAppRemovable,
+  isValidExternalPhoneAppId,
   NON_REMOVABLE_PHONE_APP_IDS,
   PHONE_APPS,
 } from '@/config/apps'
@@ -17,26 +21,55 @@ import {
   restoreHomeApp,
   type HomeArea,
 } from '@/utils/homeLayout'
+import { nuiCall } from '@/utils/nui'
 
 const INSTALL_DURATION_MS = 3000
-const DEFAULT_GRID_IDS = [...PHONE_APPS]
-  .sort((a, b) => a.gridOrder - b.gridOrder)
-  .map((app) => app.id)
-const DEFAULT_DOCK_IDS = PHONE_APPS.filter((app) => app.dockOrder !== null)
-  .sort((a, b) => (a.dockOrder ?? 0) - (b.dockOrder ?? 0))
-  .map((app) => app.id)
-const CORE_APP_IDS = PHONE_APPS.filter((app) => app.category !== 'games').map(
-  (app) => app.id,
-)
+
+type PendingInstallation = {
+  deviceImei: string
+  timer: ReturnType<typeof globalThis.setTimeout>
+  token: symbol
+}
+
+const pendingInstallations = new WeakMap<
+  object,
+  Map<LaunchablePhoneAppId, PendingInstallation>
+>()
+
+function getDefaultGridIds(): LaunchablePhoneAppId[] {
+  return [...PHONE_APPS]
+    .sort((a, b) => a.gridOrder - b.gridOrder)
+    .map((app) => app.id)
+}
+
+function getDefaultDockIds(): LaunchablePhoneAppId[] {
+  return PHONE_APPS.filter((app) => app.dockOrder !== null)
+    .sort((a, b) => (a.dockOrder ?? 0) - (b.dockOrder ?? 0))
+    .map((app) => app.id)
+}
+
+function getDefaultInstalledIds(): LaunchablePhoneAppId[] {
+  return PHONE_APPS.filter((app) =>
+    isExternalPhoneApp(app) ? app.defaultInstalled : app.category !== 'games',
+  ).map((app) => app.id)
+}
+
+function isProtectedHomeApp(appId: LaunchablePhoneAppId): boolean {
+  const app = getPhoneApp(appId)
+  return app
+    ? !isPhoneAppRemovable(app)
+    : NON_REMOVABLE_PHONE_APP_IDS.has(appId)
+}
 
 export const useAppStoreStore = defineStore('app-store', {
   state: () => ({
     claimedApps: [] as LaunchablePhoneAppId[],
     homeLayout: createDefaultHomeLayout(
-      CORE_APP_IDS,
-      DEFAULT_GRID_IDS,
-      DEFAULT_DOCK_IDS,
+      getDefaultInstalledIds(),
+      getDefaultGridIds(),
+      getDefaultDockIds(),
     ),
+    hydrated: false,
     installingApps: {} as Partial<Record<LaunchablePhoneAppId, boolean>>,
     launchCounts: {} as Partial<Record<LaunchablePhoneAppId, number>>,
   }),
@@ -62,9 +95,18 @@ export const useAppStoreStore = defineStore('app-store', {
         this.persist()
       }
     },
+    cancelPendingInstalls(): void {
+      const installations = pendingInstallations.get(this)
+      if (installations) {
+        for (const installation of installations.values()) {
+          globalThis.clearTimeout(installation.timer)
+        }
+        pendingInstallations.delete(this)
+      }
+      this.installingApps = {}
+    },
     installApp(id: LaunchablePhoneAppId): void {
-      const installed =
-        CORE_APP_IDS.includes(id) || this.claimedApps.includes(id)
+      const installed = this.isInstalled(id)
       if (
         this.installingApps[id] ||
         (installed && !this.homeLayout.hidden.includes(id))
@@ -72,51 +114,111 @@ export const useAppStoreStore = defineStore('app-store', {
         return
       }
 
+      const phone = usePhoneStore()
+      const deviceImei = phone.device?.imei
+      if (!phone.isOpen || !deviceImei) {
+        console.error(
+          `[App store] Installation cancelled because no phone device is open for ${id}.`,
+        )
+        return
+      }
+
+      const app = getPhoneApp(id)
+      const reportInstall = !installed && isExternalPhoneApp(app)
+      const token = Symbol(id)
+      const installations =
+        pendingInstallations.get(this) ??
+        new Map<LaunchablePhoneAppId, PendingInstallation>()
       this.installingApps[id] = true
-      globalThis.setTimeout(() => {
-        if (CORE_APP_IDS.includes(id) || this.claimedApps.includes(id)) {
+      const timer = globalThis.setTimeout(() => {
+        const pending = installations.get(id)
+        if (!pending || pending.token !== token) return
+        installations.delete(id)
+        if (!installations.size) pendingInstallations.delete(this)
+
+        const activePhone = usePhoneStore()
+        if (
+          !activePhone.isOpen ||
+          activePhone.device?.imei !== pending.deviceImei
+        ) {
+          delete this.installingApps[id]
+          console.error(
+            `[App store] Installation cancelled because the active phone changed for ${id}.`,
+          )
+          return
+        }
+        if (reportInstall && !isExternalPhoneApp(getPhoneApp(id))) {
+          delete this.installingApps[id]
+          console.error(
+            `[Custom apps] Installation cancelled because ${id} is no longer registered.`,
+          )
+          return
+        }
+        if (this.isInstalled(id)) {
           this.restoreHomeApp(id)
         } else {
           this.claimApp(id)
         }
         delete this.installingApps[id]
+        if (reportInstall) {
+          void nuiCall('custom-app:lifecycle', {
+            appId: id,
+            event: 'install',
+          }).then((response) => {
+            if (!response.success) {
+              console.error(
+                `[Custom apps] Install lifecycle failed for ${id}: ${response.error ?? 'request_failed'}`,
+              )
+            }
+          })
+        }
       }, INSTALL_DURATION_MS)
+      installations.set(id, { deviceImei, timer, token })
+      pendingInstallations.set(this, installations)
     },
     hydrate(payload: unknown): void {
+      this.cancelPendingInstalls()
       const data = payload as {
         claimedApps?: unknown
         homeLayout?: unknown
         launchCounts?: unknown
       } | null
+      const layoutVersion =
+        data?.homeLayout && typeof data.homeLayout === 'object'
+          ? (data.homeLayout as { version?: unknown }).version
+          : undefined
       this.claimedApps = Array.isArray(data?.claimedApps)
         ? data.claimedApps.filter(
             (id): id is LaunchablePhoneAppId =>
-              typeof id === 'string' && isPhoneAppId(id),
+              typeof id === 'string' &&
+              (isPhoneAppId(id) ||
+                (layoutVersion === 3 && isValidExternalPhoneAppId(id))),
           )
         : []
-      const installedIds = [...CORE_APP_IDS, ...this.claimedApps]
+      const installedIds = [
+        ...new Set([...getDefaultInstalledIds(), ...this.claimedApps]),
+      ]
       const defaults = createDefaultHomeLayout(
         installedIds,
-        DEFAULT_GRID_IDS,
-        DEFAULT_DOCK_IDS,
+        getDefaultGridIds(),
+        getDefaultDockIds(),
       )
       this.homeLayout = parseHomeLayout(
         data?.homeLayout,
         defaults,
         installedIds,
       )
-      const protectedHiddenAppIds = this.homeLayout.hidden.filter((id) =>
-        NON_REMOVABLE_PHONE_APP_IDS.has(id),
-      )
+      const protectedHiddenAppIds =
+        this.homeLayout.hidden.filter(isProtectedHomeApp)
       for (const appId of protectedHiddenAppIds) {
         this.homeLayout = restoreHomeApp(this.homeLayout, appId)
       }
-      this.installingApps = {}
       this.launchCounts = {}
       if (data?.launchCounts && typeof data.launchCounts === 'object') {
         for (const [appId, count] of Object.entries(data.launchCounts)) {
           if (
-            isPhoneAppId(appId) &&
+            (isPhoneAppId(appId) ||
+              (layoutVersion === 3 && isValidExternalPhoneAppId(appId))) &&
             typeof count === 'number' &&
             Number.isFinite(count) &&
             count > 0
@@ -125,8 +227,39 @@ export const useAppStoreStore = defineStore('app-store', {
           }
         }
       }
+      this.hydrated = true
       if (protectedHiddenAppIds.length) this.persist()
     },
+    isInstalled(appId: LaunchablePhoneAppId): boolean {
+      if (this.claimedApps.includes(appId)) return true
+      const app = getPhoneApp(appId)
+      if (!app) return false
+      return isExternalPhoneApp(app)
+        ? app.defaultInstalled
+        : app.category !== 'games'
+    },
+    reconcileCatalog(): void {
+      const installedIds = [
+        ...new Set([...getDefaultInstalledIds(), ...this.claimedApps]),
+      ]
+      const defaults = createDefaultHomeLayout(
+        installedIds,
+        getDefaultGridIds(),
+        getDefaultDockIds(),
+      )
+      const previous = JSON.stringify(this.homeLayout)
+      this.homeLayout = parseHomeLayout(this.homeLayout, defaults, installedIds)
+
+      for (const appId of [...this.homeLayout.hidden]) {
+        if (isProtectedHomeApp(appId)) {
+          this.homeLayout = restoreHomeApp(this.homeLayout, appId)
+        }
+      }
+
+      if (this.hydrated && previous !== JSON.stringify(this.homeLayout)) {
+        this.persist()
+      }
+    },
     recordLaunch(appId: LaunchablePhoneAppId): void {
       this.launchCounts[appId] = (this.launchCounts[appId] ?? 0) + 1
       this.persist()
@@ -147,7 +280,7 @@ export const useAppStoreStore = defineStore('app-store', {
       this.persist()
     },
     removeHomeApp(appId: LaunchablePhoneAppId): void {
-      if (NON_REMOVABLE_PHONE_APP_IDS.has(appId)) return
+      if (isProtectedHomeApp(appId)) return
 
       this.homeLayout = removeHomeApp(this.homeLayout, appId)
       this.persist()
diff --git a/frontend/src/stores/companies.test.ts b/frontend/src/stores/companies.test.ts
new file mode 100644
index 0000000..2a49e89
--- /dev/null
+++ b/frontend/src/stores/companies.test.ts
@@ -0,0 +1,327 @@
+import { createPinia, setActivePinia } from 'pinia'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { useCompaniesStore } from '@/stores/companies'
+import type {
+  Company,
+  CompanyDirectoryFilters,
+  CompanyRequest,
+  CompanySummary,
+} from '@/types/companies'
+import { nuiCall } from '@/utils/nui'
+
+vi.mock('@/utils/nui', () => ({ nuiCall: vi.fn() }))
+
+const mockNuiCall = vi.mocked(nuiCall)
+
+const summary: CompanySummary = {
+  acceptsRequests: true,
+  announcement: null,
+  availability: 'available',
+  availabilityUpdatedAt: '2026-08-10T10:00:00.000Z',
+  canCall: true,
+  canMessage: false,
+  categoryId: 'public',
+  categoryName: 'Public services',
+  description: 'City emergency service.',
+  id: 'police',
+  location: {
+    address: 'Mission Row',
+    coords: { x: 441, y: -981, z: 30 },
+    district: 'Mission Row',
+    label: 'Mission Row Station',
+  },
+  logoUrl: null,
+  name: 'Los Santos Police',
+  phoneNumber: '911',
+  serviceSummary: 'Emergency response',
+  verified: true,
+}
+
+const company: Company = {
+  ...summary,
+  coverUrl: null,
+  hours: [],
+  revision: 3,
+  services: [],
+}
+
+const request: CompanyRequest = {
+  actions: {
+    allowedStatuses: ['in_progress'],
+    canAssign: false,
+    canCall: true,
+    canCancel: true,
+    canClaim: false,
+    canReply: true,
+  },
+  assignedLabel: null,
+  companyId: company.id,
+  companyLogoUrl: null,
+  companyName: company.name,
+  createdAt: '2026-08-10T10:00:00.000Z',
+  description: 'I need assistance.',
+  events: [],
+  id: 'request-1',
+  media: [],
+  messages: [],
+  phoneNumber: '911',
+  revision: 1,
+  serviceId: 'response',
+  serviceName: 'Emergency response',
+  status: 'new',
+  subject: 'Help needed',
+  unreadCount: 1,
+  updatedAt: '2026-08-10T10:00:00.000Z',
+}
+
+const filters: CompanyDirectoryFilters = {
+  acceptsRequests: false,
+  availability: null,
+  categoryId: null,
+  hasLocation: false,
+  search: '',
+  sort: 'relevance',
+}
+
+describe('companies store', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia())
+    mockNuiCall.mockReset()
+  })
+
+  it('loads, filters and deduplicates cursor pages', async () => {
+    mockNuiCall
+      .mockResolvedValueOnce({
+        data: {
+          categories: [{ id: 'public', name: 'Public services' }],
+          companies: [summary],
+          nextCursor: 'page-2',
+        },
+        success: true,
+      })
+      .mockResolvedValueOnce({
+        data: {
+          categories: [],
+          companies: [
+            { ...summary, description: 'Updated description' },
+            { ...summary, id: 'medical', name: 'Los Santos Medical' },
+          ],
+          nextCursor: null,
+        },
+        success: true,
+      })
+    const store = useCompaniesStore()
+
+    expect(await store.loadCompanies(filters)).toBe(true)
+    expect(await store.loadCompanies(filters, true)).toBe(true)
+
+    expect(store.directory.map((item) => item.id)).toEqual([
+      'police',
+      'medical',
+    ])
+    expect(store.directory[0].description).toBe('Updated description')
+    expect(mockNuiCall).toHaveBeenNthCalledWith(2, 'companies:list', {
+      acceptsRequests: false,
+      availability: null,
+      categoryId: null,
+      cursor: 'page-2',
+      hasLocation: false,
+      search: '',
+      sort: 'relevance',
+    })
+  })
+
+  it('uses server-provided unread counts for the app badge', async () => {
+    mockNuiCall.mockResolvedValueOnce({
+      data: {
+        nextCursor: null,
+        requests: [request],
+        unreadCount: 4,
+      },
+      success: true,
+    })
+    const store = useCompaniesStore()
+
+    await store.loadMyRequests('open')
+    store.applyUnreadCounts({ work: 2 })
+
+    expect(store.customerUnreadCount).toBe(4)
+    expect(store.workUnreadCount).toBe(2)
+    expect(store.unreadCount).toBe(6)
+  })
+
+  it('does not refresh directory data before the app has loaded it', async () => {
+    const store = useCompaniesStore()
+
+    await store.applyChanged({ area: 'directory', companyId: 'police' })
+
+    expect(mockNuiCall).not.toHaveBeenCalled()
+
+    mockNuiCall.mockResolvedValue({
+      data: { categories: [], companies: [summary], nextCursor: null },
+      success: true,
+    })
+    await store.loadCompanies(filters)
+    mockNuiCall.mockClear()
+
+    await store.applyChanged({ area: 'directory', companyId: 'police' })
+
+    expect(mockNuiCall).toHaveBeenCalledOnce()
+  })
+
+  it('clears customer badge state when the active device has no usable SIM', async () => {
+    mockNuiCall.mockResolvedValueOnce({ error: 'no_sim', success: false })
+    const store = useCompaniesStore()
+    store.customerUnreadCount = 4
+
+    expect(await store.loadMyRequests('open')).toBe(false)
+    expect(store.customerUnreadCount).toBe(0)
+  })
+
+  it('drops SIM-scoped request data when the active device changes', () => {
+    const store = useCompaniesStore()
+    store.bindDeviceScope('device-a', 'sim-a')
+    store.customerUnreadCount = 3
+    store.myRequests = [request]
+    store.request = request
+
+    store.bindDeviceScope('device-a', 'sim-b')
+
+    expect(store.customerUnreadCount).toBe(0)
+    expect(store.myRequests).toEqual([])
+    expect(store.request).toBeNull()
+  })
+
+  it('keeps server-resolved request media in the loaded thread', async () => {
+    const requestWithMedia = {
+      ...request,
+      media: [{ id: 12, url: 'https://example.test/request-photo.jpg' }],
+    }
+    mockNuiCall.mockResolvedValueOnce({
+      data: { request: requestWithMedia },
+      success: true,
+    })
+    const store = useCompaniesStore()
+
+    expect(await store.loadRequest(request.id)).toBe(true)
+    expect(store.request?.media).toEqual(requestWithMedia.media)
+  })
+
+  it('refreshes counts without replacing the selected request list', async () => {
+    mockNuiCall
+      .mockResolvedValueOnce({
+        data: { nextCursor: null, requests: [], unreadCount: 3 },
+        success: true,
+      })
+      .mockResolvedValueOnce({
+        data: {
+          context: {
+            authorized: false,
+            callAvailable: false,
+            company: null,
+            metrics: { assigned: 0, completedToday: 0, new: 0, waiting: 0 },
+            ownRequests: [],
+            permissions: {
+              canAssign: false,
+              canManageAnnouncement: false,
+              canManageHours: false,
+              canManageProfile: false,
+              canManageServices: false,
+              canSetAvailability: false,
+              canTakeCalls: false,
+            },
+            recentRequests: [],
+            role: null,
+            unreadCount: 0,
+          },
+        },
+        success: true,
+      })
+    const store = useCompaniesStore()
+    store.myRequestsList = 'closed'
+
+    await store.refreshUnreadCounts()
+
+    expect(mockNuiCall).toHaveBeenCalledWith('companies:my-requests', {
+      cursor: null,
+      list: 'closed',
+    })
+  })
+
+  it('sends only server-resolved request identifiers when claiming', async () => {
+    mockNuiCall.mockResolvedValueOnce({
+      data: { request: { ...request, revision: 2, status: 'assigned' } },
+      success: true,
+    })
+    const store = useCompaniesStore()
+
+    await store.claimRequest(request.id, request.revision)
+
+    expect(mockNuiCall).toHaveBeenCalledWith('companies:claim-request', {
+      requestId: request.id,
+      revision: request.revision,
+    })
+    expect(store.request?.status).toBe('assigned')
+  })
+
+  it('does not apply manager edits until the server confirms them', async () => {
+    mockNuiCall.mockResolvedValueOnce({
+      error: 'revision_conflict',
+      success: false,
+    })
+    const store = useCompaniesStore()
+    store.company = company
+
+    await store.updateProfile({
+      acceptsRequests: false,
+      address: 'New address',
+      description: 'Changed locally',
+      district: 'Downtown',
+      locationLabel: 'Office',
+      revision: company.revision,
+    })
+
+    expect(store.company).toEqual(company)
+    expect(store.mutationError).toBe('revision_conflict')
+  })
+
+  it('includes the current revision when availability changes', async () => {
+    mockNuiCall.mockResolvedValueOnce({
+      data: { company: { ...company, availability: 'busy', revision: 4 } },
+      success: true,
+    })
+    const store = useCompaniesStore()
+
+    await store.updateAvailability('busy', 3)
+
+    expect(mockNuiCall).toHaveBeenCalledWith('companies:update-availability', {
+      availability: 'busy',
+      revision: 3,
+    })
+  })
+
+  it('creates requests without client-owned identity fields', async () => {
+    mockNuiCall.mockResolvedValueOnce({
+      data: { request },
+      success: true,
+    })
+    const store = useCompaniesStore()
+
+    await store.createRequest({
+      companyId: 'police',
+      description: 'I need assistance.',
+      mediaIds: ['10'],
+      serviceId: 'response',
+      subject: 'Help needed',
+    })
+
+    expect(mockNuiCall).toHaveBeenCalledWith('companies:create-request', {
+      companyId: 'police',
+      description: 'I need assistance.',
+      mediaIds: ['10'],
+      serviceId: 'response',
+      subject: 'Help needed',
+    })
+  })
+})
diff --git a/frontend/src/stores/companies.ts b/frontend/src/stores/companies.ts
new file mode 100644
index 0000000..4e46162
--- /dev/null
+++ b/frontend/src/stores/companies.ts
@@ -0,0 +1,539 @@
+import { defineStore } from 'pinia'
+
+import type {
+  Company,
+  CompanyAvailability,
+  CompanyChangedPayload,
+  CompanyDirectoryFilters,
+  CompanyDirectoryPage,
+  CompanyHours,
+  CompanyMember,
+  CompanyMembersResult,
+  CompanyMutationResult,
+  CompanyRequest,
+  CompanyRequestList,
+  CompanyRequestMutationResult,
+  CompanyRequestPage,
+  CompanyRequestStatus,
+  CompanyRequestSummary,
+  CompanyService,
+  CompanySummary,
+  CompanyUnreadCounts,
+  CompanyWorkContext,
+  CompanyWorkFilter,
+  CompanyWorkQueuePage,
+  CreateCompanyRequest,
+  PublishCompanyAnnouncement,
+  UpdateCompanyProfile,
+} from '@/types/companies'
+import type { PhoneCall } from '@/types/phone'
+import { nuiCall, type NuiResponse } from '@/utils/nui'
+
+function mergeById<T extends { id: string }>(current: T[], incoming: T[]): T[] {
+  const merged = new Map(current.map((item) => [item.id, item]))
+  for (const item of incoming) merged.set(item.id, item)
+  return [...merged.values()]
+}
+
+export const useCompaniesStore = defineStore('companies', {
+  state: () => ({
+    categories: [] as CompanyDirectoryPage['categories'],
+    company: null as Company | null,
+    customerUnreadCount: 0,
+    directory: [] as CompanySummary[],
+    directoryFilters: {
+      acceptsRequests: false,
+      availability: null,
+      categoryId: null,
+      hasLocation: false,
+      search: '',
+      sort: 'relevance',
+    } as CompanyDirectoryFilters,
+    directoryError: '',
+    directoryLoaded: false,
+    directoryLoading: false,
+    directoryLoadingMore: false,
+    directoryNextCursor: null as string | null,
+    deviceScopeKey: '',
+    deviceScopeVersion: 0,
+    members: [] as CompanyMember[],
+    membersLoading: false,
+    mutationError: '',
+    mutating: false,
+    myRequests: [] as CompanyRequestSummary[],
+    myRequestsList: 'open' as CompanyRequestList,
+    myRequestsError: '',
+    myRequestsLoaded: false,
+    myRequestsLoading: false,
+    myRequestsLoadingMore: false,
+    myRequestsNextCursor: null as string | null,
+    request: null as CompanyRequest | null,
+    requestError: '',
+    requestLoading: false,
+    workContext: null as CompanyWorkContext | null,
+    workContextError: '',
+    workContextLoaded: false,
+    workContextLoading: false,
+    workQueue: [] as CompanyRequestSummary[],
+    workQueueFilter: 'new' as CompanyWorkFilter,
+    workQueueError: '',
+    workQueueLoading: false,
+    workQueueLoadingMore: false,
+    workQueueNextCursor: null as string | null,
+    workUnreadCount: 0,
+  }),
+  getters: {
+    unreadCount: (state): number =>
+      state.customerUnreadCount + state.workUnreadCount,
+  },
+  actions: {
+    bindDeviceScope(imei: string, simId: string | null): void {
+      const key = `${imei}:${simId ?? 'no-sim'}`
+      if (!this.deviceScopeKey) {
+        this.deviceScopeKey = key
+        return
+      }
+      if (this.deviceScopeKey === key) return
+      this.deviceScopeKey = key
+      this.resetDeviceScope()
+    },
+    applyUnreadCounts(counts: CompanyUnreadCounts): void {
+      if (typeof counts.customer === 'number') {
+        this.customerUnreadCount = Math.max(0, Math.floor(counts.customer))
+      }
+      if (typeof counts.work === 'number') {
+        this.workUnreadCount = Math.max(0, Math.floor(counts.work))
+      }
+    },
+    async refreshUnreadCounts(): Promise<void> {
+      await Promise.all([
+        this.loadMyRequests(this.myRequestsList),
+        this.loadWorkContext(),
+      ])
+    },
+    async applyChanged(change: CompanyChangedPayload): Promise<void> {
+      const refreshDirectory =
+        this.directoryLoaded &&
+        (change.area === 'all' || change.area === 'directory')
+      const refreshCustomer =
+        this.myRequestsLoaded &&
+        (change.area === 'all' || change.area === 'customer')
+      const refreshWork =
+        this.workContextLoaded &&
+        (change.area === 'all' || change.area === 'work')
+      const tasks: Promise<unknown>[] = []
+      if (refreshDirectory) {
+        tasks.push(this.loadCompanies(this.directoryFilters))
+        if (change.companyId && this.company?.id === change.companyId) {
+          tasks.push(this.loadCompany(change.companyId))
+        }
+      }
+      if (refreshCustomer) tasks.push(this.loadMyRequests(this.myRequestsList))
+      if (refreshWork) {
+        tasks.push(
+          this.loadWorkContext().then((loaded) =>
+            loaded && this.workContext?.authorized
+              ? this.loadWorkQueue(this.workQueueFilter)
+              : false,
+          ),
+        )
+      }
+      if (
+        change.requestId &&
+        this.request?.id === change.requestId &&
+        (refreshCustomer || refreshWork)
+      ) {
+        tasks.push(this.loadRequest(change.requestId))
+      }
+      await Promise.all(tasks)
+    },
+    async loadCompanies(
+      filters: CompanyDirectoryFilters,
+      append = false,
+    ): Promise<boolean> {
+      if (append && (!this.directoryNextCursor || this.directoryLoadingMore)) {
+        return false
+      }
+      if (append) this.directoryLoadingMore = true
+      else this.directoryLoading = true
+      this.directoryLoaded = true
+      this.directoryFilters = { ...filters }
+      const response = await nuiCall<CompanyDirectoryPage>('companies:list', {
+        acceptsRequests: filters.acceptsRequests,
+        availability: filters.availability,
+        categoryId: filters.categoryId,
+        cursor: append ? this.directoryNextCursor : null,
+        hasLocation: filters.hasLocation,
+        search: filters.search,
+        sort: filters.sort,
+      })
+      this.directoryLoading = false
+      this.directoryLoadingMore = false
+      if (!response.success || !response.data) {
+        this.directoryError = response.error ?? 'request_failed'
+        if (!append) {
+          this.directory = []
+          this.directoryNextCursor = null
+        }
+        return false
+      }
+      this.categories = response.data.categories ?? this.categories
+      this.directory = append
+        ? mergeById(this.directory, response.data.companies)
+        : response.data.companies
+      this.directoryNextCursor = response.data.nextCursor
+      this.directoryError = ''
+      return true
+    },
+    async loadCompany(companyId: string): Promise<boolean> {
+      this.directoryError = ''
+      this.directoryLoading = true
+      const response = await nuiCall<{ company: Company }>('companies:get', {
+        companyId,
+      })
+      this.directoryLoading = false
+      if (!response.success || !response.data?.company) {
+        this.directoryError = response.error ?? 'request_failed'
+        return false
+      }
+      this.company = response.data.company
+      this.replaceCompanySummary(response.data.company)
+      return true
+    },
+    async loadMyRequests(
+      list: CompanyRequestList,
+      append = false,
+    ): Promise<boolean> {
+      if (
+        append &&
+        (!this.myRequestsNextCursor || this.myRequestsLoadingMore)
+      ) {
+        return false
+      }
+      if (append) this.myRequestsLoadingMore = true
+      else this.myRequestsLoading = true
+      this.myRequestsLoaded = true
+      this.myRequestsList = list
+      const deviceScopeVersion = this.deviceScopeVersion
+      const response = await nuiCall<CompanyRequestPage>(
+        'companies:my-requests',
+        {
+          cursor: append ? this.myRequestsNextCursor : null,
+          list,
+        },
+      )
+      this.myRequestsLoading = false
+      this.myRequestsLoadingMore = false
+      if (deviceScopeVersion !== this.deviceScopeVersion) return false
+      if (!response.success || !response.data) {
+        this.myRequestsError = response.error ?? 'request_failed'
+        if (!append) {
+          this.myRequests = []
+          this.myRequestsNextCursor = null
+          if (
+            response.error === 'anonymous_sim' ||
+            response.error === 'device_not_found' ||
+            response.error === 'no_sim'
+          ) {
+            this.customerUnreadCount = 0
+          }
+        }
+        return false
+      }
+      this.myRequests = append
+        ? mergeById(this.myRequests, response.data.requests)
+        : response.data.requests
+      this.myRequestsNextCursor = response.data.nextCursor
+      this.customerUnreadCount = Math.max(0, response.data.unreadCount)
+      this.myRequestsError = ''
+      return true
+    },
+    async loadRequest(requestId: string): Promise<boolean> {
+      this.requestLoading = true
+      const deviceScopeVersion = this.deviceScopeVersion
+      const response = await nuiCall<{ request: CompanyRequest }>(
+        'companies:get-request',
+        { requestId },
+      )
+      this.requestLoading = false
+      if (deviceScopeVersion !== this.deviceScopeVersion) return false
+      if (!response.success || !response.data?.request) {
+        this.requestError = response.error ?? 'request_failed'
+        return false
+      }
+      this.request = response.data.request
+      this.requestError = ''
+      this.replaceRequestSummary(response.data.request)
+      return true
+    },
+    async loadWorkContext(): Promise<boolean> {
+      this.workContextLoaded = true
+      this.workContextLoading = true
+      const response = await nuiCall<{ context: CompanyWorkContext }>(
+        'companies:work-context',
+      )
+      this.workContextLoading = false
+      if (!response.success || !response.data?.context) {
+        this.workContextError = response.error ?? 'request_failed'
+        return false
+      }
+      this.workContext = response.data.context
+      this.workUnreadCount = Math.max(0, response.data.context.unreadCount)
+      this.workContextError = ''
+      return true
+    },
+    async loadWorkQueue(
+      filter: CompanyWorkFilter,
+      append = false,
+    ): Promise<boolean> {
+      if (append && (!this.workQueueNextCursor || this.workQueueLoadingMore)) {
+        return false
+      }
+      if (append) this.workQueueLoadingMore = true
+      else this.workQueueLoading = true
+      this.workQueueFilter = filter
+      const response = await nuiCall<CompanyWorkQueuePage>(
+        'companies:work-queue',
+        {
+          cursor: append ? this.workQueueNextCursor : null,
+          filter,
+        },
+      )
+      this.workQueueLoading = false
+      this.workQueueLoadingMore = false
+      if (!response.success || !response.data) {
+        this.workQueueError = response.error ?? 'request_failed'
+        if (!append) {
+          this.workQueue = []
+          this.workQueueNextCursor = null
+        }
+        return false
+      }
+      this.workQueue = append
+        ? mergeById(this.workQueue, response.data.requests)
+        : response.data.requests
+      this.workQueueNextCursor = response.data.nextCursor
+      this.workQueueError = ''
+      return true
+    },
+    async loadMembers(): Promise<boolean> {
+      this.membersLoading = true
+      const response = await nuiCall<CompanyMembersResult>(
+        'companies:list-members',
+      )
+      this.membersLoading = false
+      if (!response.success || !response.data) {
+        this.mutationError = response.error ?? 'request_failed'
+        return false
+      }
+      this.members = response.data.members
+      this.mutationError = ''
+      return true
+    },
+    async createRequest(
+      draft: CreateCompanyRequest,
+    ): Promise<NuiResponse<CompanyRequestMutationResult>> {
+      return this.mutateRequest('companies:create-request', draft)
+    },
+    async cancelRequest(
+      requestId: string,
+      revision: number,
+    ): Promise<NuiResponse<CompanyRequestMutationResult>> {
+      return this.mutateRequest('companies:cancel-request', {
+        requestId,
+        revision,
+      })
+    },
+    async sendMessage(
+      requestId: string,
+      body: string,
+      revision: number,
+    ): Promise<NuiResponse<CompanyRequestMutationResult>> {
+      return this.mutateRequest('companies:send-message', {
+        body,
+        requestId,
+        revision,
+      })
+    },
+    async claimRequest(
+      requestId: string,
+      revision: number,
+    ): Promise<NuiResponse<CompanyRequestMutationResult>> {
+      return this.mutateRequest('companies:claim-request', {
+        requestId,
+        revision,
+      })
+    },
+    async assignRequest(
+      requestId: string,
+      memberId: string,
+      revision: number,
+    ): Promise<NuiResponse<CompanyRequestMutationResult>> {
+      return this.mutateRequest('companies:assign-request', {
+        memberId,
+        requestId,
+        revision,
+      })
+    },
+    async updateRequestStatus(
+      requestId: string,
+      status: CompanyRequestStatus,
+      revision: number,
+    ): Promise<NuiResponse<CompanyRequestMutationResult>> {
+      return this.mutateRequest('companies:update-request-status', {
+        requestId,
+        revision,
+        status,
+      })
+    },
+    async updateAvailability(
+      availability: CompanyAvailability,
+      revision: number,
+    ): Promise<NuiResponse<CompanyMutationResult>> {
+      return this.mutateCompany('companies:update-availability', {
+        availability,
+        revision,
+      })
+    },
+    async updateProfile(
+      profile: UpdateCompanyProfile,
+    ): Promise<NuiResponse<CompanyMutationResult>> {
+      return this.mutateCompany('companies:update-profile', profile)
+    },
+    async updateHours(
+      revision: number,
+      hours: CompanyHours[],
+    ): Promise<NuiResponse<CompanyMutationResult>> {
+      return this.mutateCompany('companies:update-hours', { hours, revision })
+    },
+    async updateServices(
+      revision: number,
+      services: CompanyService[],
+    ): Promise<NuiResponse<CompanyMutationResult>> {
+      return this.mutateCompany('companies:update-services', {
+        revision,
+        services,
+      })
+    },
+    async publishAnnouncement(
+      announcement: PublishCompanyAnnouncement,
+    ): Promise<NuiResponse<CompanyMutationResult>> {
+      return this.mutateCompany('companies:publish-announcement', announcement)
+    },
+    async setCallAvailability(
+      available: boolean,
+    ): Promise<NuiResponse<{ context: CompanyWorkContext }>> {
+      this.mutating = true
+      const response = await nuiCall<{ context: CompanyWorkContext }>(
+        'companies:set-call-availability',
+        { available },
+      )
+      this.mutating = false
+      if (!response.success || !response.data?.context) {
+        this.mutationError = response.error ?? 'request_failed'
+        return response
+      }
+      this.workContext = response.data.context
+      this.workUnreadCount = Math.max(0, response.data.context.unreadCount)
+      this.mutationError = ''
+      return response
+    },
+    async callCustomer(requestId: string): Promise<NuiResponse<PhoneCall>> {
+      this.mutating = true
+      const response = await nuiCall<PhoneCall>('companies:call-customer', {
+        requestId,
+      })
+      this.mutating = false
+      this.mutationError = response.success
+        ? ''
+        : (response.error ?? 'request_failed')
+      return response
+    },
+    async mutateRequest(
+      endpoint: string,
+      payload: Record<string, unknown>,
+    ): Promise<NuiResponse<CompanyRequestMutationResult>> {
+      this.mutating = true
+      const deviceScopeVersion = this.deviceScopeVersion
+      const response = await nuiCall<CompanyRequestMutationResult>(
+        endpoint,
+        payload,
+      )
+      this.mutating = false
+      if (deviceScopeVersion !== this.deviceScopeVersion) {
+        return { success: false, error: 'device_changed' }
+      }
+      if (!response.success || !response.data?.request) {
+        this.mutationError = response.error ?? 'request_failed'
+        return response
+      }
+      this.request = response.data.request
+      this.replaceRequestSummary(response.data.request)
+      if (response.data.context) {
+        this.workContext = response.data.context
+        this.workUnreadCount = Math.max(0, response.data.context.unreadCount)
+      }
+      this.mutationError = ''
+      return response
+    },
+    async mutateCompany(
+      endpoint: string,
+      payload: Record<string, unknown>,
+    ): Promise<NuiResponse<CompanyMutationResult>> {
+      this.mutating = true
+      const response = await nuiCall<CompanyMutationResult>(endpoint, payload)
+      this.mutating = false
+      if (!response.success || !response.data?.company) {
+        this.mutationError = response.error ?? 'request_failed'
+        return response
+      }
+      this.company = response.data.company
+      this.replaceCompanySummary(response.data.company)
+      if (this.workContext) this.workContext.company = response.data.company
+      if (response.data.context) {
+        this.workContext = response.data.context
+        this.workUnreadCount = Math.max(0, response.data.context.unreadCount)
+      }
+      this.mutationError = ''
+      return response
+    },
+    replaceCompanySummary(company: Company): void {
+      const index = this.directory.findIndex((item) => item.id === company.id)
+      if (index >= 0) this.directory[index] = company
+    },
+    replaceRequestSummary(request: CompanyRequest): void {
+      const lists = [this.myRequests, this.workQueue]
+      for (const list of lists) {
+        const index = list.findIndex((item) => item.id === request.id)
+        if (index >= 0) list[index] = request
+      }
+      if (this.workContext) {
+        const contextLists = [
+          this.workContext.ownRequests,
+          this.workContext.recentRequests,
+        ]
+        for (const list of contextLists) {
+          const index = list.findIndex((item) => item.id === request.id)
+          if (index >= 0) list[index] = request
+        }
+      }
+    },
+    resetRequest(): void {
+      this.request = null
+      this.requestError = ''
+    },
+    resetDeviceScope(): void {
+      this.deviceScopeVersion += 1
+      this.customerUnreadCount = 0
+      this.myRequests = []
+      this.myRequestsError = ''
+      this.myRequestsLoaded = false
+      this.myRequestsLoading = false
+      this.myRequestsLoadingMore = false
+      this.myRequestsNextCursor = null
+      this.request = null
+      this.requestError = ''
+      this.requestLoading = false
+    },
+  },
+})
diff --git a/frontend/src/stores/notifications.test.ts b/frontend/src/stores/notifications.test.ts
index 86b8578..e38b885 100644
--- a/frontend/src/stores/notifications.test.ts
+++ b/frontend/src/stores/notifications.test.ts
@@ -145,10 +145,11 @@ describe('notifications store', () => {
     const notifications = useNotificationsStore()
 
     notifications.show({
-      appId: 'mail',
+      appId: 'companies',
       device: device('111'),
+      route: '/apps/companies?requestId=request-1&area=customer',
       text: 'Store while closed',
-      title: 'Mail',
+      title: 'Companies',
     })
     await Promise.resolve()
     await Promise.resolve()
@@ -158,9 +159,10 @@ describe('notifications store', () => {
       payload: {
         items: [
           expect.objectContaining({
-            appId: 'mail',
+            appId: 'companies',
+            route: '/apps/companies?requestId=request-1&area=customer',
             text: 'Store while closed',
-            title: 'Mail',
+            title: 'Companies',
           }),
         ],
         version: 1,
@@ -247,10 +249,7 @@ describe('notifications store', () => {
     })
     const notifications = useNotificationsStore()
 
-    notifications.hydrate(
-      phone.device?.data.notifications?.payload,
-      '111',
-    )
+    notifications.hydrate(phone.device?.data.notifications?.payload, '111')
     vi.advanceTimersByTime(60_000)
 
     expect(notifications.lockScreenNotifications[0].text).toBe('Saved message')
diff --git a/frontend/src/stores/notifications.ts b/frontend/src/stores/notifications.ts
index d92ddfc..1487a2c 100644
--- a/frontend/src/stores/notifications.ts
+++ b/frontend/src/stores/notifications.ts
@@ -5,7 +5,10 @@ import { isPhoneAppId } from '@/config/apps'
 import { usePhoneStore } from '@/stores/phone'
 import type { LaunchablePhoneAppId } from '@/types/apps'
 import { nuiCall } from '@/utils/nui'
-import type { PhonePreferencesV1 } from '@/utils/preferences'
+import {
+  DEFAULT_APP_NOTIFICATION_PREFERENCES,
+  type PhonePreferencesV1,
+} from '@/utils/preferences'
 import { playPhoneTone, type PhoneToneId } from '@/utils/tones'
 
 export type PhoneNotificationDevice = {
@@ -19,6 +22,7 @@ export type PhoneNotificationInput = {
   critical?: boolean
   device?: PhoneNotificationDevice
   persistent?: boolean
+  route?: string
   sound?: PhoneToneId
   subtitle?: string
   text: string
@@ -31,7 +35,7 @@ export type PhoneNotification = PhoneNotificationInput & {
 
 type PersistedPhoneNotification = Pick<
   PhoneNotification,
-  'appId' | 'id' | 'subtitle' | 'text' | 'title'
+  'appId' | 'id' | 'route' | 'subtitle' | 'text' | 'title'
 >
 
 type PersistedNotificationsV1 = {
@@ -73,9 +77,10 @@ export const useNotificationsStore = defineStore('notifications', () => {
 
   function persist(imei: string): void {
     const items = (lockScreenQueues.value[imei] ?? []).map(
-      ({ appId, id, subtitle, text, title }) => ({
+      ({ appId, id, route, subtitle, text, title }) => ({
         appId,
         id,
+        ...(route ? { route } : {}),
         ...(subtitle ? { subtitle } : {}),
         text,
         title,
@@ -108,7 +113,9 @@ export const useNotificationsStore = defineStore('notifications', () => {
         (payload as Partial<PersistedNotificationsV1>).version !== 1 ||
         !Array.isArray((payload as Partial<PersistedNotificationsV1>).items)
       ) {
-        console.error('[Phone notifications] Invalid persisted notification data.')
+        console.error(
+          '[Phone notifications] Invalid persisted notification data.',
+        )
       } else {
         for (const item of (payload as PersistedNotificationsV1).items) {
           if (
@@ -117,14 +124,21 @@ export const useNotificationsStore = defineStore('notifications', () => {
             !isPhoneAppId(item.appId) ||
             typeof item?.text !== 'string' ||
             typeof item?.title !== 'string' ||
+            (item.route !== undefined &&
+              (typeof item.route !== 'string' ||
+                (item.route !== `/apps/${item.appId}` &&
+                  !item.route.startsWith(`/apps/${item.appId}?`)))) ||
             (item.subtitle !== undefined && typeof item.subtitle !== 'string')
           ) {
-            console.error('[Phone notifications] Ignored an invalid persisted notification.')
+            console.error(
+              '[Phone notifications] Ignored an invalid persisted notification.',
+            )
             continue
           }
           stored.push({
             appId: item.appId,
             id: item.id,
+            ...(item.route ? { route: item.route } : {}),
             ...(item.subtitle ? { subtitle: item.subtitle } : {}),
             text: item.text,
             title: item.title,
@@ -161,7 +175,8 @@ export const useNotificationsStore = defineStore('notifications', () => {
   function activate(notification: PhoneNotification): void {
     const preferences = notification.device?.preferences ?? phone.preferences
     const appPreferences =
-      preferences.settings.notifications[notification.appId]
+      preferences.settings.notifications[notification.appId] ??
+      DEFAULT_APP_NOTIFICATION_PREFERENCES
     if (appPreferences.sounds || notification.critical) {
       const sound = notification.sound ?? preferences.settings.notificationSound
       const volume = notification.critical
@@ -218,15 +233,19 @@ export const useNotificationsStore = defineStore('notifications', () => {
     if (current.value) dismiss(current.value.id)
   }
 
-  function dismissFromLockScreen(id: string): void {
+  function dismissFromLockScreen(
+    id: string,
+    targetImei = phone.device?.imei,
+  ): void {
     dismiss(id)
-    const imei = phone.device?.imei
-    if (!imei) return
-    const notifications = lockScreenQueues.value[imei]
+    if (!targetImei) return
+    const notifications = lockScreenQueues.value[targetImei]
     if (!notifications) return
-    const index = notifications.findIndex((notification) => notification.id === id)
+    const index = notifications.findIndex(
+      (notification) => notification.id === id,
+    )
     if (index >= 0) notifications.splice(index, 1)
-    persist(imei)
+    persist(targetImei)
   }
 
   function clearLockScreen(): void {
@@ -248,12 +267,14 @@ export const useNotificationsStore = defineStore('notifications', () => {
   }
 
   function show(input: PhoneNotificationInput): string | null {
-    const preferences = input.device?.preferences ?? phone.preferences
-    const appPreferences = preferences.settings.notifications[input.appId]
-    if (!appPreferences) {
+    if (!isPhoneAppId(input.appId)) {
       console.error(`[Phone notifications] Unknown app: ${input.appId}`)
       return null
     }
+    const preferences = input.device?.preferences ?? phone.preferences
+    const appPreferences =
+      preferences.settings.notifications[input.appId] ??
+      DEFAULT_APP_NOTIFICATION_PREFERENCES
     if (!input.critical && preferences.settings.focusMode) return null
     if (!input.critical && !appPreferences.enabled) {
       return null
diff --git a/frontend/src/stores/phone.ts b/frontend/src/stores/phone.ts
index e9288b9..94c0a6b 100644
--- a/frontend/src/stores/phone.ts
+++ b/frontend/src/stores/phone.ts
@@ -12,6 +12,7 @@ import { nuiCall } from '@/utils/nui'
 import type { NuiResponse } from '@/utils/nui'
 import {
   DEFAULT_PHONE_PREFERENCES,
+  ensureAppNotificationPreferences,
   parsePhonePreferences,
   type AppNotificationPreferences,
   type PhonePreferencesV1,
@@ -38,8 +39,314 @@ export type PhoneOpenPayload = {
 
 const namespaceQueues = new Map<string, Promise<void>>()
 
+const companiesFallbackLocales = {
+  name: 'Companies',
+  navigation: 'Companies navigation',
+  actions: 'Request actions',
+  request: 'Service Request',
+  verified: 'Verified company',
+  back: 'Back',
+  close: 'Close',
+  tryAgain: 'Try Again',
+  loadMore: 'Load More',
+  routeSet: 'GPS route set.',
+  tabs: {
+    directory: 'Discover',
+    requests: 'Requests',
+    work: 'Work',
+  },
+  availability: {
+    available: 'Available',
+    busy: 'Busy',
+    closed: 'Closed',
+  },
+  requestStatuses: {
+    new: 'New',
+    assigned: 'Assigned',
+    in_progress: 'In Progress',
+    waiting_customer: 'Waiting',
+    completed: 'Completed',
+    cancelled: 'Cancelled',
+  },
+  roles: {
+    employee: 'Employee',
+    manager: 'Manager',
+  },
+  categories: {
+    gastronomy: 'Food & Drink',
+    vehicles: 'Vehicles',
+    transport: 'Transport',
+    crafts: 'Trades',
+    retail: 'Retail',
+    real_estate: 'Real Estate',
+    media: 'Media',
+    nightlife: 'Nightlife',
+    public_services: 'Public Services',
+    emergency: 'Emergency Services',
+    medical: 'Medical',
+    mechanics: 'Mechanics',
+    government: 'Government',
+  },
+  days: {
+    monday: 'Monday',
+    tuesday: 'Tuesday',
+    wednesday: 'Wednesday',
+    thursday: 'Thursday',
+    friday: 'Friday',
+    saturday: 'Saturday',
+    sunday: 'Sunday',
+  },
+  directory: {
+    searchPlaceholder: 'Search companies or services',
+    categories: 'Company categories',
+    allCategories: 'All',
+    allCompanies: 'All Companies',
+    availableNow: 'Available now',
+    availableNowHint: 'Only show companies taking calls right now.',
+    availableSection: 'Available Now',
+    moreFilters: 'More filters',
+    hasLocation: 'Location',
+    acceptsRequests: 'Requests',
+    resetFilters: 'Reset Filters',
+  },
+  loading: {
+    directory: 'Loading companies...',
+    profile: 'Loading company profile...',
+    request: 'Loading request...',
+    requests: 'Loading your requests...',
+    work: 'Loading workspace...',
+  },
+  states: {
+    directoryError: 'Companies are unavailable',
+    requestsError: 'Requests are unavailable',
+    workError: 'Workspace unavailable',
+    profileError: 'Company unavailable',
+    requestError: 'Request unavailable',
+    noCompanies: 'No companies listed',
+    noCompaniesBody: 'Public companies will appear here when configured.',
+    noResults: 'No matching companies',
+    noResultsBody: 'Try another search or reset your filters.',
+    noOpenRequests: 'No open requests',
+    noClosedRequests: 'No completed requests',
+    noRequestsBody: 'Requests you create with a company will appear here.',
+  },
+  actionUnavailable: {
+    call: 'This company cannot be called right now.',
+    message: 'This service line does not accept text messages.',
+    route: 'This company has no public location.',
+    request: 'This company is not accepting service requests.',
+  },
+  profile: {
+    updated: 'Status updated {time}',
+    announcement: 'Latest Update',
+    location: 'Location',
+    noLocation: 'No public location',
+    hours: 'Opening Hours',
+    closed: 'Closed',
+    byAvailability: 'Open by availability',
+    services: 'Services',
+    noServices: 'No public services listed',
+    call: 'Call',
+    message: 'Message',
+    route: 'Route',
+    request: 'Request',
+  },
+  composer: {
+    title: 'New Service Request',
+    chooseService: 'Choose a Service',
+    subject: 'Subject',
+    subjectPlaceholder: 'What do you need?',
+    description: 'Details',
+    descriptionPlaceholder:
+      'Describe what happened and how the company can help.',
+    contact: 'Contact number',
+    registeredSim: 'Replies go to your registered SIM {number}.',
+    registeredSimRequired: 'A registered SIM is required to send a request.',
+    addPhotos: 'Add Photos ({count}/3)',
+    selectedPhoto: 'Selected request photo',
+    removePhoto: 'Remove photo',
+    review: 'Review Request',
+    confirmTitle: 'Send this request?',
+    confirmBody: 'Send your {service} request to {company}.',
+    edit: 'Keep Editing',
+    send: 'Send Request',
+  },
+  requests: {
+    open: 'Open',
+    closed: 'Completed',
+    findCompany: 'Find a Company',
+    generalService: 'General service',
+    attachments: 'Request photos',
+    attachedPhoto: 'Attached request photo',
+    timeline: 'Timeline',
+    conversation: 'Conversation',
+    noMessages: 'No replies yet',
+    replyPlaceholder: 'Write a reply',
+    sendReply: 'Send reply',
+    call: 'Call Company',
+    cancel: 'Cancel Request',
+    cancelTitle: 'Cancel this request?',
+    cancelBody: 'The company will be notified and can no longer complete it.',
+    keep: 'Keep Request',
+    cancelConfirm: 'Cancel Request',
+  },
+  timeline: {
+    created: 'Request created',
+    assigned: 'Request assigned',
+    cancelled: 'Request cancelled',
+    completed: 'Request completed',
+    statusChanged: 'Status changed to {status}',
+  },
+  time: {
+    justNow: 'just now',
+    minutesAgo: '{count} min ago',
+    hoursAgo: '{count} hr ago',
+    daysAgo: '{count} days ago',
+  },
+  work: {
+    notAuthorized: 'No company workspace',
+    notAuthorizedBody:
+      'Your current job is not connected to a configured company.',
+    workspace: 'Company Workspace',
+    publicAvailability: 'Public Availability',
+    takeCalls: 'Take company calls',
+    takeCallsBody: 'Route new service-line calls to this active SIM.',
+    overview: 'Today at a Glance',
+    metrics: {
+      new: 'New',
+      assigned: 'Mine',
+      waiting: 'Waiting',
+      completedToday: 'Done Today',
+    },
+    queue: 'Request Queue',
+    filters: {
+      new: 'New',
+      assigned: 'Mine',
+      in_progress: 'In Progress',
+      waiting_customer: 'Waiting',
+      completed: 'Done',
+    },
+    unassigned: 'Unassigned',
+    emptyQueue: 'Queue is clear',
+    emptyQueueBody: 'No requests match this filter.',
+  },
+  workActions: {
+    claim: 'Claim Request',
+    assign: 'Assign Employee',
+    callCustomer: 'Call Customer',
+    setStatus: 'Set status: {status}',
+  },
+  assignment: {
+    title: 'Assign Employee',
+    online: 'Online',
+    offline: 'Offline',
+    unknownMember: 'Unknown employee',
+    confirm: 'Assign Request',
+  },
+  assignmentLabels: {
+    you: 'Assigned to you',
+    assigned: 'Assigned to a colleague',
+  },
+  messageAuthors: {
+    you: 'You',
+    customer: 'Customer',
+    company: 'Company',
+  },
+  manager: {
+    title: 'Company Profile',
+    subtitle: 'Manage public information, services, and announcements.',
+    revision: 'Server revision {revision}',
+    availability: 'Availability',
+    profile: 'Public Profile',
+    description: 'Description',
+    descriptionPlaceholder: 'Describe the company and what it offers.',
+    phoneNumber: 'Service number',
+    phoneNumberManaged: 'Configured by the server and cannot be edited here.',
+    noPhoneNumber: 'No service number configured',
+    chooseCover: 'Choose cover photo',
+    chooseLogo: 'Choose logo',
+    coverPhoto: 'Company cover photo',
+    logoPhoto: 'Company logo',
+    locationLabel: 'Location name',
+    locationReady: 'A map position is attached to this profile.',
+    useCurrentLocation: 'Use Current Location',
+    address: 'Address',
+    district: 'District',
+    acceptRequests: 'Accept service requests',
+    acceptRequestsBody: 'Allow registered SIMs to open structured requests.',
+    saveProfile: 'Save Profile',
+    hours: 'Opening Hours',
+    dayOpen: 'Company is open on this day',
+    opensAt: 'Opens',
+    closesAt: 'Closes',
+    saveHours: 'Save Hours',
+    services: 'Services',
+    serviceTitle: 'Service name',
+    serviceDescription: 'Description',
+    priceText: 'Price text',
+    serviceActive: 'Publicly visible',
+    serviceRequests: 'Accept requests for this service',
+    removeService: 'Remove Service',
+    addService: 'Add Service',
+    saveServices: 'Save Services',
+    announcement: 'Current Announcement',
+    announcementText: 'Announcement',
+    announcementPlaceholder: 'Share a short, timely update.',
+    expiresAt: 'Expires at',
+    publish: 'Publish Announcement',
+  },
+  feedback: {
+    requestCreated: 'Request sent.',
+    requestCancelled: 'Request cancelled.',
+    requestClaimed: 'Request claimed.',
+    requestAssigned: 'Request assigned.',
+    statusUpdated: 'Request status updated.',
+    availabilityUpdated: 'Public availability updated.',
+    locationUpdated: 'Current location selected.',
+    callsEnabled: 'Company calls enabled.',
+    callsDisabled: 'Company calls disabled.',
+    profileSaved: 'Company profile saved.',
+    hoursSaved: 'Opening hours saved.',
+    servicesSaved: 'Services saved.',
+    announcementPublished: 'Announcement published.',
+  },
+  conflict: {
+    title: 'Newer changes are available',
+    body: 'Another manager updated this information. Reload before saving again.',
+    reload: 'Reload',
+  },
+  notifications: {
+    newRequest: 'New company request',
+    requestUpdated: 'A company request was updated.',
+    newMessage: 'New reply to your company request.',
+    assigned: 'A company request was assigned to you.',
+  },
+  errors: {
+    anonymous_sim: 'A registered SIM is required for service requests.',
+    call_unavailable: 'This service line is currently unavailable.',
+    company_not_found: 'This company is no longer available.',
+    invalid_profile: 'Check the company profile fields.',
+    invalid_request: 'Check the subject and request details.',
+    invalid_media: 'One or more attached photos are unavailable.',
+    invalid_expiration: 'Choose a valid announcement expiration.',
+    invalid_service: 'This service is no longer available.',
+    invalid_status: 'That status change is not allowed.',
+    messaging_unavailable: 'This company does not accept text messages.',
+    no_sim: 'Insert a SIM card to continue.',
+    not_authorized: 'You are not authorized for this company action.',
+    rate_limited: 'Please wait before trying again.',
+    request_not_found: 'This request is no longer available.',
+    revision_conflict:
+      'The data changed on another device. Reload and try again.',
+    service_unavailable: 'The Companies service is temporarily unavailable.',
+    too_many_open_requests: 'You already have too many open requests.',
+    request_failed: 'Companies could not complete the request.',
+  },
+}
+
 const defaultLocales: LocaleTree = {
   Apps: {
+    companies: companiesFallbackLocales,
     crewlink: {
       name: 'CrewLink',
       connecting: 'Connecting your crew...',
@@ -62,8 +369,7 @@ const defaultLocales: LocaleTree = {
       noGroupBody:
         'Create a crew or join friends with a private invitation code.',
       createGroup: 'Create Group',
-      createGroupBody:
-        'Give your crew a recognizable name and signal colour.',
+      createGroupBody: 'Give your crew a recognizable name and signal colour.',
       joinGroup: 'Join Group',
       joinWithCode: 'Join with Code',
       joinWithCodeBody:
@@ -114,8 +420,7 @@ const defaultLocales: LocaleTree = {
       invite: 'Invite',
       inviteSent: 'Invitation sent to @{username}.',
       nobodyNearby: 'Nobody in range',
-      nobodyNearbyBody:
-        'Move closer to another CrewLink user and scan again.',
+      nobodyNearbyBody: 'Move closer to another CrewLink user and scan again.',
       scanAgain: 'Scan Again',
       liveCoordination: 'Live coordination',
       noPings: 'No active pings',
@@ -1066,6 +1371,8 @@ const defaultLocales: LocaleTree = {
       message: 'Message',
       send: 'Send',
       details: 'Details',
+      officialContact: 'Official company contact',
+      messagingUnavailable: 'This company contact does not accept messages.',
       filterUnread: 'Show Unread Messages',
       smsLabel: 'Text Message · SMS',
       photo: 'Photo',
@@ -1135,6 +1442,7 @@ const defaultLocales: LocaleTree = {
         gif_provider_failed: 'GIF search is temporarily unavailable.',
         self_message: 'You cannot message your own number.',
         recipient_not_found: 'That number is unavailable.',
+        messaging_unavailable: 'This company contact does not accept messages.',
         no_sim: 'This phone has no SIM card.',
         rate_limited: 'Too many messages. Try again in a minute.',
         request_failed: 'Messages are temporarily unavailable.',
@@ -1170,6 +1478,7 @@ const defaultLocales: LocaleTree = {
       editContact: 'Edit Contact',
       contactName: 'Name',
       phoneNumber: 'Phone Number',
+      officialContact: 'Official company contact',
       call: 'Call',
       calling: 'calling...',
       incoming: 'Incoming Call',
@@ -1198,10 +1507,13 @@ const defaultLocales: LocaleTree = {
       errors: {
         invalid_contact: 'Enter a name and valid phone number.',
         invalid_number: 'Enter a valid phone number.',
+        invalid_sim: 'The active SIM card is unavailable.',
         no_sim: 'This phone has no SIM card.',
         airplane_mode: 'Turn off Airplane Mode to make calls.',
         self_call: 'You cannot call your own number.',
         busy: 'The line is busy.',
+        company_unavailable: 'This company service line is unavailable.',
+        readonly_contact: 'Official company contacts cannot be changed.',
         rate_limited: 'Too many calls. Try again in a minute.',
         voice_unavailable: 'The configured phone voice service is unavailable.',
         inventory_full: 'There is no room for the ejected SIM card.',
@@ -2973,7 +3285,11 @@ const defaultLocales: LocaleTree = {
     stop: 'Stop',
     use: 'Use',
   },
-  Notifications: { now: 'now' },
+  Notifications: {
+    clearAll: 'Clear All',
+    now: 'now',
+    open: 'Open notification',
+  },
   LockScreen: {
     label: 'Lock Screen',
     flashlight: 'Flashlight',
@@ -3173,6 +3489,9 @@ export const usePhoneStore = defineStore('phone', {
     setLaunchOrigin(origin: AppLaunchOrigin | null): void {
       this.launchOrigin = origin
     },
+    ensureAppNotificationPreferences(appIds: LaunchablePhoneAppId[]): void {
+      ensureAppNotificationPreferences(this.preferences, appIds)
+    },
     setAppNotification(
       appId: LaunchablePhoneAppId,
       key: keyof AppNotificationPreferences,
diff --git a/frontend/src/types/apps.ts b/frontend/src/types/apps.ts
index 6483166..a21a28d 100644
--- a/frontend/src/types/apps.ts
+++ b/frontend/src/types/apps.ts
@@ -1,6 +1,6 @@
 import type { Component } from 'vue'
 
-export type PhoneAppId =
+export type BuiltinPhoneAppId =
   | 'phone'
   | 'messages'
   | 'darkchat'
@@ -36,7 +36,15 @@ export type PhoneAppId =
   | 'skyride'
   | 'feather'
   | 'crewlink'
+  | 'companies'
 
+declare const externalPhoneAppId: unique symbol
+
+export type ExternalPhoneAppId = string & {
+  readonly [externalPhoneAppId]: true
+}
+
+export type PhoneAppId = BuiltinPhoneAppId | ExternalPhoneAppId
 export type LaunchablePhoneAppId = PhoneAppId
 
 export type PhoneAppCategory =
@@ -54,21 +62,107 @@ export type AppLaunchOrigin = {
   y: number
 }
 
-export type PhoneAppDefinition = {
+type PhoneAppDefinitionBase = {
   category: PhoneAppCategory
-  component: Component | null
   dockOrder: number | null
   gridOrder: number
   icon: Component
   iconClass: string
   iconImage: string
-  id: PhoneAppId
-  labelKey: string
-  route: `/apps/${LaunchablePhoneAppId}` | null
 }
 
-export type LaunchablePhoneAppDefinition = PhoneAppDefinition & {
+export type BuiltinPhoneAppDefinition = PhoneAppDefinitionBase & {
   component: Component
-  id: LaunchablePhoneAppId
-  route: `/apps/${LaunchablePhoneAppId}`
+  id: BuiltinPhoneAppId
+  kind?: 'builtin'
+  labelKey: string
+  route: `/apps/${BuiltinPhoneAppId}`
+}
+
+export type CustomAppBridgeMode = 'legacy' | 'sky'
+
+export type ExternalPhoneAppDefinition = PhoneAppDefinitionBase & {
+  bridgeMode: CustomAppBridgeMode
+  bundled: boolean
+  capabilities: string[]
+  compatibility: Record<string, unknown>
+  component: null
+  defaultInstalled: boolean
+  description: string
+  developer: string
+  iconBackground?: string
+  id: ExternalPhoneAppId
+  kind: 'external'
+  name: string
+  orientation: 'landscape' | 'portrait'
+  ownerResource: string
+  readyTimeoutMs: number
+  removable: boolean
+  route: `/apps/${ExternalPhoneAppId}`
+  ui: string
+}
+
+export type PhoneAppDefinition =
+  | BuiltinPhoneAppDefinition
+  | ExternalPhoneAppDefinition
+
+export type LaunchablePhoneAppDefinition = PhoneAppDefinition
+
+export type CustomAppCatalogPayload = {
+  apps: unknown[]
+}
+
+export type CustomAppHostMessage = {
+  payload: unknown
+  sequence: number
+}
+
+export type CustomAppOpenRequest = {
+  data?: unknown
+  sequence: number
+}
+
+export type SkyPhoneAppCapability =
+  | 'app.close'
+  | 'app.open'
+  | 'device.storage.get'
+  | 'device.storage.set'
+  | 'locale.read'
+  | 'notification.create'
+  | 'theme.read'
+
+export type SkyPhoneAppBridgeMethod =
+  | 'app.close'
+  | 'app.open'
+  | 'device.storage.get'
+  | 'device.storage.set'
+  | 'notification.create'
+
+export type SkyPhoneAppBridgeRequest = {
+  method: string
+  payload?: unknown
+  requestId: string
+}
+
+export type SkyPhoneAppBridgeResponse = {
+  data?: unknown
+  error?: string
+  requestId: string
+  success: boolean
+}
+
+export type SkyPhoneAppContextV1 = {
+  appId: string
+  capabilities: SkyPhoneAppCapability[]
+  colorScheme: 'dark' | 'light'
+  language: string
+  locale: Record<string, unknown>
+  phoneScale: number
+  protocolVersion: 1
+  safeArea: {
+    bottom: number
+    left: number
+    right: number
+    top: number
+  }
 }
diff --git a/frontend/src/types/companies.ts b/frontend/src/types/companies.ts
new file mode 100644
index 0000000..4807571
--- /dev/null
+++ b/frontend/src/types/companies.ts
@@ -0,0 +1,271 @@
+export type CompanyAvailability = 'available' | 'busy' | 'closed'
+
+export type CompanyDirectorySort = 'name' | 'relevance' | 'updated'
+
+export type CompanyRequestList = 'closed' | 'open'
+
+export type CompanyRequestStatus =
+  | 'assigned'
+  | 'cancelled'
+  | 'completed'
+  | 'in_progress'
+  | 'new'
+  | 'waiting_customer'
+
+export type CompanyWorkFilter =
+  | 'assigned'
+  | 'completed'
+  | 'in_progress'
+  | 'new'
+  | 'waiting_customer'
+
+export type CompanyRequestEventType =
+  | 'assigned'
+  | 'cancelled'
+  | 'completed'
+  | 'created'
+  | 'status_changed'
+
+export type CompanyCategory = {
+  id: string
+  name: string
+}
+
+export type CompanyCoordinates = {
+  x: number
+  y: number
+  z: number
+}
+
+export type CompanyLocation = {
+  address: string
+  coords: CompanyCoordinates
+  district: string
+  label: string
+}
+
+export type CompanyAnnouncement = {
+  body: string
+  expiresAt: string | null
+  publishedAt: string
+}
+
+export type CompanyService = {
+  acceptsRequests: boolean
+  active: boolean
+  description: string
+  id: string
+  priceText: string | null
+  title: string
+}
+
+export type CompanyHours = {
+  closesAt: string | null
+  day: number
+  isClosed: boolean
+  opensAt: string | null
+}
+
+export type CompanySummary = {
+  acceptsRequests: boolean
+  announcement: CompanyAnnouncement | null
+  availability: CompanyAvailability
+  availabilityUpdatedAt: string
+  canCall: boolean
+  canMessage: boolean
+  categoryId: string
+  categoryName: string
+  description: string
+  id: string
+  location: CompanyLocation | null
+  logoUrl: string | null
+  name: string
+  phoneNumber: string | null
+  serviceSummary: string
+  verified: boolean
+}
+
+export type Company = CompanySummary & {
+  coverUrl: string | null
+  hours: CompanyHours[]
+  revision: number
+  services: CompanyService[]
+}
+
+export type CompanyDirectoryFilters = {
+  acceptsRequests: boolean
+  availability: CompanyAvailability | null
+  categoryId: string | null
+  hasLocation: boolean
+  search: string
+  sort: CompanyDirectorySort
+}
+
+export type CompanyDirectoryPage = {
+  categories: CompanyCategory[]
+  companies: CompanySummary[]
+  nextCursor: string | null
+}
+
+export type CompanyRequestActions = {
+  allowedStatuses: CompanyRequestStatus[]
+  canAssign: boolean
+  canCall: boolean
+  canCancel: boolean
+  canClaim: boolean
+  canReply: boolean
+}
+
+export type CompanyRequestSummary = {
+  assignedLabel: 'assigned' | 'you' | null
+  companyId: string
+  companyLogoUrl: string | null
+  companyName: string
+  createdAt: string
+  id: string
+  serviceId: string | null
+  serviceName: string | null
+  status: CompanyRequestStatus
+  subject: string
+  unreadCount: number
+  updatedAt: string
+}
+
+export type CompanyRequestMessage = {
+  author: 'company' | 'customer'
+  authorLabel: 'company' | 'customer' | 'you'
+  body: string
+  createdAt: string
+  id: string
+  isMine: boolean
+}
+
+export type CompanyRequestMedia = {
+  id: number
+  url: string
+}
+
+export type CompanyRequestEvent = {
+  createdAt: string
+  id: string
+  status: CompanyRequestStatus | null
+  type: CompanyRequestEventType
+}
+
+export type CompanyRequest = CompanyRequestSummary & {
+  actions: CompanyRequestActions
+  description: string
+  events: CompanyRequestEvent[]
+  media: CompanyRequestMedia[]
+  messages: CompanyRequestMessage[]
+  phoneNumber: string | null
+  revision: number
+}
+
+export type CompanyRequestPage = {
+  nextCursor: string | null
+  requests: CompanyRequestSummary[]
+  unreadCount: number
+}
+
+export type CompanyWorkMetrics = {
+  assigned: number
+  completedToday: number
+  new: number
+  waiting: number
+}
+
+export type CompanyWorkPermissions = {
+  canAssign: boolean
+  canManageAnnouncement: boolean
+  canManageHours: boolean
+  canManageProfile: boolean
+  canManageServices: boolean
+  canSetAvailability: boolean
+  canTakeCalls: boolean
+}
+
+export type CompanyWorkContext = {
+  authorized: boolean
+  callAvailable: boolean
+  company: Company | null
+  metrics: CompanyWorkMetrics
+  ownRequests: CompanyRequestSummary[]
+  permissions: CompanyWorkPermissions
+  recentRequests: CompanyRequestSummary[]
+  role: 'employee' | 'manager' | null
+  unreadCount: number
+}
+
+export type CompanyWorkQueuePage = {
+  nextCursor: string | null
+  requests: CompanyRequestSummary[]
+}
+
+export type CompanyMember = {
+  id: string
+  name: string
+  online: boolean
+  role: string
+}
+
+export type CompanyMembersResult = {
+  members: CompanyMember[]
+}
+
+export type CreateCompanyRequest = {
+  companyId: string
+  description: string
+  mediaIds: string[]
+  serviceId: string
+  subject: string
+}
+
+export type CompanyRequestMutationResult = {
+  context?: CompanyWorkContext
+  request: CompanyRequest
+}
+
+export type CompanyMutationResult = {
+  company: Company
+  context?: CompanyWorkContext
+}
+
+export type UpdateCompanyProfile = {
+  acceptsRequests: boolean
+  address: string
+  coords?: CompanyCoordinates
+  coverMediaId?: number
+  description: string
+  district: string
+  logoMediaId?: number
+  locationLabel: string
+  revision: number
+}
+
+export type UpdateCompanyHours = {
+  hours: CompanyHours[]
+  revision: number
+}
+
+export type UpdateCompanyServices = {
+  revision: number
+  services: CompanyService[]
+}
+
+export type PublishCompanyAnnouncement = {
+  body: string
+  expiresAt: string | null
+  revision: number
+}
+
+export type CompanyUnreadCounts = {
+  customer?: number
+  work?: number
+}
+
+export type CompanyChangedPayload = {
+  area: 'all' | 'customer' | 'directory' | 'work'
+  companyId?: string
+  requestId?: string
+}
diff --git a/frontend/src/types/phone.ts b/frontend/src/types/phone.ts
index d0ffa84..c445a23 100644
--- a/frontend/src/types/phone.ts
+++ b/frontend/src/types/phone.ts
@@ -8,11 +8,18 @@ export type PhoneSim = {
 }
 
 export type PhoneContact = {
+  canCall?: boolean
+  canMessage?: boolean
+  companyId?: string
   created_at?: string
   id: string
+  icon?: string
   name: string
   phone_number: string
+  readonly?: boolean
+  source?: 'personal' | 'company'
   updated_at?: string
+  verified?: boolean
 }
 
 export type CallDirection = 'incoming' | 'outgoing'
diff --git a/frontend/src/utils/customAppBridge.test.ts b/frontend/src/utils/customAppBridge.test.ts
new file mode 100644
index 0000000..db1a77d
--- /dev/null
+++ b/frontend/src/utils/customAppBridge.test.ts
@@ -0,0 +1,268 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import {
+  createCustomAppBridgeRequestHandler,
+  getSkyPhoneAppCapabilities,
+  shouldReportCustomAppReady,
+  type CustomAppBridgeNotification,
+  type CustomAppBridgeTarget,
+} from '@/utils/customAppBridge'
+
+const source = {
+  capabilities: [] as string[],
+  id: 'source-app',
+}
+const createNotification =
+  vi.fn<(input: CustomAppBridgeNotification) => string | null>()
+const prepareExternalOpen = vi.fn<(appId: string, data?: unknown) => boolean>()
+const resolveTarget = vi.fn<(appId: string) => CustomAppBridgeTarget | null>()
+const storageCall = vi.fn()
+
+function createHandler() {
+  return createCustomAppBridgeRequestHandler({
+    createNotification,
+    getSourceApp: () => source,
+    prepareExternalOpen,
+    resolveTarget,
+    storageCall,
+  })
+}
+
+describe('custom app bridge', () => {
+  beforeEach(() => {
+    source.capabilities = []
+    createNotification.mockReset().mockReturnValue('notification-1')
+    prepareExternalOpen.mockReset().mockReturnValue(true)
+    resolveTarget.mockReset().mockReturnValue(null)
+    storageCall.mockReset().mockResolvedValue({ success: true })
+  })
+
+  it('advertises only implemented methods granted by manifest permissions', () => {
+    expect(
+      getSkyPhoneAppCapabilities([
+        'app.close',
+        'device.storage',
+        'notifications',
+        'location.read',
+      ]),
+    ).toEqual([
+      'app.close',
+      'device.storage.get',
+      'device.storage.set',
+      'notification.create',
+    ])
+  })
+
+  it('reports ready lifecycle from load only for legacy frames', () => {
+    expect(shouldReportCustomAppReady('legacy', 'frame-load')).toBe(true)
+    expect(shouldReportCustomAppReady('legacy', 'bridge-ready')).toBe(false)
+    expect(shouldReportCustomAppReady('sky', 'frame-load')).toBe(false)
+    expect(shouldReportCustomAppReady('sky', 'bridge-ready')).toBe(true)
+  })
+
+  it('passes validated storage data and server response data through', async () => {
+    source.capabilities = ['device.storage']
+    storageCall.mockResolvedValue({
+      data: { exists: true, revision: 4, value: { enabled: true } },
+      success: true,
+    })
+    const handler = createHandler()
+
+    const result = await handler.handle({
+      method: 'device.storage.get',
+      payload: { key: 'settings.main' },
+      requestId: 'storage-get',
+    })
+
+    expect(storageCall).toHaveBeenCalledWith('custom-app:storage:get', {
+      appId: 'source-app',
+      key: 'settings.main',
+    })
+    expect(result?.response).toEqual({
+      data: { exists: true, revision: 4, value: { enabled: true } },
+      requestId: 'storage-get',
+      success: true,
+    })
+  })
+
+  it('validates storage writes and deduplicates request ids', async () => {
+    source.capabilities = ['device.storage']
+    const handler = createHandler()
+    const request = {
+      method: 'device.storage.set',
+      payload: { key: 'profile', revision: 2, value: { color: 'blue' } },
+      requestId: 'storage-set',
+    }
+
+    const first = await handler.handle(request)
+    const duplicate = await handler.handle(request)
+    const invalid = await handler.handle({
+      method: 'device.storage.set',
+      payload: { key: '../profile', revision: -1, value: Number.NaN },
+      requestId: 'storage-invalid',
+    })
+
+    expect(first?.response.success).toBe(true)
+    expect(duplicate).toBeNull()
+    expect(invalid?.response).toMatchObject({
+      error: 'invalid_storage_request',
+      success: false,
+    })
+    expect(storageCall).toHaveBeenCalledWith('custom-app:storage:set', {
+      appId: 'source-app',
+      key: 'profile',
+      revision: 2,
+      value: { color: 'blue' },
+    })
+    expect(storageCall).toHaveBeenCalledOnce()
+  })
+
+  it('bounds the request-id deduplication window', async () => {
+    const handler = createHandler()
+    const first = await handler.handle({
+      method: 'unknown',
+      requestId: 'oldest-request',
+    })
+    for (let index = 0; index < 512; index += 1) {
+      await handler.handle({
+        method: 'unknown',
+        requestId: `request-${index}`,
+      })
+    }
+    const afterEviction = await handler.handle({
+      method: 'unknown',
+      requestId: 'oldest-request',
+    })
+
+    expect(first?.response.error).toBe('unsupported_method')
+    expect(afterEviction?.response.error).toBe('unsupported_method')
+  })
+
+  it('requires storage and close permissions', async () => {
+    const handler = createHandler()
+
+    const storage = await handler.handle({
+      method: 'device.storage.get',
+      payload: { key: 'profile' },
+      requestId: 'denied-storage',
+    })
+    const close = await handler.handle({
+      method: 'app.close',
+      requestId: 'denied-close',
+    })
+
+    expect(storage?.response.error).toBe('permission_denied')
+    expect(close?.response.error).toBe('permission_denied')
+    expect(close?.effect).toBeUndefined()
+  })
+
+  it('creates a small text-only notification routed to its own app', async () => {
+    source.capabilities = ['notifications']
+    const handler = createHandler()
+
+    const result = await handler.handle({
+      method: 'notification.create',
+      payload: {
+        sound: 'signal',
+        subtitle: '  Update  ',
+        text: '  Work completed.  ',
+        title: '  Example  ',
+      },
+      requestId: 'notification',
+    })
+
+    expect(createNotification).toHaveBeenCalledWith({
+      appId: 'source-app',
+      route: '/apps/source-app',
+      sound: 'signal',
+      subtitle: 'Update',
+      text: 'Work completed.',
+      title: 'Example',
+    })
+    expect(result?.response.data).toEqual({
+      notificationId: 'notification-1',
+    })
+  })
+
+  it('rejects notification route injection and undeclared notification use', async () => {
+    source.capabilities = ['notifications']
+    const handler = createHandler()
+    const injected = await handler.handle({
+      method: 'notification.create',
+      payload: {
+        route: 'https://example.test',
+        text: 'Body',
+        title: 'Title',
+      },
+      requestId: 'notification-injected',
+    })
+    source.capabilities = []
+    const denied = await handler.handle({
+      method: 'notification.create',
+      payload: { text: 'Body', title: 'Title' },
+      requestId: 'notification-denied',
+    })
+
+    expect(injected?.response.error).toBe('invalid_notification')
+    expect(denied?.response.error).toBe('permission_denied')
+    expect(createNotification).not.toHaveBeenCalled()
+  })
+
+  it('opens only registered targets and passes JSON data to external apps', async () => {
+    source.capabilities = ['app.open']
+    resolveTarget.mockReturnValue({
+      external: true,
+      id: 'target-app',
+      route: '/apps/target-app',
+    })
+    const handler = createHandler()
+    const data = { screen: 'details', selectedId: 17 }
+
+    const result = await handler.handle({
+      method: 'app.open',
+      payload: { appId: 'target-app', data },
+      requestId: 'open-target',
+    })
+
+    expect(resolveTarget).toHaveBeenCalledWith('target-app')
+    expect(prepareExternalOpen).toHaveBeenCalledWith('target-app', data)
+    expect(result).toMatchObject({
+      effect: { route: '/apps/target-app', type: 'open' },
+      response: {
+        data: { appId: 'target-app' },
+        success: true,
+      },
+    })
+  })
+
+  it('rejects foreign URLs, unknown apps, and data for built-in apps', async () => {
+    source.capabilities = ['app.open']
+    const handler = createHandler()
+
+    const foreignUrl = await handler.handle({
+      method: 'app.open',
+      payload: { appId: 'target-app', url: 'https://example.test' },
+      requestId: 'open-url',
+    })
+    const missing = await handler.handle({
+      method: 'app.open',
+      payload: { appId: 'missing-app' },
+      requestId: 'open-missing',
+    })
+    resolveTarget.mockReturnValue({
+      external: false,
+      id: 'notes',
+      route: '/apps/notes',
+    })
+    const builtInData = await handler.handle({
+      method: 'app.open',
+      payload: { appId: 'notes', data: { noteId: 'one' } },
+      requestId: 'open-built-in-data',
+    })
+
+    expect(foreignUrl?.response.error).toBe('invalid_app_open')
+    expect(missing?.response.error).toBe('app_not_found')
+    expect(builtInData?.response.error).toBe('open_data_not_supported')
+    expect(prepareExternalOpen).not.toHaveBeenCalled()
+  })
+})
diff --git a/frontend/src/utils/customAppBridge.ts b/frontend/src/utils/customAppBridge.ts
new file mode 100644
index 0000000..e51a00e
--- /dev/null
+++ b/frontend/src/utils/customAppBridge.ts
@@ -0,0 +1,512 @@
+import type {
+  CustomAppBridgeMode,
+  SkyPhoneAppBridgeRequest,
+  SkyPhoneAppBridgeResponse,
+  SkyPhoneAppCapability,
+} from '@/types/apps'
+import type { NuiResponse } from '@/utils/nui'
+import type { NotificationSoundId } from '@/utils/preferences'
+
+const STORAGE_KEY_PATTERN = /^[A-Za-z0-9._-]{1,64}$/
+const NOTIFICATION_SOUNDS: ReadonlySet<NotificationSoundId> = new Set([
+  'chime',
+  'signal',
+  'soft',
+])
+const JSON_MAX_DEPTH = 8
+const JSON_MAX_NODES = 512
+const HANDLED_REQUEST_ID_LIMIT = 512
+const STORAGE_VALUE_MAX_BYTES = 65_536
+const DEEP_LINK_DATA_MAX_BYTES = 16_384
+
+type JsonResult = { success: true; value: unknown } | { success: false }
+
+export type CustomAppBridgeNotification = {
+  appId: string
+  route: string
+  sound?: NotificationSoundId
+  subtitle?: string
+  text: string
+  title: string
+}
+
+export type CustomAppBridgeTarget = {
+  external: boolean
+  id: string
+  route: string
+}
+
+export type CustomAppBridgeEffect =
+  | { type: 'close' }
+  | { route: string; type: 'open' }
+
+export type CustomAppBridgeResult = {
+  effect?: CustomAppBridgeEffect
+  response: SkyPhoneAppBridgeResponse
+}
+
+type CustomAppBridgeDependencies = {
+  createNotification: (
+    notification: CustomAppBridgeNotification,
+  ) => string | null
+  getSourceApp: () => { capabilities: readonly string[]; id: string }
+  prepareExternalOpen: (appId: string, data?: unknown) => boolean
+  resolveTarget: (appId: string) => CustomAppBridgeTarget | null
+  storageCall: (
+    endpoint: 'custom-app:storage:get' | 'custom-app:storage:set',
+    payload: Record<string, unknown>,
+  ) => Promise<NuiResponse>
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+function hasOnlyKeys(
+  value: Record<string, unknown>,
+  allowedKeys: readonly string[],
+): boolean {
+  const allowed = new Set(allowedKeys)
+  return Object.keys(value).every((key) => allowed.has(key))
+}
+
+function readText(value: unknown, maximumLength: number): string | null {
+  if (typeof value !== 'string') return null
+  const normalized = value.trim()
+  return normalized.length > 0 && normalized.length <= maximumLength
+    ? normalized
+    : null
+}
+
+function cloneJsonValue(
+  value: unknown,
+  depth: number,
+  state: { nodes: number; seen: WeakSet<object> },
+): JsonResult {
+  state.nodes += 1
+  if (state.nodes > JSON_MAX_NODES || depth > JSON_MAX_DEPTH) {
+    return { success: false }
+  }
+  if (
+    value === null ||
+    typeof value === 'boolean' ||
+    typeof value === 'string'
+  ) {
+    return { success: true, value }
+  }
+  if (typeof value === 'number') {
+    return Number.isFinite(value)
+      ? { success: true, value }
+      : { success: false }
+  }
+  if (typeof value !== 'object' || state.seen.has(value)) {
+    return { success: false }
+  }
+
+  state.seen.add(value)
+  if (Array.isArray(value)) {
+    if (value.length > 128) return { success: false }
+    const result: unknown[] = []
+    for (const item of value) {
+      const normalized = cloneJsonValue(item, depth + 1, state)
+      if (!normalized.success) return normalized
+      result.push(normalized.value)
+    }
+    state.seen.delete(value)
+    return { success: true, value: result }
+  }
+
+  const prototype = Object.getPrototypeOf(value)
+  if (prototype !== Object.prototype && prototype !== null) {
+    return { success: false }
+  }
+  const entries = Object.entries(value)
+  if (entries.length > 128) return { success: false }
+  const result: Record<string, unknown> = {}
+  for (const [key, item] of entries) {
+    if (
+      key.length < 1 ||
+      key.length > 64 ||
+      key === '__proto__' ||
+      key === 'constructor' ||
+      key === 'prototype'
+    ) {
+      return { success: false }
+    }
+    const normalized = cloneJsonValue(item, depth + 1, state)
+    if (!normalized.success) return normalized
+    result[key] = normalized.value
+  }
+  state.seen.delete(value)
+  return { success: true, value: result }
+}
+
+function normalizeJsonValue(value: unknown, maximumBytes: number): JsonResult {
+  const normalized = cloneJsonValue(value, 0, {
+    nodes: 0,
+    seen: new WeakSet(),
+  })
+  if (!normalized.success) return normalized
+
+  const serialized = JSON.stringify(normalized.value)
+  if (
+    typeof serialized !== 'string' ||
+    new TextEncoder().encode(serialized).byteLength > maximumBytes
+  ) {
+    return { success: false }
+  }
+  return normalized
+}
+
+function normalizeStorageGetPayload(payload: unknown): { key: string } | null {
+  if (!isRecord(payload) || !hasOnlyKeys(payload, ['key'])) return null
+  return typeof payload.key === 'string' &&
+    STORAGE_KEY_PATTERN.test(payload.key)
+    ? { key: payload.key }
+    : null
+}
+
+function normalizeStorageSetPayload(
+  payload: unknown,
+): { key: string; revision: number; value: unknown } | null {
+  if (
+    !isRecord(payload) ||
+    !hasOnlyKeys(payload, ['key', 'revision', 'value']) ||
+    !Object.prototype.hasOwnProperty.call(payload, 'value') ||
+    typeof payload.key !== 'string' ||
+    !STORAGE_KEY_PATTERN.test(payload.key) ||
+    typeof payload.revision !== 'number' ||
+    !Number.isInteger(payload.revision) ||
+    payload.revision < 0 ||
+    payload.revision > 4_294_967_294
+  ) {
+    return null
+  }
+
+  const value = normalizeJsonValue(payload.value, STORAGE_VALUE_MAX_BYTES)
+  return value.success
+    ? { key: payload.key, revision: payload.revision, value: value.value }
+    : null
+}
+
+function normalizeNotificationPayload(
+  appId: string,
+  payload: unknown,
+): CustomAppBridgeNotification | null {
+  if (
+    !isRecord(payload) ||
+    !hasOnlyKeys(payload, ['sound', 'subtitle', 'text', 'title'])
+  ) {
+    return null
+  }
+
+  const title = readText(payload.title, 80)
+  const text = readText(payload.text, 240)
+  if (!title || !text) return null
+
+  const subtitle =
+    payload.subtitle === undefined ? undefined : readText(payload.subtitle, 80)
+  if (payload.subtitle !== undefined && !subtitle) return null
+  const sound =
+    payload.sound === undefined ||
+    (typeof payload.sound === 'string' &&
+      NOTIFICATION_SOUNDS.has(payload.sound as NotificationSoundId))
+      ? (payload.sound as NotificationSoundId | undefined)
+      : null
+  if (sound === null) return null
+
+  return {
+    appId,
+    route: `/apps/${appId}`,
+    ...(sound ? { sound } : {}),
+    ...(subtitle ? { subtitle } : {}),
+    text,
+    title,
+  }
+}
+
+function normalizeOpenPayload(
+  payload: unknown,
+): { appId: string; data?: unknown } | null {
+  if (
+    !isRecord(payload) ||
+    !hasOnlyKeys(payload, ['appId', 'data']) ||
+    typeof payload.appId !== 'string' ||
+    payload.appId.length < 1 ||
+    payload.appId.length > 64
+  ) {
+    return null
+  }
+  if (!Object.prototype.hasOwnProperty.call(payload, 'data')) {
+    return { appId: payload.appId }
+  }
+
+  const data = normalizeJsonValue(payload.data, DEEP_LINK_DATA_MAX_BYTES)
+  if (!data.success || !isRecord(data.value)) return null
+  return { appId: payload.appId, data: data.value }
+}
+
+function hasPermission(
+  capabilities: readonly string[],
+  permission: string,
+): boolean {
+  return capabilities.includes(permission)
+}
+
+function response(
+  requestId: string,
+  success: boolean,
+  data?: unknown,
+  error?: string,
+): SkyPhoneAppBridgeResponse {
+  return {
+    ...(data === undefined ? {} : { data }),
+    ...(error ? { error } : {}),
+    requestId,
+    success,
+  }
+}
+
+export function getSkyPhoneAppCapabilities(
+  permissions: readonly string[],
+): SkyPhoneAppCapability[] {
+  const capabilities: SkyPhoneAppCapability[] = []
+  if (hasPermission(permissions, 'app.close')) capabilities.push('app.close')
+  if (hasPermission(permissions, 'app.open')) capabilities.push('app.open')
+  if (hasPermission(permissions, 'device.storage')) {
+    capabilities.push('device.storage.get', 'device.storage.set')
+  }
+  if (hasPermission(permissions, 'locale.read'))
+    capabilities.push('locale.read')
+  if (hasPermission(permissions, 'notifications')) {
+    capabilities.push('notification.create')
+  }
+  if (hasPermission(permissions, 'theme.read')) capabilities.push('theme.read')
+  return capabilities
+}
+
+export function shouldReportCustomAppReady(
+  bridgeMode: CustomAppBridgeMode,
+  signal: 'bridge-ready' | 'frame-load',
+): boolean {
+  return bridgeMode === 'sky'
+    ? signal === 'bridge-ready'
+    : signal === 'frame-load'
+}
+
+export function createCustomAppBridgeRequestHandler(
+  dependencies: CustomAppBridgeDependencies,
+): {
+  handle: (
+    request: SkyPhoneAppBridgeRequest,
+  ) => Promise<CustomAppBridgeResult | null>
+} {
+  const handledRequestIds = new Set<string>()
+  const handledRequestOrder: string[] = []
+
+  return {
+    async handle(
+      request: SkyPhoneAppBridgeRequest,
+    ): Promise<CustomAppBridgeResult | null> {
+      if (
+        typeof request.requestId !== 'string' ||
+        request.requestId.length < 1 ||
+        request.requestId.length > 128 ||
+        typeof request.method !== 'string' ||
+        request.method.length < 1 ||
+        request.method.length > 64 ||
+        handledRequestIds.has(request.requestId)
+      ) {
+        return null
+      }
+      handledRequestIds.add(request.requestId)
+      handledRequestOrder.push(request.requestId)
+      if (handledRequestOrder.length > HANDLED_REQUEST_ID_LIMIT) {
+        const expiredRequestId = handledRequestOrder.shift()
+        if (expiredRequestId) handledRequestIds.delete(expiredRequestId)
+      }
+
+      const source = dependencies.getSourceApp()
+      try {
+        if (request.method === 'app.close') {
+          return hasPermission(source.capabilities, 'app.close')
+            ? {
+                effect: { type: 'close' },
+                response: response(request.requestId, true),
+              }
+            : {
+                response: response(
+                  request.requestId,
+                  false,
+                  undefined,
+                  'permission_denied',
+                ),
+              }
+        }
+
+        if (
+          request.method === 'device.storage.get' ||
+          request.method === 'device.storage.set'
+        ) {
+          if (!hasPermission(source.capabilities, 'device.storage')) {
+            return {
+              response: response(
+                request.requestId,
+                false,
+                undefined,
+                'permission_denied',
+              ),
+            }
+          }
+
+          const storagePayload =
+            request.method === 'device.storage.get'
+              ? normalizeStorageGetPayload(request.payload)
+              : normalizeStorageSetPayload(request.payload)
+          if (!storagePayload) {
+            return {
+              response: response(
+                request.requestId,
+                false,
+                undefined,
+                'invalid_storage_request',
+              ),
+            }
+          }
+
+          const result = await dependencies.storageCall(
+            request.method === 'device.storage.get'
+              ? 'custom-app:storage:get'
+              : 'custom-app:storage:set',
+            { appId: source.id, ...storagePayload },
+          )
+          return {
+            response: response(
+              request.requestId,
+              result.success,
+              result.data,
+              result.error,
+            ),
+          }
+        }
+
+        if (request.method === 'notification.create') {
+          if (!hasPermission(source.capabilities, 'notifications')) {
+            return {
+              response: response(
+                request.requestId,
+                false,
+                undefined,
+                'permission_denied',
+              ),
+            }
+          }
+          const notification = normalizeNotificationPayload(
+            source.id,
+            request.payload,
+          )
+          if (!notification) {
+            return {
+              response: response(
+                request.requestId,
+                false,
+                undefined,
+                'invalid_notification',
+              ),
+            }
+          }
+          const notificationId = dependencies.createNotification(notification)
+          return {
+            response: response(request.requestId, true, { notificationId }),
+          }
+        }
+
+        if (request.method === 'app.open') {
+          if (!hasPermission(source.capabilities, 'app.open')) {
+            return {
+              response: response(
+                request.requestId,
+                false,
+                undefined,
+                'permission_denied',
+              ),
+            }
+          }
+          const openPayload = normalizeOpenPayload(request.payload)
+          if (!openPayload) {
+            return {
+              response: response(
+                request.requestId,
+                false,
+                undefined,
+                'invalid_app_open',
+              ),
+            }
+          }
+          const target = dependencies.resolveTarget(openPayload.appId)
+          if (!target) {
+            return {
+              response: response(
+                request.requestId,
+                false,
+                undefined,
+                'app_not_found',
+              ),
+            }
+          }
+          if (openPayload.data !== undefined && !target.external) {
+            return {
+              response: response(
+                request.requestId,
+                false,
+                undefined,
+                'open_data_not_supported',
+              ),
+            }
+          }
+          if (
+            target.external &&
+            !dependencies.prepareExternalOpen(target.id, openPayload.data)
+          ) {
+            return {
+              response: response(
+                request.requestId,
+                false,
+                undefined,
+                'open_failed',
+              ),
+            }
+          }
+          return {
+            effect: { route: target.route, type: 'open' },
+            response: response(request.requestId, true, {
+              appId: target.id,
+            }),
+          }
+        }
+
+        return {
+          response: response(
+            request.requestId,
+            false,
+            undefined,
+            'unsupported_method',
+          ),
+        }
+      } catch (error) {
+        console.error(
+          `[Custom apps] Bridge request failed for ${source.id}.`,
+          error,
+        )
+        return {
+          response: response(
+            request.requestId,
+            false,
+            undefined,
+            'request_failed',
+          ),
+        }
+      }
+    },
+  }
+}
diff --git a/frontend/src/utils/customAppLifecycle.test.ts b/frontend/src/utils/customAppLifecycle.test.ts
new file mode 100644
index 0000000..cf67f98
--- /dev/null
+++ b/frontend/src/utils/customAppLifecycle.test.ts
@@ -0,0 +1,229 @@
+import { describe, expect, it, vi } from 'vitest'
+
+import type { ExternalPhoneAppDefinition } from '@/types/apps'
+import {
+  createCustomAppLifecycleReporter,
+  createCustomAppLifecycleScheduler,
+  createCustomAppOrientationCoordinator,
+  getCustomAppFrameKey,
+  getCustomAppSafeArea,
+} from '@/utils/customAppLifecycle'
+import type { NuiResponse } from '@/utils/nui'
+
+function deferredResponse(): {
+  promise: Promise<NuiResponse>
+  resolve: (response: NuiResponse) => void
+} {
+  let resolve!: (response: NuiResponse) => void
+  const promise = new Promise<NuiResponse>((complete) => {
+    resolve = complete
+  })
+  return { promise, resolve }
+}
+
+function externalApp(
+  overrides: Partial<ExternalPhoneAppDefinition> = {},
+): ExternalPhoneAppDefinition {
+  return {
+    bridgeMode: 'sky',
+    bundled: true,
+    capabilities: ['theme.read'],
+    category: 'utilities',
+    compatibility: {},
+    component: null,
+    defaultInstalled: true,
+    description: 'Example description',
+    developer: 'Example developer',
+    dockOrder: null,
+    gridOrder: 100,
+    icon: {} as ExternalPhoneAppDefinition['icon'],
+    iconClass: 'app-icon--custom',
+    iconImage: 'https://cfx-nui-example/web/icon.svg',
+    id: 'example-app' as ExternalPhoneAppDefinition['id'],
+    kind: 'external',
+    name: 'Example App',
+    orientation: 'portrait',
+    ownerResource: 'example_resource',
+    readyTimeoutMs: 8000,
+    removable: true,
+    route: '/apps/example-app' as ExternalPhoneAppDefinition['route'],
+    ui: 'https://cfx-nui-example/web/index.html',
+    ...overrides,
+  }
+}
+
+describe('custom app lifecycle', () => {
+  it('waits for delayed open and preserves fast ready/close ordering', async () => {
+    const open = deferredResponse()
+    const ready = deferredResponse()
+    const close = deferredResponse()
+    const calls: string[] = []
+    const send = vi.fn((event: string) => {
+      calls.push(event)
+      if (event === 'open') return open.promise
+      if (event === 'ready') return ready.promise
+      return close.promise
+    })
+    const reporter = createCustomAppLifecycleReporter({
+      scheduler: createCustomAppLifecycleScheduler(),
+      send,
+    })
+
+    const openResult = reporter.report('open', { screen: 'details' })
+    const readyResult = reporter.report('ready')
+    const closeResult = reporter.report('close')
+    await Promise.resolve()
+
+    expect(calls).toEqual(['open'])
+
+    open.resolve({ success: true })
+    await openResult
+    await Promise.resolve()
+    expect(calls).toEqual(['open', 'ready'])
+
+    ready.resolve({ success: true })
+    await readyResult
+    await Promise.resolve()
+    expect(calls).toEqual(['open', 'ready', 'close'])
+
+    close.resolve({ success: true })
+    await expect(closeResult).resolves.toEqual({ success: true })
+    expect(send).toHaveBeenNthCalledWith(1, 'open', { screen: 'details' })
+  })
+
+  it('finalizes only successful events and retries a failed event', async () => {
+    const failure = vi.fn()
+    const send = vi
+      .fn()
+      .mockResolvedValueOnce({ error: 'phone_closed', success: false })
+      .mockResolvedValueOnce({ success: true })
+    const reporter = createCustomAppLifecycleReporter({
+      onFailure: failure,
+      scheduler: createCustomAppLifecycleScheduler(),
+      send,
+    })
+
+    await expect(reporter.report('open')).resolves.toMatchObject({
+      error: 'phone_closed',
+      success: false,
+    })
+    expect(reporter.isComplete('open')).toBe(false)
+
+    await expect(reporter.report('open')).resolves.toEqual({ success: true })
+    expect(reporter.isComplete('open')).toBe(true)
+    expect(send).toHaveBeenCalledTimes(2)
+    expect(failure).toHaveBeenCalledWith('open', 'phone_closed')
+  })
+
+  it('treats a failed hook as applied and continues with ready', async () => {
+    const failure = vi.fn()
+    const send = vi
+      .fn()
+      .mockResolvedValueOnce({ error: 'hook_failed', success: false })
+      .mockResolvedValueOnce({ success: true })
+    const reporter = createCustomAppLifecycleReporter({
+      onFailure: failure,
+      scheduler: createCustomAppLifecycleScheduler(),
+      send,
+    })
+
+    const open = reporter.report('open')
+    const ready = reporter.report('ready')
+
+    await expect(open).resolves.toEqual({
+      error: 'hook_failed',
+      success: false,
+    })
+    await expect(ready).resolves.toEqual({ success: true })
+    expect(reporter.isComplete('open')).toBe(true)
+    expect(reporter.isComplete('ready')).toBe(true)
+    expect(failure).toHaveBeenCalledWith('open', 'hook_failed')
+    expect(send).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not report ready when its queued open failed', async () => {
+    const send = vi.fn().mockResolvedValue({
+      error: 'phone_closed',
+      success: false,
+    })
+    const reporter = createCustomAppLifecycleReporter({
+      scheduler: createCustomAppLifecycleScheduler(),
+      send,
+    })
+
+    const open = reporter.report('open')
+    const ready = reporter.report('ready')
+
+    await expect(open).resolves.toMatchObject({ success: false })
+    await expect(ready).resolves.toEqual({
+      error: 'open_not_completed',
+      success: false,
+    })
+    expect(send).toHaveBeenCalledOnce()
+  })
+
+  it('turns a rejected transport promise into a retryable response', async () => {
+    const send = vi
+      .fn()
+      .mockRejectedValueOnce(new Error('network down'))
+      .mockResolvedValueOnce({ success: true })
+    const reporter = createCustomAppLifecycleReporter({
+      scheduler: createCustomAppLifecycleScheduler(),
+      send,
+    })
+
+    await expect(reporter.report('open')).resolves.toEqual({
+      error: 'network down',
+      success: false,
+    })
+    await expect(reporter.report('open')).resolves.toEqual({ success: true })
+    expect(reporter.isComplete('open')).toBe(true)
+  })
+
+  it('turns iframe, bridge, permission, and orientation updates into remounts', () => {
+    const original = externalApp()
+    const originalKey = getCustomAppFrameKey(original)
+
+    expect(
+      getCustomAppFrameKey(
+        externalApp({ ui: 'https://cfx-nui-example/web/v2.html' }),
+      ),
+    ).not.toBe(originalKey)
+    expect(
+      getCustomAppFrameKey(externalApp({ bridgeMode: 'legacy' })),
+    ).not.toBe(originalKey)
+    expect(
+      getCustomAppFrameKey(externalApp({ capabilities: ['app.close'] })),
+    ).not.toBe(originalKey)
+    expect(
+      getCustomAppFrameKey(externalApp({ orientation: 'landscape' })),
+    ).not.toBe(originalKey)
+  })
+
+  it('applies landscape safe areas and resets only the current owner', () => {
+    const changes: boolean[] = []
+    const coordinator = createCustomAppOrientationCoordinator()
+    const previous = coordinator.createSession((value) => changes.push(value))
+    const current = coordinator.createSession((value) => changes.push(value))
+
+    previous.apply('landscape')
+    current.apply('landscape')
+    previous.release()
+    current.apply('portrait')
+    current.release()
+
+    expect(changes).toEqual([true, true, false, false])
+    expect(getCustomAppSafeArea('portrait')).toEqual({
+      bottom: 25,
+      left: 0,
+      right: 0,
+      top: 44,
+    })
+    expect(getCustomAppSafeArea('landscape')).toEqual({
+      bottom: 0,
+      left: 44,
+      right: 25,
+      top: 0,
+    })
+  })
+})
diff --git a/frontend/src/utils/customAppLifecycle.ts b/frontend/src/utils/customAppLifecycle.ts
new file mode 100644
index 0000000..4742481
--- /dev/null
+++ b/frontend/src/utils/customAppLifecycle.ts
@@ -0,0 +1,183 @@
+import type { ExternalPhoneAppDefinition } from '@/types/apps'
+import type { NuiResponse } from '@/utils/nui'
+
+export type CustomAppLifecycleEvent = 'close' | 'open' | 'ready'
+export type CustomAppOrientation = ExternalPhoneAppDefinition['orientation']
+
+type CustomAppLifecycleTask = () => Promise<NuiResponse>
+
+export type CustomAppLifecycleScheduler = {
+  enqueue: (task: CustomAppLifecycleTask) => Promise<NuiResponse>
+}
+
+type CustomAppLifecycleReporterOptions = {
+  onFailure?: (event: CustomAppLifecycleEvent, error: string) => void
+  scheduler: CustomAppLifecycleScheduler
+  send: (event: CustomAppLifecycleEvent, data?: unknown) => Promise<NuiResponse>
+}
+
+export type CustomAppOrientationCoordinator = {
+  createSession: (setLandscape: (landscape: boolean) => void) => {
+    apply: (orientation: CustomAppOrientation) => void
+    release: () => void
+  }
+}
+
+function stableValue(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(stableValue)
+  if (!value || typeof value !== 'object') return value
+
+  return Object.fromEntries(
+    Object.entries(value as Record<string, unknown>)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, item]) => [key, stableValue(item)]),
+  )
+}
+
+export function getCustomAppFrameKey(app: ExternalPhoneAppDefinition): string {
+  return JSON.stringify(
+    stableValue({
+      bridgeMode: app.bridgeMode,
+      bundled: app.bundled,
+      capabilities: app.capabilities,
+      compatibility: app.compatibility,
+      description: app.description,
+      id: app.id,
+      name: app.name,
+      orientation: app.orientation,
+      ownerResource: app.ownerResource,
+      readyTimeoutMs: app.readyTimeoutMs,
+      ui: app.ui,
+    }),
+  )
+}
+
+export function getCustomAppSafeArea(orientation: CustomAppOrientation): {
+  bottom: number
+  left: number
+  right: number
+  top: number
+} {
+  return orientation === 'landscape'
+    ? { bottom: 0, left: 44, right: 25, top: 0 }
+    : { bottom: 25, left: 0, right: 0, top: 44 }
+}
+
+export function createCustomAppOrientationCoordinator(): CustomAppOrientationCoordinator {
+  let owner: symbol | null = null
+
+  return {
+    createSession(setLandscape) {
+      const token = Symbol('custom-app-orientation')
+
+      return {
+        apply(orientation): void {
+          owner = token
+          setLandscape(orientation === 'landscape')
+        },
+        release(): void {
+          if (owner !== token) return
+          owner = null
+          setLandscape(false)
+        },
+      }
+    },
+  }
+}
+
+export const customAppOrientationCoordinator =
+  createCustomAppOrientationCoordinator()
+
+export function createCustomAppLifecycleScheduler(): CustomAppLifecycleScheduler {
+  let tail: Promise<void> = Promise.resolve()
+
+  return {
+    enqueue(task): Promise<NuiResponse> {
+      const operation = tail.then(task)
+      tail = operation.then(
+        () => undefined,
+        () => undefined,
+      )
+      return operation
+    },
+  }
+}
+
+export const customAppLifecycleScheduler = createCustomAppLifecycleScheduler()
+
+export function createCustomAppLifecycleReporter(
+  options: CustomAppLifecycleReporterOptions,
+): {
+  isComplete: (event: CustomAppLifecycleEvent) => boolean
+  report: (
+    event: CustomAppLifecycleEvent,
+    data?: unknown,
+  ) => Promise<NuiResponse>
+} {
+  const completed = new Set<CustomAppLifecycleEvent>()
+  const pending = new Map<CustomAppLifecycleEvent, Promise<NuiResponse>>()
+
+  function notifyFailure(event: CustomAppLifecycleEvent, error: string): void {
+    try {
+      options.onFailure?.(event, error)
+    } catch (failureHandlerError) {
+      console.error(
+        '[Custom apps] Lifecycle failure handler threw an error.',
+        failureHandlerError,
+      )
+    }
+  }
+
+  function report(
+    event: CustomAppLifecycleEvent,
+    data?: unknown,
+  ): Promise<NuiResponse> {
+    if (completed.has(event)) return Promise.resolve({ success: true })
+
+    const existing = pending.get(event)
+    if (existing) return existing
+
+    const operation = options.scheduler.enqueue(async () => {
+      if (event === 'ready' && !completed.has('open')) {
+        return { error: 'open_not_completed', success: false }
+      }
+
+      try {
+        return await options.send(event, data)
+      } catch (error) {
+        return {
+          error: error instanceof Error ? error.message : 'request_failed',
+          success: false,
+        }
+      }
+    })
+
+    const settled = operation.then(
+      (response) => {
+        if (response.success || response.error === 'hook_failed') {
+          completed.add(event)
+        }
+        if (!response.success)
+          notifyFailure(event, response.error ?? 'request_failed')
+        if (pending.get(event) === settled) pending.delete(event)
+        return response
+      },
+      (error) => {
+        const response = {
+          error: error instanceof Error ? error.message : 'request_failed',
+          success: false,
+        }
+        notifyFailure(event, response.error)
+        if (pending.get(event) === settled) pending.delete(event)
+        return response
+      },
+    )
+    pending.set(event, settled)
+    return settled
+  }
+
+  return {
+    isComplete: (event) => completed.has(event),
+    report,
+  }
+}
diff --git a/frontend/src/utils/homeLayout.test.ts b/frontend/src/utils/homeLayout.test.ts
index 9bcf86d..72602c6 100644
--- a/frontend/src/utils/homeLayout.test.ts
+++ b/frontend/src/utils/homeLayout.test.ts
@@ -34,7 +34,7 @@ describe('home layout', () => {
       null,
     ])
     expect(layout.dock).toEqual(['phone', 'messages', 'clock', null])
-    expect(layout.version).toBe(2)
+    expect(layout.version).toBe(3)
   })
 
   it('migrates compact persisted arrays and appends newly installed apps', () => {
@@ -51,7 +51,7 @@ describe('home layout', () => {
     expect(layout.dock).toEqual(['messages', null, null, null])
     expect(layout.grid.slice(0, 4)).toEqual(['mail', 'clock', 'notes', null])
     expect(layout.hidden).toEqual(['phone'])
-    expect(layout.version).toBe(2)
+    expect(layout.version).toBe(3)
   })
 
   it('preserves explicit gaps in versioned layouts', () => {
@@ -79,6 +79,28 @@ describe('home layout', () => {
     expect(layout.dock).toEqual(['messages', null, 'clock', null])
   })
 
+  it('keeps valid custom-app tombstones in version 3 layouts', () => {
+    const grid: HomeLayout['grid'] = Array.from(
+      { length: HOME_GRID_PAGE_SIZE },
+      () => null,
+    )
+    grid[6] = 'temporarily-missing' as HomeLayout['hidden'][number]
+
+    const layout = parseHomeLayout(
+      {
+        dock: ['phone', null, null, null],
+        grid,
+        hidden: [],
+        version: 3,
+      },
+      defaults,
+      [...installed],
+    )
+
+    expect(layout.grid[6]).toBe('temporarily-missing')
+    expect(layout.version).toBe(3)
+  })
+
   it('preserves independently positioned shortcuts for the same app', () => {
     const grid: HomeLayout['grid'] = Array.from(
       { length: HOME_GRID_PAGE_SIZE },
diff --git a/frontend/src/utils/homeLayout.ts b/frontend/src/utils/homeLayout.ts
index e55356c..01bb146 100644
--- a/frontend/src/utils/homeLayout.ts
+++ b/frontend/src/utils/homeLayout.ts
@@ -11,7 +11,11 @@ export type HomeLayout = {
   dock: HomeSlot[]
   grid: HomeSlot[]
   hidden: LaunchablePhoneAppId[]
-  version: 2
+  version: 3
+}
+
+function isPersistableAppId(value: unknown): value is LaunchablePhoneAppId {
+  return typeof value === 'string' && /^[a-z0-9][a-z0-9._-]{1,63}$/.test(value)
 }
 
 function readAppIds(
@@ -134,7 +138,7 @@ export function createDefaultHomeLayout(
     dock[index] = id
   }
 
-  return { dock, grid, hidden: [], version: 2 }
+  return { dock, grid, hidden: [], version: 3 }
 }
 
 export function parseHomeLayout(
@@ -146,6 +150,14 @@ export function parseHomeLayout(
 
   const source = value as Partial<Record<keyof HomeLayout, unknown>>
   const availableIds = new Set(installedIds)
+  if (source.version === 3) {
+    for (const collection of [source.dock, source.grid, source.hidden]) {
+      if (!Array.isArray(collection)) continue
+      for (const appId of collection) {
+        if (isPersistableAppId(appId)) availableIds.add(appId)
+      }
+    }
+  }
   const hidden = readAppIds(source.hidden, availableIds)
   const hiddenIds = new Set(hidden)
   const persistedGridLength = Array.isArray(source.grid)
@@ -158,7 +170,7 @@ export function parseHomeLayout(
   let grid: HomeSlot[]
   let dock: HomeSlot[]
 
-  if (source.version === 2) {
+  if (source.version === 2 || source.version === 3) {
     grid = readSlots(source.grid, availableIds, gridLength)
     dock = readSlots(source.dock, availableIds, HOME_DOCK_CAPACITY)
   } else {
@@ -189,7 +201,7 @@ export function parseHomeLayout(
     }
   }
 
-  return { dock, grid, hidden, version: 2 }
+  return { dock, grid, hidden, version: 3 }
 }
 
 export function removeHomeApp(
@@ -202,7 +214,7 @@ export function removeHomeApp(
     hidden: layout.hidden.includes(appId)
       ? [...layout.hidden]
       : [...layout.hidden, appId],
-    version: 2,
+    version: 3,
   }
 }
 
@@ -217,7 +229,7 @@ export function restoreHomeApp(
     dock: [...layout.dock],
     grid,
     hidden: layout.hidden.filter((id) => id !== appId),
-    version: 2,
+    version: 3,
   }
 }
 
@@ -230,7 +242,7 @@ export function addHomePage(layout: HomeLayout): HomeLayout {
     dock: [...layout.dock],
     grid: [...layout.grid, ...createSlots(HOME_GRID_PAGE_SIZE)],
     hidden: [...layout.hidden],
-    version: 2,
+    version: 3,
   }
 }
 
@@ -252,7 +264,7 @@ export function deleteHomePage(layout: HomeLayout, page: number): HomeLayout {
     dock: [...layout.dock],
     grid,
     hidden: [...layout.hidden],
-    version: 2,
+    version: 3,
   }
 }
 
@@ -267,7 +279,7 @@ export function moveHomeApp(
     dock: [...layout.dock],
     grid: [...layout.grid],
     hidden: [...layout.hidden],
-    version: 2,
+    version: 3,
   }
   const source = next[from]
   const target = next[to]
diff --git a/frontend/src/utils/nui.ts b/frontend/src/utils/nui.ts
index 670160f..22ecce7 100644
--- a/frontend/src/utils/nui.ts
+++ b/frontend/src/utils/nui.ts
@@ -1,4 +1,4 @@
-const resourceName = window.GetParentResourceName?.() ?? 'sky_phone'
+const resourceName = globalThis.window?.GetParentResourceName?.() ?? 'sky_phone'
 
 export type NuiResponse<T = unknown> = {
   success: boolean
diff --git a/frontend/src/utils/preferences.test.ts b/frontend/src/utils/preferences.test.ts
index 45a0cef..9ddfb58 100644
--- a/frontend/src/utils/preferences.test.ts
+++ b/frontend/src/utils/preferences.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'vitest'
+import type { LaunchablePhoneAppId } from '@/types/apps'
 import { DEFAULT_PHONE_PREFERENCES, parsePhonePreferences } from './preferences'
 describe('preferences', () => {
   it('falls back for malformed and obsolete records', () => {
@@ -84,6 +85,27 @@ describe('preferences', () => {
     expect(value.settings.screenBrightness).toBe(10)
   })
 
+  it('preserves safe notification preferences for custom apps', () => {
+    const appId = 'example-app' as LaunchablePhoneAppId
+    const value = parsePhonePreferences(
+      JSON.stringify({
+        version: 1,
+        settings: {
+          notifications: {
+            [appId]: { enabled: false, sounds: true },
+            '../unsafe': { enabled: false, sounds: false },
+          },
+        },
+      }),
+    )
+
+    expect(value.settings.notifications[appId]).toEqual({
+      enabled: false,
+      sounds: true,
+    })
+    expect(value.settings.notifications).not.toHaveProperty('../unsafe')
+  })
+
   it('adds safe control center defaults to legacy version one preferences', () => {
     const value = parsePhonePreferences(
       JSON.stringify({ version: 1, settings: { airplaneMode: true } }),
diff --git a/frontend/src/utils/preferences.ts b/frontend/src/utils/preferences.ts
index 3a5464d..7ef0550 100644
--- a/frontend/src/utils/preferences.ts
+++ b/frontend/src/utils/preferences.ts
@@ -38,6 +38,12 @@ export type AppNotificationPreferences = {
   sounds: boolean
 }
 
+export const DEFAULT_APP_NOTIFICATION_PREFERENCES: AppNotificationPreferences =
+  {
+    enabled: true,
+    sounds: true,
+  }
+
 export type PhonePreferencesV1 = {
   settings: {
     airplaneMode: boolean
@@ -80,6 +86,7 @@ const DEFAULT_APP_NOTIFICATIONS: Record<
   'sky-flappy': { enabled: true, sounds: true },
   'neon-drop': { enabled: true, sounds: true },
   citymarkt: { enabled: true, sounds: true },
+  companies: { enabled: true, sounds: true },
   'local-pages': { enabled: true, sounds: true },
   picstagram: { enabled: true, sounds: true },
   fliptok: { enabled: true, sounds: true },
@@ -155,30 +162,41 @@ function readChoice<T extends string>(
 function readNotifications(
   value: unknown,
 ): Record<LaunchablePhoneAppId, AppNotificationPreferences> {
-  const source =
-    value && typeof value === 'object'
-      ? (value as Partial<
-          Record<LaunchablePhoneAppId, Partial<AppNotificationPreferences>>
-        >)
-      : {}
+  const source: Record<string, unknown> =
+    value && typeof value === 'object' ? (value as Record<string, unknown>) : {}
   const notifications = cloneJsonData(DEFAULT_APP_NOTIFICATIONS)
 
-  for (const appId of Object.keys(notifications) as LaunchablePhoneAppId[]) {
-    notifications[appId] = {
-      enabled: readBoolean(
-        source[appId]?.enabled,
-        DEFAULT_APP_NOTIFICATIONS[appId].enabled,
-      ),
-      sounds: readBoolean(
-        source[appId]?.sounds,
-        DEFAULT_APP_NOTIFICATIONS[appId].sounds,
-      ),
+  for (const appId of Object.keys(source)) {
+    if (!/^[a-z0-9][a-z0-9._-]{1,63}$/.test(appId)) continue
+    const rawPreferences =
+      source[appId] &&
+      typeof source[appId] === 'object' &&
+      !Array.isArray(source[appId])
+        ? (source[appId] as Partial<AppNotificationPreferences>)
+        : {}
+    const defaults =
+      DEFAULT_APP_NOTIFICATIONS[appId as LaunchablePhoneAppId] ??
+      DEFAULT_APP_NOTIFICATION_PREFERENCES
+    notifications[appId as LaunchablePhoneAppId] = {
+      enabled: readBoolean(rawPreferences.enabled, defaults.enabled),
+      sounds: readBoolean(rawPreferences.sounds, defaults.sounds),
     }
   }
 
   return notifications
 }
 
+export function ensureAppNotificationPreferences(
+  preferences: PhonePreferencesV1,
+  appIds: LaunchablePhoneAppId[],
+): void {
+  for (const appId of appIds) {
+    preferences.settings.notifications[appId] ??= cloneJsonData(
+      DEFAULT_APP_NOTIFICATION_PREFERENCES,
+    )
+  }
+}
+
 export function parsePhonePreferences(raw: string | null): PhonePreferencesV1 {
   if (!raw) return cloneJsonData(DEFAULT_PHONE_PREFERENCES)
 
diff --git a/frontend/src/utils/windowMessages.test.ts b/frontend/src/utils/windowMessages.test.ts
new file mode 100644
index 0000000..022f6b1
--- /dev/null
+++ b/frontend/src/utils/windowMessages.test.ts
@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest'
+
+import { isTrustedRootMessageSource } from '@/utils/windowMessages'
+
+describe('root window message source', () => {
+  it('accepts native NUI messages and messages posted by the root window', () => {
+    const rootWindow = {} as Window
+
+    expect(isTrustedRootMessageSource(null, rootWindow)).toBe(true)
+    expect(isTrustedRootMessageSource(rootWindow, rootWindow)).toBe(true)
+  })
+
+  it('rejects messages posted by child frames', () => {
+    const rootWindow = {} as Window
+    const childFrame = {} as Window
+
+    expect(isTrustedRootMessageSource(childFrame, rootWindow)).toBe(false)
+  })
+})
diff --git a/frontend/src/utils/windowMessages.ts b/frontend/src/utils/windowMessages.ts
new file mode 100644
index 0000000..5fa674d
--- /dev/null
+++ b/frontend/src/utils/windowMessages.ts
@@ -0,0 +1,6 @@
+export function isTrustedRootMessageSource(
+  source: MessageEventSource | null,
+  rootWindow: Window,
+): boolean {
+  return source === null || source === rootWindow
+}
diff --git a/frontend/src/views/PhoneAppWindow.vue b/frontend/src/views/PhoneAppWindow.vue
index d71f687..9bdca8b 100644
--- a/frontend/src/views/PhoneAppWindow.vue
+++ b/frontend/src/views/PhoneAppWindow.vue
@@ -2,8 +2,10 @@
 import { computed } from 'vue'
 import { useRoute } from 'vue-router'
 
-import { getPhoneApp } from '@/config/apps'
+import CustomAppFrame from '@/components/CustomAppFrame.vue'
+import { getPhoneApp, isExternalPhoneApp } from '@/config/apps'
 import { usePhoneStore } from '@/stores/phone'
+import { getCustomAppFrameKey } from '@/utils/customAppLifecycle'
 
 const route = useRoute()
 const phone = usePhoneStore()
@@ -21,8 +23,13 @@ const launchStyle = computed(() => {
 </script>
 
 <template>
-  <div v-if="app?.component" class="app-window" :style="launchStyle">
-    <Suspense>
+  <div v-if="app" class="app-window" :style="launchStyle">
+    <CustomAppFrame
+      v-if="isExternalPhoneApp(app)"
+      :key="getCustomAppFrameKey(app)"
+      :app="app"
+    />
+    <Suspense v-else>
       <component :is="app.component" />
       <template #fallback>
         <div class="app-loading">{{ phone.t('Common.loading') }}</div>
diff --git a/frontend/src/views/SpringboardView.vue b/frontend/src/views/SpringboardView.vue
index e5a0ab3..aa02bf4 100644
--- a/frontend/src/views/SpringboardView.vue
+++ b/frontend/src/views/SpringboardView.vue
@@ -7,7 +7,7 @@ import AppIcon from '@/components/AppIcon.vue'
 import SpringboardWidgetGrid from '@/components/SpringboardWidgetGrid.vue'
 import WidgetConfigSheet from '@/components/WidgetConfigSheet.vue'
 import WidgetPickerSheet from '@/components/WidgetPickerSheet.vue'
-import { PHONE_APPS } from '@/config/apps'
+import { getPhoneAppLabel, PHONE_APPS } from '@/config/apps'
 import { useAppStoreStore } from '@/stores/app-store'
 import { usePhoneStore } from '@/stores/phone'
 import { useWidgetsStore } from '@/stores/widgets'
@@ -74,9 +74,7 @@ let edgePageDirection = 0
 let edgePageLocked = false
 
 const installedApps = computed(() =>
-  PHONE_APPS.filter(
-    (app) => app.category !== 'games' || appStore.claimedApps.includes(app.id),
-  ),
+  PHONE_APPS.filter((app) => appStore.isInstalled(app.id)),
 )
 const installedAppsById = computed(
   () => new Map(installedApps.value.map((app) => [app.id, app])),
@@ -190,7 +188,9 @@ const filteredApps = computed(() => {
   const query = searchQuery.value.trim().toLocaleLowerCase(phone.lang)
   if (!query) return installedApps.value
   return installedApps.value.filter((app) =>
-    phone.t(app.labelKey).toLocaleLowerCase(phone.lang).includes(query),
+    getPhoneAppLabel(app, phone.t)
+      .toLocaleLowerCase(phone.lang)
+      .includes(query),
   )
 })
 const appGroups = computed(() => {
@@ -223,9 +223,14 @@ const appGroups = computed(() => {
 const alphabeticalGroups = computed(() => {
   const groups: Array<{ apps: PhoneAppDefinition[]; letter: string }> = []
   for (const app of [...filteredApps.value].sort((a, b) =>
-    phone.t(a.labelKey).localeCompare(phone.t(b.labelKey), phone.lang),
+    getPhoneAppLabel(a, phone.t).localeCompare(
+      getPhoneAppLabel(b, phone.t),
+      phone.lang,
+    ),
   )) {
-    const letter = phone.t(app.labelKey).charAt(0).toLocaleUpperCase(phone.lang)
+    const letter = getPhoneAppLabel(app, phone.t)
+      .charAt(0)
+      .toLocaleUpperCase(phone.lang)
     const group = groups.find((candidate) => candidate.letter === letter)
     if (group) group.apps.push(app)
     else groups.push({ apps: [app], letter })
@@ -803,7 +808,9 @@ watch(isEditablePage, (visible) => {
                   rounded
                   class="app-library-restore-button"
                   :aria-label="
-                    phone.t('Home.addToHome', { app: phone.t(app.labelKey) })
+                    phone.t('Home.addToHome', {
+                      app: getPhoneAppLabel(app, phone.t),
+                    })
                   "
                   @click.stop="restoreHomeApp(app.id)"
                 >
@@ -864,14 +871,16 @@ watch(isEditablePage, (visible) => {
                 class="app-library-row"
               >
                 <AppIcon :app="app" compact :show-label="false" />
-                <span>{{ phone.t(app.labelKey) }}</span>
+                <span>{{ getPhoneAppLabel(app, phone.t) }}</span>
                 <k-button
                   v-if="appStore.homeLayout.hidden.includes(app.id)"
                   small
                   rounded
                   class="app-library-row-restore"
                   :aria-label="
-                    phone.t('Home.addToHome', { app: phone.t(app.labelKey) })
+                    phone.t('Home.addToHome', {
+                      app: getPhoneAppLabel(app, phone.t),
+                    })
                   "
                   @click.stop="restoreHomeApp(app.id)"
                 >
diff --git a/frontend/src/views/apps/AppStoreApp.vue b/frontend/src/views/apps/AppStoreApp.vue
index ecd399c..301b40e 100644
--- a/frontend/src/views/apps/AppStoreApp.vue
+++ b/frontend/src/views/apps/AppStoreApp.vue
@@ -11,7 +11,11 @@ import { Gamepad2, Grid2X2, Search } from 'lucide-vue-next'
 import { computed, ref } from 'vue'
 import { useRouter } from 'vue-router'
 
-import { PHONE_APPS } from '@/config/apps'
+import {
+  getPhoneAppLabel,
+  isLaunchablePhoneApp,
+  PHONE_APPS,
+} from '@/config/apps'
 import { useAppStoreStore } from '@/stores/app-store'
 import { usePhoneStore } from '@/stores/phone'
 import type {
@@ -35,16 +39,11 @@ const tabBarColors = {
 }
 const catalog = computed(() =>
   PHONE_APPS.filter((app): app is LaunchablePhoneAppDefinition => {
-    if (
-      app.component === null ||
-      app.route === null ||
-      app.id === 'app-store'
-    ) {
+    if (!isLaunchablePhoneApp(app) || app.id === 'app-store') {
       return false
     }
 
-    const installed =
-      app.category !== 'games' || appStore.claimedApps.includes(app.id)
+    const installed = appStore.isInstalled(app.id)
     return (
       !installed ||
       appStore.homeLayout.hidden.includes(app.id) ||
@@ -63,7 +62,9 @@ const shownApps = computed(() => {
   const search = query.value.trim().toLocaleLowerCase(phone.lang)
   if (!search) return catalog.value
   return catalog.value.filter((app) =>
-    phone.t(app.labelKey).toLocaleLowerCase(phone.lang).includes(search),
+    getPhoneAppLabel(app, phone.t)
+      .toLocaleLowerCase(phone.lang)
+      .includes(search),
   )
 })
 
@@ -76,8 +77,7 @@ function appAction(
 ): 'get' | 'installing' | 'open' {
   if (appStore.installingApps[app.id]) return 'installing'
 
-  const installed =
-    app.category !== 'games' || appStore.claimedApps.includes(app.id)
+  const installed = appStore.isInstalled(app.id)
   if (
     installed &&
     !appStore.homeLayout.hidden.includes(app.id) &&
@@ -130,13 +130,13 @@ function handleApp(app: LaunchablePhoneAppDefinition): void {
             draggable="false"
           />
           <div>
-            <strong>{{ phone.t(app.labelKey) }}</strong>
+            <strong>{{ getPhoneAppLabel(app, phone.t) }}</strong>
             <small>{{ phone.t(`Home.groups.${app.category}`) }}</small>
           </div>
           <button
             type="button"
             :disabled="appStore.installingApps[app.id]"
-            :aria-label="`${phone.t(app.labelKey)} ${phone.t(
+            :aria-label="`${getPhoneAppLabel(app, phone.t)} ${phone.t(
               `Apps.appStore.${appAction(app)}`,
             )}`"
             @click="handleApp(app)"
diff --git a/frontend/src/views/apps/BillingApp.vue b/frontend/src/views/apps/BillingApp.vue
index 25c40b0..5b277a5 100644
--- a/frontend/src/views/apps/BillingApp.vue
+++ b/frontend/src/views/apps/BillingApp.vue
@@ -51,6 +51,7 @@ import type {
   BillingStatus,
   InvoiceSummary,
 } from '@/types/billing'
+import { isTrustedRootMessageSource } from '@/utils/windowMessages'
 
 type BillingTab = 'overview' | 'inbox' | 'history'
 type BillingScreen = 'main' | 'detail'
@@ -225,6 +226,7 @@ async function disputeInvoice(): Promise<void> {
 }
 
 function onBillingMessage(event: MessageEvent): void {
+  if (!isTrustedRootMessageSource(event.source, window)) return
   if (
     event.data?.type !== 'billing:changed' &&
     event.data?.type !== 'billing:new'
diff --git a/frontend/src/views/apps/CameraApp.vue b/frontend/src/views/apps/CameraApp.vue
index c1e604e..fe9b6e1 100644
--- a/frontend/src/views/apps/CameraApp.vue
+++ b/frontend/src/views/apps/CameraApp.vue
@@ -20,6 +20,7 @@ import type { MediaType, PhoneMedia, UploadResult } from '@/types/media'
 import { createGameView, type GameView } from '@/utils/gameView'
 import { formatRecordingDuration, mediaErrorKey } from '@/utils/media'
 import { nuiCall } from '@/utils/nui'
+import { isTrustedRootMessageSource } from '@/utils/windowMessages'
 
 type CaptureItem = {
   error?: string
@@ -333,6 +334,7 @@ function onKeydown(event: KeyboardEvent): void {
 }
 
 function onMessage(event: MessageEvent): void {
+  if (!isTrustedRootMessageSource(event.source, window)) return
   const message = event.data as {
     data?: Record<string, unknown>
     type?: string
diff --git a/frontend/src/views/apps/CompaniesApp.vue b/frontend/src/views/apps/CompaniesApp.vue
new file mode 100644
index 0000000..46176eb
--- /dev/null
+++ b/frontend/src/views/apps/CompaniesApp.vue
@@ -0,0 +1,3331 @@
+<script setup lang="ts">
+import {
+  kActions,
+  kActionsButton,
+  kActionsGroup,
+  kBadge,
+  kBlock,
+  kBlockTitle,
+  kButton,
+  kCard,
+  kChip,
+  kDialog,
+  kDialogButton,
+  kIcon,
+  kLink,
+  kList,
+  kListInput,
+  kListItem,
+  kMessage,
+  kMessagebar,
+  kMessages,
+  kMessagesTitle,
+  kNavbar,
+  kNavbarBackLink,
+  kPage,
+  kPreloader,
+  kProgressbar,
+  kRadio,
+  kSearchbar,
+  kSegmented,
+  kSegmentedButton,
+  kSheet,
+  kTabbar,
+  kTabbarLink,
+  kToast,
+  kToggle,
+  kToolbarPane,
+} from 'konsta/vue'
+import {
+  BadgeCheck,
+  BriefcaseBusiness,
+  Building2,
+  Check,
+  CheckCircle2,
+  CircleAlert,
+  ClipboardList,
+  Clock3,
+  Compass,
+  ImagePlus,
+  MapPin,
+  Megaphone,
+  MessageCircle,
+  MoreHorizontal,
+  Phone,
+  PhoneCall,
+  Plus,
+  RefreshCw,
+  Send,
+  Settings2,
+  Trash2,
+  UserRound,
+  UsersRound,
+  X,
+} from 'lucide-vue-next'
+import { computed, onBeforeUnmount, onMounted, reactive, ref, watch } from 'vue'
+import { useRoute, useRouter } from 'vue-router'
+
+import { useCallsStore } from '@/stores/calls'
+import { useCompaniesStore } from '@/stores/companies'
+import { useMessageMediaStore } from '@/stores/messageMedia'
+import { useMessagesStore } from '@/stores/messages'
+import { usePhoneStore } from '@/stores/phone'
+import type {
+  Company,
+  CompanyAvailability,
+  CompanyCoordinates,
+  CompanyDirectoryFilters,
+  CompanyHours,
+  CompanyRequestEvent,
+  CompanyRequestList,
+  CompanyRequestStatus,
+  CompanyRequestSummary,
+  CompanyService,
+  CompanySummary,
+  CompanyWorkFilter,
+} from '@/types/companies'
+import type { PhoneMedia } from '@/types/media'
+import { nuiCall } from '@/utils/nui'
+
+type CompaniesTab = 'directory' | 'requests' | 'work'
+type CompaniesScreen = 'company' | 'manager' | 'request' | 'root'
+type RequestOrigin = 'customer' | 'work'
+
+type RequestMediaContext = {
+  companyId: string
+  description: string
+  media: PhoneMedia[]
+  serviceId: string
+  subject: string
+}
+
+type ManagerProfileDraft = {
+  acceptsRequests: boolean
+  address: string
+  description: string
+  district: string
+  locationLabel: string
+}
+
+type ManagerMediaContext = {
+  announcement: { body: string; expiresAt: string }
+  companyId: string
+  coords: CompanyCoordinates | null
+  coverMedia: PhoneMedia | null
+  hours: CompanyHours[]
+  kind: 'cover' | 'logo'
+  logoMedia: PhoneMedia | null
+  profile: ManagerProfileDraft
+  services: CompanyService[]
+}
+
+const phone = usePhoneStore()
+const calls = useCallsStore()
+const messages = useMessagesStore()
+const companies = useCompaniesStore()
+const mediaPicker = useMessageMediaStore()
+const route = useRoute()
+const router = useRouter()
+
+const activeTab = ref<CompaniesTab>('directory')
+const screen = ref<CompaniesScreen>('root')
+const requestOrigin = ref<RequestOrigin>('customer')
+const search = ref('')
+const selectedCategory = ref<string | null>(null)
+const onlyAvailable = ref(false)
+const onlyWithLocation = ref(false)
+const onlyAcceptingRequests = ref(false)
+const directorySort = ref<CompanyDirectoryFilters['sort']>('relevance')
+const requestList = ref<CompanyRequestList>('open')
+const workFilter = ref<CompanyWorkFilter>('new')
+const requestSheetOpened = ref(false)
+const requestConfirmOpened = ref(false)
+const requestServiceId = ref('')
+const requestSubject = ref('')
+const requestDescription = ref('')
+const requestMedia = ref<PhoneMedia[]>([])
+const threadDraft = ref('')
+const workActionsOpened = ref(false)
+const assignmentSheetOpened = ref(false)
+const selectedMemberId = ref('')
+const cancelDialogOpened = ref(false)
+const conflictDialogOpened = ref(false)
+const toastOpened = ref(false)
+const toastText = ref('')
+const profileDraft = reactive<ManagerProfileDraft>({
+  acceptsRequests: false,
+  address: '',
+  description: '',
+  district: '',
+  locationLabel: '',
+})
+const hoursDraft = ref<CompanyHours[]>([])
+const servicesDraft = ref<CompanyService[]>([])
+const announcementDraft = reactive({ body: '', expiresAt: '' })
+const profileCoords = ref<CompanyCoordinates | null>(null)
+const selectedLogoMedia = ref<PhoneMedia | null>(null)
+const selectedCoverMedia = ref<PhoneMedia | null>(null)
+
+let searchTimer: ReturnType<typeof setTimeout> | undefined
+let toastTimer: ReturnType<typeof setTimeout> | undefined
+
+const directoryFilters = computed<CompanyDirectoryFilters>(() => ({
+  acceptsRequests: onlyAcceptingRequests.value,
+  availability: onlyAvailable.value ? 'available' : null,
+  categoryId: selectedCategory.value,
+  hasLocation: onlyWithLocation.value,
+  search: search.value.trim(),
+  sort: directorySort.value,
+}))
+const availableCompanies = computed(() =>
+  companies.directory.filter((company) => company.availability === 'available'),
+)
+const filtersActive = computed(
+  () =>
+    Boolean(search.value.trim()) ||
+    Boolean(selectedCategory.value) ||
+    onlyAvailable.value ||
+    onlyWithLocation.value ||
+    onlyAcceptingRequests.value,
+)
+const activeCompany = computed(() => companies.company)
+const workCompany = computed(() => companies.workContext?.company ?? null)
+const managerLogoUrl = computed(
+  () => selectedLogoMedia.value?.url ?? workCompany.value?.logoUrl ?? null,
+)
+const managerCoverUrl = computed(
+  () => selectedCoverMedia.value?.url ?? workCompany.value?.coverUrl ?? null,
+)
+const selectedService = computed(() =>
+  activeCompany.value?.services.find(
+    (service) => service.id === requestServiceId.value,
+  ),
+)
+const requestProgress = computed(() => {
+  if (!requestServiceId.value) return 0.25
+  if (!requestSubject.value.trim() || !requestDescription.value.trim())
+    return 0.5
+  if (!phone.device?.sim?.registered) return 0.75
+  return 1
+})
+const canSubmitRequest = computed(
+  () =>
+    Boolean(requestServiceId.value) &&
+    requestSubject.value.trim().length >= 3 &&
+    requestDescription.value.trim().length >= 10 &&
+    Boolean(phone.device?.sim?.registered) &&
+    !companies.mutating,
+)
+const canSendThreadMessage = computed(
+  () =>
+    Boolean(companies.request?.actions.canReply) &&
+    Boolean(threadDraft.value.trim()) &&
+    !companies.mutating,
+)
+const navbarTitle = computed(() => {
+  if (screen.value === 'company') return activeCompany.value?.name ?? ''
+  if (screen.value === 'request') {
+    return companies.request?.subject ?? phone.t('Apps.companies.request')
+  }
+  if (screen.value === 'manager') {
+    return phone.t('Apps.companies.manager.title')
+  }
+  return phone.t('Apps.companies.name')
+})
+const availabilityValues: CompanyAvailability[] = [
+  'available',
+  'busy',
+  'closed',
+]
+const workFilters: CompanyWorkFilter[] = [
+  'new',
+  'assigned',
+  'in_progress',
+  'waiting_customer',
+  'completed',
+]
+const weekdayKeys = [
+  'monday',
+  'tuesday',
+  'wednesday',
+  'thursday',
+  'friday',
+  'saturday',
+  'sunday',
+] as const
+
+function eventValue(event: Event): string {
+  if (
+    !(event.target instanceof HTMLInputElement) &&
+    !(event.target instanceof HTMLTextAreaElement) &&
+    !(event.target instanceof HTMLSelectElement)
+  ) {
+    console.error(
+      '[companies] Input event did not originate from a form field.',
+    )
+    return ''
+  }
+  return event.target.value
+}
+
+function messagebarValue(event: Event): string {
+  if (!(event.target instanceof HTMLTextAreaElement)) {
+    console.error(
+      '[companies] Message event did not originate from a textarea.',
+    )
+    return ''
+  }
+  return event.target.value
+}
+
+function showToast(message: string): void {
+  if (toastTimer) clearTimeout(toastTimer)
+  toastText.value = message
+  toastOpened.value = true
+  toastTimer = setTimeout(() => (toastOpened.value = false), 2800)
+}
+
+function errorText(code = 'request_failed'): string {
+  const phoneErrors = ['airplane_mode', 'busy', 'no_sim', 'voice_unavailable']
+  if (phoneErrors.includes(code)) return phone.t(`Apps.phone.errors.${code}`)
+  const known = [
+    'anonymous_sim',
+    'call_unavailable',
+    'company_not_found',
+    'invalid_media',
+    'invalid_expiration',
+    'invalid_profile',
+    'invalid_request',
+    'invalid_service',
+    'invalid_status',
+    'messaging_unavailable',
+    'no_sim',
+    'not_authorized',
+    'rate_limited',
+    'request_not_found',
+    'revision_conflict',
+    'service_unavailable',
+    'too_many_open_requests',
+  ]
+  const key = known.includes(code) ? code : 'request_failed'
+  return phone.t(`Apps.companies.errors.${key}`)
+}
+
+function formatDate(value: string): string {
+  const date = new Date(value)
+  if (Number.isNaN(date.getTime())) return ''
+  return new Intl.DateTimeFormat(phone.lang, {
+    day: 'numeric',
+    hour: '2-digit',
+    hourCycle: 'h23',
+    minute: '2-digit',
+    month: 'short',
+  }).format(date)
+}
+
+function localDateTimeInput(value: string | null | undefined): string {
+  if (!value) return ''
+  const date = new Date(value)
+  if (Number.isNaN(date.getTime())) return ''
+  const parts = [
+    date.getFullYear(),
+    String(date.getMonth() + 1).padStart(2, '0'),
+    String(date.getDate()).padStart(2, '0'),
+    String(date.getHours()).padStart(2, '0'),
+    String(date.getMinutes()).padStart(2, '0'),
+  ]
+  return `${parts[0]}-${parts[1]}-${parts[2]}T${parts[3]}:${parts[4]}`
+}
+
+function relativeTime(value: string): string {
+  const timestamp = new Date(value).getTime()
+  if (Number.isNaN(timestamp)) return ''
+  const minutes = Math.max(0, Math.floor((Date.now() - timestamp) / 60_000))
+  if (minutes < 1) return phone.t('Apps.companies.time.justNow')
+  if (minutes < 60) {
+    return phone.t('Apps.companies.time.minutesAgo', {
+      count: String(minutes),
+    })
+  }
+  const hours = Math.floor(minutes / 60)
+  if (hours < 24) {
+    return phone.t('Apps.companies.time.hoursAgo', { count: String(hours) })
+  }
+  return phone.t('Apps.companies.time.daysAgo', {
+    count: String(Math.floor(hours / 24)),
+  })
+}
+
+function companyInitials(company: CompanySummary): string {
+  return company.name
+    .split(/\s+/)
+    .slice(0, 2)
+    .map((word) => word[0] ?? '')
+    .join('')
+    .toUpperCase()
+}
+
+function categoryLabel(categoryId: string, fallback: string): string {
+  const key = `Apps.companies.categories.${categoryId}`
+  const translated = phone.t(key)
+  return translated === key ? fallback : translated
+}
+
+function statusClass(
+  status: CompanyAvailability | CompanyRequestStatus,
+): string {
+  return `is-${status.replace('_', '-')}`
+}
+
+function requestSubtitle(request: CompanyRequestSummary): string {
+  const parts = [request.serviceName, relativeTime(request.updatedAt)].filter(
+    Boolean,
+  )
+  return parts.join(' · ')
+}
+
+function assignmentLabel(
+  value: CompanyRequestSummary['assignedLabel'],
+): string {
+  return value
+    ? phone.t(`Apps.companies.assignmentLabels.${value}`)
+    : phone.t('Apps.companies.work.unassigned')
+}
+
+function messageAuthorLabel(value: 'company' | 'customer' | 'you'): string {
+  return phone.t(`Apps.companies.messageAuthors.${value}`)
+}
+
+function memberName(name: string): string {
+  return name.trim() || phone.t('Apps.companies.assignment.unknownMember')
+}
+
+function maskedPhoneNumber(value: string): string {
+  return value.replace(/.(?=.{4})/g, '•')
+}
+
+function eventLabel(event: CompanyRequestEvent): string {
+  if (event.type === 'status_changed' && event.status) {
+    return phone.t('Apps.companies.timeline.statusChanged', {
+      status: phone.t(`Apps.companies.requestStatuses.${event.status}`),
+    })
+  }
+  return phone.t(`Apps.companies.timeline.${event.type}`)
+}
+
+function resetDirectoryFilters(): void {
+  search.value = ''
+  selectedCategory.value = null
+  onlyAvailable.value = false
+  onlyWithLocation.value = false
+  onlyAcceptingRequests.value = false
+  directorySort.value = 'relevance'
+  void companies.loadCompanies(directoryFilters.value)
+}
+
+function queueDirectoryLoad(): void {
+  if (searchTimer) clearTimeout(searchTimer)
+  searchTimer = setTimeout(
+    () => void companies.loadCompanies(directoryFilters.value),
+    260,
+  )
+}
+
+function selectCategory(categoryId: string | null): void {
+  selectedCategory.value = categoryId
+}
+
+async function selectTab(tab: CompaniesTab): Promise<void> {
+  activeTab.value = tab
+  screen.value = 'root'
+  if (tab === 'directory' && !companies.directory.length) {
+    await companies.loadCompanies(directoryFilters.value)
+  }
+  if (tab === 'requests') await companies.loadMyRequests(requestList.value)
+  if (tab === 'work') {
+    const loaded = await companies.loadWorkContext()
+    if (loaded && companies.workContext?.authorized) {
+      await companies.loadWorkQueue(workFilter.value)
+    }
+  }
+}
+
+async function openCompany(companyId: string): Promise<void> {
+  companies.company = null
+  screen.value = 'company'
+  if (!(await companies.loadCompany(companyId))) {
+    showToast(errorText(companies.directoryError))
+  }
+}
+
+async function openRequest(
+  requestId: string,
+  origin: RequestOrigin,
+): Promise<void> {
+  requestOrigin.value = origin
+  companies.resetRequest()
+  screen.value = 'request'
+  if (!(await companies.loadRequest(requestId))) {
+    showToast(errorText(companies.requestError))
+  }
+}
+
+function goBack(): void {
+  if (screen.value === 'manager') {
+    screen.value = 'root'
+    activeTab.value = 'work'
+    return
+  }
+  if (screen.value === 'request') {
+    companies.resetRequest()
+    screen.value = 'root'
+    activeTab.value = requestOrigin.value === 'work' ? 'work' : 'requests'
+    return
+  }
+  screen.value = 'root'
+  activeTab.value = 'directory'
+}
+
+async function callNumber(phoneNumber: string | null): Promise<void> {
+  if (!phoneNumber) {
+    showToast(phone.t('Apps.companies.actionUnavailable.call'))
+    return
+  }
+  const response = await calls.dial(phoneNumber)
+  if (!response.success) {
+    showToast(errorText(response.error))
+    return
+  }
+  await router.push('/apps/phone')
+}
+
+async function messageCompany(company: CompanySummary): Promise<void> {
+  if (!company.canMessage || !company.phoneNumber) {
+    showToast(phone.t('Apps.companies.actionUnavailable.message'))
+    return
+  }
+  if (!(await messages.openThread(company.phoneNumber))) {
+    showToast(errorText('messaging_unavailable'))
+    return
+  }
+  await router.push('/apps/messages')
+}
+
+async function setRoute(company: CompanySummary): Promise<void> {
+  if (!company.location) {
+    showToast(phone.t('Apps.companies.actionUnavailable.route'))
+    return
+  }
+  const response = await nuiCall('map:setWaypoint', {
+    coords: company.location.coords,
+  })
+  if (!response.success) {
+    showToast(errorText(response.error))
+    return
+  }
+  showToast(phone.t('Apps.companies.routeSet'))
+}
+
+function openRequestComposer(company: Company): void {
+  if (!company.acceptsRequests) {
+    showToast(phone.t('Apps.companies.actionUnavailable.request'))
+    return
+  }
+  requestServiceId.value =
+    company.services.find(
+      (service) => service.active && service.acceptsRequests,
+    )?.id ?? ''
+  requestSubject.value = ''
+  requestDescription.value = ''
+  requestMedia.value = []
+  requestSheetOpened.value = true
+}
+
+function chooseRequestMedia(): void {
+  if (!activeCompany.value) return
+  mediaPicker.begin(
+    'companies:request',
+    'photo',
+    '/apps/companies?compose=1',
+    3,
+    {
+      companyId: activeCompany.value.id,
+      description: requestDescription.value,
+      media: requestMedia.value,
+      serviceId: requestServiceId.value,
+      subject: requestSubject.value,
+    } satisfies RequestMediaContext,
+  )
+  requestSheetOpened.value = false
+  void router.push({
+    path: '/apps/photos',
+    query: { mediaAttachment: 'photo' },
+  })
+}
+
+function removeRequestMedia(id: number): void {
+  requestMedia.value = requestMedia.value.filter((media) => media.id !== id)
+}
+
+async function submitRequest(): Promise<void> {
+  if (!activeCompany.value || !canSubmitRequest.value) return
+  const response = await companies.createRequest({
+    companyId: activeCompany.value.id,
+    description: requestDescription.value.trim(),
+    mediaIds: requestMedia.value.map((media) => String(media.id)),
+    serviceId: requestServiceId.value,
+    subject: requestSubject.value.trim(),
+  })
+  requestConfirmOpened.value = false
+  if (!response.success || !response.data?.request) {
+    if (response.error === 'revision_conflict')
+      conflictDialogOpened.value = true
+    else showToast(errorText(response.error))
+    return
+  }
+  requestSheetOpened.value = false
+  showToast(phone.t('Apps.companies.feedback.requestCreated'))
+  activeTab.value = 'requests'
+  requestOrigin.value = 'customer'
+  screen.value = 'request'
+  await companies.loadMyRequests('open')
+}
+
+async function sendThreadMessage(): Promise<void> {
+  const request = companies.request
+  if (!request || !canSendThreadMessage.value) return
+  const response = await companies.sendMessage(
+    request.id,
+    threadDraft.value.trim(),
+    request.revision,
+  )
+  if (!response.success) {
+    if (response.error === 'revision_conflict')
+      conflictDialogOpened.value = true
+    else showToast(errorText(response.error))
+    return
+  }
+  threadDraft.value = ''
+}
+
+async function cancelActiveRequest(): Promise<void> {
+  const request = companies.request
+  if (!request) return
+  const response = await companies.cancelRequest(request.id, request.revision)
+  cancelDialogOpened.value = false
+  if (!response.success) {
+    if (response.error === 'revision_conflict')
+      conflictDialogOpened.value = true
+    else showToast(errorText(response.error))
+    return
+  }
+  showToast(phone.t('Apps.companies.feedback.requestCancelled'))
+}
+
+async function claimActiveRequest(): Promise<void> {
+  const request = companies.request
+  if (!request) return
+  const response = await companies.claimRequest(request.id, request.revision)
+  workActionsOpened.value = false
+  if (!response.success) {
+    if (response.error === 'revision_conflict')
+      conflictDialogOpened.value = true
+    else showToast(errorText(response.error))
+    return
+  }
+  showToast(phone.t('Apps.companies.feedback.requestClaimed'))
+}
+
+async function openAssignment(): Promise<void> {
+  workActionsOpened.value = false
+  selectedMemberId.value = ''
+  if (!(await companies.loadMembers())) {
+    showToast(errorText(companies.mutationError))
+    return
+  }
+  assignmentSheetOpened.value = true
+}
+
+async function assignActiveRequest(): Promise<void> {
+  const request = companies.request
+  if (!request || !selectedMemberId.value) return
+  const response = await companies.assignRequest(
+    request.id,
+    selectedMemberId.value,
+    request.revision,
+  )
+  if (!response.success) {
+    if (response.error === 'revision_conflict')
+      conflictDialogOpened.value = true
+    else showToast(errorText(response.error))
+    return
+  }
+  assignmentSheetOpened.value = false
+  showToast(phone.t('Apps.companies.feedback.requestAssigned'))
+}
+
+async function updateActiveRequestStatus(
+  status: CompanyRequestStatus,
+): Promise<void> {
+  const request = companies.request
+  if (!request) return
+  const response = await companies.updateRequestStatus(
+    request.id,
+    status,
+    request.revision,
+  )
+  workActionsOpened.value = false
+  if (!response.success) {
+    if (response.error === 'revision_conflict')
+      conflictDialogOpened.value = true
+    else showToast(errorText(response.error))
+    return
+  }
+  showToast(phone.t('Apps.companies.feedback.statusUpdated'))
+}
+
+async function callRequestParty(): Promise<void> {
+  const request = companies.request
+  if (!request) return
+  if (requestOrigin.value === 'work') {
+    const response = await companies.callCustomer(request.id)
+    workActionsOpened.value = false
+    if (!response.success) {
+      showToast(errorText(response.error))
+      return
+    }
+    if (response.data) calls.applyCallState(response.data)
+    await router.push('/apps/phone')
+    return
+  }
+  await callNumber(request.phoneNumber)
+}
+
+async function setCompanyAvailability(
+  availability: CompanyAvailability,
+): Promise<void> {
+  const company = workCompany.value
+  if (!company) return
+  const response = await companies.updateAvailability(
+    availability,
+    company.revision,
+  )
+  if (!response.success) {
+    if (response.error === 'revision_conflict')
+      conflictDialogOpened.value = true
+    else showToast(errorText(response.error))
+    return
+  }
+  showToast(phone.t('Apps.companies.feedback.availabilityUpdated'))
+}
+
+async function toggleCallAvailability(): Promise<void> {
+  const context = companies.workContext
+  if (!context) return
+  const response = await companies.setCallAvailability(!context.callAvailable)
+  if (!response.success) {
+    showToast(errorText(response.error))
+    return
+  }
+  showToast(
+    phone.t(
+      `Apps.companies.feedback.${response.data?.context.callAvailable ? 'callsEnabled' : 'callsDisabled'}`,
+    ),
+  )
+}
+
+function syncManagerDraft(company: Company): void {
+  profileDraft.acceptsRequests = company.acceptsRequests
+  profileDraft.address = company.location?.address ?? ''
+  profileDraft.description = company.description
+  profileDraft.district = company.location?.district ?? ''
+  profileDraft.locationLabel = company.location?.label ?? ''
+  hoursDraft.value = weekdayKeys.map((_, day) => {
+    const existing = company.hours.find((hours) => hours.day === day)
+    return existing
+      ? { ...existing }
+      : { closesAt: '18:00', day, isClosed: true, opensAt: '09:00' }
+  })
+  servicesDraft.value = company.services.map((service) => ({ ...service }))
+  announcementDraft.body = company.announcement?.body ?? ''
+  announcementDraft.expiresAt = localDateTimeInput(
+    company.announcement?.expiresAt,
+  )
+  profileCoords.value = company.location?.coords
+    ? { ...company.location.coords }
+    : null
+  selectedLogoMedia.value = null
+  selectedCoverMedia.value = null
+}
+
+function openManager(): void {
+  const company = workCompany.value
+  if (!company) return
+  syncManagerDraft(company)
+  screen.value = 'manager'
+}
+
+function managerResponseError(error?: string): void {
+  if (error === 'revision_conflict') {
+    conflictDialogOpened.value = true
+    return
+  }
+  showToast(errorText(error))
+}
+
+function chooseManagerMedia(kind: 'cover' | 'logo'): void {
+  const company = workCompany.value
+  if (!company) return
+  mediaPicker.begin(
+    'companies:manager-media',
+    'photo',
+    '/apps/companies?managerMedia=1',
+    1,
+    {
+      announcement: { ...announcementDraft },
+      companyId: company.id,
+      coords: profileCoords.value ? { ...profileCoords.value } : null,
+      coverMedia: selectedCoverMedia.value,
+      hours: hoursDraft.value.map((hours) => ({ ...hours })),
+      kind,
+      logoMedia: selectedLogoMedia.value,
+      profile: { ...profileDraft },
+      services: servicesDraft.value.map((service) => ({ ...service })),
+    } satisfies ManagerMediaContext,
+  )
+  void router.push({
+    path: '/apps/photos',
+    query: { mediaAttachment: 'photo' },
+  })
+}
+
+async function useCurrentLocation(): Promise<void> {
+  const response = await nuiCall<{ coords?: CompanyCoordinates }>(
+    'map:getPlayerCoords',
+  )
+  if (!response.success || !response.data?.coords) {
+    showToast(errorText(response.error))
+    return
+  }
+  profileCoords.value = { ...response.data.coords }
+  showToast(phone.t('Apps.companies.feedback.locationUpdated'))
+}
+
+async function saveProfile(): Promise<void> {
+  const company = workCompany.value
+  if (!company) return
+  const response = await companies.updateProfile({
+    acceptsRequests: profileDraft.acceptsRequests,
+    address: profileDraft.address.trim(),
+    ...(profileCoords.value ? { coords: profileCoords.value } : {}),
+    ...(selectedCoverMedia.value
+      ? { coverMediaId: selectedCoverMedia.value.id }
+      : {}),
+    description: profileDraft.description.trim(),
+    district: profileDraft.district.trim(),
+    ...(selectedLogoMedia.value
+      ? { logoMediaId: selectedLogoMedia.value.id }
+      : {}),
+    locationLabel: profileDraft.locationLabel.trim(),
+    revision: company.revision,
+  })
+  if (!response.success || !response.data?.company) {
+    managerResponseError(response.error)
+    return
+  }
+  syncManagerDraft(response.data.company)
+  showToast(phone.t('Apps.companies.feedback.profileSaved'))
+}
+
+function updateHour(
+  index: number,
+  field: 'closesAt' | 'opensAt',
+  event: Event,
+): void {
+  hoursDraft.value[index][field] = eventValue(event)
+}
+
+async function saveHours(): Promise<void> {
+  const company = workCompany.value
+  if (!company) return
+  const response = await companies.updateHours(
+    company.revision,
+    hoursDraft.value,
+  )
+  if (!response.success || !response.data?.company) {
+    managerResponseError(response.error)
+    return
+  }
+  syncManagerDraft(response.data.company)
+  showToast(phone.t('Apps.companies.feedback.hoursSaved'))
+}
+
+function addService(): void {
+  servicesDraft.value.push({
+    acceptsRequests: true,
+    active: true,
+    description: '',
+    id: '',
+    priceText: null,
+    title: '',
+  })
+}
+
+function removeService(index: number): void {
+  servicesDraft.value.splice(index, 1)
+}
+
+function updateService(
+  index: number,
+  field: 'description' | 'priceText' | 'title',
+  event: Event,
+): void {
+  servicesDraft.value[index][field] = eventValue(event)
+}
+
+async function saveServices(): Promise<void> {
+  const company = workCompany.value
+  if (!company) return
+  const response = await companies.updateServices(
+    company.revision,
+    servicesDraft.value,
+  )
+  if (!response.success || !response.data?.company) {
+    managerResponseError(response.error)
+    return
+  }
+  syncManagerDraft(response.data.company)
+  showToast(phone.t('Apps.companies.feedback.servicesSaved'))
+}
+
+async function publishAnnouncement(): Promise<void> {
+  const company = workCompany.value
+  if (!company) return
+  let expiresAt: string | null = null
+  if (announcementDraft.expiresAt) {
+    const expiration = new Date(announcementDraft.expiresAt)
+    if (Number.isNaN(expiration.getTime())) {
+      showToast(errorText('invalid_expiration'))
+      return
+    }
+    expiresAt = expiration.toISOString()
+  }
+  const response = await companies.publishAnnouncement({
+    body: announcementDraft.body.trim(),
+    expiresAt,
+    revision: company.revision,
+  })
+  if (!response.success || !response.data?.company) {
+    managerResponseError(response.error)
+    return
+  }
+  syncManagerDraft(response.data.company)
+  showToast(phone.t('Apps.companies.feedback.announcementPublished'))
+}
+
+async function reloadConflict(): Promise<void> {
+  conflictDialogOpened.value = false
+  const loaded = await companies.loadWorkContext()
+  if (loaded && companies.workContext?.company) {
+    syncManagerDraft(companies.workContext.company)
+  }
+  if (companies.request) await companies.loadRequest(companies.request.id)
+}
+
+watch(search, queueDirectoryLoad)
+watch(
+  [
+    selectedCategory,
+    onlyAvailable,
+    onlyWithLocation,
+    onlyAcceptingRequests,
+    directorySort,
+  ],
+  () => void companies.loadCompanies(directoryFilters.value),
+)
+watch(requestList, () => {
+  if (activeTab.value === 'requests')
+    void companies.loadMyRequests(requestList.value)
+})
+watch(workFilter, () => {
+  if (activeTab.value === 'work' && companies.workContext?.authorized) {
+    void companies.loadWorkQueue(workFilter.value)
+  }
+})
+watch(
+  () => route.query.requestId,
+  async (requestId) => {
+    if (typeof requestId !== 'string') return
+    const origin: RequestOrigin =
+      route.query.area === 'work' ? 'work' : 'customer'
+    await router.replace('/apps/companies')
+    await openRequest(requestId, origin)
+  },
+)
+
+onMounted(async () => {
+  const selection =
+    mediaPicker.consumeMany<RequestMediaContext>('companies:request')
+  const managerSelection = mediaPicker.consumeMany<ManagerMediaContext>(
+    'companies:manager-media',
+  )
+  const linkedRequestId =
+    typeof route.query.requestId === 'string' ? route.query.requestId : null
+  const linkedRequestOrigin: RequestOrigin =
+    route.query.area === 'work' ? 'work' : 'customer'
+  await Promise.all([
+    companies.loadCompanies(directoryFilters.value),
+    companies.loadMyRequests('open'),
+    companies.loadWorkContext(),
+    calls.loadContacts(),
+  ])
+  if (linkedRequestId) {
+    await router.replace('/apps/companies')
+    await openRequest(linkedRequestId, linkedRequestOrigin)
+    return
+  }
+  if (
+    managerSelection?.context &&
+    managerSelection.context.companyId === workCompany.value?.id &&
+    companies.workContext?.permissions.canManageProfile
+  ) {
+    const context = managerSelection.context
+    openManager()
+    Object.assign(profileDraft, context.profile)
+    hoursDraft.value = context.hours.map((hours) => ({ ...hours }))
+    servicesDraft.value = context.services.map((service) => ({ ...service }))
+    announcementDraft.body = context.announcement.body
+    announcementDraft.expiresAt = context.announcement.expiresAt
+    profileCoords.value = context.coords ? { ...context.coords } : null
+    selectedLogoMedia.value = context.logoMedia
+    selectedCoverMedia.value = context.coverMedia
+    const selectedMedia = managerSelection.media[0]
+    if (selectedMedia && context.kind === 'logo') {
+      selectedLogoMedia.value = selectedMedia
+    } else if (selectedMedia && context.kind === 'cover') {
+      selectedCoverMedia.value = selectedMedia
+    }
+    return
+  }
+  if (!selection?.context) return
+  await openCompany(selection.context.companyId)
+  requestServiceId.value = selection.context.serviceId
+  requestSubject.value = selection.context.subject
+  requestDescription.value = selection.context.description
+  requestMedia.value = selection.media.length
+    ? selection.media
+    : selection.context.media
+  requestSheetOpened.value = true
+})
+
+onBeforeUnmount(() => {
+  if (searchTimer) clearTimeout(searchTimer)
+  if (toastTimer) clearTimeout(toastTimer)
+})
+</script>
+
+<template>
+  <k-page
+    component="main"
+    class="companies-app"
+    :class="{ 'companies-app--dark': phone.isDarkMode }"
+    :colors="{ bgIos: 'bg-transparent' }"
+    :aria-label="phone.t('Apps.companies.name')"
+  >
+    <div class="companies-backdrop" aria-hidden="true"></div>
+
+    <k-navbar :title="navbarTitle" class="companies-navbar">
+      <template v-if="screen !== 'root'" #left>
+        <k-navbar-back-link
+          :text="phone.t('Apps.companies.back')"
+          :show-text="false"
+          @click="goBack"
+        />
+      </template>
+      <template
+        v-if="
+          screen === 'request' && requestOrigin === 'work' && companies.request
+        "
+        #right
+      >
+        <k-link
+          component="button"
+          icon-only
+          :aria-label="phone.t('Apps.companies.actions')"
+          :link-props="{ type: 'button' }"
+          @click="workActionsOpened = true"
+        >
+          <MoreHorizontal :size="24" />
+        </k-link>
+      </template>
+    </k-navbar>
+
+    <section
+      v-if="screen === 'root' && activeTab === 'directory'"
+      class="companies-content companies-directory"
+    >
+      <div class="companies-search-wrap">
+        <k-searchbar
+          :value="search"
+          :placeholder="phone.t('Apps.companies.directory.searchPlaceholder')"
+          :disable-button="true"
+          @input="search = eventValue($event)"
+          @clear="search = ''"
+        />
+      </div>
+
+      <div
+        class="companies-chip-row"
+        :aria-label="phone.t('Apps.companies.directory.categories')"
+      >
+        <k-chip
+          component="button"
+          type="button"
+          :class="{ 'is-selected': selectedCategory === null }"
+          @click="selectCategory(null)"
+        >
+          {{ phone.t('Apps.companies.directory.allCategories') }}
+        </k-chip>
+        <k-chip
+          v-for="category in companies.categories"
+          :key="category.id"
+          component="button"
+          type="button"
+          :class="{ 'is-selected': selectedCategory === category.id }"
+          @click="selectCategory(category.id)"
+        >
+          {{ categoryLabel(category.id, category.name) }}
+        </k-chip>
+      </div>
+
+      <k-card class="companies-filter-card" :content-wrap="false">
+        <k-list nested>
+          <k-list-item
+            :title="phone.t('Apps.companies.directory.availableNow')"
+            :subtitle="phone.t('Apps.companies.directory.availableNowHint')"
+          >
+            <template #after>
+              <k-toggle
+                :checked="onlyAvailable"
+                :aria-label="phone.t('Apps.companies.directory.availableNow')"
+                @change="onlyAvailable = !onlyAvailable"
+              />
+            </template>
+          </k-list-item>
+          <k-list-item :title="phone.t('Apps.companies.directory.moreFilters')">
+            <template #after>
+              <div class="companies-inline-chips">
+                <k-chip
+                  component="button"
+                  type="button"
+                  :class="{ 'is-selected': onlyWithLocation }"
+                  @click="onlyWithLocation = !onlyWithLocation"
+                >
+                  {{ phone.t('Apps.companies.directory.hasLocation') }}
+                </k-chip>
+                <k-chip
+                  component="button"
+                  type="button"
+                  :class="{ 'is-selected': onlyAcceptingRequests }"
+                  @click="onlyAcceptingRequests = !onlyAcceptingRequests"
+                >
+                  {{ phone.t('Apps.companies.directory.acceptsRequests') }}
+                </k-chip>
+              </div>
+            </template>
+          </k-list-item>
+        </k-list>
+      </k-card>
+
+      <div v-if="companies.directoryLoading" class="companies-state">
+        <k-preloader />
+        <span>{{ phone.t('Apps.companies.loading.directory') }}</span>
+      </div>
+      <div v-else-if="companies.directoryError" class="companies-state">
+        <CircleAlert :size="34" />
+        <strong>{{ phone.t('Apps.companies.states.directoryError') }}</strong>
+        <p>{{ errorText(companies.directoryError) }}</p>
+        <k-button rounded @click="companies.loadCompanies(directoryFilters)">
+          <RefreshCw :size="16" />
+          {{ phone.t('Apps.companies.tryAgain') }}
+        </k-button>
+      </div>
+      <div v-else-if="!companies.directory.length" class="companies-state">
+        <Building2 :size="36" />
+        <strong>
+          {{
+            phone.t(
+              filtersActive
+                ? 'Apps.companies.states.noResults'
+                : 'Apps.companies.states.noCompanies',
+            )
+          }}
+        </strong>
+        <p>
+          {{
+            phone.t(
+              filtersActive
+                ? 'Apps.companies.states.noResultsBody'
+                : 'Apps.companies.states.noCompaniesBody',
+            )
+          }}
+        </p>
+        <k-button v-if="filtersActive" rounded @click="resetDirectoryFilters">
+          {{ phone.t('Apps.companies.directory.resetFilters') }}
+        </k-button>
+      </div>
+      <template v-else>
+        <template v-if="availableCompanies.length && !onlyAvailable">
+          <k-block-title>{{
+            phone.t('Apps.companies.directory.availableSection')
+          }}</k-block-title>
+          <div class="companies-featured-row">
+            <k-card
+              v-for="company in availableCompanies.slice(0, 4)"
+              :key="`available-${company.id}`"
+              component="button"
+              type="button"
+              class="company-feature-card"
+              @click="openCompany(company.id)"
+            >
+              <span class="company-logo company-logo--small">
+                <img
+                  v-if="company.logoUrl"
+                  :src="company.logoUrl"
+                  :alt="company.name"
+                />
+                <span v-else>{{ companyInitials(company) }}</span>
+              </span>
+              <strong>{{ company.name }}</strong>
+              <span>{{
+                company.location?.district ??
+                categoryLabel(company.categoryId, company.categoryName)
+              }}</span>
+              <k-badge :class="statusClass(company.availability)">
+                {{
+                  phone.t(`Apps.companies.availability.${company.availability}`)
+                }}
+              </k-badge>
+            </k-card>
+          </div>
+        </template>
+
+        <k-block-title>{{
+          phone.t('Apps.companies.directory.allCompanies')
+        }}</k-block-title>
+        <k-list inset strong class="company-list">
+          <k-list-item
+            v-for="company in companies.directory"
+            :key="company.id"
+            link
+            link-component="button"
+            :link-props="{ type: 'button' }"
+            :title="company.name"
+            :subtitle="company.serviceSummary || company.description"
+            @click="openCompany(company.id)"
+          >
+            <template #media>
+              <span class="company-logo">
+                <img
+                  v-if="company.logoUrl"
+                  :src="company.logoUrl"
+                  :alt="company.name"
+                />
+                <span v-else>{{ companyInitials(company) }}</span>
+              </span>
+            </template>
+            <template #after>
+              <span class="company-row-after">
+                <k-badge :class="statusClass(company.availability)">
+                  {{
+                    phone.t(
+                      `Apps.companies.availability.${company.availability}`,
+                    )
+                  }}
+                </k-badge>
+                <small>{{
+                  company.location?.district ??
+                  categoryLabel(company.categoryId, company.categoryName)
+                }}</small>
+              </span>
+            </template>
+          </k-list-item>
+        </k-list>
+        <k-button
+          v-if="companies.directoryNextCursor"
+          outline
+          rounded
+          class="companies-load-more"
+          :disabled="companies.directoryLoadingMore"
+          @click="companies.loadCompanies(directoryFilters, true)"
+        >
+          <k-preloader v-if="companies.directoryLoadingMore" />
+          <span v-else>{{ phone.t('Apps.companies.loadMore') }}</span>
+        </k-button>
+      </template>
+    </section>
+
+    <section
+      v-else-if="screen === 'root' && activeTab === 'requests'"
+      class="companies-content"
+    >
+      <div class="companies-segment-wrap">
+        <k-segmented strong rounded>
+          <k-segmented-button
+            :active="requestList === 'open'"
+            @click="requestList = 'open'"
+          >
+            {{ phone.t('Apps.companies.requests.open') }}
+          </k-segmented-button>
+          <k-segmented-button
+            :active="requestList === 'closed'"
+            @click="requestList = 'closed'"
+          >
+            {{ phone.t('Apps.companies.requests.closed') }}
+          </k-segmented-button>
+        </k-segmented>
+      </div>
+
+      <div v-if="companies.myRequestsLoading" class="companies-state">
+        <k-preloader />
+        <span>{{ phone.t('Apps.companies.loading.requests') }}</span>
+      </div>
+      <div v-else-if="companies.myRequestsError" class="companies-state">
+        <CircleAlert :size="34" />
+        <strong>{{ phone.t('Apps.companies.states.requestsError') }}</strong>
+        <p>{{ errorText(companies.myRequestsError) }}</p>
+        <k-button rounded @click="companies.loadMyRequests(requestList)">
+          {{ phone.t('Apps.companies.tryAgain') }}
+        </k-button>
+      </div>
+      <div v-else-if="!companies.myRequests.length" class="companies-state">
+        <ClipboardList :size="36" />
+        <strong>{{
+          phone.t(
+            `Apps.companies.states.no${requestList === 'open' ? 'Open' : 'Closed'}Requests`,
+          )
+        }}</strong>
+        <p>{{ phone.t('Apps.companies.states.noRequestsBody') }}</p>
+        <k-button
+          v-if="requestList === 'open'"
+          rounded
+          @click="selectTab('directory')"
+        >
+          {{ phone.t('Apps.companies.requests.findCompany') }}
+        </k-button>
+      </div>
+      <k-list v-else inset strong class="company-request-list">
+        <k-list-item
+          v-for="item in companies.myRequests"
+          :key="item.id"
+          link
+          link-component="button"
+          :link-props="{ type: 'button' }"
+          :title="item.subject"
+          :subtitle="requestSubtitle(item)"
+          :header="item.companyName"
+          @click="openRequest(item.id, 'customer')"
+        >
+          <template #media>
+            <span class="company-request-icon"
+              ><ClipboardList :size="19"
+            /></span>
+          </template>
+          <template #after>
+            <span class="request-row-after">
+              <k-badge v-if="item.unreadCount" class="is-unread">{{
+                item.unreadCount
+              }}</k-badge>
+              <k-badge :class="statusClass(item.status)">
+                {{ phone.t(`Apps.companies.requestStatuses.${item.status}`) }}
+              </k-badge>
+            </span>
+          </template>
+        </k-list-item>
+      </k-list>
+      <k-button
+        v-if="companies.myRequestsNextCursor"
+        outline
+        rounded
+        class="companies-load-more"
+        :disabled="companies.myRequestsLoadingMore"
+        @click="companies.loadMyRequests(requestList, true)"
+      >
+        {{ phone.t('Apps.companies.loadMore') }}
+      </k-button>
+    </section>
+
+    <section
+      v-else-if="screen === 'root' && activeTab === 'work'"
+      class="companies-content companies-work"
+    >
+      <div v-if="companies.workContextLoading" class="companies-state">
+        <k-preloader />
+        <span>{{ phone.t('Apps.companies.loading.work') }}</span>
+      </div>
+      <div v-else-if="companies.workContextError" class="companies-state">
+        <CircleAlert :size="34" />
+        <strong>{{ phone.t('Apps.companies.states.workError') }}</strong>
+        <p>{{ errorText(companies.workContextError) }}</p>
+        <k-button rounded @click="selectTab('work')">
+          {{ phone.t('Apps.companies.tryAgain') }}
+        </k-button>
+      </div>
+      <div
+        v-else-if="!companies.workContext?.authorized"
+        class="companies-state"
+      >
+        <BriefcaseBusiness :size="38" />
+        <strong>{{ phone.t('Apps.companies.work.notAuthorized') }}</strong>
+        <p>{{ phone.t('Apps.companies.work.notAuthorizedBody') }}</p>
+      </div>
+      <template v-else-if="companies.workContext && workCompany">
+        <k-card class="work-identity-card">
+          <span class="company-logo company-logo--large">
+            <img
+              v-if="workCompany.logoUrl"
+              :src="workCompany.logoUrl"
+              :alt="workCompany.name"
+            />
+            <span v-else>{{ companyInitials(workCompany) }}</span>
+          </span>
+          <span>
+            <small>{{ phone.t('Apps.companies.work.workspace') }}</small>
+            <strong>{{ workCompany.name }}</strong>
+            <span>{{
+              phone.t(`Apps.companies.roles.${companies.workContext.role}`)
+            }}</span>
+          </span>
+          <k-badge :class="statusClass(workCompany.availability)">
+            {{
+              phone.t(`Apps.companies.availability.${workCompany.availability}`)
+            }}
+          </k-badge>
+        </k-card>
+
+        <k-block-title>{{
+          phone.t('Apps.companies.work.publicAvailability')
+        }}</k-block-title>
+        <k-segmented strong rounded class="availability-segmented">
+          <k-segmented-button
+            v-for="availability in availabilityValues"
+            :key="availability"
+            :active="workCompany.availability === availability"
+            :disabled="
+              !companies.workContext.permissions.canSetAvailability ||
+              companies.mutating
+            "
+            @click="setCompanyAvailability(availability)"
+          >
+            {{ phone.t(`Apps.companies.availability.${availability}`) }}
+          </k-segmented-button>
+        </k-segmented>
+
+        <k-list inset strong>
+          <k-list-item
+            v-if="companies.workContext.permissions.canTakeCalls"
+            :title="phone.t('Apps.companies.work.takeCalls')"
+            :subtitle="phone.t('Apps.companies.work.takeCallsBody')"
+          >
+            <template #media><PhoneCall :size="20" /></template>
+            <template #after>
+              <k-toggle
+                :checked="companies.workContext.callAvailable"
+                :disabled="companies.mutating"
+                :aria-label="phone.t('Apps.companies.work.takeCalls')"
+                @change="toggleCallAvailability"
+              />
+            </template>
+          </k-list-item>
+          <k-list-item
+            v-if="companies.workContext.role === 'manager'"
+            link
+            link-component="button"
+            :link-props="{ type: 'button' }"
+            :title="phone.t('Apps.companies.manager.title')"
+            :subtitle="phone.t('Apps.companies.manager.subtitle')"
+            @click="openManager"
+          >
+            <template #media><Settings2 :size="20" /></template>
+          </k-list-item>
+        </k-list>
+
+        <k-block-title>{{
+          phone.t('Apps.companies.work.overview')
+        }}</k-block-title>
+        <div class="work-metrics">
+          <k-card>
+            <strong>{{ companies.workContext.metrics.new }}</strong>
+            <span>{{ phone.t('Apps.companies.work.metrics.new') }}</span>
+          </k-card>
+          <k-card>
+            <strong>{{ companies.workContext.metrics.assigned }}</strong>
+            <span>{{ phone.t('Apps.companies.work.metrics.assigned') }}</span>
+          </k-card>
+          <k-card>
+            <strong>{{ companies.workContext.metrics.waiting }}</strong>
+            <span>{{ phone.t('Apps.companies.work.metrics.waiting') }}</span>
+          </k-card>
+          <k-card>
+            <strong>{{ companies.workContext.metrics.completedToday }}</strong>
+            <span>{{
+              phone.t('Apps.companies.work.metrics.completedToday')
+            }}</span>
+          </k-card>
+        </div>
+
+        <k-block-title>{{
+          phone.t('Apps.companies.work.queue')
+        }}</k-block-title>
+        <div class="companies-chip-row work-filter-row">
+          <k-chip
+            v-for="filter in workFilters"
+            :key="filter"
+            component="button"
+            type="button"
+            :class="{ 'is-selected': workFilter === filter }"
+            @click="workFilter = filter"
+          >
+            {{ phone.t(`Apps.companies.work.filters.${filter}`) }}
+          </k-chip>
+        </div>
+        <div
+          v-if="companies.workQueueLoading"
+          class="companies-state companies-state--compact"
+        >
+          <k-preloader />
+        </div>
+        <div
+          v-else-if="companies.workQueueError"
+          class="companies-state companies-state--compact"
+        >
+          <CircleAlert :size="28" />
+          <p>{{ errorText(companies.workQueueError) }}</p>
+          <k-button small rounded @click="companies.loadWorkQueue(workFilter)">
+            {{ phone.t('Apps.companies.tryAgain') }}
+          </k-button>
+        </div>
+        <div
+          v-else-if="!companies.workQueue.length"
+          class="companies-state companies-state--compact"
+        >
+          <CheckCircle2 :size="31" />
+          <strong>{{ phone.t('Apps.companies.work.emptyQueue') }}</strong>
+          <p>{{ phone.t('Apps.companies.work.emptyQueueBody') }}</p>
+        </div>
+        <k-list v-else inset strong class="company-request-list">
+          <k-list-item
+            v-for="item in companies.workQueue"
+            :key="item.id"
+            link
+            link-component="button"
+            :link-props="{ type: 'button' }"
+            :title="item.subject"
+            :subtitle="requestSubtitle(item)"
+            :header="assignmentLabel(item.assignedLabel)"
+            @click="openRequest(item.id, 'work')"
+          >
+            <template #media
+              ><span class="company-request-icon"
+                ><BriefcaseBusiness :size="19" /></span
+            ></template>
+            <template #after>
+              <k-badge :class="statusClass(item.status)">
+                {{ phone.t(`Apps.companies.requestStatuses.${item.status}`) }}
+              </k-badge>
+            </template>
+          </k-list-item>
+        </k-list>
+        <k-button
+          v-if="companies.workQueueNextCursor"
+          outline
+          rounded
+          class="companies-load-more"
+          :disabled="companies.workQueueLoadingMore"
+          @click="companies.loadWorkQueue(workFilter, true)"
+        >
+          {{ phone.t('Apps.companies.loadMore') }}
+        </k-button>
+      </template>
+    </section>
+
+    <section
+      v-else-if="screen === 'company'"
+      class="companies-content company-profile"
+    >
+      <div
+        v-if="companies.directoryLoading && !activeCompany"
+        class="companies-state"
+      >
+        <k-preloader />
+        <span>{{ phone.t('Apps.companies.loading.profile') }}</span>
+      </div>
+      <div
+        v-else-if="companies.directoryError || !activeCompany"
+        class="companies-state"
+      >
+        <CircleAlert :size="34" />
+        <strong>{{ phone.t('Apps.companies.states.profileError') }}</strong>
+        <p>{{ errorText(companies.directoryError) }}</p>
+        <k-button rounded @click="goBack">{{
+          phone.t('Apps.companies.back')
+        }}</k-button>
+      </div>
+      <template v-else>
+        <div
+          class="company-cover"
+          :style="
+            activeCompany.coverUrl
+              ? { backgroundImage: `url(${activeCompany.coverUrl})` }
+              : undefined
+          "
+        >
+          <span class="company-logo company-logo--hero">
+            <img
+              v-if="activeCompany.logoUrl"
+              :src="activeCompany.logoUrl"
+              :alt="activeCompany.name"
+            />
+            <span v-else>{{ companyInitials(activeCompany) }}</span>
+          </span>
+        </div>
+        <k-block class="company-profile-heading">
+          <span class="company-profile-heading__eyebrow">
+            {{
+              categoryLabel(
+                activeCompany.categoryId,
+                activeCompany.categoryName,
+              )
+            }}
+            <BadgeCheck
+              v-if="activeCompany.verified"
+              :size="15"
+              :aria-label="phone.t('Apps.companies.verified')"
+            />
+          </span>
+          <h1>{{ activeCompany.name }}</h1>
+          <k-badge :class="statusClass(activeCompany.availability)">
+            {{
+              phone.t(
+                `Apps.companies.availability.${activeCompany.availability}`,
+              )
+            }}
+          </k-badge>
+          <small>
+            {{
+              phone.t('Apps.companies.profile.updated', {
+                time: relativeTime(activeCompany.availabilityUpdatedAt),
+              })
+            }}
+          </small>
+          <p>{{ activeCompany.description }}</p>
+        </k-block>
+
+        <k-card v-if="activeCompany.announcement" class="company-announcement">
+          <Megaphone :size="20" />
+          <span>
+            <strong>{{
+              phone.t('Apps.companies.profile.announcement')
+            }}</strong>
+            <span>{{ activeCompany.announcement.body }}</span>
+          </span>
+        </k-card>
+
+        <k-block-title>{{
+          phone.t('Apps.companies.profile.location')
+        }}</k-block-title>
+        <k-list inset strong>
+          <k-list-item
+            v-if="activeCompany.location"
+            :title="activeCompany.location.label"
+            :subtitle="`${activeCompany.location.address} · ${activeCompany.location.district}`"
+          >
+            <template #media><MapPin :size="20" /></template>
+          </k-list-item>
+          <k-list-item
+            v-else
+            :title="phone.t('Apps.companies.profile.noLocation')"
+          >
+            <template #media><MapPin :size="20" /></template>
+          </k-list-item>
+        </k-list>
+
+        <k-block-title>{{
+          phone.t('Apps.companies.profile.hours')
+        }}</k-block-title>
+        <k-list inset strong>
+          <k-list-item
+            v-for="hours in activeCompany.hours"
+            :key="hours.day"
+            :title="phone.t(`Apps.companies.days.${weekdayKeys[hours.day]}`)"
+            :after="
+              hours.isClosed
+                ? phone.t('Apps.companies.profile.closed')
+                : `${hours.opensAt}–${hours.closesAt}`
+            "
+          >
+            <template #media><Clock3 :size="19" /></template>
+          </k-list-item>
+          <k-list-item
+            v-if="!activeCompany.hours.length"
+            :title="phone.t('Apps.companies.profile.byAvailability')"
+          />
+        </k-list>
+
+        <k-block-title>{{
+          phone.t('Apps.companies.profile.services')
+        }}</k-block-title>
+        <k-list inset strong>
+          <k-list-item
+            v-for="service in activeCompany.services.filter(
+              (item) => item.active,
+            )"
+            :key="service.id"
+            :title="service.title"
+            :subtitle="service.description"
+            :after="service.priceText ?? undefined"
+          />
+          <k-list-item
+            v-if="!activeCompany.services.some((service) => service.active)"
+            :title="phone.t('Apps.companies.profile.noServices')"
+          />
+        </k-list>
+
+        <div class="company-profile-actions">
+          <k-button
+            rounded
+            :disabled="!activeCompany.canCall || !activeCompany.phoneNumber"
+            @click="callNumber(activeCompany.phoneNumber)"
+          >
+            <Phone :size="17" />{{ phone.t('Apps.companies.profile.call') }}
+          </k-button>
+          <k-button
+            rounded
+            outline
+            :disabled="!activeCompany.canMessage || !activeCompany.phoneNumber"
+            @click="messageCompany(activeCompany)"
+          >
+            <MessageCircle :size="17" />{{
+              phone.t('Apps.companies.profile.message')
+            }}
+          </k-button>
+          <k-button
+            rounded
+            outline
+            :disabled="!activeCompany.location"
+            @click="setRoute(activeCompany)"
+          >
+            <MapPin :size="17" />{{ phone.t('Apps.companies.profile.route') }}
+          </k-button>
+          <k-button
+            rounded
+            :disabled="!activeCompany.acceptsRequests"
+            @click="openRequestComposer(activeCompany)"
+          >
+            <ClipboardList :size="17" />{{
+              phone.t('Apps.companies.profile.request')
+            }}
+          </k-button>
+        </div>
+      </template>
+    </section>
+
+    <section
+      v-else-if="screen === 'request'"
+      class="companies-content request-thread"
+    >
+      <div v-if="companies.requestLoading" class="companies-state">
+        <k-preloader />
+        <span>{{ phone.t('Apps.companies.loading.request') }}</span>
+      </div>
+      <div
+        v-else-if="companies.requestError || !companies.request"
+        class="companies-state"
+      >
+        <CircleAlert :size="34" />
+        <strong>{{ phone.t('Apps.companies.states.requestError') }}</strong>
+        <p>{{ errorText(companies.requestError) }}</p>
+        <k-button rounded @click="goBack">{{
+          phone.t('Apps.companies.back')
+        }}</k-button>
+      </div>
+      <template v-else>
+        <div class="request-thread-scroll">
+          <k-card class="request-summary-card">
+            <span>
+              <small>{{ companies.request.companyName }}</small>
+              <strong>{{ companies.request.subject }}</strong>
+            </span>
+            <k-badge :class="statusClass(companies.request.status)">
+              {{
+                phone.t(
+                  `Apps.companies.requestStatuses.${companies.request.status}`,
+                )
+              }}
+            </k-badge>
+            <p>{{ companies.request.description }}</p>
+            <span class="request-summary-card__meta">
+              {{
+                companies.request.serviceName ??
+                phone.t('Apps.companies.requests.generalService')
+              }}
+              · {{ formatDate(companies.request.createdAt) }}
+            </span>
+          </k-card>
+
+          <div
+            v-if="companies.request.media.length"
+            class="request-media-strip"
+            :aria-label="phone.t('Apps.companies.requests.attachments')"
+          >
+            <img
+              v-for="media in companies.request.media"
+              :key="media.id"
+              :src="media.url"
+              :alt="phone.t('Apps.companies.requests.attachedPhoto')"
+              draggable="false"
+              loading="lazy"
+              referrerpolicy="no-referrer"
+            />
+          </div>
+
+          <k-block-title>{{
+            phone.t('Apps.companies.requests.timeline')
+          }}</k-block-title>
+          <div class="request-timeline">
+            <div v-for="event in companies.request.events" :key="event.id">
+              <span><Check :size="12" /></span>
+              <p>
+                <strong>{{ eventLabel(event) }}</strong>
+                <small>{{ formatDate(event.createdAt) }}</small>
+              </p>
+            </div>
+          </div>
+
+          <k-block-title>{{
+            phone.t('Apps.companies.requests.conversation')
+          }}</k-block-title>
+          <k-messages class="company-messages">
+            <k-messages-title v-if="!companies.request.messages.length">
+              {{ phone.t('Apps.companies.requests.noMessages') }}
+            </k-messages-title>
+            <k-message
+              v-for="message in companies.request.messages"
+              :key="message.id"
+              :type="message.isMine ? 'sent' : 'received'"
+              :name="messageAuthorLabel(message.authorLabel)"
+              :text="message.body"
+              :text-footer="formatDate(message.createdAt)"
+            />
+          </k-messages>
+
+          <div class="request-thread-actions">
+            <k-button
+              v-if="companies.request.actions.canCall"
+              outline
+              rounded
+              @click="callRequestParty"
+            >
+              <Phone :size="16" />{{ phone.t('Apps.companies.requests.call') }}
+            </k-button>
+            <k-button
+              v-if="companies.request.actions.canCancel"
+              outline
+              rounded
+              class="is-danger"
+              @click="cancelDialogOpened = true"
+            >
+              <X :size="16" />{{ phone.t('Apps.companies.requests.cancel') }}
+            </k-button>
+          </div>
+        </div>
+        <k-messagebar
+          v-if="companies.request.actions.canReply"
+          class="company-messagebar"
+          :disabled="companies.mutating"
+          :placeholder="phone.t('Apps.companies.requests.replyPlaceholder')"
+          :value="threadDraft"
+          @input="threadDraft = messagebarValue($event)"
+          @keydown.enter.exact.prevent="sendThreadMessage"
+        >
+          <template #right>
+            <k-toolbar-pane class="ios:h-10">
+              <k-link
+                component="button"
+                icon-only
+                :disabled="!canSendThreadMessage"
+                :aria-label="phone.t('Apps.companies.requests.sendReply')"
+                :link-props="{ type: 'button' }"
+                @click="sendThreadMessage"
+              >
+                <Send :size="22" />
+              </k-link>
+            </k-toolbar-pane>
+          </template>
+        </k-messagebar>
+      </template>
+    </section>
+
+    <section
+      v-else-if="screen === 'manager' && workCompany"
+      class="companies-content manager-screen"
+    >
+      <k-card class="manager-intro">
+        <Settings2 :size="24" />
+        <span>
+          <strong>{{ workCompany.name }}</strong>
+          <span>{{
+            phone.t('Apps.companies.manager.revision', {
+              revision: String(workCompany.revision),
+            })
+          }}</span>
+        </span>
+      </k-card>
+
+      <k-block-title>{{
+        phone.t('Apps.companies.manager.availability')
+      }}</k-block-title>
+      <k-segmented strong rounded class="availability-segmented">
+        <k-segmented-button
+          v-for="availability in availabilityValues"
+          :key="availability"
+          :active="workCompany.availability === availability"
+          :disabled="
+            !companies.workContext?.permissions.canSetAvailability ||
+            companies.mutating
+          "
+          @click="setCompanyAvailability(availability)"
+        >
+          {{ phone.t(`Apps.companies.availability.${availability}`) }}
+        </k-segmented-button>
+      </k-segmented>
+
+      <template v-if="companies.workContext?.permissions.canManageProfile">
+        <k-block-title>{{
+          phone.t('Apps.companies.manager.profile')
+        }}</k-block-title>
+        <div class="manager-media-grid">
+          <button type="button" @click="chooseManagerMedia('cover')">
+            <img
+              v-if="managerCoverUrl"
+              :src="managerCoverUrl"
+              :alt="phone.t('Apps.companies.manager.coverPhoto')"
+              loading="lazy"
+            />
+            <span v-else><ImagePlus :size="22" /></span>
+            <small>{{ phone.t('Apps.companies.manager.chooseCover') }}</small>
+          </button>
+          <button type="button" @click="chooseManagerMedia('logo')">
+            <img
+              v-if="managerLogoUrl"
+              :src="managerLogoUrl"
+              :alt="phone.t('Apps.companies.manager.logoPhoto')"
+              loading="lazy"
+            />
+            <span v-else><ImagePlus :size="22" /></span>
+            <small>{{ phone.t('Apps.companies.manager.chooseLogo') }}</small>
+          </button>
+        </div>
+        <k-list inset strong class="manager-form-list">
+          <k-list-input
+            outline
+            type="textarea"
+            maxlength="500"
+            :label="phone.t('Apps.companies.manager.description')"
+            :placeholder="
+              phone.t('Apps.companies.manager.descriptionPlaceholder')
+            "
+            :value="profileDraft.description"
+            @input="profileDraft.description = eventValue($event)"
+          />
+          <k-list-input
+            outline
+            type="tel"
+            readonly
+            :label="phone.t('Apps.companies.manager.phoneNumber')"
+            :info="phone.t('Apps.companies.manager.phoneNumberManaged')"
+            :value="
+              workCompany.phoneNumber ??
+              phone.t('Apps.companies.manager.noPhoneNumber')
+            "
+          />
+          <k-list-input
+            outline
+            maxlength="80"
+            :label="phone.t('Apps.companies.manager.locationLabel')"
+            :value="profileDraft.locationLabel"
+            @input="profileDraft.locationLabel = eventValue($event)"
+          />
+          <k-list-input
+            outline
+            maxlength="120"
+            :label="phone.t('Apps.companies.manager.address')"
+            :value="profileDraft.address"
+            @input="profileDraft.address = eventValue($event)"
+          />
+          <k-list-input
+            outline
+            maxlength="80"
+            :label="phone.t('Apps.companies.manager.district')"
+            :value="profileDraft.district"
+            @input="profileDraft.district = eventValue($event)"
+          />
+          <k-list-item
+            :title="phone.t('Apps.companies.manager.acceptRequests')"
+            :subtitle="phone.t('Apps.companies.manager.acceptRequestsBody')"
+          >
+            <template #after>
+              <k-toggle
+                :checked="profileDraft.acceptsRequests"
+                :aria-label="phone.t('Apps.companies.manager.acceptRequests')"
+                @change="
+                  profileDraft.acceptsRequests = !profileDraft.acceptsRequests
+                "
+              />
+            </template>
+          </k-list-item>
+        </k-list>
+        <k-button
+          outline
+          rounded
+          class="manager-location"
+          :disabled="companies.mutating"
+          @click="useCurrentLocation"
+        >
+          <Compass :size="16" />{{
+            phone.t('Apps.companies.manager.useCurrentLocation')
+          }}
+        </k-button>
+        <small v-if="profileCoords" class="manager-location-status">
+          {{ phone.t('Apps.companies.manager.locationReady') }}
+        </small>
+        <k-button
+          rounded
+          class="manager-save"
+          :disabled="companies.mutating"
+          @click="saveProfile"
+        >
+          {{ phone.t('Apps.companies.manager.saveProfile') }}
+        </k-button>
+      </template>
+
+      <template v-if="companies.workContext?.permissions.canManageHours">
+        <k-block-title>{{
+          phone.t('Apps.companies.manager.hours')
+        }}</k-block-title>
+        <k-card
+          v-for="(hours, index) in hoursDraft"
+          :key="hours.day"
+          class="manager-hours-card"
+          :content-wrap="false"
+        >
+          <k-list nested>
+            <k-list-item
+              :title="phone.t(`Apps.companies.days.${weekdayKeys[hours.day]}`)"
+            >
+              <template #after>
+                <k-toggle
+                  :checked="!hours.isClosed"
+                  :aria-label="phone.t('Apps.companies.manager.dayOpen')"
+                  @change="hours.isClosed = !hours.isClosed"
+                />
+              </template>
+            </k-list-item>
+            <template v-if="!hours.isClosed">
+              <k-list-input
+                outline
+                type="time"
+                :label="phone.t('Apps.companies.manager.opensAt')"
+                :value="hours.opensAt"
+                @input="updateHour(index, 'opensAt', $event)"
+              />
+              <k-list-input
+                outline
+                type="time"
+                :label="phone.t('Apps.companies.manager.closesAt')"
+                :value="hours.closesAt"
+                @input="updateHour(index, 'closesAt', $event)"
+              />
+            </template>
+          </k-list>
+        </k-card>
+        <k-button
+          rounded
+          class="manager-save"
+          :disabled="companies.mutating"
+          @click="saveHours"
+        >
+          {{ phone.t('Apps.companies.manager.saveHours') }}
+        </k-button>
+      </template>
+
+      <template v-if="companies.workContext?.permissions.canManageServices">
+        <k-block-title>{{
+          phone.t('Apps.companies.manager.services')
+        }}</k-block-title>
+        <k-card
+          v-for="(service, index) in servicesDraft"
+          :key="`${service.id}-${index}`"
+          class="manager-service-card"
+          :content-wrap="false"
+        >
+          <k-list nested>
+            <k-list-input
+              outline
+              maxlength="80"
+              :label="phone.t('Apps.companies.manager.serviceTitle')"
+              :value="service.title"
+              @input="updateService(index, 'title', $event)"
+            />
+            <k-list-input
+              outline
+              maxlength="240"
+              :label="phone.t('Apps.companies.manager.serviceDescription')"
+              :value="service.description"
+              @input="updateService(index, 'description', $event)"
+            />
+            <k-list-input
+              outline
+              maxlength="40"
+              :label="phone.t('Apps.companies.manager.priceText')"
+              :value="service.priceText ?? ''"
+              @input="updateService(index, 'priceText', $event)"
+            />
+            <k-list-item
+              :title="phone.t('Apps.companies.manager.serviceActive')"
+            >
+              <template #after>
+                <k-toggle
+                  :checked="service.active"
+                  :aria-label="phone.t('Apps.companies.manager.serviceActive')"
+                  @change="service.active = !service.active"
+                />
+              </template>
+            </k-list-item>
+            <k-list-item
+              :title="phone.t('Apps.companies.manager.serviceRequests')"
+            >
+              <template #after>
+                <k-toggle
+                  :checked="service.acceptsRequests"
+                  :aria-label="
+                    phone.t('Apps.companies.manager.serviceRequests')
+                  "
+                  @change="service.acceptsRequests = !service.acceptsRequests"
+                />
+              </template>
+            </k-list-item>
+          </k-list>
+          <k-button
+            outline
+            rounded
+            class="manager-remove"
+            @click="removeService(index)"
+          >
+            <Trash2 :size="15" />{{
+              phone.t('Apps.companies.manager.removeService')
+            }}
+          </k-button>
+        </k-card>
+        <k-button outline rounded class="manager-save" @click="addService">
+          <Plus :size="16" />{{ phone.t('Apps.companies.manager.addService') }}
+        </k-button>
+        <k-button
+          rounded
+          class="manager-save"
+          :disabled="companies.mutating"
+          @click="saveServices"
+        >
+          {{ phone.t('Apps.companies.manager.saveServices') }}
+        </k-button>
+      </template>
+
+      <template v-if="companies.workContext?.permissions.canManageAnnouncement">
+        <k-block-title>{{
+          phone.t('Apps.companies.manager.announcement')
+        }}</k-block-title>
+        <k-list inset strong class="manager-form-list">
+          <k-list-input
+            outline
+            type="textarea"
+            maxlength="280"
+            :label="phone.t('Apps.companies.manager.announcementText')"
+            :placeholder="
+              phone.t('Apps.companies.manager.announcementPlaceholder')
+            "
+            :value="announcementDraft.body"
+            @input="announcementDraft.body = eventValue($event)"
+          />
+          <k-list-input
+            outline
+            type="datetime-local"
+            :label="phone.t('Apps.companies.manager.expiresAt')"
+            :value="announcementDraft.expiresAt"
+            @input="announcementDraft.expiresAt = eventValue($event)"
+          />
+        </k-list>
+        <k-button
+          rounded
+          class="manager-save"
+          :disabled="companies.mutating"
+          @click="publishAnnouncement"
+        >
+          <Megaphone :size="16" />{{
+            phone.t('Apps.companies.manager.publish')
+          }}
+        </k-button>
+      </template>
+    </section>
+
+    <k-tabbar
+      v-if="screen === 'root'"
+      component="nav"
+      icons
+      labels
+      class="companies-tabbar bottom-0 left-0 fixed"
+      :aria-label="phone.t('Apps.companies.navigation')"
+    >
+      <k-toolbar-pane>
+        <k-tabbar-link
+          component="button"
+          :active="activeTab === 'directory'"
+          :link-props="{ type: 'button' }"
+          @click="selectTab('directory')"
+        >
+          <template #label>{{
+            phone.t('Apps.companies.tabs.directory')
+          }}</template>
+          <template #icon
+            ><k-icon><Compass class="w-7 h-7" /></k-icon
+          ></template>
+        </k-tabbar-link>
+        <k-tabbar-link
+          component="button"
+          :active="activeTab === 'requests'"
+          :link-props="{ type: 'button' }"
+          @click="selectTab('requests')"
+        >
+          <template #label>{{
+            phone.t('Apps.companies.tabs.requests')
+          }}</template>
+          <template #icon>
+            <span class="companies-tab-icon">
+              <k-icon><ClipboardList class="w-7 h-7" /></k-icon>
+              <k-badge v-if="companies.customerUnreadCount">{{
+                companies.customerUnreadCount
+              }}</k-badge>
+            </span>
+          </template>
+        </k-tabbar-link>
+        <k-tabbar-link
+          component="button"
+          :active="activeTab === 'work'"
+          :link-props="{ type: 'button' }"
+          @click="selectTab('work')"
+        >
+          <template #label>{{ phone.t('Apps.companies.tabs.work') }}</template>
+          <template #icon>
+            <span class="companies-tab-icon">
+              <k-icon><BriefcaseBusiness class="w-7 h-7" /></k-icon>
+              <k-badge v-if="companies.workUnreadCount">{{
+                companies.workUnreadCount
+              }}</k-badge>
+            </span>
+          </template>
+        </k-tabbar-link>
+      </k-toolbar-pane>
+    </k-tabbar>
+
+    <k-sheet
+      :opened="requestSheetOpened"
+      class="companies-sheet"
+      @backdropclick="requestSheetOpened = false"
+    >
+      <section
+        v-if="requestSheetOpened && activeCompany"
+        class="companies-sheet__content"
+        role="dialog"
+        aria-modal="true"
+      >
+        <header>
+          <span><ClipboardList :size="23" /></span>
+          <div>
+            <small>{{ activeCompany.name }}</small>
+            <h2>{{ phone.t('Apps.companies.composer.title') }}</h2>
+          </div>
+          <k-link
+            component="button"
+            icon-only
+            :aria-label="phone.t('Apps.companies.close')"
+            :link-props="{ type: 'button' }"
+            @click="requestSheetOpened = false"
+          >
+            <X :size="19" />
+          </k-link>
+        </header>
+        <k-progressbar :progress="requestProgress" />
+        <k-block-title>{{
+          phone.t('Apps.companies.composer.chooseService')
+        }}</k-block-title>
+        <k-list inset strong>
+          <k-list-item
+            v-for="service in activeCompany.services.filter(
+              (item) => item.active && item.acceptsRequests,
+            )"
+            :key="service.id"
+            label
+            :title="service.title"
+            :subtitle="service.description"
+            :after="service.priceText ?? undefined"
+          >
+            <template #media>
+              <k-radio
+                name="company-request-service"
+                :value="service.id"
+                :checked="requestServiceId === service.id"
+                @change="requestServiceId = service.id"
+              />
+            </template>
+          </k-list-item>
+        </k-list>
+        <k-list inset strong class="composer-form-list">
+          <k-list-input
+            outline
+            maxlength="100"
+            :label="phone.t('Apps.companies.composer.subject')"
+            :placeholder="phone.t('Apps.companies.composer.subjectPlaceholder')"
+            :value="requestSubject"
+            @input="requestSubject = eventValue($event)"
+          />
+          <k-list-input
+            outline
+            type="textarea"
+            maxlength="1200"
+            :label="phone.t('Apps.companies.composer.description')"
+            :placeholder="
+              phone.t('Apps.companies.composer.descriptionPlaceholder')
+            "
+            :value="requestDescription"
+            @input="requestDescription = eventValue($event)"
+          />
+        </k-list>
+        <k-card class="composer-contact-card">
+          <Phone :size="18" />
+          <span>
+            <strong>{{ phone.t('Apps.companies.composer.contact') }}</strong>
+            <span v-if="phone.device?.sim?.registered">
+              {{
+                phone.t('Apps.companies.composer.registeredSim', {
+                  number: maskedPhoneNumber(phone.device.sim.number),
+                })
+              }}
+            </span>
+            <span v-else>{{
+              phone.t('Apps.companies.composer.registeredSimRequired')
+            }}</span>
+          </span>
+        </k-card>
+        <k-button
+          outline
+          rounded
+          :disabled="requestMedia.length >= 3"
+          @click="chooseRequestMedia"
+        >
+          <ImagePlus :size="17" />
+          {{
+            phone.t('Apps.companies.composer.addPhotos', {
+              count: String(requestMedia.length),
+            })
+          }}
+        </k-button>
+        <div v-if="requestMedia.length" class="composer-media-strip">
+          <span v-for="media in requestMedia" :key="media.id">
+            <img
+              :src="media.url"
+              :alt="phone.t('Apps.companies.composer.selectedPhoto')"
+            />
+            <k-button
+              rounded
+              :aria-label="phone.t('Apps.companies.composer.removePhoto')"
+              @click="removeRequestMedia(media.id)"
+            >
+              <X :size="13" />
+            </k-button>
+          </span>
+        </div>
+        <k-button
+          large
+          rounded
+          :disabled="!canSubmitRequest"
+          @click="requestConfirmOpened = true"
+        >
+          {{ phone.t('Apps.companies.composer.review') }}
+        </k-button>
+      </section>
+    </k-sheet>
+
+    <k-actions
+      v-if="workActionsOpened"
+      :opened="workActionsOpened"
+      @backdropclick="workActionsOpened = false"
+    >
+      <k-actions-group v-if="companies.request">
+        <k-actions-button
+          v-if="companies.request.actions.canClaim"
+          @click="claimActiveRequest"
+        >
+          {{ phone.t('Apps.companies.workActions.claim') }}
+        </k-actions-button>
+        <k-actions-button
+          v-if="companies.request.actions.canAssign"
+          @click="openAssignment"
+        >
+          {{ phone.t('Apps.companies.workActions.assign') }}
+        </k-actions-button>
+        <k-actions-button
+          v-if="companies.request.actions.canCall"
+          @click="callRequestParty"
+        >
+          {{ phone.t('Apps.companies.workActions.callCustomer') }}
+        </k-actions-button>
+        <k-actions-button
+          v-for="status in companies.request.actions.allowedStatuses"
+          :key="status"
+          @click="updateActiveRequestStatus(status)"
+        >
+          {{
+            phone.t('Apps.companies.workActions.setStatus', {
+              status: phone.t(`Apps.companies.requestStatuses.${status}`),
+            })
+          }}
+        </k-actions-button>
+      </k-actions-group>
+      <k-actions-group>
+        <k-actions-button bold @click="workActionsOpened = false">
+          {{ phone.t('Apps.companies.close') }}
+        </k-actions-button>
+      </k-actions-group>
+    </k-actions>
+
+    <k-sheet
+      :opened="assignmentSheetOpened"
+      class="companies-sheet companies-assignment-sheet"
+      @backdropclick="assignmentSheetOpened = false"
+    >
+      <section
+        v-if="assignmentSheetOpened"
+        class="companies-sheet__content"
+        role="dialog"
+        aria-modal="true"
+      >
+        <header>
+          <span><UsersRound :size="23" /></span>
+          <div>
+            <h2>{{ phone.t('Apps.companies.assignment.title') }}</h2>
+          </div>
+          <k-link
+            component="button"
+            icon-only
+            :aria-label="phone.t('Apps.companies.close')"
+            :link-props="{ type: 'button' }"
+            @click="assignmentSheetOpened = false"
+          >
+            <X :size="19" />
+          </k-link>
+        </header>
+        <div
+          v-if="companies.membersLoading"
+          class="companies-state companies-state--compact"
+        >
+          <k-preloader />
+        </div>
+        <k-list v-else inset strong>
+          <k-list-item
+            v-for="member in companies.members"
+            :key="member.id"
+            label
+            :title="memberName(member.name)"
+            :subtitle="`${member.role} · ${phone.t(`Apps.companies.assignment.${member.online ? 'online' : 'offline'}`)}`"
+          >
+            <template #media
+              ><span class="member-avatar"><UserRound :size="18" /></span
+            ></template>
+            <template #after>
+              <k-radio
+                name="company-member"
+                :value="member.id"
+                :checked="selectedMemberId === member.id"
+                :disabled="!member.online"
+                @change="selectedMemberId = member.id"
+              />
+            </template>
+          </k-list-item>
+        </k-list>
+        <k-button
+          large
+          rounded
+          :disabled="!selectedMemberId || companies.mutating"
+          @click="assignActiveRequest"
+        >
+          {{ phone.t('Apps.companies.assignment.confirm') }}
+        </k-button>
+      </section>
+    </k-sheet>
+
+    <k-dialog
+      :opened="requestConfirmOpened"
+      :title="phone.t('Apps.companies.composer.confirmTitle')"
+      :content="
+        phone.t('Apps.companies.composer.confirmBody', {
+          company: activeCompany?.name ?? '',
+          service: selectedService?.title ?? '',
+        })
+      "
+      @backdropclick="requestConfirmOpened = false"
+    >
+      <template #buttons>
+        <k-dialog-button @click="requestConfirmOpened = false">
+          {{ phone.t('Apps.companies.composer.edit') }}
+        </k-dialog-button>
+        <k-dialog-button
+          strong
+          :disabled="companies.mutating"
+          @click="submitRequest"
+        >
+          {{ phone.t('Apps.companies.composer.send') }}
+        </k-dialog-button>
+      </template>
+    </k-dialog>
+
+    <k-dialog
+      :opened="cancelDialogOpened"
+      :title="phone.t('Apps.companies.requests.cancelTitle')"
+      :content="phone.t('Apps.companies.requests.cancelBody')"
+      @backdropclick="cancelDialogOpened = false"
+    >
+      <template #buttons>
+        <k-dialog-button @click="cancelDialogOpened = false">
+          {{ phone.t('Apps.companies.requests.keep') }}
+        </k-dialog-button>
+        <k-dialog-button
+          strong
+          :disabled="companies.mutating"
+          @click="cancelActiveRequest"
+        >
+          {{ phone.t('Apps.companies.requests.cancelConfirm') }}
+        </k-dialog-button>
+      </template>
+    </k-dialog>
+
+    <k-dialog
+      :opened="conflictDialogOpened"
+      :title="phone.t('Apps.companies.conflict.title')"
+      :content="phone.t('Apps.companies.conflict.body')"
+      @backdropclick="conflictDialogOpened = false"
+    >
+      <template #buttons>
+        <k-dialog-button @click="conflictDialogOpened = false">
+          {{ phone.t('Apps.companies.close') }}
+        </k-dialog-button>
+        <k-dialog-button strong @click="reloadConflict">
+          {{ phone.t('Apps.companies.conflict.reload') }}
+        </k-dialog-button>
+      </template>
+    </k-dialog>
+
+    <k-toast
+      :opened="toastOpened"
+      position="center"
+      @click="toastOpened = false"
+    >
+      {{ toastText }}
+    </k-toast>
+  </k-page>
+</template>
+
+<style scoped>
+.companies-app {
+  --company-blue: #3b82f6;
+  --company-cyan: #38bdf8;
+  --company-green: #22c55e;
+  --company-orange: #f59e0b;
+  --company-red: #ef4444;
+  --k-safe-area-top: 46px;
+  --k-safe-area-bottom: 25px;
+  position: relative;
+  height: 100%;
+  overflow: hidden;
+  color: #111827;
+}
+
+.companies-app--dark {
+  color: #f8fafc;
+}
+
+.companies-backdrop {
+  position: absolute;
+  inset: 0;
+  pointer-events: none;
+  background:
+    radial-gradient(circle at 12% 4%, rgb(56 189 248 / 16%), transparent 30%),
+    radial-gradient(circle at 88% 34%, rgb(59 130 246 / 13%), transparent 32%),
+    linear-gradient(180deg, #eff7ff 0%, #f6f8fb 45%, #eef2f7 100%);
+}
+
+.companies-app--dark .companies-backdrop {
+  background:
+    radial-gradient(circle at 12% 4%, rgb(56 189 248 / 13%), transparent 30%),
+    radial-gradient(circle at 88% 34%, rgb(59 130 246 / 11%), transparent 32%),
+    linear-gradient(180deg, #07111f 0%, #0b1220 52%, #111827 100%);
+}
+
+.companies-content {
+  position: relative;
+  z-index: 1;
+}
+
+.companies-content {
+  height: calc(100% - 44px);
+  padding: 10px 10px 92px;
+  overflow-y: auto;
+  overscroll-behavior: contain;
+  scrollbar-width: none;
+}
+
+.companies-content::-webkit-scrollbar,
+.companies-chip-row::-webkit-scrollbar,
+.companies-featured-row::-webkit-scrollbar {
+  display: none;
+}
+
+.companies-search-wrap {
+  margin: 0 -4px 8px;
+}
+
+.companies-chip-row {
+  display: flex;
+  gap: 7px;
+  padding: 2px 2px 9px;
+  overflow-x: auto;
+  scrollbar-width: none;
+}
+
+.companies-chip-row :deep(.k-chip) {
+  flex: none;
+  white-space: nowrap;
+}
+
+.companies-chip-row :deep(.is-selected),
+.companies-inline-chips :deep(.is-selected) {
+  color: white;
+  background: linear-gradient(135deg, var(--company-blue), var(--company-cyan));
+}
+
+.companies-filter-card,
+.work-identity-card,
+.manager-intro,
+.request-summary-card,
+.composer-contact-card,
+.company-announcement {
+  margin: 0 0 12px;
+  border: 1px solid rgb(255 255 255 / 58%);
+  border-radius: 18px;
+  background: rgb(255 255 255 / 68%);
+  box-shadow: 0 12px 30px rgb(24 56 93 / 8%);
+  backdrop-filter: blur(18px) saturate(140%);
+  -webkit-backdrop-filter: blur(18px) saturate(140%);
+}
+
+.companies-app--dark .companies-filter-card,
+.companies-app--dark .work-identity-card,
+.companies-app--dark .manager-intro,
+.companies-app--dark .request-summary-card,
+.companies-app--dark .composer-contact-card,
+.companies-app--dark .company-announcement {
+  border-color: rgb(255 255 255 / 8%);
+  background: rgb(20 30 46 / 70%);
+}
+
+.companies-inline-chips {
+  display: flex;
+  max-width: 144px;
+  gap: 4px;
+  overflow-x: auto;
+}
+
+.companies-inline-chips :deep(.k-chip) {
+  flex: none;
+  font-size: 9px;
+}
+
+.companies-state {
+  min-height: 260px;
+  padding: 36px 22px;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 9px;
+  color: #64748b;
+  text-align: center;
+}
+
+.companies-state strong {
+  color: inherit;
+  font-size: 16px;
+}
+
+.companies-state p {
+  max-width: 260px;
+  margin: 0;
+  font-size: 12px;
+  line-height: 1.45;
+}
+
+.companies-state--compact {
+  min-height: 150px;
+  padding: 20px;
+}
+
+.companies-featured-row {
+  display: flex;
+  gap: 9px;
+  padding: 0 2px 4px;
+  overflow-x: auto;
+  scrollbar-width: none;
+}
+
+.company-feature-card {
+  width: 145px;
+  min-width: 145px;
+  margin: 0;
+  text-align: left;
+}
+
+.company-feature-card :deep(> *) {
+  padding: 12px;
+  display: grid;
+  gap: 6px;
+}
+
+.company-feature-card strong {
+  overflow: hidden;
+  font-size: 13px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.company-feature-card :deep(> *) > span {
+  color: #64748b;
+  font-size: 10px;
+}
+
+.company-list,
+.company-request-list {
+  margin-top: 6px;
+}
+
+.company-logo {
+  width: 42px;
+  height: 42px;
+  display: grid;
+  flex: none;
+  place-items: center;
+  overflow: hidden;
+  border-radius: 13px;
+  color: white;
+  background: linear-gradient(145deg, var(--company-blue), var(--company-cyan));
+  box-shadow: inset 0 1px 0 rgb(255 255 255 / 42%);
+  font-size: 13px;
+  font-weight: 800;
+}
+
+.company-logo img {
+  width: 100%;
+  height: 100%;
+  object-fit: cover;
+}
+
+.company-logo--small {
+  width: 36px;
+  height: 36px;
+  border-radius: 11px;
+}
+
+.company-logo--large {
+  width: 54px;
+  height: 54px;
+  border-radius: 17px;
+}
+
+.company-row-after,
+.request-row-after {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-end;
+  gap: 4px;
+}
+
+.company-row-after small {
+  max-width: 82px;
+  overflow: hidden;
+  color: #94a3b8;
+  font-size: 8px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+:deep(.k-badge) {
+  min-width: 0;
+  border-radius: 999px;
+  font-size: 8px;
+  line-height: 1.2;
+}
+
+:deep(.k-badge.is-available),
+:deep(.k-badge.is-completed) {
+  color: #047857;
+  background: #d1fae5;
+}
+
+:deep(.k-badge.is-busy),
+:deep(.k-badge.is-waiting-customer) {
+  color: #b45309;
+  background: #fef3c7;
+}
+
+:deep(.k-badge.is-closed),
+:deep(.k-badge.is-cancelled) {
+  color: #b91c1c;
+  background: #fee2e2;
+}
+
+:deep(.k-badge.is-new),
+:deep(.k-badge.is-assigned),
+:deep(.k-badge.is-in-progress),
+:deep(.k-badge.is-unread) {
+  color: #1d4ed8;
+  background: #dbeafe;
+}
+
+.companies-load-more,
+.manager-save {
+  width: calc(100% - 20px);
+  margin: 14px 10px 4px;
+}
+
+.companies-segment-wrap,
+.availability-segmented {
+  margin: 4px 6px 14px;
+}
+
+.company-request-icon,
+.member-avatar {
+  width: 36px;
+  height: 36px;
+  display: grid;
+  place-items: center;
+  border-radius: 12px;
+  color: var(--company-blue);
+  background: rgb(59 130 246 / 13%);
+}
+
+.work-identity-card :deep(> *),
+.manager-intro :deep(> *),
+.composer-contact-card :deep(> *),
+.company-announcement :deep(> *) {
+  display: flex;
+  align-items: center;
+  gap: 11px;
+}
+
+.work-identity-card :deep(> *) > span:nth-child(2),
+.manager-intro :deep(> *) > span,
+.composer-contact-card :deep(> *) > span,
+.company-announcement :deep(> *) > span {
+  min-width: 0;
+  display: flex;
+  flex: 1;
+  flex-direction: column;
+  gap: 2px;
+}
+
+.work-identity-card small,
+.manager-intro span span,
+.composer-contact-card span span,
+.company-announcement span span {
+  color: #64748b;
+  font-size: 10px;
+}
+
+.work-identity-card strong {
+  overflow: hidden;
+  font-size: 14px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.work-metrics {
+  display: grid;
+  grid-template-columns: repeat(2, 1fr);
+  gap: 8px;
+  margin: 0 5px 14px;
+}
+
+.work-metrics :deep(.k-card) {
+  margin: 0;
+  border-radius: 16px;
+}
+
+.work-metrics :deep(> *) {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+}
+
+.work-metrics strong {
+  color: var(--company-blue);
+  font-size: 24px;
+}
+
+.work-metrics span {
+  color: #64748b;
+  font-size: 10px;
+}
+
+.work-filter-row {
+  padding-inline: 5px;
+}
+
+.company-cover {
+  height: 145px;
+  margin: -10px -10px 0;
+  display: flex;
+  align-items: flex-end;
+  padding: 14px;
+  background:
+    linear-gradient(180deg, transparent, rgb(15 23 42 / 48%)),
+    linear-gradient(135deg, #1d4ed8, #38bdf8 58%, #67e8f9);
+  background-position: center;
+  background-size: cover;
+}
+
+.company-logo--hero {
+  width: 66px;
+  height: 66px;
+  border: 3px solid rgb(255 255 255 / 88%);
+  border-radius: 20px;
+  font-size: 18px;
+}
+
+.company-profile {
+  padding-bottom: 116px;
+}
+
+.company-profile-heading {
+  margin-top: 10px;
+}
+
+.company-profile-heading__eyebrow {
+  display: flex;
+  align-items: center;
+  gap: 5px;
+  color: var(--company-blue);
+  font-size: 11px;
+  font-weight: 700;
+}
+
+.company-profile-heading h1 {
+  margin: 3px 0 6px;
+  font-size: 24px;
+  line-height: 1.1;
+}
+
+.company-profile-heading small {
+  display: block;
+  margin-top: 5px;
+  color: #64748b;
+  font-size: 9px;
+}
+
+.company-profile-heading p {
+  margin: 12px 0 0;
+  color: #475569;
+  font-size: 12px;
+  line-height: 1.5;
+}
+
+.company-profile {
+  padding-bottom: 145px;
+}
+
+.companies-app--dark .company-profile-heading p,
+.companies-app--dark .work-identity-card small,
+.companies-app--dark .manager-intro span span,
+.companies-app--dark .composer-contact-card span span,
+.companies-app--dark .company-announcement span span,
+.companies-app--dark .work-metrics span {
+  color: #94a3b8;
+}
+
+.company-announcement {
+  color: var(--company-blue);
+}
+
+.company-profile-actions {
+  position: absolute;
+  z-index: 4;
+  right: 8px;
+  bottom: 28px;
+  left: 8px;
+  padding: 8px;
+  display: grid;
+  grid-template-columns: repeat(2, 1fr);
+  gap: 7px;
+  border: 1px solid rgb(255 255 255 / 45%);
+  border-radius: 20px;
+  background: rgb(255 255 255 / 76%);
+  box-shadow: 0 18px 35px rgb(15 23 42 / 18%);
+  backdrop-filter: blur(22px) saturate(150%);
+  -webkit-backdrop-filter: blur(22px) saturate(150%);
+}
+
+.companies-app--dark .company-profile-actions {
+  border-color: rgb(255 255 255 / 8%);
+  background: rgb(15 23 42 / 80%);
+}
+
+.request-thread {
+  padding: 8px 0 0;
+  overflow: hidden;
+}
+
+.request-thread-scroll {
+  height: 100%;
+  padding: 4px 10px 88px;
+  overflow-y: auto;
+  scrollbar-width: none;
+}
+
+.request-summary-card :deep(> *) {
+  display: grid;
+  grid-template-columns: 1fr auto;
+  gap: 6px 10px;
+}
+
+.request-summary-card :deep(> *) > span:first-child {
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+}
+
+.request-summary-card small,
+.request-summary-card__meta {
+  color: #64748b;
+  font-size: 9px;
+}
+
+.request-summary-card p,
+.request-summary-card__meta {
+  grid-column: 1 / -1;
+}
+
+.request-summary-card p {
+  margin: 5px 0 0;
+  font-size: 12px;
+  line-height: 1.45;
+}
+
+.request-media-strip {
+  margin: 0 2px 14px;
+  display: grid;
+  grid-auto-columns: minmax(112px, 58%);
+  grid-auto-flow: column;
+  gap: 8px;
+  overflow-x: auto;
+  scroll-snap-type: x proximity;
+  scrollbar-width: none;
+}
+
+.request-media-strip::-webkit-scrollbar {
+  display: none;
+}
+
+.request-media-strip img {
+  width: 100%;
+  height: 108px;
+  display: block;
+  scroll-snap-align: start;
+  border-radius: 14px;
+  object-fit: cover;
+  background: rgb(148 163 184 / 20%);
+}
+
+.request-timeline {
+  margin: 0 12px 16px;
+}
+
+.request-timeline > div {
+  position: relative;
+  display: flex;
+  gap: 9px;
+  min-height: 40px;
+}
+
+.request-timeline > div:not(:last-child)::before {
+  position: absolute;
+  top: 18px;
+  bottom: -3px;
+  left: 10px;
+  width: 1px;
+  content: '';
+  background: rgb(59 130 246 / 28%);
+}
+
+.request-timeline > div > span {
+  z-index: 1;
+  width: 21px;
+  height: 21px;
+  display: grid;
+  flex: none;
+  place-items: center;
+  border-radius: 50%;
+  color: white;
+  background: var(--company-blue);
+}
+
+.request-timeline p {
+  margin: 1px 0 0;
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  font-size: 11px;
+}
+
+.request-timeline small {
+  color: #64748b;
+  font-size: 9px;
+}
+
+.company-messages {
+  min-height: 100px;
+}
+
+.request-thread-actions {
+  margin: 14px 5px;
+  display: grid;
+  grid-template-columns: repeat(2, 1fr);
+  gap: 8px;
+}
+
+.request-thread-actions .is-danger,
+.manager-remove {
+  color: var(--company-red);
+}
+
+.company-messagebar {
+  position: absolute;
+  z-index: 4;
+  right: 0;
+  bottom: 0;
+  left: 0;
+  background: rgb(255 255 255 / 86%);
+  backdrop-filter: blur(20px);
+  -webkit-backdrop-filter: blur(20px);
+}
+
+.companies-app--dark .company-messagebar {
+  background: rgb(15 23 42 / 88%);
+}
+
+.manager-screen {
+  padding-bottom: 35px;
+}
+
+.manager-media-grid {
+  display: grid;
+  grid-template-columns: minmax(0, 1.6fr) minmax(0, 1fr);
+  gap: 9px;
+  margin: 0 10px 12px;
+}
+
+.manager-media-grid button {
+  min-width: 0;
+  min-height: 86px;
+  overflow: hidden;
+  position: relative;
+  display: grid;
+  place-items: center;
+  border: 1px solid rgb(148 163 184 / 30%);
+  border-radius: 16px;
+  padding: 0;
+  color: var(--company-blue);
+  background: rgb(255 255 255 / 62%);
+}
+
+.manager-media-grid img {
+  width: 100%;
+  height: 86px;
+  object-fit: cover;
+}
+
+.manager-media-grid small {
+  position: absolute;
+  right: 6px;
+  bottom: 6px;
+  left: 6px;
+  overflow: hidden;
+  border-radius: 8px;
+  padding: 4px 6px;
+  color: white;
+  background: rgb(15 23 42 / 72%);
+  font-size: 9px;
+  font-weight: 700;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.companies-app--dark .manager-media-grid button {
+  background: rgb(30 41 59 / 66%);
+}
+
+.manager-location {
+  width: calc(100% - 20px);
+  margin: 0 10px 4px;
+}
+
+.manager-location-status {
+  display: block;
+  margin: 0 16px 8px;
+  color: #64748b;
+  font-size: 10px;
+}
+
+.manager-form-list,
+.manager-hours-card,
+.manager-service-card {
+  margin-bottom: 10px;
+}
+
+.manager-hours-card,
+.manager-service-card {
+  border-radius: 18px;
+}
+
+.manager-remove {
+  width: calc(100% - 20px);
+  margin: 2px 10px 10px;
+}
+
+.companies-tab-icon {
+  position: relative;
+  display: inline-flex;
+}
+
+.companies-tab-icon :deep(.k-badge) {
+  position: absolute;
+  top: -5px;
+  right: -10px;
+  color: white;
+  background: var(--company-red);
+}
+
+.companies-sheet :deep(> div:last-child) {
+  max-height: 88%;
+  border-radius: 24px 24px 0 0;
+  overflow: hidden;
+}
+
+.companies-sheet__content {
+  max-height: 82vh;
+  padding: 16px 12px max(22px, env(safe-area-inset-bottom));
+  overflow-y: auto;
+}
+
+.companies-sheet__content > header {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin-bottom: 12px;
+}
+
+.companies-sheet__content > header > span {
+  width: 42px;
+  height: 42px;
+  display: grid;
+  place-items: center;
+  border-radius: 14px;
+  color: white;
+  background: linear-gradient(145deg, var(--company-blue), var(--company-cyan));
+}
+
+.companies-sheet__content > header > div {
+  min-width: 0;
+  flex: 1;
+}
+
+.companies-sheet__content h2 {
+  margin: 0;
+  font-size: 18px;
+}
+
+.companies-sheet__content header small {
+  color: #64748b;
+  font-size: 9px;
+}
+
+.composer-form-list {
+  margin-top: 12px;
+}
+
+.composer-contact-card {
+  margin-top: 12px;
+}
+
+.composer-media-strip {
+  display: flex;
+  gap: 8px;
+  margin: 10px 2px;
+  overflow-x: auto;
+}
+
+.composer-media-strip > span {
+  position: relative;
+  width: 74px;
+  height: 74px;
+  flex: none;
+}
+
+.composer-media-strip img {
+  width: 100%;
+  height: 100%;
+  border-radius: 13px;
+  object-fit: cover;
+}
+
+.composer-media-strip :deep(.k-button) {
+  position: absolute;
+  top: 3px;
+  right: 3px;
+  width: 24px;
+  min-width: 24px;
+  height: 24px;
+  padding: 0;
+  color: white;
+  background: rgb(15 23 42 / 82%);
+}
+
+@media (max-width: 330px) {
+  .companies-content {
+    padding-inline: 7px;
+  }
+
+  .company-profile-actions {
+    grid-template-columns: 1fr;
+  }
+
+  .company-profile {
+    padding-bottom: 190px;
+  }
+}
+</style>
diff --git a/frontend/src/views/apps/CrewLinkApp.vue b/frontend/src/views/apps/CrewLinkApp.vue
index 35ae297..e8ff2be 100644
--- a/frontend/src/views/apps/CrewLinkApp.vue
+++ b/frontend/src/views/apps/CrewLinkApp.vue
@@ -80,6 +80,7 @@ import type {
 } from '@/types/crewlink'
 import { copyText } from '@/utils/clipboard'
 import { nuiCall } from '@/utils/nui'
+import { isTrustedRootMessageSource } from '@/utils/windowMessages'
 
 type CrewLinkTab = 'map' | 'group' | 'pings' | 'profile'
 type CrewLinkSheet =
@@ -644,6 +645,7 @@ function onWheel(event: WheelEvent): void {
 }
 
 function onCrewLinkMessage(event: MessageEvent): void {
+  if (!isTrustedRootMessageSource(event.source, window)) return
   if (event.data?.type === 'crewlink:changed') void crew.bootstrap()
 }
 
diff --git a/frontend/src/views/apps/GalleryApp.vue b/frontend/src/views/apps/GalleryApp.vue
index d24c848..c23a1e3 100644
--- a/frontend/src/views/apps/GalleryApp.vue
+++ b/frontend/src/views/apps/GalleryApp.vue
@@ -26,6 +26,7 @@ import {
   mergeMedia,
 } from '@/utils/media'
 import { nuiCall } from '@/utils/nui'
+import { isTrustedRootMessageSource } from '@/utils/windowMessages'
 
 const isDevelopment = import.meta.env.DEV
 const developmentGalleryState = isDevelopment
@@ -331,6 +332,7 @@ async function deleteSelected(): Promise<void> {
 }
 
 function onMessage(event: MessageEvent): void {
+  if (!isTrustedRootMessageSource(event.source, window)) return
   const message = event.data as { data?: DeleteResult; type?: string }
   if (
     message.type !== 'media:deleteResult' ||
diff --git a/frontend/src/views/apps/GarageApp.vue b/frontend/src/views/apps/GarageApp.vue
index d4dcc97..a7724f9 100644
--- a/frontend/src/views/apps/GarageApp.vue
+++ b/frontend/src/views/apps/GarageApp.vue
@@ -44,6 +44,7 @@ import type {
   GarageVehicleStatus,
   GarageValetState,
 } from '@/types/garage'
+import { isTrustedRootMessageSource } from '@/utils/windowMessages'
 
 type GarageFilter = 'all' | GarageVehicleStatus
 
@@ -208,6 +209,7 @@ async function cancelValet(): Promise<void> {
 }
 
 function handleValetStatus(event: MessageEvent): void {
+  if (!isTrustedRootMessageSource(event.source, window)) return
   if (event.data?.type !== 'garage:valet-status') return
   garage.setValetState((event.data.data as GarageValetState | null) ?? null)
 }
diff --git a/frontend/src/views/apps/MailApp.vue b/frontend/src/views/apps/MailApp.vue
index 1bf48a1..b34618b 100644
--- a/frontend/src/views/apps/MailApp.vue
+++ b/frontend/src/views/apps/MailApp.vue
@@ -51,6 +51,7 @@ import {
   type MailSwipeAction,
   type MailSwipeAxis,
 } from '@/utils/mailSwipe'
+import { isTrustedRootMessageSource } from '@/utils/windowMessages'
 
 type AuthMode = 'login' | 'register'
 type MailScreen = 'folders' | 'list' | 'message' | 'compose'
@@ -594,6 +595,7 @@ function goBack(): void {
 }
 
 function onMailEvent(event: MessageEvent<MailEvent>): void {
+  if (!isTrustedRootMessageSource(event.source, window)) return
   if (event.data.type === 'mail:changed' && event.data.data?.counts) {
     mail.setCounts(event.data.data.counts)
     if (screen.value === 'list') {
diff --git a/frontend/src/views/apps/MessagesApp.vue b/frontend/src/views/apps/MessagesApp.vue
index 6eaa0a8..b1de941 100644
--- a/frontend/src/views/apps/MessagesApp.vue
+++ b/frontend/src/views/apps/MessagesApp.vue
@@ -121,8 +121,11 @@ const knownContactNumbers = computed(
 )
 const contactSuggestions = computed(() => {
   const query = composerNumber.value.trim().toLocaleLowerCase(phone.lang)
-  if (!query) return calls.contacts.slice(0, 8)
-  return calls.contacts
+  const contacts = calls.contacts.filter(
+    (contact) => contact.canMessage !== false,
+  )
+  if (!query) return contacts.slice(0, 8)
+  return contacts
     .filter((contact) =>
       `${contact.name} ${contact.phone_number}`
         .toLocaleLowerCase(phone.lang)
@@ -138,6 +141,9 @@ const activeContact = computed(() =>
     (contact) => contact.phone_number === messages.activeNumber,
   ),
 )
+const activeCanMessage = computed(
+  () => activeContact.value?.canMessage !== false,
+)
 const attachmentPanelOpen = computed(
   () => emojiOpen.value || attachmentPicker.value !== null,
 )
@@ -348,6 +354,13 @@ function beginCompose(): void {
 }
 
 async function chooseRecipient(number: string): Promise<void> {
+  const contact = calls.contacts.find(
+    (candidate) => candidate.phone_number === number,
+  )
+  if (contact?.canMessage === false) {
+    showToast(phone.t('Apps.messages.messagingUnavailable'))
+    return
+  }
   composerNumber.value = number
   if (!(await messages.openThread(number))) {
     showToast(errorText('invalid_number'))
@@ -386,6 +399,10 @@ function openContactDetails(): void {
 }
 
 async function saveContactDetails(): Promise<void> {
+  if (activeContact.value?.readonly) {
+    showToast(phone.t('Apps.phone.errors.readonly_contact'))
+    return
+  }
   if (!contactNameDraft.value.trim() || !contactNumberDraft.value.trim()) return
   const response = await calls.saveContact({
     id: activeContact.value?.id,
@@ -403,6 +420,10 @@ async function saveContactDetails(): Promise<void> {
 
 async function deleteActiveContact(): Promise<void> {
   if (!activeContact.value) return
+  if (activeContact.value.readonly) {
+    showToast(phone.t('Apps.phone.errors.readonly_contact'))
+    return
+  }
   if (!(await calls.deleteContact(activeContact.value.id))) {
     showToast(phone.t('Apps.messages.contactDeleteFailed'))
     return
@@ -412,7 +433,7 @@ async function deleteActiveContact(): Promise<void> {
 }
 
 async function callActiveContact(): Promise<void> {
-  if (!messages.activeNumber) return
+  if (!messages.activeNumber || activeContact.value?.canCall === false) return
   const response = await calls.dial(messages.activeNumber)
   if (!response.success) showToast(phone.t('Apps.messages.callFailed'))
 }
@@ -454,7 +475,7 @@ async function sendAttachment(
   mediaAssetId: string,
   mediaDurationMs?: number,
 ): Promise<void> {
-  if (!messages.activeNumber || sending.value) return
+  if (!messages.activeNumber || !activeCanMessage.value || sending.value) return
   attachmentMenuOpen.value = false
   attachmentPicker.value = null
   sending.value = true
@@ -504,7 +525,14 @@ function queueGifSearch(): void {
 }
 
 async function sendTextMessage(): Promise<void> {
-  if (!messages.activeNumber || !draft.value.trim() || sending.value) return
+  if (
+    !messages.activeNumber ||
+    !activeCanMessage.value ||
+    !draft.value.trim() ||
+    sending.value
+  ) {
+    return
+  }
   const body = draft.value
   draft.value = ''
   emojiOpen.value = false
@@ -542,6 +570,7 @@ function sampleMicrophone(): void {
 }
 
 async function startVoiceRecording(): Promise<void> {
+  if (!activeCanMessage.value) return
   emojiOpen.value = false
   if (
     !navigator.mediaDevices?.getUserMedia ||
@@ -660,7 +689,7 @@ async function finishVoiceRecording(): Promise<void> {
   const waveform = compressedWaveform()
   const shouldDiscard = discardRecording
   cleanupRecorder()
-  if (shouldDiscard) return
+  if (shouldDiscard || !activeCanMessage.value) return
   const blob = new Blob(chunks, { type: mime })
   if (!blob.size || blob.size > VOICE_MAX_BYTES) {
     showToast(phone.t('Apps.messages.recordingTooLarge'))
@@ -1011,6 +1040,7 @@ onBeforeUnmount(() => {
         </button>
         <strong>{{ phone.t('Apps.messages.contactDetails') }}</strong>
         <button
+          v-if="!activeContact?.readonly"
           type="button"
           @click="
             contactEditing ? saveContactDetails() : (contactEditing = true)
@@ -1035,14 +1065,27 @@ onBeforeUnmount(() => {
           </span>
         </span>
         <h2>{{ activeTitle }}</h2>
-        <small>{{ messages.activeNumber }}</small>
+        <small>
+          {{ messages.activeNumber }}
+          <template v-if="activeContact?.readonly">
+            · {{ phone.t('Apps.phone.officialContact') }}
+          </template>
+        </small>
       </div>
       <div class="messages-contact-details__actions">
-        <button type="button" @click="callActiveContact">
+        <button
+          v-if="activeContact?.canCall !== false"
+          type="button"
+          @click="callActiveContact"
+        >
           <PhoneIcon :size="20" />
           <span>{{ phone.t('Apps.messages.call') }}</span>
         </button>
-        <button type="button" @click="contactDetailsOpen = false">
+        <button
+          v-if="activeCanMessage"
+          type="button"
+          @click="contactDetailsOpen = false"
+        >
           <MessageCircle :size="20" />
           <span>{{ phone.t('Apps.messages.messageAction') }}</span>
         </button>
@@ -1052,7 +1095,7 @@ onBeforeUnmount(() => {
           <span>{{ phone.t('Apps.messages.contactName') }}</span>
           <input
             v-model="contactNameDraft"
-            :readonly="!contactEditing"
+            :readonly="!contactEditing || activeContact?.readonly"
             :placeholder="phone.t('Apps.messages.contactName')"
           />
         </label>
@@ -1060,7 +1103,7 @@ onBeforeUnmount(() => {
           <span>{{ phone.t('Apps.messages.phoneNumber') }}</span>
           <input
             v-model="contactNumberDraft"
-            :readonly="!contactEditing"
+            :readonly="!contactEditing || activeContact?.readonly"
             inputmode="tel"
           />
         </label>
@@ -1075,7 +1118,7 @@ onBeforeUnmount(() => {
         {{ phone.t('Apps.messages.addContact') }}
       </button>
       <button
-        v-else
+        v-else-if="!activeContact.readonly"
         type="button"
         class="messages-contact-details__delete"
         @click="deleteActiveContact"
@@ -1119,7 +1162,10 @@ onBeforeUnmount(() => {
       </template>
     </k-messages>
 
-    <section v-if="attachmentMenuOpen" class="messages-attachment-menu">
+    <section
+      v-if="activeCanMessage && attachmentMenuOpen"
+      class="messages-attachment-menu"
+    >
       <button type="button" @click="openMediaApp('photos', 'photo')">
         <span><Images :size="20" /></span>
         {{ phone.t('Apps.messages.attachPhoto') }}
@@ -1142,7 +1188,10 @@ onBeforeUnmount(() => {
       </button>
     </section>
 
-    <section v-if="attachmentPicker" class="messages-media-picker">
+    <section
+      v-if="activeCanMessage && attachmentPicker"
+      class="messages-media-picker"
+    >
       <header>
         <strong>
           {{ phone.t('Apps.messages.gifs') }}
@@ -1190,12 +1239,12 @@ onBeforeUnmount(() => {
     </section>
 
     <FullEmojiPicker
-      v-if="emojiOpen"
+      v-if="activeCanMessage && emojiOpen"
       @close="emojiOpen = false"
       @pick="appendEmoji"
     />
 
-    <section v-if="recording" class="messages-recorder">
+    <section v-if="activeCanMessage && recording" class="messages-recorder">
       <button
         type="button"
         class="messages-recorder__cancel"
@@ -1224,7 +1273,7 @@ onBeforeUnmount(() => {
     </section>
 
     <k-messagebar
-      v-else
+      v-else-if="activeCanMessage"
       class="messages-messagebar"
       :placeholder="phone.t('Apps.messages.message')"
       :value="draft"
@@ -1270,6 +1319,9 @@ onBeforeUnmount(() => {
         </k-toolbar-pane>
       </template>
     </k-messagebar>
+    <k-block v-else class="text-center text-sm text-[#8e8e93]">
+      {{ phone.t('Apps.messages.messagingUnavailable') }}
+    </k-block>
   </k-page>
 
   <k-toast :opened="toastOpened" position="center" @click="toastOpened = false">
diff --git a/frontend/src/views/apps/PhoneApp.vue b/frontend/src/views/apps/PhoneApp.vue
index dc77326..92000c7 100644
--- a/frontend/src/views/apps/PhoneApp.vue
+++ b/frontend/src/views/apps/PhoneApp.vue
@@ -102,6 +102,10 @@ function openContact(contact?: PhoneContact, number = ''): void {
 }
 
 async function saveContact(): Promise<void> {
+  if (editingContact.value?.readonly) {
+    error.value = phone.t('Apps.phone.errors.readonly_contact')
+    return
+  }
   const number = normalizePhoneNumber(contactNumber.value)
   if (!contactName.value.trim() || !number) {
     error.value = phone.t('Apps.phone.errors.invalid_contact')
@@ -137,6 +141,10 @@ async function answerCall(): Promise<void> {
 
 async function deleteEditedContact(): Promise<void> {
   if (!editingContact.value) return
+  if (editingContact.value.readonly) {
+    error.value = phone.t('Apps.phone.errors.readonly_contact')
+    return
+  }
   if (await calls.deleteContact(editingContact.value.id)) {
     editorOpened.value = false
   }
@@ -299,12 +307,17 @@ onMounted(() => {
               v-for="contact in visibleContacts"
               :key="contact.id"
               :title="contact.name"
-              :subtitle="formatPhoneNumber(contact.phone_number)"
+              :subtitle="
+                contact.readonly
+                  ? `${formatPhoneNumber(contact.phone_number)} · ${phone.t('Apps.phone.officialContact')}`
+                  : formatPhoneNumber(contact.phone_number)
+              "
               link
               @click="openContact(contact)"
             >
               <template #after>
                 <k-button
+                  v-if="contact.canCall !== false"
                   clear
                   rounded
                   @click.stop="startCall(contact.phone_number)"
@@ -402,31 +415,44 @@ onMounted(() => {
   <k-dialog :opened="editorOpened" @backdropclick="editorOpened = false">
     <template #title>{{
       phone.t(
-        editingContact ? 'Apps.phone.editContact' : 'Apps.phone.addContact',
+        editingContact?.readonly
+          ? 'Apps.phone.officialContact'
+          : editingContact
+            ? 'Apps.phone.editContact'
+            : 'Apps.phone.addContact',
       )
     }}</template>
     <k-list strong inset>
       <k-list-input
         :value="contactName"
         :label="phone.t('Apps.phone.contactName')"
+        :readonly="editingContact?.readonly"
         @input="contactName = eventValue($event)"
       />
       <k-list-input
         :value="contactNumber"
         :label="phone.t('Apps.phone.phoneNumber')"
         inputmode="numeric"
+        :readonly="editingContact?.readonly"
         @input="contactNumber = eventValue($event)"
       />
     </k-list>
     <p v-if="error" class="text-sm text-[#ff3b30]">{{ error }}</p>
     <template #buttons>
       <k-dialog-button @click="editorOpened = false">{{
-        phone.t('Common.cancel')
+        phone.t(editingContact?.readonly ? 'Common.done' : 'Common.cancel')
       }}</k-dialog-button>
-      <k-dialog-button v-if="editingContact" @click="deleteEditedContact">{{
+      <k-dialog-button
+        v-if="editingContact && !editingContact.readonly"
+        @click="deleteEditedContact"
+        >{{
         phone.t('Common.delete')
       }}</k-dialog-button>
-      <k-dialog-button strong @click="saveContact">{{
+      <k-dialog-button
+        v-if="!editingContact?.readonly"
+        strong
+        @click="saveContact"
+        >{{
         phone.t('Common.save')
       }}</k-dialog-button>
     </template>
diff --git a/frontend/src/views/apps/RadioApp.vue b/frontend/src/views/apps/RadioApp.vue
index 00a600d..ea762d9 100644
--- a/frontend/src/views/apps/RadioApp.vue
+++ b/frontend/src/views/apps/RadioApp.vue
@@ -28,6 +28,7 @@ import { computed, onBeforeUnmount, onMounted, ref } from 'vue'
 import { usePhoneStore } from '@/stores/phone'
 import { useRadioStore } from '@/stores/radio'
 import type { RadioHistoryEntry } from '@/types/radio'
+import { isTrustedRootMessageSource } from '@/utils/windowMessages'
 
 type RadioTab = 'radio' | 'settings'
 
@@ -152,6 +153,7 @@ async function saveRadioProfile(): Promise<void> {
 }
 
 function onMessage(event: MessageEvent): void {
+  if (!isTrustedRootMessageSource(event.source, window)) return
   if (event.data?.type === 'radio:updated' && event.data.data?.members) {
     memberSnapshotAt.value = Date.now()
     radio.updateMembers(event.data.data.members)
diff --git a/frontend/src/views/apps/SettingsApp.vue b/frontend/src/views/apps/SettingsApp.vue
index f390faa..87a2d9a 100644
--- a/frontend/src/views/apps/SettingsApp.vue
+++ b/frontend/src/views/apps/SettingsApp.vue
@@ -49,7 +49,11 @@ import {
 } from 'vue'
 
 import { PHONE_FRAME_COLORS } from '@/config/appearance'
-import { isLaunchablePhoneApp, PHONE_APPS } from '@/config/apps'
+import {
+  getPhoneAppLabel,
+  isLaunchablePhoneApp,
+  PHONE_APPS,
+} from '@/config/apps'
 import { usePhoneStore } from '@/stores/phone'
 import PhonePasscode from '@/components/PhonePasscode.vue'
 import { useAccountStore } from '@/stores/account'
@@ -281,7 +285,7 @@ const activeTitle = computed(() => {
   }
   if (activeView.value === 'notification-detail') {
     return selectedNotificationApp.value
-      ? phone.t(selectedNotificationApp.value.labelKey)
+      ? getPhoneAppLabel(selectedNotificationApp.value, phone.t)
       : phone.t('Apps.settings.notifications')
   }
   return phone.t(`Apps.settings.${activeView.value}`)
@@ -1030,7 +1034,7 @@ onBeforeUnmount(() => {
             v-for="app in notificationApps"
             :key="app.id"
             link
-            :title="phone.t(app.labelKey)"
+            :title="getPhoneAppLabel(app, phone.t)"
             :after="
               phone.t(
                 phone.preferences.settings.notifications[app.id].enabled
@@ -1058,7 +1062,9 @@ onBeforeUnmount(() => {
         "
       >
         <k-list strong inset>
-          <k-list-item :title="phone.t(selectedNotificationApp.labelKey)">
+          <k-list-item
+            :title="getPhoneAppLabel(selectedNotificationApp, phone.t)"
+          >
             <template #media>
               <img
                 class="w-12 h-12 object-contain"
@@ -1080,7 +1086,7 @@ onBeforeUnmount(() => {
                 "
                 :aria-label="
                   phone.t('Apps.settings.toggle.notifications', {
-                    app: phone.t(selectedNotificationApp.labelKey),
+                    app: getPhoneAppLabel(selectedNotificationApp, phone.t),
                   })
                 "
                 @change="
@@ -1110,7 +1116,7 @@ onBeforeUnmount(() => {
                 "
                 :aria-label="
                   phone.t('Apps.settings.toggle.notificationSounds', {
-                    app: phone.t(selectedNotificationApp.labelKey),
+                    app: getPhoneAppLabel(selectedNotificationApp, phone.t),
                   })
                 "
                 @change="
diff --git a/frontend/src/views/apps/SkyRideApp.vue b/frontend/src/views/apps/SkyRideApp.vue
index 2882862..d7968d7 100644
--- a/frontend/src/views/apps/SkyRideApp.vue
+++ b/frontend/src/views/apps/SkyRideApp.vue
@@ -78,6 +78,7 @@ import type {
   SkyRideRide,
   SkyRideRideStatus,
 } from '@/types/skyride'
+import { isTrustedRootMessageSource } from '@/utils/windowMessages'
 
 type SkyRideTab = 'home' | 'rides' | 'activity' | 'messages' | 'profile'
 type LocationTarget = 'pickup' | 'destination'
@@ -677,6 +678,7 @@ function selectTab(tab: SkyRideTab): void {
 }
 
 function handleSkyRideMessage(event: MessageEvent<unknown>): void {
+  if (!isTrustedRootMessageSource(event.source, window)) return
   if (typeof event.data !== 'object' || event.data === null) return
   const message = event.data as Partial<SkyRideChangedMessage>
   if (message.type !== 'skyride:changed' || !message.data) return
diff --git a/frontend/testserver/index.cjs b/frontend/testserver/index.cjs
index c9b57f2..4b18041 100644
--- a/frontend/testserver/index.cjs
+++ b/frontend/testserver/index.cjs
@@ -1054,6 +1054,42 @@ const contacts = [
     phone_number: '5558675309',
     updated_at: '2026-08-04 12:00:00',
   },
+  {
+    canCall: true,
+    canMessage: false,
+    companyId: 'police',
+    icon: 'https://picsum.photos/seed/companies-police-logo/180/180',
+    id: 'company:police',
+    name: 'Los Santos Police',
+    phone_number: '911',
+    readonly: true,
+    source: 'company',
+    verified: true,
+  },
+  {
+    canCall: true,
+    canMessage: false,
+    companyId: 'ambulance',
+    icon: 'https://picsum.photos/seed/companies-ems-logo/180/180',
+    id: 'company:ambulance',
+    name: 'Los Santos Medical',
+    phone_number: '912',
+    readonly: true,
+    source: 'company',
+    verified: true,
+  },
+  {
+    canCall: true,
+    canMessage: true,
+    companyId: 'bennys',
+    icon: 'https://picsum.photos/seed/companies-bennys-logo/180/180',
+    id: 'company:bennys',
+    name: "Benny's Motor Works",
+    phone_number: '5550102',
+    readonly: true,
+    source: 'company',
+    verified: true,
+  },
 ]
 const attachmentAssets = {
   gif: new Set(['celebrate', 'hearts', 'party', 'thumbs_up', 'wow']),
@@ -2097,6 +2133,488 @@ function flareBootstrap() {
   }
 }
 
+const companyCategories = [
+  { id: 'public_services', name: 'Public Services' },
+  { id: 'medical', name: 'Medical' },
+  { id: 'mechanics', name: 'Mechanics' },
+  { id: 'transport', name: 'Transport' },
+  { id: 'gastronomy', name: 'Food & Drink' },
+]
+let companyCallAvailable = false
+const companyProfiles = [
+  {
+    acceptsRequests: false,
+    announcement: {
+      body: 'Community traffic unit active around Legion Square.',
+      expiresAt: isoTime(6 * 60 * 60 * 1000),
+      publishedAt: isoTime(-35 * 60 * 1000),
+    },
+    availability: 'available',
+    availabilityUpdatedAt: isoTime(-12 * 60 * 1000),
+    canCall: true,
+    canMessage: false,
+    categoryId: 'public_services',
+    categoryName: 'Public Services',
+    coverUrl: 'https://picsum.photos/seed/companies-police-cover/900/360',
+    description:
+      'Public safety, non-emergency assistance, and community response for Los Santos.',
+    hours: [],
+    id: 'police',
+    location: {
+      address: 'Sinner Street',
+      coords: { x: 441.2, y: -981.9, z: 30.7 },
+      district: 'Mission Row',
+      label: 'Mission Row Police Station',
+    },
+    logoUrl: 'https://picsum.photos/seed/companies-police-logo/180/180',
+    name: 'Los Santos Police',
+    phoneNumber: '911',
+    revision: 3,
+    services: [
+      {
+        acceptsRequests: false,
+        active: true,
+        description: 'Immediate police response through the service line.',
+        id: 'emergency-response',
+        priceText: null,
+        title: 'Emergency Response',
+      },
+      {
+        acceptsRequests: false,
+        active: true,
+        description: 'General information and non-emergency assistance.',
+        id: 'public-assistance',
+        priceText: null,
+        title: 'Public Assistance',
+      },
+    ],
+    serviceSummary: 'Emergency response and public assistance',
+    verified: true,
+  },
+  {
+    acceptsRequests: false,
+    announcement: null,
+    availability: 'busy',
+    availabilityUpdatedAt: isoTime(-22 * 60 * 1000),
+    canCall: true,
+    canMessage: false,
+    categoryId: 'medical',
+    categoryName: 'Medical',
+    coverUrl: 'https://picsum.photos/seed/companies-ems-cover/900/360',
+    description:
+      'Emergency medical response and patient care across Los Santos County.',
+    hours: [],
+    id: 'ambulance',
+    location: {
+      address: 'Elgin Avenue',
+      coords: { x: 298.4, y: -584.6, z: 43.3 },
+      district: 'Pillbox Hill',
+      label: 'Pillbox Medical Center',
+    },
+    logoUrl: 'https://picsum.photos/seed/companies-ems-logo/180/180',
+    name: 'Los Santos Medical',
+    phoneNumber: '912',
+    revision: 1,
+    services: [
+      {
+        acceptsRequests: false,
+        active: true,
+        description: 'Urgent medical assistance through the service line.',
+        id: 'medical-response',
+        priceText: null,
+        title: 'Medical Response',
+      },
+    ],
+    serviceSummary: 'Emergency medical care',
+    verified: true,
+  },
+  {
+    acceptsRequests: true,
+    announcement: {
+      body: 'Same-day repairs available until 10 PM.',
+      expiresAt: isoTime(10 * 60 * 60 * 1000),
+      publishedAt: isoTime(-48 * 60 * 1000),
+    },
+    availability: 'available',
+    availabilityUpdatedAt: isoTime(-6 * 60 * 1000),
+    canCall: true,
+    canMessage: true,
+    categoryId: 'mechanics',
+    categoryName: 'Mechanics',
+    coverUrl: 'https://picsum.photos/seed/companies-bennys-cover/900/360',
+    description:
+      'Repairs, roadside assistance, performance upgrades, and custom bodywork.',
+    hours: [
+      { closesAt: '22:00', day: 0, isClosed: false, opensAt: '10:00' },
+      { closesAt: '22:00', day: 1, isClosed: false, opensAt: '10:00' },
+      { closesAt: '22:00', day: 2, isClosed: false, opensAt: '10:00' },
+      { closesAt: '22:00', day: 3, isClosed: false, opensAt: '10:00' },
+      { closesAt: '23:30', day: 4, isClosed: false, opensAt: '10:00' },
+      { closesAt: '23:30', day: 5, isClosed: false, opensAt: '12:00' },
+      { closesAt: null, day: 6, isClosed: true, opensAt: null },
+    ],
+    id: 'bennys',
+    location: {
+      address: 'Alta Street',
+      coords: { x: -211.6, y: -1324.2, z: 30.9 },
+      district: 'Strawberry',
+      label: "Benny's Original Motor Works",
+    },
+    logoUrl: 'https://picsum.photos/seed/companies-bennys-logo/180/180',
+    name: "Benny's Motor Works",
+    phoneNumber: '5550102',
+    revision: 7,
+    services: [
+      {
+        acceptsRequests: true,
+        active: true,
+        description: 'Diagnostics and general mechanical repairs.',
+        id: 'repair',
+        priceText: 'from $250',
+        title: 'Vehicle Repair',
+      },
+      {
+        acceptsRequests: true,
+        active: true,
+        description: 'Mobile help for disabled vehicles.',
+        id: 'roadside',
+        priceText: 'from $175',
+        title: 'Roadside Assistance',
+      },
+      {
+        acceptsRequests: true,
+        active: true,
+        description: 'Paint, wheels, and body modifications.',
+        id: 'customization',
+        priceText: 'Quote',
+        title: 'Customization',
+      },
+    ],
+    serviceSummary: 'Repairs, roadside help, and customization',
+    verified: true,
+  },
+  {
+    acceptsRequests: true,
+    announcement: null,
+    availability: 'available',
+    availabilityUpdatedAt: isoTime(-19 * 60 * 1000),
+    canCall: true,
+    canMessage: true,
+    categoryId: 'transport',
+    categoryName: 'Transport',
+    coverUrl: 'https://picsum.photos/seed/companies-taxi-cover/900/360',
+    description: 'Citywide passenger transport and pre-arranged group rides.',
+    hours: [],
+    id: 'downtown-cab',
+    location: {
+      address: 'Tangerine Street',
+      coords: { x: 900.3, y: -170.2, z: 74.1 },
+      district: 'East Vinewood',
+      label: 'Downtown Cab Co.',
+    },
+    logoUrl: 'https://picsum.photos/seed/companies-taxi-logo/180/180',
+    name: 'Downtown Cab Co.',
+    phoneNumber: '5550103',
+    revision: 2,
+    services: [
+      {
+        acceptsRequests: true,
+        active: true,
+        description: 'A driver will collect you at your location.',
+        id: 'pickup',
+        priceText: 'Metered',
+        title: 'Passenger Pickup',
+      },
+    ],
+    serviceSummary: 'Passenger pickups throughout the city',
+    verified: true,
+  },
+  {
+    acceptsRequests: true,
+    announcement: null,
+    availability: 'closed',
+    availabilityUpdatedAt: isoTime(-3 * 60 * 60 * 1000),
+    canCall: true,
+    canMessage: true,
+    categoryId: 'gastronomy',
+    categoryName: 'Food & Drink',
+    coverUrl: 'https://picsum.photos/seed/companies-burgershot-cover/900/360',
+    description: 'Burgers, fries, shakes, and late-night catering.',
+    hours: [],
+    id: 'burgershot',
+    location: {
+      address: 'San Andreas Avenue',
+      coords: { x: -1193.8, y: -892.5, z: 14 },
+      district: 'Vespucci',
+      label: 'Burger Shot',
+    },
+    logoUrl: 'https://picsum.photos/seed/companies-burgershot-logo/180/180',
+    name: 'Burger Shot',
+    phoneNumber: '5550104',
+    revision: 1,
+    services: [
+      {
+        acceptsRequests: true,
+        active: true,
+        description: 'Food order for collection at the restaurant.',
+        id: 'catering',
+        priceText: 'Quote',
+        title: 'Event Catering',
+      },
+    ],
+    serviceSummary: 'Food, drinks, and event catering',
+    verified: true,
+  },
+]
+
+let companyRequestSequence = 4
+let companyRequests = [
+  {
+    actions: {
+      allowedStatuses: ['in_progress', 'waiting_customer', 'completed'],
+      canAssign: true,
+      canCall: true,
+      canCancel: true,
+      canClaim: false,
+      canReply: true,
+    },
+    assignedLabel: 'you',
+    companyId: 'bennys',
+    companyLogoUrl: companyProfiles[2].logoUrl,
+    companyName: companyProfiles[2].name,
+    createdAt: isoTime(-2 * 60 * 60 * 1000),
+    description:
+      'My Sultan stopped near Legion Square and the engine will not start.',
+    events: [
+      {
+        createdAt: isoTime(-2 * 60 * 60 * 1000),
+        id: 'company-event-1',
+        status: 'new',
+        type: 'created',
+      },
+      {
+        createdAt: isoTime(-95 * 60 * 1000),
+        id: 'company-event-2',
+        status: 'assigned',
+        type: 'assigned',
+      },
+      {
+        createdAt: isoTime(-80 * 60 * 1000),
+        id: 'company-event-3',
+        status: 'in_progress',
+        type: 'status_changed',
+      },
+    ],
+    id: 'company-request-1',
+    media: [
+      {
+        id: 3,
+        url: 'https://picsum.photos/seed/sky-phone-3/800/600',
+      },
+      {
+        id: 4,
+        url: 'https://picsum.photos/seed/sky-phone-4/800/600',
+      },
+    ],
+    messages: [
+      {
+        author: 'customer',
+        authorLabel: 'you',
+        body: 'I am parked on the north side of the square.',
+        createdAt: isoTime(-110 * 60 * 1000),
+        id: 'company-message-1',
+        isMine: true,
+      },
+      {
+        author: 'company',
+        authorLabel: 'company',
+        body: 'A mechanic is heading your way. Please stay near the vehicle.',
+        createdAt: isoTime(-78 * 60 * 1000),
+        id: 'company-message-2',
+        isMine: false,
+      },
+    ],
+    phoneNumber: companyProfiles[2].phoneNumber,
+    revision: 3,
+    serviceId: 'roadside',
+    serviceName: 'Roadside Assistance',
+    status: 'in_progress',
+    subject: 'Vehicle will not start',
+    unreadCount: 1,
+    updatedAt: isoTime(-78 * 60 * 1000),
+  },
+  {
+    actions: {
+      allowedStatuses: ['assigned', 'cancelled'],
+      canAssign: true,
+      canCall: true,
+      canCancel: true,
+      canClaim: true,
+      canReply: true,
+    },
+    assignedLabel: null,
+    companyId: 'bennys',
+    companyLogoUrl: companyProfiles[2].logoUrl,
+    companyName: companyProfiles[2].name,
+    createdAt: isoTime(-18 * 60 * 1000),
+    description:
+      'I would like a quote for a metallic blue repaint and new wheels.',
+    events: [
+      {
+        createdAt: isoTime(-18 * 60 * 1000),
+        id: 'company-event-4',
+        status: 'new',
+        type: 'created',
+      },
+    ],
+    id: 'company-request-2',
+    media: [],
+    messages: [],
+    phoneNumber: companyProfiles[2].phoneNumber,
+    revision: 1,
+    serviceId: 'customization',
+    serviceName: 'Customization',
+    status: 'new',
+    subject: 'Repaint and wheels',
+    unreadCount: 0,
+    updatedAt: isoTime(-18 * 60 * 1000),
+  },
+  {
+    actions: {
+      allowedStatuses: [],
+      canAssign: false,
+      canCall: true,
+      canCancel: false,
+      canClaim: false,
+      canReply: false,
+    },
+    assignedLabel: 'assigned',
+    companyId: 'bennys',
+    companyLogoUrl: companyProfiles[2].logoUrl,
+    companyName: companyProfiles[2].name,
+    createdAt: isoTime(-2 * 24 * 60 * 60 * 1000),
+    description: 'Routine engine service and fluids.',
+    events: [
+      {
+        createdAt: isoTime(-2 * 24 * 60 * 60 * 1000),
+        id: 'company-event-5',
+        status: 'new',
+        type: 'created',
+      },
+      {
+        createdAt: isoTime(-26 * 60 * 60 * 1000),
+        id: 'company-event-6',
+        status: 'completed',
+        type: 'completed',
+      },
+    ],
+    id: 'company-request-3',
+    media: [],
+    messages: [],
+    phoneNumber: companyProfiles[2].phoneNumber,
+    revision: 4,
+    serviceId: 'repair',
+    serviceName: 'Vehicle Repair',
+    status: 'completed',
+    subject: 'Routine service',
+    unreadCount: 0,
+    updatedAt: isoTime(-26 * 60 * 60 * 1000),
+  },
+]
+
+const companyMembers = [
+  { id: 'member-mia', name: 'Mia Torres', online: true, role: 'Mechanic' },
+  { id: 'member-jay', name: 'Jay Coleman', online: true, role: 'Tow Operator' },
+  { id: 'member-robin', name: '', online: false, role: 'Mechanic' },
+]
+
+function companySummary(company) {
+  const { coverUrl, hours, revision, services, ...summary } = company
+  return {
+    ...summary,
+    serviceSummary:
+      company.serviceSummary ??
+      services.map((service) => service.title).join(', '),
+  }
+}
+
+function companyRequestSummary(request) {
+  const {
+    actions,
+    description,
+    events,
+    media,
+    messages,
+    phoneNumber,
+    revision,
+    ...summary
+  } = request
+  return summary
+}
+
+function companyWorkContext(testScenario = '') {
+  if (testScenario === 'companies-unauthorized') {
+    return {
+      authorized: false,
+      callAvailable: false,
+      company: null,
+      metrics: { assigned: 0, completedToday: 0, new: 0, waiting: 0 },
+      ownRequests: [],
+      permissions: {
+        canAssign: false,
+        canManageAnnouncement: false,
+        canManageHours: false,
+        canManageProfile: false,
+        canManageServices: false,
+        canSetAvailability: false,
+        canTakeCalls: false,
+      },
+      recentRequests: [],
+      role: null,
+      unreadCount: 0,
+    }
+  }
+  const manager = testScenario === 'companies-manager'
+  const open = companyRequests.filter(
+    (request) =>
+      request.companyId === 'bennys' &&
+      !['completed', 'cancelled'].includes(request.status),
+  )
+  return {
+    authorized: true,
+    callAvailable: companyCallAvailable,
+    company: companyProfiles.find((company) => company.id === 'bennys'),
+    metrics: {
+      assigned: open.filter((request) => request.assignedLabel).length,
+      completedToday: companyRequests.filter(
+        (request) =>
+          request.companyId === 'bennys' && request.status === 'completed',
+      ).length,
+      new: open.filter((request) => request.status === 'new').length,
+      waiting: open.filter((request) => request.status === 'waiting_customer')
+        .length,
+    },
+    ownRequests: open
+      .filter((request) => request.assignedLabel)
+      .map(companyRequestSummary),
+    permissions: {
+      canAssign: manager,
+      canManageAnnouncement: manager,
+      canManageHours: manager,
+      canManageProfile: manager,
+      canManageServices: manager,
+      canSetAvailability: true,
+      canTakeCalls: true,
+    },
+    recentRequests: open.slice(0, 4).map(companyRequestSummary),
+    role: manager ? 'manager' : 'employee',
+    unreadCount: open.reduce(
+      (total, request) => total + request.unreadCount,
+      0,
+    ),
+  }
+}
+
 app.post('/api/:endpoint', async (request, response, next) => {
   console.log(`[NUI] ${request.params.endpoint}`, request.body)
   const endpoint = request.params.endpoint
@@ -2659,6 +3177,412 @@ app.post('/api/:endpoint', (request, response) => {
   console.log(`[NUI] ${request.params.endpoint}`, request.body)
   const endpoint = request.params.endpoint
   const testScenario = String(request.body._testScenario ?? '')
+  if (endpoint.startsWith('companies:') && testScenario === 'companies-error') {
+    response.json({ success: false, error: 'service_unavailable' })
+    return
+  }
+  if (endpoint === 'companies:list') {
+    const reply = () => {
+      const search = String(request.body.search ?? '')
+        .trim()
+        .toLowerCase()
+      const categoryId = String(request.body.categoryId ?? '')
+      const availability = String(request.body.availability ?? '')
+      const offset = Math.max(0, Number(request.body.cursor ?? 0))
+      const pageSize = 3
+      let items = companyProfiles.filter((company) => {
+        if (categoryId && company.categoryId !== categoryId) return false
+        if (availability && company.availability !== availability) return false
+        if (request.body.hasLocation && !company.location) return false
+        if (request.body.acceptsRequests && !company.acceptsRequests)
+          return false
+        if (!search) return true
+        return [
+          company.name,
+          company.categoryName,
+          company.description,
+          company.location?.district,
+          ...company.services.flatMap((service) => [
+            service.title,
+            service.description,
+          ]),
+        ]
+          .filter(Boolean)
+          .some((value) => String(value).toLowerCase().includes(search))
+      })
+      if (request.body.sort === 'name') {
+        items = [...items].sort((left, right) =>
+          left.name.localeCompare(right.name),
+        )
+      } else if (request.body.sort === 'updated') {
+        items = [...items].sort(
+          (left, right) =>
+            new Date(right.availabilityUpdatedAt).getTime() -
+            new Date(left.availabilityUpdatedAt).getTime(),
+        )
+      }
+      if (
+        testScenario === 'companies-empty-search' ||
+        search === 'no results'
+      ) {
+        items = []
+      }
+      const page = items.slice(offset, offset + pageSize)
+      response.json({
+        success: true,
+        data: {
+          categories: companyCategories,
+          companies: page.map(companySummary),
+          nextCursor:
+            offset + page.length < items.length
+              ? String(offset + page.length)
+              : null,
+        },
+      })
+    }
+    if (testScenario === 'companies-loading') setTimeout(reply, 1200)
+    else reply()
+    return
+  }
+  if (endpoint === 'companies:get') {
+    const company = companyProfiles.find(
+      (item) => item.id === String(request.body.companyId),
+    )
+    response.json(
+      company
+        ? { success: true, data: { company } }
+        : { success: false, error: 'company_not_found' },
+    )
+    return
+  }
+  if (endpoint === 'companies:my-requests') {
+    const list = request.body.list === 'closed' ? 'closed' : 'open'
+    const offset = Math.max(0, Number(request.body.cursor ?? 0))
+    const matches = companyRequests.filter((item) =>
+      list === 'closed'
+        ? ['completed', 'cancelled'].includes(item.status)
+        : !['completed', 'cancelled'].includes(item.status),
+    )
+    const page = matches.slice(offset, offset + 2)
+    response.json({
+      success: true,
+      data: {
+        nextCursor:
+          offset + page.length < matches.length
+            ? String(offset + page.length)
+            : null,
+        requests: page.map(companyRequestSummary),
+        unreadCount: companyRequests.reduce(
+          (total, item) => total + item.unreadCount,
+          0,
+        ),
+      },
+    })
+    return
+  }
+  if (endpoint === 'companies:get-request') {
+    const item = companyRequests.find(
+      (candidate) => candidate.id === String(request.body.requestId),
+    )
+    if (item) item.unreadCount = 0
+    response.json(
+      item
+        ? { success: true, data: { request: item } }
+        : { success: false, error: 'request_not_found' },
+    )
+    return
+  }
+  if (endpoint === 'companies:work-context') {
+    response.json({
+      success: true,
+      data: { context: companyWorkContext(testScenario) },
+    })
+    return
+  }
+  if (endpoint === 'companies:work-queue') {
+    const filter = String(request.body.filter ?? 'new')
+    const offset = Math.max(0, Number(request.body.cursor ?? 0))
+    const matches = companyRequests.filter((item) => {
+      if (item.companyId !== 'bennys') return false
+      if (filter === 'assigned') return item.assignedLabel === 'you'
+      return item.status === filter
+    })
+    const page = matches.slice(offset, offset + 2)
+    response.json({
+      success: true,
+      data: {
+        nextCursor:
+          offset + page.length < matches.length
+            ? String(offset + page.length)
+            : null,
+        requests: page.map(companyRequestSummary),
+      },
+    })
+    return
+  }
+  if (endpoint === 'companies:list-members') {
+    response.json({ success: true, data: { members: companyMembers } })
+    return
+  }
+  if (endpoint === 'companies:create-request') {
+    const company = companyProfiles.find(
+      (item) => item.id === String(request.body.companyId),
+    )
+    const service = company?.services.find(
+      (item) => item.id === String(request.body.serviceId),
+    )
+    if (!company?.acceptsRequests || !service?.acceptsRequests) {
+      response.json({ success: false, error: 'invalid_service' })
+      return
+    }
+    const now = new Date().toISOString()
+    const item = {
+      actions: {
+        allowedStatuses: ['assigned', 'cancelled'],
+        canAssign: true,
+        canCall: true,
+        canCancel: true,
+        canClaim: true,
+        canReply: true,
+      },
+      assignedLabel: null,
+      companyId: company.id,
+      companyLogoUrl: company.logoUrl,
+      companyName: company.name,
+      createdAt: now,
+      description: String(request.body.description ?? ''),
+      events: [
+        {
+          createdAt: now,
+          id: `company-event-${Date.now()}`,
+          status: 'new',
+          type: 'created',
+        },
+      ],
+      id: `company-request-${companyRequestSequence++}`,
+      media: (Array.isArray(request.body.mediaIds)
+        ? request.body.mediaIds
+        : []
+      ).flatMap((mediaId) => {
+        const media = mockMedia.find(
+          (candidate) =>
+            candidate.id === Number(mediaId) && candidate.mediaType === 'photo',
+        )
+        return media ? [{ id: media.id, url: media.url }] : []
+      }),
+      messages: [],
+      phoneNumber: company.phoneNumber,
+      revision: 1,
+      serviceId: service.id,
+      serviceName: service.title,
+      status: 'new',
+      subject: String(request.body.subject ?? ''),
+      unreadCount: 0,
+      updatedAt: now,
+    }
+    companyRequests.unshift(item)
+    response.json({ success: true, data: { request: item } })
+    return
+  }
+  if (
+    [
+      'companies:cancel-request',
+      'companies:send-message',
+      'companies:claim-request',
+      'companies:assign-request',
+      'companies:update-request-status',
+    ].includes(endpoint)
+  ) {
+    const item = companyRequests.find(
+      (candidate) => candidate.id === String(request.body.requestId),
+    )
+    if (!item) {
+      response.json({ success: false, error: 'request_not_found' })
+      return
+    }
+    if (Number(request.body.revision) !== item.revision) {
+      response.json({ success: false, error: 'revision_conflict' })
+      return
+    }
+    const now = new Date().toISOString()
+    if (endpoint === 'companies:cancel-request') {
+      item.status = 'cancelled'
+      item.actions = {
+        allowedStatuses: [],
+        canAssign: false,
+        canCall: true,
+        canCancel: false,
+        canClaim: false,
+        canReply: false,
+      }
+      item.events.push({
+        createdAt: now,
+        id: `company-event-${Date.now()}`,
+        status: 'cancelled',
+        type: 'cancelled',
+      })
+    }
+    if (endpoint === 'companies:send-message') {
+      item.messages.push({
+        author: 'customer',
+        authorLabel: 'you',
+        body: String(request.body.body ?? ''),
+        createdAt: now,
+        id: `company-message-${Date.now()}`,
+        isMine: true,
+      })
+    }
+    if (endpoint === 'companies:claim-request') {
+      item.assignedLabel = 'you'
+      item.status = 'assigned'
+      item.actions.canClaim = false
+      item.events.push({
+        createdAt: now,
+        id: `company-event-${Date.now()}`,
+        status: 'assigned',
+        type: 'assigned',
+      })
+    }
+    if (endpoint === 'companies:assign-request') {
+      const member = companyMembers.find(
+        (candidate) => candidate.id === String(request.body.memberId),
+      )
+      if (!member?.online) {
+        response.json({ success: false, error: 'not_authorized' })
+        return
+      }
+      item.assignedLabel = 'assigned'
+      item.status = 'assigned'
+      item.actions.canClaim = false
+      item.events.push({
+        createdAt: now,
+        id: `company-event-${Date.now()}`,
+        status: 'assigned',
+        type: 'assigned',
+      })
+    }
+    if (endpoint === 'companies:update-request-status') {
+      item.status = String(request.body.status)
+      item.events.push({
+        createdAt: now,
+        id: `company-event-${Date.now()}`,
+        status: item.status,
+        type:
+          item.status === 'completed'
+            ? 'completed'
+            : item.status === 'cancelled'
+              ? 'cancelled'
+              : 'status_changed',
+      })
+    }
+    item.revision += 1
+    item.updatedAt = now
+    response.json({
+      success: true,
+      data: {
+        context: companyWorkContext(testScenario),
+        request: item,
+      },
+    })
+    return
+  }
+  if (
+    [
+      'companies:update-availability',
+      'companies:update-profile',
+      'companies:update-hours',
+      'companies:update-services',
+      'companies:publish-announcement',
+    ].includes(endpoint)
+  ) {
+    const company = companyProfiles.find((item) => item.id === 'bennys')
+    if (
+      testScenario === 'companies-conflict' ||
+      Number(request.body.revision) !== company.revision
+    ) {
+      response.json({ success: false, error: 'revision_conflict' })
+      return
+    }
+    if (endpoint === 'companies:update-availability') {
+      company.availability = String(request.body.availability)
+      company.availabilityUpdatedAt = new Date().toISOString()
+    }
+    if (endpoint === 'companies:update-profile') {
+      company.acceptsRequests = request.body.acceptsRequests === true
+      company.description = String(request.body.description ?? '')
+      company.location = {
+        ...company.location,
+        address: String(request.body.address ?? ''),
+        coords:
+          request.body.coords && typeof request.body.coords === 'object'
+            ? { ...request.body.coords }
+            : company.location.coords,
+        district: String(request.body.district ?? ''),
+        label: String(request.body.locationLabel ?? ''),
+      }
+      const logo = mockMedia.find(
+        (item) => item.id === Number(request.body.logoMediaId),
+      )
+      const cover = mockMedia.find(
+        (item) => item.id === Number(request.body.coverMediaId),
+      )
+      if (logo) company.logoUrl = logo.url
+      if (cover) company.coverUrl = cover.url
+    }
+    if (endpoint === 'companies:update-hours') {
+      company.hours = Array.isArray(request.body.hours)
+        ? request.body.hours
+        : []
+    }
+    if (endpoint === 'companies:update-services') {
+      company.services = Array.isArray(request.body.services)
+        ? request.body.services.map((service, index) => ({
+            ...service,
+            id: service.id || `service-${Date.now()}-${index}`,
+          }))
+        : []
+      company.serviceSummary = company.services
+        .filter((service) => service.active)
+        .map((service) => service.title)
+        .join(', ')
+    }
+    if (endpoint === 'companies:publish-announcement') {
+      const body = String(request.body.body ?? '').trim()
+      company.announcement = body
+        ? {
+            body,
+            expiresAt: request.body.expiresAt || null,
+            publishedAt: new Date().toISOString(),
+          }
+        : null
+    }
+    company.revision += 1
+    response.json({
+      success: true,
+      data: {
+        company,
+        context: companyWorkContext(testScenario),
+      },
+    })
+    return
+  }
+  if (endpoint === 'companies:set-call-availability') {
+    companyCallAvailable = request.body.available === true
+    response.json({
+      success: true,
+      data: { context: companyWorkContext(testScenario) },
+    })
+    return
+  }
+  if (endpoint === 'companies:call-customer') {
+    const item = companyRequests.find(
+      (candidate) => candidate.id === String(request.body.requestId),
+    )
+    response.json(
+      item ? { success: true } : { success: false, error: 'request_not_found' },
+    )
+    return
+  }
   if (endpoint === 'crewlink:bootstrap') {
     response.json({ success: true, data: crewLinkBootstrap(testScenario) })
     return
@@ -2734,7 +3658,9 @@ app.post('/api/:endpoint', (request, response) => {
     return
   }
   if (endpoint === 'crewlink:update-group') {
-    const group = crewLinkGroups.find((item) => item.id === request.body.groupId)
+    const group = crewLinkGroups.find(
+      (item) => item.id === request.body.groupId,
+    )
     if (!group) {
       response.json({ success: false, error: 'group_not_found' })
       return
@@ -2749,7 +3675,9 @@ app.post('/api/:endpoint', (request, response) => {
     return
   }
   if (endpoint === 'crewlink:delete-group') {
-    crewLinkGroups = crewLinkGroups.filter((item) => item.id !== request.body.groupId)
+    crewLinkGroups = crewLinkGroups.filter(
+      (item) => item.id !== request.body.groupId,
+    )
     delete crewLinkMembers[request.body.groupId]
     delete crewLinkPings[request.body.groupId]
     crewLinkProfile.activeGroupId = crewLinkGroups[0]?.id ?? null
@@ -2757,7 +3685,9 @@ app.post('/api/:endpoint', (request, response) => {
     return
   }
   if (endpoint === 'crewlink:set-active') {
-    const group = crewLinkGroups.find((item) => item.id === request.body.groupId)
+    const group = crewLinkGroups.find(
+      (item) => item.id === request.body.groupId,
+    )
     if (!group) {
       response.json({ success: false, error: 'group_not_found' })
       return
@@ -2802,7 +3732,9 @@ app.post('/api/:endpoint', (request, response) => {
     return
   }
   if (endpoint === 'crewlink:rotate-code') {
-    const group = crewLinkGroups.find((item) => item.id === request.body.groupId)
+    const group = crewLinkGroups.find(
+      (item) => item.id === request.body.groupId,
+    )
     if (group) group.inviteCode = 'FRESH247'
     response.json({ success: true, data: { inviteCode: 'FRESH247' } })
     return
@@ -2848,7 +3780,9 @@ app.post('/api/:endpoint', (request, response) => {
     return
   }
   if (endpoint === 'crewlink:transfer-owner') {
-    const group = crewLinkGroups.find((item) => item.id === request.body.groupId)
+    const group = crewLinkGroups.find(
+      (item) => item.id === request.body.groupId,
+    )
     const members = crewLinkMembers[request.body.groupId] ?? []
     const current = members.find((item) => item.id === crewLinkProfile.id)
     const next = members.find((item) => item.id === request.body.profileId)
@@ -2867,13 +3801,17 @@ app.post('/api/:endpoint', (request, response) => {
     crewLinkMembers[request.body.groupId] = members.filter(
       (item) => item.id !== request.body.profileId,
     )
-    const group = crewLinkGroups.find((item) => item.id === request.body.groupId)
+    const group = crewLinkGroups.find(
+      (item) => item.id === request.body.groupId,
+    )
     if (group) group.memberCount = crewLinkMembers[request.body.groupId].length
     response.json({ success: true })
     return
   }
   if (endpoint === 'crewlink:leave') {
-    crewLinkGroups = crewLinkGroups.filter((item) => item.id !== request.body.groupId)
+    crewLinkGroups = crewLinkGroups.filter(
+      (item) => item.id !== request.body.groupId,
+    )
     crewLinkProfile.activeGroupId = crewLinkGroups[0]?.id ?? null
     response.json({ success: true, data: crewLinkBootstrap() })
     return
@@ -5243,6 +6181,10 @@ app.post('/api/:endpoint', (request, response) => {
       return
     }
     let contact = contacts.find((item) => item.id === request.body.id)
+    if (contact?.readonly) {
+      response.json({ success: false, error: 'readonly_contact' })
+      return
+    }
     if (contact) {
       contact.name = name
       contact.phone_number = phoneNumber
@@ -5266,6 +6208,10 @@ app.post('/api/:endpoint', (request, response) => {
   }
   if (endpoint === 'contacts:delete') {
     const index = contacts.findIndex((item) => item.id === request.body.id)
+    if (index >= 0 && contacts[index].readonly) {
+      response.json({ success: false, error: 'readonly_contact' })
+      return
+    }
     if (index >= 0) contacts.splice(index, 1)
     response.json({ success: true })
     return
diff --git a/sky_phone/config/companies.lua b/sky_phone/config/companies.lua
new file mode 100644
index 0000000..efb5130
--- /dev/null
+++ b/sky_phone/config/companies.lua
@@ -0,0 +1,248 @@
+Config.Companies = {
+    Enabled = true,
+    PageSize = 20,
+    MaximumPageSize = 50,
+    MaximumOpenRequestsPerSim = 5,
+    MaximumServices = 25,
+    MaximumRequestMedia = 3,
+    SubjectMaxLength = 120,
+    RequestBodyMaxLength = 2000,
+    MessageMaxLength = 2000,
+    ProfileDescriptionMaxLength = 1000,
+    DistrictMaxLength = 80,
+    AddressMaxLength = 160,
+    ServiceTitleMaxLength = 80,
+    ServiceDescriptionMaxLength = 500,
+    ServicePriceMaxLength = 80,
+    AnnouncementTitleMaxLength = 120,
+    AnnouncementBodyMaxLength = 1000,
+    AvailabilityMaximumSeconds = 24 * 60 * 60,
+    AnnouncementMaximumSeconds = 30 * 24 * 60 * 60,
+    RetentionDays = 180,
+    RateLimits = {
+        Read = 120,
+        Search = 60,
+        CreateRequest = 5,
+        Message = 30,
+        RequestAction = 30,
+        Profile = 12,
+        CallAvailability = 30,
+    },
+    CallRouting = {
+        MaxAttempts = 3,
+        RingSeconds = 10,
+    },
+    Categories = {
+        "public_services",
+        "vehicles",
+        "transport",
+    },
+    Statuses = {
+        new = true,
+        assigned = true,
+        in_progress = true,
+        waiting_customer = true,
+        completed = true,
+        cancelled = true,
+    },
+    AvailabilityStatuses = {
+        available = true,
+        busy = true,
+        closed = true,
+    },
+    Definitions = {
+        police = {
+            Job = "police",
+            Name = "Los Santos Police Department",
+            Category = "public_services",
+            Public = true,
+            Emergency = true,
+            Verified = true,
+            Icon = "shield",
+            Description = "Public safety, emergency response, and police services.",
+            DefaultAvailability = "closed",
+            AcceptsRequests = false,
+            District = "Mission Row",
+            LocationLabel = "Mission Row Police Station",
+            Address = "Mission Row Police Station",
+            Location = vector3(425.1, -979.5, 30.7),
+            ServiceLine = {
+                Number = "9110000000",
+                AutoContact = true,
+                CanCall = true,
+                CanMessage = false,
+                Routing = "round_robin",
+                MinimumGrade = 0,
+            },
+            Permissions = {
+                WorkQueue = 0,
+                Availability = 1,
+                Assign = 2,
+                Profile = 3,
+                Hours = 3,
+                Services = 3,
+                Announcement = 3,
+            },
+            Services = {},
+        },
+        ambulance = {
+            Job = "ambulance",
+            Name = "Emergency Medical Services",
+            Category = "public_services",
+            Public = true,
+            Emergency = true,
+            Verified = true,
+            Icon = "medical",
+            Description = "Emergency medical response and patient care.",
+            DefaultAvailability = "closed",
+            AcceptsRequests = false,
+            District = "Pillbox Hill",
+            LocationLabel = "Pillbox Hill Medical Center",
+            Address = "Pillbox Hill Medical Center",
+            Location = vector3(307.2, -595.3, 43.3),
+            ServiceLine = {
+                Number = "9120000000",
+                AutoContact = true,
+                CanCall = true,
+                CanMessage = false,
+                Routing = "round_robin",
+                MinimumGrade = 0,
+            },
+            Permissions = {
+                WorkQueue = 0,
+                Availability = 1,
+                Assign = 2,
+                Profile = 3,
+                Hours = 3,
+                Services = 3,
+                Announcement = 3,
+            },
+            Services = {},
+        },
+        fire = {
+            Job = "fire",
+            Name = "Los Santos Fire Department",
+            Category = "public_services",
+            Public = true,
+            Emergency = true,
+            Verified = true,
+            Icon = "flame",
+            Description = "Fire response, rescue, and public safety services.",
+            DefaultAvailability = "closed",
+            AcceptsRequests = false,
+            District = "El Burro Heights",
+            LocationLabel = "Capital Boulevard Fire Station",
+            Address = "Capital Boulevard Fire Station",
+            Location = vector3(1200.6, -1473.6, 34.9),
+            ServiceLine = {
+                Number = "9130000000",
+                AutoContact = true,
+                CanCall = true,
+                CanMessage = false,
+                Routing = "round_robin",
+                MinimumGrade = 0,
+            },
+            Permissions = {
+                WorkQueue = 0,
+                Availability = 1,
+                Assign = 2,
+                Profile = 3,
+                Hours = 3,
+                Services = 3,
+                Announcement = 3,
+            },
+            Services = {},
+        },
+        mechanic = {
+            Job = "mechanic",
+            Name = "Los Santos Customs",
+            Category = "vehicles",
+            Public = true,
+            Emergency = false,
+            Verified = true,
+            Icon = "wrench",
+            Description = "Vehicle diagnostics, repairs, and roadside assistance.",
+            DefaultAvailability = "closed",
+            AcceptsRequests = true,
+            District = "Burton",
+            LocationLabel = "Los Santos Customs",
+            Address = "Carcer Way",
+            Location = vector3(-337.3, -136.9, 39.0),
+            ServiceLine = {
+                Number = "5550101000",
+                AutoContact = true,
+                CanCall = true,
+                CanMessage = false,
+                Routing = "round_robin",
+                MinimumGrade = 0,
+            },
+            Permissions = {
+                WorkQueue = 0,
+                Availability = 1,
+                Assign = 2,
+                Profile = 3,
+                Hours = 3,
+                Services = 3,
+                Announcement = 3,
+            },
+            Services = {
+                {
+                    Id = "mechanic-repair",
+                    Title = "Vehicle repair",
+                    Description = "Diagnostics and repairs for road vehicles.",
+                    Price = "Price after inspection",
+                    RequestsEnabled = true,
+                },
+                {
+                    Id = "mechanic-towing",
+                    Title = "Roadside assistance",
+                    Description = "Assistance for disabled vehicles.",
+                    Price = "Price by distance",
+                    RequestsEnabled = true,
+                },
+            },
+        },
+        taxi = {
+            Job = "taxi",
+            Name = "Downtown Cab Co.",
+            Category = "transport",
+            Public = true,
+            Emergency = false,
+            Verified = true,
+            Icon = "car",
+            Description = "Staffed taxi rides throughout Los Santos and Blaine County.",
+            DefaultAvailability = "closed",
+            AcceptsRequests = true,
+            District = "East Vinewood",
+            LocationLabel = "Downtown Cab Co.",
+            Address = "Tangerine Street",
+            Location = vector3(895.0, -179.2, 74.7),
+            ServiceLine = {
+                Number = "5550102000",
+                AutoContact = true,
+                CanCall = true,
+                CanMessage = false,
+                Routing = "round_robin",
+                MinimumGrade = 0,
+            },
+            Permissions = {
+                WorkQueue = 0,
+                Availability = 1,
+                Assign = 2,
+                Profile = 3,
+                Hours = 3,
+                Services = 3,
+                Announcement = 3,
+            },
+            Services = {
+                {
+                    Id = "taxi-ride",
+                    Title = "Taxi ride",
+                    Description = "Request a staffed taxi service.",
+                    Price = "Metered fare",
+                    RequestsEnabled = true,
+                },
+            },
+        },
+    },
+}
diff --git a/sky_phone/config/config.lua b/sky_phone/config/config.lua
index ae209d4..da4d58e 100644
--- a/sky_phone/config/config.lua
+++ b/sky_phone/config/config.lua
@@ -19,6 +19,23 @@ Config.Phone = {
     DeviceName = "iFruit Phone",
 }
 
+Config.CustomApps = {
+    Enabled = true,
+    BundledApps = true,
+    ExternalApps = true,
+    ReadyTimeoutMs = 8000,
+    MaximumMessageBytes = 65536,
+    MaximumStorageBytesPerApp = 262144,
+    MaximumStorageValueBytes = 65536, -- Bridge v1 ceiling; lower values tighten the server policy.
+    MaximumStorageKeyLength = 64, -- Bridge v1 ceiling; lower values tighten the server policy.
+    MaximumStorageKeysPerApp = 128,
+    StorageRequestsPerMinute = 120,
+    AllowRemoteOrigins = {
+        -- ["https://apps.example.com"] = true,
+    },
+    TrustedAdapters = {},
+}
+
 Config.Security = {
     PasscodePepperConvar = "sky_phone_passcode_pepper",
     MaximumAttempts = 5,
diff --git a/sky_phone/config/locales/en.lua b/sky_phone/config/locales/en.lua
index 0efd21e..b0c9912 100644
--- a/sky_phone/config/locales/en.lua
+++ b/sky_phone/config/locales/en.lua
@@ -76,7 +76,7 @@ Locales["en"] = {
             open = "Open Control Center", play = "Play", previous = "Previous track", quickActions = "Quick actions",
             timer = "Timer", unmuteRingtone = "Unmute ringtone and notifications", volume = "Volume", wifi = "Wi-Fi",
         },
-        Notifications = { clearAll = "Clear All", now = "now" },
+        Notifications = { clearAll = "Clear All", now = "now", open = "Open notification" },
         LockScreen = {
             label = "Lock Screen", flashlight = "Flashlight", camera = "Camera", swipeUp = "Swipe up to open",
             passcode = {
@@ -114,6 +114,12 @@ Locales["en"] = {
             },
         },
         Apps = {
+            customApps = {
+                loading = "Opening app...",
+                unavailableTitle = "App unavailable",
+                unavailableBody = "This custom app could not be loaded. Check that its resource is started, then reopen the app.",
+                close = "Close app",
+            },
             crewlink = {
                 name = "CrewLink", connecting = "Connecting your crew...", privateNetwork = "Private location network",
                 signInTitle = "Connect your iFruit Account", signInBody = "CrewLink uses your private iFruit identity to keep groups and roles available across your phones.", openSettings = "Open iFruit Settings",
@@ -343,6 +349,7 @@ Locales["en"] = {
             messages = {
                 name = "Messages", newMessage = "New message from {sender}", compose = "New Message",
                 search = "Search", to = "To:", message = "Message", send = "Send", details = "Details",
+                officialContact = "Official company contact", messagingUnavailable = "This company contact does not accept messages.",
                 filterUnread = "Show Unread Messages", smsLabel = "Text Message · SMS",
                 photo = "Photo", gif = "GIF", video = "Video", attachPhoto = "Attach Photo", takePhoto = "Take Photo",
                 attachGif = "Attach GIF", attachVideo = "Attach Video", photos = "Photos", gifs = "GIFs", videos = "Videos",
@@ -369,15 +376,318 @@ Locales["en"] = {
                     recording_in_progress = "A video is already being recorded.", recording_not_found = "No active video recording was found.",
                     gif_provider_unconfigured = "GIF search is not configured.", gif_provider_failed = "GIF search is temporarily unavailable.",
                     self_message = "You cannot message your own number.", recipient_not_found = "That number is unavailable.",
+                    messaging_unavailable = "This company contact does not accept messages.",
                     no_sim = "This phone has no SIM card.", rate_limited = "Too many messages. Try again in a minute.",
                     request_failed = "Messages are temporarily unavailable.", default = "The message could not be sent.",
                 },
             },
+            companies = {
+                name = "Companies",
+                navigation = "Companies navigation",
+                actions = "Request actions",
+                request = "Service Request",
+                verified = "Verified company",
+                back = "Back",
+                close = "Close",
+                tryAgain = "Try Again",
+                loadMore = "Load More",
+                routeSet = "GPS route set.",
+                tabs = {
+                    directory = "Discover",
+                    requests = "Requests",
+                    work = "Work",
+                },
+                availability = {
+                    available = "Available",
+                    busy = "Busy",
+                    closed = "Closed",
+                },
+                requestStatuses = {
+                    new = "New",
+                    assigned = "Assigned",
+                    in_progress = "In Progress",
+                    waiting_customer = "Waiting",
+                    completed = "Completed",
+                    cancelled = "Cancelled",
+                },
+                roles = {
+                    employee = "Employee",
+                    manager = "Manager",
+                },
+                categories = {
+                    gastronomy = "Food & Drink",
+                    vehicles = "Vehicles",
+                    transport = "Transport",
+                    crafts = "Trades",
+                    retail = "Retail",
+                    real_estate = "Real Estate",
+                    media = "Media",
+                    nightlife = "Nightlife",
+                    public_services = "Public Services",
+                    emergency = "Emergency Services",
+                    medical = "Medical",
+                    mechanics = "Mechanics",
+                    government = "Government",
+                },
+                days = {
+                    monday = "Monday",
+                    tuesday = "Tuesday",
+                    wednesday = "Wednesday",
+                    thursday = "Thursday",
+                    friday = "Friday",
+                    saturday = "Saturday",
+                    sunday = "Sunday",
+                },
+                directory = {
+                    searchPlaceholder = "Search companies or services",
+                    categories = "Company categories",
+                    allCategories = "All",
+                    allCompanies = "All Companies",
+                    availableNow = "Available now",
+                    availableNowHint = "Only show companies taking calls right now.",
+                    availableSection = "Available Now",
+                    moreFilters = "More filters",
+                    hasLocation = "Location",
+                    acceptsRequests = "Requests",
+                    resetFilters = "Reset Filters",
+                },
+                loading = {
+                    directory = "Loading companies...",
+                    profile = "Loading company profile...",
+                    request = "Loading request...",
+                    requests = "Loading your requests...",
+                    work = "Loading workspace...",
+                },
+                states = {
+                    directoryError = "Companies are unavailable",
+                    requestsError = "Requests are unavailable",
+                    workError = "Workspace unavailable",
+                    profileError = "Company unavailable",
+                    requestError = "Request unavailable",
+                    noCompanies = "No companies listed",
+                    noCompaniesBody = "Public companies will appear here when configured.",
+                    noResults = "No matching companies",
+                    noResultsBody = "Try another search or reset your filters.",
+                    noOpenRequests = "No open requests",
+                    noClosedRequests = "No completed requests",
+                    noRequestsBody = "Requests you create with a company will appear here.",
+                },
+                actionUnavailable = {
+                    call = "This company cannot be called right now.",
+                    message = "This service line does not accept text messages.",
+                    route = "This company has no public location.",
+                    request = "This company is not accepting service requests.",
+                },
+                profile = {
+                    updated = "Status updated {time}",
+                    announcement = "Latest Update",
+                    location = "Location",
+                    noLocation = "No public location",
+                    hours = "Opening Hours",
+                    closed = "Closed",
+                    byAvailability = "Open by availability",
+                    services = "Services",
+                    noServices = "No public services listed",
+                    call = "Call",
+                    message = "Message",
+                    route = "Route",
+                    request = "Request",
+                },
+                composer = {
+                    title = "New Service Request",
+                    chooseService = "Choose a Service",
+                    subject = "Subject",
+                    subjectPlaceholder = "What do you need?",
+                    description = "Details",
+                    descriptionPlaceholder = "Describe what happened and how the company can help.",
+                    contact = "Contact number",
+                    registeredSim = "Replies go to your registered SIM {number}.",
+                    registeredSimRequired = "A registered SIM is required to send a request.",
+                    addPhotos = "Add Photos ({count}/3)",
+                    selectedPhoto = "Selected request photo",
+                    removePhoto = "Remove photo",
+                    review = "Review Request",
+                    confirmTitle = "Send this request?",
+                    confirmBody = "Send your {service} request to {company}.",
+                    edit = "Keep Editing",
+                    send = "Send Request",
+                },
+                requests = {
+                    open = "Open",
+                    closed = "Completed",
+                    findCompany = "Find a Company",
+                    generalService = "General service",
+                    attachments = "Request photos",
+                    attachedPhoto = "Attached request photo",
+                    timeline = "Timeline",
+                    conversation = "Conversation",
+                    noMessages = "No replies yet",
+                    replyPlaceholder = "Write a reply",
+                    sendReply = "Send reply",
+                    call = "Call Company",
+                    cancel = "Cancel Request",
+                    cancelTitle = "Cancel this request?",
+                    cancelBody = "The company will be notified and can no longer complete it.",
+                    keep = "Keep Request",
+                    cancelConfirm = "Cancel Request",
+                },
+                timeline = {
+                    created = "Request created",
+                    assigned = "Request assigned",
+                    cancelled = "Request cancelled",
+                    completed = "Request completed",
+                    statusChanged = "Status changed to {status}",
+                },
+                time = {
+                    justNow = "just now",
+                    minutesAgo = "{count} min ago",
+                    hoursAgo = "{count} hr ago",
+                    daysAgo = "{count} days ago",
+                },
+                work = {
+                    notAuthorized = "No company workspace",
+                    notAuthorizedBody = "Your current job is not connected to a configured company.",
+                    workspace = "Company Workspace",
+                    publicAvailability = "Public Availability",
+                    takeCalls = "Take company calls",
+                    takeCallsBody = "Route new service-line calls to this active SIM.",
+                    overview = "Today at a Glance",
+                    metrics = {
+                        new = "New",
+                        assigned = "Mine",
+                        waiting = "Waiting",
+                        completedToday = "Done Today",
+                    },
+                    queue = "Request Queue",
+                    filters = {
+                        new = "New",
+                        assigned = "Mine",
+                        in_progress = "In Progress",
+                        waiting_customer = "Waiting",
+                        completed = "Done",
+                    },
+                    unassigned = "Unassigned",
+                    emptyQueue = "Queue is clear",
+                    emptyQueueBody = "No requests match this filter.",
+                },
+                workActions = {
+                    claim = "Claim Request",
+                    assign = "Assign Employee",
+                    callCustomer = "Call Customer",
+                    setStatus = "Set status: {status}",
+                },
+                assignment = {
+                    title = "Assign Employee",
+                    online = "Online",
+                    offline = "Offline",
+                    unknownMember = "Unknown employee",
+                    confirm = "Assign Request",
+                },
+                assignmentLabels = {
+                    you = "Assigned to you",
+                    assigned = "Assigned to a colleague",
+                },
+                messageAuthors = {
+                    you = "You",
+                    customer = "Customer",
+                    company = "Company",
+                },
+                manager = {
+                    title = "Company Profile",
+                    subtitle = "Manage public information, services, and announcements.",
+                    revision = "Server revision {revision}",
+                    availability = "Availability",
+                    profile = "Public Profile",
+                    description = "Description",
+                    descriptionPlaceholder = "Describe the company and what it offers.",
+                    phoneNumber = "Service number",
+                    phoneNumberManaged = "Configured by the server and cannot be edited here.",
+                    noPhoneNumber = "No service number configured",
+                    chooseCover = "Choose cover photo",
+                    chooseLogo = "Choose logo",
+                    coverPhoto = "Company cover photo",
+                    logoPhoto = "Company logo",
+                    locationLabel = "Location name",
+                    locationReady = "A map position is attached to this profile.",
+                    useCurrentLocation = "Use Current Location",
+                    address = "Address",
+                    district = "District",
+                    acceptRequests = "Accept service requests",
+                    acceptRequestsBody = "Allow registered SIMs to open structured requests.",
+                    saveProfile = "Save Profile",
+                    hours = "Opening Hours",
+                    dayOpen = "Company is open on this day",
+                    opensAt = "Opens",
+                    closesAt = "Closes",
+                    saveHours = "Save Hours",
+                    services = "Services",
+                    serviceTitle = "Service name",
+                    serviceDescription = "Description",
+                    priceText = "Price text",
+                    serviceActive = "Publicly visible",
+                    serviceRequests = "Accept requests for this service",
+                    removeService = "Remove Service",
+                    addService = "Add Service",
+                    saveServices = "Save Services",
+                    announcement = "Current Announcement",
+                    announcementText = "Announcement",
+                    announcementPlaceholder = "Share a short, timely update.",
+                    expiresAt = "Expires at",
+                    publish = "Publish Announcement",
+                },
+                feedback = {
+                    requestCreated = "Request sent.",
+                    requestCancelled = "Request cancelled.",
+                    requestClaimed = "Request claimed.",
+                    requestAssigned = "Request assigned.",
+                    statusUpdated = "Request status updated.",
+                    availabilityUpdated = "Public availability updated.",
+                    locationUpdated = "Current location selected.",
+                    callsEnabled = "Company calls enabled.",
+                    callsDisabled = "Company calls disabled.",
+                    profileSaved = "Company profile saved.",
+                    hoursSaved = "Opening hours saved.",
+                    servicesSaved = "Services saved.",
+                    announcementPublished = "Announcement published.",
+                },
+                conflict = {
+                    title = "Newer changes are available",
+                    body = "Another manager updated this information. Reload before saving again.",
+                    reload = "Reload",
+                },
+                notifications = {
+                    newRequest = "New company request",
+                    requestUpdated = "A company request was updated.",
+                    newMessage = "New reply to your company request.",
+                    assigned = "A company request was assigned to you.",
+                },
+                errors = {
+                    anonymous_sim = "A registered SIM is required for service requests.",
+                    call_unavailable = "This service line is currently unavailable.",
+                    company_not_found = "This company is no longer available.",
+                    invalid_profile = "Check the company profile fields.",
+                    invalid_request = "Check the subject and request details.",
+                    invalid_media = "One or more attached photos are unavailable.",
+                    invalid_expiration = "Choose a valid announcement expiration.",
+                    invalid_service = "This service is no longer available.",
+                    invalid_status = "That status change is not allowed.",
+                    messaging_unavailable = "This company does not accept text messages.",
+                    no_sim = "Insert a SIM card to continue.",
+                    not_authorized = "You are not authorized for this company action.",
+                    rate_limited = "Please wait before trying again.",
+                    request_not_found = "This request is no longer available.",
+                    revision_conflict = "The data changed on another device. Reload and try again.",
+                    service_unavailable = "The Companies service is temporarily unavailable.",
+                    too_many_open_requests = "You already have too many open requests.",
+                    request_failed = "Companies could not complete the request.",
+                },
+            },
             phone = {
                 name = "Phone", recents = "Recents", contacts = "Contacts", keypad = "Keypad",
                 noSim = "No SIM", noSimBody = "Insert a SIM card in Settings to make calls.",
                 noRecents = "No Recent Calls", noContacts = "No Contacts", searchContacts = "Search Contacts",
                 addContact = "New Contact", editContact = "Edit Contact", contactName = "Name", phoneNumber = "Phone Number",
+                officialContact = "Official company contact",
                 call = "Call", calling = "calling...", incoming = "Incoming Call", incomingDirection = "Incoming", outgoingDirection = "Outgoing", connected = "Connected",
                 missed = "Missed", declined = "Declined", busy = "Busy", unavailable = "Unavailable",
                 noAnswer = "No Answer", cancelled = "Cancelled", disconnected = "Disconnected", sim_removed = "SIM Removed", completed = "Call Ended",
@@ -387,8 +697,11 @@ Locales["en"] = {
                 choosePhoneBody = "Select the phone that should receive {number}.", emptyPhone = "No SIM inserted",
                 errors = {
                     invalid_contact = "Enter a name and valid phone number.", invalid_number = "Enter a valid phone number.",
+                    invalid_sim = "The active SIM card is unavailable.",
                     no_sim = "This phone has no SIM card.", airplane_mode = "Turn off Airplane Mode to make calls.",
                     self_call = "You cannot call your own number.", busy = "The line is busy.",
+                    company_unavailable = "This company service line is unavailable.",
+                    readonly_contact = "Official company contacts cannot be changed.",
                     rate_limited = "Too many calls. Try again in a minute.", voice_unavailable = "The configured phone voice service is unavailable.",
                     inventory_full = "There is no room for the ejected SIM card.", request_failed = "The phone request failed.",
                     operation_in_progress = "Another phone operation is already in progress.", sim_request_expired = "The SIM selection expired. Use the SIM card again.",
diff --git a/sky_phone/custom_apps/_sdk/default-icon.svg b/sky_phone/custom_apps/_sdk/default-icon.svg
new file mode 100644
index 0000000..751a276
--- /dev/null
+++ b/sky_phone/custom_apps/_sdk/default-icon.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" role="img" aria-label="Custom app">
+  <defs>
+    <linearGradient id="background" x1="18" y1="14" x2="110" y2="116" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#57c7ff"/>
+      <stop offset="1" stop-color="#3152d4"/>
+    </linearGradient>
+  </defs>
+  <rect width="128" height="128" rx="29" fill="url(#background)"/>
+  <rect x="31" y="31" width="28" height="28" rx="8" fill="#fff" fill-opacity=".96"/>
+  <rect x="69" y="31" width="28" height="28" rx="8" fill="#fff" fill-opacity=".8"/>
+  <rect x="31" y="69" width="28" height="28" rx="8" fill="#fff" fill-opacity=".8"/>
+  <path d="M83 68v30M68 83h30" stroke="#fff" stroke-width="9" stroke-linecap="round"/>
+</svg>
diff --git a/sky_phone/custom_apps/_sdk/sky-phone-app.d.ts b/sky_phone/custom_apps/_sdk/sky-phone-app.d.ts
new file mode 100644
index 0000000..48c6b8d
--- /dev/null
+++ b/sky_phone/custom_apps/_sdk/sky-phone-app.d.ts
@@ -0,0 +1,74 @@
+export type SkyPhoneAppContext = {
+  appId: string
+  capabilities: string[]
+  colorScheme: 'dark' | 'light'
+  language: string
+  locale: Record<string, unknown>
+  phoneScale: number
+  protocolVersion: 1
+  safeArea: {
+    bottom: number
+    left: number
+    right: number
+    top: number
+  }
+}
+
+export type SkyPhoneAppEvents = {
+  context: SkyPhoneAppContext | null
+  message: unknown
+  open: unknown
+}
+
+export type SkyPhoneAppNotification = {
+  sound?: 'chime' | 'signal' | 'soft'
+  subtitle?: string
+  text: string
+  title: string
+}
+
+export type SkyPhoneAppStorageEntry<Value = unknown> = {
+  exists: boolean
+  revision: number
+  value?: Value
+}
+
+export type SkyPhoneAppStorageWrite = {
+  revision: number
+}
+
+export type SkyPhoneAppApi = {
+  readonly appId: string
+  readonly protocolVersion: 1
+  close(): Promise<void>
+  getContext(): SkyPhoneAppContext | null
+  notify(
+    notification: SkyPhoneAppNotification,
+  ): Promise<{ notificationId: string | null }>
+  on<EventName extends keyof SkyPhoneAppEvents>(
+    eventName: EventName,
+    listener: (payload: SkyPhoneAppEvents[EventName]) => void,
+  ): () => void
+  open(
+    appId: string,
+    data?: Record<string, unknown>,
+  ): Promise<{ appId: string }>
+  ready(): boolean
+  request<Result = unknown>(method: string, payload?: unknown): Promise<Result>
+  storage: {
+    get<Value = unknown>(key: string): Promise<SkyPhoneAppStorageEntry<Value>>
+    set(
+      key: string,
+      value: unknown,
+      revision: number,
+    ): Promise<SkyPhoneAppStorageWrite>
+  }
+}
+
+declare global {
+  interface Window {
+    SkyPhoneApp: SkyPhoneAppApi
+  }
+}
+
+export {}
diff --git a/sky_phone/custom_apps/_sdk/sky-phone-app.js b/sky_phone/custom_apps/_sdk/sky-phone-app.js
new file mode 100644
index 0000000..4688c59
--- /dev/null
+++ b/sky_phone/custom_apps/_sdk/sky-phone-app.js
@@ -0,0 +1,211 @@
+(function bootstrapSkyPhoneApp() {
+  'use strict'
+
+  const protocolVersion = 1
+  const requestTimeoutMs = 8000
+  const query = new URLSearchParams(window.location.search)
+  const appId =
+    query.get('skyPhoneAppId') ||
+    document.documentElement.dataset.skyPhoneAppId ||
+    document.currentScript?.dataset.appId ||
+    ''
+  const listeners = new Map()
+  const pendingRequests = new Map()
+  let context = null
+  let nextRequestId = 1
+  let readySent = false
+
+  function emit(eventName, payload) {
+    const eventListeners = listeners.get(eventName)
+    if (eventListeners) {
+      for (const listener of [...eventListeners]) listener(payload)
+    }
+    window.dispatchEvent(
+      new CustomEvent(`sky-phone-app:${eventName}`, { detail: payload }),
+    )
+  }
+
+  function send(message) {
+    if (!appId) {
+      console.error('[Sky Phone App] Missing skyPhoneAppId in the frame URL.')
+      return false
+    }
+
+    window.parent.postMessage(
+      {
+        ...message,
+        appId,
+        protocolVersion,
+      },
+      '*',
+    )
+    return true
+  }
+
+  function ready() {
+    if (readySent) return true
+    readySent = send({ type: 'sky-phone-app:ready' })
+    return readySent
+  }
+
+  function on(eventName, listener) {
+    if (typeof eventName !== 'string' || typeof listener !== 'function') {
+      throw new TypeError('SkyPhoneApp.on requires an event name and a function.')
+    }
+
+    const eventListeners = listeners.get(eventName) || new Set()
+    eventListeners.add(listener)
+    listeners.set(eventName, eventListeners)
+    return function unsubscribe() {
+      eventListeners.delete(listener)
+      if (eventListeners.size === 0) listeners.delete(eventName)
+    }
+  }
+
+  function request(method, payload) {
+    if (typeof method !== 'string' || !method) {
+      return Promise.reject(new TypeError('A bridge method is required.'))
+    }
+
+    const requestId = `${Date.now().toString(36)}-${nextRequestId++}`
+    return new Promise((resolve, reject) => {
+      const timeout = window.setTimeout(() => {
+        pendingRequests.delete(requestId)
+        reject(new Error(`Sky Phone request timed out: ${method}`))
+      }, requestTimeoutMs)
+
+      pendingRequests.set(requestId, { reject, resolve, timeout })
+      if (
+        !send({
+          type: 'sky-phone-app:request',
+          method,
+          payload,
+          requestId,
+        })
+      ) {
+        window.clearTimeout(timeout)
+        pendingRequests.delete(requestId)
+        reject(new Error('Sky Phone bridge is unavailable.'))
+      }
+    })
+  }
+
+  function close() {
+    return request('app.close')
+  }
+
+  function open(targetAppId, data) {
+    if (typeof targetAppId !== 'string' || !targetAppId) {
+      return Promise.reject(new TypeError('A target app ID is required.'))
+    }
+
+    return request('app.open', {
+      appId: targetAppId,
+      ...(data === undefined ? {} : { data }),
+    })
+  }
+
+  function notify(notification) {
+    if (!notification || typeof notification !== 'object') {
+      return Promise.reject(new TypeError('A notification is required.'))
+    }
+
+    return request('notification.create', notification)
+  }
+
+  const storage = Object.freeze({
+    get(key) {
+      return request('device.storage.get', { key })
+    },
+    set(key, value, revision) {
+      return request('device.storage.set', { key, revision, value })
+    },
+  })
+
+  function applyContext(nextContext) {
+    if (!nextContext || typeof nextContext !== 'object') return
+
+    const root = document.documentElement
+    if (
+      nextContext.colorScheme === 'dark' ||
+      nextContext.colorScheme === 'light'
+    ) {
+      root.dataset.theme = nextContext.colorScheme
+      root.style.colorScheme = nextContext.colorScheme
+    }
+    if (typeof nextContext.language === 'string' && nextContext.language) {
+      root.lang = nextContext.language
+    }
+    if (typeof nextContext.phoneScale === 'number') {
+      root.style.setProperty('--sky-phone-scale', String(nextContext.phoneScale))
+    }
+    if (nextContext.safeArea && typeof nextContext.safeArea === 'object') {
+      for (const edge of ['top', 'right', 'bottom', 'left']) {
+        const value = nextContext.safeArea[edge]
+        if (typeof value === 'number') {
+          root.style.setProperty(`--sky-safe-area-${edge}`, `${value}px`)
+        }
+      }
+    }
+  }
+
+  window.addEventListener('message', (event) => {
+    if (event.source !== window.parent) return
+    const message = event.data
+    if (
+      !message ||
+      typeof message !== 'object' ||
+      message.appId !== appId ||
+      message.protocolVersion !== protocolVersion
+    ) {
+      return
+    }
+
+    if (message.type === 'sky-phone-app:context') {
+      context = message.context || null
+      applyContext(context)
+      emit('context', context)
+    } else if (message.type === 'sky-phone-app:message') {
+      emit('message', message.payload)
+    } else if (message.type === 'sky-phone-app:open') {
+      emit('open', message.data)
+    } else if (message.type === 'sky-phone-app:response') {
+      const pending = pendingRequests.get(message.requestId)
+      if (!pending) return
+      window.clearTimeout(pending.timeout)
+      pendingRequests.delete(message.requestId)
+      if (message.success) pending.resolve(message.data)
+      else pending.reject(new Error(message.error || 'Sky Phone request failed.'))
+    }
+  })
+
+  const api = Object.freeze({
+    appId,
+    close,
+    getContext: () => context,
+    notify,
+    on,
+    open,
+    protocolVersion,
+    ready,
+    request,
+    storage,
+  })
+
+  if (window.SkyPhoneApp) {
+    console.error('[Sky Phone App] window.SkyPhoneApp is already defined.')
+    return
+  }
+  Object.defineProperty(window, 'SkyPhoneApp', {
+    configurable: false,
+    enumerable: true,
+    value: api,
+    writable: false,
+  })
+
+  if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', ready, { once: true })
+  } else {
+    ready()
+  }
+})()
diff --git a/sky_phone/fxmanifest.lua b/sky_phone/fxmanifest.lua
index b8ed4ca..9d0db07 100644
--- a/sky_phone/fxmanifest.lua
+++ b/sky_phone/fxmanifest.lua
@@ -7,8 +7,15 @@ author 'Sky-Systems'
 description 'Sky Phone'
 version '0.1.0'
 
+provide 'lb-phone'
+provide '17mov_Phone'
+provide 'high-phone'
+provide 'qs-smartphone'
+provide 'yseries'
+
 escrow_ignore {
     'config/**',
+    'custom_apps/**',
     'source/bridge/**',
 }
 
@@ -17,6 +24,9 @@ shared_scripts {
     'source/bridge/shared.lua',
     'source/shared/imei.lua',
     'source/shared/sim_number.lua',
+    'source/shared/custom_apps.lua',
+    'source/shared/custom_app_compat.lua',
+    'custom_apps/**/manifest.lua',
 }
 
 client_scripts {
@@ -34,6 +44,9 @@ client_scripts {
     'source/client/crewlink.lua',
     'source/bridge/client/radio.lua',
     'source/client/payphones.lua',
+    'source/client/custom_apps.lua',
+    'source/client/custom_app_compat.lua',
+    'custom_apps/**/client.lua',
     'source/client/main.lua',
     'source/client/radio.lua',
 }
@@ -41,6 +54,7 @@ client_scripts {
 server_scripts {
     '@oxmysql/lib/MySQL.lua',
     'config/config.lua',
+    'config/companies.lua',
     'config/media.lua',
     'config/music.lua',
     'config/locales/*.lua',
@@ -53,8 +67,12 @@ server_scripts {
     'source/bridge/server/housing/*.lua',
     'source/bridge/server/inventory.lua',
     'source/bridge/server/inventory/*.lua',
+    'source/server/custom_apps.lua',
+    'source/server/custom_app_compat.lua',
     'source/server/db_migrate.lua',
     'source/server/phone.lua',
+    'source/server/companies.lua',
+    'source/server/custom_app_storage.lua',
     'source/server/sim.lua',
     'source/server/calls.lua',
     'source/server/media.lua',
@@ -78,6 +96,7 @@ server_scripts {
     'source/server/calendar.lua',
     'source/server/music.lua',
     'source/server/radio.lua',
+    'custom_apps/**/server.lua',
 }
 
 files {
@@ -85,6 +104,8 @@ files {
     'source/html/assets/**',
     'source/html/img/**',
     'config/music/**',
+    'custom_apps/**/web/**',
+    'custom_apps/_sdk/**',
 }
 
 ui_page 'source/html/index.html'
diff --git a/sky_phone/source/client/custom_app_compat.lua b/sky_phone/source/client/custom_app_compat.lua
new file mode 100644
index 0000000..b2a4ad8
--- /dev/null
+++ b/sky_phone/source/client/custom_app_compat.lua
@@ -0,0 +1,581 @@
+local RESOURCE_NAME = GetCurrentResourceName()
+local providers = SkyPhoneCompatibility.Providers
+local core = SkyPhoneApps.CompatibilityCore
+local provider_apps = {}
+local high_client_apps = {}
+local high_server_apps = {}
+
+local function get_calling_resource(export_name)
+    local owner_resource = GetInvokingResource()
+    if owner_resource then
+        return owner_resource
+    end
+
+    print(("[%s] %s rejected: the export must be called by another resource."):format(
+        RESOURCE_NAME,
+        export_name
+    ))
+    return nil, "invalid_owner"
+end
+
+local function copy_record_data(value)
+    if type(value) ~= "table" then
+        return nil
+    end
+
+    local copied = {}
+    for key, nested_value in pairs(value) do
+        copied[key] = nested_value
+    end
+    return copied
+end
+
+local function register_provider_app(provider, owner_resource, definition, vendor_data, update_existing)
+    local app_id = definition.id
+    local existing = provider_apps[app_id]
+    if existing and (existing.owner_resource ~= owner_resource or existing.provider ~= provider) then
+        return false, "duplicate_app_id"
+    end
+
+    local success, error_message
+    if existing and update_existing then
+        success, error_message = core.Update(owner_resource, definition)
+    else
+        success, error_message = core.Add(owner_resource, definition)
+    end
+    if success then
+        provider_apps[app_id] = {
+            definition = definition,
+            owner_resource = owner_resource,
+            provider = provider,
+            vendor_data = vendor_data,
+        }
+    end
+    return success, error_message
+end
+
+local function get_provider_app(owner_resource, app_id, allowed_providers)
+    if type(app_id) ~= "string" then
+        return nil, "invalid_app_id"
+    end
+
+    local record = provider_apps[app_id]
+    if not record then
+        return nil, "app_not_found"
+    end
+    if record.owner_resource ~= owner_resource then
+        return nil, "app_owner_mismatch"
+    end
+    if allowed_providers and not allowed_providers[record.provider] then
+        return nil, "app_provider_mismatch"
+    end
+    return record
+end
+
+local function remove_provider_app(owner_resource, app_id, allowed_providers)
+    local record, record_error = get_provider_app(owner_resource, app_id, allowed_providers)
+    if not record then
+        return false, record_error
+    end
+
+    return core.Remove(owner_resource, app_id)
+end
+
+function SkyPhoneApps.RegisterCompatibilityExport(owner_resource, app_data)
+    local provider
+    local definition
+    local definition_error
+    if app_data.identifier ~= nil then
+        provider = providers.lb
+        definition, definition_error = SkyPhoneCompatibility.BuildLbDefinition(owner_resource, app_data)
+    elseif app_data.key ~= nil then
+        provider = providers.yseries
+        definition, definition_error = SkyPhoneCompatibility.BuildYSeriesDefinition(app_data)
+    else
+        return false, "unknown_app_provider"
+    end
+
+    if not definition then
+        print(("[%s] %s registration rejected for %s: %s."):format(
+            RESOURCE_NAME,
+            provider,
+            owner_resource,
+            definition_error
+        ))
+        return false, definition_error
+    end
+    return register_provider_app(provider, owner_resource, definition, copy_record_data(app_data), false)
+end
+
+SkyPhoneApps.OnCompatibilityAppRemoved = function(owner_resource, app_id)
+    local record = provider_apps[app_id]
+    if record and record.owner_resource == owner_resource then
+        provider_apps[app_id] = nil
+    end
+end
+
+local function add_17mov_application(app_data)
+    local owner_resource, owner_error = get_calling_resource("AddApplication")
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local definition, definition_error = SkyPhoneCompatibility.Build17MovDefinition(app_data)
+    if not definition then
+        print(("[%s] 17mov registration rejected for %s: %s."):format(
+            RESOURCE_NAME,
+            owner_resource,
+            definition_error
+        ))
+        return false, definition_error
+    end
+    return register_provider_app(
+        providers.seventeen,
+        owner_resource,
+        definition,
+        copy_record_data(app_data),
+        false
+    )
+end
+
+local function remove_17mov_application(app_name, _resource_name)
+    local owner_resource, owner_error = get_calling_resource("RemoveApplication")
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local app_id = type(app_name) == "table" and app_name.name or app_name
+    return remove_provider_app(owner_resource, app_id, {
+        [providers.seventeen] = true,
+    })
+end
+
+local function send_app_message(app_id, data)
+    local owner_resource, owner_error = get_calling_resource("SendAppMessage")
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local record, record_error = get_provider_app(owner_resource, app_id, {
+        [providers.seventeen] = true,
+        [providers.yseries] = true,
+    })
+    if not record then
+        return false, record_error
+    end
+    return core.SendMessage(owner_resource, app_id, data)
+end
+
+local function add_high_application(app_name, data, locales)
+    local owner_resource, owner_error = get_calling_resource("addApplication")
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local definition, definition_error = SkyPhoneCompatibility.BuildHighDefinition(
+        owner_resource,
+        app_name,
+        data,
+        locales
+    )
+    if not definition then
+        print(("[%s] High Phone registration rejected for %s: %s."):format(
+            RESOURCE_NAME,
+            owner_resource,
+            definition_error
+        ))
+        return false, definition_error
+    end
+
+    high_client_apps[app_name] = {
+        definition = definition,
+        owner_resource = owner_resource,
+    }
+    local server_record = high_server_apps[app_name]
+    if server_record then
+        if server_record.owner_resource ~= owner_resource then
+            return false, "duplicate_app_id"
+        end
+        if server_record.registered then
+            return true
+        end
+        return false, "server_definition_not_registered"
+    end
+
+    return register_provider_app(
+        providers.high,
+        owner_resource,
+        definition,
+        copy_record_data(data),
+        provider_apps[app_name] ~= nil
+    )
+end
+
+local function send_high_app_nui(app_name, data)
+    local owner_resource, owner_error = get_calling_resource("sendAppNui")
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local record, record_error = get_provider_app(owner_resource, app_name, {
+        [providers.high] = true,
+    })
+    if not record then
+        return false, record_error
+    end
+    return core.SendMessage(owner_resource, app_name, data)
+end
+
+local function add_quasar_app_for_owner(owner_resource, app_data)
+    local definition, definition_error = SkyPhoneCompatibility.BuildQuasarDefinition(app_data)
+    if not definition then
+        print(("[%s] Quasar registration rejected for %s: %s."):format(
+            RESOURCE_NAME,
+            owner_resource,
+            definition_error
+        ))
+        return false, definition_error
+    end
+
+    return register_provider_app(
+        providers.quasar,
+        owner_resource,
+        definition,
+        SkyPhoneCompatibility.CopyQuasarData(app_data),
+        false
+    )
+end
+
+local function add_quasar_app(app_data)
+    local owner_resource, owner_error = get_calling_resource("addCustomApp")
+    if not owner_resource then
+        return false, owner_error
+    end
+    if type(app_data) ~= "table" then
+        return false, "invalid_app_data"
+    end
+    return add_quasar_app_for_owner(owner_resource, app_data)
+end
+
+local function add_quasar_apps_batch(apps)
+    local owner_resource, owner_error = get_calling_resource("addCustomAppsBatch")
+    if not owner_resource then
+        return false, owner_error
+    end
+    if type(apps) ~= "table" then
+        return false, "invalid_app_batch"
+    end
+
+    for index = 1, #apps do
+        local success, error_message = add_quasar_app_for_owner(owner_resource, apps[index])
+        if not success then
+            return false, error_message
+        end
+    end
+    return true
+end
+
+local function update_quasar_app(app_id, patch)
+    local owner_resource, owner_error = get_calling_resource("updateCustomApp")
+    if not owner_resource then
+        return false, owner_error
+    end
+    if type(patch) ~= "table" then
+        return false, "invalid_patch"
+    end
+
+    local record, record_error = get_provider_app(owner_resource, app_id, {
+        [providers.quasar] = true,
+    })
+    if not record then
+        return false, record_error
+    end
+
+    local merged = SkyPhoneCompatibility.CopyQuasarData(record.vendor_data)
+    for key, value in pairs(patch) do
+        if key == "iframe" and type(value) == "table" then
+            merged.iframe = merged.iframe or {}
+            for iframe_key, iframe_value in pairs(value) do
+                merged.iframe[iframe_key] = iframe_value
+            end
+        elseif key ~= "id" then
+            merged[key] = value
+        end
+    end
+    merged.id = app_id
+
+    local definition, definition_error = SkyPhoneCompatibility.BuildQuasarDefinition(merged)
+    if not definition then
+        return false, definition_error
+    end
+
+    local success, error_message = core.Update(owner_resource, definition)
+    if success then
+        record.definition = definition
+        record.vendor_data = SkyPhoneCompatibility.CopyQuasarData(merged)
+    end
+    return success, error_message
+end
+
+local function remove_quasar_app(app_id)
+    local owner_resource, owner_error = get_calling_resource("removeCustomApp")
+    if not owner_resource then
+        return false, owner_error
+    end
+    return remove_provider_app(owner_resource, app_id, {
+        [providers.quasar] = true,
+    })
+end
+
+local function get_quasar_apps()
+    local ids = {}
+    for app_id, record in pairs(provider_apps) do
+        if record.provider == providers.quasar then
+            ids[#ids + 1] = app_id
+        end
+    end
+    table.sort(ids)
+
+    local apps = {}
+    for index = 1, #ids do
+        apps[index] = SkyPhoneCompatibility.CopyQuasarData(provider_apps[ids[index]].vendor_data)
+    end
+    return apps
+end
+
+local function open_quasar_app(app_id)
+    local owner_resource, owner_error = get_calling_resource("OpenPhoneApp")
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local record, record_error = get_provider_app(owner_resource, app_id, {
+        [providers.quasar] = true,
+    })
+    if not record then
+        return false, record_error
+    end
+    return core.Open(owner_resource, app_id)
+end
+
+local function open_phone_app(app_id, data)
+    local owner_resource, owner_error = get_calling_resource("OpenApp")
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local record, record_error = get_provider_app(owner_resource, app_id)
+    if not record then
+        return false, record_error
+    end
+    return core.Open(owner_resource, app_id, data)
+end
+
+local function close_phone_app(options)
+    local owner_resource, owner_error = get_calling_resource("CloseApp")
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local app_id = type(options) == "table" and options.app or nil
+    if app_id then
+        local record, record_error = get_provider_app(owner_resource, app_id, {
+            [providers.lb] = true,
+            [providers.yseries] = true,
+        })
+        if not record then
+            return false, record_error
+        end
+        return core.Close(owner_resource, app_id)
+    end
+    return core.CloseActive(owner_resource)
+end
+
+local function register_high_server_app(owner_resource, definition, revision)
+    if type(owner_resource) ~= "string"
+        or type(definition) ~= "table"
+        or type(definition.id) ~= "string"
+        or type(revision) ~= "number"
+        or revision ~= math.floor(revision)
+        or revision < 1
+    then
+        print(("[%s] Rejected invalid High Phone server application snapshot."):format(RESOURCE_NAME))
+        return nil
+    end
+
+    local app_id = definition.id
+    local existing = high_server_apps[app_id]
+    if existing and revision <= existing.revision then
+        if revision < existing.revision or existing.registered then
+            return app_id
+        end
+        if existing.owner_resource ~= owner_resource then
+            print(("[%s] Rejected conflicting High Phone owner for %s."):format(
+                RESOURCE_NAME,
+                app_id
+            ))
+            return app_id
+        end
+    end
+
+    local provider_record = provider_apps[app_id]
+    local success, error_message
+    local retained_registration = false
+    if provider_record then
+        if provider_record.owner_resource ~= owner_resource or provider_record.provider ~= providers.high then
+            success, error_message = false, "duplicate_app_id"
+        else
+            retained_registration = true
+            success, error_message = core.Update(owner_resource, definition)
+        end
+    else
+        success, error_message = core.Add(owner_resource, definition)
+    end
+
+    high_server_apps[app_id] = {
+        definition = definition,
+        last_error = success and nil or error_message,
+        owner_resource = owner_resource,
+        registered = success or retained_registration,
+        revision = revision,
+    }
+    if success then
+        provider_apps[app_id] = {
+            definition = definition,
+            owner_resource = owner_resource,
+            provider = providers.high,
+        }
+    elseif not existing or existing.revision ~= revision or existing.last_error ~= error_message then
+        print(("[%s] Could not register High Phone server application %s revision %s: %s."):format(
+            RESOURCE_NAME,
+            app_id,
+            revision,
+            error_message or "unknown_error"
+        ))
+    end
+    return app_id
+end
+
+local function remove_high_server_app(owner_resource, app_id)
+    local record = high_server_apps[app_id]
+    if not record or record.owner_resource ~= owner_resource then
+        return
+    end
+
+    high_server_apps[app_id] = nil
+    if record.registered then
+        core.Remove(owner_resource, app_id)
+    end
+
+    local client_record = high_client_apps[app_id]
+    if client_record then
+        local success, error_message = register_provider_app(
+            providers.high,
+            client_record.owner_resource,
+            client_record.definition,
+            nil,
+            false
+        )
+        if not success then
+            print(("[%s] Could not restore High Phone client application %s: %s."):format(
+                RESOURCE_NAME,
+                app_id,
+                error_message or "unknown_error"
+            ))
+        end
+    end
+end
+
+RegisterNetEvent("sky_phone:compat:high:client:syncApplication", function(owner_resource, definition, revision)
+    if source ~= 65535 then
+        print(("[%s] Rejected locally invoked High Phone application sync."):format(RESOURCE_NAME))
+        return
+    end
+    register_high_server_app(owner_resource, definition, revision)
+end)
+
+RegisterNetEvent("sky_phone:compat:high:client:removeApplication", function(owner_resource, app_id)
+    if source ~= 65535 then
+        print(("[%s] Rejected locally invoked High Phone application removal."):format(RESOURCE_NAME))
+        return
+    end
+    if type(owner_resource) ~= "string" or type(app_id) ~= "string" then
+        print(("[%s] Rejected invalid High Phone application removal."):format(RESOURCE_NAME))
+        return
+    end
+    remove_high_server_app(owner_resource, app_id)
+end)
+
+RegisterNetEvent("sky_phone:compat:high:client:replaceSnapshot", function(snapshot)
+    if source ~= 65535 then
+        print(("[%s] Rejected locally invoked High Phone application snapshot."):format(RESOURCE_NAME))
+        return
+    end
+    if type(snapshot) ~= "table" then
+        print(("[%s] Rejected invalid High Phone application snapshot."):format(RESOURCE_NAME))
+        return
+    end
+
+    local seen = {}
+    for index = 1, #snapshot do
+        local record = snapshot[index]
+        if type(record) == "table" then
+            local app_id = register_high_server_app(
+                record.owner_resource,
+                record.definition,
+                record.revision
+            )
+            if app_id then
+                seen[app_id] = true
+            end
+        end
+    end
+
+    local removed = {}
+    for app_id, record in pairs(high_server_apps) do
+        if not seen[app_id] then
+            removed[#removed + 1] = {
+                app_id = app_id,
+                owner_resource = record.owner_resource,
+            }
+        end
+    end
+    for index = 1, #removed do
+        remove_high_server_app(removed[index].owner_resource, removed[index].app_id)
+    end
+end)
+
+AddEventHandler("onClientResourceStart", function(resource_name)
+    for _, record in pairs(high_server_apps) do
+        if record.owner_resource == resource_name and not record.registered then
+            register_high_server_app(record.owner_resource, record.definition, record.revision)
+        end
+    end
+end)
+
+AddEventHandler("onClientResourceStop", function(resource_name)
+    for app_id, record in pairs(high_client_apps) do
+        if record.owner_resource == resource_name then
+            high_client_apps[app_id] = nil
+        end
+    end
+end)
+
+CreateThread(function()
+    TriggerServerEvent("sky_phone:compat:high:server:requestSnapshot")
+    TriggerEvent("17mov_Phone:Client:Ready")
+end)
+
+exports("AddApplication", add_17mov_application)
+exports("RemoveApplication", remove_17mov_application)
+exports("SendAppMessage", send_app_message)
+exports("addApplication", add_high_application)
+exports("sendAppNui", send_high_app_nui)
+exports("addCustomApp", add_quasar_app)
+exports("addCustomAppsBatch", add_quasar_apps_batch)
+exports("updateCustomApp", update_quasar_app)
+exports("removeCustomApp", remove_quasar_app)
+exports("getCustomApps", get_quasar_apps)
+exports("OpenPhoneApp", open_quasar_app)
+exports("OpenApp", open_phone_app)
+exports("CloseApp", close_phone_app)
diff --git a/sky_phone/source/client/custom_apps.lua b/sky_phone/source/client/custom_apps.lua
new file mode 100644
index 0000000..1f95350
--- /dev/null
+++ b/sky_phone/source/client/custom_apps.lua
@@ -0,0 +1,1396 @@
+local COMPATIBILITY_MAX_BYTES = 8192
+local JSON_MAX_DEPTH = 12
+local JSON_MAX_VALUES = 4096
+local MAX_QUEUED_MESSAGES = 64
+local NOTIFICATION_TEXT_MAX_LENGTH = 2000
+local NOTIFICATION_TITLE_MAX_LENGTH = 160
+
+local NOTIFICATION_SOUNDS = {
+    chime = true,
+    signal = true,
+    soft = true,
+}
+
+local HOOK_NAMES = {
+    onClose = true,
+    onInstall = true,
+    onOpen = true,
+    onReady = true,
+}
+
+local apps_by_id = {}
+local app_ids_by_adapter = {}
+local app_ids_by_owner = {}
+local current_resource = GetCurrentResourceName()
+local active_app_id = nil
+local active_app_ready = false
+local phone_open = false
+local queued_messages = {}
+local default_icon_url = ("https://cfx-nui-%s/custom_apps/_sdk/default-icon.svg"):format(current_resource)
+
+local function trim(value)
+    return value:match("^%s*(.-)%s*$")
+end
+
+local function validate_owner_resource(owner_resource, allow_stopping)
+    if type(owner_resource) ~= "string"
+        or #owner_resource == 0
+        or #owner_resource > 64
+        or not owner_resource:match("^[%w][%w._-]*$")
+    then
+        return false, "invalid_owner_resource"
+    end
+
+    local state = GetResourceState(owner_resource)
+    if state == "started" or state == "starting" or (allow_stopping and state == "stopping") then
+        return true
+    end
+
+    return false, "owner_resource_not_running"
+end
+
+local function resolve_localized_text(value)
+    if type(value) == "string" then
+        return value
+    end
+
+    local locale = Config.Bridge.Locale:lower():gsub("_", "-")
+    if value[locale] then
+        return value[locale]
+    end
+
+    local base_locale = locale:match("^([a-z]+)-")
+    if base_locale and value[base_locale] then
+        return value[base_locale]
+    end
+    if value.en then
+        return value.en
+    end
+    if value.de then
+        return value.de
+    end
+
+    local locales = {}
+    for available_locale in pairs(value) do
+        locales[#locales + 1] = available_locale
+    end
+    table.sort(locales)
+    return value[locales[1]]
+end
+
+local function is_allowed_remote_origin(url)
+    local origin = url:match("^(https://[^/%?#]+)")
+    if not origin then
+        return false
+    end
+
+    local allowed_origins = Config.CustomApps.AllowRemoteOrigins
+    if allowed_origins[origin] then
+        return true
+    end
+
+    for index = 1, #allowed_origins do
+        if allowed_origins[index] == origin then
+            return true
+        end
+    end
+
+    return false
+end
+
+local function validate_asset_path(path)
+    if #path == 0
+        or #path > 1024
+        or path:find("\\", 1, true)
+        or path:find("[%c]")
+        or path:lower():find("%2e", 1, true)
+    then
+        return false
+    end
+
+    local path_only = path:match("^[^?#]+") or path
+    for segment in path_only:gmatch("[^/]+") do
+        if segment == "." or segment == ".." then
+            return false
+        end
+    end
+
+    return true
+end
+
+local function normalize_asset_url(value, original_owner, adapter_resource, required)
+    if value == nil and not required then
+        return nil
+    end
+    if type(value) ~= "string" then
+        return nil, "invalid_asset_url"
+    end
+
+    local url = trim(value)
+    if not validate_asset_path(url) then
+        return nil, "invalid_asset_url"
+    end
+
+    local allowed_owners = {
+        [original_owner] = true,
+    }
+    if adapter_resource then
+        allowed_owners[adapter_resource] = true
+    end
+
+    local cfx_owner = url:match("^https://cfx%-nui%-([^/]+)/")
+    if cfx_owner then
+        if not allowed_owners[cfx_owner] then
+            return nil, "asset_owner_mismatch"
+        end
+        return url
+    end
+
+    local nui_owner, nui_path = url:match("^nui://([^/]+)/(.+)$")
+    if nui_owner then
+        if not allowed_owners[nui_owner] then
+            return nil, "asset_owner_mismatch"
+        end
+        return ("https://cfx-nui-%s/%s"):format(nui_owner, nui_path)
+    end
+
+    if url:sub(1, 8) == "https://" then
+        if not is_allowed_remote_origin(url) then
+            return nil, "remote_origin_not_allowed"
+        end
+        return url
+    end
+
+    if url:match("^[%a][%w+.-]*:") or url:sub(1, 2) == "//" or url:sub(1, 1) == "/" then
+        return nil, "invalid_asset_url"
+    end
+
+    local asset_owner = original_owner
+    local asset_path = url
+    local original_prefix = original_owner .. "/"
+    if url:sub(1, #original_prefix) == original_prefix then
+        asset_path = url:sub(#original_prefix + 1)
+    elseif adapter_resource then
+        local adapter_prefix = adapter_resource .. "/"
+        if url:sub(1, #adapter_prefix) == adapter_prefix then
+            asset_owner = adapter_resource
+            asset_path = url:sub(#adapter_prefix + 1)
+        end
+    end
+
+    if not validate_asset_path(asset_path) then
+        return nil, "invalid_asset_url"
+    end
+
+    return ("https://cfx-nui-%s/%s"):format(asset_owner, asset_path)
+end
+
+local function validate_json_value(value, depth, seen, counter)
+    local value_type = type(value)
+    if value_type == "nil" or value_type == "boolean" then
+        return true
+    end
+    if value_type == "number" then
+        return value == value and value ~= math.huge and value ~= -math.huge
+    end
+    if value_type == "string" then
+        return #value <= Config.CustomApps.MaximumMessageBytes
+    end
+    if value_type ~= "table" or depth >= JSON_MAX_DEPTH or seen[value] then
+        return false
+    end
+
+    seen[value] = true
+    local key_type = nil
+    local numeric_keys = 0
+    local value_count = 0
+    for key, nested_value in pairs(value) do
+        counter.count = counter.count + 1
+        value_count = value_count + 1
+        if counter.count > JSON_MAX_VALUES then
+            seen[value] = nil
+            return false
+        end
+
+        local current_key_type = type(key)
+        if current_key_type == "number" then
+            if key < 1 or key % 1 ~= 0 then
+                seen[value] = nil
+                return false
+            end
+            numeric_keys = numeric_keys + 1
+        elseif current_key_type ~= "string" or #key > 128 then
+            seen[value] = nil
+            return false
+        end
+
+        if key_type and key_type ~= current_key_type then
+            seen[value] = nil
+            return false
+        end
+        key_type = current_key_type
+
+        if not validate_json_value(nested_value, depth + 1, seen, counter) then
+            seen[value] = nil
+            return false
+        end
+    end
+
+    if key_type == "number" and (numeric_keys ~= value_count or #value ~= value_count) then
+        seen[value] = nil
+        return false
+    end
+
+    seen[value] = nil
+    return true
+end
+
+local function normalize_json_payload(payload, maximum_bytes)
+    if not validate_json_value(payload, 0, {}, { count = 0 }) then
+        return nil, "invalid_payload"
+    end
+
+    local encoded_success, encoded = pcall(json.encode, payload)
+    if not encoded_success or type(encoded) ~= "string" then
+        return nil, "invalid_payload"
+    end
+    if #encoded > maximum_bytes then
+        return nil, "payload_too_large"
+    end
+
+    return json.decode(encoded)
+end
+
+local function validate_optional_text(value, error_code, maximum_length)
+    if value == nil then
+        return nil
+    end
+    if type(value) ~= "string" then
+        return nil, error_code
+    end
+
+    local normalized = trim(value)
+    if #normalized == 0 or #normalized > maximum_length then
+        return nil, error_code
+    end
+
+    return normalized
+end
+
+local function normalize_external_definition(owner_resource, adapter_resource, definition)
+    if type(definition) ~= "table" then
+        return nil, "invalid_definition"
+    end
+    if definition.schemaVersion ~= nil and definition.schemaVersion ~= SkyPhoneApps.ProtocolVersion then
+        return nil, "unsupported_schema_version"
+    end
+    if definition.onDelete ~= nil then
+        return nil, "unsupported_on_delete"
+    end
+
+    local valid_id, id_error = SkyPhoneApps.ValidateAppId(definition.id)
+    if not valid_id then
+        return nil, id_error
+    end
+    if SkyPhoneApps.ReservedAppIds[definition.id] then
+        return nil, "reserved_app_id"
+    end
+
+    local name, name_error = SkyPhoneApps.ValidateLocalizedText(
+        definition.name,
+        "invalid_name",
+        64,
+        true
+    )
+    if not name then
+        return nil, name_error
+    end
+
+    local description, description_error = SkyPhoneApps.ValidateLocalizedText(
+        definition.description,
+        "invalid_description",
+        320,
+        false
+    )
+    if definition.description ~= nil and not description then
+        return nil, description_error
+    end
+
+    local developer, developer_error = validate_optional_text(definition.developer, "invalid_developer", 96)
+    if definition.developer ~= nil and not developer then
+        return nil, developer_error
+    end
+
+    local category = definition.category or "utilities"
+    if not SkyPhoneApps.AllowedCategories[category] then
+        return nil, "invalid_category"
+    end
+
+    local ui, ui_error = normalize_asset_url(definition.ui, owner_resource, adapter_resource, true)
+    if not ui then
+        return nil, ui_error
+    end
+
+    local icon, icon_error = normalize_asset_url(definition.icon, owner_resource, adapter_resource, false)
+    if definition.icon ~= nil and not icon then
+        return nil, icon_error
+    end
+
+    local permissions, permissions_error = SkyPhoneApps.ValidatePermissions(definition.permissions)
+    if not permissions then
+        return nil, permissions_error
+    end
+
+    local orientation = definition.orientation or "portrait"
+    if not SkyPhoneApps.AllowedOrientations[orientation] then
+        return nil, "invalid_orientation"
+    end
+
+    if definition.defaultInstalled ~= nil and type(definition.defaultInstalled) ~= "boolean" then
+        return nil, "invalid_default_installed"
+    end
+    if definition.removable ~= nil and type(definition.removable) ~= "boolean" then
+        return nil, "invalid_removable"
+    end
+
+    local grid_order = definition.gridOrder
+    if grid_order ~= nil
+        and (type(grid_order) ~= "number" or grid_order ~= math.floor(grid_order) or grid_order < 0 or grid_order > 9999)
+    then
+        return nil, "invalid_grid_order"
+    end
+
+    local icon_background = validate_optional_text(definition.iconBackground, "invalid_icon_background", 64)
+    if definition.iconBackground ~= nil and not icon_background then
+        return nil, "invalid_icon_background"
+    end
+    if icon_background and icon_background:find("[\r\n;{}]") then
+        return nil, "invalid_icon_background"
+    end
+
+    local bridge_mode = definition.bridgeMode or "legacy"
+    if bridge_mode ~= "sky" and bridge_mode ~= "legacy" then
+        return nil, "invalid_bridge_mode"
+    end
+
+    local compatibility = nil
+    if definition.compatibility ~= nil then
+        if type(definition.compatibility) ~= "table" or next(definition.compatibility) == nil then
+            return nil, "invalid_compatibility"
+        end
+        compatibility, permissions_error = normalize_json_payload(definition.compatibility, COMPATIBILITY_MAX_BYTES)
+        if not compatibility then
+            return nil, permissions_error
+        end
+    end
+
+    local hooks = {}
+    for hook_name in pairs(HOOK_NAMES) do
+        local hook = definition[hook_name]
+        if hook ~= nil and type(hook) ~= "function" then
+            return nil, "invalid_" .. hook_name
+        end
+        hooks[hook_name] = hook
+    end
+
+    return {
+        adapterResource = adapter_resource,
+        catalog = {
+            bridgeMode = bridge_mode,
+            bundled = false,
+            category = category,
+            compatibility = compatibility,
+            defaultInstalled = definition.defaultInstalled == true,
+            description = description and resolve_localized_text(description) or nil,
+            developer = developer,
+            gridOrder = grid_order,
+            icon = icon or default_icon_url,
+            iconBackground = icon_background,
+            id = definition.id,
+            kind = "external",
+            name = resolve_localized_text(name),
+            orientation = orientation,
+            ownerResource = owner_resource,
+            permissions = permissions,
+            readyTimeoutMs = Config.CustomApps.ReadyTimeoutMs,
+            removable = definition.removable ~= false,
+            ui = ui,
+        },
+        hooks = hooks,
+        ownerResource = owner_resource,
+    }
+end
+
+local function normalize_bundled_manifest(manifest)
+    local resource_base_path = ("custom_apps/%s/"):format(manifest.folder)
+    local base_url = ("https://cfx-nui-%s/%s"):format(current_resource, resource_base_path)
+    if LoadResourceFile(current_resource, resource_base_path .. manifest.entry) == nil then
+        error(("[sky_phone] Bundled custom app '%s' entry file is missing: %s"):format(
+            manifest.id,
+            manifest.entry
+        ))
+    end
+    if manifest.icon and LoadResourceFile(current_resource, resource_base_path .. manifest.icon) == nil then
+        error(("[sky_phone] Bundled custom app '%s' icon file is missing: %s"):format(
+            manifest.id,
+            manifest.icon
+        ))
+    end
+    for index = 1, #manifest.screenshots do
+        if LoadResourceFile(current_resource, resource_base_path .. manifest.screenshots[index]) == nil then
+            error(("[sky_phone] Bundled custom app '%s' screenshot file is missing: %s"):format(
+                manifest.id,
+                manifest.screenshots[index]
+            ))
+        end
+    end
+
+    return {
+        adapterResource = nil,
+        catalog = {
+            bridgeMode = manifest.bridgeMode,
+            bundled = true,
+            category = manifest.category,
+            defaultInstalled = manifest.defaultInstalled,
+            description = resolve_localized_text(manifest.description),
+            developer = manifest.developer,
+            gridOrder = manifest.gridOrder,
+            icon = manifest.icon and (base_url .. manifest.icon) or default_icon_url,
+            iconBackground = manifest.iconBackground,
+            id = manifest.id,
+            kind = "external",
+            name = resolve_localized_text(manifest.name),
+            orientation = manifest.orientation,
+            ownerResource = current_resource,
+            permissions = manifest.permissions,
+            readyTimeoutMs = Config.CustomApps.ReadyTimeoutMs,
+            removable = manifest.removable,
+            ui = base_url .. manifest.entry,
+        },
+        hooks = {},
+        ownerResource = current_resource,
+    }
+end
+
+local function get_catalog()
+    local catalog = {}
+    for _, app in pairs(apps_by_id) do
+        catalog[#catalog + 1] = app.catalog
+    end
+    table.sort(catalog, function(left, right)
+        return left.id < right.id
+    end)
+    return catalog
+end
+
+local function send_catalog()
+    SendNUIMessage({
+        type = "custom-apps:catalog",
+        data = {
+            apps = get_catalog(),
+        },
+    })
+end
+
+local function sync_catalog_if_open()
+    if phone_open then
+        send_catalog()
+    end
+end
+
+local function add_owner_index(index, resource_name, app_id)
+    local app_ids = index[resource_name]
+    if not app_ids then
+        app_ids = {}
+        index[resource_name] = app_ids
+    end
+    app_ids[app_id] = true
+end
+
+local function remove_owner_index(index, resource_name, app_id)
+    local app_ids = index[resource_name]
+    if not app_ids then
+        return
+    end
+
+    app_ids[app_id] = nil
+    if not next(app_ids) then
+        index[resource_name] = nil
+    end
+end
+
+local function register_app(app)
+    local app_id = app.catalog.id
+    local existing = apps_by_id[app_id]
+    if existing then
+        print((
+            "[sky_phone] Rejected duplicate custom app '%s' from '%s'; it is already owned by '%s'."
+        ):format(app_id, app.ownerResource, existing.ownerResource))
+        return false, "duplicate_app_id"
+    end
+
+    apps_by_id[app_id] = app
+    add_owner_index(app_ids_by_owner, app.ownerResource, app_id)
+    if app.adapterResource then
+        add_owner_index(app_ids_by_adapter, app.adapterResource, app_id)
+    end
+    sync_catalog_if_open()
+    return true
+end
+
+local function invoke_hook(app, hook_name, payload)
+    local hook = app.hooks[hook_name]
+    if not hook then
+        return true
+    end
+
+    local success, hook_error = xpcall(function()
+        hook(payload)
+    end, debug.traceback)
+    if success then
+        return true
+    end
+
+    print(("[sky_phone] Custom app '%s' hook '%s' failed: %s"):format(
+        app.catalog.id,
+        hook_name,
+        tostring(hook_error)
+    ))
+    return false
+end
+
+local function clear_active_app(invoke_close_hook)
+    if not active_app_id then
+        return
+    end
+
+    local app = apps_by_id[active_app_id]
+    if app and invoke_close_hook then
+        invoke_hook(app, "onClose")
+    end
+    queued_messages[active_app_id] = nil
+    active_app_id = nil
+    active_app_ready = false
+end
+
+local function remove_registered_app(app_id, invoke_close_hook, synchronize)
+    local app = apps_by_id[app_id]
+    if not app then
+        return false, "app_not_found"
+    end
+
+    if active_app_id == app_id then
+        SendNUIMessage({ type = "custom-app:close", data = { appId = app_id } })
+        clear_active_app(invoke_close_hook)
+    end
+
+    apps_by_id[app_id] = nil
+    remove_owner_index(app_ids_by_owner, app.ownerResource, app_id)
+    if app.adapterResource then
+        remove_owner_index(app_ids_by_adapter, app.adapterResource, app_id)
+    end
+    if SkyPhoneApps.OnCompatibilityAppRemoved then
+        SkyPhoneApps.OnCompatibilityAppRemoved(app.ownerResource, app_id)
+    end
+    if synchronize then
+        sync_catalog_if_open()
+    end
+    return true
+end
+
+local function get_direct_owner()
+    local owner_resource = GetInvokingResource()
+    if not owner_resource then
+        return nil, "missing_invoking_resource"
+    end
+
+    local valid_owner, owner_error = validate_owner_resource(owner_resource, false)
+    if not valid_owner then
+        return nil, owner_error
+    end
+
+    return owner_resource
+end
+
+local function get_trusted_adapter()
+    local adapter_resource = GetInvokingResource()
+    if not adapter_resource or not Config.CustomApps.TrustedAdapters[adapter_resource] then
+        return nil, "untrusted_adapter"
+    end
+
+    local valid_adapter, adapter_error = validate_owner_resource(adapter_resource, false)
+    if not valid_adapter then
+        return nil, adapter_error
+    end
+
+    return adapter_resource
+end
+
+local function verify_owned_app(owner_resource, app_id, adapter_resource)
+    local valid_id, id_error = SkyPhoneApps.ValidateAppId(app_id)
+    if not valid_id then
+        return nil, id_error
+    end
+
+    local app = apps_by_id[app_id]
+    if not app then
+        return nil, "app_not_found"
+    end
+    if app.ownerResource ~= owner_resource then
+        return nil, "app_owner_mismatch"
+    end
+    if adapter_resource and app.adapterResource ~= adapter_resource then
+        return nil, "app_adapter_mismatch"
+    end
+
+    return app
+end
+
+local function add_custom_app(definition)
+    if not Config.CustomApps.Enabled or not Config.CustomApps.ExternalApps then
+        return false, "external_apps_disabled"
+    end
+
+    local owner_resource, owner_error = get_direct_owner()
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local app, definition_error = normalize_external_definition(owner_resource, nil, definition)
+    if not app then
+        return false, definition_error
+    end
+
+    return register_app(app)
+end
+
+local function add_custom_app_from_adapter(owner_resource, definition)
+    if not Config.CustomApps.Enabled or not Config.CustomApps.ExternalApps then
+        return false, "external_apps_disabled"
+    end
+
+    local adapter_resource, adapter_error = get_trusted_adapter()
+    if not adapter_resource then
+        return false, adapter_error
+    end
+    local valid_owner, owner_error = validate_owner_resource(owner_resource, false)
+    if not valid_owner then
+        return false, owner_error
+    end
+
+    local app, definition_error = normalize_external_definition(owner_resource, adapter_resource, definition)
+    if not app then
+        return false, definition_error
+    end
+
+    return register_app(app)
+end
+
+local function add_compatibility_app(owner_resource, definition)
+    if not Config.CustomApps.Enabled or not Config.CustomApps.ExternalApps then
+        return false, "external_apps_disabled"
+    end
+
+    local valid_owner, owner_error = validate_owner_resource(owner_resource, false)
+    if not valid_owner then
+        return false, owner_error
+    end
+
+    local app, definition_error = normalize_external_definition(owner_resource, nil, definition)
+    if not app then
+        return false, definition_error
+    end
+
+    return register_app(app)
+end
+
+local function replace_registered_app(app, adapter_resource)
+    local app_id = app.catalog.id
+    local existing = apps_by_id[app_id]
+    if not existing then
+        return false, "app_not_found"
+    end
+    if existing.catalog.bundled then
+        return false, "bundled_app"
+    end
+    if existing.ownerResource ~= app.ownerResource then
+        return false, "app_owner_mismatch"
+    end
+    if existing.adapterResource ~= adapter_resource then
+        return false, "app_adapter_mismatch"
+    end
+
+    apps_by_id[app_id] = app
+    sync_catalog_if_open()
+    return true
+end
+
+local function update_custom_app(definition)
+    if not Config.CustomApps.Enabled or not Config.CustomApps.ExternalApps then
+        return false, "external_apps_disabled"
+    end
+
+    local owner_resource, owner_error = get_direct_owner()
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local app, definition_error = normalize_external_definition(owner_resource, nil, definition)
+    if not app then
+        return false, definition_error
+    end
+    return replace_registered_app(app, nil)
+end
+
+local function update_custom_app_from_adapter(owner_resource, definition)
+    if not Config.CustomApps.Enabled or not Config.CustomApps.ExternalApps then
+        return false, "external_apps_disabled"
+    end
+
+    local adapter_resource, adapter_error = get_trusted_adapter()
+    if not adapter_resource then
+        return false, adapter_error
+    end
+    local valid_owner, owner_error = validate_owner_resource(owner_resource, false)
+    if not valid_owner then
+        return false, owner_error
+    end
+
+    local app, definition_error = normalize_external_definition(owner_resource, adapter_resource, definition)
+    if not app then
+        return false, definition_error
+    end
+    return replace_registered_app(app, adapter_resource)
+end
+
+local function update_compatibility_app(owner_resource, definition)
+    if not Config.CustomApps.Enabled or not Config.CustomApps.ExternalApps then
+        return false, "external_apps_disabled"
+    end
+
+    local valid_owner, owner_error = validate_owner_resource(owner_resource, false)
+    if not valid_owner then
+        return false, owner_error
+    end
+
+    local app, definition_error = normalize_external_definition(owner_resource, nil, definition)
+    if not app then
+        return false, definition_error
+    end
+    return replace_registered_app(app, nil)
+end
+
+local function remove_custom_app(app_id)
+    local owner_resource, owner_error = get_direct_owner()
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local app, app_error = verify_owned_app(owner_resource, app_id)
+    if not app then
+        return false, app_error
+    end
+    if app.catalog.bundled then
+        return false, "bundled_app"
+    end
+
+    return remove_registered_app(app_id, true, true)
+end
+
+local function remove_custom_app_from_adapter(owner_resource, app_id)
+    local adapter_resource, adapter_error = get_trusted_adapter()
+    if not adapter_resource then
+        return false, adapter_error
+    end
+
+    local app, app_error = verify_owned_app(owner_resource, app_id, adapter_resource)
+    if not app then
+        return false, app_error
+    end
+
+    return remove_registered_app(app_id, true, true)
+end
+
+local function remove_compatibility_app(owner_resource, app_id)
+    local valid_owner, owner_error = validate_owner_resource(owner_resource, false)
+    if not valid_owner then
+        return false, owner_error
+    end
+
+    local app, app_error = verify_owned_app(owner_resource, app_id)
+    if not app then
+        return false, app_error
+    end
+    if app.catalog.bundled then
+        return false, "bundled_app"
+    end
+
+    return remove_registered_app(app_id, true, true)
+end
+
+local function deliver_custom_app_message(app_id, payload)
+    SendNUIMessage({
+        type = "custom-app:message",
+        data = {
+            appId = app_id,
+            payload = payload,
+        },
+    })
+end
+
+local function send_owned_custom_app_message(owner_resource, app_id, payload, adapter_resource)
+    local app, app_error = verify_owned_app(owner_resource, app_id, adapter_resource)
+    if not app then
+        return false, app_error
+    end
+    if not phone_open or active_app_id ~= app_id then
+        return false, "app_not_active"
+    end
+
+    local normalized_payload, payload_error = normalize_json_payload(
+        payload,
+        Config.CustomApps.MaximumMessageBytes
+    )
+    if payload_error then
+        return false, payload_error
+    end
+
+    if active_app_ready then
+        deliver_custom_app_message(app_id, normalized_payload)
+        return true
+    end
+
+    local pending = queued_messages[app_id] or {}
+    if #pending >= MAX_QUEUED_MESSAGES then
+        return false, "message_queue_full"
+    end
+    pending[#pending + 1] = { payload = normalized_payload }
+    queued_messages[app_id] = pending
+    return true
+end
+
+local function send_custom_app_message(app_id, payload)
+    local owner_resource, owner_error = get_direct_owner()
+    if not owner_resource then
+        return false, owner_error
+    end
+    return send_owned_custom_app_message(owner_resource, app_id, payload)
+end
+
+local function send_custom_app_message_from_adapter(owner_resource, app_id, payload)
+    local adapter_resource, adapter_error = get_trusted_adapter()
+    if not adapter_resource then
+        return false, adapter_error
+    end
+    return send_owned_custom_app_message(owner_resource, app_id, payload, adapter_resource)
+end
+
+local function send_compatibility_app_message(owner_resource, app_id, payload)
+    local valid_owner, owner_error = validate_owner_resource(owner_resource, false)
+    if not valid_owner then
+        return false, owner_error
+    end
+    return send_owned_custom_app_message(owner_resource, app_id, payload)
+end
+
+local function open_owned_custom_app(owner_resource, app_id, payload, adapter_resource)
+    local app, app_error = verify_owned_app(owner_resource, app_id, adapter_resource)
+    if not app then
+        return false, app_error
+    end
+    if not phone_open then
+        return false, "phone_closed"
+    end
+
+    local normalized_payload, payload_error = normalize_json_payload(
+        payload,
+        Config.CustomApps.MaximumMessageBytes
+    )
+    if payload_error then
+        return false, payload_error
+    end
+
+    SendNUIMessage({
+        type = "custom-app:open",
+        data = {
+            appId = app_id,
+            data = normalized_payload,
+        },
+    })
+    return true
+end
+
+local function open_custom_app(app_id, payload)
+    local owner_resource, owner_error = get_direct_owner()
+    if not owner_resource then
+        return false, owner_error
+    end
+    return open_owned_custom_app(owner_resource, app_id, payload)
+end
+
+local function open_custom_app_from_adapter(owner_resource, app_id, payload)
+    local adapter_resource, adapter_error = get_trusted_adapter()
+    if not adapter_resource then
+        return false, adapter_error
+    end
+    return open_owned_custom_app(owner_resource, app_id, payload, adapter_resource)
+end
+
+local function open_compatibility_app(owner_resource, app_id, payload)
+    local valid_owner, owner_error = validate_owner_resource(owner_resource, false)
+    if not valid_owner then
+        return false, owner_error
+    end
+    return open_owned_custom_app(owner_resource, app_id, payload)
+end
+
+local function close_owned_custom_app(owner_resource, app_id, adapter_resource)
+    local app, app_error = verify_owned_app(owner_resource, app_id, adapter_resource)
+    if not app then
+        return false, app_error
+    end
+    if active_app_id ~= app_id then
+        return false, "app_not_active"
+    end
+
+    SendNUIMessage({ type = "custom-app:close", data = { appId = app_id } })
+    return true
+end
+
+local function close_custom_app(app_id)
+    local owner_resource, owner_error = get_direct_owner()
+    if not owner_resource then
+        return false, owner_error
+    end
+    return close_owned_custom_app(owner_resource, app_id)
+end
+
+local function close_custom_app_from_adapter(owner_resource, app_id)
+    local adapter_resource, adapter_error = get_trusted_adapter()
+    if not adapter_resource then
+        return false, adapter_error
+    end
+    return close_owned_custom_app(owner_resource, app_id, adapter_resource)
+end
+
+local function close_active_custom_app_from_adapter(owner_resource)
+    local adapter_resource, adapter_error = get_trusted_adapter()
+    if not adapter_resource then
+        return false, adapter_error
+    end
+    if not active_app_id then
+        return false, "app_not_active"
+    end
+
+    local app, app_error = verify_owned_app(owner_resource, active_app_id, adapter_resource)
+    if not app then
+        return false, app_error
+    end
+
+    SendNUIMessage({ type = "custom-app:close", data = { appId = active_app_id } })
+    return true
+end
+
+local function close_compatibility_app(owner_resource, app_id)
+    local valid_owner, owner_error = validate_owner_resource(owner_resource, false)
+    if not valid_owner then
+        return false, owner_error
+    end
+    return close_owned_custom_app(owner_resource, app_id)
+end
+
+local function close_active_compatibility_app(owner_resource)
+    local valid_owner, owner_error = validate_owner_resource(owner_resource, false)
+    if not valid_owner then
+        return false, owner_error
+    end
+    if not active_app_id then
+        return false, "app_not_active"
+    end
+
+    local app, app_error = verify_owned_app(owner_resource, active_app_id)
+    if not app then
+        return false, app_error
+    end
+
+    SendNUIMessage({ type = "custom-app:close", data = { appId = active_app_id } })
+    return true
+end
+
+local function has_permission(app, permission)
+    local permissions = app.catalog.permissions
+    for index = 1, #permissions do
+        if permissions[index] == permission then
+            return true
+        end
+    end
+    return false
+end
+
+local function normalize_notification(app, notification)
+    if type(notification) ~= "table" then
+        return nil, "invalid_notification"
+    end
+    if not has_permission(app, "notifications") then
+        return nil, "permission_denied"
+    end
+
+    local title = notification.title
+    if title == nil then
+        title = app.catalog.name
+    end
+    title = validate_optional_text(title, "invalid_notification_title", NOTIFICATION_TITLE_MAX_LENGTH)
+    if not title then
+        return nil, "invalid_notification_title"
+    end
+
+    local text = validate_optional_text(
+        notification.text or notification.content,
+        "invalid_notification_text",
+        NOTIFICATION_TEXT_MAX_LENGTH
+    )
+    if not text then
+        return nil, "invalid_notification_text"
+    end
+
+    local subtitle = validate_optional_text(notification.subtitle, "invalid_notification_subtitle", 160)
+    if notification.subtitle ~= nil and not subtitle then
+        return nil, "invalid_notification_subtitle"
+    end
+
+    if notification.critical ~= nil and type(notification.critical) ~= "boolean" then
+        return nil, "invalid_notification_critical"
+    end
+    if notification.critical and not has_permission(app, "notifications.critical") then
+        return nil, "permission_denied"
+    end
+    if notification.persistent ~= nil and type(notification.persistent) ~= "boolean" then
+        return nil, "invalid_notification_persistent"
+    end
+    if notification.sound ~= nil and not NOTIFICATION_SOUNDS[notification.sound] then
+        return nil, "invalid_notification_sound"
+    end
+
+    local app_route = "/apps/" .. app.catalog.id
+    local route = notification.route or app_route
+    if type(route) ~= "string"
+        or route ~= app_route
+        or route:find("[\r\n]")
+        or #route > 512
+    then
+        return nil, "invalid_notification_route"
+    end
+
+    return {
+        appId = app.catalog.id,
+        critical = notification.critical == true,
+        persistent = notification.persistent == true,
+        route = route,
+        sound = notification.sound,
+        subtitle = subtitle,
+        text = text,
+        title = title,
+    }
+end
+
+local function send_owned_custom_app_notification(owner_resource, app_id, notification, adapter_resource)
+    local app, app_error = verify_owned_app(owner_resource, app_id, adapter_resource)
+    if not app then
+        return false, app_error
+    end
+
+    local normalized_notification, notification_error = normalize_notification(app, notification)
+    if not normalized_notification then
+        return false, notification_error
+    end
+
+    send_catalog()
+    SendNUIMessage({ type = "notification:show", data = normalized_notification })
+    return true
+end
+
+local function send_custom_app_notification(app_id, notification)
+    local owner_resource, owner_error = get_direct_owner()
+    if not owner_resource then
+        return false, owner_error
+    end
+    return send_owned_custom_app_notification(owner_resource, app_id, notification)
+end
+
+local function send_custom_app_notification_from_adapter(owner_resource, app_id, notification)
+    local adapter_resource, adapter_error = get_trusted_adapter()
+    if not adapter_resource then
+        return false, adapter_error
+    end
+    return send_owned_custom_app_notification(owner_resource, app_id, notification, adapter_resource)
+end
+
+local function get_custom_app_capabilities()
+    return {
+        abiVersion = 1,
+        enabled = Config.CustomApps.Enabled,
+        bridgeMethods = {
+            "app.close",
+            "app.open",
+            "device.storage.get",
+            "device.storage.set",
+            "notification.create",
+        },
+        contextCapabilities = {
+            "locale.read",
+            "theme.read",
+        },
+        exports = {
+            "AddCustomApp",
+            "AddCustomAppFromAdapter",
+            "CloseActiveCustomAppFromAdapter",
+            "CloseCustomApp",
+            "CloseCustomAppFromAdapter",
+            "OpenCustomApp",
+            "OpenCustomAppFromAdapter",
+            "RemoveCustomApp",
+            "RemoveCustomAppFromAdapter",
+            "SendCustomAppMessage",
+            "SendCustomAppMessageFromAdapter",
+            "SendCustomAppNotification",
+            "SendCustomAppNotificationFromAdapter",
+            "UpdateCustomApp",
+            "UpdateCustomAppFromAdapter",
+        },
+        maximumMessageBytes = Config.CustomApps.MaximumMessageBytes,
+        maximumStorageBytesPerApp = Config.CustomApps.MaximumStorageBytesPerApp,
+        maximumStorageKeyLength = math.min(Config.CustomApps.MaximumStorageKeyLength, 64),
+        maximumStorageValueBytes = math.min(Config.CustomApps.MaximumStorageValueBytes, 65536),
+        protocolVersion = SkyPhoneApps.ProtocolVersion,
+    }
+end
+
+local function set_phone_open(is_open)
+    phone_open = is_open
+    if phone_open then
+        send_catalog()
+        return
+    end
+
+    clear_active_app(true)
+end
+
+local function register_bundled_client_hooks(app_id, hooks)
+    local valid_id, id_error = SkyPhoneApps.ValidateAppId(app_id)
+    if not valid_id then
+        return false, id_error
+    end
+
+    local app = apps_by_id[app_id]
+    if not app then
+        return false, "app_not_found"
+    end
+    if not app.catalog.bundled then
+        return false, "external_app"
+    end
+    if type(hooks) ~= "table" then
+        return false, "invalid_hooks"
+    end
+
+    local normalized_hooks = {}
+    for hook_name, hook in pairs(hooks) do
+        if not HOOK_NAMES[hook_name] or type(hook) ~= "function" then
+            return false, "invalid_hook"
+        end
+        normalized_hooks[hook_name] = hook
+    end
+
+    app.hooks = normalized_hooks
+    return true
+end
+
+SkyPhoneApps.SendCatalog = send_catalog
+SkyPhoneApps.SetPhoneOpen = set_phone_open
+SkyPhoneApps.RegisterClientHooks = register_bundled_client_hooks
+
+if Config.CustomApps.Enabled and Config.CustomApps.BundledApps then
+    local bundled = SkyPhoneApps.GetBundledManifests()
+    for index = 1, #bundled do
+        local registered, register_error = register_app(normalize_bundled_manifest(bundled[index]))
+        if not registered then
+            error(("[sky_phone] Could not register bundled custom app '%s': %s"):format(
+                bundled[index].id,
+                register_error
+            ))
+        end
+    end
+end
+
+local function add_custom_app_export(definition)
+    if type(definition) ~= "table" then
+        return add_custom_app(definition)
+    end
+
+    local provider_markers = 0
+    if definition.id ~= nil then
+        provider_markers = provider_markers + 1
+    end
+    if definition.identifier ~= nil then
+        provider_markers = provider_markers + 1
+    end
+    if definition.key ~= nil then
+        provider_markers = provider_markers + 1
+    end
+    if provider_markers > 1 then
+        return false, "ambiguous_app_provider"
+    end
+    if definition.identifier == nil and definition.key == nil then
+        return add_custom_app(definition)
+    end
+
+    local owner_resource, owner_error = get_direct_owner()
+    if not owner_resource then
+        return false, owner_error
+    end
+    if not SkyPhoneApps.RegisterCompatibilityExport then
+        return false, "compatibility_not_ready"
+    end
+    return SkyPhoneApps.RegisterCompatibilityExport(owner_resource, definition)
+end
+
+SkyPhoneApps.CompatibilityCore = {
+    Add = add_compatibility_app,
+    Close = close_compatibility_app,
+    CloseActive = close_active_compatibility_app,
+    Open = open_compatibility_app,
+    Remove = remove_compatibility_app,
+    SendMessage = send_compatibility_app_message,
+    Update = update_compatibility_app,
+}
+
+exports("AddCustomApp", add_custom_app_export)
+exports("AddCustomAppFromAdapter", add_custom_app_from_adapter)
+exports("CloseActiveCustomAppFromAdapter", close_active_custom_app_from_adapter)
+exports("CloseCustomApp", close_custom_app)
+exports("CloseCustomAppFromAdapter", close_custom_app_from_adapter)
+exports("GetCustomAppCapabilities", get_custom_app_capabilities)
+exports("OpenCustomApp", open_custom_app)
+exports("OpenCustomAppFromAdapter", open_custom_app_from_adapter)
+exports("RemoveCustomApp", remove_custom_app)
+exports("RemoveCustomAppFromAdapter", remove_custom_app_from_adapter)
+exports("SendCustomAppMessage", send_custom_app_message)
+exports("SendCustomAppMessageFromAdapter", send_custom_app_message_from_adapter)
+exports("SendCustomAppNotification", send_custom_app_notification)
+exports("SendCustomAppNotificationFromAdapter", send_custom_app_notification_from_adapter)
+exports("UpdateCustomApp", update_custom_app)
+exports("UpdateCustomAppFromAdapter", update_custom_app_from_adapter)
+
+RegisterNUICallback("custom-app:lifecycle", function(data, cb)
+    if type(data) ~= "table" then
+        cb({ success = false, error = "invalid_lifecycle_request" })
+        return
+    end
+
+    local valid_id, id_error = SkyPhoneApps.ValidateAppId(data.appId)
+    if not valid_id then
+        cb({ success = false, error = id_error })
+        return
+    end
+
+    local lifecycle_event = data.event
+    if lifecycle_event ~= "install"
+        and lifecycle_event ~= "open"
+        and lifecycle_event ~= "ready"
+        and lifecycle_event ~= "close"
+    then
+        cb({ success = false, error = "invalid_lifecycle_event" })
+        return
+    end
+
+    local app = apps_by_id[data.appId]
+    if lifecycle_event == "close"
+        and (not phone_open or not app or active_app_id ~= data.appId)
+    then
+        cb({ success = true })
+        return
+    end
+    if not phone_open then
+        cb({ success = false, error = "phone_closed" })
+        return
+    end
+    if not app then
+        cb({ success = false, error = "app_not_found" })
+        return
+    end
+
+    local lifecycle_payload, payload_error = normalize_json_payload(
+        data.data,
+        Config.CustomApps.MaximumMessageBytes
+    )
+    if payload_error then
+        cb({ success = false, error = payload_error })
+        return
+    end
+
+    local hook_success = true
+    if lifecycle_event == "install" then
+        hook_success = invoke_hook(app, "onInstall", lifecycle_payload)
+    elseif lifecycle_event == "open" then
+        if active_app_id and active_app_id ~= data.appId then
+            clear_active_app(true)
+        end
+        active_app_id = data.appId
+        active_app_ready = false
+        queued_messages[data.appId] = {}
+        hook_success = invoke_hook(app, "onOpen", lifecycle_payload)
+    elseif active_app_id ~= data.appId then
+        cb({ success = false, error = "app_not_active" })
+        return
+    elseif lifecycle_event == "ready" then
+        if active_app_ready then
+            cb({ success = true })
+            return
+        end
+        active_app_ready = true
+        local pending = queued_messages[data.appId] or {}
+        queued_messages[data.appId] = {}
+        for index = 1, #pending do
+            deliver_custom_app_message(data.appId, pending[index].payload)
+        end
+        hook_success = invoke_hook(app, "onReady", lifecycle_payload)
+    else
+        hook_success = invoke_hook(app, "onClose", lifecycle_payload)
+        clear_active_app(false)
+    end
+
+    local hook_error = nil
+    if not hook_success then
+        hook_error = "hook_failed"
+    end
+    cb({ success = hook_success, error = hook_error })
+end)
+
+AddEventHandler("onClientResourceStop", function(resource_name)
+    if resource_name == current_resource then
+        return
+    end
+
+    local app_ids = {}
+    local owner_apps = app_ids_by_owner[resource_name]
+    if owner_apps then
+        for app_id in pairs(owner_apps) do
+            app_ids[app_id] = true
+        end
+    end
+
+    local adapter_apps = app_ids_by_adapter[resource_name]
+    if adapter_apps then
+        for app_id in pairs(adapter_apps) do
+            app_ids[app_id] = true
+        end
+    end
+
+    local removed = false
+    for app_id in pairs(app_ids) do
+        local success = remove_registered_app(app_id, false, false)
+        removed = success or removed
+    end
+    if removed then
+        sync_catalog_if_open()
+    end
+end)
diff --git a/sky_phone/source/client/main.lua b/sky_phone/source/client/main.lua
index 7162d64..e4e4e53 100644
--- a/sky_phone/source/client/main.lua
+++ b/sky_phone/source/client/main.lua
@@ -13,7 +13,10 @@ local server_callbacks = {
     "security:change-passcode",
     "security:disable-passcode",
     "device:save",
+    "device:notification-open",
     "notifications:save",
+    "custom-app:storage:get",
+    "custom-app:storage:set",
     "device:factory-reset",
     "account:login",
     "account:register",
@@ -166,6 +169,26 @@ local server_callbacks = {
     "crewlink:create-ping",
     "crewlink:remove-ping",
     "crewlink:live",
+    "companies:list",
+    "companies:get",
+    "companies:my-requests",
+    "companies:get-request",
+    "companies:work-context",
+    "companies:work-queue",
+    "companies:list-members",
+    "companies:create-request",
+    "companies:cancel-request",
+    "companies:send-message",
+    "companies:claim-request",
+    "companies:assign-request",
+    "companies:update-request-status",
+    "companies:update-availability",
+    "companies:update-profile",
+    "companies:update-hours",
+    "companies:update-services",
+    "companies:publish-announcement",
+    "companies:set-call-availability",
+    "companies:call-customer",
     "sim:insert",
     "sim:eject",
     "contacts:list",
@@ -228,6 +251,7 @@ local function send_open_message()
     local payload = device_payload
     payload.lang = Config.Bridge.Locale
     payload.locales = get_locale().Nui
+    SkyPhoneApps.SendCatalog()
     SendNUIMessage({
         type = "app:open",
         data = payload,
@@ -250,6 +274,7 @@ local function close_phone()
     end
 
     is_open = false
+    SkyPhoneApps.SetPhoneOpen(false)
     TriggerEvent("sky_phone:nuiClosed")
     SetNuiFocus(notification_focus or sim_picker_open, notification_focus or sim_picker_open)
     SendNUIMessage({ type = "app:close" })
@@ -293,6 +318,7 @@ end
 RegisterNUICallback("ui:ready", function(_, cb)
     Bridge.Debug("debug", "[sky_phone] NUI reported ready.", { always = true })
     TriggerEvent("sky_phone:client:nuiReady")
+    SkyPhoneApps.SendCatalog()
     if open_requested and device_payload then
         send_open_message()
     end
@@ -312,6 +338,7 @@ RegisterNUICallback("ui:opened", function(_, cb)
     end
 
     is_open = true
+    SkyPhoneApps.SetPhoneOpen(true)
     notification_focus = false
     SetNuiFocus(true, true)
     TriggerEvent("sky_phone:animation:phone", true)
@@ -517,6 +544,18 @@ RegisterNetEvent("sky_phone:marketplace:changed", function(data)
     SendNUIMessage({ type = "marketplace:changed", data = data })
 end)
 
+RegisterNetEvent("sky_phone:companies:changed", function(data)
+    SendNUIMessage({ type = "companies:changed", data = data })
+end)
+
+RegisterNetEvent("sky_phone:companies:notification", function(data)
+    local companies_locale = get_locale().Nui.Apps.companies
+    data.title = companies_locale.name
+    data.text = companies_locale.notifications[data.kind]
+        or companies_locale.notifications.requestUpdated
+    SendNUIMessage({ type = "companies:notification", data = data })
+end)
+
 RegisterNetEvent("sky_phone:fliptok:command-feedback", function(data)
     Bridge.Framework.Notify("FlipTok", data.message, data.notificationType, 5000)
 end)
diff --git a/sky_phone/source/server/calls.lua b/sky_phone/source/server/calls.lua
index e1f7f5b..5ca23c2 100644
--- a/sky_phone/source/server/calls.lua
+++ b/sky_phone/source/server/calls.lua
@@ -8,6 +8,7 @@ local active_by_sim = {}
 local dial_locks = {}
 local dialing_by_sim = {}
 local next_voice_channel = 10000
+local reroute_company_call
 
 local function uuid()
     local rows = Bridge.Database.Query("SELECT UUID() AS `id`", {})
@@ -240,11 +241,17 @@ local function finish_call(call, status)
                 params = { status, duration, call.id },
             },
             {
-                query = "UPDATE `sky_phone_call_entries` SET `status` = ? WHERE `call_id` = ? AND `direction` = 'outgoing'",
+                query = [[
+                    UPDATE `sky_phone_call_entries` SET `status` = ?
+                    WHERE `call_id` = ? AND `direction` = 'outgoing' AND `status` IN ('ringing', 'connected')
+                ]],
                 params = { status, call.id },
             },
             {
-                query = "UPDATE `sky_phone_call_entries` SET `status` = ? WHERE `call_id` = ? AND `direction` = 'incoming'",
+                query = [[
+                    UPDATE `sky_phone_call_entries` SET `status` = ?
+                    WHERE `call_id` = ? AND `direction` = 'incoming' AND `status` IN ('ringing', 'connected')
+                ]],
                 params = { callee_status, call.id },
             },
         })
@@ -281,9 +288,17 @@ end
 
 function SkyPhoneCalls.EndForSim(sim_id, reason)
     local call_id = active_by_sim[sim_id]
-    if call_id then
-        finish_call(calls[call_id], reason or "ended")
+    local call = call_id and calls[call_id] or nil
+    if not call then
+        return
     end
+    if call.callee_sim_id == sim_id and call.company_service_call and not call.answered_at then
+        if not reroute_company_call(call, "missed") then
+            finish_call(call, "unavailable")
+        end
+        return
+    end
+    finish_call(call, reason or "ended")
 end
 
 function SkyPhoneCalls.LinkAccountData(account_id, imei)
@@ -346,7 +361,27 @@ Bridge.Callbacks.Register("sky_phone:contacts:list", function(source)
         SELECT `contact_id` AS `id`, `name`, `phone_number`, `created_at`, `updated_at`
         FROM `sky_phone_contacts` WHERE %s ORDER BY LOWER(`name`), `phone_number`
     ]]):format(condition), params)
-    return { success = true, data = rows }
+    local system_contacts = SkyPhoneCompanies.GetSystemContacts()
+    local system_ids = {}
+    local contacts = {}
+    for _, contact in ipairs(system_contacts) do
+        system_ids[contact.id] = true
+        contacts[#contacts + 1] = contact
+    end
+    for _, contact in ipairs(rows) do
+        if not system_ids[contact.id] and not SkyPhoneCompanies.IsSystemContactNumber(contact.phone_number) then
+            contacts[#contacts + 1] = contact
+        end
+    end
+    table.sort(contacts, function(left, right)
+        local left_name = tostring(left.name):lower()
+        local right_name = tostring(right.name):lower()
+        if left_name == right_name then
+            return tostring(left.phone_number) < tostring(right.phone_number)
+        end
+        return left_name < right_name
+    end)
+    return { success = true, data = contacts }
 end)
 
 Bridge.Callbacks.Register("sky_phone:contacts:save", function(source, data)
@@ -362,6 +397,16 @@ Bridge.Callbacks.Register("sky_phone:contacts:save", function(source, data)
     if not name or name == "" or #name > Config.Calls.ContactNameMaxLength or not number then
         return { success = false, error = "invalid_contact" }
     end
+    if (type(data.id) == "string" and data.id:sub(1, 8) == "company:")
+        or SkyPhoneCompanies.IsSystemContactNumber(number)
+    then
+        Bridge.Debug(
+            "warn",
+            "[sky_phone] Source %s attempted to modify a read-only company contact.",
+            tostring(source)
+        )
+        return { success = false, error = "readonly_contact" }
+    end
     local condition, condition_params = scope_condition(scope)
     local id = type(data.id) == "string" and data.id or uuid()
     if data.id then
@@ -401,6 +446,14 @@ Bridge.Callbacks.Register("sky_phone:contacts:delete", function(source, data)
     if not scope then
         return error_response
     end
+    if data.id:sub(1, 8) == "company:" then
+        Bridge.Debug(
+            "warn",
+            "[sky_phone] Source %s attempted to delete a read-only company contact.",
+            tostring(source)
+        )
+        return { success = false, error = "readonly_contact" }
+    end
     local condition, values = scope_condition(scope)
     local params = { data.id }
     for _, value in ipairs(values) do
@@ -430,13 +483,20 @@ Bridge.Callbacks.Register("sky_phone:calls:recents", function(source)
     return { success = true, data = rows }
 end)
 
-local function create_terminal_call(scope, number, target_sim, status)
+local function create_terminal_call(scope, number, target_sim, status, caller_number)
     local id = uuid()
     Bridge.Database.Query([[
         INSERT INTO `sky_phone_calls`
             (`id`, `caller_sim_id`, `callee_sim_id`, `caller_number`, `callee_number`, `status`, `ended_at`)
         VALUES (?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
-    ]], { id, scope.device.sim_id, target_sim and target_sim.id or nil, scope.device.phone_number, number, status })
+    ]], {
+        id,
+        scope.device.sim_id,
+        target_sim and target_sim.id or nil,
+        caller_number or scope.device.phone_number,
+        number,
+        status,
+    })
     add_call_entry(id, scope.device, "outgoing", status, number)
     notify_recents(scope.device, nil)
     return {
@@ -448,6 +508,329 @@ local function create_terminal_call(scope, number, target_sim, status)
     }
 end
 
+local function company_call_target(company_id, caller_source, caller_sim_id, excluded_sim_ids)
+    local has_busy_target = false
+    for _, candidate in ipairs(SkyPhoneCompanies.GetCallTargets(company_id)) do
+        local candidate_source = tonumber(candidate.source)
+        local candidate_sim_id = candidate.simId
+        local candidate_imei = candidate.imei
+        if candidate_source and type(candidate_sim_id) == "string" and type(candidate_imei) == "string"
+            and candidate_source ~= caller_source and candidate_sim_id ~= caller_sim_id
+            and (not excluded_sim_ids or not excluded_sim_ids[candidate_sim_id])
+        then
+            if active_by_source[candidate_source] or active_by_sim[candidate_sim_id]
+                or dialing_by_sim[candidate_sim_id]
+            then
+                has_busy_target = true
+            else
+                dialing_by_sim[candidate_sim_id] = true
+                local device = SkyPhone.LoadDevice(candidate_imei)
+                local holder = device and find_device_holder(candidate_imei) or nil
+                if not device or device.sim_id ~= candidate_sim_id or holder ~= candidate_source then
+                    dialing_by_sim[candidate_sim_id] = nil
+                elseif SkyPhoneCompanies.IsServiceNumber(device.phone_number) then
+                    dialing_by_sim[candidate_sim_id] = nil
+                    Bridge.Debug(
+                        "error",
+                        "[sky_phone] Company call target %s uses reserved service number %s.",
+                        tostring(candidate_source),
+                        tostring(device.phone_number)
+                    )
+                elseif airplane_mode(candidate_imei) then
+                    dialing_by_sim[candidate_sim_id] = nil
+                else
+                    return {
+                        device = device,
+                        sim_id = candidate_sim_id,
+                        source = candidate_source,
+                    }
+                end
+            end
+        end
+    end
+    return nil, has_busy_target and "busy" or "unavailable"
+end
+
+local handle_no_answer
+
+local function ring_callee(call)
+    SkyPhone.OpenDeviceForCall(call.callee_source, call.callee_device.imei)
+    TriggerClientEvent("sky_phone:call:incoming", call.callee_source, {
+        id = call.id,
+        state = "ringing",
+        direction = "incoming",
+        otherNumber = call.caller_number,
+        startedAt = call.started_at,
+        device = {
+            imei = call.callee_device.imei,
+            name = call.callee_device.device_name,
+        },
+    })
+end
+
+local function schedule_no_answer(call)
+    call.ring_attempt = (call.ring_attempt or 0) + 1
+    local ring_attempt = call.ring_attempt
+    SetTimeout(call.ring_seconds * 1000, function()
+        local active_call = calls[call.id]
+        if active_call and not active_call.answered_at and active_call.ring_attempt == ring_attempt then
+            handle_no_answer(active_call)
+        end
+    end)
+end
+
+local function start_ringing_call(call, ring_seconds)
+    if not call.payphone then
+        Bridge.Database.Query([[
+            INSERT INTO `sky_phone_calls`
+                (`id`, `caller_sim_id`, `callee_sim_id`, `caller_number`, `callee_number`, `status`)
+            VALUES (?, ?, ?, ?, ?, 'ringing')
+        ]], { call.id, call.caller_sim_id, call.callee_sim_id, call.caller_number, call.callee_number })
+        add_call_entry(call.id, call.caller_device, "outgoing", "ringing", call.callee_number)
+        add_call_entry(call.id, call.callee_device, "incoming", "ringing", call.caller_number)
+    end
+
+    calls[call.id] = call
+    active_by_source[call.caller_source] = call.id
+    active_by_source[call.callee_source] = call.id
+    if call.caller_sim_id then
+        active_by_sim[call.caller_sim_id] = call.id
+        dialing_by_sim[call.caller_sim_id] = nil
+    end
+    active_by_sim[call.callee_sim_id] = call.id
+    dialing_by_sim[call.callee_sim_id] = nil
+    dial_locks[call.caller_source] = nil
+
+    send_state(call, call.caller_source, "ringing")
+    if call.payphone then
+        send_payphone_visual(call, "start")
+    end
+    call.ring_seconds = math.max(1, math.floor(tonumber(ring_seconds) or Config.Calls.RingSeconds))
+    ring_callee(call)
+    schedule_no_answer(call)
+
+    local result = {
+        id = call.id,
+        state = "ringing",
+        direction = "outgoing",
+        otherNumber = call.callee_number,
+        startedAt = call.started_at,
+    }
+    if call.payphone then
+        result.elapsedSeconds = 0
+        result.totalCost = 0
+    end
+    return result
+end
+
+reroute_company_call = function(call, previous_status)
+    if not call.company_service_call or call.company_attempts_remaining <= 0 then
+        return false
+    end
+    if call.rerouting then
+        return true
+    end
+    call.rerouting = true
+    local next_target = company_call_target(
+        call.company_id,
+        call.caller_source,
+        call.caller_sim_id,
+        call.company_attempted_sims
+    )
+    if not next_target then
+        call.rerouting = nil
+        return false
+    end
+    if call.ended or calls[call.id] ~= call then
+        dialing_by_sim[next_target.sim_id] = nil
+        call.rerouting = nil
+        return true
+    end
+
+    local previous_source = call.callee_source
+    local previous_sim_id = call.callee_sim_id
+    local previous_device = call.callee_device
+    if not call.payphone then
+        local next_account_id, next_device_imei = scope_for_device(next_target.device)
+        local updated = Bridge.Database.Transaction({
+            {
+                query = "UPDATE `sky_phone_calls` SET `callee_sim_id` = ? WHERE `id` = ? AND `status` = 'ringing'",
+                params = { next_target.sim_id, call.id },
+            },
+            {
+                query = [[
+                    UPDATE `sky_phone_call_entries` SET `status` = ?
+                    WHERE `call_id` = ? AND `direction` = 'incoming' AND `status` = 'ringing'
+                ]],
+                params = { previous_status, call.id },
+            },
+            {
+                query = [[
+                    INSERT INTO `sky_phone_call_entries`
+                        (`call_id`, `account_id`, `device_imei`, `direction`, `status`, `other_number`)
+                    SELECT `id`, ?, ?, 'incoming', 'ringing', ?
+                    FROM `sky_phone_calls`
+                    WHERE `id` = ? AND `status` = 'ringing'
+                ]],
+                params = { next_account_id, next_device_imei, call.caller_number, call.id },
+            },
+        })
+        if not updated then
+            dialing_by_sim[next_target.sim_id] = nil
+            call.rerouting = nil
+            Bridge.Debug(
+                "error",
+                "[sky_phone] Could not reroute company call %s to the next target.",
+                tostring(call.id)
+            )
+            return false
+        end
+        if call.ended or calls[call.id] ~= call then
+            dialing_by_sim[next_target.sim_id] = nil
+            call.rerouting = nil
+            return true
+        end
+    end
+
+    send_state(call, previous_source, previous_status)
+    if active_by_source[previous_source] == call.id then
+        active_by_source[previous_source] = nil
+    end
+    if active_by_sim[previous_sim_id] == call.id then
+        active_by_sim[previous_sim_id] = nil
+    end
+    if not call.payphone then
+        notify_recents(previous_device, previous_source)
+    end
+    if call.ended or calls[call.id] ~= call then
+        dialing_by_sim[next_target.sim_id] = nil
+        call.rerouting = nil
+        return true
+    end
+
+    call.callee_source = next_target.source
+    call.callee_sim_id = next_target.sim_id
+    call.callee_device = next_target.device
+    call.company_attempted_sims[next_target.sim_id] = true
+    call.company_attempts_remaining = call.company_attempts_remaining - 1
+    active_by_source[call.callee_source] = call.id
+    active_by_sim[call.callee_sim_id] = call.id
+    dialing_by_sim[call.callee_sim_id] = nil
+    call.rerouting = nil
+    ring_callee(call)
+    schedule_no_answer(call)
+    return true
+end
+
+handle_no_answer = function(call)
+    if not reroute_company_call(call, "missed") then
+        finish_call(call, "no_answer")
+    end
+end
+
+local function lock_direct_target(caller_source, target)
+    if not target or not target.imei then
+        return nil, "unavailable"
+    end
+    local callee_source = find_device_holder(target.imei)
+    if not callee_source or callee_source == caller_source then
+        return nil, "unavailable"
+    end
+    if active_by_source[callee_source] or active_by_sim[target.id] or dialing_by_sim[target.id] then
+        return nil, "busy"
+    end
+    dialing_by_sim[target.id] = true
+    if airplane_mode(target.imei) then
+        dialing_by_sim[target.id] = nil
+        return nil, "unavailable"
+    end
+    return callee_source
+end
+
+function SkyPhoneCalls.StartCompanyCall(source, company_id, customer_number)
+    source = tonumber(source)
+    if not source or type(company_id) ~= "string" then
+        return { success = false, error = "invalid_request" }
+    end
+    if not SkyPhoneCompanies.CanPlaceCompanyCall(source, company_id) then
+        return { success = false, error = "not_authorized" }
+    end
+    if not SkyPhone.AllowOperation(source, "company_call_customer", 15, 60) then
+        return { success = false, error = "rate_limited" }
+    end
+    if dial_locks[source] then
+        return { success = false, error = "busy" }
+    end
+
+    local service_line = SkyPhoneCompanies.GetServiceLineForCompany(company_id)
+    if not service_line or not service_line.canCall then
+        return { success = false, error = "company_unavailable" }
+    end
+    local scope, error_response = current_scope(source)
+    if not scope then
+        return error_response
+    end
+    if not scope.device.sim_id then
+        return { success = false, error = "no_sim" }
+    end
+    if SkyPhoneCompanies.IsServiceNumber(scope.device.phone_number) then
+        Bridge.Debug(
+            "error",
+            "[sky_phone] Source %s attempted to call from a SIM using reserved service number %s.",
+            tostring(source),
+            tostring(scope.device.phone_number)
+        )
+        return { success = false, error = "invalid_sim" }
+    end
+    if airplane_mode(scope.device.imei) then
+        return { success = false, error = "airplane_mode" }
+    end
+
+    local number = SkyPhoneSimNumber.Normalize(customer_number, Config.Sim.NumberLength, Config.Sim.NumberPrefix)
+    if not number or SkyPhoneCompanies.IsServiceNumber(number) then
+        return { success = false, error = "invalid_number" }
+    end
+    if number == scope.device.phone_number then
+        return { success = false, error = "self_call" }
+    end
+    if active_by_source[source] or active_by_sim[scope.device.sim_id] or dialing_by_sim[scope.device.sim_id] then
+        return { success = false, error = "busy" }
+    end
+
+    dial_locks[source] = true
+    dialing_by_sim[scope.device.sim_id] = true
+    local targets = Bridge.Database.Query([[
+        SELECT s.`id`, s.`phone_number`, d.`imei`, d.`account_id`, d.`device_name`
+        FROM `sky_phone_sims` s LEFT JOIN `sky_phone_devices` d ON d.`sim_id` = s.`id`
+        WHERE s.`phone_number` = ? LIMIT 1
+    ]], { number })
+    local target = targets[1]
+    local callee_source, target_status = lock_direct_target(source, target)
+    if not callee_source then
+        local terminal = create_terminal_call(scope, number, target, target_status, service_line.number)
+        dialing_by_sim[scope.device.sim_id] = nil
+        dial_locks[source] = nil
+        return { success = true, data = terminal }
+    end
+
+    return {
+        success = true,
+        data = start_ringing_call({
+            id = uuid(),
+            caller_source = source,
+            caller_sim_id = scope.device.sim_id,
+            caller_number = service_line.number,
+            caller_device = scope.device,
+            callee_source = callee_source,
+            callee_sim_id = target.id,
+            callee_number = number,
+            callee_device = target,
+            company_id = company_id,
+            started_at = os.time(),
+        }, Config.Calls.RingSeconds),
+    }
+end
+
 Bridge.Callbacks.Register("sky_phone:calls:dial", function(source, data)
     if not SkyPhone.AllowOperation(source, "call_dial", 15, 60) then
         return { success = false, error = "rate_limited" }
@@ -468,6 +851,16 @@ Bridge.Callbacks.Register("sky_phone:calls:dial", function(source, data)
         dial_locks[source] = nil
         return { success = false, error = "no_sim" }
     end
+    if SkyPhoneCompanies.IsServiceNumber(scope.device.phone_number) then
+        Bridge.Debug(
+            "error",
+            "[sky_phone] Source %s attempted to call from a SIM using reserved service number %s.",
+            tostring(source),
+            tostring(scope.device.phone_number)
+        )
+        dial_locks[source] = nil
+        return { success = false, error = "invalid_sim" }
+    end
     if airplane_mode(scope.device.imei) then
         dial_locks[source] = nil
         return { success = false, error = "airplane_mode" }
@@ -486,80 +879,78 @@ Bridge.Callbacks.Register("sky_phone:calls:dial", function(source, data)
         return { success = false, error = "busy" }
     end
     dialing_by_sim[scope.device.sim_id] = true
+    local service_line = SkyPhoneCompanies.GetServiceLine(number)
+    if service_line then
+        if not service_line.canCall then
+            local terminal = create_terminal_call(scope, number, nil, "unavailable")
+            dialing_by_sim[scope.device.sim_id] = nil
+            dial_locks[source] = nil
+            return { success = true, data = terminal }
+        end
+        local company_target, target_status = company_call_target(
+            service_line.companyId,
+            source,
+            scope.device.sim_id
+        )
+        if not company_target then
+            local terminal = create_terminal_call(scope, number, nil, target_status)
+            dialing_by_sim[scope.device.sim_id] = nil
+            dial_locks[source] = nil
+            return { success = true, data = terminal }
+        end
+        return {
+            success = true,
+            data = start_ringing_call({
+                id = uuid(),
+                caller_source = source,
+                caller_sim_id = scope.device.sim_id,
+                caller_number = scope.device.phone_number,
+                caller_device = scope.device,
+                callee_source = company_target.source,
+                callee_sim_id = company_target.sim_id,
+                callee_number = service_line.number,
+                callee_device = company_target.device,
+                company_id = service_line.companyId,
+                company_service_call = service_line.routing == "round_robin",
+                company_attempted_sims = { [company_target.sim_id] = true },
+                company_attempts_remaining = math.max(
+                    0,
+                    math.floor(tonumber(Config.Companies.CallRouting.MaxAttempts) or 1) - 1
+                ),
+                started_at = os.time(),
+            }, Config.Companies.CallRouting.RingSeconds),
+        }
+    end
+
     local targets = Bridge.Database.Query([[
         SELECT s.`id`, s.`phone_number`, d.`imei`, d.`account_id`, d.`device_name`
         FROM `sky_phone_sims` s LEFT JOIN `sky_phone_devices` d ON d.`sim_id` = s.`id`
         WHERE s.`phone_number` = ? LIMIT 1
     ]], { number })
     local target = targets[1]
-    if not target or not target.imei then
-        local terminal = create_terminal_call(scope, number, target, "unavailable")
+    local callee_source, target_status = lock_direct_target(source, target)
+    if not callee_source then
+        local terminal = create_terminal_call(scope, number, target, target_status)
         dialing_by_sim[scope.device.sim_id] = nil
         dial_locks[source] = nil
         return { success = true, data = terminal }
     end
-    local callee_source = find_device_holder(target.imei)
-    if not callee_source or airplane_mode(target.imei) then
-        local terminal = create_terminal_call(scope, number, target, "unavailable")
-        dialing_by_sim[scope.device.sim_id] = nil
-        dial_locks[source] = nil
-        return { success = true, data = terminal }
-    end
-    if active_by_source[callee_source] or active_by_sim[target.id] or dialing_by_sim[target.id] then
-        local terminal = create_terminal_call(scope, number, target, "busy")
-        dialing_by_sim[scope.device.sim_id] = nil
-        dial_locks[source] = nil
-        return { success = true, data = terminal }
-    end
-    dialing_by_sim[target.id] = true
 
-    local id = uuid()
-    local call = {
-        id = id,
-        caller_source = source,
-        caller_sim_id = scope.device.sim_id,
-        caller_number = scope.device.phone_number,
-        caller_device = scope.device,
-        callee_source = callee_source,
-        callee_sim_id = target.id,
-        callee_number = number,
-        callee_device = target,
-        started_at = os.time(),
+    return {
+        success = true,
+        data = start_ringing_call({
+            id = uuid(),
+            caller_source = source,
+            caller_sim_id = scope.device.sim_id,
+            caller_number = scope.device.phone_number,
+            caller_device = scope.device,
+            callee_source = callee_source,
+            callee_sim_id = target.id,
+            callee_number = number,
+            callee_device = target,
+            started_at = os.time(),
+        }, Config.Calls.RingSeconds),
     }
-    Bridge.Database.Query([[
-        INSERT INTO `sky_phone_calls`
-            (`id`, `caller_sim_id`, `callee_sim_id`, `caller_number`, `callee_number`, `status`)
-        VALUES (?, ?, ?, ?, ?, 'ringing')
-    ]], { id, call.caller_sim_id, call.callee_sim_id, call.caller_number, call.callee_number })
-    add_call_entry(id, scope.device, "outgoing", "ringing", number)
-    add_call_entry(id, target, "incoming", "ringing", call.caller_number)
-    calls[id] = call
-    active_by_source[source] = id
-    active_by_source[callee_source] = id
-    active_by_sim[call.caller_sim_id] = id
-    active_by_sim[call.callee_sim_id] = id
-    dialing_by_sim[call.caller_sim_id] = nil
-    dialing_by_sim[call.callee_sim_id] = nil
-    dial_locks[source] = nil
-    send_state(call, source, "ringing")
-    SkyPhone.OpenDeviceForCall(callee_source, target.imei)
-    TriggerClientEvent("sky_phone:call:incoming", callee_source, {
-        id = id,
-        state = "ringing",
-        direction = "incoming",
-        otherNumber = call.caller_number,
-        startedAt = call.started_at,
-        device = {
-            imei = target.imei,
-            name = target.device_name,
-        },
-    })
-    SetTimeout(Config.Calls.RingSeconds * 1000, function()
-        if calls[id] and not calls[id].answered_at then
-            finish_call(calls[id], "no_answer")
-        end
-    end)
-    return { success = true, data = { id = id, state = "ringing", direction = "outgoing", otherNumber = number, startedAt = call.started_at } }
 end)
 
 local payphone_models = {}
@@ -626,89 +1017,96 @@ Bridge.Callbacks.Register("sky_phone:payphone:dial", function(source, data)
     end
 
     dial_locks[source] = true
+    local service_line = SkyPhoneCompanies.GetServiceLine(number)
+    if service_line then
+        if not service_line.canCall then
+            dial_locks[source] = nil
+            return { success = true, data = payphone_terminal(number, "unavailable") }
+        end
+        local company_target, target_status = company_call_target(service_line.companyId, source, nil)
+        if not company_target then
+            dial_locks[source] = nil
+            return { success = true, data = payphone_terminal(number, target_status) }
+        end
+        return {
+            success = true,
+            data = start_ringing_call({
+                id = uuid(),
+                caller_source = source,
+                caller_number = Config.Payphones.CallerNumber,
+                callee_source = company_target.source,
+                callee_sim_id = company_target.sim_id,
+                callee_number = service_line.number,
+                callee_device = company_target.device,
+                company_id = service_line.companyId,
+                company_service_call = service_line.routing == "round_robin",
+                company_attempted_sims = { [company_target.sim_id] = true },
+                company_attempts_remaining = math.max(
+                    0,
+                    math.floor(tonumber(Config.Companies.CallRouting.MaxAttempts) or 1) - 1
+                ),
+                started_at = os.time(),
+                payphone = {
+                    elapsed_seconds = 0,
+                    total_cost = 0,
+                    coords = booth_coords,
+                    model = booth_model,
+                    price_per_second = price_per_second,
+                    routing_bucket = GetPlayerRoutingBucket(source),
+                },
+            }, Config.Companies.CallRouting.RingSeconds),
+        }
+    end
+
     local targets = Bridge.Database.Query([[
         SELECT s.`id`, s.`phone_number`, d.`imei`, d.`account_id`, d.`device_name`
         FROM `sky_phone_sims` s LEFT JOIN `sky_phone_devices` d ON d.`sim_id` = s.`id`
         WHERE s.`phone_number` = ? LIMIT 1
     ]], { number })
     local target = targets[1]
-    if not target or not target.imei then
+    local callee_source, target_status = lock_direct_target(source, target)
+    if not callee_source then
         dial_locks[source] = nil
-        return { success = true, data = payphone_terminal(number, "unavailable") }
+        return { success = true, data = payphone_terminal(number, target_status) }
     end
-    local callee_source = find_device_holder(target.imei)
-    if not callee_source or callee_source == source or airplane_mode(target.imei) then
-        dial_locks[source] = nil
-        return { success = true, data = payphone_terminal(number, "unavailable") }
-    end
-    if active_by_source[callee_source] or active_by_sim[target.id] or dialing_by_sim[target.id] then
-        dial_locks[source] = nil
-        return { success = true, data = payphone_terminal(number, "busy") }
-    end
-    dialing_by_sim[target.id] = true
 
-    local id = uuid()
-    local call = {
-        id = id,
-        caller_source = source,
-        caller_number = Config.Payphones.CallerNumber,
-        callee_source = callee_source,
-        callee_sim_id = target.id,
-        callee_number = number,
-        callee_device = target,
-        started_at = os.time(),
-        payphone = {
-            elapsed_seconds = 0,
-            total_cost = 0,
-            coords = booth_coords,
-            model = booth_model,
-            price_per_second = price_per_second,
-            routing_bucket = GetPlayerRoutingBucket(source),
-        },
-    }
-    calls[id] = call
-    active_by_source[source] = id
-    active_by_source[callee_source] = id
-    active_by_sim[target.id] = id
-    dialing_by_sim[target.id] = nil
-    dial_locks[source] = nil
-
-    send_state(call, source, "ringing")
-    send_payphone_visual(call, "start")
-    SkyPhone.OpenDeviceForCall(callee_source, target.imei)
-    TriggerClientEvent("sky_phone:call:incoming", callee_source, {
-        id = id,
-        state = "ringing",
-        direction = "incoming",
-        otherNumber = call.caller_number,
-        startedAt = call.started_at,
-        device = {
-            imei = target.imei,
-            name = target.device_name,
-        },
-    })
-    SetTimeout(math.max(1, math.floor(tonumber(Config.Payphones.NoAnswerTimeoutSeconds) or 30)) * 1000, function()
-        if calls[id] and not calls[id].answered_at then
-            finish_call(calls[id], "no_answer")
-        end
-    end)
     return {
         success = true,
-        data = {
-            id = id,
-            state = "ringing",
-            direction = "outgoing",
-            otherNumber = number,
-            startedAt = call.started_at,
-            elapsedSeconds = 0,
-            totalCost = 0,
-        },
+        data = start_ringing_call({
+            id = uuid(),
+            caller_source = source,
+            caller_number = Config.Payphones.CallerNumber,
+            callee_source = callee_source,
+            callee_sim_id = target.id,
+            callee_number = number,
+            callee_device = target,
+            started_at = os.time(),
+            payphone = {
+                elapsed_seconds = 0,
+                total_cost = 0,
+                coords = booth_coords,
+                model = booth_model,
+                price_per_second = price_per_second,
+                routing_bucket = GetPlayerRoutingBucket(source),
+            },
+        }, Config.Payphones.NoAnswerTimeoutSeconds),
     }
 end)
 
 Bridge.Callbacks.Register("sky_phone:calls:answer", function(source, data)
     local call = type(data) == "table" and calls[data.id] or nil
-    if not call or call.callee_source ~= source or call.answered_at then
+    if not call or call.callee_source ~= source or call.answered_at or call.rerouting then
+        return { success = false, error = "call_not_found" }
+    end
+    if call.company_service_call and not SkyPhoneCompanies.CanAnswerCompanyCall(
+        source,
+        call.company_id,
+        call.callee_device.imei,
+        call.callee_sim_id
+    ) then
+        if not reroute_company_call(call, "missed") then
+            finish_call(call, "unavailable")
+        end
         return { success = false, error = "call_not_found" }
     end
     if not SkyPhone.FindDeviceSlots(source, call.callee_device.imei)[1] then
@@ -722,8 +1120,17 @@ Bridge.Callbacks.Register("sky_phone:calls:answer", function(source, data)
     call.channel = next_voice_channel
     next_voice_channel = next_voice_channel + 1
     if not call.payphone then
-        Bridge.Database.Query("UPDATE `sky_phone_calls` SET `status` = 'connected', `answered_at` = CURRENT_TIMESTAMP WHERE `id` = ?", { call.id })
-        Bridge.Database.Query("UPDATE `sky_phone_call_entries` SET `status` = 'connected' WHERE `call_id` = ?", { call.id })
+        Bridge.Database.Query([[
+            UPDATE `sky_phone_calls` SET `status` = 'connected', `answered_at` = CURRENT_TIMESTAMP
+            WHERE `id` = ? AND `status` = 'ringing'
+        ]], { call.id })
+        Bridge.Database.Query([[
+            UPDATE `sky_phone_call_entries` SET `status` = 'connected'
+            WHERE `call_id` = ? AND `status` = 'ringing'
+        ]], { call.id })
+    end
+    if call.ended or calls[call.id] ~= call then
+        return { success = false, error = "call_not_found" }
     end
     send_state(call, call.caller_source, "connected", call.channel)
     send_state(call, call.callee_source, "connected", call.channel)
@@ -732,10 +1139,12 @@ end)
 
 Bridge.Callbacks.Register("sky_phone:calls:decline", function(source, data)
     local call = type(data) == "table" and calls[data.id] or nil
-    if not call or call.callee_source ~= source or call.answered_at then
+    if not call or call.callee_source ~= source or call.answered_at or call.rerouting then
         return { success = false, error = "call_not_found" }
     end
-    finish_call(call, "declined")
+    if not reroute_company_call(call, "declined") then
+        finish_call(call, "declined")
+    end
     return { success = true }
 end)
 
@@ -747,6 +1156,15 @@ Bridge.Callbacks.Register("sky_phone:calls:hangup", function(source, data)
     then
         return { success = false, error = "call_not_found" }
     end
+    if call.company_service_call and not call.answered_at and call.callee_source == source then
+        if call.rerouting then
+            return { success = false, error = "call_not_found" }
+        end
+        if not reroute_company_call(call, "declined") then
+            finish_call(call, "declined")
+        end
+        return { success = true }
+    end
     finish_call(call, call.answered_at and "completed" or "cancelled")
     return { success = true }
 end)
@@ -781,8 +1199,16 @@ CreateThread(function()
             end
             local callee_valid = not call.callee_source
                 or SkyPhone.FindDeviceSlots(call.callee_source, call.callee_device.imei)[1] ~= nil
-            if not caller_valid or not callee_valid then
+            if not caller_valid then
                 calls_to_finish[call_id] = "disconnected"
+            elseif not callee_valid then
+                if call.company_service_call and not call.answered_at then
+                    if not reroute_company_call(call, "missed") then
+                        calls_to_finish[call_id] = "unavailable"
+                    end
+                else
+                    calls_to_finish[call_id] = "disconnected"
+                end
             elseif call.payphone and call.answered_at and not call.ended then
                 local elapsed_seconds = math.max(0, os.time() - call.answered_at)
                 local total_cost = elapsed_seconds * call.payphone.price_per_second
@@ -806,9 +1232,17 @@ end)
 
 AddEventHandler("playerDropped", function()
     local call_id = active_by_source[source]
-    if call_id then
-        finish_call(calls[call_id], "disconnected")
+    local call = call_id and calls[call_id] or nil
+    if not call then
+        return
     end
+    if call.callee_source == source and call.company_service_call and not call.answered_at then
+        if not reroute_company_call(call, "missed") then
+            finish_call(call, "unavailable")
+        end
+        return
+    end
+    finish_call(call, "disconnected")
 end)
 
 AddEventHandler("onResourceStop", function(resource_name)
diff --git a/sky_phone/source/server/companies.lua b/sky_phone/source/server/companies.lua
new file mode 100644
index 0000000..3a18a55
--- /dev/null
+++ b/sky_phone/source/server/companies.lua
@@ -0,0 +1,3028 @@
+Bridge.Database.AfterMigration("sky_phone", function()
+SkyPhoneCompanies = {}
+
+local definitions = {}
+local definition_ids = {}
+local definitions_by_job = {}
+local service_lines_by_number = {}
+local call_availability = {}
+local round_robin_positions = {}
+local member_tokens = {}
+local terminal_statuses = {
+    completed = true,
+    cancelled = true,
+}
+local status_transitions = {
+    new = { cancelled = true },
+    assigned = { in_progress = true, cancelled = true },
+    in_progress = { waiting_customer = true, completed = true, cancelled = true },
+    waiting_customer = { in_progress = true, cancelled = true },
+}
+
+local function uuid()
+    local rows = Bridge.Database.Query("SELECT UUID() AS `id`", {})
+    if not rows[1] or type(rows[1].id) ~= "string" then
+        error("[sky_phone] Database did not generate a Companies UUID.")
+    end
+    return rows[1].id
+end
+
+local function trim(value)
+    if type(value) ~= "string" then
+        return nil
+    end
+    return value:match("^%s*(.-)%s*$")
+end
+
+local function valid_text(value, maximum, allow_empty)
+    local text = trim(value)
+    if not text or text:find("%z") then
+        return nil
+    end
+    local length = utf8.len(text)
+    if not length or length > maximum or (not allow_empty and length == 0) then
+        return nil
+    end
+    return text
+end
+
+local function valid_integer(value, minimum, maximum)
+    local number = tonumber(value)
+    if not number or number ~= number or number < minimum or number > maximum
+        or number ~= math.floor(number)
+    then
+        return nil
+    end
+    return number
+end
+
+local function valid_uuid(value)
+    return type(value) == "string"
+        and value:match("^%x%x%x%x%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%x%x%x%x%x%x%x%x$") ~= nil
+end
+
+local function valid_service_id(value)
+    return type(value) == "string"
+        and #value >= 1
+        and #value <= 64
+        and value:match("^[%w_-]+$") ~= nil
+end
+
+local function valid_array(value, maximum)
+    if type(value) ~= "table" or #value > maximum then
+        return false
+    end
+    local count = 0
+    for key in pairs(value) do
+        if type(key) ~= "number" or key < 1 or key ~= math.floor(key) or key > #value then
+            return false
+        end
+        count = count + 1
+    end
+    return count == #value
+end
+
+local function iso_time(value)
+    local seconds = tonumber(value)
+    if not seconds or seconds <= 0 then
+        return nil
+    end
+    return os.date("!%Y-%m-%dT%H:%M:%SZ", seconds)
+end
+
+local function days_from_civil(year, month, day)
+    year = year - (month <= 2 and 1 or 0)
+    local era = math.floor(year / 400)
+    local year_of_era = year - era * 400
+    local adjusted_month = month + (month > 2 and -3 or 9)
+    local day_of_year = math.floor((153 * adjusted_month + 2) / 5) + day - 1
+    local day_of_era = year_of_era * 365 + math.floor(year_of_era / 4)
+        - math.floor(year_of_era / 100) + day_of_year
+    return era * 146097 + day_of_era - 719468
+end
+
+local function utc_epoch(year, month, day, hour, minute, second)
+    if year < 1970 or year > 2100 or month < 1 or month > 12
+        or day < 1 or hour < 0 or hour > 23 or minute < 0 or minute > 59
+        or second < 0 or second > 59
+    then
+        return nil
+    end
+    local month_lengths = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 }
+    if year % 400 == 0 or (year % 4 == 0 and year % 100 ~= 0) then
+        month_lengths[2] = 29
+    end
+    if day > month_lengths[month] then
+        return nil
+    end
+    return days_from_civil(year, month, day) * 86400 + hour * 3600 + minute * 60 + second
+end
+
+local function parse_expiry(value, maximum_seconds)
+    if value == nil or value == "" then
+        return nil
+    end
+    if type(value) ~= "string" or #value > 40 then
+        return false
+    end
+    local year, month, day, hour, minute, second = value:match(
+        "^(%d%d%d%d)%-(%d%d)%-(%d%d)T(%d%d):(%d%d):(%d%d)Z$"
+    )
+    if not year then
+        year, month, day, hour, minute, second = value:match(
+            "^(%d%d%d%d)%-(%d%d)%-(%d%d)T(%d%d):(%d%d):(%d%d)%.%d+Z$"
+        )
+    end
+    if not year then
+        return false
+    end
+    local epoch = utc_epoch(
+        tonumber(year),
+        tonumber(month),
+        tonumber(day),
+        tonumber(hour),
+        tonumber(minute),
+        tonumber(second)
+    )
+    local now = os.time()
+    if not epoch or epoch <= now or epoch - now > maximum_seconds then
+        return false
+    end
+    return epoch
+end
+
+local function permission_grade(definition, permission)
+    local grade = definition.Permissions and tonumber(definition.Permissions[permission])
+    return grade and math.max(0, math.floor(grade)) or nil
+end
+
+local function validate_configuration()
+    if type(Config.Companies) ~= "table" or type(Config.Companies.Definitions) ~= "table" then
+        error("[sky_phone] Config.Companies.Definitions must be configured.")
+    end
+    if type(Config.Companies.Enabled) ~= "boolean" then
+        error("[sky_phone] Config.Companies.Enabled must be a boolean.")
+    end
+    for _, field in ipairs({
+        { "PageSize", 1000 },
+        { "MaximumPageSize", 1000 },
+        { "MaximumOpenRequestsPerSim", 1000 },
+        { "MaximumServices", 255 },
+        { "MaximumRequestMedia", 255 },
+        { "SubjectMaxLength", 120 },
+        { "RequestBodyMaxLength", 2000 },
+        { "MessageMaxLength", 2000 },
+        { "ProfileDescriptionMaxLength", 1000 },
+        { "DistrictMaxLength", 80 },
+        { "AddressMaxLength", 160 },
+        { "ServiceTitleMaxLength", 80 },
+        { "ServiceDescriptionMaxLength", 500 },
+        { "ServicePriceMaxLength", 80 },
+        { "AnnouncementTitleMaxLength", 120 },
+        { "AnnouncementBodyMaxLength", 1000 },
+        { "AvailabilityMaximumSeconds", 31536000 },
+        { "AnnouncementMaximumSeconds", 31536000 },
+        { "RetentionDays", 36500 },
+    }) do
+        if not valid_integer(Config.Companies[field[1]], 1, field[2]) then
+            error(("[sky_phone] Config.Companies.%s is outside its supported range."):format(field[1]))
+        end
+    end
+    if Config.Companies.PageSize > Config.Companies.MaximumPageSize then
+        error("[sky_phone] Companies PageSize cannot exceed MaximumPageSize.")
+    end
+    if type(Config.Companies.RateLimits) ~= "table" then
+        error("[sky_phone] Config.Companies.RateLimits must be configured.")
+    end
+    for _, name in ipairs({ "Read", "Search", "CreateRequest", "Message", "RequestAction", "Profile", "CallAvailability" }) do
+        if not valid_integer(Config.Companies.RateLimits[name], 1, 100000) then
+            error(("[sky_phone] Companies rate limit '%s' is invalid."):format(name))
+        end
+    end
+    if type(Config.Companies.CallRouting) ~= "table"
+        or not valid_integer(Config.Companies.CallRouting.MaxAttempts, 1, 20)
+        or not valid_integer(Config.Companies.CallRouting.RingSeconds, 1, 120)
+    then
+        error("[sky_phone] Config.Companies.CallRouting is invalid.")
+    end
+    local configured_statuses = {
+        new = true,
+        assigned = true,
+        in_progress = true,
+        waiting_customer = true,
+        completed = true,
+        cancelled = true,
+    }
+    if type(Config.Companies.Statuses) ~= "table" then
+        error("[sky_phone] Config.Companies.Statuses must be configured.")
+    end
+    for status in pairs(configured_statuses) do
+        if Config.Companies.Statuses[status] ~= true then
+            error(("[sky_phone] Companies status '%s' must be enabled."):format(status))
+        end
+    end
+    for status, enabled in pairs(Config.Companies.Statuses) do
+        if not configured_statuses[status] or enabled ~= true then
+            error(("[sky_phone] Companies status '%s' is unsupported."):format(tostring(status)))
+        end
+    end
+    if type(Config.Companies.AvailabilityStatuses) ~= "table" then
+        error("[sky_phone] Config.Companies.AvailabilityStatuses must be configured.")
+    end
+    local configured_availability = { available = true, busy = true, closed = true }
+    for _, status in ipairs({ "available", "busy", "closed" }) do
+        if Config.Companies.AvailabilityStatuses[status] ~= true then
+            error(("[sky_phone] Companies availability status '%s' must be enabled."):format(status))
+        end
+    end
+    for status, enabled in pairs(Config.Companies.AvailabilityStatuses) do
+        if not configured_availability[status] or enabled ~= true then
+            error(("[sky_phone] Companies availability status '%s' is unsupported."):format(tostring(status)))
+        end
+    end
+    if not valid_array(Config.Companies.Categories, 100) then
+        error("[sky_phone] Config.Companies.Categories must be a bounded array.")
+    end
+    local category_ids = {}
+    local configured_service_ids = {}
+    for _, category_id in ipairs(Config.Companies.Categories) do
+        if type(category_id) ~= "string" or #category_id > 64
+            or not category_id:match("^[a-z0-9_-]+$") or category_ids[category_id]
+        then
+            error("[sky_phone] Companies contains an invalid category ID.")
+        end
+        category_ids[category_id] = true
+    end
+
+    for company_id, definition in pairs(Config.Companies.Definitions) do
+        if type(company_id) ~= "string" or #company_id > 64 or not company_id:match("^[a-z0-9_-]+$")
+            or type(definition) ~= "table"
+            or type(definition.Job) ~= "string" or #definition.Job > 64
+            or not definition.Job:match("^[%w_-]+$")
+            or not valid_text(definition.Name, 120, false)
+            or not category_ids[definition.Category]
+        then
+            error(("[sky_phone] Company definition '%s' is invalid."):format(tostring(company_id)))
+        end
+        local description = valid_text(definition.Description or "", Config.Companies.ProfileDescriptionMaxLength, true)
+        local district = valid_text(definition.District or "", Config.Companies.DistrictMaxLength, true)
+        local location_label = valid_text(
+            definition.LocationLabel or definition.Address or "",
+            Config.Companies.DistrictMaxLength,
+            true
+        )
+        local address = valid_text(definition.Address or "", Config.Companies.AddressMaxLength, true)
+        if not description or not district or not location_label or not address
+            or type(definition.Public) ~= "boolean" or type(definition.Emergency) ~= "boolean"
+            or type(definition.Verified) ~= "boolean" or type(definition.AcceptsRequests) ~= "boolean"
+            or not Config.Companies.AvailabilityStatuses[definition.DefaultAvailability]
+            or not valid_text(definition.Icon, 64, false)
+            or (definition.Emergency and definition.AcceptsRequests)
+        then
+            error(("[sky_phone] Company definition '%s' has invalid public profile defaults."):format(company_id))
+        end
+        definition.Name = trim(definition.Name)
+        definition.Description = description
+        definition.District = district
+        definition.LocationLabel = location_label
+        definition.Address = address
+        if definition.Location ~= nil then
+            local location_type = type(definition.Location)
+            if location_type ~= "table" and location_type ~= "vector3" then
+                error(("[sky_phone] Company definition '%s' has invalid location coordinates."):format(company_id))
+            end
+            local x = tonumber(definition.Location.x)
+            local y = tonumber(definition.Location.y)
+            local z = tonumber(definition.Location.z)
+            if not x or not y or not z or x ~= x or y ~= y or z ~= z
+                or math.abs(x) > 10000 or math.abs(y) > 10000 or math.abs(z) > 2000
+            then
+                error(("[sky_phone] Company definition '%s' has invalid location coordinates."):format(company_id))
+            end
+        end
+        if definitions_by_job[definition.Job] then
+            error(("[sky_phone] Framework job '%s' is assigned to more than one company."):format(definition.Job))
+        end
+        local line = definition.ServiceLine
+        if type(line) ~= "table" then
+            error(("[sky_phone] Company '%s' has no service line configuration."):format(company_id))
+        end
+        local number = SkyPhoneSimNumber.Normalize(line.Number, Config.Sim.NumberLength, Config.Sim.NumberPrefix)
+        if not number then
+            error(("[sky_phone] Company '%s' has an invalid service number."):format(company_id))
+        end
+        if service_lines_by_number[number] then
+            error(("[sky_phone] Service number '%s' is assigned more than once."):format(number))
+        end
+        if type(line.AutoContact) ~= "boolean" or type(line.CanCall) ~= "boolean"
+            or type(line.CanMessage) ~= "boolean"
+            or not valid_integer(line.MinimumGrade, 0, 10000)
+        then
+            error(("[sky_phone] Company '%s' has invalid service line flags or grade."):format(company_id))
+        end
+        if line.AutoContact and not definition.Public then
+            error(("[sky_phone] Private company '%s' cannot create a public system contact."):format(company_id))
+        end
+        if line.Routing ~= "round_robin" then
+            error(("[sky_phone] Company '%s' uses unsupported call routing '%s'."):format(company_id, tostring(line.Routing)))
+        end
+        if line.CanMessage then
+            error(("[sky_phone] Company '%s' enables messaging without a virtual service-line message router."):format(company_id))
+        end
+        line.Number = number
+        definitions[company_id] = definition
+        definition_ids[#definition_ids + 1] = company_id
+        definitions_by_job[definition.Job] = company_id
+        service_lines_by_number[number] = company_id
+        for _, permission in ipairs({ "WorkQueue", "Availability", "Assign", "Profile", "Hours", "Services", "Announcement" }) do
+            if not definition.Permissions or not valid_integer(definition.Permissions[permission], 0, 10000) then
+                error(("[sky_phone] Company '%s' has no valid '%s' grade."):format(company_id, permission))
+            end
+        end
+        local default_services = definition.Services
+        if default_services == nil then
+            default_services = {}
+            definition.Services = default_services
+        end
+        if not valid_array(default_services, Config.Companies.MaximumServices) then
+            error(("[sky_phone] Company '%s' has an invalid default service list."):format(company_id))
+        end
+        for _, service in ipairs(default_services) do
+            if type(service) ~= "table" then
+                error(("[sky_phone] Company '%s' has an invalid default service."):format(company_id))
+            end
+            local title = valid_text(service.Title, Config.Companies.ServiceTitleMaxLength, false)
+            local service_description = valid_text(
+                service.Description or "",
+                Config.Companies.ServiceDescriptionMaxLength,
+                true
+            )
+            local price = valid_text(service.Price or "", Config.Companies.ServicePriceMaxLength, true)
+            if not valid_service_id(service.Id) or not title or not service_description or not price
+                or type(service.RequestsEnabled) ~= "boolean"
+            then
+                error(("[sky_phone] Company '%s' has an invalid default service."):format(company_id))
+            end
+            service.Title = title
+            service.Description = service_description
+            service.Price = price
+            if configured_service_ids[service.Id] then
+                error(("[sky_phone] Default company service ID '%s' is configured more than once."):format(service.Id))
+            end
+            configured_service_ids[service.Id] = true
+        end
+    end
+
+    table.sort(definition_ids, function(left, right)
+        local left_name = definitions[left].Name:lower()
+        local right_name = definitions[right].Name:lower()
+        return left_name == right_name and left < right or left_name < right_name
+    end)
+end
+
+local function seed_companies()
+    if #definition_ids > 0 then
+        local placeholders = {}
+        local numbers = {}
+        for index, company_id in ipairs(definition_ids) do
+            placeholders[index] = "?"
+            numbers[index] = definitions[company_id].ServiceLine.Number
+        end
+        local collisions = Bridge.Database.Query(([[
+            SELECT `phone_number` FROM `sky_phone_sims`
+            WHERE `phone_number` IN (%s)
+            LIMIT 1
+        ]]):format(table.concat(placeholders, ", ")), numbers)
+        if collisions[1] then
+            error(("[sky_phone] Company service number '%s' collides with an existing SIM."):format(
+                tostring(collisions[1].phone_number)
+            ))
+        end
+    end
+
+    for _, company_id in ipairs(definition_ids) do
+        local definition = definitions[company_id]
+        local location = definition.Location
+        if location then
+            Bridge.Database.Query([[
+                INSERT IGNORE INTO `sky_phone_company_profiles`
+                    (`company_id`, `description`, `district`, `location_label`, `address`,
+                        `location_x`, `location_y`, `location_z`, `availability`, `accepts_requests`)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            ]], {
+                company_id,
+                definition.Description or "",
+                definition.District or "",
+                definition.LocationLabel or definition.Address or "",
+                definition.Address or "",
+                location.x,
+                location.y,
+                location.z,
+                definition.DefaultAvailability or "closed",
+                definition.AcceptsRequests and 1 or 0,
+            })
+        else
+            Bridge.Database.Query([[
+                INSERT IGNORE INTO `sky_phone_company_profiles`
+                    (`company_id`, `description`, `district`, `location_label`, `address`,
+                        `availability`, `accepts_requests`)
+                VALUES (?, ?, ?, ?, ?, ?, ?)
+            ]], {
+                company_id,
+                definition.Description or "",
+                definition.District or "",
+                definition.LocationLabel or definition.Address or "",
+                definition.Address or "",
+                definition.DefaultAvailability or "closed",
+                definition.AcceptsRequests and 1 or 0,
+            })
+        end
+        for index, service in ipairs(definition.Services or {}) do
+            Bridge.Database.Query([[
+                INSERT IGNORE INTO `sky_phone_company_services`
+                    (`id`, `company_id`, `title`, `description`, `price_text`, `requests_enabled`, `active`, `sort_order`)
+                VALUES (?, ?, ?, ?, ?, ?, 1, ?)
+            ]], {
+                service.Id,
+                company_id,
+                service.Title,
+                service.Description or "",
+                service.Price or "",
+                service.RequestsEnabled and 1 or 0,
+                index,
+            })
+            local seeded = Bridge.Database.Query(
+                "SELECT `company_id` FROM `sky_phone_company_services` WHERE `id` = ? LIMIT 1",
+                { service.Id }
+            )
+            if not seeded[1] or seeded[1].company_id ~= company_id then
+                error(("[sky_phone] Default service ID '%s' collides with another company."):format(service.Id))
+            end
+        end
+    end
+
+end
+
+local function tombstone_removed_companies()
+    local profiles = Bridge.Database.Query([[
+        SELECT DISTINCT profile.`company_id`
+        FROM `sky_phone_company_profiles` profile
+        INNER JOIN `sky_phone_company_requests` request ON request.`company_id` = profile.`company_id`
+        WHERE request.`status` NOT IN ('completed', 'cancelled')
+    ]], {})
+    for _, profile in ipairs(profiles) do
+        if not definitions[profile.company_id] then
+            local mutation_token = uuid()
+            if not Bridge.Database.Transaction({
+                {
+                    query = [[
+                        UPDATE `sky_phone_company_requests`
+                        SET `status` = 'cancelled', `revision` = `revision` + 1,
+                            `customer_unread` = `customer_unread` + 1,
+                            `cancelled_at` = CURRENT_TIMESTAMP, `mutation_token` = ?
+                        WHERE `company_id` = ? AND `status` NOT IN ('completed', 'cancelled')
+                    ]],
+                    params = { mutation_token, profile.company_id },
+                },
+                {
+                    query = [[
+                        INSERT INTO `sky_phone_company_request_events`
+                            (`id`, `request_id`, `event_type`, `actor_type`, `to_status`, `detail`)
+                        SELECT UUID(), `id`, 'cancelled', 'system', 'cancelled', 'company_removed'
+                        FROM `sky_phone_company_requests`
+                        WHERE `company_id` = ? AND `mutation_token` = ?
+                    ]],
+                    params = { profile.company_id, mutation_token },
+                },
+            }) then
+                error(("[sky_phone] Could not tombstone removed company '%s'."):format(
+                    tostring(profile.company_id)
+                ))
+            end
+        end
+    end
+end
+
+local function service_line_payload(company_id)
+    local definition = definitions[company_id]
+    if not Config.Companies.Enabled or not definition then
+        return nil
+    end
+    local line = definition.ServiceLine
+    return {
+        companyId = company_id,
+        number = line.Number,
+        name = definition.Name,
+        canCall = line.CanCall == true,
+        canMessage = line.CanMessage == true,
+        autoContact = line.AutoContact == true,
+        routing = line.Routing,
+        icon = definition.Icon,
+    }
+end
+
+function SkyPhoneCompanies.GetServiceLine(number)
+    local normalized = SkyPhoneSimNumber.Normalize(number, Config.Sim.NumberLength, Config.Sim.NumberPrefix)
+    return normalized and service_line_payload(service_lines_by_number[normalized]) or nil
+end
+
+function SkyPhoneCompanies.GetServiceLineForCompany(company_id)
+    return type(company_id) == "string" and service_line_payload(company_id) or nil
+end
+
+function SkyPhoneCompanies.IsServiceNumber(number)
+    local normalized = SkyPhoneSimNumber.Normalize(number, Config.Sim.NumberLength, Config.Sim.NumberPrefix)
+    return normalized ~= nil and service_lines_by_number[normalized] ~= nil
+end
+
+function SkyPhoneCompanies.IsSystemContactNumber(number)
+    if not Config.Companies.Enabled then
+        return false
+    end
+    local normalized = SkyPhoneSimNumber.Normalize(number, Config.Sim.NumberLength, Config.Sim.NumberPrefix)
+    local company_id = normalized and service_lines_by_number[normalized] or nil
+    local definition = company_id and definitions[company_id] or nil
+    return definition ~= nil and definition.Public == true and definition.ServiceLine.AutoContact == true
+end
+
+function SkyPhoneCompanies.GetSystemContacts()
+    local contacts = {}
+    if not Config.Companies.Enabled then
+        return contacts
+    end
+    for _, company_id in ipairs(definition_ids) do
+        local definition = definitions[company_id]
+        local line = definition.ServiceLine
+        if definition.Public and line.AutoContact then
+            contacts[#contacts + 1] = {
+                id = "company:" .. company_id,
+                companyId = company_id,
+                name = definition.Name,
+                phone_number = line.Number,
+                source = "company",
+                readonly = true,
+                canCall = line.CanCall == true,
+                canMessage = line.CanMessage == true,
+                verified = definition.Verified == true,
+                icon = definition.Icon,
+            }
+        end
+    end
+    return contacts
+end
+
+function SkyPhoneCompanies.ClearCallAvailability(source)
+    call_availability[tonumber(source) or source] = nil
+end
+
+local function current_device(source, registered_required)
+    local session, error_response = SkyPhone.RequireSession(source)
+    if not session then
+        return nil, error_response
+    end
+    local device = SkyPhone.LoadDevice(session.imei)
+    if not device then
+        return nil, { success = false, error = "request_failed" }
+    end
+    if not device.sim_id then
+        return nil, { success = false, error = "no_sim" }
+    end
+    if registered_required and (device.sim_type ~= "registered" or not device.registered_at) then
+        return nil, { success = false, error = "anonymous_sim" }
+    end
+    return device
+end
+
+local function membership(source)
+    local job = Bridge.Framework.GetJob(source)
+    local company_id = definitions_by_job[job.name]
+    if not company_id then
+        return nil
+    end
+    return {
+        company_id = company_id,
+        definition = definitions[company_id],
+        grade = tonumber(job.grade) or 0,
+        grade_label = job.gradeLabel or job.label or "",
+    }
+end
+
+local function require_permission(source, permission)
+    local member = membership(source)
+    if not member then
+        return nil, { success = false, error = "not_authorized" }
+    end
+    local minimum = permission_grade(member.definition, permission)
+    if not minimum or member.grade < minimum then
+        return nil, { success = false, error = "not_authorized" }
+    end
+    local identifier = Bridge.Framework.GetIdentifier(source)
+    if type(identifier) ~= "string" or identifier == "" then
+        return nil, { success = false, error = "not_authorized" }
+    end
+    member.identifier = identifier
+    return member
+end
+
+local function call_member(source)
+    local member = membership(source)
+    if not member then
+        return nil
+    end
+    local minimum = tonumber(member.definition.ServiceLine.MinimumGrade) or 0
+    if member.grade < minimum then
+        return nil
+    end
+    return member
+end
+
+function SkyPhoneCompanies.CanAnswerCompanyCall(source, company_id, imei, sim_id)
+    source = tonumber(source)
+    if not Config.Companies.Enabled or not source or type(company_id) ~= "string"
+        or type(imei) ~= "string" or type(sim_id) ~= "string"
+    then
+        return false
+    end
+    local readiness = call_availability[source]
+    local member = readiness and call_member(source) or nil
+    return member ~= nil
+        and member.company_id == company_id
+        and member.definition.ServiceLine.CanCall == true
+        and readiness.company_id == company_id
+        and readiness.imei == imei
+        and readiness.sim_id == sim_id
+end
+
+function SkyPhoneCompanies.CanPlaceCompanyCall(source, company_id)
+    source = tonumber(source)
+    if not Config.Companies.Enabled or not source or type(company_id) ~= "string" then
+        return false
+    end
+    local member = call_member(source)
+    return member ~= nil and member.company_id == company_id
+        and member.definition.ServiceLine.CanCall == true
+end
+
+function SkyPhoneCompanies.GetCallTargets(company_id)
+    local targets = {}
+    local definition = definitions[company_id]
+    if not Config.Companies.Enabled or not definition or not definition.ServiceLine.CanCall then
+        return targets
+    end
+    local online = {}
+    for _, player_source in ipairs(Bridge.Framework.GetPlayers()) do
+        online[tonumber(player_source) or player_source] = true
+    end
+    for source, readiness in pairs(call_availability) do
+        local member = online[source] and call_member(source) or nil
+        local device = member and current_device(source, true) or nil
+        if not member or not device or member.company_id ~= readiness.company_id
+            or readiness.company_id ~= company_id or readiness.imei ~= device.imei
+            or readiness.sim_id ~= device.sim_id
+        then
+            if not member or not device or member.company_id ~= readiness.company_id
+                or readiness.imei ~= (device and device.imei)
+                or readiness.sim_id ~= (device and device.sim_id)
+            then
+                call_availability[source] = nil
+            end
+        else
+            targets[#targets + 1] = {
+                source = source,
+                simId = device.sim_id,
+                phoneNumber = device.phone_number,
+                imei = device.imei,
+                deviceName = device.device_name,
+            }
+        end
+    end
+    table.sort(targets, function(left, right)
+        return left.source < right.source
+    end)
+    if #targets < 2 then
+        return targets
+    end
+    local start = (round_robin_positions[company_id] or 0) % #targets + 1
+    local ordered = {}
+    for offset = 0, #targets - 1 do
+        ordered[#ordered + 1] = targets[(start + offset - 1) % #targets + 1]
+    end
+    round_robin_positions[company_id] = start
+    return ordered
+end
+
+local function profile_row(company_id)
+    local rows = Bridge.Database.Query([[
+        SELECT p.`company_id`, p.`description`, p.`district`, p.`location_label`, p.`address`,
+            p.`location_x`, p.`location_y`, p.`location_z`, p.`availability`,
+            UNIX_TIMESTAMP(p.`availability_updated_at`) AS `availability_updated_at_unix`,
+            UNIX_TIMESTAMP(p.`availability_expires_at`) AS `availability_expires_at_unix`,
+            p.`logo_media_id`, p.`cover_media_id`, p.`accepts_requests`, p.`revision`,
+            UNIX_TIMESTAMP(p.`updated_at`) AS `updated_at_unix`,
+            logo.`url` AS `logo_url`, cover.`url` AS `cover_url`
+        FROM `sky_phone_company_profiles` p
+        LEFT JOIN `sky_phone_media` logo ON logo.`id` = p.`logo_media_id`
+        LEFT JOIN `sky_phone_media` cover ON cover.`id` = p.`cover_media_id`
+        WHERE p.`company_id` = ?
+        LIMIT 1
+    ]], { company_id })
+    return rows[1]
+end
+
+local function company_services(company_id, include_inactive)
+    local condition = include_inactive and " AND `archived` = 0"
+        or " AND `archived` = 0 AND `active` = 1"
+    local rows = Bridge.Database.Query(([[
+        SELECT `id`, `title`, `description`, `price_text`, `requests_enabled`, `active`
+        FROM `sky_phone_company_services`
+        WHERE `company_id` = ?%s
+        ORDER BY `sort_order`, `title`, `id`
+    ]]):format(condition), { company_id })
+    local services = {}
+    for _, row in ipairs(rows) do
+        services[#services + 1] = {
+            id = row.id,
+            title = row.title,
+            description = row.description,
+            priceText = row.price_text ~= "" and row.price_text or nil,
+            acceptsRequests = tonumber(row.requests_enabled) == 1,
+            active = tonumber(row.active) == 1,
+        }
+    end
+    return services
+end
+
+local function company_hours(company_id)
+    local rows = Bridge.Database.Query([[
+        SELECT `weekday`, `is_closed`, `opens_at`, `closes_at`
+        FROM `sky_phone_company_hours`
+        WHERE `company_id` = ?
+        ORDER BY `weekday`
+    ]], { company_id })
+    local hours = {}
+    for _, row in ipairs(rows) do
+        hours[#hours + 1] = {
+            day = tonumber(row.weekday),
+            isClosed = tonumber(row.is_closed) == 1,
+            opensAt = row.opens_at,
+            closesAt = row.closes_at,
+        }
+    end
+    return hours
+end
+
+local function current_announcement(company_id)
+    local rows = Bridge.Database.Query([[
+        SELECT `body`, UNIX_TIMESTAMP(`expires_at`) AS `expires_at_unix`,
+            UNIX_TIMESTAMP(`created_at`) AS `created_at_unix`
+        FROM `sky_phone_company_announcements`
+        WHERE `company_id` = ? AND `active` = 1
+            AND (`expires_at` IS NULL OR `expires_at` > CURRENT_TIMESTAMP)
+        ORDER BY `created_at` DESC
+        LIMIT 1
+    ]], { company_id })
+    local row = rows[1]
+    return row and {
+        body = row.body,
+        expiresAt = iso_time(row.expires_at_unix),
+        publishedAt = iso_time(row.created_at_unix),
+    } or nil
+end
+
+local function company_payload(company_id, include_inactive_services)
+    local definition = definitions[company_id]
+    local row = definition and profile_row(company_id) or nil
+    if not definition or not row then
+        return nil
+    end
+    local services = company_services(company_id, include_inactive_services)
+    local availability = row.availability
+    local availability_expires = tonumber(row.availability_expires_at_unix)
+    if availability_expires and availability_expires <= os.time() then
+        availability = definition.DefaultAvailability or "closed"
+    end
+    local location = nil
+    local x = tonumber(row.location_x)
+    local y = tonumber(row.location_y)
+    local z = tonumber(row.location_z)
+    if x and y and z then
+        location = {
+            address = row.address,
+            district = row.district,
+            label = row.location_label,
+            coords = { x = x, y = y, z = z },
+        }
+    end
+    local line = definition.ServiceLine
+    return {
+        id = company_id,
+        name = definition.Name,
+        categoryId = definition.Category,
+        categoryName = definition.Category,
+        verified = definition.Verified == true,
+        description = row.description,
+        availability = availability,
+        availabilityUpdatedAt = iso_time(row.availability_updated_at_unix)
+            or iso_time(row.updated_at_unix),
+        acceptsRequests = tonumber(row.accepts_requests) == 1 and not definition.Emergency,
+        phoneNumber = line and line.Number or nil,
+        canCall = line and line.CanCall == true or false,
+        canMessage = line and line.CanMessage == true or false,
+        location = location,
+        logoUrl = row.logo_url,
+        coverUrl = row.cover_url,
+        serviceSummary = services[1] and services[1].title or "",
+        announcement = current_announcement(company_id),
+        services = services,
+        hours = company_hours(company_id),
+        revision = tonumber(row.revision) or 1,
+        updatedAtUnix = tonumber(row.updated_at_unix) or 0,
+    }
+end
+
+local function public_company(company_id)
+    local definition = definitions[company_id]
+    if not definition or not definition.Public then
+        return nil
+    end
+    return company_payload(company_id, false)
+end
+
+local function category_payloads()
+    local categories = {}
+    for _, category_id in ipairs(Config.Companies.Categories or {}) do
+        categories[#categories + 1] = { id = category_id, name = category_id }
+    end
+    return categories
+end
+
+local function allow_read(source, operation)
+    if not Config.Companies.Enabled then
+        return nil, { success = false, error = "service_unavailable" }
+    end
+    local limit = Config.Companies.RateLimits[operation] or Config.Companies.RateLimits.Read
+    if not SkyPhone.AllowOperation(source, "companies_" .. operation:lower(), limit, 60) then
+        return nil, { success = false, error = "rate_limited" }
+    end
+    local session, error_response = SkyPhone.RequireSession(source)
+    if not session then
+        return nil, error_response
+    end
+    return session
+end
+
+local function cleanup_retained_data()
+    local cutoff = os.time() - Config.Companies.RetentionDays * 86400
+    local success = Bridge.Database.Transaction({
+        {
+            query = [[
+                DELETE FROM `sky_phone_company_requests`
+                WHERE `status` IN ('completed', 'cancelled')
+                    AND COALESCE(`completed_at`, `cancelled_at`, `updated_at`) < FROM_UNIXTIME(?)
+            ]],
+            params = { cutoff },
+        },
+        {
+            query = [[
+                DELETE FROM `sky_phone_company_audit`
+                WHERE `created_at` < FROM_UNIXTIME(?)
+            ]],
+            params = { cutoff },
+        },
+        {
+            query = [[
+                DELETE FROM `sky_phone_company_announcements`
+                WHERE (`active` = 0 OR `expires_at` <= CURRENT_TIMESTAMP)
+                    AND `created_at` < FROM_UNIXTIME(?)
+            ]],
+            params = { cutoff },
+        },
+    })
+    if not success then
+        print("[sky_phone] Companies retention cleanup failed.")
+    end
+end
+
+validate_configuration()
+seed_companies()
+tombstone_removed_companies()
+cleanup_retained_data()
+
+CreateThread(function()
+    while true do
+        Wait(24 * 60 * 60 * 1000)
+        cleanup_retained_data()
+    end
+end)
+
+CreateThread(function()
+    while true do
+        Wait(1000)
+        local online = {}
+        for _, player_source in ipairs(Bridge.Framework.GetPlayers()) do
+            online[tonumber(player_source) or player_source] = true
+        end
+        for source, readiness in pairs(call_availability) do
+            local member = online[source] and call_member(source) or nil
+            if not member or member.company_id ~= readiness.company_id
+                or member.definition.ServiceLine.CanCall ~= true
+            then
+                call_availability[source] = nil
+            end
+        end
+    end
+end)
+
+local function company_summary(company)
+    return {
+        id = company.id,
+        name = company.name,
+        categoryId = company.categoryId,
+        categoryName = company.categoryName,
+        verified = company.verified,
+        description = company.description,
+        availability = company.availability,
+        availabilityUpdatedAt = company.availabilityUpdatedAt,
+        acceptsRequests = company.acceptsRequests,
+        phoneNumber = company.phoneNumber,
+        canCall = company.canCall,
+        canMessage = company.canMessage,
+        location = company.location,
+        logoUrl = company.logoUrl,
+        serviceSummary = company.serviceSummary,
+        announcement = company.announcement,
+    }
+end
+
+local function search_score(company, search)
+    if search == "" then
+        return 0
+    end
+    local name = company.name:lower()
+    if name:sub(1, #search) == search then
+        return 4
+    end
+    if name:find(search, 1, true) then
+        return 3
+    end
+    local values = {
+        company.categoryId,
+        company.description,
+        company.location and company.location.district or "",
+        company.location and company.location.address or "",
+        company.serviceSummary,
+    }
+    for _, value in ipairs(values) do
+        if tostring(value):lower():find(search, 1, true) then
+            return 1
+        end
+    end
+    for _, service in ipairs(company.services) do
+        if service.title:lower():find(search, 1, true)
+            or service.description:lower():find(search, 1, true)
+        then
+            return 1
+        end
+    end
+    return -1
+end
+
+Bridge.Callbacks.Register("sky_phone:companies:list", function(source, data)
+    local session, error_response = allow_read(source, "Search")
+    if not session then
+        return error_response
+    end
+    data = type(data) == "table" and data or {}
+    local search = valid_text(data.search or "", 80, true)
+    if not search then
+        return { success = false, error = "invalid_request" }
+    end
+    search = search:lower()
+    local category_id = data.categoryId
+    if category_id ~= nil then
+        local category_valid = false
+        for _, configured in ipairs(Config.Companies.Categories or {}) do
+            if category_id == configured then
+                category_valid = true
+                break
+            end
+        end
+        if not category_valid then
+            return { success = false, error = "invalid_request" }
+        end
+    end
+    local availability = data.availability
+    if availability ~= nil and not Config.Companies.AvailabilityStatuses[availability] then
+        return { success = false, error = "invalid_request" }
+    end
+    if data.acceptsRequests ~= nil and type(data.acceptsRequests) ~= "boolean" then
+        return { success = false, error = "invalid_request" }
+    end
+    if data.hasLocation ~= nil and type(data.hasLocation) ~= "boolean" then
+        return { success = false, error = "invalid_request" }
+    end
+    local sort = data.sort or "relevance"
+    if sort ~= "relevance" and sort ~= "name" and sort ~= "updated" then
+        return { success = false, error = "invalid_request" }
+    end
+    local cursor = data.cursor == nil and 0 or valid_integer(data.cursor, 0, 100000)
+    if not cursor then
+        return { success = false, error = "invalid_request" }
+    end
+
+    local matches = {}
+    for _, company_id in ipairs(definition_ids) do
+        local company = public_company(company_id)
+        if company then
+            local score = search_score(company, search)
+            if score >= 0
+                and (not category_id or company.categoryId == category_id)
+                and (not availability or company.availability == availability)
+                and (data.acceptsRequests ~= true or company.acceptsRequests)
+                and (data.hasLocation ~= true or company.location ~= nil)
+            then
+                matches[#matches + 1] = { company = company, score = score }
+            end
+        end
+    end
+    table.sort(matches, function(left, right)
+        if sort == "updated" and left.company.updatedAtUnix ~= right.company.updatedAtUnix then
+            return left.company.updatedAtUnix > right.company.updatedAtUnix
+        end
+        if sort == "relevance" and left.score ~= right.score then
+            return left.score > right.score
+        end
+        local left_name = left.company.name:lower()
+        local right_name = right.company.name:lower()
+        return left_name == right_name and left.company.id < right.company.id or left_name < right_name
+    end)
+
+    local companies = {}
+    local page_size = math.min(Config.Companies.PageSize, Config.Companies.MaximumPageSize)
+    local last_index = math.min(#matches, cursor + page_size)
+    for index = cursor + 1, last_index do
+        companies[#companies + 1] = company_summary(matches[index].company)
+    end
+    return {
+        success = true,
+        data = {
+            companies = companies,
+            categories = category_payloads(),
+            nextCursor = last_index < #matches and tostring(last_index) or nil,
+        },
+    }
+end)
+
+Bridge.Callbacks.Register("sky_phone:companies:get", function(source, data)
+    local session, error_response = allow_read(source, "Read")
+    if not session then
+        return error_response
+    end
+    local company_id = type(data) == "table" and data.companyId or nil
+    local company = type(company_id) == "string" and public_company(company_id) or nil
+    if not company then
+        return { success = false, error = "company_not_found" }
+    end
+    company.updatedAtUnix = nil
+    return { success = true, data = { company = company } }
+end)
+
+local function decode_request_cursor(value)
+    if value == nil then
+        return nil, nil
+    end
+    if type(value) ~= "string" or #value > 64 then
+        return false, false
+    end
+    local timestamp, request_id = value:match("^(%d+):(.+)$")
+    timestamp = valid_integer(timestamp, 1, 4102444800)
+    if not timestamp or not valid_uuid(request_id) then
+        return false, false
+    end
+    return timestamp, request_id
+end
+
+local function encode_request_cursor(row)
+    return ("%s:%s"):format(tostring(math.floor(tonumber(row.updated_at_unix) or 0)), row.id)
+end
+
+local function request_row(request_id)
+    local rows = Bridge.Database.Query([[
+        SELECT r.`id`, r.`company_id`, r.`service_id`, r.`customer_sim_id`, r.`subject`, r.`description`,
+            r.`status`, r.`assigned_identifier`, r.`customer_unread`,
+            r.`company_activity_revision`, r.`revision`,
+            UNIX_TIMESTAMP(r.`created_at`) AS `created_at_unix`,
+            UNIX_TIMESTAMP(r.`updated_at`) AS `updated_at_unix`, service.`title` AS `service_title`,
+            logo.`url` AS `company_logo_url`
+        FROM `sky_phone_company_requests` r
+        LEFT JOIN `sky_phone_company_services` service ON service.`id` = r.`service_id`
+        LEFT JOIN `sky_phone_company_profiles` profile ON profile.`company_id` = r.`company_id`
+        LEFT JOIN `sky_phone_media` logo ON logo.`id` = profile.`logo_media_id`
+        WHERE r.`id` = ?
+        LIMIT 1
+    ]], { request_id })
+    return rows[1]
+end
+
+local function request_summary(row, audience, identifier)
+    local definition = definitions[row.company_id]
+    local assigned_label = nil
+    if row.assigned_identifier then
+        assigned_label = identifier and row.assigned_identifier == identifier and "you" or "assigned"
+    end
+    local unread_count
+    if audience == "customer" then
+        unread_count = tonumber(row.customer_unread) or 0
+    else
+        local relevant = not terminal_statuses[row.status]
+            and (row.status == "new" or row.assigned_identifier == identifier)
+        unread_count = relevant and math.max(
+            0,
+            (tonumber(row.company_activity_revision) or 1)
+                - (tonumber(row.company_read_revision) or 0)
+        ) or 0
+    end
+    return {
+        id = row.id,
+        companyId = row.company_id,
+        companyName = definition and definition.Name or row.company_id,
+        companyLogoUrl = row.company_logo_url,
+        serviceId = row.service_id,
+        serviceName = row.service_title,
+        subject = row.subject,
+        status = row.status,
+        assignedLabel = assigned_label,
+        unreadCount = unread_count,
+        createdAt = iso_time(row.created_at_unix),
+        updatedAt = iso_time(row.updated_at_unix),
+    }
+end
+
+local function request_access(source, request_id)
+    local session, error_response = SkyPhone.RequireSession(source)
+    if not session then
+        return nil, error_response
+    end
+    local row = request_row(request_id)
+    if not row then
+        return nil, { success = false, error = "request_not_found" }
+    end
+    local device = SkyPhone.LoadDevice(session.imei)
+    if not device then
+        return nil, { success = false, error = "request_failed" }
+    end
+    if device.sim_id and device.sim_id == row.customer_sim_id
+        and device.sim_type == "registered" and device.registered_at
+    then
+        return { audience = "customer", row = row, device = device }
+    end
+    local member = membership(source)
+    if not member or member.company_id ~= row.company_id
+        or member.grade < permission_grade(member.definition, "WorkQueue")
+    then
+        return nil, { success = false, error = "request_not_found" }
+    end
+    local identifier = Bridge.Framework.GetIdentifier(source)
+    if type(identifier) ~= "string" or identifier == "" then
+        return nil, { success = false, error = "not_authorized" }
+    end
+    member.identifier = identifier
+    return { audience = "company", row = row, device = device, member = member }
+end
+
+local function can_handle_request(access)
+    if access.audience ~= "company" then
+        return false
+    end
+    return access.row.assigned_identifier == access.member.identifier
+        or access.member.grade >= permission_grade(access.member.definition, "Assign")
+end
+
+local function request_actions(access)
+    local row = access.row
+    local definition = definitions[row.company_id]
+    local active = not terminal_statuses[row.status]
+    if access.audience == "customer" then
+        return {
+            allowedStatuses = {},
+            canAssign = false,
+            canCall = definition ~= nil and definition.ServiceLine.CanCall == true,
+            canCancel = active,
+            canClaim = false,
+            canReply = active,
+        }
+    end
+    local handler = can_handle_request(access)
+    local allowed = {}
+    if handler then
+        for _, status in ipairs({ "in_progress", "waiting_customer", "completed", "cancelled" }) do
+            if status_transitions[row.status] and status_transitions[row.status][status] then
+                allowed[#allowed + 1] = status
+            end
+        end
+    end
+    return {
+        allowedStatuses = allowed,
+        canAssign = active and access.member.grade >= permission_grade(access.member.definition, "Assign"),
+        canCall = active
+            and access.member.definition.ServiceLine.CanCall == true
+            and access.member.grade >= (tonumber(access.member.definition.ServiceLine.MinimumGrade) or 0),
+        canCancel = active and handler,
+        canClaim = row.status == "new" and not row.assigned_identifier,
+        canReply = active and handler,
+    }
+end
+
+local function request_detail(access)
+    local row = request_row(access.row.id)
+    if not row then
+        return nil
+    end
+    access.row = row
+    if access.audience == "customer" then
+        Bridge.Database.Query(
+            "UPDATE `sky_phone_company_requests` SET `customer_unread` = 0, `updated_at` = `updated_at` WHERE `id` = ?",
+            { row.id }
+        )
+        row.customer_unread = 0
+    else
+        Bridge.Database.Query([[
+            INSERT INTO `sky_phone_company_request_reads`
+                (`request_id`, `reader_identifier`, `read_revision`)
+            VALUES (?, ?, ?)
+            ON DUPLICATE KEY UPDATE
+                `read_revision` = GREATEST(`read_revision`, VALUES(`read_revision`)),
+                `updated_at` = CURRENT_TIMESTAMP
+        ]], { row.id, access.member.identifier, row.company_activity_revision })
+        row.company_read_revision = row.company_activity_revision
+    end
+    local messages = Bridge.Database.Query([[
+        SELECT `id`, `sender_type`, `sender_identifier`, `sender_sim_id`, `body`,
+            UNIX_TIMESTAMP(`created_at`) AS `created_at_unix`
+        FROM `sky_phone_company_request_messages`
+        WHERE `request_id` = ?
+        ORDER BY `created_at`, `id`
+    ]], { row.id })
+    local message_payloads = {}
+    for _, message in ipairs(messages) do
+        local mine = access.audience == "customer"
+            and message.sender_type == "customer" and message.sender_sim_id == row.customer_sim_id
+            or access.audience == "company"
+                and message.sender_type == "company" and message.sender_identifier == access.member.identifier
+        message_payloads[#message_payloads + 1] = {
+            id = message.id,
+            author = message.sender_type,
+            authorLabel = mine and "you" or message.sender_type,
+            body = message.body,
+            createdAt = iso_time(message.created_at_unix),
+            isMine = mine,
+        }
+    end
+    local events = Bridge.Database.Query([[
+        SELECT `id`, `event_type`, `to_status`, UNIX_TIMESTAMP(`created_at`) AS `created_at_unix`
+        FROM `sky_phone_company_request_events`
+        WHERE `request_id` = ?
+        ORDER BY `created_at`, `id`
+    ]], { row.id })
+    local event_payloads = {}
+    for _, event in ipairs(events) do
+        local event_type = event.event_type
+        if event_type == "status" then
+            event_type = event.to_status == "completed" and "completed" or "status_changed"
+        end
+        event_payloads[#event_payloads + 1] = {
+            id = event.id,
+            type = event_type,
+            status = event.to_status,
+            createdAt = iso_time(event.created_at_unix),
+        }
+    end
+    local media_rows = Bridge.Database.Query([[
+        SELECT media.`id`, media.`url`
+        FROM `sky_phone_company_request_media` request_media
+        INNER JOIN `sky_phone_media` media ON media.`id` = request_media.`media_id`
+        WHERE request_media.`request_id` = ?
+        ORDER BY request_media.`sort_order`
+    ]], { row.id })
+    local payload = request_summary(
+        row,
+        access.audience,
+        access.member and access.member.identifier or nil
+    )
+    payload.description = row.description
+    payload.revision = tonumber(row.revision) or 1
+    local definition = definitions[row.company_id]
+    payload.phoneNumber = definition and definition.ServiceLine.Number or nil
+    payload.messages = message_payloads
+    payload.events = event_payloads
+    payload.media = media_rows
+    payload.actions = request_actions(access)
+    return payload
+end
+
+local function list_request_rows(query, parameters, audience, identifier)
+    local rows = Bridge.Database.Query(query, parameters)
+    local has_more = #rows > Config.Companies.PageSize
+    if has_more then
+        rows[#rows] = nil
+    end
+    local requests = {}
+    for _, row in ipairs(rows) do
+        requests[#requests + 1] = request_summary(row, audience, identifier)
+    end
+    return requests, has_more and encode_request_cursor(rows[#rows]) or nil
+end
+
+local request_list_select = [[
+    SELECT r.`id`, r.`company_id`, r.`service_id`, r.`customer_sim_id`, r.`subject`, r.`status`,
+        r.`assigned_identifier`, r.`customer_unread`, r.`company_activity_revision`, r.`revision`,
+        UNIX_TIMESTAMP(r.`created_at`) AS `created_at_unix`,
+        UNIX_TIMESTAMP(r.`updated_at`) AS `updated_at_unix`, service.`title` AS `service_title`,
+        logo.`url` AS `company_logo_url`, NULL AS `company_read_revision`
+    FROM `sky_phone_company_requests` r
+    LEFT JOIN `sky_phone_company_services` service ON service.`id` = r.`service_id`
+    LEFT JOIN `sky_phone_company_profiles` profile ON profile.`company_id` = r.`company_id`
+    LEFT JOIN `sky_phone_media` logo ON logo.`id` = profile.`logo_media_id`
+]]
+
+local company_request_list_select = [[
+    SELECT r.`id`, r.`company_id`, r.`service_id`, r.`customer_sim_id`, r.`subject`, r.`status`,
+        r.`assigned_identifier`, r.`customer_unread`, r.`company_activity_revision`, r.`revision`,
+        UNIX_TIMESTAMP(r.`created_at`) AS `created_at_unix`,
+        UNIX_TIMESTAMP(r.`updated_at`) AS `updated_at_unix`, service.`title` AS `service_title`,
+        logo.`url` AS `company_logo_url`, company_read.`read_revision` AS `company_read_revision`
+    FROM `sky_phone_company_requests` r
+    LEFT JOIN `sky_phone_company_services` service ON service.`id` = r.`service_id`
+    LEFT JOIN `sky_phone_company_profiles` profile ON profile.`company_id` = r.`company_id`
+    LEFT JOIN `sky_phone_media` logo ON logo.`id` = profile.`logo_media_id`
+    LEFT JOIN `sky_phone_company_request_reads` company_read
+        ON company_read.`request_id` = r.`id` AND company_read.`reader_identifier` = ?
+]]
+
+local function context_request_rows(company_id, identifier, own)
+    local condition = own
+        and " AND r.`assigned_identifier` = ? AND r.`status` NOT IN ('completed', 'cancelled')"
+        or ""
+    local parameters = { identifier, company_id }
+    if own then
+        parameters[#parameters + 1] = identifier
+    end
+    parameters[#parameters + 1] = 4
+    local rows = Bridge.Database.Query(company_request_list_select .. ([=[
+        WHERE r.`company_id` = ?%s
+        ORDER BY r.`updated_at` DESC, r.`id` DESC
+        LIMIT ?
+    ]=]):format(condition), parameters)
+    local requests = {}
+    for _, row in ipairs(rows) do
+        requests[#requests + 1] = request_summary(row, "company", identifier)
+    end
+    return requests
+end
+
+local function work_context(source)
+    local member = membership(source)
+    if not member or member.grade < permission_grade(member.definition, "WorkQueue") then
+        return {
+            authorized = false,
+            callAvailable = false,
+            company = nil,
+            metrics = { assigned = 0, completedToday = 0, new = 0, waiting = 0 },
+            ownRequests = {},
+            recentRequests = {},
+            permissions = {
+                canAssign = false,
+                canManageAnnouncement = false,
+                canManageHours = false,
+                canManageProfile = false,
+                canManageServices = false,
+                canSetAvailability = false,
+                canTakeCalls = false,
+            },
+            role = nil,
+            unreadCount = 0,
+        }
+    end
+    local identifier = Bridge.Framework.GetIdentifier(source)
+    if type(identifier) ~= "string" or identifier == "" then
+        return nil
+    end
+    member.identifier = identifier
+    local rows = Bridge.Database.Query([[
+        SELECT
+            COALESCE(SUM(request.`status` = 'new'), 0) AS `new_count`,
+            COALESCE(SUM(request.`assigned_identifier` = ?
+                AND request.`status` NOT IN ('completed', 'cancelled')), 0) AS `assigned_count`,
+            COALESCE(SUM(request.`status` = 'waiting_customer'), 0) AS `waiting_count`,
+            COALESCE(SUM(request.`status` = 'completed'
+                AND DATE(request.`completed_at`) = CURRENT_DATE), 0) AS `completed_today`,
+            COALESCE(SUM(CASE
+                WHEN request.`status` NOT IN ('completed', 'cancelled')
+                    AND (request.`status` = 'new' OR request.`assigned_identifier` = ?)
+                    AND COALESCE(company_read.`read_revision`, 0) < request.`company_activity_revision`
+                    THEN request.`company_activity_revision` - COALESCE(company_read.`read_revision`, 0)
+                ELSE 0
+            END), 0) AS `unread_count`
+        FROM `sky_phone_company_requests` request
+        LEFT JOIN `sky_phone_company_request_reads` company_read
+            ON company_read.`request_id` = request.`id` AND company_read.`reader_identifier` = ?
+        WHERE request.`company_id` = ?
+    ]], { identifier, identifier, identifier, member.company_id })
+    local metrics = rows[1] or {}
+    local permissions = {
+        canAssign = member.grade >= permission_grade(member.definition, "Assign"),
+        canManageAnnouncement = member.grade >= permission_grade(member.definition, "Announcement"),
+        canManageHours = member.grade >= permission_grade(member.definition, "Hours"),
+        canManageProfile = member.grade >= permission_grade(member.definition, "Profile"),
+        canManageServices = member.grade >= permission_grade(member.definition, "Services"),
+        canSetAvailability = member.grade >= permission_grade(member.definition, "Availability"),
+        canTakeCalls = member.definition.ServiceLine.CanCall == true
+            and member.grade >= (tonumber(member.definition.ServiceLine.MinimumGrade) or 0),
+    }
+    local manager = permissions.canAssign or permissions.canManageAnnouncement
+        or permissions.canManageHours or permissions.canManageProfile or permissions.canManageServices
+    local readiness = call_availability[source]
+    local company = company_payload(member.company_id, true)
+    company.updatedAtUnix = nil
+    return {
+        authorized = true,
+        callAvailable = permissions.canTakeCalls and readiness ~= nil
+            and readiness.company_id == member.company_id,
+        company = company,
+        metrics = {
+            new = tonumber(metrics.new_count) or 0,
+            assigned = tonumber(metrics.assigned_count) or 0,
+            waiting = tonumber(metrics.waiting_count) or 0,
+            completedToday = tonumber(metrics.completed_today) or 0,
+        },
+        ownRequests = context_request_rows(member.company_id, identifier, true),
+        recentRequests = context_request_rows(member.company_id, identifier, false),
+        permissions = permissions,
+        role = manager and "manager" or "employee",
+        unreadCount = tonumber(metrics.unread_count) or 0,
+    }
+end
+
+local function notify_sim(sim_id, event_name, payload)
+    local devices = Bridge.Database.Query([[
+        SELECT d.`imei`, d.`device_name`, settings.`payload` AS `settings`
+        FROM `sky_phone_devices` d
+        LEFT JOIN `sky_phone_device_data` settings
+            ON settings.`device_imei` = d.`imei` AND settings.`namespace` = 'settings'
+        WHERE d.`sim_id` = ?
+    ]], { sim_id })
+    for _, device in ipairs(devices) do
+        for _, player_source in ipairs(Bridge.Framework.GetPlayers()) do
+            local target = tonumber(player_source) or player_source
+            if SkyPhone.FindDeviceSlots(target, device.imei)[1] then
+                local event_payload = {}
+                for key, value in pairs(payload) do
+                    event_payload[key] = value
+                end
+                event_payload.device = {
+                    imei = device.imei,
+                    name = device.device_name,
+                    settings = device.settings,
+                }
+                TriggerClientEvent(event_name, target, event_payload)
+            end
+        end
+    end
+end
+
+local function notify_source(source, event_name, payload)
+    local session = SkyPhone.RequireSession(source)
+    if not session then
+        return
+    end
+    local rows = Bridge.Database.Query([[
+        SELECT d.`device_name`, settings.`payload` AS `settings`
+        FROM `sky_phone_devices` d
+        LEFT JOIN `sky_phone_device_data` settings
+            ON settings.`device_imei` = d.`imei` AND settings.`namespace` = 'settings'
+        WHERE d.`imei` = ?
+        LIMIT 1
+    ]], { session.imei })
+    if not rows[1] then
+        return
+    end
+    local event_payload = {}
+    for key, value in pairs(payload) do
+        event_payload[key] = value
+    end
+    event_payload.device = {
+        imei = session.imei,
+        name = rows[1].device_name,
+        settings = rows[1].settings,
+    }
+    TriggerClientEvent(event_name, source, event_payload)
+end
+
+local function notify_company(company_id, event_name, payload, excluded_source)
+    local definition = definitions[company_id]
+    if not definition then
+        return
+    end
+    for _, player_source in ipairs(Bridge.Framework.GetPlayers()) do
+        local target = tonumber(player_source) or player_source
+        if target ~= excluded_source then
+            local job = Bridge.Framework.GetJob(target)
+            if job.name == definition.Job and (tonumber(job.grade) or 0) >= permission_grade(definition, "WorkQueue") then
+                notify_source(target, event_name, payload)
+            end
+        end
+    end
+end
+
+local function notify_identifier(identifier, company_id, event_name, payload)
+    for _, player_source in ipairs(Bridge.Framework.GetPlayers()) do
+        local target = tonumber(player_source) or player_source
+        local member = membership(target)
+        if member and member.company_id == company_id
+            and member.grade >= permission_grade(member.definition, "WorkQueue")
+            and Bridge.Framework.GetIdentifier(target) == identifier
+        then
+            notify_source(target, event_name, payload)
+        end
+    end
+end
+
+local function emit_public_change(company_id)
+    local definition = definitions[company_id]
+    if not definition then
+        return
+    end
+    notify_company(company_id, "sky_phone:companies:changed", {
+        area = "work",
+        companyId = company_id,
+    })
+    if not definition.Public then
+        return
+    end
+    for _, player_source in ipairs(Bridge.Framework.GetPlayers()) do
+        notify_source(tonumber(player_source) or player_source, "sky_phone:companies:changed", {
+            area = "directory",
+            companyId = company_id,
+        })
+    end
+end
+
+local function emit_request_change(row, customer, company, excluded_source)
+    local payload = {
+        area = customer and "customer" or "work",
+        companyId = row.company_id,
+        requestId = row.id,
+    }
+    if customer then
+        notify_sim(row.customer_sim_id, "sky_phone:companies:changed", payload)
+    end
+    if company then
+        payload = {
+            area = "work",
+            companyId = row.company_id,
+            requestId = row.id,
+        }
+        notify_company(row.company_id, "sky_phone:companies:changed", payload, excluded_source)
+    end
+end
+
+Bridge.Callbacks.Register("sky_phone:companies:my-requests", function(source, data)
+    local session, error_response = allow_read(source, "Read")
+    if not session then
+        return error_response
+    end
+    local device, device_error = current_device(source, true)
+    if not device then
+        return device_error
+    end
+    data = type(data) == "table" and data or {}
+    local list = data.list or "open"
+    if list ~= "open" and list ~= "closed" then
+        return { success = false, error = "invalid_request" }
+    end
+    local cursor_time, cursor_id = decode_request_cursor(data.cursor)
+    if cursor_time == false then
+        return { success = false, error = "invalid_request" }
+    end
+    local status_condition = list == "open"
+        and "r.`status` NOT IN ('completed', 'cancelled')"
+        or "r.`status` IN ('completed', 'cancelled')"
+    local cursor_condition = ""
+    local parameters = { device.sim_id }
+    if cursor_time then
+        cursor_condition = [[
+            AND (r.`updated_at` < FROM_UNIXTIME(?)
+                OR (r.`updated_at` = FROM_UNIXTIME(?) AND r.`id` < ?))
+        ]]
+        parameters[#parameters + 1] = cursor_time
+        parameters[#parameters + 1] = cursor_time
+        parameters[#parameters + 1] = cursor_id
+    end
+    parameters[#parameters + 1] = Config.Companies.PageSize + 1
+    local requests, next_cursor = list_request_rows(request_list_select .. ([=[
+        WHERE r.`customer_sim_id` = ? AND %s %s
+        ORDER BY r.`updated_at` DESC, r.`id` DESC
+        LIMIT ?
+    ]=]):format(status_condition, cursor_condition), parameters, "customer")
+    local unread_rows = Bridge.Database.Query([[
+        SELECT COALESCE(SUM(`customer_unread`), 0) AS `unread_count`
+        FROM `sky_phone_company_requests`
+        WHERE `customer_sim_id` = ?
+    ]], { device.sim_id })
+    return {
+        success = true,
+        data = {
+            requests = requests,
+            nextCursor = next_cursor,
+            unreadCount = tonumber(unread_rows[1] and unread_rows[1].unread_count) or 0,
+        },
+    }
+end)
+
+Bridge.Callbacks.Register("sky_phone:companies:get-request", function(source, data)
+    local session, error_response = allow_read(source, "Read")
+    if not session then
+        return error_response
+    end
+    local request_id = type(data) == "table" and data.requestId or nil
+    if not valid_uuid(request_id) then
+        return { success = false, error = "invalid_request" }
+    end
+    local access, access_error = request_access(source, request_id)
+    if not access then
+        return access_error
+    end
+    local request = request_detail(access)
+    if not request then
+        return { success = false, error = "request_not_found" }
+    end
+    return { success = true, data = { request = request } }
+end)
+
+Bridge.Callbacks.Register("sky_phone:companies:work-context", function(source)
+    local session, error_response = allow_read(source, "Read")
+    if not session then
+        return error_response
+    end
+    local context = work_context(source)
+    if not context then
+        return { success = false, error = "not_authorized" }
+    end
+    return { success = true, data = { context = context } }
+end)
+
+Bridge.Callbacks.Register("sky_phone:companies:work-queue", function(source, data)
+    local session, error_response = allow_read(source, "Read")
+    if not session then
+        return error_response
+    end
+    local member, member_error = require_permission(source, "WorkQueue")
+    if not member then
+        return member_error
+    end
+    data = type(data) == "table" and data or {}
+    local filter = data.filter or "new"
+    local filters = {
+        new = "r.`status` = 'new'",
+        assigned = "r.`assigned_identifier` = ? AND r.`status` NOT IN ('completed', 'cancelled')",
+        in_progress = "r.`status` = 'in_progress'",
+        waiting_customer = "r.`status` = 'waiting_customer'",
+        completed = "r.`status` = 'completed'",
+    }
+    if not filters[filter] then
+        return { success = false, error = "invalid_request" }
+    end
+    local cursor_time, cursor_id = decode_request_cursor(data.cursor)
+    if cursor_time == false then
+        return { success = false, error = "invalid_request" }
+    end
+    local parameters = { member.identifier, member.company_id }
+    if filter == "assigned" then
+        parameters[#parameters + 1] = member.identifier
+    end
+    local cursor_condition = ""
+    if cursor_time then
+        cursor_condition = [[
+            AND (r.`updated_at` < FROM_UNIXTIME(?)
+                OR (r.`updated_at` = FROM_UNIXTIME(?) AND r.`id` < ?))
+        ]]
+        parameters[#parameters + 1] = cursor_time
+        parameters[#parameters + 1] = cursor_time
+        parameters[#parameters + 1] = cursor_id
+    end
+    parameters[#parameters + 1] = Config.Companies.PageSize + 1
+    local requests, next_cursor = list_request_rows(company_request_list_select .. ([=[
+        WHERE r.`company_id` = ? AND %s %s
+        ORDER BY r.`updated_at` DESC, r.`id` DESC
+        LIMIT ?
+    ]=]):format(filters[filter], cursor_condition), parameters, "company", member.identifier)
+    return { success = true, data = { requests = requests, nextCursor = next_cursor } }
+end)
+
+local function member_token(target, company_id, identifier)
+    local entry = member_tokens[target]
+    if not entry or entry.company_id ~= company_id or entry.identifier ~= identifier
+        or os.time() - entry.created_at > 300
+    then
+        entry = {
+            token = uuid(),
+            company_id = company_id,
+            identifier = identifier,
+            created_at = os.time(),
+        }
+        member_tokens[target] = entry
+    end
+    return entry.token
+end
+
+Bridge.Callbacks.Register("sky_phone:companies:list-members", function(source)
+    local session, error_response = allow_read(source, "Read")
+    if not session then
+        return error_response
+    end
+    local member, member_error = require_permission(source, "Assign")
+    if not member then
+        return member_error
+    end
+    local members = {}
+    for _, player_source in ipairs(Bridge.Framework.GetPlayers()) do
+        local target = tonumber(player_source) or player_source
+        local target_member = membership(target)
+        local target_identifier = target_member and Bridge.Framework.GetIdentifier(target) or nil
+        if target_member and target_member.company_id == member.company_id
+            and target_member.grade >= permission_grade(target_member.definition, "WorkQueue")
+            and type(target_identifier) == "string" and target_identifier ~= ""
+        then
+            local first_name = trim(Bridge.Framework.GetFirstname(target) or "") or ""
+            local last_name = trim(Bridge.Framework.GetLastname(target) or "") or ""
+            local name = trim(first_name .. " " .. last_name)
+            members[#members + 1] = {
+                id = member_token(target, member.company_id, target_identifier),
+                name = name,
+                online = true,
+                role = target_member.grade_label,
+            }
+        end
+    end
+    table.sort(members, function(left, right)
+        return left.name:lower() < right.name:lower()
+    end)
+    return { success = true, data = { members = members } }
+end)
+
+local function allow_mutation(source, operation, limit_name)
+    if not Config.Companies.Enabled then
+        return false, { success = false, error = "service_unavailable" }
+    end
+    local limit = Config.Companies.RateLimits[limit_name]
+    if not SkyPhone.AllowOperation(source, "companies_" .. operation, limit, 60) then
+        return false, { success = false, error = "rate_limited" }
+    end
+    local session, error_response = SkyPhone.RequireSession(source)
+    if not session then
+        return false, error_response
+    end
+    return true
+end
+
+local function mutation_request_payload(source, request_id)
+    local access, access_error = request_access(source, request_id)
+    if not access then
+        return nil, access_error
+    end
+    local request = request_detail(access)
+    if not request then
+        return nil, { success = false, error = "request_not_found" }
+    end
+    local data = { request = request }
+    if access.audience == "company" then
+        data.context = work_context(source)
+    end
+    return data
+end
+
+local function notification_payload(kind, area, row)
+    return {
+        kind = kind,
+        area = area,
+        companyId = row.company_id,
+        requestId = row.id,
+    }
+end
+
+Bridge.Callbacks.Register("sky_phone:companies:create-request", function(source, data)
+    local allowed, rate_error = allow_mutation(source, "create_request", "CreateRequest")
+    if not allowed then
+        return rate_error
+    end
+    local device, device_error = current_device(source, true)
+    if not device then
+        return device_error
+    end
+    if type(data) ~= "table" then
+        return { success = false, error = "invalid_request" }
+    end
+    local company_id = data.companyId
+    local definition = type(company_id) == "string" and definitions[company_id] or nil
+    if not definition or not definition.Public or definition.Emergency then
+        return { success = false, error = "company_not_found" }
+    end
+    local subject = valid_text(data.subject, Config.Companies.SubjectMaxLength, false)
+    local description = valid_text(data.description, Config.Companies.RequestBodyMaxLength, false)
+    if not subject or not description or not valid_service_id(data.serviceId) then
+        return { success = false, error = "invalid_request" }
+    end
+    local profiles = Bridge.Database.Query(
+        "SELECT `accepts_requests` FROM `sky_phone_company_profiles` WHERE `company_id` = ? LIMIT 1",
+        { company_id }
+    )
+    if not profiles[1] or tonumber(profiles[1].accepts_requests) ~= 1 then
+        return { success = false, error = "invalid_service" }
+    end
+    local services = Bridge.Database.Query([[
+        SELECT `id` FROM `sky_phone_company_services`
+        WHERE `id` = ? AND `company_id` = ? AND `archived` = 0
+            AND `active` = 1 AND `requests_enabled` = 1
+        LIMIT 1
+    ]], { data.serviceId, company_id })
+    if not services[1] then
+        return { success = false, error = "invalid_service" }
+    end
+    local media_ids = data.mediaIds
+    if media_ids == nil then
+        media_ids = {}
+    end
+    if not valid_array(media_ids, Config.Companies.MaximumRequestMedia) then
+        return { success = false, error = "invalid_media" }
+    end
+    local media_seen = {}
+    local normalized_media = {}
+    for _, media_id in ipairs(media_ids) do
+        local normalized = valid_integer(media_id, 1, 9007199254740991)
+        if not normalized or media_seen[normalized]
+            or not SkyPhoneMedia.ResolveOwnedMedia(source, normalized, "photo")
+        then
+            return { success = false, error = "invalid_media" }
+        end
+        media_seen[normalized] = true
+        normalized_media[#normalized_media + 1] = normalized
+    end
+    local counts = Bridge.Database.Query([[
+        SELECT COUNT(*) AS `count`
+        FROM `sky_phone_company_requests`
+        WHERE `customer_sim_id` = ? AND `status` NOT IN ('completed', 'cancelled')
+    ]], { device.sim_id })
+    if (tonumber(counts[1] and counts[1].count) or 0) >= Config.Companies.MaximumOpenRequestsPerSim then
+        return { success = false, error = "too_many_open_requests" }
+    end
+    local request_id = uuid()
+    local event_id = uuid()
+    local statements = {
+        {
+            query = "UPDATE `sky_phone_sims` SET `updated_at` = `updated_at` WHERE `id` = ?",
+            params = { device.sim_id },
+        },
+        {
+            query = [[
+                INSERT INTO `sky_phone_company_requests`
+                    (`id`, `company_id`, `service_id`, `customer_sim_id`, `subject`, `description`)
+                SELECT ?, profile.`company_id`, service.`id`, sim.`id`, ?, ?
+                FROM `sky_phone_sims` sim
+                INNER JOIN `sky_phone_company_profiles` profile ON profile.`company_id` = ?
+                INNER JOIN `sky_phone_company_services` service
+                    ON service.`id` = ? AND service.`company_id` = profile.`company_id`
+                WHERE sim.`id` = ? AND profile.`accepts_requests` = 1
+                    AND service.`archived` = 0 AND service.`active` = 1
+                    AND service.`requests_enabled` = 1 AND (
+                    SELECT COUNT(*) FROM `sky_phone_company_requests`
+                    WHERE `customer_sim_id` = ? AND `status` NOT IN ('completed', 'cancelled')
+                ) < ?
+            ]],
+            params = {
+                request_id,
+                subject,
+                description,
+                company_id,
+                data.serviceId,
+                device.sim_id,
+                device.sim_id,
+                Config.Companies.MaximumOpenRequestsPerSim,
+            },
+        },
+        {
+            query = [[
+                INSERT INTO `sky_phone_company_request_events`
+                    (`id`, `request_id`, `event_type`, `actor_type`, `to_status`)
+                SELECT ?, `id`, 'created', 'customer', 'new'
+                FROM `sky_phone_company_requests` WHERE `id` = ?
+            ]],
+            params = { event_id, request_id },
+        },
+    }
+    for index, media_id in ipairs(normalized_media) do
+        statements[#statements + 1] = {
+            query = [[
+                INSERT INTO `sky_phone_company_request_media` (`request_id`, `media_id`, `sort_order`)
+                SELECT `id`, ?, ? FROM `sky_phone_company_requests` WHERE `id` = ?
+            ]],
+            params = { media_id, index, request_id },
+        }
+    end
+    if not Bridge.Database.Transaction(statements) then
+        return { success = false, error = "request_failed" }
+    end
+    local row = request_row(request_id)
+    if not row then
+        local available = Bridge.Database.Query([[
+            SELECT service.`id`
+            FROM `sky_phone_company_profiles` profile
+            INNER JOIN `sky_phone_company_services` service ON service.`company_id` = profile.`company_id`
+            WHERE profile.`company_id` = ? AND profile.`accepts_requests` = 1
+                AND service.`id` = ? AND service.`archived` = 0
+                AND service.`active` = 1 AND service.`requests_enabled` = 1
+            LIMIT 1
+        ]], { company_id, data.serviceId })
+        if not available[1] then
+            return { success = false, error = "invalid_service" }
+        end
+        return { success = false, error = "too_many_open_requests" }
+    end
+    emit_request_change(row, true, true, source)
+    notify_company(company_id, "sky_phone:companies:notification", notification_payload(
+        "newRequest",
+        "work",
+        row
+    ), source)
+    local payload, payload_error = mutation_request_payload(source, request_id)
+    if not payload then
+        return payload_error
+    end
+    return { success = true, data = payload }
+end)
+
+Bridge.Callbacks.Register("sky_phone:companies:cancel-request", function(source, data)
+    local allowed, rate_error = allow_mutation(source, "cancel_request", "RequestAction")
+    if not allowed then
+        return rate_error
+    end
+    local request_id = type(data) == "table" and data.requestId or nil
+    local revision = type(data) == "table" and valid_integer(data.revision, 1, 4294967295) or nil
+    if not valid_uuid(request_id) or not revision then
+        return { success = false, error = "invalid_request" }
+    end
+    local access, access_error = request_access(source, request_id)
+    if not access then
+        return access_error
+    end
+    if terminal_statuses[access.row.status]
+        or (access.audience == "company" and not can_handle_request(access))
+    then
+        return { success = false, error = "invalid_status" }
+    end
+    local actor_type = access.audience
+    local customer_unread_update = actor_type == "company"
+        and ", `customer_unread` = `customer_unread` + 1" or ""
+    local mutation_token = uuid()
+    local event_id = uuid()
+    local event_query
+    local event_params
+    if actor_type == "customer" then
+        event_query = [[
+            INSERT INTO `sky_phone_company_request_events`
+                (`id`, `request_id`, `event_type`, `actor_type`, `from_status`, `to_status`)
+            SELECT ?, `id`, 'cancelled', 'customer', ?, 'cancelled'
+            FROM `sky_phone_company_requests`
+            WHERE `id` = ? AND `revision` = ? AND `mutation_token` = ?
+        ]]
+        event_params = { event_id, access.row.status, request_id, revision + 1, mutation_token }
+    else
+        event_query = [[
+            INSERT INTO `sky_phone_company_request_events`
+                (`id`, `request_id`, `event_type`, `actor_type`, `actor_identifier`, `from_status`, `to_status`)
+            SELECT ?, `id`, 'cancelled', 'company', ?, ?, 'cancelled'
+            FROM `sky_phone_company_requests`
+            WHERE `id` = ? AND `revision` = ? AND `mutation_token` = ?
+        ]]
+        event_params = {
+            event_id,
+            access.member.identifier,
+            access.row.status,
+            request_id,
+            revision + 1,
+            mutation_token,
+        }
+    end
+    if not Bridge.Database.Transaction({
+        {
+            query = (([[
+                UPDATE `sky_phone_company_requests`
+                SET `status` = 'cancelled', `revision` = `revision` + 1,
+                    `cancelled_at` = CURRENT_TIMESTAMP, `mutation_token` = ?%s
+                WHERE `id` = ? AND `revision` = ? AND `status` = ?
+            ]])):format(customer_unread_update),
+            params = { mutation_token, request_id, revision, access.row.status },
+        },
+        { query = event_query, params = event_params },
+    }) then
+        return { success = false, error = "request_failed" }
+    end
+    local committed = Bridge.Database.Query(
+        "SELECT `id` FROM `sky_phone_company_request_events` WHERE `id` = ? LIMIT 1",
+        { event_id }
+    )
+    if not committed[1] then
+        return { success = false, error = "revision_conflict" }
+    end
+    local row = request_row(request_id)
+    emit_request_change(row, true, true, source)
+    if actor_type == "customer" then
+        notify_company(row.company_id, "sky_phone:companies:notification", notification_payload(
+            "requestUpdated",
+            "work",
+            row
+        ), source)
+    else
+        notify_sim(row.customer_sim_id, "sky_phone:companies:notification", notification_payload(
+            "requestUpdated",
+            "customer",
+            row
+        ))
+    end
+    local payload, payload_error = mutation_request_payload(source, request_id)
+    if not payload then
+        return payload_error
+    end
+    return { success = true, data = payload }
+end)
+
+Bridge.Callbacks.Register("sky_phone:companies:send-message", function(source, data)
+    local allowed, rate_error = allow_mutation(source, "send_message", "Message")
+    if not allowed then
+        return rate_error
+    end
+    local request_id = type(data) == "table" and data.requestId or nil
+    local revision = type(data) == "table" and valid_integer(data.revision, 1, 4294967295) or nil
+    local body = type(data) == "table" and valid_text(data.body, Config.Companies.MessageMaxLength, false) or nil
+    if not valid_uuid(request_id) or not revision or not body then
+        return { success = false, error = "invalid_request" }
+    end
+    local access, access_error = request_access(source, request_id)
+    if not access then
+        return access_error
+    end
+    if terminal_statuses[access.row.status]
+        or (access.audience == "company" and not can_handle_request(access))
+    then
+        return { success = false, error = "invalid_status" }
+    end
+    local message_id = uuid()
+    local mutation_token = uuid()
+    local new_status = access.audience == "customer" and access.row.status == "waiting_customer"
+        and "in_progress" or access.row.status
+    local audience_unread_update = access.audience == "customer"
+        and ", `company_activity_revision` = `company_activity_revision` + 1"
+        or ", `customer_unread` = `customer_unread` + 1"
+    local statements = {
+        {
+            query = ([[
+                UPDATE `sky_phone_company_requests`
+                SET `status` = ?, `revision` = `revision` + 1, `mutation_token` = ?%s
+                WHERE `id` = ? AND `revision` = ? AND `status` = ?
+                    AND `status` NOT IN ('completed', 'cancelled')
+            ]]):format(audience_unread_update),
+            params = { new_status, mutation_token, request_id, revision, access.row.status },
+        },
+    }
+    if access.audience == "customer" then
+        statements[#statements + 1] = {
+            query = [[
+                INSERT INTO `sky_phone_company_request_messages`
+                    (`id`, `request_id`, `sender_type`, `sender_sim_id`, `body`)
+                SELECT ?, `id`, 'customer', ?, ? FROM `sky_phone_company_requests`
+                WHERE `id` = ? AND `revision` = ? AND `mutation_token` = ?
+            ]],
+            params = { message_id, access.row.customer_sim_id, body, request_id, revision + 1, mutation_token },
+        }
+    else
+        statements[#statements + 1] = {
+            query = [[
+                INSERT INTO `sky_phone_company_request_messages`
+                    (`id`, `request_id`, `sender_type`, `sender_identifier`, `body`)
+                SELECT ?, `id`, 'company', ?, ? FROM `sky_phone_company_requests`
+                WHERE `id` = ? AND `revision` = ? AND `mutation_token` = ?
+            ]],
+            params = { message_id, access.member.identifier, body, request_id, revision + 1, mutation_token },
+        }
+    end
+    if new_status ~= access.row.status then
+        statements[#statements + 1] = {
+            query = [[
+                INSERT INTO `sky_phone_company_request_events`
+                    (`id`, `request_id`, `event_type`, `actor_type`, `from_status`, `to_status`)
+                SELECT ?, `id`, 'status', 'customer', ?, ? FROM `sky_phone_company_requests`
+                WHERE `id` = ? AND `revision` = ? AND `mutation_token` = ?
+            ]],
+            params = { uuid(), access.row.status, new_status, request_id, revision + 1, mutation_token },
+        }
+    end
+    if not Bridge.Database.Transaction(statements) then
+        return { success = false, error = "request_failed" }
+    end
+    local inserted = Bridge.Database.Query(
+        "SELECT `id` FROM `sky_phone_company_request_messages` WHERE `id` = ? LIMIT 1",
+        { message_id }
+    )
+    if not inserted[1] then
+        return { success = false, error = "revision_conflict" }
+    end
+    local row = request_row(request_id)
+    emit_request_change(row, true, true, source)
+    if access.audience == "customer" then
+        local notification = notification_payload("newMessage", "work", row)
+        if row.assigned_identifier then
+            notify_identifier(
+                row.assigned_identifier,
+                row.company_id,
+                "sky_phone:companies:notification",
+                notification
+            )
+        end
+    else
+        notify_sim(row.customer_sim_id, "sky_phone:companies:notification", notification_payload(
+            "newMessage",
+            "customer",
+            row
+        ))
+    end
+    local payload, payload_error = mutation_request_payload(source, request_id)
+    if not payload then
+        return payload_error
+    end
+    return { success = true, data = payload }
+end)
+
+Bridge.Callbacks.Register("sky_phone:companies:claim-request", function(source, data)
+    local allowed, rate_error = allow_mutation(source, "claim_request", "RequestAction")
+    if not allowed then
+        return rate_error
+    end
+    local member, member_error = require_permission(source, "WorkQueue")
+    if not member then
+        return member_error
+    end
+    local request_id = type(data) == "table" and data.requestId or nil
+    local revision = type(data) == "table" and valid_integer(data.revision, 1, 4294967295) or nil
+    if not valid_uuid(request_id) or not revision then
+        return { success = false, error = "invalid_request" }
+    end
+    local mutation_token = uuid()
+    local event_id = uuid()
+    if not Bridge.Database.Transaction({
+        {
+            query = [[
+                UPDATE `sky_phone_company_requests`
+                SET `assigned_identifier` = ?, `status` = 'assigned', `revision` = `revision` + 1,
+                    `customer_unread` = `customer_unread` + 1, `mutation_token` = ?
+                WHERE `id` = ? AND `company_id` = ? AND `revision` = ?
+                    AND `status` = 'new' AND `assigned_identifier` IS NULL
+            ]],
+            params = { member.identifier, mutation_token, request_id, member.company_id, revision },
+        },
+        {
+            query = [[
+                INSERT INTO `sky_phone_company_request_events`
+                    (`id`, `request_id`, `event_type`, `actor_type`, `actor_identifier`, `from_status`, `to_status`)
+                SELECT ?, `id`, 'assigned', 'company', ?, 'new', 'assigned'
+                FROM `sky_phone_company_requests`
+                WHERE `id` = ? AND `revision` = ? AND `mutation_token` = ?
+            ]],
+            params = { event_id, member.identifier, request_id, revision + 1, mutation_token },
+        },
+    }) then
+        return { success = false, error = "request_failed" }
+    end
+    local committed = Bridge.Database.Query(
+        "SELECT `id` FROM `sky_phone_company_request_events` WHERE `id` = ? LIMIT 1",
+        { event_id }
+    )
+    if not committed[1] then
+        local current = Bridge.Database.Query([[
+            SELECT `id` FROM `sky_phone_company_requests`
+            WHERE `id` = ? AND `company_id` = ?
+            LIMIT 1
+        ]], { request_id, member.company_id })
+        return { success = false, error = current[1] and "revision_conflict" or "request_not_found" }
+    end
+    local row = request_row(request_id)
+    emit_request_change(row, true, true, source)
+    notify_sim(row.customer_sim_id, "sky_phone:companies:notification", notification_payload(
+        "assigned",
+        "customer",
+        row
+    ))
+    local payload, payload_error = mutation_request_payload(source, request_id)
+    if not payload then
+        return payload_error
+    end
+    return { success = true, data = payload }
+end)
+
+local function resolve_member(member_id, company_id)
+    if not valid_uuid(member_id) then
+        return nil
+    end
+    local online = {}
+    for _, player_source in ipairs(Bridge.Framework.GetPlayers()) do
+        online[tonumber(player_source) or player_source] = true
+    end
+    for target, token in pairs(member_tokens) do
+        if token.token == member_id and token.company_id == company_id and online[target]
+            and os.time() - token.created_at <= 300
+        then
+            local target_member = membership(target)
+            if not target_member or target_member.company_id ~= company_id
+                or target_member.grade < permission_grade(target_member.definition, "WorkQueue")
+            then
+                return nil
+            end
+            local identifier = Bridge.Framework.GetIdentifier(target)
+            if type(identifier) ~= "string" or identifier == "" or identifier ~= token.identifier then
+                return nil
+            end
+            return { source = target, identifier = identifier }
+        end
+    end
+    return nil
+end
+
+Bridge.Callbacks.Register("sky_phone:companies:assign-request", function(source, data)
+    local allowed, rate_error = allow_mutation(source, "assign_request", "RequestAction")
+    if not allowed then
+        return rate_error
+    end
+    local member, member_error = require_permission(source, "Assign")
+    if not member then
+        return member_error
+    end
+    local request_id = type(data) == "table" and data.requestId or nil
+    local revision = type(data) == "table" and valid_integer(data.revision, 1, 4294967295) or nil
+    local target = type(data) == "table" and resolve_member(data.memberId, member.company_id) or nil
+    if not valid_uuid(request_id) or not revision or not target then
+        return { success = false, error = "invalid_request" }
+    end
+    local row = request_row(request_id)
+    if not row or row.company_id ~= member.company_id then
+        return { success = false, error = "request_not_found" }
+    end
+    if terminal_statuses[row.status] then
+        return { success = false, error = "invalid_status" }
+    end
+    if row.assigned_identifier == target.identifier then
+        return { success = false, error = "invalid_status" }
+    end
+    local next_status = row.status == "new" and "assigned" or row.status
+    local mutation_token = uuid()
+    local event_id = uuid()
+    if not Bridge.Database.Transaction({
+        {
+            query = [[
+                UPDATE `sky_phone_company_requests`
+                SET `assigned_identifier` = ?, `status` = ?, `revision` = `revision` + 1,
+                    `customer_unread` = `customer_unread` + 1,
+                    `company_activity_revision` = `company_activity_revision` + 1,
+                    `mutation_token` = ?
+                WHERE `id` = ? AND `company_id` = ? AND `revision` = ? AND `status` = ?
+                    AND `status` NOT IN ('completed', 'cancelled')
+            ]],
+            params = {
+                target.identifier,
+                next_status,
+                mutation_token,
+                request_id,
+                member.company_id,
+                revision,
+                row.status,
+            },
+        },
+        {
+            query = [[
+                INSERT INTO `sky_phone_company_request_events`
+                    (`id`, `request_id`, `event_type`, `actor_type`, `actor_identifier`, `from_status`, `to_status`)
+                SELECT ?, `id`, 'assigned', 'company', ?, ?, ?
+                FROM `sky_phone_company_requests`
+                WHERE `id` = ? AND `revision` = ? AND `mutation_token` = ?
+            ]],
+            params = {
+                event_id,
+                member.identifier,
+                row.status,
+                next_status,
+                request_id,
+                revision + 1,
+                mutation_token,
+            },
+        },
+    }) then
+        return { success = false, error = "request_failed" }
+    end
+    local committed = Bridge.Database.Query(
+        "SELECT `id` FROM `sky_phone_company_request_events` WHERE `id` = ? LIMIT 1",
+        { event_id }
+    )
+    if not committed[1] then
+        return { success = false, error = "revision_conflict" }
+    end
+    row = request_row(request_id)
+    emit_request_change(row, true, true, source)
+    notify_identifier(
+        target.identifier,
+        row.company_id,
+        "sky_phone:companies:notification",
+        notification_payload("assigned", "work", row)
+    )
+    notify_sim(row.customer_sim_id, "sky_phone:companies:notification", notification_payload(
+        "assigned",
+        "customer",
+        row
+    ))
+    local payload, payload_error = mutation_request_payload(source, request_id)
+    if not payload then
+        return payload_error
+    end
+    return { success = true, data = payload }
+end)
+
+Bridge.Callbacks.Register("sky_phone:companies:update-request-status", function(source, data)
+    local allowed, rate_error = allow_mutation(source, "update_request_status", "RequestAction")
+    if not allowed then
+        return rate_error
+    end
+    local request_id = type(data) == "table" and data.requestId or nil
+    local revision = type(data) == "table" and valid_integer(data.revision, 1, 4294967295) or nil
+    local status = type(data) == "table" and data.status or nil
+    if not valid_uuid(request_id) or not revision or not Config.Companies.Statuses[status] then
+        return { success = false, error = "invalid_request" }
+    end
+    local access, access_error = request_access(source, request_id)
+    if not access then
+        return access_error
+    end
+    if access.audience ~= "company" or not can_handle_request(access) then
+        return { success = false, error = "not_authorized" }
+    end
+    if not status_transitions[access.row.status] or not status_transitions[access.row.status][status] then
+        return { success = false, error = "invalid_status" }
+    end
+    local mutation_token = uuid()
+    local event_id = uuid()
+    if not Bridge.Database.Transaction({
+        {
+            query = [[
+                UPDATE `sky_phone_company_requests`
+                SET `status` = ?, `revision` = `revision` + 1, `customer_unread` = `customer_unread` + 1,
+                    `completed_at` = CASE WHEN ? = 'completed' THEN CURRENT_TIMESTAMP ELSE `completed_at` END,
+                    `cancelled_at` = CASE WHEN ? = 'cancelled' THEN CURRENT_TIMESTAMP ELSE `cancelled_at` END,
+                    `mutation_token` = ?
+                WHERE `id` = ? AND `company_id` = ? AND `revision` = ? AND `status` = ?
+            ]],
+            params = {
+                status,
+                status,
+                status,
+                mutation_token,
+                request_id,
+                access.row.company_id,
+                revision,
+                access.row.status,
+            },
+        },
+        {
+            query = [[
+                INSERT INTO `sky_phone_company_request_events`
+                    (`id`, `request_id`, `event_type`, `actor_type`, `actor_identifier`, `from_status`, `to_status`)
+                SELECT ?, `id`, ?, 'company', ?, ?, ?
+                FROM `sky_phone_company_requests`
+                WHERE `id` = ? AND `revision` = ? AND `mutation_token` = ?
+            ]],
+            params = {
+                event_id,
+                status == "cancelled" and "cancelled" or "status",
+                access.member.identifier,
+                access.row.status,
+                status,
+                request_id,
+                revision + 1,
+                mutation_token,
+            },
+        },
+    }) then
+        return { success = false, error = "request_failed" }
+    end
+    local committed = Bridge.Database.Query(
+        "SELECT `id` FROM `sky_phone_company_request_events` WHERE `id` = ? LIMIT 1",
+        { event_id }
+    )
+    if not committed[1] then
+        return { success = false, error = "revision_conflict" }
+    end
+    local row = request_row(request_id)
+    emit_request_change(row, true, true, source)
+    notify_sim(row.customer_sim_id, "sky_phone:companies:notification", notification_payload(
+        "requestUpdated",
+        "customer",
+        row
+    ))
+    local payload, payload_error = mutation_request_payload(source, request_id)
+    if not payload then
+        return payload_error
+    end
+    return { success = true, data = payload }
+end)
+
+Bridge.Callbacks.Register("sky_phone:companies:call-customer", function(source, data)
+    local allowed, rate_error = allow_mutation(source, "call_customer", "RequestAction")
+    if not allowed then
+        return rate_error
+    end
+    local request_id = type(data) == "table" and data.requestId or nil
+    if not valid_uuid(request_id) then
+        return { success = false, error = "invalid_request" }
+    end
+    local access, access_error = request_access(source, request_id)
+    if not access then
+        return access_error
+    end
+    if access.audience ~= "company" or not can_handle_request(access) or terminal_statuses[access.row.status] then
+        return { success = false, error = "not_authorized" }
+    end
+    if not SkyPhoneCompanies.CanPlaceCompanyCall(source, access.row.company_id) then
+        return { success = false, error = "not_authorized" }
+    end
+    local rows = Bridge.Database.Query([[
+        SELECT sim.`phone_number`
+        FROM `sky_phone_company_requests` request
+        INNER JOIN `sky_phone_sims` sim ON sim.`id` = request.`customer_sim_id`
+        WHERE request.`id` = ? AND request.`company_id` = ?
+        LIMIT 1
+    ]], { request_id, access.row.company_id })
+    if not rows[1] then
+        return { success = false, error = "call_unavailable" }
+    end
+    local result = SkyPhoneCalls.StartCompanyCall(source, access.row.company_id, rows[1].phone_number)
+    if not result.success and (result.error == "recipient_unavailable" or result.error == "company_unavailable") then
+        return { success = false, error = "call_unavailable" }
+    end
+    return result
+end)
+
+local function company_mutation_payload(source, company_id)
+    local company = company_payload(company_id, true)
+    if not company then
+        return nil
+    end
+    company.updatedAtUnix = nil
+    return { company = company, context = work_context(source) }
+end
+
+local function audit_statement(company_id, identifier, action, target_type, target_id, mutation_token, audit_id)
+    return {
+        query = [[
+            INSERT INTO `sky_phone_company_audit`
+                (`id`, `company_id`, `actor_identifier`, `action`, `target_type`, `target_id`, `metadata`)
+            SELECT ?, `company_id`, ?, ?, ?, ?, ?
+            FROM `sky_phone_company_profiles`
+            WHERE `company_id` = ? AND `mutation_token` = ?
+        ]],
+        params = {
+            audit_id,
+            identifier,
+            action,
+            target_type,
+            target_id,
+            json.encode({ revisionChecked = true }),
+            company_id,
+            mutation_token,
+        },
+    }
+end
+
+local function audit_committed(audit_id)
+    local rows = Bridge.Database.Query([[
+        SELECT `id` FROM `sky_phone_company_audit`
+        WHERE `id` = ?
+        LIMIT 1
+    ]], { audit_id })
+    return rows[1] ~= nil
+end
+
+Bridge.Callbacks.Register("sky_phone:companies:update-availability", function(source, data)
+    local allowed, rate_error = allow_mutation(source, "update_availability", "Profile")
+    if not allowed then
+        return rate_error
+    end
+    local member, member_error = require_permission(source, "Availability")
+    if not member then
+        return member_error
+    end
+    local availability = type(data) == "table" and data.availability or nil
+    local revision = type(data) == "table" and valid_integer(data.revision, 1, 4294967295) or nil
+    if not Config.Companies.AvailabilityStatuses[availability] or not revision then
+        return { success = false, error = "invalid_request" }
+    end
+    local expiry = parse_expiry(data.expiresAt, Config.Companies.AvailabilityMaximumSeconds)
+    if expiry == false then
+        return { success = false, error = "invalid_expiration" }
+    end
+    local mutation_token = uuid()
+    local audit_id = uuid()
+    local update_query
+    local update_params
+    if expiry then
+        update_query = [[
+            UPDATE `sky_phone_company_profiles`
+            SET `availability` = ?, `availability_updated_by` = ?,
+                `availability_updated_at` = CURRENT_TIMESTAMP,
+                `availability_expires_at` = FROM_UNIXTIME(?),
+                `revision` = `revision` + 1, `mutation_token` = ?
+            WHERE `company_id` = ? AND `revision` = ?
+        ]]
+        update_params = { availability, member.identifier, expiry, mutation_token, member.company_id, revision }
+    else
+        update_query = [[
+            UPDATE `sky_phone_company_profiles`
+            SET `availability` = ?, `availability_updated_by` = ?,
+                `availability_updated_at` = CURRENT_TIMESTAMP, `availability_expires_at` = NULL,
+                `revision` = `revision` + 1, `mutation_token` = ?
+            WHERE `company_id` = ? AND `revision` = ?
+        ]]
+        update_params = { availability, member.identifier, mutation_token, member.company_id, revision }
+    end
+    if not Bridge.Database.Transaction({
+        { query = update_query, params = update_params },
+        audit_statement(
+            member.company_id,
+            member.identifier,
+            "update_availability",
+            "profile",
+            member.company_id,
+            mutation_token,
+            audit_id
+        ),
+    }) then
+        return { success = false, error = "request_failed" }
+    end
+    if not audit_committed(audit_id) then
+        return { success = false, error = "revision_conflict" }
+    end
+    emit_public_change(member.company_id)
+    return { success = true, data = company_mutation_payload(source, member.company_id) }
+end)
+
+local function media_id_for_profile(source, value)
+    local media_id = valid_integer(value, 1, 9007199254740991)
+    if not media_id or not SkyPhoneMedia.ResolveOwnedMedia(source, media_id, "photo") then
+        return nil
+    end
+    return media_id
+end
+
+Bridge.Callbacks.Register("sky_phone:companies:update-profile", function(source, data)
+    local allowed, rate_error = allow_mutation(source, "update_profile", "Profile")
+    if not allowed then
+        return rate_error
+    end
+    local member, member_error = require_permission(source, "Profile")
+    if not member then
+        return member_error
+    end
+    if type(data) ~= "table" then
+        return { success = false, error = "invalid_request" }
+    end
+    local revision = valid_integer(data.revision, 1, 4294967295)
+    local description = valid_text(data.description, Config.Companies.ProfileDescriptionMaxLength, true)
+    local district = valid_text(data.district, Config.Companies.DistrictMaxLength, true)
+    local location_label = valid_text(data.locationLabel or "", Config.Companies.DistrictMaxLength, true)
+    local address = valid_text(data.address, Config.Companies.AddressMaxLength, true)
+    if not revision or not description or not district or not location_label or not address
+        or type(data.acceptsRequests) ~= "boolean"
+        or (member.definition.Emergency and data.acceptsRequests)
+    then
+        return { success = false, error = "invalid_profile" }
+    end
+    if data.phoneNumber ~= nil then
+        local number = SkyPhoneSimNumber.Normalize(data.phoneNumber, Config.Sim.NumberLength, Config.Sim.NumberPrefix)
+        if number ~= member.definition.ServiceLine.Number then
+            return { success = false, error = "invalid_profile" }
+        end
+    end
+    local set_parts = {
+        "`description` = ?",
+        "`district` = ?",
+        "`location_label` = ?",
+        "`address` = ?",
+        "`accepts_requests` = ?",
+    }
+    local parameters = { description, district, location_label, address, data.acceptsRequests and 1 or 0 }
+    if data.coords ~= nil then
+        if type(data.coords) ~= "table" then
+            return { success = false, error = "invalid_profile" }
+        end
+        local x = tonumber(data.coords.x)
+        local y = tonumber(data.coords.y)
+        local z = tonumber(data.coords.z)
+        if not x or not y or not z or x ~= x or y ~= y or z ~= z
+            or math.abs(x) > 10000 or math.abs(y) > 10000 or math.abs(z) > 2000
+        then
+            return { success = false, error = "invalid_profile" }
+        end
+        set_parts[#set_parts + 1] = "`location_x` = ?"
+        set_parts[#set_parts + 1] = "`location_y` = ?"
+        set_parts[#set_parts + 1] = "`location_z` = ?"
+        parameters[#parameters + 1] = x
+        parameters[#parameters + 1] = y
+        parameters[#parameters + 1] = z
+    end
+    for _, media_field in ipairs({
+        { input = "logoMediaId", column = "logo_media_id" },
+        { input = "coverMediaId", column = "cover_media_id" },
+    }) do
+        if data[media_field.input] ~= nil then
+            local media_id = media_id_for_profile(source, data[media_field.input])
+            if not media_id then
+                return { success = false, error = "invalid_media" }
+            end
+            set_parts[#set_parts + 1] = ("`%s` = ?"):format(media_field.column)
+            parameters[#parameters + 1] = media_id
+        end
+    end
+    local mutation_token = uuid()
+    local audit_id = uuid()
+    set_parts[#set_parts + 1] = "`revision` = `revision` + 1"
+    set_parts[#set_parts + 1] = "`mutation_token` = ?"
+    parameters[#parameters + 1] = mutation_token
+    parameters[#parameters + 1] = member.company_id
+    parameters[#parameters + 1] = revision
+    if not Bridge.Database.Transaction({
+        {
+            query = ("UPDATE `sky_phone_company_profiles` SET %s WHERE `company_id` = ? AND `revision` = ?")
+                :format(table.concat(set_parts, ", ")),
+            params = parameters,
+        },
+        audit_statement(
+            member.company_id,
+            member.identifier,
+            "update_profile",
+            "profile",
+            member.company_id,
+            mutation_token,
+            audit_id
+        ),
+    }) then
+        return { success = false, error = "request_failed" }
+    end
+    if not audit_committed(audit_id) then
+        return { success = false, error = "revision_conflict" }
+    end
+    emit_public_change(member.company_id)
+    return { success = true, data = company_mutation_payload(source, member.company_id) }
+end)
+
+local function valid_clock(value)
+    if type(value) ~= "string" then
+        return false
+    end
+    local hour, minute = value:match("^(%d%d):(%d%d)$")
+    hour = tonumber(hour)
+    minute = tonumber(minute)
+    return hour and minute and hour <= 23 and minute <= 59
+end
+
+Bridge.Callbacks.Register("sky_phone:companies:update-hours", function(source, data)
+    local allowed, rate_error = allow_mutation(source, "update_hours", "Profile")
+    if not allowed then
+        return rate_error
+    end
+    local member, member_error = require_permission(source, "Hours")
+    if not member then
+        return member_error
+    end
+    local revision = type(data) == "table" and valid_integer(data.revision, 1, 4294967295) or nil
+    local hours = type(data) == "table" and data.hours or nil
+    if not revision or not valid_array(hours, 7) then
+        return { success = false, error = "invalid_profile" }
+    end
+    local seen_days = {}
+    for _, entry in ipairs(hours) do
+        local day = type(entry) == "table" and valid_integer(entry.day, 0, 6) or nil
+        if not day or seen_days[day] or type(entry.isClosed) ~= "boolean"
+            or (not entry.isClosed and (not valid_clock(entry.opensAt) or not valid_clock(entry.closesAt)
+                or entry.opensAt == entry.closesAt))
+        then
+            return { success = false, error = "invalid_profile" }
+        end
+        seen_days[day] = true
+    end
+    local mutation_token = uuid()
+    local audit_id = uuid()
+    local statements = {
+        {
+            query = [[
+                UPDATE `sky_phone_company_profiles`
+                SET `revision` = `revision` + 1, `mutation_token` = ?
+                WHERE `company_id` = ? AND `revision` = ?
+            ]],
+            params = { mutation_token, member.company_id, revision },
+        },
+        {
+            query = [[
+                DELETE hours FROM `sky_phone_company_hours` hours
+                INNER JOIN `sky_phone_company_profiles` profile ON profile.`company_id` = hours.`company_id`
+                WHERE hours.`company_id` = ? AND profile.`mutation_token` = ?
+            ]],
+            params = { member.company_id, mutation_token },
+        },
+    }
+    for _, entry in ipairs(hours) do
+        local query
+        local params
+        if entry.isClosed then
+            query = [[
+                INSERT INTO `sky_phone_company_hours` (`company_id`, `weekday`, `is_closed`)
+                SELECT `company_id`, ?, 1 FROM `sky_phone_company_profiles`
+                WHERE `company_id` = ? AND `mutation_token` = ?
+            ]]
+            params = { entry.day, member.company_id, mutation_token }
+        else
+            query = [[
+                INSERT INTO `sky_phone_company_hours`
+                    (`company_id`, `weekday`, `is_closed`, `opens_at`, `closes_at`)
+                SELECT `company_id`, ?, 0, ?, ? FROM `sky_phone_company_profiles`
+                WHERE `company_id` = ? AND `mutation_token` = ?
+            ]]
+            params = { entry.day, entry.opensAt, entry.closesAt, member.company_id, mutation_token }
+        end
+        statements[#statements + 1] = { query = query, params = params }
+    end
+    statements[#statements + 1] = audit_statement(
+        member.company_id,
+        member.identifier,
+        "update_hours",
+        "hours",
+        member.company_id,
+        mutation_token,
+        audit_id
+    )
+    if not Bridge.Database.Transaction(statements) then
+        return { success = false, error = "request_failed" }
+    end
+    if not audit_committed(audit_id) then
+        return { success = false, error = "revision_conflict" }
+    end
+    emit_public_change(member.company_id)
+    return { success = true, data = company_mutation_payload(source, member.company_id) }
+end)
+
+Bridge.Callbacks.Register("sky_phone:companies:update-services", function(source, data)
+    local allowed, rate_error = allow_mutation(source, "update_services", "Profile")
+    if not allowed then
+        return rate_error
+    end
+    local member, member_error = require_permission(source, "Services")
+    if not member then
+        return member_error
+    end
+    local revision = type(data) == "table" and valid_integer(data.revision, 1, 4294967295) or nil
+    local services = type(data) == "table" and data.services or nil
+    if not revision or not valid_array(services, Config.Companies.MaximumServices) then
+        return { success = false, error = "invalid_profile" }
+    end
+    local existing_rows = Bridge.Database.Query(
+        "SELECT `id` FROM `sky_phone_company_services` WHERE `company_id` = ? AND `archived` = 0",
+        { member.company_id }
+    )
+    local existing = {}
+    for _, row in ipairs(existing_rows) do
+        existing[row.id] = true
+    end
+    local normalized = {}
+    local seen = {}
+    for index, service in ipairs(services) do
+        if type(service) ~= "table" or type(service.active) ~= "boolean"
+            or type(service.acceptsRequests) ~= "boolean"
+        then
+            return { success = false, error = "invalid_profile" }
+        end
+        local title = valid_text(service.title, Config.Companies.ServiceTitleMaxLength, false)
+        local description = valid_text(
+            service.description or "",
+            Config.Companies.ServiceDescriptionMaxLength,
+            true
+        )
+        local price = service.priceText == nil and ""
+            or valid_text(service.priceText, Config.Companies.ServicePriceMaxLength, true)
+        if not title or not description or not price then
+            return { success = false, error = "invalid_profile" }
+        end
+        local service_id = valid_service_id(service.id) and existing[service.id] and service.id or uuid()
+        if seen[service_id] then
+            return { success = false, error = "invalid_profile" }
+        end
+        seen[service_id] = true
+        normalized[#normalized + 1] = {
+            id = service_id,
+            title = title,
+            description = description,
+            price = price,
+            accepts_requests = service.acceptsRequests,
+            active = service.active,
+            sort_order = index,
+        }
+    end
+    local mutation_token = uuid()
+    local audit_id = uuid()
+    local statements = {
+        {
+            query = [[
+                UPDATE `sky_phone_company_profiles`
+                SET `revision` = `revision` + 1, `mutation_token` = ?
+                WHERE `company_id` = ? AND `revision` = ?
+            ]],
+            params = { mutation_token, member.company_id, revision },
+        },
+        {
+            query = [[
+                UPDATE `sky_phone_company_services` service
+                INNER JOIN `sky_phone_company_profiles` profile ON profile.`company_id` = service.`company_id`
+                SET service.`active` = 0, service.`requests_enabled` = 0, service.`archived` = 1
+                WHERE service.`company_id` = ? AND profile.`mutation_token` = ?
+            ]],
+            params = { member.company_id, mutation_token },
+        },
+    }
+    for _, service in ipairs(normalized) do
+        statements[#statements + 1] = {
+            query = [[
+                INSERT INTO `sky_phone_company_services`
+                    (`id`, `company_id`, `title`, `description`, `price_text`, `requests_enabled`, `active`, `sort_order`)
+                SELECT ?, `company_id`, ?, ?, ?, ?, ?, ? FROM `sky_phone_company_profiles`
+                WHERE `company_id` = ? AND `mutation_token` = ?
+                ON DUPLICATE KEY UPDATE
+                    `title` = VALUES(`title`), `description` = VALUES(`description`),
+                    `price_text` = VALUES(`price_text`), `requests_enabled` = VALUES(`requests_enabled`),
+                    `active` = VALUES(`active`), `archived` = 0, `sort_order` = VALUES(`sort_order`)
+            ]],
+            params = {
+                service.id,
+                service.title,
+                service.description,
+                service.price,
+                service.accepts_requests and 1 or 0,
+                service.active and 1 or 0,
+                service.sort_order,
+                member.company_id,
+                mutation_token,
+            },
+        }
+    end
+    statements[#statements + 1] = audit_statement(
+        member.company_id,
+        member.identifier,
+        "update_services",
+        "services",
+        member.company_id,
+        mutation_token,
+        audit_id
+    )
+    if not Bridge.Database.Transaction(statements) then
+        return { success = false, error = "request_failed" }
+    end
+    if not audit_committed(audit_id) then
+        return { success = false, error = "revision_conflict" }
+    end
+    emit_public_change(member.company_id)
+    return { success = true, data = company_mutation_payload(source, member.company_id) }
+end)
+
+Bridge.Callbacks.Register("sky_phone:companies:publish-announcement", function(source, data)
+    local allowed, rate_error = allow_mutation(source, "publish_announcement", "Profile")
+    if not allowed then
+        return rate_error
+    end
+    local member, member_error = require_permission(source, "Announcement")
+    if not member then
+        return member_error
+    end
+    local revision = type(data) == "table" and valid_integer(data.revision, 1, 4294967295) or nil
+    local body = type(data) == "table"
+        and valid_text(data.body or "", Config.Companies.AnnouncementBodyMaxLength, true) or nil
+    if not revision or body == nil then
+        return { success = false, error = "invalid_profile" }
+    end
+    local expiry = parse_expiry(data.expiresAt, Config.Companies.AnnouncementMaximumSeconds)
+    if expiry == false then
+        return { success = false, error = "invalid_expiration" }
+    end
+    local mutation_token = uuid()
+    local audit_id = uuid()
+    local statements = {
+        {
+            query = [[
+                UPDATE `sky_phone_company_profiles`
+                SET `revision` = `revision` + 1, `mutation_token` = ?
+                WHERE `company_id` = ? AND `revision` = ?
+            ]],
+            params = { mutation_token, member.company_id, revision },
+        },
+        {
+            query = [[
+                UPDATE `sky_phone_company_announcements` announcement
+                INNER JOIN `sky_phone_company_profiles` profile ON profile.`company_id` = announcement.`company_id`
+                SET announcement.`active` = 0
+                WHERE announcement.`company_id` = ? AND profile.`mutation_token` = ?
+            ]],
+            params = { member.company_id, mutation_token },
+        },
+    }
+    if body ~= "" then
+        local insert_query
+        local insert_params
+        if expiry then
+            insert_query = [[
+                INSERT INTO `sky_phone_company_announcements`
+                    (`id`, `company_id`, `title`, `body`, `created_by`, `expires_at`)
+                SELECT ?, `company_id`, '', ?, ?, FROM_UNIXTIME(?) FROM `sky_phone_company_profiles`
+                WHERE `company_id` = ? AND `mutation_token` = ?
+            ]]
+            insert_params = { uuid(), body, member.identifier, expiry, member.company_id, mutation_token }
+        else
+            insert_query = [[
+                INSERT INTO `sky_phone_company_announcements`
+                    (`id`, `company_id`, `title`, `body`, `created_by`)
+                SELECT ?, `company_id`, '', ?, ? FROM `sky_phone_company_profiles`
+                WHERE `company_id` = ? AND `mutation_token` = ?
+            ]]
+            insert_params = { uuid(), body, member.identifier, member.company_id, mutation_token }
+        end
+        statements[#statements + 1] = { query = insert_query, params = insert_params }
+    end
+    statements[#statements + 1] = audit_statement(
+        member.company_id,
+        member.identifier,
+        "publish_announcement",
+        "announcement",
+        member.company_id,
+        mutation_token,
+        audit_id
+    )
+    if not Bridge.Database.Transaction(statements) then
+        return { success = false, error = "request_failed" }
+    end
+    if not audit_committed(audit_id) then
+        return { success = false, error = "revision_conflict" }
+    end
+    emit_public_change(member.company_id)
+    return { success = true, data = company_mutation_payload(source, member.company_id) }
+end)
+
+Bridge.Callbacks.Register("sky_phone:companies:set-call-availability", function(source, data)
+    local allowed, rate_error = allow_mutation(source, "set_call_availability", "CallAvailability")
+    if not allowed then
+        return rate_error
+    end
+    if type(data) ~= "table" or type(data.available) ~= "boolean" then
+        return { success = false, error = "invalid_request" }
+    end
+    if not data.available then
+        SkyPhoneCompanies.ClearCallAvailability(source)
+        return { success = true, data = { context = work_context(source) } }
+    end
+    local member = call_member(source)
+    if not member or not member.definition.ServiceLine.CanCall then
+        return { success = false, error = "not_authorized" }
+    end
+    local device, device_error = current_device(source, true)
+    if not device then
+        return device_error
+    end
+    call_availability[source] = {
+        company_id = member.company_id,
+        sim_id = device.sim_id,
+        imei = device.imei,
+    }
+    return { success = true, data = { context = work_context(source) } }
+end)
+
+AddEventHandler("playerDropped", function()
+    SkyPhoneCompanies.ClearCallAvailability(source)
+    member_tokens[source] = nil
+end)
+
+AddEventHandler("onResourceStop", function(resource_name)
+    if resource_name ~= GetCurrentResourceName() then
+        return
+    end
+    call_availability = {}
+    round_robin_positions = {}
+    member_tokens = {}
+end)
+end)
diff --git a/sky_phone/source/server/custom_app_compat.lua b/sky_phone/source/server/custom_app_compat.lua
new file mode 100644
index 0000000..25196d2
--- /dev/null
+++ b/sky_phone/source/server/custom_app_compat.lua
@@ -0,0 +1,138 @@
+local RESOURCE_NAME = GetCurrentResourceName()
+local SNAPSHOT_COOLDOWN_MS = 2000
+local SNAPSHOT_REJECTION_LOG_COOLDOWN_MS = 10000
+local registered_apps = {}
+local snapshot_requests = {}
+local snapshot_rejection_logs = {}
+
+local function get_calling_resource(export_name)
+    local owner_resource = GetInvokingResource()
+    if owner_resource then
+        return owner_resource
+    end
+
+    print(("[%s] %s rejected: the export must be called by another resource."):format(
+        RESOURCE_NAME,
+        export_name
+    ))
+    return nil, "invalid_owner"
+end
+
+local function add_high_application(app_name, data, locales)
+    local owner_resource, owner_error = get_calling_resource("addApplication")
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local definition, definition_error = SkyPhoneCompatibility.BuildHighDefinition(
+        owner_resource,
+        app_name,
+        data,
+        locales
+    )
+    if not definition then
+        print(("[%s] High Phone registration rejected for %s: %s."):format(
+            RESOURCE_NAME,
+            owner_resource,
+            definition_error
+        ))
+        return false, definition_error
+    end
+
+    local existing = registered_apps[app_name]
+    if existing and existing.owner_resource ~= owner_resource then
+        return false, "duplicate_app_id"
+    end
+
+    local revision = existing and existing.revision + 1 or 1
+    registered_apps[app_name] = {
+        definition = definition,
+        owner_resource = owner_resource,
+        revision = revision,
+    }
+    TriggerClientEvent(
+        "sky_phone:compat:high:client:syncApplication",
+        -1,
+        owner_resource,
+        definition,
+        revision
+    )
+    return true
+end
+
+local function build_snapshot()
+    local ids = {}
+    for app_id in pairs(registered_apps) do
+        ids[#ids + 1] = app_id
+    end
+    table.sort(ids)
+
+    local snapshot = {}
+    for index = 1, #ids do
+        snapshot[index] = registered_apps[ids[index]]
+    end
+    return snapshot
+end
+
+RegisterNetEvent("sky_phone:compat:high:server:requestSnapshot", function()
+    local player_source = source
+    if player_source <= 0 then
+        print(("[%s] Rejected High Phone snapshot request without a player source."):format(
+            RESOURCE_NAME
+        ))
+        return
+    end
+
+    local now = GetGameTimer()
+    local last_request = snapshot_requests[player_source]
+    local elapsed = last_request and now - last_request or SNAPSHOT_COOLDOWN_MS
+    if elapsed >= 0 and elapsed < SNAPSHOT_COOLDOWN_MS then
+        local last_log = snapshot_rejection_logs[player_source]
+        local log_elapsed = last_log and now - last_log or SNAPSHOT_REJECTION_LOG_COOLDOWN_MS
+        if log_elapsed < 0 or log_elapsed >= SNAPSHOT_REJECTION_LOG_COOLDOWN_MS then
+            snapshot_rejection_logs[player_source] = now
+            print(("[%s] Rate-limited High Phone snapshot request from player %s."):format(
+                RESOURCE_NAME,
+                player_source
+            ))
+        end
+        return
+    end
+    snapshot_requests[player_source] = now
+
+    TriggerClientEvent(
+        "sky_phone:compat:high:client:replaceSnapshot",
+        player_source,
+        build_snapshot()
+    )
+end)
+
+AddEventHandler("playerDropped", function()
+    snapshot_requests[source] = nil
+    snapshot_rejection_logs[source] = nil
+end)
+
+AddEventHandler("onResourceStop", function(resource_name)
+    if resource_name == RESOURCE_NAME then
+        return
+    end
+
+    local removed_ids = {}
+    for app_id, record in pairs(registered_apps) do
+        if record.owner_resource == resource_name then
+            removed_ids[#removed_ids + 1] = app_id
+        end
+    end
+    for index = 1, #removed_ids do
+        local app_id = removed_ids[index]
+        registered_apps[app_id] = nil
+        TriggerClientEvent(
+            "sky_phone:compat:high:client:removeApplication",
+            -1,
+            resource_name,
+            app_id
+        )
+    end
+end)
+
+exports("addApplication", add_high_application)
diff --git a/sky_phone/source/server/custom_app_storage.lua b/sky_phone/source/server/custom_app_storage.lua
new file mode 100644
index 0000000..c777e39
--- /dev/null
+++ b/sky_phone/source/server/custom_app_storage.lua
@@ -0,0 +1,271 @@
+Bridge.Database.AfterMigration("sky_phone", function()
+local STORAGE_JSON_MAX_DEPTH = 8
+local STORAGE_JSON_MAX_NODES = 512
+local STORAGE_KEY_MAX_LENGTH = math.min(Config.CustomApps.MaximumStorageKeyLength, 64)
+local STORAGE_VALUE_MAX_BYTES = math.min(Config.CustomApps.MaximumStorageValueBytes, 65536)
+local storage_write_locks = {}
+
+local function affected_rows(result)
+    if type(result) == "number" then
+        return result
+    end
+
+    return type(result) == "table" and tonumber(result.affectedRows) or 0
+end
+
+local function validate_storage_json(value, depth, state)
+    state.nodes = state.nodes + 1
+    if state.nodes > STORAGE_JSON_MAX_NODES or depth > STORAGE_JSON_MAX_DEPTH then
+        return false
+    end
+
+    local value_type = type(value)
+    if value_type == "nil" or value_type == "boolean" then
+        return true
+    end
+    if value_type == "number" then
+        return value == value and value ~= math.huge and value ~= -math.huge
+    end
+    if value_type == "string" then
+        return #value <= STORAGE_VALUE_MAX_BYTES
+    end
+    if value_type ~= "table" or state.seen[value] then
+        return false
+    end
+
+    state.seen[value] = true
+    local key_type = nil
+    local numeric_keys = 0
+    local value_count = 0
+    for key, nested_value in pairs(value) do
+        value_count = value_count + 1
+        local current_key_type = type(key)
+        if current_key_type == "number" then
+            if key < 1 or key % 1 ~= 0 then
+                state.seen[value] = nil
+                return false
+            end
+            numeric_keys = numeric_keys + 1
+        elseif current_key_type ~= "string"
+            or #key == 0
+            or #key > 64
+            or key == "__proto__"
+            or key == "constructor"
+            or key == "prototype"
+        then
+            state.seen[value] = nil
+            return false
+        end
+
+        if key_type and key_type ~= current_key_type then
+            state.seen[value] = nil
+            return false
+        end
+        key_type = current_key_type
+
+        if not validate_storage_json(nested_value, depth + 1, state) then
+            state.seen[value] = nil
+            return false
+        end
+    end
+
+    if key_type == "number" and (numeric_keys ~= value_count or #value ~= value_count) then
+        state.seen[value] = nil
+        return false
+    end
+
+    state.seen[value] = nil
+    return true
+end
+
+local function with_storage_write_lock(lock_key, callback)
+    local previous_lock = storage_write_locks[lock_key]
+    local current_lock = promise.new()
+    storage_write_locks[lock_key] = current_lock
+
+    if previous_lock then
+        Citizen.Await(previous_lock)
+    end
+
+    local success, result = xpcall(callback, debug.traceback)
+    current_lock:resolve(true)
+    if storage_write_locks[lock_key] == current_lock then
+        storage_write_locks[lock_key] = nil
+    end
+    if not success then
+        error(result, 0)
+    end
+    return result
+end
+
+local function validate_request(source, data, operation)
+    if not Config.CustomApps.Enabled then
+        return nil, nil, { success = false, error = "custom_apps_disabled" }
+    end
+    if not SkyPhone.AllowOperation(
+        source,
+        "custom_app_storage_" .. operation,
+        Config.CustomApps.StorageRequestsPerMinute,
+        60
+    ) then
+        return nil, nil, { success = false, error = "rate_limited" }
+    end
+
+    local session, error_response = SkyPhone.RequireSession(source)
+    if not session then
+        return nil, nil, error_response
+    end
+    if type(data) ~= "table" or not SkyPhoneApps.HasPermission(data.appId, "device.storage") then
+        return nil, nil, { success = false, error = "storage_not_allowed" }
+    end
+    if type(data.key) ~= "string"
+        or #data.key == 0
+        or #data.key > STORAGE_KEY_MAX_LENGTH
+        or not data.key:match("^[%w._-]+$")
+    then
+        return nil, nil, { success = false, error = "invalid_storage_key" }
+    end
+
+    return session, data, nil
+end
+
+local function read_row(imei, app_id, data_key)
+    local rows = Bridge.Database.Query([[
+        SELECT `payload`, `revision`
+        FROM `sky_phone_custom_app_data`
+        WHERE `device_imei` = ? AND `app_id` = ? AND `data_key` = ?
+        LIMIT 1
+    ]], { imei, app_id, data_key })
+    return rows[1]
+end
+
+local function conflict_response(row)
+    if not row then
+        return {
+            success = false,
+            error = "storage_conflict",
+            data = { exists = false, revision = 0 },
+        }
+    end
+
+    return {
+        success = false,
+        error = "storage_conflict",
+        data = {
+            exists = true,
+            revision = tonumber(row.revision) or 0,
+            value = json.decode(row.payload),
+        },
+    }
+end
+
+Bridge.Callbacks.Register("sky_phone:custom-app:storage:get", function(source, data)
+    local session, request, error_response = validate_request(source, data, "get")
+    if not session then
+        return error_response
+    end
+
+    local row = read_row(session.imei, request.appId, request.key)
+    if not row then
+        return { success = true, data = { exists = false, revision = 0 } }
+    end
+
+    return {
+        success = true,
+        data = {
+            exists = true,
+            revision = tonumber(row.revision) or 0,
+            value = json.decode(row.payload),
+        },
+    }
+end)
+
+Bridge.Callbacks.Register("sky_phone:custom-app:storage:set", function(source, data)
+    local session, request, error_response = validate_request(source, data, "set")
+    if not session then
+        return error_response
+    end
+    if request.value == nil then
+        return { success = false, error = "invalid_storage_value" }
+    end
+
+    local expected_revision = tonumber(request.revision)
+    if not expected_revision
+        or expected_revision ~= math.floor(expected_revision)
+        or expected_revision < 0
+        or expected_revision > 4294967294
+    then
+        return { success = false, error = "invalid_storage_revision" }
+    end
+
+    if not validate_storage_json(request.value, 0, { nodes = 0, seen = {} }) then
+        return { success = false, error = "invalid_storage_value" }
+    end
+
+    local encoded, payload = pcall(json.encode, request.value)
+    if not encoded
+        or type(payload) ~= "string"
+        or #payload > STORAGE_VALUE_MAX_BYTES
+    then
+        return { success = false, error = "storage_value_too_large" }
+    end
+
+    local lock_key = session.imei .. "\0" .. request.appId
+    return with_storage_write_lock(lock_key, function()
+        local current_session, session_error = SkyPhone.RequireSession(source)
+        if not current_session then
+            return session_error
+        end
+        if current_session.imei ~= session.imei
+            or not SkyPhoneApps.HasPermission(request.appId, "device.storage")
+        then
+            return { success = false, error = "storage_not_allowed" }
+        end
+
+        local current = read_row(session.imei, request.appId, request.key)
+        local current_revision = current and tonumber(current.revision) or 0
+        if current_revision ~= expected_revision then
+            return conflict_response(current)
+        end
+
+        local totals = Bridge.Database.Query([[
+            SELECT COALESCE(SUM(OCTET_LENGTH(`payload`)), 0) AS `total`, COUNT(*) AS `keys`
+            FROM `sky_phone_custom_app_data`
+            WHERE `device_imei` = ? AND `app_id` = ?
+        ]], { session.imei, request.appId })
+        local current_size = current and #current.payload or 0
+        local next_total = (tonumber(totals[1] and totals[1].total) or 0) - current_size + #payload
+        if next_total > Config.CustomApps.MaximumStorageBytesPerApp then
+            return { success = false, error = "storage_quota_exceeded" }
+        end
+        if not current
+            and (tonumber(totals[1] and totals[1].keys) or 0) >= Config.CustomApps.MaximumStorageKeysPerApp
+        then
+            return { success = false, error = "storage_key_limit" }
+        end
+
+        if expected_revision == 0 then
+            local inserted = Bridge.Database.Query([[
+                INSERT IGNORE INTO `sky_phone_custom_app_data`
+                    (`device_imei`, `app_id`, `data_key`, `payload`, `revision`)
+                VALUES (?, ?, ?, ?, 1)
+            ]], { session.imei, request.appId, request.key, payload })
+            if affected_rows(inserted) ~= 1 then
+                return conflict_response(read_row(session.imei, request.appId, request.key))
+            end
+            return { success = true, data = { revision = 1 } }
+        end
+
+        local updated = Bridge.Database.Query([[
+            UPDATE `sky_phone_custom_app_data`
+            SET `payload` = ?, `revision` = `revision` + 1
+            WHERE `device_imei` = ? AND `app_id` = ? AND `data_key` = ? AND `revision` = ?
+        ]], { payload, session.imei, request.appId, request.key, expected_revision })
+        if affected_rows(updated) ~= 1 then
+            return conflict_response(read_row(session.imei, request.appId, request.key))
+        end
+
+        return { success = true, data = { revision = expected_revision + 1 } }
+    end)
+end)
+end)
diff --git a/sky_phone/source/server/custom_apps.lua b/sky_phone/source/server/custom_apps.lua
new file mode 100644
index 0000000..e53219b
--- /dev/null
+++ b/sky_phone/source/server/custom_apps.lua
@@ -0,0 +1,385 @@
+local policies_by_id = {}
+local policy_ids_by_adapter = {}
+local policy_ids_by_owner = {}
+local current_resource = GetCurrentResourceName()
+
+local function validate_owner_resource(owner_resource, allow_stopping)
+    if type(owner_resource) ~= "string"
+        or #owner_resource == 0
+        or #owner_resource > 64
+        or not owner_resource:match("^[%w][%w._-]*$")
+    then
+        return false, "invalid_owner_resource"
+    end
+
+    local state = GetResourceState(owner_resource)
+    if state == "started" or state == "starting" or (allow_stopping and state == "stopping") then
+        return true
+    end
+
+    return false, "owner_resource_not_running"
+end
+
+local function add_owner_index(index, resource_name, app_id)
+    local app_ids = index[resource_name]
+    if not app_ids then
+        app_ids = {}
+        index[resource_name] = app_ids
+    end
+    app_ids[app_id] = true
+end
+
+local function remove_owner_index(index, resource_name, app_id)
+    local app_ids = index[resource_name]
+    if not app_ids then
+        return
+    end
+
+    app_ids[app_id] = nil
+    if not next(app_ids) then
+        index[resource_name] = nil
+    end
+end
+
+local function build_permission_set(permissions)
+    local permission_set = {}
+    for index = 1, #permissions do
+        permission_set[permissions[index]] = true
+    end
+    return permission_set
+end
+
+local function register_policy(policy)
+    local app_id = policy.id
+    local existing = policies_by_id[app_id]
+    if existing then
+        print((
+            "[sky_phone] Rejected duplicate custom app policy '%s' from '%s'; it is already owned by '%s'."
+        ):format(app_id, policy.ownerResource, existing.ownerResource))
+        return false, "duplicate_app_id"
+    end
+
+    policies_by_id[app_id] = policy
+    add_owner_index(policy_ids_by_owner, policy.ownerResource, app_id)
+    if policy.adapterResource then
+        add_owner_index(policy_ids_by_adapter, policy.adapterResource, app_id)
+    end
+    return true
+end
+
+local function remove_policy(app_id)
+    local policy = policies_by_id[app_id]
+    if not policy then
+        return false, "app_not_found"
+    end
+
+    policies_by_id[app_id] = nil
+    remove_owner_index(policy_ids_by_owner, policy.ownerResource, app_id)
+    if policy.adapterResource then
+        remove_owner_index(policy_ids_by_adapter, policy.adapterResource, app_id)
+    end
+    return true
+end
+
+local function get_direct_owner()
+    local owner_resource = GetInvokingResource()
+    if not owner_resource then
+        return nil, "missing_invoking_resource"
+    end
+
+    local valid_owner, owner_error = validate_owner_resource(owner_resource, false)
+    if not valid_owner then
+        return nil, owner_error
+    end
+
+    return owner_resource
+end
+
+local function get_trusted_adapter()
+    local adapter_resource = GetInvokingResource()
+    if not adapter_resource or not Config.CustomApps.TrustedAdapters[adapter_resource] then
+        return nil, "untrusted_adapter"
+    end
+
+    local valid_adapter, adapter_error = validate_owner_resource(adapter_resource, false)
+    if not valid_adapter then
+        return nil, adapter_error
+    end
+
+    return adapter_resource
+end
+
+local function normalize_policy(owner_resource, adapter_resource, definition)
+    if type(definition) ~= "table" then
+        return nil, "invalid_definition"
+    end
+    if definition.schemaVersion ~= nil and definition.schemaVersion ~= SkyPhoneApps.ProtocolVersion then
+        return nil, "unsupported_schema_version"
+    end
+
+    local valid_id, id_error = SkyPhoneApps.ValidateAppId(definition.id)
+    if not valid_id then
+        return nil, id_error
+    end
+    if SkyPhoneApps.ReservedAppIds[definition.id] then
+        return nil, "reserved_app_id"
+    end
+
+    local permissions, permissions_error = SkyPhoneApps.ValidatePermissions(definition.permissions)
+    if not permissions then
+        return nil, permissions_error
+    end
+
+    return {
+        adapterResource = adapter_resource,
+        bundled = false,
+        id = definition.id,
+        ownerResource = owner_resource,
+        permissions = build_permission_set(permissions),
+    }
+end
+
+local function add_custom_app_policy(definition)
+    if not Config.CustomApps.Enabled or not Config.CustomApps.ExternalApps then
+        return false, "external_apps_disabled"
+    end
+
+    local owner_resource, owner_error = get_direct_owner()
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local policy, policy_error = normalize_policy(owner_resource, nil, definition)
+    if not policy then
+        return false, policy_error
+    end
+    return register_policy(policy)
+end
+
+local function add_custom_app_policy_from_adapter(owner_resource, definition)
+    if not Config.CustomApps.Enabled or not Config.CustomApps.ExternalApps then
+        return false, "external_apps_disabled"
+    end
+
+    local adapter_resource, adapter_error = get_trusted_adapter()
+    if not adapter_resource then
+        return false, adapter_error
+    end
+    local valid_owner, owner_error = validate_owner_resource(owner_resource, false)
+    if not valid_owner then
+        return false, owner_error
+    end
+
+    local policy, policy_error = normalize_policy(owner_resource, adapter_resource, definition)
+    if not policy then
+        return false, policy_error
+    end
+    return register_policy(policy)
+end
+
+local function verify_owned_policy(owner_resource, app_id, adapter_resource)
+    local valid_id, id_error = SkyPhoneApps.ValidateAppId(app_id)
+    if not valid_id then
+        return nil, id_error
+    end
+
+    local policy = policies_by_id[app_id]
+    if not policy then
+        return nil, "app_not_found"
+    end
+    if policy.ownerResource ~= owner_resource then
+        return nil, "app_owner_mismatch"
+    end
+    if adapter_resource and policy.adapterResource ~= adapter_resource then
+        return nil, "app_adapter_mismatch"
+    end
+
+    return policy
+end
+
+local function replace_policy(policy, adapter_resource)
+    local existing, policy_error = verify_owned_policy(
+        policy.ownerResource,
+        policy.id,
+        adapter_resource
+    )
+    if not existing then
+        return false, policy_error
+    end
+    if existing.bundled then
+        return false, "bundled_app"
+    end
+
+    policies_by_id[policy.id] = policy
+    return true
+end
+
+local function update_custom_app_policy(definition)
+    if not Config.CustomApps.Enabled or not Config.CustomApps.ExternalApps then
+        return false, "external_apps_disabled"
+    end
+
+    local owner_resource, owner_error = get_direct_owner()
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local policy, policy_error = normalize_policy(owner_resource, nil, definition)
+    if not policy then
+        return false, policy_error
+    end
+    return replace_policy(policy, nil)
+end
+
+local function update_custom_app_policy_from_adapter(owner_resource, definition)
+    if not Config.CustomApps.Enabled or not Config.CustomApps.ExternalApps then
+        return false, "external_apps_disabled"
+    end
+
+    local adapter_resource, adapter_error = get_trusted_adapter()
+    if not adapter_resource then
+        return false, adapter_error
+    end
+    local valid_owner, owner_error = validate_owner_resource(owner_resource, false)
+    if not valid_owner then
+        return false, owner_error
+    end
+
+    local policy, policy_error = normalize_policy(owner_resource, adapter_resource, definition)
+    if not policy then
+        return false, policy_error
+    end
+    return replace_policy(policy, adapter_resource)
+end
+
+local function remove_custom_app_policy(app_id)
+    local owner_resource, owner_error = get_direct_owner()
+    if not owner_resource then
+        return false, owner_error
+    end
+
+    local policy, policy_error = verify_owned_policy(owner_resource, app_id)
+    if not policy then
+        return false, policy_error
+    end
+    if policy.bundled then
+        return false, "bundled_app"
+    end
+
+    return remove_policy(app_id)
+end
+
+local function remove_custom_app_policy_from_adapter(owner_resource, app_id)
+    local adapter_resource, adapter_error = get_trusted_adapter()
+    if not adapter_resource then
+        return false, adapter_error
+    end
+
+    local policy, policy_error = verify_owned_policy(owner_resource, app_id, adapter_resource)
+    if not policy then
+        return false, policy_error
+    end
+    return remove_policy(app_id)
+end
+
+local function has_custom_app_permission(app_id, permission)
+    local valid_id = SkyPhoneApps.ValidateAppId(app_id)
+    if not valid_id or type(permission) ~= "string" or not SkyPhoneApps.AllowedPermissions[permission] then
+        return false
+    end
+
+    local policy = policies_by_id[app_id]
+    return policy ~= nil and policy.permissions[permission] == true
+end
+
+local function get_custom_app_policy(app_id)
+    local valid_id = SkyPhoneApps.ValidateAppId(app_id)
+    if not valid_id then
+        return nil
+    end
+
+    local policy = policies_by_id[app_id]
+    if not policy then
+        return nil
+    end
+
+    local permissions = {}
+    for permission in pairs(policy.permissions) do
+        permissions[#permissions + 1] = permission
+    end
+    table.sort(permissions)
+    return {
+        bundled = policy.bundled,
+        id = policy.id,
+        ownerResource = policy.ownerResource,
+        permissions = permissions,
+    }
+end
+
+local function get_custom_app_capabilities()
+    return {
+        abiVersion = 1,
+        enabled = Config.CustomApps.Enabled,
+        policyRegistration = true,
+        policyUpdate = true,
+        protocolVersion = SkyPhoneApps.ProtocolVersion,
+    }
+end
+
+SkyPhoneApps.GetPolicy = get_custom_app_policy
+SkyPhoneApps.HasPermission = has_custom_app_permission
+
+if Config.CustomApps.Enabled and Config.CustomApps.BundledApps then
+    local bundled = SkyPhoneApps.GetBundledManifests()
+    for index = 1, #bundled do
+        local manifest = bundled[index]
+        local registered, register_error = register_policy({
+            adapterResource = nil,
+            bundled = true,
+            id = manifest.id,
+            ownerResource = current_resource,
+            permissions = build_permission_set(manifest.permissions),
+        })
+        if not registered then
+            error(("[sky_phone] Could not register bundled custom app policy '%s': %s"):format(
+                manifest.id,
+                register_error
+            ))
+        end
+    end
+end
+
+exports("AddCustomAppPolicy", add_custom_app_policy)
+exports("AddCustomAppPolicyFromAdapter", add_custom_app_policy_from_adapter)
+exports("GetCustomAppCapabilities", get_custom_app_capabilities)
+exports("GetCustomAppPolicy", get_custom_app_policy)
+exports("HasCustomAppPermission", has_custom_app_permission)
+exports("RemoveCustomAppPolicy", remove_custom_app_policy)
+exports("RemoveCustomAppPolicyFromAdapter", remove_custom_app_policy_from_adapter)
+exports("UpdateCustomAppPolicy", update_custom_app_policy)
+exports("UpdateCustomAppPolicyFromAdapter", update_custom_app_policy_from_adapter)
+
+AddEventHandler("onResourceStop", function(resource_name)
+    if resource_name == current_resource then
+        return
+    end
+
+    local app_ids = {}
+    local owner_policies = policy_ids_by_owner[resource_name]
+    if owner_policies then
+        for app_id in pairs(owner_policies) do
+            app_ids[app_id] = true
+        end
+    end
+
+    local adapter_policies = policy_ids_by_adapter[resource_name]
+    if adapter_policies then
+        for app_id in pairs(adapter_policies) do
+            app_ids[app_id] = true
+        end
+    end
+
+    for app_id in pairs(app_ids) do
+        remove_policy(app_id)
+    end
+end)
diff --git a/sky_phone/source/server/db_migrate.lua b/sky_phone/source/server/db_migrate.lua
index 4b113ba..b088676 100644
--- a/sky_phone/source/server/db_migrate.lua
+++ b/sky_phone/source/server/db_migrate.lua
@@ -208,6 +208,56 @@ local schema = {
         },
         tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
     },
+    {
+        name = "sky_phone_custom_app_data",
+        columns = {
+            { name = "id", type = "BIGINT UNSIGNED NOT NULL AUTO_INCREMENT" },
+            {
+                name = "device_imei",
+                type = "CHAR(15) NOT NULL",
+                characterSet = "ascii",
+                collation = "ascii_bin",
+            },
+            {
+                name = "app_id",
+                type = "VARCHAR(64) NOT NULL",
+                characterSet = "ascii",
+                collation = "ascii_bin",
+            },
+            {
+                name = "data_key",
+                type = "VARCHAR(64) NOT NULL",
+                characterSet = "ascii",
+                collation = "ascii_bin",
+            },
+            { name = "payload", type = "LONGTEXT NOT NULL" },
+            { name = "revision", type = "INT UNSIGNED NOT NULL DEFAULT 1" },
+            {
+                name = "updated_at",
+                type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP",
+            },
+        },
+        primaryKey = "id",
+        uniqueKeys = {
+            {
+                name = "uniq_sky_phone_custom_app_data",
+                columns = "(`device_imei`, `app_id`, `data_key`)",
+            },
+        },
+        indexes = {
+            {
+                name = "idx_sky_phone_custom_app_storage",
+                columns = "(`device_imei`, `app_id`, `updated_at`)",
+            },
+        },
+        foreignKeys = {
+            {
+                column = "device_imei",
+                references = "`sky_phone_devices` (`imei`) ON DELETE CASCADE",
+            },
+        },
+        tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+    },
     {
         name = "sky_phone_device_security",
         columns = {
@@ -2069,6 +2119,242 @@ local schema = {
         },
         tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
     },
+    {
+        name = "sky_phone_company_profiles",
+        columns = {
+            { name = "company_id", type = "VARCHAR(64) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "description", type = "VARCHAR(1000) NOT NULL DEFAULT ''" },
+            { name = "district", type = "VARCHAR(80) NOT NULL DEFAULT ''" },
+            { name = "location_label", type = "VARCHAR(80) NOT NULL DEFAULT ''" },
+            { name = "address", type = "VARCHAR(160) NOT NULL DEFAULT ''" },
+            { name = "location_x", type = "DECIMAL(10,3) NULL" },
+            { name = "location_y", type = "DECIMAL(10,3) NULL" },
+            { name = "location_z", type = "DECIMAL(10,3) NULL" },
+            { name = "logo_media_id", type = "BIGINT UNSIGNED NULL" },
+            { name = "cover_media_id", type = "BIGINT UNSIGNED NULL" },
+            { name = "availability", type = "ENUM('available','busy','closed') NOT NULL DEFAULT 'closed'" },
+            { name = "availability_updated_by", type = "VARCHAR(80) NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "availability_updated_at", type = "DATETIME NULL" },
+            { name = "availability_expires_at", type = "DATETIME NULL" },
+            { name = "accepts_requests", type = "TINYINT(1) NOT NULL DEFAULT 1" },
+            { name = "revision", type = "INT UNSIGNED NOT NULL DEFAULT 1" },
+            { name = "mutation_token", type = "CHAR(36) NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "created_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP" },
+            { name = "updated_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP" },
+        },
+        primaryKey = "company_id",
+        indexes = {
+            { name = "idx_sky_phone_company_profiles_public", columns = "(`availability`, `updated_at`)" },
+        },
+        foreignKeys = {
+            { column = "logo_media_id", references = "`sky_phone_media` (`id`) ON DELETE SET NULL" },
+            { column = "cover_media_id", references = "`sky_phone_media` (`id`) ON DELETE SET NULL" },
+        },
+        tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+    },
+    {
+        name = "sky_phone_company_hours",
+        columns = {
+            { name = "id", type = "BIGINT UNSIGNED NOT NULL AUTO_INCREMENT" },
+            { name = "company_id", type = "VARCHAR(64) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "weekday", type = "TINYINT UNSIGNED NOT NULL" },
+            { name = "is_closed", type = "TINYINT(1) NOT NULL DEFAULT 0" },
+            { name = "opens_at", type = "CHAR(5) NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "closes_at", type = "CHAR(5) NULL", characterSet = "ascii", collation = "ascii_bin" },
+        },
+        primaryKey = "id",
+        uniqueKeys = {
+            { name = "uniq_sky_phone_company_hours_day", columns = "(`company_id`, `weekday`)" },
+        },
+        foreignKeys = {
+            { column = "company_id", references = "`sky_phone_company_profiles` (`company_id`) ON DELETE CASCADE" },
+        },
+        tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+    },
+    {
+        name = "sky_phone_company_services",
+        columns = {
+            { name = "id", type = "VARCHAR(64) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "company_id", type = "VARCHAR(64) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "title", type = "VARCHAR(80) NOT NULL" },
+            { name = "description", type = "VARCHAR(500) NOT NULL DEFAULT ''" },
+            { name = "price_text", type = "VARCHAR(80) NOT NULL DEFAULT ''" },
+            { name = "requests_enabled", type = "TINYINT(1) NOT NULL DEFAULT 1" },
+            { name = "active", type = "TINYINT(1) NOT NULL DEFAULT 1" },
+            { name = "archived", type = "TINYINT(1) NOT NULL DEFAULT 0" },
+            { name = "sort_order", type = "TINYINT UNSIGNED NOT NULL DEFAULT 0" },
+            { name = "created_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP" },
+            { name = "updated_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP" },
+        },
+        primaryKey = "id",
+        indexes = {
+            { name = "idx_sky_phone_company_services_list", columns = "(`company_id`, `archived`, `active`, `sort_order`)" },
+        },
+        foreignKeys = {
+            { column = "company_id", references = "`sky_phone_company_profiles` (`company_id`) ON DELETE CASCADE" },
+        },
+        tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+    },
+    {
+        name = "sky_phone_company_announcements",
+        columns = {
+            { name = "id", type = "CHAR(36) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "company_id", type = "VARCHAR(64) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "title", type = "VARCHAR(120) NOT NULL" },
+            { name = "body", type = "VARCHAR(1000) NOT NULL" },
+            { name = "created_by", type = "VARCHAR(80) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "active", type = "TINYINT(1) NOT NULL DEFAULT 1" },
+            { name = "expires_at", type = "DATETIME NULL" },
+            { name = "created_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP" },
+            { name = "updated_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP" },
+        },
+        primaryKey = "id",
+        indexes = {
+            { name = "idx_sky_phone_company_announcements_active", columns = "(`company_id`, `active`, `expires_at`, `created_at`)" },
+        },
+        foreignKeys = {
+            { column = "company_id", references = "`sky_phone_company_profiles` (`company_id`) ON DELETE CASCADE" },
+        },
+        tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+    },
+    {
+        name = "sky_phone_company_requests",
+        columns = {
+            { name = "id", type = "CHAR(36) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "company_id", type = "VARCHAR(64) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "service_id", type = "VARCHAR(64) NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "customer_sim_id", type = "CHAR(36) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "subject", type = "VARCHAR(120) NOT NULL" },
+            { name = "description", type = "VARCHAR(2000) NOT NULL" },
+            { name = "status", type = "ENUM('new','assigned','in_progress','waiting_customer','completed','cancelled') NOT NULL DEFAULT 'new'" },
+            { name = "assigned_identifier", type = "VARCHAR(80) NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "customer_unread", type = "INT UNSIGNED NOT NULL DEFAULT 0" },
+            { name = "company_activity_revision", type = "INT UNSIGNED NOT NULL DEFAULT 1" },
+            { name = "revision", type = "INT UNSIGNED NOT NULL DEFAULT 1" },
+            { name = "mutation_token", type = "CHAR(36) NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "created_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP" },
+            { name = "updated_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP" },
+            { name = "completed_at", type = "DATETIME NULL" },
+            { name = "cancelled_at", type = "DATETIME NULL" },
+        },
+        primaryKey = "id",
+        indexes = {
+            { name = "idx_sky_phone_company_requests_customer", columns = "(`customer_sim_id`, `updated_at`, `id`)" },
+            { name = "idx_sky_phone_company_requests_queue", columns = "(`company_id`, `status`, `updated_at`, `id`)" },
+            { name = "idx_sky_phone_company_requests_assignee", columns = "(`company_id`, `assigned_identifier`, `status`)" },
+        },
+        foreignKeys = {
+            { column = "company_id", references = "`sky_phone_company_profiles` (`company_id`) ON DELETE CASCADE" },
+            { column = "service_id", references = "`sky_phone_company_services` (`id`) ON DELETE SET NULL" },
+            { column = "customer_sim_id", references = "`sky_phone_sims` (`id`) ON DELETE CASCADE" },
+        },
+        tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+    },
+    {
+        name = "sky_phone_company_request_reads",
+        columns = {
+            { name = "id", type = "BIGINT UNSIGNED NOT NULL AUTO_INCREMENT" },
+            { name = "request_id", type = "CHAR(36) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "reader_identifier", type = "VARCHAR(80) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "read_revision", type = "INT UNSIGNED NOT NULL DEFAULT 0" },
+            { name = "created_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP" },
+            { name = "updated_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP" },
+        },
+        primaryKey = "id",
+        uniqueKeys = {
+            { name = "uniq_sky_phone_company_request_reads_reader", columns = "(`request_id`, `reader_identifier`)" },
+        },
+        indexes = {
+            { name = "idx_sky_phone_company_request_reads_identifier", columns = "(`reader_identifier`, `updated_at`)" },
+        },
+        foreignKeys = {
+            { column = "request_id", references = "`sky_phone_company_requests` (`id`) ON DELETE CASCADE" },
+        },
+        tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+    },
+    {
+        name = "sky_phone_company_request_media",
+        columns = {
+            { name = "id", type = "BIGINT UNSIGNED NOT NULL AUTO_INCREMENT" },
+            { name = "request_id", type = "CHAR(36) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "media_id", type = "BIGINT UNSIGNED NOT NULL" },
+            { name = "sort_order", type = "TINYINT UNSIGNED NOT NULL DEFAULT 0" },
+        },
+        primaryKey = "id",
+        uniqueKeys = {
+            { name = "uniq_sky_phone_company_request_media", columns = "(`request_id`, `media_id`)" },
+            { name = "uniq_sky_phone_company_request_media_order", columns = "(`request_id`, `sort_order`)" },
+        },
+        foreignKeys = {
+            { column = "request_id", references = "`sky_phone_company_requests` (`id`) ON DELETE CASCADE" },
+            { column = "media_id", references = "`sky_phone_media` (`id`) ON DELETE CASCADE" },
+        },
+        tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+    },
+    {
+        name = "sky_phone_company_request_messages",
+        columns = {
+            { name = "id", type = "CHAR(36) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "request_id", type = "CHAR(36) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "sender_type", type = "ENUM('customer','company') NOT NULL" },
+            { name = "sender_identifier", type = "VARCHAR(80) NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "sender_sim_id", type = "CHAR(36) NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "body", type = "VARCHAR(2000) NOT NULL" },
+            { name = "created_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP" },
+        },
+        primaryKey = "id",
+        indexes = {
+            { name = "idx_sky_phone_company_request_messages", columns = "(`request_id`, `created_at`, `id`)" },
+        },
+        foreignKeys = {
+            { column = "request_id", references = "`sky_phone_company_requests` (`id`) ON DELETE CASCADE" },
+            { column = "sender_sim_id", references = "`sky_phone_sims` (`id`) ON DELETE SET NULL" },
+        },
+        tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+    },
+    {
+        name = "sky_phone_company_request_events",
+        columns = {
+            { name = "id", type = "CHAR(36) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "request_id", type = "CHAR(36) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "event_type", type = "ENUM('created','assigned','status','cancelled') NOT NULL" },
+            { name = "actor_type", type = "ENUM('customer','company','system') NOT NULL" },
+            { name = "actor_identifier", type = "VARCHAR(80) NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "from_status", type = "VARCHAR(32) NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "to_status", type = "VARCHAR(32) NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "detail", type = "VARCHAR(255) NOT NULL DEFAULT ''" },
+            { name = "created_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP" },
+        },
+        primaryKey = "id",
+        indexes = {
+            { name = "idx_sky_phone_company_request_events", columns = "(`request_id`, `created_at`, `id`)" },
+        },
+        foreignKeys = {
+            { column = "request_id", references = "`sky_phone_company_requests` (`id`) ON DELETE CASCADE" },
+        },
+        tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+    },
+    {
+        name = "sky_phone_company_audit",
+        columns = {
+            { name = "id", type = "CHAR(36) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "company_id", type = "VARCHAR(64) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "actor_identifier", type = "VARCHAR(80) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "action", type = "VARCHAR(64) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "target_type", type = "VARCHAR(32) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "target_id", type = "VARCHAR(64) NOT NULL", characterSet = "ascii", collation = "ascii_bin" },
+            { name = "metadata", type = "LONGTEXT NOT NULL" },
+            { name = "created_at", type = "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP" },
+        },
+        primaryKey = "id",
+        indexes = {
+            { name = "idx_sky_phone_company_audit", columns = "(`company_id`, `created_at`, `id`)" },
+        },
+        foreignKeys = {
+            { column = "company_id", references = "`sky_phone_company_profiles` (`company_id`) ON DELETE CASCADE" },
+        },
+        tableOptions = "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+    },
 }
 
 Bridge.Database.Migrate("sky_phone", schema)
diff --git a/sky_phone/source/server/phone.lua b/sky_phone/source/server/phone.lua
index e25f8dd..cb37275 100644
--- a/sky_phone/source/server/phone.lua
+++ b/sky_phone/source/server/phone.lua
@@ -569,6 +569,7 @@ function SkyPhone.RequireDeviceSession(source)
 
     local matches = find_device_slots(source, session.imei)
     if not matches[1] then
+        SkyPhoneCompanies.ClearCallAvailability(source)
         sessions[source] = nil
         TriggerClientEvent("sky_phone:device:invalidated", source)
         return nil, { success = false, error = "device_not_owned" }
@@ -722,6 +723,9 @@ local function open_phone(source, used_item)
     end
 
     local security = load_device_security(imei)
+    if sessions[source] and sessions[source].imei ~= imei then
+        SkyPhoneCompanies.ClearCallAvailability(source)
+    end
     sessions[source] = {
         imei = imei,
         slot = slot.slot,
@@ -750,6 +754,9 @@ function SkyPhone.OpenDeviceForCall(source, imei)
         return false
     end
     local security = load_device_security(imei)
+    if sessions[source] and sessions[source].imei ~= imei then
+        SkyPhoneCompanies.ClearCallAvailability(source)
+    end
     sessions[source] = {
         imei = imei,
         slot = matches[1].slot,
@@ -776,10 +783,23 @@ Bridge.Debug(
 )
 
 Bridge.Callbacks.Register("sky_phone:device:close", function(source)
+    SkyPhoneCompanies.ClearCallAvailability(source)
     sessions[source] = nil
     return { success = true }
 end)
 
+Bridge.Callbacks.Register("sky_phone:device:notification-open", function(source, data)
+    if not SkyPhone.AllowOperation(source, "notification_open", 10, 60)
+        or type(data) ~= "table" or type(data.imei) ~= "string"
+    then
+        return { success = false, error = "invalid_request" }
+    end
+    if not SkyPhone.OpenDeviceForCall(source, data.imei) then
+        return { success = false, error = "device_not_owned" }
+    end
+    return { success = true }
+end)
+
 Bridge.Callbacks.Register("sky_phone:security:unlock", function(source, data)
     if not SkyPhone.AllowOperation(source, "security_unlock", Config.Security.AttemptsPerMinute, 60) then
         return { success = false, error = "rate_limited" }
@@ -1087,6 +1107,10 @@ Bridge.Callbacks.Register("sky_phone:device:factory-reset", function(source)
             query = "DELETE FROM `sky_phone_device_data` WHERE `device_imei` = ?",
             params = { session.imei },
         },
+        {
+            query = "DELETE FROM `sky_phone_custom_app_data` WHERE `device_imei` = ?",
+            params = { session.imei },
+        },
         {
             query = "DELETE FROM `sky_phone_notes` WHERE `device_imei` = ? AND `account_id` IS NULL",
             params = { session.imei },
@@ -1129,6 +1153,7 @@ Bridge.Callbacks.Register("sky_phone:device:factory-reset", function(source)
 end)
 
 AddEventHandler("playerDropped", function()
+    SkyPhoneCompanies.ClearCallAvailability(source)
     sessions[source] = nil
     auth_attempts[source] = nil
     operation_attempts[source] = nil
diff --git a/sky_phone/source/server/sim.lua b/sky_phone/source/server/sim.lua
index 601e810..f931e77 100644
--- a/sky_phone/source/server/sim.lua
+++ b/sky_phone/source/server/sim.lua
@@ -27,6 +27,9 @@ end
 local function reserve_sim(sim_type)
     local sim_id
     local number = SkyPhoneSimNumber.Reserve(uuid, function(candidate)
+        if SkyPhoneCompanies.IsServiceNumber(candidate) then
+            return false
+        end
         sim_id = uuid()
         local result = Bridge.Database.Query([[
             INSERT IGNORE INTO `sky_phone_sims` (`id`, `phone_number`, `sim_type`)
@@ -85,6 +88,15 @@ local function ensure_sim(source, slot, sim_type)
     if metadata.sim_id and (not sim or sim.sim_type ~= sim_type or sim.phone_number ~= metadata.phone_number) then
         return nil, "invalid_sim"
     end
+    if sim and SkyPhoneCompanies.IsServiceNumber(sim.phone_number) then
+        Bridge.Debug(
+            "error",
+            "[sky_phone] SIM %s uses reserved company service number %s.",
+            tostring(sim.id),
+            tostring(sim.phone_number)
+        )
+        return nil, "invalid_sim"
+    end
     if not sim then
         sim = reserve_sim(sim_type)
         if not Bridge.Inventory.SetSlotMetadata(source, slot.slot, sim_metadata(sim)) then
@@ -129,6 +141,16 @@ local function insert_sim(source, phone_imei, confirmed)
         pending_insertions[source] = nil
         return { success = false, error = "sim_request_expired" }
     end
+    if SkyPhoneCompanies.IsServiceNumber(pending.sim.phone_number) then
+        pending_insertions[source] = nil
+        Bridge.Debug(
+            "error",
+            "[sky_phone] Refused to insert SIM %s with reserved company service number %s.",
+            tostring(pending.sim.id),
+            tostring(pending.sim.phone_number)
+        )
+        return { success = false, error = "invalid_sim" }
+    end
     local sim_slot = Bridge.Inventory.GetSlot(source, pending.slot)
     if not sim_slot or sim_slot.name ~= pending.item_name or not sim_slot.metadata
         or sim_slot.metadata.sim_id ~= pending.sim.id then
@@ -203,6 +225,7 @@ local function insert_sim(source, phone_imei, confirmed)
     pending_insertions[source] = nil
     operation_locks[source] = nil
     if old_sim then
+        SkyPhoneCompanies.ClearCallAvailability(source)
         SkyPhoneCalls.EndForSim(old_sim.id, "sim_removed")
     end
     SkyPhone.RefreshDevice(phone_imei)
@@ -304,6 +327,7 @@ Bridge.Callbacks.Register("sky_phone:sim:eject", function(source)
         return { success = false, error = "request_failed" }
     end
     operation_locks[source] = nil
+    SkyPhoneCompanies.ClearCallAvailability(source)
     SkyPhoneCalls.EndForSim(sim.id, "sim_removed")
     SkyPhone.RefreshDevice(session.imei)
     return { success = true }
diff --git a/sky_phone/source/shared/custom_app_compat.lua b/sky_phone/source/shared/custom_app_compat.lua
new file mode 100644
index 0000000..d69b0b2
--- /dev/null
+++ b/sky_phone/source/shared/custom_app_compat.lua
@@ -0,0 +1,229 @@
+SkyPhoneCompatibility = {}
+
+SkyPhoneCompatibility.Providers = {
+    lb = "lb_phone",
+    seventeen = "17mov",
+    high = "high_phone",
+    quasar = "quasar_v3",
+    yseries = "yseries",
+}
+
+local function normalize_at_resource_url(owner_resource, url, error_prefix)
+    if type(url) ~= "string" or url == "" then
+        return nil, "invalid_" .. error_prefix
+    end
+    if url:sub(1, 7) == "http://" then
+        return nil, "insecure_" .. error_prefix
+    end
+    if url:sub(1, 1) ~= "@" then
+        return url
+    end
+
+    local url_owner, url_path = url:match("^@([^/]+)/(.+)$")
+    if url_owner ~= owner_resource or not url_path then
+        return nil, error_prefix .. "_owner_mismatch"
+    end
+    return owner_resource .. "/" .. url_path
+end
+
+local function build_locale_maps(app_name, locales)
+    local names = {}
+    local descriptions = {}
+
+    if type(locales) == "table" then
+        for locale, locale_data in pairs(locales) do
+            if type(locale) == "string" and type(locale_data) == "table" then
+                if type(locale_data.label) == "string" and locale_data.label ~= "" then
+                    names[locale] = locale_data.label
+                end
+                if type(locale_data.description) == "string" and locale_data.description ~= "" then
+                    descriptions[locale] = locale_data.description
+                end
+            end
+        end
+    end
+
+    if not next(names) then
+        return app_name, app_name
+    end
+    for locale, label in pairs(names) do
+        if not descriptions[locale] then
+            descriptions[locale] = label
+        end
+    end
+    return names, descriptions
+end
+
+function SkyPhoneCompatibility.CopyQuasarData(app_data)
+    local copy = {}
+    for key, value in pairs(app_data) do
+        if key == "iframe" and type(value) == "table" then
+            copy.iframe = {}
+            for iframe_key, iframe_value in pairs(value) do
+                copy.iframe[iframe_key] = iframe_value
+            end
+        else
+            copy[key] = value
+        end
+    end
+    return copy
+end
+
+function SkyPhoneCompatibility.BuildLbDefinition(owner_resource, app_data)
+    if type(app_data) ~= "table" or type(app_data.identifier) ~= "string" then
+        return nil, "invalid_app_data"
+    end
+
+    local ui, ui_error = normalize_at_resource_url(owner_resource, app_data.ui, "ui")
+    if not ui then
+        return nil, ui_error
+    end
+
+    return {
+        schemaVersion = 1,
+        id = app_data.identifier,
+        name = app_data.name,
+        description = app_data.description,
+        developer = app_data.developer,
+        category = app_data.game and "games" or "utilities",
+        ui = ui,
+        bridgeMode = "legacy",
+        icon = app_data.icon,
+        defaultInstalled = app_data.defaultApp or false,
+        removable = not app_data.defaultApp,
+        orientation = app_data.landscape and "landscape" or "portrait",
+        onInstall = app_data.onInstall,
+        onOpen = app_data.onOpen or app_data.onUse,
+        onClose = app_data.onClose,
+        compatibility = {
+            provider = SkyPhoneCompatibility.Providers.lb,
+            apiVersion = 1,
+        },
+    }
+end
+
+function SkyPhoneCompatibility.Build17MovDefinition(app_data)
+    if type(app_data) ~= "table" or type(app_data.name) ~= "string" then
+        return nil, "invalid_app_data"
+    end
+
+    return {
+        schemaVersion = 1,
+        id = app_data.name,
+        name = app_data.label,
+        description = app_data.description or app_data.label,
+        category = "utilities",
+        ui = app_data.ui,
+        bridgeMode = "legacy",
+        icon = app_data.icon,
+        iconBackground = type(app_data.iconBackground) == "string" and app_data.iconBackground or nil,
+        defaultInstalled = app_data.default or app_data.preInstalled or false,
+        removable = not app_data.default,
+        orientation = "portrait",
+        compatibility = {
+            provider = SkyPhoneCompatibility.Providers.seventeen,
+            apiVersion = 1,
+        },
+    }
+end
+
+function SkyPhoneCompatibility.BuildHighDefinition(owner_resource, app_name, data, locales)
+    if type(owner_resource) ~= "string" or type(app_name) ~= "string" or type(data) ~= "table" then
+        return nil, "invalid_app_data"
+    end
+    if #app_name > 64 or not app_name:match("^[a-z0-9][a-z0-9._-]+$") then
+        return nil, "invalid_app_id"
+    end
+
+    local external_url, url_error = normalize_at_resource_url(
+        owner_resource,
+        data.externalUrl,
+        "external_url"
+    )
+    if not external_url then
+        return nil, url_error
+    end
+
+    local name, description = build_locale_maps(app_name, locales)
+    local icon = type(data.icon) == "table" and data.icon.imageUrl or data.icon
+    return {
+        schemaVersion = 1,
+        id = app_name,
+        name = name,
+        description = description,
+        developer = data.developer,
+        category = "utilities",
+        ui = external_url,
+        bridgeMode = "legacy",
+        icon = icon,
+        iconBackground = type(data.icon) == "table" and data.icon.background or nil,
+        defaultInstalled = data.preAdded or false,
+        removable = data.removable ~= false,
+        orientation = "portrait",
+        compatibility = {
+            provider = SkyPhoneCompatibility.Providers.high,
+            apiVersion = 1,
+        },
+    }
+end
+
+function SkyPhoneCompatibility.BuildQuasarDefinition(app_data)
+    local iframe_url = type(app_data) == "table"
+        and type(app_data.iframe) == "table"
+        and app_data.iframe.url
+        or nil
+    if type(app_data) ~= "table"
+        or type(app_data.id) ~= "string"
+        or type(app_data.label) ~= "string"
+        or type(iframe_url) ~= "string"
+    then
+        return nil, "invalid_app_data"
+    end
+
+    return {
+        schemaVersion = 1,
+        id = app_data.id,
+        name = app_data.label,
+        description = app_data.description or app_data.label,
+        category = "utilities",
+        ui = iframe_url,
+        bridgeMode = "legacy",
+        icon = app_data.icon,
+        defaultInstalled = app_data.defaultInstalled or false,
+        removable = true,
+        orientation = "portrait",
+        compatibility = {
+            provider = SkyPhoneCompatibility.Providers.quasar,
+            apiVersion = 1,
+        },
+    }
+end
+
+function SkyPhoneCompatibility.BuildYSeriesDefinition(app_data)
+    if type(app_data) ~= "table" or type(app_data.key) ~= "string" then
+        return nil, "invalid_app_data"
+    end
+
+    local icon = app_data.icon
+    if type(icon) == "table" then
+        icon = icon.yos or icon.humanoid
+    end
+
+    return {
+        schemaVersion = 1,
+        id = app_data.key,
+        name = app_data.name,
+        description = app_data.description or app_data.name,
+        category = app_data.game and "games" or "utilities",
+        ui = app_data.ui,
+        bridgeMode = "legacy",
+        icon = icon,
+        defaultInstalled = app_data.defaultApp or false,
+        removable = true,
+        orientation = "portrait",
+        compatibility = {
+            provider = SkyPhoneCompatibility.Providers.yseries,
+            apiVersion = 1,
+        },
+    }
+end
diff --git a/sky_phone/source/shared/custom_apps.lua b/sky_phone/source/shared/custom_apps.lua
new file mode 100644
index 0000000..a21d199
--- /dev/null
+++ b/sky_phone/source/shared/custom_apps.lua
@@ -0,0 +1,451 @@
+local APP_ID_MAX_LENGTH = 64
+local DESCRIPTION_MAX_LENGTH = 320
+local DEVELOPER_MAX_LENGTH = 96
+local NAME_MAX_LENGTH = 64
+local PATH_MAX_LENGTH = 512
+local VERSION_MAX_LENGTH = 32
+
+local ALLOWED_CATEGORIES = {
+    games = true,
+    productivity = true,
+    shopping = true,
+    social = true,
+    utilities = true,
+}
+
+local ALLOWED_ORIENTATIONS = {
+    any = true,
+    landscape = true,
+    portrait = true,
+}
+
+local ALLOWED_PERMISSIONS = {
+    ["app.close"] = true,
+    ["app.open"] = true,
+    ["camera.capture"] = true,
+    ["contacts.pick"] = true,
+    ["device.storage"] = true,
+    ["locale.read"] = true,
+    ["location.read"] = true,
+    ["media.pick"] = true,
+    ["notifications"] = true,
+    ["notifications.critical"] = true,
+    ["nui.fetch"] = true,
+    ["theme.read"] = true,
+}
+
+local RESERVED_APP_IDS = {
+    ["app-store"] = true,
+    banking = true,
+    billing = true,
+    calculator = true,
+    calendar = true,
+    camera = true,
+    citymarkt = true,
+    clock = true,
+    companies = true,
+    crewlink = true,
+    darkchat = true,
+    feather = true,
+    flare = true,
+    fliptok = true,
+    garage = true,
+    house = true,
+    ["local-pages"] = true,
+    mail = true,
+    map = true,
+    memory = true,
+    messages = true,
+    minesweeper = true,
+    music = true,
+    ["neon-drop"] = true,
+    notes = true,
+    ["number-merge"] = true,
+    phone = true,
+    photos = true,
+    picstagram = true,
+    radio = true,
+    settings = true,
+    ["sky-flappy"] = true,
+    skyride = true,
+    snake = true,
+    ["tower-stack"] = true,
+    weather = true,
+}
+
+local bundled_manifests = {}
+local bundled_manifests_by_id = {}
+
+SkyPhoneApps = SkyPhoneApps or {}
+SkyPhoneApps.ProtocolVersion = 1
+
+local function trim(value)
+    return value:match("^%s*(.-)%s*$")
+end
+
+local function validate_app_id(app_id)
+    if type(app_id) ~= "string" then
+        return false, "invalid_app_id"
+    end
+
+    if #app_id == 0 or #app_id > APP_ID_MAX_LENGTH then
+        return false, "invalid_app_id"
+    end
+
+    if not app_id:match("^[a-z0-9][a-z0-9._-]+$") then
+        return false, "invalid_app_id"
+    end
+
+    return true
+end
+
+local function validate_text(value, error_code, maximum_length, required)
+    if value == nil and not required then
+        return nil
+    end
+
+    if type(value) ~= "string" then
+        return nil, error_code
+    end
+
+    local normalized = trim(value)
+    if (required and #normalized == 0) or #normalized > maximum_length then
+        return nil, error_code
+    end
+
+    return normalized
+end
+
+local function validate_localized_text(value, error_code, maximum_length, required)
+    if type(value) == "string" then
+        return validate_text(value, error_code, maximum_length, required)
+    end
+
+    if type(value) ~= "table" then
+        return nil, error_code
+    end
+
+    local normalized = {}
+    local count = 0
+    for locale, text in pairs(value) do
+        if type(locale) ~= "string" or not locale:match("^[a-zA-Z][a-zA-Z0-9_-]*$") then
+            return nil, error_code
+        end
+
+        local normalized_text = validate_text(text, error_code, maximum_length, true)
+        if not normalized_text then
+            return nil, error_code
+        end
+
+        count = count + 1
+        if count > 16 then
+            return nil, error_code
+        end
+
+        normalized[locale:lower():gsub("_", "-")] = normalized_text
+    end
+
+    if count == 0 then
+        return nil, error_code
+    end
+
+    return normalized
+end
+
+local function validate_local_path(path, required)
+    if path == nil and not required then
+        return nil
+    end
+
+    if type(path) ~= "string" or #path == 0 or #path > PATH_MAX_LENGTH then
+        return nil, "invalid_local_path"
+    end
+
+    if path:sub(1, 1) == "/" or path:find("\\", 1, true) or path:find(":", 1, true) then
+        return nil, "invalid_local_path"
+    end
+
+    if not path:match("^web/[%w%._%-%/]+$") then
+        return nil, "invalid_local_path"
+    end
+
+    for segment in path:gmatch("[^/]+") do
+        if segment == "." or segment == ".." then
+            return nil, "invalid_local_path"
+        end
+    end
+
+    return path
+end
+
+local function validate_string_array(value, error_code, maximum_items, validator)
+    if value == nil then
+        return {}
+    end
+
+    if type(value) ~= "table" then
+        return nil, error_code
+    end
+
+    local normalized = {}
+    local count = 0
+    for key in pairs(value) do
+        if type(key) ~= "number" or key < 1 or key % 1 ~= 0 then
+            return nil, error_code
+        end
+        count = count + 1
+    end
+
+    if count ~= #value or count > maximum_items then
+        return nil, error_code
+    end
+
+    for index = 1, count do
+        local item = value[index]
+        if type(item) ~= "string" then
+            return nil, error_code
+        end
+
+        local normalized_item, validation_error = validator(item)
+        if not normalized_item then
+            return nil, validation_error or error_code
+        end
+
+        normalized[index] = normalized_item
+    end
+
+    return normalized
+end
+
+local function validate_permissions(value)
+    local permissions, error_code = validate_string_array(
+        value,
+        "invalid_permissions",
+        32,
+        function(permission)
+            if not ALLOWED_PERMISSIONS[permission] then
+                return nil, "unknown_permission"
+            end
+            return permission
+        end
+    )
+    if not permissions then
+        return nil, error_code
+    end
+
+    local seen = {}
+    for index = 1, #permissions do
+        local permission = permissions[index]
+        if seen[permission] then
+            return nil, "duplicate_permission"
+        end
+        seen[permission] = true
+    end
+
+    return permissions
+end
+
+local function validate_grid_order(value)
+    if value == nil then
+        return nil
+    end
+
+    if type(value) ~= "number" or value ~= math.floor(value) or value < 0 or value > 9999 then
+        return nil, "invalid_grid_order"
+    end
+
+    return value
+end
+
+local function validate_icon_background(value)
+    if value == nil then
+        return nil
+    end
+
+    if type(value) ~= "string" or #value == 0 or #value > 64 then
+        return nil, "invalid_icon_background"
+    end
+
+    if value:find("[\r\n;{}]") then
+        return nil, "invalid_icon_background"
+    end
+
+    return value
+end
+
+local function normalize_manifest(folder, definition)
+    if type(folder) ~= "string" or type(definition) ~= "table" then
+        return nil, "invalid_manifest"
+    end
+
+    if definition.schemaVersion ~= SkyPhoneApps.ProtocolVersion then
+        return nil, "unsupported_schema_version"
+    end
+
+    local app_id = definition.id
+    local valid_id, id_error = validate_app_id(app_id)
+    if not valid_id then
+        return nil, id_error
+    end
+    if RESERVED_APP_IDS[app_id] then
+        return nil, "reserved_app_id"
+    end
+    if folder ~= app_id then
+        return nil, "folder_id_mismatch"
+    end
+
+    if definition.defaultInstalled ~= nil and type(definition.defaultInstalled) ~= "boolean" then
+        return nil, "invalid_default_installed"
+    end
+    if definition.removable ~= nil and type(definition.removable) ~= "boolean" then
+        return nil, "invalid_removable"
+    end
+
+    local version, version_error = validate_text(
+        definition.version or "1.0.0",
+        "invalid_version",
+        VERSION_MAX_LENGTH,
+        true
+    )
+    if not version then
+        return nil, version_error
+    end
+    if not version:match("^[%w%._+-]+$") then
+        return nil, "invalid_version"
+    end
+
+    local name, name_error = validate_localized_text(
+        definition.name,
+        "invalid_name",
+        NAME_MAX_LENGTH,
+        true
+    )
+    if not name then
+        return nil, name_error
+    end
+
+    local description, description_error = validate_localized_text(
+        definition.description,
+        "invalid_description",
+        DESCRIPTION_MAX_LENGTH,
+        true
+    )
+    if not description then
+        return nil, description_error
+    end
+
+    local developer, developer_error = validate_text(
+        definition.developer,
+        "invalid_developer",
+        DEVELOPER_MAX_LENGTH,
+        false
+    )
+    if definition.developer ~= nil and not developer then
+        return nil, developer_error
+    end
+
+    local category = definition.category or "utilities"
+    if not ALLOWED_CATEGORIES[category] then
+        return nil, "invalid_category"
+    end
+
+    local entry, entry_error = validate_local_path(definition.entry, true)
+    if not entry then
+        return nil, entry_error
+    end
+
+    local icon, icon_error = validate_local_path(definition.icon, false)
+    if definition.icon ~= nil and not icon then
+        return nil, icon_error
+    end
+
+    local screenshots, screenshots_error = validate_string_array(
+        definition.screenshots,
+        "invalid_screenshots",
+        8,
+        function(path)
+            return validate_local_path(path, true)
+        end
+    )
+    if not screenshots then
+        return nil, screenshots_error
+    end
+
+    local permissions, permissions_error = validate_permissions(definition.permissions)
+    if not permissions then
+        return nil, permissions_error
+    end
+
+    local orientation = definition.orientation or "portrait"
+    if not ALLOWED_ORIENTATIONS[orientation] then
+        return nil, "invalid_orientation"
+    end
+
+    local grid_order, grid_order_error = validate_grid_order(definition.gridOrder)
+    if definition.gridOrder ~= nil and not grid_order then
+        return nil, grid_order_error
+    end
+
+    local icon_background, background_error = validate_icon_background(definition.iconBackground)
+    if definition.iconBackground ~= nil and not icon_background then
+        return nil, background_error
+    end
+
+    local bridge_mode = definition.bridgeMode or "sky"
+    if bridge_mode ~= "sky" and bridge_mode ~= "legacy" then
+        return nil, "invalid_bridge_mode"
+    end
+
+    return {
+        bridgeMode = bridge_mode,
+        category = category,
+        defaultInstalled = definition.defaultInstalled == true,
+        description = description,
+        developer = developer,
+        entry = entry,
+        folder = folder,
+        gridOrder = grid_order,
+        icon = icon,
+        iconBackground = icon_background,
+        id = app_id,
+        name = name,
+        orientation = orientation,
+        permissions = permissions,
+        removable = definition.removable ~= false,
+        schemaVersion = SkyPhoneApps.ProtocolVersion,
+        screenshots = screenshots,
+        version = version,
+    }
+end
+
+---@param folder string App folder relative to custom_apps.
+---@param definition table Declarative bundled app manifest.
+function SkyPhoneApps.RegisterManifest(folder, definition)
+    local manifest, error_code = normalize_manifest(folder, definition)
+    if not manifest then
+        error(("[sky_phone] Invalid custom app manifest '%s': %s"):format(tostring(folder), error_code), 2)
+    end
+
+    if bundled_manifests_by_id[manifest.id] then
+        error(("[sky_phone] Duplicate bundled custom app id '%s'."):format(manifest.id), 2)
+    end
+
+    bundled_manifests[#bundled_manifests + 1] = manifest
+    bundled_manifests_by_id[manifest.id] = manifest
+end
+
+function SkyPhoneApps.GetBundledManifests()
+    return bundled_manifests
+end
+
+function SkyPhoneApps.GetBundledManifest(app_id)
+    return bundled_manifests_by_id[app_id]
+end
+
+SkyPhoneApps.AllowedCategories = ALLOWED_CATEGORIES
+SkyPhoneApps.AllowedOrientations = ALLOWED_ORIENTATIONS
+SkyPhoneApps.AllowedPermissions = ALLOWED_PERMISSIONS
+SkyPhoneApps.ReservedAppIds = RESERVED_APP_IDS
+SkyPhoneApps.ValidateAppId = validate_app_id
+SkyPhoneApps.ValidateLocalizedText = validate_localized_text
+SkyPhoneApps.ValidatePermissions = validate_permissions
diff --git a/sky_phone/sql/install.sql b/sky_phone/sql/install.sql
index 7e93c5d..f7127dc 100644
--- a/sky_phone/sql/install.sql
+++ b/sky_phone/sql/install.sql
@@ -92,6 +92,20 @@ CREATE TABLE IF NOT EXISTS `sky_phone_device_data` (
     FOREIGN KEY (`device_imei`) REFERENCES `sky_phone_devices` (`imei`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
+CREATE TABLE IF NOT EXISTS `sky_phone_custom_app_data` (
+    `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+    `device_imei` CHAR(15) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `app_id` VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `data_key` VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `payload` LONGTEXT NOT NULL,
+    `revision` INT UNSIGNED NOT NULL DEFAULT 1,
+    `updated_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    PRIMARY KEY (`id`),
+    UNIQUE KEY `uniq_sky_phone_custom_app_data` (`device_imei`, `app_id`, `data_key`),
+    KEY `idx_sky_phone_custom_app_storage` (`device_imei`, `app_id`, `updated_at`),
+    FOREIGN KEY (`device_imei`) REFERENCES `sky_phone_devices` (`imei`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
 CREATE TABLE IF NOT EXISTS `sky_phone_device_security` (
     `device_imei` CHAR(15) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
     `passcode_hash` BINARY(32) NOT NULL,
@@ -929,3 +943,167 @@ CREATE TABLE IF NOT EXISTS `sky_phone_crewlink_pings` (
     FOREIGN KEY (`group_id`) REFERENCES `sky_phone_crewlink_groups` (`id`) ON DELETE CASCADE,
     FOREIGN KEY (`creator_profile_id`) REFERENCES `sky_phone_crewlink_profiles` (`id`) ON DELETE SET NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `sky_phone_company_profiles` (
+    `company_id` VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `description` VARCHAR(1000) NOT NULL DEFAULT '',
+    `district` VARCHAR(80) NOT NULL DEFAULT '',
+    `location_label` VARCHAR(80) NOT NULL DEFAULT '',
+    `address` VARCHAR(160) NOT NULL DEFAULT '',
+    `location_x` DECIMAL(10,3) NULL,
+    `location_y` DECIMAL(10,3) NULL,
+    `location_z` DECIMAL(10,3) NULL,
+    `logo_media_id` BIGINT UNSIGNED NULL,
+    `cover_media_id` BIGINT UNSIGNED NULL,
+    `availability` ENUM('available','busy','closed') NOT NULL DEFAULT 'closed',
+    `availability_updated_by` VARCHAR(80) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    `availability_updated_at` DATETIME NULL,
+    `availability_expires_at` DATETIME NULL,
+    `accepts_requests` TINYINT(1) NOT NULL DEFAULT 1,
+    `revision` INT UNSIGNED NOT NULL DEFAULT 1,
+    `mutation_token` CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    `created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    `updated_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    PRIMARY KEY (`company_id`),
+    KEY `idx_sky_phone_company_profiles_public` (`availability`,`updated_at`),
+    FOREIGN KEY (`logo_media_id`) REFERENCES `sky_phone_media` (`id`) ON DELETE SET NULL,
+    FOREIGN KEY (`cover_media_id`) REFERENCES `sky_phone_media` (`id`) ON DELETE SET NULL
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `sky_phone_company_hours` (
+    `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+    `company_id` VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `weekday` TINYINT UNSIGNED NOT NULL,
+    `is_closed` TINYINT(1) NOT NULL DEFAULT 0,
+    `opens_at` CHAR(5) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    `closes_at` CHAR(5) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    PRIMARY KEY (`id`),
+    UNIQUE KEY `uniq_sky_phone_company_hours_day` (`company_id`,`weekday`),
+    FOREIGN KEY (`company_id`) REFERENCES `sky_phone_company_profiles` (`company_id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `sky_phone_company_services` (
+    `id` VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `company_id` VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `title` VARCHAR(80) NOT NULL,
+    `description` VARCHAR(500) NOT NULL DEFAULT '',
+    `price_text` VARCHAR(80) NOT NULL DEFAULT '',
+    `requests_enabled` TINYINT(1) NOT NULL DEFAULT 1,
+    `active` TINYINT(1) NOT NULL DEFAULT 1,
+    `archived` TINYINT(1) NOT NULL DEFAULT 0,
+    `sort_order` TINYINT UNSIGNED NOT NULL DEFAULT 0,
+    `created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    `updated_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    PRIMARY KEY (`id`),
+    KEY `idx_sky_phone_company_services_list` (`company_id`,`archived`,`active`,`sort_order`),
+    FOREIGN KEY (`company_id`) REFERENCES `sky_phone_company_profiles` (`company_id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `sky_phone_company_announcements` (
+    `id` CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `company_id` VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `title` VARCHAR(120) NOT NULL,
+    `body` VARCHAR(1000) NOT NULL,
+    `created_by` VARCHAR(80) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `active` TINYINT(1) NOT NULL DEFAULT 1,
+    `expires_at` DATETIME NULL,
+    `created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    `updated_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    PRIMARY KEY (`id`),
+    KEY `idx_sky_phone_company_announcements_active` (`company_id`,`active`,`expires_at`,`created_at`),
+    FOREIGN KEY (`company_id`) REFERENCES `sky_phone_company_profiles` (`company_id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `sky_phone_company_requests` (
+    `id` CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `company_id` VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `service_id` VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    `customer_sim_id` CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `subject` VARCHAR(120) NOT NULL,
+    `description` VARCHAR(2000) NOT NULL,
+    `status` ENUM('new','assigned','in_progress','waiting_customer','completed','cancelled') NOT NULL DEFAULT 'new',
+    `assigned_identifier` VARCHAR(80) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    `customer_unread` INT UNSIGNED NOT NULL DEFAULT 0,
+    `company_activity_revision` INT UNSIGNED NOT NULL DEFAULT 1,
+    `revision` INT UNSIGNED NOT NULL DEFAULT 1,
+    `mutation_token` CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    `created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    `updated_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    `completed_at` DATETIME NULL,
+    `cancelled_at` DATETIME NULL,
+    PRIMARY KEY (`id`),
+    KEY `idx_sky_phone_company_requests_customer` (`customer_sim_id`,`updated_at`,`id`),
+    KEY `idx_sky_phone_company_requests_queue` (`company_id`,`status`,`updated_at`,`id`),
+    KEY `idx_sky_phone_company_requests_assignee` (`company_id`,`assigned_identifier`,`status`),
+    FOREIGN KEY (`company_id`) REFERENCES `sky_phone_company_profiles` (`company_id`) ON DELETE CASCADE,
+    FOREIGN KEY (`service_id`) REFERENCES `sky_phone_company_services` (`id`) ON DELETE SET NULL,
+    FOREIGN KEY (`customer_sim_id`) REFERENCES `sky_phone_sims` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `sky_phone_company_request_reads` (
+    `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+    `request_id` CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `reader_identifier` VARCHAR(80) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `read_revision` INT UNSIGNED NOT NULL DEFAULT 0,
+    `created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    `updated_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    PRIMARY KEY (`id`),
+    UNIQUE KEY `uniq_sky_phone_company_request_reads_reader` (`request_id`,`reader_identifier`),
+    KEY `idx_sky_phone_company_request_reads_identifier` (`reader_identifier`,`updated_at`),
+    FOREIGN KEY (`request_id`) REFERENCES `sky_phone_company_requests` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `sky_phone_company_request_media` (
+    `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+    `request_id` CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `media_id` BIGINT UNSIGNED NOT NULL,
+    `sort_order` TINYINT UNSIGNED NOT NULL DEFAULT 0,
+    PRIMARY KEY (`id`),
+    UNIQUE KEY `uniq_sky_phone_company_request_media` (`request_id`,`media_id`),
+    UNIQUE KEY `uniq_sky_phone_company_request_media_order` (`request_id`,`sort_order`),
+    FOREIGN KEY (`request_id`) REFERENCES `sky_phone_company_requests` (`id`) ON DELETE CASCADE,
+    FOREIGN KEY (`media_id`) REFERENCES `sky_phone_media` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `sky_phone_company_request_messages` (
+    `id` CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `request_id` CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `sender_type` ENUM('customer','company') NOT NULL,
+    `sender_identifier` VARCHAR(80) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    `sender_sim_id` CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    `body` VARCHAR(2000) NOT NULL,
+    `created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (`id`),
+    KEY `idx_sky_phone_company_request_messages` (`request_id`,`created_at`,`id`),
+    FOREIGN KEY (`request_id`) REFERENCES `sky_phone_company_requests` (`id`) ON DELETE CASCADE,
+    FOREIGN KEY (`sender_sim_id`) REFERENCES `sky_phone_sims` (`id`) ON DELETE SET NULL
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `sky_phone_company_request_events` (
+    `id` CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `request_id` CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `event_type` ENUM('created','assigned','status','cancelled') NOT NULL,
+    `actor_type` ENUM('customer','company','system') NOT NULL,
+    `actor_identifier` VARCHAR(80) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    `from_status` VARCHAR(32) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    `to_status` VARCHAR(32) CHARACTER SET ascii COLLATE ascii_bin NULL,
+    `detail` VARCHAR(255) NOT NULL DEFAULT '',
+    `created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (`id`),
+    KEY `idx_sky_phone_company_request_events` (`request_id`,`created_at`,`id`),
+    FOREIGN KEY (`request_id`) REFERENCES `sky_phone_company_requests` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `sky_phone_company_audit` (
+    `id` CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `company_id` VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `actor_identifier` VARCHAR(80) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `action` VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `target_type` VARCHAR(32) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `target_id` VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    `metadata` LONGTEXT NOT NULL,
+    `created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (`id`),
+    KEY `idx_sky_phone_company_audit` (`company_id`,`created_at`,`id`),
+    FOREIGN KEY (`company_id`) REFERENCES `sky_phone_company_profiles` (`company_id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
diff --git a/tests/custom_app_compat.lua b/tests/custom_app_compat.lua
new file mode 100644
index 0000000..55c79b4
--- /dev/null
+++ b/tests/custom_app_compat.lua
@@ -0,0 +1,80 @@
+dofile("sky_phone/source/shared/custom_app_compat.lua")
+
+local lb_definition = assert(SkyPhoneCompatibility.BuildLbDefinition("lb_app", {
+    identifier = "dispatch",
+    name = "Dispatch",
+    description = "Dispatch terminal",
+    ui = "ui/index.html",
+    defaultApp = true,
+    landscape = true,
+    onUse = function() end,
+}))
+assert(lb_definition.id == "dispatch", "LB identifier must map to the Sky app ID")
+assert(lb_definition.ui == "ui/index.html", "LB relative UI must remain owner-relative")
+assert(lb_definition.orientation == "landscape", "LB landscape flag must be preserved")
+assert(type(lb_definition.onOpen) == "function", "LB onUse must map to the open lifecycle")
+
+local invalid_lb, invalid_lb_error = SkyPhoneCompatibility.BuildLbDefinition("lb_app", {
+    identifier = "dispatch",
+    name = "Dispatch",
+    ui = "@another_resource/ui/index.html",
+})
+assert(invalid_lb == nil, "LB must reject an @ URL owned by another resource")
+assert(invalid_lb_error == "ui_owner_mismatch", "LB owner mismatch must be explicit")
+
+local mov_definition = assert(SkyPhoneCompatibility.Build17MovDefinition({
+    name = "market",
+    label = "Market",
+    ui = "https://cfx-nui-market_app/ui/index.html",
+    iconBackground = "#112233",
+    preInstalled = true,
+}))
+assert(mov_definition.id == "market", "17mov name must map to the Sky app ID")
+assert(mov_definition.iconBackground == "#112233", "17mov icon background must be preserved")
+assert(mov_definition.defaultInstalled, "17mov preInstalled must be preserved")
+
+local high_definition = assert(SkyPhoneCompatibility.BuildHighDefinition("high_app", "bankingv2", {
+    externalUrl = "@high_app/ui/index.html",
+    icon = {
+        imageUrl = "ui/icon.png",
+        background = "#1b1b1b",
+    },
+    preAdded = true,
+}, {
+    en = {
+        label = "Banking",
+        description = "Banking app",
+    },
+}))
+assert(high_definition.ui == "high_app/ui/index.html", "High @ URL must normalize to its owner")
+assert(high_definition.name.en == "Banking", "High locale labels must be preserved")
+assert(high_definition.iconBackground == "#1b1b1b", "High icon background must be preserved")
+
+local quasar_data = {
+    id = "services",
+    label = "Services",
+    iframe = {
+        url = "https://cfx-nui-services/ui/index.html",
+    },
+}
+local quasar_definition = assert(SkyPhoneCompatibility.BuildQuasarDefinition(quasar_data))
+local quasar_copy = SkyPhoneCompatibility.CopyQuasarData(quasar_data)
+quasar_copy.iframe.url = "changed"
+assert(quasar_definition.id == "services", "Quasar ID must be preserved")
+assert(quasar_data.iframe.url ~= quasar_copy.iframe.url, "Quasar iframe data must be copied")
+
+local yseries_definition = assert(SkyPhoneCompatibility.BuildYSeriesDefinition({
+    key = "slots",
+    name = "Slots",
+    ui = "https://cfx-nui-slots/ui/index.html",
+    icon = {
+        yos = "ui/yos.png",
+        humanoid = "ui/humanoid.png",
+    },
+    game = true,
+}))
+assert(yseries_definition.id == "slots", "YSeries key must map to the Sky app ID")
+assert(yseries_definition.icon == "ui/yos.png", "YSeries must prefer the YOS icon")
+assert(yseries_definition.category == "games", "YSeries game flag must be preserved")
+
+print("Custom app compatibility mapping tests passed")
diff --git a/tests/custom_app_compat_client.lua b/tests/custom_app_compat_client.lua
new file mode 100644
index 0000000..0a21629
--- /dev/null
+++ b/tests/custom_app_compat_client.lua
@@ -0,0 +1,140 @@
+local registered_exports = {}
+local invoking_resource = nil
+
+Config = {
+    Bridge = {
+        Locale = "en",
+    },
+    CustomApps = {
+        AllowRemoteOrigins = {},
+        BundledApps = false,
+        Enabled = true,
+        ExternalApps = true,
+        MaximumMessageBytes = 65536,
+        MaximumStorageBytesPerApp = 262144,
+        MaximumStorageKeyLength = 64,
+        MaximumStorageValueBytes = 65536,
+        ReadyTimeoutMs = 8000,
+        TrustedAdapters = {},
+    },
+}
+
+json = {
+    decode = function()
+        return {}
+    end,
+    encode = function()
+        return "{}"
+    end,
+}
+
+exports = setmetatable({}, {
+    __call = function(_, export_name, handler)
+        registered_exports[export_name] = handler
+    end,
+})
+
+function GetCurrentResourceName()
+    return "sky_phone"
+end
+
+function GetInvokingResource()
+    return invoking_resource
+end
+
+function GetResourceState(resource_name)
+    if resource_name == "missing_resource" then
+        return "missing"
+    end
+    return "started"
+end
+
+function RegisterNUICallback() end
+function RegisterNetEvent() end
+function AddEventHandler() end
+function SendNUIMessage() end
+function TriggerServerEvent() end
+function TriggerEvent() end
+
+function CreateThread(handler)
+    handler()
+end
+
+dofile("sky_phone/source/shared/custom_apps.lua")
+dofile("sky_phone/source/shared/custom_app_compat.lua")
+dofile("sky_phone/source/client/custom_apps.lua")
+dofile("sky_phone/source/client/custom_app_compat.lua")
+
+invoking_resource = "lb_app"
+local lb_success, lb_error = registered_exports.AddCustomApp({
+    identifier = "dispatch",
+    name = "Dispatch",
+    description = "Dispatch terminal",
+    ui = "ui/index.html",
+})
+assert(lb_success and lb_error == nil, "LB AddCustomApp must register through the shared export")
+
+invoking_resource = "another_app"
+local duplicate_success, duplicate_error = registered_exports.AddCustomApp({
+    identifier = "dispatch",
+    name = "Hijack",
+    description = "Hijack",
+    ui = "ui/index.html",
+})
+assert(not duplicate_success and duplicate_error == "duplicate_app_id", "cross-owner IDs must be rejected")
+
+local remove_success, remove_error = registered_exports.RemoveCustomApp("dispatch")
+assert(not remove_success and remove_error == "app_owner_mismatch", "cross-owner removal must be rejected")
+
+invoking_resource = "lb_app"
+assert(registered_exports.RemoveCustomApp("dispatch"), "the LB owner must be able to remove its app")
+
+invoking_resource = "yseries_app"
+assert(registered_exports.AddCustomApp({
+    key = "slots",
+    name = "Slots",
+    ui = "https://cfx-nui-yseries_app/ui/index.html",
+}), "YSeries AddCustomApp must be selected from the key field")
+
+local ambiguous_success, ambiguous_error = registered_exports.AddCustomApp({
+    id = "ambiguous",
+    identifier = "ambiguous",
+    name = "Ambiguous",
+    ui = "ui/index.html",
+})
+assert(not ambiguous_success and ambiguous_error == "ambiguous_app_provider", "ambiguous schemas must fail")
+
+invoking_resource = "mov_app"
+assert(registered_exports.AddApplication({
+    name = "market",
+    label = "Market",
+    ui = "https://cfx-nui-mov_app/ui/index.html",
+}), "17mov AddApplication must register")
+
+invoking_resource = "high_app"
+assert(registered_exports.addApplication("bankingv2", {
+    externalUrl = "@high_app/ui/index.html",
+}, {
+    en = {
+        label = "Banking",
+        description = "Banking app",
+    },
+}), "High addApplication must register")
+
+invoking_resource = "quasar_app"
+assert(registered_exports.addCustomApp({
+    id = "services",
+    label = "Services",
+    iframe = {
+        url = "https://cfx-nui-quasar_app/ui/index.html",
+    },
+}), "Quasar addCustomApp must register")
+
+local quasar_apps = registered_exports.getCustomApps()
+assert(#quasar_apps == 1 and quasar_apps[1].id == "services", "Quasar getCustomApps must expose the registry")
+assert(registered_exports.updateCustomApp("services", {
+    label = "City Services",
+}), "Quasar updateCustomApp must update an owned app")
+assert(registered_exports.removeCustomApp("services"), "Quasar removeCustomApp must remove an owned app")
+
+print("Custom app compatibility client tests passed")
diff --git a/tests/custom_app_compat_server.lua b/tests/custom_app_compat_server.lua
new file mode 100644
index 0000000..2ba77f6
--- /dev/null
+++ b/tests/custom_app_compat_server.lua
@@ -0,0 +1,68 @@
+local event_handlers = {}
+local registered_exports = {}
+local sent_events = {}
+local invoking_resource = nil
+
+exports = setmetatable({}, {
+    __call = function(_, export_name, handler)
+        registered_exports[export_name] = handler
+    end,
+})
+
+function GetCurrentResourceName()
+    return "sky_phone"
+end
+
+function GetInvokingResource()
+    return invoking_resource
+end
+
+function GetGameTimer()
+    return 5000
+end
+
+function RegisterNetEvent(event_name, handler)
+    event_handlers[event_name] = handler
+end
+
+function AddEventHandler() end
+
+function TriggerClientEvent(event_name, target, ...)
+    sent_events[#sent_events + 1] = {
+        arguments = { ... },
+        event_name = event_name,
+        target = target,
+    }
+end
+
+dofile("sky_phone/source/shared/custom_app_compat.lua")
+dofile("sky_phone/source/server/custom_app_compat.lua")
+
+invoking_resource = "high_server_app"
+local add_success, add_error = registered_exports.addApplication("bankingv2", {
+    externalUrl = "@high_server_app/ui/index.html",
+}, {
+    en = {
+        label = "Banking",
+        description = "Banking app",
+    },
+})
+assert(add_success and add_error == nil, "High server addApplication must register")
+assert(#sent_events == 1, "High server registration must broadcast an update")
+assert(sent_events[1].event_name == "sky_phone:compat:high:client:syncApplication", "High sync event must be used")
+assert(sent_events[1].arguments[1] == "high_server_app", "High sync must preserve the owner")
+
+invoking_resource = "other_server_app"
+local duplicate_success, duplicate_error = registered_exports.addApplication("bankingv2", {
+    externalUrl = "@other_server_app/ui/index.html",
+})
+assert(not duplicate_success and duplicate_error == "duplicate_app_id", "High cross-owner replacement must fail")
+
+source = 42
+event_handlers["sky_phone:compat:high:server:requestSnapshot"]()
+assert(#sent_events == 2, "High snapshot request must emit one response")
+assert(sent_events[2].event_name == "sky_phone:compat:high:client:replaceSnapshot", "High snapshot event must be used")
+assert(sent_events[2].target == 42, "High snapshot must target only the requester")
+assert(#sent_events[2].arguments[1] == 1, "High snapshot must include the registered app")
+
+print("Custom app compatibility server tests passed")

From c9a656264c1017ab108881031ae5dd5bf3afe3e0 Mon Sep 17 00:00:00 2001
From: "Leon.Schmidt" <leonmauricewill15@gmail.com>
Date: Tue, 11 Aug 2026 02:34:11 +0200
Subject: [PATCH 02/13] FIX - allow FiveM host NUI messages

---
 frontend/src/utils/windowMessages.test.ts | 16 +++++++++++++---
 frontend/src/utils/windowMessages.ts      |  7 ++++++-
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/frontend/src/utils/windowMessages.test.ts b/frontend/src/utils/windowMessages.test.ts
index 022f6b1..38575bf 100644
--- a/frontend/src/utils/windowMessages.test.ts
+++ b/frontend/src/utils/windowMessages.test.ts
@@ -3,15 +3,25 @@ import { describe, expect, it } from 'vitest'
 import { isTrustedRootMessageSource } from '@/utils/windowMessages'
 
 describe('root window message source', () => {
-  it('accepts native NUI messages and messages posted by the root window', () => {
-    const rootWindow = {} as Window
+  it('accepts native NUI messages and messages posted by trusted host windows', () => {
+    const parentWindow = {} as Window
+    const topWindow = {} as Window
+    const rootWindow = {
+      parent: parentWindow,
+      top: topWindow,
+    } as Window
 
     expect(isTrustedRootMessageSource(null, rootWindow)).toBe(true)
     expect(isTrustedRootMessageSource(rootWindow, rootWindow)).toBe(true)
+    expect(isTrustedRootMessageSource(parentWindow, rootWindow)).toBe(true)
+    expect(isTrustedRootMessageSource(topWindow, rootWindow)).toBe(true)
   })
 
   it('rejects messages posted by child frames', () => {
-    const rootWindow = {} as Window
+    const rootWindow = {
+      parent: {} as Window,
+      top: {} as Window,
+    } as Window
     const childFrame = {} as Window
 
     expect(isTrustedRootMessageSource(childFrame, rootWindow)).toBe(false)
diff --git a/frontend/src/utils/windowMessages.ts b/frontend/src/utils/windowMessages.ts
index 5fa674d..6147977 100644
--- a/frontend/src/utils/windowMessages.ts
+++ b/frontend/src/utils/windowMessages.ts
@@ -2,5 +2,10 @@ export function isTrustedRootMessageSource(
   source: MessageEventSource | null,
   rootWindow: Window,
 ): boolean {
-  return source === null || source === rootWindow
+  return (
+    source === null ||
+    source === rootWindow ||
+    source === rootWindow.parent ||
+    source === rootWindow.top
+  )
 }

From 0f282eef0c3c42594c5c4e4af1c513b734a05a1d Mon Sep 17 00:00:00 2001
From: "Leon.Schmidt" <leonmauricewill15@gmail.com>
Date: Tue, 11 Aug 2026 16:18:46 +0200
Subject: [PATCH 03/13] FIX - refine Companies request interface

---
 frontend/src/views/apps/CompaniesApp.vue | 539 ++++++++++-------------
 1 file changed, 236 insertions(+), 303 deletions(-)

diff --git a/frontend/src/views/apps/CompaniesApp.vue b/frontend/src/views/apps/CompaniesApp.vue
index 46176eb..3e2de93 100644
--- a/frontend/src/views/apps/CompaniesApp.vue
+++ b/frontend/src/views/apps/CompaniesApp.vue
@@ -11,6 +11,7 @@ import {
   kChip,
   kDialog,
   kDialogButton,
+  kGlass,
   kIcon,
   kLink,
   kList,
@@ -41,7 +42,6 @@ import {
   BriefcaseBusiness,
   Building2,
   Check,
-  CheckCircle2,
   CircleAlert,
   ClipboardList,
   Clock3,
@@ -62,7 +62,15 @@ import {
   UsersRound,
   X,
 } from 'lucide-vue-next'
-import { computed, onBeforeUnmount, onMounted, reactive, ref, watch } from 'vue'
+import {
+  computed,
+  nextTick,
+  onBeforeUnmount,
+  onMounted,
+  reactive,
+  ref,
+  watch,
+} from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 
 import { useCallsStore } from '@/stores/calls'
@@ -82,7 +90,6 @@ import type {
   CompanyRequestSummary,
   CompanyService,
   CompanySummary,
-  CompanyWorkFilter,
 } from '@/types/companies'
 import type { PhoneMedia } from '@/types/media'
 import { nuiCall } from '@/utils/nui'
@@ -132,14 +139,9 @@ const screen = ref<CompaniesScreen>('root')
 const requestOrigin = ref<RequestOrigin>('customer')
 const search = ref('')
 const selectedCategory = ref<string | null>(null)
-const onlyAvailable = ref(false)
-const onlyWithLocation = ref(false)
-const onlyAcceptingRequests = ref(false)
-const directorySort = ref<CompanyDirectoryFilters['sort']>('relevance')
 const requestList = ref<CompanyRequestList>('open')
-const workFilter = ref<CompanyWorkFilter>('new')
 const requestSheetOpened = ref(false)
-const requestConfirmOpened = ref(false)
+const requestSheetContent = ref<HTMLElement | null>(null)
 const requestServiceId = ref('')
 const requestSubject = ref('')
 const requestDescription = ref('')
@@ -170,23 +172,18 @@ let searchTimer: ReturnType<typeof setTimeout> | undefined
 let toastTimer: ReturnType<typeof setTimeout> | undefined
 
 const directoryFilters = computed<CompanyDirectoryFilters>(() => ({
-  acceptsRequests: onlyAcceptingRequests.value,
-  availability: onlyAvailable.value ? 'available' : null,
+  acceptsRequests: false,
+  availability: null,
   categoryId: selectedCategory.value,
-  hasLocation: onlyWithLocation.value,
+  hasLocation: false,
   search: search.value.trim(),
-  sort: directorySort.value,
+  sort: 'relevance',
 }))
 const availableCompanies = computed(() =>
   companies.directory.filter((company) => company.availability === 'available'),
 )
 const filtersActive = computed(
-  () =>
-    Boolean(search.value.trim()) ||
-    Boolean(selectedCategory.value) ||
-    onlyAvailable.value ||
-    onlyWithLocation.value ||
-    onlyAcceptingRequests.value,
+  () => Boolean(search.value.trim()) || Boolean(selectedCategory.value),
 )
 const activeCompany = computed(() => companies.company)
 const workCompany = computed(() => companies.workContext?.company ?? null)
@@ -196,11 +193,6 @@ const managerLogoUrl = computed(
 const managerCoverUrl = computed(
   () => selectedCoverMedia.value?.url ?? workCompany.value?.coverUrl ?? null,
 )
-const selectedService = computed(() =>
-  activeCompany.value?.services.find(
-    (service) => service.id === requestServiceId.value,
-  ),
-)
 const requestProgress = computed(() => {
   if (!requestServiceId.value) return 0.25
   if (!requestSubject.value.trim() || !requestDescription.value.trim())
@@ -237,13 +229,6 @@ const availabilityValues: CompanyAvailability[] = [
   'busy',
   'closed',
 ]
-const workFilters: CompanyWorkFilter[] = [
-  'new',
-  'assigned',
-  'in_progress',
-  'waiting_customer',
-  'completed',
-]
 const weekdayKeys = [
   'monday',
   'tuesday',
@@ -384,14 +369,6 @@ function requestSubtitle(request: CompanyRequestSummary): string {
   return parts.join(' · ')
 }
 
-function assignmentLabel(
-  value: CompanyRequestSummary['assignedLabel'],
-): string {
-  return value
-    ? phone.t(`Apps.companies.assignmentLabels.${value}`)
-    : phone.t('Apps.companies.work.unassigned')
-}
-
 function messageAuthorLabel(value: 'company' | 'customer' | 'you'): string {
   return phone.t(`Apps.companies.messageAuthors.${value}`)
 }
@@ -416,10 +393,6 @@ function eventLabel(event: CompanyRequestEvent): string {
 function resetDirectoryFilters(): void {
   search.value = ''
   selectedCategory.value = null
-  onlyAvailable.value = false
-  onlyWithLocation.value = false
-  onlyAcceptingRequests.value = false
-  directorySort.value = 'relevance'
   void companies.loadCompanies(directoryFilters.value)
 }
 
@@ -442,12 +415,7 @@ async function selectTab(tab: CompaniesTab): Promise<void> {
     await companies.loadCompanies(directoryFilters.value)
   }
   if (tab === 'requests') await companies.loadMyRequests(requestList.value)
-  if (tab === 'work') {
-    const loaded = await companies.loadWorkContext()
-    if (loaded && companies.workContext?.authorized) {
-      await companies.loadWorkQueue(workFilter.value)
-    }
-  }
+  if (tab === 'work') await companies.loadWorkContext()
 }
 
 async function openCompany(companyId: string): Promise<void> {
@@ -576,7 +544,6 @@ async function submitRequest(): Promise<void> {
     serviceId: requestServiceId.value,
     subject: requestSubject.value.trim(),
   })
-  requestConfirmOpened.value = false
   if (!response.success || !response.data?.request) {
     if (response.error === 'revision_conflict')
       conflictDialogOpened.value = true
@@ -933,24 +900,15 @@ async function reloadConflict(): Promise<void> {
 }
 
 watch(search, queueDirectoryLoad)
-watch(
-  [
-    selectedCategory,
-    onlyAvailable,
-    onlyWithLocation,
-    onlyAcceptingRequests,
-    directorySort,
-  ],
-  () => void companies.loadCompanies(directoryFilters.value),
-)
+watch(selectedCategory, () => companies.loadCompanies(directoryFilters.value))
 watch(requestList, () => {
   if (activeTab.value === 'requests')
     void companies.loadMyRequests(requestList.value)
 })
-watch(workFilter, () => {
-  if (activeTab.value === 'work' && companies.workContext?.authorized) {
-    void companies.loadWorkQueue(workFilter.value)
-  }
+watch(requestSheetOpened, async (opened) => {
+  if (!opened) return
+  await nextTick()
+  requestSheetContent.value?.scrollTo({ top: 0 })
 })
 watch(
   () => route.query.requestId,
@@ -1098,50 +1056,21 @@ onBeforeUnmount(() => {
         </k-chip>
       </div>
 
-      <k-card class="companies-filter-card" :content-wrap="false">
-        <k-list nested>
-          <k-list-item
-            :title="phone.t('Apps.companies.directory.availableNow')"
-            :subtitle="phone.t('Apps.companies.directory.availableNowHint')"
-          >
-            <template #after>
-              <k-toggle
-                :checked="onlyAvailable"
-                :aria-label="phone.t('Apps.companies.directory.availableNow')"
-                @change="onlyAvailable = !onlyAvailable"
-              />
-            </template>
-          </k-list-item>
-          <k-list-item :title="phone.t('Apps.companies.directory.moreFilters')">
-            <template #after>
-              <div class="companies-inline-chips">
-                <k-chip
-                  component="button"
-                  type="button"
-                  :class="{ 'is-selected': onlyWithLocation }"
-                  @click="onlyWithLocation = !onlyWithLocation"
-                >
-                  {{ phone.t('Apps.companies.directory.hasLocation') }}
-                </k-chip>
-                <k-chip
-                  component="button"
-                  type="button"
-                  :class="{ 'is-selected': onlyAcceptingRequests }"
-                  @click="onlyAcceptingRequests = !onlyAcceptingRequests"
-                >
-                  {{ phone.t('Apps.companies.directory.acceptsRequests') }}
-                </k-chip>
-              </div>
-            </template>
-          </k-list-item>
-        </k-list>
-      </k-card>
-
-      <div v-if="companies.directoryLoading" class="companies-state">
+      <k-block
+        v-if="companies.directoryLoading"
+        inset
+        strong
+        class="companies-state"
+      >
         <k-preloader />
         <span>{{ phone.t('Apps.companies.loading.directory') }}</span>
-      </div>
-      <div v-else-if="companies.directoryError" class="companies-state">
+      </k-block>
+      <k-block
+        v-else-if="companies.directoryError"
+        inset
+        strong
+        class="companies-state"
+      >
         <CircleAlert :size="34" />
         <strong>{{ phone.t('Apps.companies.states.directoryError') }}</strong>
         <p>{{ errorText(companies.directoryError) }}</p>
@@ -1149,8 +1078,13 @@ onBeforeUnmount(() => {
           <RefreshCw :size="16" />
           {{ phone.t('Apps.companies.tryAgain') }}
         </k-button>
-      </div>
-      <div v-else-if="!companies.directory.length" class="companies-state">
+      </k-block>
+      <k-block
+        v-else-if="!companies.directory.length"
+        inset
+        strong
+        class="companies-state"
+      >
         <Building2 :size="36" />
         <strong>
           {{
@@ -1173,9 +1107,9 @@ onBeforeUnmount(() => {
         <k-button v-if="filtersActive" rounded @click="resetDirectoryFilters">
           {{ phone.t('Apps.companies.directory.resetFilters') }}
         </k-button>
-      </div>
+      </k-block>
       <template v-else>
-        <template v-if="availableCompanies.length && !onlyAvailable">
+        <template v-if="availableCompanies.length">
           <k-block-title>{{
             phone.t('Apps.companies.directory.availableSection')
           }}</k-block-title>
@@ -1286,19 +1220,34 @@ onBeforeUnmount(() => {
         </k-segmented>
       </div>
 
-      <div v-if="companies.myRequestsLoading" class="companies-state">
+      <k-block
+        v-if="companies.myRequestsLoading"
+        inset
+        strong
+        class="companies-state"
+      >
         <k-preloader />
         <span>{{ phone.t('Apps.companies.loading.requests') }}</span>
-      </div>
-      <div v-else-if="companies.myRequestsError" class="companies-state">
+      </k-block>
+      <k-block
+        v-else-if="companies.myRequestsError"
+        inset
+        strong
+        class="companies-state"
+      >
         <CircleAlert :size="34" />
         <strong>{{ phone.t('Apps.companies.states.requestsError') }}</strong>
         <p>{{ errorText(companies.myRequestsError) }}</p>
         <k-button rounded @click="companies.loadMyRequests(requestList)">
           {{ phone.t('Apps.companies.tryAgain') }}
         </k-button>
-      </div>
-      <div v-else-if="!companies.myRequests.length" class="companies-state">
+      </k-block>
+      <k-block
+        v-else-if="!companies.myRequests.length"
+        inset
+        strong
+        class="companies-state"
+      >
         <ClipboardList :size="36" />
         <strong>{{
           phone.t(
@@ -1313,7 +1262,7 @@ onBeforeUnmount(() => {
         >
           {{ phone.t('Apps.companies.requests.findCompany') }}
         </k-button>
-      </div>
+      </k-block>
       <k-list v-else inset strong class="company-request-list">
         <k-list-item
           v-for="item in companies.myRequests"
@@ -1359,26 +1308,38 @@ onBeforeUnmount(() => {
       v-else-if="screen === 'root' && activeTab === 'work'"
       class="companies-content companies-work"
     >
-      <div v-if="companies.workContextLoading" class="companies-state">
+      <k-block
+        v-if="companies.workContextLoading"
+        inset
+        strong
+        class="companies-state"
+      >
         <k-preloader />
         <span>{{ phone.t('Apps.companies.loading.work') }}</span>
-      </div>
-      <div v-else-if="companies.workContextError" class="companies-state">
+      </k-block>
+      <k-block
+        v-else-if="companies.workContextError"
+        inset
+        strong
+        class="companies-state"
+      >
         <CircleAlert :size="34" />
         <strong>{{ phone.t('Apps.companies.states.workError') }}</strong>
         <p>{{ errorText(companies.workContextError) }}</p>
         <k-button rounded @click="selectTab('work')">
           {{ phone.t('Apps.companies.tryAgain') }}
         </k-button>
-      </div>
-      <div
+      </k-block>
+      <k-block
         v-else-if="!companies.workContext?.authorized"
+        inset
+        strong
         class="companies-state"
       >
         <BriefcaseBusiness :size="38" />
         <strong>{{ phone.t('Apps.companies.work.notAuthorized') }}</strong>
         <p>{{ phone.t('Apps.companies.work.notAuthorizedBody') }}</p>
-      </div>
+      </k-block>
       <template v-else-if="companies.workContext && workCompany">
         <k-card class="work-identity-card">
           <span class="company-logo company-logo--large">
@@ -1454,98 +1415,25 @@ onBeforeUnmount(() => {
           phone.t('Apps.companies.work.overview')
         }}</k-block-title>
         <div class="work-metrics">
-          <k-card>
+          <k-glass :highlight="false" class="work-metric">
             <strong>{{ companies.workContext.metrics.new }}</strong>
             <span>{{ phone.t('Apps.companies.work.metrics.new') }}</span>
-          </k-card>
-          <k-card>
+          </k-glass>
+          <k-glass :highlight="false" class="work-metric">
             <strong>{{ companies.workContext.metrics.assigned }}</strong>
             <span>{{ phone.t('Apps.companies.work.metrics.assigned') }}</span>
-          </k-card>
-          <k-card>
+          </k-glass>
+          <k-glass :highlight="false" class="work-metric">
             <strong>{{ companies.workContext.metrics.waiting }}</strong>
             <span>{{ phone.t('Apps.companies.work.metrics.waiting') }}</span>
-          </k-card>
-          <k-card>
+          </k-glass>
+          <k-glass :highlight="false" class="work-metric">
             <strong>{{ companies.workContext.metrics.completedToday }}</strong>
             <span>{{
               phone.t('Apps.companies.work.metrics.completedToday')
             }}</span>
-          </k-card>
+          </k-glass>
         </div>
-
-        <k-block-title>{{
-          phone.t('Apps.companies.work.queue')
-        }}</k-block-title>
-        <div class="companies-chip-row work-filter-row">
-          <k-chip
-            v-for="filter in workFilters"
-            :key="filter"
-            component="button"
-            type="button"
-            :class="{ 'is-selected': workFilter === filter }"
-            @click="workFilter = filter"
-          >
-            {{ phone.t(`Apps.companies.work.filters.${filter}`) }}
-          </k-chip>
-        </div>
-        <div
-          v-if="companies.workQueueLoading"
-          class="companies-state companies-state--compact"
-        >
-          <k-preloader />
-        </div>
-        <div
-          v-else-if="companies.workQueueError"
-          class="companies-state companies-state--compact"
-        >
-          <CircleAlert :size="28" />
-          <p>{{ errorText(companies.workQueueError) }}</p>
-          <k-button small rounded @click="companies.loadWorkQueue(workFilter)">
-            {{ phone.t('Apps.companies.tryAgain') }}
-          </k-button>
-        </div>
-        <div
-          v-else-if="!companies.workQueue.length"
-          class="companies-state companies-state--compact"
-        >
-          <CheckCircle2 :size="31" />
-          <strong>{{ phone.t('Apps.companies.work.emptyQueue') }}</strong>
-          <p>{{ phone.t('Apps.companies.work.emptyQueueBody') }}</p>
-        </div>
-        <k-list v-else inset strong class="company-request-list">
-          <k-list-item
-            v-for="item in companies.workQueue"
-            :key="item.id"
-            link
-            link-component="button"
-            :link-props="{ type: 'button' }"
-            :title="item.subject"
-            :subtitle="requestSubtitle(item)"
-            :header="assignmentLabel(item.assignedLabel)"
-            @click="openRequest(item.id, 'work')"
-          >
-            <template #media
-              ><span class="company-request-icon"
-                ><BriefcaseBusiness :size="19" /></span
-            ></template>
-            <template #after>
-              <k-badge :class="statusClass(item.status)">
-                {{ phone.t(`Apps.companies.requestStatuses.${item.status}`) }}
-              </k-badge>
-            </template>
-          </k-list-item>
-        </k-list>
-        <k-button
-          v-if="companies.workQueueNextCursor"
-          outline
-          rounded
-          class="companies-load-more"
-          :disabled="companies.workQueueLoadingMore"
-          @click="companies.loadWorkQueue(workFilter, true)"
-        >
-          {{ phone.t('Apps.companies.loadMore') }}
-        </k-button>
       </template>
     </section>
 
@@ -1553,15 +1441,19 @@ onBeforeUnmount(() => {
       v-else-if="screen === 'company'"
       class="companies-content company-profile"
     >
-      <div
+      <k-block
         v-if="companies.directoryLoading && !activeCompany"
+        inset
+        strong
         class="companies-state"
       >
         <k-preloader />
         <span>{{ phone.t('Apps.companies.loading.profile') }}</span>
-      </div>
-      <div
+      </k-block>
+      <k-block
         v-else-if="companies.directoryError || !activeCompany"
+        inset
+        strong
         class="companies-state"
       >
         <CircleAlert :size="34" />
@@ -1570,7 +1462,7 @@ onBeforeUnmount(() => {
         <k-button rounded @click="goBack">{{
           phone.t('Apps.companies.back')
         }}</k-button>
-      </div>
+      </k-block>
       <template v-else>
         <div
           class="company-cover"
@@ -1691,7 +1583,7 @@ onBeforeUnmount(() => {
           />
         </k-list>
 
-        <div class="company-profile-actions">
+        <k-glass :highlight="false" class="company-profile-actions">
           <k-button
             rounded
             :disabled="!activeCompany.canCall || !activeCompany.phoneNumber"
@@ -1726,7 +1618,7 @@ onBeforeUnmount(() => {
               phone.t('Apps.companies.profile.request')
             }}
           </k-button>
-        </div>
+        </k-glass>
       </template>
     </section>
 
@@ -1734,12 +1626,19 @@ onBeforeUnmount(() => {
       v-else-if="screen === 'request'"
       class="companies-content request-thread"
     >
-      <div v-if="companies.requestLoading" class="companies-state">
+      <k-block
+        v-if="companies.requestLoading"
+        inset
+        strong
+        class="companies-state"
+      >
         <k-preloader />
         <span>{{ phone.t('Apps.companies.loading.request') }}</span>
-      </div>
-      <div
+      </k-block>
+      <k-block
         v-else-if="companies.requestError || !companies.request"
+        inset
+        strong
         class="companies-state"
       >
         <CircleAlert :size="34" />
@@ -1748,7 +1647,7 @@ onBeforeUnmount(() => {
         <k-button rounded @click="goBack">{{
           phone.t('Apps.companies.back')
         }}</k-button>
-      </div>
+      </k-block>
       <template v-else>
         <div class="request-thread-scroll">
           <k-card class="request-summary-card">
@@ -1905,7 +1804,13 @@ onBeforeUnmount(() => {
           phone.t('Apps.companies.manager.profile')
         }}</k-block-title>
         <div class="manager-media-grid">
-          <button type="button" @click="chooseManagerMedia('cover')">
+          <k-button
+            tonal
+            rounded
+            large
+            class="manager-media-button"
+            @click="chooseManagerMedia('cover')"
+          >
             <img
               v-if="managerCoverUrl"
               :src="managerCoverUrl"
@@ -1914,8 +1819,14 @@ onBeforeUnmount(() => {
             />
             <span v-else><ImagePlus :size="22" /></span>
             <small>{{ phone.t('Apps.companies.manager.chooseCover') }}</small>
-          </button>
-          <button type="button" @click="chooseManagerMedia('logo')">
+          </k-button>
+          <k-button
+            tonal
+            rounded
+            large
+            class="manager-media-button"
+            @click="chooseManagerMedia('logo')"
+          >
             <img
               v-if="managerLogoUrl"
               :src="managerLogoUrl"
@@ -1924,7 +1835,7 @@ onBeforeUnmount(() => {
             />
             <span v-else><ImagePlus :size="22" /></span>
             <small>{{ phone.t('Apps.companies.manager.chooseLogo') }}</small>
-          </button>
+          </k-button>
         </div>
         <k-list inset strong class="manager-form-list">
           <k-list-input
@@ -2243,6 +2154,7 @@ onBeforeUnmount(() => {
     >
       <section
         v-if="requestSheetOpened && activeCompany"
+        ref="requestSheetContent"
         class="companies-sheet__content"
         role="dialog"
         aria-modal="true"
@@ -2264,10 +2176,10 @@ onBeforeUnmount(() => {
           </k-link>
         </header>
         <k-progressbar :progress="requestProgress" />
-        <k-block-title>{{
+        <k-block-title class="composer-service-title">{{
           phone.t('Apps.companies.composer.chooseService')
         }}</k-block-title>
-        <k-list inset strong>
+        <k-list inset strong class="composer-service-list">
           <k-list-item
             v-for="service in activeCompany.services.filter(
               (item) => item.active && item.acceptsRequests,
@@ -2276,7 +2188,11 @@ onBeforeUnmount(() => {
             label
             :title="service.title"
             :subtitle="service.description"
-            :after="service.priceText ?? undefined"
+            title-font-size-ios="text-[15px]"
+            title-font-size-material="text-[15px]"
+            media-class="!py-2.5 !me-3"
+            inner-class="!py-2.5 !pe-safe-3"
+            title-wrap-class="!min-h-5"
           >
             <template #media>
               <k-radio
@@ -2286,6 +2202,11 @@ onBeforeUnmount(() => {
                 @change="requestServiceId = service.id"
               />
             </template>
+            <template v-if="service.priceText" #after>
+              <span class="composer-service-price">{{
+                service.priceText
+              }}</span>
+            </template>
           </k-list-item>
         </k-list>
         <k-list inset strong class="composer-form-list">
@@ -2295,6 +2216,7 @@ onBeforeUnmount(() => {
             :label="phone.t('Apps.companies.composer.subject')"
             :placeholder="phone.t('Apps.companies.composer.subjectPlaceholder')"
             :value="requestSubject"
+            :input-style="{ height: '38px' }"
             @input="requestSubject = eventValue($event)"
           />
           <k-list-input
@@ -2306,6 +2228,13 @@ onBeforeUnmount(() => {
               phone.t('Apps.companies.composer.descriptionPlaceholder')
             "
             :value="requestDescription"
+            :input-style="{
+              height: '72px',
+              lineHeight: '20px',
+              paddingBottom: '8px',
+              paddingTop: '8px',
+              resize: 'none',
+            }"
             @input="requestDescription = eventValue($event)"
           />
         </k-list>
@@ -2356,10 +2285,11 @@ onBeforeUnmount(() => {
         <k-button
           large
           rounded
-          :disabled="!canSubmitRequest"
-          @click="requestConfirmOpened = true"
+          :disabled="!canSubmitRequest || companies.mutating"
+          @click="submitRequest"
         >
-          {{ phone.t('Apps.companies.composer.review') }}
+          <k-preloader v-if="companies.mutating" />
+          <span v-else>{{ phone.t('Apps.companies.composer.send') }}</span>
         </k-button>
       </section>
     </k-sheet>
@@ -2433,12 +2363,14 @@ onBeforeUnmount(() => {
             <X :size="19" />
           </k-link>
         </header>
-        <div
+        <k-block
           v-if="companies.membersLoading"
+          inset
+          strong
           class="companies-state companies-state--compact"
         >
           <k-preloader />
-        </div>
+        </k-block>
         <k-list v-else inset strong>
           <k-list-item
             v-for="member in companies.members"
@@ -2472,31 +2404,6 @@ onBeforeUnmount(() => {
       </section>
     </k-sheet>
 
-    <k-dialog
-      :opened="requestConfirmOpened"
-      :title="phone.t('Apps.companies.composer.confirmTitle')"
-      :content="
-        phone.t('Apps.companies.composer.confirmBody', {
-          company: activeCompany?.name ?? '',
-          service: selectedService?.title ?? '',
-        })
-      "
-      @backdropclick="requestConfirmOpened = false"
-    >
-      <template #buttons>
-        <k-dialog-button @click="requestConfirmOpened = false">
-          {{ phone.t('Apps.companies.composer.edit') }}
-        </k-dialog-button>
-        <k-dialog-button
-          strong
-          :disabled="companies.mutating"
-          @click="submitRequest"
-        >
-          {{ phone.t('Apps.companies.composer.send') }}
-        </k-dialog-button>
-      </template>
-    </k-dialog>
-
     <k-dialog
       :opened="cancelDialogOpened"
       :title="phone.t('Apps.companies.requests.cancelTitle')"
@@ -2554,6 +2461,8 @@ onBeforeUnmount(() => {
   --k-safe-area-bottom: 25px;
   position: relative;
   height: 100%;
+  display: flex;
+  flex-direction: column;
   overflow: hidden;
   color: #111827;
 }
@@ -2582,16 +2491,19 @@ onBeforeUnmount(() => {
 .companies-content {
   position: relative;
   z-index: 1;
-}
-
-.companies-content {
-  height: calc(100% - 44px);
-  padding: 10px 10px 92px;
+  min-height: 0;
+  padding: 10px 10px calc(var(--k-safe-area-bottom) + 88px);
+  flex: 1;
+  overflow-x: hidden;
   overflow-y: auto;
   overscroll-behavior: contain;
   scrollbar-width: none;
 }
 
+.companies-navbar {
+  flex: none;
+}
+
 .companies-content::-webkit-scrollbar,
 .companies-chip-row::-webkit-scrollbar,
 .companies-featured-row::-webkit-scrollbar {
@@ -2615,13 +2527,11 @@ onBeforeUnmount(() => {
   white-space: nowrap;
 }
 
-.companies-chip-row :deep(.is-selected),
-.companies-inline-chips :deep(.is-selected) {
+.companies-chip-row :deep(.is-selected) {
   color: white;
   background: linear-gradient(135deg, var(--company-blue), var(--company-cyan));
 }
 
-.companies-filter-card,
 .work-identity-card,
 .manager-intro,
 .request-summary-card,
@@ -2636,7 +2546,6 @@ onBeforeUnmount(() => {
   -webkit-backdrop-filter: blur(18px) saturate(140%);
 }
 
-.companies-app--dark .companies-filter-card,
 .companies-app--dark .work-identity-card,
 .companies-app--dark .manager-intro,
 .companies-app--dark .request-summary-card,
@@ -2646,20 +2555,9 @@ onBeforeUnmount(() => {
   background: rgb(20 30 46 / 70%);
 }
 
-.companies-inline-chips {
-  display: flex;
-  max-width: 144px;
-  gap: 4px;
-  overflow-x: auto;
-}
-
-.companies-inline-chips :deep(.k-chip) {
-  flex: none;
-  font-size: 9px;
-}
-
 .companies-state {
   min-height: 260px;
+  margin: 14px 6px;
   padding: 36px 22px;
   display: flex;
   flex-direction: column;
@@ -2725,6 +2623,16 @@ onBeforeUnmount(() => {
   margin-top: 6px;
 }
 
+.company-list :deep(.k-list-item > button),
+.company-request-list :deep(.k-list-item > button) {
+  width: 100%;
+  text-align: left;
+}
+
+.companies-content :deep(.k-block-title) {
+  margin-bottom: 10px;
+}
+
 .company-logo {
   width: 42px;
   height: 42px;
@@ -2872,15 +2780,13 @@ onBeforeUnmount(() => {
   margin: 0 5px 14px;
 }
 
-.work-metrics :deep(.k-card) {
+.work-metric {
   margin: 0;
-  border-radius: 16px;
-}
-
-.work-metrics :deep(> *) {
+  padding: 15px 16px;
   display: flex;
   flex-direction: column;
   gap: 2px;
+  border-radius: 16px;
 }
 
 .work-metrics strong {
@@ -2893,10 +2799,6 @@ onBeforeUnmount(() => {
   font-size: 10px;
 }
 
-.work-filter-row {
-  padding-inline: 5px;
-}
-
 .company-cover {
   height: 145px;
   margin: -10px -10px 0;
@@ -2918,10 +2820,6 @@ onBeforeUnmount(() => {
   font-size: 18px;
 }
 
-.company-profile {
-  padding-bottom: 116px;
-}
-
 .company-profile-heading {
   margin-top: 10px;
 }
@@ -2956,7 +2854,17 @@ onBeforeUnmount(() => {
 }
 
 .company-profile {
-  padding-bottom: 145px;
+  padding-bottom: calc(var(--k-safe-area-bottom) + 24px);
+}
+
+.company-profile > :deep(.k-block-title) {
+  margin-top: 18px;
+  margin-bottom: 6px;
+}
+
+.company-profile > :deep(.k-list) {
+  margin-top: 8px;
+  margin-bottom: 10px;
 }
 
 .companies-app--dark .company-profile-heading p,
@@ -2973,26 +2881,19 @@ onBeforeUnmount(() => {
 }
 
 .company-profile-actions {
-  position: absolute;
+  position: relative;
   z-index: 4;
-  right: 8px;
-  bottom: 28px;
-  left: 8px;
+  margin: 18px 0 0;
   padding: 8px;
   display: grid;
   grid-template-columns: repeat(2, 1fr);
   gap: 7px;
   border: 1px solid rgb(255 255 255 / 45%);
   border-radius: 20px;
-  background: rgb(255 255 255 / 76%);
-  box-shadow: 0 18px 35px rgb(15 23 42 / 18%);
-  backdrop-filter: blur(22px) saturate(150%);
-  -webkit-backdrop-filter: blur(22px) saturate(150%);
 }
 
 .companies-app--dark .company-profile-actions {
   border-color: rgb(255 255 255 / 8%);
-  background: rgb(15 23 42 / 80%);
 }
 
 .request-thread {
@@ -3149,7 +3050,7 @@ onBeforeUnmount(() => {
   margin: 0 10px 12px;
 }
 
-.manager-media-grid button {
+.manager-media-button {
   min-width: 0;
   min-height: 86px;
   overflow: hidden;
@@ -3157,10 +3058,7 @@ onBeforeUnmount(() => {
   display: grid;
   place-items: center;
   border: 1px solid rgb(148 163 184 / 30%);
-  border-radius: 16px;
   padding: 0;
-  color: var(--company-blue);
-  background: rgb(255 255 255 / 62%);
 }
 
 .manager-media-grid img {
@@ -3185,10 +3083,6 @@ onBeforeUnmount(() => {
   white-space: nowrap;
 }
 
-.companies-app--dark .manager-media-grid button {
-  background: rgb(30 41 59 / 66%);
-}
-
 .manager-location {
   width: calc(100% - 20px);
   margin: 0 10px 4px;
@@ -3274,8 +3168,47 @@ onBeforeUnmount(() => {
   font-size: 9px;
 }
 
+.composer-service-title {
+  margin-top: 18px;
+  margin-bottom: 8px;
+}
+
+.composer-service-list {
+  margin-top: 0;
+  margin-right: 8px;
+  margin-bottom: 10px;
+  margin-left: 8px;
+}
+
+.composer-service-list :deep(.k-list-item .text-sm) {
+  overflow: hidden;
+  font-size: 11px;
+  line-height: 1.3;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.composer-service-list :deep(.k-radio > i) {
+  width: 20px;
+  height: 20px;
+}
+
+.composer-service-price {
+  color: #64748b;
+  font-size: 11px;
+  font-weight: 500;
+}
+
 .composer-form-list {
-  margin-top: 12px;
+  margin-top: 10px;
+  margin-right: 8px;
+  margin-bottom: 10px;
+  margin-left: 8px;
+}
+
+.composer-form-list :deep(.k-list-input) {
+  margin-top: 8px;
+  margin-bottom: 8px;
 }
 
 .composer-contact-card {

From bbcdc50ad0afd6f963f55d78822f630850bf4b5a Mon Sep 17 00:00:00 2001
From: "Leon.Schmidt" <leonmauricewill15@gmail.com>
Date: Tue, 11 Aug 2026 17:01:27 +0200
Subject: [PATCH 04/13] CLN - remove custom app packaging

Remove the bundled custom-app SDK assets and stop including custom app manifests, scripts, web assets, and escrow exclusions in the resource manifest.
---
 sky_phone/custom_apps/_sdk/default-icon.svg   |  13 --
 sky_phone/custom_apps/_sdk/sky-phone-app.d.ts |  74 ------
 sky_phone/custom_apps/_sdk/sky-phone-app.js   | 211 ------------------
 sky_phone/fxmanifest.lua                      |  11 -
 4 files changed, 309 deletions(-)
 delete mode 100644 sky_phone/custom_apps/_sdk/default-icon.svg
 delete mode 100644 sky_phone/custom_apps/_sdk/sky-phone-app.d.ts
 delete mode 100644 sky_phone/custom_apps/_sdk/sky-phone-app.js

diff --git a/sky_phone/custom_apps/_sdk/default-icon.svg b/sky_phone/custom_apps/_sdk/default-icon.svg
deleted file mode 100644
index 751a276..0000000
--- a/sky_phone/custom_apps/_sdk/default-icon.svg
+++ /dev/null
@@ -1,13 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" role="img" aria-label="Custom app">
-  <defs>
-    <linearGradient id="background" x1="18" y1="14" x2="110" y2="116" gradientUnits="userSpaceOnUse">
-      <stop stop-color="#57c7ff"/>
-      <stop offset="1" stop-color="#3152d4"/>
-    </linearGradient>
-  </defs>
-  <rect width="128" height="128" rx="29" fill="url(#background)"/>
-  <rect x="31" y="31" width="28" height="28" rx="8" fill="#fff" fill-opacity=".96"/>
-  <rect x="69" y="31" width="28" height="28" rx="8" fill="#fff" fill-opacity=".8"/>
-  <rect x="31" y="69" width="28" height="28" rx="8" fill="#fff" fill-opacity=".8"/>
-  <path d="M83 68v30M68 83h30" stroke="#fff" stroke-width="9" stroke-linecap="round"/>
-</svg>
diff --git a/sky_phone/custom_apps/_sdk/sky-phone-app.d.ts b/sky_phone/custom_apps/_sdk/sky-phone-app.d.ts
deleted file mode 100644
index 48c6b8d..0000000
--- a/sky_phone/custom_apps/_sdk/sky-phone-app.d.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-export type SkyPhoneAppContext = {
-  appId: string
-  capabilities: string[]
-  colorScheme: 'dark' | 'light'
-  language: string
-  locale: Record<string, unknown>
-  phoneScale: number
-  protocolVersion: 1
-  safeArea: {
-    bottom: number
-    left: number
-    right: number
-    top: number
-  }
-}
-
-export type SkyPhoneAppEvents = {
-  context: SkyPhoneAppContext | null
-  message: unknown
-  open: unknown
-}
-
-export type SkyPhoneAppNotification = {
-  sound?: 'chime' | 'signal' | 'soft'
-  subtitle?: string
-  text: string
-  title: string
-}
-
-export type SkyPhoneAppStorageEntry<Value = unknown> = {
-  exists: boolean
-  revision: number
-  value?: Value
-}
-
-export type SkyPhoneAppStorageWrite = {
-  revision: number
-}
-
-export type SkyPhoneAppApi = {
-  readonly appId: string
-  readonly protocolVersion: 1
-  close(): Promise<void>
-  getContext(): SkyPhoneAppContext | null
-  notify(
-    notification: SkyPhoneAppNotification,
-  ): Promise<{ notificationId: string | null }>
-  on<EventName extends keyof SkyPhoneAppEvents>(
-    eventName: EventName,
-    listener: (payload: SkyPhoneAppEvents[EventName]) => void,
-  ): () => void
-  open(
-    appId: string,
-    data?: Record<string, unknown>,
-  ): Promise<{ appId: string }>
-  ready(): boolean
-  request<Result = unknown>(method: string, payload?: unknown): Promise<Result>
-  storage: {
-    get<Value = unknown>(key: string): Promise<SkyPhoneAppStorageEntry<Value>>
-    set(
-      key: string,
-      value: unknown,
-      revision: number,
-    ): Promise<SkyPhoneAppStorageWrite>
-  }
-}
-
-declare global {
-  interface Window {
-    SkyPhoneApp: SkyPhoneAppApi
-  }
-}
-
-export {}
diff --git a/sky_phone/custom_apps/_sdk/sky-phone-app.js b/sky_phone/custom_apps/_sdk/sky-phone-app.js
deleted file mode 100644
index 4688c59..0000000
--- a/sky_phone/custom_apps/_sdk/sky-phone-app.js
+++ /dev/null
@@ -1,211 +0,0 @@
-(function bootstrapSkyPhoneApp() {
-  'use strict'
-
-  const protocolVersion = 1
-  const requestTimeoutMs = 8000
-  const query = new URLSearchParams(window.location.search)
-  const appId =
-    query.get('skyPhoneAppId') ||
-    document.documentElement.dataset.skyPhoneAppId ||
-    document.currentScript?.dataset.appId ||
-    ''
-  const listeners = new Map()
-  const pendingRequests = new Map()
-  let context = null
-  let nextRequestId = 1
-  let readySent = false
-
-  function emit(eventName, payload) {
-    const eventListeners = listeners.get(eventName)
-    if (eventListeners) {
-      for (const listener of [...eventListeners]) listener(payload)
-    }
-    window.dispatchEvent(
-      new CustomEvent(`sky-phone-app:${eventName}`, { detail: payload }),
-    )
-  }
-
-  function send(message) {
-    if (!appId) {
-      console.error('[Sky Phone App] Missing skyPhoneAppId in the frame URL.')
-      return false
-    }
-
-    window.parent.postMessage(
-      {
-        ...message,
-        appId,
-        protocolVersion,
-      },
-      '*',
-    )
-    return true
-  }
-
-  function ready() {
-    if (readySent) return true
-    readySent = send({ type: 'sky-phone-app:ready' })
-    return readySent
-  }
-
-  function on(eventName, listener) {
-    if (typeof eventName !== 'string' || typeof listener !== 'function') {
-      throw new TypeError('SkyPhoneApp.on requires an event name and a function.')
-    }
-
-    const eventListeners = listeners.get(eventName) || new Set()
-    eventListeners.add(listener)
-    listeners.set(eventName, eventListeners)
-    return function unsubscribe() {
-      eventListeners.delete(listener)
-      if (eventListeners.size === 0) listeners.delete(eventName)
-    }
-  }
-
-  function request(method, payload) {
-    if (typeof method !== 'string' || !method) {
-      return Promise.reject(new TypeError('A bridge method is required.'))
-    }
-
-    const requestId = `${Date.now().toString(36)}-${nextRequestId++}`
-    return new Promise((resolve, reject) => {
-      const timeout = window.setTimeout(() => {
-        pendingRequests.delete(requestId)
-        reject(new Error(`Sky Phone request timed out: ${method}`))
-      }, requestTimeoutMs)
-
-      pendingRequests.set(requestId, { reject, resolve, timeout })
-      if (
-        !send({
-          type: 'sky-phone-app:request',
-          method,
-          payload,
-          requestId,
-        })
-      ) {
-        window.clearTimeout(timeout)
-        pendingRequests.delete(requestId)
-        reject(new Error('Sky Phone bridge is unavailable.'))
-      }
-    })
-  }
-
-  function close() {
-    return request('app.close')
-  }
-
-  function open(targetAppId, data) {
-    if (typeof targetAppId !== 'string' || !targetAppId) {
-      return Promise.reject(new TypeError('A target app ID is required.'))
-    }
-
-    return request('app.open', {
-      appId: targetAppId,
-      ...(data === undefined ? {} : { data }),
-    })
-  }
-
-  function notify(notification) {
-    if (!notification || typeof notification !== 'object') {
-      return Promise.reject(new TypeError('A notification is required.'))
-    }
-
-    return request('notification.create', notification)
-  }
-
-  const storage = Object.freeze({
-    get(key) {
-      return request('device.storage.get', { key })
-    },
-    set(key, value, revision) {
-      return request('device.storage.set', { key, revision, value })
-    },
-  })
-
-  function applyContext(nextContext) {
-    if (!nextContext || typeof nextContext !== 'object') return
-
-    const root = document.documentElement
-    if (
-      nextContext.colorScheme === 'dark' ||
-      nextContext.colorScheme === 'light'
-    ) {
-      root.dataset.theme = nextContext.colorScheme
-      root.style.colorScheme = nextContext.colorScheme
-    }
-    if (typeof nextContext.language === 'string' && nextContext.language) {
-      root.lang = nextContext.language
-    }
-    if (typeof nextContext.phoneScale === 'number') {
-      root.style.setProperty('--sky-phone-scale', String(nextContext.phoneScale))
-    }
-    if (nextContext.safeArea && typeof nextContext.safeArea === 'object') {
-      for (const edge of ['top', 'right', 'bottom', 'left']) {
-        const value = nextContext.safeArea[edge]
-        if (typeof value === 'number') {
-          root.style.setProperty(`--sky-safe-area-${edge}`, `${value}px`)
-        }
-      }
-    }
-  }
-
-  window.addEventListener('message', (event) => {
-    if (event.source !== window.parent) return
-    const message = event.data
-    if (
-      !message ||
-      typeof message !== 'object' ||
-      message.appId !== appId ||
-      message.protocolVersion !== protocolVersion
-    ) {
-      return
-    }
-
-    if (message.type === 'sky-phone-app:context') {
-      context = message.context || null
-      applyContext(context)
-      emit('context', context)
-    } else if (message.type === 'sky-phone-app:message') {
-      emit('message', message.payload)
-    } else if (message.type === 'sky-phone-app:open') {
-      emit('open', message.data)
-    } else if (message.type === 'sky-phone-app:response') {
-      const pending = pendingRequests.get(message.requestId)
-      if (!pending) return
-      window.clearTimeout(pending.timeout)
-      pendingRequests.delete(message.requestId)
-      if (message.success) pending.resolve(message.data)
-      else pending.reject(new Error(message.error || 'Sky Phone request failed.'))
-    }
-  })
-
-  const api = Object.freeze({
-    appId,
-    close,
-    getContext: () => context,
-    notify,
-    on,
-    open,
-    protocolVersion,
-    ready,
-    request,
-    storage,
-  })
-
-  if (window.SkyPhoneApp) {
-    console.error('[Sky Phone App] window.SkyPhoneApp is already defined.')
-    return
-  }
-  Object.defineProperty(window, 'SkyPhoneApp', {
-    configurable: false,
-    enumerable: true,
-    value: api,
-    writable: false,
-  })
-
-  if (document.readyState === 'loading') {
-    document.addEventListener('DOMContentLoaded', ready, { once: true })
-  } else {
-    ready()
-  }
-})()
diff --git a/sky_phone/fxmanifest.lua b/sky_phone/fxmanifest.lua
index 9d0db07..cfc540c 100644
--- a/sky_phone/fxmanifest.lua
+++ b/sky_phone/fxmanifest.lua
@@ -13,12 +13,6 @@ provide 'high-phone'
 provide 'qs-smartphone'
 provide 'yseries'
 
-escrow_ignore {
-    'config/**',
-    'custom_apps/**',
-    'source/bridge/**',
-}
-
 shared_scripts {
     'config/init.lua',
     'source/bridge/shared.lua',
@@ -26,7 +20,6 @@ shared_scripts {
     'source/shared/sim_number.lua',
     'source/shared/custom_apps.lua',
     'source/shared/custom_app_compat.lua',
-    'custom_apps/**/manifest.lua',
 }
 
 client_scripts {
@@ -46,7 +39,6 @@ client_scripts {
     'source/client/payphones.lua',
     'source/client/custom_apps.lua',
     'source/client/custom_app_compat.lua',
-    'custom_apps/**/client.lua',
     'source/client/main.lua',
     'source/client/radio.lua',
 }
@@ -96,7 +88,6 @@ server_scripts {
     'source/server/calendar.lua',
     'source/server/music.lua',
     'source/server/radio.lua',
-    'custom_apps/**/server.lua',
 }
 
 files {
@@ -104,8 +95,6 @@ files {
     'source/html/assets/**',
     'source/html/img/**',
     'config/music/**',
-    'custom_apps/**/web/**',
-    'custom_apps/_sdk/**',
 }
 
 ui_page 'source/html/index.html'

From d671f704ee306759f5e3c984fbb3a3e69a68142c Mon Sep 17 00:00:00 2001
From: "Leon.Schmidt" <leonmauricewill15@gmail.com>
Date: Tue, 11 Aug 2026 18:26:12 +0200
Subject: [PATCH 05/13] FIX - handle unavailable ESX integrations

---
 sky_phone/source/bridge/client/housing/esx_property.lua | 5 +++++
 sky_phone/source/bridge/server/frameworks/esx.lua       | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/sky_phone/source/bridge/client/housing/esx_property.lua b/sky_phone/source/bridge/client/housing/esx_property.lua
index 08fe3f3..9c9ef8c 100644
--- a/sky_phone/source/bridge/client/housing/esx_property.lua
+++ b/sky_phone/source/bridge/client/housing/esx_property.lua
@@ -2,6 +2,11 @@ if Bridge.Framework.GetName() ~= "esx" then
     return
 end
 
+if GetResourceState("esx_property") ~= "started" then
+    print("[sky_phone] esx_property is not started; the housing provider is disabled.")
+    return
+end
+
 local ESX = exports["es_extended"]:getSharedObject()
 
 local callback_names = {
diff --git a/sky_phone/source/bridge/server/frameworks/esx.lua b/sky_phone/source/bridge/server/frameworks/esx.lua
index 33658e1..1c4a820 100644
--- a/sky_phone/source/bridge/server/frameworks/esx.lua
+++ b/sky_phone/source/bridge/server/frameworks/esx.lua
@@ -2,6 +2,10 @@ if Bridge.Framework.Name ~= "esx" then
     return
 end
 
+if GetResourceState("es_extended") ~= "started" then
+    error("[sky_phone] ESX is configured, but es_extended is not started.")
+end
+
 local ESX = exports["es_extended"]:getSharedObject()
 
 local function get_player(source)

From 2a87432e50f6e35303e4f9af8569032b7966bdbd Mon Sep 17 00:00:00 2001
From: "Leon.Schmidt" <leonmauricewill15@gmail.com>
Date: Tue, 11 Aug 2026 18:26:22 +0200
Subject: [PATCH 06/13] FIX - support third-party custom apps

---
 README.md                                     |   5 +-
 frontend/public/img/custom-app.svg            |  15 ++
 sky_phone/source/client/custom_app_compat.lua |  44 +++-
 sky_phone/source/client/custom_apps.lua       |  76 ++++++-
 sky_phone/source/server/custom_app_compat.lua |   1 +
 sky_phone/source/shared/custom_app_compat.lua |  39 ++++
 tests/custom_app_compat_client.lua            | 193 ++++++++++++++++--
 tests/custom_app_compat_server.lua            |  24 ++-
 8 files changed, 361 insertions(+), 36 deletions(-)
 create mode 100644 frontend/public/img/custom-app.svg

diff --git a/README.md b/README.md
index a23642c..923633b 100644
--- a/README.md
+++ b/README.md
@@ -6,8 +6,9 @@
 Hersteller-Aliase und übernimmt unterstützte Apps automatisch in Springboard und App Store. In
 App-Ressourcen müssen dafür keine Sky-Vorlagen abgelegt werden. Unterstützt werden die
 dokumentierten Basisverträge von LB Phone, 17Movement, High Phone, Quasar Smartphone V3 und
-YSeries; die Aliase `lb-phone`, `17mov_Phone`, `high-phone`, `qs-smartphone` und `yseries` werden
-direkt von `sky_phone` bereitgestellt. Einrichtung und ehrliche Kompatibilitätsgrenzen stehen in der
+YSeries; die Resource- und Cfx-Export-Aliase `lb-phone`, `17mov_Phone`, `high-phone`,
+`qs-smartphone` und `yseries` werden direkt von `sky_phone` bereitgestellt. Einrichtung und
+ehrliche Kompatibilitätsgrenzen stehen in der
 [deutschen Custom-App-Anleitung](docs/custom-apps.md).
 
 ## FlipTok verification
diff --git a/frontend/public/img/custom-app.svg b/frontend/public/img/custom-app.svg
new file mode 100644
index 0000000..8b9ec86
--- /dev/null
+++ b/frontend/public/img/custom-app.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128">
+  <defs>
+    <linearGradient id="background" x1="16" y1="12" x2="112" y2="116" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#64748b"/>
+      <stop offset="1" stop-color="#1e293b"/>
+    </linearGradient>
+  </defs>
+  <rect width="128" height="128" rx="28" fill="url(#background)"/>
+  <g fill="#f8fafc">
+    <rect x="29" y="29" width="29" height="29" rx="8"/>
+    <rect x="70" y="29" width="29" height="29" rx="8"/>
+    <rect x="29" y="70" width="29" height="29" rx="8"/>
+    <rect x="70" y="70" width="29" height="29" rx="8"/>
+  </g>
+</svg>
diff --git a/sky_phone/source/client/custom_app_compat.lua b/sky_phone/source/client/custom_app_compat.lua
index b2a4ad8..0228d99 100644
--- a/sky_phone/source/client/custom_app_compat.lua
+++ b/sky_phone/source/client/custom_app_compat.lua
@@ -561,11 +561,6 @@ AddEventHandler("onClientResourceStop", function(resource_name)
     end
 end)
 
-CreateThread(function()
-    TriggerServerEvent("sky_phone:compat:high:server:requestSnapshot")
-    TriggerEvent("17mov_Phone:Client:Ready")
-end)
-
 exports("AddApplication", add_17mov_application)
 exports("RemoveApplication", remove_17mov_application)
 exports("SendAppMessage", send_app_message)
@@ -579,3 +574,42 @@ exports("getCustomApps", get_quasar_apps)
 exports("OpenPhoneApp", open_quasar_app)
 exports("OpenApp", open_phone_app)
 exports("CloseApp", close_phone_app)
+
+SkyPhoneCompatibility.RegisterExportAlias("lb-phone", "OpenApp", open_phone_app)
+SkyPhoneCompatibility.RegisterExportAlias("lb-phone", "CloseApp", close_phone_app)
+
+SkyPhoneCompatibility.RegisterExportAlias("17mov_Phone", "AddApplication", add_17mov_application)
+SkyPhoneCompatibility.RegisterExportAlias("17mov_Phone", "RemoveApplication", remove_17mov_application)
+SkyPhoneCompatibility.RegisterExportAlias("17mov_Phone", "SendAppMessage", send_app_message)
+
+SkyPhoneCompatibility.RegisterExportAlias("high-phone", "addApplication", add_high_application)
+SkyPhoneCompatibility.RegisterExportAlias("high-phone", "sendAppNui", send_high_app_nui)
+
+SkyPhoneCompatibility.RegisterExportAlias("qs-smartphone", "addCustomApp", add_quasar_app)
+SkyPhoneCompatibility.RegisterExportAlias("qs-smartphone", "addCustomAppsBatch", add_quasar_apps_batch)
+SkyPhoneCompatibility.RegisterExportAlias("qs-smartphone", "updateCustomApp", update_quasar_app)
+SkyPhoneCompatibility.RegisterExportAlias("qs-smartphone", "removeCustomApp", remove_quasar_app)
+SkyPhoneCompatibility.RegisterExportAlias("qs-smartphone", "getCustomApps", get_quasar_apps)
+SkyPhoneCompatibility.RegisterExportAlias("qs-smartphone", "OpenPhoneApp", open_quasar_app)
+
+SkyPhoneCompatibility.RegisterExportAlias("yseries", "SendAppMessage", send_app_message)
+SkyPhoneCompatibility.RegisterExportAlias("yseries", "CloseApp", close_phone_app)
+SkyPhoneCompatibility.RegisterExportAlias("yseries", "GetDataLoaded", function()
+    return true
+end)
+
+CreateThread(function()
+    TriggerServerEvent("sky_phone:compat:high:server:requestSnapshot")
+    TriggerEvent("17mov_Phone:Client:Ready")
+
+    local provider_resources = {
+        "lb-phone",
+        "17mov_Phone",
+        "high-phone",
+        "qs-smartphone",
+        "yseries",
+    }
+    for index = 1, #provider_resources do
+        TriggerEvent("onResourceStart", provider_resources[index])
+    end
+end)
diff --git a/sky_phone/source/client/custom_apps.lua b/sky_phone/source/client/custom_apps.lua
index 1f95350..c098f70 100644
--- a/sky_phone/source/client/custom_apps.lua
+++ b/sky_phone/source/client/custom_apps.lua
@@ -26,12 +26,24 @@ local active_app_id = nil
 local active_app_ready = false
 local phone_open = false
 local queued_messages = {}
-local default_icon_url = ("https://cfx-nui-%s/custom_apps/_sdk/default-icon.svg"):format(current_resource)
+local default_icon_url = ("https://cfx-nui-%s/img/custom-app.svg"):format(current_resource)
 
 local function trim(value)
     return value:match("^%s*(.-)%s*$")
 end
 
+local function is_callable(value)
+    if type(value) == "function" then
+        return true
+    end
+    if type(value) ~= "table" then
+        return false
+    end
+
+    local value_metatable = getmetatable(value)
+    return type(value_metatable) == "table" and type(value_metatable.__call) == "function"
+end
+
 local function validate_owner_resource(owner_resource, allow_stopping)
     if type(owner_resource) ~= "string"
         or #owner_resource == 0
@@ -118,7 +130,7 @@ local function validate_asset_path(path)
     return true
 end
 
-local function normalize_asset_url(value, original_owner, adapter_resource, required)
+local function normalize_asset_url(value, original_owner, adapter_resource, asset_resource, required)
     if value == nil and not required then
         return nil
     end
@@ -137,6 +149,9 @@ local function normalize_asset_url(value, original_owner, adapter_resource, requ
     if adapter_resource then
         allowed_owners[adapter_resource] = true
     end
+    if asset_resource then
+        allowed_owners[asset_resource] = true
+    end
 
     local cfx_owner = url:match("^https://cfx%-nui%-([^/]+)/")
     if cfx_owner then
@@ -177,6 +192,13 @@ local function normalize_asset_url(value, original_owner, adapter_resource, requ
             asset_path = url:sub(#adapter_prefix + 1)
         end
     end
+    if asset_resource then
+        local asset_prefix = asset_resource .. "/"
+        if url:sub(1, #asset_prefix) == asset_prefix then
+            asset_owner = asset_resource
+            asset_path = url:sub(#asset_prefix + 1)
+        end
+    end
 
     if not validate_asset_path(asset_path) then
         return nil, "invalid_asset_url"
@@ -326,14 +348,42 @@ local function normalize_external_definition(owner_resource, adapter_resource, d
         return nil, "invalid_category"
     end
 
-    local ui, ui_error = normalize_asset_url(definition.ui, owner_resource, adapter_resource, true)
+    local asset_resource = definition.assetResource
+    if asset_resource ~= nil then
+        if definition.compatibility == nil then
+            return nil, "asset_resource_not_allowed"
+        end
+        local valid_asset_resource, asset_resource_error = validate_owner_resource(asset_resource, false)
+        if not valid_asset_resource then
+            return nil, asset_resource_error
+        end
+    end
+
+    local ui, ui_error = normalize_asset_url(
+        definition.ui,
+        owner_resource,
+        adapter_resource,
+        asset_resource,
+        true
+    )
     if not ui then
         return nil, ui_error
     end
 
-    local icon, icon_error = normalize_asset_url(definition.icon, owner_resource, adapter_resource, false)
+    local icon, icon_error = normalize_asset_url(
+        definition.icon,
+        owner_resource,
+        adapter_resource,
+        asset_resource,
+        false
+    )
     if definition.icon ~= nil and not icon then
-        return nil, icon_error
+        if definition.compatibility == nil then
+            return nil, icon_error
+        end
+        print((
+            "[sky_phone] Custom app '%s' from '%s' uses an unavailable icon (%s); using the default icon."
+        ):format(definition.id, owner_resource, icon_error))
     end
 
     local permissions, permissions_error = SkyPhoneApps.ValidatePermissions(definition.permissions)
@@ -387,7 +437,7 @@ local function normalize_external_definition(owner_resource, adapter_resource, d
     local hooks = {}
     for hook_name in pairs(HOOK_NAMES) do
         local hook = definition[hook_name]
-        if hook ~= nil and type(hook) ~= "function" then
+        if hook ~= nil and not is_callable(hook) then
             return nil, "invalid_" .. hook_name
         end
         hooks[hook_name] = hook
@@ -1280,6 +1330,12 @@ exports("SendCustomAppNotificationFromAdapter", send_custom_app_notification_fro
 exports("UpdateCustomApp", update_custom_app)
 exports("UpdateCustomAppFromAdapter", update_custom_app_from_adapter)
 
+SkyPhoneCompatibility.RegisterExportAlias("lb-phone", "AddCustomApp", add_custom_app_export)
+SkyPhoneCompatibility.RegisterExportAlias("lb-phone", "RemoveCustomApp", remove_custom_app)
+SkyPhoneCompatibility.RegisterExportAlias("lb-phone", "SendCustomAppMessage", send_custom_app_message)
+SkyPhoneCompatibility.RegisterExportAlias("yseries", "AddCustomApp", add_custom_app_export)
+SkyPhoneCompatibility.RegisterExportAlias("yseries", "RemoveCustomApp", remove_custom_app)
+
 RegisterNUICallback("custom-app:lifecycle", function(data, cb)
     if type(data) ~= "table" then
         cb({ success = false, error = "invalid_lifecycle_request" })
@@ -1358,11 +1414,11 @@ RegisterNUICallback("custom-app:lifecycle", function(data, cb)
         clear_active_app(false)
     end
 
-    local hook_error = nil
-    if not hook_success then
-        hook_error = "hook_failed"
+    if not hook_success and not app.catalog.compatibility then
+        cb({ success = false, error = "hook_failed" })
+        return
     end
-    cb({ success = hook_success, error = hook_error })
+    cb({ success = true })
 end)
 
 AddEventHandler("onClientResourceStop", function(resource_name)
diff --git a/sky_phone/source/server/custom_app_compat.lua b/sky_phone/source/server/custom_app_compat.lua
index 25196d2..022c21b 100644
--- a/sky_phone/source/server/custom_app_compat.lua
+++ b/sky_phone/source/server/custom_app_compat.lua
@@ -136,3 +136,4 @@ AddEventHandler("onResourceStop", function(resource_name)
 end)
 
 exports("addApplication", add_high_application)
+SkyPhoneCompatibility.RegisterExportAlias("high-phone", "addApplication", add_high_application)
diff --git a/sky_phone/source/shared/custom_app_compat.lua b/sky_phone/source/shared/custom_app_compat.lua
index d69b0b2..ff14ea1 100644
--- a/sky_phone/source/shared/custom_app_compat.lua
+++ b/sky_phone/source/shared/custom_app_compat.lua
@@ -1,5 +1,15 @@
 SkyPhoneCompatibility = {}
 
+function SkyPhoneCompatibility.RegisterExportAlias(resource_name, export_name, handler)
+    assert(type(resource_name) == "string" and resource_name ~= "", "Export alias resource must be a non-empty string")
+    assert(type(export_name) == "string" and export_name ~= "", "Export alias name must be a non-empty string")
+    assert(type(handler) == "function", "Export alias handler must be a function")
+
+    AddEventHandler(("__cfx_export_%s_%s"):format(resource_name, export_name), function(set_callback)
+        set_callback(handler)
+    end)
+end
+
 SkyPhoneCompatibility.Providers = {
     lb = "lb_phone",
     seventeen = "17mov",
@@ -26,6 +36,34 @@ local function normalize_at_resource_url(owner_resource, url, error_prefix)
     return owner_resource .. "/" .. url_path
 end
 
+local function resolve_lb_asset_resource(owner_resource, app_data)
+    local ui = app_data.ui
+    if type(ui) ~= "string" then
+        return nil
+    end
+
+    local explicit_ui_resource = ui:match("^https://cfx%-nui%-([^/]+)/")
+        or ui:match("^nui://([^/]+)/")
+    local asset_resource = explicit_ui_resource or ui:match("^([%w][%w._-]*)/")
+    if not asset_resource or asset_resource == owner_resource then
+        return nil
+    end
+
+    if explicit_ui_resource or app_data.resource == asset_resource then
+        return asset_resource
+    end
+
+    local icon = app_data.icon
+    local icon_resource = type(icon) == "string" and (
+        icon:match("^https://cfx%-nui%-([^/]+)/") or icon:match("^nui://([^/]+)/")
+    ) or nil
+    if icon_resource == asset_resource then
+        return asset_resource
+    end
+
+    return nil
+end
+
 local function build_locale_maps(app_name, locales)
     local names = {}
     local descriptions = {}
@@ -87,6 +125,7 @@ function SkyPhoneCompatibility.BuildLbDefinition(owner_resource, app_data)
         developer = app_data.developer,
         category = app_data.game and "games" or "utilities",
         ui = ui,
+        assetResource = resolve_lb_asset_resource(owner_resource, app_data),
         bridgeMode = "legacy",
         icon = app_data.icon,
         defaultInstalled = app_data.defaultApp or false,
diff --git a/tests/custom_app_compat_client.lua b/tests/custom_app_compat_client.lua
index 0a21629..f4a5027 100644
--- a/tests/custom_app_compat_client.lua
+++ b/tests/custom_app_compat_client.lua
@@ -1,4 +1,8 @@
 local registered_exports = {}
+local registered_event_handlers = {}
+local registered_nui_callbacks = {}
+local triggered_events = {}
+local nui_messages = {}
 local invoking_resource = nil
 
 Config = {
@@ -43,18 +47,31 @@ function GetInvokingResource()
 end
 
 function GetResourceState(resource_name)
-    if resource_name == "missing_resource" then
+    if resource_name == "missing_resource" or resource_name == "ui" then
         return "missing"
     end
     return "started"
 end
 
-function RegisterNUICallback() end
+function RegisterNUICallback(callback_name, handler)
+    registered_nui_callbacks[callback_name] = handler
+end
 function RegisterNetEvent() end
-function AddEventHandler() end
-function SendNUIMessage() end
+function AddEventHandler(event_name, handler)
+    local handlers = registered_event_handlers[event_name] or {}
+    handlers[#handlers + 1] = handler
+    registered_event_handlers[event_name] = handlers
+end
+function SendNUIMessage(message)
+    nui_messages[#nui_messages + 1] = message
+end
 function TriggerServerEvent() end
-function TriggerEvent() end
+function TriggerEvent(event_name, ...)
+    triggered_events[#triggered_events + 1] = {
+        event_name = event_name,
+        arguments = { ... },
+    }
+end
 
 function CreateThread(handler)
     handler()
@@ -65,17 +82,110 @@ dofile("sky_phone/source/shared/custom_app_compat.lua")
 dofile("sky_phone/source/client/custom_apps.lua")
 dofile("sky_phone/source/client/custom_app_compat.lua")
 
+local function get_alias_export(resource_name, export_name)
+    local event_name = ("__cfx_export_%s_%s"):format(resource_name, export_name)
+    local handlers = registered_event_handlers[event_name]
+    assert(handlers and #handlers == 1, ("Missing %s:%s export alias"):format(resource_name, export_name))
+
+    local alias_handler
+    local export_callback = setmetatable({
+        __cfx_functionReference = "test-export-callback",
+    }, {
+        __call = function(_, handler)
+            alias_handler = handler
+        end,
+    })
+    handlers[1](export_callback)
+    assert(type(alias_handler) == "function", ("Invalid %s:%s export alias"):format(resource_name, export_name))
+    return alias_handler
+end
+
+local function make_cfx_function_reference(reference, handler)
+    return setmetatable({
+        __cfx_functionReference = reference,
+    }, {
+        __call = function(_, ...)
+            return handler(...)
+        end,
+    })
+end
+
+local lb_add_custom_app = get_alias_export("lb-phone", "AddCustomApp")
+local lb_remove_custom_app = get_alias_export("lb-phone", "RemoveCustomApp")
+local lb_send_custom_app_message = get_alias_export("lb-phone", "SendCustomAppMessage")
+local lb_open_app = get_alias_export("lb-phone", "OpenApp")
+local lb_close_app = get_alias_export("lb-phone", "CloseApp")
+local mov_add_application = get_alias_export("17mov_Phone", "AddApplication")
+local mov_remove_application = get_alias_export("17mov_Phone", "RemoveApplication")
+local mov_send_app_message = get_alias_export("17mov_Phone", "SendAppMessage")
+local high_add_application = get_alias_export("high-phone", "addApplication")
+local high_send_app_nui = get_alias_export("high-phone", "sendAppNui")
+local quasar_add_custom_app = get_alias_export("qs-smartphone", "addCustomApp")
+local quasar_add_custom_apps_batch = get_alias_export("qs-smartphone", "addCustomAppsBatch")
+local quasar_update_custom_app = get_alias_export("qs-smartphone", "updateCustomApp")
+local quasar_remove_custom_app = get_alias_export("qs-smartphone", "removeCustomApp")
+local quasar_get_custom_apps = get_alias_export("qs-smartphone", "getCustomApps")
+local quasar_open_phone_app = get_alias_export("qs-smartphone", "OpenPhoneApp")
+local yseries_add_custom_app = get_alias_export("yseries", "AddCustomApp")
+local yseries_remove_custom_app = get_alias_export("yseries", "RemoveCustomApp")
+local yseries_send_app_message = get_alias_export("yseries", "SendAppMessage")
+local yseries_close_app = get_alias_export("yseries", "CloseApp")
+local yseries_get_data_loaded = get_alias_export("yseries", "GetDataLoaded")
+
+local expected_provider_resources = {
+    ["lb-phone"] = true,
+    ["17mov_Phone"] = true,
+    ["high-phone"] = true,
+    ["qs-smartphone"] = true,
+    ["yseries"] = true,
+}
+local resource_start_events = {}
+for index = 1, #triggered_events do
+    local event = triggered_events[index]
+    local resource_name = event.arguments[1]
+    if event.event_name == "onResourceStart" then
+        resource_start_events[resource_name] = true
+    end
+end
+for resource_name in pairs(expected_provider_resources) do
+    assert(resource_start_events[resource_name], ("Missing %s provider start signal"):format(resource_name))
+end
+assert(yseries_get_data_loaded(), "YSeries must see the compatibility provider as loaded")
+
 invoking_resource = "lb_app"
-local lb_success, lb_error = registered_exports.AddCustomApp({
+local lb_success, lb_error = lb_add_custom_app({
     identifier = "dispatch",
     name = "Dispatch",
     description = "Dispatch terminal",
     ui = "ui/index.html",
+    onInstall = make_cfx_function_reference("install-hook", function()
+        error("vendor install failure")
+    end),
+    onOpen = make_cfx_function_reference("open-hook", function()
+        error("vendor open failure")
+    end),
 })
 assert(lb_success and lb_error == nil, "LB AddCustomApp must register through the shared export")
 
+local lifecycle_callback = assert(registered_nui_callbacks["custom-app:lifecycle"])
+local lifecycle_response
+SkyPhoneApps.SetPhoneOpen(true)
+lifecycle_callback({ appId = "dispatch", event = "install" }, function(response)
+    lifecycle_response = response
+end)
+assert(lifecycle_response.success, "a vendor install hook failure must not fail installation")
+lifecycle_callback({ appId = "dispatch", event = "open" }, function(response)
+    lifecycle_response = response
+end)
+assert(lifecycle_response.success, "a vendor open hook failure must not prevent opening the app")
+lifecycle_callback({ appId = "dispatch", event = "ready" }, function(response)
+    lifecycle_response = response
+end)
+assert(lifecycle_response.success, "ready must complete after a failed vendor open hook")
+SkyPhoneApps.SetPhoneOpen(false)
+
 invoking_resource = "another_app"
-local duplicate_success, duplicate_error = registered_exports.AddCustomApp({
+local duplicate_success, duplicate_error = lb_add_custom_app({
     identifier = "dispatch",
     name = "Hijack",
     description = "Hijack",
@@ -83,18 +193,61 @@ local duplicate_success, duplicate_error = registered_exports.AddCustomApp({
 })
 assert(not duplicate_success and duplicate_error == "duplicate_app_id", "cross-owner IDs must be rejected")
 
-local remove_success, remove_error = registered_exports.RemoveCustomApp("dispatch")
+local remove_success, remove_error = lb_remove_custom_app("dispatch")
 assert(not remove_success and remove_error == "app_owner_mismatch", "cross-owner removal must be rejected")
 
 invoking_resource = "lb_app"
-assert(registered_exports.RemoveCustomApp("dispatch"), "the LB owner must be able to remove its app")
+local inactive_message_success, inactive_message_error = lb_send_custom_app_message("dispatch", { type = "ping" })
+assert(not inactive_message_success and inactive_message_error == "app_not_active", "LB message alias must preserve app state checks")
+local closed_open_success, closed_open_error = lb_open_app("dispatch")
+assert(not closed_open_success and closed_open_error == "phone_closed", "LB open alias must preserve phone state checks")
+local inactive_close_success, inactive_close_error = lb_close_app({ app = "dispatch" })
+assert(not inactive_close_success and inactive_close_error == "app_not_active", "LB close alias must preserve app state checks")
+assert(lb_remove_custom_app("dispatch"), "the LB owner must be able to remove its app")
+
+invoking_resource = "phone_adapter"
+assert(lb_add_custom_app({
+    identifier = "manufacturer-app",
+    name = "Manufacturer App",
+    description = "Manufacturer-owned UI assets",
+    ui = "manufacturer_app/ui/index.html",
+    icon = "nui://manufacturer_app/ui/icon.png",
+}), "LB resource-prefixed assets must register through an adapter")
+SkyPhoneApps.SetPhoneOpen(true)
+SkyPhoneApps.SendCatalog()
+local catalog_message = nui_messages[#nui_messages]
+local manufacturer_app
+for index = 1, #catalog_message.data.apps do
+    if catalog_message.data.apps[index].id == "manufacturer-app" then
+        manufacturer_app = catalog_message.data.apps[index]
+        break
+    end
+end
+assert(manufacturer_app, "manufacturer app must be present in the catalog")
+assert(
+    manufacturer_app.ui == "https://cfx-nui-manufacturer_app/ui/index.html",
+    "LB resource-prefixed UI must preserve its asset resource"
+)
+assert(
+    manufacturer_app.icon == "https://cfx-nui-manufacturer_app/ui/icon.png",
+    "LB resource-prefixed icon must preserve its asset resource"
+)
+SkyPhoneApps.SetPhoneOpen(false)
 
 invoking_resource = "yseries_app"
-assert(registered_exports.AddCustomApp({
+assert(yseries_add_custom_app({
     key = "slots",
     name = "Slots",
     ui = "https://cfx-nui-yseries_app/ui/index.html",
+    icon = {
+        yos = "https://cdn.example.com/slots.png",
+    },
 }), "YSeries AddCustomApp must be selected from the key field")
+local yseries_message_success, yseries_message_error = yseries_send_app_message("slots", { type = "ping" })
+assert(not yseries_message_success and yseries_message_error == "app_not_active", "YSeries message alias must preserve app state checks")
+local yseries_close_success, yseries_close_error = yseries_close_app({ app = "slots" })
+assert(not yseries_close_success and yseries_close_error == "app_not_active", "YSeries close alias must preserve app state checks")
+assert(yseries_remove_custom_app("slots"), "YSeries RemoveCustomApp must use the provider alias")
 
 local ambiguous_success, ambiguous_error = registered_exports.AddCustomApp({
     id = "ambiguous",
@@ -105,14 +258,17 @@ local ambiguous_success, ambiguous_error = registered_exports.AddCustomApp({
 assert(not ambiguous_success and ambiguous_error == "ambiguous_app_provider", "ambiguous schemas must fail")
 
 invoking_resource = "mov_app"
-assert(registered_exports.AddApplication({
+assert(mov_add_application({
     name = "market",
     label = "Market",
     ui = "https://cfx-nui-mov_app/ui/index.html",
 }), "17mov AddApplication must register")
+local mov_message_success, mov_message_error = mov_send_app_message("market", { type = "ping" })
+assert(not mov_message_success and mov_message_error == "app_not_active", "17mov message alias must preserve app state checks")
+assert(mov_remove_application("market"), "17mov RemoveApplication must use the provider alias")
 
 invoking_resource = "high_app"
-assert(registered_exports.addApplication("bankingv2", {
+assert(high_add_application("bankingv2", {
     externalUrl = "@high_app/ui/index.html",
 }, {
     en = {
@@ -120,9 +276,11 @@ assert(registered_exports.addApplication("bankingv2", {
         description = "Banking app",
     },
 }), "High addApplication must register")
+local high_message_success, high_message_error = high_send_app_nui("bankingv2", { type = "ping" })
+assert(not high_message_success and high_message_error == "app_not_active", "High message alias must preserve app state checks")
 
 invoking_resource = "quasar_app"
-assert(registered_exports.addCustomApp({
+assert(quasar_add_custom_app({
     id = "services",
     label = "Services",
     iframe = {
@@ -130,11 +288,14 @@ assert(registered_exports.addCustomApp({
     },
 }), "Quasar addCustomApp must register")
 
-local quasar_apps = registered_exports.getCustomApps()
+local quasar_apps = quasar_get_custom_apps()
 assert(#quasar_apps == 1 and quasar_apps[1].id == "services", "Quasar getCustomApps must expose the registry")
-assert(registered_exports.updateCustomApp("services", {
+assert(quasar_update_custom_app("services", {
     label = "City Services",
 }), "Quasar updateCustomApp must update an owned app")
-assert(registered_exports.removeCustomApp("services"), "Quasar removeCustomApp must remove an owned app")
+local quasar_open_success, quasar_open_error = quasar_open_phone_app("services")
+assert(not quasar_open_success and quasar_open_error == "phone_closed", "Quasar open alias must preserve phone state checks")
+assert(quasar_remove_custom_app("services"), "Quasar removeCustomApp must remove an owned app")
+assert(quasar_add_custom_apps_batch({}), "Quasar batch alias must accept an empty batch")
 
 print("Custom app compatibility client tests passed")
diff --git a/tests/custom_app_compat_server.lua b/tests/custom_app_compat_server.lua
index 2ba77f6..3348d66 100644
--- a/tests/custom_app_compat_server.lua
+++ b/tests/custom_app_compat_server.lua
@@ -1,4 +1,5 @@
 local event_handlers = {}
+local registered_event_handlers = {}
 local registered_exports = {}
 local sent_events = {}
 local invoking_resource = nil
@@ -25,7 +26,11 @@ function RegisterNetEvent(event_name, handler)
     event_handlers[event_name] = handler
 end
 
-function AddEventHandler() end
+function AddEventHandler(event_name, handler)
+    local handlers = registered_event_handlers[event_name] or {}
+    handlers[#handlers + 1] = handler
+    registered_event_handlers[event_name] = handlers
+end
 
 function TriggerClientEvent(event_name, target, ...)
     sent_events[#sent_events + 1] = {
@@ -38,8 +43,21 @@ end
 dofile("sky_phone/source/shared/custom_app_compat.lua")
 dofile("sky_phone/source/server/custom_app_compat.lua")
 
+local alias_handlers = registered_event_handlers["__cfx_export_high-phone_addApplication"]
+assert(alias_handlers and #alias_handlers == 1, "Missing high-phone:addApplication export alias")
+local high_add_application
+local export_callback = setmetatable({
+    __cfx_functionReference = "test-export-callback",
+}, {
+    __call = function(_, handler)
+        high_add_application = handler
+    end,
+})
+alias_handlers[1](export_callback)
+assert(type(high_add_application) == "function", "Invalid high-phone:addApplication export alias")
+
 invoking_resource = "high_server_app"
-local add_success, add_error = registered_exports.addApplication("bankingv2", {
+local add_success, add_error = high_add_application("bankingv2", {
     externalUrl = "@high_server_app/ui/index.html",
 }, {
     en = {
@@ -53,7 +71,7 @@ assert(sent_events[1].event_name == "sky_phone:compat:high:client:syncApplicatio
 assert(sent_events[1].arguments[1] == "high_server_app", "High sync must preserve the owner")
 
 invoking_resource = "other_server_app"
-local duplicate_success, duplicate_error = registered_exports.addApplication("bankingv2", {
+local duplicate_success, duplicate_error = high_add_application("bankingv2", {
     externalUrl = "@other_server_app/ui/index.html",
 })
 assert(not duplicate_success and duplicate_error == "duplicate_app_id", "High cross-owner replacement must fail")

From c95775fb2ce5dd635188a192a20d336818391dc6 Mon Sep 17 00:00:00 2001
From: "Leon.Schmidt" <leonmauricewill15@gmail.com>
Date: Tue, 11 Aug 2026 18:39:11 +0200
Subject: [PATCH 07/13] FIX - defer custom app lifecycle hooks

---
 sky_phone/source/client/custom_apps.lua | 44 ++++++++++++++++++++-----
 tests/custom_app_compat_client.lua      | 13 +++++++-
 2 files changed, 48 insertions(+), 9 deletions(-)

diff --git a/sky_phone/source/client/custom_apps.lua b/sky_phone/source/client/custom_apps.lua
index c098f70..87b4222 100644
--- a/sky_phone/source/client/custom_apps.lua
+++ b/sky_phone/source/client/custom_apps.lua
@@ -609,14 +609,40 @@ local function invoke_hook(app, hook_name, payload)
     return false
 end
 
-local function clear_active_app(invoke_close_hook)
+local function invoke_or_defer_hook(app, hook_name, payload, deferred_hooks)
+    if not app.catalog.compatibility then
+        return invoke_hook(app, hook_name, payload)
+    end
+
+    deferred_hooks[#deferred_hooks + 1] = {
+        app = app,
+        hookName = hook_name,
+        payload = payload,
+    }
+    return true
+end
+
+local function invoke_deferred_hooks(deferred_hooks)
+    for index = 1, #deferred_hooks do
+        local deferred_hook = deferred_hooks[index]
+        CreateThread(function()
+            invoke_hook(deferred_hook.app, deferred_hook.hookName, deferred_hook.payload)
+        end)
+    end
+end
+
+local function clear_active_app(invoke_close_hook, deferred_hooks)
     if not active_app_id then
         return
     end
 
     local app = apps_by_id[active_app_id]
     if app and invoke_close_hook then
-        invoke_hook(app, "onClose")
+        if deferred_hooks then
+            invoke_or_defer_hook(app, "onClose", nil, deferred_hooks)
+        else
+            invoke_hook(app, "onClose")
+        end
     end
     queued_messages[active_app_id] = nil
     active_app_id = nil
@@ -1383,17 +1409,18 @@ RegisterNUICallback("custom-app:lifecycle", function(data, cb)
         return
     end
 
+    local deferred_hooks = {}
     local hook_success = true
     if lifecycle_event == "install" then
-        hook_success = invoke_hook(app, "onInstall", lifecycle_payload)
+        hook_success = invoke_or_defer_hook(app, "onInstall", lifecycle_payload, deferred_hooks)
     elseif lifecycle_event == "open" then
         if active_app_id and active_app_id ~= data.appId then
-            clear_active_app(true)
+            clear_active_app(true, deferred_hooks)
         end
         active_app_id = data.appId
         active_app_ready = false
         queued_messages[data.appId] = {}
-        hook_success = invoke_hook(app, "onOpen", lifecycle_payload)
+        hook_success = invoke_or_defer_hook(app, "onOpen", lifecycle_payload, deferred_hooks)
     elseif active_app_id ~= data.appId then
         cb({ success = false, error = "app_not_active" })
         return
@@ -1408,17 +1435,18 @@ RegisterNUICallback("custom-app:lifecycle", function(data, cb)
         for index = 1, #pending do
             deliver_custom_app_message(data.appId, pending[index].payload)
         end
-        hook_success = invoke_hook(app, "onReady", lifecycle_payload)
+        hook_success = invoke_or_defer_hook(app, "onReady", lifecycle_payload, deferred_hooks)
     else
-        hook_success = invoke_hook(app, "onClose", lifecycle_payload)
+        hook_success = invoke_or_defer_hook(app, "onClose", lifecycle_payload, deferred_hooks)
         clear_active_app(false)
     end
 
-    if not hook_success and not app.catalog.compatibility then
+    if not hook_success then
         cb({ success = false, error = "hook_failed" })
         return
     end
     cb({ success = true })
+    invoke_deferred_hooks(deferred_hooks)
 end)
 
 AddEventHandler("onClientResourceStop", function(resource_name)
diff --git a/tests/custom_app_compat_client.lua b/tests/custom_app_compat_client.lua
index f4a5027..558184d 100644
--- a/tests/custom_app_compat_client.lua
+++ b/tests/custom_app_compat_client.lua
@@ -153,16 +153,21 @@ end
 assert(yseries_get_data_loaded(), "YSeries must see the compatibility provider as loaded")
 
 invoking_resource = "lb_app"
+local lifecycle_response_delivered = false
+local install_hook_after_response = false
+local open_hook_after_response = false
 local lb_success, lb_error = lb_add_custom_app({
     identifier = "dispatch",
     name = "Dispatch",
     description = "Dispatch terminal",
     ui = "ui/index.html",
     onInstall = make_cfx_function_reference("install-hook", function()
+        install_hook_after_response = lifecycle_response_delivered
         error("vendor install failure")
     end),
     onOpen = make_cfx_function_reference("open-hook", function()
-        error("vendor open failure")
+        open_hook_after_response = lifecycle_response_delivered
+        error(5)
     end),
 })
 assert(lb_success and lb_error == nil, "LB AddCustomApp must register through the shared export")
@@ -170,14 +175,20 @@ assert(lb_success and lb_error == nil, "LB AddCustomApp must register through th
 local lifecycle_callback = assert(registered_nui_callbacks["custom-app:lifecycle"])
 local lifecycle_response
 SkyPhoneApps.SetPhoneOpen(true)
+lifecycle_response_delivered = false
 lifecycle_callback({ appId = "dispatch", event = "install" }, function(response)
     lifecycle_response = response
+    lifecycle_response_delivered = true
 end)
 assert(lifecycle_response.success, "a vendor install hook failure must not fail installation")
+assert(install_hook_after_response, "a vendor install hook must run after the NUI response")
+lifecycle_response_delivered = false
 lifecycle_callback({ appId = "dispatch", event = "open" }, function(response)
     lifecycle_response = response
+    lifecycle_response_delivered = true
 end)
 assert(lifecycle_response.success, "a vendor open hook failure must not prevent opening the app")
+assert(open_hook_after_response, "a vendor open hook must run after the NUI response")
 lifecycle_callback({ appId = "dispatch", event = "ready" }, function(response)
     lifecycle_response = response
 end)

From 4be632759ba3762f92d42368ebb0aecdf01bce84 Mon Sep 17 00:00:00 2001
From: "Leon.Schmidt" <leonmauricewill15@gmail.com>
Date: Tue, 11 Aug 2026 19:00:51 +0200
Subject: [PATCH 08/13] FIX - isolate custom app JSON payload

---
 sky_phone/source/client/custom_apps.lua |  3 ++-
 tests/custom_app_compat_client.lua      | 10 ++++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/sky_phone/source/client/custom_apps.lua b/sky_phone/source/client/custom_apps.lua
index 87b4222..ea0ed2c 100644
--- a/sky_phone/source/client/custom_apps.lua
+++ b/sky_phone/source/client/custom_apps.lua
@@ -280,7 +280,8 @@ local function normalize_json_payload(payload, maximum_bytes)
         return nil, "payload_too_large"
     end
 
-    return json.decode(encoded)
+    local decoded = json.decode(encoded)
+    return decoded
 end
 
 local function validate_optional_text(value, error_code, maximum_length)
diff --git a/tests/custom_app_compat_client.lua b/tests/custom_app_compat_client.lua
index 558184d..09353b2 100644
--- a/tests/custom_app_compat_client.lua
+++ b/tests/custom_app_compat_client.lua
@@ -24,10 +24,16 @@ Config = {
 }
 
 json = {
-    decode = function()
+    decode = function(encoded)
+        if encoded == "null" then
+            return nil, 5
+        end
         return {}
     end,
-    encode = function()
+    encode = function(value)
+        if value == nil then
+            return "null"
+        end
         return "{}"
     end,
 }

From 8b205739a5da531859c48102ce812f39139e58b3 Mon Sep 17 00:00:00 2001
From: "Leon.Schmidt" <leonmauricewill15@gmail.com>
Date: Tue, 11 Aug 2026 19:23:40 +0200
Subject: [PATCH 09/13] FIX - boot LB custom app frames

---
 frontend/src/components/CustomAppFrame.vue |  7 ++++++-
 frontend/src/utils/customAppBridge.test.ts | 10 ++++++++++
 frontend/src/utils/customAppBridge.ts      |  9 +++++++++
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/frontend/src/components/CustomAppFrame.vue b/frontend/src/components/CustomAppFrame.vue
index 1b11e4f..fdbd4d5 100644
--- a/frontend/src/components/CustomAppFrame.vue
+++ b/frontend/src/components/CustomAppFrame.vue
@@ -17,6 +17,7 @@ import type {
 } from '@/types/apps'
 import {
   createCustomAppBridgeRequestHandler,
+  getCustomAppFrameBootstrapMessages,
   getSkyPhoneAppCapabilities,
   shouldReportCustomAppReady,
 } from '@/utils/customAppBridge'
@@ -266,6 +267,11 @@ function onFrameLoad(): void {
     loadTimeout = undefined
   }
   frameLoaded.value = true
+  for (const message of getCustomAppFrameBootstrapMessages(
+    props.app.compatibility,
+  )) {
+    postToFrame(message)
+  }
   if (props.app.bridgeMode === 'legacy' || skyBridgeReady.value) {
     frameUnavailable.value = false
   }
@@ -331,7 +337,6 @@ watch(() => catalog.openRequests[props.app.id], flushOpenRequest, {
       :class="{
         'custom-app-frame--fix-blur': app.compatibility.fixBlur === true,
       }"
-      :name="app.ownerResource"
       :sandbox="sandbox"
       :src="frameUrl"
       :title="app.name"
diff --git a/frontend/src/utils/customAppBridge.test.ts b/frontend/src/utils/customAppBridge.test.ts
index db1a77d..4e61985 100644
--- a/frontend/src/utils/customAppBridge.test.ts
+++ b/frontend/src/utils/customAppBridge.test.ts
@@ -2,6 +2,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 import {
   createCustomAppBridgeRequestHandler,
+  getCustomAppFrameBootstrapMessages,
   getSkyPhoneAppCapabilities,
   shouldReportCustomAppReady,
   type CustomAppBridgeNotification,
@@ -60,6 +61,15 @@ describe('custom app bridge', () => {
     expect(shouldReportCustomAppReady('sky', 'bridge-ready')).toBe(true)
   })
 
+  it('boots LB Phone frames with their documented ready signal', () => {
+    expect(
+      getCustomAppFrameBootstrapMessages({ provider: 'lb_phone' }),
+    ).toEqual(['componentsLoaded'])
+    expect(
+      getCustomAppFrameBootstrapMessages({ provider: '17mov' }),
+    ).toEqual([])
+  })
+
   it('passes validated storage data and server response data through', async () => {
     source.capabilities = ['device.storage']
     storageCall.mockResolvedValue({
diff --git a/frontend/src/utils/customAppBridge.ts b/frontend/src/utils/customAppBridge.ts
index e51a00e..fdde136 100644
--- a/frontend/src/utils/customAppBridge.ts
+++ b/frontend/src/utils/customAppBridge.ts
@@ -294,6 +294,15 @@ export function shouldReportCustomAppReady(
     : signal === 'frame-load'
 }
 
+export function getCustomAppFrameBootstrapMessages(
+  compatibility: Readonly<Record<string, unknown>>,
+): readonly unknown[] {
+  if (compatibility.provider === 'lb_phone') {
+    return ['componentsLoaded']
+  }
+  return []
+}
+
 export function createCustomAppBridgeRequestHandler(
   dependencies: CustomAppBridgeDependencies,
 ): {

From dc401e2b8705ef765af5bf5dc5f667e6fcae3832 Mon Sep 17 00:00:00 2001
From: "Leon.Schmidt" <leonmauricewill15@gmail.com>
Date: Tue, 11 Aug 2026 20:31:01 +0200
Subject: [PATCH 10/13] FIX - provide LB custom app browser bridge

---
 frontend/src/components/CustomAppFrame.vue    |  76 +++++-
 frontend/src/utils/lbPhoneAppBridge.test.ts   | 119 +++++++++
 frontend/src/utils/lbPhoneAppBridge.ts        | 237 ++++++++++++++++++
 sky_phone/source/shared/custom_app_compat.lua |   1 +
 tests/custom_app_compat.lua                   |  12 +
 5 files changed, 441 insertions(+), 4 deletions(-)
 create mode 100644 frontend/src/utils/lbPhoneAppBridge.test.ts
 create mode 100644 frontend/src/utils/lbPhoneAppBridge.ts

diff --git a/frontend/src/components/CustomAppFrame.vue b/frontend/src/components/CustomAppFrame.vue
index fdbd4d5..1139e6f 100644
--- a/frontend/src/components/CustomAppFrame.vue
+++ b/frontend/src/components/CustomAppFrame.vue
@@ -27,6 +27,12 @@ import {
   customAppLifecycleScheduler,
   getCustomAppSafeArea,
 } from '@/utils/customAppLifecycle'
+import {
+  createLbPhoneFrameDocument,
+  createLbPhoneHostSettings,
+  getLbPhoneCallbackResource,
+  usesLbPhoneHostRuntime,
+} from '@/utils/lbPhoneAppBridge'
 import { nuiCall } from '@/utils/nui'
 
 const props = defineProps<{
@@ -43,7 +49,9 @@ const frame = ref<HTMLIFrameElement | null>(null)
 const frameLoaded = ref(false)
 const frameUnavailable = ref(false)
 const skyBridgeReady = ref(false)
+const lbFrameDocument = ref<string | null>(null)
 let loadTimeout: ReturnType<typeof setTimeout> | undefined
+let frameDocumentController: AbortController | undefined
 const lifecycleAppId = props.app.id
 const initialOpenRequest: CustomAppOpenRequest | undefined =
   catalog.openRequests[lifecycleAppId]
@@ -94,11 +102,18 @@ const frameUrl = computed(() => {
   return url.href
 })
 const frameOrigin = computed(() => new URL(frameUrl.value).origin)
+const lbHostRuntime = computed(() => usesLbPhoneHostRuntime(props.app))
+const frameMountable = computed(
+  () => !lbHostRuntime.value || lbFrameDocument.value !== null,
+)
+const frameSource = computed(() =>
+  lbHostRuntime.value ? undefined : frameUrl.value,
+)
 const postMessageOrigin = computed(() =>
-  props.app.bundled ? '*' : frameOrigin.value,
+  props.app.bundled || lbHostRuntime.value ? '*' : frameOrigin.value,
 )
 const sandbox = computed(() =>
-  props.app.bundled
+  props.app.bundled || lbHostRuntime.value
     ? 'allow-downloads allow-forms allow-modals allow-scripts'
     : 'allow-downloads allow-forms allow-modals allow-same-origin allow-scripts',
 )
@@ -120,6 +135,15 @@ const context = computed<SkyPhoneAppContextV1>(() => ({
   protocolVersion: PROTOCOL_VERSION,
   safeArea: getCustomAppSafeArea(props.app.orientation),
 }))
+const lbSettings = computed(() =>
+  createLbPhoneHostSettings({
+    deviceName: phone.device?.name ?? '',
+    isDarkMode: phone.isDarkMode,
+    language: phone.lang,
+    preferences: phone.preferences,
+    securityEnabled: phone.security.enabled,
+  }),
+)
 
 function postToFrame(payload: unknown): boolean {
   const target = frame.value?.contentWindow
@@ -149,6 +173,44 @@ function sendContext(): void {
   })
 }
 
+function sendLbSettings(): void {
+  if (!lbHostRuntime.value || !frameLoaded.value) return
+  postToFrame({
+    settings: lbSettings.value,
+    type: 'sky-phone:lb-settings',
+  })
+}
+
+async function prepareLbFrameDocument(): Promise<void> {
+  const controller = new AbortController()
+  frameDocumentController = controller
+  try {
+    const response = await fetch(frameUrl.value, {
+      credentials: 'omit',
+      signal: controller.signal,
+    })
+    if (!response.ok) {
+      throw new Error(`${response.status} ${response.statusText}`)
+    }
+    const html = await response.text()
+    lbFrameDocument.value = createLbPhoneFrameDocument(html, {
+      appName: props.app.id,
+      resourceName: getLbPhoneCallbackResource(props.app),
+      settings: lbSettings.value,
+      ui: props.app.ui,
+    })
+  } catch (error) {
+    if (controller.signal.aborted) return
+    if (loadTimeout !== undefined) clearTimeout(loadTimeout)
+    loadTimeout = undefined
+    frameUnavailable.value = true
+    console.error(
+      `[Custom apps] Could not prepare LB Phone frame ${props.app.id}.`,
+      error,
+    )
+  }
+}
+
 function flushOpenRequest(): void {
   const request = catalog.openRequests[props.app.id]
   if (!request || !frameLoaded.value) return
@@ -216,7 +278,7 @@ async function handleBridgeRequest(
 
 function isTrustedFrameMessage(event: MessageEvent): boolean {
   if (event.source !== frame.value?.contentWindow) return false
-  if (props.app.bundled) {
+  if (props.app.bundled || lbHostRuntime.value) {
     return event.origin === 'null' || event.origin === frameOrigin.value
   }
   return event.origin === frameOrigin.value
@@ -272,6 +334,7 @@ function onFrameLoad(): void {
   )) {
     postToFrame(message)
   }
+  sendLbSettings()
   if (props.app.bridgeMode === 'legacy' || skyBridgeReady.value) {
     frameUnavailable.value = false
   }
@@ -300,16 +363,19 @@ onBeforeMount(() => {
       `[Custom apps] Frame readiness timed out for ${props.app.id}.`,
     )
   }, props.app.readyTimeoutMs)
+  if (lbHostRuntime.value) void prepareLbFrameDocument()
 })
 
 onBeforeUnmount(() => {
   if (loadTimeout !== undefined) clearTimeout(loadTimeout)
+  frameDocumentController?.abort()
   window.removeEventListener('message', onFrameMessage)
   orientation.release()
   void lifecycle.report('close')
 })
 
 watch(context, sendContext, { deep: true })
+watch(lbSettings, sendLbSettings, { deep: true })
 watch(
   () => props.app.orientation,
   (nextOrientation) => orientation.apply(nextOrientation),
@@ -331,6 +397,7 @@ watch(() => catalog.openRequests[props.app.id], flushOpenRequest, {
     }"
   >
     <iframe
+      v-if="frameMountable"
       ref="frame"
       v-show="frameReady && !frameUnavailable"
       class="custom-app-frame"
@@ -338,7 +405,8 @@ watch(() => catalog.openRequests[props.app.id], flushOpenRequest, {
         'custom-app-frame--fix-blur': app.compatibility.fixBlur === true,
       }"
       :sandbox="sandbox"
-      :src="frameUrl"
+      :src="frameSource"
+      :srcdoc="lbFrameDocument ?? undefined"
       :title="app.name"
       referrerpolicy="no-referrer"
       @load="onFrameLoad"
diff --git a/frontend/src/utils/lbPhoneAppBridge.test.ts b/frontend/src/utils/lbPhoneAppBridge.test.ts
new file mode 100644
index 0000000..c26af99
--- /dev/null
+++ b/frontend/src/utils/lbPhoneAppBridge.test.ts
@@ -0,0 +1,119 @@
+import { describe, expect, it } from 'vitest'
+
+import type { ExternalPhoneAppDefinition } from '@/types/apps'
+import {
+  createLbPhoneFrameDocument,
+  createLbPhoneHostSettings,
+  getLbPhoneCallbackResource,
+  usesLbPhoneHostRuntime,
+} from '@/utils/lbPhoneAppBridge'
+import { DEFAULT_PHONE_PREFERENCES } from '@/utils/preferences'
+
+function externalApp(
+  overrides: Partial<ExternalPhoneAppDefinition> = {},
+): ExternalPhoneAppDefinition {
+  return {
+    bridgeMode: 'legacy',
+    bundled: false,
+    capabilities: [],
+    category: 'games',
+    compatibility: { provider: 'lb_phone', resourceName: 'snake_app' },
+    component: null,
+    defaultInstalled: true,
+    description: 'Snake',
+    developer: 'Example',
+    dockOrder: null,
+    gridOrder: 100,
+    icon: {} as ExternalPhoneAppDefinition['icon'],
+    iconClass: 'app-icon--custom',
+    iconImage: 'https://cfx-nui-snake_app/ui/icon.png',
+    id: 'snake-game' as ExternalPhoneAppDefinition['id'],
+    kind: 'external',
+    name: 'Snake',
+    orientation: 'portrait',
+    ownerResource: 'phone_adapter',
+    readyTimeoutMs: 8000,
+    removable: true,
+    route: '/apps/snake-game' as ExternalPhoneAppDefinition['route'],
+    ui: 'https://cfx-nui-snake_app/ui/dist/index.html',
+    ...overrides,
+  }
+}
+
+describe('LB Phone app bridge', () => {
+  it('selects local LB documents without taking over query-driven apps', () => {
+    expect(usesLbPhoneHostRuntime(externalApp())).toBe(true)
+    expect(
+      usesLbPhoneHostRuntime(
+        externalApp({
+          ui: 'https://cfx-nui-snake_app/ui/index.html?route=/dispatch',
+        }),
+      ),
+    ).toBe(false)
+    expect(
+      usesLbPhoneHostRuntime(
+        externalApp({ compatibility: { provider: '17mov' } }),
+      ),
+    ).toBe(false)
+  })
+
+  it('uses the declared callback resource and rejects malformed overrides', () => {
+    expect(getLbPhoneCallbackResource(externalApp())).toBe('snake_app')
+    expect(
+      getLbPhoneCallbackResource(
+        externalApp({
+          compatibility: {
+            provider: 'lb_phone',
+            resourceName: '../wrong',
+          },
+        }),
+      ),
+    ).toBe('phone_adapter')
+  })
+
+  it('maps phone preferences into the LB settings contract', () => {
+    const settings = createLbPhoneHostSettings({
+      deviceName: 'Main phone',
+      isDarkMode: true,
+      language: 'de',
+      preferences: DEFAULT_PHONE_PREFERENCES,
+      securityEnabled: true,
+    })
+
+    expect(settings).toMatchObject({
+      display: { brightness: 1, size: 1, theme: 'dark' },
+      locale: 'de',
+      name: 'Main phone',
+      security: { pinCode: true },
+    })
+  })
+
+  it('injects the LB runtime and asset base before the vendor bundle', () => {
+    const html =
+      '<!doctype html><html><head><script type="module" src="/ui/dist/assets/index.js"></script></head><body></body></html>'
+    const document = createLbPhoneFrameDocument(html, {
+      appName: 'snake-game',
+      resourceName: 'snake_app',
+      settings: createLbPhoneHostSettings({
+        deviceName: '</script><script>window.injected=true</script>',
+        isDarkMode: false,
+        language: 'en',
+        preferences: DEFAULT_PHONE_PREFERENCES,
+        securityEnabled: false,
+      }),
+      ui: 'https://cfx-nui-snake_app/ui/dist/index.html',
+    })
+
+    expect(document.indexOf('<base href=')).toBeLessThan(
+      document.indexOf('src="/ui/dist/assets/index.js"'),
+    )
+    expect(document).toContain('globalThis.fetchNui = async')
+    expect(document).toContain('globalThis.onNuiEvent = globalThis.useNuiEvent')
+    expect(document).toContain('https://cfx-nui-snake_app/ui/dist/')
+    expect(document).not.toContain('</script><script>window.injected=true')
+
+    const runtime = /<script>([\s\S]*?)<\/script>/.exec(document)?.[1]
+    expect(runtime).toBeTruthy()
+    expect(() => new Function(runtime ?? '')).not.toThrow()
+  })
+})
diff --git a/frontend/src/utils/lbPhoneAppBridge.ts b/frontend/src/utils/lbPhoneAppBridge.ts
new file mode 100644
index 0000000..da52aa2
--- /dev/null
+++ b/frontend/src/utils/lbPhoneAppBridge.ts
@@ -0,0 +1,237 @@
+import type { ExternalPhoneAppDefinition } from '@/types/apps'
+import type { PhonePreferencesV1 } from '@/utils/preferences'
+
+const LB_PHONE_PROVIDER = 'lb_phone'
+const RESOURCE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/
+const MAX_FRAME_DOCUMENT_BYTES = 1_048_576
+
+export type LbPhoneHostSettings = {
+  airplaneMode: boolean
+  apps: string[][]
+  display: {
+    automatic: boolean
+    brightness: number
+    size: number
+    theme: 'dark' | 'light'
+  }
+  doNotDisturb: boolean
+  locale: string
+  lockscreen: {
+    color: string
+    fontStyle: number
+    layout: number
+  }
+  name: string
+  notifications: Record<string, { enabled: boolean; sound: boolean }>
+  phone: { showCallerId: boolean }
+  security: { faceId: boolean; pinCode: boolean }
+  sound: {
+    ringtone: string
+    silent: boolean
+    texttone: string
+    volume: number
+  }
+  storage: { total: number; used: number }
+  streamerMode: boolean
+  time: { twelveHourClock: boolean }
+  version: string
+  wallpaper: { background: string }
+  weather: { celcius: boolean }
+}
+
+type LbPhoneFrameDocumentOptions = {
+  appName: string
+  resourceName: string
+  settings: LbPhoneHostSettings
+  ui: string
+}
+
+type LbPhoneSettingsOptions = {
+  deviceName: string
+  isDarkMode: boolean
+  language: string
+  preferences: PhonePreferencesV1
+  securityEnabled: boolean
+}
+
+const LB_PHONE_RUNTIME_SOURCE = String.raw`
+const listeners = new Map();
+const settingsListeners = new Set();
+const resourcePattern = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
+const eventPattern = /^[A-Za-z0-9][A-Za-z0-9:._/-]{0,127}$/;
+
+function applySettings(nextSettings) {
+  globalThis.settings = nextSettings;
+  const theme = nextSettings?.display?.theme === 'dark' ? 'dark' : 'light';
+  document.documentElement.dataset.theme = theme;
+  if (document.body) document.body.dataset.theme = theme;
+}
+
+globalThis.resourceName = config.resourceName;
+globalThis.appName = config.appName;
+globalThis.components = globalThis.components ?? {};
+globalThis.GetParentResourceName = () => config.resourceName;
+globalThis.fetchNui = async (eventName, data, requestedResource) => {
+  if (typeof eventName !== 'string' || !eventPattern.test(eventName) || eventName.includes('..')) {
+    throw new TypeError('Invalid NUI callback name');
+  }
+
+  const targetResource = typeof requestedResource === 'string'
+    ? requestedResource
+    : config.resourceName;
+  if (!resourcePattern.test(targetResource)) {
+    throw new TypeError('Invalid NUI callback resource');
+  }
+
+  const response = await fetch('https://' + targetResource + '/' + eventName, {
+    body: JSON.stringify(data === undefined ? {} : data),
+    headers: { 'Content-Type': 'application/json; charset=UTF-8' },
+    method: 'POST'
+  });
+  if (!response.ok) {
+    throw new Error('NUI callback failed with HTTP ' + response.status);
+  }
+
+  const body = await response.text();
+  return body ? JSON.parse(body) : null;
+};
+globalThis.onNuiEvent = globalThis.useNuiEvent = (eventName, callback) => {
+  if (typeof eventName !== 'string' || !eventPattern.test(eventName) || typeof callback !== 'function') {
+    throw new TypeError('Invalid NUI event listener');
+  }
+  const callbacks = listeners.get(eventName) ?? new Set();
+  callbacks.add(callback);
+  listeners.set(eventName, callbacks);
+};
+globalThis.onSettingsChange = (callback) => {
+  if (typeof callback !== 'function') throw new TypeError('Invalid settings listener');
+  settingsListeners.add(callback);
+};
+globalThis.getSettings = async () => globalThis.settings;
+
+globalThis.addEventListener('message', (event) => {
+  const message = event.data;
+  if (!message || typeof message !== 'object') return;
+
+  if (message.type === 'sky-phone:lb-settings') {
+    applySettings(message.settings);
+    for (const callback of settingsListeners) callback(globalThis.settings);
+    return;
+  }
+
+  const eventName = typeof message.action === 'string'
+    ? message.action
+    : typeof message.type === 'string'
+      ? message.type
+      : null;
+  if (!eventName) return;
+  const data = Object.prototype.hasOwnProperty.call(message, 'data')
+    ? message.data
+    : message;
+  for (const callback of listeners.get(eventName) ?? []) callback(data);
+});
+
+applySettings(config.settings);
+document.addEventListener('DOMContentLoaded', () => applySettings(globalThis.settings), { once: true });
+`
+
+function escapeAttribute(value: string): string {
+  return value
+    .replace(/&/g, '&amp;')
+    .replace(/"/g, '&quot;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+}
+
+function serializeForInlineScript(value: unknown): string {
+  return JSON.stringify(value)
+    .replace(/</g, '\\u003c')
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029')
+}
+
+export function usesLbPhoneHostRuntime(
+  app: ExternalPhoneAppDefinition,
+): boolean {
+  if (app.compatibility.provider !== LB_PHONE_PROVIDER) return false
+
+  const url = new URL(app.ui)
+  return url.protocol === 'https:' && url.search === ''
+}
+
+export function getLbPhoneCallbackResource(
+  app: ExternalPhoneAppDefinition,
+): string {
+  const configured = app.compatibility.resourceName
+  return typeof configured === 'string' &&
+    RESOURCE_NAME_PATTERN.test(configured)
+    ? configured
+    : app.ownerResource
+}
+
+export function createLbPhoneHostSettings(
+  options: LbPhoneSettingsOptions,
+): LbPhoneHostSettings {
+  const preferences = options.preferences.settings
+  return {
+    airplaneMode: preferences.airplaneMode,
+    apps: [],
+    display: {
+      automatic: preferences.appearanceMode === 'automatic',
+      brightness: preferences.screenBrightness / 100,
+      size: preferences.phoneScale / 100,
+      theme: options.isDarkMode ? 'dark' : 'light',
+    },
+    doNotDisturb: preferences.focusMode,
+    locale: options.language,
+    lockscreen: { color: '#ffffff', fontStyle: 0, layout: 0 },
+    name: options.deviceName,
+    notifications: Object.fromEntries(
+      Object.entries(preferences.notifications).map(([appId, settings]) => [
+        appId,
+        { enabled: settings.enabled, sound: settings.sounds },
+      ]),
+    ),
+    phone: { showCallerId: true },
+    security: { faceId: false, pinCode: options.securityEnabled },
+    sound: {
+      ringtone: preferences.ringtone,
+      silent:
+        preferences.notificationVolume === 0 &&
+        preferences.ringtoneVolume === 0,
+      texttone: preferences.notificationSound,
+      volume: preferences.notificationVolume / 100,
+    },
+    storage: { total: 0, used: 0 },
+    streamerMode: preferences.streamerMode,
+    time: { twelveHourClock: false },
+    version: 'sky_phone',
+    wallpaper: { background: preferences.wallpaper },
+    weather: { celcius: true },
+  }
+}
+
+export function createLbPhoneFrameDocument(
+  html: string,
+  options: LbPhoneFrameDocumentOptions,
+): string {
+  if (
+    new TextEncoder().encode(html).byteLength > MAX_FRAME_DOCUMENT_BYTES ||
+    !RESOURCE_NAME_PATTERN.test(options.resourceName)
+  ) {
+    throw new Error('invalid_lb_phone_frame_document')
+  }
+
+  const head = /<head(?:\s[^>]*)?>/i.exec(html)
+  if (!head) throw new Error('invalid_lb_phone_frame_document')
+
+  const baseUrl = new URL('.', options.ui).href
+  const config = serializeForInlineScript({
+    appName: options.appName,
+    resourceName: options.resourceName,
+    settings: options.settings,
+  })
+  const injection = `<base href="${escapeAttribute(baseUrl)}"><script>(() => { const config = ${config};${LB_PHONE_RUNTIME_SOURCE}\n})();<\/script>`
+  const insertionPoint = head.index + head[0].length
+  return `${html.slice(0, insertionPoint)}${injection}${html.slice(insertionPoint)}`
+}
diff --git a/sky_phone/source/shared/custom_app_compat.lua b/sky_phone/source/shared/custom_app_compat.lua
index ff14ea1..514ddff 100644
--- a/sky_phone/source/shared/custom_app_compat.lua
+++ b/sky_phone/source/shared/custom_app_compat.lua
@@ -137,6 +137,7 @@ function SkyPhoneCompatibility.BuildLbDefinition(owner_resource, app_data)
         compatibility = {
             provider = SkyPhoneCompatibility.Providers.lb,
             apiVersion = 1,
+            resourceName = type(app_data.resource) == "string" and app_data.resource or owner_resource,
         },
     }
 end
diff --git a/tests/custom_app_compat.lua b/tests/custom_app_compat.lua
index 55c79b4..2613ad3 100644
--- a/tests/custom_app_compat.lua
+++ b/tests/custom_app_compat.lua
@@ -13,6 +13,18 @@ assert(lb_definition.id == "dispatch", "LB identifier must map to the Sky app ID
 assert(lb_definition.ui == "ui/index.html", "LB relative UI must remain owner-relative")
 assert(lb_definition.orientation == "landscape", "LB landscape flag must be preserved")
 assert(type(lb_definition.onOpen) == "function", "LB onUse must map to the open lifecycle")
+assert(lb_definition.compatibility.resourceName == "lb_app", "LB callbacks must target the registering resource")
+
+local bridged_lb_definition = assert(SkyPhoneCompatibility.BuildLbDefinition("phone_adapter", {
+    identifier = "bridged",
+    name = "Bridged",
+    ui = "manufacturer_app/ui/index.html",
+    resource = "manufacturer_app",
+}))
+assert(
+    bridged_lb_definition.compatibility.resourceName == "manufacturer_app",
+    "LB adapter callbacks must target the declared app resource"
+)
 
 local invalid_lb, invalid_lb_error = SkyPhoneCompatibility.BuildLbDefinition("lb_app", {
     identifier = "dispatch",

From 5d984b5efe6d4ff051376ba0a7b69584d3df48cc Mon Sep 17 00:00:00 2001
From: "Leon.Schmidt" <leonmauricewill15@gmail.com>
Date: Tue, 11 Aug 2026 21:46:40 +0200
Subject: [PATCH 11/13] FIX - clone custom app frame messages

---
 frontend/src/components/CustomAppFrame.vue |  3 ++-
 frontend/src/utils/clone.test.ts           | 20 ++++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 frontend/src/utils/clone.test.ts

diff --git a/frontend/src/components/CustomAppFrame.vue b/frontend/src/components/CustomAppFrame.vue
index 1139e6f..bc6d973 100644
--- a/frontend/src/components/CustomAppFrame.vue
+++ b/frontend/src/components/CustomAppFrame.vue
@@ -33,6 +33,7 @@ import {
   getLbPhoneCallbackResource,
   usesLbPhoneHostRuntime,
 } from '@/utils/lbPhoneAppBridge'
+import { cloneJsonData } from '@/utils/clone'
 import { nuiCall } from '@/utils/nui'
 
 const props = defineProps<{
@@ -150,7 +151,7 @@ function postToFrame(payload: unknown): boolean {
   if (!target) return false
 
   try {
-    target.postMessage(payload, postMessageOrigin.value)
+    target.postMessage(cloneJsonData(payload), postMessageOrigin.value)
     return true
   } catch (error) {
     console.error(`[Custom apps] Could not message ${props.app.id}.`, error)
diff --git a/frontend/src/utils/clone.test.ts b/frontend/src/utils/clone.test.ts
new file mode 100644
index 0000000..2c4c8cf
--- /dev/null
+++ b/frontend/src/utils/clone.test.ts
@@ -0,0 +1,20 @@
+import { reactive } from 'vue'
+import { describe, expect, it } from 'vitest'
+
+import { cloneJsonData } from '@/utils/clone'
+
+describe('JSON data cloning', () => {
+  it('turns reactive custom app payloads into structured-cloneable data', () => {
+    const payload = reactive({
+      action: 'setSpeedCameras',
+      data: [{ id: 1, label: 'Alta Street' }],
+    })
+
+    expect(() => structuredClone(payload)).toThrow()
+
+    const cloned = cloneJsonData(payload)
+
+    expect(cloned).toEqual(payload)
+    expect(() => structuredClone(cloned)).not.toThrow()
+  })
+})

From a3787d8fa713ae113d043f1368e40fc680ee6716 Mon Sep 17 00:00:00 2001
From: "Leon.Schmidt" <leonmauricewill15@gmail.com>
Date: Tue, 11 Aug 2026 22:14:53 +0200
Subject: [PATCH 12/13] FIX - remove duplicate CrewLink polling

---
 sky_phone/source/client/crewlink.lua | 21 +++++++---
 sky_phone/source/client/main.lua     |  1 -
 sky_phone/source/server/crewlink.lua | 60 +++++++++++-----------------
 sky_phone/source/server/phone.lua    | 12 +++---
 4 files changed, 46 insertions(+), 48 deletions(-)

diff --git a/sky_phone/source/client/crewlink.lua b/sky_phone/source/client/crewlink.lua
index d554d0a..5ecf4eb 100644
--- a/sky_phone/source/client/crewlink.lua
+++ b/sky_phone/source/client/crewlink.lua
@@ -1,4 +1,5 @@
 local overhead_members = {}
+local overhead_expires_at = 0
 
 local function draw_overhead_label(coords, username, role)
     SetDrawOrigin(coords.x, coords.y, coords.z + 1.05, 0)
@@ -14,17 +15,25 @@ local function draw_overhead_label(coords, username, role)
     ClearDrawOrigin()
 end
 
-CreateThread(function()
-    while true do
-        local result = Bridge.Callbacks.Trigger("sky_phone:crewlink:overhead", {})
-        overhead_members = result and result.success and result.data and result.data.members or {}
-        Wait(Config.CrewLink.OverheadRefreshMilliseconds)
-    end
+RegisterNUICallback("crewlink:live", function(data, cb)
+    local result = Bridge.Callbacks.Trigger("sky_phone:crewlink:live", data)
+    overhead_members = result and result.success and result.data and result.data.overheadMembers or {}
+    overhead_expires_at = GetGameTimer() + Config.CrewLink.OverheadRefreshMilliseconds * 2
+    cb(result or { success = false, error = "request_failed" })
+end)
+
+AddEventHandler("sky_phone:nuiClosed", function()
+    overhead_members = {}
+    overhead_expires_at = 0
 end)
 
 CreateThread(function()
     while true do
         local sleep = 1000
+        if overhead_expires_at > 0 and GetGameTimer() >= overhead_expires_at then
+            overhead_members = {}
+            overhead_expires_at = 0
+        end
         if #overhead_members > 0 then
             sleep = 0
             local player_coords = GetEntityCoords(PlayerPedId())
diff --git a/sky_phone/source/client/main.lua b/sky_phone/source/client/main.lua
index 4bfd8f5..19867cc 100644
--- a/sky_phone/source/client/main.lua
+++ b/sky_phone/source/client/main.lua
@@ -168,7 +168,6 @@ local server_callbacks = {
     "crewlink:leave",
     "crewlink:create-ping",
     "crewlink:remove-ping",
-    "crewlink:live",
     "companies:list",
     "companies:get",
     "companies:my-requests",
diff --git a/sky_phone/source/server/crewlink.lua b/sky_phone/source/server/crewlink.lua
index 7dca0f3..0bb5cfe 100644
--- a/sky_phone/source/server/crewlink.lua
+++ b/sky_phone/source/server/crewlink.lua
@@ -1089,51 +1089,39 @@ Bridge.Callbacks.Register("sky_phone:crewlink:live", function(source)
     if not profile then
         return error_response
     end
-    if not profile.active_group_id or not membership(profile.id, profile.active_group_id) then
-        return { success = true, data = { members = {}, pings = {} } }
+    if not profile.active_group_id then
+        return { success = true, data = { members = {}, overheadMembers = {}, pings = {} } }
+    end
+    local active_membership = membership(profile.id, profile.active_group_id)
+    if not active_membership then
+        return { success = true, data = { members = {}, overheadMembers = {}, pings = {} } }
+    end
+    local members = live_group(profile.active_group_id)
+    local overhead_members = {}
+    if tonumber(profile.overhead_visible) == 1
+        and tonumber(active_membership.overhead_allowed) == 1
+    then
+        for _, member in ipairs(members) do
+            if member.source and member.source ~= source and member.overheadVisible then
+                overhead_members[#overhead_members + 1] = {
+                    source = member.source,
+                    username = member.username,
+                    role = member.role,
+                    roleLabel = member.role:sub(1, 1):upper() .. member.role:sub(2),
+                }
+            end
+        end
     end
     return {
         success = true,
         data = {
-            members = live_group(profile.active_group_id),
+            members = members,
+            overheadMembers = overhead_members,
             pings = active_pings(profile.active_group_id),
         },
     }
 end)
 
-Bridge.Callbacks.Register("sky_phone:crewlink:overhead", function(source)
-    if not SkyPhone.AllowOperation(
-        source,
-        "crewlink:overhead",
-        Config.CrewLink.LiveRequestsPerMinute,
-        60
-    ) then
-        return { success = false, error = "rate_limited" }
-    end
-    local profile = require_profile(source)
-    if not profile or not profile.active_group_id or tonumber(profile.overhead_visible) ~= 1 then
-        return { success = true, data = { members = {} } }
-    end
-    local active_membership = membership(profile.id, profile.active_group_id)
-    if not active_membership or tonumber(active_membership.overhead_allowed) ~= 1 then
-        return { success = true, data = { members = {} } }
-    end
-    local live_sources = live_sources_by_account()
-    local members = {}
-    for _, member in ipairs(member_dtos(profile.active_group_id)) do
-        local member_source = live_sources[member.account_id]
-        if member_source and member_source ~= source and member.overheadVisible then
-            members[#members + 1] = {
-                source = member_source,
-                username = member.username,
-                role = member.role,
-                roleLabel = member.role:sub(1, 1):upper() .. member.role:sub(2),
-            }
-        end
-    end
-    return { success = true, data = { members = members } }
-end)
-
 exports("GetCrewLinkActiveGroup", function(source)
     local profile = require_profile(source)
     if not profile or not profile.active_group_id then
diff --git a/sky_phone/source/server/phone.lua b/sky_phone/source/server/phone.lua
index 1c6d072..91d0a0f 100644
--- a/sky_phone/source/server/phone.lua
+++ b/sky_phone/source/server/phone.lua
@@ -492,6 +492,9 @@ local function bootstrap(source, security, security_loaded)
         error(("[sky_phone] Active IMEI %s has no device row."):format(session.imei))
     end
 
+    session.account_id = device.account_id and tonumber(device.account_id) or nil
+    session.account_email = session.account_id and device.email or nil
+
     return {
         token = session.token,
         security = security_status(device.imei, security, security_loaded),
@@ -747,14 +750,13 @@ function SkyPhone.RequireAccount(source)
     if not session then
         return nil, error_response
     end
-    local device = load_device(session.imei)
-    if not device or not device.account_id then
+    if not session.account_id then
         return nil, { success = false, error = "not_authenticated" }
     end
     return {
-        id = tonumber(device.account_id),
-        email = device.email,
-        imei = device.imei,
+        id = session.account_id,
+        email = session.account_email,
+        imei = session.imei,
     }
 end
 

From 01e583805d171bea6fecece40d39e291d7f1a3a9 Mon Sep 17 00:00:00 2001
From: "Leon.Schmidt" <leonmauricewill15@gmail.com>
Date: Tue, 11 Aug 2026 22:54:03 +0200
Subject: [PATCH 13/13] FIX - accept custom app registration retries

---
 sky_phone/source/client/custom_app_compat.lua | 18 +++++++-----------
 tests/custom_app_compat_client.lua            | 17 +++++++++++++++--
 2 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/sky_phone/source/client/custom_app_compat.lua b/sky_phone/source/client/custom_app_compat.lua
index 0228d99..57ec252 100644
--- a/sky_phone/source/client/custom_app_compat.lua
+++ b/sky_phone/source/client/custom_app_compat.lua
@@ -30,7 +30,7 @@ local function copy_record_data(value)
     return copied
 end
 
-local function register_provider_app(provider, owner_resource, definition, vendor_data, update_existing)
+local function register_provider_app(provider, owner_resource, definition, vendor_data)
     local app_id = definition.id
     local existing = provider_apps[app_id]
     if existing and (existing.owner_resource ~= owner_resource or existing.provider ~= provider) then
@@ -38,7 +38,7 @@ local function register_provider_app(provider, owner_resource, definition, vendo
     end
 
     local success, error_message
-    if existing and update_existing then
+    if existing then
         success, error_message = core.Update(owner_resource, definition)
     else
         success, error_message = core.Add(owner_resource, definition)
@@ -104,7 +104,7 @@ function SkyPhoneApps.RegisterCompatibilityExport(owner_resource, app_data)
         ))
         return false, definition_error
     end
-    return register_provider_app(provider, owner_resource, definition, copy_record_data(app_data), false)
+    return register_provider_app(provider, owner_resource, definition, copy_record_data(app_data))
 end
 
 SkyPhoneApps.OnCompatibilityAppRemoved = function(owner_resource, app_id)
@@ -133,8 +133,7 @@ local function add_17mov_application(app_data)
         providers.seventeen,
         owner_resource,
         definition,
-        copy_record_data(app_data),
-        false
+        copy_record_data(app_data)
     )
 end
 
@@ -206,8 +205,7 @@ local function add_high_application(app_name, data, locales)
         providers.high,
         owner_resource,
         definition,
-        copy_record_data(data),
-        provider_apps[app_name] ~= nil
+        copy_record_data(data)
     )
 end
 
@@ -241,8 +239,7 @@ local function add_quasar_app_for_owner(owner_resource, app_data)
         providers.quasar,
         owner_resource,
         definition,
-        SkyPhoneCompatibility.CopyQuasarData(app_data),
-        false
+        SkyPhoneCompatibility.CopyQuasarData(app_data)
     )
 end
 
@@ -473,8 +470,7 @@ local function remove_high_server_app(owner_resource, app_id)
             providers.high,
             client_record.owner_resource,
             client_record.definition,
-            nil,
-            false
+            nil
         )
         if not success then
             print(("[%s] Could not restore High Phone client application %s: %s."):format(
diff --git a/tests/custom_app_compat_client.lua b/tests/custom_app_compat_client.lua
index 09353b2..cd548fb 100644
--- a/tests/custom_app_compat_client.lua
+++ b/tests/custom_app_compat_client.lua
@@ -162,7 +162,7 @@ invoking_resource = "lb_app"
 local lifecycle_response_delivered = false
 local install_hook_after_response = false
 local open_hook_after_response = false
-local lb_success, lb_error = lb_add_custom_app({
+local lb_definition = {
     identifier = "dispatch",
     name = "Dispatch",
     description = "Dispatch terminal",
@@ -175,12 +175,25 @@ local lb_success, lb_error = lb_add_custom_app({
         open_hook_after_response = lifecycle_response_delivered
         error(5)
     end),
-})
+}
+local lb_success, lb_error = lb_add_custom_app(lb_definition)
 assert(lb_success and lb_error == nil, "LB AddCustomApp must register through the shared export")
+lb_definition.name = "Dispatch Updated"
+local retry_success, retry_error = lb_add_custom_app(lb_definition)
+assert(retry_success and retry_error == nil, "same-owner LB registration retries must update in place")
 
 local lifecycle_callback = assert(registered_nui_callbacks["custom-app:lifecycle"])
 local lifecycle_response
 SkyPhoneApps.SetPhoneOpen(true)
+local retry_catalog = nui_messages[#nui_messages]
+local retried_app
+for index = 1, #retry_catalog.data.apps do
+    if retry_catalog.data.apps[index].id == "dispatch" then
+        retried_app = retry_catalog.data.apps[index]
+        break
+    end
+end
+assert(retried_app and retried_app.name == "Dispatch Updated", "same-owner retry must publish the updated app")
 lifecycle_response_delivered = false
 lifecycle_callback({ appId = "dispatch", event = "install" }, function(response)
     lifecycle_response = response