@lazehq/cli 0.1.37 → 0.1.39

package/dist/laze.mjs

@@ -18733,8 +18733,8 @@ var require_snapshot_utils = __commonJS({
 var require_snapshot_recorder = __commonJS({
   "../../node_modules/.pnpm/undici@8.10.0/node_modules/undici/lib/mock/snapshot-recorder.js"(exports, module) {
     "use strict";
-    var { writeFile: writeFile23, readFile: readFile39, mkdir: mkdir21 } = __require("node:fs/promises");
-    var { dirname: dirname22, resolve: resolve17 } = __require("node:path");
+    var { writeFile: writeFile23, readFile: readFile39, mkdir: mkdir22 } = __require("node:fs/promises");
+    var { dirname: dirname23, resolve: resolve17 } = __require("node:path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("node:timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -18980,7 +18980,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         const resolvedPath = resolve17(path);
-        await mkdir21(dirname22(resolvedPath), { recursive: true });
+        await mkdir22(dirname23(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
           snapshot
@@ -35708,7 +35708,7 @@ function flagText({
 }
 
 // src/rules/cli-version.rules.ts
-var STAMPED = "0.1.37";
+var STAMPED = "0.1.39";
 function cliVersionOf({ stamped = STAMPED } = {}) {
   return stamped.startsWith("__") ? "dev" : stamped;
 }
@@ -57796,6 +57796,96 @@ var deviceGrantSummarySchema = deviceGrantSummarySchemaDefinition;
 var ApiKeyApi = moduleApi()("api-key");
 var apiKeyTrpc = defineTrpcContract("apiKey").mutation("create").withInput(createApiKeyInputSchema).withOutput(createdApiKeySchema).query("list").withInput(external_exports.object({ workspaceId: external_exports.string().min(1) })).withOutput(external_exports.array(apiKeySummarySchema)).mutation("revoke").withInput(revokeApiKeyInputSchema).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("listMine").withInput(external_exports.object({ workspaceId: external_exports.string().min(1) })).withOutput(external_exports.array(personalApiKeySchema)).mutation("revokeMine").withInput(revokeApiKeyInputSchema).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("deviceGrant").withInput(external_exports.object({ workspaceId: external_exports.string().min(1), userCode: external_exports.string().min(1).max(20) })).withOutput(deviceGrantSummarySchema).mutation("approveDevice").withInput(decideDeviceGrantInputSchema).withOutput(external_exports.object({ approved: external_exports.literal(true) })).mutation("denyDevice").withInput(decideDeviceGrantInputSchema).withOutput(external_exports.object({ denied: external_exports.literal(true) })).build();
 
+// ../../modules/chat/contract/src/chat.layout.ts
+var LAYOUT_BLOCKS_MAX = 50;
+var LAYOUT_TEXT_MAX = 3e3;
+var LAYOUT_ITEMS_MAX = 25;
+var markdown = external_exports.string().max(LAYOUT_TEXT_MAX);
+var plain = external_exports.string().max(LAYOUT_TEXT_MAX);
+var imageUrl = external_exports.url({ protocol: /^https?$/ }).max(2e3);
+var linkUrl = external_exports.string().max(3e3);
+var layoutImageSchemaDefinition = external_exports.object({ url: imageUrl, alt: plain });
+var layoutButtonSchemaDefinition = external_exports.object({
+  text: plain,
+  url: linkUrl.nullable(),
+  style: external_exports.enum(["default", "primary", "danger"])
+});
+var layoutAccessorySchemaDefinition = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("image"), image: layoutImageSchemaDefinition }),
+  external_exports.object({ type: external_exports.literal("button"), button: layoutButtonSchemaDefinition })
+]);
+var contextItemSchemaDefinition = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("text"), text: markdown }),
+  external_exports.object({ type: external_exports.literal("image"), image: layoutImageSchemaDefinition })
+]);
+var buttons = external_exports.array(layoutButtonSchemaDefinition).max(LAYOUT_ITEMS_MAX);
+var cardSchemaDefinition = external_exports.object({
+  type: external_exports.literal("card"),
+  icon: layoutImageSchemaDefinition.nullable(),
+  heroImage: layoutImageSchemaDefinition.nullable(),
+  title: markdown,
+  subtitle: markdown,
+  body: markdown,
+  actions: buttons
+});
+var layoutBlockSchemaDefinition = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("header"), text: plain }),
+  external_exports.object({
+    type: external_exports.literal("section"),
+    text: markdown,
+    fields: external_exports.array(markdown).max(LAYOUT_ITEMS_MAX),
+    accessory: layoutAccessorySchemaDefinition.nullable()
+  }),
+  external_exports.object({
+    type: external_exports.literal("context"),
+    items: external_exports.array(contextItemSchemaDefinition).max(LAYOUT_ITEMS_MAX)
+  }),
+  external_exports.object({ type: external_exports.literal("actions"), buttons }),
+  external_exports.object({ type: external_exports.literal("divider") }),
+  external_exports.object({
+    type: external_exports.literal("image"),
+    image: layoutImageSchemaDefinition,
+    title: plain
+  }),
+  /** Rich text, a markdown block or the source's own text: drawn like a message body. */
+  external_exports.object({ type: external_exports.literal("text"), text: markdown }),
+  cardSchemaDefinition,
+  external_exports.object({ type: external_exports.literal("carousel"), cards: external_exports.array(cardSchemaDefinition).max(10) })
+]);
+var attachmentFieldSchemaDefinition = external_exports.object({
+  title: plain,
+  value: markdown,
+  short: external_exports.boolean()
+});
+var layoutAttachmentSchemaDefinition = external_exports.object({
+  type: external_exports.literal("attachment"),
+  /** `#RRGGBB`, or null for the default grey bar. */
+  color: external_exports.string().regex(/^#[0-9A-F]{6}$/).nullable(),
+  pretext: markdown,
+  author: external_exports.object({ name: plain, url: linkUrl.nullable(), icon: imageUrl.nullable() }).nullable(),
+  title: plain,
+  titleUrl: linkUrl.nullable(),
+  text: markdown,
+  fields: external_exports.array(attachmentFieldSchemaDefinition).max(LAYOUT_ITEMS_MAX),
+  blocks: external_exports.array(layoutBlockSchemaDefinition).max(LAYOUT_BLOCKS_MAX),
+  image: layoutImageSchemaDefinition.nullable(),
+  thumb: layoutImageSchemaDefinition.nullable(),
+  actions: buttons,
+  footer: markdown,
+  footerIcon: imageUrl.nullable(),
+  /** The attachment's time, a `<!date^...>` token the reader formats; "" for none. */
+  ts: markdown
+});
+var layoutPartSchemaDefinition = external_exports.union([
+  layoutBlockSchemaDefinition,
+  layoutAttachmentSchemaDefinition
+]);
+var messageLayoutSchemaDefinition = external_exports.object({
+  /** No parts means the source drew only its text: no layout is kept. */
+  parts: external_exports.array(layoutPartSchemaDefinition).max(LAYOUT_BLOCKS_MAX)
+});
+var messageLayoutSchema = messageLayoutSchemaDefinition;
+
 // ../../modules/chat/contract/src/chat.presence.ts
 var STATUS_TEXT_MAX = 100;
 var idSchema = external_exports.string().min(1).max(64);
@@ -58384,6 +58474,8 @@ var messageSchemaDefinition = external_exports.object({
   pin: messagePinSchemaDefinition.nullable().default(null),
   /** A forward's quote of the original message, taken when it was forwarded. */
   forward: messageForwardSchemaDefinition.nullable().optional(),
+  /** The blocks and attachments a mirrored message's source drew; clients draw it for the body. */
+  layout: messageLayoutSchema.nullable().optional(),
   /** A message written in Laze that its mirror is still waiting to send, or could not send. */
   mirrorDelivery: mirrorDeliverySchema.nullable().optional(),
   /** A thread reply also sent to its conversation: it shows in the thread and the channel. */
@@ -58548,7 +58640,9 @@ var updateChannelInputSchemaDefinition = external_exports.object({
   /** Makes a public channel private; the creator's or a workspace Admin's change, one way only. */
   visibility: external_exports.literal("private").optional(),
   /** No agent answers unless named; a channel Admin's or a workspace Admin's change. */
-  mentionedOnly: external_exports.boolean().optional()
+  mentionedOnly: external_exports.boolean().optional(),
+  /** The sender's key: each notice the change posts carries it, as `<key>-name` or `-topic`. */
+  clientKey: external_exports.string().regex(/^[A-Za-z0-9_-]{8,48}$/).optional()
 });
 var updateChannelInputSchema = updateChannelInputSchemaDefinition;
 var logChannelHintSchemaDefinition = external_exports.object({ suggested: external_exports.boolean() });
@@ -58572,7 +58666,9 @@ var newMemberSchemaDefinition = external_exports.object({
 var addMembersInputSchemaDefinition = external_exports.object({
   workspaceId: workspaceIdSchema,
   channelId: idSchema4,
-  members: external_exports.array(newMemberSchemaDefinition).min(1).max(100)
+  members: external_exports.array(newMemberSchemaDefinition).min(1).max(100),
+  /** The sender's key: the notice for `members[i]` carries `<key>-<i>`. */
+  clientKey: external_exports.string().regex(/^[A-Za-z0-9_-]{8,48}$/).optional()
 });
 var addMembersInputSchema = addMembersInputSchemaDefinition;
 var removeMemberInputSchemaDefinition = external_exports.object({
@@ -58738,6 +58834,8 @@ var postMirroredInputSchemaDefinition = external_exports.object({
   keyOwnerUserId: idSchema4,
   origin: messageOriginSchemaDefinition,
   body: external_exports.string().max(MESSAGE_BODY_MAX),
+  /** The source's blocks and attachments, drawn in place of the body; null when it has none. */
+  layout: messageLayoutSchema.nullable().default(null),
   threadRootId: idSchema4.nullable().default(null),
   createdAt: external_exports.iso.datetime().optional(),
   /** A notice is a one-line change at the source, such as a new topic; it mentions no one. */
@@ -58749,6 +58847,8 @@ var updateMirroredInputSchemaDefinition = external_exports.object({
   /** Whose vault holds a key in the new text: the linked author, else whoever mirrored it. */
   keyOwnerUserId: idSchema4,
   body: external_exports.string().max(MESSAGE_BODY_MAX).optional(),
+  /** The source's blocks and attachments now; null drops them; left out keeps them. */
+  layout: messageLayoutSchema.nullable().optional(),
   deleted: external_exports.boolean().default(false),
   /** Laze read the source's message again, which is not an edit: no edited mark. */
   rerendered: external_exports.boolean().default(false)
@@ -59293,6 +59393,11 @@ var readableTextInputSchemaDefinition = external_exports.object({
   workspaceId: workspaceIdSchema,
   bodies: external_exports.array(external_exports.string()).max(HISTORY_PAGE_MAX)
 });
+var joinedChannelSchemaDefinition = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  kind: external_exports.enum(["public", "private"])
+});
 var ChatApi = moduleApi()("chat");
 var chatConversationsTrpc = defineTrpcContract("chat").query("overview").withInput(workspaceInputSchema).withOutput(chatOverviewSchema).query("unreadSummary").withInput(external_exports.object({})).withOutput(external_exports.array(workspaceUnreadSchema)).query("browse").withInput(workspaceInputSchema).withOutput(external_exports.array(browsableChannelSchema)).mutation("createChannel").withInput(createChannelInputSchema).withOutput(conversationSchema).mutation("join").withInput(channelInputSchema).withOutput(conversationSchema).mutation("leave").withInput(channelInputSchema).withOutput(external_exports.object({ left: external_exports.literal(true) })).mutation("updateChannel").withInput(updateChannelInputSchema).withOutput(conversationSchema).mutation("setDefaultAgent").withInput(setDefaultAgentInputSchema).withOutput(conversationSchema).query("logChannelHint").withInput(channelInputSchema).withOutput(logChannelHintSchema).mutation("dismissLogChannelHint").withInput(channelInputSchema).withOutput(external_exports.object({ dismissed: external_exports.literal(true) })).mutation("archiveChannel").withInput(channelInputSchema).withOutput(conversationSchema).mutation("unarchiveChannel").withInput(channelInputSchema).withOutput(conversationSchema).mutation("addMembers").withInput(addMembersInputSchema).withOutput(conversationSchema).mutation("removeMember").withInput(removeMemberInputSchema).withOutput(conversationSchema).mutation("openDirect").withInput(openDirectInputSchema).withOutput(conversationSchema).query("conversation").withInput(channelInputSchema).withOutput(conversationSchema).build();
 var chatChannelRolesTrpc = defineTrpcContract("chat").mutation("setChannelRole").withInput(setChannelRoleInputSchema).withOutput(conversationSchema).mutation("extendChannel").withInput(extendChannelInputSchema).withOutput(conversationSchema).build();
@@ -59348,6 +59453,7 @@ var apnsPayloadSchemaDefinition = external_exports.object({
   aps: external_exports.object({
     alert: external_exports.object({ title: external_exports.string().min(1).max(120), body: external_exports.string().max(400) }).optional(),
     badge: external_exports.number().int().nonnegative().optional(),
+    /** The system's default sound; absent plays nothing. */
     sound: external_exports.literal("default").optional(),
     "thread-id": external_exports.string().min(1).max(200).optional(),
     category: external_exports.literal(APNS_APPROVAL_CATEGORY).optional(),
@@ -59397,7 +59503,9 @@ var webPushPayloadSchemaDefinition = external_exports.object({
   title: external_exports.string().min(1).max(WEB_PUSH_TITLE_MAX),
   body: external_exports.string().max(WEB_PUSH_BODY_MAX),
   url: external_exports.string().min(1).max(2048),
-  tag: external_exports.string().min(1).max(200)
+  tag: external_exports.string().min(1).max(200),
+  /** Shown without the system sound, such as for a message a Slack mirror brought in. */
+  silent: external_exports.boolean().optional()
 }).strict();
 var webPushPayloadSchema = webPushPayloadSchemaDefinition;
 var requestWebPushDeliveryCommandSchemaDefinition = external_exports.object({
@@ -59486,6 +59594,8 @@ var clockSchema = external_exports.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, "
 var channelDefaultSchema = external_exports.enum(["all", "mentions", "nothing"]);
 var FEED_PUSH_KINDS = ["approvals", "urgent", "replies", "wakeups", "groups"];
 var feedPushKindSchema = external_exports.enum(FEED_PUSH_KINDS);
+var PHONE_PUSH_DELAYS = [0, 1, 2, 5, 10, 15, 30];
+var phonePushDelaySchema = external_exports.literal(PHONE_PUSH_DELAYS);
 var notificationSettingsSchemaDefinition = external_exports.object({
   channelDefault: channelDefaultSchema,
   /** Words that notify like a mention, matched whole and case-blind. */
@@ -59511,7 +59621,9 @@ var notificationSettingsSchemaDefinition = external_exports.object({
   /** Weekly sends on Mondays only. */
   digestFrequency: external_exports.enum(["daily", "weekly"]),
   /** Skips Saturday and Sunday. */
-  digestWeekdaysOnly: external_exports.boolean()
+  digestWeekdaysOnly: external_exports.boolean(),
+  /** Minutes without input on the web or the desktop app before notices reach the phone. */
+  phonePushAfterMinutes: phonePushDelaySchema
 });
 var notificationSettingsSchema = notificationSettingsSchemaDefinition;
 var updateSettingsInputSchemaDefinition = external_exports.object({
@@ -59572,7 +59684,9 @@ var messageNoticeSchema = external_exports.object({
   /** Who it comes from, anyone outside Laze included: a burst from one sender is pushed once. */
   from: external_exports.object({ key: external_exports.string().min(1).max(200), name: external_exports.string().max(120) }).optional(),
   /** The sender picked "Notify anyway": it breaks through Do Not Disturb, once. */
-  urgent: external_exports.boolean().optional()
+  urgent: external_exports.boolean().optional(),
+  /** It came in through a mirror such as Slack, whose own app already rings: Laze stays silent. */
+  mirrored: external_exports.boolean().optional()
 });
 var approvalNoticeSchema = external_exports.object({
   workspaceId: workspaceIdSchema2,
@@ -59626,7 +59740,9 @@ var desktopPublicationSchemaDefinition = external_exports.object({
     tag: external_exports.string(),
     sender: noticeSenderSchema.optional(),
     /** The message's place in its conversation, so reading past it closes the notification. */
-    seq: external_exports.number().int().nonnegative().optional()
+    seq: external_exports.number().int().nonnegative().optional(),
+    /** Shown without any sound, such as for a message a Slack mirror brought in. */
+    silent: external_exports.boolean().optional()
   }).nullable(),
   badge: external_exports.number().int().nonnegative(),
   /** The tag of a notification to take back, such as one for a message since deleted. */
@@ -60417,6 +60533,7 @@ var vaultSealedApprovalSchemaDefinition = external_exports.object({
 var vaultSealedApprovalSchema = vaultSealedApprovalSchemaDefinition;
 var vaultUi = uiTokens("vault");
 var VaultSealedApprovalSlot = vaultUi.component("sealedApproval");
+var VaultShareApprovalSlot = vaultUi.component("shareApproval");
 var VaultPasskeyStepSlot = vaultUi.component("passkeyStep");
 var VaultNavSlot = vaultUi.component("nav");
 var answerSealedApprovalInputSchemaDefinition = external_exports.object({
@@ -60789,6 +60906,24 @@ var approveVaultShareInputSchemaDefinition = external_exports.object({
   reauthToken: external_exports.string().min(1)
 });
 var approveVaultShareInputSchema = approveVaultShareInputSchemaDefinition;
+var revokeVaultGrantInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  grantId: external_exports.string().min(1),
+  resolutionNote: external_exports.string().trim().max(500).optional()
+});
+var revokeVaultGrantInputSchema = revokeVaultGrantInputSchemaDefinition;
+var vaultWaitingShareSchemaDefinition = external_exports.object({
+  grantId: external_exports.string().min(1),
+  connectionId: external_exports.string().min(1),
+  /** The key's name as its owner reads it. */
+  keyLabel: external_exports.string(),
+  /** The teammate the share is for. */
+  recipientUserId: external_exports.string().min(1),
+  /** The agent that asked the share; null when it was asked from the CLI. */
+  agentId: external_exports.string().nullable().default(null),
+  expiresAt: external_exports.iso.datetime().nullable(),
+  askedAt: external_exports.iso.datetime()
+});
 var sealVaultConnectionInputSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
   connectionId: external_exports.string().min(1),
@@ -61168,7 +61303,7 @@ var vaultTrpc = defineTrpcContract("vault").mutation("createConnection").withInp
     reason: external_exports.string().trim().min(1).max(200),
     reauthToken: external_exports.string().min(1).max(200).optional()
   })
-).withOutput(external_exports.object({ fields: external_exports.record(external_exports.string(), external_exports.string()) })).mutation("beginReauth").withInput(workspaceInput).withOutput(vaultReauthChallengeSchema).mutation("confirmReauth").withInput(confirmVaultReauthInputSchema).withOutput(vaultReauthProofSchema).mutation("grantConnection").withInput(grantVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("lendToChannel").withInput(lendVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("revokeGrant").withInput(external_exports.object({ workspaceId: external_exports.string().min(1), grantId: external_exports.string().min(1) })).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("listGrants").withInput(connectionInput).withOutput(external_exports.array(vaultGrantSchema)).mutation("shareConnection").withInput(shareVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("approveShare").withInput(approveVaultShareInputSchema).withOutput(vaultGrantSchema).mutation("sealConnection").withInput(sealVaultConnectionInputSchema).withOutput(vaultConnectionSchema).query("listApprovals").withInput(external_exports.object({ ...workspaceInput.shape, state: vaultApprovalStateSchema.optional() })).withOutput(external_exports.array(vaultApprovalRequestSchema)).mutation("answerApproval").withInput(answerVaultApprovalInputSchema).withOutput(vaultApprovalRequestSchema).query("listAudit").withInput(vaultAuditReadInputSchema).withOutput(vaultAuditPageSchema).query("listActivity").withInput(vaultAuditReadInputSchema).withOutput(external_exports.array(vaultAuditEntrySchema)).query("listLeases").withInput(workspaceInput).withOutput(external_exports.array(vaultLeaseSchema)).mutation("endLease").withInput(endVaultLeaseInputSchema).withOutput(external_exports.object({ ended: external_exports.literal(true) })).query("mostAsked").withInput(vaultMostAskedInputSchema).withOutput(vaultMostAskedSchema).query("judgeStatus").withInput(workspaceInput).withOutput(vaultJudgeStatusSchema).query("listLevelLimits").withInput(workspaceInput).withOutput(external_exports.array(vaultLevelLimitSchema)).mutation("setLevelLimit").withInput(setVaultLevelLimitInputSchema).withOutput(external_exports.array(vaultLevelLimitSchema)).query("listDevices").withInput(workspaceInput).withOutput(external_exports.array(vaultDeviceSchema)).mutation("beginDeviceEnrolment").withInput(workspaceInput).withOutput(vaultDeviceEnrolmentSchema).mutation("finishDeviceEnrolment").withInput(finishVaultDeviceEnrolmentInputSchema).withOutput(vaultDeviceSchema).mutation("beginDeviceApproval").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ challenge: external_exports.string(), sealed: external_exports.array(vaultSealedMaterialSchema) })).mutation("approveDevice").withInput(approveVaultDeviceInputSchema).withOutput(vaultDeviceSchema).mutation("removeDevice").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ removed: external_exports.literal(true) })).mutation("createSealedConnection").withInput(createSealedConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("resealConnection").withInput(resealConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("openSealedConnection").withInput(
+).withOutput(external_exports.object({ fields: external_exports.record(external_exports.string(), external_exports.string()) })).mutation("beginReauth").withInput(workspaceInput).withOutput(vaultReauthChallengeSchema).mutation("confirmReauth").withInput(confirmVaultReauthInputSchema).withOutput(vaultReauthProofSchema).mutation("grantConnection").withInput(grantVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("lendToChannel").withInput(lendVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("revokeGrant").withInput(revokeVaultGrantInputSchema).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("listGrants").withInput(connectionInput).withOutput(external_exports.array(vaultGrantSchema)).mutation("shareConnection").withInput(shareVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("approveShare").withInput(approveVaultShareInputSchema).withOutput(vaultGrantSchema).mutation("sealConnection").withInput(sealVaultConnectionInputSchema).withOutput(vaultConnectionSchema).query("listApprovals").withInput(external_exports.object({ ...workspaceInput.shape, state: vaultApprovalStateSchema.optional() })).withOutput(external_exports.array(vaultApprovalRequestSchema)).mutation("answerApproval").withInput(answerVaultApprovalInputSchema).withOutput(vaultApprovalRequestSchema).query("listAudit").withInput(vaultAuditReadInputSchema).withOutput(vaultAuditPageSchema).query("listActivity").withInput(vaultAuditReadInputSchema).withOutput(external_exports.array(vaultAuditEntrySchema)).query("listLeases").withInput(workspaceInput).withOutput(external_exports.array(vaultLeaseSchema)).mutation("endLease").withInput(endVaultLeaseInputSchema).withOutput(external_exports.object({ ended: external_exports.literal(true) })).query("mostAsked").withInput(vaultMostAskedInputSchema).withOutput(vaultMostAskedSchema).query("judgeStatus").withInput(workspaceInput).withOutput(vaultJudgeStatusSchema).query("listLevelLimits").withInput(workspaceInput).withOutput(external_exports.array(vaultLevelLimitSchema)).mutation("setLevelLimit").withInput(setVaultLevelLimitInputSchema).withOutput(external_exports.array(vaultLevelLimitSchema)).query("listDevices").withInput(workspaceInput).withOutput(external_exports.array(vaultDeviceSchema)).mutation("beginDeviceEnrolment").withInput(workspaceInput).withOutput(vaultDeviceEnrolmentSchema).mutation("finishDeviceEnrolment").withInput(finishVaultDeviceEnrolmentInputSchema).withOutput(vaultDeviceSchema).mutation("beginDeviceApproval").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ challenge: external_exports.string(), sealed: external_exports.array(vaultSealedMaterialSchema) })).mutation("approveDevice").withInput(approveVaultDeviceInputSchema).withOutput(vaultDeviceSchema).mutation("removeDevice").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ removed: external_exports.literal(true) })).mutation("createSealedConnection").withInput(createSealedConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("resealConnection").withInput(resealConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("openSealedConnection").withInput(
   external_exports.object({
     ...connectionInput.shape,
     reason: external_exports.string().trim().min(1).max(200),
@@ -61303,6 +61438,18 @@ var vaultApprovalResolvedPayloadSchemaDefinition = external_exports.object({
   /** Who decides the card, so their open approvals lists refresh. */
   approverUserIds: external_exports.array(external_exports.string()).readonly().default([])
 });
+var vaultShareSettledPayloadSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  grantId: external_exports.string().min(1),
+  ownerUserId: external_exports.string().min(1),
+  state: external_exports.enum(["approved", "denied"]),
+  answeredByUserId: external_exports.string().min(1),
+  /** The agent that asked the share; null when it was asked from the CLI. */
+  agentId: external_exports.string().nullable().default(null),
+  /** Why the owner said no, for the agent that asked; empty when nothing. */
+  resolutionNote: external_exports.string().default(""),
+  at: external_exports.iso.datetime()
+});
 
 // ../../modules/vault/contract/src/vault-oauth.ts
 var tokenFieldsSchema = external_exports.object({
@@ -61357,7 +61504,7 @@ async function hkdfKey(input2) {
 }
 async function gcmOpen(input2) {
   try {
-    const plain2 = await subtle().decrypt(
+    const plain3 = await subtle().decrypt(
       {
         name: "AES-GCM",
         iv: input2.sealed.subarray(0, IV_BYTES),
@@ -61366,7 +61513,7 @@ async function gcmOpen(input2) {
       input2.key,
       input2.sealed.subarray(IV_BYTES)
     );
-    return new Uint8Array(plain2);
+    return new Uint8Array(plain3);
   } catch {
     throw new VaultSealMismatchError();
   }
@@ -61402,7 +61549,7 @@ function fieldsOf(value) {
 }
 var releaseLabel = (requestId) => `laze-vault/release/v1/${requestId}`;
 async function openRunRelease(input2) {
-  const plain2 = await decryptFrom({
+  const plain3 = await decryptFrom({
     agree: agreementOf(input2.runPrivateKey),
     publicKey: fromBase64Url(input2.runPublicKey),
     epk: input2.release.epk,
@@ -61410,7 +61557,7 @@ async function openRunRelease(input2) {
     info: releaseLabel(input2.requestId),
     aad: releaseLabel(input2.requestId)
   });
-  return fieldsOf(JSON.parse(new TextDecoder().decode(plain2)).fields);
+  return fieldsOf(JSON.parse(new TextDecoder().decode(plain3)).fields);
 }
 
 // ../../modules/vault/contract/src/vault-scrub.ts
@@ -61558,6 +61705,8 @@ var vaultAlertRaisedPayloadSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
   /** One per alert: `vaultd:<seq>:<at>` from vaultd, `audit:<workspace>:<seq>` from the chain. */
   alertId: external_exports.string().min(1),
+  /** The card it lands on: repeats of one incident share it. Absent, the alert has its own. */
+  incidentId: external_exports.string().min(1).optional(),
   /** vaultd's sequence number, the worker's cursor; null for an alert the vault raised itself. */
   seq: external_exports.number().int().nonnegative().nullable(),
   /** `unexpected_caller`, `decrypt_burst`, `audit_chain_broken`, `test`, or a newer kind. */
@@ -61743,7 +61892,9 @@ var vaultWatchReportSchemaDefinition = external_exports.object({
 });
 var vaultWatchReportReceiptSchemaDefinition = external_exports.object({
   stored: external_exports.boolean(),
-  alerted: external_exports.boolean()
+  alerted: external_exports.boolean(),
+  /** This report made VAULT_WATCH_FAILED_CHECKS failed checks in a row, or ended such a run. */
+  checkFailing: external_exports.enum(["started", "ended"]).nullable()
 });
 var b64url = external_exports.string().min(1).max(8192).regex(/^[A-Za-z0-9_-]+$/, "base64url without padding");
 var vaultPasskeyAssertionSchemaDefinition = external_exports.object({
@@ -61773,7 +61924,9 @@ var vaultdStateSchemaDefinition = external_exports.union([
     currentKeyId: external_exports.string(),
     readableKeyIds: external_exports.array(external_exports.string()),
     breaker: external_exports.enum(["closed", "open"]),
-    dryRun: external_exports.boolean()
+    dryRun: external_exports.boolean(),
+    /** The pinned operator passkey's credential id; empty when none is pinned. */
+    operatorCredentialId: external_exports.string()
   }),
   external_exports.object({ holder: external_exports.literal("vaultd"), reachable: external_exports.literal(false), problem: external_exports.string() }),
   /** Development and tests: the key lives in this process, which has no breaker. */
@@ -61802,12 +61955,16 @@ var vaultWatchReportReceivedPayloadSchemaDefinition = external_exports.object({
   /** The alert workspace (VAULT_ALERT_WORKSPACE_ID), where a stopped watchdog's card lands. */
   workspaceId: external_exports.string().min(1),
   reportAt: external_exports.iso.datetime({ offset: true }),
-  at: external_exports.iso.datetime()
+  at: external_exports.iso.datetime(),
+  /** False when the run could not count unwraps: it does not hold the stopped card back. */
+  checked: external_exports.boolean().default(true)
 });
 var vaultAlertClearedPayloadSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
   /** The `alertId` of the vault_alert_raised it clears. */
   alertId: external_exports.string().min(1),
+  /** The incident it clears, when the alert named one: its card goes to Handled. */
+  incidentId: external_exports.string().min(1).optional(),
   label: external_exports.string().min(1).max(80),
   at: external_exports.iso.datetime()
 });
@@ -62064,6 +62221,14 @@ var lazeAgentEventSchemaDefinition = external_exports.discriminatedUnion("type",
   external_exports.object({ type: external_exports.literal("stalled"), silentMs: external_exports.number().int().nonnegative() }),
   /** A supervisor process came up with empty queues: Laze sends it what is still unanswered. */
   external_exports.object({ type: external_exports.literal("supervisor_started"), bootId: external_exports.string().min(1) }),
+  /** A message the computer took no turn for: the laze CLI the agent answers with is gone. */
+  external_exports.object({
+    type: external_exports.literal("computer_trouble"),
+    reason: external_exports.literal("cli_missing"),
+    detail: external_exports.string().max(1e3),
+    channelId: external_exports.string().min(1),
+    threadRootId: external_exports.string().min(1).optional()
+  }),
   /** The harness stopped to ask a person questions; it waits for an `attention_answer` frame. */
   external_exports.object({
     type: external_exports.literal("attention_opened"),
@@ -63931,8 +64096,10 @@ var liveStepsSchemaDefinition = external_exports.object({
   turn: liveTurnSchemaDefinition.nullable(),
   steps: external_exports.array(sequencedStepSchemaDefinition),
   lastSeq: external_exports.number().int().nonnegative(),
-  /** Null where the realtime edge is not configured: the panel says live steps are unavailable. */
-  stream: realtimeTokenSchema.nullable()
+  /** Null where the realtime edge is not configured: the panel shows what it read. */
+  stream: realtimeTokenSchema.nullable(),
+  /** False for a person who may not talk to the agent: they see none of its steps. */
+  visible: external_exports.boolean()
 });
 var liveStepsSchema = liveStepsSchemaDefinition;
 var replyStepsInputSchemaDefinition = external_exports.object({
@@ -64546,6 +64713,15 @@ var agentHarnessSchema = external_exports.enum([
   "mcp",
   "other"
 ]);
+var AGENT_HARNESS_NAMES = {
+  "claude-code": "Claude Code",
+  codex: "Codex",
+  chatgpt: "ChatGPT",
+  claude: "Claude",
+  cowork: "Cowork",
+  cursor: "Cursor",
+  openclaw: "OpenClaw"
+};
 var agentSessionSchemaDefinition = external_exports.object({
   harness: agentHarnessSchema,
   sessionId: external_exports.string().min(1).max(200),
@@ -64818,6 +64994,12 @@ var receiveInboxInputSchemaDefinition = external_exports.object({
   waitSeconds: external_exports.coerce.number().int().min(0).max(INBOX_WAIT_MAX_SECONDS).default(0),
   limit: external_exports.coerce.number().int().min(1).max(50).default(20)
 });
+var inboxWaitingSchemaDefinition = external_exports.object({
+  count: external_exports.number().int().min(0),
+  /** When the oldest waiting message was posted; null when nothing waits. */
+  oldestPostedAt: external_exports.iso.datetime().nullable(),
+  session: agentSessionSchemaDefinition.nullable()
+});
 var callerSchemaDefinition = external_exports.object({
   kind: external_exports.enum(["person", "agent"]),
   id: idSchema14,
@@ -65032,7 +65214,6 @@ var AgentLoginCardSlot = agentUi.component("loginCard");
 var AgentBudgetCardSlot = agentUi.component("budgetCard");
 var AgentStopTurnSlot = agentUi.component("stopTurn");
 var AgentLiveStepsSlot = agentUi.component("liveSteps");
-var AgentReplyStepsSlot = agentUi.component("replySteps");
 var AgentSessionHooksToken = agentUi.hooks("session");
 var AgentCreateDialogSlot = agentUi.component("createDialog");
 var AgentEditDialogSlot = agentUi.component("editDialog");
@@ -65699,6 +65880,14 @@ var sessionClaimSchemaDefinition = external_exports.object({
   folder: external_exports.string().max(500),
   host: external_exports.string().max(200)
 });
+function sessionLabelOf({
+  harness,
+  folder,
+  host: host2
+}) {
+  const name3 = AGENT_HARNESS_NAMES[harness] ?? "A session";
+  return [name3, folder ? `in ${folder}` : "", host2 ? `on ${host2}` : ""].filter(Boolean).join(" ");
+}
 var boundSessionSchemaDefinition = external_exports.object({ bound: external_exports.literal(true) });
 var requestConnectionInputSchemaDefinition = external_exports.object({
   harness: agentHarnessSchema.default("other"),
@@ -66028,8 +66217,8 @@ async function copyAgent({
 }
 
 // src/services/agent-commands.service.ts
-import { mkdir as mkdir14, readFile as readFile14, writeFile as writeFile14 } from "node:fs/promises";
-import { join as join15, resolve as resolve4 } from "node:path";
+import { mkdir as mkdir15, readFile as readFile14, writeFile as writeFile14 } from "node:fs/promises";
+import { join as join16, resolve as resolve4 } from "node:path";
 
 // src/rules/agent-profile.rules.ts
 var LEVELS = { fast: "Laze Fast", frontier: "Laze Frontier" };
@@ -66647,6 +66836,11 @@ var slackMessageEventSchemaDefinition = external_exports.object({
   latestReply: external_exports.string().nullable().default(null),
   /** When the message was last edited, Slack's `edited.ts`; null when it never was. */
   editedTs: external_exports.string().nullable().default(null),
+  /** The message's Block Kit blocks and legacy attachments as Slack sent them, until handled. */
+  blocks: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).optional(),
+  /** The message's own `text` beside its blocks; `text` above is what Slack shows, flattened. */
+  sourceText: external_exports.string().optional(),
+  attachments: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).optional(),
   /** For `tokens_revoked`: the Slack users whose tokens were revoked, and whether the bot's was. */
   revoked: external_exports.object({ userIds: external_exports.array(external_exports.string()), bot: external_exports.boolean() }).optional()
 });
@@ -67050,7 +67244,7 @@ var TOKEN = /<@(person|agent):([A-Za-z0-9_-]+)>|<!(channel|here)>|<#([A-Za-z0-9_
 var LINK = /!?\[([^\]]*)\]\([^)\s]*(?:\s+"[^"]*")?\)/g;
 var AUTOLINK = /<((?:https?|mailto):[^>\s]+)>/g;
 var FILE_MARKER = /<file:[A-Za-z0-9_-]+>/g;
-function plain(text2) {
+function plain2(text2) {
   return withoutMarkdownMarks(
     text2.replace(/```[\w+-]*/g, " ").replace(LINK, "$1").replace(AUTOLINK, "$1").replace(FILE_MARKER, " ")
   );
@@ -67065,14 +67259,14 @@ function bodyAsText({
   let from = 0;
   for (const token2 of written.matchAll(TOKEN)) {
     const [whole, kind2, id2, broadcast, channelId] = token2;
-    text2 += plain(written.slice(from, token2.index));
+    text2 += plain2(written.slice(from, token2.index));
     from = token2.index + whole.length;
     if (channelId) {
       text2 += `#${mentions.channels.find((channel) => channel.id === channelId)?.name ?? "channel"}`;
     } else if (kind2 && id2) text2 += `@${actorName(kind2, id2)}`;
     else text2 += `@${broadcast ?? "channel"}`;
   }
-  text2 += plain(written.slice(from));
+  text2 += plain2(written.slice(from));
   return text2.replace(/\s+/g, " ").trim();
 }
 function escaped(term) {
@@ -67501,6 +67695,27 @@ function notBoundText({
   const who = `${agent2 ? `"${agent2}"` : "this agent"} (config ${configPath})`;
   return `Laze: ${who} listens in another session${meta3.bound ? `: ${meta3.bound}` : ""}. Create a new Laze agent with this session: laze agent request. Or move this agent here: laze agent bind.`;
 }
+function boundMetaOf({ error: error62 }) {
+  if (!(error62 instanceof LazeApiError) || error62.code !== "session_not_bound") return void 0;
+  return error62.meta ?? {};
+}
+async function takeOverHere({
+  context,
+  client,
+  session,
+  meta: meta3,
+  profile
+}) {
+  if (!session || !meta3.session || meta3.host !== session.host) return false;
+  const sessions = (await context.store.read()).sessions ?? {};
+  const theirs = sessions[meta3.session];
+  const mine4 = sessions[sessionKeyOf({ session })] === profile;
+  const stale = mine4 && theirs !== void 0 && theirs !== profile;
+  const claudePid = (await nearestHarnessOf({ context }))?.pid;
+  if (!stale && await liveElsewhere({ context, key: meta3.session, claudePid })) return false;
+  await forSession({ client, session }).post("/api/agents/me/bind", {});
+  return true;
+}
 async function notBoundNotice({
   context,
   client,
@@ -67510,12 +67725,8 @@ async function notBoundNotice({
 }) {
   if (!(error62 instanceof LazeApiError) || error62.code !== "session_not_bound") return void 0;
   const meta3 = error62.meta ?? {};
-  if (client && session && meta3.session && meta3.host === session.host) {
-    const claudePid = (await nearestHarnessOf({ context }))?.pid;
-    if (!await liveElsewhere({ context, key: meta3.session, claudePid })) {
-      await client.post("/api/agents/me/bind", {});
-      return { notice: void 0, rebound: true };
-    }
+  if (client && await takeOverHere({ context, client, session, meta: meta3, profile })) {
+    return { notice: void 0, rebound: true };
   }
   const key = session ? sessionKeyOf({ session }) : "unknown";
   const path = statePathOf({ context, kind: "told", profile: key });
@@ -68220,13 +68431,13 @@ function channelLabelIn(channel) {
 }
 
 // src/services/claude-wait.service.ts
-import { readFile as readFile10, rm as rm4, writeFile as writeFile9, mkdir as mkdir9 } from "node:fs/promises";
-import { dirname as dirname10 } from "node:path";
+import { readFile as readFile10, rm as rm4, writeFile as writeFile9, mkdir as mkdir10 } from "node:fs/promises";
+import { dirname as dirname11 } from "node:path";
 
 // src/services/connect-service.service.ts
 import { createHash } from "node:crypto";
-import { mkdir as mkdir8, rm as rm3, writeFile as writeFile8 } from "node:fs/promises";
-import { dirname as dirname9, join as join11 } from "node:path";
+import { mkdir as mkdir9, rm as rm3, writeFile as writeFile8 } from "node:fs/promises";
+import { dirname as dirname10, join as join12 } from "node:path";
 
 // src/rules/connect-service.rules.ts
 function systemdWordOf(word3) {
@@ -68348,9 +68559,9 @@ function rolloutEventOf({
 }
 
 // src/services/connect-delivery.service.ts
-import { mkdir as mkdir7, readFile as readFile9, rename as rename3, rm as rm2, stat as stat2, writeFile as writeFile7 } from "node:fs/promises";
+import { mkdir as mkdir8, readFile as readFile9, rename as rename3, rm as rm2, stat as stat2, writeFile as writeFile7 } from "node:fs/promises";
 import { homedir as homedir2, hostname as hostname4 } from "node:os";
-import { dirname as dirname8, join as join10 } from "node:path";
+import { dirname as dirname9, join as join11 } from "node:path";
 
 // src/services/codex-turn-watch.service.ts
 import { open as open2, readdir as readdir2 } from "node:fs/promises";
@@ -68943,12 +69154,14 @@ async function notesOf({ context }) {
   const notes = await Promise.all(
     files2.map(async (file3) => {
       const pid = Number(file3.replace(/\.json$/, ""));
-      const session = await jsonOf(join9(folder, file3));
+      const note = await jsonOf(join9(folder, file3));
       const at = await stat(join9(folder, file3)).then(
         (info) => info.mtimeMs,
         () => 0
       );
-      return pid && session ? [{ pid, key: sessionKeyOf({ session }), at }] : [];
+      if (!pid || !note) return [];
+      const { launch = {}, ...session } = note;
+      return [{ pid, key: sessionKeyOf({ session }), at, session, launch }];
     })
   );
   return notes.flat().toSorted((a, b) => b.at - a.at);
@@ -68968,15 +69181,21 @@ async function rushListenersOf({
   for (const [key, profile] of bound) {
     const one = sessions.find((each) => `claude-code:${each.sessionId}` === key);
     if (!one?.id) continue;
-    const pids = notes.filter((note) => note.key === key).map((note) => note.pid);
+    const own2 = notes.filter((note) => note.key === key);
+    const pids = own2.map((note) => note.pid);
     const listenerPid = await listenerOf({ context, key, profile, pids });
+    const waiterPid = await waiterOf({ context, key, profile });
     const lastClaudePid = pids.find((pid) => !context.processes.alive(pid));
+    const newest = own2[0];
     rows.push({
       profile,
       rushId: one.id,
+      key,
       standing: rushStandingOf({ one }),
       ...listenerPid ? { listenerPid } : {},
-      ...lastClaudePid ? { lastClaudePid } : {}
+      ...waiterPid ? { waiterPid } : {},
+      ...lastClaudePid ? { lastClaudePid } : {},
+      ...newest ? { noted: { session: newest.session, launch: newest.launch } } : {}
     });
   }
   return rows;
@@ -68991,6 +69210,13 @@ async function listenerOf({
     const guard = await jsonOf(guardPathOf({ context, claudePid }));
     if (guard && context.processes.alive(guard.pid)) return guard.pid;
   }
+  return waiterOf({ context, key, profile });
+}
+async function waiterOf({
+  context,
+  key,
+  profile
+}) {
   const lock = statePathOf({ context, kind: "waiters", profile });
   const waiter = await jsonOf(lock);
   const mine4 = waiter?.sessionId === key.slice(key.indexOf(":") + 1);
@@ -69007,12 +69233,122 @@ async function rearmRushGuards({ context }) {
   return started;
 }
 
+// src/services/rush-watchdog.service.ts
+import { appendFile, mkdir as mkdir7 } from "node:fs/promises";
+import { dirname as dirname8, join as join10 } from "node:path";
+var UNDELIVERED_AFTER_MS = 6e4;
+var CHECK_TIMEOUT_MS = 5e3;
+function clientOf({ context, profile }) {
+  return context.store.read().then((config2) => {
+    const entry = config2.profiles[profile];
+    if (!entry) return void 0;
+    return LazeClient.create({
+      baseUrl: entry.url,
+      token: entry.token,
+      fetcher: (input2, init) => context.fetcher(input2, { ...init, signal: AbortSignal.timeout(CHECK_TIMEOUT_MS) })
+    });
+  });
+}
+async function waitingOf({ context, profile }) {
+  const client = await clientOf({ context, profile });
+  return client?.get("/api/agents/me/inbox/waiting").catch(() => void 0);
+}
+function waitedMsOf({ waiting, nowMs }) {
+  if (waiting.count === 0 || !waiting.oldestPostedAt) return 0;
+  return Math.max(0, nowMs - Temporal3.Instant.from(waiting.oldestPostedAt).epochMilliseconds);
+}
+function boundAwayOf({ waiting, key }) {
+  const bound = waiting.session;
+  if (!bound || `${bound.harness}:${bound.sessionId}` === key) return void 0;
+  return `${sessionLabelOf(bound)} (${bound.harness}:${bound.sessionId})`;
+}
+async function logDelivery({ context, line }) {
+  const folder = join10(dirname8(context.environment.configPath), "connect");
+  const at = Temporal3.Instant.fromEpochMilliseconds(context.nowMs());
+  const stamped = `${at.toString({ smallestUnit: "second" })} ${line}
+`;
+  context.out(stamped);
+  await mkdir7(folder, { recursive: true, mode: 448 });
+  await appendFile(join10(folder, "delivery.log"), stamped, { mode: 384 });
+}
+async function claimFor({
+  context,
+  client,
+  row
+}) {
+  const session = row.noted.session;
+  const claim3 = () => forSession({ client, session }).post("/api/agents/me/inbox", {
+    waitSeconds: 0
+  });
+  try {
+    return await claim3();
+  } catch (error62) {
+    const meta3 = boundMetaOf({ error: error62 });
+    if (!meta3) throw error62;
+    const profile = row.profile;
+    if (!await takeOverHere({ context, client, session, meta: meta3, profile })) {
+      return `Laze binds it to ${meta3.bound ?? meta3.session ?? "another session"}, which this machine still runs; \`laze agent bind\` in rush ${row.rushId} moves it here`;
+    }
+    await logDelivery({
+      context,
+      line: `${profile}: moved the agent from ${meta3.session} to ${row.key}, which this machine binds it to`
+    });
+    return claim3();
+  }
+}
+async function checkSession({ context, row }) {
+  if (row.standing === "stopped" || !row.noted) return void 0;
+  const client = await clientOf({ context, profile: row.profile });
+  if (!client) return void 0;
+  const waiting = await client.get("/api/agents/me/inbox/waiting");
+  const waited = waitedMsOf({ waiting, nowMs: context.nowMs() });
+  if (waited <= UNDELIVERED_AFTER_MS) return void 0;
+  const taken = await claimFor({ context, client, row: { ...row, noted: row.noted } });
+  if (typeof taken === "string") return `${row.profile}: ${waiting.count} undelivered; ${taken}`;
+  if (taken.length === 0) return void 0;
+  await keepTaken({ context, profile: row.profile, messages: taken });
+  const self2 = await currentNameOf({ context, client, profile: row.profile });
+  const env = { ...row.noted.launch, LAZE_WAKE_TEXT: hookContextOf({ messages: taken, self: self2 }) };
+  const command = rushSendCommand({ id: row.rushId, program: "rush" });
+  const ids = taken.map((message2) => message2.messageId);
+  if (await context.runCommand({ command, env }) !== 0) {
+    return `${row.profile}: rush session send ${row.rushId} failed; ${ids.join(", ")} stay for its next hook`;
+  }
+  await turnStarted({ context, client, agent: row.profile, messages: taken }).catch(
+    () => void 0
+  );
+  await dropFromSpool({ context, profile: row.profile, messageIds: ids });
+  const seconds = Math.round(waited / 1e3);
+  await logDelivery({
+    context,
+    line: `${row.profile}: its hooks left ${ids.join(", ")} waiting ${seconds}s; handed over through rush ${row.rushId} (${row.standing})`
+  });
+  return void 0;
+}
+async function watchRushDelivery({
+  context,
+  said
+}) {
+  for (const row of await rushListenersOf({ context })) {
+    const problem = await checkSession({ context, row }).catch(
+      (error62) => `${row.profile}: the delivery check failed: ${String(error62)}`
+    );
+    if (!problem) {
+      said.delete(row.profile);
+      continue;
+    }
+    if (said.get(row.profile) === problem) continue;
+    said.set(row.profile, problem);
+    await logDelivery({ context, line: problem });
+  }
+}
+
 // src/services/connect-delivery.service.ts
 function connectFolderOf({ context }) {
-  return join10(dirname8(context.environment.configPath), "connect");
+  return join11(dirname9(context.environment.configPath), "connect");
 }
 function runStatePathOf({ context }) {
-  return join10(connectFolderOf({ context }), "run.json");
+  return join11(connectFolderOf({ context }), "run.json");
 }
 async function readJson({ path }) {
   try {
@@ -69176,7 +69512,7 @@ async function serveRounds({
 }
 var saves = 0;
 async function save(run4) {
-  await mkdir7(dirname8(run4.path), { recursive: true, mode: 448 });
+  await mkdir8(dirname9(run4.path), { recursive: true, mode: 448 });
   const temporary = `${run4.path}.${run4.self}.${saves += 1}.tmp`;
   await writeFile7(temporary, JSON.stringify(run4.state));
   await rename3(temporary, run4.path);
@@ -69234,6 +69570,7 @@ async function runConnectLoop({ context }) {
   context.out(`laze connect run: pid ${self2}
 `);
   const startedFrom = await cliStampOf({ context });
+  const said = /* @__PURE__ */ new Map();
   const relays = RelayLoops.create({
     context,
     report: async (connectionId, relay2) => {
@@ -69248,6 +69585,10 @@ async function runConnectLoop({ context }) {
       await relays.sync();
       await rearmRushGuards({ context }).catch((error62) => {
         context.err(`laze connect: no rush guard check this round: ${String(error62)}
+`);
+      });
+      await watchRushDelivery({ context, said }).catch((error62) => {
+        context.err(`laze connect: no rush delivery check this round: ${String(error62)}
 `);
       });
       await save(run4);
@@ -69279,17 +69620,17 @@ var CONNECT_SERVICE_USAGE = `laze connect install|status|stop|uninstall|run: the
 \`laze openclaw connect --local\`, whose OpenClaw relay it also runs.
 `;
 function installedPathOf({ context }) {
-  return join11(connectFolderOf({ context }), "service.json");
+  return join12(connectFolderOf({ context }), "service.json");
 }
 function logPathOf({ context }) {
-  return join11(connectFolderOf({ context }), "connect.log");
+  return join12(connectFolderOf({ context }), "connect.log");
 }
 function homeOf({ context }) {
-  return context.environment.inherited.HOME ?? dirname9(dirname9(context.environment.configPath));
+  return context.environment.inherited.HOME ?? dirname10(dirname10(context.environment.configPath));
 }
 function serviceNameOf({ context }) {
   const { configPath } = context.environment;
-  if (configPath === join11(homeOf({ context }), ".laze", "config.json")) return "laze-connect";
+  if (configPath === join12(homeOf({ context }), ".laze", "config.json")) return "laze-connect";
   return `laze-connect-${createHash("sha256").update(configPath).digest("hex").slice(0, 8)}`;
 }
 function serviceEnvOf({ context }) {
@@ -69312,9 +69653,9 @@ async function run({ context, command }) {
 async function installSystemd({ context }) {
   const name3 = serviceNameOf({ context });
   const env = context.environment.inherited;
-  const base = env.XDG_CONFIG_HOME || join11(homeOf({ context }), ".config");
-  const file3 = join11(base, "systemd", "user", `${name3}.service`);
-  await mkdir8(dirname9(file3), { recursive: true });
+  const base = env.XDG_CONFIG_HOME || join12(homeOf({ context }), ".config");
+  const file3 = join12(base, "systemd", "user", `${name3}.service`);
+  await mkdir9(dirname10(file3), { recursive: true });
   await writeFile8(
     file3,
     systemdUnitOf({ argv: runArgvOf({ context }), env: serviceEnvOf({ context }) })
@@ -69328,9 +69669,9 @@ async function installSystemd({ context }) {
 async function installLaunchd({ context }) {
   const name3 = serviceNameOf({ context });
   const label3 = `ai.laze.${name3}`;
-  const file3 = join11(homeOf({ context }), "Library", "LaunchAgents", `${label3}.plist`);
+  const file3 = join12(homeOf({ context }), "Library", "LaunchAgents", `${label3}.plist`);
   const log = logPathOf({ context });
-  await mkdir8(dirname9(file3), { recursive: true });
+  await mkdir9(dirname10(file3), { recursive: true });
   await writeFile8(
     file3,
     launchAgentOf({
@@ -69383,7 +69724,7 @@ async function installConnectService({ context }) {
   const manager = await managerOf({ context });
   const install = { systemd: installSystemd, launchd: installLaunchd, detached: installDetached };
   const installed = await install[manager]({ context });
-  await mkdir8(dirname9(path), { recursive: true, mode: 448 });
+  await mkdir9(dirname10(path), { recursive: true, mode: 448 });
   await writeFile8(path, JSON.stringify(installed));
   return describeInstalled({ installed });
 }
@@ -69420,8 +69761,11 @@ async function status2({ context }) {
 `
     );
   }
-  for (const row of await rushListenersOf({ context })) context.out(`${rushLineOf({ row })}
+  for (const row of await rushListenersOf({ context })) {
+    const waiting = await waitingOf({ context, profile: row.profile });
+    context.out(`${rushLineOf({ row })}${inLazeOf({ row, waiting, nowMs: context.nowMs() })}
 `);
+  }
   const config2 = await context.store.read();
   const linked = Object.entries(config2.profiles).filter(([, profile]) => profile.delivery);
   if (linked.length === 0) {
@@ -69436,11 +69780,31 @@ async function status2({ context }) {
 }
 function rushLineOf({ row }) {
   const head = `${row.profile}	Claude Code in rush ${row.rushId}	${row.standing}`;
-  if (row.standing === "awake") return `${head}, its Claude Code delivers`;
+  if (row.standing === "awake" && row.waiterPid) {
+    return `${head}, its Claude Code delivers (waiter pid ${row.waiterPid})`;
+  }
+  if (row.standing === "awake") {
+    return `${head}, no hook waiter right now: the connect service hands over what waits over ${UNDELIVERED_AFTER_MS / 1e3}s`;
+  }
   if (row.standing === "stopped") return `${head}, gets messages when rush starts it again`;
   if (row.listenerPid) return `${head}, guard pid ${row.listenerPid}`;
   return `${head}, NO LISTENER: messages wait in Laze; \`laze connect install\` brings a guard back`;
 }
+function inLazeOf({
+  row,
+  waiting,
+  nowMs
+}) {
+  if (!waiting) return "; Laze could not say what waits";
+  const away = boundAwayOf({ waiting, key: row.key });
+  const bound = away ? `; Laze binds the agent to ${away}, not this session` : "";
+  const waited = waitedMsOf({ waiting, nowMs });
+  if (waiting.count === 0) return bound;
+  const age = `the oldest for ${Math.round(waited / 1e3)}s`;
+  if (waited > UNDELIVERED_AFTER_MS)
+    return `${bound}; UNDELIVERED: ${waiting.count} waiting, ${age}`;
+  return `${bound}; ${waiting.count} waiting, ${age}`;
+}
 async function stop({ context }) {
   const installed = await readJson({ path: installedPathOf({ context }) });
   if (!installed) {
@@ -69523,7 +69887,7 @@ async function takeLock({
     if (served && context.processes.alive(served) && !mine4) return false;
     context.processes.stop(holder.pid);
   }
-  await mkdir9(dirname10(path), { recursive: true, mode: 448 });
+  await mkdir10(dirname11(path), { recursive: true, mode: 448 });
   await writeFile9(
     path,
     JSON.stringify({
@@ -69681,13 +70045,13 @@ async function monitorServes({
 // src/services/codex-link.service.ts
 import { createReadStream } from "node:fs";
 import { readdir as readdir5, rm as rm6, stat as stat4 } from "node:fs/promises";
-import { join as join13, resolve as resolve3 } from "node:path";
+import { join as join14, resolve as resolve3 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 
 // src/services/codex-adopt.service.ts
 import { spawn as spawn2 } from "node:child_process";
-import { mkdir as mkdir10, readdir as readdir4, readFile as readFile11, rm as rm5, stat as stat3, writeFile as writeFile10 } from "node:fs/promises";
-import { dirname as dirname11, join as join12 } from "node:path";
+import { mkdir as mkdir11, readdir as readdir4, readFile as readFile11, rm as rm5, stat as stat3, writeFile as writeFile10 } from "node:fs/promises";
+import { dirname as dirname12, join as join13 } from "node:path";
 import { createInterface } from "node:readline";
 
 // src/rules/codex-requests.rules.ts
@@ -69807,11 +70171,11 @@ var CodexAppServer = class _CodexAppServer {
   }
 };
 async function newestThreadId({ codexHome }) {
-  const root = join12(codexHome, "sessions");
+  const root = join13(codexHome, "sessions");
   const files2 = await readdir4(root, { recursive: true }).catch(() => []);
   const rollouts = files2.filter((file3) => /rollout-.*\.jsonl$/.test(file3));
   const dated = await Promise.all(
-    rollouts.map(async (file3) => ({ file: file3, at: (await stat3(join12(root, file3))).mtimeMs }))
+    rollouts.map(async (file3) => ({ file: file3, at: (await stat3(join13(root, file3))).mtimeMs }))
   );
   const newest = dated.toSorted((a, b) => b.at - a.at)[0]?.file ?? "";
   const id2 = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/.exec(newest);
@@ -69908,7 +70272,7 @@ async function startAdoptInBackground({
   const adopt = ["adopt", "codex", "--profile", profile, ...threadFlag({ thread: thread2 })];
   const argv = [...context.program, ...adopt, "--supervise"];
   const pid = context.processes.spawnDetached({ argv, logPath: log });
-  await mkdir10(dirname11(path), { recursive: true, mode: 448 });
+  await mkdir11(dirname12(path), { recursive: true, mode: 448 });
   await writeFile10(path, JSON.stringify({ pid, thread: thread2, log, startedAt: context.nowMs() }));
   return [
     `Started \`${laze} adopt codex\` in the background (pid ${pid}). It answers each Laze message`,
@@ -70004,7 +70368,7 @@ async function adoptedThreadOf({
   }
   const forked = record3((await codex.call("thread/fork", { threadId })).thread).id;
   if (typeof forked !== "string") throw new Error("thread/fork answered no thread id");
-  await mkdir10(dirname11(path), { recursive: true, mode: 448 });
+  await mkdir11(dirname12(path), { recursive: true, mode: 448 });
   await writeFile10(path, JSON.stringify({ ...forks, [threadId]: forked }));
   context.out(
     `Codex holds thread ${threadId} open elsewhere; answering in its new fork ${forked}.
@@ -70076,13 +70440,13 @@ async function newestThreadIn({
   codexHome,
   directory
 }) {
-  const root = join13(codexHome, "sessions");
+  const root = join14(codexHome, "sessions");
   const files2 = await readdir5(root, { recursive: true }).catch(() => []);
   const rollouts = files2.filter((file3) => /rollout-.*\.jsonl$/.test(file3));
   const dated = await Promise.all(
     rollouts.map(async (file3) => ({
-      path: join13(root, file3),
-      at: await stat4(join13(root, file3)).then(
+      path: join14(root, file3),
+      at: await stat4(join14(root, file3)).then(
         (info) => info.mtimeMs,
         () => 0
       )
@@ -70152,9 +70516,9 @@ async function linkCodexSession({
 }
 
 // src/services/laze-plugin.service.ts
-import { mkdir as mkdir11, readFile as readFile12, writeFile as writeFile11 } from "node:fs/promises";
+import { mkdir as mkdir12, readFile as readFile12, writeFile as writeFile11 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname12, join as join14 } from "node:path";
+import { dirname as dirname13, join as join15 } from "node:path";
 
 // src/rules/laze-plugin.rules.ts
 var LAZE_PLUGIN = "laze";
@@ -70273,10 +70637,10 @@ function lazePluginFiles({
 var REGISTER_LIMIT_MS = 6e4;
 var quote2 = (value) => `'${value.replaceAll("'", "'\\''")}'`;
 function pluginFolderOf({ context }) {
-  return join14(dirname12(context.environment.configPath), "plugins");
+  return join15(dirname13(context.environment.configPath), "plugins");
 }
 async function pluginIsCurrent({ context }) {
-  const manifest = join14(pluginFolderOf({ context }), LAZE_PLUGIN, ".claude-plugin", "plugin.json");
+  const manifest = join15(pluginFolderOf({ context }), LAZE_PLUGIN, ".claude-plugin", "plugin.json");
   const written = await readFile12(manifest, "utf8").then(
     (text2) => JSON.parse(text2).version,
     () => void 0
@@ -70291,8 +70655,8 @@ async function writeLazePlugin({ context }) {
     configPath: context.environment.configPath
   });
   for (const [path, text2] of Object.entries(files2)) {
-    const target = join14(folder, path);
-    await mkdir11(dirname12(target), { recursive: true });
+    const target = join15(folder, path);
+    await mkdir12(dirname13(target), { recursive: true });
     await writeFile11(target, text2);
   }
   return folder;
@@ -70323,8 +70687,8 @@ var RUN_FILES = ["hooks/hooks.json", "monitors/monitors.json"];
 async function cachedPluginOf({ context }) {
   const inherited = context.environment.inherited;
   const home = inherited.HOME || homedir3();
-  const claude = inherited.CLAUDE_CONFIG_DIR || join14(home, ".claude");
-  const listed = await readFile12(join14(claude, "plugins", "installed_plugins.json"), "utf8").then(
+  const claude = inherited.CLAUDE_CONFIG_DIR || join15(home, ".claude");
+  const listed = await readFile12(join15(claude, "plugins", "installed_plugins.json"), "utf8").then(
     (text2) => JSON.parse(text2),
     () => void 0
   );
@@ -70335,8 +70699,8 @@ async function refreshStaleCache({ context, folder }) {
   if (!cached2) return true;
   const read3 = (path) => readFile12(path, "utf8").catch(() => "");
   for (const file3 of RUN_FILES) {
-    const ours = await read3(join14(folder, LAZE_PLUGIN, file3));
-    if (ours === await read3(join14(cached2, file3))) continue;
+    const ours = await read3(join15(folder, LAZE_PLUGIN, file3));
+    if (ours === await read3(join15(cached2, file3))) continue;
     const plugin2 = `${LAZE_PLUGIN}@${LAZE_PLUGIN}`;
     const script = [
       `claude plugin uninstall ${plugin2} --scope user ${QUIET}`,
@@ -70347,7 +70711,7 @@ async function refreshStaleCache({ context, folder }) {
   return true;
 }
 function registeredMarkOf({ context }) {
-  return join14(pluginFolderOf({ context }), "registered");
+  return join15(pluginFolderOf({ context }), "registered");
 }
 async function pluginRegistered({ context }) {
   return readFile12(registeredMarkOf({ context }), "utf8").then(
@@ -70364,7 +70728,7 @@ async function installLazePlugin({ context }) {
 async function plugin({ context, args }) {
   const action = args.words[1] ?? "install";
   if (action === "path") {
-    context.out(`${join14(pluginFolderOf({ context }), LAZE_PLUGIN)}
+    context.out(`${join15(pluginFolderOf({ context }), LAZE_PLUGIN)}
 `);
     return 0;
   }
@@ -70382,8 +70746,8 @@ async function plugin({ context, args }) {
 }
 
 // src/services/mcp-channel.service.ts
-import { mkdir as mkdir12, rm as rm7, writeFile as writeFile12 } from "node:fs/promises";
-import { dirname as dirname13 } from "node:path";
+import { mkdir as mkdir13, rm as rm7, writeFile as writeFile12 } from "node:fs/promises";
+import { dirname as dirname14 } from "node:path";
 var LAZE_MCP_SERVER = "laze";
 var DEV_CHANNELS_FLAG = "--dangerously-load-development-channels";
 var ROUND_SECONDS3 = 50;
@@ -70473,7 +70837,7 @@ async function pushInbox({
   signal
 }) {
   const marker = statePathOf({ context, kind: "channels", profile });
-  await mkdir12(dirname13(marker), { recursive: true, mode: 448 });
+  await mkdir13(dirname14(marker), { recursive: true, mode: 448 });
   await writeFile12(marker, JSON.stringify({ pid: context.processes.pid }));
   try {
     while (!signal.aborted) {
@@ -70501,8 +70865,8 @@ async function pushInbox({
 }
 
 // src/services/plugin-tip.service.ts
-import { mkdir as mkdir13, readFile as readFile13, writeFile as writeFile13 } from "node:fs/promises";
-import { dirname as dirname14 } from "node:path";
+import { mkdir as mkdir14, readFile as readFile13, writeFile as writeFile13 } from "node:fs/promises";
+import { dirname as dirname15 } from "node:path";
 var RELOAD_TIP = "Laze: the Laze plugin is installed in Claude Code, and this session has not loaded it yet. Tell the user once, in one plain line, that it is optional: typing /reload-plugins makes Laze messages arrive right away; until then they still arrive through the hooks.";
 var LINK_RELOAD_TIP = "Tell the user once, in one plain line, that it is optional: typing /reload-plugins makes Laze messages arrive right away; until then they still arrive through the hooks.";
 function monitorsRunHere({ context }) {
@@ -70536,7 +70900,7 @@ async function markReloadTipTold({
 }) {
   if (!session) return;
   const path = toldPathOf({ context, session });
-  await mkdir13(dirname14(path), { recursive: true, mode: 448 });
+  await mkdir14(dirname15(path), { recursive: true, mode: 448 });
   await writeFile13(path, String(context.nowMs()), { mode: 384 });
 }
 async function reloadTipOnce({
@@ -70611,8 +70975,8 @@ async function installHooks({
   directory,
   profile
 }) {
-  const folder = join15(directory, ".claude");
-  const path = join15(folder, "settings.local.json");
+  const folder = join16(directory, ".claude");
+  const path = join16(folder, "settings.local.json");
   const current2 = await readFile14(path, "utf8").then(
     (text2) => JSON.parse(text2),
     () => ({})
@@ -70624,7 +70988,7 @@ async function installHooks({
     waitCommand: command("wait"),
     preToolCommand: command("pre-tool")
   });
-  await mkdir14(folder, { recursive: true });
+  await mkdir15(folder, { recursive: true });
   await writeFile14(path, `${JSON.stringify(settings2, null, 2)}
 `);
   return path;
@@ -70888,7 +71252,7 @@ async function addSessionStartWaiter({ context, args }) {
   const directory = context.environment.inherited.CLAUDE_PROJECT_DIR;
   const profile = flagText({ args, name: "profile" });
   if (!directory || !profile) return;
-  const path = join15(directory, ".claude", "settings.local.json");
+  const path = join16(directory, ".claude", "settings.local.json");
   const settings2 = await readFile14(path, "utf8").then(
     (text2) => JSON.parse(text2),
     () => void 0
@@ -70898,7 +71262,7 @@ async function addSessionStartWaiter({ context, args }) {
 }
 async function refreshPlugin({ context }) {
   if (await pluginIsCurrent({ context })) return;
-  const logPath = join15(pluginFolderOf({ context }), "install.log");
+  const logPath = join16(pluginFolderOf({ context }), "install.log");
   context.processes.spawnDetached({ argv: [...context.program, "plugin", "install"], logPath });
 }
 async function stopHook({ context, args }) {
@@ -71775,8 +72139,8 @@ async function requestAgent({ context, args }) {
 }
 
 // src/services/app-commands.service.ts
-import { mkdir as mkdir15, readdir as readdir6, readFile as readFile16, writeFile as writeFile16 } from "node:fs/promises";
-import { dirname as dirname15, join as join17, relative as relative3, resolve as resolve6, sep as sep2 } from "node:path";
+import { mkdir as mkdir16, readdir as readdir6, readFile as readFile16, writeFile as writeFile16 } from "node:fs/promises";
+import { dirname as dirname16, join as join18, relative as relative3, resolve as resolve6, sep as sep2 } from "node:path";
 
 // ../../modules/app/contract/src/app.connections.ts
 var appFunctionNameSchema = external_exports.string().regex(/^[a-z0-9][a-z0-9_-]{0,63}$/);
@@ -72032,7 +72396,8 @@ var createAppInputSchemaDefinition = external_exports.object({
   /** Defaults to the name in lower case words. */
   slug: appSlugSchema.optional(),
   channelId: external_exports.string().min(1).optional(),
-  visibility: appVisibilitySchema.default("internal")
+  /** Restricted unless chosen: owner, admins, shares and the conversations it is pinned to. */
+  visibility: appVisibilitySchema.default("restricted")
 });
 var createAppInputSchema = createAppInputSchemaDefinition;
 var listAppsInputSchemaDefinition = external_exports.object({
@@ -72211,7 +72576,8 @@ var appKeyCallerViewSchemaDefinition = external_exports.object({
 });
 var signInHandoffInputSchemaDefinition = external_exports.object({
   ...appRefSchemaDefinition.shape,
-  site: appSiteSchema,
+  /** Left out, the published site when there is one, else the draft. */
+  site: appSiteSchema.optional(),
   /** Where the app sends the person after sign-in; kept on the app's own origin. */
   returnPath: external_exports.string().max(2e3).default("/")
 });
@@ -72219,6 +72585,8 @@ var signInHandoffInputSchema = signInHandoffInputSchemaDefinition;
 var signInHandoffSchemaDefinition = external_exports.object({
   /** The app origin's callback, carrying a one-use token valid only for this app and site. */
   redirectUrl: external_exports.string(),
+  /** The site the token opens. */
+  site: appSiteSchema,
   expiresAt: external_exports.iso.datetime()
 });
 var signInHandoffSchema = signInHandoffSchemaDefinition;
@@ -72357,7 +72725,9 @@ var listFunctionLogsInputSchema = listFunctionLogsInputSchemaDefinition;
 var appFunctionSettingsSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
   /** Off: pushes with functions are refused and every function answers app_functions_disabled. */
-  functionsEnabled: external_exports.boolean()
+  functionsEnabled: external_exports.boolean(),
+  /** On: a Builder makes an app public at once. Off: a public publish asks an admin. */
+  publicAppsAllowed: external_exports.boolean()
 });
 var appFunctionSettingsSchema = appFunctionSettingsSchemaDefinition;
 var workspaceRefSchemaDefinition = external_exports.object({ workspaceId: external_exports.string().min(1) });
@@ -72367,6 +72737,11 @@ var setFunctionsEnabledInputSchemaDefinition = external_exports.object({
   enabled: external_exports.boolean()
 });
 var setFunctionsEnabledInputSchema = setFunctionsEnabledInputSchemaDefinition;
+var setPublicAppsAllowedInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  allowed: external_exports.boolean()
+});
+var setPublicAppsAllowedInputSchema = setPublicAppsAllowedInputSchemaDefinition;
 var appRestoreSchemaDefinition = external_exports.object({
   id: external_exports.string(),
   /** The time the data went back to; absent when the restore undid an earlier one. */
@@ -72467,7 +72842,11 @@ var appAccessSchemaDefinition = external_exports.object({
   /** Pending requests, to the app's Builders; empty for anyone else. */
   requests: external_exports.array(appAccessRequestSchemaDefinition),
   /** The reader's own role. */
-  role: appRoleSchema
+  role: appRoleSchema,
+  /** The workspace's name, for "Everyone in <workspace>". */
+  workspaceName: external_exports.string(),
+  /** Whether a Builder makes it public without asking an admin. */
+  publicAppsAllowed: external_exports.boolean()
 });
 var appAccessSchema = appAccessSchemaDefinition;
 var grantAppAccessInputSchemaDefinition = external_exports.object({
@@ -72859,7 +73238,9 @@ var pinAppInputSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
   appId: external_exports.string().min(1),
   /** The conversation, by id or by channel name with or without `#`. */
-  channel: external_exports.string().trim().min(1).max(120)
+  channel: external_exports.string().trim().min(1).max(120),
+  /** What the conversation's members may do: editor unless the pinner picked view-only. */
+  role: external_exports.enum(["viewer", "editor"]).optional()
 });
 var pinAppInputSchema = pinAppInputSchemaDefinition;
 var channelPinsInputSchemaDefinition = external_exports.object({
@@ -72885,7 +73266,9 @@ var reorderPinsInputSchema = reorderPinsInputSchemaDefinition;
 var pinAppByKeyInputSchemaDefinition = external_exports.object({
   appId: external_exports.string().min(1),
   /** Absent in an agent's turn means the conversation the turn runs in. */
-  channel: external_exports.string().trim().min(1).max(120).optional()
+  channel: external_exports.string().trim().min(1).max(120).optional(),
+  /** On a pin: what the conversation's members may do, editor unless view-only. */
+  role: external_exports.enum(["viewer", "editor"]).optional()
 });
 var channelPinsByKeyInputSchemaDefinition = channelPinsInputSchemaDefinition.omit({
   workspaceId: true
@@ -72935,7 +73318,7 @@ var appBackupCheckAlertsSchemaDefinition = external_exports.object({
 });
 
 // ../../modules/app/contract/src/app.trpc.ts
-var appMainTrpc = defineTrpcContract("app").query("list").withInput(listAppsInputSchema).withOutput(external_exports.array(appSchema)).query("get").withInput(appRefSchema).withOutput(appSchema).mutation("create").withInput(createAppInputSchema).withOutput(appSchema).mutation("rename").withInput(renameAppInputSchema).withOutput(appSchema).mutation("archive").withInput(appRefSchema).withOutput(appSchema).mutation("unarchive").withInput(appRefSchema).withOutput(appSchema).mutation("delete").withInput(deleteAppInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).query("versions").withInput(appRefSchema).withOutput(external_exports.array(appVersionSchema)).mutation("revert").withInput(revertInputSchema).withOutput(appVersionSchema).mutation("publish").withInput(publishInputSchema).withOutput(publishOutcomeSchema).query("collections").withInput(siteRefSchema).withOutput(external_exports.array(collectionSchema)).query("records").withInput(listRecordsInputSchema).withOutput(recordPageSchema).mutation("writeRecord").withInput(writeRecordInputSchema).withOutput(appRecordSchema).mutation("deleteRecord").withInput(deleteRecordInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).query("views").withInput(siteRefSchema).withOutput(external_exports.array(appViewSchema)).mutation("saveView").withInput(saveViewInputSchema).withOutput(appViewSchema).mutation("deleteView").withInput(deleteViewInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).mutation("chooseCardRows").withInput(chooseCardRowsInputSchema).withOutput(appCardChoiceSchema).query("exportRecords").withInput(exportRecordsInputSchema).withOutput(recordExportSchema).mutation("importRecords").withInput(importRecordsInputSchema).withOutput(recordImportSchema).mutation("decidePublish").withInput(decidePublishInputSchema).withOutput(publishOutcomeSchema).mutation("nameVersion").withInput(nameVersionInputSchema).withOutput(appVersionSchema).mutation("makeInternal").withInput(appRefSchema).withOutput(appSchema).mutation("revokePublishLease").withInput(appRefSchema).withOutput(appSchema).mutation("signInHandoff").withInput(signInHandoffInputSchema).withOutput(signInHandoffSchema).query("functionLogs").withInput(listFunctionLogsInputSchema).withOutput(external_exports.array(appFunctionLogEntrySchema)).query("functionSettings").withInput(appWorkspaceRefSchema).withOutput(appFunctionSettingsSchema).query("access").withInput(appRefSchema).withOutput(appAccessSchema).query("members").withInput(appRefSchema).withOutput(appMembersSchema).mutation("grantAccess").withInput(grantAppAccessInputSchema).withOutput(appAccessSchema).mutation("revokeAccess").withInput(revokeAppAccessInputSchema).withOutput(appAccessSchema).mutation("setVisibility").withInput(setAppVisibilityInputSchema).withOutput(visibilityOutcomeSchema).mutation("setMemberRole").withInput(setMemberRoleInputSchema).withOutput(appAccessSchema).mutation("unpublish").withInput(appRefSchema).withOutput(appSchema).query("door").withInput(appRefSchema).withOutput(appDoorSchema).mutation("requestAccess").withInput(appRefSchema).withOutput(appDoorSchema).mutation("decideAccess").withInput(decideAppAccessInputSchema).withOutput(appAccessRequestSchema).query("users").withInput(appRefSchema).withOutput(appUsersSchema).mutation("blockUser").withInput(blockAppUserInputSchema).withOutput(appUsersSchema).mutation("deleteUser").withInput(deleteAppUserInputSchema).withOutput(deletedAppUserSchema).mutation("setFunctionsEnabled").withInput(setFunctionsEnabledInputSchema).withOutput(appFunctionSettingsSchema).query("backups").withInput(appRefSchema).withOutput(appBackupStatusSchema).mutation("restoreData").withInput(restoreAppDataInputSchema).withOutput(appRestoreSchema).query("cost").withInput(appRefSchema).withOutput(appCostSchema).mutation("setBudget").withInput(setAppBudgetInputSchema).withOutput(appCostSchema).query("triggers").withInput(appRefSchema).withOutput(appTriggersSchema).mutation("setTriggerPaused").withInput(setAppTriggerPausedInputSchema).withOutput(appTriggerSchema).mutation("removeTrigger").withInput(appTriggerRefSchema).withOutput(external_exports.object({ removed: external_exports.literal(true) })).build();
+var appMainTrpc = defineTrpcContract("app").query("list").withInput(listAppsInputSchema).withOutput(external_exports.array(appSchema)).query("get").withInput(appRefSchema).withOutput(appSchema).mutation("create").withInput(createAppInputSchema).withOutput(appSchema).mutation("rename").withInput(renameAppInputSchema).withOutput(appSchema).mutation("archive").withInput(appRefSchema).withOutput(appSchema).mutation("unarchive").withInput(appRefSchema).withOutput(appSchema).mutation("delete").withInput(deleteAppInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).query("versions").withInput(appRefSchema).withOutput(external_exports.array(appVersionSchema)).mutation("revert").withInput(revertInputSchema).withOutput(appVersionSchema).mutation("publish").withInput(publishInputSchema).withOutput(publishOutcomeSchema).query("collections").withInput(siteRefSchema).withOutput(external_exports.array(collectionSchema)).query("records").withInput(listRecordsInputSchema).withOutput(recordPageSchema).mutation("writeRecord").withInput(writeRecordInputSchema).withOutput(appRecordSchema).mutation("deleteRecord").withInput(deleteRecordInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).query("views").withInput(siteRefSchema).withOutput(external_exports.array(appViewSchema)).mutation("saveView").withInput(saveViewInputSchema).withOutput(appViewSchema).mutation("deleteView").withInput(deleteViewInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).mutation("chooseCardRows").withInput(chooseCardRowsInputSchema).withOutput(appCardChoiceSchema).query("exportRecords").withInput(exportRecordsInputSchema).withOutput(recordExportSchema).mutation("importRecords").withInput(importRecordsInputSchema).withOutput(recordImportSchema).mutation("decidePublish").withInput(decidePublishInputSchema).withOutput(publishOutcomeSchema).mutation("nameVersion").withInput(nameVersionInputSchema).withOutput(appVersionSchema).mutation("makeInternal").withInput(appRefSchema).withOutput(appSchema).mutation("revokePublishLease").withInput(appRefSchema).withOutput(appSchema).mutation("signInHandoff").withInput(signInHandoffInputSchema).withOutput(signInHandoffSchema).query("functionLogs").withInput(listFunctionLogsInputSchema).withOutput(external_exports.array(appFunctionLogEntrySchema)).query("functionSettings").withInput(appWorkspaceRefSchema).withOutput(appFunctionSettingsSchema).query("access").withInput(appRefSchema).withOutput(appAccessSchema).query("members").withInput(appRefSchema).withOutput(appMembersSchema).mutation("grantAccess").withInput(grantAppAccessInputSchema).withOutput(appAccessSchema).mutation("revokeAccess").withInput(revokeAppAccessInputSchema).withOutput(appAccessSchema).mutation("setVisibility").withInput(setAppVisibilityInputSchema).withOutput(visibilityOutcomeSchema).mutation("setMemberRole").withInput(setMemberRoleInputSchema).withOutput(appAccessSchema).mutation("unpublish").withInput(appRefSchema).withOutput(appSchema).query("door").withInput(appRefSchema).withOutput(appDoorSchema).mutation("requestAccess").withInput(appRefSchema).withOutput(appDoorSchema).mutation("decideAccess").withInput(decideAppAccessInputSchema).withOutput(appAccessRequestSchema).query("users").withInput(appRefSchema).withOutput(appUsersSchema).mutation("blockUser").withInput(blockAppUserInputSchema).withOutput(appUsersSchema).mutation("deleteUser").withInput(deleteAppUserInputSchema).withOutput(deletedAppUserSchema).mutation("setFunctionsEnabled").withInput(setFunctionsEnabledInputSchema).withOutput(appFunctionSettingsSchema).mutation("setPublicAppsAllowed").withInput(setPublicAppsAllowedInputSchema).withOutput(appFunctionSettingsSchema).query("backups").withInput(appRefSchema).withOutput(appBackupStatusSchema).mutation("restoreData").withInput(restoreAppDataInputSchema).withOutput(appRestoreSchema).query("cost").withInput(appRefSchema).withOutput(appCostSchema).mutation("setBudget").withInput(setAppBudgetInputSchema).withOutput(appCostSchema).query("triggers").withInput(appRefSchema).withOutput(appTriggersSchema).mutation("setTriggerPaused").withInput(setAppTriggerPausedInputSchema).withOutput(appTriggerSchema).mutation("removeTrigger").withInput(appTriggerRefSchema).withOutput(external_exports.object({ removed: external_exports.literal(true) })).build();
 var appConnectionsTrpc = defineTrpcContract("app").query("connections").withInput(appRefSchema).withOutput(appConnectionsSchema).mutation("allowConnection").withInput(appConnectionRefSchema).withOutput(appConnectionsSchema).mutation("revokeConnection").withInput(appConnectionRefSchema).withOutput(appConnectionsSchema).build();
 var appPinsTrpc = defineTrpcContract("app").query("pins").withInput(channelPinsInputSchema).withOutput(channelAppPinsSchema).mutation("pin").withInput(pinAppInputSchema).withOutput(channelAppPinsSchema).mutation("unpin").withInput(pinAppInputSchema).withOutput(channelAppPinsSchema).mutation("setPinView").withInput(setPinViewInputSchema).withOutput(channelAppPinsSchema).mutation("reorderPins").withInput(reorderPinsInputSchema).withOutput(channelAppPinsSchema).build();
 var appTrpc = joinTrpcContracts("app", appMainTrpc, appConnectionsTrpc, appPinsTrpc);
@@ -72978,6 +73361,7 @@ var renameAppByKeyInputSchemaDefinition = renameAppInputSchema.omit(byKey);
 var deleteAppByKeyInputSchemaDefinition = deleteAppInputSchema.omit(byKey);
 var functionSettingsByKeyInputSchemaDefinition = external_exports.object({});
 var setFunctionsEnabledByKeyInputSchemaDefinition = setFunctionsEnabledInputSchema.omit(byKey);
+var setPublicAppsAllowedByKeyInputSchemaDefinition = setPublicAppsAllowedInputSchema.omit(byKey);
 var restoreDataByKeyInputSchemaDefinition = external_exports.object({
   ...appByKeySchemaDefinition.shape,
   /** The time to go back to, ISO 8601. */
@@ -73058,8 +73442,8 @@ var appCliCommands = [
   {
     command: "laze app publish",
     operation: "requestPublish",
-    arguments: ["[version]", "--visibility internal|public"],
-    summary: "Publish for the workspace now; a public publish waits for an approval"
+    arguments: ["[version]", "--visibility restricted|channel|internal|public"],
+    summary: "Publish now for the people who can open the app; opening it to more people waits for an approval"
   },
   {
     command: "laze app make-internal",
@@ -73172,8 +73556,8 @@ var appCliCommands = [
   {
     command: "laze app pin",
     operation: "pinApp",
-    arguments: ["[app]", "--channel <c>"],
-    summary: "Pin the app as a tab of a channel or chat for everyone in it, who may then open it; an app an agent creates or publishes from a conversation is pinned there on its own"
+    arguments: ["[app]", "--channel <c>", "--view-only"],
+    summary: "Pin the app as a tab of a channel or chat; everyone in it and their agents may then edit it, or only view it with --view-only. An app an agent creates or publishes from a conversation is pinned there on its own"
   },
   {
     command: "laze app unpin",
@@ -73223,6 +73607,12 @@ var appCliCommands = [
     arguments: ["[on|off]"],
     summary: "Whether the workspace's apps run server functions; on and off need an admin"
   },
+  {
+    command: "laze app public-apps",
+    operation: "setPublicAppsAllowed",
+    arguments: ["[on|off]"],
+    summary: "Whether Builders make apps public without asking an admin (on by default); on and off need an admin"
+  },
   {
     command: "laze app backups",
     operation: "getBackups",
@@ -74057,6 +74447,18 @@ var functions = async ({ context, args, signed: signed2 }) => {
   const text2 = settings2.functionsEnabled ? "Server functions are on for this workspace's apps.\n" : "Server functions are off: pushes with functions are refused and every function answers app_functions_disabled.\n";
   print2({ context, args, value: settings2, text: text2 });
 };
+var publicApps = async ({ context, args, signed: signed2 }) => {
+  const word3 = args.words[2];
+  if (word3 !== void 0 && word3 !== "on" && word3 !== "off") {
+    throw new CliUsageError("Usage: laze app public-apps [on|off]");
+  }
+  const client = await signed2();
+  const settings2 = word3 === void 0 ? await client.post("/api/apps/functions", {}) : await client.post("/api/apps/public-apps", {
+    allowed: word3 === "on"
+  });
+  const text2 = settings2.publicAppsAllowed ? "Public apps are allowed: a Builder makes an app public without asking an admin.\n" : "Public apps ask an admin first: making an app public waits for an Owner or Admin to approve.\n";
+  print2({ context, args, value: settings2, text: text2 });
+};
 function backupsText({ name: name3, status: status9 }) {
   const window2 = status9.from && status9.to ? `A restore can go back to any time from ${status9.from} to ${status9.to}.` : "Nothing to restore to yet.";
   const replicating = status9.replicating ? "The published data replicates to object storage." : "The published data does not replicate on this host.";
@@ -74137,6 +74539,7 @@ var appManageCommands = {
   delete: remove,
   "revoke-lease": revokeLease,
   functions,
+  "public-apps": publicApps,
   backups,
   restore,
   users,
@@ -74189,16 +74592,19 @@ async function appPinCommand({
 }) {
   const channel = flagText({ args, name: "channel" });
   const { client, appId, name: name3 } = await open3();
+  const viewOnly = verb === "pin" && Boolean(args.flags["view-only"]);
   const listed = await client.post(`/api/apps/${verb}`, {
     appId,
-    ...channel ? { channel } : {}
+    ...channel ? { channel } : {},
+    ...viewOnly ? { role: "viewer" } : {}
   });
   const where = channel || "this conversation";
+  const may = viewOnly ? "may open and read the app" : "may open and edit the app";
   print3({
     context,
     args,
     value: listed,
-    text: verb === "pin" ? `Pinned ${name3} to ${where}: everyone in it sees the tab and may open the app.
+    text: verb === "pin" ? `Pinned ${name3} to ${where}: everyone in it and their agents see the tab and ${may}.
 ` : `Unpinned ${name3} from ${where}. The app and its data stay.
 `
   });
@@ -74221,7 +74627,7 @@ async function appPinsCommand({
 import { execFile } from "node:child_process";
 import { mkdtemp, rm as rm8, writeFile as writeFile15 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 import { promisify } from "node:util";
 var run2 = promisify(execFile);
 var MODULE_SYNTAX = /^\s*(import|export)\s/m;
@@ -74250,11 +74656,11 @@ async function scriptErrorsOf({
   const unknown2 = unknownCollectionsOf({ files: files2, collections });
   const scripts = files2.flatMap(scriptsOf);
   if (scripts.length === 0) return unknown2;
-  const dir = await mkdtemp(join16(tmpdir(), "laze-app-check-"));
+  const dir = await mkdtemp(join17(tmpdir(), "laze-app-check-"));
   try {
     const errors = await Promise.all(
       scripts.map(async (script, index) => {
-        const file3 = join16(dir, `${index}.${script.module ? "mjs" : "cjs"}`);
+        const file3 = join17(dir, `${index}.${script.module ? "mjs" : "cjs"}`);
         await writeFile15(file3, script.code);
         try {
           await run2(process.execPath, ["--check", file3]);
@@ -74430,7 +74836,7 @@ function folderOf({ context, word: word3 }) {
   return resolve6(context.cwd, word3 ?? ".");
 }
 async function readManifest(folder) {
-  const text2 = await readFile16(join17(folder, APP_MANIFEST_FILE), "utf8").catch(() => void 0);
+  const text2 = await readFile16(join18(folder, APP_MANIFEST_FILE), "utf8").catch(() => void 0);
   if (text2 === void 0) return void 0;
   const parsed = appManifestSchema.safeParse(JSON.parse(text2));
   if (!parsed.success) {
@@ -74478,7 +74884,7 @@ async function listFiles(folder) {
   while (pending.length > 0 && found.length <= MAX_FILES) {
     const current2 = pending.pop() ?? folder;
     for (const entry of await readdir6(current2, { withFileTypes: true })) {
-      const path = join17(current2, entry.name);
+      const path = join18(current2, entry.name);
       const rel = relative3(folder, path).split(sep2).join("/");
       if (isSkippedPath({ path: rel })) continue;
       if (entry.isDirectory()) pending.push(path);
@@ -74519,11 +74925,11 @@ var appCreate = async ({ context, args }) => {
     ...visibility ? { visibility } : {}
   });
   const folder = resolve6(context.cwd, flagText({ args, name: "dir", fallback: app2.slug }));
-  await mkdir15(folder, { recursive: true });
+  await mkdir16(folder, { recursive: true });
   const files2 = template ? templateFiles({ template, name: name3 }) : {};
   for (const [path, content] of Object.entries(files2)) {
-    await mkdir15(dirname15(join17(folder, path)), { recursive: true });
-    await writeFile16(join17(folder, path), content);
+    await mkdir16(dirname16(join18(folder, path)), { recursive: true });
+    await writeFile16(join18(folder, path), content);
   }
   const manifest = {
     app: { id: app2.id, name: app2.name, slug: app2.slug },
@@ -74531,7 +74937,7 @@ var appCreate = async ({ context, args }) => {
     views: template?.views ? [...template.views] : [],
     seed: template ? { ...template.seed } : {}
   };
-  await writeFile16(join17(folder, APP_MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
+  await writeFile16(join18(folder, APP_MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
 `);
   print5({
     context,
@@ -74700,8 +75106,8 @@ var appPull = async ({ context, args }) => {
     );
   }
   for (const file3 of pulled.files) {
-    const target = join17(folder, ...file3.path.split("/"));
-    await mkdir15(dirname15(target), { recursive: true });
+    const target = join18(folder, ...file3.path.split("/"));
+    await mkdir16(dirname16(target), { recursive: true });
     await writeFile16(
       target,
       file3.encoding === "base64" ? Buffer.from(file3.content, "base64") : file3.content
@@ -74719,7 +75125,7 @@ var appPull = async ({ context, args }) => {
       ])
     )
   };
-  await writeFile16(join17(folder, APP_MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
+  await writeFile16(join18(folder, APP_MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
 `);
   const names = pulled.collections.map((collection) => collection.name);
   const where = relative3(context.cwd, folder) || ".";
@@ -74749,16 +75155,22 @@ var appPublish = async ({ context, args }) => {
   });
   print5({ context, args, value: outcome, text: publishLine(outcome) });
 };
+var PUBLISH_AUDIENCE = {
+  restricted: "the people it is shared with and its pinned channels",
+  channel: "its channel",
+  internal: "the workspace",
+  public: "everyone"
+};
 function publishLine(outcome) {
   const { request: request2 } = outcome;
   if (request2.status === "pending") {
-    return `Waiting for approval (${request2.id}): a public publish needs a workspace admin's yes.
+    return `Waiting for approval (${request2.id}): opening the app to more people needs a workspace admin's yes.
 They see a publish card in their Laze feed and on the app's page, and can approve once, for 24 hours or always for this app.
 Nothing changes for visitors until then; the request expires after 72 hours.
 `;
   }
   if (request2.status === "denied") return "The publish was denied.\n";
-  const audience = request2.visibility === "public" ? "everyone" : "the workspace";
+  const audience = PUBLISH_AUDIENCE[request2.visibility];
   return `Published ${request2.version.slice(0, 7)} for ${audience}: ${outcome.app.publishedUrl}
 `;
 }
@@ -75356,6 +75768,7 @@ var APP_COMMANDS = {
   delete: managed(appManageCommands.delete),
   "revoke-lease": managed(appManageCommands["revoke-lease"]),
   functions: managed(appManageCommands.functions),
+  "public-apps": managed(appManageCommands["public-apps"]),
   backups: managed(appManageCommands.backups),
   restore: managed(appManageCommands.restore),
   users: managed(appManageCommands.users),
@@ -75513,6 +75926,15 @@ ${BILLING_USAGE}`);
   }
   return value;
 }
+function prepaidNoteOf(account, of) {
+  const { prepaid, overdraft = 0, welcome = 0 } = account.credits;
+  const notes = [
+    prepaid < 0 ? `${of(-prepaid)} owed, paid first by the next top-up` : null,
+    overdraft > 0 ? `may go down to -${of(overdraft)}` : null,
+    welcome > 0 ? `welcome credit, ${of(welcome)}` : null
+  ].filter((note) => note !== null);
+  return notes.length > 0 ? ` (${notes.join(", ")})` : "";
+}
 function printAccount({ context, args }, account) {
   if (args.flags.json) return printJson(context, account);
   const of = (amount) => money(amount, account.currency);
@@ -75521,7 +75943,7 @@ function printAccount({ context, args }, account) {
   context.out(`Plan: ${plan2}${pending}
 `);
   context.out(
-    `Credits: ${of(account.credits.includedLeft)} of ${of(account.credits.included)} included left, ${of(account.credits.prepaid)} prepaid${account.credits.welcome ? ` (welcome credit, ${of(account.credits.welcome)})` : ""}${account.credits.paused ? " (paused: top up to resume)" : ""}
+    `Credits: ${of(account.credits.includedLeft)} of ${of(account.credits.included)} included left, ${of(account.credits.prepaid)} prepaid${prepaidNoteOf(account, of)}${account.credits.paused ? " (paused: top up to resume)" : ""}
 `
   );
   const recharge = account.autoRecharge;
@@ -75632,8 +76054,8 @@ async function billing({ context, args }) {
 
 // src/services/browser-commands.service.ts
 import { randomBytes } from "node:crypto";
-import { mkdir as mkdir16, readFile as readFile17, writeFile as writeFile17 } from "node:fs/promises";
-import { dirname as dirname16, join as join18 } from "node:path";
+import { mkdir as mkdir17, readFile as readFile17, writeFile as writeFile17 } from "node:fs/promises";
+import { dirname as dirname17, join as join19 } from "node:path";
 
 // src/services/browser-tab-commands.service.ts
 var BROWSER_TAB_PATHS = {
@@ -76174,22 +76596,30 @@ var USAGE6 = [
   "",
   BROWSER_TAB_USAGE
 ].join("\n");
-async function turnTokenOf2({ context }) {
+async function turnTokenOf2({
+  context,
+  args,
+  client,
+  agent: agent2
+}) {
   const env = context.environment.inherited;
   const pinned = env.LAZE_TURN_TOKEN?.trim();
   if (pinned) return pinned;
-  if (!env.LAZE_TURN_FILE) return "";
-  return readFile17(env.LAZE_TURN_FILE, "utf8").then(
-    (text2) => text2.trim(),
-    () => ""
-  );
+  if (env.LAZE_TURN_FILE) {
+    return readFile17(env.LAZE_TURN_FILE, "utf8").then(
+      (text2) => text2.trim(),
+      () => ""
+    );
+  }
+  if (!agent2) return "";
+  return connectedTurnTokenOf({ client, channelId: flagText({ args, name: "channel" }) || null });
 }
 async function computeClient({
   context,
   args
 }) {
-  const { client } = await signedIn({ context, args });
-  const turn = await turnTokenOf2({ context });
+  const { client, profile } = await signedIn({ context, args });
+  const turn = await turnTokenOf2({ context, args, client, agent: profile.kind === "agent" });
   return turn ? client.withHeaders({ "x-laze-turn": turn }) : client;
 }
 function siteLine(machine2) {
@@ -76253,7 +76683,7 @@ async function cdp({ context, args }) {
 }
 function bridgeStatePath({ context, machine: machine2 }) {
   const safe = machine2.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return join18(dirname16(context.environment.configPath), "bridges", `${safe}.json`);
+  return join19(dirname17(context.environment.configPath), "bridges", `${safe}.json`);
 }
 async function bridgePort({
   context,
@@ -76274,7 +76704,7 @@ async function bridgePort({
     key,
     ...target
   });
-  await mkdir16(dirname16(path), { recursive: true, mode: 448 });
+  await mkdir17(dirname17(path), { recursive: true, mode: 448 });
   await writeFile17(path, JSON.stringify({ port, key }), { mode: 384 });
   return port;
 }
@@ -77871,9 +78301,11 @@ var billingAccountViewDefinition = external_exports.object({
     /** Included this period by the plan. */
     included: external_exports.number(),
     includedLeft: external_exports.number(),
-    /** The prepaid balance; a little below zero when the last call overshot it. */
+    /** The prepaid balance; below zero while the workspace owes usage the next top-up pays. */
     prepaid: external_exports.number(),
-    /** The one-off welcome credit this workspace got; 0 when it got none. */
+    /** How far below zero the prepaid balance may go before usage pauses; 0 when not at all. */
+    overdraft: external_exports.number().default(0),
+    /** The one-off welcome credit given before 2026-10-21; 0 when it got none. */
     welcome: external_exports.number().default(0),
     paused: external_exports.boolean(),
     pauseReason: pauseReasonSchema.nullable()
@@ -79656,7 +80088,7 @@ var judgeStatus = async ({ context, args }) => {
   const status9 = await client.get("/api/vault/judge");
   if (args.flags.json) return printJson4({ context, data: status9 });
   context.out(
-    status9.configured ? "The judge is set up: Checked uses are decided by it.\n" : "No judge is set up: every Checked use asks a person.\n"
+    status9.configured ? "Automatic approval is on: Laze checks each Auto use against the key's rules.\n" : "Automatic approval is switched off: every Auto use waits for your OK.\n"
   );
 };
 var listDevices = async ({ context, args }) => {
@@ -79675,9 +80107,9 @@ var listDevices = async ({ context, args }) => {
 
 // src/services/vault-commands.service.ts
 import { createHash as createHash2 } from "node:crypto";
-import { mkdir as mkdir17, readFile as readFile22, rm as rm10, writeFile as writeFile18 } from "node:fs/promises";
+import { mkdir as mkdir18, readFile as readFile22, rm as rm10, writeFile as writeFile18 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname17, join as join19 } from "node:path";
+import { dirname as dirname18, join as join20 } from "node:path";
 var USAGE8 = `Usage: laze vault run <connection> --reason "<one plain sentence>" [--wait <s>] -- <command> [args...]
 Runs the command with the connection's values in its environment, on a Laze agent's computer,
 on a machine it runs on, or where a connected agent runs, with its own key.
@@ -79724,8 +80156,8 @@ function runKeyPathOf({
   profile = ""
 }) {
   const name3 = createHash2("sha256").update(connection).digest("hex");
-  const base = turnFile ? dirname17(turnFile) : join19(tmpdir2(), "laze-vault", profile);
-  return join19(base, "vault-run-keys", `${name3}.json`);
+  const base = turnFile ? dirname18(turnFile) : join20(tmpdir2(), "laze-vault", profile);
+  return join20(base, "vault-run-keys", `${name3}.json`);
 }
 async function runKeyAt({ path }) {
   const saved3 = await readFile22(path, "utf8").then(
@@ -79738,7 +80170,7 @@ async function runKeyAt({ path }) {
   }
   const fresh = await generateEcdhKeys();
   const jwk = await globalThis.crypto.subtle.exportKey("jwk", fresh.privateKey);
-  await mkdir17(dirname17(path), { recursive: true, mode: 448 });
+  await mkdir18(dirname18(path), { recursive: true, mode: 448 });
   await writeFile18(path, JSON.stringify({ publicKey: fresh.publicKey, privateKey: jwk }), {
     mode: 384
   });
@@ -80694,8 +81126,8 @@ var DOMAINS_USAGE = `Usage:
 var printJson5 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
 `);
 function printDomain(context, row) {
-  const join23 = row.autoJoin ? "auto-join on" : "auto-join off";
-  context.out(`${row.domain}	${join23}${row.enforced ? "	single sign-on enforced" : ""}
+  const join24 = row.autoJoin ? "auto-join on" : "auto-join off";
+  context.out(`${row.domain}	${join24}${row.enforced ? "	single sign-on enforced" : ""}
 `);
 }
 async function list4({ context, args }) {
@@ -80730,131 +81162,6 @@ async function domains({ context, args }) {
 import { readFile as readFile26 } from "node:fs/promises";
 import { resolve as resolve10 } from "node:path";
 
-// src/rules/feed-input.rules.ts
-function csvCellsOf(line) {
-  const cells = [];
-  let cell = "";
-  let quoted = false;
-  for (let at = 0; at < line.length; at += 1) {
-    const char = line[at];
-    if (quoted && char === '"' && line[at + 1] === '"') {
-      cell += '"';
-      at += 1;
-    } else if (char === '"') {
-      quoted = !quoted;
-    } else if (char === "," && !quoted) {
-      cells.push(cell);
-      cell = "";
-    } else {
-      cell += char;
-    }
-  }
-  return [...cells, cell];
-}
-function richBodyOf({ kind: kind2, text: text2 }) {
-  if (kind2 === "metric") {
-    try {
-      return { kind: kind2, ...JSON.parse(text2) };
-    } catch {
-      throw new Error("--metric takes JSON: {label, unit, value, delta, bars: [{label, value}]}");
-    }
-  }
-  const [columns = [], ...rows] = text2.split(/\r?\n/).filter((line) => line.trim() !== "").map(csvCellsOf);
-  return { kind: kind2, columns, rows };
-}
-function richOf(args) {
-  const metric = flagText({ args, name: "metric" });
-  const table = flagText({ args, name: "table" });
-  if (metric && table) throw new Error("an item carries one rich body: pass --metric or --table");
-  if (metric) return { kind: "metric", source: sourceOf(metric) };
-  if (table) return { kind: "table", source: sourceOf(table) };
-  return void 0;
-}
-var TEXT_FLAGS = { draft: "draft", summary: "summary" };
-var FEED_WRITING = `Write for a person deciding on a phone in a few seconds:
-  - Title: the ask first, short enough to read in one glance.
-  - --summary: one plain sentence of why.
-  - No body: text to send goes in --draft, sources in --link, numbers in --metric or --table.
-  - Plain words. No ids (email, thread, card, channel), no UTC times, no PR or ticket lists,
-    no "Day 9." counters. Numbers only when they change the decision.
-  - Not too terse either: whole sentences a person understands without context.
-  - Replies and comments: same rules, short when you can.
-The server pushes back with feed_hard_to_read when the text reads like a log;
-rewrite it, or pass --force to post it as written.`;
-var FEED_NO_BODY = "feed cards have no body: put the point in the title and one --summary line, text to send in --draft, sources in --link";
-function pairOf({ value, flag: flag2 }) {
-  const at = value.indexOf("=");
-  if (at <= 0 || at === value.length - 1) {
-    throw new Error(`--${flag2} takes <label>=<value>, got "${value}"`);
-  }
-  return [value.slice(0, at), value.slice(at + 1)];
-}
-function sourceOf(value) {
-  return value.startsWith("@") && value.length > 1 ? { file: value.slice(1) } : { text: value };
-}
-function dateOf(value) {
-  return value === "none" ? null : value;
-}
-function snoozeOf(args) {
-  const people2 = args.lists["snooze-for"] ?? [];
-  if (people2.length === 0) return {};
-  const until = flagText({ args, name: "until" });
-  if (!until) throw new Error("--snooze-for needs --until <ISO time> or --until none");
-  return { snoozeFor: { userIds: [...people2], until: dateOf(until) } };
-}
-function textsOf(args) {
-  const texts = {};
-  for (const [flag2, field] of Object.entries(TEXT_FLAGS)) {
-    const value = flagText({ args, name: flag2 });
-    if (value) texts[field] = sourceOf(value);
-  }
-  return texts;
-}
-function pairsOf(args) {
-  const fields = {};
-  const links = args.lists.link ?? [];
-  if (links.length > 0) {
-    fields.links = links.map((value) => {
-      const [label3, url2] = pairOf({ value, flag: "link" });
-      return { label: label3, url: url2 };
-    });
-  }
-  const actions = args.lists.action ?? [];
-  if (actions.length > 0) {
-    fields.actions = actions.map((value) => {
-      const [label3, message2] = pairOf({ value, flag: "action" });
-      return { label: label3, message: message2 };
-    });
-  }
-  return fields;
-}
-function feedFlagsOf({ args }) {
-  if (args.flags.body !== void 0) throw new Error(FEED_NO_BODY);
-  const fields = pairsOf(args);
-  const tag = flagText({ args, name: "tag" });
-  if (tag) fields.tag = tag;
-  const header = flagText({ args, name: "draft-header" });
-  if (header) fields.draftHeader = header.replaceAll("\\n", "\n");
-  const doneLabel = flagText({ args, name: "done-label" });
-  if (doneLabel) fields.doneLabel = doneLabel;
-  for (const flag2 of ["urgent", "force"]) if (args.flags[flag2]) fields[flag2] = true;
-  const showAt = flagText({ args, name: "show-at" });
-  if (showAt) fields.showAt = dateOf(showAt);
-  const group = flagText({ args, name: "group" });
-  if (group) fields.group = group;
-  const labels = args.lists.label ?? [];
-  if (labels.length > 0) fields.labels = [...labels];
-  const autoSendOn = flagText({ args, name: "auto-send-on" });
-  if (autoSendOn) fields.autoSendOn = dateOf(autoSendOn);
-  const rich = richOf(args);
-  const texts = textsOf(args);
-  return { fields: { ...fields, ...snoozeOf(args) }, texts, ...rich ? { rich } : {} };
-}
-
-// src/services/feed-files.service.ts
-import { readFile as readFile25 } from "node:fs/promises";
-import { basename as basename4, resolve as resolve9 } from "node:path";
-
 // ../../modules/feed/contract/src/feed.ts
 var feedAuthorSchemaDefinition = external_exports.object({
   kind: external_exports.enum(["agent", "person", "system"]),
@@ -81029,7 +81336,8 @@ var feedApprovalSchemaDefinition = external_exports.object({
     "connector_connect",
     "app_access",
     "computer",
-    "agent_join"
+    "agent_join",
+    "vault_share"
   ]),
   requestId: external_exports.string(),
   /** The app, for an `app_publish` or `app_access` card. */
@@ -81117,6 +81425,13 @@ var feedGroupSummarySchemaDefinition = external_exports.object({
   counts: external_exports.array(external_exports.object({ label: external_exports.string(), count: external_exports.number().int().positive() }))
 });
 var feedGroupSummarySchema = feedGroupSummarySchemaDefinition;
+var feedDecisionsSchemaDefinition = external_exports.object({
+  /** How many decisions wait; the banner shows only above zero. */
+  count: external_exports.number().int().nonnegative(),
+  /** The decision cards in feed order, each answered as on the feed. */
+  items: external_exports.array(feedItemSchema)
+});
+var feedDecisionsSchema = feedDecisionsSchemaDefinition;
 var feedViewSchemaDefinition = external_exports.object({
   open: external_exports.array(feedItemSchema),
   comingUp: external_exports.array(feedItemSchema),
@@ -81195,7 +81510,9 @@ var answerFeedApprovalInputSchemaDefinition = external_exports.object({
 var answerFeedApprovalInputSchema = answerFeedApprovalInputSchemaDefinition;
 var decideFeedRequestInputSchemaDefinition = external_exports.object({
   ...itemRef.shape,
-  decision: external_exports.enum(["approved", "denied"])
+  decision: external_exports.enum(["approved", "denied"]),
+  /** With a Deny: why, for the agent that asked. It goes on the card as the person's reply. */
+  resolutionNote: external_exports.string().max(4e3).optional()
 });
 var decideFeedRequestInputSchema = decideFeedRequestInputSchemaDefinition;
 var feedPublishDurationSchema = external_exports.enum(["once", "day", "always"]);
@@ -81316,9 +81633,10 @@ var feedFileLinkInputSchemaDefinition = external_exports.object({
 var feedFileLinkInputSchema = feedFileLinkInputSchemaDefinition;
 var feedFileLinkSchemaDefinition = external_exports.object({ url: external_exports.string(), expiresAt: external_exports.iso.datetime() });
 var feedFileLinkSchema = feedFileLinkSchemaDefinition;
-var feedTrpc = defineTrpcContract("feed").query("channelItems").withInput(external_exports.object({ workspaceId: external_exports.string().min(1), channelId: external_exports.string().min(1) })).withOutput(external_exports.array(feedAgentItemSchema)).query("list").withInput(listFeedInputSchema).withOutput(feedViewSchema).query("card").withInput(itemRef).withOutput(feedCardViewSchema).query("fileLink").withInput(feedFileLinkInputSchema).withOutput(feedFileLinkSchema).query("count").withInput(external_exports.object({ workspaceId: external_exports.string().min(1) })).withOutput(external_exports.object({ count: external_exports.number().int().nonnegative() })).mutation("act").withInput(actFeedItemInputSchema).withOutput(feedItemSchema).mutation("comment").withInput(commentFeedItemInputSchema).withOutput(feedItemSchema).mutation("done").withInput(itemRef).withOutput(feedItemSchema).mutation("stopAutoSend").withInput(itemRef).withOutput(feedItemSchema).mutation("putBack").withInput(putBackFeedItemInputSchema).withOutput(feedItemSchema).mutation("snooze").withInput(snoozeFeedItemInputSchema).withOutput(feedItemSchema).mutation("unsnooze").withInput(itemRef).withOutput(feedItemSchema).mutation("saveDraft").withInput(saveFeedDraftInputSchema).withOutput(feedItemSchema).mutation("editItem").withInput(editFeedItemInputSchema).withOutput(feedItemSchema).mutation("saveMessage").withInput(saveFeedMessageInputSchema).withOutput(feedItemSchema).mutation("answerApproval").withInput(answerFeedApprovalInputSchema).withOutput(feedItemSchema).mutation("decidePublish").withInput(decideFeedPublishInputSchema).withOutput(feedItemSchema).mutation("decideAccess").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).mutation("decideServer").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).mutation("decideAppAccess").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).mutation("decideComputer").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).mutation("decideAgentJoin").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).build();
+var feedTrpc = defineTrpcContract("feed").query("channelItems").withInput(external_exports.object({ workspaceId: external_exports.string().min(1), channelId: external_exports.string().min(1) })).withOutput(external_exports.array(feedAgentItemSchema)).query("list").withInput(listFeedInputSchema).withOutput(feedViewSchema).query("card").withInput(itemRef).withOutput(feedCardViewSchema).query("fileLink").withInput(feedFileLinkInputSchema).withOutput(feedFileLinkSchema).query("count").withInput(external_exports.object({ workspaceId: external_exports.string().min(1) })).withOutput(external_exports.object({ count: external_exports.number().int().nonnegative() })).query("decisions").withInput(external_exports.object({ workspaceId: external_exports.string().min(1) })).withOutput(feedDecisionsSchema).mutation("act").withInput(actFeedItemInputSchema).withOutput(feedItemSchema).mutation("comment").withInput(commentFeedItemInputSchema).withOutput(feedItemSchema).mutation("done").withInput(itemRef).withOutput(feedItemSchema).mutation("stopAutoSend").withInput(itemRef).withOutput(feedItemSchema).mutation("putBack").withInput(putBackFeedItemInputSchema).withOutput(feedItemSchema).mutation("snooze").withInput(snoozeFeedItemInputSchema).withOutput(feedItemSchema).mutation("unsnooze").withInput(itemRef).withOutput(feedItemSchema).mutation("saveDraft").withInput(saveFeedDraftInputSchema).withOutput(feedItemSchema).mutation("editItem").withInput(editFeedItemInputSchema).withOutput(feedItemSchema).mutation("saveMessage").withInput(saveFeedMessageInputSchema).withOutput(feedItemSchema).mutation("answerApproval").withInput(answerFeedApprovalInputSchema).withOutput(feedItemSchema).mutation("decidePublish").withInput(decideFeedPublishInputSchema).withOutput(feedItemSchema).mutation("decideAccess").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).mutation("decideServer").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).mutation("decideAppAccess").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).mutation("decideComputer").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).mutation("decideAgentJoin").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).build();
 var feedUi = uiTokens("feed");
 var FeedNavSlot = feedUi.component("nav");
+var FeedDecisionsSlot = feedUi.component("decisions");
 var FeedCountHooksToken = feedUi.hooks("count");
 var FeedChannelCardSlot = feedUi.component("channel-card");
 var FeedSearchSlot = feedUi.component("search");
@@ -81397,7 +81715,135 @@ var feedWakeIntentSchemaDefinition = external_exports.object({
 // ../../modules/feed/contract/src/feed.config.ts
 var feedConfig = Config.define(() => ({ publicBaseUrl }));
 
+// ../../modules/feed/contract/src/feed.decisions.ts
+function decisionsLineOf(count5) {
+  return `${count5} ${count5 === 1 ? "decision" : "decisions"} waiting on you`;
+}
+
+// src/rules/feed-input.rules.ts
+function csvCellsOf(line) {
+  const cells = [];
+  let cell = "";
+  let quoted = false;
+  for (let at = 0; at < line.length; at += 1) {
+    const char = line[at];
+    if (quoted && char === '"' && line[at + 1] === '"') {
+      cell += '"';
+      at += 1;
+    } else if (char === '"') {
+      quoted = !quoted;
+    } else if (char === "," && !quoted) {
+      cells.push(cell);
+      cell = "";
+    } else {
+      cell += char;
+    }
+  }
+  return [...cells, cell];
+}
+function richBodyOf({ kind: kind2, text: text2 }) {
+  if (kind2 === "metric") {
+    try {
+      return { kind: kind2, ...JSON.parse(text2) };
+    } catch {
+      throw new Error("--metric takes JSON: {label, unit, value, delta, bars: [{label, value}]}");
+    }
+  }
+  const [columns = [], ...rows] = text2.split(/\r?\n/).filter((line) => line.trim() !== "").map(csvCellsOf);
+  return { kind: kind2, columns, rows };
+}
+function richOf(args) {
+  const metric = flagText({ args, name: "metric" });
+  const table = flagText({ args, name: "table" });
+  if (metric && table) throw new Error("an item carries one rich body: pass --metric or --table");
+  if (metric) return { kind: "metric", source: sourceOf(metric) };
+  if (table) return { kind: "table", source: sourceOf(table) };
+  return void 0;
+}
+var TEXT_FLAGS = { draft: "draft", summary: "summary" };
+var FEED_WRITING = `Write for a person deciding on a phone in a few seconds:
+  - Title: the ask first, short enough to read in one glance.
+  - --summary: one plain sentence of why.
+  - No body: text to send goes in --draft, sources in --link, numbers in --metric or --table.
+  - Plain words. No ids (email, thread, card, channel), no UTC times, no PR or ticket lists,
+    no "Day 9." counters. Numbers only when they change the decision.
+  - Not too terse either: whole sentences a person understands without context.
+  - Replies and comments: same rules, short when you can.
+The server pushes back with feed_hard_to_read when the text reads like a log;
+rewrite it, or pass --force to post it as written.`;
+var FEED_NO_BODY = "feed cards have no body: put the point in the title and one --summary line, text to send in --draft, sources in --link";
+function pairOf({ value, flag: flag2 }) {
+  const at = value.indexOf("=");
+  if (at <= 0 || at === value.length - 1) {
+    throw new Error(`--${flag2} takes <label>=<value>, got "${value}"`);
+  }
+  return [value.slice(0, at), value.slice(at + 1)];
+}
+function sourceOf(value) {
+  return value.startsWith("@") && value.length > 1 ? { file: value.slice(1) } : { text: value };
+}
+function dateOf(value) {
+  return value === "none" ? null : value;
+}
+function snoozeOf(args) {
+  const people2 = args.lists["snooze-for"] ?? [];
+  if (people2.length === 0) return {};
+  const until = flagText({ args, name: "until" });
+  if (!until) throw new Error("--snooze-for needs --until <ISO time> or --until none");
+  return { snoozeFor: { userIds: [...people2], until: dateOf(until) } };
+}
+function textsOf(args) {
+  const texts = {};
+  for (const [flag2, field] of Object.entries(TEXT_FLAGS)) {
+    const value = flagText({ args, name: flag2 });
+    if (value) texts[field] = sourceOf(value);
+  }
+  return texts;
+}
+function pairsOf(args) {
+  const fields = {};
+  const links = args.lists.link ?? [];
+  if (links.length > 0) {
+    fields.links = links.map((value) => {
+      const [label3, url2] = pairOf({ value, flag: "link" });
+      return { label: label3, url: url2 };
+    });
+  }
+  const actions = args.lists.action ?? [];
+  if (actions.length > 0) {
+    fields.actions = actions.map((value) => {
+      const [label3, message2] = pairOf({ value, flag: "action" });
+      return { label: label3, message: message2 };
+    });
+  }
+  return fields;
+}
+function feedFlagsOf({ args }) {
+  if (args.flags.body !== void 0) throw new Error(FEED_NO_BODY);
+  const fields = pairsOf(args);
+  const tag = flagText({ args, name: "tag" });
+  if (tag) fields.tag = tag;
+  const header = flagText({ args, name: "draft-header" });
+  if (header) fields.draftHeader = header.replaceAll("\\n", "\n");
+  const doneLabel = flagText({ args, name: "done-label" });
+  if (doneLabel) fields.doneLabel = doneLabel;
+  for (const flag2 of ["urgent", "force"]) if (args.flags[flag2]) fields[flag2] = true;
+  const showAt = flagText({ args, name: "show-at" });
+  if (showAt) fields.showAt = dateOf(showAt);
+  const group = flagText({ args, name: "group" });
+  if (group) fields.group = group;
+  const labels = args.lists.label ?? [];
+  if (labels.length > 0) fields.labels = [...labels];
+  const autoSendOn = flagText({ args, name: "auto-send-on" });
+  if (autoSendOn) fields.autoSendOn = dateOf(autoSendOn);
+  const rich = richOf(args);
+  const texts = textsOf(args);
+  return { fields: { ...fields, ...snoozeOf(args) }, texts, ...rich ? { rich } : {} };
+}
+
 // src/services/feed-files.service.ts
+import { readFile as readFile25 } from "node:fs/promises";
+import { basename as basename4, resolve as resolve9 } from "node:path";
 async function bytesOf2({
   context,
   source
@@ -81486,6 +81932,7 @@ var USAGE10 = `Usage:
   laze feed group-summary <group>
   laze feed list [--json]
   laze feed count
+  laze feed decisions [--json]
   laze feed act <id> <actionId> [--draft <text|@file>]
   laze feed comment <id> <text> [--draft <text|@file>] [--force]
   laze feed done|put-back|unsnooze <id>
@@ -81697,6 +82144,16 @@ async function feedCount({ context, args }) {
   context.out(`${answer4.count}
 `);
 }
+async function feedDecisions({ context, args }) {
+  const { client } = await signedIn({ context, args });
+  const answer4 = await client.get("/api/feed/mine/decisions");
+  if (args.flags.json) return context.out(`${JSON.stringify(answer4, null, 2)}
+`);
+  if (answer4.count === 0) return context.out("No decisions waiting on you.\n");
+  context.out(`${decisionsLineOf(answer4.count)}
+`);
+  for (const item of answer4.items) printCard2({ context, item });
+}
 async function feedAct({ context, args }) {
   const [itemId, actionId] = [args.words[2], args.words[3]];
   if (!itemId || !actionId) throw new CliUsageError(USAGE10);
@@ -81761,6 +82218,7 @@ var FEED_COMMANDS = {
   loops: feedLoops,
   list: feedList,
   count: feedCount,
+  decisions: feedDecisions,
   act: feedAct,
   comment: feedComment,
   done: moveItem("done"),
@@ -82268,12 +82726,12 @@ async function ip({ context, args }) {
 }
 
 // src/services/join-commands.service.ts
-import { mkdir as mkdir18, readFile as readFile29, rename as rename5, rm as rm11, writeFile as writeFile19 } from "node:fs/promises";
-import { dirname as dirname18, join as join20 } from "node:path";
+import { mkdir as mkdir19, readFile as readFile29, rename as rename5, rm as rm11, writeFile as writeFile19 } from "node:fs/promises";
+import { dirname as dirname19, join as join21 } from "node:path";
 var DEFAULT_WAIT_SECONDS2 = 100;
 var JOIN_USAGE = "Usage: laze join [--workspace <name|id|invite link>] [--for <email>] [--name <name>] [--note <text>] [--timeout <seconds>] [--project <folder>]";
 function pendingPathOf({ context }) {
-  return join20(dirname18(context.environment.configPath), "join", "pending.json");
+  return join21(dirname19(context.environment.configPath), "join", "pending.json");
 }
 async function readPending({
   context,
@@ -82290,7 +82748,7 @@ async function readPending({
 }
 async function keepPending({ context, pending }) {
   const path = pendingPathOf({ context });
-  await mkdir18(dirname18(path), { recursive: true, mode: 448 });
+  await mkdir19(dirname19(path), { recursive: true, mode: 448 });
   const temporary = `${path}.${process.pid}.tmp`;
   await writeFile19(temporary, JSON.stringify(pending), { mode: 384 });
   await rename5(temporary, path);
@@ -83110,8 +83568,8 @@ async function serveMcp({
 }
 
 // src/services/mount-files.service.ts
-import { mkdir as mkdir19, readFile as readFile30, rm as rm12, writeFile as writeFile20 } from "node:fs/promises";
-import { dirname as dirname19, relative as relative5, resolve as resolve11 } from "node:path";
+import { mkdir as mkdir20, readFile as readFile30, rm as rm12, writeFile as writeFile20 } from "node:fs/promises";
+import { dirname as dirname20, relative as relative5, resolve as resolve11 } from "node:path";
 async function textArgument({
   context,
   value
@@ -83131,13 +83589,13 @@ async function writeMount({
 }) {
   const root = resolve11(context.cwd, flagText({ args, name: "dir", fallback: ".laze" }), folder);
   await rm12(root, { recursive: true, force: true });
-  await mkdir19(root, { recursive: true });
+  await mkdir20(root, { recursive: true });
   for (const file3 of files2) {
     const target = resolve11(root, file3.path);
     const inside = relative5(root, target);
     if (!inside || inside.startsWith(".."))
       throw new Error(`Refusing to write outside ${root}: ${file3.path}`);
-    await mkdir19(dirname19(target), { recursive: true });
+    await mkdir20(dirname20(target), { recursive: true });
     await writeFile20(target, file3.content);
   }
   return root;
@@ -83779,11 +84237,12 @@ ${OPS_USAGE}`);
 }
 
 // src/services/release-watch.service.ts
-import { mkdir as mkdir20, readFile as readFile31, realpath, writeFile as writeFile21 } from "node:fs/promises";
-import { dirname as dirname20, join as join21 } from "node:path";
+import { mkdir as mkdir21, readFile as readFile31, realpath, writeFile as writeFile21 } from "node:fs/promises";
+import { dirname as dirname21, join as join22 } from "node:path";
 
 // src/rules/cli-update.rules.ts
-var CLI_PACKAGE_LATEST = "@lazehq/cli@latest";
+var CLI_PACKAGE = "@lazehq/cli";
+var CLI_PACKAGE_LATEST = `${CLI_PACKAGE}@latest`;
 var MANAGERS = [
   { manager: "bun", pattern: /[\\/]\.?bun[\\/]/, command: ["bun", "add", "-g"] },
   { manager: "pnpm", pattern: /[\\/]\.?pnpm[\\/]/, command: ["pnpm", "add", "-g"] },
@@ -83796,7 +84255,17 @@ var MANAGERS = [
 ];
 var NPM_PREFIX = /^(.+)[\\/]lib[\\/]node_modules[\\/]@lazehq[\\/]cli[\\/]/;
 var NPX_CACHE2 = /[\\/]_npx[\\/]/;
-function updatePlanOf({ script }) {
+function releaseAgeOverrideOf({
+  manager,
+  nowMs
+}) {
+  if (manager === "npm")
+    return [`--before=${Temporal3.Instant.fromEpochMilliseconds(nowMs).toString()}`];
+  if (manager === "pnpm") return [`--config.minimum-release-age-exclude=${CLI_PACKAGE}`];
+  if (manager === "bun") return ["--minimum-release-age=0"];
+  return [];
+}
+function updatePlanOf({ script, nowMs }) {
   if (script === SANDBOX_CLI_PATH) return { kind: "sandbox" };
   const found = MANAGERS.find(({ pattern }) => pattern.test(script));
   if (!found) return { kind: "unmanaged", script };
@@ -83804,17 +84273,59 @@ function updatePlanOf({ script }) {
   return {
     kind: "install",
     manager: found.manager,
-    command: [...found.command, ...prefix ? ["--prefix", prefix] : [], CLI_PACKAGE_LATEST]
+    command: [
+      ...found.command,
+      ...prefix ? ["--prefix", prefix] : [],
+      ...releaseAgeOverrideOf({ manager: found.manager, nowMs }),
+      CLI_PACKAGE_LATEST
+    ]
   };
 }
-var RELEASE_AGE_REFUSAL = /\b(ENOVERSIONS|ETARGET)\b/;
-function releaseAgeRetryOf({
+function pinnedCommandOf({
   plan: plan2,
-  stderr: stderr2
+  version: version2
 }) {
-  if (plan2.manager !== "npm" || !RELEASE_AGE_REFUSAL.test(stderr2)) return null;
-  const at = plan2.command.indexOf(CLI_PACKAGE_LATEST);
-  return [...plan2.command.slice(0, at), "--min-release-age=0", ...plan2.command.slice(at)];
+  return plan2.command.map(
+    (part) => part === CLI_PACKAGE_LATEST ? `${CLI_PACKAGE}@${version2}` : part
+  );
+}
+var RELEASE_AGE_SETTINGS = {
+  npm: [
+    { setting: "min-release-age", read: ["npm", "config", "get", "min-release-age"] },
+    { setting: "before", read: ["npm", "config", "get", "before"] }
+  ],
+  pnpm: [
+    { setting: "minimum-release-age", read: ["pnpm", "config", "get", "minimum-release-age"] }
+  ]
+};
+function settingValueOf({ printed }) {
+  const value = printed.trim();
+  return value === "" || value === "null" || value === "undefined" || value === "0" ? null : value;
+}
+var VERSION_LINE = /^laze (\S+)\s*$/m;
+function printedVersionOf({ printed }) {
+  return VERSION_LINE.exec(printed)?.[1] ?? null;
+}
+function heldBackLineOf({
+  manager,
+  installed,
+  latest,
+  settings: settings2,
+  command,
+  script
+}) {
+  const head = latest ? `laze is ${installed} after the install, but the latest release is ${latest}.` : `laze is still ${installed} after the install, and the npm registry did not say which release is the latest.`;
+  const line = command.join(" ");
+  if (settings2.length > 0) {
+    return `${head} ${manager}'s ${settings2.join(" and ")} setting holds back releases younger than it allows, so ${manager} kept or picked an older one. Install the latest with: ${line}
+`;
+  }
+  if (manager === "bun") {
+    return `${head} A minimumReleaseAge in bunfig.toml may hold it back, or another laze comes first on PATH (this one is ${script}). Install the latest with: ${line}
+`;
+  }
+  return `${head} No release-age setting is set, so another laze may come first on PATH (this one is ${script}). Install the latest with: ${line}
+`;
 }
 
 // src/rules/cli-release.rules.ts
@@ -83879,18 +84390,18 @@ async function startedUpdate({
   server
 }) {
   if (context.environment.inherited.LAZE_AUTO_UPDATE === "0") return null;
-  const plan2 = updatePlanOf({ script: await scriptOf(context) });
+  const plan2 = updatePlanOf({ script: await scriptOf(context), nowMs: context.nowMs() });
   if (plan2.kind !== "install") return null;
-  const folder = dirname20(context.environment.configPath);
-  const stamp = join21(folder, "auto-update.json");
+  const folder = dirname21(context.environment.configPath);
+  const stamp = join22(folder, "auto-update.json");
   const last = await readFile31(stamp, "utf8").then((text2) => JSON.parse(text2)).catch(() => null);
   const now = context.nowMs();
   if (last?.server === server && now - last.atMs < RETRY_AFTER_MS) return null;
-  await mkdir20(folder, { recursive: true, mode: 448 });
+  await mkdir21(folder, { recursive: true, mode: 448 });
   await writeFile21(stamp, JSON.stringify({ server, atMs: now }), { mode: 384 });
   context.processes.spawnDetached({
     argv: [...context.program, "update"],
-    logPath: join21(folder, "auto-update.log")
+    logPath: join22(folder, "auto-update.log")
   });
   return { manager: plan2.manager };
 }
@@ -84127,7 +84638,7 @@ async function schedule({ context, args }) {
 
 // src/services/skill-commands.service.ts
 import { readdir as readdir7, readFile as readFile33 } from "node:fs/promises";
-import { join as join22, relative as relative6, resolve as resolve12 } from "node:path";
+import { join as join23, relative as relative6, resolve as resolve12 } from "node:path";
 var USAGE16 = `Usage:
   laze skill list [--agent <agentId>]
   laze skill install <catalogue-id> [--as <name>] [--agent <agentId>]
@@ -84148,7 +84659,7 @@ async function folderFiles({ root }) {
   const files2 = [];
   for (const entry of entries) {
     if (!entry.isFile()) continue;
-    const full = join22(entry.parentPath, entry.name);
+    const full = join23(entry.parentPath, entry.name);
     files2.push({ path: relative6(root, full), content: await readFile33(full, "utf8") });
   }
   return files2.toSorted((a, b) => a.path.localeCompare(b.path));
@@ -84947,6 +85458,8 @@ async function statusUsage() {
 // src/services/update-commands.service.ts
 import { realpath as realpath2 } from "node:fs/promises";
 var BY_HAND = `npm install -g ${CLI_PACKAGE_LATEST}`;
+var REGISTRY_LATEST_URL = `https://registry.npmjs.org/${CLI_PACKAGE}/latest`;
+var REGISTRY_TIMEOUT_MS = 1e4;
 async function realScriptOf({ program }) {
   const script = program.at(-1) ?? "";
   try {
@@ -84955,11 +85468,55 @@ async function realScriptOf({ program }) {
     return script;
   }
 }
+async function latestReleaseOf({ context }) {
+  try {
+    const response = await context.fetcher(REGISTRY_LATEST_URL, {
+      signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS)
+    });
+    if (!response.ok) return null;
+    const body = await response.json();
+    return typeof body.version === "string" ? body.version : null;
+  } catch {
+    return null;
+  }
+}
+async function printedBy({
+  context,
+  command
+}) {
+  let printed = "";
+  const sink = {
+    write: (chunk) => {
+      printed += chunk;
+    }
+  };
+  try {
+    const code = await context.runCommand({ command, env: {}, stdout: sink, stderr: sink });
+    return code === 0 ? printed : null;
+  } catch {
+    return null;
+  }
+}
+async function releaseAgeSettingsOf({
+  context,
+  manager
+}) {
+  const settings2 = [];
+  for (const { setting, read: read3 } of RELEASE_AGE_SETTINGS[manager] ?? []) {
+    const value = settingValueOf({ printed: await printedBy({ context, command: read3 }) ?? "" });
+    if (value) settings2.push(`${setting}=${value}`);
+  }
+  return settings2;
+}
 async function update2({
   context,
-  args
+  args,
+  mine: mine4 = cliVersionOf()
 }) {
-  const plan2 = updatePlanOf({ script: await realScriptOf({ program: context.program }) });
+  const plan2 = updatePlanOf({
+    script: await realScriptOf({ program: context.program }),
+    nowMs: context.nowMs()
+  });
   if (plan2.kind === "sandbox") {
     context.out("This laze comes with your computer and updates with every Laze release.\n");
     return 0;
@@ -84973,40 +85530,51 @@ async function update2({
   }
   const line = plan2.command.join(" ");
   if (args.flags["dry-run"]) {
-    context.out(`laze ${cliVersionOf()}, installed with ${plan2.manager}. Would run: ${line}
+    context.out(`laze ${mine4}, installed with ${plan2.manager}. Would run: ${line}
 `);
     return 0;
   }
-  context.out(`Updating laze ${cliVersionOf()} with ${plan2.manager}: ${line}
+  const latest = await latestReleaseOf({ context });
+  if (latest && latest === mine4) {
+    context.out(`laze ${mine4} is the latest release.
 `);
-  let stderr2 = "";
-  const tee = {
-    write: (chunk) => {
-      stderr2 += chunk;
-      context.err(chunk);
-    }
-  };
-  let code = await context.runCommand({ command: plan2.command, env: {}, stderr: tee });
-  const retry = code === 0 ? null : releaseAgeRetryOf({ plan: plan2, stderr: stderr2 });
-  if (retry) {
-    const retryLine = retry.join(" ");
-    context.out(
-      `npm's min-release-age setting held back the latest release. Trying once more with the guard off for @lazehq/cli only: ${retryLine}
-`
-    );
-    code = await context.runCommand({ command: retry, env: {} });
-    if (code !== 0) {
-      context.err(`npm exited ${code}. Update by hand with: ${retryLine}
+    return 0;
+  }
+  context.out(`Updating laze ${mine4} with ${plan2.manager}: ${line}
 `);
-      return code;
-    }
-  } else if (code !== 0) {
+  const code = await context.runCommand({ command: plan2.command, env: {} });
+  if (code !== 0) {
     context.err(`${plan2.manager} exited ${code}. Update by hand with: ${line}
 `);
     return code;
   }
-  context.out("Updated. `laze --version` names the new version.\n");
-  return 0;
+  const printed = await printedBy({ context, command: [...context.program, "--version"] });
+  const installed = printed === null ? null : printedVersionOf({ printed });
+  if (!installed) {
+    context.out("Installed. `laze --version` names the new version.\n");
+    return 0;
+  }
+  const held = latest ? releaseSkewOf({ mine: installed, server: latest }) === "older" : installed === mine4;
+  if (!held) {
+    context.out(
+      installed === mine4 ? `laze ${mine4} is the latest release.
+` : `Updated laze ${mine4} to ${installed}.
+`
+    );
+    return 0;
+  }
+  const settings2 = await releaseAgeSettingsOf({ context, manager: plan2.manager });
+  context.err(
+    heldBackLineOf({
+      manager: plan2.manager,
+      installed,
+      latest,
+      settings: settings2,
+      command: latest ? pinnedCommandOf({ plan: plan2, version: latest }) : plan2.command,
+      script: context.program.at(-1) ?? ""
+    })
+  );
+  return 1;
 }
 
 // src/services/vault-save-message-commands.service.ts
@@ -86612,7 +87180,7 @@ var HELP = `laze: work in a Laze workspace from your terminal or your agent.
   laze star add|remove|list [channel]       starred conversations in your sidebar (people)
   laze feed post <title> [--channel <c>] ...     put an item in people's feed as your agent
   laze feed update|reply|read <id>, laze feed inbox   change, answer and read your items
-  laze feed list|count                           your own feed as a person: cards and their actions
+  laze feed list|count|decisions                 your own feed as a person: cards and their actions
   laze feed act <id> <actionId>, comment <id> <text>   answer a card in your feed
   laze feed done|put-back|unsnooze <id>, snooze <id> --until <time>   move a card
   laze feed channel <channelId>                  the feed cards a channel shows
@@ -86959,7 +87527,7 @@ async function runCli({
 import { execFile as execFile2, spawn as spawn4 } from "node:child_process";
 import { mkdirSync, openSync } from "node:fs";
 import { readFile as readFile38, readlink } from "node:fs/promises";
-import { dirname as dirname21 } from "node:path";
+import { dirname as dirname22 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 var run3 = promisify2(execFile2);
 function alive(pid) {
@@ -86996,7 +87564,7 @@ async function cwdOf(pid) {
   return line ? line.slice(1) : void 0;
 }
 function spawnDetached({ argv, logPath }) {
-  mkdirSync(dirname21(logPath), { recursive: true, mode: 448 });
+  mkdirSync(dirname22(logPath), { recursive: true, mode: 448 });
   const log = openSync(logPath, "a", 384);
   const [program = "", ...rest] = argv;
   const child = spawn4(program, rest, { detached: true, stdio: ["ignore", log, log] });